the-custodian/docs/netkingdom-security-gaps.md

NetKingdom security gaps and closure sequence

Assessment date: 2026-10-12. Blueprint. Coordinator: CUST-WP-0080. Existing owner work remains authoritative. Statuses below distinguish actual defects, incomplete integration and missing verification. No whole-estate SEC-DSM conformance or maturity level is claimed.

Gaps ordered for execution

ID	Gap and current evidence	Existing owner work	Closure evidence
G01	MFA recovery rejects the issuer's DN-shaped subject: LLDAP sets user.ID to entry.DN, while recovery applies a login-only regex to actor. Attended U08 is blocked.	KEY-WP-0040-T01/T02; USER-WP-0028-T03	Regression for real subject shape; value-free field diagnostics; deployed preview without mutation; attended recovery and fresh sign-in
G02	First reusable browser case lacks native structure/execution proof despite substantial local compiler and kernel work.	NK-WP-0048-T06/T07; MASON-WP-0010-T03/T04; WARDEN-WP-0044-T03/T04; KEY-WP-0038	Exact accepted type/case, independent structure observations, contained issuance/delivery, positive and denied groups, revocation and rollback receipts
G03	OpenBao service-JWT login does not grant task-scoped execution. Backend readiness guard correctly refuses protected handlers.	SECRETS-WP-0013-T01/T03; RPF-WP-0035-T12; SECRETS-WP-0008-T06; KEY-WP-0039	Owner-reviewed entitlement; native protected effect with exact binding; sibling/actor/body/replay/expiry refusals; no ambient fallback; cleanup
G04	Credential inventory is incomplete and its five metadata fields do not by themselves establish full SEC-DSM lifecycle coverage. Mason's dated survey found 49 paths; coverage is not current estate-wide discovery.	MASON-WP-0004-T03/T04; RPF-WP-0035; CUST-WP-0080-T03	Current metadata-only discovery denominator; owners/consumers/scopes; rotation and revocation procedures; unknown entries remain findings
G05	Agent effective authority and credential isolation are unproven. Glas declares no ready profile; the Custodian record grants no autopilot authority.	CUST-WP-0073-T02/T04; GLAS-WP-0012	Actual admitted agent identity, runtime read-denial and tool-effect restrictions, task expiry/cancel cleanup, no cross-task credential accumulation
G06	Native evidence delivery, source completeness and attribution remain incomplete. Independent archive custody is not source completeness.	AUDIT-WP-0013/0014/0015; RPF-WP-0035-T08; existing FLEX-WP-0031 and NK-WP-0035/0040 residual records	Admitted sender, durable outbox, native archive readback, heartbeat/reconciliation and failure recovery. Residual work requires explicit promotion
G07	Automated secret-detection coverage is unverified across production repositories and pipelines. Inspection of 36 tracked workflow/build configurations in 21 repositories found no common scanner references. Custom, inherited and server-side controls remain unverified.	CUST-WP-0080-T03, with repo-manager/railiance-forge ownership review	Deterministic production-repo inventory; actual prevention/detection runs; scanner findings kept private; finding-to-revocation procedure
G08	Bootstrap instructions still describe displaying/reprinting emergency bundles in an agent-driven workflow; root isolation and secret-free transcripts must govern executable paths.	NK-WP-0045 existing root custody work; CUST-WP-0073; CUST-WP-0080-T03	Inspect actual bootstrap callers; stop secret output reaching model/logs; owner-reviewed safe recovery procedure and tests
G09	Rotation and revocation closure are incomplete: existing exposure rotation is founder-deferred, npm migration remains open, and five-field descriptions do not prove consumer adoption.	CUST-WP-0073-T05; SECRETS-WP-0006-T06; WARDEN-WP-0037-T03; RPF-WP-0035-T07	For each relevant credential: new consumer accepted, old credential refused, copies reconciled; explicit DSM exception if still deferred
G10	Build-mode exceptions and close-down checklist do not uniformly contain DSM-EXC requirement, risk, compensating controls and review fields.	CUST-WP-0080-T03; existing security-close-down checklist and October 11 decisions	Requirement-level exception records with real approval references and revalidation; no invented approval or retroactive conformance
G11	Root recovery, independent custody and single-node resilience require scoped native proof. Old successful source preparation is insufficient.	WARDEN-WP-0027-T02; platform recovery records; RPF-WP-0015 residual	Fresh authorized scenario, off-host encrypted backup, independent recovery access, verified restore/return; honor build-mode single-holder decision
G12	CI credential authority, Kubernetes delivery-copy lifecycle and at-rest protection lack complete estate coverage in this review.	RPF-WP-0036/0044; railiance-forge; existing CCRs; CUST-WP-0080-T03	Pipeline writer scope and job identity, per-store namespace/path isolation, refresh/deletion semantics, consumer adoption, independently governed encryption keys
G13	PDP authenticity is separate from digest binding. FLEX-WP-0024 implemented optional signatures, but Secrets Engine's decision client still relies on address shape; unsigned-mode producer and consumer rollout coverage is unverified.	Completed FLEX-WP-0024 is source evidence; CUST-WP-0080-T03 tracks uncovered runtime/consumer work	Independently trusted key or authenticated channel, configured producer, consumer verification, forged/altered/unknown-key/unsigned-downgrade refusals and key-rotation evidence

G01 is immediately actionable source work. G02 and G03 require existing owner acceptance and native custody gates; fixture success cannot remove them. G04, G07, G08, G10, G12 and G13 require further inspection and concrete corrections under the coordinator task, with owner records reused when coverage is established. G05, G06, G09 and G11 retain their existing owners and governing decisions.

