tegwick
710dc99585
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 696317@bnt-lap001 Assistant-Session: bab9e511-0915-45b3-926a-2fab552edff6
2069 lines
No EOL
84 KiB
JSON
2069 lines
No EOL
84 KiB
JSON
{
|
|
"schema": "nk49.t02-caller-ledger.v1",
|
|
"generated": "2026-10-23",
|
|
"source_inventory": "docs/evidence/2026-10-15-bootstrap-recovery/caller-source-inventory.json",
|
|
"source_inventory_sha256": "d6a1a575e2690a242db76d6d5de60f48648211f2cf62c156f22486e1e0bbf28d",
|
|
"status": "complete per-entry ledger (read-only source reconciliation); owner acceptance of dispositions and native checks remain with T21/T22",
|
|
"method": "presence + sha256 drift vs inventory; basename referenced from Makefile/*.mk/bootstrap scripts/console = active route; else basename referenced from any tracked markdown outside workplans/history = documented operator route",
|
|
"pending_columns": [],
|
|
"summary": {
|
|
"current": 59,
|
|
"owner-deferred (greenfield/initial activation only)": 1,
|
|
"retired": 11,
|
|
"owner-deferred (greenfield bootstrap only)": 3,
|
|
"current, superseded on 1.3 admission": 1,
|
|
"current diagnostic": 12,
|
|
"current (internal)": 1,
|
|
"current (repair)": 1,
|
|
"current (recovery tooling)": 4
|
|
},
|
|
"drifted": 5,
|
|
"entries": [
|
|
{
|
|
"path": "Makefile",
|
|
"inventory_sha256": "5d2114f6141bb8504c5c780044302126c07958a5732afdb0d0c0218a4f84210e",
|
|
"present": true,
|
|
"drifted": true,
|
|
"last_change": "bde143e 2026-10-19",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [
|
|
"(root)"
|
|
],
|
|
"candidate_status": "current (active route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "none directly; dispatches the routes below",
|
|
"consumers": "operators, pre-commit recipe",
|
|
"native_evidence": "drift = staged work-record/receiver build targets (bde143e, 4c7f32a); no credential path changed",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/NetkingdomRuntimeArchitecture.md",
|
|
"docs/adr/ADR-0015-netkingdom-railiance-workload-packaging-and-relational-platform.md",
|
|
"docs/security-bootstrap-rebuild-risk-and-rehearsal.md",
|
|
"docs/security-bootstrap-retrospective.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/bootstrap/apply-service-secrets.py",
|
|
"inventory_sha256": "ea9c3418ed00527b9019ab9893f1f3c9fe29d0697f1f0c879e28fdbae373889b",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "1cbe00f 2026-10-13",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "current (documented operator route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)",
|
|
"consumers": "operators via documented runbook",
|
|
"native_evidence": "documented route (see documented_in); native acceptance per owning task",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"sso-mfa/bootstrap/README.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/bootstrap/creds-apply.sh",
|
|
"inventory_sha256": "a70dba396484b2a353a39349c3d3719f7b6695b9f0e35025ef79e3db0ec2ff53",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "1cbe00f 2026-10-13",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [
|
|
"Makefile",
|
|
"sso-mfa/bootstrap/creds-bootstrap-agent.sh"
|
|
],
|
|
"candidate_status": "current (active route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per Make/bootstrap route",
|
|
"consumers": "operators via Make/bootstrap",
|
|
"native_evidence": "active route reference (see referenced_by)",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"canon/standards/credential-management_v0.2.md",
|
|
"sso-mfa/bootstrap/README.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/bootstrap/creds-bootstrap-agent.sh",
|
|
"inventory_sha256": "cc27c4f3969c292a913a0ae325cd0d4ec2665f9fffbbd1eb1c5f73b08e398a32",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "d9557ba 2026-10-15",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [
|
|
"Makefile",
|
|
"tools/security-bootstrap-console/security_bootstrap_console.py"
|
|
],
|
|
"candidate_status": "current (active route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per Make/bootstrap route",
|
|
"consumers": "operators via Make/bootstrap",
|
|
"native_evidence": "active route reference (see referenced_by)",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
".claude/commands/creds-init.md",
|
|
"canon/standards/credential-management_v0.2.md",
|
|
"docs/smooth-bootstrap-guide.md",
|
|
"sso-mfa/k8s/privacyidea/KEY-RECOVERY.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/bootstrap/creds-rotate.sh",
|
|
"inventory_sha256": "09b387d3555ce2beaeb8d7f000c2d52a1ffea274c793f30bce80a8f3ef5dc2f8",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "b01a30b 2026-10-13",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [
|
|
"Makefile"
|
|
],
|
|
"candidate_status": "current (active route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per Make/bootstrap route",
|
|
"consumers": "operators via Make/bootstrap",
|
|
"native_evidence": "active route reference (see referenced_by)",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"canon/standards/credential-management_v0.2.md",
|
|
"docs/security-bootstrap-age-custody.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/bootstrap/creds-status.sh",
|
|
"inventory_sha256": "f0fe0b885fd22f4789baa86cc2438272700aff8634cfa6b27d55c2c860c9f36d",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "7d4bb16 2026-10-13",
|
|
"inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials",
|
|
"referenced_by": [
|
|
"Makefile"
|
|
],
|
|
"candidate_status": "current (active route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per Make/bootstrap route",
|
|
"consumers": "operators via Make/bootstrap",
|
|
"native_evidence": "active route reference (see referenced_by)",
|
|
"next_task": "none",
|
|
"documented_in": [],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/bootstrap/creds-verify.sh",
|
|
"inventory_sha256": "101b12948c862f21a668b49b3a82efae691ba885d5c8fd7a94a10e095c16a24a",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "d9557ba 2026-10-15",
|
|
"inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials",
|
|
"referenced_by": [
|
|
"Makefile",
|
|
"sso-mfa/bootstrap/creds-bootstrap-agent.sh"
|
|
],
|
|
"candidate_status": "current (active route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per Make/bootstrap route",
|
|
"consumers": "operators via Make/bootstrap",
|
|
"native_evidence": "active route reference (see referenced_by)",
|
|
"next_task": "none",
|
|
"documented_in": [],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/bootstrap/decrypt-secrets.sh",
|
|
"inventory_sha256": "1572c170ceb9eff9ff408409acb82650ac911edb02961cde48806c68fa80ce76",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "d9557ba 2026-10-15",
|
|
"inventory_classification": "private custody/local operation; explicit input; owner procedure required",
|
|
"referenced_by": [
|
|
"sso-mfa/bootstrap/creds-bootstrap-agent.sh"
|
|
],
|
|
"candidate_status": "current (active route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per Make/bootstrap route",
|
|
"consumers": "operators via Make/bootstrap",
|
|
"native_evidence": "active route reference (see referenced_by)",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/security-bootstrap-age-custody.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/bootstrap/emergency-bundle.sh",
|
|
"inventory_sha256": "c1a0e9853dae6b71537ecb708b05ce967eacf797334192156485ca943dc8c71e",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "b97f9f6 2026-10-12",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [
|
|
"Makefile",
|
|
"sso-mfa/bootstrap/creds-bootstrap-agent.sh"
|
|
],
|
|
"candidate_status": "current (active route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per Make/bootstrap route",
|
|
"consumers": "operators via Make/bootstrap",
|
|
"native_evidence": "active route reference (see referenced_by)",
|
|
"next_task": "none",
|
|
"documented_in": [],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/bootstrap/encrypt-secrets.sh",
|
|
"inventory_sha256": "5b4774488e09a22b409079021e7cd10632c7cf6cf9db6f98cd85e3878d34d435",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "4cf26a9 2026-10-12",
|
|
"inventory_classification": "private custody/local operation; explicit input; owner procedure required",
|
|
"referenced_by": [
|
|
"sso-mfa/bootstrap/creds-bootstrap-agent.sh"
|
|
],
|
|
"candidate_status": "current (active route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per Make/bootstrap route",
|
|
"consumers": "operators via Make/bootstrap",
|
|
"native_evidence": "active route reference (see referenced_by)",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/security-bootstrap-age-custody.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/bootstrap/gen-secrets.sh",
|
|
"inventory_sha256": "b4a910cca93427c0e70e1f4c7646fc94d9b885aeae65a10a01cf8e11548ce03d",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "d9557ba 2026-10-15",
|
|
"inventory_classification": "private custody/local operation; explicit input; owner procedure required",
|
|
"referenced_by": [
|
|
"Makefile",
|
|
"sso-mfa/bootstrap/creds-bootstrap-agent.sh",
|
|
"sso-mfa/bootstrap/encrypt-secrets.sh"
|
|
],
|
|
"candidate_status": "current (active route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per Make/bootstrap route",
|
|
"consumers": "operators via Make/bootstrap",
|
|
"native_evidence": "active route reference (see referenced_by)",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"sso-mfa/WORKPLAN.md",
|
|
"sso-mfa/bootstrap/README.md",
|
|
"sso-mfa/k8s/authelia/README.md",
|
|
"sso-mfa/k8s/keycape/README.md",
|
|
"sso-mfa/k8s/lldap/README.md",
|
|
"sso-mfa/k8s/postgresql/README.md",
|
|
"sso-mfa/k8s/privacyidea/README.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/bootstrap/openbao-init-unseal.sh",
|
|
