3.7 KiB
HelixForge critical path: issuer pin complete, custody reviews ready
NetKingdom completed the stored upstream issuer prerequisite on 2026-09-09
(2026-09-08T22:23:58Z). Its live configuration was missing authelia.issuer;
the contained owner helper inserted the independently verified
https://auth.coulomb.social value and read it back successfully.
The Secret UID stayed the same and its resourceVersion advanced from 51346058
to 58713343. Atomic UID/revision preconditions prevented a stale write. Every
other configuration byte and Secret data entry, including the signing key, was
preserved. The Deployment stayed at generation 29, image main-153258b, with
one ready and available replica. No credential value entered output or evidence.
The owner implementation extends the existing configuration helper with two issuer-only modes; its legacy client/LLDAP patch mode was not used. All thirteen tests passed, including concurrency, byte preservation and error containment. The read and write procedures are both exercised against the actual target. Owner procedure.
This closes one concrete prerequisite inside KEY-WP-0013-T02 and HFACT-WP-0001-T03. Those tasks still wait for custody and the compatible image/configuration rollout. A stored pin does not prove that the existing process reloaded it or that downstream login regression has passed.
The next human dependency is now actionable in its existing owner record, RPF-WP-0035-T05. Both existing CCRs have pending review decisions:
| Request | Pending decision | Required reviewers |
|---|---|---|
| CCR-2026-0017 | b533a271-b704-4c5c-98a2-9a5951aadfb6 |
platform-operator, key-cape-owner |
| CCR-2026-0018 | efa90517-0cae-4eb6-a68d-5b0489c84d65 |
platform-operator, key-cape-owner |
The review packet
sets out the exact paths, two separate policies/roles/stores, namespace and
service-account binding, TTL, risks and excluded capabilities. Both CCRs validate
and their generated policies match source. Both still refuse apply-plan
because they are proposed. No owner review, custody activation or client-side
credential access has been inferred from the user's continuation instruction.
The generated plans still leave initial secret provisioning to a contained owner procedure. That procedure must be completed and exercised before the attended activation window; a successful capabilities preflight does not establish that it is ready. This remaining work stays with RPF-WP-0035-T05 and the linked KeyCape rollout, alongside their existing rollback and live acceptance duties.
Efficiency has improved in two concrete ways: the issuer pin no longer requires manual configuration reconstruction, and the custody review is now a pair of linked decisions owned by one task instead of an unstructured cross-repository wait. No elapsed-time saving or factory throughput result is claimed. The fourteen-day operating observation remains unstarted.
Final synchronization also cleared the sole already owner-archived NetKingdom duplicate after a scoped review. Its history remains readable, and the canonical profile handoff remains waiting. Repo Manager's acknowledgement retry reused an idempotency key with a changed payload and received HTTP 409. The supported primary endpoint completed the reviewed operation using distinct request keys. HFACT-WP-0001-T02 retains the CLI fix and regression test; this receipt does not claim that defect is fixed.
Execution, synchronization and progress receipt contains the live evidence, published owner revisions and final Hub readbacks.