ops-warden/docs/security-case-execution-kernel-v1.md

Closed case execution kernel v1 — 2026-10-11

Owner implementation record for WARDEN-WP-0044-T03. The architectural proposal at SHA256 78ab1439e4c5beb205aeccf15b1b2e706511be55ab195c5a3aa682f326c7c77c was accepted through memo infd-20261010-security-case-execution, version 1, approval e46b149b-ec3c-4b3b-98a7-dcb4934448ca, confirmed disposition disp-cf44dacb-2117-4de7-8f90-cfa99f84f325 at 2026-10-10T23:23:31Z. The original approved proposal remains byte-identical. That decision accepts source design; it grants no execution session, credential or deployment authority.

src/warden/case_run.py advances the pure reducer into an executable injected owner harness with private durable receipts. Descriptor version warden.case.execution.v1 is a closed local implementation seam, not an accepted NetKingdom type schema. It contains fixed owner/adapter/source digest, actor, lane, target parameter, effect, reviewed created-object identifiers declared retry safety and explicit required revocation scopes (parent-session and broker-grant). A mint descriptor cannot omit either scope. Unknown fields, free shell text and secret parameters are refused. An acknowledged type must additionally pin the descriptor bytes under its execution_descriptors map and independent owner evidence must authenticate that exact machine-seam revision. Existing descriptive types lack this map and remain plan-only. Their acknowledged labels do not authorize this new seam.

There are no installed owner adapters, native provenance verifier or dispatch CLI in this change. Callables are injected only through a fixed adapter registry, with immutable owner reference/source pins. A real integration must supply independent owner/native verification or explicit attended manual evidence; a bare JSON receipt identifier is insufficient. Fixture verifiers in tests are deliberately fake and attest no native case. Caller sessions are independently verified for exact principal/actor/lane at admission and again before dispatch; input actor labels alone are never sufficient. Agent mint is refused, including when WARDEN_AGENT_ID appears after initial human admission.

Each admission pins exact case/type/descriptor/catalog bytes, acceptance reference and run-sheet identity. Actual ops-mason materialization evidence is required against the case source, separately from its status label. Case parameters supply an exact metadata target. Source/session changes cannot inherit journal success. Owner results have a closed metadata shape, result evidence fingerprint and separate independently authenticated grant/parent-session revocation evidence fingerprints. An aggregate revoked boolean alone cannot satisfy either scope. Unknown result payloads, unverified evidence, absent revocation and created objects outside the reviewed scope become uncertain, never success. Python and OS stdout/stderr, including inherited child-process output, are discarded without buffering or retention under a serialized fd containment context. Independent provenance verification uses the same containment and sanitizes exceptions. All source inputs are capped at 256 KiB before parsing. Error text is not copied to the journal. KeyboardInterrupt/SystemExit and other owner interruptions are rethrown with a fixed message while retaining running intent for crash recovery.

The journal uses an owner-private 0700 directory and 0600 files, refuses symlinks and insecure modes, uses SQLite FULL synchronization and commits running intent before calling the adapter. A separate process lock prevents concurrent mutation. A crash between dispatch and final receipt leaves running; the next lock holder persists uncertain before refusing replay. Both intent and outcome remain in history. Each persisted attempt has a unique identity bound to all exact pins, operation (run/reconcile/rollback), sequence and nonce. Adapter results and both revocation proof purposes carry that identity. Prior-attempt evidence cannot verify a safe retry, even if a caller rewrites result labels. Descriptor-created objects are capped at 32 and histories at 128 transitions, with dispatch stopped before archival is required. A throw or lost response is not failed-before-change. A safe retry needs verified failed-before-change, unchanged pins, descriptor retry-safe and explicit retry. Success and no-change cannot replay.

Reconciliation is an explicit fixed owner callback, never the mutation callback. It may verify an already-present native CAS result as no-change/success, or prove failed-before-change; it never tells Warden to regenerate a credential. Uncertain or failed-after-change requires this owner-native inspection before any retry. Owner proof and revocation remain mandatory. Rollback visits only objects in a verified creation receipt, in reverse order; no-change has no undo and shared objects are excluded. Unknown/lost undo blocks another rollback.

The kernel operates individual admitted steps. Full ordered run-sheet orchestration, verification inventory, contained login integration, native owner adapters and CLI activation remain WARDEN-WP-0044-T03; no overall native-complete result is implemented. Current Forgejo source is not materialized and has no acknowledged machine descriptors. Its first native run remains an acceptance requirement, with real materialization, separately authenticated broker-grant and parent-session revocation receipts, session/owner receipts and consumer enforcement. This implementation neither promotes a type nor changes any case status.

Validation: 37 new kernel tests plus 14 reducer tests pass (51 total). Tests open an independent SQLite connection inside dispatch to prove running was committed, crash after mutation and reopen a fresh journal to prove no duplicate invocation, lose a response then reconcile without mint, require explicit retry, check exact pins/session expiry, withhold malicious output and unconfirmed revocation, and prove created-only reverse undo plus uncertain-undo refusal. Ruff formatting and checks pass. No live token or target action occurred.