"inventory_sha256": "49485948a8d44576e293b6f709f1bb444e36bed3310c843d47393c3c8d4c1d0b",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "d9557ba 2026-10-15",
|
|
"inventory_classification": "lab-only custody adapter; explicit target; production forbidden",
|
|
"referenced_by": [
|
|
"Makefile",
|
|
"sso-mfa/bootstrap/creds-bootstrap-agent.sh"
|
|
],
|
|
"candidate_status": "current (active route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per Make/bootstrap route",
|
|
"consumers": "operators via Make/bootstrap",
|
|
"native_evidence": "active route reference (see referenced_by)",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/openbao-unseal-custody-models.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/bootstrap/openbao-lab.py",
|
|
"inventory_sha256": "0c14e38f86e189f6123b99e036e4423ebb31266d90f4c4423d3619c2060c3bc7",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "d9557ba 2026-10-15",
|
|
"inventory_classification": "lab-only custody adapter; explicit target; production forbidden",
|
|
"referenced_by": [
|
|
"sso-mfa/bootstrap/openbao-init-unseal.sh"
|
|
],
|
|
"candidate_status": "current (active route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per Make/bootstrap route",
|
|
"consumers": "operators via Make/bootstrap",
|
|
"native_evidence": "active route reference (see referenced_by)",
|
|
"next_task": "none",
|
|
"documented_in": [],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/bootstrap/pack-bundle.sh",
|
|
"inventory_sha256": "53abc7af3dcda6cfa9f52e9c10d352b66defa2cbfa7cd71b07c483c6f4a60f66",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "d9557ba 2026-10-15",
|
|
"inventory_classification": "private custody/local operation; explicit input; owner procedure required",
|
|
"referenced_by": [
|
|
"Makefile",
|
|
"sso-mfa/bootstrap/creds-bootstrap-agent.sh"
|
|
],
|
|
"candidate_status": "current (active route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per Make/bootstrap route",
|
|
"consumers": "operators via Make/bootstrap",
|
|
"native_evidence": "active route reference (see referenced_by)",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"sso-mfa/WORKPLAN.md",
|
|
"sso-mfa/bootstrap/README.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/bootstrap/rotation-env.py",
|
|
"inventory_sha256": "bab079a51b8e7ad0199676e76e473a13e70f46e0495d8c942502c952236ec893",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "6ae4708 2026-10-12",
|
|
"inventory_classification": "private custody/local operation; explicit input; owner procedure required",
|
|
"referenced_by": [
|
|
"sso-mfa/bootstrap/creds-rotate.sh"
|
|
],
|
|
"candidate_status": "current (active route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per Make/bootstrap route",
|
|
"consumers": "operators via Make/bootstrap",
|
|
"native_evidence": "active route reference (see referenced_by)",
|
|
"next_task": "none",
|
|
"documented_in": [],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/bootstrap/sops-custody-unlock.sh",
|
|
"inventory_sha256": "8a6c02ace974b489d23869a9e99d3305896f4bdc4c430164df09bb4ce1710959",
|
|
"present": true,
|
|
"drifted": true,
|
|
"last_change": "4f65e41 2026-10-17",
|
|
"inventory_classification": "private custody/local operation; explicit input; owner procedure required",
|
|
"referenced_by": [
|
|
"Makefile"
|
|
],
|
|
"candidate_status": "current (active route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "operator-held SOPS/age custody key, per-invocation only (make sops-custody-run)",
|
|
"consumers": "make sops-custody-*, creds-*",
|
|
"native_evidence": "drift = 4f65e41 sealed recovery custody; covered by T37 SOPS compatibility proof",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"canon/standards/credential-management_v0.2.md",
|
|
"docs/bootstrap-recovery-ceremony.md",
|
|
"docs/disaster-recovery-storage-share.md",
|
|
"docs/security-bootstrap-age-custody.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/bootstrap/sops-private.py",
|
|
"inventory_sha256": "113d17ee4cd7ad405e73cc51e1823dc02bd2e618e7fa67c1b624f0226e334ec6",
|
|
"present": true,
|
|
"drifted": true,
|
|
"last_change": "4f65e41 2026-10-17",
|
|
"inventory_classification": "private custody/local operation; explicit input; owner procedure required",
|
|
"referenced_by": [
|
|
"Makefile"
|
|
],
|
|
"candidate_status": "current (active route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "operator-held SOPS/age custody key, per-invocation only (make sops-custody-run)",
|
|
"consumers": "sealed recovery custody (T34/T37)",
|
|
"native_evidence": "drift = 4f65e41; T37 verified actual SOPS read/write custody",
|
|
"next_task": "none",
|
|
"documented_in": [],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/bootstrap/sops-write.py",
|
|
"inventory_sha256": "5a785e9c8e6a40ca9120a668d93992ea5c3115566ada21933536cc2d931f1ddf",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "8f80857 2026-10-13",
|
|
"inventory_classification": "private custody/local operation; explicit input; owner procedure required",
|
|
"referenced_by": [
|
|
"Makefile"
|
|
],
|
|
"candidate_status": "current (active route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per Make/bootstrap route",
|
|
"consumers": "operators via Make/bootstrap",
|
|
"native_evidence": "active route reference (see referenced_by)",
|
|
"next_task": "none",
|
|
"documented_in": [],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/authelia/create-secrets.sh",
|
|
"inventory_sha256": "137e137d973993e3938dbfe656b036e8d4d9643f84b5e8ca7ab30fbc5810ea1c",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "b01a30b 2026-10-13",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [
|
|
"Makefile",
|
|
"sso-mfa/bootstrap/creds-apply.sh",
|
|
"sso-mfa/bootstrap/creds-bootstrap-agent.sh",
|
|
"sso-mfa/bootstrap/creds-rotate.sh",
|
|
"sso-mfa/bootstrap/gen-secrets.sh",
|
|
"tools/security-bootstrap-console/README.md",
|
|
"tools/security-bootstrap-console/security_bootstrap_console.py"
|
|
],
|
|
"candidate_status": "current (active route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per Make/bootstrap route",
|
|
"consumers": "operators via Make/bootstrap",
|
|
"native_evidence": "active route reference (see referenced_by)",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"CONFIG.md",
|
|
"canon/standards/credential-management_v0.2.md",
|
|
"docs/attended-procedure-inventory.md",
|
|
"docs/security-bootstrap-rebuild-risk-and-rehearsal.md",
|
|
"docs/security-bootstrap-retrospective.md",
|
|
"docs/smooth-bootstrap-guide.md",
|
|
"sso-mfa/WORKPLAN.md",
|
|
"sso-mfa/bootstrap/README.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/keycape/approval-clients-rollout.py",
|
|
"inventory_sha256": "488d5cc59e081993dd2b5fc6d9e46bbddcaec4f5170b8f7a5ad0aae3a211a790",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "303a584 2026-09-09",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "current (documented operator route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)",
|
|
"consumers": "operators via documented runbook",
|
|
"native_evidence": "documented route (see documented_in); native acceptance per owning task",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/keycape-approval-clients-rollout.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/keycape/authentication-policy-rollout.py",
|
|
"inventory_sha256": "2c1bd23fded4855bae1eb3a08dbc4510d7f60f2bc4d625d60e471ab78f6f0251",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "a549617 2026-09-14",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "unrouted: owner disposition needed",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "attended operator kube session, namespace sso (lane keycape-attended-case-change)",
|
|
"consumers": "none after initial activation; later changes use the authenticated policy journey",
|
|
"native_evidence": "initial activation of the two baseline registrations; later changes use the authenticated policy journey; covered by test_authentication_policy_rollout.py",
|
|
"next_task": "none on the current estate; retained for greenfield/recovery rebuild of the issuer",
|
|
"documented_in": [
|
|
"sso-mfa/k8s/keycape/README.md"
|
|
],
|
|
"disposition": "owner-deferred (greenfield/initial activation only)"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/keycape/configure-openbao-oidc.sh",
|
|
"inventory_sha256": "bf214ac511fbd2269935f3270c6d4491c729d834e8138b9d7404aecf23c0825f",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "d9557ba 2026-10-15",
|
|
"inventory_classification": "retired entry point; refuses before credential/cluster access",
|
|
"referenced_by": [
|
|
"tools/security-bootstrap-console/security_bootstrap_console.py"
|
|
],
|
|
"candidate_status": "retired (refusing entry point)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "none (refuses before credential/cluster access)",
|
|
"consumers": "none",
|
|
"native_evidence": "refusal covered by tests/test_retirement_and_bundle_boundaries.py",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/attended-procedure-inventory.md",
|
|
"sso-mfa/k8s/keycape/README.md"
|
|
],
|
|
"disposition": "retired"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/keycape/create-pi-token.sh",
|
|
"inventory_sha256": "2f750aea638c06eb11dfe7afcf7b3d6117ba9e964cbf2a48bb12590054178152",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "7d4bb16 2026-10-13",
|
|
"inventory_classification": "retired entry point; refuses before credential/cluster access",
|
|
"referenced_by": [],
|
|
"candidate_status": "retired (refusing entry point)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "none (refuses before credential/cluster access)",
|
|
"consumers": "none",
|
|
"native_evidence": "refusal covered by tests/test_retirement_and_bundle_boundaries.py",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/attended-procedure-inventory.md",
