key-cape/docs/offline-checker-owner-review-2026-10-16.md

KeyCape owner review: exact offline configuration checker

Reviewer: key-cape-owner (agent key-cape, codex)
Decision: approved for the bounded source/artifact behavior below
Work item: KEY-WP-0038-T02 (remains wait)
Date: 2026-10-16

KeyCape endorses the offline configuration validation behavior of published source 3c71226a1a7b8a2bdb710e9c497e1a1f7f8a3987, src tree f0010b9cab17dbc3a787628a29657d98b900320f, and the Linux/amd64 Go 1.23.0 artifact SHA256 be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5 (13,633,409 bytes). This review is an owner judgement, not human approval, production authorization or native admission.

The INTENT.md basis is KeyCape's Tooling declaration, Purpose/Primary Utility and Strategic Boundaries: deterministic profile-constrained authentication tooling, explicit configuration checks, delivered secret references, and separation from authorization decisions. The review stays within these responsibilities.

Source and build evidence

The candidate's source archive matches the exact published revision and src tree. Independent owner checks matched all 108 archived source files, 9876 cached Go toolchain files and every file in the ten selected module source trees against the closure. The closure JSON SHA256 is cb2f8ce0a3ee1efb7099ce00d139ebe00a23a8b356fba160ab8c4b067f5818f9; archive SHA256 is 770a15933e6c45d4b94beb37d4322fd4ae1436d8193dfb7f5655bbc851f3fc73. The actual executable matches the artifact above. Its command is the existing ./cmd/keycape target, also built by the owner Makefile/Dockerfile. The retained build uses explicit environment, cached Go 1.23.0, readonly module resolution, CGO disabled, fixed Linux/amd64/v1, trimpath and buildvcs=false, GOPROXY=off and GOSUMDB=off. These are deterministic local input checks, not independent attestation of upstream toolchain/module provenance or host custody.

main.go dispatches check-config first, before server config processing, private-key loading, adapter construction, policy-store opening or listener startup. checkconfig.go calls the same config.Load, ValidateConfig, global lifetime parse, and registry conversion used by startup, with a constant placeholder in place of client-secret lookup. policy.CheckClients checks registry shape without opening the policy store. Source inspection found no application init path that reads credentials or contacts an upstream for this command. No KeyCape private-key read, client-secret lookup, upstream request, listener, real authentication or signing occurs in this branch.

Fourteen direct executable checks passed: valid confidential/public registrations without any actual secret/key; bad port/lifetime/query redirect/browser roles; missing declared env name; omitted and empty env-name semantics; required policy client presence with and without policy assertion; non-secret URL environment overlay; synthetic secret non-emission; permissive unknown YAML field handling; and success with an unopened signing-key FIFO plus unused policy path. The three relevant package suites (cmd/keycape, internal/config, internal/server/policy) passed. The first package-suite attempt failed because the candidate src-only archive omitted two committed external config fixtures. It is retained. Rerun added only those fixture paths archived from the exact reviewed revision. The coordinator separately reports reproducing the same artifact and eight adapter fixture checks; that is supporting coordinator evidence, not an owner claim of native or caller integration acceptance.

Contract and limitations

• Always pass the explicit synthetic/config path. This command loads the supplied YAML file; it cannot guarantee the caller supplied only non-secret contents.
• config.Load reads the non-secret KEYCAPE_ACCOUNT_PORTAL_URL and KEYCAPE_BROWSER_LOGOUT_URL environment overrides. Validation therefore is not independent of the caller environment. The caller must intentionally supply the desired URL configuration in a minimal environment. This endorsement does not certify the current NetKingdom subprocess environment or its correction.
• --env-names checks names only when its value is nonempty. Omitted/empty means list required names without proving their provision. Even nonempty assertions prove neither Secret existence, values, mount/ESO delivery nor readable custody.
• --policy-store asserts the target enables that store and checks its required clients. It proves no path permissions, lock availability or stored state.
• The loader follows existing server YAML semantics, including acceptance of unknown fields. Validation is the implemented startup subset, not a complete OIDC/profile policy or schema audit. It does not strengthen every currently accepted redirect/grant/client field.
• No key existence/parsing, policy-file access, port binding, upstream readiness, live config equivalence, browser flow, token claims, group enforcement, secret minting/delivery, consumer login or actual human/agent/service identity is proved.
• Exact byte identity does not establish immutable executable storage, safe file descriptors, launch custody, type/version acknowledgement, descriptor step-set composition, Warden admission or parent-session revocation. Those remain with the respective owners. No other owner role is endorsed here.

No blocking defect was found within this exact offline checker scope. The broader browser registration and identity tasks remain open. No production configuration, credentials, cluster mutations, external messages or paid calls were used.

Reproduction and detailed local receipts are in the-custodian/docs/changes/netkingdom-target-2026-10-16/keycape-checker-owner-review/: review_checks.py, owner-checks.json, source-tests.json, source-tests.txt and source-tests-first-attempt.txt. Original candidate build/closure receipts remain in the adjacent browser-checker-artifact-next/ packet, including failed closure collection attempts.