G01 progress on 2026-10-12: the two DN-subject regressions failed against the original implementation. The repair passes 20 recovery tests and the full Go suite. KeyCape commit 1344fc8 contains the recovery repair and task record. The existing blue-lane authorization covered a code-volume-only rollout; privacyIDEA generation 11 is Ready on factor-recovery-01119187d90d7b76, health returns 200 and unauthenticated recovery returns 403. Native receipt. The authenticated preview and U08 remain open. The OTP help link is prepared locally; its image publication and live verification have not run.

SEC DSM requirement coverage

Each numbered requirement in these families is in scope for assessment. The family mapping is a navigation index, not a finding that every requirement is met. The accompanying requirement ledger enumerates individual IDs from the exact canon source. No unverified requirement is counted as conformant.

Family	Architectural treatment	Gaps / proof still required
TRANS, ARCH	Highest practical identity path; one authority; static exceptions; outage behavior	G03, G04, G10, G12
DX	Known case templates, routing, developer separation, value-free diagnosis	G01, G02, G05, G08
ID, AUTH	Unique identity and independently bound authorization; tenant/environment isolation and authentic PDP responses	G02, G03, G05, G12, G13
ISSUE	Bounded per-execution capability and protected producer authority	G02, G03, G05
STORE	OpenBao runtime custody; independently protected bootstrap/backup keys; minimized copies	G04, G08, G11, G12
DELIV	Direct/ephemeral where practical, ESO only for compatibility, no scope broadening	G02, G03, G12
ROT, REV	Issue → distribute → adopt → validate → revoke; disclosure is not fixed by deleting text	G04, G09
DETECT	Repository/pipeline detection and response	G07
CI	Job identity, pipeline-change authority, masking only as defense in depth	G07, G12
K8S	Projected bounded identity, exact namespace/path policy, explicit ESO lifecycle	G12
KEY	Protect roots/signers, prefer operations over key export, justify compatibility	G08, G11, G12
HUM	Contained attended path and attributable recovery; no normal human secret transport	G01, G03, G08, G11
AGENT	Distinguishable bounded identity, deterministic gates, tools included in authority	G03, G05
AUDIT	Source atomicity, independent custody, sanitized telemetry and attribution	G06
ROOT	Enumerated independent roots and periodically tested recovery	G08, G11
INV	Owner inventory plus discovery, explicit unknowns and orphans	G04
EXC	Real approval, scope, reason, risk, controls and review/elimination trigger	G09, G10
AP	Anti-pattern catalog used to challenge all paths, not treated as new controls	G03–G12
CORE	Minimum viable profile before any full conformance claim; prioritize exposure	G04, G05, G07, G09, G10, G12

Unnumbered normative obligations also apply: section 29 requires honest metric coverage, sections 38–39 restrict conformance/maturity claims, and the section 37 decision procedure records why any proposed credential must exist. Product mapping tables and reference architectures are guidance, not proof of deployed product capability.

Efficient workplan

1. Finish G01 source repair and targeted tests against the real identity contract. Prepare its reviewed rollout and preview; batch the real-factor U08 action in the existing attended window.
2. Progress the existing Forgejo case through G02 in dependency order: exact type and case acceptance → native structure receipt → contained follow-through → independent positive/negative/cleanup proof. Do not reopen finished producers.
3. Complete G03 using the existing execution-contract and platform-entitlement plans. Reuse wrapped delivery as a primitive; do not equate it with admission.
4. In parallel with owner returns, reconcile metadata inventory and exceptions, inspect legacy bootstrap output and establish actual scanning coverage. Use facts already in CCRs and owner procedures; never read credential values to improve documentation.
5. Complete the existing native agent, audit, rotation and recovery acceptance gates. Keep explicitly deferred/residual work visible and seek promotion only where needed to meet the objective; do not implement it by relabeling.
6. Re-run a requirement-by-requirement completion audit. Source checks prove only source behavior. A missing native receipt or incomplete exception leaves the corresponding gap open and the overall goal unfinished.

Architecture review disposition

The blueprint was inspected against the accepted layer model, SEC-DSM hierarchy, source implementations, owner task gates and build-mode decisions. It now distinguishes login from entitlement, native identity from brokerage, structure from execution, archive integrity from completeness, offline engines from live services, and role definitions from access grants. These changes close ambiguity in the blueprint; they do not close the implementation gaps above.

No independent owner assent is claimed for this assessment. Required owner reviews remain in the existing plans. Completion means verified closure of these findings and all applicable requirements, not merely publication of this plan.

Individual requirement ledger: 116 numbered entries, including 20 anti-pattern entries and 96 entries requiring substantive assessment. The ledger enumerates scope and evidence obligations; its currently unverified statuses intentionally do not imply conformance. Source inventory records 21 repository revisions and their open workplans at initial inspection. The scanner configuration inventory records exactly which tracked configuration files were inspected. It contains no credential values or scanner findings and does not claim complete detection coverage.