From 30d22908882146b0694d12c58d7793b25dd668be Mon Sep 17 00:00:00 2001 From: codex Date: Sun, 11 Oct 2026 19:47:45 +0200 Subject: [PATCH] Retain qualified coding custody source assessment and plan index Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade --- WORK-RECORDS.md | 3 +- ...nt-custody-platform-source-assessment.json | 49 +++++++++++++++++++ 2 files changed, 51 insertions(+), 1 deletion(-) create mode 100644 docs/reviews/2026-10-11-key39-coding-client-custody-platform-source-assessment.json diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index b172ee5..3da1a90 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -36,6 +36,7 @@ | workplan | RPF-WP-0055 | backlog | — | workplans/RPF-WP-0055-keycape-client-secret-rotation-residual.md | | task | RPF-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md | | task | RPF-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md | +| task | RPF-WP-ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md | | task | RPF-WP-0015-T01 | done | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md | | task | RPF-WP-0015-T02 | wait | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md | | task | RPF-WP-0015-T03 | wait | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md | @@ -63,7 +64,7 @@ | task | RPF-WP-0035-T09 | wait | — | workplans/RPF-WP-0035-credential-lane-implementation.md | | task | RPF-WP-0035-T10 | wait | — | workplans/RPF-WP-0035-credential-lane-implementation.md | | task | RPF-WP-0035-T11 | done | — | workplans/RPF-WP-0035-credential-lane-implementation.md | -| task | RPF-WP-0035-T12 | todo | — | workplans/RPF-WP-0035-credential-lane-implementation.md | +| task | RPF-WP-0035-T12 | progress | — | workplans/RPF-WP-0035-credential-lane-implementation.md | | task | RPF-WP-0035-T13 | done | — | workplans/RPF-WP-0035-credential-lane-implementation.md | | task | RPF-WP-0036-T01 | done | — | workplans/RPF-WP-0036-platform-service-assurance.md | | task | RPF-WP-0036-T02 | done | — | workplans/RPF-WP-0036-platform-service-assurance.md | diff --git a/docs/reviews/2026-10-11-key39-coding-client-custody-platform-source-assessment.json b/docs/reviews/2026-10-11-key39-coding-client-custody-platform-source-assessment.json new file mode 100644 index 0000000..7ff8789 --- /dev/null +++ b/docs/reviews/2026-10-11-key39-coding-client-custody-platform-source-assessment.json @@ -0,0 +1,49 @@ +{ + "schema": "platform-owner-source-assessment/v1", + "owner": "railiance-platform", + "role": "own custody/delivery source projection; maker qualification, not independent technical approval", + "task": "RPF-WP-ADHOC-2026-10-11-T03", + "completed_owner_record_before_formal_entry": { + "commit": "9460f6f", + "path": "workplans/ADHOC-2026-10-11.md", + "sha256": "c659956b2280bb2fa40d21a7ac6acca9514304aa5e7282b9ff61cd741881b544" + }, + "exact_input_manifest_sha256": "18c6cac097104f79ef15e4293c6c8b18bebd617289df8f168b1cfe7d5e69598c", + "exact_proposal_sha256": "959a924adc12283405c529ecd573cad5e16f4dd9c96c258c44cab8df014dc8c0", + "disposition": "qualified_public_source_projection_agreement; actual custody_and_delivery_admission_not_established", + "source_agreement": [ + "Current Key client fragment and Platform JWT role bind named codex client and tenant:platform; standing table source correction is exact", + "Current existing JWT role/policy bytes remain unchanged; no direct agent client-secret read grant or token substitution", + "Candidate coordinates are proposed, not observed or installed; no CCR assigned and browser CCR0040 is outside this case", + "Checked Deployment source lacks named env ref; bounded CCR/grant/catalogue source search finds no exact admission receipt; neither fact proves live absence" + ], + "checks": { + "passed": 15, + "kind": "offline public-source consistency and counterexamples only", + "script": "/tmp/platform-key39-coding-custody-stage/checks/check_public_source.py", + "sha256": "169a0d8e92088cbeacd4b3f63bc5b6c02169856d15e49f8ccad5757c949fdf01", + "implementation_or_native_proof": false + }, + "specific_source_counterexamples": [ + "CLI valid signed JWT with wrong coding subject/tenant/type/roles is not rejected by its generic claim verifier; exact coding producer check absent", + "CLI expiry ceiling above900 is not enforced by generic verifier; future exact producer must add it", + "Stale tenant:coulomb source table fails projection agreement", + "Existing shared issuer/ESO admission, browser generation CCR or historical AppRole proof cannot substitute for named client custody/delivery" + ], + "required_returns_before_credentials": [ + "Exact Platform reviewed CCR/grant/catalogue/custody version and one-use founder reader binding", + "Net privately projected active client registration and env reference with matched custody/issuer versions, dedicated reader and controller/Argo/readiness owners", + "Reviewed private producer binding signature-verified subject/tenant/type/roles/scope/finite900 maximum", + "Actual runtime isolation from agent, exclusive tmpfs/host/process/profile and founder private environment/file delivery", + "Fresh exact authenticated founder native decision, runtime/plugin/leeway/node health and required production maintenance exception", + "Value-free refusal correlation, verified known-token revoke and owner-private unknown recovery" + ], + "native_authorized": false, + "custody_reader_authorized": false, + "client_registration_authorized": false, + "transport_authorized": false, + "new_CCR_or_grant": false, + "standing_policy_widened": false, + "RPF55_residual_promoted": false, + "KEY39_native_complete": false +}