Prepare reviewed durable case execution kernel and accepted layer pins
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
parent
3eb648846e
commit
1b8261917e
17 changed files with 2163 additions and 34 deletions
93
docs/evidence/2026-10-11-security-layer-v08-migration.json
Normal file
93
docs/evidence/2026-10-11-security-layer-v08-migration.json
Normal file
|
|
@ -0,0 +1,93 @@
|
|||
{
|
||||
"owner": "ops-warden",
|
||||
"accepted_standard_sha256": "3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b",
|
||||
"accepted_source": "net-kingdom/canon/standards/security-layer-model_v0.8.md",
|
||||
"acceptance_receipt": "net-kingdom/docs/security-layer-v0.8-acceptance.md",
|
||||
"tests": {
|
||||
"layer_conformance_passed": 31,
|
||||
"source": "staged modified scripts/tests + read-only current source support",
|
||||
"limitations": "mechanical declared scope only, not complete estate/runtime conformance",
|
||||
"routing": {
|
||||
"full_suite_passed": 99,
|
||||
"full_suite_failed": 1,
|
||||
"failure": "staging fixture missing unchanged wiki links; not product regression",
|
||||
"focused_after_fixture_repair_passed": 2,
|
||||
"focused_cases": [
|
||||
"every_wiki_ref_anchor_resolves",
|
||||
"route_find_layer_declaration_resolves_to_reference_playbook"
|
||||
],
|
||||
"environment": "WARDEN_MEMORY=0 and explicit staged WARDEN_ROUTING_CATALOG; no installed catalog/memory mutation"
|
||||
}
|
||||
},
|
||||
"checker_runs": [
|
||||
{
|
||||
"argv": [],
|
||||
"returncode": 0,
|
||||
"stdout": "validated against: net-kingdom/canon/standards/security-layer-model_v0.8.md (accepted; sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b)\nscope: single repository ops-warden (catalogued in \u00a74); INTENT.md frontmatter, layer.yaml, src/warden/**/*.py\nPASS \u2014 4 module(s) with Tooling contact, all declared; validated against net-kingdom/canon/standards/security-layer-model_v0.8.md (accepted; sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b)\n",
|
||||
"stderr": ""
|
||||
},
|
||||
{
|
||||
"argv": [
|
||||
"--report"
|
||||
],
|
||||
"returncode": 0,
|
||||
"stdout": "validated against: net-kingdom/canon/standards/security-layer-model_v0.8.md (accepted; sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b)\nscope: single repository ops-warden (catalogued in \u00a74); INTENT.md frontmatter, layer.yaml, src/warden/**/*.py\nops-warden \u2014 layer: Staff (declared in INTENT.md; \u00a711 governing form)\n layer.yaml: derived from INTENT.md, layer: staff\ndeclared by docs/adr/ADR-0010\n\n \u00a75.3 ssh-ca-signing-write src/warden/vault.py -> secrets-engine review 2026-11-28\n \u00a75.3 desk-paste-once-provision src/warden/desk.py -> secrets-engine review 2026-11-28\n \u00a75.1 taint-metadata-read src/warden/taint.py\n \u00a75.2 access-proxy-conduit src/warden/proxy.py\n \u00a75.2 caller-identity-token src/warden/caller_identity.py\n\n2 declared gap(s) \u2014 tracked non-conformance, not conformance (\u00a711).\n\nPASS \u2014 every direct Tooling contact maps to a declared shape; validated against net-kingdom/canon/standards/security-layer-model_v0.8.md (accepted; sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b)\n",
|
||||
"stderr": ""
|
||||
}
|
||||
],
|
||||
"meaningful_regressions": {
|
||||
"unicode_token_original_fold": "staff",
|
||||
"original_accepted_non_ascii_token": true
|
||||
},
|
||||
"source_changes": [
|
||||
{
|
||||
"repo": "ops-warden",
