ops-warden/docs/security-case-execution-kernel-v1.md

# Closed case execution kernel v1 — 2026-10-11

Owner implementation record for WARDEN-WP-0044-T03. The architectural proposal
at SHA256 78ab1439e4c5beb205aeccf15b1b2e706511be55ab195c5a3aa682f326c7c77c
was accepted through memo `infd-20261010-security-case-execution`, version 1,
approval e46b149b-ec3c-4b3b-98a7-dcb4934448ca, confirmed disposition
disp-cf44dacb-2117-4de7-8f90-cfa99f84f325 at 2026-10-10T23:23:31Z. The original
approved proposal remains byte-identical. That decision accepts source design;
it grants no execution session, credential or deployment authority.

`src/warden/case_run.py` advances the pure reducer into an executable injected
owner harness with private durable receipts. Descriptor version
`warden.case.execution.v1` is a closed local implementation seam, not an accepted
NetKingdom type schema. It contains fixed owner/adapter/source digest, actor,
lane, target parameter, effect, reviewed created-object identifiers declared
retry safety and explicit required revocation scopes (parent-session and broker-grant).
A mint descriptor cannot omit either scope. Unknown fields, free shell text and secret parameters are refused.
An acknowledged type must additionally pin the descriptor bytes under its
`execution_descriptors` map and independent owner evidence must authenticate
that exact machine-seam revision. Existing descriptive types lack this map and
remain plan-only. Their acknowledged labels do not authorize this new seam.

There are no installed owner adapters, native provenance verifier or dispatch CLI
in this change. Callables are injected only through a fixed adapter registry,
with immutable owner reference/source pins. A real integration must supply
independent owner/native verification or explicit attended manual evidence;
a bare JSON receipt identifier is insufficient. Fixture verifiers in tests
are deliberately fake and attest no native case. Caller sessions are independently
verified for exact principal/actor/lane at admission and again before dispatch;
input actor labels alone are never sufficient. Agent mint is refused, including
when WARDEN_AGENT_ID appears after initial human admission.

Each admission pins exact case/type/descriptor/catalog bytes, acceptance reference
and run-sheet identity. Actual ops-mason materialization evidence is required
against the case source, separately from its status label. Case parameters supply
an exact metadata target. Source/session changes cannot inherit journal success.
Owner results have a closed metadata shape, result evidence fingerprint and
separate independently authenticated grant/parent-session revocation evidence
fingerprints. An aggregate revoked boolean alone cannot satisfy either scope. Unknown result payloads, unverified evidence, absent revocation and
created objects outside the reviewed scope become uncertain, never success.
Python and OS stdout/stderr, including inherited child-process output, are
discarded without buffering or retention under a serialized fd containment
context. Independent provenance verification uses the same containment and
sanitizes exceptions. All source inputs are capped at 256 KiB before parsing.
Error text is not copied to the journal. KeyboardInterrupt/SystemExit and other
owner interruptions are rethrown with a fixed message while retaining running
intent for crash recovery.

The journal uses an owner-private 0700 directory and 0600 files, refuses symlinks
and insecure modes, uses SQLite FULL synchronization and commits running intent
before calling the adapter. A separate process lock prevents concurrent mutation.
A crash between dispatch and final receipt leaves running; the next lock holder
persists uncertain before refusing replay. Both intent and outcome remain in
history. Each persisted attempt has a unique identity bound to all exact pins,
operation (run/reconcile/rollback), sequence and nonce. Adapter results and both
revocation proof purposes carry that identity. Prior-attempt evidence cannot
verify a safe retry, even if a caller rewrites result labels. Descriptor-created
objects are capped at 32 and histories at 128 transitions, with dispatch stopped
before archival is required. A throw or lost response is not failed-before-change. A safe retry needs
verified failed-before-change, unchanged pins, descriptor retry-safe and explicit
retry. Success and no-change cannot replay.

Reconciliation is an explicit fixed owner callback, never the mutation callback.
It may verify an already-present native CAS result as no-change/success, or prove
failed-before-change; it never tells Warden to regenerate a credential. Uncertain
or failed-after-change requires this owner-native inspection before any retry.
Owner proof and revocation remain mandatory. Rollback visits only objects in a
verified creation receipt, in reverse order; no-change has no undo and shared
objects are excluded. Unknown/lost undo blocks another rollback.

The kernel operates individual admitted steps. Full ordered run-sheet orchestration,
verification inventory, contained login integration, native owner adapters and
CLI activation remain WARDEN-WP-0044-T03; no overall native-complete result is
implemented. Current Forgejo source is not materialized and has no acknowledged
machine descriptors. Its first native run remains an acceptance requirement,
with real materialization, separately authenticated broker-grant and parent-session
revocation receipts, session/owner receipts and consumer enforcement. This
implementation neither promotes a type nor changes any case status.

Validation: 37 new kernel tests plus 14 reducer tests pass (51 total). Tests open
an independent SQLite connection inside dispatch to prove running was committed,
crash after mutation and reopen a fresh journal to prove no duplicate invocation,
lose a response then reconcile without mint, require explicit retry, check exact
pins/session expiry, withhold malicious output and unconfirmed revocation, and
prove created-only reverse undo plus uncertain-undo refusal. Ruff formatting and
checks pass. No live token or target action occurred.

