key-cape/docs/openbao-negative-token-producer-decision.md

# KEY39 private token producer and node-route decision packet

Proposal `KEY-WP-0039-T02/private-producer-handoff-v1`, source preparation only.
Lifecycle V5 is unchanged (manifest d1f997624db46693a7126a6eb6435f6b3a353d5bd67dcc8a539683e4b7147285).
This packet names concrete supported flows and a reviewable local handoff. It
supplies no admitted credential route, authenticated approval or native readiness.
T01 stays done and T02 open; no new workplan or task is created.

## Existing flows and exact owner choice

Choose existing `netkingdom-bootstrap-console` for the human class refusal if
NetKingdom/founder approve this one attended use of their existing client and
literal `http://127.0.0.1:8876/oidc/callback` listener. Its source registration is
public authorization_code, scopes openid/profile/email/groups, default audience
netkingdom-bootstrap-console. Request only `openid`; do not request approval or
OpenBao permissions. `keycape login` verifies RS256 issuer/access audience/scopes,
ID-token client audience/nonce and matching subject. It binds before emitting a
browser URL, validates exact callback host/path/state, uses S256 PKCE, and has a
five-minute attempt bound. The provider handles password/MFA. Fresh deployed
MFA/registration evidence is required; the handoff requires human aal2/mfa=true.
Do not infer MFA from the client fragment: it has no per-client mfaRequired pin.
Do not run the bootstrap console simultaneously on port8876. The same client's
localhost callback is not substituted: the CLI requires a literal loopback IP.

Concrete producer invocation after that decision, on the attended workstation:

```
keycape login --issuer https://kc.coulomb.social \
  --client-id netkingdom-bootstrap-console --audience netkingdom-bootstrap-console \
  --scope openid --redirect-uri http://127.0.0.1:8876/oidc/callback \
  --out /OWNER-PRIVATE-TMPFS-DIR/key39-human.json
```

The private directory is new owner-controlled mode0700 tmpfs outside Git; the
CLI creates the file mode0600 exclusively. No invocation is performed here.
Current browser access-token lifetime is server TokenLifetime; per-client
TokenLifetime is used only for client_credentials. Do not promise a new one-minute
human lifetime by adding that field to a browser registration.

Alternative only if the owner rejects existing-client use: request one separately
reviewed public client `key39-negative-human`, audience of the same name, exact
callback `http://127.0.0.1:8877/oidc/callback`, scopes [openid], grantTypes
[authorization_code], mfaRequired true, no role/serviceSubject/secretRef. That
requires a new source registration, reviewed native merge/rollback and changed
handoff audience binding. It is not part of V5's six temporary clients and must
not silently enter that mutation. The current adapter intentionally refuses it.
Reuse of informed-decision-approver is unsuitable for this CLI: its registered
callback is HTTPS decisions.coulomb.social, not literal loopback. OpenBao admin
is another source-compatible callback but its admin relying-party purpose is
unnecessary for this probe and is not the selected plan.

Coding-agent producer is exactly the existing accepted source identity:

```
keycape service-token --issuer https://kc.coulomb.social \
  --client-id codex-railiance-platform --audience codex-railiance-platform \
  --scope openbao:login --secret-env KEYCAPE_CODEX_RAILIANCE_PLATFORM_CLIENT_SECRET \
  --out /OWNER-PRIVATE-TMPFS-DIR/key39-agent.json
```

Subject service:codex:railiance-platform, tenant:platform, roles [coding-agent],
principal_type service; fifteen-minute JWT, no refresh or ID token. The secret
must arrive from an existing **admitted** owner-controlled delivery. No client
secret request or generation occurs here. A source fragment is not live
registration or consumer entitlement. The inspected Platform operational identity
is AppRole; its OpenBao token cannot substitute for this JWT. Its historical
coding-agent prose still names tenant:coulomb, whereas current KeyCape source
uses tenant:platform. Platform must reconcile its exact proposed/installed
metadata, not use that historical prose as evidence.

No reviewed coding-agent client-side custody reader/consumer delivery receipt
was found in the inspected CCR/registry sources. Platform must either return
exact existing admission coordinates and fresh live registration/delivery evidence
or own a new narrow custody/issuer/consumer admission proposal. Do not borrow
secrets-engine's credential, widen its role, read raw KV, or mint an ephemeral
coding-agent lookalike to manufacture this case. If unavailable, the joint
session remains blocked and coding-agent refusal inconclusive; V5 requires both
private token inputs and cannot silently skip the case.

