From 3718e60d7385db091d3423352f44e922863087de Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 16 Oct 2026 18:44:05 +0200 Subject: [PATCH] Record reproducible CLI release and exact native admission requirements Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786 --- docs/proposals/native-cli-admission/README.md | 47 ++++++++++++++ .../native-cli-admission/proposal.json | 63 ++++++++++++------- ...-transport-and-responder-authentication.md | 17 ++++- 3 files changed, 104 insertions(+), 23 deletions(-) diff --git a/docs/proposals/native-cli-admission/README.md b/docs/proposals/native-cli-admission/README.md index 3729cf6..63c48f5 100644 --- a/docs/proposals/native-cli-admission/README.md +++ b/docs/proposals/native-cli-admission/README.md @@ -1,5 +1,52 @@ # Native CLI signer and consumer admission preparation +## Current release preparation — 2026-10-16 R2 + +Published canonical Secrets `4dd004a2250104ba56293b2d7b0d96f4e076ea99` was +built twice from an isolated clean checkout. Artifacts and deterministic bundle +manifest match exactly: manifest SHA256 +`sha256:105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e`, +fixed helper SHA256 +`sha256:ed922b62533e4d33ae2d5f11175111f6f28e684a19e63ac704d43b63f0e0e12e`. +Disposable installation/help and empty native trust refusal pass; no native +prefix, trust/key, caller credential, protected effect or rollout was admitted. +Artifact integrity is not independent package admission. Full receipts and a +concrete probe/placement proposal are in Custodian `decision-native-preparation/r2/`. + +Initial native scope remains the existing lifecycle pin and **0/11 protected +sites across10 handlers**. Runtime UID/release/config/catalog/stance/trust/evidence +and scoped caller/Approval delivery paths remain owner-unselected. A concrete +workstation candidate uses a new release prefix ending +`4dd004a22501-105dcebe6f03`; it is a proposal, not an installed/admitted path. +Only its exact future `bin/secrets-engine` wrapper is the effect entrypoint. +The current repo editable invocation and ambient demo/preflight fallbacks do not +constitute release admission. A local CLI does not automatically hold the named +ServiceAccount identity: existing docs describe separately authorized per-session +TokenRequest delivery, not a standing credential or pod identity grant. + +Access's single offline signer-receipt tool is published at +`2b064eee510640224274ccdc7cefceb1ae13162e`; verified API/sign source matches this +consumer. Native producer rollout still awaits independent public kid/key/custody +and immutable candidate image/log/storage returns, including the Access owner's +separate durable-log hardening review. Published source alone is not that image. +The lifecycle pin stays v2/bd11c5fe...; task v2 is a separate unadmitted pin. + +Source task correspondence is now implemented and cross-owner source-server +proved: fixed typed service mapping before issue, retained-registry signed-DENY +preapproval, original claim/context preservation, independent fresh source facts, +precise Approval CAS and independent confirmation/journal/native disposable proof. +This supersedes the historical source gaps below; it neither adds an execute-ccr +CLI command nor selects a real CCR/catalogue/Plan/grant/backend/journal runtime. +All native effect, caller/key/config and task-entitlement gates remain open under +existing WP14/WP13/WP8 records. `service-jwt` still refuses protected CLI work. + +## Historical ff1a13d preparation (preserved) + +The following draft records the earlier source/admission observations. References +to absent B2/B3/request/source-fact implementation are superseded by R2 above; +missing native keys, runtime placement and actual task inputs remain unresolved. + + This proposal covers the existing lifecycle CLI authentication path under SECRETS-WP-0014. It grants no installation, key retrieval, caller mint, approval consume, OpenBao effect or task-policy activation. All native acceptance counts diff --git a/docs/proposals/native-cli-admission/proposal.json b/docs/proposals/native-cli-admission/proposal.json index d5c50c2..0176631 100644 --- a/docs/proposals/native-cli-admission/proposal.json +++ b/docs/proposals/native-cli-admission/proposal.json @@ -1,7 +1,7 @@ { "proposal_id": "SECRETS-WP-0014-native-cli-20261016", "status": "preparation only; not installable or executable authorization", - "source_base": "ff1a13dabd44ba02ddd6bc26ad75568f6d2e6225", + "source_base": "4dd004a2250104ba56293b2d7b0d96f4e076ea99", "workplans": [ "SECRETS-WP-0014-T02", "SECRETS-WP-0014-T03", @@ -33,8 +33,10 @@ "custody_receipt": null, "candidate_producer_oci_digest": null, "rule": "No responder keys endpoint, synthetic fixture key or deployment metadata