From fb6f373fec24c7c00d26f000da246c7422d187a5 Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 8 Oct 2026 23:49:48 +0200 Subject: [PATCH] MASON-WP-0005-T01: founder go for LLDAP group fluid-telegram-operators Single initial member tegwick. Handed to net-kingdom (directory owner); T01 now waits on its metadata-only evidence and a scoped survey grant. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 327203@bnt-lap001 Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0 --- plans/fluid-telegram-operator-credential-lane.md | 6 +++--- ...ON-WP-0005-fluid-telegram-operator-credential-lane.md | 9 +++++++-- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/plans/fluid-telegram-operator-credential-lane.md b/plans/fluid-telegram-operator-credential-lane.md index 96bf329..5f77372 100644 --- a/plans/fluid-telegram-operator-credential-lane.md +++ b/plans/fluid-telegram-operator-credential-lane.md @@ -118,9 +118,9 @@ until recovery is verified and must never be exposed through this OIDC role. `b2ed890f-a05a-4b96-95eb-2cd9d8b32caa`, key-cape `e0b5fae`). Human ID tokens always carry `groups` (LLDAP group names); `aal2` is set only after a verified privacyIDEA factor, the same pin as CCR-2026-0034. -- precondition: LLDAP group `fluid-telegram-operators` does not exist yet; - creating it with its members is a NetKingdom directory act needing the - founder go. KeyCape does not create groups. +- precondition: LLDAP group `fluid-telegram-operators`, initial member + `tegwick` only. Founder go given 2026-10-08; net-kingdom creates it (message + `259ec26d`). KeyCape does not create groups. - callbacks (subset of the `openbao-admin` client registration): `http://localhost:8250/oidc/callback`, `http://127.0.0.1:8250/oidc/callback`, `http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback`. Never the diff --git a/workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md b/workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md index d8feadd..9841fcf 100644 --- a/workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md +++ b/workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md @@ -44,8 +44,8 @@ consumer workplan `FT-WP-0002` (`f2373858-c932-5a4d-81b6-db9a3595135a`). ```task id: MASON-WP-0005-T01 status: wait -blocked_on: human -blocking_reason: "Claim, assurance and callbacks confirmed by key-cape (2026-10-08). Remaining: founder go for net-kingdom to create LLDAP group fluid-telegram-operators with its members, and a scoped OpenBao grant (bao-session.sh grant MASON-WP-0005-T01) for the live survey." +blocked_on: message-from:net-kingdom +blocking_reason: "Founder go given 2026-10-08 (group fluid-telegram-operators, member tegwick); net-kingdom creates it and returns metadata-only evidence. Also needs a scoped OpenBao grant (bao-session.sh grant MASON-WP-0005-T01) for the live survey." priority: high state_hub_task_id: "18c9099f-882f-575c-93b9-cc68d7fbc2af" ``` @@ -82,6 +82,11 @@ public one (`tests/test_oidc_matrix.py`, 153 passed). Two inputs remain, both human: the founder go for net-kingdom to create the LLDAP group with its members, and a scoped grant for the live survey (no operator session today). +2026-10-08: founder go given in this session: create LLDAP group +`fluid-telegram-operators` with the single initial member `tegwick`. Sent to +net-kingdom (message `259ec26d`), which owns directory acts; ops-mason does not +write LLDAP. Waiting for net-kingdom's metadata-only evidence. + ## Extend the construction and credential-change contracts ```task