## Private handoff adapter

`scripts/openbao_negative_private_handoff.py` adapts the two existing CLI files
to V5 private stdin JSON keys human_token and coding_agent_token. It makes no
network request, login, secret retrieval, registration, deployment or executor
launch. The source is Linux main-thread only. Before file consumption it requires
an inherited **writable pipe FD >=3**, never stdout/stderr, a new owner mode0700
non-symlink directory outside Git, single-link mode0600 regular files owned by
the current UID, bounded reads and unchanged inode/size/timestamps. JSON rejects
duplicate/nonfinite keys; token length is bounded. Both files must be distinct.
A second inode/metadata compare immediately precedes each unlink.

The adapter checks decoded issuer/audience/principal/agent claims and at least
300 seconds remaining lifetime, plus human MFA shape. These are not signature
verification or authenticated custody: its tests deliberately use unsigned
synthetic JWT shapes. The founder must run the pinned current KeyCape CLI and
retain exclusive custody continuously; arbitrary downloaded/preexisting files
are inadmissible despite matching mode or claims. CLI signature verification is
the issuer-verification boundary. Require a fresh remaining-lifetime check before
native execution and ensure token validity through the actual presentation; the
five-minute adapter floor is not a grant for a longer session.

Explicit `--consume-owner-files` authorizes removal of precisely these inspected
caller-owned files. After both load successfully, the adapter consumes them
before writing the pipe and closes its inherited endpoint on every exit. Partial
unlink failure records possible retained files; partial/broken/timed-out delivery
records unknown delivery and must stop before native mutation, with no retry.
Delivery has a hard five-second SIGALRM bound; preexisting timer refuses and
handler/timer state is restored. Receipts contain booleans and fixed failure
codes only; a pipe write completion does not prove downstream validation or native
acceptance. No stdout token path exists. A private pipe still requires a trusted
consumer: the adapter cannot authenticate its peer, approval JSON or native go.

The founder-reviewed launcher must create the pipe and start a pinned destination
wrapper before running the adapter with that endpoint inherited as FD3. The
wrapper may invoke the already approved SSH transport to railiance01 and forward
stdin without PTY, shell tracing, tee, terminal/stdout copies, token argv/env,
logging, agent custody or persistent remote files. The destination reads the
private JSON with V5; no additional file copy. Exact workstation producer and
node wrapper paths, hashes, SSH host identity/transport grant, consumer startup
order, refusal gating and receipt handling must be owner-reviewed first. This
packet does not ship or admit such a launcher and cannot claim a full handoff.
Token files must be consumed before starting V5; on failed preparation the owner
removes remaining exact files. This packet requires founder choice to admit the
two bounded caller-owned JWT files: V5's no-copy rule for generated six client
secrets is unchanged. Python memory/Unix unlink are not secure-zeroization claims;
use an owner tmpfs directory and process termination. Issued JWTs expire normally.
No issuer-side JWT revocation is claimed. Any OpenBao acceptance remains V5's
bounded self-revoke/Platform reconciliation obligation.

## Mandatory route and decision ordering

The child is a Linux main-thread process on railiance01 using its k3s kubeconfig.
Workstation loopback18200 tunnel evidence does not prove node loopback18200;
openbao.openbao.svc normally resolves from Pods, not necessarily the host. Keep
native proposal gated until Platform/NetKingdom verify one of V5's exact origins
**from the actual node process placement**, using a separately reviewed founder
port-forward path if required. Do not expand V5 origins or use workstation role
observations as route proof.

Before any token exchange, temporary credential generation, Secret creation,
registry/env mutation or restart, the owner preflight must run a bounded public
Bao health request from that exact placement to the selected origin. It follows
no redirect or ambient proxy, caps response bytes and total elapsed time, sends
no auth header and prints only normalized initialized/unsealed/health booleans.
Verify acceptable active/standby health semantics independently, current TLS or
local port-forward ownership, no unintended public bind and non-secret issuer
connectivity. No auth, KV/data path or raw error output. The V5 transport currently
allows login/revoke only; this additional public health/route preflight belongs
in the reviewed launcher/NetKingdom guard, not an unreviewed V5 edit.