substitutes for independent owner admission", - "receipt_verifier_integrated_revision": null, - "signer_purpose_pin_and_sharing_receipt": null + "receipt_verifier_integrated_revision": "2b064eee510640224274ccdc7cefceb1ae13162e", + "signer_purpose_pin_and_sharing_receipt": null, + "public_fingerprint_convention": "Platform proposal: sha256(canonical unpadded base64url43 public-key ASCII); independent owner receipt required", + "candidate_producer_prerequisite": "Access durable-log hardening source and immutable image/storage/custody awaiting separate root/Platform review; published2b064ee alone is not native candidate admission" }, "placement": { "owner": "Secrets consumer/deploying owner; exact runtime UID and paths not yet agreed", @@ -52,7 +54,9 @@ "absolute independently reviewed config/catalog/policy/stance/trust paths; no working-directory defaults for native use", "trust regular non-symlink, not group/world writable; key admission not file-presence inference", "owner retains manifest/admission/installation receipts and same-UID control boundary" - ] + ], + "candidate_cli_release_prefix": "/home/worsch/.local/share/secrets-engine/releases/4dd004a22501-105dcebe6f03", + "candidate_status": "proposal only; no path selected/created/admitted" }, "configuration_contract": { "SECRETS_ENGINE_PDP_URL": "literal loopback bare origin bound to independently verified cluster and named producer pod; exact native port awaiting owner placement", @@ -81,36 +85,41 @@ }, "task_mapping_gap": { "existing_cli_execute_ccr_command": false, - "source_handoff": "secrets_engine.task_execution_handoff authorize_task_execution/consume_task_execution", + "source_handoff": "secrets_engine.task_execution_handoff prepare_task_approval/authorize_task_execution/consume_task_execution", "platform_source_mediator": "railiance-platform/scripts/task_execution_mediator.py run_native_fixture_task; source proof only", "unadmitted_inputs": [ - "real service caller-to-subject server mapping and request/service binding join", - "actual task policy candidate and independently reviewed source/runtime admission; both false gates unchanged", + "native admission of the existing exact service-caller-to-subject request mapping and immutable original-claim/source join", "owner-selected fresh approved CCR/catalog/execution-grant, compiled Plan/whole descriptor and operation UUID", "independent expected-before/after bytes for exact two metadata targets and actual estate/backend origin", "actual source/Plan/install/journal/cleanup placement and trusted provider endpoints/credentials/custody", "load-bearing audit/outbox cadence and durable receipt correlation", - "Approval/Access reviewed out-of-band fresh-fact versus original carried-claim correspondence and signed provenance; strict context equality remains unchanged" + "exact native task v2 policy/caller/source/config/placement/key/runtime admission; v1 hard DENY retained" ], "approval_fact_interface_review": { - "status": "review preference only; no implementation/admission", - "preserve": "strict binding.context equality and original submitted/approval-free/native joins", - "direction": "Access prefers out-of-band server-fetched authoritative fact checking while retaining original carried context, then reviewed producer-owned signed provenance/audit evidence", - "required_review": [ - "Approval fact/freshness semantic correspondence", - "Access source receipt/provenance binding and exact request digests" - ], - "b1": "signed-DENY caller join only; no context replacement", - "b2_b3": "not enabled or implemented here" + "status": "implemented/source-proved; native source/config/identity/trust admission remains missing", + "preserve": "type-sensitive original context/native/request/descriptor correspondence; original and independently fresh fact deadlines; no numeric translation", + "receipt": "Custodian decision-trusted-successor/verification-final-r4.json" }, "approval_fact_contract": { "artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-fact-contract/consumer-contract.md", - "sha256": "3dfb7987a4d9fe461b917cfa5bae7beef61bc4d9a4561fdded3e90128f5966de", + "sha256": "sha256:3dfb7987a4d9fe461b917cfa5bae7beef61bc4d9a4561fdded3e90128f5966de", "vectors_artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-fact-contract/golden-vectors.json", - "vectors_sha256": "dfb0a8810cd91847d7af6a7af6a51607a67a66fad7b86fc57365308c36bd9323", - "status": "owner source contract pending integration; no Go conformance or B2 behavior admitted", - "required": "preserve original fact/context/freshness, independently validate fresh fact window and exact nonfreshness authority; do not translate native numeric digests or invent target