Record independent KEY39 lifecycle deadline review
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
parent
bb9b9b556c
commit
98f09f4d4b
2 changed files with 93 additions and 0 deletions
|
|
@ -0,0 +1,73 @@
|
|||
{
|
||||
"reviewer": "net-kingdom-owner (agent net-kingdom, codex)",
|
||||
"decision": "changes_requested",
|
||||
"review_id": "NK-REVIEW-20261011-KEY39-LIFECYCLE-V2",
|
||||
"work_item_id": "NK-WP-ADHOC-2026-10-11-T07",
|
||||
"reviewed_proposal_id": "KEY-WP-0039-T02/attended-lifecycle-v2",
|
||||
"reviewed_manifest_sha256": "6fc0fe47f99a97c11c6e7538f5ea02054335df7d46055d3f84bed4e194aeaaed",
|
||||
"reviewed_source_hashes": {
|
||||
"sso-mfa/k8s/keycape/openbao-negative-session.py": "9b19909090431194a4e868ba10eeb911fe4dcc5bf006c2f4351beb115ac39750",
|
||||
"sso-mfa/k8s/keycape/test_openbao_negative_session.py": "1ada5bd2ac5f8595de3c5b51dfb00e5e6d53ec9354b41983c308aa5ae5648b5a"
|
||||
},
|
||||
"reviewed_runner_sha256": "bb9610babf44a959342bac700bb5712e97f400b44c4d0659d21df4426e616e19",
|
||||
"comment": "NetKingdom INTENT Taxonomy declaration, Principles 6/7 (minimize exposure and owner responsibility), and SECURITY-COMPANION sections 3/7 require time-bounded task authority and reconstructable owner-held execution. Exact frozen v2 manifest 6fc0fe47f99a97c11c6e7538f5ea02054335df7d46055d3f84bed4e194aeaaed reviewed under completed own work item NK-WP-ADHOC-2026-10-11-T07. Source agreement withheld for the two reproduced deadline gaps below. No foreign owner role or founder approval is supplied.",
|
||||
"findings": [
|
||||
{
|
||||
"id": "NK-KEY39-V2-F01",
|
||||
"severity": "medium",
|
||||
"location": "openbao-negative-session.py:verify_sources/check_deadline",
|
||||
"counterexample": "valid_until_epoch=Infinity survives json.loads and verify_sources; check_deadline permits requests even at epoch 10**30.",
|
||||
"impact": "The approval expiry can be disabled and the same purportedly time-bounded envelope remains reusable indefinitely. Monotonic per-execution reserve does not bound lifetime or replay of the envelope.",
|
||||
"requested_change": "Require finite, non-boolean numeric approval expiry and observation timestamps before comparisons; reject JSON nonfinite constants or validate the fields explicitly. Preserve separate recovery approval and add refusal tests."
|
||||
},
|
||||
{
|
||||
"id": "NK-KEY39-V2-F02",
|
||||
"severity": "medium",
|
||||
"location": "openbao-negative-session.py:SessionTransport.request",
|
||||
"counterexample": "Offline response starts before deadline then advances clock beyond expiry during read; request returns status 200 without refusal. urllib timeout is socket inactivity, not a total request/read duration, so a bounded-size slow-trickle response can also exceed maximum_session_seconds.",
|
||||
"impact": "An in-flight protected exchange/login can remain active beyond approved wall-clock and monotonic session bounds. A byte cap plus an inactivity timeout cannot establish bounded HTTP elapsed duration.",
|
||||
"requested_change": "Enforce a total monotonic HTTP duration cap across connect, headers and body reads, clipped to remaining protected-action window; retain a finite explicit cleanup/revoke request cap after action expiry. Recheck expiry after protected response completion and add slow-response/late-completion refusals."