Owner sequence: select source plan -> independent KeyCape/NetKingdom/Platform
reviews -> approved exact launcher plus route/health preflight -> admitted
producer/custody and human browser attempt -> private-pipe delivery -> destination
validates complete stdin/envelope/source/runtime/role receipts -> native action
only under fresh exact founder authorization -> V5 cleanup/revoke plus producer
cleanup. Any unavailable route/custody/client/complete input keeps T02 open.

## Exact acknowledgments still required

- KeyCape: selected client/claims/CLI verification, lifetime and MFA source;
  this packet is preparation, not a formal source acknowledgment of a launcher.
- NetKingdom: actual existing registration/image, client reuse and callback
  listener ownership, browser/workstation/node placement, guarded public health
  preflight ordering and exact restart/cleanup runtime pins.
- Platform: coding-agent existing custody/consumer entitlement or new proposal,
  corrected tenant metadata, route/port-forward ownership, fresh bounded role/
  leeway/effective-policy observation, session revoke and unknown reconciliation.
- Founder: existing-client purpose reuse versus new registration, explicit private
  tmpfs JWT-file allowance, admitted exact launcher/transport/target/window/cleanup
  obligation and actual supervised custody. Source acceptance is not that go.

18 synthetic adapter checks pass: successful private write and file consumption,
stdout/stderr/regular/read-only FD refusal, explicit consumption, symlink/hardlink/
public mode/parent/Git/oversize/duplicate JSON refusal, wrong audience/MFA/tenant/
role/AppRole/expiry refusal, replacement before unlink, hard write timeout with
signal restoration and value-safe partial/broken delivery. Original V5/failed
review histories and all source/current owner records remain retained.

# V2 correction and exact child-ready integration

The V1 packet text above is retained history. Proposal
`KEY-WP-0039-T02/private-producer-handoff-v2` supersedes its unsafe no-ready
adapter and its precise-inode-removal wording. V1's immutable manifest239aaa
and NetKingdom consumer refusal a1ed14e6b2db1ae77c3fd638fd7e47b5bd50c25eebba418e31aba89bb4b7f88e
remain recorded as the same correction trial. The exact compatible consumer is
`KEY-WP-0039-T02/attended-lifecycle-v9-ready-input`, separately pinned below;
V5/V6/V7/V8 source/review history is never implicitly repinned. No owner admission
or founder go is supplied by V2.

The KeyCape launcher is `scripts/openbao_negative_private_launcher.py`. It
validates its own and its adjacent adapter's exact source hashes plus the local
copy of the exact remote envelope. The remote child/wrapper paths and hashes
must occur in that envelope; proposal/target/source owner receipts, finite
window/health pin and founder/file-allowance receipt references must match the
reviewed contract. These fields are procedural constraints only: editable JSON
cannot authenticate approval. The founder must authenticate/retain the actual
exact disposition and own this entire launcher/custody/host context.

The source launcher alone creates SSH stdin/stdout pipes, a fresh random256-bit
nonce and fixed direct SSH argv to railiance01. It uses no PTY, strict existing
host-key checking, batch mode, no agent forwarding, no remote forwarding, finite
connection/keepalive bounds, and a minimal environment that excludes confidential
client credentials. It does not create or request a certificate, token, credential
or route. This is a proposed **separate founder-admitted direct SSH profile**:
the normal warden silent lane has different stdout rules and is not silently
repurposed. The founder/transport owner must review actual node host identity,
SSH certificate/session entitlement and pinned remote paths before execution.
No SSH command was invoked during preparation.

On railiance01 the independently NetKingdom-owned pinned wrapper creates a
local dedicated child-ready pipe and launches the exact pinned Python child
with inherited SSH stdin. No invented extra SSH file-descriptor forwarding is
used. Only after exact source/envelope checks, original action-window start and
pinned public Bao health succeeds does the child emit a bounded value-free
marker to that local pipe, close it, and enter the V8 bounded private receiver.
The wrapper validates that local marker and forwards exactly one newline JSON
marker on SSH stdout. SSH stdout stays open until child completion; Key reads
only to the first newline, never waits for SSH stdout EOF. Child stdout/stderr
stay suppressed; protected receipt remains exclusive on the node.

