net-kingdom/workplans/NK-WP-0050-playwright-consumer-registration.md

id	type	title	domain	repo	status	flavor	owner	topic_slug	created	updated	depends_on	related	state_hub_workstream_id
NK-WP-0050	workplan	Register Playwright human and agent consumers through governed identity delivery	infotech	net-kingdom	blocked	implementation	codex	netkingdom	2026-10-13	2026-10-28		CUST-WP-0080 RPF-WP-0056 RAPP-PLAYWRIGHT-WP-0004	06ba98d5-609e-5aaa-9bf7-4c4f4460e377

Accept NetKingdom's concrete implementation request c6b4dfb0-44d5-4f12-8854-2c38ab6dc454 (original 94a0096c-f34c-463c-b336-b13cf629b968). This is the missing registration-owner implementation, not another cross-owner coordination plan. Coordination remains CUST-WP-0080-T05; Platform and provider retain consumer/service acceptance. Initial eligibility of all identified platform humans and coding agents is already decided. Do not request another membership approval or reuse a shared admin identity, kubeconfig, SSH identity or existing OpenBao credential.

Blocked 2026-10-28 (founder triage): T02 waits on Platform custody/delivery and the real agent records, T03 on CUST-WP-0080-T05 acceptance. No NetKingdom-side step remains open. Return to active when Platform custody is in place.

Prepare exact registrations and preservation checks

id: NK-WP-0050-T01
status: done
priority: high
state_hub_task_id: "64893d94-9717-5812-b8e3-7cabe095fcdc"

docs/playwright-registration.md owns the bounded registration contract. sso-mfa/k8s/keycape/playwright-registration.py constructs the exact public PKCE record and distinct per-agent confidential registrations from existing identity references, with dedicated audience/scope and 15-minute agent lifetime. It reuses the existing byte-preserving registry adapter, refuses drift/shared references/unreviewed audience registrations and bounds the existing human issuer lifetime without modifying it. CLI emits only source proposals; no credential access, live mutation or fabricated SecurityCaseType acceptance.

Verified: nine new compiler/merge tests and 64 existing registration tests pass. The broader 159-test directory run passed 157 and failed two unchanged short-window OpenBao input tests; all seven tests in that module passed unchanged on rerun. Native KeyCape config/startup suites and the generated-registration token/JWKS fixture pass against committed issuer source 1344fc80e56315c5c99f58993f9ee02ce79e8a76. Public output exactly matches Platform's candidate. Synthetic identity references and local fixtures are not issuer-owner or real consumer acceptance.

Deliver custody integration and guarded registration activation

id: NK-WP-0050-T02
status: progress
priority: high
depends_on: [NK-WP-0050-T01]
state_hub_task_id: "a9dadd07-f136-5dc7-9229-7a9dbb941f0d"

Resolve the exact real agent records and Platform custody/delivery source task; add protected registration/config/Deployment integration using existing owner operations, exact source/object/revision bindings, pinned native check-config, created-only provenance, readback and guarded rollback. Prepare the concrete action before any needed privileged approval. Source work can proceed while owner acceptance is collected; custody and live grants must not be invented. Neither compiler output nor another client's acceptance authorizes live apply.

2026-10-13: private activation patch preparation implemented in playwright-activation.py. Original/candidate registry and Deployment state bind an exact proposal digest. Ordered stop/configure/resume avoids a registry/env startup race in the single-Recreate issuer. Native verifier digest checks, fresh object UID/resource-version/data/spec conditions, complete pod-quiescence checks, readback and exact original-state rollback retain pre-existing registrations and bindings. No mutation occurs from this module; the protected executor owns fresh reads, admitted custody, actual approval and live acceptance. Source tests cover partial recovery and independent RFC 6902 patch application; native KeyCape check-config accepts both synthetic configurations. Real identity/custody owner returns, executor/recovery-state integration, exact current image verification and the supervised maintenance action remain open.

Follow-up review reproduced two collision gaps: implicit client-ID audience and different env names referencing the same proposed agent Secret/key. Both are now refused; two new regressions failed before repair and pass afterward. This does not establish isolation outside the observed registry/issuer environment.

Verify issuer and real consumer acceptance

id: NK-WP-0050-T03
status: wait
priority: high
depends_on: [NK-WP-0050-T02, RPF-WP-0056-T03]
blocking_reason: "Await owner-scoped registry/custody activation, native cluster authentication and individual transport, then real human and agent acceptance under CUST-WP-0080-T05."
state_hub_task_id: "5a3aaf57-de5c-5a03-bc99-9bcf2fc5d95e"

Retain real human/agent issuance and identity/tenant/audience/scope/expiry proof, native negative cases, preserved existing login, renewal, removal and active connection termination. Hand the exact receipts to RPF-WP-0056-T03 and provider RAPP-PLAYWRIGHT-WP-0004-T01/T03. Do not introduce a reciprocal prerequisite on Platform activation: T02 owns issuer preparation/activation, T03 consumes final Platform end-to-end acceptance. Close only after the registration owner's requirements are proven; hand any residuals to live work records first.