4.9 KiB
Native preparation after verified source delivery
These are owner-bound preparation steps. Source evidence establishes neither current native assent nor production acceptance. Source references bind 23 group/storage and 17 recovery references to exact reviewed Git bytes.
Group journal and protected rollback — NK-WP-0048-T14
NetKingdom owns implementation and attended directory reconciliation. Platform owns shared database/custody governance; rapp-postgres supplies the existing database-per-consumer surface. The inspected runtime package bindings do not assign identity-provisioner a managed package. Settle that assignment first. Accepted ADR-0015 excludes SQLite-on-PVC from production. Keep the delivered SQLite backend local/disposable; build the same journal semantics behind the existing injection seam using CNPG, or obtain an explicit scoped policy exception.
The proposed consumer is identity-provisioner in namespace sso, with a separate database/schema and runtime/migration/owner roles. Placement, connections, statement/idle timeouts, retention, backup and dynamic credential lease delivery need existing package/Platform acceptance. Source declarations suggest the second cell as an overflow candidate; they prove no live headroom or granted capacity. EUR cost and credible loss bounds remain unknown. No consumer or database was created and no lease was requested.
Tenant/case scope must come from an authoritative protected caller binding. Caller JSON and a default platform scope are insufficient. Warden's old group caller route was dropped; User Engine's runtime token/pod access is not new protected-case authority. Bind current case/source/principal/native identities, independent evidence and per-attempt session revocation through existing owners.
SQL row versions/active-slot exclusion can serialize cooperating journal calls. They cannot fence LLDAP's admin WebUI, helper or user-deletion writers. Prove an all-writer maintenance barrier that survives process loss, or provider CAS and generation semantics, before native destructive rollback. Two reads and one replica do not prevent races or remove/re-add ABA. A database restored behind an LDAP effect must remain quarantined pending independent reconciliation. Preserve intents/evidence; never clear uncertainty by dropping or reinitializing storage.
Original TLS and selected consumer — NK-WP-0049-T35/T36
railiance-cluster owns the ingress/cert-manager/cluster-backup substrate; NetKingdom owns namespace ingress intent. The declared TLS identity is kc.coulomb.social using sso/kc-tls and letsencrypt-prod, terminated by Traefik. The identity archive profile excludes this TLS Secret. The inspected encrypted cluster-backup source writes same-host state/Helm/kubeconfig copies and establishes no independently recoverable original TLS/trust snapshot. Its named plaintext staging and whole-cluster restore are not admitted isolated recovery steps.
Obtain the existing source owner's metadata and independent private custody path, or an explicitly accepted reissue disposition for the outage claim. Draft owner questions have not been sent. No key retrieval or self-signed substitute is ready. Once public-only original certificate/chain/trust provenance is established, bind its public hashes/SANs/validity to the exact isolated attempt. Keep private inputs in the owner's terminal and run complete preflight before any key prompt.
The historically deployed secrets-engine-openbao client is a defensible selector candidate: issuer proof from 7 October and consumer proof from 10 October predate the 16 October archive. The public selector is:
| Field | Candidate value |
|---|---|
| Client / audience | secrets-engine-openbao |
| Secret environment name | KEYCAPE_SECRETS_ENGINE_OPENBAO_CLIENT_SECRET |
| Scope / denied scope | openbao:login / openbao:admin |
| Subject / tenant | service:secrets-engine / tenant:platform |
| Required role | secrets-engine |
Historical deployment does not prove current owner assent, archived uniqueness, environment binding or restored consumer continuity. Have the existing service owner validate the selector; later private archive/native checks must establish the original registration without retrieving a client secret into work records. No token exchange, OpenBao login, new grant, rotation or consumer redirect occurred. T33 still waits for complete reviewed readiness; T18 owns actual owner-held execution/consumer acceptance and T19 retained-factor MFA.
Configured-hook acceptance — RMGR-WP-0021-T05
Source publication, canonical import routing, 42 tests, 13 parity cases and four actual configured clean/private-key cases are established separately. Keep the actual unavailable-scanner hook case pending until a reviewed fixture can shadow the exact scanner path without changing the real scanner or user state. Remote receive/CI/private-response coverage and whole TSA-15 acceptance remain open.