From 98f09f4d4b0cee3d58ac756591c849467a22340e Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 11 Oct 2026 14:21:04 +0200 Subject: [PATCH] Record independent KEY39 lifecycle deadline review Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade --- ...-key39-lifecycle-v2-netkingdom-review.json | 73 +++++++++++++++++++ workplans/ADHOC-2026-10-11.md | 20 +++++ 2 files changed, 93 insertions(+) create mode 100644 docs/reviews/2026-10-11-key39-lifecycle-v2-netkingdom-review.json diff --git a/docs/reviews/2026-10-11-key39-lifecycle-v2-netkingdom-review.json b/docs/reviews/2026-10-11-key39-lifecycle-v2-netkingdom-review.json new file mode 100644 index 0000000..b4549a1 --- /dev/null +++ b/docs/reviews/2026-10-11-key39-lifecycle-v2-netkingdom-review.json @@ -0,0 +1,73 @@ +{ + "reviewer": "net-kingdom-owner (agent net-kingdom, codex)", + "decision": "changes_requested", + "review_id": "NK-REVIEW-20261011-KEY39-LIFECYCLE-V2", + "work_item_id": "NK-WP-ADHOC-2026-10-11-T07", + "reviewed_proposal_id": "KEY-WP-0039-T02/attended-lifecycle-v2", + "reviewed_manifest_sha256": "6fc0fe47f99a97c11c6e7538f5ea02054335df7d46055d3f84bed4e194aeaaed", + "reviewed_source_hashes": { + "sso-mfa/k8s/keycape/openbao-negative-session.py": "9b19909090431194a4e868ba10eeb911fe4dcc5bf006c2f4351beb115ac39750", + "sso-mfa/k8s/keycape/test_openbao_negative_session.py": "1ada5bd2ac5f8595de3c5b51dfb00e5e6d53ec9354b41983c308aa5ae5648b5a" + }, + "reviewed_runner_sha256": "bb9610babf44a959342bac700bb5712e97f400b44c4d0659d21df4426e616e19", + "comment": "NetKingdom INTENT Taxonomy declaration, Principles 6/7 (minimize exposure and owner responsibility), and SECURITY-COMPANION sections 3/7 require time-bounded task authority and reconstructable owner-held execution. Exact frozen v2 manifest 6fc0fe47f99a97c11c6e7538f5ea02054335df7d46055d3f84bed4e194aeaaed reviewed under completed own work item NK-WP-ADHOC-2026-10-11-T07. Source agreement withheld for the two reproduced deadline gaps below. No foreign owner role or founder approval is supplied.", + "findings": [ + { + "id": "NK-KEY39-V2-F01", + "severity": "medium", + "location": "openbao-negative-session.py:verify_sources/check_deadline", + "counterexample": "valid_until_epoch=Infinity survives json.loads and verify_sources; check_deadline permits requests even at epoch 10**30.", + "impact": "The approval expiry can be disabled and the same purportedly time-bounded envelope remains reusable indefinitely. Monotonic per-execution reserve does not bound lifetime or replay of the envelope.", + "requested_change": "Require finite, non-boolean numeric approval expiry and observation timestamps before comparisons; reject JSON nonfinite constants or validate the fields explicitly. Preserve separate recovery approval and add refusal tests." + }, + { + "id": "NK-KEY39-V2-F02", + "severity": "medium", + "location": "openbao-negative-session.py:SessionTransport.request", + "counterexample": "Offline response starts before deadline then advances clock beyond expiry during read; request returns status 200 without refusal. urllib timeout is socket inactivity, not a total request/read duration, so a bounded-size slow-trickle response can also exceed maximum_session_seconds.", + "impact": "An in-flight protected exchange/login can remain active beyond approved wall-clock and monotonic session bounds. A byte cap plus an inactivity timeout cannot establish bounded HTTP elapsed duration.", + "requested_change": "Enforce a total monotonic HTTP duration cap across connect, headers and body reads, clipped to remaining protected-action window; retain a finite explicit cleanup/revoke request cap after action expiry. Recheck expiry after protected response completion and add slow-response/late-completion refusals." + } + ], + "independent_coverage": [ + "Exact manifest/executor/test/runner pins independently verified; originals unchanged", + "CAS patch tests require UID and resourceVersion; both dry runs and baseline UID/spec/config pins inspected", + "Six temporary registrations/env refs and separate Secret with no production credential replacement inspected; single replica Recreate causes two intended restarts", + "Captured subprocess stdout/stderr, fixed refusal messages, private stdin, value-free receipts and exclusive receipt creation inspected; synthetic raw error suppression verified", + "Normal cleanup refuses concurrent config/spec drift, restores baseline/readback, proves precise removed-client denial then UID/resourceVersion-precondition delete", + "Hard-interruption recovery requires separate recovery-approved envelope, reconstructs exact registry/spec baseline, refuses partial registrations/env and baseline drift; uncertain creation UID needs independent owner acknowledgement; issued OpenBao sessions require separate reconciliation", + "Fixed token/discovery/login/revoke allowlist, no ambient proxy/redirect, response close and byte bound inspected; unreviewed paths/methods refuse", + "Future/stale role observations now refuse; monotonic probe cleanup reserve inspected; two residual deadline counterexamples reproduced" + ], + "validation": [ + { + "name": "supplied", + "returncode": 0, + "tests": 28 + }, + { + "name": "independent", + "returncode": 0, + "tests": 11 + } + ], + "orientation": { + "emergent_security_version": "0.2.6", + "package_digest": "8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02", + "status": "withheld; reviewed current NetKingdom SECURITY-COMPANION source directly", + "supervision": "custodian-codex record descriptive only; no grant inherited for net-kingdom scope" + }, + "authority_boundary": { + "source_preparation_only": true, + "native_actions": false, + "owner_checkout_writes": false, + "credential_access": false, + "secret_reads": false, + "db_access": false, + "foreign_reviews": false, + "founder_approval": false, + "native_acceptance": false, + "task_closure_KEY39": false + }, + "work_record_anchor_sha256": "635de289061708ec4c097eb6a0f14b1dc6125fc0dcd5a323363df1ba28ed2fd5" +} diff --git a/workplans/ADHOC-2026-10-11.md b/workplans/ADHOC-2026-10-11.md index 19f1085..c7edd75 100644 --- a/workplans/ADHOC-2026-10-11.md +++ b/workplans/ADHOC-2026-10-11.md @@ -176,3 +176,23 @@ and executionfalse. Canonical/acknowledgment hashes verified unchanged; source loader selection confers no case admission, native adapter/global verifier, materialization, grant or implemented status. Existing NK0048-T06 remains wait. No new source-ack trial or broad implementation plan is created. + +## Independently review the frozen KEY39 lifecycle v2 source + +```task +id: NK-WP-ADHOC-2026-10-11-T07 +status: done +priority: high +``` + +Completed NetKingdom-only offline source-owner review preparation of exact +KEY-WP-0039-T02/attended-lifecycle-v2 manifest +6fc0fe47f99a97c11c6e7538f5ea02054335df7d46055d3f84bed4e194aeaaed. +The source and tests, runtime CAS, temporary registration/env/Secret isolation, +two single-replica Recreate restarts, captured output, normal cleanup and separate +hard-interruption recovery were inspected against NetKingdom INTENT. +Supplied tests and independent synthetic refusal checks are retained with the +formal owner review under the temporary source-review stage. This completed +local review task is distinct from KEY39 T02 and all native owner obligations. +No founder decision, deployment, credential access, Secret read, grant, live +acceptance or task closure in other repositories is claimed.