tegwick
3718e60d73
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
152 lines
10 KiB
JSON
152 lines
10 KiB
JSON
{
|
|
"proposal_id": "SECRETS-WP-0014-native-cli-20261016",
|
|
"status": "preparation only; not installable or executable authorization",
|
|
"source_base": "4dd004a2250104ba56293b2d7b0d96f4e076ea99",
|
|
"workplans": [
|
|
"SECRETS-WP-0014-T02",
|
|
"SECRETS-WP-0014-T03",
|
|
"SECRETS-WP-0013-T01",
|
|
"SECRETS-WP-0013-T03"
|
|
],
|
|
"initial_scope": {
|
|
"producer": "existing flex-auth/flex-auth-secrets-engine lifecycle pin",
|
|
"consumer": "existing Secrets CLI serving authorization workflow, prospective reviewed release-bundle entrypoint only",
|
|
"stage1": "independent signer/package/trust admission and offline captured native allow+deny verification; zero protected effects",
|
|
"native_effects_admitted": 0,
|
|
"task_execution_enabled": false
|
|
},
|
|
"owner_returns": {
|
|
"access": "Custodian docs/changes/netkingdom-target-2026-10-16/access-native-preparation/native-admission-proposal-r1.json and source-policy-pins.json",
|
|
"platform": "No selected actual approved CCR/catalog/Plan/descriptor/grant/install placement; CCR-2026-0042 remains in_flight without matching catalog. Disposable source proofs are not production inputs."
|
|
},
|
|
"producer_pin": {
|
|
"evaluator": "flex-auth/local",
|
|
"mode": "standalone",
|
|
"policy_package": "secrets-engine.catalog-lane.lifecycle",
|
|
"policy_version": "v2",
|
|
"policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4"
|
|
},
|
|
"independent_admission": {
|
|
"production_kid": null,
|
|
"public_key": null,
|
|
"public_key_sha256": null,
|
|
"custody_receipt": null,
|
|
"candidate_producer_oci_digest": null,
|
|
"rule": "No responder keys endpoint, synthetic fixture key or deployment metadata substitutes for independent owner admission",
|
|
"receipt_verifier_integrated_revision": "2b064eee510640224274ccdc7cefceb1ae13162e",
|
|
"signer_purpose_pin_and_sharing_receipt": null,
|
|
"public_fingerprint_convention": "Platform proposal: sha256(canonical unpadded base64url43 public-key ASCII); independent owner receipt required",
|
|
"candidate_producer_prerequisite": "Access durable-log hardening source and immutable image/storage/custody awaiting separate root/Platform review; published2b064ee alone is not native candidate admission"
|
|
},
|
|
"placement": {
|
|
"owner": "Secrets consumer/deploying owner; exact runtime UID and paths not yet agreed",
|
|
"cli_release_prefix": null,
|
|
"cli_entrypoint": "<admitted-prefix>/bin/secrets-engine",
|
|
"fixed_verifier": "<admitted-prefix>/libexec/secrets-engine-pdp-verify",
|
|
"config_parent": null,
|
|
"trust_file": null,
|
|
"catalog_directory": null,
|
|
"policy_directory": null,
|
|
"pep_stance_file": null,
|
|
"evidence_directory": null,
|
|
"constraints": [
|
|
"new owner-controlled immutable release prefix; no overwrite or rolling source alias",
|
|
"absolute independently reviewed config/catalog/policy/stance/trust paths; no working-directory defaults for native use",
|
|
"trust regular non-symlink, not group/world writable; key admission not file-presence inference",
|
|
"owner retains manifest/admission/installation receipts and same-UID control boundary"
|
|
],
|
|
"candidate_cli_release_prefix": "/home/worsch/.local/share/secrets-engine/releases/4dd004a22501-105dcebe6f03",
|
|
"candidate_status": "proposal only; no path selected/created/admitted"
|
|
},
|
|
"configuration_contract": {
|
|
