net-kingdom/.custodian-brief.md

Custodian Brief — net-kingdom

Domain: infotech
Last synced: 2026-10-14 22:34 UTC
State Hub: http://127.0.0.1:8000 (adjust if running on a remote machine)

Active Workstreams

Implement deterministic posture and evidence feedback

Progress: 4/5 done | workplan_id: 9d7b04f9-3803-5613-b7a5-8bd606c77f5a

Open tasks:

• ! Obtain audit-core freshness adoption 7d2029d2 (wait: audit-core tenancy.yaml must publish structured authoritative owner, observation/expiry and replacement-action metadata for WH-ENG-20260822-AUDIT-E2-03. Re-evaluate with explicit current as-of; later recovery prose does not renew E2.)

Publish the NetKingdom emission-cadence security profile

Progress: 4/5 done | workplan_id: 04685f94-1991-5e62-80d2-5669913e99fc

Open tasks:

• ! Bind and hand off the published contract e3fbc8b8 (wait: Approval Engine and Qonto owner declarations now pass the published schema and supplied-inventory profile; local-identity incompatibility is retained. Requires actual sender cadence mappings, lifecycle delivery/readback/reconciliation and Kings Guard operational feed evidence.)

Reconcile reef placement and security-zone canon dependencies

Progress: 3/6 done | workplan_id: 965ad365-6b81-50a1-a2a3-2d0c1fcce0b4

Open tasks:

• ! T02 — Extend provider declarations to reefs 5b35b646 (wait: Requires repo-manager acceptance of the reef provider carrier/schema, then railiance-infra authored ceilings, conditions and evidence in the authoritative reef declaration.)
• ! T03 — Reconcile reef ceilings mechanically e3f0bb0f (wait: Mechanical join of reef ceilings to consumer V declarations waits on T02.)
• ! T06 — Resolve the DataClassification mismatch bf8b3e1d (wait: Requires InfoTechCanon ruling on public disclosure classification versus synthetic provenance, then ops-warden authoritative dataclass_floor mapping and tests; no public-to-synthetic alias.)

Remove bootstrap secret output and verify separated recovery custody

Progress: 1/3 done | workplan_id: 17d315f0-829e-57c7-85cc-3a7914152804

Open tasks:

• ! Verify owner-approved recovery and current native callers d68cd4d3 (wait: Source caller reconciliation and exact owner-scoped isolated recovery ceremony are required; no live bootstrap or root retrieval is authorized by this source receipt.)
• ► Reconcile other legacy custody callers and root-output boundaries 479d6970

Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker

Progress: 1/9 done | workplan_id: 1075448f-d533-5f9e-94b7-c3adfe151a07

Open tasks:

• ! Admit the database consumer 2fe6f100 (wait: ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence.)
• ! Package the broker deployment 32d1411b (wait: ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment.)
• ! Integrate an upstream identity provider 6697a994 (wait: Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence.)
• ! Define federated assurance d845380d (wait: Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners.)
• ! Verify IAM conformance and coexistence 9cb7fd93 (wait: Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent.)
• ! Enforce tenant and platform boundaries 38998c68 (wait: Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission.)
• ! Prove recovery and audit delivery e5f44ddc (wait: Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent.)
• … and 1 more open tasks

Establish SecurityCaseTypes so that known security cases are light

Progress: 7/9 done | workplan_id: e31f3f9d-0748-5137-b0a3-7b3ca46a66eb

Open tasks:

• ! T05 — Acknowledge the type through informed-decision d9b26bcf (wait: Type1.2 architecture has a confirmed source-only founder acknowledgment; canonical1.1 remains unchanged/default and the1.2 reference case stays proposed. Needs explicit version selection/reference-source integration without normal admission bypass, closed owner adapters plus global/native receipt verifier (WARDEN-WP-0044-T03), independently verified six-object structural materialization and CCR42 claims/created-only provenance, exact broker/case/source reconciliation, then separately authorized native mint/delivery and attended registry/consumer verification. Source acknowledgment, a bundle or local tests do not prove implemented/materialized/live status.)
• ! T06 — First KnownSecurityCase: Forgejo c3c9c3ae (wait: The next types follow once the first one is proven end to end.)

Show who a workload sign-in actually is

Progress: 3/6 done | workplan_id: c1771c07-4466-5aa2-ad43-df63a471946b

Open tasks:

• ! Account site shows both sessions bdc8b414 (wait: Implemented in user-engine 80f5870 (USER-WP-0039). Waits for USER-WP-0039-T02: deploy and a mismatched-session check.)
• ! Enroll the negative-login factor afb5816f (wait: After T04 names the fixture uid. Founder enrolls its one-time password at https://pink-account.coulomb.social/, realm coulomb.)
• ! Hand the OpenBao proof back to its owners 86fb4a6b (wait: Implemented in ops-mason fca5591 (MASON-WP-0012) and railiance-platform 0f0282a (RPF-WP-0057). Waits for CCR-2026-0045 apply, overlay deploy, and the MASON-WP-0012-T04 live proof.)

Register Playwright human and agent consumers through governed identity delivery

Progress: 1/3 done | workplan_id: 06ba98d5-609e-5aaa-9bf7-4c4f4460e377

Open tasks:

• ! Verify issuer and real consumer acceptance 5a3aaf57 (wait: Await owner-scoped registry/custody activation, native cluster authentication and individual transport, then real human and agent acceptance under CUST-WP-0080-T05.)
• ► Deliver custody integration and guarded registration activation a9dadd07

Define an execution-attribution receipt for Railiance runs

Progress: 1/2 done | workplan_id: e2533f3a-aa43-59b3-bff3-8e64b6149487

Open tasks:

• ! Agree the evidence holder and schema with audit-core and Railiance 963120c1 (wait: Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance.)

Cut over NetKingdom identity to railiance01 and retire CoulombCore

Progress: 7/8 done | workplan_id: d76ddccc-00c8-548a-b141-2cd660fa38da

Open tasks:

• ! T08 - Final deletion and closure 42a3b4c0 (wait: Founder 2026-10-11: coulombcore is retired and the machine reused (D4 batch approved). Order: host-side inventory (containers, on-disk manifests; no kube API, certs expired 2026-08-31), then stop k3s for good and wipe for reuse. Executes after Sol's passing railiance01 restore/restart drill receipt. Never rotate certs or restart k3s there first.)

---

MCP Orientation (when available)

If the state-hub MCP server is reachable, call: get_domain_summary("infotech") This provides richer cross-domain context. If the MCP call fails, use this file as your orientation source.