coulomb/ops-warden
5
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

fix(cases): admit reviewed descriptor pin validator revision
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
tegwick 2026-10-16 21:35:04 +02:00
parent d79f065955
commit d97652a3bb
4 changed files with 72 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

37
docs/reviews/2026-10-16-browser-producer-pin-refresh.md Normal file
View file

@ -0,0 +1,37 @@
# Browser producer pin refresh — 2026-10-16
WARDEN-WP-0044-T03 source review, scoped to NetKingdom commit
`015694ee414c802dc2ef1fa0120dfed610086e69`, against Warden `d79f065`.
Reviewed the exact committed schema, validator, evidence changes and the 21
producer contract tests. The optional bounded `execution_descriptors` map now
requires lowercase exact SHA-256 byte pins keyed to declared steps. The direct
evidence API refuses malformed maps. Absent and incomplete maps retain plan-only
behavior; the repair supplies no descriptor, adapter or execution authority.
This is compatible with Warden's independently authenticated admission gates.
Refresh only the validator and evidence module pins. Composer/capability module
hashes and both reviewed parameter-definition hashes remain exact and unchanged.
All four copied module bytes match the named NetKingdom commit and canonical
checkout. No fallback, wildcard or allowed-drift path is added.
Before the refresh, explicit canonical producer integration failed both positive
version tests (1.1/1.2), with 20 refusals passing. After refresh, 87 producer,
Executor and reducer checks pass, including 14 new malformed descriptor cases
and existing missing/changed-source checks across all four pinned modules.
The 21 producer descriptor-contract checks and focused Ruff checks also pass.
Use `WARDEN_TEST_NETKINGDOM_ROOT=/home/worsch/net-kingdom` explicitly: the
isolated checkout's default sibling can resolve another checkout.
Emergent knowledge 0.2.6 digest
`8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02`
was withheld due to source drift; start/local-work cards and actual source were
reviewed directly. It conveys no authority.
No new browser or identity-restore adapter was admitted or attested. No credential
or privileged execution occurred. Native structural receipts, authenticated owner
provenance, descriptor assent, attended sessions, ordered verification and the
first native case run remain open. T03 stays progress; T04 stays wait.
Exact pin hashes, tests and publication identity are retained under the Custodian
`docs/changes/netkingdom-target-2026-10-16/warden-browser-pin-refresh/` directory.