coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
net-kingdom/workplans/ADHOC-2026-08-14.md
repo-manager d4d61b722e
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
repo.work.assign_missing_identifiers 
source: repo-manager
reason: deterministic projection registration

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a05e30-2884-71b0-98d7-7edd16ae737b
2026-09-04 00:26:59 +02:00

2.4 KiB
Raw Blame History

id type title domain repo status owner topic_slug created updated state_hub_workstream_id
NK-WP-ADHOC-2026-08-14 workplan Close NK-WP-0025 residuals infotech net-kingdom finished codex netkingdom 2026-08-14 2026-08-14 d9c4de99-ab79-5238-afe5-c4c77204758c

NK-WP-ADHOC-2026-08-14 - NK-WP-0025 residual closeout

Reconcile Coulomb Social Case B residual records

id: NK-WP-ADHOC-2026-08-14-T01
status: done
priority: medium
state_hub_task_id: "9968795f-bfc8-5e3e-8b1e-37933fc555a3"

Update the owning smoke evidence and close or narrow CSOC-IN-0001 and CSOC-IN-0002 now that NK-WP-0025 completed the public registration, OIDC/JIT, repeat-login, collision, redirect, and assurance evidence.

Protect the canonical LDAP-DN subject contract

id: NK-WP-ADHOC-2026-08-14-T02
status: done
priority: medium
state_hub_task_id: "664aff29-2d03-5cbe-a3e0-1c52d160d019"

Add focused regression coverage for the canonical LDAP-DN OIDC subject and the reverse normalization used by directory lifecycle and password setup.

Persist the audit-core multi-tenant sender scope

id: NK-WP-ADHOC-2026-08-14-T03
status: done
priority: high
state_hub_task_id: "000e4708-6ef5-550b-9191-f914bdfcd255"

Move the live user-engine sender registry from its manually minted Secret to the authoritative OpenBao/ExternalSecret path with source-bound write-only scope and tenants: ["*"], without reading or logging its token.

2026-08-14 probe: the live Secret has the correct redacted scope, but platform/workloads/audit-core/senders does not exist. ClusterSecretStore openbao-audit-core is present and can read only that exact path. The current workstation OpenBao identity returns 403 and credential routing exposes no resolvable write grant. Completion therefore waits for a short-lived platform-admin OpenBao session to perform the documented wrapped migration; the temporary probe ExternalSecret was removed.

Done 2026-08-14: after an attended KeyCape/MFA platform-admin login, the existing registry was streamed directly from Kubernetes to OpenBao without printing or staging it. OpenBao created version 1; ExternalSecret audit-core-senders became SecretSynced and owns the derived Secret. Its base64 checksum remained dcf342e33fd326c536ee3ada443f294221836e226e5924ac1b2ec490631a3cdb, proving the migration did not change the live document. The audit-core rollout completed and /readyz returned durable archive custody.