secrets-engine/docs/proposals/native-cli-admission/proposal.json

{
  "proposal_id": "SECRETS-WP-0014-native-cli-20261016",
  "status": "preparation only; not installable or executable authorization",
  "source_base": "4dd004a2250104ba56293b2d7b0d96f4e076ea99",
  "workplans": [
    "SECRETS-WP-0014-T02",
    "SECRETS-WP-0014-T03",
    "SECRETS-WP-0013-T01",
    "SECRETS-WP-0013-T03"
  ],
  "initial_scope": {
    "producer": "existing flex-auth/flex-auth-secrets-engine lifecycle pin",
    "consumer": "existing Secrets CLI serving authorization workflow, prospective reviewed release-bundle entrypoint only",
    "stage1": "independent signer/package/trust admission and offline captured native allow+deny verification; zero protected effects",
    "native_effects_admitted": 0,
    "task_execution_enabled": false
  },
  "owner_returns": {
    "access": "Custodian docs/changes/netkingdom-target-2026-10-16/access-native-preparation/native-admission-proposal-r1.json and source-policy-pins.json",
    "platform": "No selected actual approved CCR/catalog/Plan/descriptor/grant/install placement; CCR-2026-0042 remains in_flight without matching catalog. Disposable source proofs are not production inputs."
  },
  "producer_pin": {
    "evaluator": "flex-auth/local",
    "mode": "standalone",
    "policy_package": "secrets-engine.catalog-lane.lifecycle",
    "policy_version": "v2",
    "policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4"
  },
  "independent_admission": {
    "production_kid": null,
    "public_key": null,
    "public_key_sha256": null,
    "custody_receipt": null,
    "candidate_producer_oci_digest": null,
    "rule": "No responder keys endpoint, synthetic fixture key or deployment metadata substitutes for independent owner admission",
    "receipt_verifier_integrated_revision": "2b064eee510640224274ccdc7cefceb1ae13162e",
    "signer_purpose_pin_and_sharing_receipt": null,
    "public_fingerprint_convention": "Platform proposal: sha256(canonical unpadded base64url43 public-key ASCII); independent owner receipt required",
    "candidate_producer_prerequisite": "Access durable-log hardening source and immutable image/storage/custody awaiting separate root/Platform review; published2b064ee alone is not native candidate admission"
  },
  "placement": {
    "owner": "Secrets consumer/deploying owner; exact runtime UID and paths not yet agreed",
    "cli_release_prefix": null,
    "cli_entrypoint": "<admitted-prefix>/bin/secrets-engine",
    "fixed_verifier": "<admitted-prefix>/libexec/secrets-engine-pdp-verify",
    "config_parent": null,
    "trust_file": null,
    "catalog_directory": null,
    "policy_directory": null,
    "pep_stance_file": null,
    "evidence_directory": null,
    "constraints": [
      "new owner-controlled immutable release prefix; no overwrite or rolling source alias",
      "absolute independently reviewed config/catalog/policy/stance/trust paths; no working-directory defaults for native use",
      "trust regular non-symlink, not group/world writable; key admission not file-presence inference",
      "owner retains manifest/admission/installation receipts and same-UID control boundary"
    ],
    "candidate_cli_release_prefix": "/home/worsch/.local/share/secrets-engine/releases/4dd004a22501-105dcebe6f03",
    "candidate_status": "proposal only; no path selected/created/admitted"
  },
  "configuration_contract": {
    "SECRETS_ENGINE_PDP_URL": "literal loopback bare origin bound to independently verified cluster and named producer pod; exact native port awaiting owner placement",
    "SECRETS_ENGINE_PDP_TOKEN_FILE": "admitted bounded Secrets ServiceAccount caller file outside Git; no mint/read here",
    "SECRETS_ENGINE_PDP_TRUST_FILE": "absolute independently admitted lifecycle trust path; empty-key template deliberately refuses",
    "SECRETS_ENGINE_PDP_VERIFIER": "bundle wrapper fixes installed helper; no ambient override or source-checkout helper",
    "SECRETS_ENGINE_AUTHORIZATION_SUBJECT_ID": "secrets-engine",
    "SECRETS_ENGINE_AUTHORIZATION_SUBJECT_TYPE": "service",
    "SECRETS_ENGINE_AUTHORIZATION_POLICY_PACKAGE": "secrets-engine.catalog-lane.lifecycle",
    "SECRETS_ENGINE_AUTHORIZATION_POLICY_VERSION": "v2",
    "SECRETS_ENGINE_APPROVAL_URL": "independently admitted Approval endpoint/owner-bound tunnel; not yet supplied for this session",
    "SECRETS_ENGINE_APPROVAL_CLIENT_SECRET_FILE": "separately admitted attended provider lifetime from existing custody contract; no read here",
    "SECRETS_ENGINE_APPROVAL_TOKEN_FILE": "unset when client-secret provider selected; no simultaneous providers",
    "SECRETS_ENGINE_CATALOG": "absolute owner-admitted metadata directory; initial actual lane unselected",
    "SECRETS_ENGINE_POLICIES": "absolute owner-admitted metadata/policy directory",
    "SECRETS_ENGINE_PEP_STANCE": "absolute hash-pinned existing total stance map; prod remains fail_closed",
    "SECRETS_ENGINE_EVIDENCE": "absolute owner-private evidence/outbox path with declared custody/delivery",
    "SECRETS_ENGINE_UNSAFE_DEMO": "unset; no native exception",
    "backend_provider": "no new selection/entitlement; configured service-jwt protected handlers remain blocked; do not switch to bootstrap/env as workaround"
  },
  "rotation": {