|
||||
"path": "scripts/check_layer_conformance.py",
|
||||
"staged_path": "/tmp/layer-migration-stage/ops-warden/scripts/check_layer_conformance.py",
|
||||
"original_sha256": "064be430b64072fd1620e6adc19b4e24a1790c9df06144a9670cd262faf66e8a",
|
||||
"staged_sha256": "7262fae9fae7ed454c0765cc6859e83a74e59ef6eade849991e0b8ab9c66757b"
|
||||
},
|
||||
{
|
||||
"repo": "ops-warden",
|
||||
"path": "tests/test_layer_conformance.py",
|
||||
"staged_path": "/tmp/layer-migration-stage/ops-warden/tests/test_layer_conformance.py",
|
||||
"original_sha256": "3d39b0a24a65263b2be9f18add2b9c69e12b7926716d610e8200d5c788c1b696",
|
||||
"staged_sha256": "93e3a8805460c4a6a4fd78734cf4dd85947a46e23d16a0d6898a43e8ec39275d"
|
||||
},
|
||||
{
|
||||
"repo": "ops-warden",
|
||||
"path": "INTENT.md",
|
||||
"staged_path": "/tmp/layer-migration-stage/ops-warden/INTENT.md",
|
||||
"original_sha256": "766c2d44851be7078a031575710843cd7d1278d665e874882c8e90980dcd0704",
|
||||
"staged_sha256": "3e9382fefa52ee0970dfac133cc799656e5034760b26dccc1bf9bab65fc538d9"
|
||||
},
|
||||
{
|
||||
"repo": "ops-warden",
|
||||
"path": "registry/routing/catalog.yaml",
|
||||
"staged_path": "/tmp/layer-migration-stage/ops-warden/registry/routing/catalog.yaml",
|
||||
"original_sha256": "32b0093cf5b93025d2aa90397247fef6ccce73cde5f477895a90ad09ddb48643",
|
||||
"staged_sha256": "09ee40df21b0ad8cad420be4613afcb1731967f68128631a94f9b96f3f31b318"
|
||||
},
|
||||
{
|
||||
"repo": "ops-warden",
|
||||
"path": "tests/test_routing.py",
|
||||
"staged_path": "/tmp/layer-migration-stage/ops-warden/tests/test_routing.py",
|
||||
"original_sha256": "e449a4e169ccb7021d1bc547c420628b2b618d713915b90cf68d0bcaf5d5430f",
|
||||
"staged_sha256": "43998fccf67b1f0d1a6c8bde1a4768a32f8418fb72a8eda5bf321dd96c097d35"
|
||||
},
|
||||
{
|
||||
"repo": "ops-warden",
|
||||
"path": "wiki/playbooks/netkingdom-layer-declaration.md",
|
||||
"staged_path": "/tmp/layer-migration-stage/ops-warden/wiki/playbooks/netkingdom-layer-declaration.md",
|
||||
"original_sha256": "2dbef2235afdc33203fb01582220370051cf6c9eefc7c7d482ff05ebd615fb64",
|
||||
"staged_sha256": "6a409a1c474ce8759b01cf5a62e5b95bba297e167a05fd8f8b616abdf6414306"
|
||||
}
|
||||
],
|
||||
"knowledge_orientation": {
|
||||
"package_version": "0.2.6",
|
||||
"package_digest": "8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02",
|
||||
"start_status": "withheld due changed sources; source reviewed directly"
|
||||
},
|
||||
"native_runtime_changed": false,
|
||||
"pushed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
{
|
||||
"initial_kernel_sha256": "eb6ee0cd00b2704904782e71c214c34a91d060086b49fbd4ba1b86b2290da7a7",
|
||||
"initial_fixture_tests_passed": 23,
|
||||
"initial_independent_probe": {
|
||||
"fd_output_escaped": true,
|
||||
"provenance_exception_escaped": true,
|
||||
"fixture_only": true,
|
||||
"native_execution": false,
|
||||
"subprocess_exit": 1
|
||||
},
|
||||
"findings_disposition": {
|
||||
"unbounded_source_parsing": "fixed:256KiB caps before JSON/YAML",
|
||||
"python_only_output_withholding": "fixed:serialized fd-level+Python containment",
|
||||
"provenance_error_payload": "fixed:contained verifier with fixed Refused; BaseException sanitized preserving running",
|
||||
"aggregate_revocation": "fixed:separate required broker/parent receipt proofs",
|
||||
"prior_attempt_receipt_reuse": "fixed:result/proof purposes include all Pins+operation+sequence+nonce attempt identity",
