Prepare reviewed Forgejo type 1.2 source decision package
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
parent
c26b018328
commit
584a964684
41 changed files with 5515 additions and 0 deletions
|
|
@ -0,0 +1,34 @@
|
|||
# Proposed OIDC browser relying-party 1.2 package
|
||||
|
||||
This package supplements the exact proposed 1.2 type and Forgejo reference design. It is source-only and unimplemented. Its examples are proposed, including Forgejo; normal admission must refuse them until the separate implemented-type and canonical-case acceptance requirements are discharged. Completing this package or acknowledging its type does not accept a canonical case or authorize native work. Immutable acknowledged 1.1 history remains unchanged.
|
||||
|
||||
## Purpose
|
||||
|
||||
Register exact-redirect browser OIDC relying parties through KeyCape, with groups enforced by the consumer. Confidential clients add a custody path, two reader policies, the existing KeyCape ESO role and a sixth dedicated consumer ESO reader role. consumer_namespace is explicit and independently constrained; a consuming service name does not establish its namespace or workload identity. Public clients require no secret materialization.
|
||||
|
||||
## Threat model
|
||||
|
||||
Exact HTTPS redirects prohibit wildcard, query, fragment and plaintext HTTP. Requested scopes always include groups, but KeyCape issues identity tokens without a per-client group gate: each consumer must enforce its required claims. MFA pinning is client configuration, not proof of a human MFA session. Secret custody parameters and reader identities cannot be overridden by case authors.
|
||||
|
||||
The namespace SecretStore references a dedicated automount-disabled service account rather than forgejo/default. ESO's broadly privileged common controller remains trusted; this is routing and identity attribution, not cryptographic controller isolation. The supported v0.16.1 TokenRequest path requests a 600-second token; its legacy fallback must not acquire static tokens. The proposed OpenBao role has a 900-second maximum token TTL and no default policy. Neither rendered claims nor source tests prove native bindings, token audience, capabilities, delivery readiness or revocation.
|
||||
|
||||
## Alternatives considered
|
||||
|
||||
Retain 1.1 with the observed Forgejo/runner workload ServiceAccount forgejo/default: preserves existing history but does not express the dedicated reader boundary. This describes observed workload identity only; the historical 1.1 consumer OpenBao policy was unbound and no historical default-SA OpenBao reader binding is claimed. Reuse the KeyCape reader role: combines provider and consumer identities unnecessarily. Adopt a separate controller: potentially reduces shared trust but adds infrastructure outside this bounded proposal. Proposed 1.2 retains shared-controller trust explicitly while adding the sixth dedicated role; no new grant follows from this source design.
|
||||
|
||||
## Known limits
|
||||
|
||||
All native bound claims remain unconfirmed and execution remains false. HTTP OpenBao transport, shared ESO controller trust, legacy fallback, retained target Secrets and later dependency handling require owner verification before any separately approved session. A SecretStore/SA deletion alone does not revoke issued tokens. Recovery may remove only authenticated case-created resources with unchanged UID/ownership, must preserve preexisting exact matches, revert consumer references first and revoke issued tokens or verify expiry before declaring deactivation. Owner adapter and global verifier observations remain required. No human login, MFA, credentials, native materialization or first-case completion is claimed.
|
||||
|
||||
## Verification
|
||||
|
||||
Run the existing owner full-package validator against this directory, then run its tests. Tests use the existing owner validator/composer and actual declarations; they prove source schema, examples, deterministic rendering, six-object confidential versus public boundaries, refused mutation/parameters, normal admission refusal and bounded rollback ordering. They do not contact native services.
|
||||
|
||||
```sh
|
||||
python3 tools/security-case-types/security_case_validator.py validate-type docs/proposals/2026-10-11-forgejo-consumer-eso/package-1.2
|
||||
NET_KINGDOM_ROOT=/home/worsch/net-kingdom python3 -m pytest docs/proposals/2026-10-11-forgejo-consumer-eso/package-1.2/tests
|
||||
```
|
||||
|
||||
## Governance and recording
|
||||
|
||||
SecurityCaseTypes section 3 requires the complete package and a separate NetKingdom source-owner review before type acknowledgment recording. Sections 4/5 require an implemented type for canonical case acceptance; section 6 requires a genuine new acknowledgment for the sixth role/authentication path. The old 1.1 acknowledgment is not inherited. Reference-migration source approval is a separate owner receipt; canonical 1.2 stays proposed without acceptance fields or phase acceptance.
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
apiVersion: netkingdom.io/security-case/v0.1
|
||||
kind: SecurityCase
|
||||
spec:
|
||||
id: example-public-portal
|
||||
type: oidc-browser-relying-party@1.2
|
||||
status: proposed
|
||||
owner:
|
||||
repo: net-kingdom
|
||||
person: example-owner
|
||||
parameters:
|
||||
client_id: example-portal
|
||||
display_name: Example portal
|
||||
redirect_uris: https://portal.example.invalid/auth/callback
|
||||
allowed_scopes: openid,profile,email,groups
|
||||
client_type: public
|
||||
mfa_required: 'false'
|
||||
access_groups: example-portal-users
|
||||
consuming_service: example-portal
|
||||
consumer_owner_repo: net-kingdom
|
||||
consumer_namespace: example-portal
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
apiVersion: netkingdom.io/security-case/v0.1
|
||||
kind: SecurityCase
|
||||
spec:
|
||||
id: forgejo-netkingdom-oidc
|
||||
type: oidc-browser-relying-party@1.2
|
||||
status: proposed
|
||||
owner:
|
||||
repo: railiance-apps
|
||||
person: founder
|
||||
parameters:
|
||||
client_id: forgejo
|
||||
display_name: Forgejo source forge
|
||||
redirect_uris: https://forgejo.coulomb.social/user/oauth2/netkingdom/callback
|
||||
allowed_scopes: openid,profile,email,groups
|
||||
client_type: confidential
|
||||
mfa_required: 'true'
|
||||
access_groups: forge-admins,forge-coulomb-owners,forge-coulomb-readers
|
||||
initial_members: forge-admins=tegwick;forge-coulomb-owners=tegwick
|
||||
consuming_service: forgejo
|
||||
consumer_owner_repo: railiance-apps
|
||||
consumer_namespace: forgejo
|
||||
|
|
@ -0,0 +1,88 @@
|
|||
"""Source-only contract checks against the actual owner validator and declarations."""
|
||||
import copy, importlib.util, os, sys
|
||||
from pathlib import Path
|
||||
import pytest, yaml
|
||||
PACKAGE=Path(__file__).resolve().parents[1]
|
||||
OWNER=Path(os.environ.get("NET_KINGDOM_ROOT", "/home/worsch/net-kingdom"))
|
||||
VP=OWNER/"tools/security-case-types/security_case_validator.py"
|
||||
sys.path.insert(0,str(VP.parent))
|
||||
spec=importlib.util.spec_from_file_location("security_case_validator",VP)
|
||||
v=importlib.util.module_from_spec(spec);sys.modules[spec.name]=v;spec.loader.exec_module(v)
|
||||
TYPE=yaml.safe_load((PACKAGE/"type.yaml").read_text())
|
||||
FORGEJO=yaml.safe_load((PACKAGE/"examples/forgejo.yaml").read_text())
|
||||
paths,discovery=v.discover_declarations(TYPE,OWNER.parent)
|
||||
DECLS,loading=v.composer.load_declarations(paths)
|
||||
def render(case):
|
||||
issues,result=v.render_case(case,TYPE,DECLS,require_implemented=False)
|
||||
assert not v.has_errors(discovery+loading+issues)
|
||||
return result
|
||||
|
||||
def test_full_package_and_proposed_boundary():
|
||||
assert not v.has_errors(v.validate_type(TYPE,PACKAGE))
|
||||
assert TYPE["spec"]["status"]=="proposed"
|
||||
assert FORGEJO["spec"]["status"]=="proposed"
|
||||
assert "acceptance" not in FORGEJO["spec"]
|
||||
assert v.has_errors(v.validate_case(FORGEJO,TYPE))
|
||||
|
||||
def test_acknowledged_is_still_not_implemented_admission():
|
||||
acknowledged=copy.deepcopy(TYPE);acknowledged["spec"]["status"]="acknowledged"
|
||||
assert v.has_errors(v.validate_case(FORGEJO,acknowledged))
|
||||
|
||||
@pytest.mark.parametrize("example",sorted((PACKAGE/"examples").glob("*.yaml")))
|
||||
def test_examples_valid_deterministic_and_nonexecuting(example):
|
||||
case=yaml.safe_load(example.read_text())
|
||||
assert not v.has_errors(v.validate_case(case,TYPE,require_implemented=False))
|
||||
first=render(case);assert first==render(case)
|
||||
assert first["execution"]["permitted"] is False
|
||||
assert first["composition"]["execution"]["permitted"] is False
|
||||
|
||||
def test_sixth_role_is_exact_consumer_identity_and_namespace():
|
||||
case=copy.deepcopy(FORGEJO);case["spec"]["parameters"]["consumer_namespace"]="forgejo-preview"
|
||||
r=render(case);objects={x["id"]:x for x in r["materialization"]}
|
||||
assert len(objects)==6
|
||||
consumer=yaml.safe_load(objects["consumer-eso-role"]["body"])
|
||||
assert consumer["bound_service_account_names"]==["forgejo-keycape-forgejo-eso"]
|
||||
assert consumer["bound_service_account_namespaces"]==["forgejo-preview"]
|
||||
assert consumer["audience"]=="openbao"
|
||||
assert consumer["token_policies"]==["workload-kv-read-keycape-forgejo-forgejo"]
|
||||
assert consumer["token_no_default_policy"] is True
|
||||
provider=yaml.safe_load(objects["eso-role"]["body"])
|
||||
assert provider["bound_service_account_names"]!=consumer["bound_service_account_names"]
|
||||
|
||||
def test_original_five_structural_bodies_unchanged():
|
||||
old=yaml.safe_load((OWNER/"security-case-types/oidc-browser-relying-party/type.yaml").read_text())
|
||||
case=yaml.safe_load((OWNER/"security-cases/forgejo-netkingdom-oidc.yaml").read_text())
|
||||
issues,before=v.render_case(case,old,DECLS,require_implemented=False)
|
||||
assert not v.has_errors(issues)
|
||||
after={x["id"]:x["body"] for x in render(FORGEJO)["materialization"]}
|
||||
for item in before["materialization"]:assert item["body"]==after[item["id"]]
|
||||
|
||||
def test_public_has_no_secret_or_delivery_hooks():
|
||||
r=render(yaml.safe_load((PACKAGE/"examples/example-public-portal.yaml").read_text()))
|
||||
assert [x["id"] for x in r["materialization"]]==["catalog-entry"]
|
||||
assert not {"mint-secret","deliver-secret","deliver-consumer-secret","bind-env"}&{x["id"] for x in r["follow_through"]}
|
||||
|
||||
@pytest.mark.parametrize("key,value",[("consumer_namespace",None),("consumer_namespace","default/other"),("consumer_namespace","x"*64),("consuming_service","x"*64),("redirect_uris","http://portal.invalid/callback"),("redirect_uris","https://portal.invalid/*"),("redirect_uris","https://portal.invalid/callback?x=y"),("redirect_uris","https://portal.invalid/callback#x"),("allowed_scopes","openid,email"),("consumer_reader_service_account","default"),("secret_path","other/path")])
|
||||
def test_invalid_or_unsettable_parameter_refused(key,value):
|
||||
case=copy.deepcopy(FORGEJO)
|
||||
if value is None:case["spec"]["parameters"].pop(key)
|
||||
else:case["spec"]["parameters"][key]=value
|
||||
assert v.has_errors(v.validate_case(case,TYPE,require_implemented=False))
|
||||
|
||||
def test_created_only_role_recovery_precedes_policy_and_needs_revocation():
|
||||
rollback=render(FORGEJO)["rollback"];ids=[x["reverses"] for x in rollback]
|
||||
assert ids.index("consumer-eso-role")<ids.index("consumer-reader-policy")
|
||||
action=next(x["action"] for x in rollback if x["reverses"]=="consumer-eso-role")
|
||||
assert "case-created" in action and "revoke" in action and "expiration" in action
|
||||
delivery=next(x["action"] for x in rollback if x["reverses"]=="deliver-consumer-secret")
|
||||
assert "UID" in delivery and "preexisting" in delivery and "consumer secret reference" in delivery
|
||||
|
||||
@pytest.mark.parametrize("omitted",["README.md","tests/test_source_contract.py","examples"])
|
||||
def test_full_package_validator_rejects_incomplete_supplement(tmp_path,omitted):
|
||||
import shutil
|
||||
trial=tmp_path/"package";shutil.copytree(PACKAGE,trial,ignore=shutil.ignore_patterns("__pycache__",".pytest_cache"))
|
||||
target=trial/omitted
|
||||
if target.is_dir():
|
||||
for example in target.glob("*.yaml"):example.unlink()
|
||||
else:target.unlink()
|
||||
assert v.has_errors(v.validate_type(TYPE,trial))
|
||||
|
|
@ -0,0 +1,442 @@
|
|||
apiVersion: netkingdom.io/security-case-type/v0.1
|
||||
kind: SecurityCaseType
|
||||
spec:
|
||||
id: oidc-browser-relying-party
|
||||
version: '1.2'
|
||||
status: proposed
|
||||
title: Browser OIDC relying party for an internal service
|
||||
purpose: 'Let an internal web service sign its human users in through NetKingdom
|
||||
(KeyCape): an exact-redirect OIDC client, optional MFA pin, the LLDAP groups the
|
||||
service maps to its own roles, and, for confidential clients, a client secret
|
||||
minted straight into OpenBao custody. Replaces the per-client rollout scripts
|
||||
in sso-mfa/k8s/keycape. First case: Forgejo (KEY-WP-0038).'
|
||||
parameters:
|
||||
- name: client_id
|
||||
type: string
|
||||
case_settable: true
|
||||
constraints:
|
||||
pattern: ^[a-z0-9][a-z0-9-]{1,62}$
|
||||
sensitivity: operational
|
||||
description: OAuth2 client_id, unique in KeyCape.
|
||||
- name: display_name
|
||||
type: string
|
||||
case_settable: true
|
||||
constraints:
|
||||
pattern: ^[^\n\r]{1,80}$
|
||||
sensitivity: public
|
||||
description: Name shown on the sign-in page.
|
||||
- name: redirect_uris
|
||||
type: string
|
||||
case_settable: true
|
||||
constraints:
|
||||
pattern: ^https://[^*?#\s,]+(,https://[^*?#\s,]+)*$
|
||||
sensitivity: security_sensitive
|
||||
description: 'Comma-separated exact https redirect URIs. No wildcards, no plain
|
||||
http, no query and no fragment: KeyCape refuses ''*'' and ''?'' at startup,
|
||||
and OAuth 2.0 forbids fragments (key-cape type review R1).'
|
||||
- name: allowed_scopes
|
||||
type: string
|
||||
case_settable: true
|
||||
constraints:
|
||||
enum:
|
||||
- openid,profile,email,groups
|
||||
- openid,email,groups
|
||||
- openid,profile,groups
|
||||
- openid,groups
|
||||
sensitivity: security_sensitive
|
||||
description: Scopes the client may request, openid first. Always includes groups,
|
||||
because access_groups is required and KeyCape's UserInfo returns groups only
|
||||
for that scope (key-cape type review R2).
|
||||
- name: client_type
|
||||
type: string
|
||||
case_settable: true
|
||||
constraints:
|
||||
enum:
|
||||
- confidential
|
||||
- public
|
||||
sensitivity: security_sensitive
|
||||
description: confidential for server-side services that can hold a secret; public
|
||||
for SPAs and native apps (PKCE only).
|
||||
- name: mfa_required
|
||||
type: string
|
||||
case_settable: true
|
||||
constraints:
|
||||
enum:
|
||||
- 'true'
|
||||
- 'false'
|
||||
sensitivity: security_sensitive
|
||||
description: '"true" pins MFA on this client; required when the service grants
|
||||
administrative or owner rights. "false" is not "no MFA": the client then carries
|
||||
no mfaRequired field and KeyCape applies the per-user privacyIDEA policy. A
|
||||
renderer must never emit an explicit mfaRequired false, which would skip that
|
||||
policy (key-cape type review R3).'
|
||||
- name: access_groups
|
||||
type: string
|
||||
case_settable: true
|
||||
constraints:
|
||||
pattern: ^[a-z][a-z0-9-]{1,62}(,[a-z][a-z0-9-]{1,62})*$
|
||||
sensitivity: operational
|
||||
description: 'Comma-separated LLDAP groups that the service maps to its roles.
|
||||
Created if absent. KeyCape has no per-client group gate: it issues tokens to
|
||||
any authenticated user and only carries the groups claim, so the consuming service
|
||||
enforces the gate itself (for Forgejo, its required-claim setting; key-cape
|
||||
type review R2).'
|
||||
- name: initial_members
|
||||
type: string
|
||||
required: false
|
||||
case_settable: true
|
||||
constraints:
|
||||
pattern: ^[a-z][a-z0-9-]*=[a-z][a-z0-9._-]*(\+[a-z][a-z0-9._-]*)*(;[a-z][a-z0-9-]*=[a-z][a-z0-9._-]*(\+[a-z][a-z0-9._-]*)*)*$
|
||||
sensitivity: operational
|
||||
description: Initial memberships as group=user+user;group=user. Usernames are
|
||||
directory usernames, never secrets.
|
||||
- name: consuming_service
|
||||
type: string
|
||||
case_settable: true
|
||||
constraints:
|
||||
pattern: ^[a-z0-9][a-z0-9-]{0,62}$
|
||||
sensitivity: operational
|
||||
description: The service that signs users in with this client.
|
||||
- name: consumer_owner_repo
|
||||
type: string
|
||||
case_settable: true
|
||||
constraints:
|
||||
pattern: ^[a-z0-9][a-z0-9-]*$
|
||||
sensitivity: operational
|
||||
description: The repository that owns the consuming service's configuration.
|
||||
- name: consumer_namespace
|
||||
type: string
|
||||
case_settable: true
|
||||
constraints:
|
||||
pattern: ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$
|
||||
sensitivity: security_sensitive
|
||||
description: Consumer namespace for namespaced ESO TokenRequest reader; actual
|
||||
workload owner must confirm; never infer from service name.
|
||||
- name: issuer
|
||||
type: string
|
||||
case_settable: false
|
||||
default: https://kc.coulomb.social
|
||||
sensitivity: security_sensitive
|
||||
description: The NetKingdom issuer; fixed by the type.
|
||||
composition:
|
||||
authority: netkingdom
|
||||
initial_trust:
|
||||
- runtime_secret_trust
|
||||
- runtime_identity_trust
|
||||
capabilities:
|
||||
- c1.lightweight-sso
|
||||
providers:
|
||||
c1.lightweight-sso: net-kingdom.keycape-client-registration
|
||||
parameter_bindings:
|
||||
net-kingdom.keycape-client-registration.client_id: client_id
|
||||
net-kingdom.keycape-client-registration.display_name: display_name
|
||||
net-kingdom.keycape-client-registration.redirect_uris: redirect_uris
|
||||
net-kingdom.keycape-client-registration.allowed_scopes: allowed_scopes
|
||||
net-kingdom.keycape-client-registration.client_type: client_type
|
||||
net-kingdom.keycape-client-registration.mfa_required: mfa_required
|
||||
materialization:
|
||||
- id: client-secret-path
|
||||
kind: kv_path
|
||||
when: client_type == confidential
|
||||
template: platform/workloads/keycape/{client_id}
|
||||
body: field CLIENT_SECRET; minted by the credential broker, never written by hand
|
||||
- id: keycape-reader-policy
|
||||
kind: openbao_policy
|
||||
when: client_type == confidential
|
||||
template: workload-kv-read-keycape-{client_id}-eso
|
||||
body: "path \"platform/data/workloads/keycape/{client_id}\" {{\n capabilities\
|
||||
\ = [\"read\"]\n}}\n"
|
||||
description: KeyCape reads its client secret only through ESO. No metadata, list,
|
||||
parent or sibling access.
|
||||
- id: consumer-reader-policy
|
||||
kind: openbao_policy
|
||||
when: client_type == confidential
|
||||
template: workload-kv-read-keycape-{client_id}-{consuming_service}
|
||||
body: "path \"platform/data/workloads/keycape/{client_id}\" {{\n capabilities\
|
||||
\ = [\"read\"]\n}}\n"
|
||||
description: The consuming service reads the same secret. No metadata, list, parent
|
||||
or sibling access.
|
||||
- id: eso-role
|
||||
kind: openbao_role
|
||||
when: client_type == confidential
|
||||
template: external-secrets-keycape-{client_id}
|
||||
body: 'auth: kubernetes
|
||||
|
||||
bound_service_account_names: [external-secrets]
|
||||
|
||||
bound_service_account_namespaces: [external-secrets]
|
||||
|
||||
token_policies: [workload-kv-read-keycape-{client_id}-eso]
|
||||
|
||||
token_no_default_policy: true
|
||||
|
||||
token_ttl: 15m
|
||||
|
||||
token_max_ttl: 15m
|
||||
|
||||
'
|
||||
description: The Kubernetes-auth role deliver-secret uses; bound to the ESO service
|
||||
account only.
|
||||
- id: consumer-eso-role
|
||||
kind: openbao_role
|
||||
when: client_type == confidential
|
||||
template: external-secrets-keycape-{client_id}-{consuming_service}
|
||||
body: 'auth: kubernetes
|
||||
|
||||
bound_service_account_names: [{consuming_service}-keycape-{client_id}-eso]
|
||||
|
||||
bound_service_account_namespaces: [{consumer_namespace}]
|
||||
|
||||
audience: openbao
|
||||
|
||||
token_policies: [workload-kv-read-keycape-{client_id}-{consuming_service}]
|
||||
|
||||
token_no_default_policy: true
|
||||
|
||||
token_ttl: 15m
|
||||
|
||||
token_max_ttl: 15m
|
||||
|
||||
'
|
||||
description: Consumer ESO requests a token for this separate reference identity.
|
||||
Common ESO controller remains trusted and can request tokens; no cryptographic
|
||||
controller isolation is claimed.
|
||||
- id: catalog-entry
|
||||
kind: catalog_entry
|
||||
template: '{consuming_service}-keycape-client'
|
||||
body: 'id: {consuming_service}-keycape-client
|
||||
|
||||
owner_repo: key-cape
|
||||
|
||||
warden_executes: false
|
||||
|
||||
risk: high
|
||||
|
||||
status: active once verification passes
|
||||
|
||||
workload_ref: applicable, name {consuming_service}, declaration_ref of the consumer''s
|
||||
published declaration or the explicit unknown form, never inferred
|
||||
|
||||
path_template: platform/workloads/keycape/{client_id}
|
||||
|
||||
field: CLIENT_SECRET
|
||||
|
||||
delegation: native, intended_owner key-cape
|
||||
|
||||
rotation: mint-secret then verification; automatable false until a run has been
|
||||
proven
|
||||
|
||||
'
|
||||
description: One entry per case (ops-mason item 5, ops-warden R4'). It carries
|
||||
the consumer's workload reference, which ADR-0009 needs for zone selection.
|
||||
follow_through:
|
||||
- id: ensure-groups
|
||||
owner: net-kingdom
|
||||
entry_point: identity-provisioner ensure_service_groups, run inside the provisioner
|
||||
pod through the session's contained cluster access (groups {access_groups};
|
||||
members exactly {initial_members} as recorded in the accepted case, nothing
|
||||
else)
|
||||
auth: operator cluster access in the attended register-client session; the in-pod
|
||||
call uses the provisioner's own directory binding, and no provisioner or user-engine
|
||||
token is read or sent
|
||||
lane: key-cape-oidc-login
|
||||
warden_executes: false
|
||||
attended: true
|
||||
value_handling: none
|
||||
attended_justification: The provisioner's only HTTP credential is user-engine's
|
||||
runtime token, and its NetworkPolicy admits only user-engine pods. A proxy lane
|
||||
would act as user-engine (ops-warden review R8; canon section 3; ops-warden
|
||||
ADR-0002). Running it in the session register-client already needs adds no attended
|
||||
session. It can become unattended once the provisioner has an operator credential
|
||||
of its own and an admitted path.
|
||||
- id: mint-secret
|
||||
owner: railiance-platform
|
||||
when: client_type == confidential
|
||||
entry_point: 'railiance-platform credential broker: generate a client secret inside
|
||||
custody at bao:platform/workloads/keycape/{client_id}'
|
||||
auth: the caller's broker grant for the case's KV path, through its lane; the
|
||||
value is generated in custody and never returned
|
||||
lane: keycape-client-secret-generate
|
||||
warden_executes: true
|
||||
attended: false
|
||||
value_handling: generated_in_custody
|
||||
- id: deliver-secret
|
||||
owner: railiance-platform
|
||||
when: client_type == confidential
|
||||
entry_point: ExternalSecret sso/keycape-{client_id}-client (key client-secret)
|
||||
from bao:platform/workloads/keycape/{client_id}
|
||||
auth: railiance-platform ESO delivery through role external-secrets-keycape-{client_id};
|
||||
no value leaves custody
|
||||
warden_executes: false
|
||||
attended: false
|
||||
value_handling: none
|
||||
ready_check: the delivery for sso/keycape-{client_id}-client reports Ready=True
|
||||
(status only, no value read)
|
||||
- id: bind-env
|
||||
owner: net-kingdom
|
||||
when: client_type == confidential
|
||||
entry_point: 'patch Deployment sso/keycape: env KEYCAPE_{client_id:env}_CLIENT_SECRET
|
||||
from sso/keycape-{client_id}-client'
|
||||
auth: operator kube credentials for namespace sso
|
||||
lane: key-cape-oidc-login
|
||||
warden_executes: false
|
||||
attended: true
|
||||
value_handling: none
|
||||
attended_justification: A change to the live identity provider's Deployment. It
|
||||
runs in the same attended operator session as register-client, before it, because
|
||||
KeyCape resolves a confidential client's secret at start and fails closed if
|
||||
the binding is missing.
|
||||
- id: register-client
|
||||
owner: net-kingdom
|
||||
entry_point: sso-mfa/k8s/keycape/keycape-client.py apply --client-file <client-from-case>
|
||||
--case-acceptance <record> --check-config <keycape binary> (net-kingdom.keycape-client-registration)
|
||||
auth: operator write access to the live KeyCape client registry in namespace sso
|
||||
lane: key-cape-oidc-login
|
||||
warden_executes: false
|
||||
attended: true
|
||||
value_handling: none
|
||||
attended_justification: 'The live KeyCape client registry is a Kubernetes Secret,
|
||||
and agents do not read or write Secrets. Until KeyCape loads clients from a
|
||||
non-secret registry with secrets referenced from custody, one attended operator
|
||||
session applies the rendered registration. ops-warden groups all attended steps
|
||||
of a run into that one session. KeyCape loads clients at startup and keeps login,
|
||||
authorization and handoff state in memory, so the restart drops in-flight logins
|
||||
and sessions for every client; runs go in a quiet window (key-cape type review
|
||||
R4). The rendered registry must pass KeyCape''s own startup checks (keycape
|
||||
check-config, key-cape c528daa, which keycape-client.py runs before it patches)
|
||||
before the restart: a refused entry stops the single replica and every client
|
||||
loses sign-in (R1).'
|
||||
- id: deliver-consumer-secret
|
||||
owner: '{consumer_owner_repo}'
|
||||
when: client_type == confidential
|
||||
entry_point: Owner applies dedicated ServiceAccount {consumer_namespace}/{consuming_service}-keycape-{client_id}-eso
|
||||
(automount=false, no legacy tokens), namespace SecretStore openbao-keycape-{client_id}-consumer
|
||||
with serviceAccountRef and audiences [openbao], and ExternalSecret {consuming_service}-netkingdom-oidc-client
|
||||
with Owner target, Retain remote deletion and only CLIENT_SECRET from workloads/keycape/{client_id}.
|
||||
Admission validates actual installed ESO TokenRequest support and common controller
|
||||
RBAC before any owner-approved apply.
|
||||
auth: Consumer owner contained Kubernetes deployment authority; ESO authenticates
|
||||
to OpenBao role external-secrets-keycape-{client_id}-{consuming_service} with
|
||||
a TokenRequest for the dedicated namespaced serviceAccountRef; controller remains
|
||||
trusted
|
||||
warden_executes: false
|
||||
attended: false
|
||||
value_handling: none
|
||||
ready_check: Namespace SecretStore and ExternalSecret both report Ready=True;
|
||||
dedicated SA has no legacy token refs; status and fixed metadata only, never
|
||||
Secret values.
|
||||
- id: hand-over
|
||||
owner: '{consumer_owner_repo}'
|
||||
entry_point: configure {consuming_service} with issuer {issuer}, client {client_id}
|
||||
and custody bao:platform/workloads/keycape/{client_id}, and make it require
|
||||
one of {access_groups} in the groups claim before sign-in completes
|
||||
auth: the consumer owner's own deployment path
|
||||
warden_executes: false
|
||||
attended: false
|
||||
value_handling: none
|
||||
verification:
|
||||
- id: authorize-accepts-redirects
|
||||
check: GET {issuer}/authorize with client {client_id} and each of {redirect_uris}
|
||||
returns the login page
|
||||
expect: present
|
||||
reads_secret_value: false
|
||||
- id: authorize-refuses-other-redirect
|
||||
check: GET {issuer}/authorize with client {client_id} and an unregistered redirect
|
||||
returns an OAuth error
|
||||
expect: deny
|
||||
reads_secret_value: false
|
||||
- id: custody-denied-to-default
|
||||
when: client_type == confidential
|
||||
check: a default-only OpenBao identity has no read capability on bao:platform/workloads/keycape/{client_id}
|
||||
expect: deny
|
||||
reads_secret_value: false
|
||||
- id: custody-allowed-to-consumer
|
||||
when: client_type == confidential
|
||||
check: policy workload-kv-read-keycape-{client_id}-{consuming_service} grants
|
||||
read on bao:platform/workloads/keycape/{client_id} (capabilities check only)
|
||||
expect: allow
|
||||
reads_secret_value: false
|
||||
- id: groups-present
|
||||
check: LLDAP groups {access_groups} exist, with exactly the memberships of the
|
||||
accepted case added
|
||||
expect: present
|
||||
reads_secret_value: false
|
||||
- id: consumer-enforces-groups
|
||||
check: '{consuming_service}''s OIDC source for {client_id} (owner {consumer_owner_repo})
|
||||
requires one of {access_groups} in the groups claim (configuration read, no
|
||||
secret value)'
|
||||
expect: present
|
||||
reads_secret_value: false
|
||||
- id: secret-delivered
|
||||
when: client_type == confidential
|
||||
check: the delivery for sso/keycape-{client_id}-client reports Ready=True (status
|
||||
only)
|
||||
expect: present
|
||||
reads_secret_value: false
|
||||
- id: mfa-pinned
|
||||
when: mfa_required == true
|
||||
check: keycape-client.py inspect for {client_id} shows the MFA pin on the registered
|
||||
client (non-secret client view)
|
||||
expect: present
|
||||
reads_secret_value: false
|
||||
- id: consumer-secret-delivered
|
||||
when: client_type == confidential
|
||||
check: '{consumer_namespace} SecretStore openbao-keycape-{client_id}-consumer
|
||||
and ExternalSecret {consuming_service}-netkingdom-oidc-client Ready=True, exact
|
||||
dedicated SA/audience role binding, fixed CLIENT_SECRET mapping; no Secret value
|
||||
read'
|
||||
expect: present
|
||||
reads_secret_value: false
|
||||
rollback:
|
||||
- reverses: hand-over
|
||||
action: remove the OIDC source for {client_id} from {consuming_service} (owner
|
||||
{consumer_owner_repo})
|
||||
- reverses: deliver-consumer-secret
|
||||
when: client_type == confidential
|
||||
action: After reverting consumer secret reference, delete only authenticated created
|
||||
ExternalSecret/owned target by UID and ownerReference, then SecretStore and
|
||||
dedicated SA; preserve preexisting-matched resources and never delete a shared
|
||||
target. Retain audit and ownership receipts; removing SecretStore/SA alone is
|
||||
not immediate OpenBao token revocation.
|
||||
- reverses: register-client
|
||||
action: keycape-client.py apply --operation remove for {client_id}
|
||||
- reverses: bind-env
|
||||
when: client_type == confidential
|
||||
action: remove env KEYCAPE_{client_id:env}_CLIENT_SECRET from Deployment sso/keycape,
|
||||
after register-client is reversed
|
||||
- reverses: deliver-secret
|
||||
when: client_type == confidential
|
||||
action: delete ExternalSecret sso/keycape-{client_id}-client and its target
|
||||
- reverses: mint-secret
|
||||
when: client_type == confidential
|
||||
action: 'covered by client-secret-path: one metadata delete, after deliver-secret
|
||||
is reversed'
|
||||
- reverses: ensure-groups
|
||||
action: identity-provisioner revoke_service_groups inside the provisioner pod
|
||||
(attended, as ensure-groups) with the case's memberships; delete_if_empty only
|
||||
if no other case uses {access_groups}
|
||||
- reverses: client-secret-path
|
||||
when: client_type == confidential
|
||||
action: delete metadata and all versions at platform/workloads/keycape/{client_id},
|
||||
after the ExternalSecret is gone (this also reverses mint-secret)
|
||||
- reverses: eso-role
|
||||
when: client_type == confidential
|
||||
action: delete Kubernetes-auth role external-secrets-keycape-{client_id}
|
||||
- reverses: keycape-reader-policy
|
||||
when: client_type == confidential
|
||||
action: delete policy workload-kv-read-keycape-{client_id}-eso, after eso-role
|
||||
- reverses: consumer-eso-role
|
||||
when: client_type == confidential
|
||||
action: Delete only this case-created role external-secrets-keycape-{client_id}-{consuming_service},
|
||||
before deleting consumer-reader-policy; revoke case-issued OpenBao tokens or
|
||||
prove expiration before declaring deactivation.
|
||||
- reverses: consumer-reader-policy
|
||||
when: client_type == confidential
|
||||
action: delete policy workload-kv-read-keycape-{client_id}-{consuming_service}
|
||||
- reverses: catalog-entry
|
||||
action: remove catalog entry {consuming_service}-keycape-client
|
||||
acceptance:
|
||||
accepted_by:
|
||||
- owner
|
||||
- founder
|
||||
risk_class: medium
|
||||
File diff suppressed because one or more lines are too long
|
|
@ -0,0 +1,110 @@
|
|||
id: CCR-2026-0042
|
||||
kind: credential-change-request
|
||||
schema_version: 1
|
||||
request_type: workload-kv-read
|
||||
title: 'forgejo-netkingdom-oidc: proposed dedicated consumer ESO reader (oidc-browser-relying-party@1.2)'
|
||||
status: proposed
|
||||
created: '2026-10-09'
|
||||
updated: '2026-10-11'
|
||||
requester:
|
||||
agent: ops-mason
|
||||
reason: Source-only owner refinement of existing CCR-2026-0042. Proposed type/case1.2 and full run source require
|
||||
new exact acknowledgment; original approvals do not authorize this reader role or native delivery. Historical
|
||||
body retained by exact file hash and provenance below.
|
||||
review:
|
||||
required: true
|
||||
required_approvers:
|
||||
- platform-owner
|
||||
comments: []
|
||||
target:
|
||||
domain: infotech
|
||||
tenant: platform
|
||||
workload: forgejo
|
||||
environment: production
|
||||
purpose: Dedicated namespace-local ESO reference identity delivers CLIENT_SECRET to Forgejo; the Forgejo workload/default
|
||||
SA does not authenticate directly to OpenBao.
|
||||
openbao:
|
||||
mount: platform
|
||||
kv_path: platform/workloads/keycape/forgejo
|
||||
fields:
|
||||
- CLIENT_SECRET
|
||||
policy_name: workload-kv-read-keycape-forgejo-forgejo
|
||||
policy_file: openbao/policies/workload-kv-read-keycape-forgejo-forgejo.hcl
|
||||
metadata_read: false
|
||||
token_self_lifecycle: true
|
||||
auth:
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
role: external-secrets-keycape-forgejo-forgejo
|
||||
audience: openbao
|
||||
ttl: 15m
|
||||
token_max_ttl: 15m
|
||||
token_explicit_max_ttl: 15m
|
||||
token_no_default_policy: true
|
||||
policies:
|
||||
- workload-kv-read-keycape-forgejo-forgejo
|
||||
bound_claims:
|
||||
service_account_names:
|
||||
- forgejo-keycape-forgejo-eso
|
||||
service_account_namespaces:
|
||||
- forgejo
|
||||
bound_claims_confirmed: false
|
||||
access_frontdoor:
|
||||
type: external-secrets
|
||||
catalog_id: forgejo-keycape-client
|
||||
readiness: pending-review
|
||||
resolvable: false
|
||||
risk:
|
||||
classification: high
|
||||
notes:
|
||||
- Rendered from proposed SecurityCaseType/case 1.2 source, not an acknowledged successor. Retained read-only native
|
||||
ESO image/CRD/RBAC and Forgejo identity observations support preparation only; bound claims remain unconfirmed
|
||||
and apply blocked. The new sixth consumer role/auth path requires fresh informed-decision acknowledgment under
|
||||
SecurityCaseTypes canon section 6; acknowledged type 1.1 and accepted case 1.1 do not authorize it.
|
||||
- Exact read on one KV path; no metadata, list, parent or sibling access.
|
||||
- Dedicated reference identity separates consumer and KeyCape role bindings, but common ESO controller already
|
||||
has clusterwide TokenRequest and Secret permissions; no controller compromise isolation is claimed.
|
||||
- ESO v0.16.1 TokenRequest expiry is 600 seconds and its fallback reads legacy SA token references; proposed dedicated
|
||||
SA has no legacy tokens and automount false.
|
||||
- Native publication requires exact1.2 acknowledgment and independent owner changes/created-only receipts; no
|
||||
live grant is issued by this draft.
|
||||
verification:
|
||||
positive:
|
||||
- policy workload-kv-read-keycape-forgejo-forgejo grants read on platform/data/workloads/keycape/forgejo only
|
||||
(capabilities check)
|
||||
negative:
|
||||
- a default-only identity has no read capability on the path
|
||||
- sibling GET and parent LIST are denied
|
||||
activation_conditions:
|
||||
- case acceptance present
|
||||
- bound claims confirmed by the platform owner
|
||||
lifecycle:
|
||||
deactivate: First revert consumer reference and remove only proved-created target/delivery objects; revoke issued
|
||||
reader tokens or await verified expiry, then delete created role and finally policy. Preserve shared/matched
|
||||
objects.
|
||||
rotate: roll-forward through the credential broker (mint-secret); never a read of the old value
|
||||
compromised: owner incident process; no automatic read, reseed or cleanup
|
||||
security_case:
|
||||
case: forgejo-netkingdom-oidc
|
||||
type: oidc-browser-relying-party@1.2
|
||||
render_digest: sha256:c0afd5576cdae0cbc807eccb2b9fa87ac668f15e32ec7cf79d295bdb23c75b35
|
||||
acceptance_record: PENDING exact proposed1.2 owner/founder acknowledgment; original1.1 acceptance is not transferred
|
||||
accepted_at: null
|
||||
accepted_by: []
|
||||
historical_request:
|
||||
path: credential-change-requests/CCR-2026-0042-forgejo-netkingdom-oidc-consumer-reader.yaml
|
||||
sha256: a36ab567839c12660c8ca468c8e4c6a67e367c92ae2ae51851b8e34c35a277f3
|
||||
security_case:
|
||||
case: forgejo-netkingdom-oidc
|
||||
type: oidc-browser-relying-party@1.0
|
||||
render_digest: sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23
|
||||
acceptance_record: key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01);
|
||||
type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e
|
||||
accepted_at: '2026-10-08'
|
||||
accepted_by:
|
||||
- owner
|
||||
- founder
|
||||
proposed_refinement_readiness:
|
||||
owner: railiance-apps
|
||||
blocking_reason: Concrete identity and supported ESO design are prepared; native metadata apply/delivery remains
|
||||
unapproved. Existing ORGREF-WP-0002 coordinates consumer handover and break-glass gates.
