docs: preserve reviewed NetKingdom session artifacts
This commit is contained in:
codex
parent
c66481bb25
commit
fa513ee38b
49 changed files with 9212 additions and 0 deletions
|
|
@ -0,0 +1,91 @@
|
|||
<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
|
||||
# Custodian Brief — net-kingdom
|
||||
|
||||
**Domain:** infotech
|
||||
**Last synced:** 2026-10-17 09:16 UTC
|
||||
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
|
||||
|
||||
## Active Workstreams
|
||||
|
||||
### Publish the NetKingdom emission-cadence security profile
|
||||
Progress: 5/6 done | workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc`
|
||||
|
||||
**Open tasks:**
|
||||
- ► Bind and hand off the published contract `e3fbc8b8`
|
||||
|
||||
### Register Playwright human and agent consumers through governed identity delivery
|
||||
Progress: 1/3 done | workplan_id: `06ba98d5-609e-5aaa-9bf7-4c4f4460e377`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Verify issuer and real consumer acceptance `5a3aaf57`
|
||||
*(wait: Await owner-scoped registry/custody activation, native cluster authentication and individual transport, then real human and agent acceptance under CUST-WP-0080-T05.)*
|
||||
- ► Deliver custody integration and guarded registration activation `a9dadd07`
|
||||
|
||||
### Remove bootstrap secret output and verify separated recovery custody
|
||||
Progress: 26/38 done | workplan_id: `17d315f0-829e-57c7-85cc-3a7914152804`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Accept remaining recovery and caller evidence and close the G08 handoff `d68cd4d3`
|
||||
*(wait: Await the separately tracked native service proofs, current/legacy caller dispositions and residual-scope decisions; archive recovery, backup activation, independent outage retrieval and guide publication are complete.)*
|
||||
- ! Resolve historical credential and configuration-preserving rotation dispositions `3ea6bf00`
|
||||
*(wait: Await the caller/consumer ledger, current replacement-lane acceptance and explicit credential-owner dispositions; existing exposure-rotation deferral is unchanged.)*
|
||||
- ! Verify current caller and provider admission at their actual boundaries `77aa42be`
|
||||
*(wait: Await the current-caller ledger and exact per-caller owner admission/test inputs; the backup credential grants do not admit unrelated callers.)*
|
||||
- ! Prove retained privacyIDEA token decryption and existing-token MFA `6f8af1a7`
|
||||
*(wait: LLDAP T16, token-material T31 and audit T20 passed; await the exact isolated MFA adapter and owner-selected retained-token/factor inputs.)*
|
||||
- ! Prove restored KeyCape issuer, policy and consumer continuity `141dd773`
|
||||
*(wait: Source and synthetic KeyCape lifecycle proof are delivered in T32; await exact owner-held recovery attempt preparation T33, selected consumer acceptance and retained-token MFA for the selected flow.)*
|
||||
- ! Prove restored Authelia storage and OIDC continuity `b47f9975`
|
||||
*(wait: LLDAP recovery T16 passed; await the exact isolated Authelia adapter/procedure and private authentication-flow inputs from T15.)*
|
||||
- ! Prepare the exact owner-held KeyCape recovery attempt `56c8d469`
|
||||
*(wait: Source custody/preflight preparation is evidenced in T34; await original TLS/trust recovery disposition T35 and selected original registration/private-admission metadata T36 before final reviewed command and existing owner process.)*
|
||||
- … and 5 more open tasks
|
||||
|
||||
### Establish SecurityCaseTypes so that known security cases are light
|
||||
Progress: 25/31 done | workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb`
|
||||
|
||||
**Open tasks:**
|
||||
- ! T05 — Acknowledge the type through informed-decision `d9b26bcf`
|
||||
*(wait: Type1.2 architecture has a confirmed source-only founder acknowledgment; canonical1.1 remains unchanged/default and the1.2 reference case stays proposed. Needs explicit version selection/reference-source integration without normal admission bypass, closed owner adapters plus global/native receipt verifier (WARDEN-WP-0044-T03), independently verified six-object structural materialization and CCR42 claims/created-only provenance, exact broker/case/source reconciliation, then separately authorized native mint/delivery and attended registry/consumer verification. Source acknowledgment, a bundle or local tests do not prove implemented/materialized/live status.)*
|
||||
- ! T06 — First KnownSecurityCase: Forgejo `c3c9c3ae`
|
||||
*(wait: The next types follow once the first one is proven end to end.)*
|
||||
- ! T15 — Define authenticated recovery for lost registration process state `1b825705`
|
||||
*(wait: Source candidate 061461e is merged. Waiting on the owner to select the real authenticated original-attempt holder and native readback, and on independent re-review of the changed T13 adapter source.)*
|
||||
- ► T14 — Admit governed group rollback against native owner boundaries `fce95440`
|
||||
- · T12 — Prepare NetKingdom-owned attended step adapters `7ce4eee3`
|
||||
- · T16 — Select and review the actual machine descriptor composition `200bf500`
|
||||
|
||||
### Define an execution-attribution receipt for Railiance runs
|
||||
Progress: 1/2 done | workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Agree the evidence holder and schema with audit-core and Railiance `963120c1`
|
||||
*(wait: Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance.)*
|
||||
|
||||
### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker
|
||||
Progress: 1/9 done | workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Admit the database consumer `2fe6f100`
|
||||
*(wait: ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence.)*
|
||||
- ! Package the broker deployment `32d1411b`
|
||||
*(wait: ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment.)*
|
||||
- ! Integrate an upstream identity provider `6697a994`
|
||||
*(wait: Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence.)*
|
||||
- ! Define federated assurance `d845380d`
|
||||
*(wait: Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners.)*
|
||||
- ! Verify IAM conformance and coexistence `9cb7fd93`
|
||||
*(wait: Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent.)*
|
||||
- ! Enforce tenant and platform boundaries `38998c68`
|
||||
*(wait: Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission.)*
|
||||
- ! Prove recovery and audit delivery `e5f44ddc`
|
||||
*(wait: Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent.)*
|
||||
- … and 1 more open tasks
|
||||
|
||||
---
|
||||
## MCP Orientation (when available)
|
||||
|
||||
If the state-hub MCP server is reachable, call:
|
||||
`get_domain_summary("infotech")`
|
||||
This provides richer cross-domain context.
|
||||
If the MCP call fails, use this file as your orientation source.
|
||||
|
|
@ -0,0 +1,289 @@
|
|||
# Work Records — net-kingdom
|
||||
|
||||
> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
|
||||
> stage 3). Do not edit by hand — edit the source file/block listed for
|
||||
> each record and re-run fix-consistency to refresh this index. Archived
|
||||
> workplans are omitted; closed decisions/intakes/engagements stay listed
|
||||
> so recently-resolved work is still visible. [auto]
|
||||
|
||||
| Kind | ID | Status | Lane | Source |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| workplan | NK-WP-ADHOC-2026-07-02 | finished | — | workplans/ADHOC-2026-07-02.md |
|
||||
| workplan | NK-WP-ADHOC-2026-08-14 | finished | — | workplans/ADHOC-2026-08-14.md |
|
||||
| workplan | NK-WP-ADHOC-2026-08-23 | finished | — | workplans/ADHOC-2026-08-23.md |
|
||||
| workplan | NK-WP-ADHOC-2026-10-03 | finished | — | workplans/ADHOC-2026-10-03.md |
|
||||
| workplan | NK-WP-ADHOC-2026-10-10 | finished | — | workplans/ADHOC-2026-10-10.md |
|
||||
| workplan | NK-WP-ADHOC-2026-10-11 | finished | — | workplans/ADHOC-2026-10-11.md |
|
||||
| workplan | NK-WP-ADHOC-2026-10-16 | finished | — | workplans/ADHOC-2026-10-16.md |
|
||||
| workplan | NET-WP-0020 | finished | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| workplan | NK-WP-0009 | finished | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| workplan | NK-WP-0011 | active | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| workplan | NK-WP-0021 | finished | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| workplan | NK-WP-0022 | finished | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| workplan | NK-WP-0023 | finished | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| workplan | NK-WP-0024 | finished | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| workplan | NK-WP-0025 | finished | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| workplan | NK-WP-0026 | finished | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
|
||||
| workplan | NK-WP-0027 | backlog | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| workplan | NK-WP-0028 | finished | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| workplan | NK-WP-0029 | finished | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| workplan | NK-WP-0030 | finished | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| workplan | NK-WP-0031 | finished | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| workplan | NK-WP-0032 | finished | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| workplan | NK-WP-0033 | finished | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| workplan | NK-WP-0034 | finished | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| workplan | NK-WP-0035 | active | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| workplan | NK-WP-0036 | finished | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| workplan | NK-WP-0037 | finished | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
|
||||
| workplan | NK-WP-0038 | finished | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
|
||||
| workplan | NK-WP-0039 | finished | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| workplan | NK-WP-0040 | active | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
|
||||
| workplan | NK-WP-0041 | finished | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
|
||||
| workplan | NK-WP-0042 | finished | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
|
||||
| workplan | NK-WP-0043 | finished | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
|
||||
| workplan | NK-WP-0044 | finished | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| workplan | NK-WP-0045 | finished | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| workplan | NK-WP-0046 | finished | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
|
||||
| workplan | NK-WP-0047 | finished | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
|
||||
| workplan | NK-WP-0048 | active | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| workplan | NK-WP-0049 | active | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| workplan | NK-WP-0050 | active | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| workplan | NK-WP-0051 | finished | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md |
|
||||
| task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md |
|
||||
| task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md |
|
||||
| task | NK-WP-ADHOC-2026-08-14-T02 | done | — | workplans/ADHOC-2026-08-14.md |
|
||||
| task | NK-WP-ADHOC-2026-08-14-T03 | done | — | workplans/ADHOC-2026-08-14.md |
|
||||
| task | NK-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md |
|
||||
| task | NK-WP-ADHOC-2026-10-03-T01 | done | — | workplans/ADHOC-2026-10-03.md |
|
||||
| task | NK-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T03 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T04 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T05 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T06 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T07 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-16-T01 | done | — | workplans/ADHOC-2026-10-16.md |
|
||||
| task | NET-WP-0020-T01 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NET-WP-0020-T02 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NET-WP-0020-T03 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NET-WP-0020-T04 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NET-WP-0020-T05 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NK-WP-0009-T01 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T02 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T03 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T04 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T05 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T06 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0011-T01 | done | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T02 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T03 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T04 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T05 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T06 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T07 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T08 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T09 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0021-T01 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0021-T02 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0021-T03 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0021-T04 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0021-T05 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0022-T01 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T02 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T03 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T04 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T05 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T06 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T07 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T08 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0023-T01 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T02 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T03 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T04 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T05 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T06 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T07 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T08 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0024-T01 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| task | NK-WP-0024-T02 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| task | NK-WP-0024-T03 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| task | NK-WP-0024-T04 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| task | NK-WP-0025-T01 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T02 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T03 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T04 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T05 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0026-T01 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
|
||||
| task | NK-WP-0026-T02 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
|
||||
| task | NK-WP-0027-T01 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T02 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T03 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T04 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T05 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T06 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0028-T01 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| task | NK-WP-0028-T02 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| task | NK-WP-0028-T03 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| task | NK-WP-0028-T04 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| task | NK-WP-0029-T01 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| task | NK-WP-0029-T02 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| task | NK-WP-0029-T03 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| task | NK-WP-0029-T04 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| task | NK-WP-0030-T01 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0030-T02 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0030-T03 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0030-T04 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0030-T05 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0031-T01 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0031-T02 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0031-T03 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0031-T04 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0031-T05 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0032-T01 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| task | NK-WP-0032-T02 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| task | NK-WP-0032-T03 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| task | NK-WP-0032-T04 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| task | NK-WP-0033-T01 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0033-T02 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0033-T03 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0033-T04 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0033-T05 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0034-T01 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| task | NK-WP-0034-T02 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| task | NK-WP-0034-T03 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| task | NK-WP-0034-T04 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| task | NK-WP-0035-T01 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T02 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T03 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T04 | progress | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T05 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T06 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0036-T01 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T02 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T03 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T04 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T05 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T06 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0037-T01 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
|
||||
| task | NK-WP-0037-T02 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
|
||||
| task | NK-WP-0038-T01 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
|
||||
| task | NK-WP-0038-T02 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
|
||||
| task | NK-WP-0039-T01 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-0039-T02 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-0039-T03 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-0039-T04 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-0040-T01 | done | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
|
||||
| task | NK-WP-0040-T02 | wait | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
|
||||
| task | NK-WP-0041-T01 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
|
||||
| task | NK-WP-0041-T02 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
|
||||
| task | NK-WP-0041-T03 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
|
||||
| task | NK-WP-0042-T01 | done | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
|
||||
| task | NK-WP-0042-T02 | cancel | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
|
||||
| task | NK-WP-0043-T01 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
|
||||
| task | NK-WP-0043-T02 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
|
||||
| task | NK-WP-0043-T03 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
|
||||
| task | NK-WP-0044-T01 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T02 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T03 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T04 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T05 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T06 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T07 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0045-T01 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T02 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T03 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T04 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T05 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T06 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0046-T01 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
|
||||
| task | NK-WP-0046-T02 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
|
||||
| task | NK-WP-0046-T03 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
|
||||
| task | NK-WP-0047-T01 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
|
||||
| task | NK-WP-0047-T02 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
|
||||
| task | NK-WP-0047-T03 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
|
||||
| task | NK-WP-0048-T01 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T02 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T03 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T04 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T05 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T06 | wait | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T07 | wait | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T08 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T09 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T10 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T11 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T12 | todo | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T13 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T14 | progress | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T15 | wait | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T16 | todo | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T17 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T18 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T19 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T20 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T21 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T22 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T23 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T24 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T25 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T26 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T27 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T28 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T29 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T30 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T31 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0049-T01 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T02 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T03 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T04 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T05 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T06 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T07 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T08 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T09 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T10 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T11 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T12 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T13 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T14 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T15 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T16 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T17 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T18 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T19 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T20 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T21 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T22 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T23 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T24 | todo | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T25 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T26 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T27 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T28 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T29 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T30 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T31 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T32 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T33 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T34 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T35 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T36 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T37 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T38 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0050-T01 | done | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| task | NK-WP-0050-T02 | progress | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| task | NK-WP-0050-T03 | wait | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| task | NK-WP-0051-T01 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T02 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T03 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T04 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T05 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T06 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
|
||||
| intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
|
||||
| intake | NET-IN-0001 | open | — | intakes/intakes.md |
|
||||
| intake | NET-IN-0002 | open | — | intakes/intakes.md |
|
||||
| intake | NET-IN-0003 | open | — | intakes/intakes.md |
|
||||
| intake | NET-IN-0004 | open | — | intakes/intakes.md |
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
[
|
||||
{
|
||||
"path": ".custodian-brief.md",
|
||||
"index": "100644 f60f8bad019e23e6f7e0e074745da0bb2fcbb870 0\t.custodian-brief.md"
|
||||
},
|
||||
{
|
||||
"path": "WORK-RECORDS.md",
|
||||
"index": "100644 76a6b7fc304c508f1b50010cb72d892826c6a831 0\tWORK-RECORDS.md"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
{
|
||||
"exit_code": 0,
|
||||
"commit": "6201a1d2de282a218fde8d81b32f790a526942ef",
|
||||
"base": "0241070b914d62b6ee483d61d587ee9a8e7152f0",
|
||||
"files": [
|
||||
{
|
||||
"path": "workplans/NK-WP-0048-security-case-types.md",
|
||||
"sha256": "db5a09b78e559794228aab8dab1567190f56f12a47869acc208f0e0c39ceeebc"
|
||||
}
|
||||
],
|
||||
"stdout": "[main 6201a1d] Record compiled any-of consumer source and actual release follow-through\n 1 file changed, 76 insertions(+)\n",
|
||||
"stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 1, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n"
|
||||
}
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
{
|
||||
"owner": "net-kingdom",
|
||||
"base_revision": "0241070b914d62b6ee483d61d587ee9a8e7152f0",
|
||||
"message": "Record compiled any-of consumer source and actual release follow-through",
|
||||
"files": [
|
||||
{
|
||||
"path": "workplans/NK-WP-0048-security-case-types.md",
|
||||
"sha256": "db5a09b78e559794228aab8dab1567190f56f12a47869acc208f0e0c39ceeebc"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,45 @@
|
|||
{
|
||||
"base": "0241070b914d62b6ee483d61d587ee9a8e7152f0",
|
||||
"files": [
|
||||
{
|
||||
"path": "workplans/NK-WP-0048-security-case-types.md",
|
||||
"sha256": "db5a09b78e559794228aab8dab1567190f56f12a47869acc208f0e0c39ceeebc"
|
||||
}
|
||||
],
|
||||
"original_task_blocks_preserved": 37,
|
||||
"source_task_count": 39,
|
||||
"new_tasks": {
|
||||
"NK-WP-0048-T38": "done",
|
||||
"NK-WP-0048-T39": "todo"
|
||||
},
|
||||
"unrelated_state": {
|
||||
"WORK-RECORDS.md": {
|
||||
"worktree": "a1fec217a6e380f528778d781dbea1fc5a836fdefa1dd4dd0308100fbe08112a",
|
||||
"index": "100644 76a6b7fc304c508f1b50010cb72d892826c6a831 0\tWORK-RECORDS.md"
|
||||
},
|
||||
".custodian-brief.md": {
|
||||
"worktree": "3eb7f91f2443090c9b859a716d83711310364897b6144dcf10d3254342fec3d1",
|
||||
"index": "100644 f60f8bad019e23e6f7e0e074745da0bb2fcbb870 0\t.custodian-brief.md"
|
||||
}
|
||||
},
|
||||
"new_ids": [
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "NK-WP-0048-T38",
|
||||
"uuid": "2c32b963-a87c-50a1-91e1-b07ea1fe4960",
|
||||
"path": "workplans/NK-WP-0048-security-case-types.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "NK-WP-0048-T39",
|
||||
"uuid": "513c43ae-05f2-5a65-9c80-a911b7d680b8",
|
||||
"path": "workplans/NK-WP-0048-security-case-types.md"
|
||||
}
|
||||
],
|
||||
"knowledge": {
|
||||
"version": "0.2.6",
|
||||
"digest": "sha256:8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02",
|
||||
"status": "withheld/orientation-only; actual INTENT and SECURITY-COMPANION reviewed"
|
||||
},
|
||||
"native_or_credential_actions": false
|
||||
}
|
||||
|
|
@ -0,0 +1,74 @@
|
|||
|
||||
## T38 — Implement and independently compile the exact any-of source candidate
|
||||
|
||||
```task
|
||||
id: NK-WP-0048-T38
|
||||
status: done
|
||||
priority: high
|
||||
```
|
||||
|
||||
Completed 2026-10-17, source proposal and backend verification only. Split the
|
||||
completed implementation evidence from T37. The isolated seven-path Forgejo
|
||||
11.0.3 patch introduces a separate multi-value required-claim field and CLI
|
||||
flag, preserves legacy singular behavior, and requires current well-formed
|
||||
UserInfo groups before the existing provider merges ID-token claims. The
|
||||
original exact three-group access set and groups claim remain unchanged.
|
||||
No KeyCape authorization verdict, case/type acknowledgment or deployed image
|
||||
is introduced. Existing consumer enforcement still needs the governing
|
||||
architecture/owner review; this does not satisfy the target application's
|
||||
independent Access Engine decision requirement.
|
||||
|
||||
Candidate: Custodian `docs/changes/netkingdom-target-2026-10-17/forgejo-required-claim-values-r1/`.
|
||||
Independent technical review: `forgejo-required-claim-values-review-r1/`.
|
||||
All 33 frozen packet digests and exact official-source pre/postimages match.
|
||||
The actual full patched backend executable compiles offline under verified
|
||||
official Go 1.24.3 in 304.79 seconds with sqlite/sqlite_unlock_notify tags.
|
||||
Eight source/provider fixture race tests, five actual package tests and three
|
||||
independent actual-package test functions pass; the latter include 14 named
|
||||
subtests. Full frontend/release/container build and native browser behavior are
|
||||
not claimed. The initial test-harness /dev/null Git-config failure is retained;
|
||||
its corrected scratch-only config does not modify candidate code.
|
||||
|
||||
The technical review accepts exact source for owner integration review, with no
|
||||
formal owner assent. T39 owns reproducible release/package and image evidence;
|
||||
T37 retains architecture acceptance, actual owner integration and exact review/
|
||||
re-freeze. T34 retains real operation/inverse/session/journal/writer-exclusion
|
||||
bindings. T06's independent native first-case acceptance remains unchanged.
|
||||
|
||||
## T39 — Package and review the actual consumer release and inverse prerequisites
|
||||
|
||||
```task
|
||||
id: NK-WP-0048-T39
|
||||
status: todo
|
||||
depends_on: [NK-WP-0048-T38]
|
||||
priority: high
|
||||
```
|
||||
|
||||
Implementation owner: Apps; NetKingdom coordinates the existing T37/T16 case
|
||||
contract. Next action: prepare a reproducible full frontend/backend/container
|
||||
build from T38's reviewed official-source patch through Apps' existing owner
|
||||
build path, with exact source/toolchain/dependency/base-image/output pins and
|
||||
offline verification. Do not select, publish or deploy a replacement image as
|
||||
an implied consequence of backend compilation. Prepare the concrete owner
|
||||
source/release and native change proposal after verification.
|
||||
|
||||
Resolve the actual persisted-source inverse before any image downgrade. Helm
|
||||
chart omission and values/revision rollback do not remove the OAuth source;
|
||||
the stock older image ignores the new list field and can weaken the gate.
|
||||
Authoritative before/post/current/inverse application-source state, existing
|
||||
secret/config preservation, fresh operation/inverse sessions, durable evidence
|
||||
and effective exclusion of all release writers remain T34 obligations. Existing
|
||||
linked users/external logins can make source deletion refuse; never delete users
|
||||
or preexisting/shared sources to force an inverse. Retain the extended image
|
||||
and reconcile rather than downgrade first. Exact capability/source evidence is
|
||||
in T38's `OWNER-INVERSE.md`; list/update/delete tools alone are not admission.
|
||||
|
||||
Completion requires the actual owner package/build/image provenance and tests,
|
||||
the explicit architecture and owner dispositions (including the single-PDP
|
||||
application profile), a verified application-state inverse path or honest
|
||||
refusal/recovery contract, and an exact bounded deployment/verification/rollback
|
||||
proposal. The chart's runtime client-secret argv confidentiality also needs its
|
||||
owner boundary resolved; reference-only source does not prove it. Native go,
|
||||
deployment and independent browser/group/revocation observations remain existing
|
||||
T06/T16 and owner gates. No credentials, image deployment or new kernel step
|
||||
is authorized by this task.
|
||||
|
|
@ -0,0 +1,91 @@
|
|||
<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
|
||||
# Custodian Brief — net-kingdom
|
||||
|
||||
**Domain:** infotech
|
||||
**Last synced:** 2026-10-17 09:16 UTC
|
||||
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
|
||||
|
||||
## Active Workstreams
|
||||
|
||||
### Publish the NetKingdom emission-cadence security profile
|
||||
Progress: 5/6 done | workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc`
|
||||
|
||||
**Open tasks:**
|
||||
- ► Bind and hand off the published contract `e3fbc8b8`
|
||||
|
||||
### Register Playwright human and agent consumers through governed identity delivery
|
||||
Progress: 1/3 done | workplan_id: `06ba98d5-609e-5aaa-9bf7-4c4f4460e377`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Verify issuer and real consumer acceptance `5a3aaf57`
|
||||
*(wait: Await owner-scoped registry/custody activation, native cluster authentication and individual transport, then real human and agent acceptance under CUST-WP-0080-T05.)*
|
||||
- ► Deliver custody integration and guarded registration activation `a9dadd07`
|
||||
|
||||
### Remove bootstrap secret output and verify separated recovery custody
|
||||
Progress: 26/38 done | workplan_id: `17d315f0-829e-57c7-85cc-3a7914152804`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Accept remaining recovery and caller evidence and close the G08 handoff `d68cd4d3`
|
||||
*(wait: Await the separately tracked native service proofs, current/legacy caller dispositions and residual-scope decisions; archive recovery, backup activation, independent outage retrieval and guide publication are complete.)*
|
||||
- ! Resolve historical credential and configuration-preserving rotation dispositions `3ea6bf00`
|
||||
*(wait: Await the caller/consumer ledger, current replacement-lane acceptance and explicit credential-owner dispositions; existing exposure-rotation deferral is unchanged.)*
|
||||
- ! Verify current caller and provider admission at their actual boundaries `77aa42be`
|
||||
*(wait: Await the current-caller ledger and exact per-caller owner admission/test inputs; the backup credential grants do not admit unrelated callers.)*
|
||||
- ! Prove retained privacyIDEA token decryption and existing-token MFA `6f8af1a7`
|
||||
*(wait: LLDAP T16, token-material T31 and audit T20 passed; await the exact isolated MFA adapter and owner-selected retained-token/factor inputs.)*
|
||||
- ! Prove restored KeyCape issuer, policy and consumer continuity `141dd773`
|
||||
*(wait: Source and synthetic KeyCape lifecycle proof are delivered in T32; await exact owner-held recovery attempt preparation T33, selected consumer acceptance and retained-token MFA for the selected flow.)*
|
||||
- ! Prove restored Authelia storage and OIDC continuity `b47f9975`
|
||||
*(wait: LLDAP recovery T16 passed; await the exact isolated Authelia adapter/procedure and private authentication-flow inputs from T15.)*
|
||||
- ! Prepare the exact owner-held KeyCape recovery attempt `56c8d469`
|
||||
*(wait: Source custody/preflight preparation is evidenced in T34; await original TLS/trust recovery disposition T35 and selected original registration/private-admission metadata T36 before final reviewed command and existing owner process.)*
|
||||
- … and 5 more open tasks
|
||||
|
||||
### Establish SecurityCaseTypes so that known security cases are light
|
||||
Progress: 25/31 done | workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb`
|
||||
|
||||
**Open tasks:**
|
||||
- ! T05 — Acknowledge the type through informed-decision `d9b26bcf`
|
||||
*(wait: Type1.2 architecture has a confirmed source-only founder acknowledgment; canonical1.1 remains unchanged/default and the1.2 reference case stays proposed. Needs explicit version selection/reference-source integration without normal admission bypass, closed owner adapters plus global/native receipt verifier (WARDEN-WP-0044-T03), independently verified six-object structural materialization and CCR42 claims/created-only provenance, exact broker/case/source reconciliation, then separately authorized native mint/delivery and attended registry/consumer verification. Source acknowledgment, a bundle or local tests do not prove implemented/materialized/live status.)*
|
||||
- ! T06 — First KnownSecurityCase: Forgejo `c3c9c3ae`
|
||||
*(wait: The next types follow once the first one is proven end to end.)*
|
||||
- ! T15 — Define authenticated recovery for lost registration process state `1b825705`
|
||||
*(wait: Source candidate 061461e is merged. Waiting on the owner to select the real authenticated original-attempt holder and native readback, and on independent re-review of the changed T13 adapter source.)*
|
||||
- ► T14 — Admit governed group rollback against native owner boundaries `fce95440`
|
||||
- · T12 — Prepare NetKingdom-owned attended step adapters `7ce4eee3`
|
||||
- · T16 — Select and review the actual machine descriptor composition `200bf500`
|
||||
|
||||
### Define an execution-attribution receipt for Railiance runs
|
||||
Progress: 1/2 done | workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Agree the evidence holder and schema with audit-core and Railiance `963120c1`
|
||||
*(wait: Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance.)*
|
||||
|
||||
### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker
|
||||
Progress: 1/9 done | workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Admit the database consumer `2fe6f100`
|
||||
*(wait: ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence.)*
|
||||
- ! Package the broker deployment `32d1411b`
|
||||
*(wait: ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment.)*
|
||||
- ! Integrate an upstream identity provider `6697a994`
|
||||
*(wait: Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence.)*
|
||||
- ! Define federated assurance `d845380d`
|
||||
*(wait: Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners.)*
|
||||
- ! Verify IAM conformance and coexistence `9cb7fd93`
|
||||
*(wait: Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent.)*
|
||||
- ! Enforce tenant and platform boundaries `38998c68`
|
||||
*(wait: Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission.)*
|
||||
- ! Prove recovery and audit delivery `e5f44ddc`
|
||||
*(wait: Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent.)*
|
||||
- … and 1 more open tasks
|
||||
|
||||
---
|
||||
## MCP Orientation (when available)
|
||||
|
||||
If the state-hub MCP server is reachable, call:
|
||||
`get_domain_summary("infotech")`
|
||||
This provides richer cross-domain context.
|
||||
If the MCP call fails, use this file as your orientation source.
