coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0048-T25/T30: mint-secret actor is agent (founder decision); 1.2 set composes
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
This commit is contained in:
tegwick 2026-10-17 08:48:22 +02:00
parent e6014dd804
commit 8b30eef8a5
6 changed files with 33 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

3
sso-mfa/k8s/keycape/compose-1.2-descriptors.py
View file

@ -46,7 +46,8 @@ ADAPTERS = {
# Worker-proposed names (T25-T29) that the type does not fix. Each needs owner
# confirmation before any pin; the artifact marks them owner_confirmation_required.
PROPOSED = {
'mint-secret': {'task': 'NK-WP-0048-T25', 'actor': 'warden',
# Actor 'agent' was decided by the founder on 2026-10-17; only the schema is open.
'mint-secret': {'task': 'NK-WP-0048-T25',
'schema': 'railiance-platform.custody-mint.v1'},
'deliver-secret': {'task': 'NK-WP-0048-T26', 'lane': 'platform-secret-delivery',
'schema': 'netkingdom.deliver-secret.v1'},

25
sso-mfa/k8s/keycape/descriptor-composition-1.2.candidate.json
View file

@ -6,14 +6,22 @@
"unchanged": true
},
"check_config_digest": "sha256:be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5",
"complete_executable_descriptor_set": false,
"complete_executable_descriptor_set": true,
"dispatch_permitted": false,
"execution_descriptors": null,
"execution_descriptors": {
"bind-env": "sha256:55898e15f5851525910f6ee3b2802d9167f0c0dd1bfcf921a81470161773f70a",
"deliver-consumer-secret": "sha256:a74220eddab2709e90e6349b45940f68233c169009cccd0cdeea25a5541774a6",
"deliver-secret": "sha256:1e23b05058a61b3558070805329b6906f0ba9b989b98d9df35c621471a7c4938",
"ensure-groups": "sha256:775dd71d7da43d16437dcdd9cba81ea6eef5803ab74e93c24d4994a764180135",
"hand-over": "sha256:24d1ab891bfccaac1d691245d495ced2571d940d055c5e387076bb57dc68444e",
"mint-secret": "sha256:1fb462d930bae75e35a64bbdefded1e916613f2a630fdecf61885d0e542ea89b",
"register-client": "sha256:3ccc8eed545cf31f8a48feb8afa0c1355e126d9549eef9737d92d0c1b87708a8"
},
"owner_review": false,
"params": {
"consumer_owner_repo": "railiance-apps"
},
"refusal": "mint-secret: descriptor refused by the Warden v1 kernel",
"refusal": null,
"review_requirement": "successor candidate only: new descriptor bytes need a reviewed successor revision under canon section 6 and owner review (NK-WP-0048-T16) before pinning",
"schema": "netkingdom.descriptor-composition-candidate.v1",
"selection": "explicit version root 1.2=security-case-type-revisions/1.2; default root unchanged",
@ -47,11 +55,11 @@
"type_owner": "net-kingdom"
},
{
"candidate_descriptor_digest": "sha256:d33f16653dfa5d226d8cfb82bc5b95f447a3d8ad439d65b9437b1656e1abb875",
"candidate_descriptor_digest": "sha256:1fb462d930bae75e35a64bbdefded1e916613f2a630fdecf61885d0e542ea89b",
"descriptor": {
"actor": "warden",
"actor": "agent",
"adapter": "net-kingdom/keycape-mint-secret@v1",
"adapter_source": "sha256:ede3c2b3edfa453233fc6fd4eb4f713b26240ff38b497d38d63d90b01d797cf4",
"adapter_source": "sha256:b9be1e421f17ae36a2da19699ea86a9368583f9e1f5f089c68a49e315f76bf5c",
"allowed_created": [
"custody-secret-version"
],
@ -67,11 +75,8 @@
"target_parameter": "client_id",
"version": "warden.case.execution.v1"
},
"findings": [
"refused by Warden v1 Descriptor.decode"
],
"findings": [],
"owner_confirmation_required": {
"actor": "warden",
"schema": "railiance-platform.custody-mint.v1",
"task": "NK-WP-0048-T25"
},

2
sso-mfa/k8s/keycape/mint-secret-adapter.py
View file

@ -32,7 +32,7 @@ def source_digest():
def descriptor():
return Descriptor('warden.case.execution.v1', 'mint-secret', 'railiance-platform',
REFERENCE, source_digest(), 'warden', 'keycape-client-secret-generate',
REFERENCE, source_digest(), 'agent', 'keycape-client-secret-generate',
'client_id', 'mint', CREATED, False, ('parent-session', 'broker-grant'))

13
sso-mfa/k8s/keycape/test_compose_1_2_descriptors.py
View file

@ -98,14 +98,15 @@ class ComposeTests(unittest.TestCase):
def test_current_adapters_do_not_compose(self):
# Pins the present source findings; this test must change when they are fixed.
doc = c.artifact(CHECKER, PARAMS)
self.assertFalse(doc['complete_executable_descriptor_set'])
self.assertIsNone(doc['execution_descriptors'])
# Complete in source since mint-secret's actor became 'agent'; still not an admission.
self.assertTrue(doc['complete_executable_descriptor_set'])
self.assertEqual(len(doc['execution_descriptors']), 7)
self.assertIsNone(doc['refusal'])
self.assertFalse(doc['admitted'] or doc['owner_review'] or doc['dispatch_permitted'])
findings = {r['step']: r['findings'] for r in doc['steps']}
# Only mint-secret stays refused: its 'warden' actor is an owner decision.
self.assertEqual({s for s, f in findings.items() if f}, {'mint-secret'})
self.assertEqual(findings['mint-secret'], ['refused by Warden v1 Descriptor.decode'])
self.assertIn('mint-secret', doc['refusal'])
self.assertEqual({s for s, f in findings.items() if f}, set())
mint = next(r for r in doc['steps'] if r['step'] == 'mint-secret')
self.assertEqual(mint['descriptor']['actor'], 'agent')
hand_over = next(r for r in doc['steps'] if r['step'] == 'hand-over')
self.assertEqual(hand_over['descriptor']['owner'], PARAMS['consumer_owner_repo'])
self.assertNotIn('owner', hand_over['owner_confirmation_required'])

2
sso-mfa/k8s/keycape/test_mint_secret_adapter.py
View file

@ -30,7 +30,7 @@ class MintSecretTests(unittest.TestCase):
desc = json.dumps(asdict(a.descriptor()), sort_keys=True, separators=(',', ':')).encode()
pins = Pins(digest(self.case), digest(b'type'), digest(desc), digest(b'catalog'),
digest(b'case-acceptance:test'), digest(b'run sheet'))
self.admitted = Invocation('mint-secret', 'railiance-platform', 'forgejo', 'warden',
self.admitted = Invocation('mint-secret', 'railiance-platform', 'forgejo', 'agent',
'founder', 'keycape-client-secret-generate', pins)
self.run = replace(self.admitted, attempt_id='attempt-one', operation='run')
self.back = replace(self.admitted, attempt_id='attempt-one', operation='rollback')

8
workplans/NK-WP-0048-security-case-types.md
View file

@ -1378,12 +1378,18 @@ stay separate gates and are not supplied by this task.
```task
id: NK-WP-0048-T30
status: wait
blocking_reason: "Composer and candidate artifact merged; six of seven descriptors pass Warden decode. mint-secret actor (warden vs kernel human/agent) needs an owner decision, and proposed lanes/schemas/owners need owner confirmation."
blocking_reason: "Seven-step 1.2 candidate composes completely in source. Waiting on owner confirmation of the proposed lanes and schemas for T25-T29."
depends_on: [NK-WP-0048-T24, NK-WP-0048-T25, NK-WP-0048-T26, NK-WP-0048-T27, NK-WP-0048-T28, NK-WP-0048-T29]
priority: high
state_hub_task_id: "6f6073ac-52dd-5b70-8874-6d76d4c072e4"
```
2026-10-17 founder decision: the mint-secret actor is `agent`, not `warden`.
The kernel is unchanged. The adapter, its test and the composer were updated and
the artifact regenerated; all seven steps pass `Descriptor.decode` and
`complete_executable_descriptor_set` is true (98 tests passed). The artifact
stays `not_an_admission`, with no owner review, admission or dispatch permission.
2026-10-17 composer merged (60b41a1 via 3c62bec) with follow-up 376b44b (merged;
combined suite 98 passed). `compose-1.2-descriptors.py` loads 1.2 only through an
explicit version root and refuses partial, duplicate, unknown or mismatched maps.