coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
net-kingdom/docs
History
tegwick abed4360d4 NK-WP-0056-T10: journey-only executor mode; fail-closed proof on the T08 stack 
cli.py --journey-only: read-only, no admission; journey-read role only
(CCR-2026-0059), no Kubernetes/directory client, no approval or audit call;
exit 0 pass / 1 fail closed / 4 refused. Shared operations.journey_from_kv
with the admission check. Synthetic proof: healthy pass, broken svc-authelia
bind fails closed at authelia_first_factor, restored pass, journey token
cannot read the bind; all_met, no values. 45 executor tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
2026-10-31 19:56:52 +01:00
..
adr NK-WP-0055-T10: founder production-scope decisions; ADR-0018 defers Topaz 2026-10-27 22:24:54 +01:00
architecture Give changed draft publications new immutable revision identities 2026-10-11 02:25:23 +02:00
contracts Accept live empty custody integration and isolated recovery evidence 2026-10-03 20:35:46 +02:00
evidence NK-WP-0056-T10: journey-only executor mode; fail-closed proof on the T08 stack 2026-10-31 19:56:52 +01:00
intakes Add NK-WP-0021 for activity-core ops SSO least-privilege. 2026-07-22 15:21:22 +02:00
proposals NK-WP-0056-T02: note all misattributed hub replies 2026-10-31 14:35:59 +01:00
reviews Publish reviewed bounded JWT ready handoff and retained owner history 2026-10-11 18:31:04 +02:00
tutorials Follow the access-engine CLI rename: ./cmd/flex-auth -> ./cmd/access-engine 2026-10-10 15:28:05 +02:00
attended-procedure-inventory.md Harden remaining bootstrap custody callers and prepare isolated recovery 2026-10-15 22:57:14 +02:00
attended-procedure-standard.md fix: preserve resolver configuration during attended password cutover 2026-10-14 01:52:37 +02:00
audit-core-intake-identity-providers.md NK-WP-0055-T11: audit-core intake packages for Authelia, LLDAP, privacyIDEA (draft) 2026-10-27 23:30:14 +01:00
bootstrap-recovery-ceremony.md NK-WP-0049-T33: independent attempt receipt verifier, retained location and ACME reissue step 2026-10-23 00:22:50 +02:00
crisis-custody-list.md NK-WP-0054: founder decision 9f0f7a87 - split goes live this week, admin dispositions, crisis list confirmed 2026-10-28 18:53:10 +01:00
disaster-recovery-storage-share.md NK-WP-0055-T13: production generate-root listener live; DR guide and crisis list updated 2026-10-28 00:06:55 +01:00
forgejo-type12-source-acknowledgment-followthrough.md Select explicitly pinned security case type revisions without fallback 2026-10-11 09:09:24 +02:00
identity-provisioner-bind-repair.md Pin identity-provisioner digest and readiness to directory preflight 2026-09-14 04:57:39 +02:00
identity-restore-drill.md NK-WP-0054-T05: post-split restore drill passed as admin; SI-X1 retired 2026-10-31 08:31:17 +01:00
identity-service-restore-packet.md NK-WP-0049-T19: done; founder ran the isolated existing-token MFA check on the actual backup 2026-10-24 18:49:33 +02:00
keycape-approval-clients-rollout.md feat: accept KeyCape approval clients with tested recovery 2026-09-09 02:18:12 +02:00
keycape-exposure-resolver-reconciliation.md fix: preserve resolver configuration during attended password cutover 2026-10-14 01:52:37 +02:00
keycape-upstream-issuer-pin.md Record exercised live issuer pin and unchanged production deployment 2026-09-09 00:40:23 +02:00
legacy-lldap-lifecycle-retirement.md security: repair LDAP group callers and fail incomplete T07 acceptance 2026-10-14 01:17:35 +02:00
LocalIdentity.md Local Identity OICD bootstrap 2026-05-02 16:58:44 +02:00
NetkingdomRuntimeArchitecture.md security: retire unsafe legacy LDAP lifecycle callers 2026-10-14 00:08:42 +02:00
nk49-phase-b-admission.example.json NK-WP-0049-T43: phase B plan, unsigned admission template and decision; refresh position 2026-10-24 18:54:25 +02:00
nk49-phase-b-plan.md NK-WP-0049-T43: record founder answers; owner requests sent 2026-10-27 19:05:27 +01:00
object-storage-sts-credential-vending.md Implement NK-WP-0012 IAM profile specification 2026-05-22 14:35:31 +02:00
openbao-attended-ceremony-runbook.md NET-WP-0020 finished: attended-ceremony + auto-unseal-transit profiles, greenfield init/unseal proof 2026-07-02 22:08:33 +02:00
openbao-unseal-custody-models.md Harden remaining bootstrap custody callers and prepare isolated recovery 2026-10-15 22:57:14 +02:00
platform-identity-security-architecture.md Accept ADR-0009 with tenant-selectable isolation upgrade path 2026-09-28 23:41:12 +02:00