|
||||
|
|
@ -0,0 +1,289 @@
|
|||
# Work Records — net-kingdom
|
||||
|
||||
> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
|
||||
> stage 3). Do not edit by hand — edit the source file/block listed for
|
||||
> each record and re-run fix-consistency to refresh this index. Archived
|
||||
> workplans are omitted; closed decisions/intakes/engagements stay listed
|
||||
> so recently-resolved work is still visible. [auto]
|
||||
|
||||
| Kind | ID | Status | Lane | Source |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| workplan | NK-WP-ADHOC-2026-07-02 | finished | — | workplans/ADHOC-2026-07-02.md |
|
||||
| workplan | NK-WP-ADHOC-2026-08-14 | finished | — | workplans/ADHOC-2026-08-14.md |
|
||||
| workplan | NK-WP-ADHOC-2026-08-23 | finished | — | workplans/ADHOC-2026-08-23.md |
|
||||
| workplan | NK-WP-ADHOC-2026-10-03 | finished | — | workplans/ADHOC-2026-10-03.md |
|
||||
| workplan | NK-WP-ADHOC-2026-10-10 | finished | — | workplans/ADHOC-2026-10-10.md |
|
||||
| workplan | NK-WP-ADHOC-2026-10-11 | finished | — | workplans/ADHOC-2026-10-11.md |
|
||||
| workplan | NK-WP-ADHOC-2026-10-16 | finished | — | workplans/ADHOC-2026-10-16.md |
|
||||
| workplan | NET-WP-0020 | finished | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| workplan | NK-WP-0009 | finished | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| workplan | NK-WP-0011 | active | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| workplan | NK-WP-0021 | finished | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| workplan | NK-WP-0022 | finished | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| workplan | NK-WP-0023 | finished | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| workplan | NK-WP-0024 | finished | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| workplan | NK-WP-0025 | finished | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| workplan | NK-WP-0026 | finished | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
|
||||
| workplan | NK-WP-0027 | backlog | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| workplan | NK-WP-0028 | finished | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| workplan | NK-WP-0029 | finished | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| workplan | NK-WP-0030 | finished | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| workplan | NK-WP-0031 | finished | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| workplan | NK-WP-0032 | finished | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| workplan | NK-WP-0033 | finished | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| workplan | NK-WP-0034 | finished | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| workplan | NK-WP-0035 | active | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| workplan | NK-WP-0036 | finished | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| workplan | NK-WP-0037 | finished | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
|
||||
| workplan | NK-WP-0038 | finished | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
|
||||
| workplan | NK-WP-0039 | finished | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| workplan | NK-WP-0040 | active | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
|
||||
| workplan | NK-WP-0041 | finished | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
|
||||
| workplan | NK-WP-0042 | finished | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
|
||||
| workplan | NK-WP-0043 | finished | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
|
||||
| workplan | NK-WP-0044 | finished | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| workplan | NK-WP-0045 | finished | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| workplan | NK-WP-0046 | finished | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
|
||||
| workplan | NK-WP-0047 | finished | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
|
||||
| workplan | NK-WP-0048 | active | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| workplan | NK-WP-0049 | active | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| workplan | NK-WP-0050 | active | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| workplan | NK-WP-0051 | finished | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md |
|
||||
| task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md |
|
||||
| task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md |
|
||||
| task | NK-WP-ADHOC-2026-08-14-T02 | done | — | workplans/ADHOC-2026-08-14.md |
|
||||
| task | NK-WP-ADHOC-2026-08-14-T03 | done | — | workplans/ADHOC-2026-08-14.md |
|
||||
| task | NK-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md |
|
||||
| task | NK-WP-ADHOC-2026-10-03-T01 | done | — | workplans/ADHOC-2026-10-03.md |
|
||||
| task | NK-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T03 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T04 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T05 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T06 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T07 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-16-T01 | done | — | workplans/ADHOC-2026-10-16.md |
|
||||
| task | NET-WP-0020-T01 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NET-WP-0020-T02 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NET-WP-0020-T03 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NET-WP-0020-T04 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NET-WP-0020-T05 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NK-WP-0009-T01 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T02 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T03 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T04 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T05 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T06 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0011-T01 | done | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T02 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T03 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T04 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T05 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T06 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T07 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T08 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T09 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0021-T01 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0021-T02 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0021-T03 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0021-T04 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0021-T05 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0022-T01 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T02 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T03 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T04 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T05 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T06 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T07 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T08 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0023-T01 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T02 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T03 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T04 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T05 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T06 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T07 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T08 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0024-T01 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| task | NK-WP-0024-T02 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| task | NK-WP-0024-T03 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| task | NK-WP-0024-T04 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| task | NK-WP-0025-T01 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T02 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T03 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T04 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T05 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0026-T01 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
|
||||
| task | NK-WP-0026-T02 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
|
||||
| task | NK-WP-0027-T01 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T02 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T03 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T04 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T05 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T06 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0028-T01 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| task | NK-WP-0028-T02 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| task | NK-WP-0028-T03 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| task | NK-WP-0028-T04 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| task | NK-WP-0029-T01 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| task | NK-WP-0029-T02 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| task | NK-WP-0029-T03 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| task | NK-WP-0029-T04 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| task | NK-WP-0030-T01 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0030-T02 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0030-T03 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0030-T04 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0030-T05 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0031-T01 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0031-T02 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0031-T03 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0031-T04 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0031-T05 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0032-T01 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| task | NK-WP-0032-T02 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| task | NK-WP-0032-T03 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| task | NK-WP-0032-T04 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| task | NK-WP-0033-T01 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0033-T02 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0033-T03 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0033-T04 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0033-T05 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0034-T01 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| task | NK-WP-0034-T02 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| task | NK-WP-0034-T03 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| task | NK-WP-0034-T04 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| task | NK-WP-0035-T01 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T02 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T03 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T04 | progress | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T05 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T06 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0036-T01 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T02 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T03 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T04 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T05 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T06 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0037-T01 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
|
||||
| task | NK-WP-0037-T02 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
|
||||
| task | NK-WP-0038-T01 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
|
||||
| task | NK-WP-0038-T02 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
|
||||
| task | NK-WP-0039-T01 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-0039-T02 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-0039-T03 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-0039-T04 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-0040-T01 | done | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
|
||||
| task | NK-WP-0040-T02 | wait | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
|
||||
| task | NK-WP-0041-T01 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
|
||||
| task | NK-WP-0041-T02 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
|
||||
| task | NK-WP-0041-T03 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
|
||||
| task | NK-WP-0042-T01 | done | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
|
||||
| task | NK-WP-0042-T02 | cancel | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
|
||||
| task | NK-WP-0043-T01 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
|
||||
| task | NK-WP-0043-T02 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
|
||||
| task | NK-WP-0043-T03 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
|
||||
| task | NK-WP-0044-T01 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T02 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T03 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T04 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T05 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T06 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T07 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0045-T01 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T02 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T03 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T04 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T05 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T06 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0046-T01 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
|
||||
| task | NK-WP-0046-T02 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
|
||||
| task | NK-WP-0046-T03 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
|
||||
| task | NK-WP-0047-T01 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
|
||||
| task | NK-WP-0047-T02 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
|
||||
| task | NK-WP-0047-T03 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
|
||||
| task | NK-WP-0048-T01 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T02 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T03 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T04 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T05 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T06 | wait | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T07 | wait | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T08 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T09 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T10 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T11 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T12 | todo | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T13 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T14 | progress | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T15 | wait | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T16 | todo | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T17 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T18 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T19 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T20 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T21 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T22 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T23 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T24 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T25 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T26 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T27 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T28 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T29 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T30 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T31 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0049-T01 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T02 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T03 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T04 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T05 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T06 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T07 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T08 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T09 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T10 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T11 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T12 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T13 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T14 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T15 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T16 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T17 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T18 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T19 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T20 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T21 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T22 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T23 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T24 | todo | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T25 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T26 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T27 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T28 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T29 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T30 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T31 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T32 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T33 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T34 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T35 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T36 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T37 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T38 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0050-T01 | done | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| task | NK-WP-0050-T02 | progress | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| task | NK-WP-0050-T03 | wait | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| task | NK-WP-0051-T01 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T02 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T03 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T04 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T05 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T06 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
|
||||
| intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
|
||||
| intake | NET-IN-0001 | open | — | intakes/intakes.md |
|
||||
| intake | NET-IN-0002 | open | — | intakes/intakes.md |
|
||||
| intake | NET-IN-0003 | open | — | intakes/intakes.md |
|
||||
| intake | NET-IN-0004 | open | — | intakes/intakes.md |
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
[
|
||||
{
|
||||
"path": ".custodian-brief.md",
|
||||
"index": "100644 f60f8bad019e23e6f7e0e074745da0bb2fcbb870 0\t.custodian-brief.md"
|
||||
},
|
||||
{
|
||||
"path": "WORK-RECORDS.md",
|
||||
"index": "100644 76a6b7fc304c508f1b50010cb72d892826c6a831 0\tWORK-RECORDS.md"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,144 @@
|
|||
<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
|
||||
# Custodian Brief — railiance-platform
|
||||
|
||||
**Domain:** financials
|
||||
**Last synced:** 2026-10-17 02:33 UTC
|
||||
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
|
||||
|
||||
## Active Workstreams
|
||||
|
||||
### Prepare the exact seven private-source reader for reuse-surface
|
||||
Progress: 4/5 done | workplan_id: `b55a8aec-7457-563b-990b-4a55ca04d2f6`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Rotate or revoke dedicated seven-source reader within 90 days `f0780e75`
|
||||
|
||||
### Coordinate audit-core temporary custody and recovery exercises
|
||||
Progress: 3/4 done | workplan_id: `f4640325-e89c-591d-b58e-ec6b087900ac`
|
||||
|
||||
**Open tasks:**
|
||||
- ! T03 — Define the coordinated railiance01 reboot exercise `ba729d18`
|
||||
*(wait: Single-node outage exercise needs operator access and a declared restart order coordinated with railiance-infra, railiance-cluster, audit-core and the OpenBao package owner.)*
|
||||
|
||||
### Admit hourly receiver cadence and exact Qonto collector custody
|
||||
Progress: 3/4 done | workplan_id: `d57eeafb-c406-5e1e-841c-5d1288aacabf`
|
||||
|
||||
**Open tasks:**
|
||||
- ► Collect actual producer and independent observer acceptance `7d8e5315`
|
||||
|
||||
### Let the hub-writer caller prove its own reach and pick the workload role in the OpenBao UI
|
||||
Progress: 3/4 done | workplan_id: `04f7c4aa-0a24-5d61-994d-2487ca6bfb91`
|
||||
|
||||
**Open tasks:**
|
||||
- ► Deploy the overlay `94cdfd1c`
|
||||
|
||||
### Coordinate KeyCape live Secret exposure recovery
|
||||
Progress: 4/6 done | workplan_id: `b2c25a01-4a80-55c1-90cf-8538000f7e0e`
|
||||
|
||||
**Open tasks:**
|
||||
- ! T03 — Collect exact owner acknowledgements `714ae011`
|
||||
*(wait: Owner work first: NetKingdom packages the complete resolver sequence as one receipt-producing command; then it enters the attended-window checklist (D1 standing rule).)*
|
||||
- ! T06 — Publish the Railiance/OpenBao custody handoff `3b9748c4`
|
||||
*(wait: Owner work first: the OpenBao owner confirms mount/path/fields and writer/reader authority and publishes the non-secret routing receipt; the handoff enters the attended window only when a command exists.)*
|
||||
|
||||
### Admit the Playwright pilot and establish scoped consumer group access
|
||||
Progress: 5/6 done | workplan_id: `31933d08-c877-5fda-aff9-6220c3705c92`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Connect platform identities and prove managed consumer operation `a82762eb`
|
||||
*(wait: User admitted all identified platform humans and coding agents; their supported Kubernetes authentication/group-mapping route remains unimplemented.)*
|
||||
|
||||
### ArgoCD phase B: adopt the four existing Applications on railiance01
|
||||
Progress: 5/8 done | workplan_id: `98140775-3b9a-5cf9-9af6-722502d487dc`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Adopt issue-core (from rapp-issue-core) `0e619658`
|
||||
- ! Adopt external-secrets (highest risk) `4ca54868`
|
||||
*(wait: Ordered D2 adoption: issue-core T04 must provide automated Argo health/diff and private/authenticated smoke proof; target-revenue T05 is already proven. No further founder approval is required.)*
|
||||
- ! Turn the root back to the production lane `844ff115`
|
||||
*(wait: Restore prune/selfHeal once T03-T06 have automated proof; no further founder go-ahead (D2).)*
|
||||
|
||||
### Onboard rapp-policy-nexus to the ArgoCD production lane
|
||||
Progress: 3/5 done | workplan_id: `ec41a4bd-df18-5b07-9b63-ccb80d9f001c`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Adopt policy-nexus (live, founder go-ahead) `8638fa73`
|
||||
*(wait: Merge approved by D2; runs once T03 diff and root automation (RPF-WP-0044-T07) are proven.)*
|
||||
- ! Prepare the Application and the dry-run evidence `2afb1aac`
|
||||
*(wait: Steps 1 and 3 done 2026-10-11 (docs/evidence/2026-10-11-policy-nexus-adoption-readonly-precheck.json, no stop condition). Step 2 render diff needs the railiance-apps values path from RAPP-POLICY-NEXUS-WP-0002-T02; agents can run it read-only via the k3s tunnel.)*
|
||||
|
||||
### Close Forgejo primary backup coverage on Scaleway
|
||||
Progress: 3/4 done | workplan_id: `7beec1a7-aa82-5a36-9a66-6b60008a2455`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Establish primary full-archive delivery and application recovery `a4807df0`
|
||||
*(wait: Durable scheduled caller, verified inventory and quota/retention gates remain open; September 15 prohibits expiration and scheduled secondary cutover.)*
|
||||
|
||||
### Close S3 service assurance and ownership gaps
|
||||
Progress: 4/7 done | workplan_id: `ca639c3d-3a87-5fa4-ad13-6f2e014b0c84`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Make backup freshness and recurring recovery evidence checkable `d64446fb`
|
||||
*(wait: D2 accepts the activity-core scheduling role; ACTIVITY-WP-0042 must supply the implemented bounded scheduler and scoped custody/execution proof before recurring backup/restore work can execute. No new founder go-ahead is required.)*
|
||||
- ! Produce S3 signals and prove their delivery to the evidence owner `5351e0e4`
|
||||
*(wait: Needs a concrete receiving contract from railiance-telemetry (RTEL-WP-0002) before health transport is accepted; unmonitored state retained meanwhile.)*
|
||||
- ! Obtain acceptance for compatibility assets and derived-record cleanup `3b74f79c`
|
||||
*(wait: Owner-ready handoffs to railiance-forge, rapp-openbao and the ArgoCD bootstrap owner await acceptance; S3 custody contracts stay here until then.)*
|
||||
|
||||
### Adopt activity-core application runtime into railiance01 GitOps
|
||||
Progress: 2/3 done | workplan_id: `b8cf2fc2-60c2-5d4e-a60a-55f1304d9f54`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Observe adoption and enforce bounded promotion readiness `63b44949`
|
||||
|
||||
### Implement reviewed credential lanes with separate owner gates
|
||||
Progress: 7/13 done | workplan_id: `975db491-5412-5e27-8e34-14a2417bb039`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Accept and provision secrets-engine service JWT login `e0c82ea9`
|
||||
*(wait: Agent work, not a human gate: claim refusals (KEY-WP-0039-T02 probe) and capabilities-self deny, then ops-mason MASON-WP-0009-T05.)*
|
||||
- ! Implement the platform operator-write CCR contract and Fluid lane `f47e5bc5`
|
||||
*(wait: Founder session done 2026-10-09; waits on ops-mason verification (MASON-WP-0005-T05) and the FT-WP-0002 owner salt CAS probe.)*
|
||||
- ! Dispose of the ungoverned whynot-design npm duplicate `0dd7c9a5`
|
||||
*(wait: Hold kept by D3 until SECRETS-WP-0006-T06 moves publishing off the legacy whynot-design npm path; then rotate and prove a fresh publish.)*
|
||||
- ! Admit the two factory audit-sender custody lanes `0ef52c26`
|
||||
*(wait: Approved conditionally (ab85ae8a, standing change rule): executes once independent archive readback and the interim bearer revocation receipt exist; owner work with audit-core.)*
|
||||
- ! Retire the approval-engine-operator client delivery and custody (CCR-2026-0018) `af2d4dba`
|
||||
*(wait: Blue lane under the standing change rule (removing access, with reviewed order, rollback and receipts): executes once approval-engine confirms there is no presenter. No founder window needed.)*
|
||||
- ► Implement and prove the separately approved task execution entitlement `914bf383`
|
||||
|
||||
### Coordinate KeyCape live Secret exposure recovery
|
||||
Progress: 4/6 done | workplan_id: `038bc3c0-4492-5b91-95eb-ae515ca205df`
|
||||
|
||||
**Open tasks:**
|
||||
- ! T03 — Collect exact owner acknowledgements `e019c166`
|
||||
*(wait: Canonical RPF-WP-0027-T03: complete platform custody acknowledgements remain missing.)*
|
||||
- ! T06 — Publish the Railiance/OpenBao custody handoff `69326850`
|
||||
*(wait: Canonical RPF-WP-0027-T06: complete field/auth/expiry/handoff contract absent; September 15 operator block remains in force.)*
|
||||
|
||||
### Coordinate audit-core temporary custody and recovery exercises
|
||||
Progress: 2/4 done | workplan_id: `88c4ef7f-0af8-580e-90dc-a2bae2675a4d`
|
||||
|
||||
**Open tasks:**
|
||||
- ! T02 — Define the runtime database lease recovery exercise `caba7fcd`
|
||||
*(wait: Canonical RPF-WP-0015-T02: approved sender identity, fresh bounded attended window, named abort operator and live recovery receipt required.)*
|
||||
- ! T03 — Define the coordinated railiance01 reboot exercise `09cf4065`
|
||||
*(wait: Canonical RPF-WP-0015-T03: fresh outage approval, off-host snapshot, quorum/access evidence and owner execution required.)*
|
||||
|
||||
### Retract public OpenBao listener behind operator-only access
|
||||
Progress: 2/3 done | workplan_id: `6f8a6cbc-c076-5f0a-ade2-281a7ec71360`
|
||||
|
||||
**Open tasks:**
|
||||
- ! T03 — Complete the attended operator cutover `99f8b41f`
|
||||
|
||||
## Inbox Hygiene
|
||||
|
||||
**Missing thread_id:** 14 unread message(s) lack supersession chains.
|
||||
|
||||
---
|
||||
## MCP Orientation (when available)
|
||||
|
||||
If the state-hub MCP server is reachable, call:
|
||||
`get_domain_summary("financials")`
|
||||
This provides richer cross-domain context.
|
||||
If the MCP call fails, use this file as your orientation source.
|
||||
|
|
@ -0,0 +1,176 @@
|
|||
# Work Records — railiance-platform
|
||||
|
||||
> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
|
||||
> stage 3). Do not edit by hand — edit the source file/block listed for
|
||||
> each record and re-run fix-consistency to refresh this index. Archived
|
||||
> workplans are omitted; closed decisions/intakes/engagements stay listed
|
||||
> so recently-resolved work is still visible. [auto]
|
||||
|
||||
| Kind | ID | Status | Lane | Source |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| workplan | RPF-WP-ADHOC-2026-10-10 | finished | — | workplans/ADHOC-2026-10-10.md |
|
||||
| workplan | RPF-WP-ADHOC-2026-10-11 | finished | — | workplans/ADHOC-2026-10-11.md |
|
||||
| workplan | RPF-WP-0015 | active | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
|
||||
| workplan | RPF-WP-0025 | finished | — | workplans/RPF-WP-0025-openbao-operator-only-access.md |
|
||||
| workplan | RPF-WP-0027 | blocked | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
|
||||
| workplan | RPF-WP-0029 | finished | — | workplans/RPF-WP-0029-backup-credential-default-removal.md |
|
||||
| workplan | RPF-WP-0035 | blocked | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
|
||||
| workplan | RPF-WP-0036 | blocked | — | workplans/RPF-WP-0036-platform-service-assurance.md |
|
||||
| workplan | RPF-WP-0038 | blocked | — | workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md |
|
||||
| workplan | RPF-WP-0039 | finished | — | workplans/RPF-WP-0039-vergabe-demo-company-database.md |
|
||||
| workplan | RPF-WP-0040 | finished | — | workplans/RPF-WP-0040-keycape-factor-credential-custody.md |
|
||||
| workplan | RPF-WP-0041 | finished | — | workplans/RPF-WP-0041-state-hub-105m-not-provisioning.md |
|
||||
| workplan | RPF-WP-0042 | finished | — | workplans/RPF-WP-0042-informed-decision-sitting-requester.md |
|
||||
| workplan | RPF-WP-0043 | blocked | — | workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md |
|
||||
| workplan | RPF-WP-0044 | blocked | — | workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md |
|
||||
| workplan | RPF-WP-0045 | finished | — | workplans/RPF-WP-0045-eso-kubernetes-auth-activity-core-email-connect.md |
|
||||
| workplan | RPF-WP-0046 | finished | — | workplans/RPF-WP-0046-eso-database-token-renewal.md |
|
||||
| workplan | RPF-WP-0047 | finished | — | workplans/RPF-WP-0047-bao-coulomb-social-notice-page.md |
|
||||
| workplan | RPF-WP-0048 | blocked | — | workplans/RPF-WP-0048-activity-core-gitops-adoption.md |
|
||||
| workplan | RPF-WP-0049 | finished | — | workplans/RPF-WP-0049-platform-root-custody-record-delivery.md |
|
||||
| workplan | RPF-WP-0050 | finished | — | workplans/RPF-WP-0050-attended-provisioning-preparation.md |
|
||||
| workplan | RPF-WP-0051 | finished | — | workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md |
|
||||
| workplan | RPF-WP-0052 | finished | — | workplans/RPF-WP-0052-authelia-platform-smtp-admission.md |
|
||||
| workplan | RPF-WP-0053 | proposed | — | workplans/RPF-WP-0053-coulomb-paired-backup-admission.md |
|
||||
| workplan | RPF-WP-0054 | finished | — | workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md |
|
||||
| workplan | RPF-WP-0055 | backlog | — | workplans/RPF-WP-0055-keycape-client-secret-rotation-residual.md |
|
||||
| workplan | RPF-WP-0056 | blocked | — | workplans/RPF-WP-0056-playwright-consumer-admission.md |
|
||||
| workplan | RPF-WP-0057 | active | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md |
|
||||
| workplan | RPF-WP-0058 | active | — | workplans/RPF-WP-0058-reuse-private-source-reader.md |
|
||||
| workplan | RPF-WP-0059 | active | — | workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md |
|
||||
| task | RPF-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md |
|
||||
| task | RPF-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | RPF-WP-ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | RPF-WP-ADHOC-2026-10-11-T03 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | RPF-WP-0015-T01 | done | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
|
||||
| task | RPF-WP-0015-T02 | done | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
|
||||
| task | RPF-WP-0015-T03 | wait | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
|
||||
| task | RPF-WP-0015-T04 | done | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
|
||||
| task | RPF-WP-0025-T01 | done | — | workplans/RPF-WP-0025-openbao-operator-only-access.md |
|
||||
| task | RPF-WP-0025-T02 | done | — | workplans/RPF-WP-0025-openbao-operator-only-access.md |
|
||||
| task | RPF-WP-0025-T03 | done | — | workplans/RPF-WP-0025-openbao-operator-only-access.md |
|
||||
| task | RPF-WP-0027-T01 | done | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
|
||||
| task | RPF-WP-0027-T02 | done | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
|
||||
| task | RPF-WP-0027-T03 | wait | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
|
||||
| task | RPF-WP-0027-T04 | done | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
|
||||
| task | RPF-WP-0027-T05 | done | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
|
||||
| task | RPF-WP-0027-T06 | wait | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
|
||||
| task | RPF-WP-0029-T01 | done | — | workplans/RPF-WP-0029-backup-credential-default-removal.md |
|
||||
| task | RPF-WP-0029-T02 | done | — | workplans/RPF-WP-0029-backup-credential-default-removal.md |
|
||||
| task | RPF-WP-0029-T03 | done | — | workplans/RPF-WP-0029-backup-credential-default-removal.md |
|
||||
| task | RPF-WP-0035-T01 | done | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
|
||||
| task | RPF-WP-0035-T02 | wait | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
|
||||
| task | RPF-WP-0035-T03 | wait | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
|
||||
| task | RPF-WP-0035-T04 | done | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
|
||||
| task | RPF-WP-0035-T05 | done | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
|
||||
| task | RPF-WP-0035-T06 | done | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
|
||||
| task | RPF-WP-0035-T07 | wait | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
|
||||
| task | RPF-WP-0035-T08 | wait | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
|
||||
| task | RPF-WP-0035-T09 | done | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
|
||||
| task | RPF-WP-0035-T10 | wait | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
|
||||
| task | RPF-WP-0035-T11 | done | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
|
||||
| task | RPF-WP-0035-T12 | progress | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
|
||||
| task | RPF-WP-0035-T13 | done | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
|
||||
| task | RPF-WP-0036-T01 | done | — | workplans/RPF-WP-0036-platform-service-assurance.md |
|
||||
| task | RPF-WP-0036-T02 | done | — | workplans/RPF-WP-0036-platform-service-assurance.md |
|
||||
| task | RPF-WP-0036-T03 | wait | — | workplans/RPF-WP-0036-platform-service-assurance.md |
|
||||
| task | RPF-WP-0036-T04 | wait | — | workplans/RPF-WP-0036-platform-service-assurance.md |
|
||||
| task | RPF-WP-0036-T05 | done | — | workplans/RPF-WP-0036-platform-service-assurance.md |
|
||||
| task | RPF-WP-0036-T06 | wait | — | workplans/RPF-WP-0036-platform-service-assurance.md |
|
||||
| task | RPF-WP-0036-T07 | done | — | workplans/RPF-WP-0036-platform-service-assurance.md |
|
||||
| task | RPF-WP-0038-T01 | done | — | workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md |
|
||||
| task | RPF-WP-0038-T02 | done | — | workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md |
|
||||
| task | RPF-WP-0038-T03 | done | — | workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md |
|
||||
| task | RPF-WP-0038-T04 | wait | — | workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md |
|
||||
| task | RPF-WP-0039-T01 | done | — | workplans/RPF-WP-0039-vergabe-demo-company-database.md |
|
||||
| task | RPF-WP-0039-T02 | done | — | workplans/RPF-WP-0039-vergabe-demo-company-database.md |
|
||||
| task | RPF-WP-0040-T01 | done | — | workplans/RPF-WP-0040-keycape-factor-credential-custody.md |
|
||||
| task | RPF-WP-0040-T02 | done | — | workplans/RPF-WP-0040-keycape-factor-credential-custody.md |
|
||||
| task | RPF-WP-0040-T03 | done | — | workplans/RPF-WP-0040-keycape-factor-credential-custody.md |
|
||||
| task | RPF-WP-0040-T04 | done | — | workplans/RPF-WP-0040-keycape-factor-credential-custody.md |
|
||||
| task | RPF-WP-0041-T01 | done | — | workplans/RPF-WP-0041-state-hub-105m-not-provisioning.md |
|
||||
| task | RPF-WP-0042-T01 | done | — | workplans/RPF-WP-0042-informed-decision-sitting-requester.md |
|
||||
| task | RPF-WP-0042-T02 | done | — | workplans/RPF-WP-0042-informed-decision-sitting-requester.md |
|
||||
| task | RPF-WP-0043-T01 | done | — | workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md |
|
||||
| task | RPF-WP-0043-T02 | done | — | workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md |
|
||||
| task | RPF-WP-0043-T03 | wait | — | workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md |
|
||||
| task | RPF-WP-0043-T04 | wait | — | workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md |
|
||||
| task | RPF-WP-0043-T05 | done | — | workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md |
|
||||
| task | RPF-WP-0044-T01 | done | — | workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md |
|
||||
| task | RPF-WP-0044-T02 | done | — | workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md |
|
||||
| task | RPF-WP-0044-T03 | done | — | workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md |
|
||||
| task | RPF-WP-0044-T04 | wait | — | workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md |
|
||||
| task | RPF-WP-0044-T05 | done | — | workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md |
|
||||
| task | RPF-WP-0044-T06 | wait | — | workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md |
|
||||
| task | RPF-WP-0044-T07 | wait | — | workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md |
|
||||
| task | RPF-WP-0044-T08 | done | — | workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md |
|
||||
| task | RPF-WP-0045-T01 | done | — | workplans/RPF-WP-0045-eso-kubernetes-auth-activity-core-email-connect.md |
|
||||
| task | RPF-WP-0045-T02 | done | — | workplans/RPF-WP-0045-eso-kubernetes-auth-activity-core-email-connect.md |
|
||||
| task | RPF-WP-0045-T03 | done | — | workplans/RPF-WP-0045-eso-kubernetes-auth-activity-core-email-connect.md |
|
||||
| task | RPF-WP-0045-T04 | done | — | workplans/RPF-WP-0045-eso-kubernetes-auth-activity-core-email-connect.md |
|
||||
| task | RPF-WP-0045-T05 | cancel | — | workplans/RPF-WP-0045-eso-kubernetes-auth-activity-core-email-connect.md |
|
||||
| task | RPF-WP-0045-T06 | done | — | workplans/RPF-WP-0045-eso-kubernetes-auth-activity-core-email-connect.md |
|
||||
| task | RPF-WP-0046-T01 | done | — | workplans/RPF-WP-0046-eso-database-token-renewal.md |
|
||||
| task | RPF-WP-0046-T02 | done | — | workplans/RPF-WP-0046-eso-database-token-renewal.md |
|
||||
| task | RPF-WP-0046-T03 | done | — | workplans/RPF-WP-0046-eso-database-token-renewal.md |
|
||||
| task | RPF-WP-0046-T04 | done | — | workplans/RPF-WP-0046-eso-database-token-renewal.md |
|
||||
| task | RPF-WP-0046-T05 | done | — | workplans/RPF-WP-0046-eso-database-token-renewal.md |
|
||||
| task | RPF-WP-0046-T06 | done | — | workplans/RPF-WP-0046-eso-database-token-renewal.md |
|
||||
| task | RPF-WP-0047-T01 | done | — | workplans/RPF-WP-0047-bao-coulomb-social-notice-page.md |
|
||||
| task | RPF-WP-0047-T02 | done | — | workplans/RPF-WP-0047-bao-coulomb-social-notice-page.md |
|
||||
| task | RPF-WP-0047-T03 | done | — | workplans/RPF-WP-0047-bao-coulomb-social-notice-page.md |
|
||||
| task | RPF-WP-0048-T01 | done | — | workplans/RPF-WP-0048-activity-core-gitops-adoption.md |
|
||||
| task | RPF-WP-0048-T02 | wait | — | workplans/RPF-WP-0048-activity-core-gitops-adoption.md |
|
||||
| task | RPF-WP-0048-T03 | done | — | workplans/RPF-WP-0048-activity-core-gitops-adoption.md |
|
||||
| task | RPF-WP-0049-T01 | done | — | workplans/RPF-WP-0049-platform-root-custody-record-delivery.md |
|
||||
| task | RPF-WP-0049-T02 | done | — | workplans/RPF-WP-0049-platform-root-custody-record-delivery.md |
|
||||
| task | RPF-WP-0049-T03 | done | — | workplans/RPF-WP-0049-platform-root-custody-record-delivery.md |
|
||||
| task | RPF-WP-0049-T04 | done | — | workplans/RPF-WP-0049-platform-root-custody-record-delivery.md |
|
||||
| task | RPF-WP-0049-T05 | done | — | workplans/RPF-WP-0049-platform-root-custody-record-delivery.md |
|
||||
| task | RPF-WP-0050-T01 | done | — | workplans/RPF-WP-0050-attended-provisioning-preparation.md |
|
||||
| task | RPF-WP-0050-T02 | done | — | workplans/RPF-WP-0050-attended-provisioning-preparation.md |
|
||||
| task | RPF-WP-0050-T03 | cancel | — | workplans/RPF-WP-0050-attended-provisioning-preparation.md |
|
||||
| task | RPF-WP-0050-T04 | done | — | workplans/RPF-WP-0050-attended-provisioning-preparation.md |
|
||||
| task | RPF-WP-0051-T01 | done | — | workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md |
|
||||
| task | RPF-WP-0051-T02 | done | — | workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md |
|
||||
| task | RPF-WP-0051-T03 | done | — | workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md |
|
||||
| task | RPF-WP-0052-T01 | done | — | workplans/RPF-WP-0052-authelia-platform-smtp-admission.md |
|
||||
| task | RPF-WP-0052-T02 | done | — | workplans/RPF-WP-0052-authelia-platform-smtp-admission.md |
|
||||
| task | RPF-WP-0052-T03 | done | — | workplans/RPF-WP-0052-authelia-platform-smtp-admission.md |
|
||||
| task | RPF-WP-0053-T01 | progress | — | workplans/RPF-WP-0053-coulomb-paired-backup-admission.md |
|
||||
| task | RPF-WP-0053-T02 | todo | — | workplans/RPF-WP-0053-coulomb-paired-backup-admission.md |
|
||||
| task | RPF-WP-0053-T03 | todo | — | workplans/RPF-WP-0053-coulomb-paired-backup-admission.md |
|
||||
| task | RPF-WP-0053-T04 | todo | — | workplans/RPF-WP-0053-coulomb-paired-backup-admission.md |
|
||||
| task | RPF-WP-0053-T05 | progress | — | workplans/RPF-WP-0053-coulomb-paired-backup-admission.md |
|
||||
| task | RPF-WP-0053-T06 | done | — | workplans/RPF-WP-0053-coulomb-paired-backup-admission.md |
|
||||
| task | RPF-WP-0054-T01 | done | — | workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md |
|
||||
| task | RPF-WP-0054-T02 | done | — | workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md |
|
||||
| task | RPF-WP-0054-T03 | done | — | workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md |
|
||||
| task | RPF-WP-0054-T04 | done | — | workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md |
|
||||
| task | RPF-WP-0054-T05 | done | — | workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md |
|
||||
| task | RPF-WP-0054-T06 | done | — | workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md |
|
||||
| task | RPF-WP-0054-T07 | cancel | — | workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md |
|
||||
| task | RPF-WP-0055-T01 | todo | — | workplans/RPF-WP-0055-keycape-client-secret-rotation-residual.md |
|
||||
| task | RPF-WP-0056-T01 | done | — | workplans/RPF-WP-0056-playwright-consumer-admission.md |
|
||||
| task | RPF-WP-0056-T02 | done | — | workplans/RPF-WP-0056-playwright-consumer-admission.md |
|
||||
| task | RPF-WP-0056-T03 | wait | — | workplans/RPF-WP-0056-playwright-consumer-admission.md |
|
||||
| task | RPF-WP-0056-T04 | done | — | workplans/RPF-WP-0056-playwright-consumer-admission.md |
|
||||
| task | RPF-WP-0056-T05 | done | — | workplans/RPF-WP-0056-playwright-consumer-admission.md |
|
||||
| task | RPF-WP-0056-T06 | done | — | workplans/RPF-WP-0056-playwright-consumer-admission.md |
|
||||
| task | RPF-WP-0057-T01 | done | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md |
|
||||
| task | RPF-WP-0057-T02 | done | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md |
|
||||
| task | RPF-WP-0057-T03 | done | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md |
|
||||
| task | RPF-WP-0057-T04 | progress | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md |
|
||||
| task | RPF-WP-0058-T01 | done | — | workplans/RPF-WP-0058-reuse-private-source-reader.md |
|
||||
| task | RPF-WP-0058-T02 | done | — | workplans/RPF-WP-0058-reuse-private-source-reader.md |
|
||||
| task | RPF-WP-0058-T03 | done | — | workplans/RPF-WP-0058-reuse-private-source-reader.md |
|
||||
| task | RPF-WP-0058-T04 | done | — | workplans/RPF-WP-0058-reuse-private-source-reader.md |
|
||||
| task | RPF-WP-0058-T05 | wait | — | workplans/RPF-WP-0058-reuse-private-source-reader.md |
|
||||
| task | RPF-WP-0059-T01 | done | — | workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md |
|
||||
| task | RPF-WP-0059-T02 | done | — | workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md |
|
||||
| task | RPF-WP-0059-T03 | done | — | workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md |
|
||||
| task | RPF-WP-0059-T04 | progress | — | workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md |
|
||||
| intake | RPF-IN-0001 | closed | — | intakes/intakes.md |
|
||||
| intake | RPF-IN-0002 | open | — | intakes/intakes.md |
|
||||
| intake | RPF-IN-0003 | open | — | intakes/intakes.md |
|
||||
| intake | RPF-IN-0004 | open | — | intakes/intakes.md |
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
[
|
||||
{
|
||||
"path": ".custodian-brief.md",
|
||||
"index": "100644 1c9e635012d170c76646bf76d5202f6de163a643 0\t.custodian-brief.md"
|
||||
},
|
||||
{
|
||||
"path": "WORK-RECORDS.md",
|
||||
"index": "100644 dc7f3aab6de945558ddb9e48a482a9d92d734c3b 0\tWORK-RECORDS.md"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,91 @@
|
|||
<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
|
||||
# Custodian Brief — net-kingdom
|
||||
|
||||
**Domain:** infotech
|
||||
**Last synced:** 2026-10-17 09:16 UTC
|
||||
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
|
||||
|
||||
## Active Workstreams
|
||||
|
||||
### Publish the NetKingdom emission-cadence security profile
|
||||
Progress: 5/6 done | workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc`
|
||||
|
||||
**Open tasks:**
|
||||
- ► Bind and hand off the published contract `e3fbc8b8`
|
||||
|
||||
### Register Playwright human and agent consumers through governed identity delivery
|
||||
Progress: 1/3 done | workplan_id: `06ba98d5-609e-5aaa-9bf7-4c4f4460e377`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Verify issuer and real consumer acceptance `5a3aaf57`
|
||||
*(wait: Await owner-scoped registry/custody activation, native cluster authentication and individual transport, then real human and agent acceptance under CUST-WP-0080-T05.)*
|
||||
- ► Deliver custody integration and guarded registration activation `a9dadd07`
|
||||
|
||||
### Remove bootstrap secret output and verify separated recovery custody
|
||||
Progress: 26/38 done | workplan_id: `17d315f0-829e-57c7-85cc-3a7914152804`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Accept remaining recovery and caller evidence and close the G08 handoff `d68cd4d3`
|
||||
*(wait: Await the separately tracked native service proofs, current/legacy caller dispositions and residual-scope decisions; archive recovery, backup activation, independent outage retrieval and guide publication are complete.)*
|
||||
- ! Resolve historical credential and configuration-preserving rotation dispositions `3ea6bf00`
|
||||
*(wait: Await the caller/consumer ledger, current replacement-lane acceptance and explicit credential-owner dispositions; existing exposure-rotation deferral is unchanged.)*
|
||||
- ! Verify current caller and provider admission at their actual boundaries `77aa42be`
|
||||
*(wait: Await the current-caller ledger and exact per-caller owner admission/test inputs; the backup credential grants do not admit unrelated callers.)*
|
||||
- ! Prove retained privacyIDEA token decryption and existing-token MFA `6f8af1a7`
|
||||
*(wait: LLDAP T16, token-material T31 and audit T20 passed; await the exact isolated MFA adapter and owner-selected retained-token/factor inputs.)*
|
||||
- ! Prove restored KeyCape issuer, policy and consumer continuity `141dd773`
|
||||
*(wait: Source and synthetic KeyCape lifecycle proof are delivered in T32; await exact owner-held recovery attempt preparation T33, selected consumer acceptance and retained-token MFA for the selected flow.)*
|
||||
- ! Prove restored Authelia storage and OIDC continuity `b47f9975`
|
||||
*(wait: LLDAP recovery T16 passed; await the exact isolated Authelia adapter/procedure and private authentication-flow inputs from T15.)*
|
||||
- ! Prepare the exact owner-held KeyCape recovery attempt `56c8d469`
|
||||
*(wait: Source custody/preflight preparation is evidenced in T34; await original TLS/trust recovery disposition T35 and selected original registration/private-admission metadata T36 before final reviewed command and existing owner process.)*
|
||||
- … and 5 more open tasks
|
||||
|
||||
### Establish SecurityCaseTypes so that known security cases are light
|
||||
Progress: 25/31 done | workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb`
|
||||
|
||||
**Open tasks:**
|
||||
- ! T05 — Acknowledge the type through informed-decision `d9b26bcf`
|
||||
*(wait: Type1.2 architecture has a confirmed source-only founder acknowledgment; canonical1.1 remains unchanged/default and the1.2 reference case stays proposed. Needs explicit version selection/reference-source integration without normal admission bypass, closed owner adapters plus global/native receipt verifier (WARDEN-WP-0044-T03), independently verified six-object structural materialization and CCR42 claims/created-only provenance, exact broker/case/source reconciliation, then separately authorized native mint/delivery and attended registry/consumer verification. Source acknowledgment, a bundle or local tests do not prove implemented/materialized/live status.)*
|
||||
- ! T06 — First KnownSecurityCase: Forgejo `c3c9c3ae`
|
||||
*(wait: The next types follow once the first one is proven end to end.)*
|
||||
- ! T15 — Define authenticated recovery for lost registration process state `1b825705`
|
||||
*(wait: Source candidate 061461e is merged. Waiting on the owner to select the real authenticated original-attempt holder and native readback, and on independent re-review of the changed T13 adapter source.)*
|
||||
- ► T14 — Admit governed group rollback against native owner boundaries `fce95440`
|
||||
- · T12 — Prepare NetKingdom-owned attended step adapters `7ce4eee3`
|
||||
- · T16 — Select and review the actual machine descriptor composition `200bf500`
|
||||
|
||||
### Define an execution-attribution receipt for Railiance runs
|
||||
Progress: 1/2 done | workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Agree the evidence holder and schema with audit-core and Railiance `963120c1`
|
||||
*(wait: Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance.)*
|
||||
|
||||
### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker
|
||||
Progress: 1/9 done | workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Admit the database consumer `2fe6f100`
|
||||
*(wait: ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence.)*
|
||||
- ! Package the broker deployment `32d1411b`
|
||||
*(wait: ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment.)*
|
||||
- ! Integrate an upstream identity provider `6697a994`
|
||||
*(wait: Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence.)*
|
||||
- ! Define federated assurance `d845380d`
|
||||
*(wait: Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners.)*
|
||||
- ! Verify IAM conformance and coexistence `9cb7fd93`
|
||||
*(wait: Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent.)*
|
||||
- ! Enforce tenant and platform boundaries `38998c68`
|
||||
*(wait: Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission.)*
|
||||
- ! Prove recovery and audit delivery `e5f44ddc`
|
||||
*(wait: Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent.)*
|
||||
- … and 1 more open tasks
|
||||
|
||||
---
|
||||
## MCP Orientation (when available)
|
||||
|
||||
If the state-hub MCP server is reachable, call:
|
||||
`get_domain_summary("infotech")`
|
||||
This provides richer cross-domain context.