"SECRETS_ENGINE_PDP_URL": "literal loopback bare origin bound to independently verified cluster and named producer pod; exact native port awaiting owner placement",
|
|
"SECRETS_ENGINE_PDP_TOKEN_FILE": "admitted bounded Secrets ServiceAccount caller file outside Git; no mint/read here",
|
|
"SECRETS_ENGINE_PDP_TRUST_FILE": "absolute independently admitted lifecycle trust path; empty-key template deliberately refuses",
|
|
"SECRETS_ENGINE_PDP_VERIFIER": "bundle wrapper fixes installed helper; no ambient override or source-checkout helper",
|
|
"SECRETS_ENGINE_AUTHORIZATION_SUBJECT_ID": "secrets-engine",
|
|
"SECRETS_ENGINE_AUTHORIZATION_SUBJECT_TYPE": "service",
|
|
"SECRETS_ENGINE_AUTHORIZATION_POLICY_PACKAGE": "secrets-engine.catalog-lane.lifecycle",
|
|
"SECRETS_ENGINE_AUTHORIZATION_POLICY_VERSION": "v2",
|
|
"SECRETS_ENGINE_APPROVAL_URL": "independently admitted Approval endpoint/owner-bound tunnel; not yet supplied for this session",
|
|
"SECRETS_ENGINE_APPROVAL_CLIENT_SECRET_FILE": "separately admitted attended provider lifetime from existing custody contract; no read here",
|
|
"SECRETS_ENGINE_APPROVAL_TOKEN_FILE": "unset when client-secret provider selected; no simultaneous providers",
|
|
"SECRETS_ENGINE_CATALOG": "absolute owner-admitted metadata directory; initial actual lane unselected",
|
|
"SECRETS_ENGINE_POLICIES": "absolute owner-admitted metadata/policy directory",
|
|
"SECRETS_ENGINE_PEP_STANCE": "absolute hash-pinned existing total stance map; prod remains fail_closed",
|
|
"SECRETS_ENGINE_EVIDENCE": "absolute owner-private evidence/outbox path with declared custody/delivery",
|
|
"SECRETS_ENGINE_UNSAFE_DEMO": "unset; no native exception",
|
|
"backend_provider": "no new selection/entitlement; configured service-jwt protected handlers remain blocked; do not switch to bootstrap/env as workaround"
|
|
},
|
|
"rotation": {
|
|
"admit": "owner reviews independent new kid/public key/custody receipt and bounded overlap, preserving exact issuer/policy artifact pin",
|
|
"roll": "separate exact producer candidate digest/seed projection rollout with native signed receipts; never fetch discovery keys",
|
|
"remove": "after new-key native receipt/consumer acceptance, remove old kid and prove old-key refusal",
|
|
"rollback": "retain reviewed signed producer/key overlap or stop/refuse. An unsigned old deployment is an outage; never disable consumer verification, restore removed key without review, relax pin, widen backend grants or blind retry consumed operation"
|
|
},
|
|
"task_mapping_gap": {
|
|
"existing_cli_execute_ccr_command": false,
|
|
"source_handoff": "secrets_engine.task_execution_handoff prepare_task_approval/authorize_task_execution/consume_task_execution",
|
|
"platform_source_mediator": "railiance-platform/scripts/task_execution_mediator.py run_native_fixture_task; source proof only",
|
|
"unadmitted_inputs": [
|
|
"native admission of the existing exact service-caller-to-subject request mapping and immutable original-claim/source join",
|
|
"owner-selected fresh approved CCR/catalog/execution-grant, compiled Plan/whole descriptor and operation UUID",
|
|
"independent expected-before/after bytes for exact two metadata targets and actual estate/backend origin",
|
|
"actual source/Plan/install/journal/cleanup placement and trusted provider endpoints/credentials/custody",
|
|
"load-bearing audit/outbox cadence and durable receipt correlation",
|
|
"exact native task v2 policy/caller/source/config/placement/key/runtime admission; v1 hard DENY retained"
|
|
],
|
|
"approval_fact_interface_review": {
|
|