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
apiVersion: netkingdom.io/security-case/v0.1
|
||||
kind: SecurityCase
|
||||
spec:
|
||||
id: forgejo-netkingdom-oidc
|
||||
type: oidc-browser-relying-party@1.2
|
||||
status: proposed
|
||||
owner:
|
||||
repo: railiance-apps
|
||||
person: founder
|
||||
parameters:
|
||||
client_id: forgejo
|
||||
display_name: Forgejo source forge
|
||||
redirect_uris: https://forgejo.coulomb.social/user/oauth2/netkingdom/callback
|
||||
allowed_scopes: openid,profile,email,groups
|
||||
client_type: confidential
|
||||
mfa_required: 'true'
|
||||
access_groups: forge-admins,forge-coulomb-owners,forge-coulomb-readers
|
||||
initial_members: forge-admins=tegwick;forge-coulomb-owners=tegwick
|
||||
consuming_service: forgejo
|
||||
consumer_owner_repo: railiance-apps
|
||||
consumer_namespace: forgejo
|
||||
|
|
@ -0,0 +1,57 @@
|
|||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: forgejo-keycape-forgejo-eso
|
||||
namespace: forgejo
|
||||
labels:
|
||||
app.kubernetes.io/name: forgejo
|
||||
app.kubernetes.io/part-of: railiance-apps
|
||||
automountServiceAccountToken: false
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: SecretStore
|
||||
metadata:
|
||||
name: openbao-keycape-forgejo-consumer
|
||||
namespace: forgejo
|
||||
spec:
|
||||
provider:
|
||||
vault:
|
||||
server: http://openbao.openbao.svc:8200
|
||||
path: platform
|
||||
version: v2
|
||||
auth:
|
||||
kubernetes:
|
||||
mountPath: kubernetes
|
||||
role: external-secrets-keycape-forgejo-forgejo
|
||||
serviceAccountRef:
|
||||
name: forgejo-keycape-forgejo-eso
|
||||
audiences:
|
||||
- openbao
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: forgejo-netkingdom-oidc-client
|
||||
namespace: forgejo
|
||||
labels:
|
||||
app.kubernetes.io/name: forgejo
|
||||
app.kubernetes.io/part-of: railiance-apps
|
||||
spec:
|
||||
refreshInterval: 15m
|
||||
secretStoreRef:
|
||||
name: openbao-keycape-forgejo-consumer
|
||||
kind: SecretStore
|
||||
target:
|
||||
name: forgejo-netkingdom-oidc-client
|
||||
creationPolicy: Owner
|
||||
deletionPolicy: Retain
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: forgejo
|
||||
app.kubernetes.io/part-of: railiance-apps
|
||||
data:
|
||||
- secretKey: CLIENT_SECRET
|
||||
remoteRef:
|
||||
key: workloads/keycape/forgejo
|
||||
property: CLIENT_SECRET
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
# First KnownSecurityCase of oidc-browser-relying-party 1.1 (NK-WP-0048-T06).
|
||||
# Parameters are the request the founder accepted on 2026-10-08
|
||||
# (key-cape docs/forgejo-oidc-client-request.yaml, KEY-WP-0038-T01); that
|
||||
# acceptance carries over as this case's acceptance. One difference: custody is
|
||||
# derived by the type (platform/workloads/keycape/forgejo), not the request's
|
||||
# proposed platform/workloads/forgejo/netkingdom-oidc-client. The founder
|
||||
# acknowledged that derivation with the type (memo r4, 2026-10-09).
|
||||
# Re-pinned from 1.0 to 1.1 on 2026-10-10 on the founder's go, before any
|
||||
# apply, so no 1.0 run overlaps (minor change: consumer-enforces-groups).
|
||||
apiVersion: netkingdom.io/security-case/v0.1
|
||||
kind: SecurityCase
|
||||
spec:
|
||||
id: forgejo-netkingdom-oidc
|
||||
type: oidc-browser-relying-party@1.1
|
||||
status: accepted
|
||||
acceptance:
|
||||
at: "2026-10-08"
|
||||
record: "key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01); type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e"
|
||||
by:
|
||||
- {role: owner, name: "founder (for railiance-apps)"}
|
||||
- {role: founder, name: founder}
|
||||
owner:
|
||||
repo: railiance-apps
|
||||
person: founder
|
||||
parameters:
|
||||
client_id: forgejo
|
||||
display_name: Forgejo source forge
|
||||
redirect_uris: https://forgejo.coulomb.social/user/oauth2/netkingdom/callback
|
||||
allowed_scopes: openid,profile,email,groups
|
||||
client_type: confidential
|
||||
mfa_required: "true"
|
||||
access_groups: forge-admins,forge-coulomb-owners,forge-coulomb-readers
|
||||
initial_members: forge-admins=tegwick;forge-coulomb-owners=tegwick
|
||||
consuming_service: forgejo
|
||||
consumer_owner_repo: railiance-apps
|
||||
|
|
@ -0,0 +1,322 @@
|
|||
apiVersion: netkingdom.io/security-case-type/v0.1
|
||||
kind: SecurityCaseType
|
||||
spec:
|
||||
id: oidc-browser-relying-party
|
||||
version: "1.1"
|
||||
status: acknowledged
|
||||
title: "Browser OIDC relying party for an internal service"
|
||||
purpose: >-
|
||||
Let an internal web service sign its human users in through NetKingdom
|
||||
(KeyCape): an exact-redirect OIDC client, optional MFA pin, the LLDAP groups
|
||||
the service maps to its own roles, and, for confidential clients, a client
|
||||
secret minted straight into OpenBao custody. Replaces the per-client rollout
|
||||
scripts in sso-mfa/k8s/keycape. First case: Forgejo (KEY-WP-0038).
|
||||
|
||||
parameters:
|
||||
- name: client_id
|
||||
type: string
|
||||
case_settable: true
|
||||
constraints: {pattern: "^[a-z0-9][a-z0-9-]{1,62}$"}
|
||||
sensitivity: operational
|
||||
description: OAuth2 client_id, unique in KeyCape.
|
||||
- name: display_name
|
||||
type: string
|
||||
case_settable: true
|
||||
constraints: {pattern: "^[^\\n\\r]{1,80}$"}
|
||||
sensitivity: public
|
||||
description: Name shown on the sign-in page.
|
||||
- name: redirect_uris
|
||||
type: string
|
||||
case_settable: true
|
||||
constraints: {pattern: "^https://[^*?#\\s,]+(,https://[^*?#\\s,]+)*$"}
|
||||
sensitivity: security_sensitive
|
||||
description: >-
|
||||
Comma-separated exact https redirect URIs. No wildcards, no plain http, no
|
||||
query and no fragment: KeyCape refuses '*' and '?' at startup, and OAuth
|
||||
2.0 forbids fragments (key-cape type review R1).
|
||||
- name: allowed_scopes
|
||||
type: string
|
||||
case_settable: true
|
||||
constraints: {enum: ["openid,profile,email,groups", "openid,email,groups", "openid,profile,groups", "openid,groups"]}
|
||||
sensitivity: security_sensitive
|
||||
description: >-
|
||||
Scopes the client may request, openid first. Always includes groups,
|
||||
because access_groups is required and KeyCape's UserInfo returns groups
|
||||
only for that scope (key-cape type review R2).
|
||||
- name: client_type
|
||||
type: string
|
||||
case_settable: true
|
||||
constraints: {enum: ["confidential", "public"]}
|
||||
sensitivity: security_sensitive
|
||||
description: confidential for server-side services that can hold a secret; public for SPAs and native apps (PKCE only).
|
||||
- name: mfa_required
|
||||
type: string
|
||||
case_settable: true
|
||||
constraints: {enum: ["true", "false"]}
|
||||
sensitivity: security_sensitive
|
||||
description: >-
|
||||
"true" pins MFA on this client; required when the service grants
|
||||
administrative or owner rights. "false" is not "no MFA": the client then
|
||||
carries no mfaRequired field and KeyCape applies the per-user privacyIDEA
|
||||
policy. A renderer must never emit an explicit mfaRequired false, which
|
||||
would skip that policy (key-cape type review R3).
|
||||
- name: access_groups
|
||||
type: string
|
||||
case_settable: true
|
||||
constraints: {pattern: "^[a-z][a-z0-9-]{1,62}(,[a-z][a-z0-9-]{1,62})*$"}
|
||||
sensitivity: operational
|
||||
description: >-
|
||||
Comma-separated LLDAP groups that the service maps to its roles. Created if
|
||||
absent. KeyCape has no per-client group gate: it issues tokens to any
|
||||
authenticated user and only carries the groups claim, so the consuming
|
||||
service enforces the gate itself (for Forgejo, its required-claim setting;
|
||||
key-cape type review R2).
|
||||
- name: initial_members
|
||||
type: string
|
||||
required: false
|
||||
case_settable: true
|
||||
constraints: {pattern: "^[a-z][a-z0-9-]*=[a-z][a-z0-9._-]*(\\+[a-z][a-z0-9._-]*)*(;[a-z][a-z0-9-]*=[a-z][a-z0-9._-]*(\\+[a-z][a-z0-9._-]*)*)*$"}
|
||||
sensitivity: operational
|
||||
description: "Initial memberships as group=user+user;group=user. Usernames are directory usernames, never secrets."
|
||||
- name: consuming_service
|
||||
type: string
|
||||
case_settable: true
|
||||
constraints: {pattern: "^[a-z0-9][a-z0-9-]*$"}
|
||||
sensitivity: operational
|
||||
description: The service that signs users in with this client.
|
||||
- name: consumer_owner_repo
|
||||
type: string
|
||||
case_settable: true
|
||||
constraints: {pattern: "^[a-z0-9][a-z0-9-]*$"}
|
||||
sensitivity: operational
|
||||
description: The repository that owns the consuming service's configuration.
|
||||
- name: issuer
|
||||
type: string
|
||||
case_settable: false
|
||||
default: https://kc.coulomb.social
|
||||
sensitivity: security_sensitive
|
||||
description: The NetKingdom issuer; fixed by the type.
|
||||
|
||||
composition:
|
||||
authority: netkingdom
|
||||
initial_trust: [runtime_secret_trust, runtime_identity_trust]
|
||||
capabilities: [c1.lightweight-sso]
|
||||
providers:
|
||||
c1.lightweight-sso: net-kingdom.keycape-client-registration
|
||||
parameter_bindings:
|
||||
net-kingdom.keycape-client-registration.client_id: client_id
|
||||
net-kingdom.keycape-client-registration.display_name: display_name
|
||||
net-kingdom.keycape-client-registration.redirect_uris: redirect_uris
|
||||
net-kingdom.keycape-client-registration.allowed_scopes: allowed_scopes
|
||||
net-kingdom.keycape-client-registration.client_type: client_type
|
||||
net-kingdom.keycape-client-registration.mfa_required: mfa_required
|
||||
|
||||
materialization:
|
||||
# Placement follows the live CCR-2026-0033 reference (secrets-engine-openbao,
|
||||
# ops-mason plans/keycape-secrets-engine-openbao-client-custody.md). The path
|
||||
# is derived, not case-settable, and the policies reuse the existing
|
||||
# workload-kv-read-keycape-<client>-<reader> family (MASON-WP-0010-T01).
|
||||
- id: client-secret-path
|
||||
kind: kv_path
|
||||
when: "client_type == confidential"
|
||||
template: "platform/workloads/keycape/{client_id}"
|
||||
body: "field CLIENT_SECRET; minted by the credential broker, never written by hand"
|
||||
- id: keycape-reader-policy
|
||||
kind: openbao_policy
|
||||
when: "client_type == confidential"
|
||||
template: "workload-kv-read-keycape-{client_id}-eso"
|
||||
body: |
|
||||
path "platform/data/workloads/keycape/{client_id}" {{
|
||||
capabilities = ["read"]
|
||||
}}
|
||||
description: KeyCape reads its client secret only through ESO. No metadata, list, parent or sibling access.
|
||||
- id: consumer-reader-policy
|
||||
kind: openbao_policy
|
||||
when: "client_type == confidential"
|
||||
template: "workload-kv-read-keycape-{client_id}-{consuming_service}"
|
||||
body: |
|
||||
path "platform/data/workloads/keycape/{client_id}" {{
|
||||
capabilities = ["read"]
|
||||
}}
|
||||
description: The consuming service reads the same secret. No metadata, list, parent or sibling access.
|
||||
- id: eso-role
|
||||
kind: openbao_role
|
||||
when: "client_type == confidential"
|
||||
template: "external-secrets-keycape-{client_id}"
|
||||
body: |
|
||||
auth: kubernetes
|
||||
bound_service_account_names: [external-secrets]
|
||||
bound_service_account_namespaces: [external-secrets]
|
||||
token_policies: [workload-kv-read-keycape-{client_id}-eso]
|
||||
token_no_default_policy: true
|
||||
token_ttl: 15m
|
||||
token_max_ttl: 15m
|
||||
description: The Kubernetes-auth role deliver-secret uses; bound to the ESO service account only.
|
||||
- id: catalog-entry
|
||||
kind: catalog_entry
|
||||
template: "{consuming_service}-keycape-client"
|
||||
body: |
|
||||
id: {consuming_service}-keycape-client
|
||||
owner_repo: key-cape
|
||||
warden_executes: false
|
||||
risk: high
|
||||
status: active once verification passes
|
||||
workload_ref: applicable, name {consuming_service}, declaration_ref of the consumer's published declaration or the explicit unknown form, never inferred
|
||||
path_template: platform/workloads/keycape/{client_id}
|
||||
field: CLIENT_SECRET
|
||||
delegation: native, intended_owner key-cape
|
||||
rotation: mint-secret then verification; automatable false until a run has been proven
|
||||
description: >-
|
||||
One entry per case (ops-mason item 5, ops-warden R4'). It carries the
|
||||
consumer's workload reference, which ADR-0009 needs for zone selection.
|
||||
follow_through:
|
||||
- id: ensure-groups
|
||||
owner: net-kingdom
|
||||
entry_point: "identity-provisioner ensure_service_groups, run inside the provisioner pod through the session's contained cluster access (groups {access_groups}; members exactly {initial_members} as recorded in the accepted case, nothing else)"
|
||||
auth: "operator cluster access in the attended register-client session; the in-pod call uses the provisioner's own directory binding, and no provisioner or user-engine token is read or sent"
|
||||
lane: key-cape-oidc-login
|
||||
warden_executes: false
|
||||
attended: true
|
||||
value_handling: none
|
||||
attended_justification: >-
|
||||
The provisioner's only HTTP credential is user-engine's runtime token, and
|
||||
its NetworkPolicy admits only user-engine pods. A proxy lane would act as
|
||||
user-engine (ops-warden review R8; canon section 3; ops-warden ADR-0002).
|
||||
Running it in the session register-client already needs adds no attended
|
||||
session. It can become unattended once the provisioner has an operator
|
||||
credential of its own and an admitted path.
|
||||
- id: mint-secret
|
||||
owner: railiance-platform
|
||||
when: "client_type == confidential"
|
||||
entry_point: "railiance-platform credential broker: generate a client secret inside custody at bao:platform/workloads/keycape/{client_id}"
|
||||
auth: "the caller's broker grant for the case's KV path, through its lane; the value is generated in custody and never returned"
|
||||
lane: keycape-client-secret-generate
|
||||
warden_executes: true
|
||||
attended: false
|
||||
value_handling: generated_in_custody
|
||||
- id: deliver-secret
|
||||
owner: railiance-platform
|
||||
when: "client_type == confidential"
|
||||
entry_point: "ExternalSecret sso/keycape-{client_id}-client (key client-secret) from bao:platform/workloads/keycape/{client_id}"
|
||||
auth: "railiance-platform ESO delivery through role external-secrets-keycape-{client_id}; no value leaves custody"
|
||||
warden_executes: false
|
||||
attended: false
|
||||
value_handling: none
|
||||
ready_check: "the delivery for sso/keycape-{client_id}-client reports Ready=True (status only, no value read)"
|
||||
- id: bind-env
|
||||
owner: net-kingdom
|
||||
when: "client_type == confidential"
|
||||
entry_point: "patch Deployment sso/keycape: env KEYCAPE_{client_id:env}_CLIENT_SECRET from sso/keycape-{client_id}-client"
|
||||
auth: "operator kube credentials for namespace sso"
|
||||
lane: key-cape-oidc-login
|
||||
warden_executes: false
|
||||
attended: true
|
||||
value_handling: none
|
||||
attended_justification: >-
|
||||
A change to the live identity provider's Deployment. It runs in the same
|
||||
attended operator session as register-client, before it, because
|
||||
KeyCape resolves a confidential client's secret at start and fails
|
||||
closed if the binding is missing.
|
||||
- id: register-client
|
||||
owner: net-kingdom
|
||||
entry_point: "sso-mfa/k8s/keycape/keycape-client.py apply --client-file <client-from-case> --case-acceptance <record> --check-config <keycape binary> (net-kingdom.keycape-client-registration)"
|
||||
auth: "operator write access to the live KeyCape client registry in namespace sso"
|
||||
lane: key-cape-oidc-login
|
||||
warden_executes: false
|
||||
attended: true
|
||||
value_handling: none
|
||||
attended_justification: >-
|
||||
The live KeyCape client registry is a Kubernetes Secret, and agents do
|
||||
not read or write Secrets. Until KeyCape loads clients from a
|
||||
non-secret registry with secrets referenced from custody, one attended
|
||||
operator session applies the rendered registration. ops-warden groups
|
||||
all attended steps of a run into that one session. KeyCape loads clients
|
||||
at startup and keeps login, authorization and handoff state in memory, so
|
||||
the restart drops in-flight logins and sessions for every client; runs go
|
||||
in a quiet window (key-cape type review R4). The rendered registry must
|
||||
pass KeyCape's own startup checks (keycape check-config, key-cape
|
||||
c528daa, which keycape-client.py runs before it patches) before the
|
||||
restart: a refused entry stops the single replica and every client
|
||||
loses sign-in (R1).
|
||||
- id: hand-over
|
||||
owner: "{consumer_owner_repo}"
|
||||
entry_point: "configure {consuming_service} with issuer {issuer}, client {client_id} and custody bao:platform/workloads/keycape/{client_id}, and make it require one of {access_groups} in the groups claim before sign-in completes"
|
||||
auth: "the consumer owner's own deployment path"
|
||||
warden_executes: false
|
||||
attended: false
|
||||
value_handling: none
|
||||
|
||||
verification:
|
||||
- id: authorize-accepts-redirects
|
||||
check: "GET {issuer}/authorize with client {client_id} and each of {redirect_uris} returns the login page"
|
||||
expect: present
|
||||
reads_secret_value: false
|
||||
- id: authorize-refuses-other-redirect
|
||||
check: "GET {issuer}/authorize with client {client_id} and an unregistered redirect returns an OAuth error"
|
||||
expect: deny
|
||||
reads_secret_value: false
|
||||
- id: custody-denied-to-default
|
||||
when: "client_type == confidential"
|
||||
check: "a default-only OpenBao identity has no read capability on bao:platform/workloads/keycape/{client_id}"
|
||||
expect: deny
|
||||
reads_secret_value: false
|
||||
- id: custody-allowed-to-consumer
|
||||
when: "client_type == confidential"
|
||||
check: "policy workload-kv-read-keycape-{client_id}-{consuming_service} grants read on bao:platform/workloads/keycape/{client_id} (capabilities check only)"
|
||||
expect: allow
|
||||
reads_secret_value: false
|
||||
- id: groups-present
|
||||
check: "LLDAP groups {access_groups} exist, with exactly the memberships of the accepted case added"
|
||||
expect: present
|
||||
reads_secret_value: false
|
||||
- id: consumer-enforces-groups
|
||||
# KeyCape has no per-client group gate; only the consumer can enforce
|
||||
# access_groups (key-cape type review R2, type 1.1).
|
||||
check: "{consuming_service}'s OIDC source for {client_id} (owner {consumer_owner_repo}) requires one of {access_groups} in the groups claim (configuration read, no secret value)"
|
||||
expect: present
|
||||
reads_secret_value: false
|
||||
- id: secret-delivered
|
||||
when: "client_type == confidential"
|
||||
check: "the delivery for sso/keycape-{client_id}-client reports Ready=True (status only)"
|
||||
expect: present
|
||||
reads_secret_value: false
|
||||
- id: mfa-pinned
|
||||
when: "mfa_required == true"
|
||||
check: "keycape-client.py inspect for {client_id} shows the MFA pin on the registered client (non-secret client view)"
|
||||
expect: present
|
||||
reads_secret_value: false
|
||||
|
||||
rollback:
|
||||
- reverses: hand-over
|
||||
action: "remove the OIDC source for {client_id} from {consuming_service} (owner {consumer_owner_repo})"
|
||||
- reverses: register-client
|
||||
action: "keycape-client.py apply --operation remove for {client_id}"
|
||||
- reverses: bind-env
|
||||
when: "client_type == confidential"
|
||||
action: "remove env KEYCAPE_{client_id:env}_CLIENT_SECRET from Deployment sso/keycape, after register-client is reversed"
|
||||
- reverses: deliver-secret
|
||||
when: "client_type == confidential"
|
||||
action: "delete ExternalSecret sso/keycape-{client_id}-client and its target"
|
||||
- reverses: mint-secret
|
||||
when: "client_type == confidential"
|
||||
action: "covered by client-secret-path: one metadata delete, after deliver-secret is reversed"
|
||||
- reverses: ensure-groups
|
||||
action: "identity-provisioner revoke_service_groups inside the provisioner pod (attended, as ensure-groups) with the case's memberships; delete_if_empty only if no other case uses {access_groups}"
|
||||
- reverses: client-secret-path
|
||||
when: "client_type == confidential"
|
||||
action: "delete metadata and all versions at platform/workloads/keycape/{client_id}, after the ExternalSecret is gone (this also reverses mint-secret)"
|
||||
- reverses: eso-role
|
||||
when: "client_type == confidential"
|
||||
action: "delete Kubernetes-auth role external-secrets-keycape-{client_id}"
|
||||
- reverses: keycape-reader-policy
|
||||
when: "client_type == confidential"
|
||||
action: "delete policy workload-kv-read-keycape-{client_id}-eso, after eso-role"
|
||||
- reverses: consumer-reader-policy
|
||||
when: "client_type == confidential"
|
||||
action: "delete policy workload-kv-read-keycape-{client_id}-{consuming_service}"
|
||||
- reverses: catalog-entry
|
||||
action: "remove catalog entry {consuming_service}-keycape-client"
|
||||
|
||||
acceptance:
|
||||
accepted_by: [owner, founder]
|
||||
risk_class: medium
|
||||
|
|
@ -0,0 +1,41 @@
|
|||
# Forgejo type/case 1.2 — source acknowledgment only
|
||||
|
||||
## Requested acknowledgment
|
||||
|
||||
Acknowledge the attached oidc-browser-relying-party1.2 security architecture and approve the existing Forgejo reference-case 1.2 migration design for a separate owner source receipt only. This is NK-FORGEJO-TYPE12-SOURCE-20261011-R1, a new exact informed-decision acknowledgment under SecurityCaseTypes §6 because the sixth consumer reader role changes authentication/materialization. Prior 1.1 acknowledgment and case acceptance do not transfer. Scope is type source acknowledgment and separate reference-design receipt only: canonical case 1.2 stays proposed while the type is unimplemented, and no canonical or phase case acceptance is authorized. No credentials, OpenBao authentication, role/policy/Secret changes, ESO deployment, structural materialization, first contained session/grant or native first-case completion is authorized.
|
||||
|
||||
## Exact source and owner agreement
|
||||
|
||||
The original nineteen-file preparation manifest is 5dbd04cf96d73a2604cbf113073d618c03434fc87508ba614cbe3820a1a0e431. Applied nineteen sources match it exactly. Full proposed render is c0afd5576cdae0cbc807eccb2b9fa87ac668f15e32ec7cf79d295bdb23c75b35. Exact proposed and current1.1 type/case bytes are attached, along with independent NetKingdom, Mason and Platform final technical reviews copied from their real owner trees unchanged. Their reviews acknowledge technical source only; none supplies this founder disposition or native permission. Actual reviewed commits and later observed HEADs are retained separately in source-inventory.json, without changing the content-bound nineteen-file scope.
|
||||
|
||||
The core proposed type/case schema and render checks pass; complete section 3 package readiness is not proved, and no implemented/status-live readiness is claimed. This is the existing first-reference case migration, not a new known-case light-path admission. The acknowledged type 1.1/current accepted case and historical CCR41/42/bundle remain unchanged until genuine new source disposition is recorded with preserved immutable originals. Canon sections 4/5 permits canonical case acceptance only for implemented types. Type acknowledgment cannot mark implemented, accept a canonical case or arm execution; the existing first-reference --allow-unimplemented build handling is not normal admission. Complete section 3 type-package README/examples/runnable tests, actual full-package validation and a separate NetKingdom source-owner receipt are still mandatory before type acknowledgment recording. Core schema/render checks and the existing 1.1 package do not prove those gates; this packet currently records them unproved. An actual full-package validator call on the owner proposal directory reports missing README, runnable tests and examples; human-posting readiness is false until these sources and a separate NetKingdom owner receipt are prepared and bound into this same unposted memo.
|
||||
|
||||
## Concrete structural and trust refinement
|
||||
|
||||
All original five rendered materialization bodies remain unchanged. The sixth object is consumer-eso-role: OpenBao Kubernetes role external-secrets-keycape-forgejo-forgejo, exact namespace forgejo/SA forgejo-keycape-forgejo-eso, audience openbao, only workload-kv-read-keycape-forgejo-forgejo and no default policy, 15-minute maximum tokens. Policy grants only platform/data/workloads/keycape/forgejo read plus existing self-token lookup/revoke; no metadata/list/parent/sibling reads. The consumer's namespace-local SecretStore references that dedicated SA and one field CLIENT_SECRET into an Owner target, deletionPolicy Retain. Forgejo and runner shared forgejo/default are not readers; existing SMTP reader remains separate. No namespace or deployment identity replacement is proposed.
|
||||
|
||||
Native retained compatibility metadata and installed ESO v0.16.1 source establish supported serviceAccountRef/audiences and existing controller TokenRequest RBAC. ESO requests a 600-second Kubernetes token and can fall back to legacy SA tokens. Owner admission must require automount=false/no legacy-token refs and stop on failed TokenRequest rather than add static tokens. The common ESO controller retains broad TokenRequest/Secret authority; dedicated identities are routing/revocation separation, not isolation from controller compromise. Existing internal HTTP custody remains disclosed, not an encrypted-transport claim. Tag/source observations are compatibility evidence, not immutable OCI identity proof.
|
||||
|
||||
## Lifecycle, defects and residual gates
|
||||
|
||||
Generated consumer CCR now targets consuming_service Forgejo while KeyCape ESO output stays unchanged. Its recovery obligations revert the consumer reference, require authenticated case-created ownership, preserve shared/preexisting objects, revoke issued reader tokens or independently verify expiry before declaring deactivation, and forbid recovery login/remint. Role/SA/store deletion alone does not revoke issued tokens. Retained Secret deletion requires independent creation/ownerReference/UID evidence; unknown or changed ownership stops. These are owner obligations, not an installed revocation adapter or grant. Source type/manual rollback keeps role before policy, with revocation/expiry bound.
|
||||
|
||||
Original overwrite regression, false inherited acknowledgment note, wrong generated consumer target and delete-only lifecycle counterexamples are preserved. Final independent owners each report 44 focused passes; old 42 and earlier failing checks stay in history. The untouched historical 1.1 bundle now correctly fails its wrong consumer target; new source rebundle/reconciliation after acknowledgment is required, never reassignment of old approval or weakened checker.
|
||||
|
||||
Actual bound_claims_confirmed=false blocks apply. Before any first contained session still require refreshed native identities/CRD/RBAC/no legacy refs; Platform CCR approval/confirmed binding; authenticated per-owner policy/role/layout/capability/created-vs-matched observations; admitted owner adapters/global verifier provenance; Warden machine descriptors, contained-session and revocation receipts; source-resolved current full run pins and separate founder native authority. Mint/ESO Ready are follow-through and are not structural proof. This memo creates none of those gates or permissions.
|
||||
|
||||
Helm secret consumption, required groups and unknown-user refusal, current local sign-in/break-glass, account linking, MFA and browser positive/negative checks remain distinct unfinished gates. Readiness/source tests do not close the case or forge. ORGREF-WP-0002 continues as driver for existing NK0048/Mason0010/Warden0044/RAPPS0016/CCR42 work; no duplicate planner is introduced.
|
||||
|
||||
## Alternatives and recording
|
||||
|
||||
Decline/return keeps proposed 1.2 and existing accepted 1.1 untouched; owners can revise and request a new exact source review under this same stable proposal. Accepting only the current source architecture can support type acknowledgment only after its complete-package/source-owner gates, and reference-design approval in a separate receipt; canonical case 1.2 remains proposed/unimplemented and every native gate stays false. A direct native deployment is outside this decision. Estimated incremental preparation/recording cost EUR0.10; no runtime resource change or credential exposure is authorized.
|
||||
|
||||
After a genuine native founder disposition, independently verify new memo ID/version, stale=false, exact packet/digests, actual actor/resolver and selected source-only act, then require actual full type-package validation and a separate NetKingdom source-owner receipt before type status recording. Record only those actually fulfilled owner/founder roles: technical worker reviews do not impersonate the declared consumer owner. Preserve original proposed and acknowledged 1.1 bytes/receipts before any permitted type acknowledgment and separate reference-design receipt; canonical case 1.2 stays proposed and cannot acquire acceptance/status fields from this act. Decline, pending, stale or hash drift leaves source proposed; never fabricate acceptance IDs, dates, claims or native grants. Recording-gates.md sets the exact before/after source boundary.
|
||||
|
||||
## Completed proposed package supplement
|
||||
|
||||
The initial three README/examples/runnable-tests failures remain in proposal history. The proposed package-1.2 supplement now contains the exact unchanged type and Forgejo example, a representative public example, a threat/alternatives/limits README and runnable source-contract tests. Actual full owner package validator passes and 22 tests pass. validation-and-history.json binds all source bytes and commands. Separate NetKingdom source-owner review of this supplement is required before human submission. This preparation does not implement the type, accept canonical case 1.2 or grant native authority.
|
||||
|
||||
## Actual completed-package source review binding
|
||||
|
||||
The independent NetKingdom completed-package source review of exact prior packet 330da7fe is now losslessly attached, alongside the original exact19 source review, in the two clearly labelled review bundles. Each carries the source path, SHA256 and gzip-base64 encoding of the exact original bytes. The separate package-owner review gate is satisfied; source-only posting readiness is true after root obtains narrow confirmation of this receipt rebinding and README clarification. README now explicitly distinguishes observed Forgejo/runner workload forgejo/default from the historical unbound OpenBao consumer policy; no historical default-SA reader binding is claimed. The genuine human disposition remains absent and canonical case remains proposed/unimplemented.
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
|
|
@ -0,0 +1,27 @@
|
|||
{
|
||||
"schema": "owner-source-review.v1",
|
||||
"owner_role": "ops-mason-owner",
|
||||
"work_item": "ops-mason ADHOC-2026-10-11-T02",
|
||||
"work_item_sha256": "e035a058220a070ce7bf368bd001f27594e1591a00ede9bf41a690db8306bea1",
|
||||
"prior_review_preserved": "docs/evidence/2026-10-11-forgejo-consumer-eso-independent-mason-review.json",
|
||||
"reviewed_manifest": "sha256:5dbd04cf96d73a2604cbf113073d618c03434fc87508ba614cbe3820a1a0e431",
|
||||
"reviewed_render": "sha256:c0afd5576cdae0cbc807eccb2b9fa87ac668f15e32ec7cf79d295bdb23c75b35",
|
||||
"formal_owner_entry": {
|
||||
"reviewer": "ops-mason-owner (agent ops-mason, codex)",
|
||||
"decision": "approved",
|
||||
"comment": "Fresh exact19 source review under completed own ADHOC-2026-10-11-T02 supporting MASON-WP-0010-T03; frozen manifest sha256:5dbd04cf96d73a2604cbf113073d618c03434fc87508ba614cbe3820a1a0e431 and full proposed render sha256:c0afd5576cdae0cbc807eccb2b9fa87ac668f15e32ec7cf79d295bdb23c75b35. INTENT.md Mission consistency review and Responsibility boundary support deriving the actual consumer workload and requiring authenticated created-only recovery, owner issued-token revocation or verified expiry, retained provenance and no recovery login/remint.44 independent tests pass; both new counterexamples fail against earlier c48 source. KeyCape CCR remains unchanged; current1.1 consumer target intentionally corrects to forgejo and unchanged historical bundle correctly refuses exact matching. Prior42 review/original failures preserved. Role-before-policy order remains in type/CCR42 rollback. This approves source only: exact1.2 acknowledgment, source rebundle, confirmed binding, authenticated native evidence and founder live go remain pending; no native approval or recovery authority supplied."
|
||||
},
|
||||
"checks": {
|
||||
"focused_passed": 44,
|
||||
"pre_refinement_counterexamples_failed_as_expected": 2,
|
||||
"historical_bundle_refusal_test": "passed",
|
||||
"actual_proposed_admission": "refused",
|
||||
"all_19_hashes_verified": true,
|
||||
"all_3_baselines_verified": true,
|
||||
"owner_native_mutation": false
|
||||
},
|
||||
"limits": [
|
||||
"Generated lifecycle obligations are not an implemented custody/revocation adapter.",
|
||||
"Historical1.1 source approval is not reassigned; corrected source build/bundle needs explicit reconciliation after exact acceptance."
