Publish reviewed KEY39 lifecycle source and preserve failed review history
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
parent
98f09f4d4b
commit
dfc357eb8a
6 changed files with 1540 additions and 0 deletions
|
|
@ -0,0 +1,53 @@
|
|||
{
|
||||
"reviewer": "net-kingdom-owner (agent net-kingdom, codex)",
|
||||
"decision": "changes_requested",
|
||||
"review_id": "NK-REVIEW-20261011-KEY39-LIFECYCLE-V3",
|
||||
"work_item_id": "NK-WP-ADHOC-2026-10-11-T07",
|
||||
"reviewed_proposal_id": "KEY-WP-0039-T02/attended-lifecycle-v3",
|
||||
"reviewed_manifest_sha256": "fbc31fda2b6194747547b9fbe876095914c3d53231c79abd43a010dbb3273efa",
|
||||
"reviewed_executor_sha256": "1161b3666ebf1f3eb322c7d5112584bce7e074da7e7650c5840e3c5de9311194",
|
||||
"reviewed_tests_sha256": "75e26a9be4422be539f7e0a4d46c3dd6d8e2eab21d3cb6e4ba03cfe8c7c1b9cd",
|
||||
"reviewed_runner_sha256": "bb9610babf44a959342bac700bb5712e97f400b44c4d0659d21df4426e616e19",
|
||||
"previous_review_sha256": "f7293bc3cc896e23840d767bf86bd379f202a665f6a334485081831ad067d262",
|
||||
"comment": "NetKingdom INTENT Taxonomy declaration and Principles 6/7 require bounded exposure with owner-held execution. Same completed work item NK-WP-ADHOC-2026-10-11-T07 independently reviews frozen v3 manifest fbc31fda2b6194747547b9fbe876095914c3d53231c79abd43a010dbb3273efa. V2 findings are resolved, but the new aggregate cleanup bound bypass below needs correction. This is source judgement only, not founder approval.",
|
||||
"v2_findings_status": {
|
||||
"NK-KEY39-V2-F01": "resolved: strict finite nonbool expiry and observation validation, JSON constants refused, expiry limited to maxsession",
|
||||
"NK-KEY39-V2-F02": "resolved: total SIGALRM request guard clips wall and monotonic deadline; postcompletion recheck; known late accepted session revoked privately; unknown partial response retained"
|
||||
},
|
||||
"findings": [
|
||||
{
|
||||
"id": "NK-KEY39-V3-F01",
|
||||
"severity": "medium",
|
||||
"location": "openbao-negative-session.py:delete_temporary",
|
||||
"counterexample": "With CLEANING=True and CLEANUP_MONOTONIC_DEADLINE=time.monotonic()-1, mocked subprocess.run records one Secret DELETE; only subsequent guarded k absence GET raises cleanup_budget_expired.",
|
||||
"impact": "The final native Secret deletion bypasses the promised nonrenewable aggregate cleanup deadline and its remaining-time cap.",
|
||||
"requested_change": "Route the exact UID/resourceVersion-precondition raw DeleteOptions request through guarded k or equivalent precheck/remaining-budget/total-timeout/postcheck. Add expired-budget no-call and near-expiry total-duration regressions."