Ready schema `key39-private-input-ready/v1` has exactly these keys:
schema, session_nonce, proposal_id, target, executor_sha256, envelope_sha256,
bao_health_identity_sha256, valid_until_epoch, receive_budget_seconds. Marker
must bind the new nonce and exact consumer proposal/target/source/envelope/health
pin and epoch; receive budget must be finite nonboolean, positive and <=15s.
Marker size is <=4096 bytes. An old/missing/malformed/mismatched/failed/expired
ready marker produces **zero token file loads, zero consumption, zero private
bytes**, then closes local endpoints. A readiness marker is not authentication,
JWT verification, custody admission, routing authority or a live grant. It is
trusted only because the reviewed launcher captures the intended pinned wrapper
under the separately admitted authenticated host/session context. There is no
standalone adapter CLI accepting a ready file, boolean or user-provided marker.

The adapter validates two distinct kernel pipe identities: private data endpoint
write-only, control endpoint read-only, each FD>=3 and each device/inode distinct
from stdin/stdout/stderr and from each other. Actual duplicates of stdout/stderr
are refused even when their descriptor number is >=3. Captured SSH stdout is a
separate control pipe owned by the launcher; it never becomes token output.

The launch preparation cap is5s. The adapter has one total5s deadline covering
ready wait, caller-file load, cleanup and delivery. After ready this existing
timer only clips downward against its remaining budget, received child budget
and current remaining approval lifetime. Advertised child budget is not compared
as <=current remaining wall time (transport necessarily consumes time); the
actual delivery timer clips to both. Before each write and after completion the
same absolute expiry/monotonic delivery bound is rechecked. No retries or clock
reset; stdin closes to provide complete EOF. A partial write, transport break or
expiry remains unknown and cannot be native proof. Launcher waits only for a
value-free child/transport exit under remaining action +300s cleanup +30s margin;
local transport teardown never proves remote custody or process reconciliation.
Native receipt/unknown-session acceptance remains Platform/NetKingdom's.

## Honest file-cleanup boundary

Owner mode0700/0600, no symlink/hardlink/Git and unchanged identity/size/time
checks remain. **The compare and unlink are not atomic inode-conditioned delete.**
Continuously exclusive same-UID custody of the directory, no concurrent writers
and no attacker sharing that UID are mandatory for this proposed file approach.
No helper boolean can prove that condition. The founder must control the new
private tmpfs directory/process context and retain exclusive custody; no shared
agent/shell/daemon may modify it. Any known interference requires abort and owner
reconciliation before another attempt.

V2 removes V1's exact-inode/atomic implications. Its retained stat-to-unlink race
check deliberately shows that a concurrent same-UID replacement can still be
removed; that is outside the admitted exclusive-custody assumption and is not
represented as a fixed filesystem capability. Even after nominal path removal,
receipts retain `atomic_inode_delete_guaranteed=false`,
`exclusive_same_uid_custody_required=true`, `credential_copy_cleanup_verified=false`
and `credential_files_remain_possible=true`. `caller_path_removal_completed`
means only these unlink calls completed under that assumption. It is not token
copy inventory, secure erase or cleanup proof. Owner verification/process
termination/tmpfs teardown remains required; issued JWTs expire normally.
If that exclusive context cannot be admitted, do not use these private files;
separately implement/review a process-to-process in-memory producer instead.

The existing human-client reuse versus new registration, live MFA, coding-agent
client-side custody/consumer delivery, exact authenticated launcher/SSH profile,
private tmpfs files/exclusive custody, actual node route/provider/role/leeway,
quiet restart window and fresh founder disposition are still unapproved choices.
This source packet does not resolve them. Source-pinned readiness eliminates
premature token transport only within the admitted trusted launcher context.

Exact compatible consumer manifest SHA256 84542ddcff00932fc7ce22dcb2626be8942a3c006c5098a62fdd6b2478d0cd14;
child 24b7b803e4eb7e6e7c0700a069dad0ec315ee7eb5538a88b9e56147f8fab5cdd;
node wrapper 76ac013d1a676a0dfa58aea1ce87b0c3e72483ccd21f586a22c5475e9132f6c1.
31 distinct supplied producer/launcher synthetic checks pass; 74 supplied
compatible consumer source checks pass. No actual SSH, login, tokens, custody
or native route was used. Fresh independent consumer and Platform source
reviews of this exact V2 and V9 remain necessary before founder choice.

