Review exact offline checker behavior for browser registration
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
parent
3c71226a1a
commit
834b0d06a1
3 changed files with 151 additions and 1 deletions
34
docs/offline-checker-owner-review-2026-10-16.json
Normal file
34
docs/offline-checker-owner-review-2026-10-16.json
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
{
|
||||
"reviewer": "key-cape-owner (agent key-cape, codex)",
|
||||
"decision": "approved",
|
||||
"scope": "exact source/artifact offline configuration validation behavior only",
|
||||
"comment": "INTENT.md Tooling declaration, Purpose/Primary Utility and Strategic Boundaries; deterministic constrained IAM config validation and delivered-reference boundary. KEY-WP-0038-T02 remains wait. See bound narrative for explicit limits; this is an owner review, not human approval or admission.",
|
||||
"work_item": "KEY-WP-0038-T02",
|
||||
"source_revision": "3c71226a1a7b8a2bdb710e9c497e1a1f7f8a3987",
|
||||
"source_tree": "f0010b9cab17dbc3a787628a29657d98b900320f",
|
||||
"artifact_sha256": "sha256:be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5",
|
||||
"artifact_bytes": 13633409,
|
||||
"closure_sha256": "sha256:cb2f8ce0a3ee1efb7099ce00d139ebe00a23a8b356fba160ab8c4b067f5818f9",
|
||||
"review_narrative_sha256": "sha256:75ed6866b29cbb9f2c5c2a395da2afa25d021f248587c7055bd721e2c55b8685",
|
||||
"owner_checks_sha256": "sha256:4669c8ac2fcee76926b1419a9fe6c5924abf354c7ebc1fd2ee1b697c6e4f5419",
|
||||
"source_tests_receipt_sha256": "sha256:e606adb20b943072d1052f8f9dffd89b78f73c4dd10bd761f29b6cec72fc21a0",
|
||||
"candidate_inputs": {
|
||||
"README.md": "sha256:0df0fd7f263481ef706433c320af0d908f1b763557c3b0f5e4beca57408d7d5a",
|
||||
"build_checker.py": "sha256:ea58117252e7cc5328307d3551580dc251780db12e9e8c1600de88633ea24179",
|
||||
"build-receipt.json": "sha256:cc227c17375cd89edb9a1b0304e2cf277a8c8d46370cd71f1c071da57931d3de",
|
||||
"source-toolchain-module-closure.json": "sha256:cb2f8ce0a3ee1efb7099ce00d139ebe00a23a8b356fba160ab8c4b067f5818f9",
|
||||
"artifact-build-info.txt": "sha256:025391cc0fc013352783eedadd34a9bdaf6dc6cf10d5d2cebec7099598a8300a",
|
||||
"verification.json": "sha256:1655501a3124cbb3ebd88cd440d96592ccfd1138e01724b79eaafff69031e464"
|
||||
},
|
||||
"limits": [
|
||||
"two non-secret URL environment overrides remain inputs",
|
||||
"omitted/empty env-names does not check provision",
|
||||
"policy-store flag is caller assertion",
|
||||
"permissive server YAML semantics",
|
||||
"no executable custody, launch descriptors or native/type admission",
|
||||
"no actual identity, signing, upstream or group/consumer proof"
|
||||
],
|
||||
"native_admission": false,
|
||||
"production_authorization": false,
|
||||
"other_owner_roles_reviewed": []
|
||||
}
|
||||
94
docs/offline-checker-owner-review-2026-10-16.md
Normal file
94
docs/offline-checker-owner-review-2026-10-16.md
Normal file
|
|
@ -0,0 +1,94 @@
|
|||
# KeyCape owner review: exact offline configuration checker
|
||||
|
||||
Reviewer: `key-cape-owner (agent key-cape, codex)`
|
||||
Decision: `approved` for the bounded source/artifact behavior below
|
||||
Work item: `KEY-WP-0038-T02` (remains `wait`)
|
||||
Date: 2026-10-16
|
||||
|
||||
KeyCape endorses the offline configuration validation behavior of published
|
||||
source `3c71226a1a7b8a2bdb710e9c497e1a1f7f8a3987`, `src` tree
|
||||
`f0010b9cab17dbc3a787628a29657d98b900320f`, and the Linux/amd64 Go 1.23.0
|
||||
artifact SHA256 `be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5`
|
||||
(13,633,409 bytes). This review is an owner judgement, not human approval,
|
||||
production authorization or native admission.
|
||||
|
||||
The INTENT.md basis is KeyCape's Tooling declaration, Purpose/Primary Utility and
|
||||
Strategic Boundaries: deterministic profile-constrained authentication tooling,
|
||||
explicit configuration checks, delivered secret references, and separation from
|
||||
authorization decisions. The review stays within these responsibilities.
|
||||
|
||||
## Source and build evidence
|
||||
|
||||
The candidate's source archive matches the exact published revision and src tree.
|
||||
Independent owner checks matched all 108 archived source files, 9876 cached
|
||||
Go toolchain files and every file in the ten selected module source trees against
|
||||
the closure. The closure JSON SHA256 is
|
||||
`cb2f8ce0a3ee1efb7099ce00d139ebe00a23a8b356fba160ab8c4b067f5818f9`;
|
||||
archive SHA256 is `770a15933e6c45d4b94beb37d4322fd4ae1436d8193dfb7f5655bbc851f3fc73`.
|
||||
The actual executable matches the artifact above. Its command is the existing
|
||||
`./cmd/keycape` target, also built by the owner Makefile/Dockerfile. The retained
|
||||
build uses explicit environment, cached Go 1.23.0, readonly module resolution,
|
||||
CGO disabled, fixed Linux/amd64/v1, trimpath and buildvcs=false, GOPROXY=off and
|
||||
GOSUMDB=off. These are deterministic local input checks, not independent
|
||||
attestation of upstream toolchain/module provenance or host custody.
|
||||
|
||||
`main.go` dispatches `check-config` first, before server config processing,
|
||||
private-key loading, adapter construction, policy-store opening or listener
|
||||
startup. `checkconfig.go` calls the same `config.Load`, `ValidateConfig`, global
|
||||
lifetime parse, and registry conversion used by startup, with a constant
|
||||
placeholder in place of client-secret lookup. `policy.CheckClients` checks
|
||||
registry shape without opening the policy store. Source inspection found no
|
||||
application init path that reads credentials or contacts an upstream for this
|
||||
command. No KeyCape private-key read, client-secret lookup, upstream request,
|
||||
listener, real authentication or signing occurs in this branch.
|
||||
|
||||
Fourteen direct executable checks passed: valid confidential/public registrations
|
||||
without any actual secret/key; bad port/lifetime/query redirect/browser roles;
|
||||
missing declared env name; omitted and empty env-name semantics; required policy
|
||||
client presence with and without policy assertion; non-secret URL environment
|
||||
overlay; synthetic secret non-emission; permissive unknown YAML field handling;
|
||||
and success with an unopened signing-key FIFO plus unused policy path. The three
|
||||
relevant package suites (`cmd/keycape`, `internal/config`, `internal/server/policy`)
|
||||
passed. The first package-suite attempt failed because the candidate src-only
|
||||
archive omitted two committed external config fixtures. It is retained. Rerun
|
||||
added only those fixture paths archived from the exact reviewed revision.
|
||||
The coordinator separately reports reproducing the same artifact and eight
|
||||
adapter fixture checks; that is supporting coordinator evidence, not an owner
|
||||
claim of native or caller integration acceptance.
|
||||
|
||||
## Contract and limitations
|
||||
|
||||
- Always pass the explicit synthetic/config path. This command loads the supplied
|
||||
YAML file; it cannot guarantee the caller supplied only non-secret contents.
|
||||
- `config.Load` reads the non-secret `KEYCAPE_ACCOUNT_PORTAL_URL` and
|
||||
`KEYCAPE_BROWSER_LOGOUT_URL` environment overrides. Validation therefore is not
|
||||
independent of the caller environment. The caller must intentionally supply
|
||||
the desired URL configuration in a minimal environment. This endorsement does
|
||||
not certify the current NetKingdom subprocess environment or its correction.
|
||||
- `--env-names` checks names only when its value is nonempty. Omitted/empty means
|
||||
list required names without proving their provision. Even nonempty assertions
|
||||
prove neither Secret existence, values, mount/ESO delivery nor readable custody.
|
||||
- `--policy-store` asserts the target enables that store and checks its required
|
||||
clients. It proves no path permissions, lock availability or stored state.
|
||||
- The loader follows existing server YAML semantics, including acceptance of
|
||||
unknown fields. Validation is the implemented startup subset, not a complete
|
||||
OIDC/profile policy or schema audit. It does not strengthen every currently
|
||||
accepted redirect/grant/client field.
|
||||
- No key existence/parsing, policy-file access, port binding, upstream readiness,
|
||||
live config equivalence, browser flow, token claims, group enforcement, secret
|
||||
minting/delivery, consumer login or actual human/agent/service identity is proved.
|
||||
- Exact byte identity does not establish immutable executable storage, safe file
|
||||
descriptors, launch custody, type/version acknowledgement, descriptor step-set
|
||||
composition, Warden admission or parent-session revocation. Those remain with
|
||||
the respective owners. No other owner role is endorsed here.
|
||||
|
||||
No blocking defect was found within this exact offline checker scope. The broader
|
||||
browser registration and identity tasks remain open. No production configuration,
|
||||
credentials, cluster mutations, external messages or paid calls were used.
|
||||
|
||||
Reproduction and detailed local receipts are in
|
||||
`the-custodian/docs/changes/netkingdom-target-2026-10-16/keycape-checker-owner-review/`:
|
||||
`review_checks.py`, `owner-checks.json`, `source-tests.json`, `source-tests.txt`
|
||||
and `source-tests-first-attempt.txt`. Original candidate build/closure receipts
|
||||
remain in the adjacent `browser-checker-artifact-next/` packet, including failed
|
||||
closure collection attempts.
|
||||
Loading…
Add table
Add a link
Reference in a new issue