Record verified KEY39 source acceptance and remaining execution prerequisites
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
parent
e956fd1b52
commit
21c664643b
3 changed files with 179 additions and 0 deletions
51
docs/evidence/2026-10-11-key39-next-source-inspection.json
Normal file
51
docs/evidence/2026-10-11-key39-next-source-inspection.json
Normal file
|
|
@ -0,0 +1,51 @@
|
|||
{
|
||||
"schema": "key39-own-source-inspection/v1",
|
||||
"task": "KEY-WP-0039-T03",
|
||||
"task_status": "done",
|
||||
"completed_before_next_packet": true,
|
||||
"scope": "KeyCape issuer/client/custody source coordinates and source-disposition receipt only; no foreign formal runtime/backend review",
|
||||
"source_pins": [
|
||||
{
|
||||
"path": "/home/worsch/key-cape/config/service-clients.example.yaml",
|
||||
"sha256": "b7e17698a0946f387c481b7e27fe9ddea22cdd9db2e34e32a50457e02a34b18e"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/key-cape/docs/openbao-service-auth-contract.md",
|
||||
"sha256": "9b815eff44ebe898b93da5f4a5eeb927fe23d9490397386f3bca3682ce5c81dc"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/key-cape/docs/native-authentication.md",
|
||||
"sha256": "378a5fa8174580bde811b716ec8e987339013b9f8d7725cb398fa3b9f8d95655"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/sso-mfa/k8s/keycape/create-secrets.sh",
|
||||
"sha256": "5f727f3146016184da867ce3c304ac0b19f7ceee63c479f6ea2606f7183640f5"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/sso-mfa/k8s/keycape/deployment.yaml",
|
||||
"sha256": "b21c04841245263861273133ac8bde06653deb88be3afef9596ed2fba9db631b"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/railiance-platform/openbao/auth/coding-agent-jwt-role.json",
|
||||
"sha256": "c72e836ab72713a49aa8fb84faa26e824ff1263b5a184600fca0c0284720ee3b"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/railiance-platform/docs/coding-agent-openbao-identity.md",
|
||||
"sha256": "5ceeaafe150f4186c878f8beb4d741f282a322de2cc6dc7773ffd56a14b2af3d"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/railiance-platform/credential-grants/catalog.yaml",
|
||||
"sha256": "cb70165f80c58245d4231b4e712a4b322c51a6b168513dc839ad4c0234027047"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/ops-warden/registry/routing/catalog.yaml",
|
||||
"sha256": "09ee40df21b0ad8cad420be4613afcb1731967f68128631a94f9b96f3f31b318"
|
||||
}
|
||||
],
|
||||
"source_disposition_receipt_path": "/home/worsch/the-custodian/docs/evidence/2026-10-10-security-consolidation/key39-source-design-publication/founder-source-disposition-readback-r1.json",
|
||||
"source_disposition_receipt_sha256": "453213194d605336e9c424976f1ac27691def39e225026f0a99628d1cfc97d1d",
|
||||
"original_workplan_sha256": "f6113d269f127976518acb48eca818fd5d6f12421f4e4c742e8a84f49a14360b",
|
||||
"no_credentials_or_native_actions": true,
|
||||
"prior_preparation_manifest_sha256": "41c78a2aa85d11ae167f1dc3ceb16f6b72fe1c8375d12d208be746f287ed3188",
|
||||
"refinement": "Canonical verified public review URL recorded; actual T02 wait block retained for external custody/attended dependencies. Historical r1 preserved."