# V3 remote-unknown reporting correction

Proposal `KEY-WP-0039-T02/private-producer-handoff-v3`. Exact NetKingdom V9
manifest84542ddc and child/wrapper bytes are unchanged; this is only a new Key
launcher reporting revision in the same preparation trial. Platform V2 pair
review finding RPF-KEY39-PAIR-V2-F01 is retained unchanged, SHA256
8353eb8aae11be8ce874887d6a5ca10bf37c6fba73c3f85f0644a7546dd7d33f.

After copying adapter outcome, `private_input_delivery_unknown=true` immediately
sets sticky `consumer_outcome_unknown=true` and `consumer_process_completed=false`
before any failure/early return. A complete payload can reach the remote child
before local write/EOF confirmation times out. Terminating local SSH cannot
prove that no remote operation occurred, that the child stopped or that remote
custody/cleanup completed. No retry or subsequent local success rewrites this
attempt. Native acceptance and unknown resolution stay independent owner duties.

33 distinct checks pass, including actual full kernel-pipe JSON write followed
by SIGALRM interruption before confirmation, and an actual4096-byte partial
write/timeout; both retain remote unknown after local terminate. No actual SSH,
protected consumer or credentials were involved. All V2/V1 source, unsuccessful
reviews and previous narrow issuer acknowledgments remain frozen history.
Exact source return and all prior native/client/custody/transport/file choices
remain required. Source reporting correction is not runtime admission.

# V4 source-acquisition and shared preparation deadline correction

Proposal `KEY-WP-0039-T02/private-producer-handoff-v4`, same trial. The exact
Net V9 manifest84542ddc and child/wrapper are unchanged. NetKingdom V3 consumer
refusal NET-PRODUCER-V3-F01 stays frozen, SHA256
38abf660701194f85934a076a0c01d3047e6bfe790e02ba1b0e4616e356634e6. V1/V2/V3 source and earlier acknowledgments/refusals remain history.

Actual CLI now starts one absolute monotonic5-second preparation deadline before
contract acquisition. Initial source read, source/envelope/hash checks and SSH
spawn then ready/file/consumption/write phase all use only remaining time from
that original deadline. Phase timers may disarm/rearm, but each is clipped to
original remaining time; launch never restarts the budget spent reading contract.
After ready, child receive budget and absolute approval expiry only clip further.
Once private input is delivered, existing separate action/cleanup completion
wait remains; it cannot renew preparation or mutation authority.

Contract/envelope reads use bounded4096-byte chunks, at most65536 bytes, absolute
paths, no observed symlink ancestry, O_NOFOLLOW/O_NONBLOCK, single-link regular
files with no group/world write, and stable device/inode/UID/mode/link/size/time
comparisons. FIFOs/devices/symlinks/empty/oversized files refuse before private
file access/SSH. Source digest reads share that path with at most262144 bytes.
All actual CLI source acquisition runs under the finite remaining preparation
alarm; a stalled filesystem call cannot escape this total deadline. Observed
path/source races refuse; continuously trusted exclusive custody remains required
and no atomic pathname/exec protection or authenticated metadata grant is claimed.

40 distinct producer/launcher checks pass, including actual CLI FIFO/symlink/
oversize refusal, delayed regular read under the hard timer with restored signals,
a main contract-read delay followed by launch delay that cannot renew the budget,
source drift/chunk bounds and earlier actual full/partialwrite stickyunknown.
Nine retained real paired handshake regressions also pass using actual pinned
Net wrapper and child main with only local fake SSH/health/execute substitutions:
no network, Kubernetes, protected credentials or native mutation. The original
Net fixture files are copied unchanged except the Key stage path, solely as
source regression evidence, never a new foreign formal owner review.

Fresh exact independent pair source returns and all unadmitted human/MFA/client/
coding-agent custody/consumer/directSSH/exclusive tmpfs/route/provider/role/leeway/
readiness-Argo/maintenance-exception/founder/native-acceptance duties still gate
use. No source-only helper choice, ready marker or editable approval JSON supplies
that authority. T01done/T02open; actual native outcome remains pending.