## Browser input projection — 2026-10-16 source preparation

An explicitly configured `BrowserInputs(netkingdom_root)` now validates browser
cases before admission. It calls the real NetKingdom type/case validator over
verified producer bytes in a disposable Python process (`-I`, empty environment,
timeout, no inherited output). The validator, composer, capability contract and lazy evidence
modules have exact source pins; missing or changed code refuses. There is no
automatic discovery or download. A producer upgrade needs reviewed pin changes.

Only the exact reviewed 1.1/1.2 browser parameter definitions qualify. A digest
of each complete parameter definition list prevents reclassifying secrets as
metadata, loosening constraints, or adding fields under a recognized version.
The complete case passes producer validation, including required fields,
constraints and credential-shape checks. Explicit fixed/default overrides,
unknown fields and secret references refuse. Security-sensitive browser metadata
can therefore be present without being passed to an owner adapter: the only
projection is its descriptor's exact public/operational target identifier.
No raw parameter values are added to invocations or persisted receipts.

`require_implemented=False` validates the acknowledged type's source, not its
execution authority. Existing descriptor/type/source/catalog/caller provenance
gates stay mandatory. Neither historical browser type contains the required
exact machine-descriptor map, and neither is promoted by this change. There are
still no installed native owner adapters, authenticated provenance verifier,
contained session/ordered run orchestration or live CLI dispatch. A journal digest
is a fingerprint and cannot authenticate native evidence. Completion still needs
owner-admitted descriptors and actual structural, mint/delivery, consumer and
revocation/rollback evidence. Local fixture success is not native acceptance.

Tests use the actual producer checkout (override sibling location with
`WARDEN_TEST_NETKINGDOM_ROOT`), the real Executor, SQLite journal and injected
test-only owner adapter/evidence verifier. Their descriptor extensions and case
materialized labels exist only in memory. Canonical case/type bytes stay intact.

Producer integration refinement: the accepted NetKingdom browser-case patch
`d32a7f51cbf3012bee3e4bb329f4259dea867eff1c59a2b01a65d72774488d05`
is now the tested producer revision. Its evidence module is imported lazily only
by `check-evidence`, outside this admission path; Warden nevertheless pins and
copies it with the complete reviewed producer set. Missing or modified bytes in
any of the four modules refuse admission. The test covers every dependency.


## Original-intent consistency boundary — 2026-10-17

`OriginalIntent` and the optional additive
`reconcile_original(ReconcileContext(original, attempt))` callback retain the
original run separately from a fresh reconciliation attempt. Existing one-argument
reconcile adapters remain source-compatible. Intent and pre-dispatch receipt are
committed in one SQLite transaction; lookup now requires their exact attempt,
actor, step/owner/target, source and pin correspondence. Missing legacy context,
an orphan receipt, changed context or an invalid bounded field contract refuses;
there is no backfill or new runtime holder.

Original intent serialization accepts only the fixed reviewed Invocation/Pins
field contract and bounded operational identifiers. Duplicate, oversized and
malformed original records refuse. Current Executor.admit leaves tenant and realm
empty: those reserved fields are not admitted tenant/realm provenance, and future
nonempty coordinates need an authoritative owner contract. Raw owner payloads,
credentials, parameters and caller output are not part of this context contract.

Local dispatch correspondence is not independent owner proof. A real owner must
still authenticate the exact original created-only result and original revocation,
current native revision and the fresh attempt's session/grant evidence before
recovery can count. No actual original holder/verifier or native adapter is added.
NetKingdom's current registration adapter still has no reconciliation callback;
source tests do not authorize its post-restart undo, replay or a changed caller/
session/run-sheet migration. WARDEN-WP-0044-T03 remains a native acceptance gate.

## Current caller versus original session reference — 2026-10-18 source

`Executor.admit` now accepts the optional `original_session_reference` for an
exact existing original-run continuation. It is metadata, never current
authentication. The normal `session_evidence` is independently verified as the
current caller's principal/actor/lane proof, including after restart, and remains
the evidence rechecked immediately before every journal write/owner callback.

The optional reference preserves the original run-sheet digest rather than
replacing immutable provenance with the new login. Before admitting it, under
the existing journal lock, the kernel requires an existing matching step journal
and `Journal.original_intent` correspondence: the original running receipt,
attempt, owner/target/principal/actor/lane, all six pins and exact adapter source.
Missing/orphan/legacy context, a changed reference or caller and a stale current
session refuse. The reference must differ from the current evidence identifier;
the actual session owner must additionally establish distinct authenticated
token/session identity, not just two labels. No new original context is created,
no completed operation can replay, and uncertainty is not cleared by readmission.

Omitting this option retains the old admission/pin semantics. Supplying a fresh
session alone still creates a different run sheet and cannot reuse a previous
journal. No existing descriptor, Invocation, Pins or receipt schema changes.
The new source seam does not implement changed-source/catalog/caller migration
or loss of rollback result; those still require the existing owner reconciliation
and recovery evidence. It is not general session management or another issuer.

A source integration fixture runs the actual producer-owned KeyCape status CLI
over HTTPS, the actual Warden kernel and a separately compiled generated Go
consumer. It verifies revoked-parent refusal before writes, distinct inverse
authentication in another Python process, original journal pin retention,
no business replay, exact synthetic target restore and independent read-only
negative cleanup observation. Case/type/catalog/owner attestations and the
target are synthetic; this is not Forgejo/browser/native acceptance or a real
approval. KeyCape's proposed online profile remains unadmitted. The private
unsigned CLI observation is not portable execution authority; actual owner
custody and original grant ownership are still mandatory before an inactive
response can establish revocation. No native verifier or adapter is installed.