"status": "implemented/source-proved; native source/config/identity/trust admission remains missing",
|
|
"preserve": "type-sensitive original context/native/request/descriptor correspondence; original and independently fresh fact deadlines; no numeric translation",
|
|
"receipt": "Custodian decision-trusted-successor/verification-final-r4.json"
|
|
},
|
|
"approval_fact_contract": {
|
|
"artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-fact-contract/consumer-contract.md",
|
|
"sha256": "sha256:3dfb7987a4d9fe461b917cfa5bae7beef61bc4d9a4561fdded3e90128f5966de",
|
|
"vectors_artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-fact-contract/golden-vectors.json",
|
|
"vectors_sha256": "sha256:dfb0a8810cd91847d7af6a7af6a51607a67a66fad7b86fc57365308c36bd9323",
|
|
"status": "owner contract/helper source implemented and integrated; Go conformance and actual source-server B2 behavior proved; native identity/config/trust/custody/effect admission remains unaccepted",
|
|
"required": "preserve original fact/context/freshness, independently validate fresh fact window and exact nonfreshness authority; do not translate native numeric digests or invent target restrictions",
|
|
"historical_attribution": "artifact and golden vectors below identify the initial prehelper contract; their former pending status was historical source preparation, not current implementation",
|
|
"current_helper_package": {
|
|
"artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-go-fact/manifest.json",
|
|
"sha256": "sha256:6d67f0005d4642bc60ed3a5f8901442f10c7bbf3f6b5d9fb8dba621298ed3851"
|
|
},
|
|
"integrated_source": {
|
|
"producer_git_commit": "2b064eee510640224274ccdc7cefceb1ae13162e",
|
|
"consumer_git_commit": "4dd004a2250104ba56293b2d7b0d96f4e076ea99",
|
|
"receipt": "the-custodian/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/verification-final-r4.json",
|
|
"receipt_sha256": "sha256:9ed4d80a7d1aa7353d7b57954b7924a146329d1bd18a3f9152c6055bd51b92b5"
|
|
}
|
|
},
|
|
"source_status": "implemented and cross-owner source-server proved, including retained registry and precise CAS; no native adoption"
|
|
},
|
|
"approval_state": "no owner assent, key admission, install, caller token, operation grant or live change requested/executed by this preparation",
|
|
"denominator": {
|
|
"shared_check_implementation": 1,
|
|
"serving_cli_call_sites": 11,
|
|
"serving_cli_handlers": 10,
|
|
"lifecycle_pdp_action_values": 12,
|
|
"native_effect_call_sites_accepted": 0,
|
|
"excluded": [
|
|
"session revoke stance-only backend path",
|
|
"service-auth explicit identity probes",
|
|
"route ambient-backend readiness probes",
|
|
"dry-run/non-effect reporting"
|
|
],
|
|
"task_cli_command_count": 0,
|
|
"platform_source_mediator_native_acceptance": false,
|
|
"generic_cli_consume_is_strict_task_handoff": false,
|
|
"effect_acceptance_required": "Review actual selected handler/generic consume response and caller scope separately; strict Platform fixture proof does not close existing CLI effects"
|
|
},
|
|
"historical_source_base": "ff1a13dabd44ba02ddd6bc26ad75568f6d2e6225",
|
|
"release_candidate": {
|
|
"bundle_manifest_sha256": "sha256:105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e",
|
|
"helper_sha256": "sha256:ed922b62533e4d33ae2d5f11175111f6f28e684a19e63ac704d43b63f0e0e12e",
|
|
"two_clean_builds_equal": true,
|
|
"disposable_install_passed": true,
|
|
"native_install_admitted": false,
|
|
"artifact_integrity_is_not_package_admission": true,
|
|
"receipt": "Custodian decision-native-preparation/r2/canonical-build-install-receipt.json"
|
|
}
|
|
}
|