coulomb/key-cape
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Publish reviewed bounded JWT ready handoff and retained owner history

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 18:31:04 +02:00
parent f60e7419a9
commit 0f47e0c666
13 changed files with 2002 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

82
docs/openbao-negative-token-producer-decision.json Normal file
View file

@ -0,0 +1,82 @@
{
"proposal_id": "KEY-WP-0039-T02/private-producer-handoff-v4",
"status": "owner_choice_required",
"native_authority": false,
"native_readiness": false,
"lifecycle_manifest_sha256": "84542ddcff00932fc7ce22dcb2626be8942a3c006c5098a62fdd6b2478d0cd14",
"recommended_human": {
"client_id": "netkingdom-bootstrap-console",
"audience": "netkingdom-bootstrap-console",
"scope": "openid",
"callback": "http://127.0.0.1:8876/oidc/callback",
"existing_client_purpose_reuse_admitted": false,
"fresh_mfa_verified": false
},
"coding_agent": {
"client_id": "codex-railiance-platform",
"audience": "codex-railiance-platform",
"scope": "openbao:login",
"subject": "service:codex:railiance-platform",
"tenant": "tenant:platform",
"secret_env": "KEYCAPE_CODEX_RAILIANCE_PLATFORM_CLIENT_SECRET",
"live_registration_verified": false,
"existing_custody_admission_receipt": null,
"consumer_delivery_coordinates": null,
"alternative_if_missing": "Platform-owned new narrow admission proposal; do not silently provision"
},
"handoff": {
"adapter": "scripts/openbao_negative_private_handoff.py",
"pipe_fd": 3,
"private_tmpfs_jwt_files_approved": false,
"exact_launcher_source_digest": null,
"ssh_transport_admission_receipt": null,
"destination": "railiance01 Linux main-thread V5 stdin",
"no_pty": true,
"caller_files_explicit_consumption": true,
"delivery_timeout_seconds": 5,
"decoded_claim_checks_are_signature_verification": false,
"launcher": "scripts/openbao_negative_private_launcher.py",
"ready_schema": "key39-private-input-ready/v1",
"ready_before_any_token_load_consume_write": true,
"ready_requires_nonce_source_envelope_health_window_match": true,
"marker_is_authenticated_authority": false,
"launcher_or_transport_admitted": false,
"remote_child_sha256": "24b7b803e4eb7e6e7c0700a069dad0ec315ee7eb5538a88b9e56147f8fab5cdd",
"remote_wrapper_sha256": "76ac013d1a676a0dfa58aea1ce87b0c3e72483ccd21f586a22c5475e9132f6c1",
"stdio_alias_rejection": "device/inode aliases of0/1/2 and data/control pipes",
"exclusive_same_uid_custody_required": true,
"atomic_inode_delete_guaranteed": false,
"credential_copy_cleanup_verified": false,
"credential_files_remain_possible": true,
"private_unknown_implies_sticky_consumer_unknown": true,
"preparation_total_seconds": 5,
"original_budget_shared_from_main_through_contract_spawn_ready_and_handoff": true,
"source_files_nonblocking_nofollow_regular_stable": true,
"source_contract_envelope_max_bytes": 65536,
"source_hash_file_max_bytes": 262144
},
"node_route": {
"selected_reviewed_origin": null,
"allowed_v5_origins": [
"http://127.0.0.1:18200",
"http://openbao.openbao.svc:8200"
],
"owner_route_receipt": null,
"public_health_preflight_guard_source_digest": null,
"health_before_tokens_credentials_mutations_restarts": true,
"workstation_observation_is_node_route_evidence": false
},
"decisions_required": [
"Founder existing console reuse versus new client",
"NetKingdom current registration/MFA/callback/runtime/guarded health ordering",
"Platform coding-agent live/custody/consumer admission and node route",
"Exact trusted launcher and private-file allowance",
"Fresh exact founder live proposal decision after all evidence",
"Separate founder directSSH control profile, exact launcher and continuously exclusive sameUID private tmpfs custody; marker is not a grant"
],
"previous_producer_manifest_sha256": "569672ecdb3f1f5b46122183dc3b82e83ff168c07c87db7211ec26bc1ce6184a",
"previous_producer_consumer_refusal_sha256": "a1ed14e6b2db1ae77c3fd638fd7e47b5bd50c25eebba418e31aba89bb4b7f88e",
"lifecycle_proposal_id": "KEY-WP-0039-T02/attended-lifecycle-v9-ready-input",
"previous_pair_source_refusal_sha256": "8353eb8aae11be8ce874887d6a5ca10bf37c6fba73c3f85f0644a7546dd7d33f",
"previous_source_refusal_sha256": "38abf660701194f85934a076a0c01d3047e6bfe790e02ba1b0e4616e356634e6"
}

