From dd2283412f1a8babf7b0d7d1f12d727adb2a4f3b Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Thu, 30 Jul 2026 00:39:04 +0200 Subject: [PATCH 1/2] chore(consistency): sync task status from DB [auto] MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Updated by fix-consistency on 2026-07-30: - USER-WP-0020-T02: progress → done --- ...f-service-and-user-administration-portal.md | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/workplans/USER-WP-0020-self-service-and-user-administration-portal.md b/workplans/USER-WP-0020-self-service-and-user-administration-portal.md index 951bbb6..055d354 100644 --- a/workplans/USER-WP-0020-self-service-and-user-administration-portal.md +++ b/workplans/USER-WP-0020-self-service-and-user-administration-portal.md @@ -8,7 +8,7 @@ status: active owner: codex topic_slug: netkingdom created: "2026-07-27" -updated: "2026-07-28" +updated: "2026-07-30" depends_on: - USER-WP-0014 - USER-WP-0015 @@ -54,7 +54,7 @@ metadata for that later stage. ```task id: USER-WP-0020-T02 -status: progress +status: done priority: high state_hub_task_id: "fdb0c322-3efe-4077-bfba-1648787ef411" ``` @@ -134,7 +134,7 @@ removal, and full cross-tenant conformance remain. ```task id: USER-WP-0020-T05 -status: progress +status: done priority: high state_hub_task_id: "65ff5c96-134a-4ec2-ad92-511f0e5f6f04" ``` @@ -162,10 +162,14 @@ and rollback/roll-forward no longer depends on containerd retaining local tags. An age-encrypted user-engine Postgres dump was uploaded through the established activity-core offsite lane with plaintext cleanup. -The remaining T05 item is migration of the portal edge marker and provisioner -service token from bootstrap Kubernetes Secrets into an OpenBao-owned, -ExternalSecret-delivered, rotatable lane. This requires the ops-mason -executive approval gate for new secret custody. +2026-07-30 completion: the approved ops-mason plan moved the portal edge +marker and provisioner service token into one exact OpenBao workload path, +delivered through separate bounded AppRoles and namespace-restricted +ExternalSecret stores. A coordinated rotation converged all three derived +Secrets before restarting the portal and provisioner, and both Deployments +returned Ready. Exact-path access succeeds, sibling-path access is denied, +the derived client/server tokens match, and a post-rotation disposable +identity reconciliation passed. No secret value entered recorded evidence. ## T06 - Security, accessibility, and workflow conformance From cf5eb674a538070760bb8c9295ca87fc461f364d Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Thu, 30 Jul 2026 00:39:07 +0200 Subject: [PATCH 2/2] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-07-30: - update .custodian-brief.md for user-engine --- .custodian-brief.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index e32c9b0..407cfed 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,20 +2,19 @@ # Custodian Brief — user-engine **Domain:** communication -**Last synced:** 2026-07-29 22:37 UTC +**Last synced:** 2026-07-29 22:39 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams ### Production self-service and user administration portal -Progress: 3/8 done | workplan_id: `35b9c315-e721-4e0b-9710-bad04f8d2519` +Progress: 4/8 done | workplan_id: `35b9c315-e721-4e0b-9710-bad04f8d2519` **Open tasks:** - ! T06 - Security, accessibility, and workflow conformance `39dc383c` - ! T08 - Closure and next-stage handoff `ecbdeef3` - ► T03 - Implement self-service login and registration UX `45ed1485` - ► T04 - Implement tenant-admin and platform-admin UX `16555b68` -- ► T05 - Add production persistence and operability `65ff5c96` ## Inbox Hygiene