tegwick
21c664643b
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
97 lines
6.7 KiB
JSON
97 lines
6.7 KiB
JSON
{
|
|
"schema": "key39-next-execution-prerequisites/v1",
|
|
"task": "KEY-WP-0039-T02",
|
|
"status": "source_prerequisites_pending_owner_returns",
|
|
"source_direction_accepted": true,
|
|
"founder_source_disposition": {
|
|
"memo_id": "infd-20261011-key39-source-design-r1",
|
|
"review_memo_id": "review-62626f54-0212-4684-9b45-0a7222d61957",
|
|
"version": 1,
|
|
"route": "/review?memo_id=review-62626f54-0212-4684-9b45-0a7222d61957",
|
|
"approval_id": "ca118afc-d746-4454-a5b9-9b387b120cd9",
|
|
"disposition_id": "disp-870f9c1b-0444-4216-ae7f-f5463d590e36",
|
|
"at": "2026-10-11T17:19:01Z",
|
|
"readback_sha256": "453213194d605336e9c424976f1ac27691def39e225026f0a99628d1cfc97d1d",
|
|
"commands_sha256": "36e20813596f3ddbb86e01fd0b838867ece2f4916c5880305cf12cd61b567f89",
|
|
"inventory_sha256": "aea196db9e513900d5e7165455d6e9c3dc68749a606dc219ec340ac595642cc0",
|
|
"canonical_public_review_url": "https://decisions.coulomb.social/review?memo_id=review-62626f54-0212-4684-9b45-0a7222d61957"
|
|
},
|
|
"own_completed_inspection_receipt_sha256": "80e78c86591e05a3f9585342646e11f6784928444ab234b5bba1566e028ddb36",
|
|
"named_coding_identity": {
|
|
"issuer": "https://kc.coulomb.social",
|
|
"client_id": "codex-railiance-platform",
|
|
"audience": "codex-railiance-platform",
|
|
"subject": "service:codex:railiance-platform",
|
|
"tenant": "tenant:platform",
|
|
"principal_type": "service",
|
|
"roles": [
|
|
"coding-agent"
|
|
],
|
|
"requested_scope": "openbao:login",
|
|
"JWT_max_lifetime_seconds": 900,
|
|
"issuer_secret_env_reference": "KEYCAPE_CODEX_RAILIANCE_PLATFORM_CLIENT_SECRET",
|
|
"client_source_path": "key-cape/config/service-clients.example.yaml",
|
|
"current_live_registration_proven": false,
|
|
"custody_admission_receipt": null,
|
|
"consumer_delivery_coordinates": null,
|
|
"new_CCR_assigned": false,
|
|
"AppRole_or_Bao_token_substitution_allowed": false
|
|
},
|
|
"shortest_next_sequence": [
|
|
{
|
|
"step": 1,
|
|
"owner": "railiance-platform + NetKingdom",
|
|
"action": "Return existing exact coding-client admission and deployment binding if present. Owner determines protected-custody entry/key, admitted consumer identity/host/private injection mechanism, issuer Secret env reference and current matched versions; retain value-free metadata receipt only. If absent, prepare one new narrow coding-client admission/delivery proposal under existing owner records. Do not assume CCR0040 create-only browser-case grant supplies consumer delivery or make up a CCR number.",
|
|
"required_before": "Any founder native execution proposal purporting to include the coding-agent case"
|
|
},
|
|
{
|
|
"step": 2,
|
|
"owner": "NetKingdom runtime + KeyCape issuer",
|
|
"action": "Confirm accepted source purpose reuse maps to current netkingdom-bootstrap-console public PKCE registration, exact literal callback http://127.0.0.1:8876/oidc/callback and sole intended workstation CLI listener. Confirm deployment enforces real MFA; actual verified aal2/mfa token proof is an attended future operation.",
|
|
"required_before": "Private human producer admission"
|
|
},
|
|
{
|
|
"step": 3,
|
|
"owner": "Platform + NetKingdom + founder transport/runtime owner",
|
|
"action": "Supply exact node-local Bao origin and public GET /v1/sys/health receipt with cluster-ID digest from the actual consumer node route; constrain to reviewed origins. Pin current executor/wrapper/launcher/runtime paths and live deployment metadata; confirm protected role/config/leeway and ownership/production maintenance requirements separately through attended sanitized owner reads.",
|
|
"required_before": "Any temporary credentials, client registration, restart or private token delivery"
|
|
},
|
|
{
|
|
"step": 4,
|
|
"owner": "founder and existing custody/transport owners",
|
|
"action": "Populate one fresh exact native envelope with source digests, admitted human/coding producers, host/session/cert profile, continuous exclusive sameUID tmpfs custody, original wall/monotonic windows, target UIDs/resourceVersions, temporary Secret/client names, role observation/leeway, cost/risk and bounded cleanup/recovery. Obtain distinct authenticated informed decision for that exact execution revision, with necessary owner acknowledgments.",
|
|
"required_before": "Native session execution"
|
|
}
|
|
],
|
|
"safe_public_or_metadata_readback_plan": {
|
|
"performed": false,
|
|
"permitted_outputs": [
|
|
"issuer discovery/JWKS metadata only",
|
|
"deployment image digest, UID, generation, Ready count, annotations/owner references and current source revision only",
|
|
"Secret object metadata only; never .data/.stringData, full YAML or pod environment",
|
|
"actual node-local public Bao health initialized/unsealed/active booleans and cluster-ID digest",
|
|
"workstation callback socket listener ownership metadata without process environment/command arguments"
|
|
],
|
|
"protected_owner_readback_separate": [
|
|
"Deployed KeyCape registry is held in keycape-config Secret alongside signing key: no full config read through ordinary public-readback path. Runtime owner privately projects only reviewed nonsecret registration facts.",
|
|
"OpenBao role/config/effective policy/leeway are protected metadata owner obligations, not assumed public.",
|
|
"Custody entry existence/version metadata and exact consumer admission come from Platform, not agent secret reads."
|
|
]
|
|
},
|
|
"source_findings": [
|
|
"KeyCape source fragment and actual Platform JWT-role source agree tenant:platform. Platform coding-agent-openbao-identity.md still lists tenant:coulomb; preserve this evidence and obtain Platform source correction/ack before relying on that stale table.",
|
|
"No exact named coding-client custody/delivery receipt located in scanned CCR/grant/routing source; this bounded negative source search is not a claim that no live entry exists.",
|
|
"Applied CCR0040 generate grant is create-only custody and browser SecurityCase flow; no generic read/delivery grant inferred.",
|
|
"Supported keycape service-token/login emit new private mode0600 verified JWT JSON files; launcher source requires exact child-ready handshake before ANY token-file load/consume/write.",
|
|
"Existing V9/V4 independent source compatibility does not prove installed path/host/private producer or founder runtime admission."
|
|
],
|
|
"native_authorized": false,
|
|
"credentials_or_login_authorized": false,
|
|
"source_choices_newly_invented": false,
|
|
"T01_done_preserved": true,
|
|
"T02_native_acceptance": false,
|
|
"T03_done_preserved": true,
|
|
"new_workplan_created": false,
|
|
"T02_status": "wait",
|
|
"T02_wait_scope": "External coding-client custody/admission and separate attended execution authority remain pending; source-direction acceptance is recorded as preparation progress only."
|
|
}
|