|
|
"docs/security-bootstrap-age-custody.md",
|
|
"sso-mfa/WORKPLAN.md",
|
|
"sso-mfa/k8s/keycape/README.md"
|
|
],
|
|
"disposition": "retired"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/keycape/create-secrets.py",
|
|
"inventory_sha256": "5da672fff36eb94101741ad99e2a1a96ae81fea15ed1871304c40e63ce27c787",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "7d4bb16 2026-10-13",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "unrouted: owner disposition needed",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "private operator inputs; never replaces an existing Secret",
|
|
"consumers": "greenfield C0 bootstrap",
|
|
"native_evidence": "refuses replacement; no live re-run on the current estate",
|
|
"next_task": "none on the current estate (greenfield only); any re-run needs its own owner decision",
|
|
"documented_in": [
|
|
"sso-mfa/k8s/keycape/README.md"
|
|
],
|
|
"disposition": "owner-deferred (greenfield bootstrap only)"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/keycape/create-secrets.sh",
|
|
"inventory_sha256": "f5131160d91641a59c3163a17a8dd4f9b97d228eb8a5e0d8ad04cc2f7ff51644",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "7d4bb16 2026-10-13",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [
|
|
"Makefile",
|
|
"sso-mfa/bootstrap/creds-apply.sh",
|
|
"sso-mfa/bootstrap/creds-bootstrap-agent.sh",
|
|
"sso-mfa/bootstrap/creds-rotate.sh",
|
|
"sso-mfa/bootstrap/gen-secrets.sh",
|
|
"tools/security-bootstrap-console/README.md",
|
|
"tools/security-bootstrap-console/security_bootstrap_console.py"
|
|
],
|
|
"candidate_status": "current (active route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per Make/bootstrap route",
|
|
"consumers": "operators via Make/bootstrap",
|
|
"native_evidence": "active route reference (see referenced_by)",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"CONFIG.md",
|
|
"canon/standards/credential-management_v0.2.md",
|
|
"docs/attended-procedure-inventory.md",
|
|
"docs/security-bootstrap-rebuild-risk-and-rehearsal.md",
|
|
"docs/security-bootstrap-retrospective.md",
|
|
"docs/smooth-bootstrap-guide.md",
|
|
"sso-mfa/WORKPLAN.md",
|
|
"sso-mfa/bootstrap/README.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/keycape/exercise-approval-clients.py",
|
|
"inventory_sha256": "e2d3dd741ac52af28dce752344227a4443b78fedd4cfcc06ba902e679dfc9351",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "303a584 2026-09-09",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "current (documented operator route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)",
|
|
"consumers": "operators via documented runbook",
|
|
"native_evidence": "documented route (see documented_in); native acceptance per owning task",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/keycape-approval-clients-rollout.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/keycape/keycape-client.py",
|
|
"inventory_sha256": "e31ee2883fad4f93635700608ad98e05984c9e0453515dd7710c897ca856b8c8",
|
|
"present": true,
|
|
"drifted": true,
|
|
"last_change": "8790dd1 2026-10-16",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "current (documented operator route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "attended operator kube session, namespace sso (lane keycape-attended-case-change)",
|
|
"consumers": "register-client adapter (NK-WP-0048), per-client helpers",
|
|
"native_evidence": "drift = 8790dd1/916ba4b sealed checker snapshot; coordinator-reviewed with NK48 adapter set",
|
|
"next_task": "NK-WP-0048-T16 (1.3 re-freeze)",
|
|
"documented_in": [
|
|
"docs/playwright-registration.md",
|
|
"security-case-types/oidc-browser-relying-party/README.md",
|
|
"security-case-types/oidc-browser-relying-party/decision/packet.md",
|
|
"sso-mfa/k8s/keycape/bind-env-adapter.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/keycape/openbao-client-config.py",
|
|
"inventory_sha256": "1b908b4c36134212d78f9fbe7a2a201eb3ced06d31bb1dcea4a59d80689d84b1",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "d9557ba 2026-10-15",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "current (documented operator route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)",
|
|
"consumers": "operators via documented runbook",
|
|
"native_evidence": "documented route (see documented_in); native acceptance per owning task",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/keycape-upstream-issuer-pin.md",
|
|
"security-case-types/oidc-browser-relying-party/README.md",
|
|
"sso-mfa/k8s/keycape/README.md",
|
|
"sso-mfa/k8s/keycape/bind-env-adapter.md",
|
|
"sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/keycape/openbao-negative-node-wrapper.py",
|
|
"inventory_sha256": "76ac013d1a676a0dfa58aea1ce87b0c3e72483ccd21f586a22c5475e9132f6c1",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "7ceac43 2026-10-11",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "current (documented operator route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)",
|
|
"consumers": "operators via documented runbook",
|
|
"native_evidence": "documented route (see documented_in); native acceptance per owning task",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"sso-mfa/k8s/keycape/openbao-negative-node-route.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/keycape/openbao-negative-session.py",
|
|
"inventory_sha256": "24b7b803e4eb7e6e7c0700a069dad0ec315ee7eb5538a88b9e56147f8fab5cdd",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "7ceac43 2026-10-11",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "current (documented operator route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)",
|
|
"consumers": "operators via documented runbook",
|
|
"native_evidence": "documented route (see documented_in); native acceptance per owning task",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"sso-mfa/k8s/keycape/openbao-negative-node-route.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/keycape/openbao-signin-diagnosis-rollout.py",
|
|
"inventory_sha256": "a57b957d6eed9e8fb09d2a7aa7405a39deeafd9aaf57a9e6dc907afabd380371",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "c7ad8a5 2026-10-15",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "unrouted: owner disposition needed",
|
|
"owner": "net-kingdom + key-cape",
|
|
"credential_route": "attended operator kube session, namespace sso (lane keycape-attended-case-change)",
|
|
"consumers": "KeyCape openbao-admin registration",
|
|
"native_evidence": "owned by NK-WP-0051-T02 / KEY-WP-0041-T02",
|
|
"next_task": "NK-WP-0051-T02",
|
|
"documented_in": [
|
|
"sso-mfa/k8s/keycape/README.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/keycape/patch-openbao-client.sh",
|
|
"inventory_sha256": "cfd0dbd0528e799ee59d8aa4cd1cefc2189227cbc92d251f2a67bb25212aecad",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "d9557ba 2026-10-15",
|
|
"inventory_classification": "retired entry point; refuses before credential/cluster access",
|
|
"referenced_by": [
|
|
"tools/security-bootstrap-console/security_bootstrap_console.py"
|
|
],
|
|
"candidate_status": "retired (refusing entry point)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "none (refuses before credential/cluster access)",
|
|
"consumers": "none",
|
|
"native_evidence": "refusal covered by tests/test_retirement_and_bundle_boundaries.py",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/attended-procedure-inventory.md",
|
|
"sso-mfa/k8s/keycape/README.md"
|
|
],
|
|
"disposition": "retired"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/keycape/playwright-activation.py",
|
|
"inventory_sha256": "5ac683b3324b00e6253f6040f4c73057027b1f98f7071160a6153794ba522757",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "276b95f 2026-10-13",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "current (documented operator route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)",
|
|
"consumers": "operators via documented runbook",
|
|
"native_evidence": "documented route (see documented_in); native acceptance per owning task",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/playwright-registration.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/keycape/playwright-registration.py",
|
|
"inventory_sha256": "bf2d6b83d93629df8ddaf6c31d6c7408ae3866969d63895714df0e08a570da99",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "276b95f 2026-10-13",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "current (documented operator route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)",
|
|
"consumers": "operators via documented runbook",
|
|
"native_evidence": "documented route (see documented_in); native acceptance per owning task",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/playwright-registration.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/keycape/portal-client-rollout.py",
|
|
"inventory_sha256": "158e1d36eb881cdd0a2eda91b472adea5e8fde5061e00d26dda368580aeb871f",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "dc42b03 2026-09-14",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "current (documented operator route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)",
|
|
"consumers": "operators via documented runbook",
|
|
"native_evidence": "documented route (see documented_in); native acceptance per owning task",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"security-case-types/oidc-browser-relying-party/README.md",
|
|
"sso-mfa/k8s/keycape/bind-env-adapter.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/keycape/refresh-pi-token-live.sh",
|
|
"inventory_sha256": "2f750aea638c06eb11dfe7afcf7b3d6117ba9e964cbf2a48bb12590054178152",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "7d4bb16 2026-10-13",
|
|