|
||||
If the MCP call fails, use this file as your orientation source.
|
||||
|
|
@ -0,0 +1,289 @@
|
|||
# Work Records — net-kingdom
|
||||
|
||||
> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
|
||||
> stage 3). Do not edit by hand — edit the source file/block listed for
|
||||
> each record and re-run fix-consistency to refresh this index. Archived
|
||||
> workplans are omitted; closed decisions/intakes/engagements stay listed
|
||||
> so recently-resolved work is still visible. [auto]
|
||||
|
||||
| Kind | ID | Status | Lane | Source |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| workplan | NK-WP-ADHOC-2026-07-02 | finished | — | workplans/ADHOC-2026-07-02.md |
|
||||
| workplan | NK-WP-ADHOC-2026-08-14 | finished | — | workplans/ADHOC-2026-08-14.md |
|
||||
| workplan | NK-WP-ADHOC-2026-08-23 | finished | — | workplans/ADHOC-2026-08-23.md |
|
||||
| workplan | NK-WP-ADHOC-2026-10-03 | finished | — | workplans/ADHOC-2026-10-03.md |
|
||||
| workplan | NK-WP-ADHOC-2026-10-10 | finished | — | workplans/ADHOC-2026-10-10.md |
|
||||
| workplan | NK-WP-ADHOC-2026-10-11 | finished | — | workplans/ADHOC-2026-10-11.md |
|
||||
| workplan | NK-WP-ADHOC-2026-10-16 | finished | — | workplans/ADHOC-2026-10-16.md |
|
||||
| workplan | NET-WP-0020 | finished | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| workplan | NK-WP-0009 | finished | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| workplan | NK-WP-0011 | active | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| workplan | NK-WP-0021 | finished | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| workplan | NK-WP-0022 | finished | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| workplan | NK-WP-0023 | finished | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| workplan | NK-WP-0024 | finished | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| workplan | NK-WP-0025 | finished | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| workplan | NK-WP-0026 | finished | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
|
||||
| workplan | NK-WP-0027 | backlog | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| workplan | NK-WP-0028 | finished | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| workplan | NK-WP-0029 | finished | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| workplan | NK-WP-0030 | finished | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| workplan | NK-WP-0031 | finished | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| workplan | NK-WP-0032 | finished | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| workplan | NK-WP-0033 | finished | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| workplan | NK-WP-0034 | finished | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| workplan | NK-WP-0035 | active | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| workplan | NK-WP-0036 | finished | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| workplan | NK-WP-0037 | finished | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
|
||||
| workplan | NK-WP-0038 | finished | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
|
||||
| workplan | NK-WP-0039 | finished | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| workplan | NK-WP-0040 | active | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
|
||||
| workplan | NK-WP-0041 | finished | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
|
||||
| workplan | NK-WP-0042 | finished | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
|
||||
| workplan | NK-WP-0043 | finished | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
|
||||
| workplan | NK-WP-0044 | finished | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| workplan | NK-WP-0045 | finished | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| workplan | NK-WP-0046 | finished | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
|
||||
| workplan | NK-WP-0047 | finished | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
|
||||
| workplan | NK-WP-0048 | active | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| workplan | NK-WP-0049 | active | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| workplan | NK-WP-0050 | active | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| workplan | NK-WP-0051 | finished | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md |
|
||||
| task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md |
|
||||
| task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md |
|
||||
| task | NK-WP-ADHOC-2026-08-14-T02 | done | — | workplans/ADHOC-2026-08-14.md |
|
||||
| task | NK-WP-ADHOC-2026-08-14-T03 | done | — | workplans/ADHOC-2026-08-14.md |
|
||||
| task | NK-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md |
|
||||
| task | NK-WP-ADHOC-2026-10-03-T01 | done | — | workplans/ADHOC-2026-10-03.md |
|
||||
| task | NK-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T03 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T04 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T05 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T06 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T07 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-16-T01 | done | — | workplans/ADHOC-2026-10-16.md |
|
||||
| task | NET-WP-0020-T01 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NET-WP-0020-T02 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NET-WP-0020-T03 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NET-WP-0020-T04 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NET-WP-0020-T05 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NK-WP-0009-T01 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T02 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T03 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T04 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T05 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T06 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0011-T01 | done | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T02 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T03 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T04 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T05 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T06 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T07 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T08 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T09 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0021-T01 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0021-T02 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0021-T03 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0021-T04 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0021-T05 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0022-T01 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T02 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T03 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T04 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T05 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T06 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T07 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T08 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0023-T01 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T02 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T03 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T04 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T05 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T06 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T07 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T08 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0024-T01 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| task | NK-WP-0024-T02 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| task | NK-WP-0024-T03 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| task | NK-WP-0024-T04 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| task | NK-WP-0025-T01 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T02 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T03 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T04 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T05 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0026-T01 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
|
||||
| task | NK-WP-0026-T02 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
|
||||
| task | NK-WP-0027-T01 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T02 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T03 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T04 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T05 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T06 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0028-T01 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| task | NK-WP-0028-T02 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| task | NK-WP-0028-T03 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| task | NK-WP-0028-T04 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| task | NK-WP-0029-T01 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| task | NK-WP-0029-T02 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| task | NK-WP-0029-T03 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| task | NK-WP-0029-T04 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| task | NK-WP-0030-T01 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0030-T02 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0030-T03 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0030-T04 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0030-T05 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0031-T01 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0031-T02 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0031-T03 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0031-T04 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0031-T05 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0032-T01 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| task | NK-WP-0032-T02 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| task | NK-WP-0032-T03 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| task | NK-WP-0032-T04 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| task | NK-WP-0033-T01 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0033-T02 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0033-T03 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0033-T04 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0033-T05 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0034-T01 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| task | NK-WP-0034-T02 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| task | NK-WP-0034-T03 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| task | NK-WP-0034-T04 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| task | NK-WP-0035-T01 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T02 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T03 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T04 | progress | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T05 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T06 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0036-T01 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T02 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T03 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T04 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T05 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T06 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0037-T01 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
|
||||
| task | NK-WP-0037-T02 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
|
||||
| task | NK-WP-0038-T01 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
|
||||
| task | NK-WP-0038-T02 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
|
||||
| task | NK-WP-0039-T01 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-0039-T02 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-0039-T03 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-0039-T04 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-0040-T01 | done | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
|
||||
| task | NK-WP-0040-T02 | wait | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
|
||||
| task | NK-WP-0041-T01 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
|
||||
| task | NK-WP-0041-T02 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
|
||||
| task | NK-WP-0041-T03 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
|
||||
| task | NK-WP-0042-T01 | done | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
|
||||
| task | NK-WP-0042-T02 | cancel | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
|
||||
| task | NK-WP-0043-T01 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
|
||||
| task | NK-WP-0043-T02 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
|
||||
| task | NK-WP-0043-T03 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
|
||||
| task | NK-WP-0044-T01 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T02 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T03 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T04 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T05 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T06 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T07 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0045-T01 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T02 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T03 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T04 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T05 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T06 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0046-T01 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
|
||||
| task | NK-WP-0046-T02 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
|
||||
| task | NK-WP-0046-T03 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
|
||||
| task | NK-WP-0047-T01 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
|
||||
| task | NK-WP-0047-T02 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
|
||||
| task | NK-WP-0047-T03 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
|
||||
| task | NK-WP-0048-T01 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T02 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T03 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T04 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T05 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T06 | wait | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T07 | wait | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T08 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T09 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T10 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T11 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T12 | todo | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T13 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T14 | progress | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T15 | wait | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T16 | todo | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T17 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T18 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T19 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T20 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T21 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T22 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T23 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T24 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T25 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T26 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T27 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T28 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T29 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T30 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T31 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0049-T01 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T02 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T03 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T04 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T05 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T06 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T07 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T08 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T09 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T10 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T11 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T12 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T13 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T14 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T15 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T16 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T17 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T18 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T19 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T20 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T21 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T22 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T23 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T24 | todo | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T25 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T26 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T27 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T28 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T29 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T30 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T31 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T32 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T33 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T34 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T35 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T36 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T37 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T38 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0050-T01 | done | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| task | NK-WP-0050-T02 | progress | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| task | NK-WP-0050-T03 | wait | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| task | NK-WP-0051-T01 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T02 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T03 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T04 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T05 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T06 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
|
||||
| intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
|
||||
| intake | NET-IN-0001 | open | — | intakes/intakes.md |
|
||||
| intake | NET-IN-0002 | open | — | intakes/intakes.md |
|
||||
| intake | NET-IN-0003 | open | — | intakes/intakes.md |
|
||||
| intake | NET-IN-0004 | open | — | intakes/intakes.md |
|
||||
|
|
@ -0,0 +1,91 @@
|
|||
<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
|
||||
# Custodian Brief — net-kingdom
|
||||
|
||||
**Domain:** infotech
|
||||
**Last synced:** 2026-10-17 09:16 UTC
|
||||
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
|
||||
|
||||
## Active Workstreams
|
||||
|
||||
### Publish the NetKingdom emission-cadence security profile
|
||||
Progress: 5/6 done | workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc`
|
||||
|
||||
**Open tasks:**
|
||||
- ► Bind and hand off the published contract `e3fbc8b8`
|
||||
|
||||
### Register Playwright human and agent consumers through governed identity delivery
|
||||
Progress: 1/3 done | workplan_id: `06ba98d5-609e-5aaa-9bf7-4c4f4460e377`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Verify issuer and real consumer acceptance `5a3aaf57`
|
||||
*(wait: Await owner-scoped registry/custody activation, native cluster authentication and individual transport, then real human and agent acceptance under CUST-WP-0080-T05.)*
|
||||
- ► Deliver custody integration and guarded registration activation `a9dadd07`
|
||||
|
||||
### Remove bootstrap secret output and verify separated recovery custody
|
||||
Progress: 26/38 done | workplan_id: `17d315f0-829e-57c7-85cc-3a7914152804`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Accept remaining recovery and caller evidence and close the G08 handoff `d68cd4d3`
|
||||
*(wait: Await the separately tracked native service proofs, current/legacy caller dispositions and residual-scope decisions; archive recovery, backup activation, independent outage retrieval and guide publication are complete.)*
|
||||
- ! Resolve historical credential and configuration-preserving rotation dispositions `3ea6bf00`
|
||||
*(wait: Await the caller/consumer ledger, current replacement-lane acceptance and explicit credential-owner dispositions; existing exposure-rotation deferral is unchanged.)*
|
||||
- ! Verify current caller and provider admission at their actual boundaries `77aa42be`
|
||||
*(wait: Await the current-caller ledger and exact per-caller owner admission/test inputs; the backup credential grants do not admit unrelated callers.)*
|
||||
- ! Prove retained privacyIDEA token decryption and existing-token MFA `6f8af1a7`
|
||||
*(wait: LLDAP T16, token-material T31 and audit T20 passed; await the exact isolated MFA adapter and owner-selected retained-token/factor inputs.)*
|
||||
- ! Prove restored KeyCape issuer, policy and consumer continuity `141dd773`
|
||||
*(wait: Source and synthetic KeyCape lifecycle proof are delivered in T32; await exact owner-held recovery attempt preparation T33, selected consumer acceptance and retained-token MFA for the selected flow.)*
|
||||
- ! Prove restored Authelia storage and OIDC continuity `b47f9975`
|
||||
*(wait: LLDAP recovery T16 passed; await the exact isolated Authelia adapter/procedure and private authentication-flow inputs from T15.)*
|
||||
- ! Prepare the exact owner-held KeyCape recovery attempt `56c8d469`
|
||||
*(wait: Source custody/preflight preparation is evidenced in T34; await original TLS/trust recovery disposition T35 and selected original registration/private-admission metadata T36 before final reviewed command and existing owner process.)*
|
||||
- … and 5 more open tasks
|
||||
|
||||
### Establish SecurityCaseTypes so that known security cases are light
|
||||
Progress: 25/31 done | workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb`
|
||||
|
||||
**Open tasks:**
|
||||
- ! T05 — Acknowledge the type through informed-decision `d9b26bcf`
|
||||
*(wait: Type1.2 architecture has a confirmed source-only founder acknowledgment; canonical1.1 remains unchanged/default and the1.2 reference case stays proposed. Needs explicit version selection/reference-source integration without normal admission bypass, closed owner adapters plus global/native receipt verifier (WARDEN-WP-0044-T03), independently verified six-object structural materialization and CCR42 claims/created-only provenance, exact broker/case/source reconciliation, then separately authorized native mint/delivery and attended registry/consumer verification. Source acknowledgment, a bundle or local tests do not prove implemented/materialized/live status.)*
|
||||
- ! T06 — First KnownSecurityCase: Forgejo `c3c9c3ae`
|
||||
*(wait: The next types follow once the first one is proven end to end.)*
|
||||
- ! T15 — Define authenticated recovery for lost registration process state `1b825705`
|
||||
*(wait: Source candidate 061461e is merged. Waiting on the owner to select the real authenticated original-attempt holder and native readback, and on independent re-review of the changed T13 adapter source.)*
|
||||
- ► T14 — Admit governed group rollback against native owner boundaries `fce95440`
|
||||
- · T12 — Prepare NetKingdom-owned attended step adapters `7ce4eee3`
|
||||
- · T16 — Select and review the actual machine descriptor composition `200bf500`
|
||||
|
||||
### Define an execution-attribution receipt for Railiance runs
|
||||
Progress: 1/2 done | workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Agree the evidence holder and schema with audit-core and Railiance `963120c1`
|
||||
*(wait: Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance.)*
|
||||
|
||||
### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker
|
||||
Progress: 1/9 done | workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Admit the database consumer `2fe6f100`
|
||||
*(wait: ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence.)*
|
||||
- ! Package the broker deployment `32d1411b`
|
||||
*(wait: ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment.)*
|
||||
- ! Integrate an upstream identity provider `6697a994`
|
||||
*(wait: Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence.)*
|
||||
- ! Define federated assurance `d845380d`
|
||||
*(wait: Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners.)*
|
||||
- ! Verify IAM conformance and coexistence `9cb7fd93`
|
||||
*(wait: Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent.)*
|
||||
- ! Enforce tenant and platform boundaries `38998c68`
|
||||
*(wait: Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission.)*
|
||||
- ! Prove recovery and audit delivery `e5f44ddc`
|
||||
*(wait: Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent.)*
|
||||
- … and 1 more open tasks
|
||||
|
||||
---
|
||||
## MCP Orientation (when available)
|
||||
|
||||
If the state-hub MCP server is reachable, call:
|
||||
`get_domain_summary("infotech")`
|
||||
This provides richer cross-domain context.
|
||||
If the MCP call fails, use this file as your orientation source.
|
||||
|
|
@ -0,0 +1,289 @@
|
|||
# Work Records — net-kingdom
|
||||
|
||||
> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
|
||||
> stage 3). Do not edit by hand — edit the source file/block listed for
|
||||
> each record and re-run fix-consistency to refresh this index. Archived
|
||||
> workplans are omitted; closed decisions/intakes/engagements stay listed
|
||||
> so recently-resolved work is still visible. [auto]
|
||||
|
||||
| Kind | ID | Status | Lane | Source |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| workplan | NK-WP-ADHOC-2026-07-02 | finished | — | workplans/ADHOC-2026-07-02.md |
|
||||
| workplan | NK-WP-ADHOC-2026-08-14 | finished | — | workplans/ADHOC-2026-08-14.md |
|
||||
| workplan | NK-WP-ADHOC-2026-08-23 | finished | — | workplans/ADHOC-2026-08-23.md |
|
||||
| workplan | NK-WP-ADHOC-2026-10-03 | finished | — | workplans/ADHOC-2026-10-03.md |
|
||||
| workplan | NK-WP-ADHOC-2026-10-10 | finished | — | workplans/ADHOC-2026-10-10.md |
|
||||
| workplan | NK-WP-ADHOC-2026-10-11 | finished | — | workplans/ADHOC-2026-10-11.md |
|
||||
| workplan | NK-WP-ADHOC-2026-10-16 | finished | — | workplans/ADHOC-2026-10-16.md |
|
||||
| workplan | NET-WP-0020 | finished | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| workplan | NK-WP-0009 | finished | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| workplan | NK-WP-0011 | active | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| workplan | NK-WP-0021 | finished | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| workplan | NK-WP-0022 | finished | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| workplan | NK-WP-0023 | finished | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| workplan | NK-WP-0024 | finished | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| workplan | NK-WP-0025 | finished | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| workplan | NK-WP-0026 | finished | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
|
||||
| workplan | NK-WP-0027 | backlog | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| workplan | NK-WP-0028 | finished | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| workplan | NK-WP-0029 | finished | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| workplan | NK-WP-0030 | finished | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| workplan | NK-WP-0031 | finished | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| workplan | NK-WP-0032 | finished | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| workplan | NK-WP-0033 | finished | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| workplan | NK-WP-0034 | finished | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| workplan | NK-WP-0035 | active | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| workplan | NK-WP-0036 | finished | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| workplan | NK-WP-0037 | finished | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
|
||||
| workplan | NK-WP-0038 | finished | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
|
||||
| workplan | NK-WP-0039 | finished | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| workplan | NK-WP-0040 | active | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
|
||||
| workplan | NK-WP-0041 | finished | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
|
||||
| workplan | NK-WP-0042 | finished | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
|
||||
| workplan | NK-WP-0043 | finished | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
|
||||
| workplan | NK-WP-0044 | finished | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| workplan | NK-WP-0045 | finished | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| workplan | NK-WP-0046 | finished | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
|
||||
| workplan | NK-WP-0047 | finished | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
|
||||
| workplan | NK-WP-0048 | active | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| workplan | NK-WP-0049 | active | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| workplan | NK-WP-0050 | active | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| workplan | NK-WP-0051 | finished | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md |
|
||||
| task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md |
|
||||
| task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md |
|
||||
| task | NK-WP-ADHOC-2026-08-14-T02 | done | — | workplans/ADHOC-2026-08-14.md |
|
||||
| task | NK-WP-ADHOC-2026-08-14-T03 | done | — | workplans/ADHOC-2026-08-14.md |
|
||||
| task | NK-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md |
|
||||
| task | NK-WP-ADHOC-2026-10-03-T01 | done | — | workplans/ADHOC-2026-10-03.md |
|
||||
| task | NK-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T03 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T04 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T05 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T06 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T07 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-16-T01 | done | — | workplans/ADHOC-2026-10-16.md |
|
||||
| task | NET-WP-0020-T01 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NET-WP-0020-T02 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NET-WP-0020-T03 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NET-WP-0020-T04 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NET-WP-0020-T05 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NK-WP-0009-T01 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T02 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T03 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T04 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T05 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T06 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0011-T01 | done | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T02 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T03 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T04 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T05 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T06 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T07 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T08 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T09 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0021-T01 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0021-T02 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0021-T03 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0021-T04 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0021-T05 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0022-T01 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T02 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T03 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T04 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T05 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T06 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T07 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T08 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0023-T01 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T02 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T03 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T04 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T05 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T06 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T07 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T08 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0024-T01 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| task | NK-WP-0024-T02 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| task | NK-WP-0024-T03 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| task | NK-WP-0024-T04 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| task | NK-WP-0025-T01 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T02 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T03 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T04 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T05 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0026-T01 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
|
||||
| task | NK-WP-0026-T02 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
|
||||
| task | NK-WP-0027-T01 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T02 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T03 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T04 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T05 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T06 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0028-T01 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| task | NK-WP-0028-T02 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| task | NK-WP-0028-T03 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| task | NK-WP-0028-T04 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| task | NK-WP-0029-T01 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| task | NK-WP-0029-T02 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| task | NK-WP-0029-T03 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| task | NK-WP-0029-T04 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| task | NK-WP-0030-T01 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0030-T02 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0030-T03 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0030-T04 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0030-T05 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0031-T01 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0031-T02 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0031-T03 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0031-T04 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0031-T05 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0032-T01 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| task | NK-WP-0032-T02 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| task | NK-WP-0032-T03 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| task | NK-WP-0032-T04 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| task | NK-WP-0033-T01 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0033-T02 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0033-T03 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0033-T04 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0033-T05 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0034-T01 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| task | NK-WP-0034-T02 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| task | NK-WP-0034-T03 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| task | NK-WP-0034-T04 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| task | NK-WP-0035-T01 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T02 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T03 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T04 | progress | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T05 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T06 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0036-T01 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T02 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T03 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T04 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T05 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T06 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0037-T01 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
|
||||
| task | NK-WP-0037-T02 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
|
||||
| task | NK-WP-0038-T01 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
|
||||
| task | NK-WP-0038-T02 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
|
||||
| task | NK-WP-0039-T01 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-0039-T02 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-0039-T03 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-0039-T04 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-0040-T01 | done | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
|
||||
| task | NK-WP-0040-T02 | wait | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
|
||||
| task | NK-WP-0041-T01 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
|
||||
| task | NK-WP-0041-T02 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
|
||||
| task | NK-WP-0041-T03 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
|
||||
| task | NK-WP-0042-T01 | done | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
|
||||
| task | NK-WP-0042-T02 | cancel | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
|
||||
| task | NK-WP-0043-T01 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
|
||||
| task | NK-WP-0043-T02 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
|
||||
| task | NK-WP-0043-T03 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
|
||||
| task | NK-WP-0044-T01 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T02 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T03 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T04 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T05 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T06 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T07 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0045-T01 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T02 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T03 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T04 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T05 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T06 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0046-T01 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
|
||||
| task | NK-WP-0046-T02 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
|
||||
| task | NK-WP-0046-T03 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
|
||||
| task | NK-WP-0047-T01 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
|
||||
| task | NK-WP-0047-T02 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
|
||||
| task | NK-WP-0047-T03 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
|
||||
| task | NK-WP-0048-T01 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T02 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T03 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T04 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T05 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T06 | wait | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T07 | wait | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T08 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T09 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T10 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T11 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T12 | todo | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T13 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T14 | progress | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T15 | wait | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T16 | todo | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T17 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T18 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T19 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T20 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T21 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T22 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T23 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T24 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T25 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T26 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T27 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T28 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T29 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T30 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T31 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0049-T01 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T02 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T03 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T04 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T05 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T06 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T07 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T08 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T09 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T10 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T11 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T12 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T13 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T14 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T15 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T16 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T17 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T18 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T19 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T20 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T21 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T22 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T23 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T24 | todo | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T25 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T26 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T27 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T28 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T29 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T30 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T31 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T32 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T33 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T34 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T35 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T36 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T37 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T38 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0050-T01 | done | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| task | NK-WP-0050-T02 | progress | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| task | NK-WP-0050-T03 | wait | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| task | NK-WP-0051-T01 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T02 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T03 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T04 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T05 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T06 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
|
||||
| intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
|
||||
| intake | NET-IN-0001 | open | — | intakes/intakes.md |
|
||||
| intake | NET-IN-0002 | open | — | intakes/intakes.md |
|
||||
| intake | NET-IN-0003 | open | — | intakes/intakes.md |
|
||||
| intake | NET-IN-0004 | open | — | intakes/intakes.md |
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
[
|
||||
{
|
||||
"path": ".custodian-brief.md",