|
||||
"undeclared_secret_parameters": "author self-audit fixed explicit acknowledged-type parameter gate"
|
||||
},
|
||||
"final_kernel_sha256": "3636d089bfa9dd3fe66971529305354ba1e7ed46572eeceaabeb3c9a064b76a8",
|
||||
"final_fixture_tests_passed": 51,
|
||||
"refined_containment_probe": {
|
||||
"fd_output_escaped": false,
|
||||
"provenance_exception_escaped": false,
|
||||
"fixture_only": true,
|
||||
"native_execution": false,
|
||||
"subprocess_exit": 0
|
||||
},
|
||||
"refined_containment_probe_scope": "independent probe at preceding4edb183 kernel, unchanged containment in final3636d089; final51tests reverify all regressions",
|
||||
"failed_outcomes_preserved": true,
|
||||
"refinements_are_same_review_trial": true,
|
||||
"native_verified": false
|
||||
}
|
||||
|
|
@ -0,0 +1,55 @@
|
|||
# Independent SecurityCase kernel review — 2026-10-11
|
||||
|
||||
Disposition: **agree to bounded local kernel preparation** at SHA-256
|
||||
`3636d089bfa9dd3fe66971529305354ba1e7ed46572eeceaabeb3c9a064b76a8`.
|
||||
Review ID `WARDEN-REVIEW-20261011-CASE-KERNEL-v1`. Exact source/test/owner records
|
||||
and accepted design are hashed in the adjacent sources receipt. This implements
|
||||
part of accepted design 78ab1439, not live authority or executable type acceptance.
|
||||
|
||||
The initial inspected kernel passed 23 fixture tests but independent synthetic
|
||||
probes proved fd output escaped and raw provenance errors reached tracebacks.
|
||||
Review also identified absent parser caps, aggregate revocation proof and missing
|
||||
per-attempt binding. The findings receipt retains the failed revision and its
|
||||
actual outcomes. Refinements are one trial, not separate scored successes.
|
||||
|
||||
The final exact revision independently passes **51 tests** (37 kernel, 14 reducer).
|
||||
Source review confirms 256 KiB pre-parser bounds; closed descriptor metadata;
|
||||
exact case/type/catalog/descriptor pins; independently checked acceptance,
|
||||
structural materialization and refreshed caller-session provenance; and explicit
|
||||
undeclared/fixed/secret parameter refusal. Caller-asserted human labels cannot
|
||||
satisfy the injected verifier. Agent mint remains refused after human admission.
|
||||
|
||||
Private SQLite running intent commits before dispatch. Crash recovery persists
|
||||
uncertainty without redispatch; success/no-change cannot replay. Safe retry needs
|
||||
verified failed-before-change, unchanged pins, explicit retry and declared safety.
|
||||
Each persisted attempt binds all exact Pins, operation, sequence and nonce. Owner
|
||||
results and separate broker-grant/parent-session revocation proof purposes must
|
||||
match it; stale proof reuse and absence of either required proof cannot succeed.
|
||||
Reconciliation is a separate owner callback, not credential regeneration.
|
||||
|
||||
Serialized Python plus OS-fd containment discards adapter/verifier output without
|
||||
payload retention, including inherited synchronous subprocess output. Typed
|
||||
errors and sanitized interruptions preserve running intent without raw messages.
|
||||
This contains trusted fixed owner callbacks; it is no sandbox for arbitrary
|
||||
in-process hostile code or background children. Production adapters must reuse
|
||||
admitted attended-login containment and tie installed code to owner source pins.
