net-kingdom/docs/evidence/2026-10-03-open-dependency-reconciliation.md

Remaining NetKingdom dependency review

Review date: 2026-10-03. NK-WP-0045 remains finished with all six tasks done. Two read-only subagent reviews checked remaining plan requirements against owner source; no live changes or credential retrieval were performed.

Plan/task	Finding and next evidence needed
NK-WP-0011 T02–T09	Correct active/todo to blocked/wait under accepted ADR-0009. No named tenant, upstream IdP owner and unmet federation need is recorded. Non-secret admission packet prepared; runtime implementation stays unstarted.
NK-WP-0027 T02/T03	Repo-manager must accept the reef provider carrier/schema; railiance-infra must author bounds/conditions/evidence. Current reef-railiance declaration lacks posture_provider. Mechanical join remains dependent on that accepted shape.
NK-WP-0027 T06	First InfoTechCanon's disclosure/provenance ruling, then ops-warden mapping/tests. Public exists in the workload declaration but not the current maturity mapping; it cannot be aliased to synthetic.
NK-WP-0031 T04	audit-core tenancy declaration still lacks authoritative structured owner/freshness/replacement metadata for WH-ENG-20260822-AUDIT-E2-03. Use explicit current as-of on revalidation; unrelated restore evidence does not renew E2.
NK-WP-0035 T04	Upstream publication is already bound (candidate0.2.0, bundle b08b4d95fc4b0bd3). Correct the stale publication blocker to owner migration, incompatibility disposition and observed delivery/handoff.
NK-WP-0040 T02	No agreed execution-attribution emitter/holder/schema or actual owner receipt found. Local validation follows owner contract agreement, with observed readback and invalid/unknown/clock cases.
NK-WP-0042 T02	Accepted pilot journey and actual-user enrollment/return/recovery acceptance remain independent of the completed root-custody approval. Keep wait; IAM v0.4 remains proposed.

Reuse and delivery limits

AUDIT-WP-0009 T04/T05/T06 already implement heartbeat/cadence/reconciliation. The residual cadence request is source admission/mapping and observed results, not duplicate feature implementation. APPROVAL-WP-0002-T04 remains waiting for live admission/drain/reconciliation evidence; its cadence.yaml still needs the owner schema envelope. QONTO-WP-0005 T01/T02/T03 implement local declarations and heartbeat/reconciliation, but their completion does not establish envelope migration or observer acceptance. local-identity records its bootstrap-tool incompatibility and missing observer feed; preserve that disposition without claiming profile-wide adoption. Then obtain King's Guard handoff acceptance.

Existing federation reuse includes the PostgreSQL consumer admission tooling, the IAM conformance suite and access-engine normalized claims. Default platform-pg already has four catalogued consumers; explicit placement/capacity admission is required. No Keycloak consumer or assigned broker owner task was found. KEY-WP-0023's migration checks do not prove browser login/MFA or unchanged subject: the documented transform preserves the canonical ID as an attribute while changing sub. Do not use those receipts to close the new isolation drill.

Owner task references are recorded only where found. Missing assignments are requirements, not invented task IDs. Each external dependency needs an owner-attributed artifact and acceptance evidence before a NetKingdom wait task can progress. Existing blocked plans stay blocked.

Security orientation: package0.2.4, digest 025aab4f38246219c924bc94954e70ea0e6e7f72bcaf8d4344cd599602d345c3, start withheld/orientation-only because informed-decision changed. Reviewed local SECURITY-COMPANION, accepted ADRs and current informed-decision README directly; orientation is not an authorization or live readiness claim.