356
docs/openbao-negative-token-producer-decision.md Normal file
View file

@ -0,0 +1,356 @@
# KEY39 private token producer and node-route decision packet
Proposal `KEY-WP-0039-T02/private-producer-handoff-v1`, source preparation only.
Lifecycle V5 is unchanged (manifest d1f997624db46693a7126a6eb6435f6b3a353d5bd67dcc8a539683e4b7147285).
This packet names concrete supported flows and a reviewable local handoff. It
supplies no admitted credential route, authenticated approval or native readiness.
T01 stays done and T02 open; no new workplan or task is created.
## Existing flows and exact owner choice
Choose existing `netkingdom-bootstrap-console` for the human class refusal if
NetKingdom/founder approve this one attended use of their existing client and
literal `http://127.0.0.1:8876/oidc/callback` listener. Its source registration is
public authorization_code, scopes openid/profile/email/groups, default audience
netkingdom-bootstrap-console. Request only `openid`; do not request approval or
OpenBao permissions. `keycape login` verifies RS256 issuer/access audience/scopes,
ID-token client audience/nonce and matching subject. It binds before emitting a
browser URL, validates exact callback host/path/state, uses S256 PKCE, and has a
five-minute attempt bound. The provider handles password/MFA. Fresh deployed
MFA/registration evidence is required; the handoff requires human aal2/mfa=true.
Do not infer MFA from the client fragment: it has no per-client mfaRequired pin.
Do not run the bootstrap console simultaneously on port8876. The same client's
localhost callback is not substituted: the CLI requires a literal loopback IP.
Concrete producer invocation after that decision, on the attended workstation:
```
keycape login --issuer https://kc.coulomb.social \
--client-id netkingdom-bootstrap-console --audience netkingdom-bootstrap-console \
--scope openid --redirect-uri http://127.0.0.1:8876/oidc/callback \
--out /OWNER-PRIVATE-TMPFS-DIR/key39-human.json
```
The private directory is new owner-controlled mode0700 tmpfs outside Git; the
CLI creates the file mode0600 exclusively. No invocation is performed here.
Current browser access-token lifetime is server TokenLifetime; per-client
TokenLifetime is used only for client_credentials. Do not promise a new one-minute
human lifetime by adding that field to a browser registration.
Alternative only if the owner rejects existing-client use: request one separately
reviewed public client `key39-negative-human`, audience of the same name, exact
callback `http://127.0.0.1:8877/oidc/callback`, scopes [openid], grantTypes
[authorization_code], mfaRequired true, no role/serviceSubject/secretRef. That
requires a new source registration, reviewed native merge/rollback and changed
handoff audience binding. It is not part of V5's six temporary clients and must
not silently enter that mutation. The current adapter intentionally refuses it.
Reuse of informed-decision-approver is unsuitable for this CLI: its registered
callback is HTTPS decisions.coulomb.social, not literal loopback. OpenBao admin
is another source-compatible callback but its admin relying-party purpose is
unnecessary for this probe and is not the selected plan.
Coding-agent producer is exactly the existing accepted source identity:
```
keycape service-token --issuer https://kc.coulomb.social \
--client-id codex-railiance-platform --audience codex-railiance-platform \
--scope openbao:login --secret-env KEYCAPE_CODEX_RAILIANCE_PLATFORM_CLIENT_SECRET \
--out /OWNER-PRIVATE-TMPFS-DIR/key39-agent.json
```
Subject service:codex:railiance-platform, tenant:platform, roles [coding-agent],
principal_type service; fifteen-minute JWT, no refresh or ID token. The secret
must arrive from an existing **admitted** owner-controlled delivery. No client
secret request or generation occurs here. A source fragment is not live
registration or consumer entitlement. The inspected Platform operational identity
is AppRole; its OpenBao token cannot substitute for this JWT. Its historical
coding-agent prose still names tenant:coulomb, whereas current KeyCape source
uses tenant:platform. Platform must reconcile its exact proposed/installed
metadata, not use that historical prose as evidence.
No reviewed coding-agent client-side custody reader/consumer delivery receipt
was found in the inspected CCR/registry sources. Platform must either return
exact existing admission coordinates and fresh live registration/delivery evidence
or own a new narrow custody/issuer/consumer admission proposal. Do not borrow
secrets-engine's credential, widen its role, read raw KV, or mint an ephemeral
coding-agent lookalike to manufacture this case. If unavailable, the joint
session remains blocked and coding-agent refusal inconclusive; V5 requires both
private token inputs and cannot silently skip the case.
## Private handoff adapter
`scripts/openbao_negative_private_handoff.py` adapts the two existing CLI files
to V5 private stdin JSON keys human_token and coding_agent_token. It makes no
network request, login, secret retrieval, registration, deployment or executor
launch. The source is Linux main-thread only. Before file consumption it requires
an inherited **writable pipe FD >=3**, never stdout/stderr, a new owner mode0700
non-symlink directory outside Git, single-link mode0600 regular files owned by
the current UID, bounded reads and unchanged inode/size/timestamps. JSON rejects
duplicate/nonfinite keys; token length is bounded. Both files must be distinct.
A second inode/metadata compare immediately precedes each unlink.
The adapter checks decoded issuer/audience/principal/agent claims and at least
300 seconds remaining lifetime, plus human MFA shape. These are not signature
verification or authenticated custody: its tests deliberately use unsigned
synthetic JWT shapes. The founder must run the pinned current KeyCape CLI and
retain exclusive custody continuously; arbitrary downloaded/preexisting files
are inadmissible despite matching mode or claims. CLI signature verification is
the issuer-verification boundary. Require a fresh remaining-lifetime check before
native execution and ensure token validity through the actual presentation; the
five-minute adapter floor is not a grant for a longer session.
Explicit `--consume-owner-files` authorizes removal of precisely these inspected
caller-owned files. After both load successfully, the adapter consumes them
before writing the pipe and closes its inherited endpoint on every exit. Partial
unlink failure records possible retained files; partial/broken/timed-out delivery
records unknown delivery and must stop before native mutation, with no retry.
Delivery has a hard five-second SIGALRM bound; preexisting timer refuses and
handler/timer state is restored. Receipts contain booleans and fixed failure
codes only; a pipe write completion does not prove downstream validation or native
acceptance. No stdout token path exists. A private pipe still requires a trusted
consumer: the adapter cannot authenticate its peer, approval JSON or native go.
The founder-reviewed launcher must create the pipe and start a pinned destination
wrapper before running the adapter with that endpoint inherited as FD3. The
wrapper may invoke the already approved SSH transport to railiance01 and forward
stdin without PTY, shell tracing, tee, terminal/stdout copies, token argv/env,
logging, agent custody or persistent remote files. The destination reads the
private JSON with V5; no additional file copy. Exact workstation producer and
node wrapper paths, hashes, SSH host identity/transport grant, consumer startup
order, refusal gating and receipt handling must be owner-reviewed first. This
packet does not ship or admit such a launcher and cannot claim a full handoff.
Token files must be consumed before starting V5; on failed preparation the owner
removes remaining exact files. This packet requires founder choice to admit the
two bounded caller-owned JWT files: V5's no-copy rule for generated six client
secrets is unchanged. Python memory/Unix unlink are not secure-zeroization claims;
use an owner tmpfs directory and process termination. Issued JWTs expire normally.
No issuer-side JWT revocation is claimed. Any OpenBao acceptance remains V5's
bounded self-revoke/Platform reconciliation obligation.
## Mandatory route and decision ordering
The child is a Linux main-thread process on railiance01 using its k3s kubeconfig.
Workstation loopback18200 tunnel evidence does not prove node loopback18200;
openbao.openbao.svc normally resolves from Pods, not necessarily the host. Keep
native proposal gated until Platform/NetKingdom verify one of V5's exact origins
**from the actual node process placement**, using a separately reviewed founder
port-forward path if required. Do not expand V5 origins or use workstation role
observations as route proof.
Before any token exchange, temporary credential generation, Secret creation,
registry/env mutation or restart, the owner preflight must run a bounded public
Bao health request from that exact placement to the selected origin. It follows
no redirect or ambient proxy, caps response bytes and total elapsed time, sends
no auth header and prints only normalized initialized/unsealed/health booleans.
Verify acceptable active/standby health semantics independently, current TLS or
local port-forward ownership, no unintended public bind and non-secret issuer
connectivity. No auth, KV/data path or raw error output. The V5 transport currently
allows login/revoke only; this additional public health/route preflight belongs
in the reviewed launcher/NetKingdom guard, not an unreviewed V5 edit.
Owner sequence: select source plan -> independent KeyCape/NetKingdom/Platform
reviews -> approved exact launcher plus route/health preflight -> admitted
producer/custody and human browser attempt -> private-pipe delivery -> destination
validates complete stdin/envelope/source/runtime/role receipts -> native action
only under fresh exact founder authorization -> V5 cleanup/revoke plus producer
cleanup. Any unavailable route/custody/client/complete input keeps T02 open.
## Exact acknowledgments still required
- KeyCape: selected client/claims/CLI verification, lifetime and MFA source;
this packet is preparation, not a formal source acknowledgment of a launcher.
- NetKingdom: actual existing registration/image, client reuse and callback
listener ownership, browser/workstation/node placement, guarded public health
preflight ordering and exact restart/cleanup runtime pins.
- Platform: coding-agent existing custody/consumer entitlement or new proposal,
corrected tenant metadata, route/port-forward ownership, fresh bounded role/
leeway/effective-policy observation, session revoke and unknown reconciliation.
- Founder: existing-client purpose reuse versus new registration, explicit private
tmpfs JWT-file allowance, admitted exact launcher/transport/target/window/cleanup
obligation and actual supervised custody. Source acceptance is not that go.
18 synthetic adapter checks pass: successful private write and file consumption,
stdout/stderr/regular/read-only FD refusal, explicit consumption, symlink/hardlink/
public mode/parent/Git/oversize/duplicate JSON refusal, wrong audience/MFA/tenant/
role/AppRole/expiry refusal, replacement before unlink, hard write timeout with
signal restoration and value-safe partial/broken delivery. Original V5/failed
review histories and all source/current owner records remain retained.
# V2 correction and exact child-ready integration
The V1 packet text above is retained history. Proposal
`KEY-WP-0039-T02/private-producer-handoff-v2` supersedes its unsafe no-ready
adapter and its precise-inode-removal wording. V1's immutable manifest239aaa
