coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
net-kingdom/workplans/ADHOC-2026-08-14.md
codex 82452d655f
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
fix(workplans): adopt ADR-007 derived identifiers for unregistered records 
These workplans exist only in the retired local hub. Their random pre-ADR-007
identifiers are refused by C-06 as stale references, so they cannot be
registered. Deriving from the canonical record id takes no identity from
anything: central does not hold them and the old ids die with the cache.

Records central already holds were deliberately left untouched.

Refs CUST-WP-0068-T06

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
2026-08-25 20:14:28 +02:00

2.4 KiB
Raw Blame History

id type title domain repo status owner topic_slug created updated state_hub_workstream_id
ADHOC-2026-08-14 workplan Close NK-WP-0025 residuals infotech net-kingdom finished codex netkingdom 2026-08-14 2026-08-14 a5097121-1461-59f8-81fa-e6ecef527337

ADHOC-2026-08-14 - NK-WP-0025 residual closeout

Reconcile Coulomb Social Case B residual records

id: ADHOC-2026-08-14-T01
status: done
priority: medium
state_hub_task_id: "9eaad1fd-695c-5df3-aec2-012e4a4bc8c8"

Update the owning smoke evidence and close or narrow CSOC-IN-0001 and CSOC-IN-0002 now that NK-WP-0025 completed the public registration, OIDC/JIT, repeat-login, collision, redirect, and assurance evidence.

Protect the canonical LDAP-DN subject contract

id: ADHOC-2026-08-14-T02
status: done
priority: medium
state_hub_task_id: "31319b1b-8b55-59fe-b3d7-4486f1928b4c"

Add focused regression coverage for the canonical LDAP-DN OIDC subject and the reverse normalization used by directory lifecycle and password setup.

Persist the audit-core multi-tenant sender scope

id: ADHOC-2026-08-14-T03
status: done
priority: high
state_hub_task_id: "90250faf-0022-5553-b832-a51f775166a8"

Move the live user-engine sender registry from its manually minted Secret to the authoritative OpenBao/ExternalSecret path with source-bound write-only scope and tenants: ["*"], without reading or logging its token.

2026-08-14 probe: the live Secret has the correct redacted scope, but platform/workloads/audit-core/senders does not exist. ClusterSecretStore openbao-audit-core is present and can read only that exact path. The current workstation OpenBao identity returns 403 and credential routing exposes no resolvable write grant. Completion therefore waits for a short-lived platform-admin OpenBao session to perform the documented wrapped migration; the temporary probe ExternalSecret was removed.

Done 2026-08-14: after an attended KeyCape/MFA platform-admin login, the existing registry was streamed directly from Kubernetes to OpenBao without printing or staging it. OpenBao created version 1; ExternalSecret audit-core-senders became SecretSynced and owns the derived Secret. Its base64 checksum remained dcf342e33fd326c536ee3ada443f294221836e226e5924ac1b2ec490631a3cdb, proving the migration did not change the live document. The audit-core rollout completed and /readyz returned durable archive custody.