Prepare reviewed durable case execution kernel and accepted layer pins

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

docs/security-case-execution-kernel-v1.md

@@ -0,0 +1,86 @@
+# Closed case execution kernel v1 — 2026-10-11
+
+Owner implementation record for WARDEN-WP-0044-T03. The architectural proposal
+at SHA256 78ab1439e4c5beb205aeccf15b1b2e706511be55ab195c5a3aa682f326c7c77c
+was accepted through memo `infd-20261010-security-case-execution`, version 1,
+approval e46b149b-ec3c-4b3b-98a7-dcb4934448ca, confirmed disposition
+disp-cf44dacb-2117-4de7-8f90-cfa99f84f325 at 2026-10-10T23:23:31Z. The original
+approved proposal remains byte-identical. That decision accepts source design;
+it grants no execution session, credential or deployment authority.
+
+`src/warden/case_run.py` advances the pure reducer into an executable injected
+owner harness with private durable receipts. Descriptor version
+`warden.case.execution.v1` is a closed local implementation seam, not an accepted
+NetKingdom type schema. It contains fixed owner/adapter/source digest, actor,
+lane, target parameter, effect, reviewed created-object identifiers declared
+retry safety and explicit required revocation scopes (parent-session and broker-grant).
+A mint descriptor cannot omit either scope. Unknown fields, free shell text and secret parameters are refused.
+An acknowledged type must additionally pin the descriptor bytes under its
+`execution_descriptors` map and independent owner evidence must authenticate
+that exact machine-seam revision. Existing descriptive types lack this map and
+remain plan-only. Their acknowledged labels do not authorize this new seam.
+
+There are no installed owner adapters, native provenance verifier or dispatch CLI
+in this change. Callables are injected only through a fixed adapter registry,
+with immutable owner reference/source pins. A real integration must supply
+independent owner/native verification or explicit attended manual evidence;
+a bare JSON receipt identifier is insufficient. Fixture verifiers in tests
+are deliberately fake and attest no native case. Caller sessions are independently
+verified for exact principal/actor/lane at admission and again before dispatch;
+input actor labels alone are never sufficient. Agent mint is refused, including
+when WARDEN_AGENT_ID appears after initial human admission.
+
+Each admission pins exact case/type/descriptor/catalog bytes, acceptance reference
+and run-sheet identity. Actual ops-mason materialization evidence is required
+against the case source, separately from its status label. Case parameters supply
+an exact metadata target. Source/session changes cannot inherit journal success.
+Owner results have a closed metadata shape, result evidence fingerprint and
+separate independently authenticated grant/parent-session revocation evidence
+fingerprints. An aggregate revoked boolean alone cannot satisfy either scope. Unknown result payloads, unverified evidence, absent revocation and
+created objects outside the reviewed scope become uncertain, never success.
+Python and OS stdout/stderr, including inherited child-process output, are
+discarded without buffering or retention under a serialized fd containment
+context. Independent provenance verification uses the same containment and
+sanitizes exceptions. All source inputs are capped at 256 KiB before parsing.
+Error text is not copied to the journal. KeyboardInterrupt/SystemExit and other
+owner interruptions are rethrown with a fixed message while retaining running
+intent for crash recovery.
+
+The journal uses an owner-private 0700 directory and 0600 files, refuses symlinks
+and insecure modes, uses SQLite FULL synchronization and commits running intent
+before calling the adapter. A separate process lock prevents concurrent mutation.
+A crash between dispatch and final receipt leaves running; the next lock holder
+persists uncertain before refusing replay. Both intent and outcome remain in
+history. Each persisted attempt has a unique identity bound to all exact pins,
+operation (run/reconcile/rollback), sequence and nonce. Adapter results and both
+revocation proof purposes carry that identity. Prior-attempt evidence cannot
+verify a safe retry, even if a caller rewrites result labels. Descriptor-created
+objects are capped at 32 and histories at 128 transitions, with dispatch stopped
+before archival is required. A throw or lost response is not failed-before-change. A safe retry needs
+verified failed-before-change, unchanged pins, descriptor retry-safe and explicit
+retry. Success and no-change cannot replay.
+
+Reconciliation is an explicit fixed owner callback, never the mutation callback.
+It may verify an already-present native CAS result as no-change/success, or prove
+failed-before-change; it never tells Warden to regenerate a credential. Uncertain
+or failed-after-change requires this owner-native inspection before any retry.
+Owner proof and revocation remain mandatory. Rollback visits only objects in a
+verified creation receipt, in reverse order; no-change has no undo and shared
+objects are excluded. Unknown/lost undo blocks another rollback.
+
+The kernel operates individual admitted steps. Full ordered run-sheet orchestration,
+verification inventory, contained login integration, native owner adapters and
+CLI activation remain WARDEN-WP-0044-T03; no overall native-complete result is
+implemented. Current Forgejo source is not materialized and has no acknowledged
+machine descriptors. Its first native run remains an acceptance requirement,
+with real materialization, separately authenticated broker-grant and parent-session
+revocation receipts, session/owner receipts and consumer enforcement. This
+implementation neither promotes a type nor changes any case status.
+
+Validation: 37 new kernel tests plus 14 reducer tests pass (51 total). Tests open
+an independent SQLite connection inside dispatch to prove running was committed,
+crash after mutation and reopen a fresh journal to prove no duplicate invocation,
+lose a response then reconcile without mint, require explicit retry, check exact
+pins/session expiry, withhold malicious output and unconfirmed revocation, and
+prove created-only reverse undo plus uncertain-undo refusal. Ruff formatting and
+checks pass. No live token or target action occurred.