and NetKingdom consumer refusal a1ed14e6b2db1ae77c3fd638fd7e47b5bd50c25eebba418e31aba89bb4b7f88e
remain recorded as the same correction trial. The exact compatible consumer is
`KEY-WP-0039-T02/attended-lifecycle-v9-ready-input`, separately pinned below;
V5/V6/V7/V8 source/review history is never implicitly repinned. No owner admission
or founder go is supplied by V2.
The KeyCape launcher is `scripts/openbao_negative_private_launcher.py`. It
validates its own and its adjacent adapter's exact source hashes plus the local
copy of the exact remote envelope. The remote child/wrapper paths and hashes
must occur in that envelope; proposal/target/source owner receipts, finite
window/health pin and founder/file-allowance receipt references must match the
reviewed contract. These fields are procedural constraints only: editable JSON
cannot authenticate approval. The founder must authenticate/retain the actual
exact disposition and own this entire launcher/custody/host context.
The source launcher alone creates SSH stdin/stdout pipes, a fresh random256-bit
nonce and fixed direct SSH argv to railiance01. It uses no PTY, strict existing
host-key checking, batch mode, no agent forwarding, no remote forwarding, finite
connection/keepalive bounds, and a minimal environment that excludes confidential
client credentials. It does not create or request a certificate, token, credential
or route. This is a proposed **separate founder-admitted direct SSH profile**:
the normal warden silent lane has different stdout rules and is not silently
repurposed. The founder/transport owner must review actual node host identity,
SSH certificate/session entitlement and pinned remote paths before execution.
No SSH command was invoked during preparation.
On railiance01 the independently NetKingdom-owned pinned wrapper creates a
local dedicated child-ready pipe and launches the exact pinned Python child
with inherited SSH stdin. No invented extra SSH file-descriptor forwarding is
used. Only after exact source/envelope checks, original action-window start and
pinned public Bao health succeeds does the child emit a bounded value-free
marker to that local pipe, close it, and enter the V8 bounded private receiver.
The wrapper validates that local marker and forwards exactly one newline JSON
marker on SSH stdout. SSH stdout stays open until child completion; Key reads
only to the first newline, never waits for SSH stdout EOF. Child stdout/stderr
stay suppressed; protected receipt remains exclusive on the node.
Ready schema `key39-private-input-ready/v1` has exactly these keys:
schema, session_nonce, proposal_id, target, executor_sha256, envelope_sha256,
bao_health_identity_sha256, valid_until_epoch, receive_budget_seconds. Marker
must bind the new nonce and exact consumer proposal/target/source/envelope/health
pin and epoch; receive budget must be finite nonboolean, positive and <=15s.
Marker size is <=4096 bytes. An old/missing/malformed/mismatched/failed/expired
ready marker produces **zero token file loads, zero consumption, zero private
bytes**, then closes local endpoints. A readiness marker is not authentication,
JWT verification, custody admission, routing authority or a live grant. It is
trusted only because the reviewed launcher captures the intended pinned wrapper
under the separately admitted authenticated host/session context. There is no
standalone adapter CLI accepting a ready file, boolean or user-provided marker.
The adapter validates two distinct kernel pipe identities: private data endpoint
write-only, control endpoint read-only, each FD>=3 and each device/inode distinct
from stdin/stdout/stderr and from each other. Actual duplicates of stdout/stderr
are refused even when their descriptor number is >=3. Captured SSH stdout is a
separate control pipe owned by the launcher; it never becomes token output.
The launch preparation cap is5s. The adapter has one total5s deadline covering
ready wait, caller-file load, cleanup and delivery. After ready this existing
timer only clips downward against its remaining budget, received child budget
and current remaining approval lifetime. Advertised child budget is not compared
as <=current remaining wall time (transport necessarily consumes time); the
actual delivery timer clips to both. Before each write and after completion the
same absolute expiry/monotonic delivery bound is rechecked. No retries or clock
reset; stdin closes to provide complete EOF. A partial write, transport break or
expiry remains unknown and cannot be native proof. Launcher waits only for a
value-free child/transport exit under remaining action +300s cleanup +30s margin;
local transport teardown never proves remote custody or process reconciliation.
Native receipt/unknown-session acceptance remains Platform/NetKingdom's.
## Honest file-cleanup boundary
Owner mode0700/0600, no symlink/hardlink/Git and unchanged identity/size/time
checks remain. **The compare and unlink are not atomic inode-conditioned delete.**
Continuously exclusive same-UID custody of the directory, no concurrent writers
and no attacker sharing that UID are mandatory for this proposed file approach.
No helper boolean can prove that condition. The founder must control the new
private tmpfs directory/process context and retain exclusive custody; no shared
agent/shell/daemon may modify it. Any known interference requires abort and owner
reconciliation before another attempt.
V2 removes V1's exact-inode/atomic implications. Its retained stat-to-unlink race
check deliberately shows that a concurrent same-UID replacement can still be
removed; that is outside the admitted exclusive-custody assumption and is not
represented as a fixed filesystem capability. Even after nominal path removal,
receipts retain `atomic_inode_delete_guaranteed=false`,
`exclusive_same_uid_custody_required=true`, `credential_copy_cleanup_verified=false`
and `credential_files_remain_possible=true`. `caller_path_removal_completed`
means only these unlink calls completed under that assumption. It is not token
copy inventory, secure erase or cleanup proof. Owner verification/process
termination/tmpfs teardown remains required; issued JWTs expire normally.
If that exclusive context cannot be admitted, do not use these private files;
separately implement/review a process-to-process in-memory producer instead.
The existing human-client reuse versus new registration, live MFA, coding-agent
client-side custody/consumer delivery, exact authenticated launcher/SSH profile,
private tmpfs files/exclusive custody, actual node route/provider/role/leeway,
quiet restart window and fresh founder disposition are still unapproved choices.
This source packet does not resolve them. Source-pinned readiness eliminates
premature token transport only within the admitted trusted launcher context.
Exact compatible consumer manifest SHA256 84542ddcff00932fc7ce22dcb2626be8942a3c006c5098a62fdd6b2478d0cd14;
child 24b7b803e4eb7e6e7c0700a069dad0ec315ee7eb5538a88b9e56147f8fab5cdd;
node wrapper 76ac013d1a676a0dfa58aea1ce87b0c3e72483ccd21f586a22c5475e9132f6c1.
31 distinct supplied producer/launcher synthetic checks pass; 74 supplied
compatible consumer source checks pass. No actual SSH, login, tokens, custody
or native route was used. Fresh independent consumer and Platform source
reviews of this exact V2 and V9 remain necessary before founder choice.
# V3 remote-unknown reporting correction
Proposal `KEY-WP-0039-T02/private-producer-handoff-v3`. Exact NetKingdom V9
manifest84542ddc and child/wrapper bytes are unchanged; this is only a new Key
launcher reporting revision in the same preparation trial. Platform V2 pair
review finding RPF-KEY39-PAIR-V2-F01 is retained unchanged, SHA256
8353eb8aae11be8ce874887d6a5ca10bf37c6fba73c3f85f0644a7546dd7d33f.
After copying adapter outcome, `private_input_delivery_unknown=true` immediately
sets sticky `consumer_outcome_unknown=true` and `consumer_process_completed=false`
before any failure/early return. A complete payload can reach the remote child
before local write/EOF confirmation times out. Terminating local SSH cannot
prove that no remote operation occurred, that the child stopped or that remote
custody/cleanup completed. No retry or subsequent local success rewrites this
attempt. Native acceptance and unknown resolution stay independent owner duties.
33 distinct checks pass, including actual full kernel-pipe JSON write followed
by SIGALRM interruption before confirmation, and an actual4096-byte partial
write/timeout; both retain remote unknown after local terminate. No actual SSH,
protected consumer or credentials were involved. All V2/V1 source, unsuccessful
reviews and previous narrow issuer acknowledgments remain frozen history.
Exact source return and all prior native/client/custody/transport/file choices
remain required. Source reporting correction is not runtime admission.
# V4 source-acquisition and shared preparation deadline correction
Proposal `KEY-WP-0039-T02/private-producer-handoff-v4`, same trial. The exact
Net V9 manifest84542ddc and child/wrapper are unchanged. NetKingdom V3 consumer
refusal NET-PRODUCER-V3-F01 stays frozen, SHA256
38abf660701194f85934a076a0c01d3047e6bfe790e02ba1b0e4616e356634e6. V1/V2/V3 source and earlier acknowledgments/refusals remain history.
Actual CLI now starts one absolute monotonic5-second preparation deadline before
contract acquisition. Initial source read, source/envelope/hash checks and SSH
spawn then ready/file/consumption/write phase all use only remaining time from
that original deadline. Phase timers may disarm/rearm, but each is clipped to
original remaining time; launch never restarts the budget spent reading contract.
After ready, child receive budget and absolute approval expiry only clip further.
Once private input is delivered, existing separate action/cleanup completion
wait remains; it cannot renew preparation or mutation authority.
Contract/envelope reads use bounded4096-byte chunks, at most65536 bytes, absolute
paths, no observed symlink ancestry, O_NOFOLLOW/O_NONBLOCK, single-link regular
files with no group/world write, and stable device/inode/UID/mode/link/size/time
comparisons. FIFOs/devices/symlinks/empty/oversized files refuse before private
file access/SSH. Source digest reads share that path with at most262144 bytes.
All actual CLI source acquisition runs under the finite remaining preparation
alarm; a stalled filesystem call cannot escape this total deadline. Observed
path/source races refuse; continuously trusted exclusive custody remains required
and no atomic pathname/exec protection or authenticated metadata grant is claimed.
40 distinct producer/launcher checks pass, including actual CLI FIFO/symlink/
oversize refusal, delayed regular read under the hard timer with restored signals,
a main contract-read delay followed by launch delay that cannot renew the budget,
source drift/chunk bounds and earlier actual full/partialwrite stickyunknown.
Nine retained real paired handshake regressions also pass using actual pinned
Net wrapper and child main with only local fake SSH/health/execute substitutions:
no network, Kubernetes, protected credentials or native mutation. The original
Net fixture files are copied unchanged except the Key stage path, solely as
source regression evidence, never a new foreign formal owner review.
Fresh exact independent pair source returns and all unadmitted human/MFA/client/
coding-agent custody/consumer/directSSH/exclusive tmpfs/route/provider/role/leeway/
readiness-Argo/maintenance-exception/founder/native-acceptance duties still gate
use. No source-only helper choice, ready marker or editable approval JSON supplies
that authority. T01done/T02open; actual native outcome remains pending.

