key-cape/docs/proposals/2026-10-11-key39-founder-source-design-decision.json
tegwick 0f47e0c666 Publish reviewed bounded JWT ready handoff and retained owner history
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
2026-10-11 18:31:04 +02:00

100 lines
3.8 KiB
JSON

{
"schema": "founder-source-design-choice/v1",
"proposal_id": "KEY-WP-0039-T02/founder-source-design-v1",
"status": "pending_founder_source_direction_only",
"submitted": false,
"memo_sha256": "1816e48b44eb874e4c97db82ee56ed27c23083ddcfc322d9de9876132e802688",
"source_pair": {
"key_producer_manifest_sha256": "d6f641dc1e4aae7d36658d4199d89af14d2fd7a4bd4e526856eb340234f2d33e",
"net_consumer_manifest_sha256": "84542ddcff00932fc7ce22dcb2626be8942a3c006c5098a62fdd6b2478d0cd14",
"net_qualified_consumer_review_sha256": "9566955b77db4a0b041887ef4a6aff6c7a02ef30cc0727a4deb6c29bbdc79518",
"platform_fresh_exact_pair_source_return": "required separately"
},
"choices": [
{
"id": "human_producer",
"recommended": "existing_bootstrap_console_purpose_reuse_source_direction",
"options": [
"existing_bootstrap_console_purpose_reuse_source_direction",
"new_narrow_public_client_source_proposal",
"defer"
],
"selected": null,
"exact_existing_client": "netkingdom-bootstrap-console",
"exact_audience": "netkingdom-bootstrap-console",
"scope": "openid",
"callback": "http://127.0.0.1:8876/oidc/callback",
"pending": [
"Net owner purpose reuse/live registration",
"Sole intended workstation CLI listener; no existing port8876 occupant",
"Actual provider MFA receipt; verified aal2/mfa claims"
]
},
{
"id": "coding_agent",
"recommended": "return_existing_admission_or_prepare_narrow_platform_proposal",
"options": [
"return_existing_admission_or_prepare_narrow_platform_proposal",
"defer"
],
"selected": null,
"client_audience": "codex-railiance-platform",
"subject": "service:codex:railiance-platform",
"tenant": "tenant:platform",
"scope": "openbao:login",
"custody_admission_receipt": null,
"consumer_coordinates": null,
"new_ccr_number": null,
"approle_jwt_substitution_allowed": false
},
{
"id": "transport",
"recommended": "retain_proposed_founder_direct_ssh_source_profile",
"options": [
"retain_proposed_founder_direct_ssh_source_profile",
"redesign_and_review",
"defer"
],
"selected": null,
"host": "railiance01",
"compatible_with_warden_silent_lane": false,
"authenticated_host_session_entitlement_receipt": null,
"runtime_paths": null,
"granted": false
},
{
"id": "private_material",
"recommended": "conditionally_retain_exclusive_owner_tmpfs_file_source_design",
"options": [
"conditionally_retain_exclusive_owner_tmpfs_file_source_design",
"review_in_memory_producer_design",
"defer"
],
"selected": null,
"exclusive_same_uid_custody_verified": false,
"file_allowance_receipt": null,
"atomic_unlink_claimed": false,
"secure_zeroization_claimed": false
}
],
"permitted_effect_of_source_direction": "Owner source/design preparation and exact independent review only",
"cost_and_risk_scope": {
"external_spend_authorized_eur": 0,
"native_cost_risk_decision": "separate future scoped proposal required",
"source_risks": [
"Purpose reuse/MFA/callback listener unadmitted",
"Coding-agent custody missing",
"Distinct SSH profile/session identity unadmitted",
"SameUID private-file exclusivity non-atomic/no zeroization",
"Provider/plugin/role/leeway and readiness/Argo/maintenanceexception facts pending"
]
},
"native_authorized": false,
"credentials_or_login_authorized": false,
"ssh_or_portforward_authorized": false,
"registrations_or_restart_authorized": false,
"architecture_whole_v0_9_accepted": false,
"agent_autonomy_promoted": false,
"standing_privilege_or_default_flip": false,
"KEY39_T02_closed": false
}