Prepare signed lifecycle runtime admission and receipt verification

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

docs/native-signer-workload.json

@@ -0,0 +1,68 @@
+{
+  "schema": "access-engine.signer-workload-reference.v1",
+  "owner_repo": "access-engine",
+  "existing_workload": "flex-auth",
+  "authoritative_owner_declaration": "tenancy.yaml#/workload_identity",
+  "exact_signer_identity_binding": "system:serviceaccount:flex-auth:flex-auth-secrets-engine",
+  "declaration_scope": "Existing retained Secrets lifecycle PDP pin; declaration of identity source only. Not a new managed workload, credential grant, zone promotion or live admission.",
+  "observed_runtime": {
+    "cluster": "railiance01",
+    "node_internal_ip": "92.205.62.239",
+    "namespace": "flex-auth",
+    "release": "flex-auth-secrets-engine",
+    "deployment": "flex-auth-secrets-engine",
+    "reviewer_service_account": "flex-auth-secrets-engine",
+    "source_evidence": "the-custodian/docs/changes/netkingdom-target-2026-10-16/access-native-preparation/live-metadata-r1.json",
+    "evidence_sha256": "bafce991e02083ac30c8d6ce15f037dc22087bbb5dc8185c472149b46bca47c2"
+  },
+  "identity_roles": {
+    "signer_workload": "system:serviceaccount:flex-auth:flex-auth-secrets-engine",
+    "requesting_consumer": "system:serviceaccount:secrets-engine:secrets-engine",
+    "retained_caller_audience": "flex-auth",
+    "rule": "Signer custody binds the PDP workload, not the consumer or a human approver. Existing TokenReview reviewer projection does not grant signing-key custody."
+  },
+  "custody_reference": {
+    "catalog_id": "flex-auth-decision-envelope-signing-key",
+    "owner_repo": "railiance-platform",
+    "current_state": "draft/nonresolvable",
+    "proposed_source_path": "platform/workloads/flex-auth/envelope-signing",
+    "proposed_private_field": "ED25519_PRIVATE_KEY",
+    "required_encoding": "unpadded base64url 32-byte Ed25519 seed; mount0440 allowed, group-write and world permissions refused",
+    "public_fields": [
+      "ED25519_PUBLIC_KEY",
+      "kid"
+    ],
+    "proposed_catalog_workload_reference": {
+      "name": "flex-auth",
+      "declaration_ref": "access-engine/tenancy.yaml#/workload_identity",
+      "exact_binding": "system:serviceaccount:flex-auth:flex-auth-secrets-engine",
+      "resolution": "unknown until owner custody and managed-package admission; do not mark resolvable merely from source binding"
+    },
+    "key_created_or_admitted": false
+  },
+  "managed_package_limit": {
+    "rapp_declaration_ref": null,
+    "status": "Existing managed-deployable migration debt remains unknown under security-zones_v0.1 \u00a76; no matching authoritative rapp declaration was established. Existing source tenancy declaration supplies owner identity binding but cannot substitute for managed-package admission.",
+    "no_fiction": "Do not invent a rapp tuple or describe this Helm-managed Deployment as an independent operational unit to bypass the rule."
+  },
+  "unchanged_limits": [
+    "tenancy and zones grades are unchanged",
+    "service-pilot literal false gate unchanged",
+    "human variant unchanged",
+    "legacy twelve lifecycle actions remain the selected policy package",
+    "no signer Secret name, kid, public fingerprint, custody receipt or rollout permission is supplied"
+  ],
+  "consumer_admission": "Secrets owner independently admits public keys/pins and exact installed verifier; this file never bootstraps trust from PDP discovery.",
+  "native_tool": {
+    "path": "tools/verify_native_signer_receipt.py",
+    "requires": "Installed reviewed Secrets Engine package/helper and independent public admission; source request, authenticated response and original source record for one allow and one deny.",
+    "operation": "Offline captured receipt checks only, no network/token input/key build or protected effect. Current clock validation; no CLI backdating option.",
+    "result_limits": "Does not prove record durability, real rejected HTTP caller, audit receiver custody, rotation, or authorization to run effect."
+  },
+  "ci": {
+    "trigger": "Existing ordinary push to main when .forgejo/workflows/image.yaml, Containerfile, cmd/**, internal/**, pkg/**, examples/**, go.mod/go.sum or tools/publish-runtime-images.sh changes; workflow_dispatch also exists. This patch changes the workflow, so an authorized push would trigger it.",
+    "scope": "Existing container-build runner and already admitted forgejo.coulomb.social/coulomb/flex-auth package only in legacy mode; paired access-engine package publication requires separate existing dispatch authority and is excluded.",
+    "provenance_preparation": "Download archive/${REF}.tar.gz using full validated GITHUB_SHA; existing publisher labels org.opencontainers.image.revision and reads back registry manifest digest.",
+    "not_invoked": "No push, workflow dispatch, Docker build, image publication or paid resource allocation in this source preparation."
+  }
+}