100
docs/proposals/2026-10-11-key39-founder-source-design-decision.json Normal file
View file

@ -0,0 +1,100 @@
{
"schema": "founder-source-design-choice/v1",
"proposal_id": "KEY-WP-0039-T02/founder-source-design-v1",
"status": "pending_founder_source_direction_only",
"submitted": false,
"memo_sha256": "1816e48b44eb874e4c97db82ee56ed27c23083ddcfc322d9de9876132e802688",
"source_pair": {
"key_producer_manifest_sha256": "d6f641dc1e4aae7d36658d4199d89af14d2fd7a4bd4e526856eb340234f2d33e",
"net_consumer_manifest_sha256": "84542ddcff00932fc7ce22dcb2626be8942a3c006c5098a62fdd6b2478d0cd14",
"net_qualified_consumer_review_sha256": "9566955b77db4a0b041887ef4a6aff6c7a02ef30cc0727a4deb6c29bbdc79518",
"platform_fresh_exact_pair_source_return": "required separately"
},
"choices": [
{
"id": "human_producer",
"recommended": "existing_bootstrap_console_purpose_reuse_source_direction",
"options": [
"existing_bootstrap_console_purpose_reuse_source_direction",
"new_narrow_public_client_source_proposal",
"defer"
],
"selected": null,
"exact_existing_client": "netkingdom-bootstrap-console",
"exact_audience": "netkingdom-bootstrap-console",
"scope": "openid",
"callback": "http://127.0.0.1:8876/oidc/callback",
"pending": [
"Net owner purpose reuse/live registration",
"Sole intended workstation CLI listener; no existing port8876 occupant",
"Actual provider MFA receipt; verified aal2/mfa claims"
]
},
{
"id": "coding_agent",
"recommended": "return_existing_admission_or_prepare_narrow_platform_proposal",
"options": [
"return_existing_admission_or_prepare_narrow_platform_proposal",
"defer"
],
"selected": null,
"client_audience": "codex-railiance-platform",
"subject": "service:codex:railiance-platform",
"tenant": "tenant:platform",
"scope": "openbao:login",
"custody_admission_receipt": null,
"consumer_coordinates": null,
"new_ccr_number": null,
"approle_jwt_substitution_allowed": false
},
{
"id": "transport",
"recommended": "retain_proposed_founder_direct_ssh_source_profile",
"options": [
"retain_proposed_founder_direct_ssh_source_profile",
"redesign_and_review",
"defer"
],
"selected": null,
"host": "railiance01",
"compatible_with_warden_silent_lane": false,
"authenticated_host_session_entitlement_receipt": null,
"runtime_paths": null,
"granted": false
},
{
"id": "private_material",
"recommended": "conditionally_retain_exclusive_owner_tmpfs_file_source_design",
"options": [
"conditionally_retain_exclusive_owner_tmpfs_file_source_design",
"review_in_memory_producer_design",
"defer"
],
"selected": null,
"exclusive_same_uid_custody_verified": false,
"file_allowance_receipt": null,
"atomic_unlink_claimed": false,
"secure_zeroization_claimed": false
}
],
"permitted_effect_of_source_direction": "Owner source/design preparation and exact independent review only",
"cost_and_risk_scope": {
"external_spend_authorized_eur": 0,
"native_cost_risk_decision": "separate future scoped proposal required",
"source_risks": [
"Purpose reuse/MFA/callback listener unadmitted",
"Coding-agent custody missing",
"Distinct SSH profile/session identity unadmitted",
"SameUID private-file exclusivity non-atomic/no zeroization",
"Provider/plugin/role/leeway and readiness/Argo/maintenanceexception facts pending"
]
},
"native_authorized": false,
"credentials_or_login_authorized": false,
"ssh_or_portforward_authorized": false,
"registrations_or_restart_authorized": false,
"architecture_whole_v0_9_accepted": false,
"agent_autonomy_promoted": false,
"standing_privilege_or_default_flip": false,
"KEY39_T02_closed": false
}

