7b2824e72271 | Merge ra5sec/identity-2026-10-29 into main (lane RA5-SEC): RA5-29 a refused login names the person only after the signature verified; RA5-30 a failed redemption write opens the invite again and a sign-up is stored before it is mailed; RA5-32 IdentityGrpc believes the client field only from loopback by default (ClientTrust; Gunnar opts in with EveryPeer, its transport is mTLS off loopback); RA5-33 a used fed hash is never re-opened nor trimmed. nornir-identity 0.2.3. RED f0f1759 420ec5a^ 9984638^ 9855a94^, GREEN 245ffca 420ec5a 9984638 9855a94. Gate on the merged tree: lockcheck green, xtask ci identity steps green (nornir-identity --all-features conformance 23/0, grpc 3/0), clippy -D warnings clean | 2026-10-29 |
5253772b5e63 | nornir-identity test store: clippy manual_contains | 2026-10-29 |
74811fdead90 | Bump nornir-identity 0.2.3 (RA5-29, RA5-30, RA5-32, RA5-33) | 2026-10-29 |
9855a94855a1 | GREEN RA5-30: redeem_finish opens the spent invite again when the person or passkey write fails; sign_up stores the person and the link before it mails (a refused mail withdraws the link) | 2026-10-29 |
5797f03d40ea | RED RA5-30: a failed redemption write leaves the link open, and a sign-up whose store fails mails nothing | 2026-10-29 |
99846381e543 | GREEN RA5-33: fed_enrolment refuses a used hash (InviteNotOpen) instead of pushing a fresh open invite beside the spent row, and keep_bounded never trims a spent fed link | 2026-10-29 |
6b6ea89386c3 | RED RA5-33: a used fed hash is never re-opened, fed again or after the invite table is trimmed | 2026-10-29 |
420ec5a2790f | GREEN RA5-32: IdentityGrpc believes a client field only from loopback by default (ClientTrust::Loopback); a product whose transport authenticates every peer opts in with trust_clients(ClientTrust::EveryPeer) | 2026-10-29 |
c6300ef6a4a6 | RED RA5-32: a caller off loopback that names a fresh client on every call is still one client (the per-client ceremony bound trusted the request's own field) | 2026-10-29 |
245ffcad57ac | GREEN RA5-29: the LoginRefused audit names the person only after verify_assertion; a forged signature on a known credential id names nobody | 2026-10-29 |
f0f17598c708 | RED RA5-29: a refused login names the person only after their passkey signed (a credential id is no secret, so a forged signature wrote rows into anyone's audit) | 2026-10-29 |
a285af470d02 | kernel: a built kernel is also filed under its step pin (.kernel-out/<name>/pins/<ledger key>/), so two merges of one donor kernel coexist | 2026-10-29 |
b6bf7d83bf57 | split_opts: a path under an edge the consumer's tree does not draw is the donor's (kernel.toolchain=off) | 2026-10-29 |
d865b9fcf3ca | nornir-build-thing provenance: every source tree, the door's builder id, a versioned buildType | 2026-10-29 |
6fbf12065596 | k8s-hardened.config: the node rows now pass; drop the stale refusal note | 2026-10-29 |
b44a168abedb | k8s-hardened.config: the kconfig-stage measurement | 2026-10-29 |
c45b28ffec76 | kernel: the k8s-hardened profile — hardened with exactly the BPF reversal | 2026-10-29 |
0d548cfb05ce | why-files: one requirers array per row, TOML basic strings | 2026-10-29 |
83f18e50af20 | Merge ox-follow/estate-front-0.3.0-2026-10-28 into main (lane OX-POSTPUB): estate-front 0.3.0 and nornir-xtask-support 0.1.6 are on crates.io (owner publish 2026-10-29 084035Z) | 2026-10-29 |
663e2650dfd6 | Bump estate-front 0.3.0 and nornir-xtask-support 0.1.6 (publish r5k, lane OX-FOLLOW) | 2026-10-28 |