|
||||
}
|
||||
|
|
@ -0,0 +1,97 @@
|
|||
{
|
||||
"schema": "key39-next-execution-prerequisites/v1",
|
||||
"task": "KEY-WP-0039-T02",
|
||||
"status": "source_prerequisites_pending_owner_returns",
|
||||
"source_direction_accepted": true,
|
||||
"founder_source_disposition": {
|
||||
"memo_id": "infd-20261011-key39-source-design-r1",
|
||||
"review_memo_id": "review-62626f54-0212-4684-9b45-0a7222d61957",
|
||||
"version": 1,
|
||||
"route": "/review?memo_id=review-62626f54-0212-4684-9b45-0a7222d61957",
|
||||
"approval_id": "ca118afc-d746-4454-a5b9-9b387b120cd9",
|
||||
"disposition_id": "disp-870f9c1b-0444-4216-ae7f-f5463d590e36",
|
||||
"at": "2026-10-11T17:19:01Z",
|
||||
"readback_sha256": "453213194d605336e9c424976f1ac27691def39e225026f0a99628d1cfc97d1d",
|
||||
"commands_sha256": "36e20813596f3ddbb86e01fd0b838867ece2f4916c5880305cf12cd61b567f89",
|
||||
"inventory_sha256": "aea196db9e513900d5e7165455d6e9c3dc68749a606dc219ec340ac595642cc0",
|
||||
"canonical_public_review_url": "https://decisions.coulomb.social/review?memo_id=review-62626f54-0212-4684-9b45-0a7222d61957"
|
||||
},
|
||||
"own_completed_inspection_receipt_sha256": "80e78c86591e05a3f9585342646e11f6784928444ab234b5bba1566e028ddb36",
|
||||
"named_coding_identity": {
|
||||
"issuer": "https://kc.coulomb.social",
|
||||
"client_id": "codex-railiance-platform",
|
||||
"audience": "codex-railiance-platform",
|
||||
"subject": "service:codex:railiance-platform",
|
||||
"tenant": "tenant:platform",
|
||||
"principal_type": "service",
|
||||
"roles": [
|
||||
"coding-agent"
|
||||
],
|
||||
"requested_scope": "openbao:login",
|
||||
"JWT_max_lifetime_seconds": 900,
|
||||
"issuer_secret_env_reference": "KEYCAPE_CODEX_RAILIANCE_PLATFORM_CLIENT_SECRET",
|
||||
"client_source_path": "key-cape/config/service-clients.example.yaml",
|
||||
"current_live_registration_proven": false,
|
||||
"custody_admission_receipt": null,
|
||||
"consumer_delivery_coordinates": null,
|
||||
"new_CCR_assigned": false,
|
||||
"AppRole_or_Bao_token_substitution_allowed": false
|
||||
},
|
||||
"shortest_next_sequence": [
|
||||
{
|
||||
"step": 1,
|
||||
"owner": "railiance-platform + NetKingdom",
|
||||
"action": "Return existing exact coding-client admission and deployment binding if present. Owner determines protected-custody entry/key, admitted consumer identity/host/private injection mechanism, issuer Secret env reference and current matched versions; retain value-free metadata receipt only. If absent, prepare one new narrow coding-client admission/delivery proposal under existing owner records. Do not assume CCR0040 create-only browser-case grant supplies consumer delivery or make up a CCR number.",
|
||||
"required_before": "Any founder native execution proposal purporting to include the coding-agent case"
|
||||
},
|
||||
{
|
||||
"step": 2,
|
||||
"owner": "NetKingdom runtime + KeyCape issuer",
|
||||
"action": "Confirm accepted source purpose reuse maps to current netkingdom-bootstrap-console public PKCE registration, exact literal callback http://127.0.0.1:8876/oidc/callback and sole intended workstation CLI listener. Confirm deployment enforces real MFA; actual verified aal2/mfa token proof is an attended future operation.",
|
||||
"required_before": "Private human producer admission"
|
||||
},
|
||||
{
|
||||
"step": 3,
|
||||
"owner": "Platform + NetKingdom + founder transport/runtime owner",
|
||||
"action": "Supply exact node-local Bao origin and public GET /v1/sys/health receipt with cluster-ID digest from the actual consumer node route; constrain to reviewed origins. Pin current executor/wrapper/launcher/runtime paths and live deployment metadata; confirm protected role/config/leeway and ownership/production maintenance requirements separately through attended sanitized owner reads.",
|
||||
"required_before": "Any temporary credentials, client registration, restart or private token delivery"
|
||||
},
|
||||
{
|
||||
"step": 4,
|
||||
"owner": "founder and existing custody/transport owners",
|
||||
"action": "Populate one fresh exact native envelope with source digests, admitted human/coding producers, host/session/cert profile, continuous exclusive sameUID tmpfs custody, original wall/monotonic windows, target UIDs/resourceVersions, temporary Secret/client names, role observation/leeway, cost/risk and bounded cleanup/recovery. Obtain distinct authenticated informed decision for that exact execution revision, with necessary owner acknowledgments.",
|
||||
"required_before": "Native session execution"
|
||||
}
|
||||
],
|
||||
"safe_public_or_metadata_readback_plan": {
|
||||
"performed": false,
|
||||
"permitted_outputs": [
|
||||
"issuer discovery/JWKS metadata only",
|
||||
"deployment image digest, UID, generation, Ready count, annotations/owner references and current source revision only",
|
||||
"Secret object metadata only; never .data/.stringData, full YAML or pod environment",
|
||||
"actual node-local public Bao health initialized/unsealed/active booleans and cluster-ID digest",
|
||||
"workstation callback socket listener ownership metadata without process environment/command arguments"
|
||||
],
|
||||
"protected_owner_readback_separate": [
|
||||
"Deployed KeyCape registry is held in keycape-config Secret alongside signing key: no full config read through ordinary public-readback path. Runtime owner privately projects only reviewed nonsecret registration facts.",
|
||||
"OpenBao role/config/effective policy/leeway are protected metadata owner obligations, not assumed public.",
|
||||
"Custody entry existence/version metadata and exact consumer admission come from Platform, not agent secret reads."