158
docs/proposals/2026-10-11-key39-founder-source-design-decision.md Normal file
View file

@ -0,0 +1,158 @@
# Founder source-design choice for KEY39 private input
Proposal ID: `KEY-WP-0039-T02/founder-source-design-v1`.
Disposition: pending founder choice. Scope: source-design direction only.
Recommended: retain the existing bootstrap-console human client for one attended
negative-class producer, require Platform to return exact existing coding-agent
admission or a new narrow owner proposal, and retain the reviewed direct SSH
ready-channel design for later separate admission. Approving that direction
allows owner source preparation and review. It does not allow a login, credential
request/read, client registration, port-forward, SSH session, native preflight,
issuer restart or mutation.
## Exact source under consideration
Key producer V4 manifest:
`d6f641dc1e4aae7d36658d4199d89af14d2fd7a4bd4e526856eb340234f2d33e`,
`/tmp/keycape-jwt-producer-handoff-v4-stage/manifest.json`.
Net consumer V9 manifest:
`84542ddcff00932fc7ce22dcb2626be8942a3c006c5098a62fdd6b2478d0cd14`,
`/tmp/keycape-jwt-ready-v9-stage/manifest.json`.
Launcher `46e57504b3185cc13f1656901a0ca02cc3887527cb09566e270f57b76099ab9c`;
adapter `faf63a3e9504dcbb46847a114275f83d508521e095410a47f92f02b86ba82b1b`;
child `24b7b803e4eb7e6e7c0700a069dad0ec315ee7eb5538a88b9e56147f8fab5cdd`;
node wrapper `76ac013d1a676a0dfa58aea1ce87b0c3e72483ccd21f586a22c5475e9132f6c1`.
NetKingdom's exact qualified consumer source agreement:
`9566955b77db4a0b041887ef4a6aff6c7a02ef30cc0727a4deb6c29bbdc79518`.
Its 40 maker and 13 independent checks establish source behavior with synthetic
transport/health/private tokens. Platform's fresh exact-pair source return is
required separately. KeyCape's issuer/interface judgment stays inside its INTENT
Tooling boundary. No source return is a protected-operation entitlement.
## Choices to record
| Choice | Recommended source direction | Alternative and consequence |
|---|---|---|
| Human producer | Owner-permitted reuse of `netkingdom-bootstrap-console` for one attended CLI session; request `openid` only. | If NetKingdom rejects purpose reuse, propose public `key39-negative-human`, audience same name, literal callback `http://127.0.0.1:8877/oidc/callback`, scopes [openid], authorization_code, mfaRequired true. This needs a new source/registration/rollback packet and changed adapter audience. No registration is implied. |
| Coding-agent input | Require Platform's exact existing `codex-railiance-platform` live registration and client-side custody/consumer delivery receipts. | If missing, stop this native case and let Platform prepare a narrow custody/issuer/consumer admission proposal with coordinates/owners settled first. No invented CCR number or entitlement; AppRole is not a JWT substitute. |
| Transport source profile | Retain proposed founder-owned direct SSH captured-control profile to railiance01, with pinned child/wrapper/envelope and exact-child-ready gate. | If that profile cannot be independently admitted, keep the native session gated and redesign/review a compatible transport. Do not reuse the warden silent lane or eager shell piping. |
| Caller-token material | Source-design option: two owner-created private tmpfs files, mode0700 directory/mode0600 single-link files, then explicit consumption and pipe-only transfer. | If continuously exclusive same-UID custody cannot be established, do not use the file design; separately review an in-memory producer. Source approval does not admit either custody mechanism. |
No answer, partial answer or rejected choice defaults to a gated native session.
The recommendation is a direction for source preparation, not an automatic
registration, credential generation or admission.
## Human identity, callback and MFA contract
Exact candidate client/audience: `netkingdom-bootstrap-console`.
Issuer: `https://kc.coulomb.social`. Requested scope: `openid`.
Literal callback: `http://127.0.0.1:8876/oidc/callback`.
The current source registration is public authorization_code and lists this
literal callback separately from localhost. KeyCape CLI requires literal
loopback, binds `127.0.0.1:8876` before emitting its browser URL, and accepts
only GET, exact Host `127.0.0.1:8876`, exact path `/oidc/callback`, one matching
state and one code. Fresh state/nonce/S256 PKCE, five-minute attempt timeout,
RS256 discovery/JWKS verification, access audience/requested scopes and ID-token
client audience/nonce/matching subject remain the existing source contracts.
Do not alias localhost, change a callback string or redirect a browser to the
node. Producer and browser are on the founder-owned workstation.
Before any future attempt, NetKingdom must confirm this exact client is live,
accept its proposed CLI purpose reuse, establish that no bootstrap console or
other listener owns port8876, and identify the sole intended CLI listener/process
in the attended workstation context. Bind failure stops, never kills or adopts
another listener. A public callback and source registration alone are not that
runtime evidence.
This registration has no per-client mfaRequired pin. Earlier deployment-default
MFA statements are historical, not current proof. The future owner receipt must
confirm actual provider/client MFA behavior; producer handoff requires verified
human claims `assurance.level=aal2` and `assurance.mfa=true`, not an unenforced
caller label. The CLI cryptographically verifies returned tokens; the adapter's
decoded shape check does not. A human token may differ on audience/tenant/roles
as well as principal_type, so this is human-class refusal, not isolated proof
of principal_type enforcement. Browser access-token lifetime uses the server
lifetime; adding per-client tokenLifetime does not shorten that flow.
## Coding-agent contract and actual missing custody
Exact accepted source identity:
client/audience `codex-railiance-platform`, subject
`service:codex:railiance-platform`, tenant `tenant:platform`, roles [coding-agent],
principal_type service, scope `openbao:login`, fifteen-minute JWT.
Secret reference name: `KEYCAPE_CODEX_RAILIANCE_PLATFORM_CLIENT_SECRET`.
This is a reference, never a value or a request for one.
Source acceptance does not prove the client is live or supply consumer-side
secret injection. No admitted coding-agent custody/consumer receipt was found
in the inspected source set. Platform must return exact existing admission and
fresh registration/delivery ownership or prepare a separate narrow proposal.
Historical Platform coding-agent prose names tenant:coulomb and describes an
operational AppRole; it cannot supersede current tenant:platform issuer source
or manufacture the requested JWT. Do not skip this case, borrow secrets-engine's
credential, retrieve raw KV, widen an AppRole/policy or make a temporary coding-
agent lookalike. Full KEY39 native evidence remains incomplete until settled.
## Proposed source profile and trust limits
The source launcher creates captured stdin/data and stdout/control pipes for a
fixed direct SSH command to railiance01: no PTY, strict existing host-key checking,
batch mode, no agent forwarding or remote forwarding, bounded connect/keepalive
and credential-excluding environment. The node wrapper creates a local ready
pipe; SSH does not forward arbitrary extra file descriptors. Child/wrapper/
envelope hashes, exact target `sso/keycape`, proposal, fresh nonce, public-health
identity hash, original finite window and receive budget bind the returned marker.
No marker means zero caller-token loads/consumption/private bytes. Caller STDIO
aliases are refused by kernel pipe identity. Source acquisition and handoff share
one original five-second preparation budget; V8's bounded complete EOF receive
and original action/cleanup limits remain. Uncertain delivery stays remote
consumer uncertainty after local SSH termination.
This captured control stdout profile is **incompatible with the existing warden
silent-output lane**. It is not an exception inferred from shell prefixes or
source review. Future direct SSH admission must name the authenticated founder
identity/session/certificate entitlement, exact host key/transport/runtime paths,
producer/consumer process identities and custody/window/cleanup obligations.
No certificate, credential, SSH access or profile activation is requested here.
The ready marker synchronizes source readiness; it does not authenticate a peer,
issuer, provider, founder decision or privileged grant by itself.
The file option requires continuously exclusive same-UID directory custody, no
concurrent writer and owner tmpfs/process teardown. Stat/unlink is non-atomic.
Receipts explicitly keep atomic delete and copy cleanup unverified and possible
copies true. Unix unlink/Python memory are not secure-zeroization guarantees;
remaining or unknown copies/sessions require owner reconciliation. If these
assumptions cannot be established, the file option must remain unused.
## Facts still required before a separate native decision
NetKingdom/Platform must verify the actual same-node route. Workstation
loopback18200 does not prove node loopback18200; Pod DNS is not assumed for the
host. A public health cluster digest detects changes but does not authenticate
the provider. Actual admitted route/Service/cluster identity, freshly observed
installed JWT plugin, role/config/effective policies and all expiration,
clock-skew and not-before leeway interactions are pending native facts.
Issuer readiness_state, actual Argo ownership and production-tier mapping must
be established authoritatively. Absence of a declaration is not nonproduction.
If adopted/production-approved, temporary direct CAS changes require an explicit
reviewed one-use maintenance exception, close-down entry and reconciliation.
Headroom, quiet restart window, exact runtime revision, approved temporary names
and cleanup/recovery remain required.
Future native founder go must be a distinct authenticated scoped disposition for
exact approved source/runtime/target/window/route/producer/credential custody and
bounded abort/revoke/restoration/recovery duties. Source-design approval today
cannot be replayed as that go. Actual eight refusals including expiry positive
control, revoked unexpected acceptance, baseline restoration/removed clients/
temporary-object absence/private-copy reconciliation remain required afterward.
This memo approves no architecture-wide v0.9 acceptance, agent autonomy promotion,
standing privilege/default flip, routing activation, native KEY39 closure,
Platform/Mason acceptance or Secrets Engine full adoption. It leaves T01done and
T02open under the existing work record, with all failed/revised source history.

