security: retain native LDAP group maintenance verification

2026-10-14 01:26:39 +02:00 · 2026-10-14 01:26:39 +02:00 · c53ebce2b7
commit c53ebce2b7
parent 880c224a4b
2 changed files with 128 additions and 0 deletions
--- a/docs/evidence/2026-10-14-netkingdom-security/lldap-group-maintenance.json
+++ b/docs/evidence/2026-10-14-netkingdom-security/lldap-group-maintenance.json
@ -0,0 +1,108 @@
+{
+  "observed_at": "2026-10-14",
+  "source_repo": "net-kingdom",
+  "source_base": "e861f63513859d5240773ce72e162b303fa7b9e4",
+  "workplan_id": "NK-WP-0049",
+  "task_id": "NK-WP-0049-T02",
+  "custodian_task_id": "CUST-WP-0080-T03",
+  "result": "ldap_group_callers_reconciled_with_isolated_native_proof_not_estate_acceptance",
+  "files": {
+    "docs/attended-procedure-inventory.md": "9b3cde4de1f6410c105d608f7ff45774862c50dd72535aff5b131f8528357ab3",
+    "docs/legacy-lldap-lifecycle-retirement.md": "996d562989516beb1830232fb7c77800c6ae4b033883c6d5760fc4f93cdb107e",
+    "sso-mfa/WORKPLAN.md": "6a88e36c8e82b447e1297e970ee429ba066a42605771520d352cf899e844dc10",
+    "sso-mfa/k8s/backup/DR-RUNBOOK.md": "4a5227703fca967fb550a93682ad20310b3c7cdf792736682d7067e0d8df8353",
+    "sso-mfa/k8s/keycape/README.md": "9571e99a535b1a26999e7fc3bfe22185dd3014d101c328300f57dde44d014522",
+    "sso-mfa/k8s/lldap/OPERATOR-GROUPS.md": "7adfea8205fd3e6a98d9c2c49032f17bc67dcf8e3bc9e39c1d940be714c32798",
+    "sso-mfa/k8s/lldap/README.md": "44ad28585ddbe1ab2eeb299246f1dbec2a186b71fa67b9b874780662216ffc6a",
+    "sso-mfa/k8s/lldap/bootstrap-users.sh": "309da1de430638e4ed0b9bfe11b7bbb472a6bfe364cdfb6c69499c6fb78b66d6",
+    "sso-mfa/k8s/lldap/manage-group-members.sh": "3c85e4e882ad003a4dc513d9085d136531511273db8adf27e1fcf5e749ae04d1",
+    "sso-mfa/k8s/verify-t07.sh": "026406ff1fec9e4bf542741c08002c45ea8a94a4ce5a50980665b601485882df",
+    "workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md": "099fe590e7cbc5b2bda7b2da5f2e083ab0305bb3bdde60f02de785efbe301358",
+    "sso-mfa/k8s/lldap/lldap_admin.py": "80a353b4a452267be32ffc7f4ece7f7b727a18778575444b93177425b4f660e3",
+    "sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md": "61618e61d077bae00daa4ea77ebd3af124810c1047d90832b3f1b351f3b46a22",
+    "tests/test_lldap_group_maintenance.py": "ab9c3620b8f779b258aabf742d678860d647be55c307abf112925a8b817f0c18",
+    "tests/lldap_groups_native_fixture.py": "19ce0721671114b632ffc4215cb1ebe5349354e1666942bccd4a500b8cb0a1d1"
+  },
+  "unchanged_dependencies": [
+    {
+      "path": "identity-provisioner/provisioner.py",
+      "sha256": "bac0069de2552a2f226d788ab9891ab9362c65244e7cdf13e8b20d2c569e4618"
+    },
+    {
+      "path": "sso-mfa/bootstrap/apply-service-secrets.py",
+      "sha256": "ea9c3418ed00527b9019ab9893f1f3c9fe29d0697f1f0c879e28fdbae373889b"
+    }
+  ],
+  "verification": {
+    "baseline": {
+      "failed": 3,
+      "description": "Old bootstrap, membership and T07 scripts executed supplied credential-file shell code; curl/kubectl were controlled stubs, credentials synthetic."
