Record published consumer build and refine private input inverse and PDP work

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa

workplans/NK-WP-0048-security-case-types.md

@@ -1788,3 +1788,106 @@ owner boundary resolved; reference-only source does not prove it. Native go,
 deployment and independent browser/group/revocation observations remain existing
 T06/T16 and owner gates. No credentials, image deployment or new kernel step
 is authorized by this task.
+
+
+## T40 — Publish the independently reviewed full consumer build path
+
+```task
+id: NK-WP-0048-T40
+status: done
+depends_on: [NK-WP-0048-T38]
+priority: high
+state_hub_task_id: "7cc93671-fe94-5108-a486-1b0029e69487"
+```
+
+Completed 2026-10-18, release source/tooling outcome extracted from T39.
+Apps RAPPS-WP-0016-T06 owns the pinned official-source/frontend/bindata/static
+binary/OCI recipe. The original profile produced identical complete binaries and
+local OCI archives. Independent review rehashed those artifacts, re-extracted all
+2,234 embedded files and found a host process argv visibility defect through
+/proc. The corrected recipe adds a private PID namespace; a synthetic unrelated
+process canary is visible with r1 and denied with exact r2. Existing full builds
+are historical r1-profile evidence, not an executed full r2 build claim.
+
+Canonical Apps source c29408ae contains the six reviewed build paths plus its
+work-record refinement; the normal owner projection receipt is in Custodian
+apps-release-source-integration-r1. Exact candidate patch sha256:b7ad8f8fd908532800f4e7eb0f7ad85d77e21a0b729cb5115ade3d5fe3e4acd8
+and review sha256:6f016d53a7ec9ece2f9da9686e76127c52d17066f2b3d371628832ac9537ac5c
+are retained with original changes-required review and harness refinements.
+No image/default values, registry publication, formal owner assent or native
+acceptance changed. T39 retains integrated successor package/image provenance,
+architecture/owner dispositions and bounded deployment/inverse readiness.
+
+## T41 — Integrate the real private-input CLI and chart revision
+
+```task
+id: NK-WP-0048-T41
+status: progress
+depends_on: [NK-WP-0048-T38]
+priority: high
+state_hub_task_id: "6edf049f-2c52-5040-8d38-0bb1bc78fa31"
+```
+
+Owner: Apps RAPPS-WP-0016-T07. Current public-source implementation adds actual
+Forgejo add/update --secret-file and adapts the exact chart helper plus fixed
+CLIENT_SECRET read-only subPath reference. Next: independently review the exact
+candidate, including real CLI/SQLite update preservation and refusals, descriptor
+file replacement/permissions and actual Helm command/mount rendering. Preserve
+legacy and three-group semantics and the current custody route/key. Custody,
+mount/reader/version admission and rotation/restart remain runtime obligations;
+no agent or public receipt receives the value. Re-freeze the accepted software/
+chart/type/package only after review; T06 native proof remains separate.
+Evidence under Custodian forgejo-private-input-r1; do not substitute a path flag
+without suppressing the chart's legacy secret argument.
+
+## T42 — Integrate the actual durable application-source transaction and inverse
+
+```task
+id: NK-WP-0048-T42
+status: progress
+priority: high
+state_hub_task_id: "3d1b9128-bade-5bd9-8660-22a14eea2d37"
+```
+
+Owner: Apps RAPPS-WP-0016-T08; retained umbrella T34. Actual Forgejo model-layer
+work compares complete raw persisted state privately and records intent/outcome
+in the same DB transaction. SQLite write transactions and PostgreSQL table locks
+must exclude competing DB writes; unsupported databases refuse. Tests include
+real SQLite competing connections and process crash/restart. Fixed SQL-error,
+slow-query and trace diagnostics must not leak private journal arguments.
+
+Next: independently review exact primitive/schema/logging/recovery code, then
+bind it through authenticated current operation/inverse sessions and admitted
+evidence/release serialization. The DB primitive itself grants no authority and
+is not a complete operation backend. Its private journal introduces credential
+copies in the owner's DB: track reader custody, capacity, retention and recovery;
+never erase uncertainty or downgrade while a linked source prevents safe removal.
+All application/Helm writers and current provider state remain T34 obligations.
+Evidence under Custodian apps-operation-backend-r1; no private production DB read.
+
+## T43 — Bind the consumer and protected operations to the actual single PDP
+
+```task
+id: NK-WP-0048-T43
+status: progress
+priority: high
+state_hub_task_id: "ac77b046-1226-5e5a-a212-512cb4fdc484"
+```
+
+Owners: Access Engine for producer adapter/policy; Apps RAPPS-WP-0016-T09 for
+consumer enforcement; retained umbrella T37. Next: implement and independently
+review the producer-owned standalone Go adapter using exact pinned API/signing
+source, current authenticated request/policy/registry/caller bindings and bounded
+nonce/lifetime checks. The actual provider must validate issuer JWT signatures,
+algorithm/audience/type/lifetime and retain a trusted identity snapshot separate
+from mutable UserInfo groups/claims before calling the PDP. Do not treat decoded
+Goth RawData as verified identity or let UserInfo overwrite issuer/tenant/assurance.
+Any producer numeric-decoding fix needs actual producer/consumer parity tests.
+
+Keep the accepted three-group any-of set as PDP policy input; do not invent an
+issuer verdict or allow a local compatibility gate to replace the PDP. A callback
+check proves login only: actual HTTP/API/Git/SSH resource/action and session/
+revocation coverage must match the final application profile. No source adapter,
+synthetic key, stale cached decision or Boolean callback constitutes authority.
+Evidence under Custodian apps-access-engine-integration-r1; live source/key/caller/
+policy admission and full profile acceptance remain open under T06/T16/T37.