|
||||
]
|
||||
},
|
||||
"source_findings": [
|
||||
"KeyCape source fragment and actual Platform JWT-role source agree tenant:platform. Platform coding-agent-openbao-identity.md still lists tenant:coulomb; preserve this evidence and obtain Platform source correction/ack before relying on that stale table.",
|
||||
"No exact named coding-client custody/delivery receipt located in scanned CCR/grant/routing source; this bounded negative source search is not a claim that no live entry exists.",
|
||||
"Applied CCR0040 generate grant is create-only custody and browser SecurityCase flow; no generic read/delivery grant inferred.",
|
||||
"Supported keycape service-token/login emit new private mode0600 verified JWT JSON files; launcher source requires exact child-ready handshake before ANY token-file load/consume/write.",
|
||||
"Existing V9/V4 independent source compatibility does not prove installed path/host/private producer or founder runtime admission."
|
||||
],
|
||||
"native_authorized": false,
|
||||
"credentials_or_login_authorized": false,
|
||||
"source_choices_newly_invented": false,
|
||||
"T01_done_preserved": true,
|
||||
"T02_native_acceptance": false,
|
||||
"T03_done_preserved": true,
|
||||
"new_workplan_created": false,
|
||||
"T02_status": "wait",
|
||||
"T02_wait_scope": "External coding-client custody/admission and separate attended execution authority remain pending; source-direction acceptance is recorded as preparation progress only."
|
||||
}
|
||||
|
|
@ -295,3 +295,34 @@ bytes unchanged. Prior issuer/custody/transport/file/route/readiness-Argo/role/
|
|||
maintenanceexception/founder choices remain unadmitted. No SSH/network/Secrets/
|
||||
credentials/native/owner checkout changes; no task/plan duplication. T01done
|
||||
and T02open; source correction is not native acceptance.
|
||||
|
||||
|
||||
2026-10-11 T02 source-design disposition checkpoint: founder accepted exact
|
||||
source memo `infd-20261011-key39-source-design-r1`, review
|
||||
`review-62626f54-0212-4684-9b45-0a7222d61957` version1 at `2026-10-11T17:19:01Z`.
|
||||
Disposition `disp-870f9c1b-0444-4216-ae7f-f5463d590e36`, approval
|
||||
`ca118afc-d746-4454-a5b9-9b387b120cd9`; authenticated person subject
|
||||
`uid=platform-root,ou=people,dc=netkingdom,dc=local`. Exact canonical public review URL:
|
||||
`https://decisions.coulomb.social/review?memo_id=review-62626f54-0212-4684-9b45-0a7222d61957`.
|
||||
Root's authenticated confirmed readback is
|
||||
`the-custodian/docs/evidence/2026-10-10-security-consolidation/key39-source-design-publication/founder-source-disposition-readback-r1.json`,
|
||||
SHA256 `453213194d605336e9c424976f1ac27691def39e225026f0a99628d1cfc97d1d`; observed
|
||||
`2026-10-11T17:30:47.080081+00:00`. Source commands SHA256
|
||||
`36e20813596f3ddbb86e01fd0b838867ece2f4916c5880305cf12cd61b567f89` and source inventory SHA256
|
||||
`aea196db9e513900d5e7165455d6e9c3dc68749a606dc219ec340ac595642cc0` bind the accepted source direction.
|
||||
|
||||
Acceptance covers recommended source preparation for existing bootstrap-console
|
||||
human-client purpose reuse, returning existing coding-agent custody admission or
|
||||
preparing a narrow owner proposal, proposed founder directSSH source profile,
|
||||
and conditional exclusive-owner tmpfs files. It does not establish actual
|
||||
registration/MFA/listener, coding-agent custody/delivery, transport/file admission,
|
||||
node-local Bao route, issuer/OpenBao role/leeway/maintenance readiness or fresh
|
||||
attended native go. The published choice documents remain historical exact
|
||||
pending proposals; this appended receipt records their later source disposition.
|
||||
T02 remains wait on external owner custody/admission and separate attended
|
||||
execution authorization. Source acceptance permits further source preparation;
|
||||
actual registry, token exchange, negative probe, revoke and cleanup remain pending. T01 and T03
|
||||
remain done. No native or credential action is authorized by this source receipt.
|
||||
See docs/proposals/2026-10-11-key39-next-execution-prerequisites.json for exact
|
||||
owner returns and safe metadata evidence needed before preparing a runnable
|
||||
attended execution proposal.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue