diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/handoff.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/handoff.json new file mode 100644 index 00000000..8a4a706b --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/handoff.json @@ -0,0 +1,98 @@ +{ + "approval_binding_digest": "sha256:5dbfc366910c8f62bf26a15f9e00289f774016a4092d462b2a82b9e30790e25a", + "approval_expires_at": "2026-10-16T15:08:43.625859+00:00", + "approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8", + "decision_expires_at": "2026-10-16T15:06:43Z", + "decision_id": "decision:9da2b8442a192d6d", + "decision_not_before": "2026-10-16T15:05:44.150488791Z", + "execution_contract": { + "backend_budget": { + "ttl_seconds": 30, + "uses": 12 + }, + "backend_origin": "http://127.0.0.1:18200", + "catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f", + "ccr_id": "CCR-2099-0001", + "ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "cluster_uid": "test-estate-not-live", + "contract_version": "SECRETS-EXEC-20261011-v1", + "execution_actor": "service:secrets-engine", + "execution_grant_ccr_id": "CCR-2099-0002", + "expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "operation": "metadata-apply-ccr", + "operation_deadline": "2026-10-16T15:06:43+00:00", + "operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153", + "operations": [ + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + ], + "source_bundle": { + "engine_dispatcher": { + "path": "/owner/engine_dispatcher.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "platform_mediator": { + "path": "/owner/platform_mediator.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "policy_auth": { + "path": "/owner/policy_auth.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "typed_ccr": { + "path": "/owner/typed_ccr.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + } + }, + "native_binding": { + "action": "execute-ccr", + "actor": "secrets-engine", + "principal": "secrets-engine", + "purpose": "metadata-test", + "target": { + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + }, + "id": "catalog:test-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + } + }, + "request_digest": "sha256:ac65003b1b527d2194d7a50872f3dda3a9a4824fd3f8ba61721ba20c475ae645", + "submitted_request_digest": "sha256:6133a8947e450efc52f9f35883ab20b2c2f3539c8a8fa89c93a586edb0670a96" +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/negative-cases.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/negative-cases.json new file mode 100644 index 00000000..aefd9ca2 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/negative-cases.json @@ -0,0 +1,8 @@ +{ + "missing-service-binding": true, + "changed-descriptor": true, + "changed-native-target": true, + "expired-original": true, + "tampered-signature": true, + "prepared-replay": true +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/normalization-source-record.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/normalization-source-record.json new file mode 100644 index 00000000..d7b78739 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/normalization-source-record.json @@ -0,0 +1,226 @@ +{ + "id": "decision:b420b2c43aff27f2", + "contract_version": "flex-auth.decision-record.v1", + "effect": "deny", + "reason": "service_execution_contract_unmatched", + "matched_policy_version": "v2", + "matched_rule": "service_execution_contract_unmatched", + "resource": { + "id": "catalog:test-lane", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + } + }, + "subject": { + "id": "secrets-engine", + "type": "service", + "tenant": "tenant:platform", + "attributes": { + "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.", + "display_name": "secrets-engine service principal", + "groups": [ + "group:secrets-engine-lane-operators" + ], + "organization_relation": "ServiceProvider", + "roles": [ + "Operator" + ] + } + }, + "binding": { + "tenant": "tenant:platform", + "subject": { + "id": "secrets-engine", + "type": "service", + "tenant": "tenant:platform", + "attributes": { + "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.", + "display_name": "secrets-engine service principal", + "groups": [ + "group:secrets-engine-lane-operators" + ], + "organization_relation": "ServiceProvider", + "roles": [ + "Operator" + ] + } + }, + "action": "execute-ccr", + "resource": { + "id": "catalog:test-lane", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + } + }, + "context": { + "catalog_target": { + "auth_capability": {}, + "consumers": [ + { + "auth": "approle", + "claim": "role:c", + "name": "c" + } + ], + "delivery_auth": { + "management": "engine", + "method": "approle" + }, + "delivery_config": {}, + "delivery_modes": [ + "exec-env" + ], + "fields": [ + "api_token" + ], + "kind": "kv", + "mount": "secret", + "mount_management": "engine", + "org": "coulomb", + "path": "test/team/thing", + "repo": "team-repo", + "workload_delivery": [] + }, + "execution_contract": { + "backend_budget": { + "ttl_seconds": 30, + "uses": 12 + }, + "backend_origin": "http://127.0.0.1:18200", + "catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f", + "ccr_id": "CCR-2099-0001", + "ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "cluster_uid": "test-estate-not-live", + "contract_version": "SECRETS-EXEC-20261011-v1", + "execution_actor": "service:secrets-engine", + "execution_grant_ccr_id": "CCR-2099-0002", + "expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "operation": "metadata-apply-ccr", + "operation_deadline": "2026-10-16T15:06:43+00:00", + "operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153", + "operations": [ + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + ], + "source_bundle": { + "engine_dispatcher": { + "path": "/owner/engine_dispatcher.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "platform_mediator": { + "path": "/owner/platform_mediator.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "policy_auth": { + "path": "/owner/policy_auth.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "typed_ccr": { + "path": "/owner/typed_ccr.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + } + }, + "human_control": true, + "purpose": "metadata-test", + "service_actor_binding": { + "subject_id": "secrets-engine", + "subject_type": "service", + "tenant": "tenant:platform", + "transport_principal": "system:serviceaccount:secrets-engine:secrets-engine", + "version": "proposed-service-task-caller/v1" + } + }, + "request_digest": "sha256:5dbfc366910c8f62bf26a15f9e00289f774016a4092d462b2a82b9e30790e25a", + "approval_binding_digest": "sha256:5dbfc366910c8f62bf26a15f9e00289f774016a4092d462b2a82b9e30790e25a", + "submitted_request_digest": "sha256:a3cb02a5a0521416d41128e8298fd191b033b4268d518be8a7b6791fcb3998a8" + }, + "diagnostics": { + "action": "execute-ccr", + "matched_relationship": "", + "policy_package": "secrets-engine.task-execution.service-pilot", + "policy_status": "proposed", + "registry_overrode": [], + "registry_resource": false, + "registry_subject": true + }, + "provenance": { + "evaluator": "flex-auth/local", + "mode": "standalone", + "policy_package": "secrets-engine.task-execution.service-pilot", + "policy_version": "v2", + "policy_package_digest": "sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d", + "registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb", + "input_claim_digests": { + "context": "sha256:48a3deac59c4cfdd1b1ee6faadb861c4162e9432406224521c51b5126fcdb07d" + }, + "decision_time": "2026-10-16T15:05:43Z", + "caller": { + "mode": "enforce", + "principal": "system:serviceaccount:secrets-engine:secrets-engine", + "audience": "flex-auth", + "not_after": "2026-10-16T15:07:43Z" + } + }, + "signature": { + "mode": "signed", + "alg": "ed25519", + "kid": "synthetic-v2", + "value": "YeNWS7cj35EydBet36hpbM_SgG-8oARxrFXYFXI6ZempCtJufwFEJHHme3EuuqVonqKgkk6L_GgYurldtedjCg" + }, + "caring": { + "profile": "caring-0.4.0-rc2", + "conformance_findings": [ + { + "code": "CARING-DESCRIPTOR-MISSING", + "severity": "warning", + "message": "no CARING descriptor matched the request", + "fields": [ + "caring_context" + ] + } + ] + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/offline-signature-replay.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/offline-signature-replay.json new file mode 100644 index 00000000..6448b5b5 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/offline-signature-replay.json @@ -0,0 +1,17 @@ +{ + "normalization-source-record.json": { + "effect": "deny", + "decision_id": "decision:b420b2c43aff27f2", + "signature_valid": true + }, + "response.json": { + "effect": "allow", + "decision_id": "decision:9da2b8442a192d6d", + "signature_valid": true + }, + "source-record.json": { + "effect": "allow", + "decision_id": "decision:9da2b8442a192d6d", + "signature_valid": true + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/original-approval-claim.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/original-approval-claim.json new file mode 100644 index 00000000..7eeb0f12 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/original-approval-claim.json @@ -0,0 +1,42 @@ +{ + "approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8", + "binding": { + "action": "execute-ccr", + "actor": "secrets-engine", + "digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2", + "human_control": true, + "pdp_digest": "sha256:5dbfc366910c8f62bf26a15f9e00289f774016a4092d462b2a82b9e30790e25a", + "pdp_path": true, + "principal": "secrets-engine", + "purpose": "metadata-test", + "target": { + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + }, + "id": "catalog:test-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + } + }, + "consumed": false, + "freshness": { + "not_after": "2026-10-16T15:07:44.099087+00:00", + "observed_at": "2026-10-16T15:05:44.099087+00:00", + "ttl_seconds": 120 + }, + "issuer": "approval-engine", + "kind": "approval-claim", + "reason_code": "ok", + "schema_version": "0.1", + "state": "valid", + "valid_now": true, + "validity": { + "expires_at": "2026-10-16T15:08:43.625859+00:00", + "not_before": "2026-10-16T15:04:43.625859+00:00" + }, + "yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)" +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/preapproval.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/preapproval.json new file mode 100644 index 00000000..dbf82253 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/preapproval.json @@ -0,0 +1,224 @@ +{ + "approval_binding_digest": "sha256:5dbfc366910c8f62bf26a15f9e00289f774016a4092d462b2a82b9e30790e25a", + "decision_id": "decision:b420b2c43aff27f2", + "execution_contract": { + "backend_budget": { + "ttl_seconds": 30, + "uses": 12 + }, + "backend_origin": "http://127.0.0.1:18200", + "catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f", + "ccr_id": "CCR-2099-0001", + "ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "cluster_uid": "test-estate-not-live", + "contract_version": "SECRETS-EXEC-20261011-v1", + "execution_actor": "service:secrets-engine", + "execution_grant_ccr_id": "CCR-2099-0002", + "expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "operation": "metadata-apply-ccr", + "operation_deadline": "2026-10-16T15:06:43+00:00", + "operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153", + "operations": [ + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + ], + "source_bundle": { + "engine_dispatcher": { + "path": "/owner/engine_dispatcher.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "platform_mediator": { + "path": "/owner/platform_mediator.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "policy_auth": { + "path": "/owner/policy_auth.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "typed_ccr": { + "path": "/owner/typed_ccr.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + } + }, + "native_binding": { + "action": "execute-ccr", + "actor": "secrets-engine", + "principal": "secrets-engine", + "purpose": "metadata-test", + "target": { + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + }, + "id": "catalog:test-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + } + }, + "original_request": { + "action": "execute-ccr", + "context": { + "catalog_target": { + "auth_capability": {}, + "consumers": [ + { + "auth": "approle", + "claim": "role:c", + "name": "c" + } + ], + "delivery_auth": { + "management": "engine", + "method": "approle" + }, + "delivery_config": {}, + "delivery_modes": [ + "exec-env" + ], + "fields": [ + "api_token" + ], + "kind": "kv", + "mount": "secret", + "mount_management": "engine", + "org": "coulomb", + "path": "test/team/thing", + "repo": "team-repo", + "workload_delivery": [] + }, + "execution_contract": { + "backend_budget": { + "ttl_seconds": 30, + "uses": 12 + }, + "backend_origin": "http://127.0.0.1:18200", + "catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f", + "ccr_id": "CCR-2099-0001", + "ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "cluster_uid": "test-estate-not-live", + "contract_version": "SECRETS-EXEC-20261011-v1", + "execution_actor": "service:secrets-engine", + "execution_grant_ccr_id": "CCR-2099-0002", + "expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "operation": "metadata-apply-ccr", + "operation_deadline": "2026-10-16T15:06:43+00:00", + "operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153", + "operations": [ + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + ], + "source_bundle": { + "engine_dispatcher": { + "path": "/owner/engine_dispatcher.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "platform_mediator": { + "path": "/owner/platform_mediator.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "policy_auth": { + "path": "/owner/policy_auth.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "typed_ccr": { + "path": "/owner/typed_ccr.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + } + }, + "human_control": true, + "purpose": "metadata-test", + "service_actor_binding": { + "subject_id": "secrets-engine", + "subject_type": "service", + "tenant": "tenant:platform", + "transport_principal": "system:serviceaccount:secrets-engine:secrets-engine", + "version": "proposed-service-task-caller/v1" + } + }, + "resource": { + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + }, + "id": "catalog:test-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + }, + "subject": { + "id": "secrets-engine", + "tenant": "tenant:platform", + "type": "service" + }, + "tenant": "tenant:platform" + }, + "registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb", + "submitted_request_digest": "sha256:a3cb02a5a0521416d41128e8298fd191b033b4268d518be8a7b6791fcb3998a8" +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/receipt.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/receipt.json new file mode 100644 index 00000000..7a64761f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/receipt.json @@ -0,0 +1,32 @@ +{ + "scope": "disposable synthetic only", + "actual_source": "Approval App over TLS with authenticated create, configured synthetic human entry, read; actual SQLite engine", + "actual_access": "production serve binary from frozen B2/B3 retained-registry R3", + "allow": true, + "original_context_unchanged": true, + "published_digest_match": true, + "returned_source_record_match": true, + "actual_source_consumed_refused": true, + "actual_strict_prepare_and_consume": true, + "retained_registry": true, + "signed_deny_preapproval": true, + "no_precision_sleep": true, + "approval_precision_patch": "74eb0ff67d14508c2a2cee14d055790321ee171a96d5290ad6d037ce8f61dbcd", + "actual_registry_drift_refuses_before_cas": true, + "no_record_after_refusal": true, + "native_admission": false, + "files_sha256": { + "consumption-confirmation.json": "sha256:b8e73258585ebcba195c16d9ea3866afbcdfb226b70225e804ceade4a80da929", + "preapproval.json": "sha256:75a808a854af61465e5f1fd8a5a8fd003c9530a748fbed54ec3e825a31e2778a", + "negative-cases.json": "sha256:1bef572773c34f87a3c6587dbc60ebeb2835c01125f690e8d2f5b0d70a6abadd", + "registry-drift-refusal.json": "sha256:e6ce8bfeb9559370022b801d556d78df39ce82dc425d461e0ad5dcdf7b2a39c6", + "synthetic-public-trust.json": "sha256:a612f8b7ca6cc7342bb150d7ff48b2da15b342efa0f8d6bae55f288f266bb7cb", + "source-record.json": "sha256:80d140aec62a1a6ab49b14374d2349732bfa39aa15dc33ad6f7dfe3b02553872", + "handoff.json": "sha256:7994cccc9491ed3c7cbb56d35e7f5d9f27b46aa1abde299be3818d9e2aea97ea", + "claimfree-request.json": "sha256:03735c353218483016ee42e054097b1b26b7faf8cecf7991c2bfc2c3a301b0e8", + "normalization-source-record.json": "sha256:67dff5deb09aa98ce9fb11af1eff213a98cb3a730a06de062cb08442de4fd90c", + "response.json": "sha256:80d140aec62a1a6ab49b14374d2349732bfa39aa15dc33ad6f7dfe3b02553872", + "original-approval-claim.json": "sha256:a4347f3ba2ac0ba29c9104948b10fe62f6292179315abcbd268998c1a3046e07", + "request.json": "sha256:c4f6d753b433f8b60b649fb4afda96336e8c60e5a84ec5b0efaeca909b1d54ca" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/registry-drift-refusal.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/registry-drift-refusal.json new file mode 100644 index 00000000..f93411a1 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/registry-drift-refusal.json @@ -0,0 +1,10 @@ +{ + "actual_owner_registry_changed": true, + "original_registry_sha256": "sha256:37fba44ec0e0fd9b1e17a05ad1b7e4f9bb6ec9e0fc0bb3133e8af2ac6f832d7c", + "authoritative_registry_enrichment_retained": true, + "original_preapproval_refused_by_final_check": true, + "new_decision_record": false, + "approval_consumed": false, + "CAS_calls": 0, + "native_effects": 0 +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/request.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/request.json new file mode 100644 index 00000000..4cbc8677 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/request.json @@ -0,0 +1,172 @@ +{ + "action": "execute-ccr", + "context": { + "approval": { + "approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8", + "binding": { + "action": "execute-ccr", + "actor": "secrets-engine", + "digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2", + "human_control": true, + "pdp_digest": "sha256:5dbfc366910c8f62bf26a15f9e00289f774016a4092d462b2a82b9e30790e25a", + "pdp_path": true, + "principal": "secrets-engine", + "purpose": "metadata-test", + "target": { + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + }, + "id": "catalog:test-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + } + }, + "consumed": false, + "freshness": { + "not_after": "2026-10-16T15:07:44.099087+00:00", + "observed_at": "2026-10-16T15:05:44.099087+00:00", + "ttl_seconds": 120 + }, + "issuer": "approval-engine", + "kind": "approval-claim", + "reason_code": "ok", + "schema_version": "0.1", + "state": "valid", + "valid_now": true, + "validity": { + "expires_at": "2026-10-16T15:08:43.625859+00:00", + "not_before": "2026-10-16T15:04:43.625859+00:00" + }, + "yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)" + }, + "catalog_target": { + "auth_capability": {}, + "consumers": [ + { + "auth": "approle", + "claim": "role:c", + "name": "c" + } + ], + "delivery_auth": { + "management": "engine", + "method": "approle" + }, + "delivery_config": {}, + "delivery_modes": [ + "exec-env" + ], + "fields": [ + "api_token" + ], + "kind": "kv", + "mount": "secret", + "mount_management": "engine", + "org": "coulomb", + "path": "test/team/thing", + "repo": "team-repo", + "workload_delivery": [] + }, + "execution_contract": { + "backend_budget": { + "ttl_seconds": 30, + "uses": 12 + }, + "backend_origin": "http://127.0.0.1:18200", + "catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f", + "ccr_id": "CCR-2099-0001", + "ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "cluster_uid": "test-estate-not-live", + "contract_version": "SECRETS-EXEC-20261011-v1", + "execution_actor": "service:secrets-engine", + "execution_grant_ccr_id": "CCR-2099-0002", + "expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "operation": "metadata-apply-ccr", + "operation_deadline": "2026-10-16T15:06:43+00:00", + "operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153", + "operations": [ + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + ], + "source_bundle": { + "engine_dispatcher": { + "path": "/owner/engine_dispatcher.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "platform_mediator": { + "path": "/owner/platform_mediator.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "policy_auth": { + "path": "/owner/policy_auth.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "typed_ccr": { + "path": "/owner/typed_ccr.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + } + }, + "human_control": true, + "purpose": "metadata-test", + "service_actor_binding": { + "subject_id": "secrets-engine", + "subject_type": "service", + "tenant": "tenant:platform", + "transport_principal": "system:serviceaccount:secrets-engine:secrets-engine", + "version": "proposed-service-task-caller/v1" + } + }, + "resource": { + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + }, + "id": "catalog:test-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + }, + "subject": { + "id": "secrets-engine", + "tenant": "tenant:platform", + "type": "service" + }, + "tenant": "tenant:platform" +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/response.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/response.json new file mode 100644 index 00000000..a95c1165 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/response.json @@ -0,0 +1,284 @@ +{ + "id": "decision:9da2b8442a192d6d", + "contract_version": "flex-auth.decision-record.v1", + "effect": "allow", + "reason": "exact_task_execution_matched", + "matched_policy_version": "v2", + "matched_rule": "exact_task_execution_matched", + "resource": { + "id": "catalog:test-lane", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + } + }, + "subject": { + "id": "secrets-engine", + "type": "service", + "tenant": "tenant:platform", + "attributes": { + "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.", + "display_name": "secrets-engine service principal", + "groups": [ + "group:secrets-engine-lane-operators" + ], + "organization_relation": "ServiceProvider", + "roles": [ + "Operator" + ] + } + }, + "binding": { + "tenant": "tenant:platform", + "subject": { + "id": "secrets-engine", + "type": "service", + "tenant": "tenant:platform", + "attributes": { + "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.", + "display_name": "secrets-engine service principal", + "groups": [ + "group:secrets-engine-lane-operators" + ], + "organization_relation": "ServiceProvider", + "roles": [ + "Operator" + ] + } + }, + "action": "execute-ccr", + "resource": { + "id": "catalog:test-lane", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + } + }, + "context": { + "approval": { + "approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8", + "binding": { + "action": "execute-ccr", + "actor": "secrets-engine", + "digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2", + "human_control": true, + "pdp_digest": "sha256:5dbfc366910c8f62bf26a15f9e00289f774016a4092d462b2a82b9e30790e25a", + "pdp_path": true, + "principal": "secrets-engine", + "purpose": "metadata-test", + "target": { + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + }, + "id": "catalog:test-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + } + }, + "consumed": false, + "freshness": { + "not_after": "2026-10-16T15:07:44.099087+00:00", + "observed_at": "2026-10-16T15:05:44.099087+00:00", + "ttl_seconds": 120 + }, + "issuer": "approval-engine", + "kind": "approval-claim", + "reason_code": "ok", + "schema_version": "0.1", + "state": "valid", + "valid_now": true, + "validity": { + "expires_at": "2026-10-16T15:08:43.625859+00:00", + "not_before": "2026-10-16T15:04:43.625859+00:00" + }, + "yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)" + }, + "catalog_target": { + "auth_capability": {}, + "consumers": [ + { + "auth": "approle", + "claim": "role:c", + "name": "c" + } + ], + "delivery_auth": { + "management": "engine", + "method": "approle" + }, + "delivery_config": {}, + "delivery_modes": [ + "exec-env" + ], + "fields": [ + "api_token" + ], + "kind": "kv", + "mount": "secret", + "mount_management": "engine", + "org": "coulomb", + "path": "test/team/thing", + "repo": "team-repo", + "workload_delivery": [] + }, + "execution_contract": { + "backend_budget": { + "ttl_seconds": 30, + "uses": 12 + }, + "backend_origin": "http://127.0.0.1:18200", + "catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f", + "ccr_id": "CCR-2099-0001", + "ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "cluster_uid": "test-estate-not-live", + "contract_version": "SECRETS-EXEC-20261011-v1", + "execution_actor": "service:secrets-engine", + "execution_grant_ccr_id": "CCR-2099-0002", + "expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "operation": "metadata-apply-ccr", + "operation_deadline": "2026-10-16T15:06:43+00:00", + "operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153", + "operations": [ + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + ], + "source_bundle": { + "engine_dispatcher": { + "path": "/owner/engine_dispatcher.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "platform_mediator": { + "path": "/owner/platform_mediator.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "policy_auth": { + "path": "/owner/policy_auth.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "typed_ccr": { + "path": "/owner/typed_ccr.