|
||||
}
|
||||
],
|
||||
"validation": {
|
||||
"supplied_tests": 39,
|
||||
"independent_tests": 15,
|
||||
"all_passed": true,
|
||||
"counterexamples_reproduced": true
|
||||
},
|
||||
"coverage": [
|
||||
"Prior eleven independent checks adapted to v3; v2 counterexamples now rejected",
|
||||
"Real SIGALRM slow-body interruption and signal/timer restoration",
|
||||
"Partial accepted login timeout records only unknown-outcome boolean",
|
||||
"Aggregate cleanup is nonrenewable and guarded k refuses after expiry",
|
||||
"Direct final delete bypass reproduced independently",
|
||||
"CAS/source/runtime pins, temporary registration/environment isolation, output suppression, normal cleanup and hard-interruption recovery inspected unchanged"
|
||||
],
|
||||
"authority_boundary": {
|
||||
"source_preparation_only": true,
|
||||
"native_actions": false,
|
||||
"owner_checkout_writes": false,
|
||||
"credential_access": false,
|
||||
"secret_reads": false,
|
||||
"foreign_reviews": false,
|
||||
"founder_approval": false,
|
||||
"native_acceptance": false,
|
||||
"KEY39_task_closure": false
|
||||
},
|
||||
"work_record_anchor_sha256": "aa56b9cd64301f031cedd3cbd703e1698605fe97b0fee7b9ba45343333ff54f5"
|
||||
}
|
||||
|
|
@ -0,0 +1,64 @@
|
|||
{
|
||||
"reviewer": "net-kingdom-owner (agent net-kingdom, codex)",
|
||||
"decision": "approved",
|
||||
"review_id": "NK-REVIEW-20261011-KEY39-LIFECYCLE-V4",
|
||||
"work_item_id": "NK-WP-ADHOC-2026-10-11-T07",
|
||||
"reviewed_proposal_id": "KEY-WP-0039-T02/attended-lifecycle-v4",
|
||||
"reviewed_manifest_sha256": "d079f85c47d5c2635e1ee633ea4d1346b1737ce2be9ca273f22a38e620f418d8",
|
||||
"reviewed_source_hashes": {
|
||||
"sso-mfa/k8s/keycape/openbao-negative-session.py": "b4687c2d07819c43b45d0cddcad0488b62eb49175b2a06a43f7806a0838d3a4d",
|
||||
"sso-mfa/k8s/keycape/test_openbao_negative_session.py": "ea2b5f7466c1da016f528093daf168c274238d4803eb5424d7353c66adbecf43"
|
||||
},
|
||||
"reviewed_runner_sha256": "bb9610babf44a959342bac700bb5712e97f400b44c4d0659d21df4426e616e19",
|
||||
"previous_review_sha256": "06ac6616e75eb7690836fbce94b30ebecd3a674a3b256118d180ed13c90db3b1",
|
||||
"original_v2_review_sha256": "f7293bc3cc896e23840d767bf86bd379f202a665f6a334485081831ad067d262",
|
||||
"comment": "NetKingdom INTENT Taxonomy declaration, Principles 6/7 and SECURITY-COMPANION sections 3/7 support this bounded owner-held source preparation. Exact frozen v4 manifest d079f85c47d5c2635e1ee633ea4d1346b1737ce2be9ca273f22a38e620f418d8 reviewed under same completed own work item NK-WP-ADHOC-2026-10-11-T07. Technical source agreement: all independently reproduced v2/v3 gaps resolve. This owner source judgement supplies neither human approval nor native execution authority/acceptance and does not close KEY39 T02.",
|
||||
"findings": [],
|
||||
"prior_findings_status": {
|
||||
"NK-KEY39-V2-F01": "resolved: finite nonbool approval and role observation values; integer bounded session; nonfinite JSON constants refused",
|
||||
"NK-KEY39-V2-F02": "resolved: total Linux main-thread SIGALRM bound across connect/headers/body; finite per-request caps clipped to wall and monotonic action deadlines; postcompletion check and bounded late-session revoke",
|
||||
"NK-KEY39-V3-F01": "resolved: final UID/resourceVersion raw DeleteOptions now uses guarded k; expired aggregate issues no delete and slow delete is clipped to remaining time"
|
||||
},
|
||||
"independent_coverage": [
|
||||
"Exact manifest/executor/test/runner pins independently verified; originals unchanged",
|
||||
"CAS patch tests require UID and resourceVersion; both dry runs and baseline UID/spec/config pins inspected",
|
||||
"Six temporary registrations/env refs and separate Secret with no production credential replacement inspected; single replica Recreate causes two intended restarts",
|
||||
"Captured subprocess stdout/stderr, fixed refusal messages, private stdin, value-free receipts and exclusive receipt creation inspected; synthetic raw error suppression verified",
|
||||
"Normal cleanup refuses concurrent config/spec drift, restores baseline/readback, proves precise removed-client denial then UID/resourceVersion-precondition delete",
|
||||
"Hard-interruption recovery requires separate recovery-approved envelope, reconstructs exact registry/spec baseline, refuses partial registrations/env and baseline drift; uncertain creation UID needs independent owner acknowledgement; issued OpenBao sessions require separate reconciliation",
