coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Preserve canonical journal digests and bounded JWT source reviews
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
codex 2026-10-11 17:30:10 +02:00
parent 4ed50501f6
commit 4e8fa6e831
6 changed files with 241 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

51
workplans/RPF-WP-0035-credential-lane-implementation.md
View file

@ -1078,3 +1078,54 @@ CAS requires an explicit reviewed one-use maintenance exception and close-down
entry, plus reconciliation, before native go. No helper/source acknowledgment
waives that gate. Private token producer/callback/client/custody admission and
actual native negative/revoke/restoration/cleanup remain prerequisites.
2026-10-11 T13 v7 node-route preparation refinement (same trial): exact frozen
manifest `90aabec336008d7d51e37c04b5ff96ba8ed6630821cca1a4c333d803367247f7`
and all entries verified.58 supplied lifecycle/route checks plus9 independent
checks pass offline. Actual main now verifies source/public health before private
stdin; execute preserves the original wall/monotonic window rather than renewing
it. Actual child-process partial-pipe counterexample shows unbounded stdin.read
remains blocked beyond a synthetic20ms original window (still alive after100ms
without EOF). No credential/native/provider access is involved. Before private
producer admission, require byte-capped, deadline-bounded JSON input and EOF within
the original window, with fail-closed fixed receipt and no protected effects.
This completed ownT13 preparation precedes formal v7 source changes-requested
review. Retain v6 qualified health-gate agreement and all prior reviews; neither
v7 health ordering nor any source acknowledgment establishes custody completion,
actual route/plugin/leeway/readiness/Argo identity or founder/runtime authority.
Native and private-producer gates remain open; no owner checkout write occurred.
2026-10-11 T13 v8 bounded-input correction preparation (same trial): exact
frozen manifest `316fd6005cc4cb7fe14ea69a5fd408aed13e6122afef60afd13d97952b27cf4a`
and all entry hashes verified.65 supplied tests plus12 fresh independent checks
pass offline, including a standard buffered stdin pipe with complete JSON/noEOF
interrupted within original20ms window and restored SIGALRM state; exact64KiB
JSON/EOF accepted and extra byte refused, UTF8 token bytecap enforced, original
wall deadline clips longer monotonic budget. Original preinput window is retained.
Completed ownT13 preparation precedes fresh exact source review; v7 refusal and
v6 qualified agreement/prior reviews retained. This accepts child bounded-input
source only. No parent-ready handshake exists: producer must not eagerly pipe
private inputs, and producer/session/window readiness protocol remains an
unimplemented admission gate. No custody/native completion, sourcepacket approval
authentication, route/plugin/leeway/readiness/Argo observation or inherited grant.
Native prerequisites and producer handoff remain open; no owner checkout changed.
2026-10-11 T11 journal v4 canonical-format preparation refinement (same trial):
exact frozen manifest `22c6d225d393b994ab7b44a43904ced1b6d7f74e0e2bebf71ffe99f87191ef4c`
and entry hashes verified. Actual access-engine pkg/api/canonical.go RequestDigest/
CanonicalDigest, Approval binding.py and Secrets authorization/approval_consume
all use sha256:<64 lowercase hex> request digests. V4 now preserves this exact
request value without prefix stripping; plan/call/evidence content hashes remain
explicit bare64hex.15 supplied checks plus15 fresh independent checks pass,
including malformed prefix/bare/uppercase/trailing whitespace refusal before
reservation, exact persistent value/reopen/mismatch replay, private-file mode,
real child crash after pending intent, ill-typed confirmations and pending-unknown
refusal. Completed ownT11 preparation precedes formal v4 source review; prior v2
refusal/v3 approval and T13 v7 refusal/v8 source acknowledgment retained.
Acceptance is unintegrated primitive source only; no data migration/native use
of v3 journal has occurred. RPF35-T12 caller/PDP/consume validation, independent
owner plan compiler/restricted adapter, private runtime custody, bounded execution
and owner-private unknown cleanup recovery remain open. No checkout/native writes.