diff --git a/docs/evidence/2026-10-13-netkingdom-security/realm-bootstrap-repair.json b/docs/evidence/2026-10-13-netkingdom-security/realm-bootstrap-repair.json new file mode 100644 index 00000000..74ce562d --- /dev/null +++ b/docs/evidence/2026-10-13-netkingdom-security/realm-bootstrap-repair.json @@ -0,0 +1,169 @@ +{ + "observed_at": "2026-10-13", + "source_repo": "net-kingdom", + "source_base": "96feef46ab22811e3736231f04818655ca7b834e", + "source_commit": "30f0d2784018daa98e36e7c1042d4e2138a05a7c", + "workplan_id": "NK-WP-0049", + "task_id": "NK-WP-0049-T02", + "custodian_task_id": "CUST-WP-0080-T03", + "result": "Source repair and disposable native acceptance passed; live owner acceptance remains open", + "changes": [ + "Replaced shell-sourced/%q credential transfer with literal owned/private files or attended in-memory prompts; no password environment/argv or temporary files.", + "Preview by default; explicit apply creates missing resolver/realm or fills only missing tuning; established bind password, custom fields, bindings/priorities and defaults remain unchanged.", + "Conflicting backend/type/binding and snapshot drift refuse before writes; each operation is read back; partial/unknown outcomes stop without retry or rollback.", + "Removed broad self-service/delete/disable and passthrough policy replay; existing onboarding guard and policy owner procedures remain authoritative.", + "Attended wrapper retains known-user lookup and fresh token-backed MFA proof and propagates failure; shared HTTP transport restricts origins, TLS, redirects/proxies and response sizes.", + "Updated console action, guides and work records; corrected the historical general claim that resolver POST replaces omitted configuration." + ], + "files": [ + { + "path": "sso-mfa/k8s/privacyidea/pi_api.py", + "sha256": "2eec0866fb140398c8f096cdbf9f99bed134e39d5cc20551bc66842b17e513a7" + }, + { + "path": "sso-mfa/k8s/privacyidea/realm_bootstrap.py", + "sha256": "2885086fdc4fd64b58496f90e82c75eefc7171017004e0804defaaabf791b3a9" + }, + { + "path": "sso-mfa/k8s/privacyidea/bootstrap-realm.sh", + "sha256": "d3dc530d378ce826f4875c4cf066a6f7f916c3abd5492eb5ee237a8c98b7957b" + }, + { + "path": "sso-mfa/k8s/privacyidea/repair-realm-live.sh", + "sha256": "2684a6caca848f5d9e74191af4ca2864adba92fe3ee410a4236045d1743b99e6" + }, + { + "path": "tests/test_realm_bootstrap.py", + "sha256": "caffb75f7a5fc1091a3d20d08cfd03344a6e78ec53210e69bacd3057fcc5f6e0" + }, + { + "path": "tests/realm_bootstrap_native_fixture.py", + "sha256": "a943a4c2f4fb78d0bea78242b7900bb1b68066d90ad4b291bad2b98b9b3484da" + }, + { + "path": "tests/test_privacyidea_verification.py", + "sha256": "3cae495f6f85b23e3f08c8a983020d9f11bd958007eab05852164bb405e10e31" + }, + { + "path": "sso-mfa/k8s/privacyidea/README.md", + "sha256": "299c68d881dbcda5db03f3435ce0e56034912e29b40a15e58a0dc5044ad21c2d" + }, + { + "path": "tools/security-bootstrap-console/security_bootstrap_console.py", + "sha256": "ba699abe9194325c55551802c0327948f8e6a8444e97ee83d912a8f1e486766d" + }, + { + "path": "tools/security-bootstrap-console/README.md", + "sha256": "bc1af3598d667346370a476d0765bff1f0c3ebb57f751c4da6e61a4add29f30d" + }, + { + "path": "docs/smooth-bootstrap-guide.md", + "sha256": "f58c7075d01a4d497ae58e65520961a5ad24e48bdd87072f2d72aba04681cf19" + }, + { + "path": "docs/keycape-exposure-resolver-reconciliation.md", + "sha256": "260d5c2117eb711ce1493e8e636c55730c6239e6eded8929a7c1bd2099d4a0b3" + }, + { + "path": "docs/verify-t06.md", + "sha256": "9c82ebee9c7e3aafc72d282eefd098f2d3f509e8985771d9ac4753296543a751" + }, + { + "path": "docs/attended-procedure-inventory.md", + "sha256": "f70cce61206aa6f5561089648d808a9c3775d902f1786e7b0b263325f7d573e3" + }, + { + "path": "sso-mfa/WORKPLAN.md", + "sha256": "561ec79578f49c23f6bc07ea681d60ef2a83d26fb4f9724632d524c2ea75a467" + }, + { + "path": "workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md", + "sha256": "739df5571a062b06c58b1d338318272f1654770c819505d41da63748eee2b64e" + } + ], + "verification": { + "full_suite": { + "passed": 