From 8b30eef8a58e2a838b8b569cdac6cadf3d55ec61 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 17 Oct 2026 08:48:22 +0200 Subject: [PATCH] NK-WP-0048-T25/T30: mint-secret actor is agent (founder decision); 1.2 set composes Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 903097@bnt-lap001 Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23 --- .../k8s/keycape/compose-1.2-descriptors.py | 3 ++- .../descriptor-composition-1.2.candidate.json | 25 +++++++++++-------- sso-mfa/k8s/keycape/mint-secret-adapter.py | 2 +- .../keycape/test_compose_1_2_descriptors.py | 13 +++++----- .../k8s/keycape/test_mint_secret_adapter.py | 2 +- workplans/NK-WP-0048-security-case-types.md | 8 +++++- 6 files changed, 33 insertions(+), 20 deletions(-) diff --git a/sso-mfa/k8s/keycape/compose-1.2-descriptors.py b/sso-mfa/k8s/keycape/compose-1.2-descriptors.py index 2b2b22f..0bbd036 100644 --- a/sso-mfa/k8s/keycape/compose-1.2-descriptors.py +++ b/sso-mfa/k8s/keycape/compose-1.2-descriptors.py @@ -46,7 +46,8 @@ ADAPTERS = { # Worker-proposed names (T25-T29) that the type does not fix. Each needs owner # confirmation before any pin; the artifact marks them owner_confirmation_required. PROPOSED = { - 'mint-secret': {'task': 'NK-WP-0048-T25', 'actor': 'warden', + # Actor 'agent' was decided by the founder on 2026-10-17; only the schema is open. + 'mint-secret': {'task': 'NK-WP-0048-T25', 'schema': 'railiance-platform.custody-mint.v1'}, 'deliver-secret': {'task': 'NK-WP-0048-T26', 'lane': 'platform-secret-delivery', 'schema': 'netkingdom.deliver-secret.v1'}, diff --git a/sso-mfa/k8s/keycape/descriptor-composition-1.2.candidate.json b/sso-mfa/k8s/keycape/descriptor-composition-1.2.candidate.json index 7074762..3be34b0 100644 --- a/sso-mfa/k8s/keycape/descriptor-composition-1.2.candidate.json +++ b/sso-mfa/k8s/keycape/descriptor-composition-1.2.candidate.json @@ -6,14 +6,22 @@ "unchanged": true }, "check_config_digest": "sha256:be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5", - "complete_executable_descriptor_set": false, + "complete_executable_descriptor_set": true, "dispatch_permitted": false, - "execution_descriptors": null, + "execution_descriptors": { + "bind-env": "sha256:55898e15f5851525910f6ee3b2802d9167f0c0dd1bfcf921a81470161773f70a", + "deliver-consumer-secret": "sha256:a74220eddab2709e90e6349b45940f68233c169009cccd0cdeea25a5541774a6", + "deliver-secret": "sha256:1e23b05058a61b3558070805329b6906f0ba9b989b98d9df35c621471a7c4938", + "ensure-groups": "sha256:775dd71d7da43d16437dcdd9cba81ea6eef5803ab74e93c24d4994a764180135", + "hand-over": "sha256:24d1ab891bfccaac1d691245d495ced2571d940d055c5e387076bb57dc68444e", + "mint-secret": "sha256:1fb462d930bae75e35a64bbdefded1e916613f2a630fdecf61885d0e542ea89b", + "register-client": "sha256:3ccc8eed545cf31f8a48feb8afa0c1355e126d9549eef9737d92d0c1b87708a8" + }, "owner_review": false, "params": { "consumer_owner_repo": "railiance-apps" }, - "refusal": "mint-secret: descriptor refused by the Warden v1 kernel", + "refusal": null, "review_requirement": "successor candidate only: new descriptor bytes need a reviewed successor revision under canon section 6 and owner review (NK-WP-0048-T16) before pinning", "schema": "netkingdom.descriptor-composition-candidate.v1", "selection": "explicit version root 1.2=security-case-type-revisions/1.2; default root unchanged", @@ -47,11 +55,11 @@ "type_owner": "net-kingdom" }, { - "candidate_descriptor_digest": "sha256:d33f16653dfa5d226d8cfb82bc5b95f447a3d8ad439d65b9437b1656e1abb875", + "candidate_descriptor_digest": "sha256:1fb462d930bae75e35a64bbdefded1e916613f2a630fdecf61885d0e542ea89b", "descriptor": { - "actor": "warden", + "actor": "agent", "adapter": "net-kingdom/keycape-mint-secret@v1", - "adapter_source": "sha256:ede3c2b3edfa453233fc6fd4eb4f713b26240ff38b497d38d63d90b01d797cf4", + "adapter_source": "sha256:b9be1e421f17ae36a2da19699ea86a9368583f9e1f5f089c68a49e315f76bf5c", "allowed_created": [ "custody-secret-version" ], @@ -67,11 +75,8 @@ "target_parameter": "client_id", "version": "warden.case.execution.v1" }, - "findings": [ - "refused by Warden v1 Descriptor.decode" - ], + "findings": [], "owner_confirmation_required": { - "actor": "warden", "schema": "railiance-platform.custody-mint.v1", "task": "NK-WP-0048-T25" }, diff --git a/sso-mfa/k8s/keycape/mint-secret-adapter.py b/sso-mfa/k8s/keycape/mint-secret-adapter.py index 25f6115..0141f40 100644 --- a/sso-mfa/k8s/keycape/mint-secret-adapter.py +++ b/sso-mfa/k8s/keycape/mint-secret-adapter.py @@ -32,7 +32,7 @@ def source_digest(): def descriptor(): return Descriptor('warden.case.execution.v1', 'mint-secret', 'railiance-platform', - REFERENCE, source_digest(), 'warden', 'keycape-client-secret-generate', + REFERENCE, source_digest(), 'agent', 'keycape-client-secret-generate', 'client_id', 'mint', CREATED, False, ('parent-session', 'broker-grant')) diff --git a/sso-mfa/k8s/keycape/test_compose_1_2_descriptors.py b/sso-mfa/k8s/keycape/test_compose_1_2_descriptors.py index 8af980b..009add0 100644 --- a/sso-mfa/k8s/keycape/test_compose_1_2_descriptors.py +++ b/sso-mfa/k8s/keycape/test_compose_1_2_descriptors.py @@ -98,14 +98,15 @@ class ComposeTests(unittest.TestCase): def test_current_adapters_do_not_compose(self): # Pins the present source findings; this test must change when they are fixed. doc = c.artifact(CHECKER, PARAMS) - self.assertFalse(doc['complete_executable_descriptor_set']) - self.assertIsNone(doc['execution_descriptors']) + # Complete in source since mint-secret's actor became 'agent'; still not an admission. + self.assertTrue(doc['complete_executable_descriptor_set']) + self.assertEqual(len(doc['execution_descriptors']), 7) + self.assertIsNone(doc['refusal']) self.assertFalse(doc['admitted'] or doc['owner_review'] or doc['dispatch_permitted']) findings = {r['step']: r['findings'] for r in doc['steps']} - # Only mint-secret stays refused: its 'warden' actor is an owner decision. - self.assertEqual({s for s, f in findings.items() if f}, {'mint-secret'}) - self.assertEqual(findings['mint-secret'], ['refused by Warden v1 Descriptor.decode']) - self.assertIn('mint-secret', doc['refusal']) + self.assertEqual({s for s, f in findings.items() if f}, set()) + mint = next(r for r in doc['steps'] if r['step'] == 'mint-secret') + self.assertEqual(mint['descriptor']['actor'], 'agent') hand_over = next(r for r in doc['steps'] if r['step'] == 'hand-over') self.assertEqual(hand_over['descriptor']['owner'], PARAMS['consumer_owner_repo']) self.assertNotIn('owner', hand_over['owner_confirmation_required']) diff --git a/sso-mfa/k8s/keycape/test_mint_secret_adapter.py b/sso-mfa/k8s/keycape/test_mint_secret_adapter.py index c50f78d..f1bd664 100644 --- a/sso-mfa/k8s/keycape/test_mint_secret_adapter.py +++ b/sso-mfa/k8s/keycape/test_mint_secret_adapter.py @@ -30,7 +30,7 @@ class MintSecretTests(unittest.TestCase): desc = json.dumps(asdict(a.descriptor()), sort_keys=True, separators=(',', ':')).encode() pins = Pins(digest(self.case), digest(b'type'), digest(desc), digest(b'catalog'), digest(b'case-acceptance:test'), digest(b'run sheet')) - self.admitted = Invocation('mint-secret', 'railiance-platform', 'forgejo', 'warden', + self.admitted = Invocation('mint-secret', 'railiance-platform', 'forgejo', 'agent', 'founder', 'keycape-client-secret-generate', pins) self.run = replace(self.admitted, attempt_id='attempt-one', operation='run') self.back = replace(self.admitted, attempt_id='attempt-one', operation='rollback') diff --git a/workplans/NK-WP-0048-security-case-types.md b/workplans/NK-WP-0048-security-case-types.md index 9494276..ff1e3f3 100644 --- a/workplans/NK-WP-0048-security-case-types.md +++ b/workplans/NK-WP-0048-security-case-types.md @@ -1378,12 +1378,18 @@ stay separate gates and are not supplied by this task. ```task id: NK-WP-0048-T30 status: wait -blocking_reason: "Composer and candidate artifact merged; six of seven descriptors pass Warden decode. mint-secret actor (warden vs kernel human/agent) needs an owner decision, and proposed lanes/schemas/owners need owner confirmation." +blocking_reason: "Seven-step 1.2 candidate composes completely in source. Waiting on owner confirmation of the proposed lanes and schemas for T25-T29." depends_on: [NK-WP-0048-T24, NK-WP-0048-T25, NK-WP-0048-T26, NK-WP-0048-T27, NK-WP-0048-T28, NK-WP-0048-T29] priority: high state_hub_task_id: "6f6073ac-52dd-5b70-8874-6d76d4c072e4" ``` +2026-10-17 founder decision: the mint-secret actor is `agent`, not `warden`. +The kernel is unchanged. The adapter, its test and the composer were updated and +the artifact regenerated; all seven steps pass `Descriptor.decode` and +`complete_executable_descriptor_set` is true (98 tests passed). The artifact +stays `not_an_admission`, with no owner review, admission or dispatch permission. + 2026-10-17 composer merged (60b41a1 via 3c62bec) with follow-up 376b44b (merged; combined suite 98 passed). `compose-1.2-descriptors.py` loads 1.2 only through an explicit version root and refuses partial, duplicate, unknown or mismatched maps.