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,141 @@
|
|||
{
|
||||
"id": "infd-20261011-forgejo-type12-source-r1",
|
||||
"version": 1,
|
||||
"question": "Acknowledge the exact proposed OIDC browser relying-party 1.2 architecture after complete-package validation and owner review, with Forgejo migration design recorded separately and its canonical case staying proposed, without native authority?",
|
||||
"requested_act": "approve",
|
||||
"binding_level": "organizational",
|
||||
"brief": "Source-only acknowledgment under SecurityCaseTypes section 6 of the sixth dedicated consumer reader role and separate Forgejo reference-migration design receipt only. Canonical case 1.2 stays proposed while type is unimplemented; actual full package README/examples/runnable tests and separate NetKingdom source-owner review gate type acknowledgment recording. Original five structural bodies unchanged; common ESO trust/600-second TokenRequest/legacy fallback and created-only token-revocation-or-expiry recovery disclosed. Three independent architecture owner reviews / 44 tests and the completed package NetKingdom review / 22 tests attached; bound claims and execution remain false. Old 1.1 is not inherited and native gates remain separate.",
|
||||
"binding": {
|
||||
"principal": {
|
||||
"id": "pending-human-session",
|
||||
"kind": "person",
|
||||
"display_name": "Founder source acknowledgment"
|
||||
},
|
||||
"target": {
|
||||
"kind": "resource",
|
||||
"id": "oidc-browser-relying-party@1.2/forgejo-netkingdom-oidc",
|
||||
"label": "Exact NetKingdom type 1.2 and Forgejo reference-case source",
|
||||
"environment": "build"
|
||||
},
|
||||
"terms": "Only NK-FORGEJO-TYPE12-SOURCE-20261011-R1 and exact reviewed nineteen-file manifest 5dbd04cf96d73a2604cbf113073d618c03434fc87508ba614cbe3820a1a0e431/full render c0afd5576cdae0cbc807eccb2b9fa87ac668f15e32ec7cf79d295bdb23c75b35. Type acknowledgment recording requires actual complete section 3 package validation and separate NetKingdom source-owner review. Reference-migration design approval is separate owner-receipt only; canonical case 1.2 stays proposed/unimplemented, without acceptance fields or phase acceptance. Record genuine new native human source disposition before any permitted type acknowledgment fields, after full package/source-owner gates, preserve immutable 1.1 history. No credential/auth/ESO/materialization/session/grant/native completion; execution.permitted=false and bound_claims_confirmed=false until separately discharged actual native owner gates."
|
||||
},
|
||||
"step_kind": "approve",
|
||||
"packet": [
|
||||
{
|
||||
"item_id": "decision-packet-md",
|
||||
"label": "decision-packet.md",
|
||||
"hash": "sha256:bb9a3f12248d18a51d06daf1235903ed8827c55e9e28bcb80c76d414db0d1a56"
|
||||
},
|
||||
{
|
||||
"item_id": "proposal-json",
|
||||
"label": "proposal.json",
|
||||
"hash": "sha256:3d726df3bebcfeb50dd0a5f83ad1ba94d0408caeec84a421feb1555b4b106e97"
|
||||
},
|
||||
{
|
||||
"item_id": "source-inventory-json",
|
||||
"label": "source-inventory.json",
|
||||
"hash": "sha256:fc06655f48d33c84fee1764de71649dde4f584e36388bce2af1e459d2728bc7c"
|
||||
},
|
||||
{
|
||||
"item_id": "type-1-2-yaml",
|
||||
"label": "type-1.2.yaml",
|
||||
"hash": "sha256:017885bdd139cd66a5bf6d9839b1b8ec9bc08fb051d9577adc3928b76a7be6db"
|
||||
},
|
||||
{
|
||||
"item_id": "case-1-2-yaml",
|
||||
"label": "case-1.2.yaml",
|
||||
"hash": "sha256:1c868c1da7d9077fae97bc6bc029706ec3dc418cfeaae30dc0f92b5b4ba6f2ab"
|
||||
},
|
||||
{
|
||||
"item_id": "render-1-2-json",
|
||||
"label": "render-1.2.json",
|
||||
"hash": "sha256:96b25108335e2cf5f96af481fe8a7735831c8320d81b50f7c6e6d4e53d0c0f02"
|
||||
},
|
||||
{
|
||||
"item_id": "current-type-1-1-yaml",
|
||||
"label": "current-type-1.1.yaml",
|
||||
"hash": "sha256:f705c64e4875e9b8e18a912fb51c135e77898926d6a451f5cb74ab3c0cbe4d1c"
|
||||
},
|
||||
{
|
||||
"item_id": "current-case-1-1-yaml",
|
||||
"label": "current-case-1.1.yaml",
|
||||
"hash": "sha256:bcc2c6d5bae0d28242b3cdb71e74d8ca297c2afe04766b55d53597f86893351d"
|
||||
},
|
||||
{
|
||||
"item_id": "consumer-delivery-yaml",
|
||||
"label": "consumer-delivery.yaml",
|
||||
"hash": "sha256:56478a83d799c08dc1e5159983b1e843a46b16dfeee7e84c31401d1f92430df2"
|
||||
},
|
||||
{
|
||||
"item_id": "ccr-0042-proposed-body-yaml",
|
||||
"label": "CCR-0042-proposed-body.yaml",
|
||||
"hash": "sha256:6544600c63a86559ba053240c476d493f4d2f25c9cd22cf6a9a05f09ee617a86"
|
||||
},
|
||||
{
|
||||
"item_id": "reader-role-json",
|
||||
"label": "reader-role.json",
|
||||
"hash": "sha256:976b19e0780b6056ed54bf5e8f27a0eb786af65817d9ec00ca161ac46e7d72e7"
|
||||
},
|
||||
{
|
||||
"item_id": "reader-policy-hcl",
|
||||
"label": "reader-policy.hcl",
|
||||
"hash": "sha256:af3a638605c1f6dff7879771fede4c56a6b9a7e430d4b5b58c370063b2c888ca"
|
||||
},
|
||||
{
|
||||
"item_id": "owner-design-md",
|
||||
"label": "owner-design.md",
|
||||
"hash": "sha256:c523949454e4c6eb58e8caee382380a561f561704136de62bf5783c592f962f2"
|
||||
},
|
||||
{
|
||||
"item_id": "retained-native-metadata-json",
|
||||
"label": "retained-native-metadata.json",
|
||||
"hash": "sha256:4e2993f5920215f41e4a235743023f22b78b8f597d3d70ed279991b2fc3204b5"
|
||||
},
|
||||
{
|
||||
"item_id": "mason-final-review-json",
|
||||
"label": "mason-final-review.json",
|
||||
"hash": "sha256:28541874fb437a06a8f1749bc50c88f6fee3d7c100c2f3ee0c52b59afaf8e102"
|
||||
},
|
||||
{
|
||||
"item_id": "platform-final-review-json",
|
||||
"label": "platform-final-review.json",
|
||||
"hash": "sha256:72854a798e01c6d65a16770efb1329d211fe3c59a3f4ad3190d6972f5c886f6e"
|
||||
},
|
||||
{
|
||||
"item_id": "netkingdom-review-bundle-json",
|
||||
"label": "netkingdom-review-bundle.json",
|
||||
"hash": "sha256:d452d90d886519186e2170592e6ab7389f384eff6c12795c8ad66a798e0966e0"
|
||||
},
|
||||
{
|
||||
"item_id": "netkingdom-review-sources-bundle-json",
|
||||
"label": "netkingdom-review-sources-bundle.json",
|
||||
"hash": "sha256:1b6c0432150ec9fd07a8aa4a005051081f7ac2557a2787fe5b32cdb7387d6648"
|
||||
},
|
||||
{
|
||||
"item_id": "validation-and-history-json",
|
||||
"label": "validation-and-history.json",
|
||||
"hash": "sha256:494d555b7dc33c05cd2f456c781e36bfe13deae3f44ce249d43fef71fe6c2c6a"
|
||||
},
|
||||
{
|
||||
"item_id": "recording-gates-md",
|
||||
"label": "recording-gates.md",
|
||||
"hash": "sha256:ca7b851f6357951101e7026883ccc29529c5ad798d5692987ee29a4c65962bce"
|
||||
}
|
||||
],
|
||||
"highlights": [
|
||||
{
|
||||
"id": "source-only-authentication-refinement",
|
||||
"item_id": "decision-packet-md",
|
||||
"note": "New sixth role/auth path requires this new acknowledgment; prior 1.1 does not transfer. Shared ESO controller remains broadly trusted, failed TokenRequest must not seed legacy/static tokens, and deletion alone cannot revoke issued tokens. Canonical case 1.2 stays proposed on unimplemented type; full package/source-owner gates remain required. No native credentials, apply, session or case completion.",
|
||||
"required_ack": true,
|
||||
"severity": "warning",
|
||||
"locator": {
|
||||
"kind": "section",
|
||||
"heading": "Requested acknowledgment"
|
||||
}
|
||||
}
|
||||
],
|
||||
"sealed": false,
|
||||
"approval_id": null,
|
||||
"approval_binding_digest": null
|
||||
}
|
||||
|
|
@ -0,0 +1,191 @@
|
|||
{
|
||||
"independent_checks": {
|
||||
"exact_manifest_sha256": "5dbd04cf96d73a2604cbf113073d618c03434fc87508ba614cbe3820a1a0e431",
|
||||
"verified_files": 19,
|
||||
"all_seven_current_source_pins_match": true,
|
||||
"type_case_preparation_validation_pass": true,
|
||||
"runtime_admission_of_proposed_type_refused": true,
|
||||
"render_regeneration_identical": true,
|
||||
"render_digest": "sha256:c0afd5576cdae0cbc807eccb2b9fa87ac668f15e32ec7cf79d295bdb23c75b35",
|
||||
"prior271_wrong_consumer_target_counterexample_reproduced": true,
|
||||
"prior271_missing_recovery_guards_counterexample_reproduced": true,
|
||||
"corrected_generated_projection_verified": true,
|
||||
"keycape_projection_unchanged": true,
|
||||
"unbound_consumer_projection_only_workload_changed": true,
|
||||
"native_mutation": false,
|
||||
"execution_permitted": false
|
||||
},
|
||||
"reviewed_proposal_files": [
|
||||
{
|
||||
"repo": "railiance-apps",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/consumer-delivery.yaml",
|
||||
"staged_path": "/tmp/forgejo-consumer-eso-refinement-stage/railiance-apps/docs/proposals/2026-10-11-forgejo-consumer-eso/consumer-delivery.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "56478a83d799c08dc1e5159983b1e843a46b16dfeee7e84c31401d1f92430df2"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-apps",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/native-metadata.json",
|
||||
"staged_path": "/tmp/forgejo-consumer-eso-refinement-stage/railiance-apps/docs/proposals/2026-10-11-forgejo-consumer-eso/native-metadata.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "4e2993f5920215f41e4a235743023f22b78b8f597d3d70ed279991b2fc3204b5"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-apps",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/observe-native-metadata.py",
|
||||
"staged_path": "/tmp/forgejo-consumer-eso-refinement-stage/railiance-apps/docs/proposals/2026-10-11-forgejo-consumer-eso/observe-native-metadata.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "3732aa0ff45b5197ac7837cbc5814f59ea3d694d4a157d19d00711f29da76913"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-apps",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/owner-design.md",
|
||||
"staged_path": "/tmp/forgejo-consumer-eso-refinement-stage/railiance-apps/docs/proposals/2026-10-11-forgejo-consumer-eso/owner-design.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "c523949454e4c6eb58e8caee382380a561f561704136de62bf5783c592f962f2"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-apps",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/owner-source-pins.json",
|
||||
"staged_path": "/tmp/forgejo-consumer-eso-refinement-stage/railiance-apps/docs/proposals/2026-10-11-forgejo-consumer-eso/owner-source-pins.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "775971a60db57f7334f68b0916a27760e28f02c62f2c653e963237925a1c2711"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-apps",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/primary-source-provenance.json",
|
||||
"staged_path": "/tmp/forgejo-consumer-eso-refinement-stage/railiance-apps/docs/proposals/2026-10-11-forgejo-consumer-eso/primary-source-provenance.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "c3d5ce5c6a5e89f19be5e293034c8d633183d19666fc61d837537527246d9a42"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-apps",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/validation.json",
|
||||
"staged_path": "/tmp/forgejo-consumer-eso-refinement-stage/railiance-apps/docs/proposals/2026-10-11-forgejo-consumer-eso/validation.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "95318f54942871a125a5200ec05d6f9dc80077918f26ebe671b9ab4d150b112d"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/CCR-2026-0042-proposed-body.yaml",
|
||||
"staged_path": "/tmp/forgejo-consumer-eso-refinement-stage/railiance-platform/docs/proposals/2026-10-11-forgejo-consumer-eso/CCR-2026-0042-proposed-body.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "6544600c63a86559ba053240c476d493f4d2f25c9cd22cf6a9a05f09ee617a86"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/reader-role.json",
|
||||
"staged_path": "/tmp/forgejo-consumer-eso-refinement-stage/railiance-platform/docs/proposals/2026-10-11-forgejo-consumer-eso/reader-role.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "976b19e0780b6056ed54bf5e8f27a0eb786af65817d9ec00ca161ac46e7d72e7"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/workload-kv-read-keycape-forgejo-forgejo.hcl",
|
||||
"staged_path": "/tmp/forgejo-consumer-eso-refinement-stage/railiance-platform/docs/proposals/2026-10-11-forgejo-consumer-eso/workload-kv-read-keycape-forgejo-forgejo.hcl",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "af3a638605c1f6dff7879771fede4c56a6b9a7e430d4b5b58c370063b2c888ca"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/case-1.2.yaml",
|
||||
"staged_path": "/tmp/forgejo-consumer-eso-refinement-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-consumer-eso/case-1.2.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "1c868c1da7d9077fae97bc6bc029706ec3dc418cfeaae30dc0f92b5b4ba6f2ab"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/render-1.2.json",
|
||||
"staged_path": "/tmp/forgejo-consumer-eso-refinement-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-consumer-eso/render-1.2.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "96b25108335e2cf5f96af481fe8a7735831c8320d81b50f7c6e6d4e53d0c0f02"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/review-boundary.md",
|
||||
"staged_path": "/tmp/forgejo-consumer-eso-refinement-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-consumer-eso/review-boundary.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "21c8d666a46490f829cfb9c043ea168ad1c02873dc6baf7e50173188e0c99ea9"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/type-1.2.yaml",
|
||||
"staged_path": "/tmp/forgejo-consumer-eso-refinement-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-consumer-eso/type-1.2.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "017885bdd139cd66a5bf6d9839b1b8ec9bc08fb051d9577adc3928b76a7be6db"
|
||||
},
|
||||
{
|
||||
"repo": "ops-mason",
|
||||
"path": "docs/forgejo-consumer-eso-builder-review.md",
|
||||
"staged_path": "/tmp/forgejo-consumer-eso-refinement-stage/ops-mason/docs/forgejo-consumer-eso-builder-review.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "27d20e4d6915a8d16d65e4fcdf20cd565b2742d6bc2a0999a8ec21522fb0a590"
|
||||
},
|
||||
{
|
||||
"repo": "ops-mason",
|
||||
"path": "docs/forgejo-consumer-generated-ccr-refinement.json",
|
||||
"staged_path": "/tmp/forgejo-consumer-eso-refinement-stage/ops-mason/docs/forgejo-consumer-generated-ccr-refinement.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "29aabe3e5d1f9c3c55a1d0c2580da89a97e707600358232f4c0bd79f02c8442e"
|
||||
},
|
||||
{
|
||||
"repo": "ops-mason",
|
||||
"path": "src/ops_mason/case_build.py",
|
||||
"staged_path": "/tmp/forgejo-consumer-eso-refinement-stage/ops-mason/src/ops_mason/case_build.py",
|
||||
"original_sha256": "249cc8574939d2c3193f968309781c472c96c199e04206c336463b4d65ea6659",
|
||||
"staged_sha256": "c2b140f380407779ce5478ca57c97eb0e6375d6a9cad4591b0b29ddd177db686"
|
||||
},
|
||||
{
|
||||
"repo": "ops-mason",
|
||||
"path": "tests/test_case_build.py",
|
||||
"staged_path": "/tmp/forgejo-consumer-eso-refinement-stage/ops-mason/tests/test_case_build.py",
|
||||
"original_sha256": "177e8feed5d1af9abe96522fb5399780b3199daed6bf360882398044357071bc",
|
||||
"staged_sha256": "aea22297178b5bb1eaaf5d59bbd1c71112dfc32bed2075b33ccc0598c8fc5be5"
|
||||
},
|
||||
{
|
||||
"repo": "ops-mason",
|
||||
"path": "tests/test_case_structure.py",
|
||||
"staged_path": "/tmp/forgejo-consumer-eso-refinement-stage/ops-mason/tests/test_case_structure.py",
|
||||
"original_sha256": "524e8567183b6989aa5791b8d85350771c15988833b0d5221ab082dc6a920ffb",
|
||||
"staged_sha256": "2e7446eaf01d4bb59d7d8fb3c3cdc5e6e3007b3ae84d8ed0a49f11f745f2e386"
|
||||
}
|
||||
],
|
||||
"sources": [
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/AGENTS.md",
|
||||
"sha256": "065d47b7bdbfe829672a2a6161a7f8cf243237a1210fb61d82f153fa37f22131"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/INTENT.md",
|
||||
"sha256": "fd2ba8dff9dfd5583ec6d8b0348f273bfe00c59923b5d5d47cd22b1fb4658c54"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/canon/standards/security-case-types_v0.1.md",
|
||||
"sha256": "a4fda906d5138d2594a1f8d047c7c28e1cdf96b1eae051f543b9a5e5852bcb5e"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/canon/standards/security-layer-model_v0.8.md",
|
||||
"sha256": "3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/reviews/2026-10-11-forgejo-consumer-eso-net-owner-review.md",
|
||||
"sha256": "c9f2ce444de9007370a0b2ea68f9474054e46a403cbbb38232797b1395057e80"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/workplans/ADHOC-2026-10-11.md",
|
||||
"sha256": "9910c22c0ad2b161543865610b72bff53ed00112005e2c2e3cc9a0db369664fe"
|
||||
},
|
||||
{
|
||||
"path": "/tmp/forgejo-eso-mason-independent-review/refined-return-stage/ops-mason/docs/evidence/2026-10-11-forgejo-consumer-eso-independent-mason-review-refined.json",
|
||||
"sha256": "28541874fb437a06a8f1749bc50c88f6fee3d7c100c2f3ee0c52b59afaf8e102"
|
||||
},
|
||||
{
|
||||
"path": "/tmp/forgejo-platform-owner-review-stage/railiance-platform/docs/evidence/2026-10-11-forgejo-consumer-eso-owner-review/final-review.json",
|
||||
"sha256": "72854a798e01c6d65a16770efb1329d211fe3c59a3f4ad3190d6972f5c886f6e"
|
||||
},
|
||||
{
|
||||
"path": "/tmp/forgejo-consumer-eso-refinement-original-271/manifest.json",
|
||||
"sha256": "271afd04512b3dac642b3385013cac03d28afde22ff97bcca8d0e262ab3d9279"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,75 @@
|
|||
---
|
||||
reviewer: net-kingdom-owner (agent net-kingdom, codex)
|
||||
decision: approved
|
||||
work_item: NK-WP-ADHOC-2026-10-11-T05
|
||||
reviewed_manifest_sha256: 5dbd04cf96d73a2604cbf113073d618c03434fc87508ba614cbe3820a1a0e431
|
||||
scope: final-nineteen-path-proposed-source-technical-review-only
|
||||
---
|
||||
|
||||
# NetKingdom final Forgejo consumer ESO source review
|
||||
|
||||
Technical agreement on exact nineteen-path manifest
|
||||
5dbd04cf96d73a2604cbf113073d618c03434fc87508ba614cbe3820a1a0e431 under completed
|
||||
own NK-WP-ADHOC-2026-10-11-T05. This is the same NetKingdom role only; apply the
|
||||
work record before this formal entry. Original SHA guards preserve already
|
||||
applied T03/T04 and any State Hub UUIDs. The earlier271 review and its evidence
|
||||
remain historical; they are not claimed as an exact review of this final source.
|
||||
|
||||
INTENT's Taxonomy declaration, Identity is the Control Plane, Minimize Threat
|
||||
Exposure and Meta-Orchestration principles support truthful consumer identity,
|
||||
inspectable canonical contracts and separate owner-executed acceptance. The two
|
||||
Platform counterexamples touched that contract: an incorrectly generated keycape
|
||||
consumer identity and delete-only lifecycle wording. Builder source SHA256
|
||||
c2b140f380407779ce5478ca57c97eb0e6375d6a9cad4591b0b29ddd177db686 corrects them
|
||||
without changing canonical proposed type/case or its six-object render.
|
||||
|
||||
Independently checked all19 hashes and seven current source pins, preparation
|
||||
validators, refusal of proposed source by normal implemented-type admission and
|
||||
full regeneration of render
|
||||
sha256:c0afd5576cdae0cbc807eccb2b9fa87ac668f15e32ec7cf79d295bdb23c75b35.
|
||||
execution.permitted stays false. Direct isolated projections reproduce both
|
||||
failures against preserved271 builder and verify the corrected generated CCR
|
||||
against its exact retained projection. The consumer target is forgejo, KeyCape
|
||||
reader output matches the earlier builder exactly, and unbound consumer output
|
||||
changes only the previously incorrect workload field. No fixture provenance or
|
||||
private projection call is accepted-case/native evidence. Fresh distinct Mason
|
||||
and Platform owner receipts pin this exact final manifest and each report44
|
||||
independently rerun focused passes; neither is a native installation receipt.
|
||||
|
||||
The generator requires consumer-reference recovery, independently proved
|
||||
case-created ownership, preservation of preexisting/shared objects, owner issued
|
||||
reader-token revocation or independently verified expiry, no new login/remint,
|
||||
retained receipts and refusal on changed references/UIDs/ownership. These are
|
||||
obligations, not an implemented revocation adapter or recovery permission.
|
||||
Canonical/manual proposed rollback still orders role before policy and requires
|
||||
revocation/expiry before removal of the created role; deleting role/SA/store alone
|
||||
never proves token deactivation. Historical1.1 bundles/CCR history are preserved:
|
||||
the old wrongly targeted bundle now correctly fails matching. A corrected source
|
||||
build/bundle needs fresh exact owner reconciliation after successor acceptance;
|
||||
old approvals are not silently reassigned and the verifier is not weakened.
|
||||
|
||||
All earlier exact271 identity/trust/acceptance boundaries remain applicable:
|
||||
forgejo/forgejo-keycape-forgejo-eso only, namespace forgejo, audience openbao,
|
||||
exact CLIENT_SECRET data read and no default policy. Forgejo/runner default SA
|
||||
must never bind. Dedicated automount=false identity must have no legacy token
|
||||
refs; no static fallback. Shared ESO controller authority and existing HTTP
|
||||
custody remain disclosed rather than described as isolation. Delivery applies
|
||||
only three admitted namespaced objects and acquires no deletion authority over
|
||||
matched/shared target objects.
|
||||
|
||||
The sixth structural role changes authentication/materialization under
|
||||
SecurityCaseTypes §6 and therefore needs a new founder informed-decision
|
||||
acknowledgment as for a new type, regardless of proposed1.2 label. Existing
|
||||
acknowledgedtype1.1/acceptedcase1.1 cannot authorize it. Pending claims still
|
||||
block apply. No type/case acknowledgment, implemented marker, broker pin bypass,
|
||||
role/policy grant, source materialization, installed adapter/session or live go
|
||||
follows from this review. Refresh exact ESO/native identity metadata; obtain
|
||||
independent admitted bindings, capability/creation receipts and Warden native
|
||||
session/revocation/descriptors before their existing acceptance steps.
|
||||
|
||||
Helm secret consumption/group enforcement, break-glass/account-link/MFA and
|
||||
positive/negative browser checks stay separate owner/project gates. Delivery
|
||||
Ready and source tests do not complete the first case. Existing ORGREF/NK0048,
|
||||
Mason, Warden, Platform and consumer work records retain that work; no duplicate
|
||||
plan or new standing authority is introduced. No further NetKingdom source
|
||||
correction is required in this exact final candidate.
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
{
|
||||
"description": "Requester-prepared lossless review bundle; enclosed original source bytes are independent owner receipts, not requester review assertions.",
|
||||
"entries": [
|
||||
{
|
||||
"label": "original_exact19_source_review",
|
||||
"source_path": "/home/worsch/net-kingdom/docs/reviews/2026-10-11-forgejo-consumer-eso-net-owner-final-review.md",
|
||||
"sha256": "e21aeed24b6bb092ddbba12957a7c06861240655f977e7023d5475ca7a3f569f",
|
||||
"encoding": "gzip-base64",
|
||||
"original_source_bytes": "H4sIAAAAAAACA6VY224juxF8n68gkIckgEajiyX5gjw4Xm+82Kx3YevgPC44ZEvi8Wg4ITm2dX4o/5EvSzXJkbSbIC8BdmHrMs3u6urqosuyLBy9Gnojdy1aCuWLabfa7kv71pITf5JbasP5ByOhrKb3PxealPHGttdCdp2zr6SLN+tevptA+2vx+Ln89Vt5++Hh6105m8yW5XRSTqflerIYztPf97I1G/Lhu9/J2WJ5LRa61pMLtbla6tVczpb4vd5Mp/PJaq6X00s1mV/MLzbqcrWYXNZyOcXHNL+cTeRUTuhiPi28sh1di41pZVO2BmkTtWUnw65Eip31pEtve6eoDKR2rVH4XsqntG1zKErgUfxBPFL4nMpNscRH67b0m0Xtre/3AOb++atIkUR6vijWQ0Qht45oz8DZVtC7VEDwPBkxVF78vxWLvtXIRtl91yC+LtC2/4H9WKx3xgv8CzsSXu7pvFRnGxIMww23tDnwl2JPUaKyTouaNtYR3kYA/LZHqSjSHcbiqzPbCNTzw63Y9tJpLzpHntwrCdk4kvpQcFBDWqwn82o9uRCy1fh/EM9BBhIPfS1++eXTB89JkiDp8GU3W00zwPHrJniBV5paRSDSXppWIJtgHQN/wxkfhESOrQ1CNdLscZ70eDb3Iceym1xFTDo1clwUnx7X94/rP3qxlu+2tfuDAMsb6WQA0UfiE84NJhwGAO8sqreN+NbIlkbii2nN3vxOyB8Fh+L+HYzrkQxn/oWCLL86tUPbUzwAZFpl0DgvfN911gURXB92m745Ec3kM0eFaX1HKsgaXVKytYlrinNAZT6e4qnjbNFGHt+S3kn1gSFQiroggVpCN7zZAlkH7iJC9G0gB4D2MZlge6SpUaIMx/jXjCHytQ5kCCAHhIH4KC1e6KBkR8V/5BxT0sTMjOMlGrBeHRQKAK00aDcWf+1NwxTOwwT+QAoKNaunF5PN/HJyMVmtVleKFherSyUXK3W1onpCy/lqoZfySkl9sbia1pN6dqW1nq5Wul5eLkXOM/ZpX7yZsLM9itnJFjzdnuE36IIIh44qJT2wc5Fn3ryXtv6NImt4zJgg+Nnxi5YhAErqhdFtmumV2EmP5uY2vFIrVI8cIAK5tA4NHPFUdJlQxatsjJYgL953tOk98gEzjynlB+sD6BynzXCDWFigY5yvkHpvPKswH1uAOA0C5c7wu4iWci+yxqqJ3OjFYrVUWtJE1epysiKl6ll9tZGXK6mWy8vNdEHzGamV2qyu9OxqUet6NlerRT1fjIvEKQQfd+T2JjADfJAHDJNsPPj1wTDymBHbRHqgHAYRT3gkg1e656Js2BUbaRoMCEDbYpJ9OGqG5rmvMzUY0VdyZhMVaWgtIp8oeHf3VAwxokbkYQ9464cUEv2PTA0Sus65sp6xwo/EZzrcMZtZs/AN0KYDc/Yy8OjGBLI0HfOLhzWHUUy0b2uMkz4dkQIUkXoIEOeAo3QsRbb3eHkcKx6Ll8ZKDWGiRo/Fo8Vv74FFJO7YlkcYBC2gHa8856fKwGl0H5WkWQdDmMxVCyJAgwfRHIuPgHgnNEQTxwbxRXowkTM/6kFa/ciHTAcswdsklgnUJJnDBos1k1Q7bi0U7OICOnU+I45c3wJd1TOjO+k9+RsYCkwkKwXSFTlFbh5KSMTNp2PkuF+50Zaz+kdvmDEDvljfG2hXGxexAkQOjfgxhexOGI5SsTIjkVij35luNHDuODB4Te8Rnm2FqXH87SgDmNIEDUauR8DEkDLYF+KEX63KMdxPCUTy8uaj985wfq0FAm+isRCjCmvMtGFUHNl6RJ6xPepCm9Qrfp4r9hXvy+pYSyQ3BAw5F7ZuzDbm40dxG7J8n+TjPF+pJfjiRIQ3QSjibEdlGRd3g1hW6Hp/rplYfk0t1QsEwIB80HQkknxE9gqdbYw65EpS64rT0VUCZPgykLCvSQPjoOdecbybtEdYu/ll9Xxb8dZnc2FbKloIrkuN5v3FDdFgZTCprWPxcDQJ0zErS6ux6SrIRrYPyTUc5ee64ARso8Wbs+2WRzYqBbJJzwLSN3FahixkPolE3Gq3ZyqVVLyIalENTxPBIW3iKKaxOg6dhSdoTO7Mhvvie0y092jPaY3fFJxcct6Q3aPn8aYZ5g6jZrbMJwafy8k0jFPH330jCaBIY8hu0b1B1mI+rL/DGq/gSnyoToeLKHHSGWJFjyYsejvF3uS6yFJa5Z9l9gfl8Jq8jTIIXsKB+k4i4lF+Za9NnGY4+baWdlQkfO7+/gnW7Pvz/d3T/Vpga0ouMRWHcdK0kX0TMt/Gg2GvID6M6/Dx822xRy0i8aXGmGJfkUbm0SX1we7ZDP0lrrKTj4nP7OQrYywa2kpQOrIMXN6wnFlegcEo3oFxIsbiOUkHXxRU8okN7zL4O/Awe6NBZ8TDev2tgEQGqw8DpJBo1aQxk1Es4ceY1l45Uydbm3ZsJPgHakyc3OSyfZEXDcQsuoS4p494HyUtmXCVRTUCyWPG3DtmyopQpAWoB0XMizNHyTINx4TLDfxtr7CyMMhRCYbNxwEZzzz6CAg+wgH9nrgebzLFM8wFH3oHsV7D4Xjxr38uBwa7JBNpeGSU0I1NNyDT8urC0huupQWagBltSG/jTUzGFZ+fYu/ElmuLiwp0wJ+7rul4JhpZUzMW97k9Z7FI87PQkGpYs7xWWFNgKaPMJthwCzBhLL5hB0S/yVcRn2SyqBsLyYxXrLjhT87zx5xHPwj2XroXciNROxDPxa1cH3ifYnOwImal3TrJT2br+BPIo2HJMn2S6lfYxz5vLWaQ2FoMcNPYN9Yn3Arj6k/XprF4onPNArcHf3EaFWwxns4bcIP32bkdOBGRJw+4YDVBGWQNwYPMRL0/W/6JnL+iR5DzdE6Rs63OdkiaiI5t9OmGSsadputMuXygjun6QM0eNh1Hhmwluhhs62zf4VaLMIpSE2qk9VJuG0DNTWd9KBvTvlRfPt5G2w3aGE6uammb0ECP3jzfy/mC4KM9/ulqVmXjJvAE+dP4Fk98VU6XiNRCfAwktE1X2nzRj3q+MQ6yxMQ5UVV8ffrb0/3H6vHzZHJxOSqivRtlEEcnjyfPLerZHd9n05wuf/xBVDfdR3kPVHS46zJXeIxQV6L3SSv4rwssduzxs3/tXVSvsz805I2YVyR3PFIsihDu+P/Fbio+CLTCJf3foiVvC7MSAAA="
