fix(cases): validate browser metadata against pinned owner source

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

docs/security-case-execution-kernel-v1.md

@@ -84,3 +84,44 @@ lose a response then reconcile without mint, require explicit retry, check exact
 pins/session expiry, withhold malicious output and unconfirmed revocation, and
 prove created-only reverse undo plus uncertain-undo refusal. Ruff formatting and
 checks pass. No live token or target action occurred.
+
+## Browser input projection — 2026-10-16 source preparation
+
+An explicitly configured `BrowserInputs(netkingdom_root)` now validates browser
+cases before admission. It calls the real NetKingdom type/case validator over
+verified producer bytes in a disposable Python process (`-I`, empty environment,
+timeout, no inherited output). The validator, composer, capability contract and lazy evidence
+modules have exact source pins; missing or changed code refuses. There is no
+automatic discovery or download. A producer upgrade needs reviewed pin changes.
+
+Only the exact reviewed 1.1/1.2 browser parameter definitions qualify. A digest
+of each complete parameter definition list prevents reclassifying secrets as
+metadata, loosening constraints, or adding fields under a recognized version.
+The complete case passes producer validation, including required fields,
+constraints and credential-shape checks. Explicit fixed/default overrides,
+unknown fields and secret references refuse. Security-sensitive browser metadata
+can therefore be present without being passed to an owner adapter: the only
+projection is its descriptor's exact public/operational target identifier.
+No raw parameter values are added to invocations or persisted receipts.
+
+`require_implemented=False` validates the acknowledged type's source, not its
+execution authority. Existing descriptor/type/source/catalog/caller provenance
+gates stay mandatory. Neither historical browser type contains the required
+exact machine-descriptor map, and neither is promoted by this change. There are
+still no installed native owner adapters, authenticated provenance verifier,
+contained session/ordered run orchestration or live CLI dispatch. A journal digest
+is a fingerprint and cannot authenticate native evidence. Completion still needs
+owner-admitted descriptors and actual structural, mint/delivery, consumer and
+revocation/rollback evidence. Local fixture success is not native acceptance.
+
+Tests use the actual producer checkout (override sibling location with
+`WARDEN_TEST_NETKINGDOM_ROOT`), the real Executor, SQLite journal and injected
+test-only owner adapter/evidence verifier. Their descriptor extensions and case
+materialized labels exist only in memory. Canonical case/type bytes stay intact.
+
+Producer integration refinement: the accepted NetKingdom browser-case patch
+`d32a7f51cbf3012bee3e4bb329f4259dea867eff1c59a2b01a65d72774488d05`
+is now the tested producer revision. Its evidence module is imported lazily only
+by `check-evidence`, outside this admission path; Warden nevertheless pins and
+copies it with the complete reviewed producer set. Missing or modified bytes in
+any of the four modules refuse admission. The test covers every dependency.