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + } + }, + "human_control": true, + "purpose": "metadata-test", + "service_actor_binding": { + "subject_id": "secrets-engine", + "subject_type": "service", + "tenant": "tenant:platform", + "transport_principal": "system:serviceaccount:secrets-engine:secrets-engine", + "version": "proposed-service-task-caller/v1" + } + }, + "request_digest": "sha256:ac65003b1b527d2194d7a50872f3dda3a9a4824fd3f8ba61721ba20c475ae645", + "approval_binding_digest": "sha256:5dbfc366910c8f62bf26a15f9e00289f774016a4092d462b2a82b9e30790e25a", + "submitted_request_digest": "sha256:6133a8947e450efc52f9f35883ab20b2c2f3539c8a8fa89c93a586edb0670a96" + }, + "lifetime": { + "kind": "ttl", + "ttl": "58.849511209s", + "not_before": "2026-10-16T15:05:44.150488791Z", + "expires_at": "2026-10-16T15:06:43Z" + }, + "diagnostics": { + "action": "execute-ccr", + "matched_relationship": "", + "policy_package": "secrets-engine.task-execution.service-pilot", + "policy_status": "proposed", + "registry_overrode": [], + "registry_resource": false, + "registry_subject": true + }, + "provenance": { + "evaluator": "flex-auth/local", + "mode": "standalone", + "policy_package": "secrets-engine.task-execution.service-pilot", + "policy_version": "v2", + "policy_package_digest": "sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d", + "registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb", + "input_claim_digests": { + "context": "sha256:2a7db6ed9f4a978909074b38fc17dc1c26127b72a10fe515895bac7bdb083435" + }, + "decision_time": "2026-10-16T15:05:44Z", + "approval_observation": { + "source_id": "synthetic-actual-approval-app", + "source_revision": "actual-owner-python-source-fixture", + "configuration_digest": "sha256:be934b2a902bbc14fa3a4fea20f1c1648390505900734b46599c7b5c544def22", + "claim_digest": "sha256:f5c973c833e6038d4a4cf7bd3425a10646265e7d9633199b88f57009b849fd4b", + "native_binding_digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2", + "observed_at": "2026-10-16T15:05:44.137304Z", + "not_after": "2026-10-16T15:07:44.099087Z", + "validated_at": "2026-10-16T15:05:44.13814262Z" + }, + "caller": { + "mode": "enforce", + "principal": "system:serviceaccount:secrets-engine:secrets-engine", + "audience": "flex-auth", + "not_after": "2026-10-16T15:07:43Z" + } + }, + "signature": { + "mode": "signed", + "alg": "ed25519", + "kid": "synthetic-v2", + "value": "utV-0akTB0x404y6mdQHAMuL8YLKrwdGtLYWCsk51pLiA_TxkamzL5fqoflcVXJfUBIEaMP8IfR3g53bUqyWBw" + }, + "caring": { + "profile": "caring-0.4.0-rc2", + "conformance_findings": [ + { + "code": "CARING-DESCRIPTOR-MISSING", + "severity": "warning", + "message": "no CARING descriptor matched the request", + "fields": [ + "caring_context" + ] + } + ] + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/source-record.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/source-record.json new file mode 100644 index 00000000..a95c1165 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/source-record.json @@ -0,0 +1,284 @@ +{ + "id": "decision:9da2b8442a192d6d", + "contract_version": "flex-auth.decision-record.v1", + "effect": "allow", + "reason": "exact_task_execution_matched", + "matched_policy_version": "v2", + "matched_rule": "exact_task_execution_matched", + "resource": { + "id": "catalog:test-lane", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + } + }, + "subject": { + "id": "secrets-engine", + "type": "service", + "tenant": "tenant:platform", + "attributes": { + "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.", + "display_name": "secrets-engine service principal", + "groups": [ + "group:secrets-engine-lane-operators" + ], + "organization_relation": "ServiceProvider", + "roles": [ + "Operator" + ] + } + }, + "binding": { + "tenant": "tenant:platform", + "subject": { + "id": "secrets-engine", + "type": "service", + "tenant": "tenant:platform", + "attributes": { + "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.", + "display_name": "secrets-engine service principal", + "groups": [ + "group:secrets-engine-lane-operators" + ], + "organization_relation": "ServiceProvider", + "roles": [ + "Operator" + ] + } + }, + "action": "execute-ccr", + "resource": { + "id": "catalog:test-lane", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + } + }, + "context": { + "approval": { + "approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8", + "binding": { + "action": "execute-ccr", + "actor": "secrets-engine", + "digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2", + "human_control": true, + "pdp_digest": "sha256:5dbfc366910c8f62bf26a15f9e00289f774016a4092d462b2a82b9e30790e25a", + "pdp_path": true, + "principal": "secrets-engine", + "purpose": "metadata-test", + "target": { + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + }, + "id": "catalog:test-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + } + }, + "consumed": false, + "freshness": { + "not_after": "2026-10-16T15:07:44.099087+00:00", + "observed_at": "2026-10-16T15:05:44.099087+00:00", + "ttl_seconds": 120 + }, + "issuer": "approval-engine", + "kind": "approval-claim", + "reason_code": "ok", + "schema_version": "0.1", + "state": "valid", + "valid_now": true, + "validity": { + "expires_at": "2026-10-16T15:08:43.625859+00:00", + "not_before": "2026-10-16T15:04:43.625859+00:00" + }, + "yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)" + }, + "catalog_target": { + "auth_capability": {}, + "consumers": [ + { + "auth": "approle", + "claim": "role:c", + "name": "c" + } + ], + "delivery_auth": { + "management": "engine", + "method": "approle" + }, + "delivery_config": {}, + "delivery_modes": [ + "exec-env" + ], + "fields": [ + "api_token" + ], + "kind": "kv", + "mount": "secret", + "mount_management": "engine", + "org": "coulomb", + "path": "test/team/thing", + "repo": "team-repo", + "workload_delivery": [] + }, + "execution_contract": { + "backend_budget": { + "ttl_seconds": 30, + "uses": 12 + }, + "backend_origin": "http://127.0.0.1:18200", + "catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f", + "ccr_id": "CCR-2099-0001", + "ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "cluster_uid": "test-estate-not-live", + "contract_version": "SECRETS-EXEC-20261011-v1", + "execution_actor": "service:secrets-engine", + "execution_grant_ccr_id": "CCR-2099-0002", + "expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "operation": "metadata-apply-ccr", + "operation_deadline": "2026-10-16T15:06:43+00:00", + "operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153", + "operations": [ + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + ], + "source_bundle": { + "engine_dispatcher": { + "path": "/owner/engine_dispatcher.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "platform_mediator": { + "path": "/owner/platform_mediator.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "policy_auth": { + "path": "/owner/policy_auth.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "typed_ccr": { + "path": "/owner/typed_ccr.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + } + }, + "human_control": true, + "purpose": "metadata-test", + "service_actor_binding": { + "subject_id": "secrets-engine", + "subject_type": "service", + "tenant": "tenant:platform", + "transport_principal": "system:serviceaccount:secrets-engine:secrets-engine", + "version": "proposed-service-task-caller/v1" + } + }, + "request_digest": "sha256:ac65003b1b527d2194d7a50872f3dda3a9a4824fd3f8ba61721ba20c475ae645", + "approval_binding_digest": "sha256:5dbfc366910c8f62bf26a15f9e00289f774016a4092d462b2a82b9e30790e25a", + "submitted_request_digest": "sha256:6133a8947e450efc52f9f35883ab20b2c2f3539c8a8fa89c93a586edb0670a96" + }, + "lifetime": { + "kind": "ttl", + "ttl": "58.849511209s", + "not_before": "2026-10-16T15:05:44.150488791Z", + "expires_at": "2026-10-16T15:06:43Z" + }, + "diagnostics": { + "action": "execute-ccr", + "matched_relationship": "", + "policy_package": "secrets-engine.task-execution.service-pilot", + "policy_status": "proposed", + "registry_overrode": [], + "registry_resource": false, + "registry_subject": true + }, + "provenance": { + "evaluator": "flex-auth/local", + "mode": "standalone", + "policy_package": "secrets-engine.task-execution.service-pilot", + "policy_version": "v2", + "policy_package_digest": "sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d", + "registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb", + "input_claim_digests": { + "context": "sha256:2a7db6ed9f4a978909074b38fc17dc1c26127b72a10fe515895bac7bdb083435" + }, + "decision_time": "2026-10-16T15:05:44Z", + "approval_observation": { + "source_id": "synthetic-actual-approval-app", + "source_revision": "actual-owner-python-source-fixture", + "configuration_digest": "sha256:be934b2a902bbc14fa3a4fea20f1c1648390505900734b46599c7b5c544def22", + "claim_digest": "sha256:f5c973c833e6038d4a4cf7bd3425a10646265e7d9633199b88f57009b849fd4b", + "native_binding_digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2", + "observed_at": "2026-10-16T15:05:44.137304Z", + "not_after": "2026-10-16T15:07:44.099087Z", + "validated_at": "2026-10-16T15:05:44.13814262Z" + }, + "caller": { + "mode": "enforce", + "principal": "system:serviceaccount:secrets-engine:secrets-engine", + "audience": "flex-auth", + "not_after": "2026-10-16T15:07:43Z" + } + }, + "signature": { + "mode": "signed", + "alg": "ed25519", + "kid": "synthetic-v2", + "value": "utV-0akTB0x404y6mdQHAMuL8YLKrwdGtLYWCsk51pLiA_TxkamzL5fqoflcVXJfUBIEaMP8IfR3g53bUqyWBw" + }, + "caring": { + "profile": "caring-0.4.0-rc2", + "conformance_findings": [ + { + "code": "CARING-DESCRIPTOR-MISSING", + "severity": "warning", + "message": "no CARING descriptor matched the request", + "fields": [ + "caring_context" + ] + } + ] + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/synthetic-public-trust.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/synthetic-public-trust.json new file mode 100644 index 00000000..ea2061ff --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/synthetic-public-trust.json @@ -0,0 +1 @@ +{"schema": "secrets-engine.pdp-trust.v1", "evaluator": "flex-auth/local", "mode": "standalone", "policy_package": "secrets-engine.task-execution.service-pilot", "policy_version": "v2", "policy_package_digest": "sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d", "keys": {"synthetic-v2": "Zs1gi5KLiOUODv6qM_rxxDzv4HKUsLh-n-CrpqPPdjM"}} \ No newline at end of file diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-test-r4.txt b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-test-r4.txt new file mode 100644 index 00000000..7a64761f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-test-r4.txt @@ -0,0 +1,32 @@ +{ + "scope": "disposable synthetic only", + "actual_source": "Approval App over TLS with authenticated create, configured synthetic human entry, read; actual SQLite engine", + "actual_access": "production serve binary from frozen B2/B3 retained-registry R3", + "allow": true, + "original_context_unchanged": true, + "published_digest_match": true, + "returned_source_record_match": true, + "actual_source_consumed_refused": true, + "actual_strict_prepare_and_consume": true, + "retained_registry": true, + "signed_deny_preapproval": true, + "no_precision_sleep": true, + "approval_precision_patch": "74eb0ff67d14508c2a2cee14d055790321ee171a96d5290ad6d037ce8f61dbcd", + "actual_registry_drift_refuses_before_cas": true, + "no_record_after_refusal": true, + "native_admission": false, + "files_sha256": { + "consumption-confirmation.json": "sha256:b8e73258585ebcba195c16d9ea3866afbcdfb226b70225e804ceade4a80da929", + "preapproval.json": "sha256:75a808a854af61465e5f1fd8a5a8fd003c9530a748fbed54ec3e825a31e2778a", + "negative-cases.json": "sha256:1bef572773c34f87a3c6587dbc60ebeb2835c01125f690e8d2f5b0d70a6abadd", + "registry-drift-refusal.json": "sha256:e6ce8bfeb9559370022b801d556d78df39ce82dc425d461e0ad5dcdf7b2a39c6", + "synthetic-public-trust.json": "sha256:a612f8b7ca6cc7342bb150d7ff48b2da15b342efa0f8d6bae55f288f266bb7cb", + "source-record.json": "sha256:80d140aec62a1a6ab49b14374d2349732bfa39aa15dc33ad6f7dfe3b02553872", + "handoff.json": "sha256:7994cccc9491ed3c7cbb56d35e7f5d9f27b46aa1abde299be3818d9e2aea97ea", + "claimfree-request.json": "sha256:03735c353218483016ee42e054097b1b26b7faf8cecf7991c2bfc2c3a301b0e8", + "normalization-source-record.json": "sha256:67dff5deb09aa98ce9fb11af1eff213a98cb3a730a06de062cb08442de4fd90c", + "response.json": "sha256:80d140aec62a1a6ab49b14374d2349732bfa39aa15dc33ad6f7dfe3b02553872", + "original-approval-claim.json": "sha256:a4347f3ba2ac0ba29c9104948b10fe62f6292179315abcbd268998c1a3046e07", + "request.json": "sha256:c4f6d753b433f8b60b649fb4afda96336e8c60e5a84ec5b0efaeca909b1d54ca" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-r4/handoff.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-r4/handoff.json new file mode 100644 index 00000000..a4c8059f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-r4/handoff.json @@ -0,0 +1,98 @@ +{ + "approval_binding_digest": "sha256:955e1c42ba2ec2c4e33c03168c0a3081d2c272d17d1e176395764308aae82a29", + "approval_expires_at": "2026-10-16T14:58:12.078227+00:00", + "approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8", + "decision_expires_at": "2026-10-16T14:56:12Z", + "decision_id": "decision:fbb2533578fcbd1b", + "decision_not_before": "2026-10-16T14:55:12.720633573Z", + "execution_contract": { + "backend_budget": { + "ttl_seconds": 30, + "uses": 12 + }, + "backend_origin": "http://127.0.0.1:18200", + "catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f", + "ccr_id": "CCR-2099-0001", + "ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "cluster_uid": "test-estate-not-live", + "contract_version": "SECRETS-EXEC-20261011-v1", + "execution_actor": "service:secrets-engine", + "execution_grant_ccr_id": "CCR-2099-0002", + "expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "operation": "metadata-apply-ccr", + "operation_deadline": "2026-10-16T14:56:12+00:00", + "operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153", + "operations": [ + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + ], + "source_bundle": { + "engine_dispatcher": { + "path": "/owner/engine_dispatcher.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "platform_mediator": { + "path": "/owner/platform_mediator.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "policy_auth": { + "path": "/owner/policy_auth.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "typed_ccr": { + "path": "/owner/typed_ccr.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + } + }, + "native_binding": { + "action": "execute-ccr", + "actor": "secrets-engine", + "principal": "secrets-engine", + "purpose": "metadata-test", + "target": { + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + }, + "id": "catalog:test-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + } + }, + "request_digest": "sha256:63eab50cea34a62c794fbad1c969354420172c94aac7dd0070701d5c6ff95a6e", + "submitted_request_digest": "sha256:63c4c4da6d4f112919a57f595fecd7b311dac541c00f51403484e1742417b4e2" +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-r4/negative-cases.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-r4/negative-cases.json new file mode 100644 index 00000000..aefd9ca2 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-r4/negative-cases.json @@ -0,0 +1,8 @@ +{ + "missing-service-binding": true, + "changed-descriptor": true, + "changed-native-target": true, + "expired-original": true, + "tampered-signature": true, + "prepared-replay": true +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-r4/original-approval-claim.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-r4/original-approval-claim.json new file mode 100644 index 00000000..1e48c34f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-r4/original-approval-claim.json @@ -0,0 +1,42 @@ +{ + "approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8", + "binding": { + "action": "execute-ccr", + "actor": "secrets-engine", + "digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2", + "human_control": true, + "pdp_digest": "sha256:955e1c42ba2ec2c4e33c03168c0a3081d2c272d17d1e176395764308aae82a29", + "pdp_path": true, + "principal": "secrets-engine", + "purpose": "metadata-test", + "target": { + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + }, + "id": "catalog:test-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + } + }, + "consumed": false, + "freshness": { + "not_after": "2026-10-16T14:57:12+00:00", + "observed_at": "2026-10-16T14:55:12+00:00", + "ttl_seconds": 120 + }, + "issuer": "approval-engine", + "kind": "approval-claim", + "reason_code": "ok", + "schema_version": "0.1", + "state": "valid", + "valid_now": true, + "validity": { + "expires_at": "2026-10-16T14:58:12.078227+00:00", + "not_before": "2026-10-16T14:54:12.078227+00:00" + }, + "yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)" +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-r4/preapproval.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-r4/preapproval.json new file mode 100644 index 00000000..cc9067dd --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-r4/preapproval.json @@ -0,0 +1,223 @@ +{ + "approval_binding_digest": "sha256:955e1c42ba2ec2c4e33c03168c0a3081d2c272d17d1e176395764308aae82a29", + "decision_id": "decision:d887e6c2729dee80", + "execution_contract": { + "backend_budget": { + "ttl_seconds": 30, + "uses": 12 + }, + "backend_origin": "http://127.0.0.1:18200", + "catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f", + "ccr_id": "CCR-2099-0001", + "ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "cluster_uid": "test-estate-not-live", + "contract_version": "SECRETS-EXEC-20261011-v1", + "execution_actor": "service:secrets-engine", + "execution_grant_ccr_id": "CCR-2099-0002", + "expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "operation": "metadata-apply-ccr", + "operation_deadline": "2026-10-16T14:56:12+00:00", + "operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153", + "operations": [ + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + ], + "source_bundle": { + "engine_dispatcher": { + "path": "/owner/engine_dispatcher.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "platform_mediator": { + "path": "/owner/platform_mediator.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "policy_auth": { + "path": "/owner/policy_auth.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "typed_ccr": { + "path": "/owner/typed_ccr.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + } + }, + "native_binding": { + "action": "execute-ccr", + "actor": "secrets-engine", + "principal": "secrets-engine", + "purpose": "metadata-test", + "target": { + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + }, + "id": "catalog:test-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + } + }, + "original_request": { + "action": "execute-ccr", + "context": { + "catalog_target": { + "auth_capability": {}, + "consumers": [ + { + "auth": "approle", + "claim": "role:c", + "name": "c" + } + ], + "delivery_auth": { + "management": "engine", + "method": "approle" + }, + "delivery_config": {}, + "delivery_modes": [ + "exec-env" + ], + "fields": [ + "api_token" + ], + "kind": "kv", + "mount": "secret", + "mount_management": "engine", + "org": "coulomb", + "path": "test/team/thing", + "repo": "team-repo", + "workload_delivery": [] + }, + "execution_contract": { + "backend_budget": { + "ttl_seconds": 30, + "uses": 12 + }, + "backend_origin": "http://127.0.0.1:18200", + "catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f", + "ccr_id": "CCR-2099-0001", + "ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "cluster_uid": "test-estate-not-live", + "contract_version": "SECRETS-EXEC-20261011-v1", + "execution_actor": "service:secrets-engine", + "execution_grant_ccr_id": "CCR-2099-0002", + "expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "operation": "metadata-apply-ccr", + "operation_deadline": "2026-10-16T14:56:12+00:00", + "operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153", + "operations": [ + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + ], + "source_bundle": { + "engine_dispatcher": { + "path": "/owner/engine_dispatcher.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "platform_mediator": { + "path": "/owner/platform_mediator.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "policy_auth": { + "path": "/owner/policy_auth.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "typed_ccr": { + "path": "/owner/typed_ccr.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + } + }, + "human_control": true, + "purpose": "metadata-test", + "service_actor_binding": { + "subject_id": "secrets-engine", + "subject_type": "service", + "tenant": "tenant:platform", + "transport_principal": "system:serviceaccount:secrets-engine:secrets-engine", + "version": "proposed-service-task-caller/v1" + } + }, + "resource": { + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + }, + "id": "catalog:test-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + }, + "subject": { + "id": "secrets-engine", + "tenant": "tenant:platform", + "type": "service" + }, + "tenant": "tenant:platform" + }, + "submitted_request_digest": "sha256:ddceaa8669948ca6e80ae9a909d4971fcde52332f92997c9902d6cb05aabe44d" +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-r4/receipt.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-r4/receipt.json new file mode 100644 index 00000000..b8c0f783 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-r4/receipt.json @@ -0,0 +1,25 @@ +{ + "scope": "disposable synthetic only", + "actual_source": "Approval App over TLS with authenticated create, configured synthetic human entry, read; actual SQLite engine", + "actual_access": "production serve binary from frozen B2/B3 temporal R2", + "allow": true, + "original_context_unchanged": true, + "published_digest_match": true, + "returned_source_record_match": true, + "actual_source_consumed_refused": true, + "actual_strict_prepare_and_consume": true, + "retained_registry": true, + "signed_deny_preapproval": true, + "no_precision_sleep": true, + "no_record_after_refusal": true, + "native_admission": false, + "files_sha256": { + "preapproval.json": "sha256:4de92cf77938a99ed24d12f858cd57d173497035bd0bb1c41775da77d61818e9", + "negative-cases.json": "sha256:1bef572773c34f87a3c6587dbc60ebeb2835c01125f690e8d2f5b0d70a6abadd", + "source-record.json": "sha256:462a9b1ef5eaa755ad9c0b912227be3f0d4103291ba5fe401ae532b6ac1219fd", + "handoff.json": "sha256:c14618c039cd5254872b7dc5420f6a40695c98e9993b9c55513cb541c5616c06", + "response.json": "sha256:462a9b1ef5eaa755ad9c0b912227be3f0d4103291ba5fe401ae532b6ac1219fd", + "original-approval-claim.json": "sha256:25f472fb00948bd3c9d806d7a5f61cd4e6a548a1f69933d240f7dfc1067155be", + "request.json": "sha256:0929ad6106d3739a1fd5a951e2827e417c9026e73586359b0f7d48820e05cc86" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-r4/request.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-r4/request.json new file mode 100644 index 00000000..eaa76f85 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-r4/request.json @@ -0,0 +1,172 @@ +{ + "action": "execute-ccr", + "context": { + "approval": { + "approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8", + "binding": { + "action": "execute-ccr", + "actor": "secrets-engine", + "digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2", + "human_control": true, + "pdp_digest": "sha256:955e1c42ba2ec2c4e33c03168c0a3081d2c272d17d1e176395764308aae82a29", + "pdp_path": true, + "principal": "secrets-engine", + "purpose": "metadata-test", + "target": { + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + }, + "id": "catalog:test-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + } + }, + "consumed": false, + "freshness": { + "not_after": "2026-10-16T14:57:12+00:00", + "observed_at": "2026-10-16T14:55:12+00:00", + "ttl_seconds": 120 + }, + "issuer": "approval-engine", + "kind": "approval-claim", + "reason_code": "ok", + "schema_version": "0.1", + "state": "valid", + "valid_now": true, + "validity": { + "expires_at": "2026-10-16T14:58:12.078227+00:00", + "not_before": "2026-10-16T14:54:12.078227+00:00" + }, + "yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)" + }, + "catalog_target": { + "auth_capability": {}, + "consumers": [ + { + "auth": "approle", + "claim": "role:c", + "name": "c" + } + ], + "delivery_auth": { + "management": "engine", + "method": "approle" + }, + "delivery_config": {}, + "delivery_modes": [ + "exec-env" + ], + "fields": [ + "api_token" + ], + "kind": "kv", + "mount": "secret", + "mount_management": "engine", + "org": "coulomb", + "path": "test/team/thing", + "repo": "team-repo", + "workload_delivery": [] + }, + "execution_contract": { + "backend_budget": { + "ttl_seconds": 30, + "uses": 12 + }, + "backend_origin": "http://127.0.0.1:18200", + "catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f", + "ccr_id": "CCR-2099-0001", + "ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "cluster_uid": "test-estate-not-live", + "contract_version": "SECRETS-EXEC-20261011-v1", + "execution_actor": "service:secrets-engine", + "execution_grant_ccr_id": "CCR-2099-0002", + "expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "operation": "metadata-apply-ccr", + "operation_deadline": "2026-10-16T14:56:12+00:00", + "operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153", + "operations": [ + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + ], + "source_bundle": { + "engine_dispatcher": { + "path": "/owner/engine_dispatcher.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "platform_mediator": { + "path": "/owner/platform_mediator.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "policy_auth": { + "path": "/owner/policy_auth.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "typed_ccr": { + "path": "/owner/typed_ccr.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + } + }, + "human_control": true, + "purpose": "metadata-test", + "service_actor_binding": { + "subject_id": "secrets-engine", + "subject_type": "service", + "tenant": "tenant:platform", + "transport_principal": "system:serviceaccount:secrets-engine:secrets-engine", + "version": "proposed-service-task-caller/v1" + } + }, + "resource": { + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + }, + "id": "catalog:test-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + }, + "subject": { + "id": "secrets-engine", + "tenant": "tenant:platform", + "type": "service" + }, + "tenant": "tenant:platform" +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-r4/response.