|
||||
},
|
||||
{
|
||||
"label": "actual_completed_package_peer_review",
|
||||
"source_path": "/tmp/netkingdom-forgejo-type12-final-packet-review-stage/net-kingdom/docs/reviews/2026-10-11-forgejo-type12-human-packet-net-owner-final-review.md",
|
||||
"sha256": "9e9b8dda889203c064b35e1bbcd4d0c62d76d4ba1935c9a10f4b2dbf1c6e8497",
|
||||
"encoding": "gzip-base64",
|
||||
"original_source_bytes": "H4sIAAAAAAACA6VYTXPcuBG941egag+bVA2HMyNZluxLFK82+1G2XLKSVE5bGBKcwYokJgQoefbX53U3QFKuvaXKB1ki+vP16wcURaEG++zsix3e6d7G4sn1h9p3hX/p7aD/Yg62j8s/rHTla/v1r6q2lQvO9++0OZ0G/2xr9eKHp99ctN07/enX4t+fi9sffrr/UOw2u6tiuym22+Jxc5X91b91pneNDfG3cDS7N1fv9MXFpjZvG7vd3ew3l5cX9nLbNM3l5f6i2tXX9Mv66np3dXPd1Pu9uWns1Waz3daXV7Z+U11eVypU/mTfIcLu1Npo6wKBnXygH0z1hFwK09dF8ONQ2cL37bk4joiC/4oUo62OvatMW0iMqkB51Hf6k42/SvZ6sI3rba2TPQ17Gj/2/qW19aGjYokxnUyox2xUi19tDoO1/KXvtf1qqnixQwTxqHNB1P9biJUO0exbqyV/0yr048f7h3/c/XJfPP7n8912V3y5/+fDhztuzhaHi4ftSo89vkbddGc7r1zf1PPfGz8c7O++iOcT4spFHLZ/w7kw7jsXCA0q9XLX1NvqrbUXe4OwENr1xeXby93b683OXtfbi43dwOrb5s3uiv6w2e+rt7vLpmpu7M2+udqs1ePRBY1/8Wh1MJ3VlnNy4Yj4Fh0RoA6+lWbwp4BZqr+OgzPtWj3YaFw/I4OO8WeNG0JckZeeXfnBHVyPblm719XR9AcbAIf/jpYLg7YNZ0WOIsWX4cC/fq+tGVpH0cA3VSOUjXHtOFj6sqMAcCj64bzW99nPl59uFdoE7EVJFoAY8fvHzZsSkwV79YQcAlt/RhZ+qHEYlgpgBjis9XHco2vR1CaatVI/f3q8+/T4fdCP5qvvfXfWmNfWDCYirJV2NSJ2kUwhcnhk2x9xvrgfqiNylS/1wZs2qDCeTn6IglZdmd4LolvAtTpXKH2DPwQAKDDsUrxpSAIbd31tT7Ynx0p6Zr/aaiQva/2IvBsuR496Rmv7onHUUQTjqDSo4WoqbzxignSNUrq+imoa29Rz8Uc4LSsTbDmQ10Hvz5FCGSxgLo2t1/qT18GiCPUCR8oPuvEjH4ITjITjWqDfVAjuyP6cAUAeUfDvvtM/zxm2qOzRggfqCXKvKEM4Qql/2cE1ZM+07cWOppZ7aQDyIFWZEZu5bLveTbaofYAVA0dJdzK9cgHWZ9O1K/2jzO5kghpJZlf64e72h493XFETdQdqb0vTRjsAXe7ZhlK1rnPUWqNPI8avymc5j2Hs+2XHUeGIwG8Fws3Ytqmuz6Z1gKZl+lDmQEFHuIXT2g1oMIYCWYVAeb8u5GD63U4sA7h91Y7A/gF4RpSd6wkFlaIypT6VQOcELXCT+1r4/e+WgOv7RpBv2jJls6dGm8FZGJcC9mCQgALbUhm4sj1+Yno5eRw4r2jogXNk1oCxW/BiZ+ty7IONiXQxZh1FB5M9/opPc+FhcloW1PU60Wa2uQL/AHYEG2oIFhdtKfy1woJFhYR4CP29PXCHFBU5rzd8iOXCFplx/DNVSnq8khLCQe6gICxMzWPEBsWYojp4LSDAhAzPrsqIpA5yIBOqkvMMjM7E6shUlrG4vVEyfVzhFkwJ4415svOUgvYqe4oG1aZBAzzsQKh3ffSw5acwA4ZNMvqeciT4E0MeMdh1WdvGjC13OowdcDcR3QLUmufWoPwyN35PCdopoZJQjbMkZ1qP775I/rdVBbBEamqks6bX94Dp341nc0QxIDlUfK1+YponTtqut3M0giD9gsNjz8jjShynr3VKoPhym20y9FxQi/UnfRC0TiNd2xoWIjPON8mXC6v4/uj2PChY8NwlDgTngzv0MtWJRmVnBVkSvm0pNXadO+6bBihnpEDq5M/Ic/BtWjUtgFqdS0SPOS2if8KibUB3e9ggMKaewKevZOdgT7kOXb5vGricFiKQAMSUATDtTEnAoaBJjc70EnabnI6vRhJZaFPcXVxc7m4gPA8odN4E74lztzf69Y4NqQAmE5fBUFdHscTAXuvPQt4RaLfDCv7QIWCBNFOBKeV5ZpIfLMdSiECGSRYjsoN44FMrwzR7vXXoyKBZUE/jR+oqUuAzX4BXKDSAgmCYKsRitgxCAFP3SUqhZZahmQRv/ga7p61pHhDrKakDTZSTQD6SLooJV9NOFImBjffBD8TdtmaGGpiXE6GeUyEJQfRr3CNGama+Nij1EfXSrKuItInMwZdZsK6mD7OeFnPZy4GajRhfNGkzbBA1qRJiE9qR0WfRNc3Iy5FERcwk5mgMHXEW9dfWK/2C8vsxqgUZcYmYNk9H4qnODE9o8lo/WICftkPRuUMqXR6i3HB4MCpIaeGv60ZZEbN+LadpTWeRo3WnyF0gdDBZYZywjGXLQ5fKgH6f+HRRFll0vFAMAwkbFkjonz1d37TMDuXCshe6NqWglv1vWnMITHBoP3gpnmXqFzRFQSz6wqeZErY7GGOQAmtC0yXvnTIvHT1JYhoDnBTyXQNMrHQozrjgmNpbzAWBcd6c2pFWphbSGHCvoE9mXUoQAEJv+0RETIqnM7eXCyuHiZPGkFR+TYB5tZ1FjoCOCDvqly/3n1IB388KcsYWLzGsIVqObfCTmPkkCiDgHE3SPMMKwG/bRARZ+s/uy1fQFDWnPy/aJLKWymWaKK2Oasr3VW7CXMlJxkzanNXGNLVINbEoUzCrcwW2RjkFijWGtufbAaydSIAhF0J0M5JGz1Ii1aGfri4nuvvg/7RDVtJOAGE/JGphVvr2Ij0vh+yIrgo/eKGmukYX0sUE7eGGptkp0y1LP9lzeJdSzST57W2dmLYX2ZFugMT7Kpko8zhyLtz9YnKaiywUkerWANHH7IwvMUnOY6ER8gztyuVtqD2LMCUZOdHkn90/oDTl0iEdpH1TqrRwyjSNFZVRxvYPuyCGV2qMyJFF3KtSrARHil3ka8ekLNOGzbstx5nfUuTyJFduWW8CL7p5Uwy5IKRmQmlI75fRdZZ0QSuTKHiR3JKQKjORlos6qLTYHO3wzB8zt5LgYlWZIk/qsl+MqmhRpkBZjtWIPdZHOhp6cwpHD36R8ZzErBtEFswsQ80NbIweRwr6Ya0+JF5Ar1JqoitKyRzLBaXl9wBeWwsG7yvXOq4wi0LfolFblStA8v31NZdctJ7+z9TETyW4TmXkwCyGBZd+akOZ1r+UWy2ikFcJ3JgCAXHslxQEyOJ+vGQhWX6rb6h2od2h99zhGOU9a6K61YxwxeoOw7LYJh8+PFBtA+0/QWJiDQgoJEN3zakKWXETyEusXXyt7r7cg5hOrT/L6cQaaJ0lweX+SFI03ZZpcG2Ky9TmhK/KhfyEJ9/QG8B+8C8AV/nxx9tyj/ieikOLIEvZnZx4GpP0OjANHrbZ3Vd+njgInZQwSptZyUTmi0u+2GSBwKqGlEUe2/QABcog/cXMMpdeeGWlhLtHKL9ctSWYvn18ycirZ+XNDIdhEv5XizsTcEEOiXBB72SLcDlpFL6cpeGZF8ZCNzCAmnFgLbJ4tMs3TtGPqXxTYN8Q3eIJREaa39+qSXsu3nP//C027a7XRZAMAmoQwN9B8TtjbsQ8a/nhOM0cdeg95AfLEl5EuHYt3nwN2gZs5ZWg6D2VyZfYmiZ2yHS4jHOtb3u65SfaY1VT18L6vskvTRJx9ByqbMzktxtDnKlweTFMbMEronYHfgGg6u1nmDAhKlkQ8swJ6Fv0wE4sL84WHLxW/wObcjMjOhgAAA=="
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
{
|
||||
"description": "Requester-prepared lossless review bundle; enclosed original source bytes are independent owner receipts, not requester review assertions.",
|
||||
"entries": [
|
||||
{
|
||||
"label": "original_exact19_source_review",
|
||||
"source_path": "/home/worsch/net-kingdom/docs/reviews/2026-10-11-forgejo-consumer-eso-net-owner-final-review.sources.json",
|
||||
"sha256": "2a3862d47a95b0fd21329292723d39fce61279d779f51b629b517b5ed130f577",
|
||||
"encoding": "gzip-base64",
|
||||
"original_source_bytes": "H4sIAAAAAAACA81a224jxxF991cYejaXfb/4zdgESV4cIPFbEBDV1dUSvbxhhtRaMPzvOU3quhFXolYrL7C6cKenp/qc6qpzevT7d99/fzZfVdkIvq22M74Q/jCe/fj977iCa/Ib8Xa2pNW8ybidjRdkfMDlM19LVY5bDjVaMgG/l6a1VdHWoBMr66xrnKJXqVDQuCw2GUWalDirz344POBShnmbS521+UL6g3W+vkKLxWyUS1nNeDcMPbhxvRtYZpv5akRIW77A8O2wk+sbtlcbmTGNGDHIhgbazter2SUt5vXw64bG8eEtw261nS9lRnU5H8c+Zt1w93qzHhHSfsJB2g4fPrmvwzXg2rms5PpB8w7gnGnx6NA6PweAHbkDhj+yola9j4ErieLCSUVhLqbkRikSh5Ca9mKNcOQWczXZl1qM5eiL9TcAbob5ejBRzz4O69X5jNercbfEA7c0nAsIXWOJMoDH5WbRV4PV1R1/uqDbWfY4YJ5BeA1urmbnOxrq+Nx5eA2qeAvwrpHBbxj5K/5vT8Y12w9v+iBXTBu5P3C34gtanX86crcqiKPerfLeLevV4mr2cT18WKwJIx67fQWmLmW23G33lOFio8V4c1V+E94dEkWG5Xy73d++H4EBf/RRYPNyLh8Pi0KS0OI2b/+zn+SwbfYDN+vO9kDzxZxWLBPabMZr0jrgtO3pe1bXPE5vJhunRpkw0Wqi9aStQeCv68nNWicyrqe3H6os5p2fd1e0XNxNO27pvEd3Pft0u9xMH5togrSer2SJlJ3s75k+DHT6ynGth/n5fAW4bivIardYfBr2vfISXEyUbI05s0qVtXjtc062aEnOkgtFh9pEJOIzW+2Urrpl46yqzZztZ/7jhzch5ZBWk6VsCZWG3v06Irf+dEo+H9WphDgxOdvmMx6rfXNaHBnrI+A2thlTYioJl2MFZ0qqAXFZF9PYGuWKf1NC1mWUAWv/FILN1Z9Py3NiO5UcG60hUq05X7zOaB4x2Yie4pN2IEUITTm76kj7WHWuSkWtm8mVYsjavi05H1f7OjHOz1fvlvUbYORYQKfSwN7Y7LLzThwHKT5JYpKue2xS5INu+IrKaRuqBFOaB0+MPQUZZd64aB1WfZBUky6pvpGy9VRcp5ISI4qSpqBq8bFFC1UaUlFZBzIxBiUmNWW448/BW8nBGhuz8aQZgki/KSmQYUsarm6XP0CDrfr03wg5z43v5J1jq2fxHMhLyk3nIh4Nx8JFcKrBWg0poHMIoXHQFcXN45+JxoWayb3tzrlzFN8IK0cDOpWG7AF08yhhJmHPaGwCb5QSVr6Glis8iooxY4xBeZMQdclUXNVeFa1NfS4NmwVtsZLlF1Px/v2/JvsxSjkzuTFuk7KuX0MY34Q9/WpRnkpY8M4FpThYSsH7XEh5a5xiF0N10Guuoq55zlyN4RYoY0BTWQR9CLe8OWGDENzwZFgvvkZJeylBx6M6eQdF+JIsKiZVgvJBqndo84IdE0kJVHKgFiDLYs3YVopJB03sgsQajcQ3J+TGME8+XE46DJNrM347+vrnuwv+RnbTyyI+lUhqloJN4JB1g9FsMcUco25SIe58oIDSF6W7TbgbSD22Ualgi+GUoPo+T+RKtpMP89V5XX85g/3Ea6LfmVcrePeCm75OLKeCrzmFxBrupGY0nEaSY+FQWJkcVRDIBXY6cRMiAQOsYPzBgisUmqHyduAfTvf2S36tcvYF8B+N5uQyForxWiVrIcO4efgTai4h+xPFaH2yoAjGviZdvGoRbgf9RrytClwo85YE9AO5yf5YEMr0lQzlF3FwPKBTaTC6q98QyAWXVUsmcyuZlbOCvpGoauyIFLEbQqEWxSsdoeCSKM4w/fntaOhH5d9KEToSy6ngA8uUfKlVW8gnkOALGkFONhddknBGOUqtKK9r9jFSZZtNKjFQhDSuTxSh9WacLOnBJn0A/aMold18sRcq+xx7pVy/jWT6ogefnNOxGiWuhqw9papDDV5c49qM4uqDLyY6U1HsDamcMwFqo70xgJp8Vq8M6+1rignzcA+cVyvnT8H7zABOhjkTFbHi+6E4W/aeNIqz8UlVSplylKgivAOKubGmOValxtyPQpJzRl4M8zhwX/PssOb967h99rzS4esdnM960P/DdmZcZk4+wh7lathq2KQcklU5Jg3jZDgH1qifMGsqsLXBQda5nqYUgs9nnznGMEU71WxSDrIlZhbvIsSgjwy8i5JgI5w0ZabqfNZFFZMrKkyMtYSn7NhnQN/KuB2n/fvsKyL+9FMegRtrg/sRGKGqqWUkZQ773extzt0mgYBcSbDjmw0qIRsz8HPWIz914c/ATULGQBGiUEP8FQ012HyFCy5ojFH3E4n++qEIKk5/Z2qZWfmcODX2RfyrwT1uhx1vd4N8dcgff9IjsHvjJPkQdbIlZGx4JCESLtXkrUdyatZAIkHhFVXBh6aikoGQoGxUa+UzsMOmOhhWakrD+xSfa6xohBZVprKXAEWuYrEkydUkVZHLTesWnW9G7G2W4/t/9+9UD4eJj7xDvUXuYr2U7vtGvnggDH76219//uXfD/vgXf8OvrpYYqkFstXkEA0ZCt1vxwbvYFw/6CVttGqlHyqapr1tZGMDHPbIwe+TMf3j518Q1JGYWjUFTa+1XPvL/2SFQ01FWdcPCCwCVYp9zsYWJDLC7+c2RbfiAhymdy+MiWnVC+aWuiSt43QU3g3z7dVk79e6Xhpnl+qdPhI1uVYpq1C9tqkanx3plqpCeJFNEo3mDceA/SdQQ807C2/sxSdvChcvrx31gq6wc5brKosedjoStgWlGXsAtjxLc/DuhQziL9ogFYtBxbcGuFsYTdSmEIB2U6jZ5ClyKi8Me9/mD0LpSa066Tce3ng8punuGktuhsU5VyVjc9moCK0D/Si17KJT/Y0TXIKyXErpr5tMhGOGcPXKo/yqFy6lH7VsFrQapz/95e//fD+5W82ROHPW0BiGFXWYg0YqpOCDViWa0pq3KAcKdVmp7itRDZgzqVpsyCG49lSm3K+gHb19jZzc+/ulaxSnh4pa8RG1cvW4EsNI3MLyJEf35z888drjXT/lU6l4VyiTdzpFh+2LQqMCpaYhOwp7xSm1gK5oa2SNPW+aFbg2bBifqVHDpjrmoh9F4+Yw7UEyPXHk9mwA7s85bb3R3GTrsZXHvnSKGU5Uc1f4sKsxKmnISSgeg3Yg/cUn2eaoQgEo+IFomgcuoYVT8uBYJ73piRMT9fTmD9iOUxUhTlDRvDbFVuLg8NMmGGrLxMpWk3BdoFtaP4piFHElJhjC6IzNdq+nfffHd/8DD1av31cnAAA="
|
||||
},
|
||||
{
|
||||
"label": "actual_completed_package_peer_review",
|
||||
"source_path": "/tmp/netkingdom-forgejo-type12-final-packet-review-stage/net-kingdom/docs/reviews/2026-10-11-forgejo-type12-human-packet-net-owner-final-review.sources.json",
|
||||
"sha256": "00eee9833108f451d99b15fb1261e4ba3aebf8a047bdd0a01d8ea4f601e99073",
|
||||
"encoding": "gzip-base64",
|
||||
"original_source_bytes": "H4sIAAAAAAACA91b244bxxF991cs9Bxq+34xkAfHEhIjiBQ4AgIjCIjqqupdRryF5EpZGP73nOFF611rvaLlmEQggFpyemZO16nLqZnu77+4uHg2mYsuFR/zzZivld+un3158T2O4Jj+h3jj3XhG80nX9Wa8viYXEwY8894I5a7W1WZC8Bps7z2E5tlJGX6UVFyqpUtrVLsmY6yVkFQih8LPfre7BU2nuME1ra91PX6nq0mfqOAGm9WN7of0m+l0vLld6nhJ/JaudPyOphOhzWKFX9brh+N/NKPp7Xh1Mx9vgH19N9a5/cjZZL2ezK/GKyWZ6X4YJj1bToFmrle0mbxTHL5aKUYu5ruL3L8dZuDMuC1u5jKWBa+3UGU8mW/orY4Jv26uV6rjqxtayccugMtP1htdjdstEAz4vA+u7o+ub9oW5mI+lskVEA7W3/HwpetiOav6RrAsrFt8yMHlYpwWsd6oscbmHl0aDpjWOLvQuVetrSdzIOFg162R+2J1pf9a7NCA+g1fwwLvJvpexdYHpl4vprTBbGGExfvhf347X7yfqlzhy/ZygLrcM3b/XKb5Yj5hmo6Z1jBUH0yA88fL1WK5AFPj+QLfWZcbmjNwTXQqD0y3WMlkTqvbMfjbG2l3ne2th4uttN/8xENw+c3+VrqkFVjGiavBZVbjyeA3A6wHaG9WGLCxY7s3zM2cr2l+9fDS68XNCmDXCKUZjdcb2tysx7uRmM9mfH2DYMK9WCfLzf1Td4fuLDjD/TCi03R9GDLfOSSiEogPx3Doh+H4h3Ad6NQNDDbdutM/tufuQnrrbsvF4ENz3YzewvtlMdv7wdYTNtfDwcGRL3dE4BaXzrg0smZk7WjvHiNGNNzMdDXS9eJy70Aj+9xdfvvyqxd/efl8JndXhRkGfzhc/HIzW14erjMwZd1oO/nRDvloO/7yRwAvf108i9XkCn4zvctnc+SYh3Dvkl1HniP1NWVrUooxOG1Jiq2i3TYywXfnQ+hNQ6/MiaQaylSJapKW7bPtlX/43W9LxCGRHf4YLW/adMKj5WK1oenzW5pNz4Sio5AeS16RFCLSXgk2ClHqHE0VClp8IVLTUhJkzKL4sagxPbQSyWruhIRn5MTk7UeeJV0fx3YsQZZLKmwhJxA2eTB7zY1TY+NqNknZCwdbuCvoguxg06trsYUGMh210xC0FQvbz/E+52PoZoUM/Hx5eyZEfSLGYwljDynHqcTYcrfIeVJUIykFC5JsrIgsI234vdVQC+dqouFqq7UN2vBEhMHa5xRFH8FzLBHQdqXEJpB6lSUlilB1AvPXBkMrV8RQ6c1EKzXmTMK+utJyotwUlek0ROzVOxTM83+tIWPOg45HUR1LCjXfuKfie6QQe+Ai7EpMkZDCuGbKJQk5KMCiPnlfQZhUldo7cl7W/ykpezPeF5mXX3/97ciY4EYH6T1qC7k9QbB8BrxjaUoxBPSknDwVSLoKGRe9C4ZDThKq70Fcd5ERWM6BT6g5E7upqslmnHICmoY+afDVsyHmEUD/VwLgkZkf0ojoFB3Z6nyC5Slkx5ITU8iFipdcK6qJsNWIEo8i06yW4CmkZpN0Vc34zt4GY8WCoQCqujsFObtefbR3T3s+3Pw8sGOpacyOk8SGLkZcccE1z0O/qTlIYUL0sKOuBikttRgl+lhzR7BV76EJTkjNcPQsqXkE2NFPDLKJnIKGkqNWaDFbqFrXW7RsfdScSy3VJUnQCLZHbjlAOLDhpkEsn4AaUZ4MT9D2tv3NH+Acj+pYUrJFBnM59RzZ+CLBOCmGyNrkyiDbGtoWP3QrNqj45oXE52yKQhkkn09Ayu4p8gl08hFwjqUBvWJvhdWK9pIN2IDhk6ui5Mr27YBka7pryFPoMTt6FyNoLU2y0GDenICG6aQr3/JU0T/MYFlZnw0lT0I7Okqgwrpnaymj0Q+ps20InBaDL97EzOKdWoQQWWdaQZuZNKUgvUZrOccT0DMjzHjUh1mOdq8qzoaeJ6EdSw9aSWjhHHoLPpNJVLrNAZ1+NFxKTxBi0Gps0dq47lUNR2jlSp06qpA5hR6b6WxxPoT8FMzREaLNW2goB/FbLap8TdEjQ3mXFZUlmuGdWxGJ6rg09DMuD3EUQheEEZ8igeGi+2ve88XR7rHg+WSz43AeHTvkUWgkZKqxmS4OlFX8y86Lr53R2rtcJefao20oSZBruUUdXqX2mPP5EHcm6uxT0B0tD5wlVXGhpdZMdTIsILCuxoyCZFIBR8Ek6IKas2YD6mIYqlEm32Oq/QQkLd7Ptw33enI1PxNmHoV09MP+6HwNNUQ0M6j0LRZFa4kiU5yHeI4J3UuySHDWJ9HkGgKleI7V9ZrcSfr/5ZQ2GDE7T0XwKeiOrkiDKqBcixrLaCoj2YTGRXsbMhzynO06cIIQCehpbDWSanboO0tJPZ3imfPhlPPh5eOAju78q6eiPZUsTlLrLgTnoAlKR92ptZksnNzwIIYRR8Ea6eSFOTvIhuhOUWOG5U9IFsvFdMK3z6/5LB7I/Ayoo9/IdE8Jld9Etj1J77lkFA/EhCCnxUSpVco6PK8MLSLDsc/GJN8g3wpIOh0lq8X0fJr/xzEdS0jNCS2lmlxMAyvDmsCAuqGlO7Q02nJJ1FMsFq2oMjoZpDNLHJJmyU5PEyO8XWx2NbqiDYToeVT5n0N1LCkSQpY4PKNE2WCfUo459Uae4vCs0kOAVccuWAcV4KKr3RGAIlDASGI+CSnDkr3tG6jzCZJHIB0dIwlGtqZ4P7SRHXIXMREKklahnH0s3nLxzkixLZqeh6cwEhSNqGHTT9Lnr3RDk7nKaLdMcTTDd6ENnRE5nwTwWKqCulrRfFQAsbEHq4FQ4TMKivPdOeSzVnA4ixeIMkGPWattrjP4Q8U5AVW7fno0mb/Dt8Xq9mwoegLYsdR4hAXB/AQxFppYyolMppAqmRacSb33GqP03NRHKr7RoJezJYxI4RSvlvdvoM7nLf8jgP6vFit9fOZ3a4JGNJfR9WR9VrHySfCOjhgorYAqE7mZwOjzfSDqtRcnrYSaeozeuVAhxTgKK1Mpor0Omi33kE5K0xlS87kyoEL4RsVHSozC0WwvOGZDCcG2FpGsBN19DSwmUEfjz6naTA60eM3+M+jYLBbTYfLDFom7bSG7+T7YpvArL3n9pXc+ujEsMbdSNajP8O0a0QZG0RZK990gRRnCUJ9DZ0gwbR75SoirSYZjkfjZxt27ySms+wtuffSjQ01WIICC5RASF4JE5eyScB8Kb+rWqqaCDqJmZ6zxUjj5VJLn6MDM3rz4/Od2f8v+JcBPt7R8MMb1YqaX7xerNV/fm/JXf3z56s3f7jdtd4UpRQm55SYN4trVlNHYUBpaztwLA793PpN11vSGGRXXbfSdfIa2s/6R3R1PYvrm1RuAegRTF9eoCMSJdIkQ+8pJSjM+DD2yB1B0xbFW51uUAf6wShG5oQW0zRzDL8S03ZN1CSLnMmxWu1wr36wmm9vdiqXBQ9bjd+a5fQQ1hS6E6EAb6Yu4WAMhXSExZc7siloWtDHNKqkZVr0E3ypFjSW6xi3q56Hebrn6GOYd5N3xhxXizlnZx4aei4bVbvBY/Je5OVuGFks70q8DUg3DwncmX8qwJsEy26wuC5VfH/snwUZScpV7MJpaRRYrnlGjfIke4Cgm04pHT8hSeqloC3twYAf+W7Mp9bHdLU/C3uWQj7jHh992u/o+7NS8n8Pu4PfhJUKJTLVCUxht8GqBn7AGOLSEqD45bTUn701DK+XQSkke8jWciH4hfPz0djml+fryqxd/ev316K6uP+LZxSAxOBPRTKDYxmZD6NWq6aoduWtw4soFNhVXgIuD9t4sd48pVe1P5Yinkvgh845UGxJUuTzsyH3cL3YDlb3NYiCts4NzGGurLcZFchYZJhSGGC8YAOtH0pKT7cjCUH+fAPjHL//uY9+jPry73VagJxFH5DxPYnPzlHMtAVHVK1Py2aKMpEASi7PZlp47E0SPxJSZhXTIgfZhtTgsh/lQLp799bs3f3r96sXrV2/+/u03b17+4bs3L79+/eLl7+3F8nZzvZj7i1/V3y8OJXY78uI33c5w2Nn7+JRfvXwz/vM3r/744vVfxt++fv3m94/N/YNxRts/QeHFaHkxX3zJhNQEdO8moquLE+xsuhj9++l5fqD2fy6ULn67/mLw9X9+8cMX/wWqy6z7wj8AAA=="
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
# Forgejo consumer ESO reader — concrete source proposal
|
||||
|
||||
RAPPS-WP-0016 already chooses ESO delivery for the OIDC client secret. This proposal fills its missing reader identity without asking the founder to make that same source choice again. It is not a live apply, a new credential grant, or first-case success. Existing ORGREF-WP-0002 remains the project driver; CCR42, MASON-WP-0010-T03 and NK-WP-0048-T06 remain the owner work, rather than another workplan.
|
||||
|
||||
Actual read-only railiance01 metadata shows ESO v0.16.1 running as external-secrets/external-secrets, served v1/v1beta1 SecretStore CRDs supporting serviceAccountRef.audiences, and controller RBAC permitting serviceaccounts/token create. Forgejo and its runner currently share forgejo/default; they must not become the OpenBao reader identity. No consumer namespace SecretStore or dedicated OIDC-delivery SA exists in the observed metadata. Existing forgejo-mailer-eso is a separate SMTP lane and remains unchanged. No OpenBao login, capability check, auth operation, Secret value, Secret object retrieval, or native materialization was performed.
|
||||
|
||||
## Exact supported reader
|
||||
|
||||
`consumer-delivery.yaml` prepares exactly three namespaced objects: ServiceAccount forgejo/forgejo-keycape-forgejo-eso with automount=false and no legacy token refs; SecretStore forgejo/openbao-keycape-forgejo-consumer; ExternalSecret forgejo/forgejo-netkingdom-oidc-client. The store requests a token for that dedicated serviceAccountRef, audiences=[openbao], and authenticates to OpenBao Kubernetes role external-secrets-keycape-forgejo-forgejo. The role binds exactly that SA and namespace, only workload-kv-read-keycape-forgejo-forgejo, no default policy, and a 900-second maximum OpenBao token lifetime. ESO's installed source requests a 600-second Kubernetes token and can fall back to legacy SA tokens; owner admission must ensure this new SA has no legacy tokens, never create one to bypass a failed TokenRequest.
|
||||
|
||||
The namespace SecretStore cannot select another namespace's SA; serviceAccountRef.namespace is omitted. No extra RBAC, projected workload token, Deployment SA replacement or controller identity change is proposed. Namespace/default is not an OpenBao-bound reader. ESO remains the shared trusted controller: it already has clusterwide TokenRequest and Secret permissions and can request this SA's token. This separates reader binding/revocation and avoids default identity reuse; it does not isolate this secret from controller compromise or grant new cryptographic isolation.
|
||||
|
||||
The exact KV data ACL is platform/data/workloads/keycape/forgejo, read only, plus existing self-token lookup/revoke stanzas. No metadata/list/parent/sibling access is added. Delivery maps only remote workloads/keycape/forgejo field CLIENT_SECRET to target key CLIENT_SECRET. Target creationPolicy=Owner and deletionPolicy=Retain preserve fail-safe remote-deletion behavior. Refresh is 15m; the value is never present in this source. Existing internal OpenBao HTTP endpoint and controller custody behavior are retained, not upgraded into a TLS/isolation claim.
|
||||
|
||||
## Type and structural boundary
|
||||
|
||||
NetKingdom's proposed successor type 1.2 adds explicit case parameter consumer_namespace, one sixth structural object consumer-eso-role, and separate owner deliver-consumer-secret follow-through/readiness/rollback. All original five rendered structural bodies compare equal to current1.1. Existing acknowledged type 1.1 and accepted case 1.1 remain byte-preserved; the proposed 1.2 case has status proposed and no copied acceptance. Full proposed render is c0afd5576cdae0cbc807eccb2b9fa87ac668f15e32ec7cf79d295bdb23c75b35. Existing acceptance does not silently extend to the new role/runtime delivery. Owner review and exact type/case acknowledgment precede any build, metadata apply or materialized-status receipt.
|
||||
|
||||
The current Mason builder gives every role-backed reader the ESO draft suffix. With two reader roles it silently overwrites one CCR. The new regression proves that defect against current source; the minimal staged fix retains ESO for the KeyCape reader and Forgejo for consumer-reader-policy, plus refuses duplicate output identities.42 actual focused builder/plan/structure tests pass with corrected source, including both independent CCRs, platform validation and a complete six-object structural request. Existing1.1 tests remain passing. No fake proposed 1.2 acceptance is used: Mason correctly refuses to build a merely proposed successor. Test fixtures alone temporarily acknowledge synthetic roles to exercise builder semantics.
|
||||
|
||||
The proposed CCR42 body uses proposed status, bound_claims_confirmed=false, explicit pending1.2 acknowledgment and old CCR's exact historical hash/provenance. Owner validation passes with the expected apply-blocking warning. It is stored separately from the actual in-flight CCR42; no historical review or applied CCR41 is rewritten. Folding this reviewed body into CCR42 remains an owner reconciliation with retained original revision, not a fresh parallel request.
|
||||
|
||||
## Admission, native proof and recovery
|
||||
|
||||
Before an exact scoped native proposal, refresh ESO image/CRD/RBAC, Forgejo/default and runner identity, the three proposed object identities and target metadata through Kubernetes PartialObjectMetadata only. Classify absent, exact preexisting-matched or conflicting; refuse a legacy-token SA, unknown ownership, changed role/policy, audience mismatch or shared target. Never read Secret data. Preserve current UIDs/resourceVersions, authenticated owner change receipts and the exact type/case/render/source pins. No placeholder SA claim substitutes for actual owner admission.
|
||||
|
||||
Platform materialization applies only the reviewed exact-path policy and dedicated Kubernetes-auth role after its own approved CCR path. Fresh owner metadata/capability receipts must prove exact binding and distinguish case-created from preexisting; no minted value or successful delivery is required to prove structure. Mason's existing typed structural contract then covers all six objects, including source layout and catalog pointer; source-only bodies are not authenticated native evidence. Warden native dispatch/descriptors/session receipt and per-owner provenance still need their existing accepted integration review.
|
||||
|
||||
Consumer follow-through applies the three admitted objects, then checks SecretStore/ExternalSecret Ready status and exact target UID/ownerReference through metadata only. Shared/matched objects never acquire delete authority. If ESO reports failure, stop; no manual Secret seeding or controller/static-token fallback is admitted. Minting, KeyCape client/env/groups, and Forgejo Helm OIDC/group enforcement stay distinct existing first-case steps. Forgejo gitea.oauth secret-consumption settings were not changed or Helm-render-verified here; they must be prepared/reviewed before T02 handover, with current local login intact and T01 break-glass acceptance still a prerequisite. Delivery Ready alone does not complete browser/MFA/group checks or forge closure.
|
||||
|
||||
Created-only rollback first reverts the consumer secret reference/auth source through its owner Helm revision. Remove only the admitted trial-created ExternalSecret and independently proven case-created target UID/ownerReference; preserve matched/shared targets. Then remove only created namespace SecretStore and SA. Remove only the created OpenBao role after revoking its issued tokens or proving expiry, then created policy. Role/SA/store deletion does not revoke already issued OpenBao tokens; deletion alone is not deactivation proof. Retain native/audit/source receipts and stop if references, UIDs or ownership changed. Do not infer delete authority from Mason's legacy planned rollback inventory.
|
||||
|
||||
RAPPS-WP-0016-T02, current CCR42, MASON-WP-0010-T03 and first-case acceptance remain unfinished. ORGREF-WP-0002 holds this owner return. Human-only break-glass/account-link/MFA/first-case acknowledgment gates remain separate from source preparation; no new human login is requested by this packet.
|
||||
|
||||
## Supplementary generated-CCR refinement after Platform conditional review
|
||||
|
||||
Exact prior 271 packet is preserved at /tmp/forgejo-consumer-eso-refinement-original-271, alongside original c48. Platform found two additional generator gaps: hardcoded keycape target for the consumer, and delete-only consumer-role lifecycle. Both meaningful counterexamples fail against 271 source before the fix. Current staged generator derives target.workload from consuming_service only for consumer-reader-policy, preserving all KeyCape ESO output fields. A role-backed consumer CCR requires reverting consumer reference, authenticated case-created ownership, preservation of preexisting/shared objects, issued-token owner revocation or independently verified expiry before deactivation, and no new login/remint during recovery. Actual owner native authority remains required; generated wording is not an implemented revocation adapter.
|
||||
|
||||
Forty-four focused builder/plan/structure tests now pass. Earlier 42 and original counterexample/failure history remain retained. The old committed 1.1 bundle still mislabels the consumer workload keycape and therefore correctly fails fresh exact target matching after this correction. That historical bundle is preserved; the checker is not weakened or grandfathered. Local fixtures alone use corrected/rehashed consumer metadata, with a separate regression proving old bundle refusal. Current 1.1 unbound consumer generation changes only its previously wrong target.workload; KeyCape reader output remains unchanged. The proposed 1.2 render/type/case/source remains pending exact acknowledgment, with identical six-object structural body and no native completion claim. Fresh source build/bundle owner reconciliation must occur after exact acceptance before any native apply/materialization; old CCR or bundle approval is not silently reassigned. New source/test hashes are in validation.json and generated projection receipt.
|
||||
|
|
@ -0,0 +1,34 @@
|
|||
{
|
||||
"review_id": "RPF-REVIEW-20261011-FORGEJO-ESO-R1-FINAL",
|
||||
"work_record": "RPF-IN-0006",
|
||||
"reviewer_role": "railiance-platform technical owner only",
|
||||
"status": "technical-agreement",
|
||||
"exact_manifest_sha256": "5dbd04cf96d73a2604cbf113073d618c03434fc87508ba614cbe3820a1a0e431",
|
||||
"reviewed_paths": 19,
|
||||
"candidate_builder_sha256": "c2b140f380407779ce5478ca57c97eb0e6375d6a9cad4591b0b29ddd177db686",
|
||||
"initial_conditional_manifest_sha256": "9e4967bfff57694ceb12883f522edc405ef3fa316e46b88c9bdad47205a180b4",
|
||||
"initial_proposal_manifest_sha256": "271afd04512b3dac642b3385013cac03d28afde22ff97bcca8d0e262ab3d9279",
|
||||
"all_manifest_hashes_match": true,
|
||||
"independently_rerun_focused_tests": 44,
|
||||
"resolved": [
|
||||
"Generated consumer-reader target.workload derives consuming_service=forgejo, KeyCape ESO reader remains keycape, generated request identities remain distinct.",
|
||||
"Generated role-backed consumer deactivation includes authenticated created-only custody, preserving shared/preexisting resources, issued-token revocation or independently verified expiry, no-new-login/no-remint recovery, and refusal on changed references/UID/ownership."
|
||||
],
|
||||
"independent_generated_source_probe": "refined-generated-ccr-probe.json",
|
||||
"retained_preconditions": [
|
||||
"Fresh owner/founder exact type/case1.2 acknowledgment required for sixth structural role/runtime delivery; accepted1.1 does not transfer.",
|
||||
"CCR42 reconciliation retains prior body/history; actual bound claims unconfirmed, source-only role/policy/delivery objects not applied.",
|
||||
"Future exact ESO runtime/CRD/RBAC and no-legacy-token SA admission, authenticated created/preexisting ownership/capability receipts and approved contained owner changes remain required; common controller trust and existing HTTP custody are disclosed.",
|
||||
"No deletion-alone revocation claim; revoke issued OpenBao tokens or independently verify expiry before deactivation, with old consumer references reverted and unknown outcomes retained.",
|
||||
"Consumer Helm secret consumption/group enforcement, break-glass/MFA/browser checks and Warden descriptor/native per-owner session proof remain distinct unfinished gates."
