coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Publish reviewed bounded JWT ready handoff and retained owner history
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 18:31:04 +02:00
parent bf6a44db6d
commit 7ceac4372d
11 changed files with 770 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

60
docs/reviews/2026-10-11-key39-producer-v3-net-refusal.json Normal file
View file

@ -0,0 +1,60 @@
{
"reviewer": "net-kingdom",
"formal_role": "native-consumer source owner only",
"disposition": "changes_requested",
"proposal_id": "KEY-WP-0039-T02/private-producer-handoff-v3",
"manifest_sha256": "569672ecdb3f1f5b46122183dc3b82e83ff168c07c87db7211ec26bc1ce6184a",
"compatible_consumer_manifest_sha256": "84542ddcff00932fc7ce22dcb2626be8942a3c006c5098a62fdd6b2478d0cd14",
"adapter_sha256": "faf63a3e9504dcbb46847a114275f83d508521e095410a47f92f02b86ba82b1b",
"launcher_sha256": "2a54568df541c38d43ca2482f037761770e6df206fb1cb88c1222ed7291f5e98",
"work_record": {
"task": "NK-WP-ADHOC-2026-10-11-T07",
"status": "done",
"actual_baseline_sha256": "6300d9d47a59a830dd32c4106441771f7227f094f351956502dbff11507b19bb",
"staged_refinement_sha256": "37d7eba09c3aa07d9efd369872f77f24522290a88aeaf149058bb84393da8cf0",
"preserved_v9_anchor_sha256": "90d34dd5520f998c269529c53de4ebb065328d3f6d8ae79cbb215b19344b1cf7",
"anchor_completed_before_formal_review": true
},
"findings": [
{
"id": "NET-PRODUCER-V3-F01",
"severity": "high",
"location": "scripts/openbao_negative_private_launcher.py:read_public/main",
"description": "main opens and reads caller contract before entering any total deadline. Actual CLI named FIFO contract stays blocked silently; offline subprocess terminated after 0.254s. Source contract acquisition has no finite bound, and bare open accepts nonregular paths. V2 reproduces too. This does not imply private bytes delivered.",
"required_change": "Bound initial contract acquisition and subsequent preparation with one nonrenewable hard elapsed budget; O_NOFOLLOW/O_NONBLOCK regular bounded stable public files should refuse FIFO/symlink/source races before private file access. Add actual CLI FIFO/stalled-read/oversize checks; preserve frozen V3."
}
],
"coverage": {
"maker_tests_passed": 33,
"independent_paired_tests_passed": 9,
"actual_cli_fifo_counterexamples": 2,
"exact_pins_matched": 22,
"paired_execution": "Local fake SSH replaces transport only; actual pinned node wrapper and actual child main/source/window/ready/bounded-input run. Health function returns a fixture digest, native execute records only receipt boolean, Kubernetes function raises if invoked. No network or native operations.",
"cases": [
"valid complete pair",
"wrong nonce zero private loads",
"extra marker key zero private loads",
"health failure zero private loads",
"expired envelope zero transport and private loads",
"changed source pin zero transport and private loads",
"child stdout suppressed; completion unknown",
"stalled marker zero private loads and local teardown",
"actual 4096 capacity partial pipe write; sticky unknown after teardown"
],
"earlier_refusals_retained": [
"a1ed14e6b2db1ae77c3fd638fd7e47b5bd50c25eebba418e31aba89bb4b7f88e",
"8353eb8aae11be8ce874887d6a5ca10bf37c6fba73c3f85f0644a7546dd7d33f"
]
},
"accepted_source_properties": [
"Actual child-ready marker precedes private file loads/delivery in owner launcher graph. Marker binds fresh nonce/exact pins/health/window but is not authenticated authority.",
"Adapter enforces kernel identity distinct stdio/control/data pipes and nonresetting clipped delivery timer.",
"V3 propagates unknown private delivery into sticky consumer unknown before early return and local teardown.",
"Exclusive same-UID directory custody explicitly required; non-atomic stat/unlink and remaining copies acknowledged. Unsigned JWT decoded shape does not authenticate issuer."
],
"native_executed": false,
"credentials_read": false,
"native_or_transport_admitted": false,
"founder_go_granted": false,
"task_closure_inferred": false
}

67
docs/reviews/2026-10-11-key39-producer-v4-net-review.json Normal file
View file

