Record reproducible CLI release and exact native admission requirements

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

docs/proposals/native-cli-admission/README.md

@@ -1,5 +1,52 @@
 # Native CLI signer and consumer admission preparation
 
+## Current release preparation — 2026-10-16 R2
+
+Published canonical Secrets `4dd004a2250104ba56293b2d7b0d96f4e076ea99` was
+built twice from an isolated clean checkout. Artifacts and deterministic bundle
+manifest match exactly: manifest SHA256
+`sha256:105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e`,
+fixed helper SHA256
+`sha256:ed922b62533e4d33ae2d5f11175111f6f28e684a19e63ac704d43b63f0e0e12e`.
+Disposable installation/help and empty native trust refusal pass; no native
+prefix, trust/key, caller credential, protected effect or rollout was admitted.
+Artifact integrity is not independent package admission. Full receipts and a
+concrete probe/placement proposal are in Custodian `decision-native-preparation/r2/`.
+
+Initial native scope remains the existing lifecycle pin and **0/11 protected
+sites across10 handlers**. Runtime UID/release/config/catalog/stance/trust/evidence
+and scoped caller/Approval delivery paths remain owner-unselected. A concrete
+workstation candidate uses a new release prefix ending
+`4dd004a22501-105dcebe6f03`; it is a proposal, not an installed/admitted path.
+Only its exact future `bin/secrets-engine` wrapper is the effect entrypoint.
+The current repo editable invocation and ambient demo/preflight fallbacks do not
+constitute release admission. A local CLI does not automatically hold the named
+ServiceAccount identity: existing docs describe separately authorized per-session
+TokenRequest delivery, not a standing credential or pod identity grant.
+
+Access's single offline signer-receipt tool is published at
+`2b064eee510640224274ccdc7cefceb1ae13162e`; verified API/sign source matches this
+consumer. Native producer rollout still awaits independent public kid/key/custody
+and immutable candidate image/log/storage returns, including the Access owner's
+separate durable-log hardening review. Published source alone is not that image.
+The lifecycle pin stays v2/bd11c5fe...; task v2 is a separate unadmitted pin.
+
+Source task correspondence is now implemented and cross-owner source-server
+proved: fixed typed service mapping before issue, retained-registry signed-DENY
+preapproval, original claim/context preservation, independent fresh source facts,
+precise Approval CAS and independent confirmation/journal/native disposable proof.
+This supersedes the historical source gaps below; it neither adds an execute-ccr
+CLI command nor selects a real CCR/catalogue/Plan/grant/backend/journal runtime.
+All native effect, caller/key/config and task-entitlement gates remain open under
+existing WP14/WP13/WP8 records. `service-jwt` still refuses protected CLI work.
+
+## Historical ff1a13d preparation (preserved)
+
+The following draft records the earlier source/admission observations. References
+to absent B2/B3/request/source-fact implementation are superseded by R2 above;
+missing native keys, runtime placement and actual task inputs remain unresolved.
+
+
 This proposal covers the existing lifecycle CLI authentication path under
 SECRETS-WP-0014. It grants no installation, key retrieval, caller mint, approval
 consume, OpenBao effect or task-policy activation. All native acceptance counts

docs/proposals/native-cli-admission/proposal.json

@@ -1,7 +1,7 @@
 {
   "proposal_id": "SECRETS-WP-0014-native-cli-20261016",
   "status": "preparation only; not installable or executable authorization",
-  "source_base": "ff1a13dabd44ba02ddd6bc26ad75568f6d2e6225",
+  "source_base": "4dd004a2250104ba56293b2d7b0d96f4e076ea99",
   "workplans": [
     "SECRETS-WP-0014-T02",
     "SECRETS-WP-0014-T03",
@@ -33,8 +33,10 @@
     "custody_receipt": null,
     "candidate_producer_oci_digest": null,
     "rule": "No responder keys endpoint, synthetic fixture key or deployment metadata substitutes for independent owner admission",
-    "receipt_verifier_integrated_revision": null,
-    "signer_purpose_pin_and_sharing_receipt": null
+    "receipt_verifier_integrated_revision": "2b064eee510640224274ccdc7cefceb1ae13162e",
+    "signer_purpose_pin_and_sharing_receipt": null,
+    "public_fingerprint_convention": "Platform proposal: sha256(canonical unpadded base64url43 public-key ASCII); independent owner receipt required",
+    "candidate_producer_prerequisite": "Access durable-log hardening source and immutable image/storage/custody awaiting separate root/Platform review; published2b064ee alone is not native candidate admission"
   },
   "placement": {
     "owner": "Secrets consumer/deploying owner; exact runtime UID and paths not yet agreed",
@@ -52,7 +54,9 @@
       "absolute independently reviewed config/catalog/policy/stance/trust paths; no working-directory defaults for native use",
       "trust regular non-symlink, not group/world writable; key admission not file-presence inference",
       "owner retains manifest/admission/installation receipts and same-UID control boundary"
-    ]
+    ],
+    "candidate_cli_release_prefix": "/home/worsch/.local/share/secrets-engine/releases/4dd004a22501-105dcebe6f03",
+    "candidate_status": "proposal only; no path selected/created/admitted"
   },
   "configuration_contract": {
     "SECRETS_ENGINE_PDP_URL": "literal loopback bare origin bound to independently verified cluster and named producer pod; exact native port awaiting owner placement",
@@ -81,36 +85,41 @@
   },
   "task_mapping_gap": {
     "existing_cli_execute_ccr_command": false,
-    "source_handoff": "secrets_engine.task_execution_handoff authorize_task_execution/consume_task_execution",
+    "source_handoff": "secrets_engine.task_execution_handoff prepare_task_approval/authorize_task_execution/consume_task_execution",
     "platform_source_mediator": "railiance-platform/scripts/task_execution_mediator.py run_native_fixture_task; source proof only",
     "unadmitted_inputs": [
-      "real service caller-to-subject server mapping and request/service binding join",
-      "actual task policy candidate and independently reviewed source/runtime admission; both false gates unchanged",
+      "native admission of the existing exact service-caller-to-subject request mapping and immutable original-claim/source join",
       "owner-selected fresh approved CCR/catalog/execution-grant, compiled Plan/whole descriptor and operation UUID",
       "independent expected-before/after bytes for exact two metadata targets and actual estate/backend origin",
       "actual source/Plan/install/journal/cleanup placement and trusted provider endpoints/credentials/custody",
       "load-bearing audit/outbox cadence and durable receipt correlation",
-      "Approval/Access reviewed out-of-band fresh-fact versus original carried-claim correspondence and signed provenance; strict context equality remains unchanged"
+      "exact native task v2 policy/caller/source/config/placement/key/runtime admission; v1 hard DENY retained"
     ],
     "approval_fact_interface_review": {
-      "status": "review preference only; no implementation/admission",
-      "preserve": "strict binding.context equality and original submitted/approval-free/native joins",
-      "direction": "Access prefers out-of-band server-fetched authoritative fact checking while retaining original carried context, then reviewed producer-owned signed provenance/audit evidence",
-      "required_review": [
-        "Approval fact/freshness semantic correspondence",
-        "Access source receipt/provenance binding and exact request digests"
-      ],
-      "b1": "signed-DENY caller join only; no context replacement",
-      "b2_b3": "not enabled or implemented here"
+      "status": "implemented/source-proved; native source/config/identity/trust admission remains missing",
+      "preserve": "type-sensitive original context/native/request/descriptor correspondence; original and independently fresh fact deadlines; no numeric translation",
+      "receipt": "Custodian decision-trusted-successor/verification-final-r4.json"
     },
     "approval_fact_contract": {
       "artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-fact-contract/consumer-contract.md",
-      "sha256": "3dfb7987a4d9fe461b917cfa5bae7beef61bc4d9a4561fdded3e90128f5966de",
+      "sha256": "sha256:3dfb7987a4d9fe461b917cfa5bae7beef61bc4d9a4561fdded3e90128f5966de",
       "vectors_artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-fact-contract/golden-vectors.json",
-      "vectors_sha256": "dfb0a8810cd91847d7af6a7af6a51607a67a66fad7b86fc57365308c36bd9323",
-      "status": "owner source contract pending integration; no Go conformance or B2 behavior admitted",
-      "required": "preserve original fact/context/freshness, independently validate fresh fact window and exact nonfreshness authority; do not translate native numeric digests or invent target restrictions"
-    }
+      "vectors_sha256": "sha256:dfb0a8810cd91847d7af6a7af6a51607a67a66fad7b86fc57365308c36bd9323",
+      "status": "owner contract/helper source implemented and integrated; Go conformance and actual source-server B2 behavior proved; native identity/config/trust/custody/effect admission remains unaccepted",
+      "required": "preserve original fact/context/freshness, independently validate fresh fact window and exact nonfreshness authority; do not translate native numeric digests or invent target restrictions",
+      "historical_attribution": "artifact and golden vectors below identify the initial prehelper contract; their former pending status was historical source preparation, not current implementation",
+      "current_helper_package": {
+        "artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-go-fact/manifest.json",
+        "sha256": "sha256:6d67f0005d4642bc60ed3a5f8901442f10c7bbf3f6b5d9fb8dba621298ed3851"
+      },
+      "integrated_source": {
+        "producer_git_commit": "2b064eee510640224274ccdc7cefceb1ae13162e",
+        "consumer_git_commit": "4dd004a2250104ba56293b2d7b0d96f4e076ea99",
+        "receipt": "the-custodian/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/verification-final-r4.json",
+        "receipt_sha256": "sha256:9ed4d80a7d1aa7353d7b57954b7924a146329d1bd18a3f9152c6055bd51b92b5"
+      }
+    },
+    "source_status": "implemented and cross-owner source-server proved, including retained registry and precise CAS; no native adoption"
   },
   "approval_state": "no owner assent, key admission, install, caller token, operation grant or live change requested/executed by this preparation",
   "denominator": {
@@ -129,5 +138,15 @@
     "platform_source_mediator_native_acceptance": false,
     "generic_cli_consume_is_strict_task_handoff": false,
     "effect_acceptance_required": "Review actual selected handler/generic consume response and caller scope separately; strict Platform fixture proof does not close existing CLI effects"
+  },
+  "historical_source_base": "ff1a13dabd44ba02ddd6bc26ad75568f6d2e6225",
+  "release_candidate": {
+    "bundle_manifest_sha256": "sha256:105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e",
+    "helper_sha256": "sha256:ed922b62533e4d33ae2d5f11175111f6f28e684a19e63ac704d43b63f0e0e12e",
+    "two_clean_builds_equal": true,
+    "disposable_install_passed": true,
+    "native_install_admitted": false,
+    "artifact_integrity_is_not_package_admission": true,
+    "receipt": "Custodian decision-native-preparation/r2/canonical-build-install-receipt.json"
   }
 }

workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md

@@ -117,7 +117,7 @@ T03 wait; task source/live obligations remain separately in SECRETS-WP-0013.
 
 2026-10-16 trusted successor source preparation: refreshed exact API/sign source
 from frozen Access B2/B3 R1 proposal (patch SHA-256
-6079ed2ff40b131aa2c5efc8d33608ecb3475c8158f0486b44ec4469e9f222c1).
+sha256:6079ed2ff40b131aa2c5efc8d33608ecb3475c8158f0486b44ec4469e9f222c1).
 Producer DecodeEnvelope preserves signed numeric lexemes; strict CAS retains and
 reauthenticates original producer JSON. Existing request/claim/native/caller joins
 remain mandatory; signed source observation additionally binds the native digest
@@ -175,3 +175,18 @@ bool/int/float substitution while allowing extra authoritative registry facts.
 Actual provider proof preparation is separately waiting on frozen Access source
 and Approval's timestamp/transaction-clock repair; source native/trust/custody and
 actual task admission remain open. T02 remains progress and T03 wait; no native adoption is claimed.
+
+2026-10-16 canonical native CLI release preparation: published4dd004a was built
+twice offline from a clean isolated checkout, with identical artifacts/manifest
+sha256:105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e.
+Disposable installation uses its fixed helper and empty native trust refuses
+before caller access. Exact invocation/config/delivery candidates, public signer
+provenance requirements, native lifecycle allow/deny capture, rotation/removal and
+isolated-transport outage probes are reviewable in Custodian
+`decision-native-preparation/r2/`. Real public kid/key/custody, candidate signed
+producer/log/storage, native UID/prefix/config/caller/Approval delivery and each
+actual handler/backend entitlement remain missing. No seed/token read, mint,
+production installation/trust/policy change or effect occurred. Native effect
+coverage remains0/11 across10handlers; T02 progress/T03 wait and task-native
+WP13/WP8 gates remain open. Published Access receipt-tool2b064ee and verified
+source APIs do not substitute for the separately reviewed hardened native image.