restrictions" - } + "vectors_sha256": "sha256:dfb0a8810cd91847d7af6a7af6a51607a67a66fad7b86fc57365308c36bd9323", + "status": "owner contract/helper source implemented and integrated; Go conformance and actual source-server B2 behavior proved; native identity/config/trust/custody/effect admission remains unaccepted", + "required": "preserve original fact/context/freshness, independently validate fresh fact window and exact nonfreshness authority; do not translate native numeric digests or invent target restrictions", + "historical_attribution": "artifact and golden vectors below identify the initial prehelper contract; their former pending status was historical source preparation, not current implementation", + "current_helper_package": { + "artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-go-fact/manifest.json", + "sha256": "sha256:6d67f0005d4642bc60ed3a5f8901442f10c7bbf3f6b5d9fb8dba621298ed3851" + }, + "integrated_source": { + "producer_git_commit": "2b064eee510640224274ccdc7cefceb1ae13162e", + "consumer_git_commit": "4dd004a2250104ba56293b2d7b0d96f4e076ea99", + "receipt": "the-custodian/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/verification-final-r4.json", + "receipt_sha256": "sha256:9ed4d80a7d1aa7353d7b57954b7924a146329d1bd18a3f9152c6055bd51b92b5" + } + }, + "source_status": "implemented and cross-owner source-server proved, including retained registry and precise CAS; no native adoption" }, "approval_state": "no owner assent, key admission, install, caller token, operation grant or live change requested/executed by this preparation", "denominator": { @@ -129,5 +138,15 @@ "platform_source_mediator_native_acceptance": false, "generic_cli_consume_is_strict_task_handoff": false, "effect_acceptance_required": "Review actual selected handler/generic consume response and caller scope separately; strict Platform fixture proof does not close existing CLI effects" + }, + "historical_source_base": "ff1a13dabd44ba02ddd6bc26ad75568f6d2e6225", + "release_candidate": { + "bundle_manifest_sha256": "sha256:105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e", + "helper_sha256": "sha256:ed922b62533e4d33ae2d5f11175111f6f28e684a19e63ac704d43b63f0e0e12e", + "two_clean_builds_equal": true, + "disposable_install_passed": true, + "native_install_admitted": false, + "artifact_integrity_is_not_package_admission": true, + "receipt": "Custodian decision-native-preparation/r2/canonical-build-install-receipt.json" } } diff --git a/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md b/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md index f65ac96..20f3b17 100644 --- a/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md +++ b/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md @@ -117,7 +117,7 @@ T03 wait; task source/live obligations remain separately in SECRETS-WP-0013. 2026-10-16 trusted successor source preparation: refreshed exact API/sign source from frozen Access B2/B3 R1 proposal (patch SHA-256 -6079ed2ff40b131aa2c5efc8d33608ecb3475c8158f0486b44ec4469e9f222c1). +sha256:6079ed2ff40b131aa2c5efc8d33608ecb3475c8158f0486b44ec4469e9f222c1). Producer DecodeEnvelope preserves signed numeric lexemes; strict CAS retains and reauthenticates original producer JSON. Existing request/claim/native/caller joins remain mandatory; signed source observation additionally binds the native digest @@ -175,3 +175,18 @@ bool/int/float substitution while allowing extra authoritative registry facts. Actual provider proof preparation is separately waiting on frozen Access source and Approval's timestamp/transaction-clock repair; source native/trust/custody and actual task admission remain open. T02 remains progress and T03 wait; no native adoption is claimed. + +2026-10-16 canonical native CLI release preparation: published4dd004a was built +twice offline from a clean isolated checkout, with identical artifacts/manifest +sha256:105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e. +Disposable installation uses its fixed helper and empty native trust refuses +before caller access. Exact invocation/config/delivery candidates, public signer +provenance requirements, native lifecycle allow/deny capture, rotation/removal and +isolated-transport outage probes are reviewable in Custodian +`decision-native-preparation/r2/`. Real public kid/key/custody, candidate signed +producer/log/storage, native UID/prefix/config/caller/Approval delivery and each +actual handler/backend entitlement remain missing. No seed/token read, mint, +production installation/trust/policy change or effect occurred. Native effect +coverage remains0/11 across10handlers; T02 progress/T03 wait and task-native +WP13/WP8 gates remain open. Published Access receipt-tool2b064ee and verified +source APIs do not substitute for the separately reviewed hardened native image.