74
docs/reviews/2026-10-11-key39-v9-v4-keycape-source-ack.json Normal file
View file

@ -0,0 +1,74 @@
{
"schema": "owner-source-review/v1",
"review_id": "KEY-ACK-20261011-KEY39-V9-PRODUCER-V4",
"reviewer": "codex acting in KeyCape issuer-owner scope",
"role_scope": "KeyCape INTENT authentication/issuance/claims and caller token lifecycle only",
"decision": "approved",
"qualification": "Exact bounded issuer/private interface source compatibility only; all native/transport/custody/founder admissions remain false",
"consumer_proposal_id": "KEY-WP-0039-T02/attended-lifecycle-v9-ready-input",
"consumer_manifest_sha256": "84542ddcff00932fc7ce22dcb2626be8942a3c006c5098a62fdd6b2478d0cd14",
"producer_proposal_id": "KEY-WP-0039-T02/private-producer-handoff-v4",
"producer_manifest_sha256": "d6f641dc1e4aae7d36658d4199d89af14d2fd7a4bd4e526856eb340234f2d33e",
"work_record": {
"task": "KEY-WP-0039-T03",
"status": "done",
"same_task_refinement": true,
"current_owner_work_record_sha256": "57d5f1a9cd5d15737d47a9273bf01355ba818b2748e1a43fd7ff2138bed50f4f",
"completed_inspection_receipt_path": "/tmp/keycape-jwt-v9-v4-owner-decision-stage/key-cape/docs/reviews/2026-10-11-key39-v9-v4-keycape-work-record.json",
"completed_inspection_receipt_sha256": "b5074fdc22eb8f62ae035254bfb8311272cf8a7ec6ed14b60eebd14f5ef4046c",
"completed_before_formal_acknowledgment": true
},
"scope_accepted": [
"Original finite source/window/public health gates precede nonce-bound ready and complete bounded private input; action window is not renewed",
"V4 actual CLI regular bounded nofollow/nonblock stable source acquisition starts under one ORIGINAL5s preparation budget shared with launch/ready/filewrite",
"Exact child/wrapper/envelope/health/window source marker matches private Key reader before ANY token load/consume/write; fixed owner-created SSH data/control pipes and stdio alias refusal",
"Private uncertain write remains sticky remote uncertainty after local transport teardown; full/partial failure histories retained",
"Existing issuer/client claim design, original runner and explicit unauthenticated shape/ready metadata limits unchanged",
"Non-atomic unlink requires continuous exclusive sameUID custody; copy cleanup remains unverified/possible"
],
"findings": [],
"fresh_qualified_net_consumer_review": {
"path": "/tmp/netkingdom-key39-producer-v4-consumer-review-stage/owner-review.json",
"sha256": "9566955b77db4a0b041887ef4a6aff6c7a02ef30cc0727a4deb6c29bbdc79518",
"source_only": true,
"not_a_KeyCape_Net_runtime_review": true
},
"validation": {
"key_source_tests_retained": 40,
"net_exact_pair_independent_checks": 13,
"own_fresh_interface_tests": 3,
"all_passed": true,
"own_checks_path": "/tmp/keycape-jwt-v9-v4-owner-decision-stage/evidence/test_keycape_ready_interface.py",
"own_checks_sha256": "ba85e5ff2cda5c7c2cc86f50bde67bca027e2e63be1c5195f06764b8e1cd5716",
"synthetic_unsigned_private_fixtures_only": true,
"native_or_credentials": false
},
"excluded": [
"Net formal runtime/route/port-forward/restarts/cleanup acceptance",
"Platform formal provider/plugin/role/policy/leeway/custody/PEP/backend acceptance",
"Founders actual identity/session/source/runtime/route/window/native decision",
"Human client purpose/MFA/listener and coding-agent live custody/consumer admission",
"Direct SSH profile, file allowance/exclusive UID context, authenticated transport/runtime authority",
"Whole architecture v0.9 acceptance, autonomy promotion, standing privileges/default flips or native task closure"
],
"pending_platform_exact_pair_return": "Required separately; old V2pairrefusal is not repinned",
"founder_source_design_memo": {
"path": "/tmp/keycape-jwt-v9-v4-owner-decision-stage/key-cape/docs/proposals/2026-10-11-key39-founder-source-design-decision.md",
"sha256": "1816e48b44eb874e4c97db82ee56ed27c23083ddcfc322d9de9876132e802688",
"status": "unsubmitted source-direction choice only",
"native_go": false
},
"sources_receipt_sha256": "2a7a587264ceeb902040417d0bc5c329af461590d8bc99edf818ec5699f0a5b0",
"prior_v2_bound_ack_sha256": "8293e18dcffe7b8e0748880753974219b99d347a173f75a32cc1aad2b4c30f95",
"preserved_refusals": [
"a1ed14e6b2db1ae77c3fd638fd7e47b5bd50c25eebba418e31aba89bb4b7f88e",
"8353eb8aae11be8ce874887d6a5ca10bf37c6fba73c3f85f0644a7546dd7d33f",
"38abf660701194f85934a076a0c01d3047e6bfe790e02ba1b0e4616e356634e6"
],
"same_trial_no_additional_scored_success": true,
"native_authority_granted": false,
"native_route_observed": false,
"private_producer_admission": false,
"founder_design_disposition_submitted": false,
"KEY39_T02_closed": false
}

