coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Accept corrected service JWT boundary verifier source only

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
codex 2026-10-11 14:12:02 +02:00
parent 83890db963
commit c0797e40cb
2 changed files with 60 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

42
docs/reviews/2026-10-11-secrets-service-jwt-v3-platform-review.json Normal file
View file

@ -0,0 +1,42 @@
{
"all_named_file_and_proof_hashes_verified": true,
"completed_work_record": "workplans/RPF-WP-0035-credential-lane-implementation.md",
"completed_work_record_original_sha256": "03af4bfd31f89d7d4df1e6673c1038ab4a64e839deac965ea8dcbfd122e890e5",
"corrections_verified": [
"PLATFORM-SE-V2-C01: cleanup must return without exception, no failure marker, and complete typed lifecycle evidence; stale true evidence cannot override close exception.",
"PLATFORM-SE-V2-C02: native acceptance now requires fixed in-memory source, establishment, attempted/confirmed operator and service revokes, and both bounded 12-hex session fingerprints. Actual in-memory provider/login source maps absent accessors to empty handles which fail these gates.",
"PLATFORM-SE-V2-C03: any top-level errors member, including empty/null, invalidates HTTP200/object-data envelopes.",
"Configured origin is checked before token send; environment proxies disabled; all redirects refused; HTTP200/application-json/bounded object data only; raw error/evidence suppression retained.",
"Packet keeps claim negatives/expiry/use/native MASON acceptance separate, recognizes deployed login-only identity and missing protected execution entitlement, and does not change default or standing service policy."
],
"decision": "approved",
"frozen_inputs_changed": false,
"intent_basis": "Platform INTENT Core Principles 2 Stable Interfaces, 4 Secure Custody and 5 Operable/Observable: constrained metadata interface and truthful cleanup evidence; declared Staff/PEP-shaped Tooling gaps, not new authority.",
"live_handoff": "RPF-WP-0035-T02 retains login/claims/TTL/use/MASON gates. T12 retains new entitlement implementation and native owner acceptance. Existing design is unimplemented proposal: explicit typed metadata-only execute-ccr pilot does not fulfill general AppRole/KV Lifecycle API. Secrets T06 remains open until actual intended protected action plus dispatcher/steady-state adoption.",
"not_approved": [
"founder native attendance or production execution",
"CCR admission/status/binding changes",
"native identity/claim/expiry/use/revoke acceptance",
"MASON reader matrices or nonmember refusal",
"new task execution backend or steady-state/default migration",
"T02/T06 completion"
],
"prior_changes_requested_retained": true,
"prior_review": "docs/reviews/2026-10-11-secrets-service-jwt-v2-platform-review.json",
"prior_review_sha256": "b5b8e6d9beeadadc22b0c2fe98da02e3dd4955d93948d336f529a3912cc2a087",
"review_scope": "corrected identity-boundary verifier and truthful source/adoption packet only; not native acceptance or execution entitlement",
"reviewed_manifest": "/tmp/secrets-service-jwt-next-stage-v3/manifest.json",
"reviewed_manifest_sha256": "6bb05bac74e4939c3e42db2ae95c5f9fb4616bb20cc285811a315c26669ebce1",
"reviewed_verifier_sha256": "f672643118aa454b35635f790d74ce9b0d9b777c2c8ef3680115d6ba0812eac4",
"reviewer": "railiance-platform-owner (agent railiance-platform, codex)",
"same_trial": true,
"schema": "owner-source-review/v1",
"validation": {
"command": "PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=/home/worsch/secrets-engine/src /home/worsch/secrets-engine/.venv/bin/python -m pytest -q -p no:cacheprovider /home/worsch/secrets-engine/tests/test_engine_auth.py /home/worsch/secrets-engine/tests/test_openbao_secret_source.py /tmp/secrets-service-jwt-next-stage-v3/tests/test_service_jwt_boundary.py /tmp/platform-jwt-execution-contract-stage/revision-v3/tests/test_frozen_secrets_v3_regressions.py",
"credential_requests_or_access": false,
"native_actions": false,
"result": "49 maker/current provider tests plus 3 independent regressions passed; synthetic/local only",
"tests": 52
},
"work_item": "RPF-WP-0035-T11"
}

18
workplans/RPF-WP-0035-credential-lane-implementation.md
View file

@ -908,6 +908,7 @@ bump cannot remove KeyCape's secret before step 3.
id: RPF-WP-0035-T11
status: done
priority: high
state_hub_task_id: "7952c8cd-c066-5b72-a025-78d24341c1ab"
```
2026-10-11: Platform-scoped agent loaded this checkout's AGENTS.md and INTENT,
@ -934,6 +935,7 @@ id: RPF-WP-0035-T12
status: todo
priority: high
depends_on: [RPF-WP-0035-T11]
state_hub_task_id: "914bf383-c13f-5247-9af0-91d7e3a4784a"
```
Review the proposed task-execution-grant schema and exact metadata-only execute-ccr
@ -945,3 +947,19 @@ Prove disposable intended result and identity/action/target/body/time/replay/cra
cleanup negatives, and return owner-native acceptance. Existing service login policy
and defaults stay unchanged. T02 still owns login/claim/TTL/use/MASON acceptance;
Secrets T06 separately owns dispatcher adoption and steady-state default migration.
2026-10-11 T11 refinement (same source-review trial): the exact Secrets Engine
v3 manifest `6bb05bac74e4939c3e42db2ae95c5f9fb4616bb20cc285811a315c26669ebce1`
and all named bytes/proof were verified and independently re-reviewed. The three
v2 counterexamples are corrected: close exceptions cannot pass through stale true
flags, complete typed source/session/attempted/revoke evidence is required, and
mixed HTTP200 errors/data fails closed. 49 maker/current-provider tests plus three
independent regressions passed (52, synthetic/local only). Platform source review
`docs/reviews/2026-10-11-secrets-service-jwt-v3-platform-review.json` approves only
the corrected boundary verifier and truthful packet. Prior changes-requested v2
review is retained; this is not a second native success or changed authority.
No native or founder go is granted. T02, T12 and Secrets T06 remain open; the
metadata-only execute-ccr pilot is explicitly insufficient for generic lifecycle
adoption. All consume-verification/journal/action/body/backend implementation and
native acceptance gates remain real prerequisites, not architecture promises.