|
||||
"index": "100644 f60f8bad019e23e6f7e0e074745da0bb2fcbb870 0\t.custodian-brief.md"
|
||||
},
|
||||
{
|
||||
"path": "WORK-RECORDS.md",
|
||||
"index": "100644 76a6b7fc304c508f1b50010cb72d892826c6a831 0\tWORK-RECORDS.md"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,343 @@
|
|||
{
|
||||
"repo_slug": "net-kingdom",
|
||||
"repo_path": "/home/worsch/net-kingdom",
|
||||
"source_revision": "201e2fa0f9c8398187e60983782d4aea31da19ea",
|
||||
"source_revision_reason": null,
|
||||
"issues": [
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-24",
|
||||
"message": "Repo classification advisory: capability_tag 'security' is not a recommended family tag (allowed, check for synonym)",
|
||||
"file_path": "",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-35",
|
||||
"message": "Repo Manager warning: workplans/: repository uses more than one workplan prefix: ['NET-WP', 'NK-WP']",
|
||||
"file_path": "workplans/",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-33",
|
||||
"message": "WORK-RECORDS.md is missing or stale \u2014 regenerate via fix-consistency (CUST-WP-0061-T04 generated work-record index)",
|
||||
"file_path": "WORK-RECORDS.md",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-37",
|
||||
"message": "Residual workplan 'nk-wp-0011' has no origin/origin_ref provenance (not invented)",
|
||||
"file_path": "workplans/NK-WP-0011-enterprise-federation-saml.md",
|
||||
"db_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Workplan dependency target 'USER-WP-0020' is not linked to State Hub",
|
||||
"file_path": "workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md",
|
||||
"db_id": "",
|
||||
"file_value": "USER-WP-0020",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Workplan dependency target 'KEY-WP-0004' is not linked to State Hub",
|
||||
"file_path": "workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md",
|
||||
"db_id": "",
|
||||
"file_value": "KEY-WP-0004",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Workplan dependency target 'USER-WP-0020' is not linked to State Hub",
|
||||
"file_path": "workplans/NK-WP-0023-user-engine-portal-platform-integration.md",
|
||||
"db_id": "",
|
||||
"file_value": "USER-WP-0020",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Workplan dependency target 'KEY-WP-0004' is not linked to State Hub",
|
||||
"file_path": "workplans/NK-WP-0023-user-engine-portal-platform-integration.md",
|
||||
"db_id": "",
|
||||
"file_value": "KEY-WP-0004",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Workplan dependency target 'USER-WP-0021' is not linked to State Hub",
|
||||
"file_path": "workplans/NK-WP-0024-user-engine-portal-integration-expansion.md",
|
||||
"db_id": "",
|
||||
"file_value": "USER-WP-0021",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Workplan dependency target 'FLEX-WP-0009' is not linked to State Hub",
|
||||
"file_path": "workplans/NK-WP-0024-user-engine-portal-integration-expansion.md",
|
||||
"db_id": "",
|
||||
"file_value": "FLEX-WP-0009",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Workplan dependency target 'AUDIT-WP-0003' is not linked to State Hub",
|
||||
"file_path": "workplans/NK-WP-0024-user-engine-portal-integration-expansion.md",
|
||||
"db_id": "",
|
||||
"file_value": "AUDIT-WP-0003",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Workplan dependency target 'EMAIL-WP-0004' is not linked to State Hub",
|
||||
"file_path": "workplans/NK-WP-0024-user-engine-portal-integration-expansion.md",
|
||||
"db_id": "",
|
||||
"file_value": "EMAIL-WP-0004",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Workplan dependency target 'USER-WP-0022' is not linked to State Hub",
|
||||
"file_path": "workplans/NK-WP-0025-public-self-registration-and-application-jit.md",
|
||||
"db_id": "",
|
||||
"file_value": "USER-WP-0022",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Workplan dependency target 'KEY-WP-0008' is not linked to State Hub",
|
||||
"file_path": "workplans/NK-WP-0025-public-self-registration-and-application-jit.md",
|
||||
"db_id": "",
|
||||
"file_value": "KEY-WP-0008",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Workplan dependency target 'CSOC-WP-0003' is not linked to State Hub",
|
||||
"file_path": "workplans/NK-WP-0025-public-self-registration-and-application-jit.md",
|
||||
"db_id": "",
|
||||
"file_value": "CSOC-WP-0003",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-37",
|
||||
"message": "Residual workplan 'nk-wp-0027' has no origin/origin_ref provenance (not invented)",
|
||||
"file_path": "workplans/NK-WP-0027-reef-placement-reconciliation.md",
|
||||
"db_id": "965ad365-6b81-50a1-a2a3-2d0c1fcce0b4",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-37",
|
||||
"message": "Residual workplan 'nk-wp-0031' has no origin/origin_ref provenance (not invented)",
|
||||
"file_path": "workplans/NK-WP-0031-deterministic-posture-feedback.md",
|
||||
"db_id": "9d7b04f9-3803-5613-b7a5-8bd606c77f5a",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-37",
|
||||
"message": "Residual workplan 'nk-wp-0040' has no origin/origin_ref provenance (not invented)",
|
||||
"file_path": "workplans/NK-WP-0040-execution-attribution-receipt.md",
|
||||
"db_id": "e2533f3a-aa43-59b3-bff3-8e64b6149487",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-40",
|
||||
"message": "blocker satisfied, task still wait: 'NK-WP-0048-T15' in workplan 'NK-WP-0048' \u2014 every depends_on target is terminal (NK-WP-0048-T31)",
|
||||
"file_path": "workplans/NK-WP-0048-security-case-types.md#NK-WP-0048-T15",
|
||||
"db_id": "",
|
||||
"file_value": "NK-WP-0048-T31",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-10",
|
||||
"message": "Task status drift 'NK-WP-0048-T39': file='progress' db='todo' (file wins)",
|
||||
"file_path": "workplans/NK-WP-0048-security-case-types.md#NK-WP-0048-T39",
|
||||
"db_id": "513c43ae-05f2-5a65-9c80-a911b7d680b8",
|
||||
"file_value": "progress",
|
||||
"db_value": "todo",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Workplan dependency target 'RAIL-PL-WP-0002' is not linked to State Hub",
|
||||
"file_path": "workplans/archived/260702-NET-WP-0017-it-security-readiness-for-user-onboarding.md",
|
||||
"db_id": "",
|
||||
"file_value": "RAIL-PL-WP-0002",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'nk-wp-0035@retired-20260908' (id=064c5e8b\u2026, status=archived) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "064c5e8b-7852-4d7f-a5fa-e26e406ab8e0",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'adhoc-2026-08-14@retired-20260827' (id=a5097121\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "a5097121-1461-59f8-81fa-e6ecef527337",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'adhoc-2026-08-23@retired-20260827' (id=e25ba5fa\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "e25ba5fa-eaae-5039-8d93-a69c6d837fc4",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'net-kingdom-adhoc-2026-07-02@retired-20260827' (id=67c1c7ac\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "67c1c7ac-d8b1-41dc-a81a-4e43f1afd068",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'net-kingdom-adhoc-2026-06-14@retired-20260827' (id=c6f3d6bf\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "c6f3d6bf-4916-490d-96ce-092d2776d7e7",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-26",
|
||||
"message": "Workplan id 'NET-WP-0020' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform",
|
||||
"file_path": "workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md",
|
||||
"db_id": "",
|
||||
"file_value": "NET-WP-0020",
|
||||
"db_value": "NK-WP",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-26",
|
||||
"message": "Workplan id 'NET-WP-0015' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform",
|
||||
"file_path": "workplans/archived/260603-NET-WP-0015-platform-root-custody-and-openbao-identity-bootstrap.md",
|
||||
"db_id": "",
|
||||
"file_value": "NET-WP-0015",
|
||||
"db_value": "NK-WP",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-26",
|
||||
"message": "Workplan id 'NET-WP-0016' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform",
|
||||
"file_path": "workplans/archived/260603-NET-WP-0016-guided-security-bootstrap-experience.md",
|
||||
"db_id": "",
|
||||
"file_value": "NET-WP-0016",
|
||||
"db_value": "NK-WP",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-26",
|
||||
"message": "Workplan id 'NET-WP-0018' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform",
|
||||
"file_path": "workplans/archived/260604-NET-WP-0018-bootstrap-automation-and-rebuild-readiness.md",
|
||||
"db_id": "",
|
||||
"file_value": "NET-WP-0018",
|
||||
"db_value": "NK-WP",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-26",
|
||||
"message": "Workplan id 'NET-WP-0017' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform",
|
||||
"file_path": "workplans/archived/260702-NET-WP-0017-it-security-readiness-for-user-onboarding.md",
|
||||
"db_id": "",
|
||||
"file_value": "NET-WP-0017",
|
||||
"db_value": "NK-WP",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-26",
|
||||
"message": "Workplan id 'NET-WP-0019' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform",
|
||||
"file_path": "workplans/archived/260702-NET-WP-0019-t06-adjacent-user-lifecycle-dry-run-polish.md",
|
||||
"db_id": "",
|
||||
"file_value": "NET-WP-0019",
|
||||
"db_value": "NK-WP",
|
||||
"fixable": false
|
||||
}
|
||||
],
|
||||
"fixes_applied": [
|
||||
"bindings: synced 64/64",
|
||||
"C-17 cleared: pushed 1 backlogged commit(s)",
|
||||
"C-33 fixed: regenerated WORK-RECORDS.md",
|
||||
"C-10 fixed: task 513c43ae\u2026 status \u2192 'progress'",
|
||||
"brief: .custodian-brief.md updated",
|
||||
"push: pushed"
|
||||
],
|
||||
"summary": {
|
||||
"fail": 0,
|
||||
"automation_error": 0,
|
||||
"warn": 27,
|
||||
"info": 5
|
||||
},
|
||||
"result": "warn"
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
WARN: git commit failed for writeback: Generated-only commits rejected: staged
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
{
|
||||
"existing_task": "NK-WP-0048-T39",
|
||||
"transition": "todo to progress",
|
||||
"source_task_count": 39,
|
||||
"prior_38_task_blocks_unchanged": true,
|
||||
"identifiers_unchanged": true,
|
||||
"scope": "Existing owner release source build underway; no image admission or deployment.",
|
||||
"prepared_file": "/tmp/nk48-release-build-progress.md"
|
||||
}
|
||||
|
|
@ -0,0 +1,987 @@
|
|||
{
|
||||
"ok": true,
|
||||
"status": "applied",
|
||||
"repo_slug": "net-kingdom",
|
||||
"commit": "201e2fa0f9c8398187e60983782d4aea31da19ea",
|
||||
"requests": 2,
|
||||
"elapsed_ms": 16783.6,
|
||||
"git": {
|
||||
"upstream": "origin/main",
|
||||
"behind": 0,
|
||||
"ahead": 0
|
||||
},
|
||||
"identifiers": {
|
||||
"schema": "repo-manager.identifier-assignment.v1",
|
||||
"ok": true,
|
||||
"executed": true,
|
||||
"repo": "net-kingdom",
|
||||
"namespace": "helixforge",
|
||||
"assignments": [],
|
||||
"historical_invalid_identifiers": [],
|
||||
"historical_identity_collisions": [],
|
||||
"files_changed": []
|
||||
},
|
||||
"receipt": {
|
||||
"schema": "state-hub.repository-projection-reconcile.v1",
|
||||
"instance_role": "primary",
|
||||
"instance_label": "railiance01",
|
||||
"expected_commit": "201e2fa0f9c8398187e60983782d4aea31da19ea",
|
||||
"derived_commit": "201e2fa0f9c8398187e60983782d4aea31da19ea",
|
||||
"outcome": {
|
||||
"schema": "state-hub.projection-reset.v1",
|
||||
"repo_slug": "net-kingdom",
|
||||
"commit": "201e2fa0f9c8398187e60983782d4aea31da19ea",
|
||||
"status": "applied",
|
||||
"counts": {
|
||||
"created": 0,
|
||||
"updated": 64,
|
||||
"retired": 0,
|
||||
"refused": 0,
|
||||
"released": 0,
|
||||
"created_tasks": 0,
|
||||
"updated_tasks": 0,
|
||||
"cancelled_tasks": 0,
|
||||
"created_edges": 0,
|
||||
"removed_edges": 0,
|
||||
"unresolved_edges": 1,
|
||||
"external_edges": 85
|
||||
},
|
||||
"created": [],
|
||||
"updated": [
|
||||
"NET-WP-0015",
|
||||
"NET-WP-0016",
|
||||
"NET-WP-0017",
|
||||
"NET-WP-0018",
|
||||
"NET-WP-0019",
|
||||
"NET-WP-0020",
|
||||
"NK-WP-0001",
|
||||
"NK-WP-0002",
|
||||
"NK-WP-0003",
|
||||
"NK-WP-0004",
|
||||
"NK-WP-0005",
|
||||
"NK-WP-0006",
|
||||
"NK-WP-0007",
|
||||
"NK-WP-0008",
|
||||
"NK-WP-0009",
|
||||
"NK-WP-0010",
|
||||
"NK-WP-0011",
|
||||
"NK-WP-0012",
|
||||
"NK-WP-0013",
|
||||
"NK-WP-0014",
|
||||
"NK-WP-0015",
|
||||
"NK-WP-0016",
|
||||
"NK-WP-0017",
|
||||
"NK-WP-0018",
|
||||
"NK-WP-0019",
|
||||
"NK-WP-0021",
|
||||
"NK-WP-0022",
|
||||
"NK-WP-0023",
|
||||
"NK-WP-0024",
|
||||
"NK-WP-0025",
|
||||
"NK-WP-0026",
|
||||
"NK-WP-0027",
|
||||
"NK-WP-0028",
|
||||
"NK-WP-0029",
|
||||
"NK-WP-0030",
|
||||
"NK-WP-0031",
|
||||
"NK-WP-0032",
|
||||
"NK-WP-0033",
|
||||
"NK-WP-0034",
|
||||
"NK-WP-0035",
|
||||
"NK-WP-0036",
|
||||
"NK-WP-0037",
|
||||
"NK-WP-0038",
|
||||
"NK-WP-0039",
|
||||
"NK-WP-0040",
|
||||
"NK-WP-0041",
|
||||
"NK-WP-0042",
|
||||
"NK-WP-0043",
|
||||
"NK-WP-0044",
|
||||
"NK-WP-0045",
|
||||
"NK-WP-0046",
|
||||
"NK-WP-0047",
|
||||
"NK-WP-0048",
|
||||
"NK-WP-0049",
|
||||
"NK-WP-0050",
|
||||
"NK-WP-0051",
|
||||
"NK-WP-ADHOC-2026-06-14",
|
||||
"NK-WP-ADHOC-2026-07-02",
|
||||
"NK-WP-ADHOC-2026-08-14",
|
||||
"NK-WP-ADHOC-2026-08-23",
|
||||
"NK-WP-ADHOC-2026-10-03",
|
||||
"NK-WP-ADHOC-2026-10-10",
|
||||
"NK-WP-ADHOC-2026-10-11",
|
||||
"NK-WP-ADHOC-2026-10-16"
|
||||
],
|
||||
"retired": [],
|
||||
"released": [],
|
||||
"created_tasks": [],
|
||||
"updated_tasks": [],
|
||||
"cancelled_tasks": [],
|
||||
"created_edges": [],
|
||||
"removed_edges": [],
|
||||
"unresolved_edges": [
|
||||
{
|
||||
"workplan": "NK-WP-0006",
|
||||
"from": "NK-WP-0006",
|
||||
"target": "NK-WP-0001",
|
||||
"reason": "missing"
|
||||
}
|
||||
],
|
||||
"external_edges": [
|
||||
{
|
||||
"workplan": "NK-WP-0008",
|
||||
"from": "NK-WP-0008",
|
||||
"target": "NK-WP-0006",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "053c6d96-9396-40c9-a2e5-c36531e7810d",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0050",
|
||||
"from": "NK-WP-0050-T03",
|
||||
"target": "RPF-WP-0056-T03",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "06ba98d5-609e-5aaa-9bf7-4c4f4460e377",
|
||||
"from_task_id": "5a3aaf57-de5c-5a03-bc99-9bcf2fc5d95e",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "a82762eb-bb6d-5600-89ca-a81ada2eba9f"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0050",
|
||||
"from": "NK-WP-0050-T03",
|
||||
"target": "NK-WP-0050-T02",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "06ba98d5-609e-5aaa-9bf7-4c4f4460e377",
|
||||
"from_task_id": "5a3aaf57-de5c-5a03-bc99-9bcf2fc5d95e",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "a9dadd07-f136-5dc7-9229-7a9dbb941f0d"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0050",
|
||||
"from": "NK-WP-0050-T02",
|
||||
"target": "NK-WP-0050-T01",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "06ba98d5-609e-5aaa-9bf7-4c4f4460e377",
|
||||
"from_task_id": "a9dadd07-f136-5dc7-9229-7a9dbb941f0d",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "64893d94-9717-5812-b8e3-7cabe095fcdc"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0017",
|
||||
"from": "NK-WP-0017",
|
||||
"target": "NK-WP-0015",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "08398d26-cadf-44bc-97ee-67da790040e6",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "343e035d-41e1-4fc4-b209-6872e4a5fdc8",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0011",
|
||||
"from": "NK-WP-0011",
|
||||
"target": "NK-WP-0006",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0011",
|
||||
"from": "NK-WP-0011",
|
||||
"target": "NK-WP-0004",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "d9cf7c4b-886b-4cd1-ad7b-99c4e1929c9e",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0011",
|
||||
"from": "NK-WP-0011",
|
||||
"target": "NK-WP-0003",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "f24cefd4-a09b-4fa1-9b25-94bf783b425e",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0011",
|
||||
"from": "NK-WP-0011-T03",
|
||||
"target": "NK-WP-0011-T02",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
|
||||
"from_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "2fe6f100-3a5d-563e-b033-7d7b846ae487"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0011",
|
||||
"from": "NK-WP-0011-T07",
|
||||
"target": "NK-WP-0011-T03",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
|
||||
"from_task_id": "38998c68-29bf-50d2-8c8d-0c75184d5833",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0011",
|
||||
"from": "NK-WP-0011-T07",
|
||||
"target": "NK-WP-0011-T04",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
|
||||
"from_task_id": "38998c68-29bf-50d2-8c8d-0c75184d5833",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "6697a994-7343-5ea8-8b37-bc3b921e5a9b"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0011",
|
||||
"from": "NK-WP-0011-T07",
|
||||
"target": "NK-WP-0011-T05",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
|
||||
"from_task_id": "38998c68-29bf-50d2-8c8d-0c75184d5833",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "d845380d-3dbc-5e59-8f2b-5a4d1b32d89d"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0011",
|
||||
"from": "NK-WP-0011-T04",
|
||||
"target": "NK-WP-0011-T03",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
|
||||
"from_task_id": "6697a994-7343-5ea8-8b37-bc3b921e5a9b",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0011",
|
||||
"from": "NK-WP-0011-T06",
|
||||
"target": "NK-WP-0011-T03",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
|
||||
"from_task_id": "9cb7fd93-c16e-5102-83ce-195b3aa87446",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0011",
|
||||
"from": "NK-WP-0011-T06",
|
||||
"target": "NK-WP-0011-T04",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
|
||||
"from_task_id": "9cb7fd93-c16e-5102-83ce-195b3aa87446",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "6697a994-7343-5ea8-8b37-bc3b921e5a9b"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0011",
|
||||
"from": "NK-WP-0011-T06",
|
||||
"target": "NK-WP-0011-T05",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
|
||||
"from_task_id": "9cb7fd93-c16e-5102-83ce-195b3aa87446",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "d845380d-3dbc-5e59-8f2b-5a4d1b32d89d"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0011",
|
||||
"from": "NK-WP-0011-T05",
|
||||
"target": "NK-WP-0011-T04",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
|
||||
"from_task_id": "d845380d-3dbc-5e59-8f2b-5a4d1b32d89d",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "6697a994-7343-5ea8-8b37-bc3b921e5a9b"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0011",
|
||||
"from": "NK-WP-0011-T09",
|
||||
"target": "NK-WP-0011-T03",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
|
||||
"from_task_id": "d9dc4292-6b66-5797-9ff9-a1a4a556278e",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0011",
|
||||
"from": "NK-WP-0011-T09",
|
||||
"target": "NK-WP-0011-T07",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
|
||||
"from_task_id": "d9dc4292-6b66-5797-9ff9-a1a4a556278e",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "38998c68-29bf-50d2-8c8d-0c75184d5833"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0011",
|
||||
"from": "NK-WP-0011-T09",
|
||||
"target": "NK-WP-0011-T08",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
|
||||
"from_task_id": "d9dc4292-6b66-5797-9ff9-a1a4a556278e",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "e5f44ddc-9645-5f61-b84c-da5ab9cccb6d"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0011",
|
||||
"from": "NK-WP-0011-T08",
|
||||
"target": "NK-WP-0011-T02",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
|
||||
"from_task_id": "e5f44ddc-9645-5f61-b84c-da5ab9cccb6d",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "2fe6f100-3a5d-563e-b033-7d7b846ae487"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0011",
|
||||
"from": "NK-WP-0011-T08",
|
||||
"target": "NK-WP-0011-T03",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07",
|
||||
"from_task_id": "e5f44ddc-9645-5f61-b84c-da5ab9cccb6d",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908"
|
||||
},
|
||||
{
|
||||
"workplan": "NET-WP-0016",
|
||||
"from": "NET-WP-0016",
|
||||
"target": "NET-WP-0015",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "16069174-6698-4855-ad9e-5092c8571f38",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "6b9c25e4-1008-429a-8de6-54361872c0dd",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NET-WP-0016",
|
||||
"from": "NET-WP-0016",
|
||||
"target": "NK-WP-0012",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "16069174-6698-4855-ad9e-5092c8571f38",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "9b8e4afc-eb71-47d9-8750-799a082b320a",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0049",
|
||||
"from": "NK-WP-0049-T18",
|
||||
"target": "NK-WP-0049-T33",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804",
|
||||
"from_task_id": "141dd773-c1fa-56c1-a852-bbe2372e5125",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "56c8d469-7a10-5d50-a30e-95cbf3cd4756"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0049",
|
||||
"from": "NK-WP-0049-T18",
|
||||
"target": "NK-WP-0049-T32",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804",
|
||||
"from_task_id": "141dd773-c1fa-56c1-a852-bbe2372e5125",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "cd78dbb7-a8f2-5754-8788-6eb1b7d97741"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0049",
|
||||
"from": "NK-WP-0049-T35",
|
||||
"target": "NK-WP-0049-T34",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804",
|
||||
"from_task_id": "1bfd1703-589f-5511-bad5-812d860e4a71",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "821b3a56-6f36-5812-abc9-5a00e37cb2e7"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0049",
|
||||
"from": "NK-WP-0049-T33",
|
||||
"target": "NK-WP-0049-T35",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804",
|
||||
"from_task_id": "56c8d469-7a10-5d50-a30e-95cbf3cd4756",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "1bfd1703-589f-5511-bad5-812d860e4a71"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0049",
|
||||
"from": "NK-WP-0049-T33",
|
||||
"target": "NK-WP-0049-T34",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804",
|
||||
"from_task_id": "56c8d469-7a10-5d50-a30e-95cbf3cd4756",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "821b3a56-6f36-5812-abc9-5a00e37cb2e7"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0049",
|
||||
"from": "NK-WP-0049-T33",
|
||||
"target": "NK-WP-0049-T36",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804",
|
||||
"from_task_id": "56c8d469-7a10-5d50-a30e-95cbf3cd4756",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "8b72334b-fc27-5707-a189-bad345eaf3bc"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0049",
|
||||
"from": "NK-WP-0049-T33",
|
||||
"target": "NK-WP-0049-T32",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804",
|
||||
"from_task_id": "56c8d469-7a10-5d50-a30e-95cbf3cd4756",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "cd78dbb7-a8f2-5754-8788-6eb1b7d97741"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0049",
|
||||
"from": "NK-WP-0049-T36",
|
||||
"target": "NK-WP-0049-T34",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804",
|
||||
"from_task_id": "8b72334b-fc27-5707-a189-bad345eaf3bc",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "821b3a56-6f36-5812-abc9-5a00e37cb2e7"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0049",
|
||||
"from": "NK-WP-0049-T03",
|
||||
"target": "NK-WP-0049-T02",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804",
|
||||
"from_task_id": "d68cd4d3-1ba3-530e-88f9-26ebb8dd6eac",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "479d6970-6516-50f5-9436-bb5b56d58aad"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0025",
|
||||
"from": "NK-WP-0025",
|
||||
"target": "NK-WP-0024",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "2412a251-d6b5-5f05-8082-3eb7697c51dc",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "635a73d4-b3cb-5c38-af22-56a6a66beb0e",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0016",
|
||||
"from": "NK-WP-0016",
|
||||
"target": "NK-WP-0015",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "2d592e18-e63d-4856-97a1-f8c3e019e150",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "343e035d-41e1-4fc4-b209-6872e4a5fdc8",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0006",
|
||||
"from": "NK-WP-0006",
|
||||
"target": "NK-WP-0005",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "75bc472b-cc0a-48f2-afb6-62b896f7cc19",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0006",
|
||||
"from": "NK-WP-0006",
|
||||
"target": "NK-WP-0004",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "d9cf7c4b-886b-4cd1-ad7b-99c4e1929c9e",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0013",
|
||||
"from": "NK-WP-0013",
|
||||
"target": "NK-WP-0006",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "32a54d8e-8633-42a6-8ec1-104842c581c1",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0015",
|
||||
"from": "NK-WP-0015",
|
||||
"target": "NK-WP-0014",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "343e035d-41e1-4fc4-b209-6872e4a5fdc8",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "b9bf56bc-7ef6-43eb-badc-fa0f4896c63c",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NET-WP-0017",
|
||||
"from": "NET-WP-0017",
|
||||
"target": "NET-WP-0016",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "385de708-fd59-4bab-a4f4-28c1c476b3ea",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "16069174-6698-4855-ad9e-5092c8571f38",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NET-WP-0017",
|
||||
"from": "NET-WP-0017",
|
||||
"target": "NET-WP-0015",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "385de708-fd59-4bab-a4f4-28c1c476b3ea",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "6b9c25e4-1008-429a-8de6-54361872c0dd",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0007",
|
||||
"from": "NK-WP-0007",
|
||||
"target": "NK-WP-0006",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "3cbc81ec-7ad5-46cf-a4a0-fc5fe9873695",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0007",
|
||||
"from": "NK-WP-0007",
|
||||
"target": "NK-WP-0005",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "3cbc81ec-7ad5-46cf-a4a0-fc5fe9873695",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "75bc472b-cc0a-48f2-afb6-62b896f7cc19",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0007",
|
||||
"from": "NK-WP-0007",
|
||||
"target": "NK-WP-0004",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "3cbc81ec-7ad5-46cf-a4a0-fc5fe9873695",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "d9cf7c4b-886b-4cd1-ad7b-99c4e1929c9e",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0024",
|
||||
"from": "NK-WP-0024",
|
||||
"target": "NK-WP-0023",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "635a73d4-b3cb-5c38-af22-56a6a66beb0e",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "fdb3deee-06c3-5d12-91ce-9c50b2ac0618",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NET-WP-0015",
|
||||
"from": "NET-WP-0015",
|
||||
"target": "NK-WP-0006",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "6b9c25e4-1008-429a-8de6-54361872c0dd",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NET-WP-0015",
|
||||
"from": "NET-WP-0015",
|
||||
"target": "NK-WP-0012",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "6b9c25e4-1008-429a-8de6-54361872c0dd",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "9b8e4afc-eb71-47d9-8750-799a082b320a",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0018",
|
||||
"from": "NK-WP-0018",
|
||||
"target": "NK-WP-0017",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "6f75035a-e056-4eab-8fdb-00a18bacdf87",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "08398d26-cadf-44bc-97ee-67da790040e6",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0018",
|
||||
"from": "NK-WP-0018",
|
||||
"target": "NK-WP-0016",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "6f75035a-e056-4eab-8fdb-00a18bacdf87",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "2d592e18-e63d-4856-97a1-f8c3e019e150",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0005",
|
||||
"from": "NK-WP-0005",
|
||||
"target": "NK-WP-0004",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "75bc472b-cc0a-48f2-afb6-62b896f7cc19",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "d9cf7c4b-886b-4cd1-ad7b-99c4e1929c9e",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NET-WP-0019",
|
||||
"from": "NET-WP-0019",
|
||||
"target": "NET-WP-0017",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "75d388b6-7ec1-4e1b-8c87-6ff44f953210",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "385de708-fd59-4bab-a4f4-28c1c476b3ea",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NET-WP-0019",
|
||||
"from": "NET-WP-0019",
|
||||
"target": "NET-WP-0018",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "75d388b6-7ec1-4e1b-8c87-6ff44f953210",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "800f9f16-bc44-4bbf-a771-58a630a3b698",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NET-WP-0018",
|
||||
"from": "NET-WP-0018",
|
||||
"target": "NET-WP-0017",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "800f9f16-bc44-4bbf-a771-58a630a3b698",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "385de708-fd59-4bab-a4f4-28c1c476b3ea",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NET-WP-0018",
|
||||
"from": "NET-WP-0018",
|
||||
"target": "NET-WP-0015",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "800f9f16-bc44-4bbf-a771-58a630a3b698",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "6b9c25e4-1008-429a-8de6-54361872c0dd",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0027",
|
||||
"from": "NK-WP-0027-T03",
|
||||
"target": "NK-WP-0027-T02",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "965ad365-6b81-50a1-a2a3-2d0c1fcce0b4",
|
||||
"from_task_id": "e3f0bb0f-0c85-5cb9-a5ab-75f668cd3447",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "5b35b646-a525-55da-852a-6005613d42ea"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0012",
|
||||
"from": "NK-WP-0012",
|
||||
"target": "NK-WP-0006",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "9b8e4afc-eb71-47d9-8750-799a082b320a",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0014",
|
||||
"from": "NK-WP-0014",
|
||||
"target": "NK-WP-0013",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "b9bf56bc-7ef6-43eb-badc-fa0f4896c63c",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "32a54d8e-8633-42a6-8ec1-104842c581c1",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0014",
|
||||
"from": "NK-WP-0014",
|
||||
"target": "NK-WP-0012",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "b9bf56bc-7ef6-43eb-badc-fa0f4896c63c",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "9b8e4afc-eb71-47d9-8750-799a082b320a",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0019",
|
||||
"from": "NK-WP-0019",
|
||||
"target": "NK-WP-0018",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "d2daa8b4-8ecf-4377-b382-492e653735f7",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "6f75035a-e056-4eab-8fdb-00a18bacdf87",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0009",
|
||||
"from": "NK-WP-0009",
|
||||
"target": "NK-WP-0008",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "d4d02dbf-3974-502d-8b87-b776fc63e17e",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "053c6d96-9396-40c9-a2e5-c36531e7810d",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0022",
|
||||
"from": "NK-WP-0022",
|
||||
"target": "NK-WP-0023",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "d76ddccc-00c8-548a-b141-2cd660fa38da",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "fdb3deee-06c3-5d12-91ce-9c50b2ac0618",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0048",
|
||||
"from": "NK-WP-0048-T15",
|
||||
"target": "NK-WP-0048-T31",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
|
||||
"from_task_id": "1b825705-4848-5edc-832f-b1622cd9bdb7",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "ed1ccd87-89a0-5e69-885c-0eaf5ab0bb5a"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0048",
|
||||
"from": "NK-WP-0048-T16",
|
||||
"target": "NK-WP-0048-T25",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
|
||||
"from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "0de2a7d9-874d-578b-a076-f653fe42e30b"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0048",
|
||||
"from": "NK-WP-0048-T16",
|
||||
"target": "NK-WP-0048-T29",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
|
||||
"from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "129db41d-4560-5e20-9f3b-c3c91e0a5601"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0048",
|
||||
"from": "NK-WP-0048-T16",
|
||||
"target": "NK-WP-0048-T24",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
|
||||
"from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "1a3931ee-3b5f-52fc-9295-4073804f4bd2"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0048",
|
||||
"from": "NK-WP-0048-T16",
|
||||
"target": "NK-WP-0048-T28",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
|
||||
"from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "6dab281c-ea9a-5a17-a83f-e8e9a4d4484f"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0048",
|
||||
"from": "NK-WP-0048-T16",
|
||||
"target": "NK-WP-0048-T30",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
|
||||
"from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "6f6073ac-52dd-5b70-8874-6d76d4c072e4"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0048",
|
||||
"from": "NK-WP-0048-T16",
|
||||
"target": "NK-WP-0048-T26",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
|
||||
"from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "94b3cbf0-c908-5ac6-b0db-67385c3e021c"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0048",
|
||||
"from": "NK-WP-0048-T16",
|
||||
"target": "NK-WP-0048-T27",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
|
||||
"from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "e56365f8-29b5-5c89-a329-8115f9f3b2a7"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0048",
|
||||
"from": "NK-WP-0048-T07",
|
||||
"target": "NK-WP-0048-T06",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
|
||||
"from_task_id": "c3c9c3ae-4f23-5ba7-9e6f-e63bcf29b9f7",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0048",
|
||||
"from": "NK-WP-0048-T06",
|
||||
"target": "NK-WP-0048-T09",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
|
||||
"from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "0ee12dfc-8260-5038-bd39-cc7fb4113be0"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0048",
|
||||
"from": "NK-WP-0048-T06",
|
||||
"target": "NK-WP-0048-T15",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
|
||||
"from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "1b825705-4848-5edc-832f-b1622cd9bdb7"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0048",
|
||||
"from": "NK-WP-0048-T06",
|
||||
"target": "NK-WP-0048-T16",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
|
||||
"from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0048",
|
||||
"from": "NK-WP-0048-T06",
|
||||
"target": "NK-WP-0048-T05",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
|
||||
"from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "3d987d3d-0797-538b-86e4-51185a327ae2"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0048",
|
||||
"from": "NK-WP-0048-T06",
|
||||
"target": "MASON-WP-0010-T03",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
|
||||
"from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "56cea6be-c613-586c-80cd-125340b374da"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0048",
|
||||
"from": "NK-WP-0048-T06",
|
||||
"target": "NK-WP-0048-T12",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
|
||||
"from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "7ce4eee3-cd47-55a9-bfa5-4f1835d4d6fd"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0048",
|
||||
"from": "NK-WP-0048-T06",
|
||||
"target": "NK-WP-0048-T20",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
|
||||
"from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "863fcbdb-e246-51ba-87ca-a2f44d01d6f8"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0048",
|
||||
"from": "NK-WP-0048-T06",
|
||||
"target": "NK-WP-0048-T17",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
|
||||
"from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "8c3e4baa-a218-5996-af9e-fe1153a46dac"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0048",
|
||||
"from": "NK-WP-0048-T06",
|
||||
"target": "NK-WP-0048-T08",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
|
||||
"from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "8e519082-dc8b-5e46-b660-03d03e55dcf6"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0048",
|
||||
"from": "NK-WP-0048-T06",
|
||||
"target": "NK-WP-0048-T18",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
|
||||
"from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "9c45da71-fb4c-5f20-9065-90f448f37c64"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0048",
|
||||
"from": "NK-WP-0048-T06",
|
||||
"target": "NK-WP-0048-T13",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
|
||||
"from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "b264c10b-565c-5d29-b788-03cf5fbd2883"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0048",
|
||||
"from": "NK-WP-0048-T06",
|
||||
"target": "WARDEN-WP-0044-T03",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
|
||||
"from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0048",
|
||||
"from": "NK-WP-0048-T06",
|
||||
"target": "NK-WP-0048-T14",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
|
||||
"from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "fce95440-a25b-5f27-8ef3-a3d182099113"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0048",
|
||||
"from": "NK-WP-0048-T14",
|
||||
"target": "NK-WP-0048-T20",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
|
||||
"from_task_id": "fce95440-a25b-5f27-8ef3-a3d182099113",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "863fcbdb-e246-51ba-87ca-a2f44d01d6f8"
|
||||
},
|
||||
{
|
||||
"workplan": "NK-WP-0010",
|
||||
"from": "NK-WP-0010",
|
||||
"target": "NK-WP-0008",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "f4faf8b4-ae57-40cf-a881-6fe66ca6ad74",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "053c6d96-9396-40c9-a2e5-c36531e7810d",
|
||||
"to_task_id": null
|
||||
}
|
||||
],
|
||||
"refused": [],
|
||||
"notes": []
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,91 @@
|
|||
<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
|
||||
# Custodian Brief — net-kingdom
|
||||
|
||||
**Domain:** infotech
|
||||
**Last synced:** 2026-10-17 09:16 UTC
|
||||
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
|
||||
|
||||
## Active Workstreams
|
||||
|
||||
### Publish the NetKingdom emission-cadence security profile
|
||||
Progress: 5/6 done | workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc`
|
||||
|
||||
**Open tasks:**
|
||||
- ► Bind and hand off the published contract `e3fbc8b8`
|
||||
|
||||
### Register Playwright human and agent consumers through governed identity delivery
|
||||
Progress: 1/3 done | workplan_id: `06ba98d5-609e-5aaa-9bf7-4c4f4460e377`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Verify issuer and real consumer acceptance `5a3aaf57`
|
||||
*(wait: Await owner-scoped registry/custody activation, native cluster authentication and individual transport, then real human and agent acceptance under CUST-WP-0080-T05.)*
|
||||
- ► Deliver custody integration and guarded registration activation `a9dadd07`
|
||||
|
||||
### Remove bootstrap secret output and verify separated recovery custody
|
||||
Progress: 26/38 done | workplan_id: `17d315f0-829e-57c7-85cc-3a7914152804`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Accept remaining recovery and caller evidence and close the G08 handoff `d68cd4d3`
|
||||
*(wait: Await the separately tracked native service proofs, current/legacy caller dispositions and residual-scope decisions; archive recovery, backup activation, independent outage retrieval and guide publication are complete.)*
|
||||
- ! Resolve historical credential and configuration-preserving rotation dispositions `3ea6bf00`
|
||||
*(wait: Await the caller/consumer ledger, current replacement-lane acceptance and explicit credential-owner dispositions; existing exposure-rotation deferral is unchanged.)*
|
||||
- ! Verify current caller and provider admission at their actual boundaries `77aa42be`
|
||||
*(wait: Await the current-caller ledger and exact per-caller owner admission/test inputs; the backup credential grants do not admit unrelated callers.)*
|
||||
- ! Prove retained privacyIDEA token decryption and existing-token MFA `6f8af1a7`
|
||||
*(wait: LLDAP T16, token-material T31 and audit T20 passed; await the exact isolated MFA adapter and owner-selected retained-token/factor inputs.)*
|
||||
- ! Prove restored KeyCape issuer, policy and consumer continuity `141dd773`
|
||||
*(wait: Source and synthetic KeyCape lifecycle proof are delivered in T32; await exact owner-held recovery attempt preparation T33, selected consumer acceptance and retained-token MFA for the selected flow.)*
|
||||
- ! Prove restored Authelia storage and OIDC continuity `b47f9975`
|
||||
*(wait: LLDAP recovery T16 passed; await the exact isolated Authelia adapter/procedure and private authentication-flow inputs from T15.)*
|
||||
- ! Prepare the exact owner-held KeyCape recovery attempt `56c8d469`
|
||||
*(wait: Source custody/preflight preparation is evidenced in T34; await original TLS/trust recovery disposition T35 and selected original registration/private-admission metadata T36 before final reviewed command and existing owner process.)*
|
||||
- … and 5 more open tasks
|
||||
|
||||
### Establish SecurityCaseTypes so that known security cases are light
|
||||
Progress: 25/31 done | workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb`
|
||||
|
||||
**Open tasks:**
|
||||
- ! T05 — Acknowledge the type through informed-decision `d9b26bcf`
|
||||
*(wait: Type1.2 architecture has a confirmed source-only founder acknowledgment; canonical1.1 remains unchanged/default and the1.2 reference case stays proposed. Needs explicit version selection/reference-source integration without normal admission bypass, closed owner adapters plus global/native receipt verifier (WARDEN-WP-0044-T03), independently verified six-object structural materialization and CCR42 claims/created-only provenance, exact broker/case/source reconciliation, then separately authorized native mint/delivery and attended registry/consumer verification. Source acknowledgment, a bundle or local tests do not prove implemented/materialized/live status.)*
|
||||
- ! T06 — First KnownSecurityCase: Forgejo `c3c9c3ae`
|
||||
*(wait: The next types follow once the first one is proven end to end.)*
|
||||
- ! T15 — Define authenticated recovery for lost registration process state `1b825705`
|
||||
*(wait: Source candidate 061461e is merged. Waiting on the owner to select the real authenticated original-attempt holder and native readback, and on independent re-review of the changed T13 adapter source.)*
|
||||
- ► T14 — Admit governed group rollback against native owner boundaries `fce95440`
|
||||
- · T12 — Prepare NetKingdom-owned attended step adapters `7ce4eee3`
|
||||
- · T16 — Select and review the actual machine descriptor composition `200bf500`
|
||||
|
||||
### Define an execution-attribution receipt for Railiance runs
|
||||
Progress: 1/2 done | workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Agree the evidence holder and schema with audit-core and Railiance `963120c1`
|
||||
*(wait: Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance.)*
|
||||
|
||||
### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker
|
||||
Progress: 1/9 done | workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Admit the database consumer `2fe6f100`
|
||||
*(wait: ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence.)*
|
||||
- ! Package the broker deployment `32d1411b`
|
||||
*(wait: ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment.)*
|
||||
- ! Integrate an upstream identity provider `6697a994`
|
||||
*(wait: Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence.)*
|
||||
- ! Define federated assurance `d845380d`
|
||||
*(wait: Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners.)*
|
||||
- ! Verify IAM conformance and coexistence `9cb7fd93`
|
||||
*(wait: Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent.)*
|
||||
- ! Enforce tenant and platform boundaries `38998c68`
|
||||
*(wait: Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission.)*
|
||||
- ! Prove recovery and audit delivery `e5f44ddc`
|
||||
*(wait: Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent.)*
|
||||
- … and 1 more open tasks
|
||||
|
||||
---
|
||||
## MCP Orientation (when available)
|
||||
|
||||
If the state-hub MCP server is reachable, call:
|
||||
`get_domain_summary("infotech")`
|
||||
This provides richer cross-domain context.
|
||||
If the MCP call fails, use this file as your orientation source.
