coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
net-kingdom/docs/evidence/2026-10-31-nk56-t09-synthetic-identity
History
tegwick 661ab6a52e
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
NK-WP-0056-T09 done: syn-journey live, synthetic journey passes at aal2 
Founder-run under CCR-2026-0057: KeyCape client registered, lane.py setup
(privacyIDEA-generated key, KV v1) and verify passed; the live journey
reached aal2 with otp against kc.coulomb.social. Receipts, findings and the
one teardown of a partial run in docs/evidence. syn-journey declared active.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
2026-10-31 13:33:31 +01:00
..
00-setup-refused-absent.json NK-WP-0056-T09: lane looks up the privacyIDEA token by serial; name login failures 2026-10-31 13:01:42 +01:00
00-setup-refused-pi-admin-login.json NK-WP-0056-T09: enroll with a privacyIDEA-generated key, write KV last 2026-10-31 13:23:47 +01:00
00-verify-before-setup.json NK-WP-0056-T09: enroll with a privacyIDEA-generated key, write KV last 2026-10-31 13:23:47 +01:00
01-setup.json NK-WP-0056-T09: enroll with a privacyIDEA-generated key, write KV last 2026-10-31 13:23:47 +01:00
10-teardown.json NK-WP-0056-T09 done: syn-journey live, synthetic journey passes at aal2 2026-10-31 13:33:31 +01:00
11-setup.json NK-WP-0056-T09 done: syn-journey live, synthetic journey passes at aal2 2026-10-31 13:33:31 +01:00
12-verify.json NK-WP-0056-T09 done: syn-journey live, synthetic journey passes at aal2 2026-10-31 13:33:31 +01:00
README.md NK-WP-0056-T09 done: syn-journey live, synthetic journey passes at aal2 2026-10-31 13:33:31 +01:00

README.md

NK-WP-0056-T09: synthetic journey identity live (2026-10-31)

Founder-run, attended. claude-code prepared the tooling and guided the run. Under CCR-2026-0057 (railiance-platform 2ac9786, sha256 4a966885…8754) and the accepted SecurityCase nk-synthetic-journey (net-kingdom d654f8a):

  1. The KeyCape client nk-synthetic-journey (public, PKCE, MFA pinned) was registered with keycape-client.py apply (check-config from the deployed e2b5fa1 binary) and KeyCape restarted.
  2. lane.py setup fenced coding agents from the KV path and created syn-journey in LLDAP with no groups and a generated password. It enrolled TOTP token SYNJOURNEY01 in realm coulomb with a key generated by privacyIDEA, confirmed with a code, and wrote PASSWORD and TOTP_SEED to platform/workloads/net-kingdom/synthetic-journey/syn-journey (KV v1, CAS=0). No workload role.
  3. lane.py verify: the KV holds exactly the two fields, the fence is present, no workload role exists, the KV password signs in to LLDAP, and the synthetic journey passed against https://kc.coulomb.social: aal2, methods pwd+otp, signature verified against KeyCape's JWKS, preferred_username matched. About 3 s end to end.
Receipt Result
00-setup-refused-absent.json refused, nothing changed (privacyIDEA token lookup by a user that did not resolve yet, or the pi-admin login)
00-setup-refused-pi-admin-login.json refused at the pi-admin sign-in, nothing changed
00-verify-before-setup.json expected failure: no KV yet
01-setup.json stopped at /token/init after the user and KV v1 were written (see finding 1)
10-teardown.json removed that partial state: token, user, KV
11-setup.json identity_prepared, key generated by privacyIDEA, enrollment confirmed with a code
12-verify.json identity_verified, journey pass (embedded, value-free)

All receipts were scanned for secret-shaped strings before commit. They hold identifiers, versions and booleans only.

Findings

  1. privacyIDEA silently replaces a supplied TOTP key for pi-admin. An admin policy with action=* (as pi-admin-all-rights) enables totp_force_server_generate, so otpkey is ignored and the confirmation with a code from the supplied key fails (ERR905). This was reproduced on the pinned 3.12.2 image. The lane now enrolls with genkey=1 and takes the seed from the enrollment response, in memory only. Any tool that enrolls a known seed as pi-admin has the same problem.
  2. Listing privacyIDEA tokens by a user that does not resolve is an error, not an empty list. The lane looks tokens up by serial.
  3. Live KeyCape issues tokens to a user with no groups and no tenant mapping. The open point in the runbook is answered.
  4. Still open, recorded in CCR-2026-0057: KeyCape marks the token principal_type: human, and KeyCape has no per-client group gate.