"inventory_classification": "retired entry point; refuses before credential/cluster access",
|
|
"referenced_by": [
|
|
"tools/security-bootstrap-console/security_bootstrap_console.py"
|
|
],
|
|
"candidate_status": "retired (refusing entry point)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "none (refuses before credential/cluster access)",
|
|
"consumers": "none",
|
|
"native_evidence": "refusal covered by tests/test_retirement_and_bundle_boundaries.py",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/attended-procedure-inventory.md",
|
|
"sso-mfa/k8s/keycape/README.md"
|
|
],
|
|
"disposition": "retired"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/keycape/register-coulomb-social.py",
|
|
"inventory_sha256": "b40ff4bdba71b797f8f393e79cb3c9d73b790045a0f7df6ecea35803369793c7",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "d9557ba 2026-10-15",
|
|
"inventory_classification": "retired entry point; refuses before credential/cluster access",
|
|
"referenced_by": [],
|
|
"candidate_status": "retired (refusing entry point)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "none (refuses before credential/cluster access)",
|
|
"consumers": "none",
|
|
"native_evidence": "refusal covered by tests/test_retirement_and_bundle_boundaries.py",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"security-case-types/oidc-browser-relying-party/README.md"
|
|
],
|
|
"disposition": "retired"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/keycape/register-coulomb-social.sh",
|
|
"inventory_sha256": "cfd0dbd0528e799ee59d8aa4cd1cefc2189227cbc92d251f2a67bb25212aecad",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "d9557ba 2026-10-15",
|
|
"inventory_classification": "retired entry point; refuses before credential/cluster access",
|
|
"referenced_by": [],
|
|
"candidate_status": "retired (refusing entry point)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "none (refuses before credential/cluster access)",
|
|
"consumers": "none",
|
|
"native_evidence": "refusal covered by tests/test_retirement_and_bundle_boundaries.py",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/attended-procedure-inventory.md"
|
|
],
|
|
"disposition": "retired"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/keycape/register-user-engine-portal.py",
|
|
"inventory_sha256": "67173edc44f5457e7b6a3e0fb2321b398159cfce5dea8ead01eabf835fb38d76",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "dc42b03 2026-09-14",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "current (documented operator route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)",
|
|
"consumers": "operators via documented runbook",
|
|
"native_evidence": "documented route (see documented_in); native acceptance per owning task",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"security-case-types/oidc-browser-relying-party/README.md",
|
|
"sso-mfa/k8s/keycape/bind-env-adapter.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/keycape/secrets-engine-openbao-client-rollout.py",
|
|
"inventory_sha256": "8b834e5f0353a5e11797637420609e06e7bf7de47777c7e78b774f74d4a6afbd",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "a1e7302 2026-10-06",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "current (documented operator route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)",
|
|
"consumers": "operators via documented runbook",
|
|
"native_evidence": "documented route (see documented_in); native acceptance per owning task",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"sso-mfa/k8s/keycape/README.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/keycape/vergabe-client-rollout.py",
|
|
"inventory_sha256": "8cee6cc5ff3e3e8617304055263d04b393d0e005c34d9af12cb7e8bc685bac1a",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "48a75b1 2026-09-12",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "unrouted: owner disposition needed",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "attended operator kube session, namespace sso (lane keycape-attended-case-change)",
|
|
"consumers": "Vergabe demo client registration",
|
|
"native_evidence": "generalized by keycape-client.py; fixture test_vergabe_client_rollout.py",
|
|
"next_task": "retire after NK-WP-0048-T16 admits 1.3",
|
|
"documented_in": [
|
|
"security-case-types/oidc-browser-relying-party/README.md"
|
|
],
|
|
"disposition": "current, superseded on 1.3 admission"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/keycape/verify-openbao-client.sh",
|
|
"inventory_sha256": "6f8e75ad16f0d35f776d1a8da85842dc1174085a730f0189a7f5a36a0d7db83f",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "d9557ba 2026-10-15",
|
|
"inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials",
|
|
"referenced_by": [
|
|
"tools/security-bootstrap-console/security_bootstrap_console.py"
|
|
],
|
|
"candidate_status": "current (active route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per Make/bootstrap route",
|
|
"consumers": "operators via Make/bootstrap",
|
|
"native_evidence": "active route reference (see referenced_by)",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/attended-procedure-inventory.md",
|
|
"docs/security-bootstrap-rebuild-risk-and-rehearsal.md",
|
|
"docs/smooth-bootstrap-guide.md",
|
|
"sso-mfa/k8s/keycape/README.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/keycape/verify-user-engine-portal.py",
|
|
"inventory_sha256": "ccd5106395bd5d7b4f3dbbcbad449e3793aff217d4429b5d5af9e52ab9a58103",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "6cd89f0 2026-09-11",
|
|
"inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials",
|
|
"referenced_by": [],
|
|
"candidate_status": "current diagnostic, unrouted",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "status-only; explicit private input where needed",
|
|
"consumers": "operators on demand",
|
|
"native_evidence": "structural observation only; proves no recovery",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/evidence/2026-09-11-native-portal-repair.md"
|
|
],
|
|
"disposition": "current diagnostic"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/lldap/bootstrap-users.sh",
|
|
"inventory_sha256": "309da1de430638e4ed0b9bfe11b7bbb472a6bfe364cdfb6c69499c6fb78b66d6",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "ab25dde 2026-10-14",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "current (documented operator route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)",
|
|
"consumers": "operators via documented runbook",
|
|
"native_evidence": "documented route (see documented_in); native acceptance per owning task",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/attended-procedure-inventory.md",
|
|
"docs/intakes/activity-core-ops-sso-operators.md",
|
|
"sso-mfa/WORKPLAN.md",
|
|
"sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md",
|
|
"sso-mfa/k8s/lldap/README.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/lldap/break-glass.sh",
|
|
"inventory_sha256": "a30cc22a990d368b9066e2e8b7aaef1c993c1c8a86e191ad2afb0e5c4d4f3294",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "84c5dbe 2026-10-14",
|
|
"inventory_classification": "retired entry point; refuses before credential/cluster access",
|
|
"referenced_by": [
|
|
"Makefile"
|
|
],
|
|
"candidate_status": "retired (refusing entry point)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "none (refuses before credential/cluster access)",
|
|
"consumers": "none",
|
|
"native_evidence": "refusal covered by tests/test_retirement_and_bundle_boundaries.py",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/attended-procedure-inventory.md",
|
|
"docs/legacy-lldap-lifecycle-retirement.md",
|
|
"sso-mfa/WORKPLAN.md"
|
|
],
|
|
"disposition": "retired"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/lldap/create-secrets.sh",
|
|
"inventory_sha256": "fb2ee3b5af858297d20f8bc8821ee13a86d6ebc9235756b9ed9a8e85a54d84a1",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "b01a30b 2026-10-13",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [
|
|
"Makefile",
|
|
"sso-mfa/bootstrap/creds-apply.sh",
|
|
"sso-mfa/bootstrap/creds-bootstrap-agent.sh",
|
|
"sso-mfa/bootstrap/creds-rotate.sh",
|
|
"sso-mfa/bootstrap/gen-secrets.sh",
|
|
"tools/security-bootstrap-console/README.md",
|
|
"tools/security-bootstrap-console/security_bootstrap_console.py"
|
|
],
|
|
"candidate_status": "current (active route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per Make/bootstrap route",
|
|
"consumers": "operators via Make/bootstrap",
|
|
"native_evidence": "active route reference (see referenced_by)",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"CONFIG.md",
|
|
"canon/standards/credential-management_v0.2.md",
|
|
"docs/attended-procedure-inventory.md",
|
|
"docs/security-bootstrap-rebuild-risk-and-rehearsal.md",
|
|
"docs/security-bootstrap-retrospective.md",
|
|
"docs/smooth-bootstrap-guide.md",
|
|
"sso-mfa/WORKPLAN.md",
|
|
"sso-mfa/bootstrap/README.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/lldap/create-user.sh",
|
|
"inventory_sha256": "a30cc22a990d368b9066e2e8b7aaef1c993c1c8a86e191ad2afb0e5c4d4f3294",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "84c5dbe 2026-10-14",
|
|
"inventory_classification": "retired entry point; refuses before credential/cluster access",
|
|
"referenced_by": [
|
|
"Makefile"
|
|
],
|
|
"candidate_status": "retired (refusing entry point)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "none (refuses before credential/cluster access)",
|
|
"consumers": "none",
|
|
"native_evidence": "refusal covered by tests/test_retirement_and_bundle_boundaries.py",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/NetkingdomRuntimeArchitecture.md",
|
|
"docs/attended-procedure-inventory.md",
|
|
"docs/legacy-lldap-lifecycle-retirement.md",
|
|
"docs/security-bootstrap-rebuild-risk-and-rehearsal.md",
|
|
