diff --git a/plans/fluid-telegram-operator-credential-lane.md b/plans/fluid-telegram-operator-credential-lane.md index 96bf329..5f77372 100644 --- a/plans/fluid-telegram-operator-credential-lane.md +++ b/plans/fluid-telegram-operator-credential-lane.md @@ -118,9 +118,9 @@ until recovery is verified and must never be exposed through this OIDC role. `b2ed890f-a05a-4b96-95eb-2cd9d8b32caa`, key-cape `e0b5fae`). Human ID tokens always carry `groups` (LLDAP group names); `aal2` is set only after a verified privacyIDEA factor, the same pin as CCR-2026-0034. -- precondition: LLDAP group `fluid-telegram-operators` does not exist yet; - creating it with its members is a NetKingdom directory act needing the - founder go. KeyCape does not create groups. +- precondition: LLDAP group `fluid-telegram-operators`, initial member + `tegwick` only. Founder go given 2026-10-08; net-kingdom creates it (message + `259ec26d`). KeyCape does not create groups. - callbacks (subset of the `openbao-admin` client registration): `http://localhost:8250/oidc/callback`, `http://127.0.0.1:8250/oidc/callback`, `http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback`. Never the diff --git a/workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md b/workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md index d8feadd..9841fcf 100644 --- a/workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md +++ b/workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md @@ -44,8 +44,8 @@ consumer workplan `FT-WP-0002` (`f2373858-c932-5a4d-81b6-db9a3595135a`). ```task id: MASON-WP-0005-T01 status: wait -blocked_on: human -blocking_reason: "Claim, assurance and callbacks confirmed by key-cape (2026-10-08). Remaining: founder go for net-kingdom to create LLDAP group fluid-telegram-operators with its members, and a scoped OpenBao grant (bao-session.sh grant MASON-WP-0005-T01) for the live survey." +blocked_on: message-from:net-kingdom +blocking_reason: "Founder go given 2026-10-08 (group fluid-telegram-operators, member tegwick); net-kingdom creates it and returns metadata-only evidence. Also needs a scoped OpenBao grant (bao-session.sh grant MASON-WP-0005-T01) for the live survey." priority: high state_hub_task_id: "18c9099f-882f-575c-93b9-cc68d7fbc2af" ``` @@ -82,6 +82,11 @@ public one (`tests/test_oidc_matrix.py`, 153 passed). Two inputs remain, both human: the founder go for net-kingdom to create the LLDAP group with its members, and a scoped grant for the live survey (no operator session today). +2026-10-08: founder go given in this session: create LLDAP group +`fluid-telegram-operators` with the single initial member `tegwick`. Sent to +net-kingdom (message `259ec26d`), which owns directory acts; ops-mason does not +write LLDAP. Waiting for net-kingdom's metadata-only evidence. + ## Extend the construction and credential-change contracts ```task