ops-warden/docs/security-case-execution-kernel-v1.md

# Closed case execution kernel v1 — 2026-10-11

Owner implementation record for WARDEN-WP-0044-T03. The architectural proposal
at SHA256 78ab1439e4c5beb205aeccf15b1b2e706511be55ab195c5a3aa682f326c7c77c
was accepted through memo `infd-20261010-security-case-execution`, version 1,
approval e46b149b-ec3c-4b3b-98a7-dcb4934448ca, confirmed disposition
disp-cf44dacb-2117-4de7-8f90-cfa99f84f325 at 2026-10-10T23:23:31Z. The original
approved proposal remains byte-identical. That decision accepts source design;
it grants no execution session, credential or deployment authority.

`src/warden/case_run.py` advances the pure reducer into an executable injected
owner harness with private durable receipts. Descriptor version
`warden.case.execution.v1` is a closed local implementation seam, not an accepted
NetKingdom type schema. It contains fixed owner/adapter/source digest, actor,
lane, target parameter, effect, reviewed created-object identifiers declared
retry safety and explicit required revocation scopes (parent-session and broker-grant).
A mint descriptor cannot omit either scope. Unknown fields, free shell text and secret parameters are refused.
An acknowledged type must additionally pin the descriptor bytes under its
`execution_descriptors` map and independent owner evidence must authenticate
that exact machine-seam revision. Existing descriptive types lack this map and
remain plan-only. Their acknowledged labels do not authorize this new seam.

There are no installed owner adapters, native provenance verifier or dispatch CLI
in this change. Callables are injected only through a fixed adapter registry,
with immutable owner reference/source pins. A real integration must supply
independent owner/native verification or explicit attended manual evidence;
a bare JSON receipt identifier is insufficient. Fixture verifiers in tests
are deliberately fake and attest no native case. Caller sessions are independently
verified for exact principal/actor/lane at admission and again before dispatch;
input actor labels alone are never sufficient. Agent mint is refused, including
when WARDEN_AGENT_ID appears after initial human admission.

Each admission pins exact case/type/descriptor/catalog bytes, acceptance reference
and run-sheet identity. Actual ops-mason materialization evidence is required
against the case source, separately from its status label. Case parameters supply
an exact metadata target. Source/session changes cannot inherit journal success.
Owner results have a closed metadata shape, result evidence fingerprint and
separate independently authenticated grant/parent-session revocation evidence
fingerprints. An aggregate revoked boolean alone cannot satisfy either scope. Unknown result payloads, unverified evidence, absent revocation and
created objects outside the reviewed scope become uncertain, never success.
Python and OS stdout/stderr, including inherited child-process output, are
discarded without buffering or retention under a serialized fd containment
context. Independent provenance verification uses the same containment and
sanitizes exceptions. All source inputs are capped at 256 KiB before parsing.
Error text is not copied to the journal. KeyboardInterrupt/SystemExit and other
owner interruptions are rethrown with a fixed message while retaining running
intent for crash recovery.

The journal uses an owner-private 0700 directory and 0600 files, refuses symlinks
and insecure modes, uses SQLite FULL synchronization and commits running intent
before calling the adapter. A separate process lock prevents concurrent mutation.
A crash between dispatch and final receipt leaves running; the next lock holder
persists uncertain before refusing replay. Both intent and outcome remain in
history. Each persisted attempt has a unique identity bound to all exact pins,
operation (run/reconcile/rollback), sequence and nonce. Adapter results and both
revocation proof purposes carry that identity. Prior-attempt evidence cannot
verify a safe retry, even if a caller rewrites result labels. Descriptor-created
objects are capped at 32 and histories at 128 transitions, with dispatch stopped
before archival is required. A throw or lost response is not failed-before-change. A safe retry needs
verified failed-before-change, unchanged pins, descriptor retry-safe and explicit
retry. Success and no-change cannot replay.

Reconciliation is an explicit fixed owner callback, never the mutation callback.
It may verify an already-present native CAS result as no-change/success, or prove
failed-before-change; it never tells Warden to regenerate a credential. Uncertain
or failed-after-change requires this owner-native inspection before any retry.
Owner proof and revocation remain mandatory. Rollback visits only objects in a
verified creation receipt, in reverse order; no-change has no undo and shared
objects are excluded. Unknown/lost undo blocks another rollback.

The kernel operates individual admitted steps. Full ordered run-sheet orchestration,
verification inventory, contained login integration, native owner adapters and
CLI activation remain WARDEN-WP-0044-T03; no overall native-complete result is
implemented. Current Forgejo source is not materialized and has no acknowledged
machine descriptors. Its first native run remains an acceptance requirement,
with real materialization, separately authenticated broker-grant and parent-session
revocation receipts, session/owner receipts and consumer enforcement. This
implementation neither promotes a type nor changes any case status.

Validation: 37 new kernel tests plus 14 reducer tests pass (51 total). Tests open
an independent SQLite connection inside dispatch to prove running was committed,
crash after mutation and reopen a fresh journal to prove no duplicate invocation,
lose a response then reconcile without mint, require explicit retry, check exact
pins/session expiry, withhold malicious output and unconfirmed revocation, and
prove created-only reverse undo plus uncertain-undo refusal. Ruff formatting and
checks pass. No live token or target action occurred.

## Browser input projection — 2026-10-16 source preparation

An explicitly configured `BrowserInputs(netkingdom_root)` now validates browser
cases before admission. It calls the real NetKingdom type/case validator over
verified producer bytes in a disposable Python process (`-I`, empty environment,
timeout, no inherited output). The validator, composer, capability contract and lazy evidence
modules have exact source pins; missing or changed code refuses. There is no
automatic discovery or download. A producer upgrade needs reviewed pin changes.

Only the exact reviewed 1.1/1.2 browser parameter definitions qualify. A digest
of each complete parameter definition list prevents reclassifying secrets as
metadata, loosening constraints, or adding fields under a recognized version.
The complete case passes producer validation, including required fields,
constraints and credential-shape checks. Explicit fixed/default overrides,
unknown fields and secret references refuse. Security-sensitive browser metadata
can therefore be present without being passed to an owner adapter: the only
projection is its descriptor's exact public/operational target identifier.
No raw parameter values are added to invocations or persisted receipts.

`require_implemented=False` validates the acknowledged type's source, not its
execution authority. Existing descriptor/type/source/catalog/caller provenance
gates stay mandatory. Neither historical browser type contains the required
exact machine-descriptor map, and neither is promoted by this change. There are
still no installed native owner adapters, authenticated provenance verifier,
contained session/ordered run orchestration or live CLI dispatch. A journal digest
is a fingerprint and cannot authenticate native evidence. Completion still needs
owner-admitted descriptors and actual structural, mint/delivery, consumer and
revocation/rollback evidence. Local fixture success is not native acceptance.

Tests use the actual producer checkout (override sibling location with
`WARDEN_TEST_NETKINGDOM_ROOT`), the real Executor, SQLite journal and injected
test-only owner adapter/evidence verifier. Their descriptor extensions and case
materialized labels exist only in memory. Canonical case/type bytes stay intact.

Producer integration refinement: the accepted NetKingdom browser-case patch
`d32a7f51cbf3012bee3e4bb329f4259dea867eff1c59a2b01a65d72774488d05`
is now the tested producer revision. Its evidence module is imported lazily only
by `check-evidence`, outside this admission path; Warden nevertheless pins and
copies it with the complete reviewed producer set. Missing or modified bytes in
any of the four modules refuse admission. The test covers every dependency.