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-r4/response.json new file mode 100644 index 00000000..45d6e839 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-r4/response.json @@ -0,0 +1,284 @@ +{ + "id": "decision:fbb2533578fcbd1b", + "contract_version": "flex-auth.decision-record.v1", + "effect": "allow", + "reason": "exact_task_execution_matched", + "matched_policy_version": "v2", + "matched_rule": "exact_task_execution_matched", + "resource": { + "id": "catalog:test-lane", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + } + }, + "subject": { + "id": "secrets-engine", + "type": "service", + "tenant": "tenant:platform", + "attributes": { + "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.", + "display_name": "secrets-engine service principal", + "groups": [ + "group:secrets-engine-lane-operators" + ], + "organization_relation": "ServiceProvider", + "roles": [ + "Operator" + ] + } + }, + "binding": { + "tenant": "tenant:platform", + "subject": { + "id": "secrets-engine", + "type": "service", + "tenant": "tenant:platform", + "attributes": { + "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.", + "display_name": "secrets-engine service principal", + "groups": [ + "group:secrets-engine-lane-operators" + ], + "organization_relation": "ServiceProvider", + "roles": [ + "Operator" + ] + } + }, + "action": "execute-ccr", + "resource": { + "id": "catalog:test-lane", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + } + }, + "context": { + "approval": { + "approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8", + "binding": { + "action": "execute-ccr", + "actor": "secrets-engine", + "digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2", + "human_control": true, + "pdp_digest": "sha256:955e1c42ba2ec2c4e33c03168c0a3081d2c272d17d1e176395764308aae82a29", + "pdp_path": true, + "principal": "secrets-engine", + "purpose": "metadata-test", + "target": { + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + }, + "id": "catalog:test-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + } + }, + "consumed": false, + "freshness": { + "not_after": "2026-10-16T14:57:12+00:00", + "observed_at": "2026-10-16T14:55:12+00:00", + "ttl_seconds": 120 + }, + "issuer": "approval-engine", + "kind": "approval-claim", + "reason_code": "ok", + "schema_version": "0.1", + "state": "valid", + "valid_now": true, + "validity": { + "expires_at": "2026-10-16T14:58:12.078227+00:00", + "not_before": "2026-10-16T14:54:12.078227+00:00" + }, + "yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)" + }, + "catalog_target": { + "auth_capability": {}, + "consumers": [ + { + "auth": "approle", + "claim": "role:c", + "name": "c" + } + ], + "delivery_auth": { + "management": "engine", + "method": "approle" + }, + "delivery_config": {}, + "delivery_modes": [ + "exec-env" + ], + "fields": [ + "api_token" + ], + "kind": "kv", + "mount": "secret", + "mount_management": "engine", + "org": "coulomb", + "path": "test/team/thing", + "repo": "team-repo", + "workload_delivery": [] + }, + "execution_contract": { + "backend_budget": { + "ttl_seconds": 30, + "uses": 12 + }, + "backend_origin": "http://127.0.0.1:18200", + "catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f", + "ccr_id": "CCR-2099-0001", + "ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "cluster_uid": "test-estate-not-live", + "contract_version": "SECRETS-EXEC-20261011-v1", + "execution_actor": "service:secrets-engine", + "execution_grant_ccr_id": "CCR-2099-0002", + "expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "operation": "metadata-apply-ccr", + "operation_deadline": "2026-10-16T14:56:12+00:00", + "operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153", + "operations": [ + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + ], + "source_bundle": { + "engine_dispatcher": { + "path": "/owner/engine_dispatcher.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "platform_mediator": { + "path": "/owner/platform_mediator.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "policy_auth": { + "path": "/owner/policy_auth.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "typed_ccr": { + "path": "/owner/typed_ccr.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + } + }, + "human_control": true, + "purpose": "metadata-test", + "service_actor_binding": { + "subject_id": "secrets-engine", + "subject_type": "service", + "tenant": "tenant:platform", + "transport_principal": "system:serviceaccount:secrets-engine:secrets-engine", + "version": "proposed-service-task-caller/v1" + } + }, + "request_digest": "sha256:63eab50cea34a62c794fbad1c969354420172c94aac7dd0070701d5c6ff95a6e", + "approval_binding_digest": "sha256:955e1c42ba2ec2c4e33c03168c0a3081d2c272d17d1e176395764308aae82a29", + "submitted_request_digest": "sha256:63c4c4da6d4f112919a57f595fecd7b311dac541c00f51403484e1742417b4e2" + }, + "lifetime": { + "kind": "ttl", + "ttl": "59.279366427s", + "not_before": "2026-10-16T14:55:12.720633573Z", + "expires_at": "2026-10-16T14:56:12Z" + }, + "diagnostics": { + "action": "execute-ccr", + "matched_relationship": "", + "policy_package": "secrets-engine.task-execution.service-pilot", + "policy_status": "proposed", + "registry_overrode": [], + "registry_resource": false, + "registry_subject": true + }, + "provenance": { + "evaluator": "flex-auth/local", + "mode": "standalone", + "policy_package": "secrets-engine.task-execution.service-pilot", + "policy_version": "v2", + "policy_package_digest": "sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d", + "registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb", + "input_claim_digests": { + "context": "sha256:0cbf619be3ce222fe0c3c74474f37d46678df486a77f540046390b13a64b5fc2" + }, + "decision_time": "2026-10-16T14:55:12Z", + "approval_observation": { + "source_id": "synthetic-actual-approval-app", + "source_revision": "actual-owner-python-source-fixture", + "configuration_digest": "sha256:ba4fc2cc956173b731487ff742e446efd6e318ab77f3d2bb97040c9a14a74f09", + "claim_digest": "sha256:045c9ae25cda8e28ff97f2b646d07d177cab6c012d1c6aac8179f9e7d65a54e2", + "native_binding_digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2", + "observed_at": "2026-10-16T14:55:12Z", + "not_after": "2026-10-16T14:57:12Z", + "validated_at": "2026-10-16T14:55:12.692281563Z" + }, + "caller": { + "mode": "enforce", + "principal": "system:serviceaccount:secrets-engine:secrets-engine", + "audience": "flex-auth", + "not_after": "2026-10-16T14:57:12Z" + } + }, + "signature": { + "mode": "signed", + "alg": "ed25519", + "kid": "synthetic-v2", + "value": "IgqOKC3xNGiurjliAin8w36agCazymTi8gMfTCGsXCzAZaLmX_m_5vk-h4OnQ7YDcX0wK7B7KARm9AczDJ4wDA" + }, + "caring": { + "profile": "caring-0.4.0-rc2", + "conformance_findings": [ + { + "code": "CARING-DESCRIPTOR-MISSING", + "severity": "warning", + "message": "no CARING descriptor matched the request", + "fields": [ + "caring_context" + ] + } + ] + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-r4/source-record.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-r4/source-record.json new file mode 100644 index 00000000..45d6e839 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-r4/source-record.json @@ -0,0 +1,284 @@ +{ + "id": "decision:fbb2533578fcbd1b", + "contract_version": "flex-auth.decision-record.v1", + "effect": "allow", + "reason": "exact_task_execution_matched", + "matched_policy_version": "v2", + "matched_rule": "exact_task_execution_matched", + "resource": { + "id": "catalog:test-lane", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + } + }, + "subject": { + "id": "secrets-engine", + "type": "service", + "tenant": "tenant:platform", + "attributes": { + "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.", + "display_name": "secrets-engine service principal", + "groups": [ + "group:secrets-engine-lane-operators" + ], + "organization_relation": "ServiceProvider", + "roles": [ + "Operator" + ] + } + }, + "binding": { + "tenant": "tenant:platform", + "subject": { + "id": "secrets-engine", + "type": "service", + "tenant": "tenant:platform", + "attributes": { + "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.", + "display_name": "secrets-engine service principal", + "groups": [ + "group:secrets-engine-lane-operators" + ], + "organization_relation": "ServiceProvider", + "roles": [ + "Operator" + ] + } + }, + "action": "execute-ccr", + "resource": { + "id": "catalog:test-lane", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + } + }, + "context": { + "approval": { + "approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8", + "binding": { + "action": "execute-ccr", + "actor": "secrets-engine", + "digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2", + "human_control": true, + "pdp_digest": "sha256:955e1c42ba2ec2c4e33c03168c0a3081d2c272d17d1e176395764308aae82a29", + "pdp_path": true, + "principal": "secrets-engine", + "purpose": "metadata-test", + "target": { + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + }, + "id": "catalog:test-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + } + }, + "consumed": false, + "freshness": { + "not_after": "2026-10-16T14:57:12+00:00", + "observed_at": "2026-10-16T14:55:12+00:00", + "ttl_seconds": 120 + }, + "issuer": "approval-engine", + "kind": "approval-claim", + "reason_code": "ok", + "schema_version": "0.1", + "state": "valid", + "valid_now": true, + "validity": { + "expires_at": "2026-10-16T14:58:12.078227+00:00", + "not_before": "2026-10-16T14:54:12.078227+00:00" + }, + "yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)" + }, + "catalog_target": { + "auth_capability": {}, + "consumers": [ + { + "auth": "approle", + "claim": "role:c", + "name": "c" + } + ], + "delivery_auth": { + "management": "engine", + "method": "approle" + }, + "delivery_config": {}, + "delivery_modes": [ + "exec-env" + ], + "fields": [ + "api_token" + ], + "kind": "kv", + "mount": "secret", + "mount_management": "engine", + "org": "coulomb", + "path": "test/team/thing", + "repo": "team-repo", + "workload_delivery": [] + }, + "execution_contract": { + "backend_budget": { + "ttl_seconds": 30, + "uses": 12 + }, + "backend_origin": "http://127.0.0.1:18200", + "catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f", + "ccr_id": "CCR-2099-0001", + "ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "cluster_uid": "test-estate-not-live", + "contract_version": "SECRETS-EXEC-20261011-v1", + "execution_actor": "service:secrets-engine", + "execution_grant_ccr_id": "CCR-2099-0002", + "expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "operation": "metadata-apply-ccr", + "operation_deadline": "2026-10-16T14:56:12+00:00", + "operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153", + "operations": [ + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + ], + "source_bundle": { + "engine_dispatcher": { + "path": "/owner/engine_dispatcher.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "platform_mediator": { + "path": "/owner/platform_mediator.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "policy_auth": { + "path": "/owner/policy_auth.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "typed_ccr": { + "path": "/owner/typed_ccr.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + } + }, + "human_control": true, + "purpose": "metadata-test", + "service_actor_binding": { + "subject_id": "secrets-engine", + "subject_type": "service", + "tenant": "tenant:platform", + "transport_principal": "system:serviceaccount:secrets-engine:secrets-engine", + "version": "proposed-service-task-caller/v1" + } + }, + "request_digest": "sha256:63eab50cea34a62c794fbad1c969354420172c94aac7dd0070701d5c6ff95a6e", + "approval_binding_digest": "sha256:955e1c42ba2ec2c4e33c03168c0a3081d2c272d17d1e176395764308aae82a29", + "submitted_request_digest": "sha256:63c4c4da6d4f112919a57f595fecd7b311dac541c00f51403484e1742417b4e2" + }, + "lifetime": { + "kind": "ttl", + "ttl": "59.279366427s", + "not_before": "2026-10-16T14:55:12.720633573Z", + "expires_at": "2026-10-16T14:56:12Z" + }, + "diagnostics": { + "action": "execute-ccr", + "matched_relationship": "", + "policy_package": "secrets-engine.task-execution.service-pilot", + "policy_status": "proposed", + "registry_overrode": [], + "registry_resource": false, + "registry_subject": true + }, + "provenance": { + "evaluator": "flex-auth/local", + "mode": "standalone", + "policy_package": "secrets-engine.task-execution.service-pilot", + "policy_version": "v2", + "policy_package_digest": "sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d", + "registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb", + "input_claim_digests": { + "context": "sha256:0cbf619be3ce222fe0c3c74474f37d46678df486a77f540046390b13a64b5fc2" + }, + "decision_time": "2026-10-16T14:55:12Z", + "approval_observation": { + "source_id": "synthetic-actual-approval-app", + "source_revision": "actual-owner-python-source-fixture", + "configuration_digest": "sha256:ba4fc2cc956173b731487ff742e446efd6e318ab77f3d2bb97040c9a14a74f09", + "claim_digest": "sha256:045c9ae25cda8e28ff97f2b646d07d177cab6c012d1c6aac8179f9e7d65a54e2", + "native_binding_digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2", + "observed_at": "2026-10-16T14:55:12Z", + "not_after": "2026-10-16T14:57:12Z", + "validated_at": "2026-10-16T14:55:12.692281563Z" + }, + "caller": { + "mode": "enforce", + "principal": "system:serviceaccount:secrets-engine:secrets-engine", + "audience": "flex-auth", + "not_after": "2026-10-16T14:57:12Z" + } + }, + "signature": { + "mode": "signed", + "alg": "ed25519", + "kid": "synthetic-v2", + "value": "IgqOKC3xNGiurjliAin8w36agCazymTi8gMfTCGsXCzAZaLmX_m_5vk-h4OnQ7YDcX0wK7B7KARm9AczDJ4wDA" + }, + "caring": { + "profile": "caring-0.4.0-rc2", + "conformance_findings": [ + { + "code": "CARING-DESCRIPTOR-MISSING", + "severity": "warning", + "message": "no CARING descriptor matched the request", + "fields": [ + "caring_context" + ] + } + ] + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-registry-smoke-r4.py b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-registry-smoke-r4.py new file mode 100644 index 00000000..38217b85 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-registry-smoke-r4.py @@ -0,0 +1,196 @@ +"""Disposable synthetic proof: actual Approval App HTTPS -> actual Access serve. +No native config, credential environment, approval or backend effect is used. +""" +import copy, base64, hashlib, http.server, io, json, os, pathlib, socket, ssl, subprocess, sys, tempfile, threading, time +from datetime import datetime, timedelta, timezone +from wsgiref.simple_server import make_server, WSGIRequestHandler +from cryptography import x509 +from cryptography.x509.oid import NameOID +from cryptography.hazmat.primitives import hashes, serialization +from cryptography.hazmat.primitives.asymmetric import rsa +sys.path.insert(0, '/tmp/netkingdom-approval-timestamp-precision-20261016') +sys.path.insert(0, '/tmp/netkingdom-secrets-trusted-successor/src') +from approval_engine.api import App +from approval_engine.auth import Identity, StaticTokenAuthenticator +from approval_engine.store import Engine +from secrets_engine.authorization import request_digest, approval_binding_digest +from secrets_engine.approval_consume import _expected_request +from secrets_engine.approval_claim import binding_from_check_request +from secrets_engine.execution_contract import ExecutionContract +from secrets_engine.task_execution_handoff import authorize_task_execution,consume_task_execution,prepare_task_approval +sys.path.insert(0,'/tmp/netkingdom-secrets-trusted-successor') +from tests.test_execution_context import entry,descriptor +from types import SimpleNamespace +from urllib.request import Request, urlopen +from urllib.error import HTTPError + +OUT=pathlib.Path(sys.argv[1]);OUT.mkdir(exist_ok=True) +def digest(raw):return 'sha256:'+hashlib.sha256(raw).hexdigest() +def write(path,raw,mode=0o600):path.write_bytes(raw);path.chmod(mode) +def identity(subject,kind,scopes):return Identity(subject=subject,issuer='synthetic-test-only',audiences=('approval-engine',),principal_type=kind,tenant='tenant:platform',roles=frozenset(),scopes=frozenset(scopes),assurance={'level':'synthetic'},evidence_ref='synthetic-test-only',tenant_source='directory') +class Quiet(WSGIRequestHandler): + def log_message(self,*args):pass +class Review(http.server.BaseHTTPRequestHandler): + def do_POST(self): + raw=self.rfile.read(int(self.headers['Content-Length']));body=json.loads(raw) + assert self.path=='/apis/authentication.k8s.io/v1/tokenreviews' + assert self.headers['Authorization']=='Bearer synthetic-reviewer' + assert body['spec']['audiences']==['flex-auth','access-engine'] + self.send_response(200);self.send_header('Content-Type','application/json');self.end_headers();self.wfile.write(json.dumps({'status':{'authenticated':True,'audiences':['flex-auth'],'user':{'username':'system:serviceaccount:secrets-engine:secrets-engine'}}}).encode()) + def log_message(self,*args):pass +with tempfile.TemporaryDirectory(prefix='access-actual-python-source-') as folder: + root=pathlib.Path(folder);now=datetime.now(timezone.utc) + key=rsa.generate_private_key(public_exponent=65537,key_size=2048);name=x509.Name([x509.NameAttribute(NameOID.COMMON_NAME,'localhost')]);cert=(x509.CertificateBuilder().subject_name(name).issuer_name(name).public_key(key.public_key()).serial_number(x509.random_serial_number()).not_valid_before(now-timedelta(minutes=1)).not_valid_after(now+timedelta(hours=1)).add_extension(x509.SubjectAlternativeName([x509.DNSName('localhost')]),critical=False).sign(key,hashes.SHA256())) + ca=root/'ca.pem';private=root/'tls-key.pem';write(ca,cert.public_bytes(serialization.Encoding.PEM));write(private,key.private_bytes(serialization.Encoding.PEM,serialization.PrivateFormat.PKCS8,serialization.NoEncryption())) + tls=ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER);tls.load_cert_chain(ca,private) + ctx=ssl.create_default_context(cafile=str(ca)) + def start(server):server.socket=tls.wrap_socket(server.socket,server_side=True);threading.Thread(target=server.serve_forever,daemon=True).start();return 'https://localhost:'+str(server.server_port) + review=http.server.HTTPServer(('127.0.0.1',0),Review);review_origin=start(review) + engine=Engine(root/'approval.sqlite3',freshness_ttl=120) + auth=StaticTokenAuthenticator({'synthetic-creator':identity('secrets-engine','service',{'approval:create'}),'synthetic-human':identity('synthetic-human','human',{'approval:approve'}),'synthetic-reader':identity('synthetic-access-reader','service',{'approval:read'}),'synthetic-consumer':identity('secrets-engine','service',{'approval:read','approval:consume'})}) + app=App(engine,auth) + source=make_server('127.0.0.1',0,app,handler_class=Quiet);origin=start(source) + consumer=make_server('127.0.0.1',0,app,handler_class=Quiet);threading.Thread(target=consumer.serve_forever,daemon=True).start() + def source_call(method,path,body,token): + request=Request(origin+path,data=json.dumps(body).encode() if body is not None else None,method=method,headers={'Authorization':'Bearer '+token,'Content-Type':'application/json'}) + with urlopen(request,context=ctx,timeout=3) as response:return response.status,json.load(response) + # Actual production builder, before issue: no caller approval enrichment. + aid='8bfc20be-47a4-4fb0-97a2-bf0a920afad8' + e=entry();d=descriptor(e) + d['operation_deadline']=(now+timedelta(seconds=60)).replace(microsecond=0).isoformat() + h='sha256:'+'a'*64 + d['backend_budget']={'ttl_seconds':30,'uses':12} + d['operations']=[{'method':method,'path':path,'payload_sha256':h} for path in ['sys/policies/acl/synthetic','auth/synthetic/role/synthetic'] for method in ['GET','PUT','GET']] + contract=ExecutionContract.parse(d) + cfg=SimpleNamespace(authorization_subject_id='secrets-engine',authorization_subject_type='service',authorization_policy_package='secrets-engine.task-execution.service-pilot',authorization_policy_version='v2',approval_url='http://127.0.0.1:'+str(consumer.server_port)) + request=_expected_request(cfg,e,'execute-ccr',execution_contract=contract) + native=binding_from_check_request(request) + seed=root/'seed';write(seed,base64.urlsafe_b64encode(bytes([19])*32).rstrip(b'='),0o440) + reviewer_token=root/'review-token';write(reviewer_token,b'synthetic-reviewer',0o440) + reader_token=root/'reader-token';write(reader_token,b'synthetic-reader',0o440) + registry=root/'registry.json';write(registry,pathlib.Path('/tmp/access-trusted-b2-b3-r2/examples/secrets-engine/registry_snapshot.json').read_bytes()) + config=root/'source.json';write(config,json.dumps({'source_id':'synthetic-actual-approval-app','source_revision':'actual-owner-python-source-fixture','origin':origin,'store_tenant':'tenant:platform','ca_file':str(ca),'token_file':str(reader_token)}).encode()) + listener=socket.socket();listener.bind(('127.0.0.1',0));port=listener.getsockname()[1];listener.close() + record=root/'record.jsonl';url=f'http://127.0.0.1:{port}' + command=['/tmp/netkingdom-access-trusted-r3','serve','--addr',f'127.0.0.1:{port}','--registry',str(registry),'--policy','/tmp/access-trusted-b2-b3-r2/examples/secrets-engine-service-task-execution-v2/policy_package.md','--log',str(record),'--caller-auth-mode','enforce','--caller-audience','flex-auth','--caller-kubernetes-url',review_origin,'--caller-reviewer-token-file',str(reviewer_token),'--caller-ca-file',str(ca),'--caller-binding','secrets-engine=system:serviceaccount:secrets-engine:secrets-engine','--envelope-signing-key-file',str(seed),'--envelope-signing-kid','synthetic-v2','--approval-source-file',str(config)] + child=subprocess.Popen(command,env={},stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL) + try: + for _ in range(100): + try: + with urlopen(url+'/healthz',timeout=.2):break + except Exception:time.sleep(.02) + jwt='synthetic.'+base64.urlsafe_b64encode(json.dumps({'exp':int((now+timedelta(minutes=2)).timestamp())}).encode()).decode().rstrip('=')+'.synthetic' + def check(value): + req=Request(url+'/v1/check',data=json.dumps(value).encode(),headers={'Authorization':'Bearer '+jwt,'Content-Type':'application/json'}) + try: + with urlopen(req,timeout=5) as response:return response.status,response.read() + except HTTPError as error:return error.code,error.read() + from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey + public=Ed25519PrivateKey.from_private_bytes(bytes([19])*32).public_key().public_bytes(serialization.Encoding.Raw,serialization.PublicFormat.Raw) + trust={'schema':'secrets-engine.pdp-trust.v1','evaluator':'flex-auth/local','mode':'standalone','policy_package':cfg.authorization_policy_package,'policy_version':'v2','policy_package_digest':'sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d','keys':{'synthetic-v2':base64.urlsafe_b64encode(public).decode().rstrip('=')}} + trustfile=root/'synthetic-trust.json';write(trustfile,json.dumps(trust).encode()) + pdptoken=root/'consumer-pdp-token';write(pdptoken,jwt.encode()) + approvaltoken=root/'consumer-approval-token';write(approvaltoken,b'synthetic-consumer') + cfg.pdp_url=url;cfg.pdp_token_file=pdptoken;cfg.approval_token_file=approvaltoken;cfg.pdp_trust_file=trustfile;cfg.pdp_verifier=pathlib.Path('/tmp/secrets-trusted-successor-verifier') + preapproval=prepare_task_approval(cfg,e,execution_contract=contract).as_owner_handoff() + assert preapproval['original_request']==request + assert preapproval['approval_binding_digest']!=preapproval['submitted_request_digest'] + native=preapproval['native_binding'] + status,created=source_call('POST','/v1/approvals',{'id':aid,'binding':native,'validity':{'not_before':(now-timedelta(minutes=1)).isoformat(),'expires_at':(now+timedelta(minutes=3)).isoformat()},'required_count':1,'pdp_digest':preapproval['approval_binding_digest'],'pdp_path':True,'human_control':True},'synthetic-creator');assert status==201 + status,_=source_call('POST',f'/v1/approvals/{aid}/entries',{},'synthetic-human');assert status==200 + status,claim=source_call('GET',f'/v1/approvals/{aid}/claim',None,'synthetic-reader');assert status==200 and claim['valid_now'] is True and claim['binding']['human_control'] is True + request['context']['approval']=claim + + # An old normalization cannot survive authoritative owner registry drift. + from secrets_engine.errors import DecisionError + normalized_record=record.read_bytes();original_registry=registry.read_bytes() + changed_registry=json.loads(original_registry) + changed_registry['subjects'][0]['roles'].append('SyntheticChangedRegistryRole') + def restart_registry(raw_registry): + global child + child.terminate();child.wait(timeout=5) + write(registry,raw_registry) + child=subprocess.Popen(command,env={},stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL) + for _ in range(100): + try: + with urlopen(url+'/healthz',timeout=.2):return + except Exception:time.sleep(.02) + raise AssertionError('restarted Access unavailable') + restart_registry(json.dumps(changed_registry).encode()) + try:authorize_task_execution(cfg,e,execution_contract=contract) + except DecisionError:pass + else:raise AssertionError('registry drift accepted original preapproval') + assert record.read_bytes()==normalized_record + _,unconsumed=source_call('GET',f'/v1/approvals/{aid}/claim',None,'synthetic-reader') + assert unconsumed['consumed'] is False + write(OUT/'registry-drift-refusal.json',(json.dumps({'actual_owner_registry_changed':True,'original_registry_sha256':digest(original_registry),'authoritative_registry_enrichment_retained':True,'original_preapproval_refused_by_final_check':True,'new_decision_record':False,'approval_consumed':False,'CAS_calls':0,'native_effects':0},indent=2)+'\n').encode(),0o644) + restart_registry(original_registry) + saved=record.read_bytes() + negative={} + for case in ['missing-service-binding','changed-descriptor','changed-native-target','expired-original']: + changed=copy.deepcopy(request) + if case=='missing-service-binding':del changed['context']['service_actor_binding'] + elif case=='changed-descriptor':changed['context']['execution_contract']['expected_after']='sha256:'+'b'*64 + elif case=='changed-native-target':changed['resource']['attributes']['synthetic_extra']=1.0 + else:changed['context']['approval']['freshness']['not_after']='2000-01-01T00:00:00Z' + refused_case,_=check(changed) + assert refused_case!