+    },
+    "affected_tests": {
+      "run": 200,
+      "failures": 0,
+      "errors": 0,
+      "skipped": 0,
+      "scope": "LDAP maintenance, retired lifecycle, private service custody and identity-provisioner suites"
+    },
+    "native": {
+      "image": "sha256:2a8454b668c1aba7157e832eab0e242e1e7eb5fb7591d7e7774ba05286511ca8",
+      "synthetic_only": true,
+      "checks": {
+        "preview_nonmutating": true,
+        "bootstrap_exact_and_existing_preserved": true,
+        "bootstrap_idempotent": true,
+        "exact_add_and_readback": true,
+        "exact_remove_and_readback": true,
+        "reserved_group_refusal_preserves_state": true,
+        "stale_preview_refused": true,
+        "t07_structural_only_exit_and_no_trace_disclosure": true,
+        "fixture_removed": true
+      },
+      "outcome": "passed"
+    },
+    "applied_files_match_manifest": true,
+    "changed_shell_syntax": "passed",
+    "git_diff_check": "passed",
+    "log_digests": {
+      "baseline.log": "384f2dfaaec9435d2f9fd372008afd97dec4de67555b1edbd28963a31534e828",
+      "focused-tests.log": "a3445b5a3491588d8202dfd42aecdc9b564491495debdaab83bfc0cfc44e3bfc",
+      "http-tests.log": "5be5939bc6eb2e47ece63dd138aa35f763056c33e68889110981fb4211874d30",
+      "affected-tests.log": "0f0fd49b9d98ad9a1e30418ee2d6e5f130b30b73eb7e18ce3c9baf7f04becb5e",
+      "native.json": "be4673cc4f6aa9e0eebee3b37a670dfcc7611fa71d8b7564e6a092818710e9a9"
+    },
+    "secret_scan": {
+      "status": "clean",
+      "changed_blobs": 15,
+      "version": "8.30.1"
+    },
+    "evidence_scan_triage": {
+      "rule": "generic-api-key",
+      "blocked_blob_id": "5f3edfcd46698972a32415aee0005c424b00a7ed",
+      "classification": "false_positive_public_source_sha256",
+      "verification": "Flagged value exactly equals SHA256 of the committed apply-service-secrets.py dependency at source_base. Dependency entries now separate path and sha256 fields; scanner policy unchanged."
+    }
+  },
+  "behavior": [
+    "Three shell entry points disable tracing and delegate to the shared adapter; existing provider operations and literal private-custody reader are reused.",
+    "Explicit outside-Git private custody; no ambient admin-password fallback, shell sourcing, auto Secret discovery, curl/kubectl, credentials in child argv or KeyCape configuration Secret reads.",
+    "Fixed HTTPS origin or explicit literal-loopback port; system trust, no redirects or ambient proxies; bounded strict JSON and contained diagnostics.",
+    "Bootstrap previews only missing fixed empty baseline groups; service membership uses an existing exact user/group and refuses reserved namespaces before login.",
+    "Apply binds origin/operation/target/observed state, checks again before first write and requires exact final preservation; stale or mismatched state refuses.",
+    "T07 emits only observed directory structure and explicit unverified native acceptance with exit 2; input/protocol/authentication failure exits 1."
+  ],
+  "limits": [
+    "LLDAP has no cross-query compare-and-swap here. An owner-controlled exclusive maintenance window is required; preview digests confer no approval or runtime isolation.",
+    "Multiple group creations can leave partial changes on failure. No blind rollback/retry or group deletion; owner must reconcile current state.",
+    "Local native fixture used an immutable existing image, generated synthetic credentials and disposable storage. It does not prove the deployed estate version, current credentials or attended authority.",
+    "No live estate credential, account, membership, deployment or KeyCape Secret was read or changed.",
+    "Actual lifecycle/login/MFA/claims/consumer/revocation and independent recovery acceptance remain open under T03. Incident-cutover callers and full root-output/caller inventory remain under T02.",
+    "Earlier provider reserved-group repair still requires owner-scoped deployment/native enforcement verification."
+  ],
+  "knowledge_orientation": {
+    "version": "0.2.6",
+    "digest": "8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02",
+    "status": "withheld/source-changed/orientation-only; current provider, caller, custody and verification-audit sources reviewed"
+  },
+  "source_commit": "ab25dde80d4520c4ff09240944d1510b2a17b9f0"
+}