platform-root-custody.md security: retire unsafe legacy LDAP lifecycle callers 2026-10-14 00:08:42 +02:00
playwright-registration.md security: reject Playwright audience and delivery alias collisions 2026-10-13 23:44:41 +02:00
princedom-isolation-exploration.md Exploring multi tenancy 2026-05-25 21:47:40 +02:00
public-registration-orchestration-contract.md Resume user-engine integration rollout 2026-08-13 14:56:53 +02:00
railiance01-coulombcore-cutover-inventory-2026-07-28.md Advance pre-cutover identity conformance 2026-07-28 16:48:47 +02:00
reef-posture-provider-contract.md docs(canon): reconcile workload and tenant grouping semantics 2026-08-22 14:53:31 +02:00
responsibility-map.md Repo hygiene: fill stack-and-commands, normalize workplan statuses 2026-07-02 00:21:49 +02:00
secrets-engine-security-infrastructure-boundary.md Repo hygiene: fill stack-and-commands, normalize workplan statuses 2026-07-02 00:21:49 +02:00
security-bootstrap-age-custody.md fix(security): constrain SOPS writes and custody argument handoff 2026-10-13 21:03:24 +02:00
security-bootstrap-handover-cleanup.md openbao king credential bootstrapping 2026-05-24 09:26:02 +02:00
security-bootstrap-king-credential-kit.md bootstrapping guidance ui and missing stuff 2026-05-24 17:04:15 +02:00
security-bootstrap-openbao-ceremony-ux.md Guide OpenBao custody ceremony order 2026-05-25 02:02:14 +02:00
security-bootstrap-operator-journey.md openbao king credential bootstrapping 2026-05-24 09:26:02 +02:00
security-bootstrap-rebuild-risk-and-rehearsal.md security: retire unsafe legacy LDAP lifecycle callers 2026-10-14 00:08:42 +02:00
security-bootstrap-related-workplan-review.md openbao king credential bootstrapping 2026-05-24 09:26:02 +02:00
security-bootstrap-retrospective.md security: retire unsafe legacy LDAP lifecycle callers 2026-10-14 00:08:42 +02:00
security-bootstrap-use-cases.md openbao king credential bootstrapping 2026-05-24 09:26:02 +02:00
security-bootstrap-user-lifecycle.md security: retire unsafe legacy LDAP lifecycle callers 2026-10-14 00:08:42 +02:00
security-case-execution-owner-review.md Preserve October 10 owner decision source packets 2026-10-11 18:46:21 +02:00
security-case-execution-owner-review.sources.json Preserve October 10 owner decision source packets 2026-10-11 18:46:21 +02:00
security-case-type-inventory.md NK-WP-0048-T02 done: SecurityCaseType inventory 2026-10-08 22:21:40 +02:00
security-layer-v0.8-acceptance.md Accept security layer v0.8 from confirmed native review 2026-10-11 01:53:56 +02:00
security-layer-v0.8-publication-readiness.md Preserve October 10 owner decision source packets 2026-10-11 18:46:21 +02:00
security-layer-v0.8-publication-readiness.sources.json Preserve October 10 owner decision source packets 2026-10-11 18:46:21 +02:00
service-group-provenance.md feat(identity): add PostgreSQL provenance and verify sealed SOPS custody 2026-10-17 01:36:38 +02:00
service-identity-inventory.md NK-WP-0054-T03b: declarations and validator migrated to canon grants (draft-3) 2026-10-24 23:35:30 +02:00
sign-in-diagnosis.md Complete NK-WP-0051 with attended member and refusal evidence 2026-10-15 19:23:19 +02:00
smooth-bootstrap-guide.md security: retire unsafe legacy LDAP lifecycle callers 2026-10-14 00:08:42 +02:00
storage-share-recovery-publication.md Accept independent outage recovery and Storage Share guide publication 2026-10-16 20:04:44 +02:00
user-engine-enterprise-identity-extension-points.md Deploy identity drift reconciliation 2026-07-29 23:41:42 +02:00
user-engine-interface-guidance.md docs: persist user-engine vs net-kingdom integration assessment (new doc + cross-references in SCOPE, boundary contract, guidance, responsibility map, 0018/0019 workplans). Also updated user-engine integration doc to reference it. 2026-06-03 10:33:31 +02:00
user-engine-netkingdom-integration-assessment.md docs: persist user-engine vs net-kingdom integration assessment (new doc + cross-references in SCOPE, boundary contract, guidance, responsibility map, 0018/0019 workplans). Also updated user-engine integration doc to reference it. 2026-06-03 10:33:31 +02:00
user-engine-platform-expansion-contract.md Activate expanded portal integration gate 2026-08-09 02:00:58 +02:00
user-engine-provisioning-contract.md Define user-engine portal integration boundary 2026-07-27 22:48:58 +02:00
verification-audit-2026-09-05.md Validate cadence contract and require functional MFA verification 2026-09-05 01:28:05 +02:00
verify-t06.md security: preserve realm configuration and remove shell credential evaluation 2026-10-13 22:47:24 +02:00