=200 and record.read_bytes()==saved,case + negative[case]=True + authorization=authorize_task_execution(cfg,e,execution_contract=contract) + handoff=authorization.as_owner_handoff() + artifacts=json.loads(authorization._action.artifacts) + request=artifacts['request'];claim=artifacts['claim'];raw=artifacts['authenticated_envelope_json'].encode() + assert handoff['native_binding']==native + assert handoff['execution_contract']==contract.as_dict() + assert datetime.fromisoformat(handoff['decision_expires_at'].replace('Z','+00:00'))==datetime.fromisoformat(contract.as_dict()['operation_deadline']) + assert handoff['execution_contract']['backend_budget']=={'ttl_seconds':30,'uses':12} + assert handoff['request_digest']==request_digest(artifacts['envelope']['binding']) + assert handoff['submitted_request_digest']==request_digest(request) + response=json.loads(raw) + assert response['provenance']['registry_snapshot_digest']==preapproval['registry_snapshot_digest'] + assert claim['binding']['pdp_digest']==preapproval['approval_binding_digest'] + assert response['effect']=='allow' and response['signature']['mode']=='signed' + assert response['binding']['context']==request['context'];assert response['binding']['submitted_request_digest']==request_digest(request);assert response['binding']['approval_binding_digest']==preapproval['approval_binding_digest'] + assert response['provenance']['approval_observation']['source_id']=='synthetic-actual-approval-app' + from secrets_engine.decision_signature import authenticate_response + from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey + public=Ed25519PrivateKey.from_private_bytes(bytes([19])*32).public_key().public_bytes(serialization.Encoding.Raw,serialization.PublicFormat.Raw) + trust={k:response['provenance'][k] for k in ('evaluator','mode','policy_package','policy_version','policy_package_digest')} + trust['keys']={'synthetic-v2':base64.urlsafe_b64encode(public).decode().rstrip('=')} + authenticated=authenticate_response(raw,trust=trust,verifier=pathlib.Path('/tmp/secrets-trusted-successor-verifier')) + assert authenticated['binding']['context']==request['context'] + assert authenticate_response(authenticated.authenticated_json.encode(),trust=trust,verifier=pathlib.Path('/tmp/secrets-trusted-successor-verifier'))==authenticated + saved=record.read_bytes();records=[json.loads(line) for line in saved.splitlines()] + assert len(records)==2 and records[0]['effect']=='deny' and records[-1]==response + assert records[0]['binding']['request_digest']==preapproval['approval_binding_digest'] + assert response['binding']['submitted_request_digest']==request_digest(request) + from secrets_engine.errors import DecisionError + tampered=raw.replace(b'"effect":"allow"',b'"effect":"deny"') + assert tampered!=raw + try:authenticate_response(tampered,trust=trust,verifier=cfg.pdp_verifier) + except DecisionError:negative['tampered-signature']=True + else:raise AssertionError('tampered envelope accepted') + consumption=consume_task_execution(cfg,authorization) + assert datetime.fromisoformat(consumption.consumed_at.replace('Z','+00:00')).microsecond!=0 + assert consumption.idempotent is False and consumption.request_digest==handoff['request_digest'] and consumption.decision_id==handoff['decision_id'] + from approval_engine.execution_confirmation import ExecutionConfirmationClient + confirmed=ExecutionConfirmationClient(cfg.approval_url,approvaltoken).confirm_consumption(aid,handoff['request_digest'],handoff['decision_id'],expected_binding=handoff['native_binding'],expected_pdp_digest=handoff['approval_binding_digest']) + assert confirmed['request_digest']==handoff['request_digest'] and confirmed['decision_id']==handoff['decision_id'] + try:consume_task_execution(cfg,authorization) + except DecisionError:negative['prepared-replay']=True + else:raise AssertionError('prepared replay accepted') + write(OUT/'negative-cases.json',(json.dumps(negative,indent=2)+'\n').encode(),0o644) + write(OUT/'normalization-source-record.json',(json.dumps(records[0],indent=2)+'\n').encode(),0o644) + write(OUT/'claimfree-request.json',(json.dumps(preapproval['original_request'],indent=2)+'\n').encode(),0o644) + write(OUT/'synthetic-public-trust.json',trustfile.read_bytes(),0o644) + write(OUT/'consumption-confirmation.json',(json.dumps(confirmed,indent=2)+'\n').encode(),0o644) + write(OUT/'preapproval.json',(json.dumps(preapproval,indent=2)+'\n').encode(),0o644) + write(OUT/'handoff.json' ,(json.dumps(handoff,indent=2)+'\n').encode(),0o644) + # Consumed provider state cannot be rescued by the original carried claim. + + refused,_=check(request);assert refused!=200 and record.read_bytes()==saved + for name,value in [('request.json',request),('response.json',response),('source-record.json',records[-1]),('original-approval-claim.json',claim)]:write(OUT/name,(json.dumps(value,indent=2)+'\n').encode(),0o644) + receipt={'scope':'disposable synthetic only','actual_source':'Approval App over TLS with authenticated create, configured synthetic human entry, read; actual SQLite engine','actual_access':'production serve binary from frozen B2/B3 retained-registry R3','allow':True,'original_context_unchanged':True,'published_digest_match':True,'returned_source_record_match':True,'actual_source_consumed_refused':True,'actual_strict_prepare_and_consume':True,'retained_registry':True,'signed_deny_preapproval':True,'no_precision_sleep':True,'approval_precision_patch':'74eb0ff67d14508c2a2cee14d055790321ee171a96d5290ad6d037ce8f61dbcd','actual_registry_drift_refuses_before_cas':True,'no_record_after_refusal':True,'native_admission':False,'files_sha256':{p.name:digest(p.read_bytes()) for p in OUT.iterdir() if p.suffix=='.json' and p.name not in ('receipt.json','offline-signature-replay.json')}} + write(OUT/'receipt.json',(json.dumps(receipt,indent=2)+'\n').encode(),0o644);print(json.dumps(receipt,indent=2)) + finally: + child.terminate();child.wait(timeout=5);source.shutdown();consumer.shutdown();review.shutdown();engine.close() diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-test-r4.txt b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-test-r4.txt new file mode 100644 index 00000000..b8c0f783 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-test-r4.txt @@ -0,0 +1,25 @@ +{ + "scope": "disposable synthetic only", + "actual_source": "Approval App over TLS with authenticated create, configured synthetic human entry, read; actual SQLite engine", + "actual_access": "production serve binary from frozen B2/B3 temporal R2", + "allow": true, + "original_context_unchanged": true, + "published_digest_match": true, + "returned_source_record_match": true, + "actual_source_consumed_refused": true, + "actual_strict_prepare_and_consume": true, + "retained_registry": true, + "signed_deny_preapproval": true, + "no_precision_sleep": true, + "no_record_after_refusal": true, + "native_admission": false, + "files_sha256": { + "preapproval.json": "sha256:4de92cf77938a99ed24d12f858cd57d173497035bd0bb1c41775da77d61818e9", + "negative-cases.json": "sha256:1bef572773c34f87a3c6587dbc60ebeb2835c01125f690e8d2f5b0d70a6abadd", + "source-record.json": "sha256:462a9b1ef5eaa755ad9c0b912227be3f0d4103291ba5fe401ae532b6ac1219fd", + "handoff.json": "sha256:c14618c039cd5254872b7dc5420f6a40695c98e9993b9c55513cb541c5616c06", + "response.json": "sha256:462a9b1ef5eaa755ad9c0b912227be3f0d4103291ba5fe401ae532b6ac1219fd", + "original-approval-claim.json": "sha256:25f472fb00948bd3c9d806d7a5f61cd4e6a548a1f69933d240f7dfc1067155be", + "request.json": "sha256:0929ad6106d3739a1fd5a951e2827e417c9026e73586359b0f7d48820e05cc86" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-source-signature-smoke.py b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-source-signature-smoke.py new file mode 100644 index 00000000..a120f77a --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-source-signature-smoke.py @@ -0,0 +1,98 @@ +"""Disposable synthetic proof: actual Approval App HTTPS -> actual Access serve. +No native config, credential environment, approval or backend effect is used. +""" +import base64, hashlib, http.server, io, json, os, pathlib, socket, ssl, subprocess, sys, tempfile, threading, time +from datetime import datetime, timedelta, timezone +from wsgiref.simple_server import make_server, WSGIRequestHandler +from cryptography import x509 +from cryptography.x509.oid import NameOID +from cryptography.hazmat.primitives import hashes, serialization +from cryptography.hazmat.primitives.asymmetric import rsa +sys.path.insert(0, '/home/worsch/approval-engine') +sys.path.insert(0, '/tmp/netkingdom-secrets-trusted-successor/src') +from approval_engine.api import App +from approval_engine.auth import Identity, StaticTokenAuthenticator +from approval_engine.store import Engine +from secrets_engine.authorization import request_digest, approval_binding_digest +from urllib.request import Request, urlopen +from urllib.error import HTTPError + +OUT=pathlib.Path(sys.argv[1]);OUT.mkdir(exist_ok=True) +def digest(raw):return 'sha256:'+hashlib.sha256(raw).hexdigest() +def write(path,raw,mode=0o600):path.write_bytes(raw);path.chmod(mode) +def identity(subject,kind,scopes):return Identity(subject=subject,issuer='synthetic-test-only',audiences=('approval-engine',),principal_type=kind,tenant='tenant:platform',roles=frozenset(),scopes=frozenset(scopes),assurance={'level':'synthetic'},evidence_ref='synthetic-test-only',tenant_source='directory') +class Quiet(WSGIRequestHandler): + def log_message(self,*args):pass +class Review(http.server.BaseHTTPRequestHandler): + def do_POST(self): + raw=self.rfile.read(int(self.headers['Content-Length']));body=json.loads(raw) + assert self.path=='/apis/authentication.k8s.io/v1/tokenreviews' + assert self.headers['Authorization']=='Bearer synthetic-reviewer' + assert body['spec']['audiences']==['flex-auth','access-engine'] + self.send_response(200);self.send_header('Content-Type','application/json');self.end_headers();self.wfile.write(json.dumps({'status':{'authenticated':True,'audiences':['flex-auth'],'user':{'username':'system:serviceaccount:secrets-engine:secrets-engine'}}}).encode()) + def log_message(self,*args):pass +with tempfile.TemporaryDirectory(prefix='access-actual-python-source-') as folder: + root=pathlib.Path(folder);now=datetime.now(timezone.utc) + key=rsa.generate_private_key(public_exponent=65537,key_size=2048);name=x509.Name([x509.NameAttribute(NameOID.COMMON_NAME,'localhost')]);cert=(x509.CertificateBuilder().subject_name(name).issuer_name(name).public_key(key.public_key()).serial_number(x509.random_serial_number()).not_valid_before(now-timedelta(minutes=1)).not_valid_after(now+timedelta(hours=1)).add_extension(x509.SubjectAlternativeName([x509.DNSName('localhost')]),critical=False).sign(key,hashes.SHA256())) + ca=root/'ca.pem';private=root/'tls-key.pem';write(ca,cert.public_bytes(serialization.Encoding.PEM));write(private,key.private_bytes(serialization.Encoding.PEM,serialization.PrivateFormat.PKCS8,serialization.NoEncryption())) + tls=ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER);tls.load_cert_chain(ca,private) + ctx=ssl.create_default_context(cafile=str(ca)) + def start(server):server.socket=tls.wrap_socket(server.socket,server_side=True);threading.Thread(target=server.serve_forever,daemon=True).start();return 'https://localhost:'+str(server.server_port) + review=http.server.HTTPServer(('127.0.0.1',0),Review);review_origin=start(review) + engine=Engine(root/'approval.sqlite3',freshness_ttl=60) + auth=StaticTokenAuthenticator({'synthetic-creator':identity('secrets-engine','service',{'approval:create'}),'synthetic-human':identity('synthetic-human','human',{'approval:approve'}),'synthetic-reader':identity('synthetic-access-reader','service',{'approval:read'})}) + app=App(engine,auth) + source=make_server('127.0.0.1',0,app,handler_class=Quiet);origin=start(source) + def source_call(method,path,body,token): + request=Request(origin+path,data=json.dumps(body).encode() if body is not None else None,method=method,headers={'Authorization':'Bearer '+token,'Content-Type':'application/json'}) + with urlopen(request,context=ctx,timeout=3) as response:return response.status,json.load(response) + # Reuse existing owner interoperability contract generator; it has synthetic metadata only. + generated=subprocess.check_output([sys.executable,'/tmp/access-trusted-b2-b3/tools/service_task_execution_fixture.py'],env={'PATH':os.defpath}) + request=json.loads(generated)['request'];request['subject']['tenant']='tenant:platform';request['resource']['tenant']='tenant:platform';request['context']['purpose']='actual Python App source-only synthetic proof';del request['context']['approval'] + native={'action':request['action'],'actor':'secrets-engine','principal':'secrets-engine','purpose':request['context']['purpose'],'target':request['resource']} + aid='aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee' + status,created=source_call('POST','/v1/approvals',{'id':aid,'binding':native,'validity':{'not_before':(now-timedelta(minutes=1)).isoformat(),'expires_at':(now+timedelta(minutes=3)).isoformat()},'required_count':1,'pdp_digest':approval_binding_digest(request),'pdp_path':True,'human_control':True},'synthetic-creator');assert