"docs/security-bootstrap-retrospective.md",
|
|
"docs/user-engine-netkingdom-integration-assessment.md"
|
|
],
|
|
"disposition": "retired"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/lldap/dry-run-nonroot-user.sh",
|
|
"inventory_sha256": "a30cc22a990d368b9066e2e8b7aaef1c993c1c8a86e191ad2afb0e5c4d4f3294",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "84c5dbe 2026-10-14",
|
|
"inventory_classification": "retired entry point; refuses before credential/cluster access",
|
|
"referenced_by": [
|
|
"Makefile"
|
|
],
|
|
"candidate_status": "retired (refusing entry point)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "none (refuses before credential/cluster access)",
|
|
"consumers": "none",
|
|
"native_evidence": "refusal covered by tests/test_retirement_and_bundle_boundaries.py",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/NetkingdomRuntimeArchitecture.md",
|
|
"docs/attended-procedure-inventory.md",
|
|
"docs/legacy-lldap-lifecycle-retirement.md",
|
|
"docs/security-bootstrap-rebuild-risk-and-rehearsal.md",
|
|
"docs/security-bootstrap-retrospective.md"
|
|
],
|
|
"disposition": "retired"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/lldap/identity-provisioner-reconcile.py",
|
|
"inventory_sha256": "e124b94c3a5749d4e3fdfc5fd054acfb295594beac24cd399a7b24a8617683d6",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "6a0773b 2026-09-11",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "current (documented operator route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)",
|
|
"consumers": "operators via documented runbook",
|
|
"native_evidence": "documented route (see documented_in); native acceptance per owning task",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/evidence/2026-09-11-native-portal-repair.md",
|
|
"docs/identity-provisioner-bind-repair.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/lldap/lldap_admin.py",
|
|
"inventory_sha256": "5e39e2eac53846a97cd25151c0a4af1ffc0230db881a6325efb66de6a51bfc36",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "2cc09ce 2026-10-14",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "current (documented operator route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)",
|
|
"consumers": "operators via documented runbook",
|
|
"native_evidence": "documented route (see documented_in); native acceptance per owning task",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/sign-in-diagnosis.md",
|
|
"sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/lldap/manage-group-members.sh",
|
|
"inventory_sha256": "3c85e4e882ad003a4dc513d9085d136531511273db8adf27e1fcf5e749ae04d1",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "ab25dde 2026-10-14",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "current (documented operator route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)",
|
|
"consumers": "operators via documented runbook",
|
|
"native_evidence": "documented route (see documented_in); native acceptance per owning task",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/attended-procedure-inventory.md",
|
|
"sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md",
|
|
"sso-mfa/k8s/lldap/OPERATOR-GROUPS.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/postgresql/create-secrets.sh",
|
|
"inventory_sha256": "801ae8a404f0a8fd2bb349003091ab6a509df2533bc1a0f456dd7d5940d917e9",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "b01a30b 2026-10-13",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [
|
|
"Makefile",
|
|
"sso-mfa/bootstrap/creds-apply.sh",
|
|
"sso-mfa/bootstrap/creds-bootstrap-agent.sh",
|
|
"sso-mfa/bootstrap/creds-rotate.sh",
|
|
"sso-mfa/bootstrap/gen-secrets.sh",
|
|
"tools/security-bootstrap-console/README.md",
|
|
"tools/security-bootstrap-console/security_bootstrap_console.py"
|
|
],
|
|
"candidate_status": "current (active route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per Make/bootstrap route",
|
|
"consumers": "operators via Make/bootstrap",
|
|
"native_evidence": "active route reference (see referenced_by)",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"CONFIG.md",
|
|
"canon/standards/credential-management_v0.2.md",
|
|
"docs/attended-procedure-inventory.md",
|
|
"docs/security-bootstrap-rebuild-risk-and-rehearsal.md",
|
|
"docs/security-bootstrap-retrospective.md",
|
|
"docs/smooth-bootstrap-guide.md",
|
|
"sso-mfa/WORKPLAN.md",
|
|
"sso-mfa/bootstrap/README.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/privacyidea/activate-onboarding-policy.py",
|
|
"inventory_sha256": "edd6d3d4507e11e1632002e56f948bb2e81465132500627b5ddc7fa0f06203d1",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "a549617 2026-09-14",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "unrouted: owner disposition needed",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "attended operator kube session, namespace mfa; provider admin via existing in-pod custody",
|
|
"consumers": "privacyIDEA enrollment policy (portal, Vergabe)",
|
|
"native_evidence": "delivered NK-WP-0042 scoped enrollment",
|
|
"next_task": "NK-WP-0042 pilot reuse",
|
|
"documented_in": [
|
|
"sso-mfa/k8s/privacyidea/README.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/privacyidea/bootstrap-admin-remote.py",
|
|
"inventory_sha256": "c83c3a5c9a753a8afec90c35ce5ddbfc15f7b8aff437065f428109d9c5774b89",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "19a1c75 2026-10-12",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "unrouted: owner disposition needed",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "stdin JSON, in-pod only",
|
|
"consumers": "called only by bootstrap-admin.py",
|
|
"native_evidence": "insert-only DB writes",
|
|
"next_task": "none on the current estate (greenfield only); any re-run needs its own owner decision",
|
|
"documented_in": [
|
|
"sso-mfa/k8s/privacyidea/README.md"
|
|
],
|
|
"disposition": "owner-deferred (greenfield bootstrap only)"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/privacyidea/bootstrap-admin.py",
|
|
"inventory_sha256": "b81b5c3806dbdf03ea7cac37884cc368de0f0ef7880ac326b67af3a291c35890",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "19a1c75 2026-10-12",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "unrouted: owner disposition needed",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "one private bootstrap credential over stdin",
|
|
"consumers": "greenfield privacyIDEA",
|
|
"native_evidence": "insert-only; never updates existing credentials",
|
|
"next_task": "none on the current estate (greenfield only); any re-run needs its own owner decision",
|
|
"documented_in": [
|
|
"sso-mfa/k8s/privacyidea/README.md"
|
|
],
|
|
"disposition": "owner-deferred (greenfield bootstrap only)"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/privacyidea/bootstrap-admin.sh",
|
|
"inventory_sha256": "1a11738c1790cc6b5f23ed40f02971591eb76afa486be89d5535b0027aca6989",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "19a1c75 2026-10-12",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [
|
|
"sso-mfa/bootstrap/creds-apply.sh",
|
|
"sso-mfa/bootstrap/creds-bootstrap-agent.sh"
|
|
],
|
|
"candidate_status": "current (active route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per Make/bootstrap route",
|
|
"consumers": "operators via Make/bootstrap",
|
|
"native_evidence": "active route reference (see referenced_by)",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/attended-procedure-inventory.md",
|
|
"docs/security-bootstrap-age-custody.md",
|
|
"sso-mfa/WORKPLAN.md",
|
|
"sso-mfa/k8s/privacyidea/README.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/privacyidea/bootstrap-realm.sh",
|
|
"inventory_sha256": "d3dc530d378ce826f4875c4cf066a6f7f916c3abd5492eb5ee237a8c98b7957b",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "30f0d27 2026-10-13",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "current (documented operator route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)",
|
|
"consumers": "operators via documented runbook",
|
|
"native_evidence": "documented route (see documented_in); native acceptance per owning task",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/attended-procedure-inventory.md",
|
|
"docs/attended-procedure-standard.md",
|
|
"sso-mfa/WORKPLAN.md",
|
|
"sso-mfa/k8s/privacyidea/README.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/privacyidea/check-user-mfa-state.sh",
|
|
"inventory_sha256": "18901decfdc974ba5a6e871b7a4fe8022be59c73123774a31c57303fd5f657be",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "96feef4 2026-10-13",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "current (documented operator route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)",
|
|
"consumers": "operators via documented runbook",
|
|
"native_evidence": "documented route (see documented_in); native acceptance per owning task",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/attended-procedure-inventory.md",
|
|
"docs/smooth-bootstrap-guide.md",
|
|
"sso-mfa/k8s/privacyidea/README.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/privacyidea/create-secrets.sh",
|
|
"inventory_sha256": "6644b37f2a0ba09b67e135516204950474bd8fa28a243f62e29b898d00c08d91",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "b01a30b 2026-10-13",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [
|
|
"Makefile",
|
|
"sso-mfa/bootstrap/creds-apply.sh",
|
|
"sso-mfa/bootstrap/creds-bootstrap-agent.sh",
|
|
"sso-mfa/bootstrap/creds-rotate.sh",
|
|
"sso-mfa/bootstrap/gen-secrets.sh",
|
|
"tools/security-bootstrap-console/README.md",
|
|
"tools/security-bootstrap-console/security_bootstrap_console.py"
|
|
],
|
|
"candidate_status": "current (active route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per Make/bootstrap route",
|
|
"consumers": "operators via Make/bootstrap",
|
|