@ -0,0 +1,67 @@
{
"reviewer": "net-kingdom",
"formal_role": "native-consumer source owner only",
"disposition": "approved",
"qualification": "Exact paired source agreement only; no transport, private custody, issuer authentication, native authorization or task closure inferred.",
"proposal_id": "KEY-WP-0039-T02/private-producer-handoff-v4",
"manifest_sha256": "d6f641dc1e4aae7d36658d4199d89af14d2fd7a4bd4e526856eb340234f2d33e",
"compatible_consumer_manifest_sha256": "84542ddcff00932fc7ce22dcb2626be8942a3c006c5098a62fdd6b2478d0cd14",
"adapter_sha256": "faf63a3e9504dcbb46847a114275f83d508521e095410a47f92f02b86ba82b1b",
"launcher_sha256": "46e57504b3185cc13f1656901a0ca02cc3887527cb09566e270f57b76099ab9c",
"work_record": {
"task": "NK-WP-ADHOC-2026-10-11-T07",
"status": "done",
"actual_baseline_sha256": "6300d9d47a59a830dd32c4106441771f7227f094f351956502dbff11507b19bb",
"staged_refinement_sha256": "ea3cd23484aecb9d2b5fe72356f279cd08d323f8cfd53f2af2d070018fae5391",
"preserved_v9_anchor_sha256": "90d34dd5520f998c269529c53de4ebb065328d3f6d8ae79cbb215b19344b1cf7",
"completed_before_formal_review": true
},
"findings": [],
"corrected_findings": [
{
"refusal_sha256": "38abf660701194f85934a076a0c01d3047e6bfe790e02ba1b0e4616e356634e6",
"finding": "NET-PRODUCER-V3-F01",
"verification": "Actual CLI FIFO, symlink and oversized public contract now refuse promptly; O_NOFOLLOW/O_NONBLOCK regular single-link stable source reads run under original main preparation deadline. Slow acquisition and default launch validation have hard elapsed bounds; acquisition plus launch cannot renew deadline."
}
],
"coverage": {
"maker_tests_passed": 40,
"independent_tests_passed": 13,
"paired_handshake_tests_passed": 9,
"preparation_tests_passed": 4,
"exact_pins_matched": 23,
"paired_execution": "Local fake SSH substitutes transport only. Actual pinned node wrapper and actual child main/source/window/ready/bounded-input run; public health returns fixture digest and native execute records private-pair receipt boolean only. Kubernetes function raises if called. Unsigned synthetic tokens only.",
"cases": [
"actual wrapper/child readiness and complete private delivery",
"wrong nonce zero token-file loads",
"extra marker field zero token-file loads",
"health failure zero token-file loads",
"expired envelope zero transport or private loads",
"local source mismatch zero transport or private loads",
"child output suppressed with consumer outcome unknown",
"stalled marker zero private loads and local teardown",
"actual 4096 capacity partial pipe with sticky unknown after teardown",
"actual CLI FIFO/symlink/oversize refuse before missing private paths",
"default caller slow validation bounded no spawn/private load",
"actual main slow acquisition bounded no spawn/private load",
"actual main acquisition and launch share original deadline"
]
},
"preserved_history": [
"a1ed14e6b2db1ae77c3fd638fd7e47b5bd50c25eebba418e31aba89bb4b7f88e",
"38abf660701194f85934a076a0c01d3047e6bfe790e02ba1b0e4616e356634e6",
"8353eb8aae11be8ce874887d6a5ca10bf37c6fba73c3f85f0644a7546dd7d33f"
],
"source_scope_conditions": [
"Trusted owner launcher must launch admitted exact pinned child/wrapper/envelope over separately founder-admitted captured SSH peer/profile. Marker synchronizes readiness and does not authenticate authority or peer.",
"Exclusive same-UID private directory custody and no concurrent writer required. Stat/unlink is non-atomic; copied credentials may remain and no zeroization/remote cleanup is established.",
"Unsigned JWT decoded claims are shape checks only; issuer/client/agent admission remains owner/founder decision.",
"Unknown partial delivery remains sticky after local transport teardown. Native remote cleanup/acceptance requires separate owner evidence."
],
"native_executed": false,
"credentials_read": false,
"actual_ssh_executed": false,
"native_or_transport_admitted": false,
"founder_go_granted": false,
"task_closure_inferred": false
}

89
docs/reviews/2026-10-11-key39-ready-v9-net-review.json Normal file
View file

@ -0,0 +1,89 @@
{
"reviewer": "net-kingdom-owner (agent net-kingdom, codex)",
"decision": "approved",
"review_id": "NK-REVIEW-20261011-KEY39-READY-PROTOCOL-SOURCE",
"work_item_id": "NK-WP-ADHOC-2026-10-11-T07",
"reviewed_manifest_sha256": "84542ddcff00932fc7ce22dcb2626be8942a3c006c5098a62fdd6b2478d0cd14",
"reviewed_proposal_id": "KEY-WP-0039-T02/attended-lifecycle-v9-ready-input",
"reviewed_source_hashes": {
"sso-mfa/k8s/keycape/openbao-negative-session.py": "24b7b803e4eb7e6e7c0700a069dad0ec315ee7eb5538a88b9e56147f8fab5cdd",
"sso-mfa/k8s/keycape/test_openbao_negative_session.py": "01e23f2b4fc77824a161a57acb3a52d19aad846b3b6c0fd3abd81afa1dc2985c",
"sso-mfa/k8s/keycape/test_openbao_node_route.py": "1c57053be6e8472174e4034fdfbf34b3e1729f5e239b3a9af89d9e59a08d6cb6",
"sso-mfa/k8s/keycape/openbao-negative-node-route.md": "cad3e3dc481d45295cc014e48285e81614911dfb4a10523883f3044f6085f363",
"sso-mfa/k8s/keycape/test_openbao_private_input.py": "84277edb5bd7858885173dea802b6bdc4f0f0c7785d6e200ee9a98d8553891a1",
"sso-mfa/k8s/keycape/openbao-negative-node-wrapper.py": "76ac013d1a676a0dfa58aea1ce87b0c3e72483ccd21f586a22c5475e9132f6c1",
"sso-mfa/k8s/keycape/test_openbao_private_ready.py": "8a7a033b1c509ba21397d1d74580c44f24592045b2b9de50fe87638607224277"
},
"previous_review_sha256": "b2711c8ff72724751f9c10ce199fa3564b7893aa4c0377df0d3d1611d0a97eda",
"comment": "NetKingdom INTENT Principles 6/7 require bounded exposure and explicit owner responsibility. Exact v9 ready child/node-wrapper manifest 84542ddcff00932fc7ce22dcb2626be8942a3c006c5098a62fdd6b2478d0cd14 prepared/reviewed under completed same-trial NK-WP-ADHOC-2026-10-11-T07. Authored owner source agreement for concrete private synchronization and bounded relay. Raw marker or approval JSON is not authenticated authority/peer proof; exact trusted owner launcher/SSH source context and independent KeyCape/Platform reviews are prerequisites. No native, credential, launcher/transport admission or KEY39 closure inferred.",
"findings": [],
"validation": {
"supplied_lifecycle_tests": 46,
"retained_node_route_actual_main_tests": 12,
"retained_private_receive_tests": 7,
"new_ready_wrapper_tests": 9,
"retained_independent_tests": 21,
"unchanged_runner_tests_previously_verified": 17,
"all_passed": true,
"synthetic_offline_only": true,
"ready_protocol_checks": [
"Distinct local writable pipe, marker exact keys/nonce/executor/envelope/health/window pins and child EOF",
"Actual duplicate stdout pipe alias refusal before marker",
"Wrong nonce/envelope pin produces no ready",
"Actual full pipe write interrupted at original remaining action deadline with signal restoration",
"Actual main health then marker received before first private read; no missing-ack private read",
"Wrapper validates all exact marker fields and typed bounded window; changed/extra fields refuse",
"Incomplete private local ready pipe without EOF interrupted under total bound",
"Wrapper mocked child launch uses local pass_fds and inherited private stdin, no SSH FD forwarding or token copy"
],
"retained_main_test_adaptation": "Existing input-only sequencing/receive tests stub the new ready emitter; new ready tests exercise actual pipe emission and main ordering separately.",
"native_readiness": false,
"compatible_producer_exact_review_pending": true,
"source_original_baseline": "Current published v8, with original v5 and v6/v7/v8 frozen provenance retained"
},
"coverage": [
"Workstation bridge configuration routing metadata and actual -L implementation distinguish node/workstation listener",
"No node Pod DNS assumption; bounded founder foreground node-local gateway Service port-forward proposal and process-specific teardown",
"Public unauth GET only; strict active initialized/unsealed body and digest-only cluster identity evidence",
"Execute initial route refusal before native/Secret access; repeated route loss after dry-runs before first mutation",
"Separate recovery route gate before native/Secret reads; health identity must match exact envelope pin",
"No auth headers, private stdin or Kubernetes in public route-preflight mode; current-process diagnostic does not attest node placement",
