---
id: NK-WP-ADHOC-2026-08-14
type: workplan
title: "Close NK-WP-0025 residuals"
domain: infotech
repo: net-kingdom
status: finished
owner: codex
topic_slug: netkingdom
created: "2026-08-14"
updated: "2026-08-14"
state_hub_workstream_id: "d9c4de99-ab79-5238-afe5-c4c77204758c"
---

# NK-WP-ADHOC-2026-08-14 - NK-WP-0025 residual closeout

## Reconcile Coulomb Social Case B residual records

```task
id: NK-WP-ADHOC-2026-08-14-T01
status: done
priority: medium
```

Update the owning smoke evidence and close or narrow CSOC-IN-0001 and
CSOC-IN-0002 now that NK-WP-0025 completed the public registration, OIDC/JIT,
repeat-login, collision, redirect, and assurance evidence.

## Protect the canonical LDAP-DN subject contract

```task
id: NK-WP-ADHOC-2026-08-14-T02
status: done
priority: medium
```

Add focused regression coverage for the canonical LDAP-DN OIDC subject and
the reverse normalization used by directory lifecycle and password setup.

## Persist the audit-core multi-tenant sender scope

```task
id: NK-WP-ADHOC-2026-08-14-T03
status: done
priority: high
```

Move the live `user-engine` sender registry from its manually minted Secret to
the authoritative OpenBao/ExternalSecret path with source-bound write-only
scope and `tenants: ["*"]`, without reading or logging its token.

2026-08-14 probe: the live Secret has the correct redacted scope, but
`platform/workloads/audit-core/senders` does not exist. ClusterSecretStore
`openbao-audit-core` is present and can read only that exact path. The current
workstation OpenBao identity returns 403 and credential routing exposes no
resolvable write grant. Completion therefore waits for a short-lived
platform-admin OpenBao session to perform the documented wrapped migration;
the temporary probe ExternalSecret was removed.

Done 2026-08-14: after an attended KeyCape/MFA `platform-admin` login, the
existing registry was streamed directly from Kubernetes to OpenBao without
printing or staging it. OpenBao created version 1; ExternalSecret
`audit-core-senders` became `SecretSynced` and owns the derived Secret. Its
base64 checksum remained
`dcf342e33fd326c536ee3ada443f294221836e226e5924ac1b2ec490631a3cdb`, proving
the migration did not change the live document. The audit-core rollout
completed and `/readyz` returned durable `archive` custody.