"native_evidence": "active route reference (see referenced_by)",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"CONFIG.md",
|
|
"canon/standards/credential-management_v0.2.md",
|
|
"docs/attended-procedure-inventory.md",
|
|
"docs/security-bootstrap-rebuild-risk-and-rehearsal.md",
|
|
"docs/security-bootstrap-retrospective.md",
|
|
"docs/smooth-bootstrap-guide.md",
|
|
"sso-mfa/WORKPLAN.md",
|
|
"sso-mfa/bootstrap/README.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/privacyidea/deploy-factor-recovery.py",
|
|
"inventory_sha256": "9a46aa7a1fdf7c202981f2529bc138dcdd952fbefab1d18a88ac65176936a389",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "a549617 2026-09-14",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "unrouted: owner disposition needed",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "attended operator kube session, namespace mfa; provider admin via existing in-pod custody",
|
|
"consumers": "private P04 factor-recovery service",
|
|
"native_evidence": "delivered; recovery journey acceptance open",
|
|
"next_task": "NK-WP-0042 step-up/recovery journey",
|
|
"documented_in": [
|
|
"sso-mfa/k8s/privacyidea/README.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/privacyidea/deploy-onboarding-guard.py",
|
|
"inventory_sha256": "95a3195d01775ea1d800aaa37131d440acc92f2a50215a108c0b63a3441cce94",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "a549617 2026-09-14",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "unrouted: owner disposition needed",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "attended operator kube session, namespace mfa; provider admin via existing in-pod custody",
|
|
"consumers": "privacyIDEA enrollment hook",
|
|
"native_evidence": "delivered NK-WP-0042",
|
|
"next_task": "NK-WP-0042 pilot reuse",
|
|
"documented_in": [
|
|
"sso-mfa/k8s/privacyidea/README.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/privacyidea/enable-factor-confirmation.py",
|
|
"inventory_sha256": "f71e22d6a7a99f4293fb688567ec11c6826a543223b27168e0577e8a6070581e",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "ce69533 2026-09-13",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "unrouted: owner disposition needed",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "attended operator kube session, namespace mfa; provider admin via existing in-pod custody",
|
|
"consumers": "new TOTP enrollments",
|
|
"native_evidence": "delivered NK-WP-0042",
|
|
"next_task": "NK-WP-0042 pilot reuse",
|
|
"documented_in": [
|
|
"sso-mfa/k8s/privacyidea/README.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/privacyidea/enckey-bootstrap.sh",
|
|
"inventory_sha256": "e47b86ae422f043145525b3deaa4c57ce6ee92974db090695be7fafbe7b61a2e",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "1cbe00f 2026-10-13",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [
|
|
"sso-mfa/bootstrap/creds-apply.sh",
|
|
"sso-mfa/bootstrap/creds-bootstrap-agent.sh",
|
|
"sso-mfa/bootstrap/gen-secrets.sh"
|
|
],
|
|
"candidate_status": "current (active route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per Make/bootstrap route",
|
|
"consumers": "operators via Make/bootstrap",
|
|
"native_evidence": "active route reference (see referenced_by)",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/attended-procedure-inventory.md",
|
|
"sso-mfa/WORKPLAN.md",
|
|
"sso-mfa/bootstrap/README.md",
|
|
"sso-mfa/k8s/privacyidea/KEY-RECOVERY.md",
|
|
"sso-mfa/k8s/privacyidea/README.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/privacyidea/enckey-restore.sh",
|
|
"inventory_sha256": "fb31831c1492006ad5f32e16f2ce47baf6e20d0cb56a592432da0698052bf362",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "1cbe00f 2026-10-13",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "current (documented operator route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)",
|
|
"consumers": "operators via documented runbook",
|
|
"native_evidence": "documented route (see documented_in); native acceptance per owning task",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"sso-mfa/k8s/privacyidea/KEY-RECOVERY.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/privacyidea/key-custody-remote.py",
|
|
"inventory_sha256": "27b2b885c81923d85054e3999c5613e104fe627779b2b50398ed9bed5088f47e",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "1cbe00f 2026-10-13",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "unrouted: owner disposition needed",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "in-pod key transport",
|
|
"consumers": "called only by key-custody.py (tests/test_privacyidea_key_custody.py)",
|
|
"native_evidence": "T31 token-material proof",
|
|
"next_task": "NK-WP-0049-T19",
|
|
"documented_in": [
|
|
"sso-mfa/k8s/privacyidea/README.md"
|
|
],
|
|
"disposition": "current (internal)"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/privacyidea/key-custody.py",
|
|
"inventory_sha256": "e43d21694cb9c99bd02257a4f225973e992c9af4b0e71788929f949b9752f08a",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "1cbe00f 2026-10-13",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "current (documented operator route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)",
|
|
"consumers": "operators via documented runbook",
|
|
"native_evidence": "documented route (see documented_in); native acceptance per owning task",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"sso-mfa/k8s/privacyidea/KEY-RECOVERY.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/privacyidea/keycape-scope-probe.py",
|
|
"inventory_sha256": "847b8d7c72c11deab15b3d16964e2619011e21d219b1d82c25f0346493abbbef",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "54a47dd 2026-09-13",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "unrouted: owner disposition needed",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "attended operator kube session, namespace mfa; provider admin via existing in-pod custody",
|
|
"consumers": "realm-visibility probe for KeyCape scope",
|
|
"native_evidence": "inert probe; emits no key",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"sso-mfa/k8s/privacyidea/README.md"
|
|
],
|
|
"disposition": "current diagnostic"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/privacyidea/mfa_state.py",
|
|
"inventory_sha256": "3f0c2e404d7df41af7f8e1fe66a4a6d392338391456ef298c7dd0219ad3d58dc",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "96feef4 2026-10-13",
|
|
"inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials",
|
|
"referenced_by": [],
|
|
"candidate_status": "current diagnostic, unrouted",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "status-only; explicit private input where needed",
|
|
"consumers": "operators on demand",
|
|
"native_evidence": "structural observation only; proves no recovery",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"sso-mfa/k8s/privacyidea/README.md"
|
|
],
|
|
"disposition": "current diagnostic"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/privacyidea/pi_api.py",
|
|
"inventory_sha256": "01bbf3a2c1f8c423f864dc4bd2145c5c89f938fa9e8b0ffbbecf6d674484896b",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "4dffe2f 2026-10-14",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "current (documented operator route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)",
|
|
"consumers": "operators via documented runbook",
|
|
"native_evidence": "documented route (see documented_in); native acceptance per owning task",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"sso-mfa/k8s/privacyidea/README.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/privacyidea/realm_bootstrap.py",
|
|
"inventory_sha256": "2885086fdc4fd64b58496f90e82c75eefc7171017004e0804defaaabf791b3a9",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "30f0d27 2026-10-13",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "unrouted: owner disposition needed",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "attended operator kube session, namespace mfa; provider admin via existing in-pod custody",
|
|
"consumers": "realm/resolver repair; library for bootstrap-realm.sh",
|
|
"native_evidence": "preserves established policy",
|
|
"next_task": "NK-WP-0049-T19 (isolated MFA adapter)",
|
|
"documented_in": [
|
|
"sso-mfa/k8s/privacyidea/README.md"
|
|
],
|
|
"disposition": "current (repair)"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/privacyidea/reconcile-lldap-resolver-live.sh",
|
|
"inventory_sha256": "89f5b279cde441ef8a7c63436e63c6242527d36949aba4bad2134c890a9e0b04",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "4dffe2f 2026-10-14",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "current (documented operator route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)",
|
|
"consumers": "operators via documented runbook",
|
|
"native_evidence": "documented route (see documented_in); native acceptance per owning task",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/attended-procedure-inventory.md",
|
|
"docs/attended-procedure-standard.md",
|
|
"docs/keycape-exposure-resolver-reconciliation.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/privacyidea/repair-realm-live.sh",
|
|
"inventory_sha256": "2684a6caca848f5d9e74191af4ca2864adba92fe3ee410a4236045d1743b99e6",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "30f0d27 2026-10-13",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [
|
|
"tools/security-bootstrap-console/README.md",
|
|
"tools/security-bootstrap-console/security_bootstrap_console.py"
|
|
],
|
|
"candidate_status": "current (active route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per Make/bootstrap route",
|
|
"consumers": "operators via Make/bootstrap",
|
|
"native_evidence": "active route reference (see referenced_by)",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/attended-procedure-inventory.md",
|
|
"docs/security-bootstrap-rebuild-risk-and-rehearsal.md",
|
|
"docs/security-bootstrap-retrospective.md",
|
|
"docs/smooth-bootstrap-guide.md",
|
|
"docs/verify-t06.md",
|
|
"sso-mfa/k8s/privacyidea/README.md",
|
|
"tools/security-bootstrap-console/README.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/privacyidea/resolver_cutover.py",
|
|
"inventory_sha256": "6ed2df95671897f073a3dc8fee62b780cdff87b08d617d5a337e1fbba206e10a",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "4dffe2f 2026-10-14",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "current (documented operator route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)",
|
|
"consumers": "operators via documented runbook",
|
|
"native_evidence": "documented route (see documented_in); native acceptance per owning task",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/keycape-exposure-resolver-reconciliation.md",
|
|
"sso-mfa/k8s/privacyidea/README.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/privacyidea/update-lldap-resolver-live.sh",
|
|
"inventory_sha256": "ffa7c551dbcc6ab74d2cfc0853fd0647dd026259b1541f99e4a84dcbac16588c",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "4dffe2f 2026-10-14",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [],
|
|
"candidate_status": "current (documented operator route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)",
|
|
"consumers": "operators via documented runbook",
|
|
"native_evidence": "documented route (see documented_in); native acceptance per owning task",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/attended-procedure-inventory.md",
|
|
"docs/keycape-exposure-resolver-reconciliation.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/privacyidea/verify_mfa.py",
|
|
"inventory_sha256": "118d0052433edb85dd53e3c988943392f59d0aa00641d45f8ff3676a15f8af19",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "4e07d60 2026-09-05",
|
|
"inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials",
|
|
"referenced_by": [],
|
|
"candidate_status": "current diagnostic, unrouted",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "status-only; explicit private input where needed",
|
|
"consumers": "operators on demand",
|
|
"native_evidence": "structural observation only; proves no recovery",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"sso-mfa/k8s/privacyidea/README.md"
|
|
],
|
|
"disposition": "current diagnostic"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/user-engine/verify-operability.sh",
|
|
"inventory_sha256": "2e1cbde1d2aa2ce9f27685baf93137d5f13d33a77421a2fba1649f874f2b7f48",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "d9557ba 2026-10-15",
|
|
"inventory_classification": "retired entry point; refuses before credential/cluster access",
|
|
"referenced_by": [],
|
|
"candidate_status": "retired (refusing entry point)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "none (refuses before credential/cluster access)",
|
|
"consumers": "none",
|
|
"native_evidence": "refusal covered by tests/test_retirement_and_bundle_boundaries.py",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/attended-procedure-inventory.md",
|
|
"sso-mfa/k8s/user-engine/README.md"
|
|
],
|
|
"disposition": "retired"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/verify-identity-cutover-dependencies.sh",
|
|
"inventory_sha256": "96da30c4eca28615685ff384bbc7d00d81c7562e8e572a3ad54c3cc6fdd297ca",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "d9557ba 2026-10-15",
|
|
"inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials",
|
|
"referenced_by": [],
|
|
"candidate_status": "current diagnostic, unrouted",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "status-only; explicit private input where needed",
|
|
"consumers": "operators on demand",
|
|
"native_evidence": "structural observation only; proves no recovery",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/attended-procedure-inventory.md",
|
|
"docs/railiance01-coulombcore-cutover-inventory-2026-07-28.md"
|
|
],
|
|
"disposition": "current diagnostic"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/verify-t02.sh",
|
|
"inventory_sha256": "7a9fe613fc83841397f2e3b0b4c26c5464d7b903d5e56a83ec786e2289719b24",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "8e7229a 2026-07-29",
|
|
"inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials",
|
|
"referenced_by": [],
|
|
"candidate_status": "current diagnostic, unrouted",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "status-only; explicit private input where needed",
|
|
"consumers": "operators on demand",
|
|
"native_evidence": "structural observation only; proves no recovery",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/attended-procedure-inventory.md",
|
|
"docs/verification-audit-2026-09-05.md",
|
|
"sso-mfa/k8s/FOUNDATIONS-HISTORICAL.md"
|
|
],
|
|
"disposition": "current diagnostic"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/verify-t03.sh",
|
|
"inventory_sha256": "7b3a888ae20394b761d7cd9cf1bc81f273813794a3002202951b061bd6c27963",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "6d25d08 2026-03-20",
|
|
"inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials",
|
|
"referenced_by": [],
|
|
"candidate_status": "current diagnostic, unrouted",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "status-only; explicit private input where needed",
|
|
"consumers": "operators on demand",
|
|
"native_evidence": "structural observation only; proves no recovery",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/attended-procedure-inventory.md",
|
|
"docs/verification-audit-2026-09-05.md",
|
|
"sso-mfa/k8s/postgresql/README.md"
|
|
],
|
|
"disposition": "current diagnostic"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/verify-t04.sh",
|
|
"inventory_sha256": "74128536919f79f17bffc107678718848c4ca095de06140cdc453e68953aabd1",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "1cbe00f 2026-10-13",
|
|
"inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials",
|
|
"referenced_by": [],
|
|
"candidate_status": "current diagnostic, unrouted",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "status-only; explicit private input where needed",
|
|
"consumers": "operators on demand",
|
|
"native_evidence": "structural observation only; proves no recovery",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/attended-procedure-inventory.md",
|
|
"docs/verification-audit-2026-09-05.md",
|
|
"docs/verify-t06.md",
|
|
"sso-mfa/WORKPLAN.md",
|
|
"sso-mfa/k8s/privacyidea/README.md"
|
|
],
|
|
"disposition": "current diagnostic"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/verify-t05.sh",
|
|
"inventory_sha256": "bb226bad1e5fb60a5d6f87fa67ecee2d6af84d6d6a84fa02d9839d8bca58a197",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "0754dc3 2026-03-19",
|
|
"inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials",
|
|
"referenced_by": [],
|
|
"candidate_status": "current diagnostic, unrouted",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "status-only; explicit private input where needed",
|
|
"consumers": "operators on demand",
|
|
"native_evidence": "structural observation only; proves no recovery",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/attended-procedure-inventory.md",
|
|
"docs/verification-audit-2026-09-05.md",
|
|
"docs/verify-t06.md",
|
|
"sso-mfa/WORKPLAN.md",
|
|
"sso-mfa/k8s/backup/DR-RUNBOOK.md"
|
|
],
|
|
"disposition": "current diagnostic"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/verify-t06.sh",
|
|
"inventory_sha256": "717317c1d51f7c3361f3b711d79cae52019c36cd6c397e5fa61f07eaad3632e2",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "4e07d60 2026-09-05",
|
|
"inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials",
|
|
"referenced_by": [
|
|
"tools/security-bootstrap-console/README.md"
|
|
],
|
|
"candidate_status": "current (active route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per Make/bootstrap route",
|
|
"consumers": "operators via Make/bootstrap",
|
|
"native_evidence": "active route reference (see referenced_by)",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/attended-procedure-inventory.md",
|
|
"docs/attended-procedure-standard.md",
|
|
"docs/verification-audit-2026-09-05.md",
|
|
"docs/verify-t06.md",
|
|
"sso-mfa/WORKPLAN.md",
|
|
"sso-mfa/k8s/privacyidea/README.md",
|
|
"tools/security-bootstrap-console/README.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/verify-t07.sh",
|
|
"inventory_sha256": "026406ff1fec9e4bf542741c08002c45ea8a94a4ce5a50980665b601485882df",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "ab25dde 2026-10-14",
|
|
"inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials",
|
|
"referenced_by": [],
|
|
"candidate_status": "current diagnostic, unrouted",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "status-only; explicit private input where needed",
|
|
"consumers": "operators on demand",
|
|
"native_evidence": "structural observation only; proves no recovery",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/attended-procedure-inventory.md",
|
|
"docs/verification-audit-2026-09-05.md",
|
|
"sso-mfa/WORKPLAN.md",
|
|
"sso-mfa/k8s/keycape/README.md",
|
|
"sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md"
|
|
],
|
|
"disposition": "current diagnostic"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/verify-t08.sh",
|
|
"inventory_sha256": "7efe14c0d71f2c846434d19f8d05702d69d3c40a617a700b08fe13b3764d0650",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "c054241 2026-03-25",
|
|
"inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials",
|
|
"referenced_by": [],
|
|
"candidate_status": "current diagnostic, unrouted",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "status-only; explicit private input where needed",
|
|
