From ff8f597d5f2f32ce8e82e370c0ad43aa98dc31b7 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Sat, 17 Oct 2026 11:08:22 +0200
Subject: [PATCH] NK-WP-0048-T30: regenerate 1.2 artifact after r2 fixes;
 record r2 outcome

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
---
 .../descriptor-composition-1.2.candidate.json  | 18 +++++++++---------
 workplans/NK-WP-0048-security-case-types.md    | 11 +++++++++++
 2 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/sso-mfa/k8s/keycape/descriptor-composition-1.2.candidate.json b/sso-mfa/k8s/keycape/descriptor-composition-1.2.candidate.json
index 8b06bb8..0d698bc 100644
--- a/sso-mfa/k8s/keycape/descriptor-composition-1.2.candidate.json
+++ b/sso-mfa/k8s/keycape/descriptor-composition-1.2.candidate.json
@@ -9,12 +9,12 @@
   "complete_executable_descriptor_set": true,
   "dispatch_permitted": false,
   "execution_descriptors": {
-    "bind-env": "sha256:55898e15f5851525910f6ee3b2802d9167f0c0dd1bfcf921a81470161773f70a",
+    "bind-env": "sha256:d2511dce3d2ff1d380f845920aa168e6fe09c0f0c382482a796a5bf13619905d",
     "deliver-consumer-secret": "sha256:a74220eddab2709e90e6349b45940f68233c169009cccd0cdeea25a5541774a6",
-    "deliver-secret": "sha256:1e23b05058a61b3558070805329b6906f0ba9b989b98d9df35c621471a7c4938",
+    "deliver-secret": "sha256:75aaa7346aebdea2a0eb0ba993995515b5248ffefc34caf8e713525e9b58da85",
     "ensure-groups": "sha256:775dd71d7da43d16437dcdd9cba81ea6eef5803ab74e93c24d4994a764180135",
     "hand-over": "sha256:24d1ab891bfccaac1d691245d495ced2571d940d055c5e387076bb57dc68444e",
-    "mint-secret": "sha256:8c40c2884f8ba15e8cb6c98f33419c395e54fce8ef33d6e1a34782cf3f1fcfa9",
+    "mint-secret": "sha256:c92957227235db04953809d92b260d32c8b947472a8e8fd17a258ade3ae8da70",
     "register-client": "sha256:3ccc8eed545cf31f8a48feb8afa0c1355e126d9549eef9737d92d0c1b87708a8"
   },
   "owner_review": false,
@@ -56,11 +56,11 @@
       "type_owner": "net-kingdom"
     },
     {
-      "candidate_descriptor_digest": "sha256:8c40c2884f8ba15e8cb6c98f33419c395e54fce8ef33d6e1a34782cf3f1fcfa9",
+      "candidate_descriptor_digest": "sha256:c92957227235db04953809d92b260d32c8b947472a8e8fd17a258ade3ae8da70",
       "descriptor": {
         "actor": "human",
         "adapter": "net-kingdom/keycape-mint-secret@v1",
-        "adapter_source": "sha256:9b292d259fa766a70970fa02ea29918e5feaf860d851688aaf80c72835c3fed8",
+        "adapter_source": "sha256:34f79944204a2cf5b2a22baecbee4bde77cbdc0e3f9fc87bc98fa12a9c2c0bc1",
         "allowed_created": [
           "custody-secret-version"
         ],
@@ -89,11 +89,11 @@
       "type_owner": "railiance-platform"
     },
     {
-      "candidate_descriptor_digest": "sha256:1e23b05058a61b3558070805329b6906f0ba9b989b98d9df35c621471a7c4938",
+      "candidate_descriptor_digest": "sha256:75aaa7346aebdea2a0eb0ba993995515b5248ffefc34caf8e713525e9b58da85",
       "descriptor": {
         "actor": "human",
         "adapter": "net-kingdom/deliver-secret@v1",
-        "adapter_source": "sha256:0e5ea5440f7f51d499c75b44e047aaeb9ddeb8eba1ce58ae4457cffb072c223b",
+        "adapter_source": "sha256:df609bb93ebdfffb12cde213381a77eb7ac82670f814ff73623c1d98262cc90e",
         "allowed_created": [
           "delivered-secret"
         ],
@@ -122,11 +122,11 @@
       "type_owner": "railiance-platform"
     },
     {
-      "candidate_descriptor_digest": "sha256:55898e15f5851525910f6ee3b2802d9167f0c0dd1bfcf921a81470161773f70a",
+      "candidate_descriptor_digest": "sha256:d2511dce3d2ff1d380f845920aa168e6fe09c0f0c382482a796a5bf13619905d",
       "descriptor": {
         "actor": "human",
         "adapter": "net-kingdom/keycape-bind-env@v1",
-        "adapter_source": "sha256:80bb389a2c91b32c7295f22c56ea7451d4bd9a0bf27d4b6519661d5eb9be0371",
+        "adapter_source": "sha256:cfc8a7f52494869ead07f9878526a27206c99b0f468673e2e7b111d29d175ddf",
         "allowed_created": [
           "keycape-env-binding"
         ],
diff --git a/workplans/NK-WP-0048-security-case-types.md b/workplans/NK-WP-0048-security-case-types.md
index 087d4bd..3e3b2b1 100644
--- a/workplans/NK-WP-0048-security-case-types.md
+++ b/workplans/NK-WP-0048-security-case-types.md
@@ -1384,6 +1384,17 @@ priority: high
 state_hub_task_id: "6f6073ac-52dd-5b70-8874-6d76d4c072e4"
 ```
 
+2026-10-17 coordinator review r2 (the-custodian `nk48-adapters-1.2-review/coordinator-review-r2.json`)
+approved five files and rejected three, plus the artifact. The fixes are merged in
+2ee4ed0: R2-F1, mint-secret revokes the session and the broker grant
+independently (eeed8e1); R2-F2, deliver-secret binds to the admitted case and
+derives its Secret and custody path, with no caller reference (640292c); R2-F3,
+bind-env pins its five-file closure, and a new closure-completeness test checks
+every adapter (d16db30). Each regression test failed on 68f4bbb. The artifact is
+regenerated, and the full suite including kernel admission passed 117. Next is
+the r3 review. Open for owner review under T16: the type marks four steps
+`warden_executes: false`, yet each has an execution descriptor.
+
 2026-10-17 founder confirmed every proposed lane and schema name for T25-T29
 as-is. The artifact records them as `names_confirmed` (by founder, 2026-10-17),
 and no step is still `owner_confirmation_required`. Next: independent source