coulomb/the-custodian
5
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

security: record platform group boundary regression and repair
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Reject generated-only commits / generated-commit-guard (push) Successful in 7s
Details

Browse source
This commit is contained in:
codex 2026-10-14 00:48:47 +02:00
parent 1bb46638a0
commit 880c224a4b
2 changed files with 52 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

42
docs/evidence/2026-10-14-netkingdom-security/platform-group-boundary.json Normal file
View file

@ -0,0 +1,42 @@
{
"observed_at": "2026-10-14",
"source_repo": "net-kingdom",
"source_base": "84c5dbeec8eb1f382febad6f21ed9533ffd2b313",
"workplan_id": "NK-WP-0049",
"task_id": "NK-WP-0049-T02",
"custodian_task_id": "CUST-WP-0080-T03",
"result": "platform_group_namespace_refused_before_directory_login_source_only",
"files": {
"identity-provisioner/provisioner.py": "bac0069de2552a2f226d788ab9891ab9362c65244e7cdf13e8b20d2c569e4618",
"identity-provisioner/tests/test_platform_group_boundary.py": "f8d212b18d80244095cad17f288b3d1062826833b169cdd325d9fcd13bdd0ec4",
"workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md": "1667f66b470f9b84cb7f98b77cecba27c08bf941974064f9ba3dce6f6aededd9"
},
"verification": {
"baseline_failures": 6,
"provider_tests": {
"run": 45,
"failures": 0,
"errors": 0,
"skipped": 0
},
"applied_files_match_manifest": true,
"log_digests": {
"baseline.log": "9e4f466dba09de41f01c881a42bbb965de2e546e279f867c839b838f62da8502",
"final-tests.log": "7e20d794037749de223fd0cec631e9b2ccc207f8770da8be280f56f3485e9b35"
},
"secret_scan": {
"status": "clean",
"changed_blobs": 3,
"version": "8.30.1"
}
},
"finding": "Service-group reserved prefixes covered netkingdom- suspension names but omitted net-kingdom- platform identity/admin groups. The old source accepted both existing platform names.",
"repair": "Reserve net-kingdom- in the existing shared validator. Both ensure and revoke refuse before directory login, including mixed requests and delete_if_empty. Ordinary service-group and tenant-access suites pass.",
"limits": [
"No provider rollout, credential access, directory mutation or native acceptance.",
"No assertion of past exploitation or currently deployed vulnerability from source alone.",
"Existing owner-scoped deployment and native verification are required before claiming live enforcement.",
"Other LDAP caller/transport and independent recovery work remains open under NK-WP-0049."
],
"source_commit": "e861f63513859d5240773ce72e162b303fa7b9e4"
}

10
workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md
View file

@ -469,6 +469,16 @@ No runtime/account/credential changed. Group bootstrap, membership management,
verify-t07, incident-cutover callers, complete inventory and native independent
recovery remain open under NK-WP-0049; G08 and this task remain progress.
2026-10-14 provider boundary follow-up: NetKingdom `e861f63` reserves
`net-kingdom-` platform groups in the existing service-group request validator.
Prior source rejected `netkingdom-` suspension names but accepted the actual
platform users/admins namespace. Six regressions reproduce reaching directory
login from both ensure/revoke before repair; all 45 provider tests pass afterward.
Mixed requests and delete-if-empty also refuse before login. Receipt:
`docs/evidence/2026-10-14-netkingdom-security/platform-group-boundary.json`.
No rollout or live directory mutation; exact owner deployment and native checks
remain necessary before claiming live enforcement. NK-WP-0049 stays active.
## Verify native closure against every requirement
```task