net-kingdom/docs/forgejo-type12-source-acknowledgment-followthrough.md

# Forgejo type1.2 source acknowledgment and existing implementation gates

Confirmed human source ACCEPT at2026-10-11T06:47:39Z is recorded separately from
implementation. Exact type package lives at
security-case-type-revisions/1.2/oidc-browser-relying-party/; its external
decision/acknowledgment.json binds actual memo, human actor/disposition, packet,
proposed/acknowledged source hashes and post-anchor review. Type.yaml changes
only semantic status proposed→acknowledged; README history and one test expectation
adapt to the recorded source state. The frozen proposed human packet stays
immutable. Independent acknowledged-package validator and22 tests pass; closed
schema/version load and identical c0afd preparation render are proved.

Current canonical1.1 package and accepted1.1 case remain unchanged, without
inherited1.2 authority. At source acknowledgment, load_type read one type.yaml per id and required
exact version, so selecting1.2 as default would break that1.1 case. The explicit
version root loads1.2 through existing --types/--types-root input, only for source
validation/preparation. This record changes no resolver/default, native broker
pin, canonicalcase or adapter. The1.2 reference remains proposed without
acceptance fields; normal admission still refuses acknowledged/unimplemented type.
Separate Apps receipt records only actual human reference-design scope.

## Actual next source/proof gates in existing work

| Owner work | Remaining contract and evidence |
| --- | --- |
| NK-WP-0048-T06 / existing ORGREF driver | Deliberately integrate explicit version selection and first-reference source receipts under the accepted lifecycle. Ordinary case acceptance requires implemented type; preparation flags and design receipt are no waiver. Define source bootstrap integration without inventing canonical admission. Type becomes implemented only after materialization/follow-through capability and actual live verified reference proof, with distinct owner acceptance. |
| WARDEN-WP-0044-T03, then T04 | Current case_run.py is a closed local kernel with no installed owner adapters/live CLI dispatch; case_receipt_state.py is a pure/proposed reducer. Need exact owner-acknowledged descriptors/adapters, independently authenticated global provenance verifier, durable attempt/recovery receipts, bounded caller grant/session/source pins and confirmed revocation. No shell/type prose execution, privilege manufacture, native success from local prototype or pending-owner receipt. |
| MASON-WP-0010-T03, then T04 | Current case_structure.py prepares typed evidence requests, not native materialization. Rebuild reviewed source deliberately with exact version/type/case/render and corrected CCR targets; obtain independent authenticated layout/policy/role/catalog observations and created-versus-preexisting ownership/change receipts for all six objects. No mint prerequisite for structural proof and no trusted self-authored JSON acceptance. Preserve old wrong-target bundle refusal. |
| Platform existing CCR-2026-0042 and broker owner path | Reconcile historical/current/proposed body and actual exact SA/namespace/audience/read-only policy; bound claims are still false. Any source broker/case pin adaptation needs exact owner review and source tests, not blanket version bypass. Native apply/capabilities/created-object/issued-token revocation or verified-expiry receipts require separately approved authority. A source role deletion does not revoke issued tokens. |
| NetKingdom/KeyCape registration/group/env owners | Supply exact attended registration/config/group/verify/undo adapters or owner receipt-only steps through existing lanes. Bind registry/environment/groups to reviewed case; do not substitute user-engine runtime identity or give Warden new broad Kubernetes authority. Native unknown outcomes remain unresolved pending owner reconciliation. |
| RAPPS-WP-0016-T02, with its existing T01 prerequisite | Refresh exact ESO/CRD/RBAC/dedicatedSA/no legacy refs and target ownership metadata. Prepare reviewed Helm OIDC secret consumption and group enforcement adapters or receipt-only consumer step; native Store/ExternalSecret Ready is not browser/MFA/group refusal, break-glass/account-link or first-case completion. Shared ESO trust/default workloadSA remain explicit. |

All created-only undo retains immutable UIDs/ownership and exact source references;
preserve matched/shared resources, revert consumer references first, revoke issued
reader tokens or independently prove expiry before role removal, then policy.
No new login/remint or speculative delete authority follows from this record.
Existing native acceptance and human gates remain in their current owner/project
records. This document adds no broad plan, promoted residual or implementation
permission and marks no existing implementation task done.

## Source-only explicit selection integration — 2026-10-11

A bounded optional version_roots input and CLI --version-root VERSION=PATH now prepare exact1.2 selection alongside the unchanged --types default. Matching exact version chooses one declared root; missing/mismatched/duplicate/symlinked source refuses without fallback. Source type ID/version must equal the case reference, including direct validation/render callers. Existing two-argument callers remain default-only; no automatic Mason/Warden/native adoption or highest/latest version resolver is introduced. See tools/security-case-types/README.md and docs/evidence/2026-10-11-explicit-type-version-selection/source-integration-validation.json.

Actual canonical1.1 is acknowledged (not implemented); its historical accepted case is retained exactly, including ordinary-admission refusal and the existing nonexecuting preparation behavior. Both1.1 and acknowledged1.2 remain refused in ordinary admission. The original and staged1.1 preparation CLI output bytes match exactly (digest e64b56e4...);1.2 mapped preparation equals its direct-root render (digest c0afd557...). No type status/canonical case/acknowledgment is rewritten. Forty-three validator tests cover exact selection, malformed/traversal/ambiguity/no-fallback, pin separation, deterministic plan-only rendering and unchanged ordinary gates. These are maker source checks, not formal NetKingdom owner agreement or native implementation proof.

NK-WP-0048-T06 remains wait in its existing ORGREF cross-owner driver. Source selection alone does not provide first-reference owner receipts, implemented type, case acceptance/materialized/live status, owner adapters/global authenticated verifier, broker source reconciliation or attended/native proof. Those existing remaining gates and approvals are unchanged.