"consumers": "operators on demand",
|
|
"native_evidence": "structural observation only; proves no recovery",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/attended-procedure-inventory.md",
|
|
"docs/verification-audit-2026-09-05.md",
|
|
"sso-mfa/WORKPLAN.md"
|
|
],
|
|
"disposition": "current diagnostic"
|
|
},
|
|
{
|
|
"path": "tools/bootstrap-recovery/inventory-scaleway.py",
|
|
"inventory_sha256": "a219df205708fa4ed44b763a418585d63c820c25434bc0fd14e805eb5c2f79d3",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "c262470 2026-10-15",
|
|
"inventory_classification": "read-only bounded owner backup metadata; existing caller/custody only; no age key or backup content read",
|
|
"referenced_by": [],
|
|
"candidate_status": "unrouted: owner disposition needed",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "existing scoped runtime delivery; admitted cluster read",
|
|
"consumers": "T06 offsite discovery",
|
|
"native_evidence": "offsite-discovery-summary.json (2026-10-15)",
|
|
"next_task": "NK-WP-0049-T24 G3 (recurring drill)",
|
|
"documented_in": [
|
|
"tools/bootstrap-recovery/README.md"
|
|
],
|
|
"disposition": "current (recovery tooling)"
|
|
},
|
|
{
|
|
"path": "tools/bootstrap-recovery/inventory-storage-share.py",
|
|
"inventory_sha256": "673f9b17fb2f3fef6fcdb5c50a2bcca69e3df3157a9e5582a2d995c6b87640b5",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "a1939a7 2026-10-16",
|
|
"inventory_classification": "read-only bounded owner backup metadata; existing caller/custody only; no age key or backup content read",
|
|
"referenced_by": [],
|
|
"candidate_status": "unrouted: owner disposition needed",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "Platform attended Backup-account lane (railiance-platform owner custody)",
|
|
"consumers": "T06 offsite discovery",
|
|
"native_evidence": "offsite-discovery-summary.json",
|
|
"next_task": "NK-WP-0049-T24 G3 (recurring drill)",
|
|
"documented_in": [
|
|
"tools/bootstrap-recovery/README.md"
|
|
],
|
|
"disposition": "current (recovery tooling)"
|
|
},
|
|
{
|
|
"path": "tools/bootstrap-recovery/verify-bundle.py",
|
|
"inventory_sha256": "885b05a2011e711228e42e316bda70bbe0d97d481383d61aa8469d0f10452370",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "d9557ba 2026-10-15",
|
|
"inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials",
|
|
"referenced_by": [],
|
|
"candidate_status": "current diagnostic, unrouted",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "status-only; explicit private input where needed",
|
|
"consumers": "operators on demand",
|
|
"native_evidence": "structural observation only; proves no recovery",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/bootstrap-recovery-ceremony.md",
|
|
"tools/bootstrap-recovery/README.md"
|
|
],
|
|
"disposition": "current diagnostic"
|
|
},
|
|
{
|
|
"path": "tools/security-bootstrap-console/security_bootstrap_console.py",
|
|
"inventory_sha256": "e9419ab1de0725b12b06fc29098c49584cb8acf47ec0ca09d552915f964a2c48",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "84c5dbe 2026-10-14",
|
|
"inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance",
|
|
"referenced_by": [
|
|
"Makefile",
|
|
"tools/security-bootstrap-console/README.md",
|
|
"tools/security-bootstrap-console/tests/test_security_bootstrap_console.py"
|
|
],
|
|
"candidate_status": "current (active route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per Make/bootstrap route",
|
|
"consumers": "operators via Make/bootstrap",
|
|
"native_evidence": "active route reference (see referenced_by)",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/NetkingdomRuntimeArchitecture.md",
|
|
"docs/openbao-attended-ceremony-runbook.md",
|
|
"docs/openbao-unseal-custody-models.md",
|
|
"docs/security-bootstrap-rebuild-risk-and-rehearsal.md",
|
|
"docs/security-bootstrap-retrospective.md",
|
|
"docs/smooth-bootstrap-guide.md",
|
|
"docs/tutorials/openbao-operating-path.md",
|
|
"tools/security-bootstrap-console/README.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "tools/sync-user-engine-delivery-secret.sh",
|
|
"inventory_sha256": "7c0fb6b066e4ad8b103e75551beecd5de65a4bbb22570d95b42e5da6395e2dfc",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "d9557ba 2026-10-15",
|
|
"inventory_classification": "retired entry point; refuses before credential/cluster access",
|
|
"referenced_by": [],
|
|
"candidate_status": "retired (refusing entry point)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "none (refuses before credential/cluster access)",
|
|
"consumers": "none",
|
|
"native_evidence": "refusal covered by tests/test_retirement_and_bundle_boundaries.py",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"sso-mfa/k8s/user-engine/README.md"
|
|
],
|
|
"disposition": "retired"
|
|
},
|
|
{
|
|
"path": "tools/bootstrap-recovery/fetch-privacyidea-backup.py",
|
|
"inventory_sha256": "233160e1206643a5cf7ad05141d733f0a75aff651190e27f77515a124ff0a59f",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "a1939a7 2026-10-16",
|
|
"inventory_classification": "bounded off-host transfer / isolated database drill; actual recovery acceptance requires operator execution",
|
|
"referenced_by": [],
|
|
"candidate_status": "unrouted: owner disposition needed",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "Platform attended Backup-account lane (railiance-platform owner custody)",
|
|
"consumers": "isolated PI database drill",
|
|
"native_evidence": "privacyidea-transfer-r1.json",
|
|
"next_task": "NK-WP-0049-T24 G3 (recurring drill)",
|
|
"documented_in": [
|
|
"tools/bootstrap-recovery/README.md"
|
|
],
|
|
"disposition": "current (recovery tooling)"
|
|
},
|
|
{
|
|
"path": "tools/bootstrap-recovery/check-privacyidea-database.py",
|
|
"inventory_sha256": "90f454c87998d7f5d625e3c6656c3418f8f56275dc1879a9d19ed605431b94a4",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "a1939a7 2026-10-16",
|
|
"inventory_classification": "bounded off-host transfer / isolated database drill; actual recovery acceptance requires operator execution",
|
|
"referenced_by": [],
|
|
"candidate_status": "current (documented operator route)",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)",
|
|
"consumers": "operators via documented runbook",
|
|
"native_evidence": "documented route (see documented_in); native acceptance per owning task",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"docs/bootstrap-recovery-ceremony.md",
|
|
"tools/bootstrap-recovery/README.md"
|
|
],
|
|
"disposition": "current"
|
|
},
|
|
{
|
|
"path": "tools/bootstrap-recovery/prepare-identity-coverage.py",
|
|
"inventory_sha256": "cd5f3067d28b4c7cc93ed08b8cf3869218bdecf7c54b5dffed22d697de71dbb1",
|
|
"present": true,
|
|
"drifted": false,
|
|
"last_change": "dca9992 2026-10-16",
|
|
"inventory_classification": "missing identity backup coverage proposal and metadata-only preparation; no live capture/grant/delivery capability",
|
|
"referenced_by": [],
|
|
"candidate_status": "unrouted: owner disposition needed",
|
|
"owner": "net-kingdom",
|
|
"credential_route": "read-only workload/PVC metadata",
|
|
"consumers": "identity-backup-profile.json proposal",
|
|
"native_evidence": "994d11c coverage proposal",
|
|
"next_task": "none",
|
|
"documented_in": [
|
|
"tools/bootstrap-recovery/README.md"
|
|
],
|
|
"disposition": "current (recovery tooling)"
|
|
},
|
|
{
|
|
"path": "tools/bootstrap-recovery/identity-backup-profile.json",
|
|
"inventory_sha256": "176c1f2f9111c2c51503212deb162274609d5e53bfe03d7319e19e44c5e09500",
|
|
"present": true,
|
|
"drifted": true,
|
|
"last_change": "a17aa7e 2026-10-16",
|
|
"inventory_classification": "missing identity backup coverage proposal and metadata-only preparation; no live capture/grant/delivery capability",
|
|
"referenced_by": [],
|
|
"candidate_status": "current (documented operator route)",
|
|
"owner": "net-kingdom (profile) / railiance-platform (job)",
|
|
"credential_route": "Platform attended Backup-account lane (railiance-platform owner custody)",
|
|
"consumers": "daily identity backup job (T14)",
|
|
"native_evidence": "drift = a17aa7e admitted host + live provider scope; T14 activation evidence",
|
|
"next_task": "NK-WP-0049-T24 (second provider)",
|
|
"documented_in": [
|
|
"docs/bootstrap-recovery-ceremony.md",
|
|
"registry/capabilities/capability.security.bootstrap-recovery.md",
|
|
"tools/bootstrap-recovery/README.md"
|
|
],
|
|
"disposition": "current"
|
|
}
|
|
],
|
|
"historical_objects": [
|
|
{
|
|
"object": "sso/keycape-pi-token",
|
|
"uid": "1d459ab6-8b42-454d-9220-0fa2ffe4e819",
|
|
"created": "2026-03-25",
|
|
"present_2026_10_15": true,
|
|
"current_source_readers": "none (check-user-mfa-state.sh retired the read; tests assert no output leak)",
|
|
"revocation_proven": false,
|
|
"disposition": "retired in source; object retained; revocation/deletion owner-deferred",
|
|
"next_task": "NK-WP-0049-T22 + NK-WP-0022 deletion approval"
|
|
},
|
|
{
|
|
"object": "mfa/privacyidea-trigger-admin",
|
|
"uid": "d1c643be-672d-4d13-8e46-3a58cb37ae39",
|
|
"created": "2026-03-25",
|
|
"present_2026_10_15": true,
|
|
"current_source_readers": "none found in repo source",
|
|
"revocation_proven": false,
|
|
"disposition": "retired in source; object retained; revocation/deletion owner-deferred",
|
|
"next_task": "NK-WP-0049-T22 + NK-WP-0022 deletion approval"
|
|
}
|
|
],
|
|
"undocumented_non_retired": [
|
|
"sso-mfa/bootstrap/creds-status.sh",
|
|
"sso-mfa/bootstrap/creds-verify.sh",
|
|
"sso-mfa/bootstrap/emergency-bundle.sh",
|
|
"sso-mfa/bootstrap/openbao-lab.py",
|
|
"sso-mfa/bootstrap/rotation-env.py",
|
|
"sso-mfa/bootstrap/sops-private.py",
|
|
"sso-mfa/bootstrap/sops-write.py"
|
|
],
|
|
"undocumented_note": "remaining entries are Make-routed bootstrap scripts (see referenced_by; documented by make help)"
|
|
} |