|
||||
|
||||
Rollback passes only verified case-created objects in reverse order, excludes
|
||||
shared objects, refuses no-change undo and stops on uncertain/lost results.
|
||||
Limits of 32 created identifiers and 128 transitions bound local receipts; owner
|
||||
archival must precede further dispatch. Independent provenance checks remain
|
||||
injected contracts, not an implemented authentication system.
|
||||
|
||||
No installed production adapters, native provenance verifier or dispatch CLI
|
||||
exist. No dynamic import, inferred shell execution or live argv adapter was
|
||||
introduced. Descriptive types lack accepted machine descriptors and remain
|
||||
plan-only; no CLI may dispatch this harness as a native run. Full ordered
|
||||
run-sheet orchestration, verification inventory, contained login integration,
|
||||
owner adapter/type acceptance, actual materialization and first live case proof
|
||||
remain WARDEN-WP-0044-T03 and existing owner tasks. Uncertain undo still requires
|
||||
owner reconciliation. T03 remains in progress.
|
||||
|
||||
Fake tests verify local persistence/refusal/withholding only. They prove no
|
||||
native identity, OpenBao grant/policy, consumer enforcement, independent audit
|
||||
custody or production revocation. No token, live Secret, login, mutation or push
|
||||
occurred during this review.
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
{
|
||||
"review_id": "WARDEN-REVIEW-20261011-CASE-KERNEL-v1",
|
||||
"disposition": "agree-bounded-local-kernel",
|
||||
"approved_design_sha256": "78ab1439e4c5beb205aeccf15b1b2e706511be55ab195c5a3aa682f326c7c77c",
|
||||
"sources": [
|
||||
{
|
||||
"owner_path": "ops-warden/src/warden/case_run.py",
|
||||
"reviewed_source_path": "/tmp/warden-case-execution-stage/src/warden/case_run.py",
|
||||
"sha256": "3636d089bfa9dd3fe66971529305354ba1e7ed46572eeceaabeb3c9a064b76a8"
|
||||
},
|
||||
{
|
||||
"owner_path": "ops-warden/tests/test_case_run.py",
|
||||
"reviewed_source_path": "/tmp/warden-case-execution-stage/tests/test_case_run.py",
|
||||
"sha256": "1e70ceb858af0eb3a126132a3c3606706120c0caf58ca9d45deb43f217705c7e"
|
||||
},
|
||||
{
|
||||
"owner_path": "ops-warden/docs/security-case-execution-kernel-v1.md",
|
||||
"reviewed_source_path": "/tmp/warden-case-execution-stage/docs/security-case-execution-kernel-v1.md",
|
||||
"sha256": "ed5b6432ada71d1065fc837e3638e248cd4803241b6430d6ded07c25c0094c8d"
|
||||
},
|
||||
{
|
||||
"owner_path": "ops-warden/workplans/WARDEN-WP-0044-security-case-follow-through.md",
|
||||
"reviewed_source_path": "/tmp/warden-case-execution-stage/workplans/WARDEN-WP-0044-security-case-follow-through.md",
|
||||
"sha256": "c0029545bd2d8c015ae0cac87f6d53a2e5ee935b7bf5d5e1b81bf1ff5dbdc4f8"
|
||||
},
|
||||
{
|
||||
"owner_path": "/home/worsch/ops-warden/docs/security-case-execution-proposal.md",
|
||||
"sha256": "78ab1439e4c5beb205aeccf15b1b2e706511be55ab195c5a3aa682f326c7c77c"
|
||||
},
|
||||
{
|
||||
"owner_path": "/home/worsch/net-kingdom/docs/security-case-execution-owner-review.md",
|
||||
"sha256": "0f1637bfddbbdf50d336974791b7fbf4646efe7e32ca04beb3bf52effd0a28e6"
|
||||
},
|
||||
{
|
||||
"owner_path": "/home/worsch/the-custodian/docs/evidence/2026-10-10-security-consolidation/human-acceptance-receipts.json",
|
||||
"sha256": "85007938d246b6fedb1ef323386720261e4ac55a9bf95f92c4915b226da357a7"
|
||||
},
|
||||
{
|
||||
"owner_path": "/home/worsch/ops-warden/src/warden/proxy.py",
|
||||
"sha256": "2d12c432f21f529c5d67a59d584bffb55b8286bdc19ed0ec26d795f889ad989f"
|
||||
}
|
||||
],
|
||||
"findings_sha256": "d583435077e15cd5239c1c748d1fc079a73b70d8a9ef6c61d79869e93aa1699b",
|