|
||||
"Fixed token/discovery/login/revoke allowlist, no ambient proxy/redirect, response close and byte bound inspected; unreviewed paths/methods refuse",
|
||||
"Future/stale role observations now refuse; monotonic probe cleanup reserve inspected; two residual deadline counterexamples reproduced",
|
||||
"Real elapsed slow HTTP interruption and SIGALRM timer/handler restoration",
|
||||
"Late full accepted OpenBao session revoked privately then result refused; partial accepted response timeout retains value-free unknown-outcome evidence",
|
||||
"Cleanup aggregate deadline starts once and cannot renew; guarded k refuses after expiry; exact final delete now shares it",
|
||||
"Real elapsed slow deletion clipped to remaining cleanup budget; approved runtime/source pins and precise Secret deletion identity preserved"
|
||||
],
|
||||
"validation": {
|
||||
"supplied_lifecycle_tests": 41,
|
||||
"unchanged_reviewed_runner_tests": 17,
|
||||
"independent_tests": 17,
|
||||
"all_passed": true,
|
||||
"network_used": false,
|
||||
"kubernetes_used": false
|
||||
},
|
||||
"limitations": [
|
||||
"Linux main-thread setitimer required; preexisting timer or worker thread refuses",
|
||||
"Fixture checks establish source behavior only; no native role/policy, headroom, runtime readiness or successful cleanup observed",
|
||||
"Owner-held token producer remains unresolved; no credential route authorized",
|
||||
"Unknown/failed session revocation requires separate owner reconciliation; cleanup alone is not revocation proof",
|
||||
"Founder exact source/runtime/window approval and each independent owner acknowledgment remain necessary before native execution"
|
||||
],
|
||||
"authority_boundary": {
|
||||
"source_preparation_only": true,
|
||||
"native_actions": false,
|
||||
"owner_checkout_writes": false,
|
||||
"credential_access": false,
|
||||
"secret_reads": false,
|
||||
"db_access": false,
|
||||
"foreign_reviews": false,
|
||||
"founder_approval": false,
|
||||
"native_acceptance": false,
|
||||
"KEY39_task_closure": false
|
||||
},
|
||||
"work_record_anchor_sha256": "3650c1eeadd74e150e528766523a284b03d02004749c04e9b6518d42f3e32531"
|
||||
}
|
||||
|
|
@ -0,0 +1,71 @@
|
|||
{
|
||||
"reviewer": "net-kingdom-owner (agent net-kingdom, codex)",
|
||||
"decision": "approved",
|
||||
"review_id": "NK-REVIEW-20261011-KEY39-LIFECYCLE-V5",
|
||||
"work_item_id": "NK-WP-ADHOC-2026-10-11-T07",
|
||||
"reviewed_proposal_id": "KEY-WP-0039-T02/attended-lifecycle-v5",
|
||||
"reviewed_manifest_sha256": "d1f997624db46693a7126a6eb6435f6b3a353d5bd67dcc8a539683e4b7147285",
|
||||
"reviewed_source_hashes": {
|
||||
"sso-mfa/k8s/keycape/openbao-negative-session.py": "3bcceebc845b17492040c76223d77088257c547a2b890198e7b5c2b04a0cd360",
|
||||
"sso-mfa/k8s/keycape/test_openbao_negative_session.py": "a428a4a5ea60bd6c4ad10481e133227ad696a4a08653bf39b554b47431fb9f8c"
|
||||
},
|
||||
"reviewed_runner_sha256": "bb9610babf44a959342bac700bb5712e97f400b44c4d0659d21df4426e616e19",
|
||||
"previous_review_sha256": "4f4498203a31bd46dbc3715c0df1cbb9eee63bed5b2c1baf430ff3c4a37c13cb",
|
||||
"original_v2_review_sha256": "f7293bc3cc896e23840d767bf86bd379f202a665f6a334485081831ad067d262",
|
||||
"comment": "NetKingdom INTENT Taxonomy declaration, Principles 6/7 and SECURITY-COMPANION sections 3/7 support bounded owner-held source preparation. Exact frozen v5 manifest d1f997624db46693a7126a6eb6435f6b3a353d5bd67dcc8a539683e4b7147285 reviewed under same completed own work item NK-WP-ADHOC-2026-10-11-T07. Technical source agreement includes bounded exceptional HTTP response cleanup and preserves all earlier failed/revised owner evidence. This owner judgement supplies neither human approval nor native execution authority/acceptance and does not close KEY39 T02.",
|
||||
"findings": [],
|
||||
"prior_findings_status": {
|
||||
"NK-KEY39-V2-F01": "resolved: finite nonbool approval and role observation values; integer bounded session; nonfinite JSON constants refused",
|
||||
"NK-KEY39-V2-F02": "resolved: total Linux main-thread SIGALRM bound across connect/headers/body; finite per-request caps clipped to wall and monotonic action deadlines; postcompletion check and bounded late-session revoke",
|
||||
"NK-KEY39-V3-F01": "resolved: final UID/resourceVersion raw DeleteOptions now uses guarded k; expired aggregate issues no delete and slow delete is clipped to remaining time",
|
||||
"Platform-v4-exceptional-close": "resolved in exact v5: normal close remains within request timer; one exceptional close uses at most 20 ms clipped to positive original remainder and finite nonrenewable cleanup remainder; expired cleanup performs no close; abort failure remains unconfirmed, never successful proof"
|
||||
},
|
||||
"independent_coverage": [
|
||||
"Exact manifest/executor/test/runner pins independently verified; originals unchanged",
|
||||
"CAS patch tests require UID and resourceVersion; both dry runs and baseline UID/spec/config pins inspected",
|
||||
"Six temporary registrations/env refs and separate Secret with no production credential replacement inspected; single replica Recreate causes two intended restarts",
|
||||
"Captured subprocess stdout/stderr, fixed refusal messages, private stdin, value-free receipts and exclusive receipt creation inspected; synthetic raw error suppression verified",
|
||||
"Normal cleanup refuses concurrent config/spec drift, restores baseline/readback, proves precise removed-client denial then UID/resourceVersion-precondition delete",
|
||||
"Hard-interruption recovery requires separate recovery-approved envelope, reconstructs exact registry/spec baseline, refuses partial registrations/env and baseline drift; uncertain creation UID needs independent owner acknowledgement; issued OpenBao sessions require separate reconciliation",
|
||||
"Fixed token/discovery/login/revoke allowlist, no ambient proxy/redirect, response close and byte bound inspected; unreviewed paths/methods refuse",
|
||||
"Future/stale role observations now refuse; monotonic probe cleanup reserve inspected; two residual deadline counterexamples reproduced",
|
||||
"Real elapsed slow HTTP interruption and SIGALRM timer/handler restoration",
|
||||
"Late full accepted OpenBao session revoked privately then result refused; partial accepted response timeout retains value-free unknown-outcome evidence",
|
||||
"Cleanup aggregate deadline starts once and cannot renew; guarded k refuses after expiry; exact final delete now shares it",
|
||||
"Real elapsed slow deletion clipped to remaining cleanup budget; approved runtime/source pins and precise Secret deletion identity preserved",
|
||||
"Independent early RuntimeError read plus slow exceptional close; fixed error and no protected text in receipt",
|
||||
"Independent timed-out body plus slow abort cap; real elapsed timer restores handler and timer",
|
||||
"Independent normal-close error on known accepted session; private bounded self-revoke then abort failure",
|
||||
"Independent expired aggregate exceptional-close zero call/no deadline renewal; prior guard suite adapted only for newly added value-free abort receipt booleans"
|
||||
],
|
||||
"validation": {
|
||||
"supplied_lifecycle_tests": 46,
|
||||
"unchanged_reviewed_runner_tests": 17,
|
||||
"independent_tests": 21,
|
||||
"all_passed": true,
|
||||
"network_used": false,
|
||||
"kubernetes_used": false,
|
||||
"review_test_adaptation": "Earlier receipt-equality assertion expected only unknown-outcome flag; v5 legitimately adds abort booleans. Updated assertion verifies those booleans and value-free shape; no source defect inferred."
|
||||
},
|
||||
"limitations": [
|
||||
"Linux main-thread setitimer required; preexisting timer or worker thread refuses",
|
||||
"Fixture checks establish source behavior only; no native role/policy, headroom, runtime readiness or successful cleanup observed",
|
||||
"Owner-held token producer remains unresolved; no credential route authorized",
|
||||
"Unknown/failed session revocation requires separate owner reconciliation; cleanup alone is not revocation proof",
|
||||
"Founder exact source/runtime/window approval and each independent owner acknowledgment remain necessary before native execution"
|
||||
],
|
||||
"authority_boundary": {
|
||||
"source_preparation_only": true,
|
||||
"native_actions": false,
|
||||
"owner_checkout_writes": false,
|
||||
"credential_access": false,
|
||||
"secret_reads": false,
|
||||
"db_access": false,
|
||||
"foreign_reviews": false,
|
||||
"founder_approval": false,
|
||||
"native_acceptance": false,
|
||||
"KEY39_task_closure": false
|
||||
},
|
||||
"work_record_anchor_sha256": "17c1e1a798516509d6ddb4d5c93090910cc6d3dd7b516827abf4fd3031ef80b3",
|
||||
"platform_previous_review_sha256": "c0f9da4850d7b6ce8a41401bfb7cddc39a60cd7bc8767de89d76b5f93198a2d9"
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue