codex
82452d655f
These workplans exist only in the retired local hub. Their random pre-ADR-007 identifiers are refused by C-06 as stale references, so they cannot be registered. Deriving from the canonical record id takes no identity from anything: central does not hold them and the old ids die with the cache. Records central already holds were deliberately left untouched. Refs CUST-WP-0068-T06 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
70 lines
2.4 KiB
Markdown
70 lines
2.4 KiB
Markdown
---
|
|
id: ADHOC-2026-08-14
|
|
type: workplan
|
|
title: "Close NK-WP-0025 residuals"
|
|
domain: infotech
|
|
repo: net-kingdom
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: netkingdom
|
|
created: "2026-08-14"
|
|
updated: "2026-08-14"
|
|
state_hub_workstream_id: "a5097121-1461-59f8-81fa-e6ecef527337"
|
|
---
|
|
|
|
# ADHOC-2026-08-14 - NK-WP-0025 residual closeout
|
|
|
|
## Reconcile Coulomb Social Case B residual records
|
|
|
|
```task
|
|
id: ADHOC-2026-08-14-T01
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "9eaad1fd-695c-5df3-aec2-012e4a4bc8c8"
|
|
```
|
|
|
|
Update the owning smoke evidence and close or narrow CSOC-IN-0001 and
|
|
CSOC-IN-0002 now that NK-WP-0025 completed the public registration, OIDC/JIT,
|
|
repeat-login, collision, redirect, and assurance evidence.
|
|
|
|
## Protect the canonical LDAP-DN subject contract
|
|
|
|
```task
|
|
id: ADHOC-2026-08-14-T02
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "31319b1b-8b55-59fe-b3d7-4486f1928b4c"
|
|
```
|
|
|
|
Add focused regression coverage for the canonical LDAP-DN OIDC subject and
|
|
the reverse normalization used by directory lifecycle and password setup.
|
|
|
|
## Persist the audit-core multi-tenant sender scope
|
|
|
|
```task
|
|
id: ADHOC-2026-08-14-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "90250faf-0022-5553-b832-a51f775166a8"
|
|
```
|
|
|
|
Move the live `user-engine` sender registry from its manually minted Secret to
|
|
the authoritative OpenBao/ExternalSecret path with source-bound write-only
|
|
scope and `tenants: ["*"]`, without reading or logging its token.
|
|
|
|
2026-08-14 probe: the live Secret has the correct redacted scope, but
|
|
`platform/workloads/audit-core/senders` does not exist. ClusterSecretStore
|
|
`openbao-audit-core` is present and can read only that exact path. The current
|
|
workstation OpenBao identity returns 403 and credential routing exposes no
|
|
resolvable write grant. Completion therefore waits for a short-lived
|
|
platform-admin OpenBao session to perform the documented wrapped migration;
|
|
the temporary probe ExternalSecret was removed.
|
|
|
|
Done 2026-08-14: after an attended KeyCape/MFA `platform-admin` login, the
|
|
existing registry was streamed directly from Kubernetes to OpenBao without
|
|
printing or staging it. OpenBao created version 1; ExternalSecret
|
|
`audit-core-senders` became `SecretSynced` and owns the derived Secret. Its
|
|
base64 checksum remained
|
|
`dcf342e33fd326c536ee3ada443f294221836e226e5924ac1b2ec490631a3cdb`, proving
|
|
the migration did not change the live document. The audit-core rollout
|
|
completed and `/readyz` returned durable `archive` custody.
|