168
docs/reviews/2026-10-11-key39-v9-v4-keycape-source-ack.sources.json Normal file
View file

@ -0,0 +1,168 @@
{
"owner": "key-cape",
"consumer_manifest_path": "/tmp/keycape-jwt-ready-v9-stage/manifest.json",
"consumer_manifest_sha256": "84542ddcff00932fc7ce22dcb2626be8942a3c006c5098a62fdd6b2478d0cd14",
"producer_manifest_path": "/tmp/keycape-jwt-producer-handoff-v4-stage/manifest.json",
"producer_manifest_sha256": "d6f641dc1e4aae7d36658d4199d89af14d2fd7a4bd4e526856eb340234f2d33e",
"qualified_net_consumer_review_path": "/tmp/netkingdom-key39-producer-v4-consumer-review-stage/owner-review.json",
"qualified_net_consumer_review_sha256": "9566955b77db4a0b041887ef4a6aff6c7a02ef30cc0727a4deb6c29bbdc79518",
"exact_consumer_entries": [
{
"repo": "net-kingdom",
"path": "sso-mfa/k8s/keycape/openbao-negative-session.py",
"staged_path": "/tmp/keycape-jwt-ready-v9-stage/net-kingdom/sso-mfa/k8s/keycape/openbao-negative-session.py",
"original_sha256": "da4e0ab767e0c3bebb48bcf5ab578b50845d9fa7211a6771661a0e1baa4314ab",
"staged_sha256": "24b7b803e4eb7e6e7c0700a069dad0ec315ee7eb5538a88b9e56147f8fab5cdd",
"previous_frozen_staged_sha256": "da4e0ab767e0c3bebb48bcf5ab578b50845d9fa7211a6771661a0e1baa4314ab"
},
{
"repo": "net-kingdom",
"path": "sso-mfa/k8s/keycape/test_openbao_negative_session.py",
"staged_path": "/tmp/keycape-jwt-ready-v9-stage/net-kingdom/sso-mfa/k8s/keycape/test_openbao_negative_session.py",
"original_sha256": "01e23f2b4fc77824a161a57acb3a52d19aad846b3b6c0fd3abd81afa1dc2985c",
"staged_sha256": "01e23f2b4fc77824a161a57acb3a52d19aad846b3b6c0fd3abd81afa1dc2985c",
"previous_frozen_staged_sha256": "01e23f2b4fc77824a161a57acb3a52d19aad846b3b6c0fd3abd81afa1dc2985c"
},
{
"repo": "net-kingdom",
"path": "sso-mfa/k8s/keycape/test_openbao_node_route.py",
"staged_path": "/tmp/keycape-jwt-ready-v9-stage/net-kingdom/sso-mfa/k8s/keycape/test_openbao_node_route.py",
"original_sha256": "9f3d8d4297c5ef68f6c6bf7ca21e981e37d7eceb836a60bc254d33b0f5129047",
"staged_sha256": "1c57053be6e8472174e4034fdfbf34b3e1729f5e239b3a9af89d9e59a08d6cb6",
"previous_frozen_staged_sha256": "9f3d8d4297c5ef68f6c6bf7ca21e981e37d7eceb836a60bc254d33b0f5129047"
},
{
"repo": "net-kingdom",
"path": "sso-mfa/k8s/keycape/openbao-negative-node-route.md",
"staged_path": "/tmp/keycape-jwt-ready-v9-stage/net-kingdom/sso-mfa/k8s/keycape/openbao-negative-node-route.md",
"original_sha256": "a04c94512efec7a524b15a3eec61d86de5a41df872e59a3114093063a11e75a0",
"staged_sha256": "cad3e3dc481d45295cc014e48285e81614911dfb4a10523883f3044f6085f363",
"previous_frozen_staged_sha256": "a04c94512efec7a524b15a3eec61d86de5a41df872e59a3114093063a11e75a0"
},
{
"repo": "net-kingdom",
"path": "sso-mfa/k8s/keycape/test_openbao_private_input.py",
"staged_path": "/tmp/keycape-jwt-ready-v9-stage/net-kingdom/sso-mfa/k8s/keycape/test_openbao_private_input.py",
"original_sha256": "a59c2cd4ec895c1718d52fd12f64666f1be45ae423fde476755b6d77a89280c2",
"staged_sha256": "84277edb5bd7858885173dea802b6bdc4f0f0c7785d6e200ee9a98d8553891a1",
"previous_frozen_staged_sha256": "a59c2cd4ec895c1718d52fd12f64666f1be45ae423fde476755b6d77a89280c2"
},
{
"repo": "net-kingdom",
"path": "sso-mfa/k8s/keycape/openbao-negative-node-wrapper.py",
"staged_path": "/tmp/keycape-jwt-ready-v9-stage/net-kingdom/sso-mfa/k8s/keycape/openbao-negative-node-wrapper.py",
"original_sha256": null,
"staged_sha256": "76ac013d1a676a0dfa58aea1ce87b0c3e72483ccd21f586a22c5475e9132f6c1"
},
{
"repo": "net-kingdom",
"path": "sso-mfa/k8s/keycape/test_openbao_private_ready.py",
"staged_path": "/tmp/keycape-jwt-ready-v9-stage/net-kingdom/sso-mfa/k8s/keycape/test_openbao_private_ready.py",
"original_sha256": null,
"staged_sha256": "8a7a033b1c509ba21397d1d74580c44f24592045b2b9de50fe87638607224277"
}
],
"exact_producer_entries": [
{
"repo": "key-cape",
"path": "docs/openbao-negative-token-producer-decision.json",
"staged_path": "/tmp/keycape-jwt-producer-handoff-v4-stage/key-cape/docs/openbao-negative-token-producer-decision.json",
"original_sha256": null,
"staged_sha256": "7b3e4a53ac4af33c780f16c3f1aa9cde0154040ad2747a8d361dd79bbb7f435c",
"previous_frozen_staged_sha256": "ee5dccb8d3b263584127edff73a6f9292b29eb2725f982cdfdbd784141bdd98f"
},
{
"repo": "key-cape",
"path": "docs/openbao-negative-token-producer-decision.md",
"staged_path": "/tmp/keycape-jwt-producer-handoff-v4-stage/key-cape/docs/openbao-negative-token-producer-decision.md",
"original_sha256": null,
"staged_sha256": "38e4c9660ca57a1fb6e5ff04f214af61dd1a58abf564a5ed22216d909e27fc73",
"previous_frozen_staged_sha256": "50994f0882bac8c78227e8d8669f8be7ab9a07a8a35f1f8cc0bc5caeac275aa3"
},
{
"repo": "key-cape",
"path": "scripts/openbao_negative_private_handoff.py",
"staged_path": "/tmp/keycape-jwt-producer-handoff-v4-stage/key-cape/scripts/openbao_negative_private_handoff.py",
"original_sha256": null,
"staged_sha256": "faf63a3e9504dcbb46847a114275f83d508521e095410a47f92f02b86ba82b1b",
"previous_frozen_staged_sha256": "faf63a3e9504dcbb46847a114275f83d508521e095410a47f92f02b86ba82b1b"
},
{
"repo": "key-cape",
"path": "scripts/openbao_negative_private_launcher.py",
"staged_path": "/tmp/keycape-jwt-producer-handoff-v4-stage/key-cape/scripts/openbao_negative_private_launcher.py",
"original_sha256": null,
"staged_sha256": "46e57504b3185cc13f1656901a0ca02cc3887527cb09566e270f57b76099ab9c",
"previous_frozen_staged_sha256": "2a54568df541c38d43ca2482f037761770e6df206fb1cb88c1222ed7291f5e98"
},
{
"repo": "key-cape",
"path": "scripts/test_openbao_negative_private_handoff.py",
"staged_path": "/tmp/keycape-jwt-producer-handoff-v4-stage/key-cape/scripts/test_openbao_negative_private_handoff.py",
"original_sha256": null,
"staged_sha256": "e4eb600718e7d93b0e801ac3ab1427af9895a6e5d877c1134369e049e0849797",
"previous_frozen_staged_sha256": "e4eb600718e7d93b0e801ac3ab1427af9895a6e5d877c1134369e049e0849797"
},
{
"repo": "key-cape",
"path": "scripts/test_openbao_negative_private_launcher.py",
"staged_path": "/tmp/keycape-jwt-producer-handoff-v4-stage/key-cape/scripts/test_openbao_negative_private_launcher.py",
"original_sha256": null,
"staged_sha256": "243426a85075b3447adeb2ca320a13711409744f71837a06699de6ad5b04ee9d",
"previous_frozen_staged_sha256": "243426a85075b3447adeb2ca320a13711409744f71837a06699de6ad5b04ee9d"
},
{
"repo": "key-cape",
"path": "scripts/test_openbao_negative_private_preparation.py",
"staged_path": "/tmp/keycape-jwt-producer-handoff-v4-stage/key-cape/scripts/test_openbao_negative_private_preparation.py",
"original_sha256": null,
"staged_sha256": "8e4dd327c4a339a0151ecba57db5987965b5d536ca18123fb7c74a047a241548"
},
{
"repo": "key-cape",
"path": "workplans/KEY-WP-0039-openbao-negative-probe-tokens.md",
"staged_path": "/tmp/keycape-jwt-producer-handoff-v4-stage/key-cape/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md",
"original_sha256": "57d5f1a9cd5d15737d47a9273bf01355ba818b2748e1a43fd7ff2138bed50f4f",
"staged_sha256": "f6113d269f127976518acb48eca818fd5d6f12421f4e4c742e8a84f49a14360b",
"previous_frozen_staged_sha256": "1385f0b692a031fd52046e1dd98c42ff7a5a4ca4d1c340551ec8751a07e80ee6"
}
],
"completed_inspection_receipt_sha256": "b5074fdc22eb8f62ae035254bfb8311272cf8a7ec6ed14b60eebd14f5ef4046c",
"founder_source_memo_sha256": "1816e48b44eb874e4c97db82ee56ed27c23083ddcfc322d9de9876132e802688",
"founder_source_choices_sha256": "d2f6e2fc733d8092a27a1dafb2f77601cbff398c5606b12bb053b4cd7bcd4091",
"current_key_source_pins": [
{
"path": "AGENTS.md",
"sha256": "77c8e1ac762e7c101cd09a3aa184993309ed057821bd53fb0d318979a45c9315"
},
{
"path": "INTENT.md",
"sha256": "b22cb440691bb399b064ee10ab1a03e1e07838da1051bf6235fbfe2cf820eb10"
},
{
"path": "src/internal/authclient/cli.go",
"sha256": "376a8e0d1d60825a8b3ef21d371e3fc353c0a34e461712a6899e264278edbe7f"
},
{
"path": "src/internal/authclient/client.go",
"sha256": "61fb150349c5d3714450a90834c59af9a579a8a649c4149297a402cfcf6e39c5"
},
{
"path": "src/internal/server/oidc/token.go",
"sha256": "8422cc9dbd39c88dfe835b43f6262cb120bc0d2e5b08898a151167b7555368d3"
},
{
"path": "config/service-clients.example.yaml",
"sha256": "b7e17698a0946f387c481b7e27fe9ddea22cdd9db2e34e32a50457e02a34b18e"
},
{
"path": "docs/native-authentication.md",
"sha256": "378a5fa8174580bde811b716ec8e987339013b9f8d7725cb398fa3b9f8d95655"
},
{
"path": "workplans/KEY-WP-0039-openbao-negative-probe-tokens.md",
"sha256": "57d5f1a9cd5d15737d47a9273bf01355ba818b2748e1a43fd7ff2138bed50f4f"
}
],
"current_net_human_fragment_source_pin": "5f727f3146016184da867ce3c304ac0b19f7ceee63c479f6ea2606f7183640f5"
}

