coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare signed lifecycle runtime admission and receipt verification
Some checks failed
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Failing after 59s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
tegwick 2026-10-16 10:48:28 +02:00
parent ec21518e25
commit 919ce25a37
9 changed files with 364 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

31
workplans/FLEX-WP-0024-decision-envelope-authenticity.md
View file

@ -184,7 +184,7 @@ This is source preparation only, not signer admission or deployed acceptance.
```task
id: FLEX-WP-0024-T06
status: wait
status: progress
priority: high
```
@ -197,3 +197,32 @@ then update actual deployed status. No signer or runtime trust is admitted by th
source review. This task owns the producer-side native gate; SECRETS-WP-0014 owns
consumer admission/enforcement. The old fixture completion never established this
gate, so the workplan is reopened rather than claiming it already passed.
2026-10-16 owner native preparation: T06 is `progress` because Access still owns
signer workload declaration, artifact/provenance and source/provider-join preparation;
no unqualified cross-owner wait is claimed. Read-only actual release metadata and
bounded proposal are in the Custodian
`docs/changes/netkingdom-target-2026-10-16/access-native-preparation/`.
The real Platform custody route `flex-auth-decision-envelope-signing-key` exists but
is draft/nonresolvable; no production kid/public fingerprint, Secret projection or
custody receipt is admitted. Coordinate that named commitment through CUST-WP-0080
instead of inventing a Platform task/approval. SECRETS-WP-0014-T03 owns installed
consumer native verification and must not form a circular blocking dependency.
The first proposed native trial only signs the unchanged lifecycle package on the
existing retained release; `execute-ccr` remains denied. Current service-pilot
`runtime_admission := false` remains mandatory: the source ServicePilotInputs is
not yet wired into HTTP, and public service_actor_binding never authenticates the
caller. Later activation needs a complete reviewed provider join, exact policy and
operation admission, artifact digests, owner execution/rollback proposal and native
receipts. Preparation/local synthetic success grants none of those permissions.
2026-10-16 source-only native preparation adds the existing Secrets PDP ServiceAccount
to `tenancy.yaml` with evidence in `docs/native-signer-workload.json`, makes the
retained `flex-auth` audience explicit, pins CI archive fetch to the full source
revision, and adds offline native signer receipt verification using the existing
Secrets verifier. No key, trust, image publication or live activation is admitted.
The managed workload's missing rapp declaration remains explicit migration debt;
this source binding does not fabricate a package declaration or raise its grade.