|
||||
}
|
||||
],
|
||||
"independent_coverage": [
|
||||
"Exact manifest/executor/test/runner pins independently verified; originals unchanged",
|
||||
"CAS patch tests require UID and resourceVersion; both dry runs and baseline UID/spec/config pins inspected",
|
||||
"Six temporary registrations/env refs and separate Secret with no production credential replacement inspected; single replica Recreate causes two intended restarts",
|
||||
"Captured subprocess stdout/stderr, fixed refusal messages, private stdin, value-free receipts and exclusive receipt creation inspected; synthetic raw error suppression verified",
|
||||
"Normal cleanup refuses concurrent config/spec drift, restores baseline/readback, proves precise removed-client denial then UID/resourceVersion-precondition delete",
|
||||
"Hard-interruption recovery requires separate recovery-approved envelope, reconstructs exact registry/spec baseline, refuses partial registrations/env and baseline drift; uncertain creation UID needs independent owner acknowledgement; issued OpenBao sessions require separate reconciliation",
|
||||
"Fixed token/discovery/login/revoke allowlist, no ambient proxy/redirect, response close and byte bound inspected; unreviewed paths/methods refuse",
|
||||
"Future/stale role observations now refuse; monotonic probe cleanup reserve inspected; two residual deadline counterexamples reproduced"
|
||||
],
|
||||
"validation": [
|
||||
{
|
||||
"name": "supplied",
|
||||
"returncode": 0,
|
||||
"tests": 28
|
||||
},
|
||||
{
|
||||
"name": "independent",
|
||||
"returncode": 0,
|
||||
"tests": 11
|
||||
}
|
||||
],
|
||||
"orientation": {
|
||||
"emergent_security_version": "0.2.6",
|
||||
"package_digest": "8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02",
|
||||
"status": "withheld; reviewed current NetKingdom SECURITY-COMPANION source directly",
|
||||
"supervision": "custodian-codex record descriptive only; no grant inherited for net-kingdom scope"
|
||||
},
|
||||
"authority_boundary": {
|
||||
"source_preparation_only": true,
|
||||
"native_actions": false,
|
||||
"owner_checkout_writes": false,
|
||||
"credential_access": false,
|
||||
"secret_reads": false,
|
||||
"db_access": false,
|
||||
"foreign_reviews": false,
|
||||
"founder_approval": false,
|
||||
"native_acceptance": false,
|
||||
"task_closure_KEY39": false
|
||||
},
|
||||
"work_record_anchor_sha256": "635de289061708ec4c097eb6a0f14b1dc6125fc0dcd5a323363df1ba28ed2fd5"
|
||||
}
|
||||
|
|
@ -176,3 +176,23 @@ and executionfalse. Canonical/acknowledgment hashes verified unchanged; source
|
|||
loader selection confers no case admission, native adapter/global verifier,
|
||||
materialization, grant or implemented status. Existing NK0048-T06 remains wait.
|
||||
No new source-ack trial or broad implementation plan is created.
|
||||
|
||||
## Independently review the frozen KEY39 lifecycle v2 source
|
||||
|
||||
```task
|
||||
id: NK-WP-ADHOC-2026-10-11-T07
|
||||
status: done
|
||||
priority: high
|
||||
```
|
||||
|
||||
Completed NetKingdom-only offline source-owner review preparation of exact
|
||||
KEY-WP-0039-T02/attended-lifecycle-v2 manifest
|
||||
6fc0fe47f99a97c11c6e7538f5ea02054335df7d46055d3f84bed4e194aeaaed.
|
||||
The source and tests, runtime CAS, temporary registration/env/Secret isolation,
|
||||
two single-replica Recreate restarts, captured output, normal cleanup and separate
|
||||
hard-interruption recovery were inspected against NetKingdom INTENT.
|
||||
Supplied tests and independent synthetic refusal checks are retained with the
|
||||
formal owner review under the temporary source-review stage. This completed
|
||||
local review task is distinct from KEY39 T02 and all native owner obligations.
|
||||
No founder decision, deployment, credential access, Secret read, grant, live
|
||||
acceptance or task closure in other repositories is claimed.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue