coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
net-kingdom/docs
History
tegwick e7d326458c
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
docs(custody): every credential says what it is 
Five custom_metadata fields on every path in operators/ and
platform/workloads/: description, owner, used_by, rotation, on_loss.
Non-secret, so anyone orienting themselves can read all of them without
being granted a value.

on_loss is the field the section exists for. When the LLDAP admin
predecessor was destroyed on 2026-08-27 the answer had to be
reconstructed from first principles under pressure; written down in
advance it is one line.

used_by is the second lesson: rotation without a consumer list is how
privacyIDEA's resolver was left holding a superseded bind credential for
four days while everything else had been reconciled.

Inventory with ops-mason/scripts/custody-inventory.py. It reports 21
paths today, 17 undescribed — the four described are the ones this
session touched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3377672@bnt-lap001
Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166
2026-08-28 11:42:51 +02:00
..
adr docs(canon): reconcile workload and tenant grouping semantics 2026-08-22 14:53:31 +02:00
architecture Separate IAM Profile ids and mark v0.2 superseded 2026-08-19 01:09:18 +02:00
evidence Complete user-engine runtime custody 2026-07-30 00:40:43 +02:00
intakes Add NK-WP-0021 for activity-core ops SSO least-privilege. 2026-07-22 15:21:22 +02:00
reviews Split user-engine implementation planning 2026-05-22 19:50:12 +02:00
attended-procedure-standard.md docs: name where operator credentials live, and label unexercised procedures 2026-08-28 10:33:48 +02:00
keycape-exposure-resolver-reconciliation.md docs: name where operator credentials live, and label unexercised procedures 2026-08-28 10:33:48 +02:00
LocalIdentity.md Local Identity OICD bootstrap 2026-05-02 16:58:44 +02:00
NetkingdomRuntimeArchitecture.md feat(NK-WP-0032): admit OpenBao operator loopback callback 2026-08-23 14:01:57 +02:00
object-storage-sts-credential-vending.md Implement NK-WP-0012 IAM profile specification 2026-05-22 14:35:31 +02:00
openbao-attended-ceremony-runbook.md NET-WP-0020 finished: attended-ceremony + auto-unseal-transit profiles, greenfield init/unseal proof 2026-07-02 22:08:33 +02:00
openbao-unseal-custody-models.md NET-WP-0020 finished: attended-ceremony + auto-unseal-transit profiles, greenfield init/unseal proof 2026-07-02 22:08:33 +02:00
platform-identity-security-architecture.md fix(workplans): normalize legacy task identifiers 2026-08-21 23:51:36 +02:00
platform-root-custody.md docs(custody): every credential says what it is 2026-08-28 11:42:51 +02:00
princedom-isolation-exploration.md Exploring multi tenancy 2026-05-25 21:47:40 +02:00
public-registration-orchestration-contract.md Resume user-engine integration rollout 2026-08-13 14:56:53 +02:00
railiance01-coulombcore-cutover-inventory-2026-07-28.md Advance pre-cutover identity conformance 2026-07-28 16:48:47 +02:00
reef-posture-provider-contract.md docs(canon): reconcile workload and tenant grouping semantics 2026-08-22 14:53:31 +02:00
responsibility-map.md Repo hygiene: fill stack-and-commands, normalize workplan statuses 2026-07-02 00:21:49 +02:00
secrets-engine-security-infrastructure-boundary.md Repo hygiene: fill stack-and-commands, normalize workplan statuses 2026-07-02 00:21:49 +02:00
security-bootstrap-age-custody.md Clarifications on sops 2026-06-14 19:51:05 +02:00
security-bootstrap-handover-cleanup.md openbao king credential bootstrapping 2026-05-24 09:26:02 +02:00
security-bootstrap-king-credential-kit.md bootstrapping guidance ui and missing stuff 2026-05-24 17:04:15 +02:00
security-bootstrap-openbao-ceremony-ux.md Guide OpenBao custody ceremony order 2026-05-25 02:02:14 +02:00
security-bootstrap-operator-journey.md openbao king credential bootstrapping 2026-05-24 09:26:02 +02:00
security-bootstrap-rebuild-risk-and-rehearsal.md NET-WP-0018 T09: Assess scratch-rebuild risk and define rehearsal plan 2026-06-04 00:50:18 +02:00
security-bootstrap-related-workplan-review.md openbao king credential bootstrapping 2026-05-24 09:26:02 +02:00
security-bootstrap-retrospective.md feat(NET-WP-0018-T03): initial retrospective + gap matrix (substantial draft) 2026-06-03 16:31:08 +02:00
security-bootstrap-use-cases.md openbao king credential bootstrapping 2026-05-24 09:26:02 +02:00
security-bootstrap-user-lifecycle.md openbao king credential bootstrapping 2026-05-24 09:26:02 +02:00
smooth-bootstrap-guide.md feat(NK-WP-0032): admit OpenBao operator loopback callback 2026-08-23 14:01:57 +02:00
user-engine-enterprise-identity-extension-points.md Deploy identity drift reconciliation 2026-07-29 23:41:42 +02:00
user-engine-interface-guidance.md docs: persist user-engine vs net-kingdom integration assessment (new doc + cross-references in SCOPE, boundary contract, guidance, responsibility map, 0018/0019 workplans). Also updated user-engine integration doc to reference it. 2026-06-03 10:33:31 +02:00
user-engine-netkingdom-integration-assessment.md docs: persist user-engine vs net-kingdom integration assessment (new doc + cross-references in SCOPE, boundary contract, guidance, responsibility map, 0018/0019 workplans). Also updated user-engine integration doc to reference it. 2026-06-03 10:33:31 +02:00
user-engine-platform-expansion-contract.md Activate expanded portal integration gate 2026-08-09 02:00:58 +02:00
user-engine-provisioning-contract.md Define user-engine portal integration boundary 2026-07-27 22:48:58 +02:00