|
||||
],
|
||||
"scope": "Technical agreement on source proposal and platform CCR semantics only. No other owner role acceptance or native activation.",
|
||||
"limits": {
|
||||
"founder_acknowledgment": false,
|
||||
"native_apply": false,
|
||||
"credential_mint": false,
|
||||
"secret_read": false,
|
||||
"structural_materialization": false,
|
||||
"first_case_complete": false
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,132 @@
|
|||
{
|
||||
"proposal_id": "NK-FORGEJO-TYPE12-SOURCE-20261011-R1",
|
||||
"memo_id": "infd-20261011-forgejo-type12-source-r1",
|
||||
"memo_version": 1,
|
||||
"status": "source-acknowledgment-draft",
|
||||
"type": "oidc-browser-relying-party@1.2",
|
||||
"case": "forgejo-netkingdom-oidc",
|
||||
"case_scope": "Reference-migration design approval may be recorded in a separate owner receipt only. Canonical case1.2 stays proposed while type is unimplemented; no phase/canonical case acceptance on acknowledgment.",
|
||||
"bound_preparation_manifest_sha256": "5dbd04cf96d73a2604cbf113073d618c03434fc87508ba614cbe3820a1a0e431",
|
||||
"proposed_type_sha256": "017885bdd139cd66a5bf6d9839b1b8ec9bc08fb051d9577adc3928b76a7be6db",
|
||||
"proposed_case_sha256": "1c868c1da7d9077fae97bc6bc029706ec3dc418cfeaae30dc0f92b5b4ba6f2ab",
|
||||
"proposed_full_render_digest": "sha256:c0afd5576cdae0cbc807eccb2b9fa87ac668f15e32ec7cf79d295bdb23c75b35",
|
||||
"case_owner_repo": "railiance-apps",
|
||||
"case_owner_person": "founder",
|
||||
"structural_objects": 6,
|
||||
"original_five_rendered_bodies_unchanged": true,
|
||||
"sixth_object": "consumer-eso-role",
|
||||
"consumer_namespace": "forgejo",
|
||||
"consumer_service_account": "forgejo-keycape-forgejo-eso",
|
||||
"role": "external-secrets-keycape-forgejo-forgejo",
|
||||
"audience": "openbao",
|
||||
"kv_data_path": "platform/data/workloads/keycape/forgejo",
|
||||
"field": "CLIENT_SECRET",
|
||||
"shared_eso_controller_trust": true,
|
||||
"tokenrequest_seconds": 600,
|
||||
"legacy_fallback_allowed": false,
|
||||
"bound_claims_confirmed": false,
|
||||
"execution_permitted": false,
|
||||
"authorizes_native_operation": false,
|
||||
"authorizes_first_session_grant": false,
|
||||
"native_type_or_case_ack_recorded": false,
|
||||
"real_human_disposition": null,
|
||||
"grant_created": false,
|
||||
"owner_commits": [
|
||||
{
|
||||
"repo": "ops-mason",
|
||||
"reviewed_source_commit": "a41312e5a4a099eb1f5b77fcf80abb033f82a45e",
|
||||
"observed_head": "6196be5dca9cfd16df829df93aef9ec42383af1b"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"reviewed_source_commit": "5b9c8262bedbbd9bf4348842e13aa668889ca745",
|
||||
"observed_head": "5b9c8262bedbbd9bf4348842e13aa668889ca745"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-apps",
|
||||
"reviewed_source_commit": "367f01cb4b5859ce0b4598a1ab652904b83f7f84",
|
||||
"observed_head": "367f01cb4b5859ce0b4598a1ab652904b83f7f84"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"reviewed_source_commit": "c26b018328caaf6734dbce9605709a40359f4f2c",
|
||||
"observed_head": "c26b018328caaf6734dbce9605709a40359f4f2c"
|
||||
}
|
||||
],
|
||||
"driver": "ORGREF-WP-0002",
|
||||
"existing_work_records": [
|
||||
"NK-WP-0048",
|
||||
"MASON-WP-0010",
|
||||
"WARDEN-WP-0044",
|
||||
"RAPPS-WP-0016",
|
||||
"CCR-2026-0042"
|
||||
],
|
||||
"cost_estimate_eur": 0.1,
|
||||
"risk_note": "Source architecture acknowledgment only. Actual native/custody/session risk and authority must be reviewed under their existing owner gates; no native credential exposure or runtime change is authorized by this memo.",
|
||||
"approval_source_identity": "Only independently confirmed genuine native founder disposition for exact new memo/version/packet supports source acknowledgment; old1.1 and technical owner agreements are not that disposition.",
|
||||
"type_acknowledgment_preconditions": [
|
||||
"actual complete SecurityCaseTypes section 3 package README/examples/runnable tests and full owner package validator/test pass (now proved for staged supplement)",
|
||||
"separate NetKingdom source-owner receipt binding that exact complete package",
|
||||
"independent genuine new human disposition for unchanged packet/type source"
|
||||
],
|
||||
"complete_type12_package_validation_proved": true,
|
||||
"complete_type12_package_owner_receipt_recorded": true,
|
||||
"canonical_case_status_after_source_ack": "proposed",
|
||||
"case_acceptance_authorized": false,
|
||||
"type_implemented": false,
|
||||
"complete_package_actual_observation": {
|
||||
"owner_path": "docs/proposals/2026-10-11-forgejo-consumer-eso",
|
||||
"README_available": false,
|
||||
"examples_available": false,
|
||||
"runnable_type_tests_available": false,
|
||||
"actual_owner_validate_type_with_package_path_passed": false,
|
||||
"reported_errors": [
|
||||
"type.README.md missing",
|
||||
"type.tests needs runnable tests/test_*.py",
|
||||
"type.examples needs at least one example"
|
||||
],
|
||||
"core_schema_render_validation_does_not_discharge_package_gate": true
|
||||
},
|
||||
"human_posting_ready": true,
|
||||
"complete_package_staged_supplement": {
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/package-1.2",
|
||||
"files": [
|
||||
{
|
||||
"path": "README.md",
|
||||
"sha256": "94dfe344f0e79cffea239612b0f7232f8bcc800d39e3b5aee6e1cad8cb2d5ee7"
|
||||
},
|
||||
{
|
||||
"path": "examples/example-public-portal.yaml",
|
||||
"sha256": "8d6457248415daa6fc509da4e838aae0b66d7808e9da8e00f4b85a1e7faed10d"
|
||||
},
|
||||
{
|
||||
"path": "examples/forgejo.yaml",
|
||||
"sha256": "1c868c1da7d9077fae97bc6bc029706ec3dc418cfeaae30dc0f92b5b4ba6f2ab",
|
||||
"bound_document": "case-1.2.yaml"
|
||||
},
|
||||
{
|
||||
"path": "tests/test_source_contract.py",
|
||||
"sha256": "c3011c6855b7f1e4fd8ee5aea41cfe1598380db4fd8b9498c79050c91911b829"
|
||||
},
|
||||
{
|
||||
"path": "type.yaml",
|
||||
"sha256": "017885bdd139cd66a5bf6d9839b1b8ec9bc08fb051d9577adc3928b76a7be6db",
|
||||
"bound_document": "type-1.2.yaml"
|
||||
}
|
||||
],
|
||||
"full_validator_passed": true,
|
||||
"runnable_tests_passed": 22,
|
||||
"owner_review_pending": false
|
||||
},
|
||||
"remaining_submission_gate": "Root obtains narrow peer hash acknowledgment of this lossless receipt rebinding before submitting; actual human source disposition remains absent.",
|
||||
"package_peer_review": {
|
||||
"manifest_sha256": "769441a39f5de412a1291cb8c1eb45df3aece9ae6c9261a02df056a3973e789d",
|
||||
"reviewed_completed_packet_sha256": "330da7fe129b0443e41fff44b3c2d829b0d682698fdbba9fe60011d46ed5c48c",
|
||||
"receipt_sha256": "9e9b8dda889203c064b35e1bbcd4d0c62d76d4ba1935c9a10f4b2dbf1c6e8497",
|
||||
"source_paths": [
|
||||
"/tmp/netkingdom-forgejo-type12-final-packet-review-stage/net-kingdom/docs/reviews/2026-10-11-forgejo-type12-human-packet-net-owner-final-review.md",
|
||||
"/tmp/netkingdom-forgejo-type12-final-packet-review-stage/net-kingdom/docs/reviews/2026-10-11-forgejo-type12-human-packet-net-owner-final-review.sources.json"
|
||||
],
|
||||
"narrow_rebinding_confirmation_pending": true
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
# workload-kv-read-keycape-forgejo-forgejo: CCR-2026-0042, from ops-mason SecurityCase forgejo-netkingdom-oidc
|
||||
# (oidc-browser-relying-party@1.0, render sha256:fb8b114d...). Platform-generated from the CCR:
|
||||
# the case render omitted the token self-lifecycle stanzas that token_self_lifecycle requires.
|
||||
|
||||
path "platform/data/workloads/keycape/forgejo" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
|
||||
path "auth/token/lookup-self" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
|
||||
path "auth/token/revoke-self" {
|
||||
capabilities = ["update"]
|
||||
}
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
{
|
||||
"bound_service_account_names": [
|
||||
"forgejo-keycape-forgejo-eso"
|
||||
],
|
||||
"bound_service_account_namespaces": [
|
||||
"forgejo"
|
||||
],
|
||||
"audience": "openbao",
|
||||
"token_policies": [
|
||||
"workload-kv-read-keycape-forgejo-forgejo"
|
||||
],
|
||||
"token_no_default_policy": true,
|
||||
"token_ttl": 900,
|
||||
"token_max_ttl": 900,
|
||||
"token_explicit_max_ttl": 900
|
||||
}
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
# Source-only disposition recording gates
|
||||
|
||||
Stable proposal NK-FORGEJO-TYPE12-SOURCE-20261011-R1; memo infd-20261011-forgejo-type12-source-r1@1. Preparation contains no disposition, acceptance ID, human identity assertion or grant.
|
||||
|
||||
1. REQUIRED before human submission or type acknowledgment recording: complete the actual 1.2 README/examples/runnable test package, obtain its full owner validator/test proof and separate NetKingdom source-review receipt, and bind them into this same unposted memo revision. The initial actual owner proposal directory lacked all three and reported those three failures, retained unchanged in proposal history. The staged proposed package supplement now passes the actual full owner validator and 22 runnable tests; its exact files and commands are bound in validation-and-history.json. Obtain the separate NetKingdom source-owner receipt for this exact supplement before posting; technical readiness is complete and owner-review remains the next required submission gate. Core schema/render success alone cannot satisfy this gate. Then verify every bound nineteen-file source hash and all three independent owner-review hashes. Verify proposed type 017885bdd139cd66a5bf6d9839b1b8ec9bc08fb051d9577adc3928b76a7be6db, proposed case 1c868c1da7d9077fae97bc6bc029706ec3dc418cfeaae30dc0f92b5b4ba6f2ab and full render c0afd5576cdae0cbc807eccb2b9fa87ac668f15e32ec7cf79d295bdb23c75b35. Regenerate with actual owner validator/composer, preserving execution.permitted=false. Changed declared role, bindings, trust, source body or packet requires review of the refined exact revision.
|
||||
2. Native informed-decision must provide a genuine independent human source disposition for this new memo/version/exact packet. Preserve approval/disposition/binding/source identities, actual founder resolver and observed time/stale state through existing admitted read paths. A technical review, local JSON, old e418/1.1 acceptance or State Hub prose alone is not this evidence. Record declined/pending/stale outcomes honestly. No privileged transport/grant/native runtime action follows from acknowledgment.
|
||||
3. If the human acknowledges the type and approves this reference-migration design as its declared consumer owner/founder, record only roles supported by that actual disposition; design approval is confined to a separate owner receipt, not canonical case acceptance. Preserve exact current acknowledged 1.1 type, accepted 1.1 case, old source acknowledgment/date/by and proposed 1.2 bytes in immutable owner history before any canonical promotion. Only after actual complete section 3 package validation and a separate NetKingdom source-owner receipt, NetKingdom may record the reviewed 1.2 type acknowledgment with only source acknowledgment status/history reference changes; do not overwrite the old version/history as a silent renewal. The actual 1.2 package must have its README, valid examples and runnable tests, pass the owner full-package validator/test command, and be bound by a separate NetKingdom owner source-review receipt before recording type acknowledgment. The bound complete proposed package now proves availability and validator/test readiness; the separate source-owner receipt must still be recorded before posting and acknowledgment recording, without inferring it from the 1.1 package. No implemented marker is permitted from this memo.
|
||||
4. REQUIRED: reference-migration source approval is recorded only in a separate NetKingdom/consumer-owner design receipt. Canonical case 1.2 remains proposed while the type is unimplemented; do not add canonical acceptance fields, phase-acceptance markers or accepted status from this acknowledgment. Canon sections 4/5 permits canonical case acceptance only for implemented types. Existing --allow-unimplemented first-reference source-build handling does not waive normal admission or this recording rule. Preserve original 1.1 case/history without overlap or repinning it as accepted 1.2. Only the actual implemented-type admission and separate case owner/founder acceptance can later change canonical case status.
|
||||
5. Reconcile source-only CCR42/draft/current bundle deliberately under owners, retaining historical body/review pins. New acknowledgment cannot confirm bound_claims, apply credentials or adopt existing resources. Historical wrong-target bundle remains refused; source rebundle must bind fresh current case/type/full render/owner review, with created-only runtime receipts still absent. Record updated source digests rather than backfill old digests with new meaning.
|
||||
6. All native auth/ESO/materialization/credential/session/verification gates remain unmet: owner adapters/global evidence verifier, independent observations/capabilities/creation ownership, Platform claims/apply approval, Warden descriptors/contained session/revocation and founder scoped native go. Preserve execution.permitted=false until those actual gates are separately discharged. Link source outcome to existing ORGREF/NK/Mason/Warden/RAPPS/CCR work; no new plan or automatic completion. Human browser/MFA/break-glass/first-case completion remains separate.
|
||||
|
||||
## Actual completed-package source review binding
|
||||
|
||||
The independent NetKingdom completed-package source review of exact prior packet 330da7fe is now losslessly attached, alongside the original exact19 source review, in the two clearly labelled review bundles. Each carries the source path, SHA256 and gzip-base64 encoding of the exact original bytes. The separate package-owner review gate is satisfied; source-only posting readiness is true after root obtains narrow confirmation of this receipt rebinding and README clarification. README now explicitly distinguishes observed Forgejo/runner workload forgejo/default from the historical unbound OpenBao consumer policy; no historical default-SA reader binding is claimed. The genuine human disposition remains absent and canonical case remains proposed/unimplemented.
|
||||
|
|
@ -0,0 +1,385 @@
|
|||
{
|
||||
"apiVersion": "netkingdom.io/security-case-render/v0.1",
|
||||
"case": "forgejo-netkingdom-oidc",
|
||||
"composition": {
|
||||
"apiVersion": "netkingdom.io/security-scenario-composition/v0.1",
|
||||
"authority": "netkingdom",
|
||||
"capability_providers": {
|
||||
"c1.lightweight-sso": "net-kingdom.keycape-client-registration"
|
||||
},
|
||||
"composition_digest": "sha256:f51e45eab2f2c15c93e2f7b8ef7d8fcc1daf1059da5749429ff5678b45c5214f",
|
||||
"execution": {
|
||||
"mode": "plan-only",
|
||||
"permitted": false,
|
||||
"reason": "Composition does not authorize or perform provider execution."
|
||||
},
|
||||
"execution_steps": [
|
||||
{
|
||||
"capabilities": [
|
||||
"c1.lightweight-sso"
|
||||
],
|
||||
"declaration_id": "net-kingdom.keycape-client-registration",
|
||||
"entry_point": {
|
||||
"description": "Add or remove exactly one client in the live KeyCape client registry without exporting secret values: contained kubectl, cluster and issuer pins, byte-preserving merge, compare-and-swap, read-back. Replaces the per-client helpers beside it. Field rules follow key-cape's canonical model (KEY-WP-0028). Modes: inspect, dry-run, apply; operations add and remove.",
|
||||
"invocation": "keycape-client.py apply --client-file <client.yaml> --case-acceptance <record> --expected-uid <uid> --expected-resource-version <rv>",
|
||||
"path": "sso-mfa/k8s/keycape/keycape-client.py",
|
||||
"type": "cli-sequence"
|
||||
},
|
||||
"executor_owner": "net-kingdom",
|
||||
"order": 1,
|
||||
"parameters": {
|
||||
"allowed_scopes": {
|
||||
"sensitivity": "security_sensitive",
|
||||
"source": "override",
|
||||
"tuning_authority": "netkingdom_tunable",
|
||||
"value": "openid,profile,email,groups"
|
||||
},
|
||||
"client_id": {
|
||||
"sensitivity": "operational",
|
||||
"source": "override",
|
||||
"tuning_authority": "netkingdom_tunable",
|
||||
"value": "forgejo"
|
||||
},
|
||||
"client_type": {
|
||||
"sensitivity": "security_sensitive",
|
||||
"source": "override",
|
||||
"tuning_authority": "netkingdom_tunable",
|
||||
"value": "confidential"
|
||||
},
|
||||
"display_name": {
|
||||
"sensitivity": "public",
|
||||
"source": "override",
|
||||
"tuning_authority": "netkingdom_tunable",
|
||||
"value": "Forgejo source forge"
|
||||
},
|
||||
"mfa_required": {
|
||||
"sensitivity": "security_sensitive",
|
||||
"source": "override",
|
||||
"tuning_authority": "netkingdom_tunable",
|
||||
"value": "true"
|
||||
},
|
||||
"redirect_uris": {
|
||||
"sensitivity": "security_sensitive",
|
||||
"source": "override",
|
||||
"tuning_authority": "netkingdom_tunable",
|
||||
"value": "https://forgejo.coulomb.social/user/oauth2/netkingdom/callback"
|
||||
}
|
||||
},
|
||||
"readiness_obligations": [
|
||||
{
|
||||
"checks": [
|
||||
{
|
||||
"description": "The authorization endpoint accepts the client with each registered redirect URI.",
|
||||
"evidence": "GET /authorize with client_id and each redirect_uri returns the login page, not an error.",
|
||||
"id": "client-authorize-accepts-registered-redirect"
|
||||
},
|
||||
{
|
||||
"description": "The authorization endpoint refuses an unregistered redirect URI for the client.",
|
||||
"evidence": "GET /authorize with an unregistered redirect_uri returns an OAuth error.",
|
||||
"id": "client-authorize-refuses-other-redirect"
|
||||
}
|
||||
],
|
||||
"state": "tenant_onboarding_trust"
|
||||
}
|
||||
],
|
||||
"repo": "net-kingdom",
|
||||
"requires_trust": [
|
||||
{
|
||||
"readiness_checks": [],
|
||||
"state": "runtime_secret_trust"
|
||||
},
|
||||
{
|
||||
"readiness_checks": [],
|
||||
"state": "runtime_identity_trust"
|
||||
}
|
||||
],
|
||||
"satisfies_trust": [
|
||||
{
|
||||
"readiness_checks": [
|
||||
{
|
||||
"description": "The authorization endpoint accepts the client with each registered redirect URI.",
|
||||
"evidence": "GET /authorize with client_id and each redirect_uri returns the login page, not an error.",
|
||||
"id": "client-authorize-accepts-registered-redirect"
|
||||
},
|
||||
{
|
||||
"description": "The authorization endpoint refuses an unregistered redirect URI for the client.",
|
||||
"evidence": "GET /authorize with an unregistered redirect_uri returns an OAuth error.",
|
||||
"id": "client-authorize-refuses-other-redirect"
|
||||
}
|
||||
],
|
||||
"state": "tenant_onboarding_trust"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"initial_trust": [
|
||||
"runtime_identity_trust",
|
||||
"runtime_secret_trust"
|
||||
],
|
||||
"kind": "SecurityScenarioComposition",
|
||||
"planned_final_trust": [
|
||||
"runtime_identity_trust",
|
||||
"runtime_secret_trust",
|
||||
"tenant_onboarding_trust"
|
||||
],
|
||||
"requested_capabilities": [
|
||||
"c1.lightweight-sso"
|
||||
],
|
||||
"responsibility_map": [
|
||||
{
|
||||
"declaration_id": "net-kingdom.keycape-client-registration",
|
||||
"netkingdom_orchestrates": "Supply the case's validated, non-secret client fields.",
|
||||
"owner": "net-kingdom",
|
||||
"repo_owns": "Live registry change for exactly this client, its idempotency and removal; field rules are key-cape's canonical model.",
|
||||
"resource_kind": "identities",
|
||||
"resources": [
|
||||
"oidc:static-clients"
|
||||
]
|
||||
},
|
||||
{
|
||||
"declaration_id": "net-kingdom.keycape-client-registration",
|
||||
"netkingdom_orchestrates": "Choose scopes and MFA posture per SecurityCaseType.",
|
||||
"owner": "key-cape",
|
||||
"repo_owns": "Enforce exact redirect URIs, allowed scopes and the MFA pin at authorization time.",
|
||||
"resource_kind": "roles_scopes_policies",
|
||||
"resources": [
|
||||
"iam-profile:client-scope-allowlists"
|
||||
]
|
||||
}
|
||||
],
|
||||
"scenario": "scenario:case:forgejo-netkingdom-oidc"
|
||||
},
|
||||
"digest": "sha256:c0afd5576cdae0cbc807eccb2b9fa87ac668f15e32ec7cf79d295bdb23c75b35",
|
||||
"execution": {
|
||||
"permitted": false
|
||||
},
|
||||
"follow_through": [
|
||||
{
|
||||
"attended": true,
|
||||
"attended_justification": "The provisioner's only HTTP credential is user-engine's runtime token, and its NetworkPolicy admits only user-engine pods. A proxy lane would act as user-engine (ops-warden review R8; canon section 3; ops-warden ADR-0002). Running it in the session register-client already needs adds no attended session. It can become unattended once the provisioner has an operator credential of its own and an admitted path.",
|
||||
"auth": "operator cluster access in the attended register-client session; the in-pod call uses the provisioner's own directory binding, and no provisioner or user-engine token is read or sent",
|
||||
"entry_point": "identity-provisioner ensure_service_groups, run inside the provisioner pod through the session's contained cluster access (groups forge-admins,forge-coulomb-owners,forge-coulomb-readers; members exactly forge-admins=tegwick;forge-coulomb-owners=tegwick as recorded in the accepted case, nothing else)",
|
||||
"id": "ensure-groups",
|
||||
"lane": "key-cape-oidc-login",
|
||||
"owner": "net-kingdom",
|
||||
"value_handling": "none",
|
||||
"warden_executes": false
|
||||
},
|
||||
{
|
||||
"attended": false,
|
||||
"auth": "the caller's broker grant for the case's KV path, through its lane; the value is generated in custody and never returned",
|
||||
"entry_point": "railiance-platform credential broker: generate a client secret inside custody at bao:platform/workloads/keycape/forgejo",
|
||||
"id": "mint-secret",
|
||||
"lane": "keycape-client-secret-generate",
|
||||
"owner": "railiance-platform",
|
||||
"value_handling": "generated_in_custody",
|
||||
"warden_executes": true
|
||||
},
|
||||
{
|
||||
"attended": false,
|
||||
"auth": "railiance-platform ESO delivery through role external-secrets-keycape-forgejo; no value leaves custody",
|
||||
"entry_point": "ExternalSecret sso/keycape-forgejo-client (key client-secret) from bao:platform/workloads/keycape/forgejo",
|
||||
"id": "deliver-secret",
|
||||
"owner": "railiance-platform",
|
||||
"ready_check": "the delivery for sso/keycape-forgejo-client reports Ready=True (status only, no value read)",
|
||||
"value_handling": "none",
|
||||
"warden_executes": false
|
||||
},
|
||||
{
|
||||
"attended": true,
|
||||
"attended_justification": "A change to the live identity provider's Deployment. It runs in the same attended operator session as register-client, before it, because KeyCape resolves a confidential client's secret at start and fails closed if the binding is missing.",
|
||||
"auth": "operator kube credentials for namespace sso",
|
||||
"entry_point": "patch Deployment sso/keycape: env KEYCAPE_FORGEJO_CLIENT_SECRET from sso/keycape-forgejo-client",
|
||||
"id": "bind-env",
|
||||
"lane": "key-cape-oidc-login",
|
||||
"owner": "net-kingdom",
|
||||
"value_handling": "none",
|
||||
"warden_executes": false
|
||||
},
|
||||
{
|
||||
"attended": true,
|
||||
"attended_justification": "The live KeyCape client registry is a Kubernetes Secret, and agents do not read or write Secrets. Until KeyCape loads clients from a non-secret registry with secrets referenced from custody, one attended operator session applies the rendered registration. ops-warden groups all attended steps of a run into that one session. KeyCape loads clients at startup and keeps login, authorization and handoff state in memory, so the restart drops in-flight logins and sessions for every client; runs go in a quiet window (key-cape type review R4). The rendered registry must pass KeyCape's own startup checks (keycape check-config, key-cape c528daa, which keycape-client.py runs before it patches) before the restart: a refused entry stops the single replica and every client loses sign-in (R1).",
|
||||
"auth": "operator write access to the live KeyCape client registry in namespace sso",
|
||||
"entry_point": "sso-mfa/k8s/keycape/keycape-client.py apply --client-file <client-from-case> --case-acceptance <record> --check-config <keycape binary> (net-kingdom.keycape-client-registration)",
|
||||
"id": "register-client",
|
||||
"lane": "key-cape-oidc-login",
|
||||
"owner": "net-kingdom",
|
||||
"value_handling": "none",
|
||||
"warden_executes": false
|
||||
},
|
||||
{
|
||||
"attended": false,
|
||||
"auth": "Consumer owner contained Kubernetes deployment authority; ESO authenticates to OpenBao role external-secrets-keycape-forgejo-forgejo with a TokenRequest for the dedicated namespaced serviceAccountRef; controller remains trusted",
|
||||
"entry_point": "Owner applies dedicated ServiceAccount forgejo/forgejo-keycape-forgejo-eso (automount=false, no legacy tokens), namespace SecretStore openbao-keycape-forgejo-consumer with serviceAccountRef and audiences [openbao], and ExternalSecret forgejo-netkingdom-oidc-client with Owner target, Retain remote deletion and only CLIENT_SECRET from workloads/keycape/forgejo. Admission validates actual installed ESO TokenRequest support and common controller RBAC before any owner-approved apply.",
|
||||
"id": "deliver-consumer-secret",
|
||||
"owner": "railiance-apps",
|
||||
"ready_check": "Namespace SecretStore and ExternalSecret both report Ready=True; dedicated SA has no legacy token refs; status and fixed metadata only, never Secret values.",
|
||||
"value_handling": "none",
|
||||
"warden_executes": false
|
||||
},
|
||||
{
|
||||
"attended": false,
|
||||
"auth": "the consumer owner's own deployment path",
|
||||
"entry_point": "configure forgejo with issuer https://kc.coulomb.social, client forgejo and custody bao:platform/workloads/keycape/forgejo, and make it require one of forge-admins,forge-coulomb-owners,forge-coulomb-readers in the groups claim before sign-in completes",
|
||||
"id": "hand-over",
|
||||
"owner": "railiance-apps",
|
||||
"value_handling": "none",
|
||||
"warden_executes": false
|
||||
}
|
||||
],
|
||||
"kind": "SecurityCaseRender",
|
||||
"materialization": [
|
||||
{
|
||||
"body": "field CLIENT_SECRET; minted by the credential broker, never written by hand",
|
||||
"id": "client-secret-path",
|
||||
"kind": "kv_path",
|
||||
"template": "platform/workloads/keycape/forgejo"
|
||||
},
|
||||
{
|
||||
"body": "path \"platform/data/workloads/keycape/forgejo\" {\n capabilities = [\"read\"]\n}\n",
|
||||
"description": "KeyCape reads its client secret only through ESO. No metadata, list, parent or sibling access.",
|
||||
"id": "keycape-reader-policy",
|
||||
"kind": "openbao_policy",
|
||||
"template": "workload-kv-read-keycape-forgejo-eso"
|
||||
},
|
||||
{
|
||||
"body": "path \"platform/data/workloads/keycape/forgejo\" {\n capabilities = [\"read\"]\n}\n",
|
||||
"description": "The consuming service reads the same secret. No metadata, list, parent or sibling access.",
|
||||
"id": "consumer-reader-policy",
|
||||
"kind": "openbao_policy",
|
||||
"template": "workload-kv-read-keycape-forgejo-forgejo"
|
||||
},
|
||||
{
|
||||
"body": "auth: kubernetes\nbound_service_account_names: [external-secrets]\nbound_service_account_namespaces: [external-secrets]\ntoken_policies: [workload-kv-read-keycape-forgejo-eso]\ntoken_no_default_policy: true\ntoken_ttl: 15m\ntoken_max_ttl: 15m\n",
|
||||
"description": "The Kubernetes-auth role deliver-secret uses; bound to the ESO service account only.",
|
||||
"id": "eso-role",
|
||||
"kind": "openbao_role",
|
||||
"template": "external-secrets-keycape-forgejo"
|
||||
},
|
||||
{
|
||||
"body": "auth: kubernetes\nbound_service_account_names: [forgejo-keycape-forgejo-eso]\nbound_service_account_namespaces: [forgejo]\naudience: openbao\ntoken_policies: [workload-kv-read-keycape-forgejo-forgejo]\ntoken_no_default_policy: true\ntoken_ttl: 15m\ntoken_max_ttl: 15m\n",
|
||||
"description": "Consumer ESO requests a token for this separate reference identity. Common ESO controller remains trusted and can request tokens; no cryptographic controller isolation is claimed.",
|
||||
"id": "consumer-eso-role",
|
||||
"kind": "openbao_role",
|
||||
"template": "external-secrets-keycape-forgejo-forgejo"
|
||||
},
|
||||
{
|
||||
"body": "id: forgejo-keycape-client\nowner_repo: key-cape\nwarden_executes: false\nrisk: high\nstatus: active once verification passes\nworkload_ref: applicable, name forgejo, declaration_ref of the consumer's published declaration or the explicit unknown form, never inferred\npath_template: platform/workloads/keycape/forgejo\nfield: CLIENT_SECRET\ndelegation: native, intended_owner key-cape\nrotation: mint-secret then verification; automatable false until a run has been proven\n",
|
||||
"description": "One entry per case (ops-mason item 5, ops-warden R4'). It carries the consumer's workload reference, which ADR-0009 needs for zone selection.",
|
||||
"id": "catalog-entry",
|
||||
"kind": "catalog_entry",
|
||||
"template": "forgejo-keycape-client"
|
||||
}
|
||||
],
|
||||
"rollback": [
|
||||
{
|
||||
"action": "remove the OIDC source for forgejo from forgejo (owner railiance-apps)",
|
||||
"reverses": "hand-over"
|
||||
},
|
||||
{
|
||||
"action": "After reverting consumer secret reference, delete only authenticated created ExternalSecret/owned target by UID and ownerReference, then SecretStore and dedicated SA; preserve preexisting-matched resources and never delete a shared target. Retain audit and ownership receipts; removing SecretStore/SA alone is not immediate OpenBao token revocation.",
|
||||
"reverses": "deliver-consumer-secret"
|
||||
},
|
||||
{
|
||||
"action": "keycape-client.py apply --operation remove for forgejo",
|
||||
"reverses": "register-client"
|
||||
},
|
||||
{
|
||||
"action": "remove env KEYCAPE_FORGEJO_CLIENT_SECRET from Deployment sso/keycape, after register-client is reversed",
|
||||
"reverses": "bind-env"
|
||||
},
|
||||
{
|
||||
"action": "delete ExternalSecret sso/keycape-forgejo-client and its target",
|
||||
"reverses": "deliver-secret"
|
||||
},
|
||||
{
|
||||
"action": "covered by client-secret-path: one metadata delete, after deliver-secret is reversed",
|
||||
"reverses": "mint-secret"
|
||||
},
|
||||
{
|
||||
"action": "identity-provisioner revoke_service_groups inside the provisioner pod (attended, as ensure-groups) with the case's memberships; delete_if_empty only if no other case uses forge-admins,forge-coulomb-owners,forge-coulomb-readers",
|
||||
"reverses": "ensure-groups"
|
||||
},
|
||||
{
|
||||
"action": "delete metadata and all versions at platform/workloads/keycape/forgejo, after the ExternalSecret is gone (this also reverses mint-secret)",
|
||||
"reverses": "client-secret-path"
|
||||
},
|
||||
{
|
||||
"action": "delete Kubernetes-auth role external-secrets-keycape-forgejo",
|
||||
"reverses": "eso-role"
|
||||
},
|
||||
{
|
||||
"action": "delete policy workload-kv-read-keycape-forgejo-eso, after eso-role",
|
||||
"reverses": "keycape-reader-policy"
|
||||
},
|
||||
{
|
||||
"action": "Delete only this case-created role external-secrets-keycape-forgejo-forgejo, before deleting consumer-reader-policy; revoke case-issued OpenBao tokens or prove expiration before declaring deactivation.",
|
||||
"reverses": "consumer-eso-role"
|
||||
},
|
||||
{
|
||||
"action": "delete policy workload-kv-read-keycape-forgejo-forgejo",
|
||||
"reverses": "consumer-reader-policy"
|
||||
},
|
||||
{
|
||||
"action": "remove catalog entry forgejo-keycape-client",
|
||||
"reverses": "catalog-entry"
|
||||
}
|
||||
],
|
||||
"type": "oidc-browser-relying-party@1.2",
|
||||
"verification": [
|
||||
{
|
||||
"check": "GET https://kc.coulomb.social/authorize with client forgejo and each of https://forgejo.coulomb.social/user/oauth2/netkingdom/callback returns the login page",
|
||||
"expect": "present",
|
||||
"id": "authorize-accepts-redirects",
|
||||
"reads_secret_value": false
|
||||
},
|
||||
{
|
||||
"check": "GET https://kc.coulomb.social/authorize with client forgejo and an unregistered redirect returns an OAuth error",
|
||||
"expect": "deny",
|
||||
"id": "authorize-refuses-other-redirect",
|
||||
"reads_secret_value": false
|
||||
},
|
||||
{
|
||||
"check": "a default-only OpenBao identity has no read capability on bao:platform/workloads/keycape/forgejo",
|
||||
"expect": "deny",
|
||||
"id": "custody-denied-to-default",
|
||||
"reads_secret_value": false
|
||||
},
|
||||
{
|
||||
"check": "policy workload-kv-read-keycape-forgejo-forgejo grants read on bao:platform/workloads/keycape/forgejo (capabilities check only)",
|
||||
"expect": "allow",
|
||||
"id": "custody-allowed-to-consumer",
|
||||
"reads_secret_value": false
|
||||
},
|
||||
{
|
||||
"check": "LLDAP groups forge-admins,forge-coulomb-owners,forge-coulomb-readers exist, with exactly the memberships of the accepted case added",
|
||||
"expect": "present",
|
||||
"id": "groups-present",
|
||||
"reads_secret_value": false
|
||||
},
|
||||
{
|
||||
"check": "forgejo's OIDC source for forgejo (owner railiance-apps) requires one of forge-admins,forge-coulomb-owners,forge-coulomb-readers in the groups claim (configuration read, no secret value)",
|
||||
"expect": "present",
|
||||
"id": "consumer-enforces-groups",
|
||||
"reads_secret_value": false
|
||||
},
|
||||
{
|
||||
"check": "the delivery for sso/keycape-forgejo-client reports Ready=True (status only)",
|
||||
"expect": "present",
|
||||
"id": "secret-delivered",
|
||||
"reads_secret_value": false
|
||||
},
|
||||
{
|
||||
"check": "keycape-client.py inspect for forgejo shows the MFA pin on the registered client (non-secret client view)",
|
||||
"expect": "present",
|
||||
"id": "mfa-pinned",
|
||||
"reads_secret_value": false
|
||||
},
|
||||
{
|
||||
"check": "forgejo SecretStore openbao-keycape-forgejo-consumer and ExternalSecret forgejo-netkingdom-oidc-client Ready=True, exact dedicated SA/audience role binding, fixed CLIENT_SECRET mapping; no Secret value read",
|
||||
"expect": "present",
|
||||
"id": "consumer-secret-delivered",
|
||||
"reads_secret_value": false
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,666 @@
|
|||
{
|
||||
"eso_rbac_bindings": [
|
||||
{
|
||||
"kind": "ClusterRoleBinding",
|
||||
"name": "external-secrets-cert-controller",
|
||||
"namespace": null,
|
||||
"roleRef": {
|
||||
"apiGroup": "rbac.authorization.k8s.io",
|
||||
"kind": "ClusterRole",
|
||||
"name": "external-secrets-cert-controller"
|
||||
},
|
||||
"rules": [
|
||||
{
|
||||
"apiGroups": [
|
||||
"apiextensions.k8s.io"
|
||||
],
|
||||
"resources": [
|
||||
"customresourcedefinitions"
|
||||
],
|
||||
"verbs": [
|
||||
"get",
|
||||
"list",
|
||||
"watch",
|
||||
"update",
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"apiGroups": [
|
||||
"admissionregistration.k8s.io"
|
||||
],
|
||||
"resources": [
|
||||
"validatingwebhookconfigurations"
|
||||
],
|
||||
"verbs": [
|
||||
"list",
|
||||
"watch",
|
||||
"get"
|
||||
]
|
||||
},
|
||||
{
|
||||
"apiGroups": [
|
||||
"admissionregistration.k8s.io"
|
||||
],
|
||||
"resourceNames": [
|
||||
"secretstore-validate",
|
||||
"externalsecret-validate"
|
||||
],
|
||||
"resources": [
|
||||
"validatingwebhookconfigurations"
|
||||
],
|
||||
"verbs": [
|
||||
"update",
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"apiGroups": [
|
||||
""
|
||||
],
|
||||
"resources": [
|
||||
"endpoints"
|
||||
],
|
||||
"verbs": [
|
||||
"list",
|
||||
"get",
|
||||
"watch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"apiGroups": [
|
||||
""
|
||||
],
|
||||
"resources": [
|
||||
"events"
|
||||
],
|
||||
"verbs": [
|
||||
"create",
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"apiGroups": [
|
||||
""
|
||||
],
|
||||
"resources": [
|
||||
"secrets"
|
||||
],
|
||||
"verbs": [
|
||||
"get",
|
||||
"list",
|
||||
"watch",
|
||||
"update",
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"apiGroups": [
|
||||
"coordination.k8s.io"
|
||||
],
|
||||
"resources": [
|
||||
"leases"
|
||||
],
|
||||
"verbs": [
|
||||
"get",
|
||||
"create",
|
||||
"update",
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"subjects": [
|
||||
{
|
||||
"kind": "ServiceAccount",
|
||||
"name": "external-secrets-cert-controller",
|
||||
"namespace": "external-secrets"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"kind": "ClusterRoleBinding",
|
||||
"name": "external-secrets-controller",
|
||||
"namespace": null,
|
||||
"roleRef": {
|
||||
"apiGroup": "rbac.authorization.k8s.io",
|
||||
"kind": "ClusterRole",
|
||||
"name": "external-secrets-controller"
|
||||
},
|
||||
"rules": [
|
||||
{
|
||||
"apiGroups": [
|
||||
"external-secrets.io"
|
||||
],
|
||||
"resources": [
|
||||
"secretstores",
|
||||
"clustersecretstores",
|
||||
"externalsecrets",
|
||||
"clusterexternalsecrets",
|
||||
"pushsecrets",
|
||||
"clusterpushsecrets"
|
||||
],
|
||||
"verbs": [
|
||||
"get",
|
||||
"list",
|
||||
"watch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"apiGroups": [
|
||||
"external-secrets.io"
|
||||
],
|
||||
"resources": [
|
||||
"externalsecrets",
|
||||
"externalsecrets/status",
|
||||
"externalsecrets/finalizers",
|
||||
"secretstores",
|
||||
"secretstores/status",
|
||||
"secretstores/finalizers",
|
||||
"clustersecretstores",
|
||||
"clustersecretstores/status",
|
||||
"clustersecretstores/finalizers",
|
||||
"clusterexternalsecrets",
|
||||
"clusterexternalsecrets/status",
|
||||
"clusterexternalsecrets/finalizers",
|
||||
"pushsecrets",
|
||||
"pushsecrets/status",
|
||||
"pushsecrets/finalizers",
|
||||
"clusterpushsecrets",
|
||||
"clusterpushsecrets/status",
|
||||
"clusterpushsecrets/finalizers"
|
||||
],
|
||||
"verbs": [
|
||||
"get",
|
||||
"update",
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"apiGroups": [
|
||||
"generators.external-secrets.io"
|
||||
],
|
||||
"resources": [
|
||||
"generatorstates"
|
||||
],
|
||||
"verbs": [
|
||||
"get",
|
||||
"list",
|
||||
"watch",
|
||||
"create",
|
||||
"update",
|
||||
"patch",
|
||||
"delete",
|
||||
"deletecollection"
|
||||
]
|
||||
},
|
||||
{
|
||||
"apiGroups": [
|
||||
"generators.external-secrets.io"
|
||||
],
|
||||
"resources": [
|
||||
"acraccesstokens",
|
||||
"clustergenerators",
|
||||
"ecrauthorizationtokens",
|
||||
"fakes",
|
||||
"gcraccesstokens",
|
||||
"githubaccesstokens",
|
||||
"quayaccesstokens",
|
||||
"passwords",
|
||||
"stssessiontokens",
|
||||
"uuids",
|
||||
"vaultdynamicsecrets",
|
||||
"webhooks",
|
||||
"grafanas"
|
||||
],
|
||||
"verbs": [
|
||||
"get",
|
||||
"list",
|
||||
"watch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"apiGroups": [
|
||||
""
|
||||
],
|
||||
"resources": [
|
||||
"serviceaccounts",
|
||||
"namespaces"
|
||||
],
|
||||
"verbs": [
|
||||
"get",
|
||||
"list",
|
||||
"watch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"apiGroups": [
|
||||
""
|
||||
],
|
||||
"resources": [
|
||||
"configmaps"
|
||||
],
|
||||
"verbs": [
|
||||
"get",
|
||||
"list",
|
||||
"watch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"apiGroups": [
|
||||
""
|
||||
],
|
||||
"resources": [
|
||||
"secrets"
|
||||
],
|
||||
"verbs": [
|
||||
"get",
|
||||
"list",
|
||||
"watch",
|
||||
"create",
|
||||
"update",
|
||||
"delete",
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"apiGroups": [
|
||||
""
|
||||
],
|
||||
"resources": [
|
||||
"serviceaccounts/token"
|
||||
],
|
||||
"verbs": [
|
||||
"create"
|
||||
]
|
||||
},
|
||||
{
|
||||
"apiGroups": [
|
||||
""
|
||||
],
|
||||
"resources": [
|
||||
"events"
|
||||
],
|
||||
"verbs": [
|
||||
"create",
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"apiGroups": [
|
||||
"external-secrets.io"
|
||||
],
|
||||
"resources": [
|
||||
"externalsecrets"
|
||||
],
|
||||
"verbs": [
|
||||
"create",
|
||||
"update",
|
||||
"delete"
|
||||
]
|
||||
},
|
||||
{
|
||||
"apiGroups": [
|
||||
"external-secrets.io"
|
||||
],
|
||||
"resources": [
|
||||
"pushsecrets"
|
||||
],
|
||||
"verbs": [
|
||||
"create",
|
||||
"update",
|
||||
"delete"
|
||||
]
|
||||
}
|
||||
],
|
||||
"subjects": [
|
||||
{
|
||||
"kind": "ServiceAccount",
|
||||
"name": "external-secrets",
|
||||
"namespace": "external-secrets"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"kind": "RoleBinding",
|
||||
"name": "external-secrets-leaderelection",
|
||||
"namespace": "external-secrets",
|
||||
"roleRef": {
|
||||
"apiGroup": "rbac.authorization.k8s.io",
|
||||
"kind": "Role",
|
||||
"name": "external-secrets-leaderelection"
|
||||
},
|
||||
"rules": [
|
||||
{
|
||||
"apiGroups": [
|
||||
""
|
||||
],
|
||||
"resourceNames": [
|
||||
"external-secrets-controller"
|
||||
],
|
||||
"resources": [
|
||||
"configmaps"
|
||||
],
|
||||
"verbs": [
|
||||
"get",
|
||||
"update",
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"apiGroups": [
|
||||
""
|
||||
],
|
||||
"resources": [
|
||||
"configmaps"
|
||||
],
|
||||
"verbs": [
|
||||
"create"
|
||||
]
|
||||
},
|
||||
{
|
||||
"apiGroups": [
|
||||
"coordination.k8s.io"
|
||||
],
|
||||
"resources": [
|
||||
"leases"
|
||||
],
|
||||
"verbs": [
|
||||
"get",
|
||||
"create",
|
||||
"update",
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"subjects": [
|
||||
{
|
||||
"kind": "ServiceAccount",
|
||||
"name": "external-secrets",
|
||||
"namespace": "external-secrets"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"external-secrets_deployments": [
|
||||
{
|
||||
"images": [
|
||||
"oci.external-secrets.io/external-secrets/external-secrets:v0.16.1"
|
||||
],
|
||||
"name": "external-secrets",
|
||||
"serviceAccount": "external-secrets",
|
||||
"uid": "e6017556-523a-4b26-b9d1-4c0c90cef483"
|
||||
},
|
||||
{
|
||||
"images": [
|
||||
"oci.external-secrets.io/external-secrets/external-secrets:v0.16.1"
|
||||
],
|
||||
"name": "external-secrets-cert-controller",
|
||||
"serviceAccount": "external-secrets-cert-controller",
|
||||
"uid": "5134a56f-aa05-4764-9b27-c56e92203c7d"
|
||||
},
|
||||
{
|
||||
"images": [
|
||||
"oci.external-secrets.io/external-secrets/external-secrets:v0.16.1"
|
||||
],
|
||||
"name": "external-secrets-webhook",
|
||||
"serviceAccount": "external-secrets-webhook",
|
||||
"uid": "6e6e4a6e-4c2c-4659-af56-d4281f2fe229"
|
||||
}
|
||||
],
|
||||
"external-secrets_externalsecrets": [],
|
||||
"external-secrets_secretstores": [],
|
||||
"external-secrets_serviceaccounts": [
|
||||
{
|
||||
"automountServiceAccountToken": null,
|
||||
"name": "default",
|
||||
"uid": "cc29abe8-5ace-4cc9-b479-cf8db84df42d"
|
||||
},
|
||||
{
|
||||
"automountServiceAccountToken": false,
|
||||
"name": "eso-token-renewer",
|
||||
"uid": "4d44afd7-59e9-44de-9e99-8cd620be41de"
|
||||
},
|
||||
{
|
||||
"automountServiceAccountToken": null,
|
||||
"name": "external-secrets",
|
||||
"uid": "c918dc22-b1ee-4e1f-a8f8-1d15ac0d5a10"
|
||||
},
|
||||
{
|
||||
"automountServiceAccountToken": null,
|
||||
"name": "external-secrets-cert-controller",
|
||||
"uid": "3c78bb78-a3c5-4953-93d4-cf6621e1200a"
|
||||
},
|
||||
{
|
||||
"automountServiceAccountToken": null,
|
||||
"name": "external-secrets-webhook",
|
||||
"uid": "c75dc3ba-42db-4a59-8952-6c94d85d054c"
|
||||
}
|
||||
],
|
||||
"forgejo_deployments": [
|
||||
{
|
||||
"images": [
|
||||
"code.forgejo.org/forgejo/forgejo:11.0.3-rootless"
|
||||
],
|
||||
"name": "forgejo-gitea",
|
||||
"serviceAccount": "default",
|
||||
"uid": "e8eff0aa-64bb-4b44-9a80-a66612986355"
|
||||
},
|
||||
{
|
||||
"images": [
|
||||
"docker:27-dind",
|
||||
"code.forgejo.org/forgejo/runner:6.3.1"
|
||||
],
|
||||
"name": "forgejo-runner",
|
||||
"serviceAccount": "default",
|
||||
"uid": "89c8a056-bcae-4940-acdd-2eb2768e108a"
|
||||
}
|
||||
],
|
||||
"forgejo_externalsecrets": [
|
||||
{
|
||||
"conditions": [
|
||||
{
|
||||
"type": "Ready",
|
||||
"status": "True",
|
||||
"reason": "SecretSynced"
|
||||
}
|
||||
],
|
||||
"data": [
|
||||
{
|
||||
"key": "workloads/forgejo/forgejo-mailer",
|
||||
"property": "PASSWD",
|
||||
"secretKey": "MAILER_PASSWD"
|
||||
}
|
||||
],
|
||||
"name": "forgejo-mailer",
|
||||
"store": {
|
||||
"kind": "ClusterSecretStore",
|
||||
"name": "openbao-forgejo"
|
||||
},
|
||||
"target": "forgejo-mailer",
|
||||
"uid": "cbbea71e-70a8-4010-aca9-9136920f2f58"
|
||||
}
|
||||
],
|
||||
"forgejo_secretstores": [],
|
||||
"forgejo_serviceaccounts": [
|
||||
{
|
||||
"automountServiceAccountToken": null,
|
||||
"name": "default",
|
||||
"uid": "2ae15248-4700-46a6-84c6-e3bb3cd33323"
|
||||
},
|
||||
{
|
||||
"automountServiceAccountToken": false,
|
||||
"name": "forgejo-mailer-eso",
|
||||
"uid": "e2214835-32dd-4333-a9c2-6d248ab8bafe"
|
||||
}
|
||||
],
|
||||
"native_mutation": false,
|
||||
"observed_at": "2026-10-11T01:20:37.519031+00:00",
|
||||
"secret_value_reads": false,
|
||||
"secretstore_crd": {
|
||||
"uid": "1eefa5c9-6c2a-4a3b-84c6-3941488201c2",
|
||||
"versions": [
|
||||
{
|
||||
"kubernetes_auth_schema": {
|
||||
"description": "Kubernetes authenticates with Vault by passing the ServiceAccount\ntoken stored in the named Secret resource to the Vault server.",
|
||||
"properties": {
|
||||
"mountPath": {
|
||||
"default": "kubernetes",
|
||||
"description": "Path where the Kubernetes authentication backend is mounted in Vault, e.g:\n\"kubernetes\"",
|
||||
"type": "string"
|
||||
},
|
||||
"role": {
|
||||
"description": "A required field containing the Vault Role to assume. A Role binds a\nKubernetes ServiceAccount with a set of Vault policies.",
|
||||
"type": "string"
|
||||
},
|
||||
"secretRef": {
|
||||
"description": "Optional secret field containing a Kubernetes ServiceAccount JWT used\nfor authenticating with Vault. If a name is specified without a key,\n`token` is the default. If one is not specified, the one bound to\nthe controller will be used.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "A key in the referenced Secret.\nSome instances of this field may be defaulted, in others it may be required.",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^[-._a-zA-Z0-9]+$",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "The name of the Secret resource being referred to.",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "The namespace of the Secret resource being referred to.\nIgnored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.",
|
||||
"maxLength": 63,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"serviceAccountRef": {
|
||||
"description": "Optional service account field containing the name of a kubernetes ServiceAccount.\nIf the service account is specified, the service account secret token JWT will be used\nfor authenticating with Vault. If the service account selector is not supplied,\nthe secretRef will be used instead.",
|
||||
"properties": {
|
||||
"audiences": {
|
||||
"description": "Audience specifies the `aud` claim for the service account token\nIf the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity\nthen this audiences will be appended to the list",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"name": {
|
||||
"description": "The name of the ServiceAccount resource being referred to.",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "Namespace of the resource being referred to.\nIgnored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.",
|
||||
"maxLength": 63,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"mountPath",
|
||||
"role"
|
||||
],
|
||||
"type": "object"
|
||||
},
|
||||
"name": "v1",
|
||||
"served": true,
|
||||
"storage": true
|
||||
},
|
||||
{
|
||||
"kubernetes_auth_schema": {
|
||||
"description": "Kubernetes authenticates with Vault by passing the ServiceAccount\ntoken stored in the named Secret resource to the Vault server.",
|
||||
"properties": {
|
||||
"mountPath": {
|
||||
"default": "kubernetes",
|
||||
"description": "Path where the Kubernetes authentication backend is mounted in Vault, e.g:\n\"kubernetes\"",
|
||||
"type": "string"
|
||||
},
|
||||
"role": {
|
||||
"description": "A required field containing the Vault Role to assume. A Role binds a\nKubernetes ServiceAccount with a set of Vault policies.",
|
||||
"type": "string"
|
||||
},
|
||||
"secretRef": {
|
||||
"description": "Optional secret field containing a Kubernetes ServiceAccount JWT used\nfor authenticating with Vault. If a name is specified without a key,\n`token` is the default. If one is not specified, the one bound to\nthe controller will be used.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "A key in the referenced Secret.\nSome instances of this field may be defaulted, in others it may be required.",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^[-._a-zA-Z0-9]+$",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "The name of the Secret resource being referred to.",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "The namespace of the Secret resource being referred to.\nIgnored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.",
|
||||
"maxLength": 63,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"serviceAccountRef": {
|
||||
"description": "Optional service account field containing the name of a kubernetes ServiceAccount.\nIf the service account is specified, the service account secret token JWT will be used\nfor authenticating with Vault. If the service account selector is not supplied,\nthe secretRef will be used instead.",
|
||||
"properties": {
|
||||
"audiences": {
|
||||
"description": "Audience specifies the `aud` claim for the service account token\nIf the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity\nthen this audiences will be appended to the list",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"name": {
|
||||
"description": "The name of the ServiceAccount resource being referred to.",
|
||||
"maxLength": 253,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "Namespace of the resource being referred to.\nIgnored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.",
|
||||
"maxLength": 63,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"mountPath",
|
||||
"role"
|
||||
],
|
||||
"type": "object"
|
||||
},
|
||||
"name": "v1beta1",
|
||||
"served": true,
|
||||
"storage": false
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,221 @@
|
|||
{
|
||||
"bound_preparation_manifest_sha256": "5dbd04cf96d73a2604cbf113073d618c03434fc87508ba614cbe3820a1a0e431",
|
||||
"reviewed19_owner_source_files": [
|
||||
{
|
||||
"repo": "railiance-apps",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/consumer-delivery.yaml",
|
||||
"sha256": "56478a83d799c08dc1e5159983b1e843a46b16dfeee7e84c31401d1f92430df2"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-apps",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/native-metadata.json",
|
||||
"sha256": "4e2993f5920215f41e4a235743023f22b78b8f597d3d70ed279991b2fc3204b5"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-apps",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/observe-native-metadata.py",
|
||||
"sha256": "3732aa0ff45b5197ac7837cbc5814f59ea3d694d4a157d19d00711f29da76913"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-apps",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/owner-design.md",
|
||||
"sha256": "c523949454e4c6eb58e8caee382380a561f561704136de62bf5783c592f962f2"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-apps",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/owner-source-pins.json",
|
||||
"sha256": "775971a60db57f7334f68b0916a27760e28f02c62f2c653e963237925a1c2711"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-apps",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/primary-source-provenance.json",
|
||||
"sha256": "c3d5ce5c6a5e89f19be5e293034c8d633183d19666fc61d837537527246d9a42"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-apps",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/validation.json",
|
||||
"sha256": "95318f54942871a125a5200ec05d6f9dc80077918f26ebe671b9ab4d150b112d"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/CCR-2026-0042-proposed-body.yaml",
|
||||
"sha256": "6544600c63a86559ba053240c476d493f4d2f25c9cd22cf6a9a05f09ee617a86"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/reader-role.json",
|
||||
"sha256": "976b19e0780b6056ed54bf5e8f27a0eb786af65817d9ec00ca161ac46e7d72e7"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/workload-kv-read-keycape-forgejo-forgejo.hcl",
|
||||
"sha256": "af3a638605c1f6dff7879771fede4c56a6b9a7e430d4b5b58c370063b2c888ca"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/case-1.2.yaml",
|
||||
"sha256": "1c868c1da7d9077fae97bc6bc029706ec3dc418cfeaae30dc0f92b5b4ba6f2ab"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/render-1.2.json",
|
||||
"sha256": "96b25108335e2cf5f96af481fe8a7735831c8320d81b50f7c6e6d4e53d0c0f02"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/review-boundary.md",
|
||||
"sha256": "21c8d666a46490f829cfb9c043ea168ad1c02873dc6baf7e50173188e0c99ea9"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/type-1.2.yaml",
|
||||
"sha256": "017885bdd139cd66a5bf6d9839b1b8ec9bc08fb051d9577adc3928b76a7be6db"
|
||||
},
|
||||
{
|
||||
"repo": "ops-mason",
|
||||
"path": "docs/forgejo-consumer-eso-builder-review.md",
|
||||
"sha256": "27d20e4d6915a8d16d65e4fcdf20cd565b2742d6bc2a0999a8ec21522fb0a590"
|
||||
},
|
||||
{
|
||||
"repo": "ops-mason",
|
||||
"path": "docs/forgejo-consumer-generated-ccr-refinement.json",
|
||||
"sha256": "29aabe3e5d1f9c3c55a1d0c2580da89a97e707600358232f4c0bd79f02c8442e"
|
||||
},
|
||||
{
|
||||
"repo": "ops-mason",
|
||||
"path": "src/ops_mason/case_build.py",
|
||||
"sha256": "c2b140f380407779ce5478ca57c97eb0e6375d6a9cad4591b0b29ddd177db686"
|
||||
},
|
||||
{
|
||||
"repo": "ops-mason",
|
||||
"path": "tests/test_case_build.py",
|
||||
"sha256": "aea22297178b5bb1eaaf5d59bbd1c71112dfc32bed2075b33ccc0598c8fc5be5"
|
||||
},
|
||||
{
|
||||
"repo": "ops-mason",
|
||||
"path": "tests/test_case_structure.py",
|
||||
"sha256": "2e7446eaf01d4bb59d7d8fb3c3cdc5e6e3007b3ae84d8ed0a49f11f745f2e386"
|
||||
}
|
||||
],
|
||||
"owner_commits": [
|
||||
{
|
||||
"repo": "ops-mason",
|
||||
"reviewed_source_commit": "a41312e5a4a099eb1f5b77fcf80abb033f82a45e",
|
||||
"observed_head": "6196be5dca9cfd16df829df93aef9ec42383af1b"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"reviewed_source_commit": "5b9c8262bedbbd9bf4348842e13aa668889ca745",
|
||||
"observed_head": "5b9c8262bedbbd9bf4348842e13aa668889ca745"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-apps",
|
||||
"reviewed_source_commit": "367f01cb4b5859ce0b4598a1ab652904b83f7f84",
|
||||
"observed_head": "367f01cb4b5859ce0b4598a1ab652904b83f7f84"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"reviewed_source_commit": "c26b018328caaf6734dbce9605709a40359f4f2c",
|
||||
"observed_head": "c26b018328caaf6734dbce9605709a40359f4f2c"
|
||||
}
|
||||
],
|
||||
"attachments_from_actual_owners": [
|
||||
{
|
||||
"name": "type-1.2.yaml",
|
||||
"owner_path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-consumer-eso/type-1.2.yaml",
|
||||
"sha256": "017885bdd139cd66a5bf6d9839b1b8ec9bc08fb051d9577adc3928b76a7be6db"
|
||||
},
|
||||
{
|
||||
"name": "case-1.2.yaml",
|
||||
"owner_path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-consumer-eso/case-1.2.yaml",
|
||||
"sha256": "1c868c1da7d9077fae97bc6bc029706ec3dc418cfeaae30dc0f92b5b4ba6f2ab"
|
||||
},
|
||||
{
|
||||
"name": "render-1.2.json",
|
||||
"owner_path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-consumer-eso/render-1.2.json",
|
||||
"sha256": "96b25108335e2cf5f96af481fe8a7735831c8320d81b50f7c6e6d4e53d0c0f02"
|
||||
},
|
||||
{
|
||||
"name": "current-type-1.1.yaml",
|
||||
"owner_path": "/home/worsch/net-kingdom/security-case-types/oidc-browser-relying-party/type.yaml",
|
||||
"sha256": "f705c64e4875e9b8e18a912fb51c135e77898926d6a451f5cb74ab3c0cbe4d1c"
|
||||
},
|
||||
{
|
||||
"name": "current-case-1.1.yaml",
|
||||
"owner_path": "/home/worsch/net-kingdom/security-cases/forgejo-netkingdom-oidc.yaml",
|
||||
"sha256": "bcc2c6d5bae0d28242b3cdb71e74d8ca297c2afe04766b55d53597f86893351d"
|
||||
},
|
||||
{
|
||||
"name": "consumer-delivery.yaml",
|
||||
"owner_path": "/home/worsch/railiance-apps/docs/proposals/2026-10-11-forgejo-consumer-eso/consumer-delivery.yaml",
|
||||
"sha256": "56478a83d799c08dc1e5159983b1e843a46b16dfeee7e84c31401d1f92430df2"
|
||||
},
|
||||
{
|
||||
"name": "CCR-0042-proposed-body.yaml",
|
||||
"owner_path": "/home/worsch/railiance-platform/docs/proposals/2026-10-11-forgejo-consumer-eso/CCR-2026-0042-proposed-body.yaml",
|
||||
"sha256": "6544600c63a86559ba053240c476d493f4d2f25c9cd22cf6a9a05f09ee617a86"
|
||||
},
|
||||
{
|
||||
"name": "reader-role.json",
|
||||
"owner_path": "/home/worsch/railiance-platform/docs/proposals/2026-10-11-forgejo-consumer-eso/reader-role.json",
|
||||
"sha256": "976b19e0780b6056ed54bf5e8f27a0eb786af65817d9ec00ca161ac46e7d72e7"
|
||||
},
|
||||
{
|
||||
"name": "reader-policy.hcl",
|
||||
"owner_path": "/home/worsch/railiance-platform/docs/proposals/2026-10-11-forgejo-consumer-eso/workload-kv-read-keycape-forgejo-forgejo.hcl",
|
||||
"sha256": "af3a638605c1f6dff7879771fede4c56a6b9a7e430d4b5b58c370063b2c888ca"
|
||||
},
|
||||
{
|
||||
"name": "owner-design.md",
|
||||
"owner_path": "/home/worsch/railiance-apps/docs/proposals/2026-10-11-forgejo-consumer-eso/owner-design.md",
|
||||
"sha256": "c523949454e4c6eb58e8caee382380a561f561704136de62bf5783c592f962f2"
|
||||
},
|
||||
{
|
||||
"name": "retained-native-metadata.json",
|
||||
"owner_path": "/home/worsch/railiance-apps/docs/proposals/2026-10-11-forgejo-consumer-eso/native-metadata.json",
|
||||
"sha256": "4e2993f5920215f41e4a235743023f22b78b8f597d3d70ed279991b2fc3204b5"
|
||||
},
|
||||
{
|
||||
"name": "mason-final-review.json",
|
||||
"owner_path": "/home/worsch/ops-mason/docs/evidence/2026-10-11-forgejo-consumer-eso-independent-mason-review-refined.json",
|
||||
"sha256": "28541874fb437a06a8f1749bc50c88f6fee3d7c100c2f3ee0c52b59afaf8e102"
|
||||
},
|
||||
{
|
||||
"name": "platform-final-review.json",
|
||||
"owner_path": "/home/worsch/railiance-platform/docs/evidence/2026-10-11-forgejo-consumer-eso-owner-review/final-review.json",
|
||||
"sha256": "72854a798e01c6d65a16770efb1329d211fe3c59a3f4ad3190d6972f5c886f6e"
|
||||
},
|
||||
{
|
||||
"name": "netkingdom-review-bundle.json",
|
||||
"owner_path": "/home/worsch/net-kingdom/docs/reviews/2026-10-11-forgejo-consumer-eso-net-owner-final-review.md",
|
||||
"sha256": "e21aeed24b6bb092ddbba12957a7c06861240655f977e7023d5475ca7a3f569f",
|
||||
"review_bundle_entry": 0
|
||||
},
|
||||
{
|
||||
"name": "netkingdom-review-sources-bundle.json",
|
||||
"owner_path": "/home/worsch/net-kingdom/docs/reviews/2026-10-11-forgejo-consumer-eso-net-owner-final-review.sources.json",
|
||||
"sha256": "2a3862d47a95b0fd21329292723d39fce61279d779f51b629b517b5ed130f577",
|
||||
"review_bundle_entry": 0
|
||||
},
|
||||
{
|
||||
"name": "validation-and-history.json",
|
||||
"owner_path": "/home/worsch/railiance-apps/docs/proposals/2026-10-11-forgejo-consumer-eso/validation.json",
|
||||
"sha256": "95318f54942871a125a5200ec05d6f9dc80077918f26ebe671b9ab4d150b112d",
|
||||
"wrapper_original_receipt_field": "original_owner_receipt_base64"
|
||||
},
|
||||
{
|
||||
"name": "netkingdom-review-bundle.json",
|
||||
"owner_path": "/tmp/netkingdom-forgejo-type12-final-packet-review-stage/net-kingdom/docs/reviews/2026-10-11-forgejo-type12-human-packet-net-owner-final-review.md",
|
||||
"sha256": "9e9b8dda889203c064b35e1bbcd4d0c62d76d4ba1935c9a10f4b2dbf1c6e8497",
|
||||
"review_bundle_entry": 1
|
||||
},
|
||||
{
|
||||
"name": "netkingdom-review-sources-bundle.json",
|
||||
"owner_path": "/tmp/netkingdom-forgejo-type12-final-packet-review-stage/net-kingdom/docs/reviews/2026-10-11-forgejo-type12-human-packet-net-owner-final-review.sources.json",
|
||||
"sha256": "00eee9833108f451d99b15fb1261e4ba3aebf8a047bdd0a01d8ea4f601e99073",
|
||||
"review_bundle_entry": 1
|
||||
}
|
||||
],
|
||||
"all19_applied_hashes_match": true,
|
||||
"no_owner_review_written_by_requester": true
|
||||
}
|
||||
|
|
@ -0,0 +1,442 @@
|
|||
apiVersion: netkingdom.io/security-case-type/v0.1
|
||||
kind: SecurityCaseType
|
||||
spec:
|
||||
id: oidc-browser-relying-party
|
||||
version: '1.2'
|
||||
status: proposed
|
||||
title: Browser OIDC relying party for an internal service
|
||||
purpose: 'Let an internal web service sign its human users in through NetKingdom
|
||||
(KeyCape): an exact-redirect OIDC client, optional MFA pin, the LLDAP groups the
|
||||
service maps to its own roles, and, for confidential clients, a client secret
|
||||
minted straight into OpenBao custody. Replaces the per-client rollout scripts
|
||||
in sso-mfa/k8s/keycape. First case: Forgejo (KEY-WP-0038).'
|
||||
parameters:
|
||||
- name: client_id
|
||||
type: string
|
||||
case_settable: true
|
||||
constraints:
|
||||
pattern: ^[a-z0-9][a-z0-9-]{1,62}$
|
||||
sensitivity: operational
|
||||
description: OAuth2 client_id, unique in KeyCape.
|
||||
- name: display_name
|
||||
type: string
|
||||
case_settable: true
|
||||
constraints:
|
||||
pattern: ^[^\n\r]{1,80}$
|
||||
sensitivity: public
|
||||
description: Name shown on the sign-in page.
|
||||
- name: redirect_uris
|
||||
type: string
|
||||
case_settable: true
|
||||
constraints:
|
||||
pattern: ^https://[^*?#\s,]+(,https://[^*?#\s,]+)*$
|
||||
sensitivity: security_sensitive
|
||||
description: 'Comma-separated exact https redirect URIs. No wildcards, no plain
|
||||
http, no query and no fragment: KeyCape refuses ''*'' and ''?'' at startup,
|
||||
and OAuth 2.0 forbids fragments (key-cape type review R1).'
|
||||
- name: allowed_scopes
|
||||
type: string
|
||||
case_settable: true
|
||||
constraints:
|
||||
enum:
|
||||
- openid,profile,email,groups
|
||||
- openid,email,groups
|
||||
- openid,profile,groups
|
||||
- openid,groups
|
||||
sensitivity: security_sensitive
|
||||
description: Scopes the client may request, openid first. Always includes groups,
|
||||
because access_groups is required and KeyCape's UserInfo returns groups only
|
||||
for that scope (key-cape type review R2).
|
||||
- name: client_type
|
||||
type: string
|
||||
case_settable: true
|
||||
constraints:
|
||||
enum:
|
||||
- confidential
|
||||
- public
|
||||
sensitivity: security_sensitive
|
||||
description: confidential for server-side services that can hold a secret; public
|
||||
for SPAs and native apps (PKCE only).
|
||||
- name: mfa_required
|
||||
type: string
|
||||
case_settable: true
|
||||
constraints:
|
||||
enum:
|
||||
- 'true'
|
||||
- 'false'
|
||||
sensitivity: security_sensitive
|
||||
description: '"true" pins MFA on this client; required when the service grants
|
||||
administrative or owner rights. "false" is not "no MFA": the client then carries
|
||||
no mfaRequired field and KeyCape applies the per-user privacyIDEA policy. A
|
||||
renderer must never emit an explicit mfaRequired false, which would skip that
|
||||
policy (key-cape type review R3).'
|
||||
- name: access_groups
|
||||
type: string
|
||||
case_settable: true
|
||||
constraints:
|
||||
pattern: ^[a-z][a-z0-9-]{1,62}(,[a-z][a-z0-9-]{1,62})*$
|
||||
sensitivity: operational
|
||||
description: 'Comma-separated LLDAP groups that the service maps to its roles.
|
||||
Created if absent. KeyCape has no per-client group gate: it issues tokens to
|
||||
any authenticated user and only carries the groups claim, so the consuming service
|
||||
enforces the gate itself (for Forgejo, its required-claim setting; key-cape
|
||||
type review R2).'
|
||||
- name: initial_members
|
||||
type: string
|
||||
required: false
|
||||
case_settable: true
|
||||
constraints:
|
||||
pattern: ^[a-z][a-z0-9-]*=[a-z][a-z0-9._-]*(\+[a-z][a-z0-9._-]*)*(;[a-z][a-z0-9-]*=[a-z][a-z0-9._-]*(\+[a-z][a-z0-9._-]*)*)*$
|
||||
sensitivity: operational
|
||||
description: Initial memberships as group=user+user;group=user. Usernames are
|
||||
directory usernames, never secrets.
|
||||
- name: consuming_service
|
||||
type: string
|
||||
case_settable: true
|
||||
constraints:
|
||||
pattern: ^[a-z0-9][a-z0-9-]{0,62}$
|
||||
sensitivity: operational
|
||||
description: The service that signs users in with this client.
|
||||
- name: consumer_owner_repo
|
||||
type: string
|
||||
case_settable: true
|
||||
constraints:
|
||||
pattern: ^[a-z0-9][a-z0-9-]*$
|
||||
sensitivity: operational
|
||||
description: The repository that owns the consuming service's configuration.
|
||||
- name: consumer_namespace
|
||||
type: string
|
||||
case_settable: true
|
||||
constraints:
|
||||
pattern: ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$
|
||||
sensitivity: security_sensitive
|
||||
description: Consumer namespace for namespaced ESO TokenRequest reader; actual
|
||||
workload owner must confirm; never infer from service name.
|
||||
- name: issuer
|
||||
type: string
|
||||
case_settable: false
|
||||
default: https://kc.coulomb.social
|
||||
sensitivity: security_sensitive
|
||||
description: The NetKingdom issuer; fixed by the type.
|
||||
composition:
|
||||
authority: netkingdom
|
||||
initial_trust:
|
||||
- runtime_secret_trust
|
||||
- runtime_identity_trust
|
||||
capabilities:
|
||||
- c1.lightweight-sso
|
||||
providers:
|
||||
c1.lightweight-sso: net-kingdom.keycape-client-registration
|
||||
parameter_bindings:
|
||||
net-kingdom.keycape-client-registration.client_id: client_id
|
||||
net-kingdom.keycape-client-registration.display_name: display_name
|
||||
net-kingdom.keycape-client-registration.redirect_uris: redirect_uris
|
||||
net-kingdom.keycape-client-registration.allowed_scopes: allowed_scopes
|
||||
net-kingdom.keycape-client-registration.client_type: client_type
|
||||
net-kingdom.keycape-client-registration.mfa_required: mfa_required
|
||||
materialization:
|
||||
- id: client-secret-path
|
||||
kind: kv_path
|
||||
when: client_type == confidential
|
||||
template: platform/workloads/keycape/{client_id}
|
||||
body: field CLIENT_SECRET; minted by the credential broker, never written by hand
|
||||
- id: keycape-reader-policy
|
||||
kind: openbao_policy
|
||||
when: client_type == confidential
|
||||
template: workload-kv-read-keycape-{client_id}-eso
|
||||
body: "path \"platform/data/workloads/keycape/{client_id}\" {{\n capabilities\
|
||||
\ = [\"read\"]\n}}\n"
|
||||
description: KeyCape reads its client secret only through ESO. No metadata, list,
|
||||
parent or sibling access.
|
||||
- id: consumer-reader-policy
|
||||
kind: openbao_policy
|
||||
when: client_type == confidential
|
||||
template: workload-kv-read-keycape-{client_id}-{consuming_service}
|
||||
body: "path \"platform/data/workloads/keycape/{client_id}\" {{\n capabilities\
|
||||
\ = [\"read\"]\n}}\n"
|
||||
description: The consuming service reads the same secret. No metadata, list, parent
|
||||
or sibling access.
|
||||
- id: eso-role
|
||||
kind: openbao_role
|
||||
when: client_type == confidential
|
||||
template: external-secrets-keycape-{client_id}
|
||||
body: 'auth: kubernetes
|
||||
|
||||
bound_service_account_names: [external-secrets]
|
||||
|
||||
bound_service_account_namespaces: [external-secrets]
|
||||
|
||||
token_policies: [workload-kv-read-keycape-{client_id}-eso]
|
||||
|
||||
token_no_default_policy: true
|
||||
|
||||
token_ttl: 15m
|
||||
|
||||
token_max_ttl: 15m
|
||||
|
||||
'
|
||||
description: The Kubernetes-auth role deliver-secret uses; bound to the ESO service
|
||||
account only.
|
||||
- id: consumer-eso-role
|
||||
kind: openbao_role
|
||||
when: client_type == confidential
|
||||
template: external-secrets-keycape-{client_id}-{consuming_service}
|
||||
body: 'auth: kubernetes
|
||||
|
||||
bound_service_account_names: [{consuming_service}-keycape-{client_id}-eso]
|
||||
|
||||
bound_service_account_namespaces: [{consumer_namespace}]
|
||||
|
||||
audience: openbao
|
||||
|
||||
token_policies: [workload-kv-read-keycape-{client_id}-{consuming_service}]
|
||||
|
||||
token_no_default_policy: true
|
||||
|
||||
token_ttl: 15m
|
||||
|
||||
token_max_ttl: 15m
|
||||
|
||||
'
|
||||
description: Consumer ESO requests a token for this separate reference identity.
|
||||
Common ESO controller remains trusted and can request tokens; no cryptographic
|
||||
controller isolation is claimed.
|
||||
- id: catalog-entry
|
||||
kind: catalog_entry
|
||||
template: '{consuming_service}-keycape-client'
|
||||
body: 'id: {consuming_service}-keycape-client
|
||||
|
||||
owner_repo: key-cape
|
||||
|
||||
warden_executes: false
|
||||
|
||||
risk: high
|
||||
|
||||
status: active once verification passes
|
||||
|
||||
workload_ref: applicable, name {consuming_service}, declaration_ref of the consumer''s
|
||||
published declaration or the explicit unknown form, never inferred
|
||||
|
||||
path_template: platform/workloads/keycape/{client_id}
|
||||
|
||||
field: CLIENT_SECRET
|
||||
|
||||
delegation: native, intended_owner key-cape
|
||||
|
||||
rotation: mint-secret then verification; automatable false until a run has been
|
||||
proven
|
||||
|
||||
'
|
||||
description: One entry per case (ops-mason item 5, ops-warden R4'). It carries
|
||||
the consumer's workload reference, which ADR-0009 needs for zone selection.
|
||||
follow_through:
|
||||
- id: ensure-groups
|
||||
owner: net-kingdom
|
||||
entry_point: identity-provisioner ensure_service_groups, run inside the provisioner
|
||||
pod through the session's contained cluster access (groups {access_groups};
|
||||
members exactly {initial_members} as recorded in the accepted case, nothing
|
||||
else)
|
||||
auth: operator cluster access in the attended register-client session; the in-pod
|
||||
call uses the provisioner's own directory binding, and no provisioner or user-engine
|
||||
token is read or sent
|
||||
lane: key-cape-oidc-login
|
||||
warden_executes: false
|
||||
attended: true
|
||||
value_handling: none
|
||||
attended_justification: The provisioner's only HTTP credential is user-engine's
|
||||
runtime token, and its NetworkPolicy admits only user-engine pods. A proxy lane
|
||||
would act as user-engine (ops-warden review R8; canon section 3; ops-warden
|
||||
ADR-0002). Running it in the session register-client already needs adds no attended
|
||||
session. It can become unattended once the provisioner has an operator credential
|
||||
of its own and an admitted path.
|
||||
- id: mint-secret
|
||||
owner: railiance-platform
|
||||
when: client_type == confidential
|
||||
entry_point: 'railiance-platform credential broker: generate a client secret inside
|
||||
custody at bao:platform/workloads/keycape/{client_id}'
|
||||
auth: the caller's broker grant for the case's KV path, through its lane; the
|
||||
value is generated in custody and never returned
|
||||
lane: keycape-client-secret-generate
|
||||
warden_executes: true
|
||||
attended: false
|
||||
value_handling: generated_in_custody
|
||||
- id: deliver-secret
|
||||
owner: railiance-platform
|
||||
when: client_type == confidential
|
||||
entry_point: ExternalSecret sso/keycape-{client_id}-client (key client-secret)
|
||||
from bao:platform/workloads/keycape/{client_id}
|
||||
auth: railiance-platform ESO delivery through role external-secrets-keycape-{client_id};
|
||||
no value leaves custody
|
||||
warden_executes: false
|
||||
attended: false
|
||||
value_handling: none
|
||||
ready_check: the delivery for sso/keycape-{client_id}-client reports Ready=True
|
||||
(status only, no value read)
|
||||
- id: bind-env
|
||||
owner: net-kingdom
|
||||
when: client_type == confidential
|
||||
entry_point: 'patch Deployment sso/keycape: env KEYCAPE_{client_id:env}_CLIENT_SECRET
|
||||
from sso/keycape-{client_id}-client'
|
||||
auth: operator kube credentials for namespace sso
|
||||
lane: key-cape-oidc-login
|
||||
warden_executes: false
|
||||
attended: true
|
||||
value_handling: none
|
||||
attended_justification: A change to the live identity provider's Deployment. It
|
||||
runs in the same attended operator session as register-client, before it, because
|
||||
KeyCape resolves a confidential client's secret at start and fails closed if
|
||||
the binding is missing.
|
||||
- id: register-client
|
||||
owner: net-kingdom
|
||||
entry_point: sso-mfa/k8s/keycape/keycape-client.py apply --client-file <client-from-case>
|
||||
--case-acceptance <record> --check-config <keycape binary> (net-kingdom.keycape-client-registration)
|
||||
auth: operator write access to the live KeyCape client registry in namespace sso
|
||||
lane: key-cape-oidc-login
|
||||
warden_executes: false
|
||||
attended: true
|
||||
value_handling: none
|
||||
attended_justification: 'The live KeyCape client registry is a Kubernetes Secret,
|
||||
and agents do not read or write Secrets. Until KeyCape loads clients from a
|
||||
non-secret registry with secrets referenced from custody, one attended operator
|
||||
session applies the rendered registration. ops-warden groups all attended steps
|
||||
of a run into that one session. KeyCape loads clients at startup and keeps login,
|
||||
authorization and handoff state in memory, so the restart drops in-flight logins
|
||||
and sessions for every client; runs go in a quiet window (key-cape type review
|
||||
R4). The rendered registry must pass KeyCape''s own startup checks (keycape
|
||||
check-config, key-cape c528daa, which keycape-client.py runs before it patches)
|
||||
before the restart: a refused entry stops the single replica and every client
|
||||
loses sign-in (R1).'
|
||||
- id: deliver-consumer-secret
|
||||
owner: '{consumer_owner_repo}'
|
||||
when: client_type == confidential
|
||||
entry_point: Owner applies dedicated ServiceAccount {consumer_namespace}/{consuming_service}-keycape-{client_id}-eso
|
||||
(automount=false, no legacy tokens), namespace SecretStore openbao-keycape-{client_id}-consumer
|
||||
with serviceAccountRef and audiences [openbao], and ExternalSecret {consuming_service}-netkingdom-oidc-client
|
||||
with Owner target, Retain remote deletion and only CLIENT_SECRET from workloads/keycape/{client_id}.
|
||||
Admission validates actual installed ESO TokenRequest support and common controller
|
||||
RBAC before any owner-approved apply.
|
||||
auth: Consumer owner contained Kubernetes deployment authority; ESO authenticates
|
||||
to OpenBao role external-secrets-keycape-{client_id}-{consuming_service} with
|
||||
a TokenRequest for the dedicated namespaced serviceAccountRef; controller remains
|
||||
trusted
|
||||
warden_executes: false
|
||||
attended: false
|
||||
value_handling: none
|
||||
ready_check: Namespace SecretStore and ExternalSecret both report Ready=True;
|
||||
dedicated SA has no legacy token refs; status and fixed metadata only, never
|
||||
Secret values.
|
||||
- id: hand-over
|
||||
owner: '{consumer_owner_repo}'
|
||||
entry_point: configure {consuming_service} with issuer {issuer}, client {client_id}
|
||||
and custody bao:platform/workloads/keycape/{client_id}, and make it require
|
||||
one of {access_groups} in the groups claim before sign-in completes
|
||||
auth: the consumer owner's own deployment path
|
||||
warden_executes: false
|
||||
attended: false
|
||||
value_handling: none
|
||||
verification:
|
||||
- id: authorize-accepts-redirects
|
||||
check: GET {issuer}/authorize with client {client_id} and each of {redirect_uris}
|
||||
returns the login page
|
||||
expect: present
|
||||
reads_secret_value: false
|
||||
- id: authorize-refuses-other-redirect
|
||||
check: GET {issuer}/authorize with client {client_id} and an unregistered redirect
|
||||
returns an OAuth error
|
||||
expect: deny
|
||||
reads_secret_value: false
|
||||
- id: custody-denied-to-default
|
||||
when: client_type == confidential
|
||||
check: a default-only OpenBao identity has no read capability on bao:platform/workloads/keycape/{client_id}
|
||||
expect: deny
|
||||
reads_secret_value: false
|
||||
- id: custody-allowed-to-consumer
|
||||
when: client_type == confidential
|
||||
check: policy workload-kv-read-keycape-{client_id}-{consuming_service} grants
|
||||
read on bao:platform/workloads/keycape/{client_id} (capabilities check only)
|
||||
expect: allow
|
||||
reads_secret_value: false
|
||||
- id: groups-present
|
||||
check: LLDAP groups {access_groups} exist, with exactly the memberships of the
|
||||
accepted case added
|
||||
expect: present
|
||||
reads_secret_value: false
|
||||
- id: consumer-enforces-groups
|
||||
check: '{consuming_service}''s OIDC source for {client_id} (owner {consumer_owner_repo})
|
||||
requires one of {access_groups} in the groups claim (configuration read, no
|
||||
secret value)'
|
||||
expect: present
|
||||
reads_secret_value: false
|
||||
- id: secret-delivered
|
||||
when: client_type == confidential
|
||||
check: the delivery for sso/keycape-{client_id}-client reports Ready=True (status
|
||||
only)
|
||||
expect: present
|
||||
reads_secret_value: false
|
||||
- id: mfa-pinned
|
||||
when: mfa_required == true
|
||||
check: keycape-client.py inspect for {client_id} shows the MFA pin on the registered
|
||||
client (non-secret client view)
|
||||
expect: present
|
||||
reads_secret_value: false
|
||||
- id: consumer-secret-delivered
|
||||
when: client_type == confidential
|
||||
check: '{consumer_namespace} SecretStore openbao-keycape-{client_id}-consumer
|
||||
and ExternalSecret {consuming_service}-netkingdom-oidc-client Ready=True, exact
|
||||
dedicated SA/audience role binding, fixed CLIENT_SECRET mapping; no Secret value
|
||||
read'
|
||||
expect: present
|
||||
reads_secret_value: false
|
||||
rollback:
|
||||
- reverses: hand-over
|
||||
action: remove the OIDC source for {client_id} from {consuming_service} (owner
|
||||
{consumer_owner_repo})
|
||||
- reverses: deliver-consumer-secret
|
||||
when: client_type == confidential
|
||||
action: After reverting consumer secret reference, delete only authenticated created
|
||||
ExternalSecret/owned target by UID and ownerReference, then SecretStore and
|
||||
dedicated SA; preserve preexisting-matched resources and never delete a shared
|
||||
target. Retain audit and ownership receipts; removing SecretStore/SA alone is
|
||||
not immediate OpenBao token revocation.
|
||||
- reverses: register-client
|
||||
action: keycape-client.py apply --operation remove for {client_id}
|
||||
- reverses: bind-env
|
||||
when: client_type == confidential
|
||||
action: remove env KEYCAPE_{client_id:env}_CLIENT_SECRET from Deployment sso/keycape,
|
||||
after register-client is reversed
|
||||
- reverses: deliver-secret
|
||||
when: client_type == confidential
|
||||
action: delete ExternalSecret sso/keycape-{client_id}-client and its target
|
||||
- reverses: mint-secret
|
||||
when: client_type == confidential
|
||||
action: 'covered by client-secret-path: one metadata delete, after deliver-secret
|
||||
is reversed'
|
||||
- reverses: ensure-groups
|
||||
action: identity-provisioner revoke_service_groups inside the provisioner pod
|
||||
(attended, as ensure-groups) with the case's memberships; delete_if_empty only
|
||||
if no other case uses {access_groups}
|
||||
- reverses: client-secret-path
|
||||
when: client_type == confidential
|
||||
action: delete metadata and all versions at platform/workloads/keycape/{client_id},
|
||||
after the ExternalSecret is gone (this also reverses mint-secret)
|
||||
- reverses: eso-role
|
||||
when: client_type == confidential
|
||||
action: delete Kubernetes-auth role external-secrets-keycape-{client_id}
|
||||
- reverses: keycape-reader-policy
|
||||
when: client_type == confidential
|
||||
action: delete policy workload-kv-read-keycape-{client_id}-eso, after eso-role
|
||||
- reverses: consumer-eso-role
|
||||
when: client_type == confidential
|
||||
action: Delete only this case-created role external-secrets-keycape-{client_id}-{consuming_service},
|
||||
before deleting consumer-reader-policy; revoke case-issued OpenBao tokens or
|
||||
prove expiration before declaring deactivation.
|
||||
- reverses: consumer-reader-policy
|
||||
when: client_type == confidential
|
||||
action: delete policy workload-kv-read-keycape-{client_id}-{consuming_service}
|
||||
- reverses: catalog-entry
|
||||
action: remove catalog entry {consuming_service}-keycape-client
|
||||
acceptance:
|
||||
accepted_by:
|
||||
- owner
|
||||
- founder
|
||||
risk_class: medium
|
||||
File diff suppressed because one or more lines are too long
|
|
@ -0,0 +1,27 @@
|
|||
{
|
||||
"actual_runnable_package_tests_passed": 22,
|
||||
"all_owner_attachments_unchanged": true,
|
||||
"bound19_applied_source_hashes_match": true,
|
||||
"canonical_case_acceptance_authorized": false,
|
||||
"canonical_case_after_ack": "proposed",
|
||||
"complete_proposed_package_validation_passed": true,
|
||||
"document_hashes_valid": 20,
|
||||
"execution_permitted": false,
|
||||
"founder_disposition_recorded": false,
|
||||
"full_intake_and_schema_valid": true,
|
||||
"negative_intake_guards": [
|
||||
"packet-content-tamper",
|
||||
"boolean-memo-version",
|
||||
"approval-prebound"
|
||||
],
|
||||
"offline_only": true,
|
||||
"offline_submitter_shape_assumption_is_native_admission": false,
|
||||
"register_payload_bytes": 241076,
|
||||
"separate_package_owner_review_recorded": true,
|
||||
"submission_digest": "sha256:585cee731de30d2b37883a57abfd9eb32f023ee694e8d911989109d5caf80569",
|
||||
"type_case_valid_and_source_render_identical": true,
|
||||
"typed_lifecycle_memo_valid": true,
|
||||
"preparation_deterministic": true,
|
||||
"historical_original_packet_sha256": "eeb2968ec317d0bc072788011918025a21d2b48c13987d09945ae8761f3d8fe5",
|
||||
"prepackage_revision_sha256": "12ce4d2d2a185a79ce102ff8f5669512dd6e8e5f99321a6e2688dab23ba42ef8"
|
||||
}
|
||||
|
|
@ -0,0 +1,75 @@
|
|||
{
|
||||
"reviewer": "net-kingdom-owner (agent net-kingdom, codex)",
|
||||
"decision": "approved",
|
||||
"work_item": "NK-WP-ADHOC-2026-10-11-T06",
|
||||
"scope": "same-trial-final-packet-rebinding-source-only",
|
||||
"comment": "NetKingdom INTENT Taxonomy/identity-contract and Meta-Orchestration basis: exact final34 manifest0b377d647ca748cd03c92f9792396412048055d4bde9f7bb06ff6d413f7acd68 preserves reviewed19 architecture and completed proposed package semantics while binding genuine separate source-owner receipts losslessly. Own completedT06 must be retained before original conditional, refined approval and this finalhashack; no T07/newtrial. This is technical agreement on source-only human posting readiness, not founder acknowledgment, canonicalcase acceptance or native authority.",
|
||||
"exact_final_manifest_sha256": "0b377d647ca748cd03c92f9792396412048055d4bde9f7bb06ff6d413f7acd68",
|
||||
"stable_proposal_id": "NK-FORGEJO-TYPE12-SOURCE-20261011-R1",
|
||||
"memo_id": "infd-20261011-forgejo-type12-source-r1",
|
||||
"memo_version": 1,
|
||||
"submission_digest": "sha256:585cee731de30d2b37883a57abfd9eb32f023ee694e8d911989109d5caf80569",
|
||||
"prior_completed_packet_sha256": "330da7fe129b0443e41fff44b3c2d829b0d682698fdbba9fe60011d46ed5c48c",
|
||||
"prior_conditional_packet_sha256": "eeb2968ec317d0bc072788011918025a21d2b48c13987d09945ae8761f3d8fe5",
|
||||
"bundled_receipts": [
|
||||
{
|
||||
"label": "original_exact19_source_review",
|
||||
"source_path": "/home/worsch/net-kingdom/docs/reviews/2026-10-11-forgejo-consumer-eso-net-owner-final-review.md",
|
||||
"sha256": "e21aeed24b6bb092ddbba12957a7c06861240655f977e7023d5475ca7a3f569f"
|
||||
},
|
||||
{
|
||||
"label": "actual_completed_package_peer_review",
|
||||
"source_path": "/tmp/netkingdom-forgejo-type12-final-packet-review-stage/net-kingdom/docs/reviews/2026-10-11-forgejo-type12-human-packet-net-owner-final-review.md",
|
||||
"sha256": "9e9b8dda889203c064b35e1bbcd4d0c62d76d4ba1935c9a10f4b2dbf1c6e8497"
|
||||
},
|
||||
{
|
||||
"label": "original_exact19_source_review",
|
||||
"source_path": "/home/worsch/net-kingdom/docs/reviews/2026-10-11-forgejo-consumer-eso-net-owner-final-review.sources.json",
|
||||
"sha256": "2a3862d47a95b0fd21329292723d39fce61279d779f51b629b517b5ed130f577"
|
||||
},
|
||||
{
|
||||
"label": "actual_completed_package_peer_review",
|
||||
"source_path": "/tmp/netkingdom-forgejo-type12-final-packet-review-stage/net-kingdom/docs/reviews/2026-10-11-forgejo-type12-human-packet-net-owner-final-review.sources.json",
|
||||
"sha256": "00eee9833108f451d99b15fb1261e4ba3aebf8a047bdd0a01d8ea4f601e99073"
|
||||
}
|
||||
],
|
||||
"checks": {
|
||||
"all34_manifest_hashes_verified": true,
|
||||
"all_four_decompressed_bundle_receipts_equal_actual_review_source_bytes": true,
|
||||
"package_type_examples_and_tests_unchanged_from330": true,
|
||||
"readme_only_workload_defaultSA_meaning_clarified_not_historical_OpenBao_binding": true,
|
||||
"full_package_validator_and22_source_tests_pass": true,
|
||||
"all20_bound_documents_and_typed_intake_pass": true,
|
||||
"all19_applied_source_pins_and_owner_attachments_match": true,
|
||||
"three_intake_negative_guards_refused": true,
|
||||
"register_payload_bytes": 241076,
|
||||
"canonical_case_after_type_ack": "proposed",
|
||||
"canonical_acceptance_fields_authorized": false,
|
||||
"normal_admission_for_acknowledged_type_still_refused": true,
|
||||
"execution_permitted": false,
|
||||
"claims_confirmed": false
|
||||
},
|
||||
"limits": {
|
||||
"actual_founder_acknowledgment": false,
|
||||
"native_submission_performed": false,
|
||||
"grant_or_session": false,
|
||||
"type_implemented": false,
|
||||
"canonical_case_accepted": false,
|
||||
"materialization_or_delivery": false
|
||||
},
|
||||
"changed_hashed_packet_paths_from330": [
|
||||
"docs/proposals/2026-10-11-forgejo-consumer-eso/package-1.2/README.md",
|
||||
"docs/proposals/2026-10-11-forgejo-consumer-eso/package-1.2/validation.json",
|
||||
"docs/proposals/2026-10-11-forgejo-type12-acknowledgment/decision-packet.md",
|
||||
"docs/proposals/2026-10-11-forgejo-type12-acknowledgment/intake.json",
|
||||
"docs/proposals/2026-10-11-forgejo-type12-acknowledgment/lifecycle-commands.json",
|
||||
"docs/proposals/2026-10-11-forgejo-type12-acknowledgment/memo.json",
|
||||
"docs/proposals/2026-10-11-forgejo-type12-acknowledgment/proposal.json",
|
||||
"docs/proposals/2026-10-11-forgejo-type12-acknowledgment/recording-gates.md",
|
||||
"docs/proposals/2026-10-11-forgejo-type12-acknowledgment/source-inventory.json",
|
||||
"docs/proposals/2026-10-11-forgejo-type12-acknowledgment/validation-and-history.json",
|
||||
"docs/proposals/2026-10-11-forgejo-type12-acknowledgment/validation.json",
|
||||
"tools/prepare_forgejo_type12_acknowledgment.py",
|
||||
"tools/validate_forgejo_type12_acknowledgment.py"
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,96 @@
|
|||
---
|
||||
reviewer: net-kingdom-owner (agent net-kingdom, codex)
|
||||
decision: approved
|
||||
work_item: NK-WP-ADHOC-2026-10-11-T06
|
||||
reviewed_manifest_sha256: 330da7fe129b0443e41fff44b3c2d829b0d682698fdbba9fe60011d46ed5c48c
|
||||
scope: completed-proposed-package-and-source-only-human-packet-technical-review
|
||||
---
|
||||
|
||||
# NetKingdom refined package and acknowledgment packet review
|
||||
|
||||
Technical source agreement on exact32-path manifest
|
||||
330da7fe129b0443e41fff44b3c2d829b0d682698fdbba9fe60011d46ed5c48c, stable proposal
|
||||
NK-FORGEJO-TYPE12-SOURCE-20261011-R1, unposted memo
|
||||
infd-20261011-forgejo-type12-source-r1@1, submission
|
||||
sha256:2fd1c7ee3bad461d48347427802e8d130e01017f52634740bbc724fcf9e9bf60.
|
||||
This is the same established NetKingdom owner role and same T06 review trial.
|
||||
Retain completed own T06 first, then the original eeb changes-requested entry
|
||||
and this refined entry; earlier revisions/failures remain history. Original SHA
|
||||
protects the actual T05/applied source and any coordinator-managed hub metadata.
|
||||
|
||||
INTENT's Taxonomy declaration, identity contract and Meta-Orchestration goals
|
||||
support exact canonical lifecycle facts, usable source packages and independent
|
||||
owner execution. The final nineteen-file architecture, earlier three distinct
|
||||
technical reviews and type/case/render bytes are unchanged. No second owner role
|
||||
or founder disposition is supplied by this review.
|
||||
|
||||
## Independently checked complete package and packet
|
||||
|
||||
Verified all32 staged hashes. The completed proposed1.2 package contains the
|
||||
exact reviewed type.yaml, Forgejo proposed example, README threat model/alternatives/
|
||||
limits, a public example and runnable source tests. Actual full owner validate-type
|
||||
against that directory passes. Independently ran22 tests, including deterministic
|
||||
composition/nonexecution, six-object confidential/public boundaries, exact namespace/
|
||||
audience/role policy, refusal of malformed/unsettable parameters, normal proposed/
|
||||
acknowledged admission refusal, ordered created-only recovery and three negative
|
||||
full-package regressions removing README, tests or examples. These source checks
|
||||
contact no native services. The type and Forgejo package example match the reviewed19
|
||||
bytes exactly; no fake type/case acceptance is inserted into those sources.
|
||||
|
||||
README's retained shared/default consumer identity alternative is read as the
|
||||
observed Forgejo/runner workload ServiceAccount, not as an OpenBao reader binding.
|
||||
Historical1.1 consumer policy was unbound; no historical default-SA reader role is
|
||||
established. The exact proposed dedicated consumer identity/default-SA prohibition
|
||||
in the bound design and reviews remains controlling. The package offers no new
|
||||
controller isolation, legacy/static-token fallback or native revocation claim.
|
||||
|
||||
Offline actual intake/schema/typed decoder validates20 bound documents at233429
|
||||
register bytes; all19 applied sources and real owner attachments match. Packet
|
||||
tamper, boolean memo-version and prebound-approval trials are refused. These checks
|
||||
neither prove native submitter admission nor attest an actual human/session identity.
|
||||
The pending-human-session field is preparation only, not authenticated founder data.
|
||||
|
||||
## Corrected recording boundary and remaining genuine decision
|
||||
|
||||
Memo question/terms, proposal, decision packet and recording gates now require
|
||||
canonicalcase1.2 to remain proposed while the type is unimplemented, without
|
||||
acceptance fields or phase markers. Reference-migration design approval is a
|
||||
separate immutable NetKingdom/consumer design receipt only. This resolves the
|
||||
eeb review's exact recording objection rather than invoking schema or first-reference
|
||||
preparation flags as authority. The historical eeb packet and prepackage12ce
|
||||
missing-README/tests/examples failures are preserved. Completing the package does
|
||||
not acknowledge its type or accept a canonical case.
|
||||
|
||||
An isolated copy with only type status changed to acknowledged passes closed
|
||||
JSON schema; unchanged proposed case shape also passes. Normal semantic admission
|
||||
still refuses the acknowledged/unimplemented type. Preparation rendering after that
|
||||
isolated status change matches the exact retained c0afd full render, with execution
|
||||
false. This demonstrates permissible future source shape and source pin handling,
|
||||
not a fabricated human acknowledgment or native permission. Do not add unsupported
|
||||
type receipt/history keys: retain actual acknowledgment provenance in the owner
|
||||
history/receipt and schema-supported status fields, with fresh actual file hashes.
|
||||
|
||||
Only a new independently confirmed genuine founder disposition for this exact memo/
|
||||
version/packet can authorize recording the reviewed1.2 type acknowledgment, after
|
||||
this complete-package validation and genuine source-owner review are retained.
|
||||
Record actual roles/actor/time/stale state and exact binding/approval/disposition
|
||||
identities; preserve immutable1.1 type/package/case and proposed bytes first.
|
||||
The current1.1 snapshots still match their real canonical files byte-for-byte.
|
||||
Changed or stale sources/roles/outcomes require exact reconciliation; no old1.1
|
||||
approval, technical review or local JSON is that founder act. Declined/pending/stale
|
||||
outcomes remain honestly unacknowledged.
|
||||
|
||||
No implemented marker, canonical case acceptance, light-path admission, confirmed
|
||||
claims, historical CCR reassignment, source rebundle approval, OpenBao auth/grant,
|
||||
ESO deployment, native materialization, contained session, adapter/revocation proof
|
||||
or browser/MFA/break-glass/first-case completion is authorized. Existing owner/project
|
||||
records retain those separate gates. Recording changes need fresh canonical hashes,
|
||||
full run/source reconciliation and independent required native receipts; render
|
||||
identity alone cannot turn an old receipt into current execution authority.
|
||||
|
||||
No further NetKingdom source correction is required for this exact completed package
|
||||
and corrected source-only acknowledgment packet. This independent receipt satisfies
|
||||
the separate technical package-review gate; it does not edit packet readiness fields,
|
||||
post the memo or record acknowledgment. Any rebinding or addition of this receipt to
|
||||
the human packet must preserve exact proposal revision/digests and be reconciled by
|
||||
the requester before genuine human disposition.
|
||||
|
|
@ -0,0 +1,290 @@
|
|||
{
|
||||
"independent_checks": {
|
||||
"exact32_manifest_sha256": "330da7fe129b0443e41fff44b3c2d829b0d682698fdbba9fe60011d46ed5c48c",
|
||||
"all32_hashes_verified": true,
|
||||
"full_type_package_validator_passed": true,
|
||||
"independently_run_tests_passed": 22,
|
||||
"missing_readme_tests_examples_negative_regressions_pass": true,
|
||||
"all20_bound_docs_typed_intake_and_three_guards_pass": true,
|
||||
"register_bytes": 233429,
|
||||
"submission_digest": "sha256:2fd1c7ee3bad461d48347427802e8d130e01017f52634740bbc724fcf9e9bf60",
|
||||
"package_type_forgejo_bytes_match_reviewed19": true,
|
||||
"isolated_allowed_acknowledged_type_shape_valid": true,
|
||||
"canonical_case_after_ack_proposed_no_acceptance_fields": true,
|
||||
"ordinary_admission_after_type_ack_refused": true,
|
||||
"post_ack_preparation_render_identical": true,
|
||||
"current1_1_bytes_unchanged": true,
|
||||
"source_schema_status_change_not_human_receipt": true,
|
||||
"human_acknowledgment": false,
|
||||
"native_action": false
|
||||
},
|
||||
"exact32_packet_files": [
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/package-1.2/README.md",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-consumer-eso/package-1.2/README.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "ffe1ae396710665542eb6d819def1ba043f2344fbe4f9cc6ad90a7a9aa96db71"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/package-1.2/examples/example-public-portal.yaml",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-consumer-eso/package-1.2/examples/example-public-portal.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "8d6457248415daa6fc509da4e838aae0b66d7808e9da8e00f4b85a1e7faed10d"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/package-1.2/examples/forgejo.yaml",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-consumer-eso/package-1.2/examples/forgejo.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "1c868c1da7d9077fae97bc6bc029706ec3dc418cfeaae30dc0f92b5b4ba6f2ab"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/package-1.2/tests/test_source_contract.py",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-consumer-eso/package-1.2/tests/test_source_contract.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "c3011c6855b7f1e4fd8ee5aea41cfe1598380db4fd8b9498c79050c91911b829"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/package-1.2/type.yaml",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-consumer-eso/package-1.2/type.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "017885bdd139cd66a5bf6d9839b1b8ec9bc08fb051d9577adc3928b76a7be6db"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-consumer-eso/package-1.2/validation.json",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-consumer-eso/package-1.2/validation.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "ab3bcf683f5a45f4c8dc28565a8cfc97a786da2ece8e36339d98d9ed9ff6bc7e"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/CCR-0042-proposed-body.yaml",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/CCR-0042-proposed-body.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "6544600c63a86559ba053240c476d493f4d2f25c9cd22cf6a9a05f09ee617a86"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/case-1.2.yaml",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/case-1.2.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "1c868c1da7d9077fae97bc6bc029706ec3dc418cfeaae30dc0f92b5b4ba6f2ab"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/consumer-delivery.yaml",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/consumer-delivery.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "56478a83d799c08dc1e5159983b1e843a46b16dfeee7e84c31401d1f92430df2"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/current-case-1.1.yaml",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/current-case-1.1.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "bcc2c6d5bae0d28242b3cdb71e74d8ca297c2afe04766b55d53597f86893351d"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/current-type-1.1.yaml",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/current-type-1.1.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f705c64e4875e9b8e18a912fb51c135e77898926d6a451f5cb74ab3c0cbe4d1c"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/decision-packet.md",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/decision-packet.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "719c0276f75c038d402d80aa11628ab3bb80d3c79014ed3b3dad37708e532637"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/intake.json",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/intake.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "ee5fb8ce1def870f75bb8629dea28d5c48d710f2b689855fd950d41c0619a030"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/lifecycle-commands.json",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/lifecycle-commands.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "77d9f3c11a7c3046fc1b19cb54383057cd32e175ca120b88ec6e664df9511c75"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/mason-final-review.json",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/mason-final-review.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "28541874fb437a06a8f1749bc50c88f6fee3d7c100c2f3ee0c52b59afaf8e102"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/memo.json",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/memo.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "7eb3189323a49164e9653d41327e5c050017f8dd5e2c8b7fa27046f44fdcb5c0"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/netkingdom-final-review-sources.json",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/netkingdom-final-review-sources.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "2a3862d47a95b0fd21329292723d39fce61279d779f51b629b517b5ed130f577"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/netkingdom-final-review.md",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/netkingdom-final-review.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e21aeed24b6bb092ddbba12957a7c06861240655f977e7023d5475ca7a3f569f"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/owner-design.md",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/owner-design.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "c523949454e4c6eb58e8caee382380a561f561704136de62bf5783c592f962f2"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/platform-final-review.json",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/platform-final-review.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "72854a798e01c6d65a16770efb1329d211fe3c59a3f4ad3190d6972f5c886f6e"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/proposal.json",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/proposal.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f93a8ef687d2d6bf244220508fd4799b07dc623597c8ca410dfa3dcc72001527"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/reader-policy.hcl",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/reader-policy.hcl",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "af3a638605c1f6dff7879771fede4c56a6b9a7e430d4b5b58c370063b2c888ca"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/reader-role.json",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/reader-role.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "976b19e0780b6056ed54bf5e8f27a0eb786af65817d9ec00ca161ac46e7d72e7"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/recording-gates.md",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/recording-gates.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "d447d512fbefbc3667576fba3a58989395792c24126eb2529f2a2020062e76cc"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/render-1.2.json",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/render-1.2.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "96b25108335e2cf5f96af481fe8a7735831c8320d81b50f7c6e6d4e53d0c0f02"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/retained-native-metadata.json",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/retained-native-metadata.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "4e2993f5920215f41e4a235743023f22b78b8f597d3d70ed279991b2fc3204b5"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/source-inventory.json",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/source-inventory.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "3c6ea78bad2d4bd1a76a07a469a0b4206fff955df7be35a83ba29d271a69a64b"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/type-1.2.yaml",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/type-1.2.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "017885bdd139cd66a5bf6d9839b1b8ec9bc08fb051d9577adc3928b76a7be6db"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/validation-and-history.json",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/validation-and-history.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "361a41fe5cb04cee334aaf9f82db8496f5532249e7dc5dceca88def9786a7f46"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/validation.json",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/validation.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "991ac5e1ac66c279b1f8a25148441bb59d2d11f94cd04af5a1c6917a2a883e73"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "tools/prepare_forgejo_type12_acknowledgment.py",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/tools/prepare_forgejo_type12_acknowledgment.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "a857b89e4e37849959a75deb48f3f066a0aa25374fc2cfeb36d9dac9060c58d5"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "tools/validate_forgejo_type12_acknowledgment.py",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/tools/validate_forgejo_type12_acknowledgment.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "ce61d3f241c446c8a6e6c726dcf06ff6f11ee680069720103d8c636863c5257b"
|
||||
}
|
||||
],
|
||||
"sources": [
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/AGENTS.md",
|
||||
"sha256": "065d47b7bdbfe829672a2a6161a7f8cf243237a1210fb61d82f153fa37f22131"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/INTENT.md",
|
||||
"sha256": "fd2ba8dff9dfd5583ec6d8b0348f273bfe00c59923b5d5d47cd22b1fb4658c54"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/canon/standards/security-case-types_v0.1.md",
|
||||
"sha256": "a4fda906d5138d2594a1f8d047c7c28e1cdf96b1eae051f543b9a5e5852bcb5e"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/canon/schemas/security-case-type_v0.1.schema.json",
|
||||
"sha256": "cc35b6b2a78a841c78a7cb21820d8efc6625e5e41c68ca3880d411cc17e27da8"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/canon/schemas/security-case_v0.1.schema.json",
|
||||
"sha256": "eb329cf40e6b937883c026385311ca560b8353dcd8f89f02f42d51153970890d"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/tools/security-case-types/security_case_validator.py",
|
||||
"sha256": "ef380a85ca9949e0ebc59d1cdce422bd45e362eb976330b2b72b8fd73784ae0a"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/workplans/ADHOC-2026-10-11.md",
|
||||
"sha256": "80829205ea71f95b144f91e0feef720a5e59c8970d28ae0c4effb1cf3e0e9ef1"
|
||||
},
|
||||
{
|
||||
"path": "/tmp/forgejo-type12-human-packet-original-eeb2968/manifest.json",
|
||||
"sha256": "eeb2968ec317d0bc072788011918025a21d2b48c13987d09945ae8761f3d8fe5"
|
||||
},
|
||||
{
|
||||
"path": "/tmp/netkingdom-forgejo-type12-packet-review-stage/manifest.json",
|
||||
"sha256": "5fd23ad17b3a779847daf9ca63711d364ad5821718f7fca11fd567ccdaeb5d51"
|
||||
}
|
||||
],
|
||||
"commands": [
|
||||
"PYTHONDONTWRITEBYTECODE=1 python3 /home/worsch/net-kingdom/tools/security-case-types/security_case_validator.py validate-type /tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-consumer-eso/package-1.2",
|
||||
"PYTHONDONTWRITEBYTECODE=1 NET_KINGDOM_ROOT=/home/worsch/net-kingdom python3 -m pytest -p no:cacheprovider /tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-consumer-eso/package-1.2/tests -q",
|
||||
"PYTHONDONTWRITEBYTECODE=1 python3 /tmp/forgejo-type12-human-packet-stage/net-kingdom/tools/validate_forgejo_type12_acknowledgment.py /tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment"
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,90 @@
|
|||
---
|
||||
reviewer: net-kingdom-owner (agent net-kingdom, codex)
|
||||
decision: changes_requested
|
||||
work_item: NK-WP-ADHOC-2026-10-11-T06
|
||||
reviewed_manifest_sha256: eeb2968ec317d0bc072788011918025a21d2b48c13987d09945ae8761f3d8fe5
|
||||
scope: source-only-acknowledgment-human-packet-recording-boundary
|
||||
---
|
||||
|
||||
# NetKingdom review of source-only type1.2 acknowledgment packet
|
||||
|
||||
Reviewed exact26-path manifest eeb2968ec317d0bc072788011918025a21d2b48c13987d09945ae8761f3d8fe5,
|
||||
including20 memo documents, stable NK-FORGEJO-TYPE12-SOURCE-20261011-R1 and
|
||||
infd-20261011-forgejo-type12-source-r1@1, submission
|
||||
sha256:5d36e27de6161e0c80c0590a99a4d47c998f673aacf289d7a6b46adfe510c6e7.
|
||||
Own T06 was prepared/completed before this formal entry; preserve current T01–T05
|
||||
and hub metadata when applying. This worker reviews only the established
|
||||
NetKingdom owner role. INTENT's Taxonomy and identity-contract goals require
|
||||
honest canonical lifecycle semantics, not merely valid file shape.
|
||||
|
||||
All26 hashes matched. The offline intake/schema and typed decoder validate20
|
||||
content-bound documents; the nineteen applied source hashes and three actual
|
||||
owner-review attachments match unchanged. Packet-content tamper, boolean memo
|
||||
version and prebound approval are refused. Proposed type/case/render preserve
|
||||
execution=false, unconfirmed claims and no disposition/grant. Current1.1 exact
|
||||
bytes and historical owner returns remain distinct. These checks are offline
|
||||
source checks and do not authenticate a submitter, principal or founder act.
|
||||
|
||||
## Required narrow recording correction
|
||||
|
||||
Recording-gates.md step4 optionally permits canonical case status accepted
|
||||
against a merely acknowledged type, then falls back to a separate source receipt
|
||||
if that path cannot safely represent the boundary. Make that existing fallback
|
||||
mandatory now. Canon SecurityCaseTypes §4 requires the referenced type implemented;
|
||||
§5 says only implemented types accept cases. The normal owner validator enforces
|
||||
this. In an isolated copy, acknowledged type plus accepted case and both owner/
|
||||
founder fixture roles passes JSON shape but normal semantic admission fails:
|
||||
“only implemented types accept cases”. The preparation bypass passes the shape,
|
||||
but cannot supply ordinary admission authority. Even there, a missing required
|
||||
founder role is rejected. No fictional fixture receipt was recorded.
|
||||
|
||||
Mason's --allow-unimplemented is documented for the first reference that takes
|
||||
an acknowledged type to implemented. This existing preparation/build mechanism
|
||||
is not a general exemption from canonical case admission and supplies no native
|
||||
permission. Source-only human acceptance of the existing migration can be retained
|
||||
without declaring ordinary admitted case status. The packet already offers this
|
||||
separate-receipt path; making it explicit avoids creating a lifecycle ambiguity.
|
||||
|
||||
Replace recording-gates step4 with:
|
||||
|
||||
> After a genuine exact human disposition fulfilling the declared consumer
|
||||
> owner/founder roles, retain source acceptance of the existing Forgejo reference
|
||||
> migration in a separate immutable owner receipt binding the proposed1.2 type,
|
||||
> case and full render hashes and the actual native disposition identities.
|
||||
> Keep the canonical1.2 case proposed and preserve current1.1 canonical source
|
||||
> until deliberate owner migration under the applicable admission contract.
|
||||
> Do not set canonical case status accepted or insert case acceptance markers
|
||||
> against an acknowledged/unimplemented type. Reference preparation/rebundle
|
||||
> remains the existing explicitly bounded first-reference path; it neither admits
|
||||
> an ordinary new case nor supplies native execution, claims or implemented status.
|
||||
> Later canonical admission/status recording must meet its actual type lifecycle,
|
||||
> owner acceptance and source/native receipt requirements, or obtain a separate
|
||||
> explicit argued canon disposition. Schema success alone is not that permission.
|
||||
|
||||
Apply the same explicit boundary to decision-packet requested-act/recording prose,
|
||||
proposal case_scope, memo question/terms and generated intake/lifecycle envelopes:
|
||||
source type acknowledgment plus separate reference-source acceptance receipt;
|
||||
canonical1.2 case stays proposed at this stage. Keep the stable proposal/trial ID,
|
||||
retain eeb as the reviewed original revision, regenerate exact packet/memo/source
|
||||
hashes and submission digest, and re-review the refined exact revision before
|
||||
submission. This changes source recording clarity only, not the reviewed19 type/
|
||||
case/native-body bytes or the founder decision itself. No new broad workplan is
|
||||
needed; existing NK0048/project records retain followthrough.
|
||||
|
||||
## Boundaries already correctly retained
|
||||
|
||||
The type's acknowledgment requires a new genuine founder informed-decision under
|
||||
§6; old1.1 receipt or technical reviews cannot provide it. Typepackage README,
|
||||
reference examples and runnable tests must actually be validated under §3 before
|
||||
canonical acknowledged-package recording; gate3 already requires that and should
|
||||
remain. Status/history references must fit closed schema: do not invent new type
|
||||
acceptance keys to imitate a receipt. Preserve immutable old package/history and
|
||||
proposed bytes. Post-record type/case file hashes and actual render/source pins
|
||||
must be reconciled rather than rewriting old source hashes with new meaning.
|
||||
|
||||
No implemented type/light-path admission, binding confirmation, CCR apply, ESO
|
||||
publication, secret access, structural materialization, native adapter/session,
|
||||
credential grant or first-case completion is authorized. Human browser/MFA/
|
||||
break-glass and native per-owner receipts stay separate. Pending, declined, stale
|
||||
or changed-source outcomes remain honest source state. This changes-requested
|
||||
review is not a founder ruling or another owner's role entry.
|
||||
|
|
@ -0,0 +1,235 @@
|
|||
{
|
||||
"independent_checks": {
|
||||
"exact_packet_manifest_sha256": "eeb2968ec317d0bc072788011918025a21d2b48c13987d09945ae8761f3d8fe5",
|
||||
"all26_paths_verified": true,
|
||||
"isolated_acknowledged_type_and_accepted_case_pass_json_shape": true,
|
||||
"normal_semantic_admission_rejects_acknowledged_type_accepted_case": [
|
||||
"Issue(level='ERROR', path='case.spec.type', message=\"type 'oidc-browser-relying-party' is 'acknowledged'; only implemented types accept cases\")"
|
||||
],
|
||||
"only_preparation_bypass_accepts_that_shape": true,
|
||||
"missing_founder_role_refused_even_in_preparation": true,
|
||||
"packet_intake_schema_and_typed_decoder_passed": true,
|
||||
"packet_hash_version_and_prebound_approval_negatives_refused": true,
|
||||
"submission_digest": "sha256:5d36e27de6161e0c80c0590a99a4d47c998f673aacf289d7a6b46adfe510c6e7",
|
||||
"native_disposition": false,
|
||||
"native_write": false
|
||||
},
|
||||
"exact_packet_files": [
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/CCR-0042-proposed-body.yaml",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/CCR-0042-proposed-body.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "6544600c63a86559ba053240c476d493f4d2f25c9cd22cf6a9a05f09ee617a86"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/case-1.2.yaml",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/case-1.2.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "1c868c1da7d9077fae97bc6bc029706ec3dc418cfeaae30dc0f92b5b4ba6f2ab"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/consumer-delivery.yaml",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/consumer-delivery.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "56478a83d799c08dc1e5159983b1e843a46b16dfeee7e84c31401d1f92430df2"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/current-case-1.1.yaml",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/current-case-1.1.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "bcc2c6d5bae0d28242b3cdb71e74d8ca297c2afe04766b55d53597f86893351d"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/current-type-1.1.yaml",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/current-type-1.1.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f705c64e4875e9b8e18a912fb51c135e77898926d6a451f5cb74ab3c0cbe4d1c"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/decision-packet.md",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/decision-packet.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "d999f2789239bb44a5cb9f87a0a39109761a92c5364b4e38e05189d02adbd167"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/intake.json",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/intake.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "bdebcc04917c2490a684824149598de587d4cf2419d797665b4d9264d71deab6"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/lifecycle-commands.json",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/lifecycle-commands.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "6652abb9aa59abc4ff71862aa99dd4bfa2c4f795ce66adb0e9ea662d01fcb021"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/mason-final-review.json",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/mason-final-review.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "28541874fb437a06a8f1749bc50c88f6fee3d7c100c2f3ee0c52b59afaf8e102"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/memo.json",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/memo.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "42bf1764f106fb44c914879532da4bcb570fafdc2f265217b342de52cf835d17"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/netkingdom-final-review-sources.json",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/netkingdom-final-review-sources.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "2a3862d47a95b0fd21329292723d39fce61279d779f51b629b517b5ed130f577"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/netkingdom-final-review.md",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/netkingdom-final-review.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e21aeed24b6bb092ddbba12957a7c06861240655f977e7023d5475ca7a3f569f"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/owner-design.md",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/owner-design.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "c523949454e4c6eb58e8caee382380a561f561704136de62bf5783c592f962f2"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/platform-final-review.json",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/platform-final-review.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "72854a798e01c6d65a16770efb1329d211fe3c59a3f4ad3190d6972f5c886f6e"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/proposal.json",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/proposal.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "5beef4986787b1bdb95918d91e8b175b2757ca1c8f8482f75feef11656f03883"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/reader-policy.hcl",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/reader-policy.hcl",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "af3a638605c1f6dff7879771fede4c56a6b9a7e430d4b5b58c370063b2c888ca"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/reader-role.json",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/reader-role.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "976b19e0780b6056ed54bf5e8f27a0eb786af65817d9ec00ca161ac46e7d72e7"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/recording-gates.md",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/recording-gates.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "bfba8ca8764590726e0db628be9d6562f59959d8babdce26bd5f9f9edad03e29"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/render-1.2.json",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/render-1.2.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "96b25108335e2cf5f96af481fe8a7735831c8320d81b50f7c6e6d4e53d0c0f02"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/retained-native-metadata.json",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/retained-native-metadata.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "4e2993f5920215f41e4a235743023f22b78b8f597d3d70ed279991b2fc3204b5"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/source-inventory.json",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/source-inventory.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "39b1db3b3a5ba935df4ad6ba3ba459114163454edef0f57398c177bead485097"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/type-1.2.yaml",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/type-1.2.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "017885bdd139cd66a5bf6d9839b1b8ec9bc08fb051d9577adc3928b76a7be6db"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/validation-and-history.json",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/validation-and-history.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "95318f54942871a125a5200ec05d6f9dc80077918f26ebe671b9ab4d150b112d"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/proposals/2026-10-11-forgejo-type12-acknowledgment/validation.json",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/validation.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "55e86b333ee5e6c032e265add0239bdff5595bd8110aba39bf150b4d810796f5"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "tools/prepare_forgejo_type12_acknowledgment.py",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/tools/prepare_forgejo_type12_acknowledgment.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "94dd98122fb5822a8d1a2dae3eeb6974ea46ab3072edc15b78e14053c2efbee0"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "tools/validate_forgejo_type12_acknowledgment.py",
|
||||
"staged_path": "/tmp/forgejo-type12-human-packet-stage/net-kingdom/tools/validate_forgejo_type12_acknowledgment.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "57a4a1a9c5433182b0c649c235fba3da6b9acdbe379b988dddec775a5c174a6e"
|
||||
}
|
||||
],
|
||||
"sources": [
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/INTENT.md",
|
||||
"sha256": "fd2ba8dff9dfd5583ec6d8b0348f273bfe00c59923b5d5d47cd22b1fb4658c54"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/AGENTS.md",
|
||||
"sha256": "065d47b7bdbfe829672a2a6161a7f8cf243237a1210fb61d82f153fa37f22131"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/canon/standards/security-case-types_v0.1.md",
|
||||
"sha256": "a4fda906d5138d2594a1f8d047c7c28e1cdf96b1eae051f543b9a5e5852bcb5e"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/canon/schemas/security-case-type_v0.1.schema.json",
|
||||
"sha256": "cc35b6b2a78a841c78a7cb21820d8efc6625e5e41c68ca3880d411cc17e27da8"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/canon/schemas/security-case_v0.1.schema.json",
|
||||
"sha256": "eb329cf40e6b937883c026385311ca560b8353dcd8f89f02f42d51153970890d"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/tools/security-case-types/security_case_validator.py",
|
||||
"sha256": "ef380a85ca9949e0ebc59d1cdce422bd45e362eb976330b2b72b8fd73784ae0a"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/workplans/ADHOC-2026-10-11.md",
|
||||
"sha256": "80829205ea71f95b144f91e0feef720a5e59c8970d28ae0c4effb1cf3e0e9ef1"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/ops-mason/src/ops_mason/case_plan.py",
|
||||
"sha256": "c964524c97b4c579a3ff2e890f40180fc469925f123a3b891f10a6dad0edbec0"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,228 @@
|
|||
{
|
||||
"reviewer": "net-kingdom-owner (agent net-kingdom, codex)",
|
||||
"decision": "approved",
|
||||
"work_item": "NK-WP-ADHOC-2026-10-11-T06",
|
||||
"scope": "post-anchor-independent-source-owner-review-only",
|
||||
"comment": "NetKingdom INTENT Taxonomy, Identity is the Control Plane and Meta-Orchestration basis: reviewed actual applied exact34 packet and completed1.2 source package only AFTER verifying actual completed ownT06 exists in its owner checkout. Approve exact source-only technical meaning/readiness for genuine founder consideration, preserving first conditional/final/hash reviews as source-check history. This receipt supplies the post-anchor owner review without inventing an earlier application order, a second owner role, T07, newtrial, founder act or native authority.",
|
||||
"chronology": {
|
||||
"owner_workrecord_prepared_before_initial_staged_review": true,
|
||||
"coordinator_reported_initial_physical_apply_order": "new review files before existing ADHOC anchor",
|
||||
"prior_order_claim_not_backfilled": true,
|
||||
"actual_owner_anchor_verified_present_and_completed_before_this_receipt": true,
|
||||
"actual_owner_workrecord_path": "/home/worsch/net-kingdom/workplans/ADHOC-2026-10-11.md",
|
||||
"actual_owner_workrecord_sha256": "b33f203ff9e6318442b04374a5c6c97518097c2c9cad2bc38f65e3e9050f7820",
|
||||
"first_reviews_retained_unchanged": true,
|
||||
"this_receipt_must_apply_after_actual_anchor_before_human_packet_submission": true
|
||||
},
|
||||
"exact_final_manifest_sha256": "0b377d647ca748cd03c92f9792396412048055d4bde9f7bb06ff6d413f7acd68",
|
||||
"stable_proposal": "NK-FORGEJO-TYPE12-SOURCE-20261011-R1",
|
||||
"memo_id": "infd-20261011-forgejo-type12-source-r1",
|
||||
"memo_version": 1,
|
||||
"submission_digest": "sha256:585cee731de30d2b37883a57abfd9eb32f023ee694e8d911989109d5caf80569",
|
||||
"actual_checks": {
|
||||
"all34_actual_applied_file_hashes_match_frozen_manifest": true,
|
||||
"actual_conditional_final_and_ACK_hashes_preserved": true,
|
||||
"all_four_bundle_receipts_decompressed_match_original_exact": true,
|
||||
"actual_checkout_full_package_validator": "PASS proposed1.2",
|
||||
"actual_checkout_independently_rerun_source_tests": 22,
|
||||
"actual_checkout_packet_validator": "PASS full intake/schema/typed20docs and three refusal guards",
|
||||
"register_payload_bytes": 241076,
|
||||
"reviewed19_applied_sources_and_owner_attachments_match": true,
|
||||
"canonical_case_after_type_ack": "proposed",
|
||||
"normal_admission_of_unimplemented_type_refused": true,
|
||||
"type_implemented": false,
|
||||
"case_acceptance_authorized": false,
|
||||
"claims_confirmed": false,
|
||||
"execution_permitted": false,
|
||||
"founder_disposition_recorded": false
|
||||
},
|
||||
"reviewed_sources": [
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-consumer-eso/package-1.2/README.md",
|
||||
"sha256": "94dfe344f0e79cffea239612b0f7232f8bcc800d39e3b5aee6e1cad8cb2d5ee7"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-consumer-eso/package-1.2/examples/example-public-portal.yaml",
|
||||
"sha256": "8d6457248415daa6fc509da4e838aae0b66d7808e9da8e00f4b85a1e7faed10d"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-consumer-eso/package-1.2/examples/forgejo.yaml",
|
||||
"sha256": "1c868c1da7d9077fae97bc6bc029706ec3dc418cfeaae30dc0f92b5b4ba6f2ab"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-consumer-eso/package-1.2/tests/test_source_contract.py",
|
||||
"sha256": "c3011c6855b7f1e4fd8ee5aea41cfe1598380db4fd8b9498c79050c91911b829"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-consumer-eso/package-1.2/type.yaml",
|
||||
"sha256": "017885bdd139cd66a5bf6d9839b1b8ec9bc08fb051d9577adc3928b76a7be6db"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-consumer-eso/package-1.2/validation.json",
|
||||
"sha256": "2368429da176c7f6b488ce47324bf22d5fd644e4f72c9453795c4b818266276c"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/CCR-0042-proposed-body.yaml",
|
||||
"sha256": "6544600c63a86559ba053240c476d493f4d2f25c9cd22cf6a9a05f09ee617a86"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/case-1.2.yaml",
|
||||
"sha256": "1c868c1da7d9077fae97bc6bc029706ec3dc418cfeaae30dc0f92b5b4ba6f2ab"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/consumer-delivery.yaml",
|
||||
"sha256": "56478a83d799c08dc1e5159983b1e843a46b16dfeee7e84c31401d1f92430df2"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/current-case-1.1.yaml",
|
||||
"sha256": "bcc2c6d5bae0d28242b3cdb71e74d8ca297c2afe04766b55d53597f86893351d"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/current-type-1.1.yaml",
|
||||
"sha256": "f705c64e4875e9b8e18a912fb51c135e77898926d6a451f5cb74ab3c0cbe4d1c"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/decision-packet.md",
|
||||
"sha256": "bb9a3f12248d18a51d06daf1235903ed8827c55e9e28bcb80c76d414db0d1a56"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/intake.json",
|
||||
"sha256": "94167d1c78a82266ef3f3cad5a968bdb10a9b2a48495eff489c69d8469d4ab65"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/lifecycle-commands.json",
|
||||
"sha256": "11bbd0d98d0fb36b30bc2daf39aee00a160db1ffa32313a283543701bb710bd3"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/mason-final-review.json",
|
||||
"sha256": "28541874fb437a06a8f1749bc50c88f6fee3d7c100c2f3ee0c52b59afaf8e102"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/memo.json",
|
||||
"sha256": "9b0d33f2a286ac950276e6c478d07527b671cca96ba115f988f282c242c00dcb"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/netkingdom-final-review-sources.json",
|
||||
"sha256": "2a3862d47a95b0fd21329292723d39fce61279d779f51b629b517b5ed130f577"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/netkingdom-final-review.md",
|
||||
"sha256": "e21aeed24b6bb092ddbba12957a7c06861240655f977e7023d5475ca7a3f569f"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/netkingdom-review-bundle.json",
|
||||
"sha256": "d452d90d886519186e2170592e6ab7389f384eff6c12795c8ad66a798e0966e0"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/netkingdom-review-sources-bundle.json",
|
||||
"sha256": "1b6c0432150ec9fd07a8aa4a005051081f7ac2557a2787fe5b32cdb7387d6648"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/owner-design.md",
|
||||
"sha256": "c523949454e4c6eb58e8caee382380a561f561704136de62bf5783c592f962f2"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/platform-final-review.json",
|
||||
"sha256": "72854a798e01c6d65a16770efb1329d211fe3c59a3f4ad3190d6972f5c886f6e"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/proposal.json",
|
||||
"sha256": "3d726df3bebcfeb50dd0a5f83ad1ba94d0408caeec84a421feb1555b4b106e97"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/reader-policy.hcl",
|
||||
"sha256": "af3a638605c1f6dff7879771fede4c56a6b9a7e430d4b5b58c370063b2c888ca"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/reader-role.json",
|
||||
"sha256": "976b19e0780b6056ed54bf5e8f27a0eb786af65817d9ec00ca161ac46e7d72e7"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/recording-gates.md",
|
||||
"sha256": "ca7b851f6357951101e7026883ccc29529c5ad798d5692987ee29a4c65962bce"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/render-1.2.json",
|
||||
"sha256": "96b25108335e2cf5f96af481fe8a7735831c8320d81b50f7c6e6d4e53d0c0f02"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/retained-native-metadata.json",
|
||||
"sha256": "4e2993f5920215f41e4a235743023f22b78b8f597d3d70ed279991b2fc3204b5"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/source-inventory.json",
|
||||
"sha256": "fc06655f48d33c84fee1764de71649dde4f584e36388bce2af1e459d2728bc7c"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/type-1.2.yaml",
|
||||
"sha256": "017885bdd139cd66a5bf6d9839b1b8ec9bc08fb051d9577adc3928b76a7be6db"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/validation-and-history.json",
|
||||
"sha256": "494d555b7dc33c05cd2f456c781e36bfe13deae3f44ce249d43fef71fe6c2c6a"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/validation.json",
|
||||
"sha256": "51f2e3e399602dd9498dced73a32c9bbe0e2c9ee7468517d71ebccad2ca7e078"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/tools/prepare_forgejo_type12_acknowledgment.py",
|
||||
"sha256": "68aea6aaa40e5d28f800ad457f3410319cac75b00fd81aa6320edd4155feb449"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/tools/validate_forgejo_type12_acknowledgment.py",
|
||||
"sha256": "505e09826b7ea27c5ed8efaf7981d3f4a3aef4163bc9f95295b2f470533cb417"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/reviews/2026-10-11-forgejo-type12-human-packet-net-owner-review.md",
|
||||
"sha256": "70925e14a31105be7a840cb68d4029618dbc5e51eb488d0d4b78d12cffba4765"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/reviews/2026-10-11-forgejo-type12-human-packet-net-owner-review.sources.json",
|
||||
"sha256": "0f8604afcdc6e520044400e9d9c9c1aa0458eefdac4edb256d2c91b8f8ea85bb"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/reviews/2026-10-11-forgejo-type12-human-packet-net-owner-final-review.md",
|
||||
"sha256": "9e9b8dda889203c064b35e1bbcd4d0c62d76d4ba1935c9a10f4b2dbf1c6e8497"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/reviews/2026-10-11-forgejo-type12-human-packet-net-owner-final-review.sources.json",
|
||||
"sha256": "00eee9833108f451d99b15fb1261e4ba3aebf8a047bdd0a01d8ea4f601e99073"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/net-kingdom/docs/reviews/2026-10-11-forgejo-type12-human-packet-final-hash-ack.json",
|
||||
"sha256": "7f2264668ad205d127bb216bc726f62a6ee447759f9899fcccc6c439b9bbefe5"
|
||||
}
|
||||
],
|
||||
"bundled_originals": [
|
||||
{
|
||||
"label": "original_exact19_source_review",
|
||||
"source_path": "/home/worsch/net-kingdom/docs/reviews/2026-10-11-forgejo-consumer-eso-net-owner-final-review.md",
|
||||
"sha256": "e21aeed24b6bb092ddbba12957a7c06861240655f977e7023d5475ca7a3f569f"
|
||||
},
|
||||
{
|
||||
"label": "actual_completed_package_peer_review",
|
||||
"source_path": "/tmp/netkingdom-forgejo-type12-final-packet-review-stage/net-kingdom/docs/reviews/2026-10-11-forgejo-type12-human-packet-net-owner-final-review.md",
|
||||
"sha256": "9e9b8dda889203c064b35e1bbcd4d0c62d76d4ba1935c9a10f4b2dbf1c6e8497"
|
||||
},
|
||||
{
|
||||
"label": "original_exact19_source_review",
|
||||
"source_path": "/home/worsch/net-kingdom/docs/reviews/2026-10-11-forgejo-consumer-eso-net-owner-final-review.sources.json",
|
||||
"sha256": "2a3862d47a95b0fd21329292723d39fce61279d779f51b629b517b5ed130f577"
|
||||
},
|
||||
{
|
||||
"label": "actual_completed_package_peer_review",
|
||||
"source_path": "/tmp/netkingdom-forgejo-type12-final-packet-review-stage/net-kingdom/docs/reviews/2026-10-11-forgejo-type12-human-packet-net-owner-final-review.sources.json",
|
||||
"sha256": "00eee9833108f451d99b15fb1261e4ba3aebf8a047bdd0a01d8ea4f601e99073"
|
||||
}
|
||||
],
|
||||
"owner_intent_sha256": "fd2ba8dff9dfd5583ec6d8b0348f273bfe00c59923b5d5d47cd22b1fb4658c54",
|
||||
"owner_instructions_sha256": "065d47b7bdbfe829672a2a6161a7f8cf243237a1210fb61d82f153fa37f22131",
|
||||
"authority_limits": [
|
||||
"Only a genuine new independently confirmed native founder act for exact packet may support type acknowledgment recording after owner/source prerequisites.",
|
||||
"Reference migration design approval goes only to separate immutable owner receipt; canonical1.2case remains proposed with no acceptance/phase markers while type unimplemented.",
|
||||
"Immutable current1.1 files/history stay preserved; exact postrecord source digests and owner reconciliation remain required.",
|
||||
"No memo post, type acknowledgment, case admission, binding confirmation, credential/auth/apply, native materialization, ESOdelivery, session/grant, installed verifier/adapter or first-case/browser/MFA completion performed or supplied.",
|
||||
"Source-ready human consideration is distinct from native submitter admission and actual human disposition."
|
||||
]
|
||||
}
|
||||
23
tools/prepare_forgejo_type12_acknowledgment.py
Normal file
23
tools/prepare_forgejo_type12_acknowledgment.py
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
"""Offline preparation of exact source-only type/case acknowledgment; no posting."""
|
||||
import argparse,base64,hashlib,json
|
||||
from pathlib import Path
|
||||
ID='infd-20261011-forgejo-type12-source-r1'
|
||||
PROPOSAL='NK-FORGEJO-TYPE12-SOURCE-20261011-R1'
|
||||
FILES=['decision-packet.md','proposal.json','source-inventory.json','type-1.2.yaml','case-1.2.yaml','render-1.2.json','current-type-1.1.yaml','current-case-1.1.yaml','consumer-delivery.yaml','CCR-0042-proposed-body.yaml','reader-role.json','reader-policy.hcl','owner-design.md','retained-native-metadata.json','mason-final-review.json','platform-final-review.json','netkingdom-review-bundle.json','netkingdom-review-sources-bundle.json','validation-and-history.json','recording-gates.md']
|
||||
|
||||
def build(root):
|
||||
sha=lambda b:'sha256:'+hashlib.sha256(b).hexdigest()
|
||||
items=[];contents=[];documents=[]
|
||||
for name in FILES:
|
||||
data=(root/name).read_bytes();item=name.replace('.','-').lower();media='application/json' if name.endswith('.json') else 'text/markdown' if name.endswith('.md') else 'text/plain'
|
||||
items.append({'item_id':item,'label':name,'hash':sha(data)});contents.append({'item_id':item,'media_type':media,'content':data.decode()});documents.append({'digest':sha(data),'media_type':media,'content_base64':base64.b64encode(data).decode()})
|
||||
memo={'id':ID,'version':1,'question':'Acknowledge the exact proposed OIDC browser relying-party 1.2 architecture after complete-package validation and owner review, with Forgejo migration design recorded separately and its canonical case staying proposed, without native authority?','requested_act':'approve','binding_level':'organizational','brief':'Source-only acknowledgment under SecurityCaseTypes section 6 of the sixth dedicated consumer reader role and separate Forgejo reference-migration design receipt only. Canonical case 1.2 stays proposed while type is unimplemented; actual full package README/examples/runnable tests and separate NetKingdom source-owner review gate type acknowledgment recording. Original five structural bodies unchanged; common ESO trust/600-second TokenRequest/legacy fallback and created-only token-revocation-or-expiry recovery disclosed. Three independent architecture owner reviews / 44 tests and the completed package NetKingdom review / 22 tests attached; bound claims and execution remain false. Old 1.1 is not inherited and native gates remain separate.','binding':{'principal':{'id':'pending-human-session','kind':'person','display_name':'Founder source acknowledgment'},'target':{'kind':'resource','id':'oidc-browser-relying-party@1.2/forgejo-netkingdom-oidc','label':'Exact NetKingdom type 1.2 and Forgejo reference-case source','environment':'build'},'terms':'Only '+PROPOSAL+' and exact reviewed nineteen-file manifest 5dbd04cf96d73a2604cbf113073d618c03434fc87508ba614cbe3820a1a0e431/full render c0afd5576cdae0cbc807eccb2b9fa87ac668f15e32ec7cf79d295bdb23c75b35. Type acknowledgment recording requires actual complete section 3 package validation and separate NetKingdom source-owner review. Reference-migration design approval is separate owner-receipt only; canonical case 1.2 stays proposed/unimplemented, without acceptance fields or phase acceptance. Record genuine new native human source disposition before any permitted type acknowledgment fields, after full package/source-owner gates, preserve immutable 1.1 history. No credential/auth/ESO/materialization/session/grant/native completion; execution.permitted=false and bound_claims_confirmed=false until separately discharged actual native owner gates.'},'step_kind':'approve','packet':items,'highlights':[{'id':'source-only-authentication-refinement','item_id':'decision-packet-md','note':'New sixth role/auth path requires this new acknowledgment; prior 1.1 does not transfer. Shared ESO controller remains broadly trusted, failed TokenRequest must not seed legacy/static tokens, and deletion alone cannot revoke issued tokens. Canonical case 1.2 stays proposed on unimplemented type; full package/source-owner gates remain required. No native credentials, apply, session or case completion.','required_ack':True,'severity':'warning','locator':{'kind':'section','heading':'Requested acknowledgment'}}],'sealed':False,'approval_id':None,'approval_binding_digest':None}
|
||||
intent={'action':'acknowledge','principal':'net-kingdom-admins','purpose':'Acknowledge exact type 1.2 after complete-package/source-owner gates; approve reference-design receipt only, keep canonical case proposed under sections 4/5/6; no native or credential authority.','target':{'id':'oidc-browser-relying-party@1.2','type':'security-case-type','system':'net-kingdom'}}
|
||||
intake={'kind':'informed-decision.memo-intake','version':1,'idempotency_key':ID+'-v1','memo_class':'decision-record','review_group':'net-kingdom-admins','drafted_by':'custodian-codex','approval_intent':intent,'memo':memo,'packet':contents}
|
||||
commands=[{'id':ID,'register':{'memo':memo,'documents':documents},'publish':{'version':1,'audience':{'subjects':[],'groups':['net-kingdom-admins']}},'review':{'version':1,'options':{'submitter':'state-hub','memo_class':'decision-record','review_group':'net-kingdom-admins','approval_intent':intent}}}]
|
||||
assert len(json.dumps(commands[0]['register']).encode())<=256*1024
|
||||
for name,value in [('memo.json',memo),('intake.json',intake),('lifecycle-commands.json',commands)]:
|
||||
(root/name).write_text(json.dumps(value,indent=2,ensure_ascii=False)+'\n')
|
||||
return {'memo_id':ID,'documents':len(items),'register_payload_bytes':len(json.dumps(commands[0]['register']).encode())}
|
||||
if __name__=='__main__':
|
||||
p=argparse.ArgumentParser(description=__doc__);p.add_argument('packet',type=Path);a=p.parse_args();print(json.dumps(build(a.packet)))
|
||||
54
tools/validate_forgejo_type12_acknowledgment.py
Normal file
54
tools/validate_forgejo_type12_acknowledgment.py
Normal file
|
|
@ -0,0 +1,54 @@
|
|||
"""Offline source/memo validation; no source disposition or posting."""
|
||||
import argparse,base64,gzip,copy,hashlib,importlib.util,json,sys
|
||||
from pathlib import Path
|
||||
|
||||
def validate(root,infd_root,nk_root):
|
||||
sys.path.insert(0,str(infd_root))
|
||||
import jsonschema,yaml
|
||||
from informed_decision.intake import validate_submission,SubmitterGrant,IntakeRefused
|
||||
from informed_decision.lifecycle_commands import decode_memo,decode_documents
|
||||
env=json.loads((root/'intake.json').read_text());commands=json.loads((root/'lifecycle-commands.json').read_text());schema=json.loads((infd_root/'schemas/memo-intake.schema.json').read_text());jsonschema.validate(env,schema)
|
||||
grant=SubmitterGrant('state-hub',frozenset({'decision-record'}),frozenset({'net-kingdom-admins'}));parsed=validate_submission(env,submitter_id='state-hub',grant=grant);memo=decode_memo(commands[0]['register']['memo']);docs=decode_documents(commands[0]['register']['documents'],memo)
|
||||
assert env['memo']==commands[0]['register']['memo']==json.loads((root/'memo.json').read_text());assert len(docs)==len(memo.packet)==20;assert commands[0]['review']['options']['approval_intent']==env['approval_intent'];assert len(json.dumps(commands[0]['register']).encode())<=256*1024
|
||||
for item in env['packet']:
|
||||
name=next(x['label'] for x in env['memo']['packet'] if x['item_id']==item['item_id'])
|
||||
assert (root/name).read_bytes()==item['content'].encode()
|
||||
inventory=json.loads((root/'source-inventory.json').read_text());assert inventory['bound_preparation_manifest_sha256']=='5dbd04cf96d73a2604cbf113073d618c03434fc87508ba614cbe3820a1a0e431'
|
||||
for item in inventory['reviewed19_owner_source_files']:
|
||||
assert hashlib.sha256((nk_root.parent/item['repo']/item['path']).read_bytes()).hexdigest()==item['sha256']
|
||||
for item in inventory['attachments_from_actual_owners']:
|
||||
attached=(root/item['name']).read_bytes()
|
||||
if 'wrapper_original_receipt_field' in item:attached=base64.b64decode(json.loads(attached)[item['wrapper_original_receipt_field']],validate=True)
|
||||
elif 'review_bundle_entry' in item:
|
||||
entry=json.loads(attached)['entries'][item['review_bundle_entry']];assert entry['encoding']=='gzip-base64' and entry['sha256']==item['sha256']
|
||||
attached=gzip.decompress(base64.b64decode(entry['original_source_bytes'],validate=True))
|
||||
assert hashlib.sha256(Path(item['owner_path']).read_bytes()).hexdigest()==item['sha256']==hashlib.sha256(attached).hexdigest()
|
||||
vp=nk_root/'tools/security-case-types/security_case_validator.py';sys.path.insert(0,str(vp.parent));spec=importlib.util.spec_from_file_location('security_case_validator',vp);v=importlib.util.module_from_spec(spec);sys.modules[spec.name]=v;spec.loader.exec_module(v)
|
||||
t=yaml.safe_load((root/'type-1.2.yaml').read_text());c=yaml.safe_load((root/'case-1.2.yaml').read_text());assert t['spec']['status']==c['spec']['status']=='proposed';assert 'acceptance' not in c['spec'];proposal=json.loads((root/'proposal.json').read_text());assert not proposal['case_acceptance_authorized'];assert proposal['canonical_case_status_after_source_ack']=='proposed';assert not proposal['type_implemented'];assert not v.has_errors(v.validate_type(t)+v.validate_case(c,t,require_implemented=False))
|
||||
paths,issues=v.discover_declarations(t,nk_root.parent);decls,issues2=v.composer.load_declarations(paths);issues3,render=v.render_case(c,t,decls,require_implemented=False);assert not v.has_errors(issues+issues2+issues3);assert (json.dumps(render,indent=2,sort_keys=True)+'\n').encode()==(root/'render-1.2.json').read_bytes();assert not render['execution']['permitted'];assert len(render['materialization'])==6
|
||||
package=json.loads((root/'validation-and-history.json').read_text())['complete_proposed_package_supplement']
|
||||
package_root=root.parent.parent.parent/package['package_path']
|
||||
# root is docs/proposals/<packet>; owner root is three parents above it.
|
||||
for item in package['files']:
|
||||
data=(package_root/item['path']).read_bytes();assert hashlib.sha256(data).hexdigest()==item['sha256']
|
||||
if 'bound_document' in item:assert data==(root/item['bound_document']).read_bytes()
|
||||
else:
|
||||
assert data==base64.b64decode(item['content_base64'],validate=True)
|
||||
assert not v.has_errors(v.validate_type(t,package_root))
|
||||
assert proposal['complete_type12_package_validation_proved'] and package['runnable_tests']['passed']==22
|
||||
assert proposal['complete_type12_package_owner_receipt_recorded'] and package['separate_netkingdom_source_owner_review_recorded'] and proposal['human_posting_ready']
|
||||
import subprocess,os
|
||||
run=subprocess.run([sys.executable,'-m','pytest',str(package_root/'tests'),'-q'],env={**os.environ,'NET_KINGDOM_ROOT':str(nk_root)},capture_output=True,text=True)
|
||||
assert run.returncode==0 and '22 passed' in run.stdout
|
||||
negative=[]
|
||||
for label in ['packet-content-tamper','boolean-memo-version','approval-prebound']:
|
||||
trial=copy.deepcopy(env)
|
||||
if label=='packet-content-tamper':trial['packet'][0]['content']+='\nchanged'
|
||||
elif label=='boolean-memo-version':trial['memo']['version']=True
|
||||
else:trial['memo']['approval_id']='fixture-unapproved'
|
||||
try:validate_submission(trial,submitter_id='state-hub',grant=grant)
|
||||
except IntakeRefused:negative.append(label)
|
||||
else:raise AssertionError('negative accepted')
|
||||
return {'offline_only':True,'full_intake_and_schema_valid':True,'typed_lifecycle_memo_valid':True,'document_hashes_valid':len(docs),'bound19_applied_source_hashes_match':True,'all_owner_attachments_unchanged':True,'type_case_valid_and_source_render_identical':True,'execution_permitted':False,'canonical_case_after_ack':'proposed','canonical_case_acceptance_authorized':False,'complete_proposed_package_validation_passed':True,'actual_runnable_package_tests_passed':22,'separate_package_owner_review_recorded':True,'negative_intake_guards':negative,'register_payload_bytes':len(json.dumps(commands[0]['register']).encode()),'submission_digest':parsed.submission_digest,'offline_submitter_shape_assumption_is_native_admission':False,'founder_disposition_recorded':False}
|
||||
if __name__=='__main__':
|
||||
p=argparse.ArgumentParser(description=__doc__);p.add_argument('packet',type=Path);p.add_argument('--informed-decision-root',type=Path,default=Path('/home/worsch/informed-decision'));p.add_argument('--net-kingdom-root',type=Path,default=Path('/home/worsch/net-kingdom'));a=p.parse_args();print(json.dumps(validate(a.packet,a.informed_decision_root,a.net_kingdom_root),sort_keys=True))
|
||||
|
|
@ -116,3 +116,34 @@ need fresh founder acknowledgment under §6, source rebundle/reconciliation and
|
|||
existing per-owner/native acceptance. No role/grant/materialization/runtime
|
||||
change or first-case completion. Exact final review/sources retained in
|
||||
docs/reviews/2026-10-11-forgejo-consumer-eso-net-owner-final-review.*.
|
||||
|
||||
## Review the source-only successor acknowledgment human packet
|
||||
|
||||
```task
|
||||
id: NK-WP-ADHOC-2026-10-11-T06
|
||||
status: done
|
||||
priority: high
|
||||
```
|
||||
|
||||
NetKingdom-only source-owner review of exact26-path packet
|
||||
eeb2968ec317d0bc072788011918025a21d2b48c13987d09945ae8761f3d8fe5, stable proposal
|
||||
NK-FORGEJO-TYPE12-SOURCE-20261011-R1, memo1, submission5d36e27de6161e0c80c0590a99a4d47c998f673aacf289d7a6b46adfe510c6e7.
|
||||
All hashes,20 documents, applied19source attachments, typed intake and tamper/
|
||||
version/prebound-approval negatives verified. Changes requested to make the
|
||||
separate source-reference acceptance receipt mandatory while canonical1.2case
|
||||
stays proposed: schema permits accepted-case shape, but normalsemantic admission
|
||||
rejects its acknowledged/unimplemented type under canon§4/5. No new founder
|
||||
acknowledgment, native publication or status change has occurred. Existing
|
||||
NK0048/project work retains recording/review followthrough; no duplicate plan.
|
||||
Exact review/proposed correction and independent proof retained in docs/reviews/.
|
||||
|
||||
T06 same-trial refinement review: exact completed32-path packet
|
||||
330da7fe129b0443e41fff44b3c2d829b0d682698fdbba9fe60011d46ed5c48c resolves the
|
||||
recording concern with mandatory separate design receipt and canonical case
|
||||
remaining proposed. Independent full-package validator and22 tests passed,
|
||||
including three missing-package regressions; schema/typed20-doc intake and
|
||||
three refusal guards passed at233429bytes. Post-ack isolated shape/render proof
|
||||
keeps canonicalcaseproposed, ordinary admission blocked and executionfalse.
|
||||
Original eeb changes-requested review and prepackage12ce failures remain history,
|
||||
not new scored successes. Final source agreement is separate receipt only;
|
||||
no actual founder acknowledgment, native intake, acceptance or runtime change.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue