From e6014dd804965d1a4c816dec4f8f6dbe65ec3c0c Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 17 Oct 2026 08:12:10 +0200 Subject: [PATCH] NK-WP-0048-T30: record composer merge; wait on mint-secret actor decision and owner name confirmation Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 903097@bnt-lap001 Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23 --- workplans/NK-WP-0048-security-case-types.md | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/workplans/NK-WP-0048-security-case-types.md b/workplans/NK-WP-0048-security-case-types.md index 5c8918f..9494276 100644 --- a/workplans/NK-WP-0048-security-case-types.md +++ b/workplans/NK-WP-0048-security-case-types.md @@ -1377,12 +1377,26 @@ stay separate gates and are not supplied by this task. ```task id: NK-WP-0048-T30 -status: todo +status: wait +blocking_reason: "Composer and candidate artifact merged; six of seven descriptors pass Warden decode. mint-secret actor (warden vs kernel human/agent) needs an owner decision, and proposed lanes/schemas/owners need owner confirmation." depends_on: [NK-WP-0048-T24, NK-WP-0048-T25, NK-WP-0048-T26, NK-WP-0048-T27, NK-WP-0048-T28, NK-WP-0048-T29] priority: high state_hub_task_id: "6f6073ac-52dd-5b70-8874-6d76d4c072e4" ``` +2026-10-17 composer merged (60b41a1 via 3c62bec) with follow-up 376b44b (merged; +combined suite 98 passed). `compose-1.2-descriptors.py` loads 1.2 only through an +explicit version root and refuses partial, duplicate, unknown or mismatched maps. +`descriptor-composition-1.2.candidate.json` is a reviewable candidate, marked +`not_an_admission`, with canonical 1.1 unchanged. ensure-groups and hand-over now +carry and honour `parent-session` revocation, and the hand-over owner is +parameterised (`railiance-apps` for Forgejo). Six of the seven steps pass +`Descriptor.decode`. mint-secret is still refused: its actor `warden` is outside +the kernel's human/agent set, and Platform (with ops-warden, if the kernel should +change) must decide. Five steps carry `owner_confirmation_required` names. The +set is complete only after both. Owner review, the canon section 6 successor +revision and admission remain T16's. + 2026-10-17 prerequisites merged (65559ef; combined suite 78 passed): ensure-groups accepts 1.2 via an explicit `version_root='1.2'` (531151b), with 1.1 still the default. bind-env is now a full Warden v1 `Adapter` (7442d21); its