||||
"live_authority": false,
|
||||
"native_complete": false
|
||||
}
|
||||
86
docs/security-case-execution-kernel-v1.md
Normal file
86
docs/security-case-execution-kernel-v1.md
Normal file
|
|
@ -0,0 +1,86 @@
|
|||
# Closed case execution kernel v1 — 2026-10-11
|
||||
|
||||
Owner implementation record for WARDEN-WP-0044-T03. The architectural proposal
|
||||
at SHA256 78ab1439e4c5beb205aeccf15b1b2e706511be55ab195c5a3aa682f326c7c77c
|
||||
was accepted through memo `infd-20261010-security-case-execution`, version 1,
|
||||
approval e46b149b-ec3c-4b3b-98a7-dcb4934448ca, confirmed disposition
|
||||
disp-cf44dacb-2117-4de7-8f90-cfa99f84f325 at 2026-10-10T23:23:31Z. The original
|
||||
approved proposal remains byte-identical. That decision accepts source design;
|
||||
it grants no execution session, credential or deployment authority.
|
||||
|
||||
`src/warden/case_run.py` advances the pure reducer into an executable injected
|
||||
owner harness with private durable receipts. Descriptor version
|
||||
`warden.case.execution.v1` is a closed local implementation seam, not an accepted
|
||||
NetKingdom type schema. It contains fixed owner/adapter/source digest, actor,
|
||||
lane, target parameter, effect, reviewed created-object identifiers declared
|
||||
retry safety and explicit required revocation scopes (parent-session and broker-grant).
|
||||
A mint descriptor cannot omit either scope. Unknown fields, free shell text and secret parameters are refused.
|
||||
An acknowledged type must additionally pin the descriptor bytes under its
|
||||
`execution_descriptors` map and independent owner evidence must authenticate
|
||||
that exact machine-seam revision. Existing descriptive types lack this map and
|
||||
remain plan-only. Their acknowledged labels do not authorize this new seam.
|
||||
|
||||
There are no installed owner adapters, native provenance verifier or dispatch CLI
|
||||
in this change. Callables are injected only through a fixed adapter registry,
|
||||
with immutable owner reference/source pins. A real integration must supply
|
||||
independent owner/native verification or explicit attended manual evidence;
|
||||
a bare JSON receipt identifier is insufficient. Fixture verifiers in tests
|
||||
are deliberately fake and attest no native case. Caller sessions are independently
|
||||
verified for exact principal/actor/lane at admission and again before dispatch;
|
||||
input actor labels alone are never sufficient. Agent mint is refused, including
|
||||
when WARDEN_AGENT_ID appears after initial human admission.
|
||||
|
||||
Each admission pins exact case/type/descriptor/catalog bytes, acceptance reference
|
||||
and run-sheet identity. Actual ops-mason materialization evidence is required
|
||||
against the case source, separately from its status label. Case parameters supply
|
||||
an exact metadata target. Source/session changes cannot inherit journal success.
|
||||
Owner results have a closed metadata shape, result evidence fingerprint and
|
||||
separate independently authenticated grant/parent-session revocation evidence
|
||||
fingerprints. An aggregate revoked boolean alone cannot satisfy either scope. Unknown result payloads, unverified evidence, absent revocation and
|
||||
created objects outside the reviewed scope become uncertain, never success.
|
||||
Python and OS stdout/stderr, including inherited child-process output, are
|
||||
discarded without buffering or retention under a serialized fd containment
|
||||
context. Independent provenance verification uses the same containment and
|
||||
sanitizes exceptions. All source inputs are capped at 256 KiB before parsing.
|
||||
Error text is not copied to the journal. KeyboardInterrupt/SystemExit and other
|
||||
owner interruptions are rethrown with a fixed message while retaining running
|
||||
intent for crash recovery.
|
||||
|
||||
The journal uses an owner-private 0700 directory and 0600 files, refuses symlinks
|
||||
and insecure modes, uses SQLite FULL synchronization and commits running intent
|
||||
before calling the adapter. A separate process lock prevents concurrent mutation.
|
||||
A crash between dispatch and final receipt leaves running; the next lock holder
|
||||
persists uncertain before refusing replay. Both intent and outcome remain in
|
||||
history. Each persisted attempt has a unique identity bound to all exact pins,
|
||||
operation (run/reconcile/rollback), sequence and nonce. Adapter results and both
|
||||
revocation proof purposes carry that identity. Prior-attempt evidence cannot
|
||||
verify a safe retry, even if a caller rewrites result labels. Descriptor-created
|
||||
objects are capped at 32 and histories at 128 transitions, with dispatch stopped
|
||||
before archival is required. A throw or lost response is not failed-before-change. A safe retry needs
|
||||
verified failed-before-change, unchanged pins, descriptor retry-safe and explicit
|
||||
retry. Success and no-change cannot replay.
|
||||
|
||||
Reconciliation is an explicit fixed owner callback, never the mutation callback.
|
||||
It may verify an already-present native CAS result as no-change/success, or prove
|
||||
failed-before-change; it never tells Warden to regenerate a credential. Uncertain
|
||||
or failed-after-change requires this owner-native inspection before any retry.
|
||||
Owner proof and revocation remain mandatory. Rollback visits only objects in a
|
||||
verified creation receipt, in reverse order; no-change has no undo and shared
|
||||
objects are excluded. Unknown/lost undo blocks another rollback.
|
||||
|
||||
The kernel operates individual admitted steps. Full ordered run-sheet orchestration,
|
||||
verification inventory, contained login integration, native owner adapters and
|
||||
CLI activation remain WARDEN-WP-0044-T03; no overall native-complete result is
|
||||
implemented. Current Forgejo source is not materialized and has no acknowledged
|
||||
machine descriptors. Its first native run remains an acceptance requirement,
|
||||
with real materialization, separately authenticated broker-grant and parent-session
|
||||
revocation receipts, session/owner receipts and consumer enforcement. This
|
||||
implementation neither promotes a type nor changes any case status.
|
||||
|
||||
Validation: 37 new kernel tests plus 14 reducer tests pass (51 total). Tests open
|
||||
an independent SQLite connection inside dispatch to prove running was committed,
|
||||
crash after mutation and reopen a fresh journal to prove no duplicate invocation,
|
||||
lose a response then reconcile without mint, require explicit retry, check exact
|
||||
pins/session expiry, withhold malicious output and unconfirmed revocation, and
|
||||
prove created-only reverse undo plus uncertain-undo refusal. Ruff formatting and
|
||||
checks pass. No live token or target action occurred.
|
||||
136
docs/security-case-execution-proposal.md
Normal file
136
docs/security-case-execution-proposal.md
Normal file
|
|
@ -0,0 +1,136 @@
|
|||
# SecurityCase execution contract proposal — 2026-10-10
|
||||
|
||||
Status: proposed owner review; not an accepted runtime protocol or authority.
|
||||
Owner: ops-warden. Related: WARDEN-WP-0044-T03, NK-WP-0048, MASON-WP-0010.
|
||||
|
||||
`warden case plan` now gives a valid descriptive run, but the type's
|
||||
`entry_point`, `auth`, verification `check` and rollback `action` fields are
|
||||
prose. No `warden case run` or `rollback` implementation exists. A case becoming
|
||||
`materialized` cannot turn those descriptions into executable commands.