"HTTP health shares all existing no-proxy/no-redirect/byte/total-timer/abort guards; slow-health real timer refusal",
"All earlier CAS/deadline/deletion/recovery/known-revoke/unknown-outcome regressions remain",
"Actual main failure tests, not only execute-function mocks: unavailable route and missing health pin prevent stdin.read; recover also consumes no stdin",
"Actual main success ordering verifies health before stdin before execution; original pre-input monotonic window is preserved",
"Source/role/authority revalidation follows private input; expired original monotonic window refuses before runner/native access",
"Actual main binary receive cap 65536 bytes, sized chunk reads and explicit EOF; exact two-token object with per-token UTF-8 byte limits",
"Linux main-thread total receive timer at most 15 seconds clipped to original wall and monotonic remaining budget; no renewal",
"Actual local pipe stalled/no EOF and complete JSON/no EOF regressions; fixed oversized/invalid/late failures before execution",
"Producer-side missing exact-child ready handshake retained as separate explicit native prerequisite; exporter write timeout is not treated as consumer read bound",
"Concrete required local child-ready FD/nonce/approved raw envelope pin before any private stdin read; aliases of all stdio endpoint identities rejected",
"Exact newline marker schema with public source/envelope/health/action-window bindings; hard emission/receive bounds and original action deadline preserved",
"Node-local wrapper constructs its own pipe and pinned Python child, validates ready under one preparation bound, forwards control line only, captures/refuses child output, performs bounded termination/capture-close cleanup",
"No SSH FD forwarding, token stdin read/copy, raw marker authority, raw credential output or warden silent-lane compatibility claimed",
"Independent KeyCape exporter/launcher coordination: newline control framing, no EOF wait on still-open SSHstdout, original producer budget only clips/no reset, no token-file access or delivery before valid exact ready"
],
"native_prerequisites": [
"Fresh exact source-reviewed KeyCape launcher/adapter matching ready schema/source/nonce/envelope/health/window, owning admitted captured SSH peer/profile before accepting marker and before any token-file read or write",
"Fresh exact source reviews by Platform and KeyCape",
"Founder exact source/runtime/route/window/cleanup decision",
"Actual same-node route preflight with owner-admitted route and independently confirmed provider identity",
"Exact envelope bao_health_identity_sha256 from current founder preflight; fresh owner role/policy/leeway observation",
"Admitted private human/coding-agent token producer remains separate gap",
"Current headroom/quiet window and actual native negative/revoke/restoration/cleanup acceptance"
],
"authority_boundary": {
"source_preparation_only": true,
"native_actions": false,
"tunnel_opened": false,
"node_reachability_observed": false,
"owner_checkout_writes": false,
"credential_access": false,
"secret_reads": false,
"foreign_reviews": false,
"founder_approval": false,
"KEY39_task_closure": false
},
"work_record_anchor_sha256": "f294f1cf152dd797b913f0f31a5b3f7939fa67de9871580b977c74001c40d168",
"retained_correction_history": "V8 receive bounds remain; producer v1 lacks consumer acknowledgment and fails stdio/race claims. Concrete v9 child/wrapper synchronization is a same-trial refinement; compatible KeyCape producer exact source review/admission remains separate. Earlier reviews/stages are unchanged."
}

9
docs/reviews/2026-10-11-key39-ready-v9-net-work-record.json Normal file
View file

@ -0,0 +1,9 @@
{
"repo": "net-kingdom",
"work_item_id": "NK-WP-ADHOC-2026-10-11-T07",
"original_path": "/home/worsch/net-kingdom/workplans/ADHOC-2026-10-11.md",
"original_sha256": "6300d9d47a59a830dd32c4106441771f7227f094f351956502dbff11507b19bb",
"staged_path": "/tmp/keycape-jwt-ready-v9-stage/net-kingdom/workplans/ADHOC-2026-10-11.md",
"staged_sha256": "90d34dd5520f998c269529c53de4ebb065328d3f6d8ae79cbb215b19344b1cf7",
"same_trial": true
}