|
||||
|
|
@ -0,0 +1,289 @@
|
|||
# Work Records — net-kingdom
|
||||
|
||||
> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
|
||||
> stage 3). Do not edit by hand — edit the source file/block listed for
|
||||
> each record and re-run fix-consistency to refresh this index. Archived
|
||||
> workplans are omitted; closed decisions/intakes/engagements stay listed
|
||||
> so recently-resolved work is still visible. [auto]
|
||||
|
||||
| Kind | ID | Status | Lane | Source |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| workplan | NK-WP-ADHOC-2026-07-02 | finished | — | workplans/ADHOC-2026-07-02.md |
|
||||
| workplan | NK-WP-ADHOC-2026-08-14 | finished | — | workplans/ADHOC-2026-08-14.md |
|
||||
| workplan | NK-WP-ADHOC-2026-08-23 | finished | — | workplans/ADHOC-2026-08-23.md |
|
||||
| workplan | NK-WP-ADHOC-2026-10-03 | finished | — | workplans/ADHOC-2026-10-03.md |
|
||||
| workplan | NK-WP-ADHOC-2026-10-10 | finished | — | workplans/ADHOC-2026-10-10.md |
|
||||
| workplan | NK-WP-ADHOC-2026-10-11 | finished | — | workplans/ADHOC-2026-10-11.md |
|
||||
| workplan | NK-WP-ADHOC-2026-10-16 | finished | — | workplans/ADHOC-2026-10-16.md |
|
||||
| workplan | NET-WP-0020 | finished | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| workplan | NK-WP-0009 | finished | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| workplan | NK-WP-0011 | active | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| workplan | NK-WP-0021 | finished | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| workplan | NK-WP-0022 | finished | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| workplan | NK-WP-0023 | finished | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| workplan | NK-WP-0024 | finished | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| workplan | NK-WP-0025 | finished | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| workplan | NK-WP-0026 | finished | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
|
||||
| workplan | NK-WP-0027 | backlog | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| workplan | NK-WP-0028 | finished | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| workplan | NK-WP-0029 | finished | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| workplan | NK-WP-0030 | finished | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| workplan | NK-WP-0031 | finished | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| workplan | NK-WP-0032 | finished | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| workplan | NK-WP-0033 | finished | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| workplan | NK-WP-0034 | finished | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| workplan | NK-WP-0035 | active | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| workplan | NK-WP-0036 | finished | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| workplan | NK-WP-0037 | finished | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
|
||||
| workplan | NK-WP-0038 | finished | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
|
||||
| workplan | NK-WP-0039 | finished | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| workplan | NK-WP-0040 | active | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
|
||||
| workplan | NK-WP-0041 | finished | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
|
||||
| workplan | NK-WP-0042 | finished | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
|
||||
| workplan | NK-WP-0043 | finished | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
|
||||
| workplan | NK-WP-0044 | finished | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| workplan | NK-WP-0045 | finished | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| workplan | NK-WP-0046 | finished | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
|
||||
| workplan | NK-WP-0047 | finished | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
|
||||
| workplan | NK-WP-0048 | active | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| workplan | NK-WP-0049 | active | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| workplan | NK-WP-0050 | active | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| workplan | NK-WP-0051 | finished | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md |
|
||||
| task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md |
|
||||
| task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md |
|
||||
| task | NK-WP-ADHOC-2026-08-14-T02 | done | — | workplans/ADHOC-2026-08-14.md |
|
||||
| task | NK-WP-ADHOC-2026-08-14-T03 | done | — | workplans/ADHOC-2026-08-14.md |
|
||||
| task | NK-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md |
|
||||
| task | NK-WP-ADHOC-2026-10-03-T01 | done | — | workplans/ADHOC-2026-10-03.md |
|
||||
| task | NK-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T03 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T04 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T05 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T06 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T07 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-16-T01 | done | — | workplans/ADHOC-2026-10-16.md |
|
||||
| task | NET-WP-0020-T01 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NET-WP-0020-T02 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NET-WP-0020-T03 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NET-WP-0020-T04 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NET-WP-0020-T05 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NK-WP-0009-T01 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T02 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T03 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T04 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T05 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T06 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0011-T01 | done | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T02 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T03 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T04 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T05 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T06 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T07 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T08 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T09 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0021-T01 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0021-T02 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0021-T03 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0021-T04 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0021-T05 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0022-T01 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T02 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T03 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T04 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T05 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T06 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T07 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T08 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0023-T01 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T02 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T03 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T04 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T05 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T06 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T07 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T08 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0024-T01 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| task | NK-WP-0024-T02 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| task | NK-WP-0024-T03 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| task | NK-WP-0024-T04 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| task | NK-WP-0025-T01 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T02 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T03 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T04 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T05 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0026-T01 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
|
||||
| task | NK-WP-0026-T02 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
|
||||
| task | NK-WP-0027-T01 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T02 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T03 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T04 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T05 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T06 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0028-T01 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| task | NK-WP-0028-T02 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| task | NK-WP-0028-T03 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| task | NK-WP-0028-T04 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| task | NK-WP-0029-T01 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| task | NK-WP-0029-T02 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| task | NK-WP-0029-T03 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| task | NK-WP-0029-T04 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| task | NK-WP-0030-T01 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0030-T02 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0030-T03 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0030-T04 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0030-T05 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0031-T01 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0031-T02 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0031-T03 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0031-T04 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0031-T05 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0032-T01 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| task | NK-WP-0032-T02 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| task | NK-WP-0032-T03 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| task | NK-WP-0032-T04 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| task | NK-WP-0033-T01 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0033-T02 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0033-T03 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0033-T04 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0033-T05 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0034-T01 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| task | NK-WP-0034-T02 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| task | NK-WP-0034-T03 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| task | NK-WP-0034-T04 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| task | NK-WP-0035-T01 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T02 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T03 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T04 | progress | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T05 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T06 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0036-T01 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T02 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T03 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T04 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T05 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T06 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0037-T01 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
|
||||
| task | NK-WP-0037-T02 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
|
||||
| task | NK-WP-0038-T01 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
|
||||
| task | NK-WP-0038-T02 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
|
||||
| task | NK-WP-0039-T01 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-0039-T02 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-0039-T03 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-0039-T04 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-0040-T01 | done | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
|
||||
| task | NK-WP-0040-T02 | wait | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
|
||||
| task | NK-WP-0041-T01 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
|
||||
| task | NK-WP-0041-T02 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
|
||||
| task | NK-WP-0041-T03 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
|
||||
| task | NK-WP-0042-T01 | done | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
|
||||
| task | NK-WP-0042-T02 | cancel | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
|
||||
| task | NK-WP-0043-T01 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
|
||||
| task | NK-WP-0043-T02 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
|
||||
| task | NK-WP-0043-T03 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
|
||||
| task | NK-WP-0044-T01 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T02 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T03 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T04 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T05 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T06 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T07 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0045-T01 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T02 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T03 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T04 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T05 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T06 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0046-T01 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
|
||||
| task | NK-WP-0046-T02 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
|
||||
| task | NK-WP-0046-T03 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
|
||||
| task | NK-WP-0047-T01 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
|
||||
| task | NK-WP-0047-T02 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
|
||||
| task | NK-WP-0047-T03 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
|
||||
| task | NK-WP-0048-T01 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T02 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T03 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T04 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T05 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T06 | wait | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T07 | wait | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T08 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T09 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T10 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T11 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T12 | todo | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T13 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T14 | progress | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T15 | wait | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T16 | todo | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T17 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T18 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T19 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T20 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T21 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T22 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T23 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T24 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T25 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T26 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T27 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T28 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T29 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T30 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T31 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0049-T01 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T02 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T03 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T04 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T05 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T06 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T07 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T08 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T09 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T10 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T11 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T12 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T13 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T14 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T15 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T16 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T17 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T18 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T19 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T20 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T21 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T22 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T23 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T24 | todo | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T25 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T26 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T27 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T28 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T29 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T30 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T31 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T32 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T33 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T34 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T35 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T36 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T37 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T38 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0050-T01 | done | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| task | NK-WP-0050-T02 | progress | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| task | NK-WP-0050-T03 | wait | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| task | NK-WP-0051-T01 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T02 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T03 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T04 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T05 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T06 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
|
||||
| intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
|
||||
| intake | NET-IN-0001 | open | — | intakes/intakes.md |
|
||||
| intake | NET-IN-0002 | open | — | intakes/intakes.md |
|
||||
| intake | NET-IN-0003 | open | — | intakes/intakes.md |
|
||||
| intake | NET-IN-0004 | open | — | intakes/intakes.md |
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
[
|
||||
{
|
||||
"path": ".custodian-brief.md",
|
||||
"index": "100644 f60f8bad019e23e6f7e0e074745da0bb2fcbb870 0\t.custodian-brief.md"
|
||||
},
|
||||
{
|
||||
"path": "WORK-RECORDS.md",
|
||||
"index": "100644 76a6b7fc304c508f1b50010cb72d892826c6a831 0\tWORK-RECORDS.md"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
{
|
||||
"exit_code": 0,
|
||||
"commit": "201e2fa0f9c8398187e60983782d4aea31da19ea",
|
||||
"base": "6201a1d2de282a218fde8d81b32f790a526942ef",
|
||||
"files": [
|
||||
{
|
||||
"path": "workplans/NK-WP-0048-security-case-types.md",
|
||||
"sha256": "49f2e870bf1ba662990fa404a62d07fc72d698a6a1bcf4d5bbbe71e4c31cfec0"
|
||||
}
|
||||
],
|
||||
"stdout": "[main 201e2fa] Track active consumer release source build under the existing task\n 1 file changed, 1 insertion(+), 1 deletion(-)\n",
|
||||
"stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 1, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n"
|
||||
}
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
{
|
||||
"owner": "net-kingdom",
|
||||
"base_revision": "6201a1d2de282a218fde8d81b32f790a526942ef",
|
||||
"message": "Track active consumer release source build under the existing task",
|
||||
"files": [
|
||||
{
|
||||
"path": "workplans/NK-WP-0048-security-case-types.md",
|
||||
"sha256": "49f2e870bf1ba662990fa404a62d07fc72d698a6a1bcf4d5bbbe71e4c31cfec0"
|
||||
}
|
||||
]
|
||||
}
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,56 @@
|
|||
--- a/workplans/NK-WP-0048-security-case-types.md
|
||||
+++ b/workplans/NK-WP-0048-security-case-types.md
|
||||
@@ -783,13 +783,15 @@
|
||||
Owner: NetKingdom for registration state, with Warden owning kernel evidence
|
||||
admission. T22 records the completed source review and exact existing-seam gaps;
|
||||
T15 retains implementation and authenticated restart/lost-receipt acceptance.
|
||||
-Next action: identify the actual owner publisher/authenticator and bounded
|
||||
-original-attempt readback contract, and obtain Warden's reviewed original-intent
|
||||
-lookup/context interface through existing WARDEN-WP-0044-T03. The current Journal
|
||||
-retains attempt identity in historical rows but only hashes evidence references;
|
||||
-load drops that context and reconcile passes a fresh attempt to the callback.
|
||||
-The adapter's original payload and creation record remain process-local. Neither
|
||||
-that journal nor a current matching registry entry reconstructs creation authority.
|
||||
+Next action: select and admit the actual owner publisher/authenticator and bounded
|
||||
+original-attempt readback contract for the merged holder/observe adapter seam.
|
||||
+Warden's original-intent persistence/interface (`a45cf475`) and additive validation
|
||||
+(`117fec9241e7b985dfb187b992e173d0a5dc3700`) are now published and projected.
|
||||
+The local Journal retains admitted nonsecret original context, validates original
|
||||
+actor/attempt and metadata linkage to the original running receipt, and supplies
|
||||
+it separately from the new reconciliation attempt. This local consistency is not
|
||||
+independent original-holder authorization or creation provenance; neither the
|
||||
+journal nor a current matching registry entry reconstructs creation authority.
|
||||
|
||||
The owner contract must bind the original Invocation, case/type/descriptor/catalog/
|
||||
acceptance pins, source, principal and admitted tenant/realm provenance, separately
|
||||
@@ -804,9 +806,10 @@
|
||||
contract: independently authenticated original created-only provenance, original
|
||||
exact client entry and unchanged current postcreation UID/resourceVersion before
|
||||
any undo, with wrong attempt/case/source/principal and unavailable-holder refusals.
|
||||
-The T13 adapter deliberately refuses post-restart rollback and installs no
|
||||
-reconciliation callback. Existing source review, JSON receipts and synthetic
|
||||
-trust do not satisfy native holder acceptance or authorize attended recovery.
|
||||
+The merged T13 adapter exposes reconciliation only through paired injected
|
||||
+holder/observe capabilities and still refuses post-restart rollback. Existing
|
||||
+source review, JSON receipts and synthetic trust do not satisfy independent
|
||||
+holder authorization/provenance or native admission, or authorize attended recovery.
|
||||
Exact remaining owner facts: Custodian native-registration-r1/original-attempt-review.json.
|
||||
|
||||
2026-10-17 check (net-kingdom-worker): Warden's original-intent lookup interface
|
||||
@@ -816,6 +819,16 @@
|
||||
T16's decomposition under the same token budget. Remains todo, gated on Warden
|
||||
publishing the reviewed lookup/context interface and on owner selection of the
|
||||
authenticated original-attempt holder.
|
||||
+
|
||||
+2026-10-17 current-source correction: the earlier same-day `d97652a` lookup
|
||||
+checkpoint and T31 adapter-next-action note above are historical and superseded
|
||||
+by the published Warden interface/validation and merged `061461e` adapter seam.
|
||||
+The 54 focused Warden checks establish source behavior only. Current admission
|
||||
+leaves tenant/realm empty; no admitted tenant/realm provenance is inferred.
|
||||
+T15 remains wait for actual independently authenticated owner-holder/readback
|
||||
+selection, independent review of the changed adapter, and native restart/lost-
|
||||
+receipt acceptance. Existing task metadata, owner gates and historical reviews
|
||||
+are unchanged.
|
||||
|
||||
## T16 — Select and review the actual machine descriptor composition
|
||||
|
||||
|
|
@ -0,0 +1,108 @@
|
|||
{
|
||||
"scope": "Read-only bounded current NetKingdom docs/evidence, docs/reviews and history public Markdown/JSON/YAML search; current KEY39 workplan and existing assessment/standing rule read",
|
||||
"netkingdom_head": "001a38ca2aa85155ce4840c4da22aca6e2346171",
|
||||
"matching_files": [
|
||||
{
|
||||
"path": "docs/evidence/2026-10-15-bootstrap-recovery/caller-source-inventory.json",
|
||||
"sha256": "d6a1a575e2690a242db76d6d5de60f48648211f2cf62c156f22486e1e0bbf28d",
|
||||
"classification": "source-inventory only"
|
||||
},
|
||||
{
|
||||
"path": "docs/reviews/2026-10-11-key39-lifecycle-v2-netkingdom-review.json",
|
||||
"sha256": "f7293bc3cc896e23840d767bf86bd379f202a665f6a334485081831ad067d262",
|
||||
"classification": "source review only"
|
||||
},
|
||||
{
|
||||
"path": "docs/reviews/2026-10-11-key39-lifecycle-v3-netkingdom-review.json",
|
||||
"sha256": "06ac6616e75eb7690836fbce94b30ebecd3a674a3b256118d180ed13c90db3b1",
|
||||
"classification": "source review only"
|
||||
},
|
||||
{
|
||||
"path": "docs/reviews/2026-10-11-key39-lifecycle-v4-netkingdom-review.json",
|
||||
"sha256": "4f4498203a31bd46dbc3715c0df1cbb9eee63bed5b2c1baf430ff3c4a37c13cb",
|
||||
"classification": "source review only"
|
||||
},
|
||||
{
|
||||
"path": "docs/reviews/2026-10-11-key39-lifecycle-v5-netkingdom-review.json",
|
||||
"sha256": "32a62bd1ca1bd7311965d016d4d6a6e4d9177f3423c63add436d9d309865eacc",
|
||||
"classification": "source review only"
|
||||
},
|
||||
{
|
||||
"path": "docs/reviews/2026-10-11-key39-private-producer-net-review.json",
|
||||
"sha256": "a1ed14e6b2db1ae77c3fd638fd7e47b5bd50c25eebba418e31aba89bb4b7f88e",
|
||||
"classification": "source review only"
|
||||
},
|
||||
{
|
||||
"path": "docs/reviews/2026-10-11-key39-producer-v3-net-refusal.json",
|
||||
"sha256": "38abf660701194f85934a076a0c01d3047e6bfe790e02ba1b0e4616e356634e6",
|
||||
"classification": "source review only"
|
||||
},
|
||||
{
|
||||
"path": "docs/reviews/2026-10-11-key39-producer-v4-net-review.json",
|
||||
"sha256": "9566955b77db4a0b041887ef4a6aff6c7a02ef30cc0727a4deb6c29bbdc79518",
|
||||
"classification": "source review only"
|
||||
},
|
||||
{
|
||||
"path": "docs/reviews/2026-10-11-key39-ready-v9-net-review.json",
|
||||
"sha256": "245edc962bbc5bef459d0194c9d0fa916417e327637407470bb6e7cbb1ca5ae9",
|
||||
"classification": "source review only"
|
||||
},
|
||||
{
|
||||
"path": "docs/reviews/2026-10-11-key39-v6-net-source-review.json",
|
||||
"sha256": "d011b8945dab70b4d7965baea826b8983993e8b8c04ca72d43f52b7c039e84ce",
|
||||
"classification": "source review only"
|
||||
},
|
||||
{
|
||||
"path": "docs/reviews/2026-10-11-key39-v7-net-source-review.json",
|
||||
"sha256": "a0c65c6655e3152f209ad83dc69ecba0dcba10e21f723fba4ab3a58501f358ff",
|
||||
"classification": "source review only"
|
||||
},
|
||||
{
|
||||
"path": "docs/reviews/2026-10-11-key39-v8-net-source-review.json",
|
||||
"sha256": "b2711c8ff72724751f9c10ce199fa3564b7893aa4c0377df0d3d1611d0a97eda",
|
||||
"classification": "source review only"
|
||||
}
|
||||
],
|
||||
"actual_native_negative_and_cleanup_receipt_found": false,
|
||||
"interpretation": "No such receipt found in searched source; no conclusion about external or live evidence absence. Other identity/backup/issuer cleanup receipts are not KEY39 OpenBao wrong-claim/native probe acceptance.",
|
||||
"latest_ready_v9": {
|
||||
"native_readiness": false,
|
||||
"KEY39_task_closure": false,
|
||||
"synthetic_offline_only": true
|
||||
},
|
||||
"existing_authority": {
|
||||
"source_design_accepted": true,
|
||||
"registration_go": "caafe4be-4f68-47b4-9567-316d47b94992 already resolved",
|
||||
"standing_attended_rule_preserved": true,
|
||||
"no_renewed_source_or_registration_approval_needed": true,
|
||||
"no_expansion_to_credential_or_native_action": true
|
||||
},
|
||||
"current_tasks": {
|
||||
"KEY-WP-0039-T01": "done",
|
||||
"KEY-WP-0039-T02": "wait",
|
||||
"KEY-WP-0039-T03": "done"
|
||||
},
|
||||
"actual_acceptance_still_needed": "Existing attended every-case refusal, value-free committed native result, revoke/baseline restoration and exact probe-client cleanup; existing KEY38 registration/claims and owner custody/readiness/role/route returns preserved. No new protocol/framework or additional closure conditions.",
|
||||
"additional_source_refs": [
|
||||
{
|
||||
"repo": "key-cape",
|
||||
"path": "workplans/KEY-WP-0039-openbao-negative-probe-tokens.md",
|
||||
"head": "e76d4130f31a02554048f30bf838043cea7a5b80",
|
||||
"sha256": "7b4b97f9a9e6b8291078e187b967a5356702dd7817880f92c12649d764e5e0ae"
|
||||
},
|
||||
{
|
||||
"repo": "the-custodian",
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/key39-infra-finalization-r1/ASSESSMENT.md",
|
||||
"head": "08870d65de615cbb8b5e1f374bf53a2229c21930",
|
||||
"sha256": "6fa24e6dab7a26356caaba07bb539538e22a0b9af2dd19c765b6007978ae8bcd"
|
||||
},
|
||||
{
|
||||
"repo": "the-custodian",
|
||||
"path": "docs/decisions/2026-10-11-security-unblock-decisions.md",
|
||||
"head": "08870d65de615cbb8b5e1f374bf53a2229c21930",
|
||||
"sha256": "660b7a3d008cd6000bbefa55ef692bb5879e067aa086f01effd249f68a382209"
|
||||
}
|
||||
],
|
||||
"native_actions": false,
|
||||
"credential_access": false
|
||||
}
|
||||
|
|
@ -0,0 +1,49 @@
|
|||
{
|
||||
"status": "prepared-unapplied",
|
||||
"source_refs": [
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "workplans/NK-WP-0048-security-case-types.md",
|
||||
"head": "001a38ca2aa85155ce4840c4da22aca6e2346171",
|
||||
"sha256": "b682cd607d9ed9b232656cc7934ec09ac4e986c1c81131a44f80240342a0571c"
|
||||
},
|
||||
{
|
||||
"repo": "ops-warden",
|
||||
"path": "src/warden/case_run.py",
|
||||
"head": "117fec9241e7b985dfb187b992e173d0a5dc3700",
|
||||
"sha256": "77e8117a1fb4e039815b555797778f7180f11e30f64cebe51b350b3eb7e46768"
|
||||
},
|
||||
{
|
||||
"repo": "ops-warden",
|
||||
"path": "workplans/WARDEN-WP-0044-security-case-follow-through.md",
|
||||
"head": "117fec9241e7b985dfb187b992e173d0a5dc3700",
|
||||
"sha256": "721a90b2ed8c896257c34a1451eb642cb8824c8263e37c483fb61b36adc54088"
|
||||
}
|
||||
],
|
||||
"candidate_sha256": "1502f1f474856172d969489cab8c0642d9456d93d326f6660df3772a4716d30b",
|
||||
"all_task_blocks_unchanged": true,
|
||||
"historical_checkpoints_preserved": true,
|
||||
"knowledge": {
|
||||
"version": "0.2.6",
|
||||
"digest": "8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02",
|
||||
"start": "withheld; actual owner source reviewed"
|
||||
},
|
||||
"files": [
|
||||
{
|
||||
"path": "candidate.md",
|
||||
"sha256": "1502f1f474856172d969489cab8c0642d9456d93d326f6660df3772a4716d30b"
|
||||
},
|
||||
{
|
||||
"path": "candidate.patch",
|
||||
"sha256": "4402448cac9b50b745f247aec1c550a5fc3532e702ad4ceeae0812691278118c"
|
||||
},
|
||||
{
|
||||
"path": "key39-readonly-crosscheck.json",
|
||||
"sha256": "c62bb32f43954b46ca2fa904874f9041c95bef7fdf00cd7e4c02f34f0570a57a"
|
||||
},
|
||||
{
|
||||
"path": "preimage.md",
|
||||
"sha256": "b682cd607d9ed9b232656cc7934ec09ac4e986c1c81131a44f80240342a0571c"
|
||||
}
|
||||
]
|
||||
}
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,27 @@
|
|||
from pathlib import Path
|
||||
import subprocess,json,hashlib,re
|
||||
p=Path(__file__).resolve().parent
|
||||
r=Path('/home/worsch/net-kingdom')
|
||||
pre=json.loads((p/'preimage.json').read_text())
|
||||
name='workplans/NK-WP-0048-security-case-types.md'
|
||||
def git(*a):return subprocess.check_output(['git','-C',str(r),*a],stderr=subprocess.PIPE).decode().strip()
|
||||
assert git('rev-parse','HEAD')==pre['head']
|
||||
assert git('ls-remote','origin','refs/heads/main').split()[0]==pre['head']
|
||||
original=(p/'backup'/name).read_bytes();candidate=(p/'candidate.md').read_bytes()
|
||||
assert (r/name).read_bytes()==original
|
||||
assert hashlib.sha256(candidate).hexdigest()=='1502f1f474856172d969489cab8c0642d9456d93d326f6660df3772a4716d30b'
|
||||
assert re.findall(rb'```task\n.*?```',original,re.S)==re.findall(rb'```task\n.*?```',candidate,re.S)
|
||||
(r/name).write_bytes(candidate)
|
||||
result=subprocess.run(['git','-C',str(r),'commit','--only','-m','docs: update published Warden original-context checkpoint','--',name],capture_output=True,text=True,timeout=240)
|
||||
head=git('rev-parse','HEAD')
|
||||
(p/'commit-receipt.json').write_text(json.dumps({'exit_code':result.returncode,'commit':head,'base':pre['head'],'stdout':result.stdout,'stderr':result.stderr},indent=2)+'\n')
|
||||
assert result.returncode==0,'normal commit refused; receipt retained'
|
||||
assert git('diff-tree','--no-commit-id','--name-only','-r',head)==name
|
||||
assert (r/name).read_bytes()==candidate
|
||||
for row in pre['files']:
|
||||
if row['path'] in ('.custodian-brief.md','WORK-RECORDS.md'):
|
||||
(r/row['path']).write_bytes((p/'backup'/row['path']).read_bytes())
|
||||
if git('ls-files','--stage','--',row['path'])!=row['index']:
|
||||
mode,oid,stage,path=row['index'].split();assert stage=='0'
|
||||
git('update-index','--cacheinfo',mode,oid,path)
|
||||
print(json.dumps({'status':'committed','commit':head,'path':name}))
|
||||
|
|
@ -0,0 +1,56 @@
|
|||
--- a/workplans/NK-WP-0048-security-case-types.md
|
||||
+++ b/workplans/NK-WP-0048-security-case-types.md
|
||||
@@ -783,13 +783,15 @@
|
||||
Owner: NetKingdom for registration state, with Warden owning kernel evidence
|
||||
admission. T22 records the completed source review and exact existing-seam gaps;
|
||||
T15 retains implementation and authenticated restart/lost-receipt acceptance.
|
||||
-Next action: identify the actual owner publisher/authenticator and bounded
|
||||
-original-attempt readback contract, and obtain Warden's reviewed original-intent
|
||||
-lookup/context interface through existing WARDEN-WP-0044-T03. The current Journal
|
||||
-retains attempt identity in historical rows but only hashes evidence references;
|
||||
-load drops that context and reconcile passes a fresh attempt to the callback.
|
||||
-The adapter's original payload and creation record remain process-local. Neither
|
||||
-that journal nor a current matching registry entry reconstructs creation authority.
|
||||
+Next action: select and admit the actual owner publisher/authenticator and bounded
|
||||
+original-attempt readback contract for the merged holder/observe adapter seam.
|
||||
+Warden's original-intent persistence/interface (`a45cf475`) and additive validation
|
||||
+(`117fec9241e7b985dfb187b992e173d0a5dc3700`) are now published and projected.
|
||||
+The local Journal retains admitted nonsecret original context, validates original
|
||||
+actor/attempt and metadata linkage to the original running receipt, and supplies
|
||||
+it separately from the new reconciliation attempt. This local consistency is not
|
||||
+independent original-holder authorization or creation provenance; neither the
|
||||
+journal nor a current matching registry entry reconstructs creation authority.
|
||||
|
||||
The owner contract must bind the original Invocation, case/type/descriptor/catalog/
|
||||
acceptance pins, source, principal and admitted tenant/realm provenance, separately
|
||||
@@ -804,9 +806,10 @@
|
||||
contract: independently authenticated original created-only provenance, original
|
||||
exact client entry and unchanged current postcreation UID/resourceVersion before
|
||||
any undo, with wrong attempt/case/source/principal and unavailable-holder refusals.
|
||||
-The T13 adapter deliberately refuses post-restart rollback and installs no
|
||||
-reconciliation callback. Existing source review, JSON receipts and synthetic
|
||||
-trust do not satisfy native holder acceptance or authorize attended recovery.
|
||||
+The merged T13 adapter exposes reconciliation only through paired injected
|
||||
+holder/observe capabilities and still refuses post-restart rollback. Existing
|
||||
+source review, JSON receipts and synthetic trust do not satisfy independent
|
||||
+holder authorization/provenance or native admission, or authorize attended recovery.
|
||||
Exact remaining owner facts: Custodian native-registration-r1/original-attempt-review.json.
|
||||
|
||||
2026-10-17 check (net-kingdom-worker): Warden's original-intent lookup interface
|
||||
@@ -816,6 +819,16 @@
|
||||
T16's decomposition under the same token budget. Remains todo, gated on Warden
|
||||
publishing the reviewed lookup/context interface and on owner selection of the
|
||||
authenticated original-attempt holder.
|
||||
+
|
||||
+2026-10-17 current-source correction: the earlier same-day `d97652a` lookup
|
||||
+checkpoint and T31 adapter-next-action note above are historical and superseded
|
||||
+by the published Warden interface/validation and merged `061461e` adapter seam.
|
||||
+The 54 focused Warden checks establish source behavior only. Current admission
|
||||
+leaves tenant/realm empty; no admitted tenant/realm provenance is inferred.
|
||||
+T15 remains wait for actual independently authenticated owner-holder/readback
|
||||
+selection, independent review of the changed adapter, and native restart/lost-
|
||||
+receipt acceptance. Existing task metadata, owner gates and historical reviews
|
||||
+are unchanged.
|
||||
|
||||
## T16 — Select and review the actual machine descriptor composition
|
||||
|
||||
|
|
@ -0,0 +1,91 @@
|
|||
<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
|
||||
# Custodian Brief — net-kingdom
|
||||
|
||||
**Domain:** infotech
|
||||
**Last synced:** 2026-10-17 09:16 UTC
|
||||
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
|
||||
|
||||
## Active Workstreams
|
||||
|
||||
### Publish the NetKingdom emission-cadence security profile
|
||||
Progress: 5/6 done | workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc`
|
||||
|
||||
**Open tasks:**
|
||||
- ► Bind and hand off the published contract `e3fbc8b8`
|
||||
|
||||
### Register Playwright human and agent consumers through governed identity delivery
|
||||
Progress: 1/3 done | workplan_id: `06ba98d5-609e-5aaa-9bf7-4c4f4460e377`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Verify issuer and real consumer acceptance `5a3aaf57`
|
||||
*(wait: Await owner-scoped registry/custody activation, native cluster authentication and individual transport, then real human and agent acceptance under CUST-WP-0080-T05.)*
|
||||
- ► Deliver custody integration and guarded registration activation `a9dadd07`
|
||||
|
||||
### Remove bootstrap secret output and verify separated recovery custody
|
||||
Progress: 26/38 done | workplan_id: `17d315f0-829e-57c7-85cc-3a7914152804`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Accept remaining recovery and caller evidence and close the G08 handoff `d68cd4d3`
|
||||
*(wait: Await the separately tracked native service proofs, current/legacy caller dispositions and residual-scope decisions; archive recovery, backup activation, independent outage retrieval and guide publication are complete.)*
|
||||
- ! Resolve historical credential and configuration-preserving rotation dispositions `3ea6bf00`
|
||||
*(wait: Await the caller/consumer ledger, current replacement-lane acceptance and explicit credential-owner dispositions; existing exposure-rotation deferral is unchanged.)*
|
||||
- ! Verify current caller and provider admission at their actual boundaries `77aa42be`
|
||||
*(wait: Await the current-caller ledger and exact per-caller owner admission/test inputs; the backup credential grants do not admit unrelated callers.)*
|
||||
- ! Prove retained privacyIDEA token decryption and existing-token MFA `6f8af1a7`
|
||||
*(wait: LLDAP T16, token-material T31 and audit T20 passed; await the exact isolated MFA adapter and owner-selected retained-token/factor inputs.)*
|
||||
- ! Prove restored KeyCape issuer, policy and consumer continuity `141dd773`
|
||||
*(wait: Source and synthetic KeyCape lifecycle proof are delivered in T32; await exact owner-held recovery attempt preparation T33, selected consumer acceptance and retained-token MFA for the selected flow.)*
|
||||
- ! Prove restored Authelia storage and OIDC continuity `b47f9975`
|
||||
*(wait: LLDAP recovery T16 passed; await the exact isolated Authelia adapter/procedure and private authentication-flow inputs from T15.)*
|
||||
- ! Prepare the exact owner-held KeyCape recovery attempt `56c8d469`
|
||||
*(wait: Source custody/preflight preparation is evidenced in T34; await original TLS/trust recovery disposition T35 and selected original registration/private-admission metadata T36 before final reviewed command and existing owner process.)*
|
||||
- … and 5 more open tasks
|
||||
|
||||
### Establish SecurityCaseTypes so that known security cases are light
|
||||
Progress: 25/31 done | workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb`
|
||||
|
||||
**Open tasks:**
|
||||
- ! T05 — Acknowledge the type through informed-decision `d9b26bcf`
|
||||
*(wait: Type1.2 architecture has a confirmed source-only founder acknowledgment; canonical1.1 remains unchanged/default and the1.2 reference case stays proposed. Needs explicit version selection/reference-source integration without normal admission bypass, closed owner adapters plus global/native receipt verifier (WARDEN-WP-0044-T03), independently verified six-object structural materialization and CCR42 claims/created-only provenance, exact broker/case/source reconciliation, then separately authorized native mint/delivery and attended registry/consumer verification. Source acknowledgment, a bundle or local tests do not prove implemented/materialized/live status.)*
|
||||
- ! T06 — First KnownSecurityCase: Forgejo `c3c9c3ae`
|
||||
*(wait: The next types follow once the first one is proven end to end.)*
|
||||
- ! T15 — Define authenticated recovery for lost registration process state `1b825705`
|
||||
*(wait: Source candidate 061461e is merged. Waiting on the owner to select the real authenticated original-attempt holder and native readback, and on independent re-review of the changed T13 adapter source.)*
|
||||
- ► T14 — Admit governed group rollback against native owner boundaries `fce95440`
|
||||
- · T12 — Prepare NetKingdom-owned attended step adapters `7ce4eee3`
|
||||
- · T16 — Select and review the actual machine descriptor composition `200bf500`
|
||||
|
||||
### Define an execution-attribution receipt for Railiance runs
|
||||
Progress: 1/2 done | workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Agree the evidence holder and schema with audit-core and Railiance `963120c1`
|
||||
*(wait: Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance.)*
|
||||
|
||||
### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker
|
||||
Progress: 1/9 done | workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Admit the database consumer `2fe6f100`
|
||||
*(wait: ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence.)*
|
||||
- ! Package the broker deployment `32d1411b`
|
||||
*(wait: ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment.)*
|
||||
- ! Integrate an upstream identity provider `6697a994`
|
||||
*(wait: Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence.)*
|
||||
- ! Define federated assurance `d845380d`
|
||||
*(wait: Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners.)*
|
||||
- ! Verify IAM conformance and coexistence `9cb7fd93`
|
||||
*(wait: Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent.)*
|
||||
- ! Enforce tenant and platform boundaries `38998c68`
|
||||
*(wait: Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission.)*
|
||||
- ! Prove recovery and audit delivery `e5f44ddc`
|
||||
*(wait: Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent.)*
|
||||
- … and 1 more open tasks
|
||||
|
||||
---
|
||||
## MCP Orientation (when available)
|
||||
|
||||
If the state-hub MCP server is reachable, call:
|
||||
`get_domain_summary("infotech")`
|
||||
This provides richer cross-domain context.
|
||||
If the MCP call fails, use this file as your orientation source.
|
||||
|
|
@ -0,0 +1,289 @@
|
|||
# Work Records — net-kingdom
|
||||
|
||||
> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
|
||||
> stage 3). Do not edit by hand — edit the source file/block listed for
|
||||
> each record and re-run fix-consistency to refresh this index. Archived
|
||||
> workplans are omitted; closed decisions/intakes/engagements stay listed
|
||||
> so recently-resolved work is still visible. [auto]
|
||||
|
||||
| Kind | ID | Status | Lane | Source |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| workplan | NK-WP-ADHOC-2026-07-02 | finished | — | workplans/ADHOC-2026-07-02.md |
|
||||
| workplan | NK-WP-ADHOC-2026-08-14 | finished | — | workplans/ADHOC-2026-08-14.md |
|
||||
| workplan | NK-WP-ADHOC-2026-08-23 | finished | — | workplans/ADHOC-2026-08-23.md |
|
||||
| workplan | NK-WP-ADHOC-2026-10-03 | finished | — | workplans/ADHOC-2026-10-03.md |
|
||||
| workplan | NK-WP-ADHOC-2026-10-10 | finished | — | workplans/ADHOC-2026-10-10.md |
|
||||
| workplan | NK-WP-ADHOC-2026-10-11 | finished | — | workplans/ADHOC-2026-10-11.md |
|
||||
| workplan | NK-WP-ADHOC-2026-10-16 | finished | — | workplans/ADHOC-2026-10-16.md |
|
||||
| workplan | NET-WP-0020 | finished | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| workplan | NK-WP-0009 | finished | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| workplan | NK-WP-0011 | active | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| workplan | NK-WP-0021 | finished | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| workplan | NK-WP-0022 | finished | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| workplan | NK-WP-0023 | finished | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| workplan | NK-WP-0024 | finished | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| workplan | NK-WP-0025 | finished | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| workplan | NK-WP-0026 | finished | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
|
||||
| workplan | NK-WP-0027 | backlog | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| workplan | NK-WP-0028 | finished | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| workplan | NK-WP-0029 | finished | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| workplan | NK-WP-0030 | finished | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| workplan | NK-WP-0031 | finished | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| workplan | NK-WP-0032 | finished | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| workplan | NK-WP-0033 | finished | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| workplan | NK-WP-0034 | finished | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| workplan | NK-WP-0035 | active | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| workplan | NK-WP-0036 | finished | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| workplan | NK-WP-0037 | finished | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
|
||||
| workplan | NK-WP-0038 | finished | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
|
||||
| workplan | NK-WP-0039 | finished | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| workplan | NK-WP-0040 | active | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
|
||||
| workplan | NK-WP-0041 | finished | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
|
||||
| workplan | NK-WP-0042 | finished | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
|
||||
| workplan | NK-WP-0043 | finished | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
|
||||
| workplan | NK-WP-0044 | finished | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| workplan | NK-WP-0045 | finished | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| workplan | NK-WP-0046 | finished | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
|
||||
| workplan | NK-WP-0047 | finished | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
|
||||
| workplan | NK-WP-0048 | active | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| workplan | NK-WP-0049 | active | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| workplan | NK-WP-0050 | active | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| workplan | NK-WP-0051 | finished | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md |
|
||||
| task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md |
|
||||
| task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md |
|
||||
| task | NK-WP-ADHOC-2026-08-14-T02 | done | — | workplans/ADHOC-2026-08-14.md |
|
||||
| task | NK-WP-ADHOC-2026-08-14-T03 | done | — | workplans/ADHOC-2026-08-14.md |
|
||||
| task | NK-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md |
|
||||
| task | NK-WP-ADHOC-2026-10-03-T01 | done | — | workplans/ADHOC-2026-10-03.md |
|
||||
| task | NK-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T03 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T04 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T05 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T06 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-11-T07 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
| task | NK-WP-ADHOC-2026-10-16-T01 | done | — | workplans/ADHOC-2026-10-16.md |
|
||||
| task | NET-WP-0020-T01 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NET-WP-0020-T02 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NET-WP-0020-T03 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NET-WP-0020-T04 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NET-WP-0020-T05 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| task | NK-WP-0009-T01 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T02 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T03 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T04 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T05 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0009-T06 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| task | NK-WP-0011-T01 | done | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T02 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T03 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T04 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T05 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T06 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T07 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T08 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0011-T09 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| task | NK-WP-0021-T01 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0021-T02 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0021-T03 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0021-T04 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0021-T05 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| task | NK-WP-0022-T01 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T02 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T03 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T04 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T05 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T06 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T07 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0022-T08 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| task | NK-WP-0023-T01 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T02 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T03 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T04 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T05 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T06 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T07 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0023-T08 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
| task | NK-WP-0024-T01 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| task | NK-WP-0024-T02 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| task | NK-WP-0024-T03 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| task | NK-WP-0024-T04 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| task | NK-WP-0025-T01 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T02 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T03 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T04 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T05 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0026-T01 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
|
||||
| task | NK-WP-0026-T02 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
|
||||
| task | NK-WP-0027-T01 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T02 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T03 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T04 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T05 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0027-T06 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
|
||||
| task | NK-WP-0028-T01 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| task | NK-WP-0028-T02 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| task | NK-WP-0028-T03 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| task | NK-WP-0028-T04 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
|
||||
| task | NK-WP-0029-T01 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| task | NK-WP-0029-T02 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| task | NK-WP-0029-T03 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| task | NK-WP-0029-T04 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
|
||||
| task | NK-WP-0030-T01 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0030-T02 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0030-T03 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0030-T04 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0030-T05 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
|
||||
| task | NK-WP-0031-T01 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0031-T02 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0031-T03 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0031-T04 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0031-T05 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
|
||||
| task | NK-WP-0032-T01 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| task | NK-WP-0032-T02 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| task | NK-WP-0032-T03 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| task | NK-WP-0032-T04 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
|
||||
| task | NK-WP-0033-T01 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0033-T02 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0033-T03 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0033-T04 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0033-T05 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
|
||||
| task | NK-WP-0034-T01 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| task | NK-WP-0034-T02 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| task | NK-WP-0034-T03 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| task | NK-WP-0034-T04 | done | — | workplans/NK-WP-0034-verification-that-verifies.md |
|
||||
| task | NK-WP-0035-T01 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T02 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T03 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T04 | progress | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T05 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0035-T06 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md |
|
||||
| task | NK-WP-0036-T01 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T02 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T03 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T04 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T05 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0036-T06 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md |
|
||||
| task | NK-WP-0037-T01 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
|
||||
| task | NK-WP-0037-T02 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md |
|
||||
| task | NK-WP-0038-T01 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
|
||||
| task | NK-WP-0038-T02 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md |
|
||||
| task | NK-WP-0039-T01 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-0039-T02 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-0039-T03 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-0039-T04 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
|
||||
| task | NK-WP-0040-T01 | done | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
|
||||
| task | NK-WP-0040-T02 | wait | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
|
||||
| task | NK-WP-0041-T01 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
|
||||
| task | NK-WP-0041-T02 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
|
||||
| task | NK-WP-0041-T03 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
|
||||
| task | NK-WP-0042-T01 | done | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
|
||||
| task | NK-WP-0042-T02 | cancel | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
|
||||
| task | NK-WP-0043-T01 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
|
||||
| task | NK-WP-0043-T02 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
|
||||
| task | NK-WP-0043-T03 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
|
||||
| task | NK-WP-0044-T01 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T02 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T03 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T04 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T05 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T06 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0044-T07 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| task | NK-WP-0045-T01 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T02 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T03 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T04 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T05 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T06 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0046-T01 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
|
||||
| task | NK-WP-0046-T02 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
|
||||
| task | NK-WP-0046-T03 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
|
||||
| task | NK-WP-0047-T01 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
|
||||
| task | NK-WP-0047-T02 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
|
||||
| task | NK-WP-0047-T03 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
|
||||
| task | NK-WP-0048-T01 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T02 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T03 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T04 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T05 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T06 | wait | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T07 | wait | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T08 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T09 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T10 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T11 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T12 | todo | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T13 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T14 | progress | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T15 | wait | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T16 | todo | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T17 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T18 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T19 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T20 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T21 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T22 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T23 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T24 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T25 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T26 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T27 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T28 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T29 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T30 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0048-T31 | done | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| task | NK-WP-0049-T01 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T02 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T03 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T04 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T05 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T06 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T07 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T08 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T09 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T10 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T11 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T12 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T13 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T14 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T15 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T16 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T17 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T18 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T19 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T20 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T21 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T22 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T23 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T24 | todo | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T25 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T26 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T27 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T28 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T29 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T30 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T31 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T32 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T33 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T34 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T35 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T36 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T37 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T38 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0050-T01 | done | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| task | NK-WP-0050-T02 | progress | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| task | NK-WP-0050-T03 | wait | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| task | NK-WP-0051-T01 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T02 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T03 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T04 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T05 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| task | NK-WP-0051-T06 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
|
||||
| intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
|
||||
| intake | NET-IN-0001 | open | — | intakes/intakes.md |
|
||||
| intake | NET-IN-0002 | open | — | intakes/intakes.md |
|
||||
| intake | NET-IN-0003 | open | — | intakes/intakes.md |
|
||||
| intake | NET-IN-0004 | open | — | intakes/intakes.md |
|
||||
|
|
@ -0,0 +1,51 @@
|
|||
---
|
||||
id: NK-WP-ADHOC-2026-07-02
|
||||
type: workplan
|
||||
title: "Ad Hoc Tasks — 2026-07-02"
|
||||
domain: infotech
|
||||
repo: net-kingdom
|
||||
status: finished
|
||||
owner: codex
|
||||
topic_slug: net-kingdom
|
||||
created: "2026-07-02"
|
||||
updated: "2026-07-02"
|
||||
state_hub_workstream_id: "a9177c57-3f48-5d32-aa04-d1822fb86d47"
|
||||
---
|
||||
|
||||
# Ad Hoc Tasks — 2026-07-02
|
||||
|
||||
## Fix creds-bootstrap-agent Phase 0 dry-run on machines without the age key
|
||||
|
||||
```task
|
||||
id: NK-WP-ADHOC-2026-07-02-T01
|
||||
status: done
|
||||
priority: low
|
||||
state_hub_task_id: "16053545-ed7f-576f-81e0-7095b62a0a1e"
|
||||
```
|
||||
|
||||
`--dry-run` previously aborted silently in Phase 0 on any machine without
|
||||
`~/.config/sops/age/keys.txt`: key generation is correctly skipped in dry-run,
|
||||
but the subsequent public-key read (`grep` on the missing file) killed the
|
||||
script under `set -e`, so no later phase could be exercised.
|
||||
|
||||
Fix: when the key file is absent in dry-run, continue with a placeholder
|
||||
recipient and a clear notice instead of dying; live runs without a key still
|
||||
fail hard. Verified: full `--dry-run` now traverses Phase 0 through Phase 10
|
||||
including the new Phase 7b OpenBao hook (NET-WP-0020-T02) on a machine with
|
||||
no age key.
|
||||
|
||||
## Fix broken check-secrets Make target (unescaped `$`)
|
||||
|
||||
```task
|
||||
id: NK-WP-ADHOC-2026-07-02-T02
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "d86d474c-d6ff-57ed-a111-d10f674cb9e4"
|
||||
```
|
||||
|
||||
`make check-secrets` failed with a bash parse error ("unexpected EOF while
|
||||
looking for matching `'`"): the trailing `grep -v '/$'` used a single `$`,
|
||||
which make expanded before bash saw it. Escaped to `$$`. Verified:
|
||||
`make check-secrets` passes again ("All secrets/ files appear SOPS-encrypted").
|
||||
Pre-existing bug, unrelated to NET-WP-0020; found while running the final
|
||||
checks for that workplan.
|
||||
|
|
@ -0,0 +1,70 @@
|
|||
---
|
||||
id: NK-WP-ADHOC-2026-08-14
|
||||
type: workplan
|
||||
title: "Close NK-WP-0025 residuals"
|
||||
domain: infotech
|
||||
repo: net-kingdom
|
||||
status: finished
|
||||
owner: codex
|
||||
topic_slug: netkingdom
|
||||
created: "2026-08-14"
|
||||
updated: "2026-08-14"
|
||||
state_hub_workstream_id: "d9c4de99-ab79-5238-afe5-c4c77204758c"
|
||||
---
|
||||
|
||||
# NK-WP-ADHOC-2026-08-14 - NK-WP-0025 residual closeout
|
||||
|
||||
## Reconcile Coulomb Social Case B residual records
|
||||
|
||||
```task
|
||||
id: NK-WP-ADHOC-2026-08-14-T01
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "9968795f-bfc8-5e3e-8b1e-37933fc555a3"
|
||||
```
|
||||
|
||||
Update the owning smoke evidence and close or narrow CSOC-IN-0001 and
|
||||
CSOC-IN-0002 now that NK-WP-0025 completed the public registration, OIDC/JIT,
|
||||
repeat-login, collision, redirect, and assurance evidence.
|
||||
|
||||
## Protect the canonical LDAP-DN subject contract
|
||||
|
||||
```task
|
||||
id: NK-WP-ADHOC-2026-08-14-T02
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "664aff29-2d03-5cbe-a3e0-1c52d160d019"
|
||||
```
|
||||
|
||||
Add focused regression coverage for the canonical LDAP-DN OIDC subject and
|
||||
the reverse normalization used by directory lifecycle and password setup.
|
||||
|
||||
## Persist the audit-core multi-tenant sender scope
|
||||
|
||||
```task
|
||||
id: NK-WP-ADHOC-2026-08-14-T03
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "000e4708-6ef5-550b-9191-f914bdfcd255"
|
||||
```
|
||||
|
||||
Move the live `user-engine` sender registry from its manually minted Secret to
|
||||
the authoritative OpenBao/ExternalSecret path with source-bound write-only
|
||||
scope and `tenants: ["*"]`, without reading or logging its token.
|
||||
|
||||
2026-08-14 probe: the live Secret has the correct redacted scope, but
|
||||
`platform/workloads/audit-core/senders` does not exist. ClusterSecretStore
|
||||
`openbao-audit-core` is present and can read only that exact path. The current
|
||||
workstation OpenBao identity returns 403 and credential routing exposes no
|
||||
resolvable write grant. Completion therefore waits for a short-lived
|
||||
platform-admin OpenBao session to perform the documented wrapped migration;
|
||||
the temporary probe ExternalSecret was removed.
|
||||
|
||||
Done 2026-08-14: after an attended KeyCape/MFA `platform-admin` login, the
|
||||
existing registry was streamed directly from Kubernetes to OpenBao without
|
||||
printing or staging it. OpenBao created version 1; ExternalSecret
|
||||
`audit-core-senders` became `SecretSynced` and owns the derived Secret. Its
|
||||
base64 checksum remained
|
||||
`dcf342e33fd326c536ee3ada443f294221836e226e5924ac1b2ec490631a3cdb`, proving
|
||||
the migration did not change the live document. The audit-core rollout
|
||||
completed and `/readyz` returned durable `archive` custody.
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
---
|
||||
id: NK-WP-ADHOC-2026-08-23
|
||||
type: workplan
|
||||
title: "Ad Hoc Tasks — 2026-08-23"
|
||||
domain: infotech
|
||||
repo: net-kingdom
|
||||
status: finished
|
||||
owner: codex
|
||||
topic_slug: netkingdom
|
||||
created: "2026-08-23"
|
||||
updated: "2026-08-23"
|
||||
state_hub_workstream_id: "b3abc407-1fd0-58c4-9d8d-2c003ae6f1c9"
|
||||
---
|
||||
|
||||
# Ad Hoc Tasks — 2026-08-23
|
||||
|
||||
## Advance the canonical audit-core E level after adversarial evidence
|
||||
|
||||
```task
|
||||
id: NK-WP-ADHOC-2026-08-23-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "997a696b-1e07-5310-8d22-412eb608cca2"
|
||||
```
|
||||
|
||||
Updated the Tenancy Posture §5 worked example from `E1` to `E2` after
|
||||
audit-core published bounded adversarial evidence for both tenant-filtered
|
||||
paths. The canon text names run `WH-ENG-20260822-AUDIT-E2-03`, preserves the
|
||||
claim's limited meaning, and records the facility freshness review deadline of
|
||||
`2026-08-23T22:10:25Z` rather than presenting the result as timeless proof.
|
||||
|
||||
Verification validates audit-core's declaration against the canonical schema,
|
||||
runs the tenancy-posture unit suite, and checks the repository diff.
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
---
|
||||
id: NK-WP-ADHOC-2026-10-03
|
||||
type: workplan
|
||||
title: "Review Emergent Security 0.2.1 orientation boundary"
|
||||
domain: infotech
|
||||
repo: net-kingdom
|
||||
status: finished
|
||||
owner: codex
|
||||
topic_slug: net-kingdom
|
||||
created: "2026-10-03"
|
||||
updated: "2026-10-03"
|
||||
state_hub_workstream_id: "a7999e06-b102-5e99-b179-4b19dffac6f9"
|
||||
---
|
||||
|
||||
## Complete owner-scoped documentary review
|
||||
|
||||
```task
|
||||
id: NK-WP-ADHOC-2026-10-03-T01
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "9849707d-11d0-568a-b902-0cf5bcc18850"
|
||||
```
|
||||
|
||||
Evidence: docs/evidence/2026-10-03-emergent-knowledge-021-review.md. The user authorized repository workers to review the exact
|
||||
0.2.1 release for EMERGENT-WP-0002. Review and feedback are complete within
|
||||
this owner's published boundaries. No policy or operational authority changed;
|
||||
no authenticated human assent asserted. Existing decision
|
||||
d20a9750-2b29-534e-8227-fb866581a6ca and EMERGENT-WP-0002-T02/T08/T09 retain
|
||||
pending acceptance/publication/pilot gates; this record does not duplicate them.
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
---
|
||||
id: NK-WP-ADHOC-2026-10-10
|
||||
type: workplan
|
||||
title: "Follow the access-engine CLI rename"
|
||||
domain: infotech
|
||||
repo: net-kingdom
|
||||
status: finished
|
||||
owner: claude-code
|
||||
topic_slug: net-kingdom
|
||||
created: "2026-10-10"
|
||||
updated: "2026-10-10"
|
||||
state_hub_workstream_id: "341b61a1-9e64-5d54-ae4e-a130abc6b960"
|
||||
---
|
||||
|
||||
## Replace `./cmd/flex-auth` with `./cmd/access-engine`
|
||||
|
||||
```task
|
||||
id: NK-WP-ADHOC-2026-10-10-T01
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "ac0c45ab-74fe-5ed3-8130-416ea111e07c"
|
||||
```
|
||||
|
||||
access-engine renamed its CLI (FLEX-DEC-2026-020, access-engine 0ced299,
|
||||
message `e2f1aac9`): `./cmd/flex-auth` is now a stub that exits 2. The
|
||||
protected-system runbook pack and tutorial now call `go run ./cmd/access-engine`
|
||||
(subcommands and flags unchanged), and the tenant-engine README no longer lists
|
||||
`cmd/flex-auth` among the unchanged runtime names. Runtime names (namespace,
|
||||
Service DNS, audience, chart, OCI package) stay `flex-auth` until FLEX-WP-0036.
|
||||
`make runbooks-validate` passes; historical records are left as they were.
|
||||
|
|
@ -0,0 +1,347 @@
|
|||
---
|
||||
id: NK-WP-ADHOC-2026-10-11
|
||||
type: workplan
|
||||
title: "Review bounded security doctrine and catalogue exception proposals"
|
||||
domain: infotech
|
||||
repo: net-kingdom
|
||||
status: finished
|
||||
flavor: planning
|
||||
owner: codex
|
||||
topic_slug: netkingdom
|
||||
created: "2026-10-11"
|
||||
updated: "2026-10-11"
|
||||
related: [GH-WP-0004]
|
||||
state_hub_workstream_id: "930ae9b3-4769-57ce-bb77-ba2a997f653e"
|
||||
---
|
||||
|
||||
## Review exact requested successor-canon amendment without publication
|
||||
|
||||
```task
|
||||
id: NK-WP-ADHOC-2026-10-11-T01
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "9dd7fb12-1ca4-5fd5-94e7-a75dd3e00939"
|
||||
```
|
||||
|
||||
Source-owner review only of GH-WP-0004-T06-r1, exact proposal SHA256
|
||||
08bc78a29c2b67cec0aafba993fb2d25312b629ecccb81458980baafe38e566a.
|
||||
Reviewed against NetKingdom INTENT, accepted v0.8, current working companion,
|
||||
GH012/014/017/021/024 and InformedDecision's requested row/event inventory.
|
||||
Approved technical compatibility for separate founder disposition and proposed
|
||||
successor publication review; no standard/case acceptance, founder decision,
|
||||
live publication, runtime conformance or completion of GH-WP-0004-T06/INFD-IN-0007
|
||||
is asserted. Review and exact sources are retained in docs/reviews/.
|
||||
|
||||
## Review the exact one-application maintenance exception source
|
||||
|
||||
```task
|
||||
id: NK-WP-ADHOC-2026-10-11-T02
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "60c1a740-75ac-56f8-bee8-905e7d236460"
|
||||
```
|
||||
|
||||
NetKingdom-only source-owner review of applied refined nine-file User Engine
|
||||
maintenance candidate manifest0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7.
|
||||
Reviewed canonical one-app/client/system facts, truthful exception attribution,
|
||||
source/hash/native-clock/single-use boundaries and retained-event recovery limits.
|
||||
Technical agreement for separate exact founder disposition; no human approval,
|
||||
runtime go, catalogue write, default role/grant or normal PDP bypass permission
|
||||
is inferred. The fresh User Engine owner supplies its distinct review; this
|
||||
worker signs only the established NetKingdom owner role. Exact review/sources
|
||||
are retained in docs/reviews/.
|
||||
|
||||
## Review the exact Forgejo consumer ESO successor source
|
||||
|
||||
```task
|
||||
id: NK-WP-ADHOC-2026-10-11-T03
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "03292a62-1803-5bdf-9f19-f2c8fa7b61db"
|
||||
```
|
||||
|
||||
NetKingdom-only source-owner review of the frozen 17-path Forgejo consumer ESO
|
||||
successor proposal. Initial manifest c48b64e5e704e8f11ca65095c376c8a9fecc2b3a58e74b9eb62096c80d00f4fb
|
||||
contained a misleading acknowledged-type risk note; the requester corrected it
|
||||
and retained that original revision. Final manifest
|
||||
271afd04512b3dac642b3385013cac03d28afde22ff97bcca8d0e262ab3d9279 independently
|
||||
verified, including the sole risk-note amendment, all 17 paths, seven current
|
||||
source pins, native source validators, identical full render regeneration and
|
||||
exact preservation of the original five structural objects plus a sixth role.
|
||||
Technical source agreement only: SecurityCaseTypes §6 requires a new founder
|
||||
informed-decision acknowledgment for this authentication/materialization change;
|
||||
current type/case1.1, historical CCR42 and all native state remain unchanged.
|
||||
No type/case acknowledgment, binding admission, materialization, credential
|
||||
grant or live delivery is authorized. Exact review and evidence retained in
|
||||
docs/reviews/2026-10-11-forgejo-consumer-eso-net-owner-review.*.
|
||||
|
||||
## Receive the accepted bounded doctrine handoff and assemble proposed source
|
||||
|
||||
```task
|
||||
id: NK-WP-ADHOC-2026-10-11-T04
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "c867858d-dda6-504a-9eac-f53b8ece6e31"
|
||||
```
|
||||
|
||||
Received exact GH-DEC-2026-025 / GH-WP-0004-T06 source-owner handoff after
|
||||
confirmed person ACCEPT d90c899b-f25c-4e66-a003-808ee5b1324f at2026-10-11T01:46:25Z
|
||||
of proposal08bc78a29c2b67cec0aafba993fb2d25312b629ecccb81458980baafe38e566a.
|
||||
Assembled the exact bounded §3.4/§4 candidate in proposed v0.9 only; accepted
|
||||
v0.8 stays byte-identical/operative. Reviewed full paragraph/row equality against
|
||||
both immutable proposal and handoff, native receipt scope, unchanged other
|
||||
normative sections and retained Staff/evidence limits. No whole v0.9 acceptance
|
||||
or serving/deployment is inferred. Live successor adoption/publication is
|
||||
retained first as NET-IN-0004; INFD-IN-0007 stays open pending accepted voice.
|
||||
Gate House handoff completion is distinct from this source-owner's outstanding
|
||||
standard adoption. No finished INFD implementation plan is reopened.
|
||||
|
||||
## Review the final nineteen-path Forgejo consumer ESO source revision
|
||||
|
||||
```task
|
||||
id: NK-WP-ADHOC-2026-10-11-T05
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "4903132f-3815-502d-bcf8-30d7a244f62d"
|
||||
```
|
||||
|
||||
Final narrow NetKingdom source-owner review of manifest
|
||||
5dbd04cf96d73a2604cbf113073d618c03434fc87508ba614cbe3820a1a0e431.
|
||||
Retains T03 and its earlier271 proposal review as history, not current exact
|
||||
acknowledgment. Verified all19 staged hashes, seven current source pins, proposed
|
||||
type/case admission refusal, identical c0afd render and independent projections.
|
||||
Both prior271 counterexamples reproduced: wrong consumer target and missing
|
||||
created-only issued-token recovery guards. Corrected builder derives forgejo,
|
||||
preserves KeyCape output and requires owner revocation or verified expiry,
|
||||
created-only preservation and no recovery login/remint. Fresh Mason/Platform
|
||||
owner44-test reports checked; no native proof inferred. Proposed type/case
|
||||
need fresh founder acknowledgment under §6, source rebundle/reconciliation and
|
||||
existing per-owner/native acceptance. No role/grant/materialization/runtime
|
||||
change or first-case completion. Exact final review/sources retained in
|
||||
docs/reviews/2026-10-11-forgejo-consumer-eso-net-owner-final-review.*.
|
||||
|
||||
## Review the source-only successor acknowledgment human packet
|
||||
|
||||
```task
|
||||
id: NK-WP-ADHOC-2026-10-11-T06
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "cee400f6-f1a6-5ee3-8fde-68bfb4c9cbf4"
|
||||
```
|
||||
|
||||
NetKingdom-only source-owner review of exact26-path packet
|
||||
eeb2968ec317d0bc072788011918025a21d2b48c13987d09945ae8761f3d8fe5, stable proposal
|
||||
NK-FORGEJO-TYPE12-SOURCE-20261011-R1, memo1, submission5d36e27de6161e0c80c0590a99a4d47c998f673aacf289d7a6b46adfe510c6e7.
|
||||
All hashes,20 documents, applied19source attachments, typed intake and tamper/
|
||||
version/prebound-approval negatives verified. Changes requested to make the
|
||||
separate source-reference acceptance receipt mandatory while canonical1.2case
|
||||
stays proposed: schema permits accepted-case shape, but normalsemantic admission
|
||||
rejects its acknowledged/unimplemented type under canon§4/5. No new founder
|
||||
acknowledgment, native publication or status change has occurred. Existing
|
||||
NK0048/project work retains recording/review followthrough; no duplicate plan.
|
||||
Exact review/proposed correction and independent proof retained in docs/reviews/.
|
||||
|
||||
T06 same-trial refinement review: exact completed32-path packet
|
||||
330da7fe129b0443e41fff44b3c2d829b0d682698fdbba9fe60011d46ed5c48c resolves the
|
||||
recording concern with mandatory separate design receipt and canonical case
|
||||
remaining proposed. Independent full-package validator and22 tests passed,
|
||||
including three missing-package regressions; schema/typed20-doc intake and
|
||||
three refusal guards passed at233429bytes. Post-ack isolated shape/render proof
|
||||
keeps canonicalcaseproposed, ordinary admission blocked and executionfalse.
|
||||
Original eeb changes-requested review and prepackage12ce failures remain history,
|
||||
not new scored successes. Final source agreement is separate receipt only;
|
||||
no actual founder acknowledgment, native intake, acceptance or runtime change.
|
||||
|
||||
2026-10-11T06:47:39Z source-recording preparation, same T06 trial: latest native
|
||||
outcome confirms nonstale person ACCEPT of exactmemo1, approval
|
||||
8e9332c8-754a-420c-b8b7-445cb4fe6765, disposition
|
||||
disp-315d54ad-20f1-40e6-862c-6c7d2e8f0ea8. Prepared external acknowledgment
|
||||
receipt and complete acknowledged1.2 package in explicit version source root
|
||||
security-case-type-revisions/1.2, changing type semantic status only. Independent
|
||||
fullvalidator and22 adapted-source tests pass; schema/versionload/render checks
|
||||
pass and normalcase admission remains refused. Packet-bound proposed sources
|
||||
and defaultcanonical1.1 package/case stay byte-identical. Separate Apps design
|
||||
receipt transcribes the actual human source scope, not an agent ownerreview or
|
||||
canonicalcase acceptance. Requesting coordinator records actual foundergo; no
|
||||
worker native/credential/grant action. Canonical1.2case remains proposed without
|
||||
acceptance; implementation followthrough remains existing NK0048-T06/project
|
||||
owner tasks. No new trial, taskT07, broad plan or whole-workplan finish.
|
||||
|
||||
Explicit version-selection source followthrough review, same completed owner T06
|
||||
anchor: reviewed exact six-file source manifest
|
||||
88238f29ebeceee36f6f6e77bb19cb43837b5bc03bce21c16acc50399b302084.
|
||||
Independent43 validator/selection tests and22 acknowledged1.2 package compatibility
|
||||
tests pass in isolated source snapshot. No mappings preserve default1.1; explicit
|
||||
1.2 loads only its selected exact root with no fallback/discovery, and mismatched
|
||||
case/type references, duplicate mappings/YAML keys and selected symlinks refuse.
|
||||
Both types remain acknowledged/unimplemented; historical accepted1.1 case and
|
||||
its normal refusal remain unchanged. Preparation digests stay e64b56e4.../c0afd557...
|
||||
and executionfalse. Canonical/acknowledgment hashes verified unchanged; source
|
||||
loader selection confers no case admission, native adapter/global verifier,
|
||||
materialization, grant or implemented status. Existing NK0048-T06 remains wait.
|
||||
No new source-ack trial or broad implementation plan is created.
|
||||
|
||||
## Independently review the frozen KEY39 lifecycle v2 source
|
||||
|
||||
```task
|
||||
id: NK-WP-ADHOC-2026-10-11-T07
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "3b6d52b2-b011-54da-a1e8-4c2aef7a94ae"
|
||||
```
|
||||
|
||||
Completed NetKingdom-only offline source-owner review preparation of exact
|
||||
KEY-WP-0039-T02/attended-lifecycle-v2 manifest
|
||||
6fc0fe47f99a97c11c6e7538f5ea02054335df7d46055d3f84bed4e194aeaaed.
|
||||
The source and tests, runtime CAS, temporary registration/env/Secret isolation,
|
||||
two single-replica Recreate restarts, captured output, normal cleanup and separate
|
||||
hard-interruption recovery were inspected against NetKingdom INTENT.
|
||||
Supplied tests and independent synthetic refusal checks are retained with the
|
||||
formal owner review under the temporary source-review stage. This completed
|
||||
local review task is distinct from KEY39 T02 and all native owner obligations.
|
||||
No founder decision, deployment, credential access, Secret read, grant, live
|
||||
acceptance or task closure in other repositories is claimed.
|
||||
|
||||
T07 same-trial v3 refinement review: independently reviewed exact manifest
|
||||
fbc31fda2b6194747547b9fbe876095914c3d53231c79abd43a010dbb3273efa.
|
||||
Both v2 deadline counterexamples now refuse; a real elapsed timer interrupts
|
||||
slow HTTP body reads and restores signal state. Thirty-nine supplied and fifteen
|
||||
independent checks pass, including a retained new failure reproduction: final
|
||||
temporary Secret deletion bypasses the aggregate cleanup deadline through an
|
||||
unguarded subprocess call. Changes requested for that exact source path only;
|
||||
v2 changes-requested evidence and frozen stages stay unchanged. No native
|
||||
authority, owner acceptance or KEY39 task closure is inferred.
|
||||
|
||||
|
||||
T07 same-trial final v4 source refinement review: exact frozen manifest
|
||||
d079f85c47d5c2635e1ee633ea4d1346b1737ce2be9ca273f22a38e620f418d8
|
||||
routes the exact temporary Secret deletion through guarded k. The v3 expired
|
||||
cleanup reproduction now makes zero native calls; a real slow-delete timer is
|
||||
clipped to remaining cleanup time. Both earlier v2 counterexamples now refuse,
|
||||
late full OpenBao acceptance is self-revoked privately before failure, partial
|
||||
acceptance stays unknown, and aggregate cleanup does not renew. Forty-one
|
||||
supplied lifecycle tests, seventeen unchanged-runner tests and seventeen
|
||||
independent checks pass. NetKingdom source agreement only; earlier unsuccessful
|
||||
reviews and immutable sources remain history in this same trial. Native token
|
||||
production, runtime authority, quiet-window/headroom, execution, revocation/
|
||||
cleanup and other owners' task closure remain separate obligations.
|
||||
|
||||
T07 same-trial v5 exceptional HTTP-close refinement review: frozen manifest
|
||||
d1f997624db46693a7126a6eb6435f6b3a353d5bd67dcc8a539683e4b7147285
|
||||
retains NetKingdom's prior v4 agreement and Platform's distinct v4
|
||||
changes-requested finding as history. Exceptional response close now has one
|
||||
20 ms abort cap clipped to positive original request time and the same
|
||||
nonrenewable aggregate cleanup deadline; expired aggregate performs no close.
|
||||
Independent early-read and timed-read failure/slow-close checks, known accepted
|
||||
session revocation despite normal-close error, signal restoration, value-free
|
||||
unknown outcomes and prior deadline/delete/recovery guards pass. Forty-six
|
||||
supplied lifecycle tests, seventeen unchanged-runner tests and twenty-one
|
||||
independent checks pass. NetKingdom exact source agreement only; same trial,
|
||||
no new task, native authority, credential access, runtime acceptance or closure.
|
||||
|
||||
T07 same-trial node-route source followthrough: prepared exact successor
|
||||
manifest 23a972abc5175e121e594726d2b7f7a28c62109253f58f12623eaf2e5564a035 from unchanged published/frozen v5. Source inspection
|
||||
confirms the named OpenBao bridge binds workstation loopback, not node loopback;
|
||||
node Pod DNS/reachability is unobserved. Proposed founder-held bounded node-local
|
||||
port-forward of existing openbao/openbao-ui-gateway includes targeted teardown.
|
||||
A public-only route diagnostic and strict health identity digest now gate execute
|
||||
before protected/native reads and again before temporary mutation; recovery
|
||||
checks first as well. Forty-six retained lifecycle, eight new route, twenty-one
|
||||
retained independent and seventeen unchanged-runner tests pass offline.
|
||||
No tunnel, native health probe, credential/Secret read or mutation ran. Current
|
||||
source agreement is only NetKingdom's; fresh independent Platform/KeyCape
|
||||
acknowledgments and exact founder route/native authority remain prerequisites.
|
||||
Same completed T07, all previous source/review bytes intact, no new workplan.
|
||||
|
||||
T07 same-trial v7 private-input sequencing correction: exact successor
|
||||
manifest 90aabec336008d7d51e37c04b5ff96ba8ed6630821cca1a4c333d803367247f7 retains immutable v6 source and NetKingdom/Platform
|
||||
reviews. V6 health gated native access but main read stdin first; its broader
|
||||
pre-private-input description was incorrect. V7 main now validates the exact
|
||||
source/approval, starts the bounded window and checks pinned public health before
|
||||
reading stdin. Execute revalidates source/expiry and preserves that original
|
||||
monotonic budget, while retaining health before native access and first mutation.
|
||||
Actual main tests prove failed/missing-pin health never consumes stdin; recovery
|
||||
remains stdin-free. Forty-six lifecycle, twelve route/main and twenty-one retained
|
||||
independent checks pass; unchanged runner remains pinned and previously verified.
|
||||
Pre-freeze local refactor/test failures were corrected and retained in validation
|
||||
evidence. Source preparation only; no owner checkout changes, native operation,
|
||||
credentials, tunnel, health observation or new workplan. Fresh exact independent
|
||||
KeyCape/Platform reviews and founder native authority remain required.
|
||||
|
||||
T07 same-trial private-producer consumer source review: exact KeyCape proposal
|
||||
manifest 239aaac8541ba05e8bba5f9ecdc8b555a02fd9d0ad1762fdfc4d4bae7e4ef463
|
||||
reviewed as NetKingdom consumer only. Eighteen supplied and five independent
|
||||
synthetic checks pass, including actual partial-write timeout/unknown outcome.