|
||||
|
||||
The proposal preserves caller authority and routes by owner. It introduces no
|
||||
new credential, policy grant, shell command inferred from prose, or authority
|
||||
for Warden to configure a consumer. Architectural contract acceptance belongs to
|
||||
net-kingdom and adapter interfaces to their owners. Founder review is needed
|
||||
only if the acknowledged type's authorization/session boundary changes; the
|
||||
current absence of a machine contract is not an excuse to fabricate one.
|
||||
|
||||
## Proposed machine seam
|
||||
|
||||
Keep human descriptions. Add a separately validated `execution` reference to
|
||||
steps and checks, resolving to owner-provided closed adapters. An adapter has:
|
||||
|
||||
- immutable reference (owner repo, interface id, version, source digest);
|
||||
- closed parameter schema (no secret-sensitivity fields; no free shell text);
|
||||
- declared actor mode and catalog lane, which must agree with the case plan;
|
||||
- explicit side-effect class and target identifier deriving from case parameters;
|
||||
- idempotency/reconciliation contract and metadata-only receipt schema;
|
||||
- supported rollback reference or explicit owner-only undo.
|
||||
|
||||
Warden does not invent an argv contract for ExternalSecrets, group membership,
|
||||
KeyCape registration or Forgejo configuration. Owner adapters may internally
|
||||
call their reviewed tools. Warden invokes only the fixed entry point provided by
|
||||
that adapter, with validated separate argv fields, and refuses unknown adapters
|
||||
or templates. `entry_point` prose never goes to `shell=True` or `sh -c`.
|
||||
|
||||
An owner may initially supply a receipt-only adapter: the run sheet records that
|
||||
step as pending until the owner performs it and provides independent evidence.
|
||||
This gives useful resumable orchestration before every live adapter exists,
|
||||
without implying native completion or transferring ownership.
|
||||
|
||||
## Run sheet and receipts
|
||||
|
||||
The run sheet pins exact case bytes (`case-ref`), accepted type bytes/version,
|
||||
owner adapter digests, catalog revision, acceptance reference and ordered step
|
||||
identities. Changed pins require a newly reviewed sheet; never inherit previous
|
||||
success into a different exact revision without explicit reconciliation.
|
||||
|
||||
Each attempt yields an immutable metadata receipt containing these pins, step
|
||||
id, owner, target, attempt id, result enum and evidence-reference fingerprints.
|
||||
Allowed results: pending-owner, not-started, running, verified-success,
|
||||
verified-no-change, failed-before-change, failed-after-change, uncertain.
|
||||
Neither subprocess output nor arbitrary owner payload is copied into receipts.
|
||||
Adapter error strings are not evidence and must not be logged verbatim.
|
||||
|
||||
Stop on failure or uncertainty. A thrown exception or lost process receipt is
|
||||
uncertain, not failed-before-change. Uncertain/failed-after-change blocks retry
|
||||
until the owner reconciles target state. `verified-success` and
|
||||
`verified-no-change` are not repeated. Retry after failed-before-change requires
|
||||
the same pins and adapter's explicit retry-safe classification; a replay-safe
|
||||
CAS0 receipt is reconciled, not retried into secret generation. State persistence
|
||||
must write running before dispatch and result afterwards; interruption between
|
||||
those writes leaves uncertain on resume. Outbox failures remain visible and do
|
||||
not get rewritten as verified audit delivery.
|
||||
|
||||
Owner receipt ingestion must authenticate provenance or be explicitly manual
|
||||
attended evidence, never a bare trusted JSON argument. Source/local receipts are
|
||||
attributive preparation until their owner contract defines independent native
|
||||
verification. Overall native completion requires every applicable step and
|
||||
verification plus confirmed session revocation; pending-owner is never success.
|
||||
|
||||
## Sessions, values and rollback
|
||||
|
||||
Reuse `proxy_attended_login_exec` containment/output suppression/revocation
|
||||
rather than add a second login helper. A key-cape login lane and the OpenBao
|
||||
broker issuer role are distinct grants; the executor must represent both and
|
||||
never silently share/inherit a token. Grouping is permitted only within the
|
||||
same declared identity/lane and preserves follow-through order. An agent
|
||||
principal cannot dispatch generated-in-custody mint-secret. The broker continues
|
||||
to rederive the exact case-ref independently.
|
||||
|
||||
Rollback traverses successful step receipts in reverse order and only invokes
|
||||
an owner's reviewed undo for target changes that receipt proves were created
|
||||
by this case. Existing shared groups, membership and policies cannot be deleted
|
||||
by interpreting a type rollback sentence literally. 'No change' yields no undo;
|
||||
failed/uncertain states require reconciliation first. Do not restore a prior
|
||||
secret value by extracting it into Warden; custody rollback is owner-native.
|
||||
|
||||
## Owner acceptance requests to prepare
|
||||
|
||||
1. net-kingdom: accept the closed machine seam separately from descriptive type
|
||||
fields, document materialized = structural acceptance, and avoid gating that
|
||||
state on mint-secret which is itself a follow-through step. Pin the revised
|
||||
schema/type and keep type acceptance provenance explicit.
|
||||
2. railiance-platform: provide a generate adapter over existing `credential.py`
|
||||
exact `--grant`, `--client-id`, `--case-file`, `--case-ref` and receipt result
|
||||
codes; clarify reconcile semantics for already-present CAS0 and grant/session
|
||||
revocation evidence. No new credential is required by this proposal.
|
||||
3. key-cape/net-kingdom: provide registration/group/env adapters and verify/undo
|
||||
contracts in the existing attended boundary; do not hand Warden a user-engine
|
||||
runtime token or a new broad Kubernetes credential.
|
||||
4. railiance-apps/Forgejo: provide consumer OIDC + groups enforcement adapter or
|
||||
receipt-only step, exact auth binding for CCR-2026-0042, and source/native
|
||||
group-denial verification. This stays consumer ownership.
|
||||
5. ops-mason: give a hash-pinned materialization receipt and list of objects
|
||||
created vs pre-existing, sufficient for collision checks and scoped rollback.
|
||||
|
||||
No coordination messages have been sent by preparation of this proposal.
|
||||
|
||||
## Implementation and verification after owner seam acceptance
|
||||
|
||||
Implement `case_run.py` with injected typed adapters and receipt storage, then
|
||||
CLI run-sheet/receipt import/resume/rollback commands. Keep case_plan read-only.
|
||||
Add type machine-seam validation without turning valid descriptive planning
|
||||
into an unreviewed source-breaking schema migration.
|
||||
|
||||
Required tests: rejected changed pins; unaccepted/unmaterialized cases; unsupported
|
||||
adapter/argv refusal; agent mint refusal; pending owner keeps native gate open;
|
||||
verified success never replayed; lost receipt resumes as uncertain; crash after
|
||||
running persistence prevents duplicate side effect; failed-before-change retries
|
||||
only with declared retry-safe adapter; failed-after-change needs owner reconcile;
|
||||
malicious/secret output excluded; inability to revoke remains unverified;
|
||||
rollback visits created successful objects only, preserves shared memberships,
|
||||
and stops on uncertain undo. Inject runners; no live login or target required.
|
||||
|
||||
WARDEN-WP-0044-T03 remains open. This packet resolves the precise source contract
|
||||
deficit; it is not case materialization, a native run, or a type decision.
|
||||
|
||||
|
||||
## Local reducer prototype
|
||||
|
||||
`src/warden/case_receipt_state.py` is proposed local source preparation, not an
|
||||
accepted wire format. Its pure immutable transitions can be tested without any
|
||||
owner adapter or shell dispatch. Persist the returned running intent before an
|
||||
external side effect; on a lost result, recover marks uncertainty and blocks
|
||||
replay. No receipt provenance, durable storage, CLI dispatch or live action is
|
||||
implemented. `tests/test_case_receipt_state.py` covers the failure boundaries.
|
||||
Loading…
Add table
Add a link
Reference in a new issue