32
docs/reviews/2026-10-11-key39-v9-v4-keycape-work-record.json Normal file
View file

@ -0,0 +1,32 @@
{
"record_kind": "completed-owner-source-inspection",
"workplan": "KEY-WP-0039",
"task": "KEY-WP-0039-T03",
"same_completed_task_refinement": true,
"status": "done",
"established_before_formal_source_acknowledgment": true,
"current_owner_work_record_path": "/home/worsch/key-cape/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md",
"current_owner_work_record_sha256": "57d5f1a9cd5d15737d47a9273bf01355ba818b2748e1a43fd7ff2138bed50f4f",
"exact_net_manifest_sha256": "84542ddcff00932fc7ce22dcb2626be8942a3c006c5098a62fdd6b2478d0cd14",
"exact_producer_manifest_sha256": "d6f641dc1e4aae7d36658d4199d89af14d2fd7a4bd4e526856eb340234f2d33e",
"scope": "KeyCape issuer/private caller-token interface only, not Net or Platform formal role",
"completed_checks": [
"Exact source/manifest entries verified",
"Fresh qualified Net consumer source review verified exact95\u2026sha and pair fields",
"Three actual child emitter + current Key V4 reader tests pass without token file loads on wrong/expired marker",
"Current CLI issuer/client/callback/MFA source inspected",
"Source-design choices separated from native authority; staged existing T02 notes untouched"
],
"validation": {
"key_maker_checks_retained": 40,
"net_independent_exact_pair_checks": 13,
"own_fresh_interface_checks": 3,
"no_network_credentials_native_or_owner_checkout_writes": true
},
"prior_v2_bound_ack_preserved_sha256": "8293e18dcffe7b8e0748880753974219b99d347a173f75a32cc1aad2b4c30f95",
"producer_T02_notes_preserved_not_applied": true,
"states_retained": {
"T01": "done",
"T02": "open"
}
}