net-kingdom/sso-mfa/k8s/keycape/handover-adapter.md

Apps hand-over adapter (source candidate, NK-WP-0048-T29)

handover-adapter.py is an unexercised, injection-only seam for Warden's v1 kernel, modelled on the T13 registration adapter. It covers step (f), Apps-owned consumer verification and the hand-over receipt.

• Descriptor: descriptor(owner) — step hand-over, owner is a parameter (type 1.2 declares {consumer_owner_repo}; the T30 composer passes it, e.g. railiance-apps), actor human, lane apps-consumer-handover, target client_id, effect change, allowed created object handover-receipt, not retry-safe, revocation scope parent-session (the Warden v1 kernel refuses an empty scope set). build() derives the descriptor from admitted.owner; a 1.2 case must carry a bounded consumer_owner_repo equal to it. The lane name is still a candidate value for Apps owner review.
• Case binding: canonical oidc-browser-relying-party@1.1 is the default; @1.2 is reached only through an explicit version_root='1.2' selection, and successor @1.3 (1.2 plus execution_descriptors) only through version_root='1.3', with the same consumer_owner_repo owner handling. No --allow-unimplemented admission exists. Case, descriptor and acceptance pins are checked; access_groups must be non-empty, because 1.1 hand-over requires the consumer to enforce them (consumer-enforces-groups).
• Injected capabilities (required, never strings or case parameters): verify_consumer(client_id, groups) must return exactly client_id, enforces_groups=True, the case's groups, login_verified=True and observations (RAPPS-1.3-C2): a value-free list of {probe, evidence} records, one each for member-login, non-member-refused, membership-add-grants and membership-remove-revokes, evidence an owner evidence identifier (IDENTIFIER pattern). Missing, extra, duplicate or unknown probes and any other key are refused; the observation digest covers the records in canonical probe order; record_handover(client_id, observation_digest) -> (identifier, created); remove_handover(identifier) -> True; publish(bytes) -> identifier and authenticate(identifier, bytes) -> True for owner evidence; revoke_session(invocation) -> identifier, called in a finally block on every run and rollback (even failed ones) so the parent session always ends. A missing or malformed revocation identifier refuses before publication; the identifier is recorded in the evidence payload and returned as session_revocation_evidence with revoked=True.
• Rollback is created-only: only a receipt this process created and whose evidence the owner authenticates may be removed. An existing receipt is no_change and never rolled back; unconfirmed removal refuses and keeps the creation. Process loss and ambiguity stay for owner reconciliation (T31/T15).

Tests: python3 -m pytest sso-mfa/k8s/keycape/test_handover_adapter.py (synthetic fixtures only; no consumer, store or credential is touched).

Not supplied here: Apps owner source review before pinning, actual consumer verifier and receipt store, admission, and any native action.