From a4f1802b720b64f2b47483fbd597902bd4c354f5 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 16 Oct 2026 20:58:30 +0200 Subject: [PATCH] Record inert native CLI source and configuration selection Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786 --- ...-transport-and-responder-authentication.md | 30 +++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md b/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md index 20f3b17..16d9406 100644 --- a/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md +++ b/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md @@ -190,3 +190,33 @@ production installation/trust/policy change or effect occurred. Native effect coverage remains0/11 across10handlers; T02 progress/T03 wait and task-native WP13/WP8 gates remain open. Published Access receipt-tool2b064ee and verified source APIs do not substitute for the separately reviewed hardened native image. + + +2026-10-16 owner public-source selection for preparatory installation: select +runtime4dd004a/documentation3718e60 and the canonical offline release manifest +sha256:105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e, +with public empty-key consumer baseline +sha256:72521ff7729f8ddf5176092f3949cd50ac5f9241b0a5d1d30f3c63ce1d83091b. +Select the fresh owner-controlled release prefix +`/home/worsch/.local/share/secrets-engine/releases/4dd004a22501-105dcebe6f03` +and config revision +`/home/worsch/.config/secrets-engine/native-lifecycle/lifecycle-20261016-pre-key-r1`. +Use the existing offline installer and fixed-helper CLI; verify the complete +owner-controlled parent chain and artifact set before installation. This closes +public runtime/config selection only; actual home installation is not yet made. +Fresh isolated install/help, ten catalog rows and real installed authorize_action +empty-key refusal before caller/socket access passed. All53 runtime source hashes +and complete consumerR1/PlatformP4/AccessrolloutR2 manifests matched. P4/R2 binds +the same baseline/policy/caller, projection8ce375f and separately pinned chartdc0420/ +image84c78e0 OCI digest09a83b2. The historical P1/failed400 finding is superseded +only for this exact new source join, with old receipts preserved. +Secrets owns consumer/trust; Access workload/Helm; Platform custody/GitOps sync; +cluster runtime/storage/PV; founder the attended disposition. No native assent is +supplied: founder/expiry/approvedCCR/window remain null. Public custody return, +independent key-bearing successor admission, named-pod/runtime receipt, bounded +caller delivery and lifecycle capture/export scope remain outstanding. Approval, +backend/effects/readback/cleanup/WP13 grants remain separate. T02 stays progress, +T03 wait; TSA01/02/03 remain open, protected acceptance0/11sites across10handlers. +No credential/kubeconfig/private custody read, caller mint, live action, actual +home install or new authority occurred. Exact review/proof and concrete install +step: Custodian `secrets-native-admission-next/` within the2026-10-16 target wave.