From 880c224a4b2b117bf1a945e98aec31544a87cdcd Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Wed, 14 Oct 2026 00:48:47 +0200
Subject: [PATCH] security: record platform group boundary regression and
 repair

---
 .../platform-group-boundary.json              | 42 +++++++++++++++++++
 ...gdom-security-blueprint-and-gap-closure.md | 10 +++++
 2 files changed, 52 insertions(+)
 create mode 100644 docs/evidence/2026-10-14-netkingdom-security/platform-group-boundary.json

diff --git a/docs/evidence/2026-10-14-netkingdom-security/platform-group-boundary.json b/docs/evidence/2026-10-14-netkingdom-security/platform-group-boundary.json
new file mode 100644
index 00000000..940f2458
--- /dev/null
+++ b/docs/evidence/2026-10-14-netkingdom-security/platform-group-boundary.json
@@ -0,0 +1,42 @@
+{
+  "observed_at": "2026-10-14",
+  "source_repo": "net-kingdom",
+  "source_base": "84c5dbeec8eb1f382febad6f21ed9533ffd2b313",
+  "workplan_id": "NK-WP-0049",
+  "task_id": "NK-WP-0049-T02",
+  "custodian_task_id": "CUST-WP-0080-T03",
+  "result": "platform_group_namespace_refused_before_directory_login_source_only",
+  "files": {
+    "identity-provisioner/provisioner.py": "bac0069de2552a2f226d788ab9891ab9362c65244e7cdf13e8b20d2c569e4618",
+    "identity-provisioner/tests/test_platform_group_boundary.py": "f8d212b18d80244095cad17f288b3d1062826833b169cdd325d9fcd13bdd0ec4",
+    "workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md": "1667f66b470f9b84cb7f98b77cecba27c08bf941974064f9ba3dce6f6aededd9"
+  },
+  "verification": {
+    "baseline_failures": 6,
+    "provider_tests": {
+      "run": 45,
+      "failures": 0,
+      "errors": 0,
+      "skipped": 0
+    },
+    "applied_files_match_manifest": true,
+    "log_digests": {
+      "baseline.log": "9e4f466dba09de41f01c881a42bbb965de2e546e279f867c839b838f62da8502",
+      "final-tests.log": "7e20d794037749de223fd0cec631e9b2ccc207f8770da8be280f56f3485e9b35"
+    },
+    "secret_scan": {
+      "status": "clean",
+      "changed_blobs": 3,
+      "version": "8.30.1"
+    }
+  },
+  "finding": "Service-group reserved prefixes covered netkingdom- suspension names but omitted net-kingdom- platform identity/admin groups. The old source accepted both existing platform names.",
+  "repair": "Reserve net-kingdom- in the existing shared validator. Both ensure and revoke refuse before directory login, including mixed requests and delete_if_empty. Ordinary service-group and tenant-access suites pass.",
+  "limits": [
+    "No provider rollout, credential access, directory mutation or native acceptance.",
+    "No assertion of past exploitation or currently deployed vulnerability from source alone.",
+    "Existing owner-scoped deployment and native verification are required before claiming live enforcement.",
+    "Other LDAP caller/transport and independent recovery work remains open under NK-WP-0049."
+  ],
+  "source_commit": "e861f63513859d5240773ce72e162b303fa7b9e4"
+}
diff --git a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md
index e6152d21..cf77c63b 100644
--- a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md
+++ b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md
@@ -469,6 +469,16 @@ No runtime/account/credential changed. Group bootstrap, membership management,
 verify-t07, incident-cutover callers, complete inventory and native independent
 recovery remain open under NK-WP-0049; G08 and this task remain progress.
 
+2026-10-14 provider boundary follow-up: NetKingdom `e861f63` reserves
+`net-kingdom-` platform groups in the existing service-group request validator.
+Prior source rejected `netkingdom-` suspension names but accepted the actual
+platform users/admins namespace. Six regressions reproduce reaching directory
+login from both ensure/revoke before repair; all 45 provider tests pass afterward.
+Mixed requests and delete-if-empty also refuse before login. Receipt:
+`docs/evidence/2026-10-14-netkingdom-security/platform-group-boundary.json`.
+No rollout or live directory mutation; exact owner deployment and native checks
+remain necessary before claiming live enforcement. NK-WP-0049 stays active.
+
 ## Verify native closure against every requirement
 
 ```task