723, + "skipped": 0, + "warnings": 4, + "exit_code": 0, + "elapsed_seconds": 266.15, + "command": [ + "/tmp/nk-pi-key-native/bin/python", + "-m", + "pytest", + "-q", + "tests", + "tools", + "sso-mfa/k8s/keycape", + "--tb=short", + "-rs" + ], + "source_unchanged_during_run": true, + "binding_sha256": "e9d14a69fc3f52b9e09258a4f9b8262650579242093ad07b8c4f4ef2f1d1edd4", + "log_sha256": "04f239798a6d71cd486bb8effff9fcfeeed0d6fe2c8a1d8c9de4003a5570ab2f" + }, + "focused_before_final_readback_regression": "54 passed; final broader run covers the added concurrent-default readback refusal as well", + "native_package": "privacyIDEA 3.12.2, disposable SQLite and real HTTP API", + "native_results": { + "native_bind_password_preserved": true, + "native_create_and_readback": true, + "native_existing_default_preserved": true, + "native_hardened_policies_preserved": true, + "native_minimal_update_preserves_omitted_fields": true, + "native_repeat_is_noop": true + }, + "provider_source_files": [ + { + "path": "api/resolver.py", + "sha256": "c8544e5406bb1c581217d414988ea227af528b253f4866f833edafd53db3bea8" + }, + { + "path": "lib/resolver.py", + "sha256": "3d59fd08ad8ea1678867d8a10129d53b77907c44b604321eeab855ab589edcb5" + }, + { + "path": "api/realm.py", + "sha256": "c4d03121ddf0c62c15041355c7a3588c07df5ab790a5c3d9aba10b02932264b3" + } + ], + "credential_file_regression": { + "source_base": "96feef46ab22811e3736231f04818655ca7b834e", + "old_executed_credential_file_command": true, + "new_executed_credential_file_command": false, + "baseline_exit": 1, + "fixed_exit": 1, + "network_target": "literal loopback port 1; no production endpoint", + "test_inputs": "synthetic; marker only in disposable temporary directory" + }, + "attended_pty": "Protected password/fresh OTP prompts complete without rendering inputs, bind prompt omitted for existing resolver, functional result propagated", + "committed_files_match_test_binding": true, + "shell_syntax": "passed", + "initial_test_failures": [ + { + "result": "10 failed, 40 passed", + "resolution": "Corrected duplicate keyword in test fixture and replaced obsolete tests that expected unsafe policy replay with preservation assertions." + }, + { + "result": "1 failed, 50 passed", + "resolution": "Native fixture attempted to create realm-scoped policies before that realm existed; move fixture policy installation after native bootstrap. Native API inspection also corrected default-realm success from boolean to positive integer ID. Subsequent focused/native/full runs passed." + } + ] + }, + "limits": [ + "No production credential, resolver, realm, policy, factor or workload was read or changed.", + "Disposable provider/database checks do not prove deployed-image acceptance, live LDAP reachability, custody or a complete KeyCape sign-in.", + "API has no CAS: pre-write snapshots/readback require an exclusive owner window and do not make multiple operations atomic.", + "On failure, partial/unknown changes remain for owner reconciliation; there is no blind retry or automatic rollback.", + "A configured realm is not an onboarding-policy/hook/enrollment acceptance. Existing approved owner flows retain those duties.", + "Explicit loopback HTTP relies on an approved local process/forward. No hostile same-UID memory isolation is claimed.", + "Historical incident evidence is not retroactively reclassified by current provider merge semantics.", + "LDAP callers, incident-specific cutover/rotation review, complete inventory, historical revocation and T03 native recovery remain open." + ], + "upstream_reference": "https://privacyidea.readthedocs.io/en/stable/modules/api/resolver.html", + "knowledge_orientation": { + "version": "0.2.6", + "digest": "8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02", + "status": "withheld/source changed; current owner sources reviewed directly" + } +} diff --git a/infra/security-flow/playwright-delivery.json b/infra/security-flow/playwright-delivery.json index bd296298..75d7f3c2 100644 --- a/infra/security-flow/playwright-delivery.json +++ b/infra/security-flow/playwright-delivery.json @@ -9,7 +9,7 @@ "obligor_workplan_id": "RPF-WP-0056", "obligor_task_id": "RPF-WP-0056-T03", "state": "waiting", - "reason": "Coordinator accepts delivery tracking. Pilot and scoped RBAC delivered; owner registration/custody/transport/authenticator implementation returns and real consumer acceptance remain pending.", + "reason": "Pilot and scoped RBAC delivered; same-image abrupt recovery now verified by provider receipts. Remaining delivery: exact owner registration/custody/authenticator/transport revisions, real human/agent trials, provider acceptance and managed discovery; cross-version rollback remains unproven in provider T01.", "request_message_id": "1b279bad-a159-43da-8709-1167882e62f8", "driver_lookup": { "local_project_workplans_scanned": 10, @@ -33,6 +33,36 @@ "path": "workplans/RAPP-PLAYWRIGHT-WP-0004-consumer-verification.md", "commit": "3a30ef159ae680da9e03179fcbe4dac9cdcc9cc3", "sha256": "14ddd47537fe25964ed4df02c71a9d78dda74c4e2fb39c427b119de5f18e504e" + }, + { + "repo": "rapp-playwright", + "path": "docs/evidence/2026-10-13-crash-recovery.md", + "commit": "2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb", + "sha256": "871221e07da35c468f0220aa0852145a83aee6a05a082219281d867d64c5ac4d" + }, + { + "repo": "rapp-playwright", + "path": "docs/evidence/2026-10-13-crash-recovery/managed/verification.json", + "commit": "2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb", + "sha256": "87bebb470a0f3839ca6e991b1b3d4932cee04317f0e35bbcc18bd2183316a3fb" + }, + { + "repo": "rapp-playwright", + "path": "docs/evidence/2026-10-13-crash-recovery/local/verification.json", + "commit": "2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb", + "sha256": "9ebd8c599cfae45e67c4994a325f78d47cc18fd1ce6ccde1791308e1c3e2ef0a" + }, + { + "repo": "rapp-playwright", + "path": "docs/evidence/2026-10-13-crash-recovery/managed-first-attempt.json", + "commit": "2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb", + "sha256": "cb32871a3b9175301444efa1246869550ad3e2c78d26839e52f6df784bd415c3" + }, + { + "repo": "rapp-playwright", + "path": "workplans/RAPP-PLAYWRIGHT-WP-0004-consumer-verification.md", + "commit": "2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb", + "sha256": "83410fc8993810fcdcdb4baba191dee334d09aa9c1817943a6dbbdf357ec9a50" } ], "linked_existing_tasks": [ @@ -55,7 +85,7 @@ "task_id": "RAPP-PLAYWRIGHT-WP-0004-T01", "hub_task_id": "09f87694-8832-5ae8-9d0b-b66834ffcfcc", "status_observed": "wait", - "responsibility": "Accept native consumer and remaining interruption/recovery evidence." + "responsibility": "Accept native human/agent consumer operation and disposition of unproven cross-version rollback; same-image abrupt recovery is delivered." }, { "repo": "rapp-playwright", @@ -120,7 +150,7 @@ "requires": [ "M3" ], - "deliverable": "Platform and provider accept receipts including remaining abrupt-interruption recovery; publish supported docs and update existing capability.infotech.headless-browser managed availability; read back discovery." + "deliverable": "Platform/provider accept real consumer receipts, retain delivered same-image abrupt recovery and explicit cross-version rollback limitation; publish docs and update existing capability.infotech.headless-browser managed availability; read back discovery." } ], "first_executable_milestone": "M1: prepared config/playwright candidates and existing owner requests are immediately reviewable; exact source task/acceptance returns are missing.", @@ -134,5 +164,17 @@ "Client disablement stops issuance; existing JWTs persist to expiry and active connections require termination.", "No foreign task statuses changed or owner approvals invented; no workers injected." ], - "availability_observed": "Managed pilot running; conditional consumer access. Local provider discovery published via finished REUSE-WP-0024; final managed availability pending." + "availability_observed": "Managed pilot and same-image abrupt recovery verified; real consumer identity/transport and final managed availability remain pending. Local provider discovery is published.", + "owner_progress": [ + { + "message_id": "a2449fe0-ba12-47b8-9ca3-d7deedc089c3", + "repo": "rapp-playwright", + "commit": "2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb", + "accepted_scope": "Local and managed same-image abrupt interruption/recovery; active and queued work interrupted, orphan PNG removed, completed hashes retained, fresh responsive/keyboard trial passed.", + "review_scope": "Reviewed committed provider report and local/managed/failure receipts; coordinator did not repeat a live crash.", + "first_transport_failure_retained": true, + "identity_acceptance": false, + "cross_version_rollback": false + } + ] } diff --git a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md index b5e498e4..eaafb650 100644 --- a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md +++ b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md @@ -436,6 +436,22 @@ a live diagnostic needs separate owner admission. Native estate acceptance and remaining LDAP/realm/inventory work stay open. Receipt: `docs/evidence/2026-10-13-netkingdom-security/mfa-state-diagnostic.json`. +2026-10-13 continuation: realm/bootstrap source repaired in NetKingdom +`30f0d2784018daa98e36e7c1042d4e2138a05a7c`. Reproduced old credential-file command execution +using a disposable marker; the replacement parses the same bytes literally. +Attended passwords stay in memory. Preview/explicit apply repairs missing core +configuration while preserving bind credentials, custom tuning, realm bindings, +defaults and owner-managed MFA policies; broad legacy policy replay is removed. +The console and guides use the supported flow, including fresh functional MFA +proof. Shared transport blocks unapproved origins, redirects/proxies and raw +error propagation. Actual privacyIDEA 3.12.2 proves minimal resolver updates +preserve omitted fields, correcting the old general replacement claim. +Frozen source passed all 723 tests with zero skips; four upstream deprecation +warnings. All 16 committed blobs match the test binding. Native/PTY/regression +receipts and limits: `docs/evidence/2026-10-13-netkingdom-security/realm-bootstrap-repair.json`. +No live provider or credential change. Remaining LDAP/incident-cutover callers, +full inventory and owner-approved native recovery keep NK-WP-0049 and G08 open. + ## Verify native closure against every requirement ```task @@ -490,3 +506,15 @@ permission, browser, lifecycle and recovery receipts, supported consumer docs, and the maintained managed-availability discovery update. Message delivery alone does not close this task. No new access gateway, shared administrator kubeconfig, shared workstation SSH identity, or broader target/permission grant is required. + +2026-10-13 provider recovery return accepted for coordination: +`a2449fe0-ba12-47b8-9ca3-d7deedc089c3`, rapp-playwright commit +`2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb`. Reviewed committed local/managed +SIGKILL, partial-artifact cleanup, completed-hash preservation and fresh browser +trial receipts, including the initial transport failure. Same-image abrupt +recovery is delivered; no crash was repeated by the coordinator. Case references +and dependency wording now retain the narrower live gap: exact registration, +custody, native JWT authenticator and per-caller transport owner revisions, then +real human/agent trials and managed acceptance/discovery. Cross-version rollback +remains explicitly unproven in provider T01. No foreign task status was changed; +this task stays progress and no membership decision is reopened.