|
||||
Changes requested: no child-ready preflight acknowledgement before private pipe
|
||||
write, writable stdout-pipe aliases pass FD>=3 guard, and final stat/unlink is
|
||||
non-atomic despite precise-inspected-inode removal wording. Exclusive caller
|
||||
custody is an assumption, not an authenticated peer or JWT signature proof.
|
||||
No KeyCape owner role, existing-client reuse, coding-agent custody admission,
|
||||
launcher/transport grant or native readiness is inferred. No private credentials,
|
||||
native operation or owner checkout writes occurred; staged v6/v7 remain history.
|
||||
|
||||
T07 same-trial v8 bounded private receive correction: exact frozen successor
|
||||
manifest 316fd6005cc4cb7fe14ea69a5fd408aed13e6122afef60afd13d97952b27cf4a retains v7 agreement and the subsequent KeyCape
|
||||
unbounded-input finding as same-trial history. Complete private JSON receive is
|
||||
now binary/chunk/65536-byte/15-second capped, clipped to the original remaining
|
||||
action window; requires actual EOF, exact two-token object and per-token byte
|
||||
limits, checks expiry again before decoding/execute and emits no private errors.
|
||||
Actual main real stalled pipe and complete JSON without EOF time out; oversized,
|
||||
incomplete and late input refuse before execution. Forty-six lifecycle, twelve
|
||||
route/main, seven new receive and twenty-one retained independent checks pass.
|
||||
Producer-side exact-child ready acknowledgment still does not exist; child read
|
||||
bounds do not authorize early exporter write. Earlier producer changes-requested
|
||||
review remains live source feedback. Fresh exact independent KeyCape/Platform
|
||||
reviews, producer/launcher handoff and founder native authority remain required.
|
||||
No original source/stage/review changed, no owner checkout writes or native/
|
||||
credential/Secret/tunnel operation; same completed T07, no duplicate workplan.
|
||||
|
||||
T07 same-trial v9 concrete private-ready protocol preparation: exact source
|
||||
manifest 84542ddcff00932fc7ce22dcb2626be8942a3c006c5098a62fdd6b2478d0cd14 follows published v8 while retaining v5/v6/v7/v8 and
|
||||
producer v1 consumer-refusal history. Child emits bounded value-free nonce/pin/
|
||||
window-bound marker via distinct local inherited pipe only after exact source/
|
||||
approval/public-health and before private input; stdio aliases refuse. A node
|
||||
wrapper creates that local pipe, launches pinned child/envelope, relays one
|
||||
marker on captured SSH control stdout and never reads/copies private stdin.
|
||||
No extra FD is forwarded by SSH/Bridge, no marker authenticates authority/peer,
|
||||
and the output-suppressed warden lane is explicitly incompatible. Independent
|
||||
KeyCape producer/launcher source is coordinated but not yet exact reviewed or
|
||||
admitted; it must await marker before loading/consuming files or writing tokens.
|
||||
Forty-six lifecycle, twelve route/main, seven receive, nine new ready/wrapper and
|
||||
twenty-one retained independent tests pass offline; real pipe timeout/alias and
|
||||
actual main ordering checked. No SSH, native child/health/tunnel, credential or
|
||||
owner checkout action occurred. Fresh independent KeyCape/Platform reviews,
|
||||
trusted founder SSH/launcher/private-file/native admission and real owner
|
||||
acceptance remain necessary; same completed T07, no duplicate workplan.
|
||||
|
||||
T07 same-trial independent NetKingdom consumer source review of exact KeyCape
|
||||
producer V3 manifest 569672ecdb3f1f5b46122183dc3b82e83ff168c07c87db7211ec26bc1ce6184a paired with unchanged Net V9 manifest
|
||||
84542ddcff00932fc7ce22dcb2626be8942a3c006c5098a62fdd6b2478d0cd14: completed source-only analysis and offline validation;
|
||||
changes requested because actual launcher CLI contract FIFO acquisition blocks
|
||||
before its preparation timer. V2 also reproduces and is preserved. Thirty-three
|
||||
maker tests and nine independent actual local fake-SSH -> real pinned wrapper ->
|
||||
real child-main handshake checks pass, with public health and native execution
|
||||
explicitly mocked, synthetic unsigned tokens only. Wrong nonce/marker, health
|
||||
failure, expired approval and source mismatch perform zero token-file loads;
|
||||
quietness failure and real partial pipe delivery retain unknown consumer outcome.
|
||||
V3 sticky unknown correction passes. Exclusive same-UID directory custody is
|
||||
required; unlink is non-atomic and no zeroization/copy cleanup is proved. Prior
|
||||
v5-v8 reviews, V9 own anchor and original producer refusal remain unchanged.
|
||||
No KeyCape formal role, authenticated marker authority, native/source admission,
|
||||
credential reads, SSH, tunnel, repository writes or workplan closure inferred.
|
||||
|
||||
T07 same-trial fresh independent NetKingdom consumer source review of exact
|
||||
KeyCape producer V4 manifest d6f641dc1e4aae7d36658d4199d89af14d2fd7a4bd4e526856eb340234f2d33e paired with unchanged Net V9 manifest
|
||||
84542ddcff00932fc7ce22dcb2626be8942a3c006c5098a62fdd6b2478d0cd14: completed source-only qualified agreement. Actual
|
||||
CLI rejects FIFO/symlink/oversize contracts before private reads, slow main
|
||||
acquisition and default caller validation are bounded, and acquisition plus
|
||||
launch retain one original preparation deadline. Forty maker tests and thirteen
|
||||
independent checks pass, including nine actual local fake-SSH/pinned-wrapper/
|
||||
child-main handshake checks with fixture public health and native execution.
|
||||
V1 and V3 refusals, V2/V3 FIFO counterexamples, V3 sticky unknown correction,
|
||||
v5-v8 histories and V9 own preparation anchor remain unchanged. Exclusive
|
||||
same-UID directory custody, admitted pinned owner launcher/SSH host profile,
|
||||
private file allowance and exact founder native authorization remain required;
|
||||
marker and unsigned claims authenticate neither authority nor issuer. No
|
||||
credential read, native command, real SSH, owner checkout write or native/task
|
||||
closure occurred. This source agreement does not approve transport or custody.
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
---
|
||||
id: NK-WP-ADHOC-2026-10-16
|
||||
type: workplan
|
||||
title: "Reconcile recovery capability index with its owner entry"
|
||||
domain: infotech
|
||||
repo: net-kingdom
|
||||
status: finished
|
||||
owner: codex
|
||||
created: "2026-10-16"
|
||||
updated: "2026-10-16"
|
||||
flavor: implementation
|
||||
state_hub_workstream_id: "dc9c40f4-930f-545d-8da0-1de5ae29f533"
|
||||
---
|
||||
|
||||
## Reconcile recovery capability index with its owner entry
|
||||
|
||||
```task
|
||||
id: NK-WP-ADHOC-2026-10-16-T01
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "489e3fa0-8193-5c08-8c41-27939010d303"
|
||||
```
|
||||
|
||||
Reconcile only the bootstrap-recovery index summary with the existing authoritative capability entry. Old strict validation passed despite the difference; the reviewed validator refuses it until this correction. No recovery capability, maturity, deployed behavior or owner acceptance is added.
|
||||
|
||||
Completed 2026-10-16 under the founder's NetKingdom target implementation demand
|
||||
(CUST-WP-0080, TSA-11). Source review and exact before/after native CLI evidence:
|
||||
`the-custodian/docs/changes/netkingdom-target-2026-10-16/improvement-loop-next/`.
|
||||
The current 60-provider cohort has all 70 reviewed IDs exactly once; 3 field
|
||||
mismatches across 2 capabilities become zero with the source corrections.
|
||||
Native hosted refresh/readback and the accepted Activity/rein schedule remain
|
||||
separate gates. No production change, model call, credential access or external
|
||||
message was performed.
|
||||
|
|
@ -0,0 +1,149 @@
|
|||
---
|
||||
id: NET-WP-0020
|
||||
type: workplan
|
||||
title: "OpenBao Unseal Custody Models and SSH Automation Path"
|
||||
domain: infotech
|
||||
repo: net-kingdom
|
||||
status: finished
|
||||
owner: codex
|
||||
topic_slug: net-kingdom
|
||||
created: "2026-06-17"
|
||||
updated: "2026-07-02"
|
||||
state_hub_workstream_id: "d6338ac9-797d-4009-8203-4b8dd39010af"
|
||||
---
|
||||
|
||||
# NET-WP-0020 — OpenBao Unseal Custody Models and SSH Automation Path
|
||||
|
||||
**Scope:** Framework for three OpenBao init/unseal custody models; automation-first
|
||||
development path; console decision points; downstream hooks for SSH engine and
|
||||
host CA automation on greenfield 3-node bootstrap.
|
||||
|
||||
**Strategy:** Start with `sops-held-automation` for fast unattended test cycles;
|
||||
add `attended-ceremony` and `auto-unseal-transit` with blocking gates as
|
||||
production trust increases.
|
||||
|
||||
---
|
||||
|
||||
## Tasks
|
||||
|
||||
### T1 — Custody model canon and console gates
|
||||
|
||||
```task
|
||||
id: NET-WP-0020-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "7040f347-d54a-42ba-a14f-5b0a7e691786"
|
||||
```
|
||||
|
||||
- [x] `docs/openbao-unseal-custody-models.md`
|
||||
- [x] Console: list + select commands; gates block planned models
|
||||
- [x] `smooth-bootstrap-guide.md` Step 5 update
|
||||
- [x] Makefile targets
|
||||
|
||||
### T2 — SOPS-held init/unseal automation hooks
|
||||
|
||||
```task
|
||||
id: NET-WP-0020-T02
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "65407eb1-9d89-4158-aed5-4987badd83fc"
|
||||
```
|
||||
|
||||
- [x] SOPS-held init/unseal automation: `sso-mfa/bootstrap/openbao-init-unseal.sh`
|
||||
(`make openbao-init-unseal` / `openbao-init-unseal-dry-run`)
|
||||
- [x] Non-secret evidence flags: `openbao_initialized`, `openbao_post_unseal_verified`
|
||||
(emitted on the script's `EVIDENCE` JSON line)
|
||||
- [x] Integrate with `make openbao-configure-initial` post-unseal
|
||||
(`OPENBAO_RUN_CONFIGURE_INITIAL=1` chains it; default prints the handoff hint)
|
||||
- [x] Wire the helper as an optional phase inside `creds-bootstrap-agent.sh`
|
||||
(Phase 7b, reviewed and approved by Bernd 2026-07-02: runs only when the
|
||||
`openbao` namespace exists, skips when already verified, sets the two
|
||||
`creds-state.yaml` flags, encrypts + commits new init material, and a
|
||||
custody-gate refusal warns without aborting the SSO/MFA bootstrap —
|
||||
dry-run/skip/refusal paths harness-tested)
|
||||
- [x] Greenfield live proof: full init→unseal→verify path proven 2026-07-02
|
||||
against a genuinely uninitialized local OpenBao 2.5.5 (kubectl-exec shim,
|
||||
script logic unmodified) — see
|
||||
`history/2026-07-02-openbao-greenfield-init-unseal-proof.md`. The proof
|
||||
caught and fixed a real bug: `bao operator unseal -` does not read stdin;
|
||||
now `bao write sys/unseal key=-` (shares still never in argv/logs). Restart/
|
||||
reseal replay path proven too. The first 3-node rebuild slate re-runs the
|
||||
same script via Phase 7b.
|
||||
|
||||
**2026-07-02 (later):** Bernd reviewed the helper design (five safety
|
||||
properties incl. the root-token-in-bundle caveat of the sops-held model) and
|
||||
approved the Phase 7b wiring as proposed. Applied, `bash -n` clean, all three
|
||||
conditional paths verified by harness. Pre-existing note: the agent's Phase 0
|
||||
cannot dry-run on machines without the age key — unrelated to this change.
|
||||
Remaining T02 item is only the greenfield live proof.
|
||||
|
||||
**2026-07-02:** Helper implemented and smoke-tested: dry-run against the live
|
||||
cluster passed the custody gate (`sops-held-automation` selected) and read
|
||||
`initialized=true sealed=false`; negative tests proved refusal for unselected
|
||||
and attended-ceremony models. Init material is written only into
|
||||
`secrets/openbao/` for age custody; unseal shares travel stdin-to-stdin and
|
||||
never appear in argv or logs.
|
||||
|
||||
### T3 — Attended ceremony automation profile
|
||||
|
||||
```task
|
||||
id: NET-WP-0020-T03
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "34f3d979-a040-49ca-bfcb-35cf17473a06"
|
||||
```
|
||||
|
||||
- [x] Implement `attended-ceremony` selection path (runbooks + evidence validators)
|
||||
- [x] Production profile blocks `sops-held-automation` default
|
||||
|
||||
**2026-07-02:** Model selectable in the console; runbook at
|
||||
`docs/openbao-attended-ceremony-runbook.md`; non-secret ceremony record
|
||||
template + `validate-openbao-ceremony-record` validator (refuses secret
|
||||
markers/placeholders). New `deployment_profile` metadata (`lab`/`production`,
|
||||
`select-deployment-profile`): production blocks `sops-held-automation` in
|
||||
selection, status gates, and `openbao-init-unseal.sh`. Console refuse-live-init
|
||||
boundary unchanged. Covered by console test suite (14 passing) + CLI smoke.
|
||||
|
||||
### T4 — Auto-unseal transit profile
|
||||
|
||||
```task
|
||||
id: NET-WP-0020-T04
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "54ab6505-c13b-4f63-8c94-07dd202de90a"
|
||||
```
|
||||
|
||||
- [x] `railiance-platform` Helm seal stanza for transit/KMS
|
||||
- [x] Console gate + evidence for `auto-unseal-transit`
|
||||
|
||||
**2026-07-02:** Commented-out `seal "transit"` stanza (disabled by default;
|
||||
token via `extraSecretEnvironmentVars`, never Git) in
|
||||
`railiance-platform/helm/openbao-values.yaml` plus an "Auto-Unseal via Transit
|
||||
Seal" section in `railiance-platform/docs/openbao.md` (enable → `-migrate` →
|
||||
pod-restart proof). Console: model selectable; init gate stays blocked until
|
||||
`openbao_transit_seal_configured` and `openbao_auto_unseal_verified` are set.
|
||||
Live transit/KMS provisioning is future ops work on the HA rebuild, gated by
|
||||
that evidence.
|
||||
|
||||
### T5 — SSH engine + host CA automation (cross-repo)
|
||||
|
||||
```task
|
||||
id: NET-WP-0020-T05
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "399e82ca-6551-4020-8db5-c78076e75cfc"
|
||||
```
|
||||
|
||||
- [x] `railiance-platform`: `openbao-configure-ssh` declarative script + Makefile targets
|
||||
- [x] `railiance-infra`: `bootstrap-ssh-ca` role + `ssh_principals.yaml` inventory
|
||||
- [x] Live apply: OpenBao SSH engine + roles + `warden-sign` on Railiance (2026-06-18)
|
||||
- [x] Live apply: `bootstrap-ssh-ca` on CoulombCore + Railiance01
|
||||
- [x] Close `ops-warden` WP-0008 T2 verification gate
|
||||
|
||||
---
|
||||
|
||||
## See also
|
||||
|
||||
- `history/2026-06-17-openbao-ssh-custody-and-bootstrap-assessment.md` — state + concepts (read before T5)
|
||||
- `ops-warden/workplans/WARDEN-WP-0008-production-ssh-path-and-stewardship-closeout.md`
|
||||
- `railiance-platform/docs/openbao.md`
|
||||
|
|
@ -0,0 +1,190 @@
|
|||
---
|
||||
id: NK-WP-0009
|
||||
type: workplan
|
||||
title: NetKingdom Security Pattern Tutorials
|
||||
domain: infotech
|
||||
repo: net-kingdom
|
||||
status: finished
|
||||
flavor: implementation
|
||||
owner: codex
|
||||
topic_slug: netkingdom
|
||||
planning_priority: medium
|
||||
planning_order: 9
|
||||
created: 2026-05-17
|
||||
updated: "2026-10-03"
|
||||
depends_on:
|
||||
- NK-WP-0008
|
||||
state_hub_workstream_id: "d4d02dbf-3974-502d-8b87-b776fc63e17e"
|
||||
---
|
||||
|
||||
# NK-WP-0009 - NetKingdom Security Pattern Tutorials
|
||||
|
||||
## Goal
|
||||
|
||||
Build practical tutorials that show operators and developers how to
|
||||
implement canonical NetKingdom security architecture patterns in
|
||||
NetKingdom-enabled IT infrastructures.
|
||||
|
||||
Where NK-WP-0008 is the pattern library, this workplan is the hands-on
|
||||
path: runnable examples, checklists, commands, manifests, verification
|
||||
steps, and failure-mode exercises.
|
||||
|
||||
## Context
|
||||
|
||||
The platform needs more than architecture statements. A new deployment
|
||||
should be able to answer:
|
||||
|
||||
- How do I issue identity tokens in lightweight mode versus expanded
|
||||
mode?
|
||||
- How do I ask flex-auth for a resource decision?
|
||||
- How do I vend temporary object-storage credentials?
|
||||
- How do I deploy OpenBao and avoid secret zero traps?
|
||||
- How do I use short-lived SSH certificates for agents and automations?
|
||||
- How do I verify audit records and break-glass behavior?
|
||||
|
||||
Tutorials turn canonical patterns into repeatable implementation
|
||||
practice without forcing every application repo to rediscover the same
|
||||
steps.
|
||||
|
||||
## Scope
|
||||
|
||||
In scope:
|
||||
|
||||
- tutorial structure and style guide
|
||||
- runnable or copy-pasteable examples
|
||||
- local/dev and production variants where appropriate
|
||||
- verification and rollback steps
|
||||
- integration references to key-cape, flex-auth, ops-warden,
|
||||
ops-bridge, railiance-platform, and artifact-store
|
||||
|
||||
Out of scope:
|
||||
|
||||
- deploying live services directly from this repo
|
||||
- replacing repo-specific operator runbooks
|
||||
- hiding provider-specific security differences behind one generic
|
||||
command
|
||||
|
||||
## Create the tutorial template
|
||||
|
||||
```task
|
||||
id: NK-WP-0009-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "3c6824a0-39e6-51f5-b46f-5861a9375439"
|
||||
```
|
||||
|
||||
Create a tutorial template with prerequisites, architecture context,
|
||||
commands, manifests, verification, rollback, threat checks, and
|
||||
cross-repo ownership notes.
|
||||
|
||||
## Demonstrate temporary object credentials
|
||||
|
||||
```task
|
||||
id: NK-WP-0009-T02
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "d13760fd-2527-5a39-acb1-11c8091d65a1"
|
||||
```
|
||||
|
||||
Write the first tutorial: "Vend temporary S3 credentials from a
|
||||
NetKingdom identity token", covering key-cape/Keycloak identity,
|
||||
flex-auth authorization, object-store STS exchange, and SDK consumer
|
||||
configuration.
|
||||
|
||||
**Drafted 2026-09-29 as a native pack**: `runbooks/object-storage-sts/` (`nk.object-storage-sts`, validates,
|
||||
`unexercised`) with an offline validator, `check_sts.py`, encoding the request, response, deny and `credential_process`
|
||||
contract from `docs/object-storage-sts-credential-vending.md`. The offline checks were run and pass, including the
|
||||
refusals (TTL over one hour, wildcard action). No credential-vending service is deployed (the baseline is NK-WP-0007),
|
||||
so the live stage records "not deployed" honestly. The task closes on a run receipt from the UI, like T03-T05.
|
||||
|
||||
## Document the existing OpenBao operating path
|
||||
|
||||
```task
|
||||
id: NK-WP-0009-T03
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "16cf51a4-0763-59e9-9b4c-d486f5bde908"
|
||||
```
|
||||
|
||||
Write "Deploy OpenBao as the canonical secrets manager for a
|
||||
NetKingdom-enabled Railiance platform", linking to the Railiance
|
||||
Platform workplan and covering auth methods, secret engines, CSI/ESO
|
||||
integration, leases, unseal, backup, and break-glass.
|
||||
|
||||
## Document SSH certificates and tunnels
|
||||
|
||||
```task
|
||||
id: NK-WP-0009-T04
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "1d28e3f1-fb39-5d0e-a7ee-ce2e9bc16ed5"
|
||||
```
|
||||
|
||||
Write "Use short-lived SSH credentials for admins, agents, and
|
||||
automations", using ops-warden and ops-bridge as the reference
|
||||
implementation.
|
||||
|
||||
## Integrate a protected flex-auth consumer
|
||||
|
||||
```task
|
||||
id: NK-WP-0009-T05
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "c380ef19-4bc2-5ade-b127-baf18c64bf35"
|
||||
```
|
||||
|
||||
Write "Add a protected system to flex-auth", covering resource
|
||||
manifests, action vocabulary, claim envelopes, policy packages,
|
||||
decision envelopes, and delegated PDP options.
|
||||
|
||||
## Verify the tutorial outcomes
|
||||
|
||||
```task
|
||||
id: NK-WP-0009-T06
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "5b6a1670-a283-56e9-892e-ef8b91194a7b"
|
||||
```
|
||||
|
||||
Add tutorial verification fixtures or checklists so each tutorial has a
|
||||
clear "done when" outcome and does not become prose-only guidance.
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- Tutorials are grouped under a stable docs path with a repeatable
|
||||
format.
|
||||
- Each tutorial maps back to one or more NK-WP-0008 patterns.
|
||||
- Tutorials name the owning repo for every concrete implementation
|
||||
step.
|
||||
- Tutorials include verification and rollback guidance, not just happy
|
||||
path commands.
|
||||
|
||||
## Infrastructure review — 2026-09-28
|
||||
|
||||
Keep this plan in backlog, with the first implementation slice T01 + T03 +
|
||||
T04 + T06: document the paths already operated and capture safe verification
|
||||
and recovery outcomes. OpenBao is already deployed and private; T03 should
|
||||
teach consumption, attended access and recovery, with greenfield deployment
|
||||
kept as an isolated lab exercise. Use the named `openbao-ui-railiance01`
|
||||
tunnel and owner runbooks, not a public Bao URL or copied runtime manifest.
|
||||
|
||||
T02 is conditional on an owner-backed object-store STS issuer and refusal/lease
|
||||
proof; ADR-0008 is architecture, not evidence that the endpoint is live. T05
|
||||
must include projected caller identity, audience, binding and unauthorized
|
||||
caller rejection: all six live consumers now enforce caller authentication.
|
||||
Use accepted IAM v0.3 and owner package declarations under ADR-0015. T06
|
||||
requires executable safe fixtures or repeatable outcome checks; never teach
|
||||
operators to apply the stale tenant-engine reference YAML.
|
||||
|
||||
Evidence and cross-plan priorities: [estate review](../history/2026-09-28-open-workplan-infrastructure-review.md).
|
||||
|
||||
## Rehearsal receipts — 2026-10-02
|
||||
|
||||
Bernd ran three packs cleanly in project `nk-rehearsal` (rehearsal environment, no deviations); the engine derives `rehearsed`:
|
||||
`nk.object-storage-sts` (run 20261002-223449-dfa0b3, T02), `nk.ssh-certificates` (20261002-225810-0d8ab7, T04; first `sign` attempt failed
|
||||
and was retried with the missing `WARDEN_CONFIG`), `nk.openbao-operating-path` (20261002-234245-d73656, T03). T02, T03 and T04 are done.
|
||||
Limits: the S3 pack proves the contract offline, not a live service; the SSH tunnel stage is recorded not proven and the rehearsal config
|
||||
bypasses the flex-auth policy gate; the OpenBao pack is read-only. T05 (`nk.protected-system-flex-auth`) has no run yet.
|
||||
|
||||
`nk.protected-system-flex-auth` (run 20261002-235239-c46227) completed cleanly in `nk-rehearsal`, so T05 is done and all four tutorials are
|
||||
rehearsed packs. The markdown verifier is retired (NK-WP-0044-T06).
|
||||
|
|
@ -0,0 +1,385 @@
|
|||
---
|
||||
id: NK-WP-0011
|
||||
type: workplan
|
||||
title: "Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker"
|
||||
domain: infotech
|
||||
repo: net-kingdom
|
||||
status: active
|
||||
flavor: residual
|
||||
owner: worsch
|
||||
topic_slug: netkingdom
|
||||
created: "2026-05-20"
|
||||
updated: "2026-10-03"
|
||||
state_hub_workstream_id: "1075448f-d533-5f9e-94b7-c3adfe151a07"
|
||||
depends_on:
|
||||
- NK-WP-0003
|
||||
- NK-WP-0004
|
||||
- NK-WP-0006
|
||||
supersedes_tasks:
|
||||
- NK-WP-0001-T05
|
||||
- NK-WP-0001-T06
|
||||
- NK-WP-0001-T07
|
||||
- NK-WP-0001-T08
|
||||
---
|
||||
|
||||
# NK-WP-0011 — Enterprise Federation & SAML (Expanded-Mode Keycloak)
|
||||
|
||||
> Extracted from NK-WP-0001 (T05–T08, the deferred Keycloak path) and
|
||||
> refined against where net-kingdom actually stands today: a deployed
|
||||
> KeyCape lightweight stack, an OpenBao runtime-secret authority, and a
|
||||
> recursive platform/tenant authorization model. This is **expanded
|
||||
> identity mode** in the architecture (`docs/platform-identity-security-architecture.md`).
|
||||
|
||||
## Goal
|
||||
|
||||
Stand up **Keycloak as an identity broker** that federates upstream
|
||||
enterprise identity providers (Microsoft Entra ID / Azure AD via OIDC,
|
||||
on-prem Active Directory via LDAP, and generic SAML 2.0 IdPs) and issues
|
||||
**NetKingdom IAM Profile-conformant** tokens downstream — without
|
||||
displacing flex-auth as the authorization decision point or breaking the
|
||||
recursive platform/tenant boundary.
|
||||
|
||||
This is the answer to the long-standing open question
|
||||
*"when does the platform switch from key-cape lightweight mode to Keycloak
|
||||
expanded mode?"* — expanded mode exists **specifically** to onboard
|
||||
identities that originate in an external enterprise IdP, which the
|
||||
lightweight Authelia + LLDAP stack cannot broker.
|
||||
|
||||
## Why this is not just "resume NK-WP-0001"
|
||||
|
||||
NK-WP-0001 assumed a greenfield: bootstrap Vault, build PostgreSQL, treat
|
||||
Keycloak as the internal user store. None of those assumptions hold now:
|
||||
|
||||
| NK-WP-0001 assumption | Current reality | Effect on this plan |
|
||||
|---|---|---|
|
||||
| HashiCorp Vault, bootstrapped from KeePassXC | **OpenBao** is the runtime secret authority (NK-WP-0006); SOPS/age + agent bootstrap exist (NK-WP-0004/0005) | Keycloak DB + admin secrets come from OpenBao via ESO; no new vault bootstrap |
|
||||
| PostgreSQL built from scratch | CloudNativePG running on RAILIANCE01 (NK-WP-0003) | Admit a database consumer through current platform owners; prove backup/restore |
|
||||
| Keycloak is the internal source of truth (D2 hybrid) | KeyCape lightweight stack is the *deployed* IAM Profile issuer | Keycloak is a **broker/federation front-end**, not the primary user store |
|
||||
| Authorization via Keycloak Authorization Services | flex-auth + Topaz is the canonical PDP (ADR-0006) | Keycloak AuthZ Services is at most an optional adapter, never canonical |
|
||||
| Single-tenant Coulomb deployment | Recursive `tenant:platform` vs `tenant:coulomb` model (NK-WP-0006) | Evaluate realm-per-tenant; tenant admins must not receive platform-root |
|
||||
| MFA solely via privacyIDEA provider JAR | privacyIDEA deployed *and* upstream IdPs carry their own MFA | MFA assurance source becomes a decision, not a default |
|
||||
|
||||
## Architecture
|
||||
|
||||
```text
|
||||
Enterprise IdPs (upstream)
|
||||
Entra ID (OIDC) AD (LDAP) SAML 2.0 IdP
|
||||
│ │ │
|
||||
└──────────────┼──────────────┘
|
||||
▼
|
||||
[ Keycloak ] expanded-mode broker
|
||||
│ realm-per-tenant candidate; IAM Profile issuer
|
||||
│ secrets ← OpenBao (ESO)
|
||||
│ MFA ← privacyIDEA *or* upstream assurance
|
||||
▼
|
||||
NetKingdom IAM Profile token (OIDC/PKCE)
|
||||
│
|
||||
├──► applications (depend on the Profile, not the provider)
|
||||
└──► flex-auth / Topaz ── authorization decision (PDP)
|
||||
|
||||
coexists with: KeyCape lightweight issuer (kc.coulomb.social)
|
||||
```
|
||||
|
||||
Keycloak answers identity (who, how authenticated, coarse claims,
|
||||
assurance). It does **not** answer resource authorization — that stays in
|
||||
flex-auth (ADR-0006). It does not store runtime secrets — those stay in
|
||||
OpenBao.
|
||||
|
||||
## Scope
|
||||
|
||||
In scope:
|
||||
|
||||
- decision record for expanded-mode adoption: trigger, federation
|
||||
topology (broker vs SAML SP), realm isolation model, and coexistence
|
||||
with the KeyCape lightweight issuer
|
||||
- owner-packaged Keycloak image (privacyIDEA provider JAR only if selected
|
||||
and verified compatible) and managed deployment on railiance01
|
||||
- upstream federation: Entra ID (OIDC), AD (LDAP), generic SAML 2.0 IdP
|
||||
- claim mapping to the NetKingdom IAM Profile (issuer, audience, subject,
|
||||
groups, tenant, assurance evidence) and IAM Profile conformance checks
|
||||
- MFA / assurance source decision and enforcement of step-up for
|
||||
privileged actions
|
||||
- recursive tenancy: realm-per-tenant, platform-root guardrails, and the
|
||||
flex-auth/Topaz authorization boundary
|
||||
- backups, DR, break-glass, monitoring, and audit shipping for the broker
|
||||
|
||||
Out of scope:
|
||||
|
||||
- replacing flex-auth/Topaz with Keycloak Authorization Services
|
||||
- migrating the deployed lightweight stack off KeyCape (coexistence only)
|
||||
- application-side OIDC client code (apps target the IAM Profile spec)
|
||||
- deploying OpenBao itself (Railiance platform) — consumed, not built
|
||||
- tenant-specific federation policy for tenants beyond `tenant:platform`
|
||||
and `tenant:coulomb`
|
||||
|
||||
## Decide federation adoption and topology
|
||||
|
||||
```task
|
||||
id: NK-WP-0011-T01
|
||||
state_hub_task_id: "a5807808-fb34-50de-8f67-9128011833d4"
|
||||
status: done
|
||||
priority: high
|
||||
```
|
||||
|
||||
**Decision record — expanded-mode adoption & federation topology.** Write
|
||||
an ADR (ADR-0009) capturing: the concrete trigger for switching a tenant
|
||||
from lightweight to expanded mode; whether Keycloak acts as an OIDC
|
||||
identity broker, a SAML service provider, or both; the realm-per-tenant
|
||||
candidate and its alternatives mapped onto `tenant:platform` /
|
||||
`tenant:coulomb`; how the Keycloak issuer
|
||||
coexists with the KeyCape issuer (`kc.coulomb.social`) so applications
|
||||
still target one IAM Profile contract; and the canonical hostname/issuer
|
||||
for the broker. Resolve or supersede D2 from NK-WP-0001.
|
||||
|
||||
## Admit the database consumer
|
||||
|
||||
```task
|
||||
id: NK-WP-0011-T02
|
||||
state_hub_task_id: "2fe6f100-3a5d-563e-b033-7d7b846ae487"
|
||||
status: wait
|
||||
priority: high
|
||||
blocking_reason: "ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence."
|
||||
needs_human: true
|
||||
decision_id: 8a5d1eb8-b665-4d25-9742-a15ecfc87c0c
|
||||
```
|
||||
|
||||
**PostgreSQL `keycloak_db` on the existing operator.** Have railiance-platform
|
||||
and rapp-postgres admit a named Keycloak database consumer against the current
|
||||
database catalog and isolation needs. Do not assume the historical NK-WP-0003
|
||||
instance is the correct placement. Source credentials from OpenBao via ESO
|
||||
into a K8s Secret. Confirm the existing backup schedule covers the new database and
|
||||
run a restore drill for `keycloak_db` specifically.
|
||||
|
||||
## Package the broker deployment
|
||||
|
||||
```task
|
||||
id: NK-WP-0011-T03
|
||||
state_hub_task_id: "32d1411b-10a4-5a8b-8f43-99ac46d83908"
|
||||
status: wait
|
||||
priority: high
|
||||
blocking_reason: "ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment."
|
||||
depends_on:
|
||||
- NK-WP-0011-T02
|
||||
```
|
||||
|
||||
**Deploy expanded-mode Keycloak.** Build a custom image
|
||||
(`kc.sh build`, privacyIDEA provider JAR included only if T5 delegates MFA
|
||||
to privacyIDEA). Assign the package/runtime owner under ADR-0015 and deploy
|
||||
through its managed declaration on railiance01 behind Traefik +
|
||||
cert-manager at the issuer hostname from T1. Admin bootstrap secret and DB
|
||||
secret come from OpenBao/ESO — never typed, never in git. Hostname
|
||||
strictness + proxy headers configured for Traefik. Realm import is
|
||||
GitOps-friendly (realm JSON/CR in git).
|
||||
|
||||
## Integrate an upstream identity provider
|
||||
|
||||
```task
|
||||
id: NK-WP-0011-T04
|
||||
state_hub_task_id: "6697a994-7343-5ea8-8b37-bc3b921e5a9b"
|
||||
status: wait
|
||||
priority: high
|
||||
blocking_reason: "Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence."
|
||||
depends_on:
|
||||
- NK-WP-0011-T03
|
||||
```
|
||||
|
||||
**Upstream federation.** Configure identity brokering for Entra ID (OIDC),
|
||||
on-prem AD (LDAP user federation), and a generic SAML 2.0 IdP. Map each
|
||||
source's claims/attributes into the NetKingdom IAM Profile shape: issuer,
|
||||
audience, subject, groups, **tenant**, and assurance evidence. Define the
|
||||
attribute/claim mappers and group→role mapping. Verify a federated login
|
||||
end-to-end for at least the Entra ID path.
|
||||
|
||||
## Define federated assurance
|
||||
|
||||
```task
|
||||
id: NK-WP-0011-T05
|
||||
state_hub_task_id: "d845380d-3dbc-5e59-8f2b-5a4d1b32d89d"
|
||||
status: wait
|
||||
priority: medium
|
||||
blocking_reason: "Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners."
|
||||
depends_on:
|
||||
- NK-WP-0011-T04
|
||||
```
|
||||
|
||||
**MFA / assurance source.** Decide and implement the assurance model: MFA
|
||||
enforced by privacyIDEA (via the Keycloak provider JAR + a "privacyIDEA
|
||||
Browser" flow, carried over from NK-WP-0001) versus trusting upstream IdP
|
||||
MFA (e.g. Entra Conditional Access) and reflecting it as assurance
|
||||
evidence in the token. Require step-up for admin console and
|
||||
platform-root-sensitive clients. Ensure assurance evidence is carried in
|
||||
the IAM Profile token so flex-auth can gate privileged actions on it.
|
||||
|
||||
## Verify IAM conformance and coexistence
|
||||
|
||||
```task
|
||||
id: NK-WP-0011-T06
|
||||
state_hub_task_id: "9cb7fd93-c16e-5102-83ce-195b3aa87446"
|
||||
status: wait
|
||||
priority: high
|
||||
blocking_reason: "Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent."
|
||||
depends_on:
|
||||
- NK-WP-0011-T03
|
||||
- NK-WP-0011-T04
|
||||
- NK-WP-0011-T05
|
||||
```
|
||||
|
||||
**IAM Profile conformance & downstream coexistence.** Run IAM Profile
|
||||
conformance checks against the Keycloak issuer (discovery document, PKCE,
|
||||
token/claim shape, JWKS, userinfo). Verify an application configured for
|
||||
the IAM Profile can authenticate against either the KeyCape or the
|
||||
Keycloak issuer per the T1 selection rule. Use the canonical
|
||||
`canon/standards/iam-profile_v0.3.md` contract and the executable suite in
|
||||
`tools/iam-profile-conformance/`. Document per-tenant issuer selection.
|
||||
|
||||
## Enforce tenant and platform boundaries
|
||||
|
||||
```task
|
||||
id: NK-WP-0011-T07
|
||||
state_hub_task_id: "38998c68-29bf-50d2-8c8d-0c75184d5833"
|
||||
status: wait
|
||||
priority: high
|
||||
blocking_reason: "Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission."
|
||||
depends_on:
|
||||
- NK-WP-0011-T03
|
||||
- NK-WP-0011-T04
|
||||
- NK-WP-0011-T05
|
||||
```
|
||||
|
||||
**Recursive tenancy & authorization boundary.** Implement T1's reviewed
|
||||
realm/tenant topology with platform-root guardrails. If realm-per-tenant is
|
||||
selected, tenant admins manage only their realm; in every topology they
|
||||
must not be able to alter IAM Profile semantics, the platform realm,
|
||||
federation trust, OpenBao platform mounts, or audit retention (per the
|
||||
flex-auth/Topaz implications in the architecture doc). Confirm flex-auth +
|
||||
Topaz remains the PDP; if a Keycloak Authorization Services adapter is
|
||||
used at all, document it as a delegated, non-canonical adapter.
|
||||
|
||||
## Prove recovery and audit delivery
|
||||
|
||||
```task
|
||||
id: NK-WP-0011-T08
|
||||
state_hub_task_id: "e5f44ddc-9645-5f61-b84c-da5ab9cccb6d"
|
||||
status: wait
|
||||
priority: medium
|
||||
blocking_reason: "Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent."
|
||||
depends_on:
|
||||
- NK-WP-0011-T02
|
||||
- NK-WP-0011-T03
|
||||
```
|
||||
|
||||
**Backups, DR, break-glass, monitoring, audit.** Only sanitized declarative
|
||||
realm configuration belongs in git; keep credential-bearing exports in
|
||||
protected backup custody; DB backup + restore drill (T2); break-glass admin path disabled-by-default
|
||||
with alerting on use; Prometheus/Grafana for auth success/failure, MFA
|
||||
latency, federation errors. Ship Keycloak events to the durable platform
|
||||
audit sink alongside flex-auth/Topaz/OpenBao records, with correlation
|
||||
ids — satisfying the "Audit sink" and "Break-glass" rows of the
|
||||
production-readiness checklist.
|
||||
|
||||
## Prove the isolation upgrade path
|
||||
|
||||
```task
|
||||
id: NK-WP-0011-T09
|
||||
status: wait
|
||||
priority: medium
|
||||
state_hub_task_id: "d9dc4292-6b66-5797-9ff9-a1a4a556278e"
|
||||
blocking_reason: "Requires named tenant and admitted package owner, canonical tier contract and isolated subject/issuer-preserving upgrade/rollback drill; adoption trigger absent."
|
||||
depends_on:
|
||||
- NK-WP-0011-T03
|
||||
- NK-WP-0011-T07
|
||||
- NK-WP-0011-T08
|
||||
```
|
||||
|
||||
**Shared-realm to dedicated-instance upgrade (ADR-0009, decision 3).** Write
|
||||
the owner-executed upgrade runbook and rehearse it in an isolated environment
|
||||
before any paid tier is offered. The drill must show issuer URL unchanged,
|
||||
every user `sub` and federated link preserved, login working after cutover,
|
||||
rollback by re-routing during the retention window, and per-tier backup and
|
||||
restore evidence. Coordinate with tenant-engine on deriving the tier from the
|
||||
`IAM` capability role; do not add an independent tier field.
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- A rehearsed shared-to-dedicated isolation upgrade preserves issuer and subjects.
|
||||
- An ADR records the expanded-mode trigger, federation topology,
|
||||
selected realm/tenant isolation model, and KeyCape/Keycloak issuer coexistence.
|
||||
- A federated user from at least one enterprise IdP (Entra ID) can log in
|
||||
and receive an IAM Profile-conformant token with tenant + assurance
|
||||
claims.
|
||||
- Keycloak secrets originate from OpenBao; none are bootstrapped from
|
||||
KeePassXC or committed to git.
|
||||
- flex-auth + Topaz remains the authorization decision point; Keycloak is
|
||||
not the canonical policy engine.
|
||||
- Tenant admins cannot cross the platform-root boundary.
|
||||
- Keycloak audit events land in the durable platform audit sink with
|
||||
correlation ids, and a DR/break-glass drill has passed.
|
||||
|
||||
## Open Questions / Dependencies on Other Repos
|
||||
|
||||
- **key-cape**: does coexistence require KeyCape changes, or can both
|
||||
issuers serve the same IAM Profile unchanged? (EP-NK-001 federation
|
||||
extension point.)
|
||||
- **flex-auth**: confirmed claim/decision-envelope contract for tenant +
|
||||
assurance evidence sourced from a federated token.
|
||||
- **railiance-platform**: OpenBao must expose a Keycloak auth role / ESO
|
||||
path before T3; unseal/break-glass story must be ready.
|
||||
- **IAM Profile spec**: resolved by NK-WP-0012. T6 consumes
|
||||
`canon/standards/iam-profile_v0.3.md` and
|
||||
`tools/iam-profile-conformance/`.
|
||||
|
||||
## Infrastructure review — 2026-09-28
|
||||
|
||||
Keep in backlog until a named enterprise tenant, upstream IdP owner and
|
||||
concrete federation need justify operating another issuer. No Keycloak
|
||||
Deployment appears in today's cluster inventory. Realm-per-tenant remains a
|
||||
proposal to evaluate in T01, not a requirement derived from current topology;
|
||||
prove its mapping to tenant-engine's canonical identity/lifecycle contract.
|
||||
|
||||
The live issuer is `https://kc.coulomb.social`; IAM v0.3 is accepted and v0.4
|
||||
step-up is proposed. T01/T05/T06 must coordinate with NK-WP-0042 and preserve
|
||||
existing issuer/subject account bindings, audiences and session/revocation
|
||||
behavior. Do not infer equivalent assurance from an upstream MFA claim without
|
||||
a reviewed trust mapping. The single-node cluster and single-instance database
|
||||
providers offer no automatic HA guarantee. T02/T08 must name backup ownership,
|
||||
off-host custody and an isolated restore proof. OpenBao access is private via
|
||||
the platform operator path. Resource placement, packaging and runtime
|
||||
execution belong to their owners, not this canon repository.
|
||||
|
||||
Evidence and cross-plan priorities: [estate review](../history/2026-09-28-open-workplan-infrastructure-review.md).
|
||||
|
||||
## Dependency reconciliation — 2026-10-03
|
||||
|
||||
Accepted ADR-0009 decision1 prohibits starting T02–T09 without the named
|
||||
tenant, upstream IdP owner and concrete unmet federation need. None is
|
||||
recorded in this plan. Corrected active/todo to blocked/wait; T01 remains done.
|
||||
Local preparation is complete in
|
||||
[expanded-mode admission requirements](../docs/architecture/expanded-mode-admission-requirements.md):
|
||||
owner deliverables, evidence gates, conformance limits and explicit resume criteria.
|
||||
New federation owner task IDs await trigger and owner acceptance; no deployment
|
||||
or issuer selection is implied by this packet.
|
||||
|
||||
## Machine-readable wait reconciliation — 2026-10-03
|
||||
|
||||
T02 is the adoption admission root: owner/sponsor Bernd Worsch must confirm
|
||||
all three accepted ADR-0009 triggers from real demand. The pending hub decision
|
||||
`8a5d1eb8-b665-4d25-9742-a15ecfc87c0c` records that demand is currently absent; it neither asks
|
||||
an agent to create demand nor grants a broker deployment. T02 also retains the
|
||||
subsequent database-owner admission and backup/restore requirements. Once the
|
||||
trigger exists, record actual owner task IDs before routing implementation.
|
||||
|
||||
T03–T09 now encode their concrete predecessor deliverables in `depends_on`.
|
||||
Every path reaches T02; no terminal historical infrastructure plan substitutes
|
||||
for adoption. Existing per-task owner commitments/evidence remain in the
|
||||
blocking reasons and admission requirements document. A deferred/declined
|
||||
admission decision requires a deliberate retain/cancel review, not automatic
|
||||
resume. All eight tasks remain wait; the workplan remains blocked.
|
||||
|
||||
Knowledge receipt: emergent-security 0.2.6 / start / verified-files /
|
||||
orientation-only; digest
|
||||
`8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02`.
|
||||
|
||||
> 2026-10-11: demoted to `flavor: residual` / `backlog` by founder-authorized triage — off the
|
||||
> critical path (identity → authz → secrets → SecurityCase execution). Tasks are unchanged;
|
||||
> promote back when demand or risk appears. See the-custodian
|
||||
> `history/20261011-netkingdom-security-progress-assessment.md`.
|
||||
|
|
@ -0,0 +1,417 @@
|
|||
---
|
||||
id: NK-WP-0022
|
||||
type: workplan
|
||||
title: "Cut over NetKingdom identity to railiance01 and retire CoulombCore"
|
||||
domain: infotech
|
||||
repo: net-kingdom
|
||||
status: finished
|
||||
flavor: implementation
|
||||
owner: codex
|
||||
topic_slug: netkingdom
|
||||
created: "2026-07-27"
|
||||
updated: "2026-10-15"
|
||||
depends_on:
|
||||
- USER-WP-0020
|
||||
- NK-WP-0023
|
||||
- KEY-WP-0004
|
||||
state_hub_workstream_id: "d76ddccc-00c8-548a-b141-2cd660fa38da"
|
||||
---
|
||||
|
||||
# NK-WP-0022 - railiance01 identity cutover and CoulombCore retirement
|
||||
|
||||
Move the authoritative lightweight NetKingdom identity stack from
|
||||
CoulombCore (`92.205.130.254`) to railiance01 (`92.205.62.239`) without
|
||||
losing users, groups, MFA enrollments, signing/encryption material, or the
|
||||
ability to roll back.
|
||||
|
||||
At the July 27 migration baseline, the two servers ran independent copies of
|
||||
KeyCape, Authelia, LLDAP,
|
||||
privacyIDEA, and `net-kingdom-pg`. At that baseline, public KeyCape DNS pointed to
|
||||
railiance01 while other identity names still pointed to CoulombCore.
|
||||
T06/T07 below supersede that topology: identity cutover and reversible
|
||||
retirement completed on July 30 after the recorded migration gates passed.
|
||||
Final deletion completed on October 15 after the separate T08 recovery and
|
||||
approval gates were satisfied.
|
||||
|
||||
The original cutover intentionally waited for the reusable user onboarding
|
||||
portal to complete the Binky tenant-admin flow. That supplied the human
|
||||
login/MFA and lifecycle evidence used to establish identity authority before
|
||||
state migration and reversible retirement.
|
||||
|
||||
## T01 - Freeze the migration contract and inventory both stacks
|
||||
|
||||
```task
|
||||
id: NK-WP-0022-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "244ef874-8ee4-5969-bcbf-42a7cb47f246"
|
||||
```
|
||||
|
||||
Capture secret-free inventories of deployments, image digests, configuration
|
||||
keys, database schemas/counts, PVCs, ingress, certificates, backup schedules,
|
||||
DNS, and external consumers on both clusters. Identify the authoritative
|
||||
source for every state set and record expected maintenance/write-freeze
|
||||
behavior. Compare public JWKS fingerprints and all client registrations
|
||||
without printing private configuration.
|
||||
|
||||
Done when every component and state owner has a source, destination,
|
||||
verification method, rollback source, and explicit decision on whether
|
||||
railiance01 is already equivalent or requires migration.
|
||||
|
||||
2026-07-28 DNS inventory: public resolvers show `auth.coulomb.social` and the
|
||||
new `login.coulomb.social` alias at railiance01 (`92.205.62.239`). The
|
||||
following names remain explicitly on CoulombCore (`92.205.130.254`):
|
||||
`bao`, `gitea`, `hub`, `lldap`, `pink-account`, and `pink` under
|
||||
`coulomb.social`. The last three are identity-cutover scope; Bao, Gitea, and
|
||||
Hub must be handed to their owning workload cutovers before CoulombCore host
|
||||
retirement. Local resolver caches may temporarily retain the former
|
||||
`auth.coulomb.social` address.
|
||||
|
||||
The read-only comparison is recorded in
|
||||
`docs/railiance01-coulombcore-cutover-inventory-2026-07-28.md`. It confirms
|
||||
matching public KeyCape JWKS fingerprints and matching declared
|
||||
Authelia/LLDAP/privacyIDEA images, but independent PVCs and divergent LLDAP
|
||||
database fingerprints. CoulombCore exposes PostgreSQL logical backups but no
|
||||
matching LLDAP, Authelia, or privacyIDEA backup CronJobs; fresh protected
|
||||
source backups remain a hard gate.
|
||||
|
||||
2026-07-29 closure review: the subsequent backup, migration, dependency and
|
||||
conformance tasks used this inventory successfully. Every identity state set
|
||||
now has an authority, protected rollback source and verification method; the
|
||||
remaining public names are tracked explicitly under T06 or their owning
|
||||
non-identity cutovers. Inventory contract complete.
|
||||
|
||||
## T02 - Prove recoverable backups before changing state
|
||||
|
||||
```task
|
||||
id: NK-WP-0022-T02
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "12658d0f-eee9-5553-92b6-956ccde094bf"
|
||||
```
|
||||
|
||||
Create fresh, encrypted backups for CoulombCore LLDAP, Authelia,
|
||||
privacyIDEA, `net-kingdom-pg`, KeyCape configuration/signing key, and required
|
||||
Kubernetes Secrets. Preserve privacyIDEA encryption material with its
|
||||
database. Validate backup manifests, checksums, custody, retention, and a
|
||||
non-production restore drill. Never emit secret values into Git, State Hub,
|
||||
logs, or chat.
|
||||
|
||||
Done when restore evidence proves the migration can be reversed from
|
||||
independent custody.
|
||||
|
||||
2026-07-28: created the age-encrypted source set documented in
|
||||
`docs/railiance01-coulombcore-cutover-inventory-2026-07-28.md`. Checksums,
|
||||
age decryption, both SQLite integrity checks, PostgreSQL dump readability,
|
||||
privacyIDEA archive readability, permissions, and plaintext cleanup passed.
|
||||
The encrypted set was then copied to mode-`0700` independent custody on
|
||||
railiance01 with mode-`0600` files and matching source hashes. A temporary,
|
||||
non-networked PostgreSQL 16 pod restored the full dump and reproduced the
|
||||
expected `interhub`, `privacyidea_db`, token, owner, realm, resolver, and policy
|
||||
counts. The pod and transient restore log were removed automatically.
|
||||
|
||||
## T03 - Reconcile persistent identity state onto railiance01
|
||||
|
||||
```task
|
||||
id: NK-WP-0022-T03
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "642cec3f-fd96-5c05-a37a-8696ed118811"
|
||||
```
|
||||
|
||||
Under a bounded write freeze, compare and migrate the authoritative
|
||||
`net-kingdom-pg` data and any non-database LLDAP, Authelia, or privacyIDEA
|
||||
state. Preserve user/group identifiers, password hashes, MFA token serials,
|
||||
realms, resolver mappings, encryption keys, and audit-relevant timestamps.
|
||||
Do not blindly overwrite newer railiance01-only configuration such as the
|
||||
`rapp-qonto-client`; merge and verify it explicitly.
|
||||
|
||||
Done when source/destination counts and semantic probes agree and restart
|
||||
tests pass on railiance01.
|
||||
|
||||
Pre-migration comparison proves this task is required: LLDAP is 4/7/7
|
||||
users/groups/memberships on CoulombCore versus 3/7/3 on railiance01.
|
||||
CoulombCore privacyIDEA has one enrolled token, two realms, two resolvers, and
|
||||
two policies; railiance01 is empty. All privacyIDEA custody fingerprints
|
||||
differ, so its database and encryption/signing material must migrate together.
|
||||
|
||||
2026-07-28: completed the bounded reconciliation documented in
|
||||
`docs/railiance01-coulombcore-cutover-inventory-2026-07-28.md`. Fresh encrypted
|
||||
source and destination snapshots preceded all changes. LLDAP now contains the
|
||||
authoritative `platform-root` identity and memberships plus preserved
|
||||
railiance01-only users and tenant groups; disposable source lifecycle users
|
||||
were excluded. privacyIDEA database counts and all matching custody
|
||||
fingerprints agree. Twelve nonempty interhub source-table digests agree while
|
||||
the newer destination schema, migration ledger, and destination-only user were
|
||||
preserved. SQLite integrity, privacyIDEA HTTP, deployment rollout, and
|
||||
post-restart semantic probes passed. Transient artifacts were removed and
|
||||
CoulombCore writers remain frozen against divergence.
|
||||
|
||||
## T04 - Align configuration, secrets, and internal dependencies
|
||||
|
||||
```task
|
||||
id: NK-WP-0022-T04
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "8aab3b5d-ec9e-5bc0-a884-ee418e78d5f4"
|
||||
```
|
||||
|
||||
Reconcile KeyCape, Authelia, LLDAP, and privacyIDEA configuration and secret
|
||||
references on railiance01 through approved custody lanes. Verify KeyCape uses
|
||||
only railiance01 cluster-local dependencies, signing-key continuity is
|
||||
preserved, service clients remain registered, and no runtime dependency
|
||||
points back to CoulombCore.
|
||||
|
||||
Done when an automated dependency graph and negative search prove there are
|
||||
no hidden CoulombCore runtime dependencies.
|
||||
|
||||
2026-07-28: added
|
||||
`sso-mfa/k8s/verify-identity-cutover-dependencies.sh`. Its live railiance01
|
||||
run found no CoulombCore IP/host or public cross-cluster endpoint in decoded
|
||||
identity Secrets, ConfigMaps, Deployments, or StatefulSets. It verified
|
||||
cluster-local KeyCape and privacyIDEA dependencies, retained user-engine and
|
||||
rapp-qonto clients, and Ready deployments. KeyCape signing fingerprints
|
||||
match. TLS-preserving direct resolution returned HTTP 200 with valid
|
||||
certificates for `auth`, `login`, `lldap`, `pink`, and `pink-account`.
|
||||
|
||||
## T05 - Run full pre-cutover identity conformance
|
||||
|
||||
```task
|
||||
id: NK-WP-0022-T05
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "a66acc29-33a7-5c20-8816-c3acedd6595d"
|
||||
```
|
||||
|
||||
Using TLS-preserving direct resolution to railiance01, verify health,
|
||||
discovery/JWKS, authorization-code + PKCE login, MFA, tenant/group/role
|
||||
claims, OpenBao OIDC login, `rapp-qonto` client credentials, wrong-secret and
|
||||
wrong-scope denial, logout/session behavior, and restart recovery. Include
|
||||
the platform-root and Binky tenant paths without exposing tokens.
|
||||
|
||||
Done when all critical human and service flows pass and rollback criteria are
|
||||
machine-readable.
|
||||
|
||||
2026-07-28 progress: the portal starts a KeyCape authorization-code flow with
|
||||
S256 PKCE, and KeyCape discovery/TLS is healthy at its canonical
|
||||
`kc.coulomb.social` issuer. `rapp-qonto-client` obtains a token only for
|
||||
`qonto:read`; a wrong secret returns 401 and excessive `qonto:write` returns
|
||||
400 without a token. The Binky administrator was created and provisioned
|
||||
through user-engine's deployed versioned API, producing a linked LLDAP
|
||||
identity and `password_setup_required` state. This exposed and fixed newline
|
||||
normalization for the portal's trusted proxy secret in user-engine
|
||||
`0ef2ae5`; 105 tests pass and the fixed image is live.
|
||||
|
||||
The missing SMTP dependency is now removed from the critical path by the
|
||||
deployed NetKingdom-owned password setup surface. It issues 15-minute,
|
||||
single-use opaque links, revokes an older link on renewal, consumes before
|
||||
calling LLDAP's official OPAQUE helper, and fails closed on restart. A
|
||||
disposable-user conformance run proved renewal, validation, setup, LLDAP
|
||||
login, replay denial, and cleanup without emitting credentials. Human
|
||||
acceptance remains open only for Binky's user-chosen password, MFA enrollment,
|
||||
and final claim/denial checks; no operator-set password was substituted.
|
||||
|
||||
2026-07-29 complete: platform-root completed password + OTP login and opened
|
||||
the portal and OpenBao paths. Binky then completed reusable password setup,
|
||||
TOTP enrollment, and a fresh authorization-code login after the KeyCape
|
||||
rollout. The session verified the canonical issuer/audience, Binky tenant and
|
||||
groups, tenant-admin role, AAL2 `pwd` + `otp`, and denial for platform and
|
||||
Coulomb administration. Together with the prior qonto positive/negative
|
||||
client tests and TLS/discovery evidence, pre-cutover conformance passes.
|
||||
|
||||
## T06 - Cut over remaining DNS with monitored rollback
|
||||
|
||||
```task
|
||||
id: NK-WP-0022-T06
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "fc9ed5fb-fd5c-5b04-990b-5a5b7f32fa0f"
|
||||
```
|
||||
|
||||
Lower TTL where needed and move `auth.coulomb.social`,
|
||||
`lldap.coulomb.social`, `pink.coulomb.social`, and
|
||||
`pink-account.coulomb.social` to `92.205.62.239`. Confirm certificate,
|
||||
ingress, resolver, and normal-DNS flows from multiple resolvers. Keep
|
||||
CoulombCore intact but prevent divergent writes during a defined observation
|
||||
window. Roll back DNS if critical authentication or MFA gates fail.
|
||||
|
||||
Done when normal DNS consistently resolves to railiance01 and the observation
|
||||
window passes without fallback traffic or state divergence.
|
||||
|
||||
2026-07-28: authoritative/public recursive DNS now returns railiance01 for
|
||||
`auth.coulomb.social`; `login.coulomb.social` was added as an Authelia ingress
|
||||
and trusted certificate alias. The complete portal → KeyCape → Authelia
|
||||
redirect reaches railiance01. LLDAP and both privacyIDEA names remain
|
||||
intentionally on CoulombCore pending the state and conformance gates above.
|
||||
|
||||
2026-07-30 recheck: normal resolution now sends `auth`, `login`, `pink`,
|
||||
`pink-account`, and `kc` to railiance01 (`92.205.62.239`). Only
|
||||
`lldap.coulomb.social` still resolves to CoulombCore (`92.205.130.254`);
|
||||
`bao` remains there intentionally and is outside this identity-workload
|
||||
cutover. No automated DNS credential lane is registered: `warden route find`
|
||||
returned generic OpenBao/login/SSH routes, not provider DNS authority.
|
||||
Consequently T06 remains in progress on one explicit operator DNS change and
|
||||
its observation window, rather than being closed cosmetically.
|
||||
|
||||
2026-07-30 completion: the operator moved `lldap.coulomb.social` to
|
||||
railiance01. Normal resolution now sends `auth`, `login`, `lldap`, `pink`,
|
||||
`pink-account`, and `kc` to `92.205.62.239`; only the explicitly retained
|
||||
`bao`, retired `gitea`, and `hub` names resolve to CoulombCore. HTTPS probes
|
||||
for Authelia, LLDAP, both privacyIDEA surfaces, and KeyCape discovery pass on
|
||||
the public path. Direct TLS-preserving requests to the old IP return 404 for
|
||||
each identity hostname, proving the stale ingress has no functioning backend.
|
||||
The observation gate therefore passes without fallback traffic.
|
||||
|
||||
## T07 - Retire CoulombCore identity workloads reversibly
|
||||
|
||||
```task
|
||||
id: NK-WP-0022-T07
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "2a6d4c0b-2565-5bf5-9c04-1b63e992ce99"
|
||||
```
|
||||
|
||||
After T01-T06, scale the old KeyCape, Authelia, LLDAP, and privacyIDEA
|
||||
deployments to zero and suspend old backup jobs/ingress. Preserve manifests,
|
||||
PVCs, database, Secrets, and encrypted final backup during a rollback
|
||||
retention period. Confirm no DNS, ingress, client, monitor, or traffic still
|
||||
targets the old services.
|
||||
|
||||
Deletion of old workloads, PVCs, database clusters, or secret material is a
|
||||
separate destructive action permitted only after the retention period and an
|
||||
explicit recorded approval.
|
||||
|
||||
Done when CoulombCore serves no identity traffic and remains recoverable
|
||||
during the retention window.
|
||||
|
||||
2026-07-30 inventory: legacy KeyCape, LLDAP, and privacyIDEA are already scaled
|
||||
to zero with their resources retained; only CoulombCore Authelia remains at
|
||||
one replica. It must not be scaled down until the final LLDAP DNS record and
|
||||
T06 observation gate pass. The reversible retirement is therefore reduced to
|
||||
one remaining workload plus stale ingress/backup checks.
|
||||
|
||||
2026-07-30 completion: after T06 passed, CoulombCore Authelia was scaled to
|
||||
zero. KeyCape, LLDAP, privacyIDEA, and Authelia are now all zero replicas.
|
||||
No legacy identity backup CronJobs remain present. Services, Ingresses,
|
||||
ConfigMaps, Secrets, PVCs, TLS material, and source manifests were deliberately
|
||||
retained. Public identity probes still reach healthy railiance01 endpoints,
|
||||
while direct old-IP identity requests return 404. The reversible rollback
|
||||
window begins 2026-07-30; no retained state may be deleted under this task.
|
||||
|
||||
## T08 - Final deletion and closure
|
||||
|
||||
```task
|
||||
id: NK-WP-0022-T08
|
||||
status: done
|
||||
needs_human: false
|
||||
decision_id: 5d8dcdb5-6d7b-463e-bb39-0a4737331403
|
||||
priority: medium
|
||||
state_hub_task_id: "42a3b4c0-3481-5cfa-bdc2-66d05e751829"
|
||||
```
|
||||
|
||||
2026-10-11: founder confirmed coulombcore is needed for nothing; retire and reuse the machine. Evidence of the frozen old ArgoCD: railiance-platform docs/evidence/2026-10-11-coulombcore-argocd-frozen.md. The inter-hub-coulombcore bridge tunnel can be retired with the machine.
|
||||
|
||||
2026-10-11: requalified — drill owner is Sol (blue lane). See the-custodian docs/decisions/2026-10-11-security-unblock-decisions.md (Round 3).
|
||||
|
||||
2026-10-11: requalified — D4 batch approval, conditional on drill receipt and retention expiry. See the-custodian docs/decisions/2026-10-11-security-unblock-decisions.md.
|
||||
|
||||
After explicit approval, expiry of the rollback retention window, and one
|
||||
successful railiance01 restore/restart drill, remove the retired CoulombCore
|
||||
identity resources and stale DNS/monitoring/configuration. Record what was
|
||||
deleted, backup retention, recovery limits, final topology, and operational
|
||||
runbooks. Run `statehub fix-consistency`.
|
||||
|
||||
Done when railiance01 is the sole authoritative identity stack, all evidence
|
||||
is reconciled, and the workplan is marked finished.
|
||||
|
||||
Retention minimum: 2026-08-29 has passed. The plan is no longer date-blocked.
|
||||
The October11 D4 batch and Round4 decision below supply the destructive
|
||||
approval; no repeated approval is required within that scope once its recovery
|
||||
condition is met. Elapsed retention alone does not satisfy the required passing
|
||||
railiance01 restore/restart receipt.
|
||||
|
||||
2026-10-03: human gate routed to hub decision 5d8dcdb5-6d7b-463e-bb39-0a4737331403 (D4: Destructive cleanup after retention expiry: CoulombCore remnants, railiance-master retention, live recipient removal) by CUST-WP-0075; resolving that decision raises C-40 here.
|
||||
|
||||
## Safety gates
|
||||
|
||||
- No retirement before a tested backup and restore path exists.
|
||||
- No database overwrite before authoritative-source and divergence analysis.
|
||||
- No privacyIDEA restore without its matching encryption material.
|
||||
- No normal-DNS cutover before direct-resolution end-to-end verification.
|
||||
- No PVC/database/Secret deletion as part of the reversible retirement step.
|
||||
- Final deletion always requires an explicit human approval distinct from DNS
|
||||
cutover approval.
|
||||
|
||||
## Infrastructure review — 2026-09-28
|
||||
|
||||
Live read-only inventory confirms the identity services on railiance01 are
|
||||
ready. CoulombCore was not inspected in this review; do not infer that its
|
||||
retained resources have been deleted. Recheck the exact retained identity
|
||||
resources and backup custody before preparing the T08 deletion list. A generic
|
||||
platform-pg recovery drill is not a restore of LLDAP, Authelia, privacyIDEA
|
||||
with its encryption material, and identity database state. At that review, whole-host retirement
|
||||
and other owners' workloads remained outside the identity-only deletion gate;
|
||||
the October 11 founder decision subsequently authorized host retirement.
|
||||
|
||||
Evidence and cross-plan priorities: [estate review](../history/2026-09-28-open-workplan-infrastructure-review.md).
|
||||
|
||||
## Final retirement completion — 2026-10-15
|
||||
|
||||
Completed all eight tasks. The October 11 D4 batch approval and Round 4 founder
|
||||
instruction authorize retirement of the otherwise unneeded CoulombCore host.
|
||||
Retention expired August 29. The October 14 owner restart receipt reports
|
||||
`reboot_comparison.passed=true`, exactly one reboot, unchanged database
|
||||
identities and no new failing pods. Its SHA256 is
|
||||
`6e41778472b4f6093614ecd51a2a0d7e7e19608a0885162764f1c605dbde7b2b`;
|
||||
source: `railiance-platform/docs/evidence/2026-10-14-rpf-wp-0015-t03-reboot/post-reboot-preflight.json`.
|
||||
This satisfies D4's passing restore/restart condition. The separate deferred
|
||||
audit E2 in RPF-WP-0015-T03 is not a named D4 condition and remains open with
|
||||
its owner. The initial review held this task while checking that distinction;
|
||||
source review resolved it without inventing a new approval or identity restore.
|
||||
The July isolated identity backup restore remains the identity recovery proof.
|
||||
|
||||
Read-only SSH inventory identified the exact old host `92.205.130.254`, its
|
||||
hostname and boot ID, 35 running containers and 18 retained PVC directories.
|
||||
Verified the installed root-owned k3s uninstall/killall script digests before
|
||||
execution. At 20:06–20:07 UTC, stopped and disabled k3s and ran the reviewed
|
||||
installed uninstall script. All commands succeeded. This removed the retired
|
||||
cluster, containers, local PVCs, databases, Secrets and cluster credential state.
|
||||
No expired Kubernetes API access, certificate rotation or k3s restart was used.
|
||||
|
||||
Independent postchecks confirm no k3s/containerd processes, no retired cluster
|
||||
mounts, and absence of `/var/lib/rancher/k3s`, `/var/lib/kubelet`,
|
||||
`/etc/rancher/k3s`, `/run/k3s`, the k3s binary and systemd unit. The host remains
|
||||
SSH reachable. The obsolete `inter-hub-coulombcore` tunnel was stopped and
|
||||
removed from the workstation bridge configuration; all five railiance01 tunnel
|
||||
declarations remain present and connected.
|
||||
|
||||
All six public identity names (`auth`, `login`, `lldap`, `pink`, `pink-account`,
|
||||
`kc`) still resolve to `92.205.62.239`; HTTPS checks, including KeyCape OIDC
|
||||
discovery, pass after retirement. Bao and Hub also resolve to railiance01.
|
||||
Railiance01 is the sole authoritative identity stack. The independent encrypted
|
||||
July identity backup set remains in railiance01 custody with mode0600 files;
|
||||
no independent backup was deleted. Recovery now uses that protected backup
|
||||
and the current owner recovery runbooks, rather than retained old cluster PVCs.
|
||||
The metadata check does not claim a fresh full identity restore.
|
||||
|
||||
Boundaries: this removed cluster state, not the provider OS or every host file;
|
||||
it is not a secure full-disk erase. Machine reinstallation/reuse belongs to the
|
||||
fleet phoenix work (`railiance-cluster/workplans/RCLUSTER-WP-0007-threephoenix-ha-cluster.md`).
|
||||
The non-identity, retired `gitea.coulomb.social` DNS record still points to the
|
||||
old address; its provider DNS cleanup remains with the forge/fleet owner,
|
||||
outside the completed identity DNS cutover. No provider DNS credential lane
|
||||
was identified, and no DNS deletion is claimed. Do not restore old k3s or
|
||||
rotate its expired certificates to repurpose the machine.
|
||||
|
||||
Evidence: [retirement preflight](../docs/evidence/2026-10-15-coulombcore-retirement/retirement-preflight.json),
|
||||
[host inventory](../docs/evidence/2026-10-15-coulombcore-retirement/host-inventory.json),
|
||||
[execution receipt](../docs/evidence/2026-10-15-coulombcore-retirement/host-cluster-retirement-result.json),
|
||||
[independent host postcheck](../docs/evidence/2026-10-15-coulombcore-retirement/post-retirement-host-verification.json),
|
||||
[public identity postcheck](../docs/evidence/2026-10-15-coulombcore-retirement/post-retirement-public-identity-checks.json),
|
||||
[tunnel retirement](../docs/evidence/2026-10-15-coulombcore-retirement/tunnel-retirement.json),
|
||||
and [backup metadata](../docs/evidence/2026-10-15-coulombcore-retirement/independent-backup-metadata.json).
|
||||
|
||||
Knowledge orientation reloaded: Emergent Security 0.2.6,
|
||||
digest `8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02`,
|
||||
withheld/orientation-only; actual owner decisions, recovery source and runtime
|
||||
metadata were reviewed. Orientation does not confer execution authority.
|
||||
Loading…
Add table
Add a link
Reference in a new issue