61 lines
3.7 KiB
Markdown
61 lines
3.7 KiB
Markdown
# HelixForge critical path: issuer pin complete, custody reviews ready
|
|
|
|
NetKingdom completed the stored upstream issuer prerequisite on 2026-09-09
|
|
(2026-09-08T22:23:58Z). Its live configuration was missing `authelia.issuer`;
|
|
the contained owner helper inserted the independently verified
|
|
`https://auth.coulomb.social` value and read it back successfully.
|
|
|
|
The Secret UID stayed the same and its resourceVersion advanced from `51346058`
|
|
to `58713343`. Atomic UID/revision preconditions prevented a stale write. Every
|
|
other configuration byte and Secret data entry, including the signing key, was
|
|
preserved. The Deployment stayed at generation 29, image `main-153258b`, with
|
|
one ready and available replica. No credential value entered output or evidence.
|
|
|
|
The owner implementation extends the existing configuration helper with two
|
|
issuer-only modes; its legacy client/LLDAP patch mode was not used. All thirteen
|
|
tests passed, including concurrency, byte preservation and error containment.
|
|
The read and write procedures are both exercised against the actual target.
|
|
[Owner procedure](/home/worsch/net-kingdom/docs/keycape-upstream-issuer-pin.md).
|
|
|
|
This closes one concrete prerequisite inside KEY-WP-0013-T02 and
|
|
HFACT-WP-0001-T03. Those tasks still wait for custody and the compatible
|
|
image/configuration rollout. A stored pin does not prove that the existing
|
|
process reloaded it or that downstream login regression has passed.
|
|
|
|
The next human dependency is now actionable in its existing owner record,
|
|
RPF-WP-0035-T05. Both existing CCRs have pending review decisions:
|
|
|
|
| Request | Pending decision | Required reviewers |
|
|
| --- | --- | --- |
|
|
| CCR-2026-0017 | `b533a271-b704-4c5c-98a2-9a5951aadfb6` | platform-operator, key-cape-owner |
|
|
| CCR-2026-0018 | `efa90517-0cae-4eb6-a68d-5b0489c84d65` | platform-operator, key-cape-owner |
|
|
|
|
[The review packet](/home/worsch/railiance-platform/docs/credential-lane-designs/keycape-approval-clients-review.md)
|
|
sets out the exact paths, two separate policies/roles/stores, namespace and
|
|
service-account binding, TTL, risks and excluded capabilities. Both CCRs validate
|
|
and their generated policies match source. Both still refuse `apply-plan`
|
|
because they are proposed. No owner review, custody activation or client-side
|
|
credential access has been inferred from the user's continuation instruction.
|
|
|
|
The generated plans still leave initial secret provisioning to a contained
|
|
owner procedure. That procedure must be completed and exercised before the
|
|
attended activation window; a successful capabilities preflight does not establish
|
|
that it is ready. This remaining work stays with RPF-WP-0035-T05 and the linked
|
|
KeyCape rollout, alongside their existing rollback and live acceptance duties.
|
|
|
|
Efficiency has improved in two concrete ways: the issuer pin no longer requires
|
|
manual configuration reconstruction, and the custody review is now a pair of
|
|
linked decisions owned by one task instead of an unstructured cross-repository
|
|
wait. No elapsed-time saving or factory throughput result is claimed. The
|
|
fourteen-day operating observation remains unstarted.
|
|
|
|
Final synchronization also cleared the sole already owner-archived NetKingdom
|
|
duplicate after a [scoped review](2026-09-09-netkingdom-projection-review.json).
|
|
Its history remains readable, and the canonical profile handoff remains waiting.
|
|
Repo Manager's acknowledgement retry reused an idempotency key with a changed
|
|
payload and received HTTP 409. The supported primary endpoint completed the
|
|
reviewed operation using distinct request keys. HFACT-WP-0001-T02 retains the
|
|
CLI fix and regression test; this receipt does not claim that defect is fixed.
|
|
|
|
[Execution, synchronization and progress receipt](2026-09-09-helixforge-issuer-pin.json)
|
|
contains the live evidence, published owner revisions and final Hub readbacks.
|