coulomb/key-cape
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Publish reviewed KEY39 lifecycle source and preserve failed review history

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 15:33:14 +02:00
parent aef56bcba1
commit a46024bf3e
9 changed files with 640 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

22
docs/openbao-negative-probe-session-proposal.md
View file

@ -83,7 +83,7 @@ outside the negative runner and remain required by RPF-WP-0035-T02.
In a finally path remove all six registrations and exactly six env references,
restore the unchanged baseline registry/config, restart and wait Ready, then
verify client_credentials for each removed client is invalid_client using the
verify client_credentials for each removed client is HTTP 401 invalid_profile_usage with feature client_id using the
still-private temporary values. Only then remove the transient Secret and any
private human-token file owned by this session. Confirm all six client IDs and
Secret/env refs are absent, service positive behavior and baseline deployment
@ -115,3 +115,23 @@ credential values. Two semantic tests fail against the original source: it
reported success when the expiry positive control was refused for a subject
mismatch, and it classified not-yet-valid as expired. Native execution has not
been attempted by this preparation.
2026-10-11 KeyCape V4 source acknowledgment: the issuer-facing correction is
acknowledged narrowly in docs/reviews/2026-10-11-key39-lifecycle-v4-keycape-source-ack.json
for exact lifecycle V4 manifest
d079f85c47d5c2635e1ee633ea4d1346b1737ce2be9ca273f22a38e620f418d8.
The removed-client denial contract above is corrected against current
token.go:306-309; wrong-secret feature Authorization is not deletion evidence.
The runner stays unchanged. V4 has finite typed deadlines, Linux main-thread
total HTTP bounds, late-known-session private revoke before refusal, unknown
partial-response outcomes and a bounded guarded cleanup/delete path. These
source checks do not grant native authority or establish runtime acceptance.
The token-producer handoff remains a concrete execution gap: existing
keycape login/service-token commands write private JSON token files, while the
lifecycle expects private stdin human_token/coding_agent_token. An actually
admitted human public-client/callback, coding-agent live registration/custody
route and reviewed private producer/native placement/cleanup must bridge this
mismatch before native go. No unattended producer or credential admission is
provided by this source acknowledgment.