    "admit": "owner reviews independent new kid/public key/custody receipt and bounded overlap, preserving exact issuer/policy artifact pin",
    "roll": "separate exact producer candidate digest/seed projection rollout with native signed receipts; never fetch discovery keys",
    "remove": "after new-key native receipt/consumer acceptance, remove old kid and prove old-key refusal",
    "rollback": "retain reviewed signed producer/key overlap or stop/refuse. An unsigned old deployment is an outage; never disable consumer verification, restore removed key without review, relax pin, widen backend grants or blind retry consumed operation"
  },
  "task_mapping_gap": {
    "existing_cli_execute_ccr_command": false,
    "source_handoff": "secrets_engine.task_execution_handoff prepare_task_approval/authorize_task_execution/consume_task_execution",
    "platform_source_mediator": "railiance-platform/scripts/task_execution_mediator.py run_native_fixture_task; source proof only",
    "unadmitted_inputs": [
      "native admission of the existing exact service-caller-to-subject request mapping and immutable original-claim/source join",
      "owner-selected fresh approved CCR/catalog/execution-grant, compiled Plan/whole descriptor and operation UUID",
      "independent expected-before/after bytes for exact two metadata targets and actual estate/backend origin",
      "actual source/Plan/install/journal/cleanup placement and trusted provider endpoints/credentials/custody",
      "load-bearing audit/outbox cadence and durable receipt correlation",
      "exact native task v2 policy/caller/source/config/placement/key/runtime admission; v1 hard DENY retained"
    ],
    "approval_fact_interface_review": {
      "status": "implemented/source-proved; native source/config/identity/trust admission remains missing",
      "preserve": "type-sensitive original context/native/request/descriptor correspondence; original and independently fresh fact deadlines; no numeric translation",
      "receipt": "Custodian decision-trusted-successor/verification-final-r4.json"
    },
    "approval_fact_contract": {
      "artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-fact-contract/consumer-contract.md",
      "sha256": "sha256:3dfb7987a4d9fe461b917cfa5bae7beef61bc4d9a4561fdded3e90128f5966de",
      "vectors_artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-fact-contract/golden-vectors.json",
      "vectors_sha256": "sha256:dfb0a8810cd91847d7af6a7af6a51607a67a66fad7b86fc57365308c36bd9323",
      "status": "owner contract/helper source implemented and integrated; Go conformance and actual source-server B2 behavior proved; native identity/config/trust/custody/effect admission remains unaccepted",
      "required": "preserve original fact/context/freshness, independently validate fresh fact window and exact nonfreshness authority; do not translate native numeric digests or invent target restrictions",
      "historical_attribution": "artifact and golden vectors below identify the initial prehelper contract; their former pending status was historical source preparation, not current implementation",
      "current_helper_package": {
        "artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-go-fact/manifest.json",
        "sha256": "sha256:6d67f0005d4642bc60ed3a5f8901442f10c7bbf3f6b5d9fb8dba621298ed3851"
      },
      "integrated_source": {
        "producer_git_commit": "2b064eee510640224274ccdc7cefceb1ae13162e",
        "consumer_git_commit": "4dd004a2250104ba56293b2d7b0d96f4e076ea99",
        "receipt": "the-custodian/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/verification-final-r4.json",
        "receipt_sha256": "sha256:9ed4d80a7d1aa7353d7b57954b7924a146329d1bd18a3f9152c6055bd51b92b5"
      }
    },
    "source_status": "implemented and cross-owner source-server proved, including retained registry and precise CAS; no native adoption"
  },
  "approval_state": "no owner assent, key admission, install, caller token, operation grant or live change requested/executed by this preparation",
  "denominator": {
    "shared_check_implementation": 1,
    "serving_cli_call_sites": 11,
    "serving_cli_handlers": 10,
    "lifecycle_pdp_action_values": 12,
    "native_effect_call_sites_accepted": 0,
    "excluded": [
      "session revoke stance-only backend path",
      "service-auth explicit identity probes",
      "route ambient-backend readiness probes",
      "dry-run/non-effect reporting"
    ],
    "task_cli_command_count": 0,
    "platform_source_mediator_native_acceptance": false,
    "generic_cli_consume_is_strict_task_handoff": false,
    "effect_acceptance_required": "Review actual selected handler/generic consume response and caller scope separately; strict Platform fixture proof does not close existing CLI effects"
  },
  "historical_source_base": "ff1a13dabd44ba02ddd6bc26ad75568f6d2e6225",
  "release_candidate": {
    "bundle_manifest_sha256": "sha256:105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e",
    "helper_sha256": "sha256:ed922b62533e4d33ae2d5f11175111f6f28e684a19e63ac704d43b63f0e0e12e",
    "two_clean_builds_equal": true,
    "disposable_install_passed": true,
    "native_install_admitted": false,
    "artifact_integrity_is_not_package_admission": true,
    "receipt": "Custodian decision-native-preparation/r2/canonical-build-install-receipt.json"
  }
}