net-kingdom/docs/reviews/2026-10-11-key39-ready-v9-net-review.json

{
  "reviewer": "net-kingdom-owner (agent net-kingdom, codex)",
  "decision": "approved",
  "review_id": "NK-REVIEW-20261011-KEY39-READY-PROTOCOL-SOURCE",
  "work_item_id": "NK-WP-ADHOC-2026-10-11-T07",
  "reviewed_manifest_sha256": "84542ddcff00932fc7ce22dcb2626be8942a3c006c5098a62fdd6b2478d0cd14",
  "reviewed_proposal_id": "KEY-WP-0039-T02/attended-lifecycle-v9-ready-input",
  "reviewed_source_hashes": {
    "sso-mfa/k8s/keycape/openbao-negative-session.py": "24b7b803e4eb7e6e7c0700a069dad0ec315ee7eb5538a88b9e56147f8fab5cdd",
    "sso-mfa/k8s/keycape/test_openbao_negative_session.py": "01e23f2b4fc77824a161a57acb3a52d19aad846b3b6c0fd3abd81afa1dc2985c",
    "sso-mfa/k8s/keycape/test_openbao_node_route.py": "1c57053be6e8472174e4034fdfbf34b3e1729f5e239b3a9af89d9e59a08d6cb6",
    "sso-mfa/k8s/keycape/openbao-negative-node-route.md": "cad3e3dc481d45295cc014e48285e81614911dfb4a10523883f3044f6085f363",
    "sso-mfa/k8s/keycape/test_openbao_private_input.py": "84277edb5bd7858885173dea802b6bdc4f0f0c7785d6e200ee9a98d8553891a1",
    "sso-mfa/k8s/keycape/openbao-negative-node-wrapper.py": "76ac013d1a676a0dfa58aea1ce87b0c3e72483ccd21f586a22c5475e9132f6c1",
    "sso-mfa/k8s/keycape/test_openbao_private_ready.py": "8a7a033b1c509ba21397d1d74580c44f24592045b2b9de50fe87638607224277"
  },
  "previous_review_sha256": "b2711c8ff72724751f9c10ce199fa3564b7893aa4c0377df0d3d1611d0a97eda",
  "comment": "NetKingdom INTENT Principles 6/7 require bounded exposure and explicit owner responsibility. Exact v9 ready child/node-wrapper manifest 84542ddcff00932fc7ce22dcb2626be8942a3c006c5098a62fdd6b2478d0cd14 prepared/reviewed under completed same-trial NK-WP-ADHOC-2026-10-11-T07. Authored owner source agreement for concrete private synchronization and bounded relay. Raw marker or approval JSON is not authenticated authority/peer proof; exact trusted owner launcher/SSH source context and independent KeyCape/Platform reviews are prerequisites. No native, credential, launcher/transport admission or KEY39 closure inferred.",
  "findings": [],
  "validation": {
    "supplied_lifecycle_tests": 46,
    "retained_node_route_actual_main_tests": 12,
    "retained_private_receive_tests": 7,
    "new_ready_wrapper_tests": 9,
    "retained_independent_tests": 21,
    "unchanged_runner_tests_previously_verified": 17,
    "all_passed": true,
    "synthetic_offline_only": true,
    "ready_protocol_checks": [
      "Distinct local writable pipe, marker exact keys/nonce/executor/envelope/health/window pins and child EOF",
      "Actual duplicate stdout pipe alias refusal before marker",
      "Wrong nonce/envelope pin produces no ready",
      "Actual full pipe write interrupted at original remaining action deadline with signal restoration",
      "Actual main health then marker received before first private read; no missing-ack private read",
      "Wrapper validates all exact marker fields and typed bounded window; changed/extra fields refuse",
      "Incomplete private local ready pipe without EOF interrupted under total bound",
      "Wrapper mocked child launch uses local pass_fds and inherited private stdin, no SSH FD forwarding or token copy"
    ],
    "retained_main_test_adaptation": "Existing input-only sequencing/receive tests stub the new ready emitter; new ready tests exercise actual pipe emission and main ordering separately.",
    "native_readiness": false,
    "compatible_producer_exact_review_pending": true,
    "source_original_baseline": "Current published v8, with original v5 and v6/v7/v8 frozen provenance retained"
  },
  "coverage": [
    "Workstation bridge configuration routing metadata and actual -L implementation distinguish node/workstation listener",
    "No node Pod DNS assumption; bounded founder foreground node-local gateway Service port-forward proposal and process-specific teardown",
    "Public unauth GET only; strict active initialized/unsealed body and digest-only cluster identity evidence",
    "Execute initial route refusal before native/Secret access; repeated route loss after dry-runs before first mutation",
    "Separate recovery route gate before native/Secret reads; health identity must match exact envelope pin",
    "No auth headers, private stdin or Kubernetes in public route-preflight mode; current-process diagnostic does not attest node placement",
    "HTTP health shares all existing no-proxy/no-redirect/byte/total-timer/abort guards; slow-health real timer refusal",
    "All earlier CAS/deadline/deletion/recovery/known-revoke/unknown-outcome regressions remain",
    "Actual main failure tests, not only execute-function mocks: unavailable route and missing health pin prevent stdin.read; recover also consumes no stdin",
    "Actual main success ordering verifies health before stdin before execution; original pre-input monotonic window is preserved",
    "Source/role/authority revalidation follows private input; expired original monotonic window refuses before runner/native access",
    "Actual main binary receive cap 65536 bytes, sized chunk reads and explicit EOF; exact two-token object with per-token UTF-8 byte limits",
    "Linux main-thread total receive timer at most 15 seconds clipped to original wall and monotonic remaining budget; no renewal",
    "Actual local pipe stalled/no EOF and complete JSON/no EOF regressions; fixed oversized/invalid/late failures before execution",
    "Producer-side missing exact-child ready handshake retained as separate explicit native prerequisite; exporter write timeout is not treated as consumer read bound",
    "Concrete required local child-ready FD/nonce/approved raw envelope pin before any private stdin read; aliases of all stdio endpoint identities rejected",
    "Exact newline marker schema with public source/envelope/health/action-window bindings; hard emission/receive bounds and original action deadline preserved",
    "Node-local wrapper constructs its own pipe and pinned Python child, validates ready under one preparation bound, forwards control line only, captures/refuses child output, performs bounded termination/capture-close cleanup",
    "No SSH FD forwarding, token stdin read/copy, raw marker authority, raw credential output or warden silent-lane compatibility claimed",
    "Independent KeyCape exporter/launcher coordination: newline control framing, no EOF wait on still-open SSHstdout, original producer budget only clips/no reset, no token-file access or delivery before valid exact ready"
  ],
  "native_prerequisites": [
    "Fresh exact source-reviewed KeyCape launcher/adapter matching ready schema/source/nonce/envelope/health/window, owning admitted captured SSH peer/profile before accepting marker and before any token-file read or write",
    "Fresh exact source reviews by Platform and KeyCape",
    "Founder exact source/runtime/route/window/cleanup decision",
    "Actual same-node route preflight with owner-admitted route and independently confirmed provider identity",
    "Exact envelope bao_health_identity_sha256 from current founder preflight; fresh owner role/policy/leeway observation",
    "Admitted private human/coding-agent token producer remains separate gap",
    "Current headroom/quiet window and actual native negative/revoke/restoration/cleanup acceptance"
  ],
  "authority_boundary": {
    "source_preparation_only": true,
    "native_actions": false,
    "tunnel_opened": false,
    "node_reachability_observed": false,
    "owner_checkout_writes": false,
    "credential_access": false,
    "secret_reads": false,
    "foreign_reviews": false,
    "founder_approval": false,
    "KEY39_task_closure": false
  },
  "work_record_anchor_sha256": "f294f1cf152dd797b913f0f31a5b3f7939fa67de9871580b977c74001c40d168",
  "retained_correction_history": "V8 receive bounds remain; producer v1 lacks consumer acknowledgment and fails stdio/race claims. Concrete v9 child/wrapper synchronization is a same-trial refinement; compatible KeyCape producer exact source review/admission remains separate. Earlier reviews/stages are unchanged."
}