From c53ebce2b7cf5a5b6d9c9d63a451f06f83fb0650 Mon Sep 17 00:00:00 2001 From: codex Date: Wed, 14 Oct 2026 01:26:39 +0200 Subject: [PATCH] security: retain native LDAP group maintenance verification --- .../lldap-group-maintenance.json | 108 ++++++++++++++++++ ...gdom-security-blueprint-and-gap-closure.md | 20 ++++ 2 files changed, 128 insertions(+) create mode 100644 docs/evidence/2026-10-14-netkingdom-security/lldap-group-maintenance.json diff --git a/docs/evidence/2026-10-14-netkingdom-security/lldap-group-maintenance.json b/docs/evidence/2026-10-14-netkingdom-security/lldap-group-maintenance.json new file mode 100644 index 0000000..3180012 --- /dev/null +++ b/docs/evidence/2026-10-14-netkingdom-security/lldap-group-maintenance.json @@ -0,0 +1,108 @@ +{ + "observed_at": "2026-10-14", + "source_repo": "net-kingdom", + "source_base": "e861f63513859d5240773ce72e162b303fa7b9e4", + "workplan_id": "NK-WP-0049", + "task_id": "NK-WP-0049-T02", + "custodian_task_id": "CUST-WP-0080-T03", + "result": "ldap_group_callers_reconciled_with_isolated_native_proof_not_estate_acceptance", + "files": { + "docs/attended-procedure-inventory.md": "9b3cde4de1f6410c105d608f7ff45774862c50dd72535aff5b131f8528357ab3", + "docs/legacy-lldap-lifecycle-retirement.md": "996d562989516beb1830232fb7c77800c6ae4b033883c6d5760fc4f93cdb107e", + "sso-mfa/WORKPLAN.md": "6a88e36c8e82b447e1297e970ee429ba066a42605771520d352cf899e844dc10", + "sso-mfa/k8s/backup/DR-RUNBOOK.md": "4a5227703fca967fb550a93682ad20310b3c7cdf792736682d7067e0d8df8353", + "sso-mfa/k8s/keycape/README.md": "9571e99a535b1a26999e7fc3bfe22185dd3014d101c328300f57dde44d014522", + "sso-mfa/k8s/lldap/OPERATOR-GROUPS.md": "7adfea8205fd3e6a98d9c2c49032f17bc67dcf8e3bc9e39c1d940be714c32798", + "sso-mfa/k8s/lldap/README.md": "44ad28585ddbe1ab2eeb299246f1dbec2a186b71fa67b9b874780662216ffc6a", + "sso-mfa/k8s/lldap/bootstrap-users.sh": "309da1de430638e4ed0b9bfe11b7bbb472a6bfe364cdfb6c69499c6fb78b66d6", + "sso-mfa/k8s/lldap/manage-group-members.sh": "3c85e4e882ad003a4dc513d9085d136531511273db8adf27e1fcf5e749ae04d1", + "sso-mfa/k8s/verify-t07.sh": "026406ff1fec9e4bf542741c08002c45ea8a94a4ce5a50980665b601485882df", + "workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md": "099fe590e7cbc5b2bda7b2da5f2e083ab0305bb3bdde60f02de785efbe301358", + "sso-mfa/k8s/lldap/lldap_admin.py": "80a353b4a452267be32ffc7f4ece7f7b727a18778575444b93177425b4f660e3", + "sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md": "61618e61d077bae00daa4ea77ebd3af124810c1047d90832b3f1b351f3b46a22", + "tests/test_lldap_group_maintenance.py": "ab9c3620b8f779b258aabf742d678860d647be55c307abf112925a8b817f0c18", + "tests/lldap_groups_native_fixture.py": "19ce0721671114b632ffc4215cb1ebe5349354e1666942bccd4a500b8cb0a1d1" + }, + "unchanged_dependencies": [ + { + "path": "identity-provisioner/provisioner.py", + "sha256": "bac0069de2552a2f226d788ab9891ab9362c65244e7cdf13e8b20d2c569e4618" + }, + { + "path": "sso-mfa/bootstrap/apply-service-secrets.py", + "sha256": "ea9c3418ed00527b9019ab9893f1f3c9fe29d0697f1f0c879e28fdbae373889b" + } + ], + "verification": { + "baseline": { + "failed": 3, + "description": "Old bootstrap, membership and T07 scripts executed supplied credential-file shell code; curl/kubectl were controlled stubs, credentials synthetic." + }, + "affected_tests": { + "run": 200, + "failures": 0, + "errors": 0, + "skipped": 0, + "scope": "LDAP maintenance, retired lifecycle, private service custody and identity-provisioner suites" + }, + "native": { + "image": "sha256:2a8454b668c1aba7157e832eab0e242e1e7eb5fb7591d7e7774ba05286511ca8", + "synthetic_only": true, + "checks": { + "preview_nonmutating": true, + "bootstrap_exact_and_existing_preserved": true, + "bootstrap_idempotent": true, + "exact_add_and_readback": true, + "exact_remove_and_readback": true, + "reserved_group_refusal_preserves_state": true, + "stale_preview_refused": true, + "t07_structural_only_exit_and_no_trace_disclosure": true, + "fixture_removed": true + }, + "outcome": "passed" + }, + "applied_files_match_manifest": true, + "changed_shell_syntax": "passed", + "git_diff_check": "passed", + "log_digests": { + "baseline.log": "384f2dfaaec9435d2f9fd372008afd97dec4de67555b1edbd28963a31534e828", + "focused-tests.log": "a3445b5a3491588d8202dfd42aecdc9b564491495debdaab83bfc0cfc44e3bfc", + "http-tests.log": "5be5939bc6eb2e47ece63dd138aa35f763056c33e68889110981fb4211874d30", + "affected-tests.log": "0f0fd49b9d98ad9a1e30418ee2d6e5f130b30b73eb7e18ce3c9baf7f04becb5e", + "native.json": "be4673cc4f6aa9e0eebee3b37a670dfcc7611fa71d8b7564e6a092818710e9a9" + }, + "secret_scan": { + "status": "clean", + "changed_blobs": 15, + "version": "8.30.1" + }, + "evidence_scan_triage": { + "rule": "generic-api-key", + "blocked_blob_id": "5f3edfcd46698972a32415aee0005c424b00a7ed", + "classification": "false_positive_public_source_sha256", + "verification": "Flagged value exactly equals SHA256 of the committed apply-service-secrets.py dependency at source_base. Dependency entries now separate path and sha256 fields; scanner policy unchanged." + } + }, + "behavior": [ + "Three shell entry points disable tracing and delegate to the shared adapter; existing provider operations and literal private-custody reader are reused.", + "Explicit outside-Git private custody; no ambient admin-password fallback, shell sourcing, auto Secret discovery, curl/kubectl, credentials in child argv or KeyCape configuration Secret reads.", + "Fixed HTTPS origin or explicit literal-loopback port; system trust, no redirects or ambient proxies; bounded strict JSON and contained diagnostics.", + "Bootstrap previews only missing fixed empty baseline groups; service membership uses an existing exact user/group and refuses reserved namespaces before login.", + "Apply binds origin/operation/target/observed state, checks again before first write and requires exact final preservation; stale or mismatched state refuses.", + "T07 emits only observed directory structure and explicit unverified native acceptance with exit 2; input/protocol/authentication failure exits 1." + ], + "limits": [ + "LLDAP has no cross-query compare-and-swap here. An owner-controlled exclusive maintenance window is required; preview digests confer no approval or runtime isolation.", + "Multiple group creations can leave partial changes on failure. No blind rollback/retry or group deletion; owner must reconcile current state.", + "Local native fixture used an immutable existing image, generated synthetic credentials and disposable storage. It does not prove the deployed estate version, current credentials or attended authority.", + "No live estate credential, account, membership, deployment or KeyCape Secret was read or changed.", + "Actual lifecycle/login/MFA/claims/consumer/revocation and independent recovery acceptance remain open under T03. Incident-cutover callers and full root-output/caller inventory remain under T02.", + "Earlier provider reserved-group repair still requires owner-scoped deployment/native enforcement verification." + ], + "knowledge_orientation": { + "version": "0.2.6", + "digest": "8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02", + "status": "withheld/source-changed/orientation-only; current provider, caller, custody and verification-audit sources reviewed" + }, + "source_commit": "ab25dde80d4520c4ff09240944d1510b2a17b9f0" +} diff --git a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md index cf77c63..eb77d9c 100644 --- a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md +++ b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md @@ -479,6 +479,26 @@ Mixed requests and delete-if-empty also refuse before login. Receipt: No rollout or live directory mutation; exact owner deployment and native checks remain necessary before claiming live enforcement. NK-WP-0049 stays active. +2026-10-14 LDAP group caller reconciliation delivered in NetKingdom `ab25dde`. +Bootstrap, membership and T07 wrappers now reuse provider operations and literal +private custody through one adapter. No executable credential sourcing, ambient +password fallback, credential argv, curl/kubectl or KeyCape config Secret read. +Bootstrap only creates missing empty fixed baseline groups; service membership +requires exact existing identities/groups and refuses reserved namespaces. +Preview/apply binds origin, operation, target and observed state; fresh prewrite +and final exact readback preserve unrelated data. Owner-controlled exclusive +maintenance remains necessary because LLDAP has no cross-query CAS; partial +failures require reconciliation, not blind rollback. + +Three old-source regressions failed; all 200 affected tests pass without skips. +An actual isolated local immutable LLDAP image passed preview, preservation, +idempotence, add/remove, reserved/stale refusal and T07 incomplete-exit checks. +The synthetic fixture/container/private files were removed. T07 is explicitly +structural-only (exit 2), not lifecycle/login/recovery acceptance. Receipt: +`docs/evidence/2026-10-14-netkingdom-security/lldap-group-maintenance.json`. +No live estate change. Incident-cutover/full inventory and owner-approved native +recovery/estate acceptance keep NK-WP-0049 and G08 open. + ## Verify native closure against every requirement ```task