status==201 + status,_=source_call('POST',f'/v1/approvals/{aid}/entries',{},'synthetic-human');assert status==200 + status,claim=source_call('GET',f'/v1/approvals/{aid}/claim',None,'synthetic-reader');assert status==200 and claim['valid_now'] is True and claim['binding']['human_control'] is True + request['context']['approval']=claim + seed=root/'seed';write(seed,base64.urlsafe_b64encode(bytes([19])*32).rstrip(b'='),0o440) + reviewer_token=root/'review-token';write(reviewer_token,b'synthetic-reviewer',0o440) + reader_token=root/'reader-token';write(reader_token,b'synthetic-reader',0o440) + registry=root/'registry.json';write(registry,b'{}') + config=root/'source.json';write(config,json.dumps({'source_id':'synthetic-actual-approval-app','source_revision':'actual-owner-python-source-fixture','origin':origin,'store_tenant':'tenant:platform','ca_file':str(ca),'token_file':str(reader_token)}).encode()) + listener=socket.socket();listener.bind(('127.0.0.1',0));port=listener.getsockname()[1];listener.close() + record=root/'record.jsonl';url=f'http://127.0.0.1:{port}' + command=['/tmp/netkingdom-access-trusted-r1','serve','--addr',f'127.0.0.1:{port}','--registry',str(registry),'--policy','/tmp/access-trusted-b2-b3/examples/secrets-engine-service-task-execution-v2/policy_package.md','--log',str(record),'--caller-auth-mode','enforce','--caller-audience','flex-auth','--caller-kubernetes-url',review_origin,'--caller-reviewer-token-file',str(reviewer_token),'--caller-ca-file',str(ca),'--caller-binding','secrets-engine=system:serviceaccount:secrets-engine:secrets-engine','--envelope-signing-key-file',str(seed),'--envelope-signing-kid','synthetic-v2','--approval-source-file',str(config)] + child=subprocess.Popen(command,env={},stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL) + try: + for _ in range(100): + try: + with urlopen(url+'/healthz',timeout=.2):break + except Exception:time.sleep(.02) + jwt='synthetic.'+base64.urlsafe_b64encode(json.dumps({'exp':int((now+timedelta(minutes=2)).timestamp())}).encode()).decode().rstrip('=')+'.synthetic' + def check(value): + req=Request(url+'/v1/check',data=json.dumps(value).encode(),headers={'Authorization':'Bearer '+jwt,'Content-Type':'application/json'}) + try: + with urlopen(req,timeout=5) as response:return response.status,response.read() + except HTTPError as error:return error.code,error.read() + status,raw=check(request);assert status==200,(status,raw) + response=json.loads(raw);assert response['effect']=='allow' and response['signature']['mode']=='signed' + assert response['binding']['context']==request['context'];assert response['binding']['submitted_request_digest']==request_digest(request);assert response['binding']['approval_binding_digest']==approval_binding_digest(request) + assert response['provenance']['approval_observation']['source_id']=='synthetic-actual-approval-app' + from secrets_engine.decision_signature import authenticate_response + from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey + public=Ed25519PrivateKey.from_private_bytes(bytes([19])*32).public_key().public_bytes(serialization.Encoding.Raw,serialization.PublicFormat.Raw) + trust={k:response['provenance'][k] for k in ('evaluator','mode','policy_package','policy_version','policy_package_digest')} + trust['keys']={'synthetic-v2':base64.urlsafe_b64encode(public).decode().rstrip('=')} + authenticated=authenticate_response(raw,trust=trust,verifier=pathlib.Path('/tmp/secrets-trusted-successor-verifier')) + assert authenticated['binding']['context']==request['context'] + assert authenticate_response(authenticated.authenticated_json.encode(),trust=trust,verifier=pathlib.Path('/tmp/secrets-trusted-successor-verifier'))==authenticated + saved=record.read_bytes();assert json.loads(saved)==response + # Actual producer state transition is fetched anew and cannot be rescued by carried claim. + engine.revoke(aid) + refused,_=check(request);assert refused!=200 and record.read_bytes()==saved + for name,value in [('request.json',request),('response.json',response),('source-record.json',json.loads(saved)),('original-approval-claim.json',claim)]:write(OUT/name,(json.dumps(value,indent=2)+'\n').encode(),0o644) + receipt={'scope':'disposable synthetic only','actual_source':'Approval App over TLS with authenticated create, configured synthetic human entry, read; actual SQLite engine','actual_access':'production serve binary from frozen B2/B3 R1','allow':True,'original_context_unchanged':True,'published_digest_match':True,'returned_source_record_match':True,'actual_source_revoke_refused':True,'no_record_after_refusal':True,'native_admission':False,'files_sha256':{p.name:digest(p.read_bytes()) for p in OUT.iterdir() if p.suffix=='.json'}} + write(OUT/'receipt.json',(json.dumps(receipt,indent=2)+'\n').encode(),0o644);print(json.dumps(receipt,indent=2)) + finally: + child.terminate();child.wait(timeout=5);source.shutdown();review.shutdown();engine.close() diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-source-signature-test.txt b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-source-signature-test.txt new file mode 100644 index 00000000..4f1e2125 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-source-signature-test.txt @@ -0,0 +1,18 @@ +{ + "scope": "disposable synthetic only", + "actual_source": "Approval App over TLS with authenticated create, configured synthetic human entry, read; actual SQLite engine", + "actual_access": "production serve binary from frozen B2/B3 R1", + "allow": true, + "original_context_unchanged": true, + "published_digest_match": true, + "returned_source_record_match": true, + "actual_source_revoke_refused": true, + "no_record_after_refusal": true, + "native_admission": false, + "files_sha256": { + "source-record.json": "sha256:4161d0cc595aa1d73fac4acb632c620cebdf100fa7e54cbb741cc43663feebc8", + "response.json": "sha256:4161d0cc595aa1d73fac4acb632c620cebdf100fa7e54cbb741cc43663feebc8", + "original-approval-claim.json": "sha256:144f133000451e504fd208b1c6b3212b7a4fa7d16c7545e7ae17e509d122619a", + "request.json": "sha256:50db27dc3f782c844df9510174383465ca554136bc10524fd566a0edf06a4df8" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-source-signature/original-approval-claim.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-source-signature/original-approval-claim.json new file mode 100644 index 00000000..4e262d57 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-source-signature/original-approval-claim.json @@ -0,0 +1,39 @@ +{ + "approval_id": "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee", + "binding": { + "action": "execute-ccr", + "actor": "secrets-engine", + "digest": "sha256:19cfbe20e156cef1f4c0a37842c47666d2f5b2164d803d77a12346ed38a9444d", + "human_control": true, + "pdp_digest": "sha256:9683b49e53006e36ea4813e631ecd688df5a7a6242a8734c2cc5dca1887fb090", + "pdp_path": true, + "principal": "secrets-engine", + "purpose": "actual Python App source-only synthetic proof", + "target": { + "attributes": { + "stage": "prod" + }, + "id": "catalog:synthetic", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + } + }, + "consumed": false, + "freshness": { + "not_after": "2026-10-16T14:20:53+00:00", + "observed_at": "2026-10-16T14:19:53+00:00", + "ttl_seconds": 60 + }, + "issuer": "approval-engine", + "kind": "approval-claim", + "reason_code": "ok", + "schema_version": "0.1", + "state": "valid", + "valid_now": true, + "validity": { + "expires_at": "2026-10-16T14:22:53.492254+00:00", + "not_before": "2026-10-16T14:18:53.492254+00:00" + }, + "yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)" +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-source-signature/receipt.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-source-signature/receipt.json new file mode 100644 index 00000000..4f1e2125 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-source-signature/receipt.json @@ -0,0 +1,18 @@ +{ + "scope": "disposable synthetic only", + "actual_source": "Approval App over TLS with authenticated create, configured synthetic human entry, read; actual SQLite engine", + "actual_access": "production serve binary from frozen B2/B3 R1", + "allow": true, + "original_context_unchanged": true, + "published_digest_match": true, + "returned_source_record_match": true, + "actual_source_revoke_refused": true, + "no_record_after_refusal": true, + "native_admission": false, + "files_sha256": { + "source-record.json": "sha256:4161d0cc595aa1d73fac4acb632c620cebdf100fa7e54cbb741cc43663feebc8", + "response.json": "sha256:4161d0cc595aa1d73fac4acb632c620cebdf100fa7e54cbb741cc43663feebc8", + "original-approval-claim.json": "sha256:144f133000451e504fd208b1c6b3212b7a4fa7d16c7545e7ae17e509d122619a", + "request.json": "sha256:50db27dc3f782c844df9510174383465ca554136bc10524fd566a0edf06a4df8" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-source-signature/request.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-source-signature/request.json new file mode 100644 index 00000000..2a522a6c --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-source-signature/request.json @@ -0,0 +1,142 @@ +{ + "tenant": "tenant:platform", + "subject": { + "id": "secrets-engine", + "type": "service", + "tenant": "tenant:platform" + }, + "action": "execute-ccr", + "resource": { + "id": "catalog:synthetic", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "attributes": { + "stage": "prod" + }, + "tenant": "tenant:platform" + }, + "context": { + "execution_contract": { + "backend_budget": { + "ttl_seconds": 120, + "uses": 12 + }, + "backend_origin": "http://127.0.0.1:18200", + "catalog_sha256": "sha256:290e55b2258d66980f9443ba7d1436adfc77b8814bd161004d5af2ba272bc9cc", + "ccr_id": "CCR-2099-0001", + "ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "cluster_uid": "synthetic-not-native", + "contract_version": "SECRETS-EXEC-20261011-v1", + "execution_actor": "service:secrets-engine", + "execution_grant_ccr_id": "CCR-2099-0002", + "expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "operation": "metadata-apply-ccr", + "operation_deadline": "2026-10-16T14:21:33.683190+00:00", + "operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153", + "operations": [ + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + ], + "source_bundle": { + "engine_dispatcher": { + "path": "/synthetic/engine_dispatcher.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "platform_mediator": { + "path": "/synthetic/platform_mediator.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "policy_auth": { + "path": "/synthetic/policy_auth.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "typed_ccr": { + "path": "/synthetic/typed_ccr.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + } + }, + "catalog_target": { + "lane": "synthetic", + "stage": "prod" + }, + "human_control": true, + "service_actor_binding": { + "version": "proposed-service-task-caller/v1", + "transport_principal": "system:serviceaccount:secrets-engine:secrets-engine", + "subject_id": "secrets-engine", + "subject_type": "service", + "tenant": "tenant:platform" + }, + "purpose": "actual Python App source-only synthetic proof", + "approval": { + "approval_id": "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee", + "binding": { + "action": "execute-ccr", + "actor": "secrets-engine", + "digest": "sha256:19cfbe20e156cef1f4c0a37842c47666d2f5b2164d803d77a12346ed38a9444d", + "human_control": true, + "pdp_digest": "sha256:9683b49e53006e36ea4813e631ecd688df5a7a6242a8734c2cc5dca1887fb090", + "pdp_path": true, + "principal": "secrets-engine", + "purpose": "actual Python App source-only synthetic proof", + "target": { + "attributes": { + "stage": "prod" + }, + "id": "catalog:synthetic", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + } + }, + "consumed": false, + "freshness": { + "not_after": "2026-10-16T14:20:53+00:00", + "observed_at": "2026-10-16T14:19:53+00:00", + "ttl_seconds": 60 + }, + "issuer": "approval-engine", + "kind": "approval-claim", + "reason_code": "ok", + "schema_version": "0.1", + "state": "valid", + "valid_now": true, + "validity": { + "expires_at": "2026-10-16T14:22:53.492254+00:00", + "not_before": "2026-10-16T14:18:53.492254+00:00" + }, + "yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)" + } + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-source-signature/response.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-source-signature/response.json new file mode 100644 index 00000000..0b79da1a --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-source-signature/response.json @@ -0,0 +1,229 @@ +{ + "id": "decision:974ba42d31e13fe2", + "contract_version": "flex-auth.decision-record.v1", + "effect": "allow", + "reason": "exact_task_execution_matched", + "matched_policy_version": "v2", + "matched_rule": "exact_task_execution_matched", + "resource": { + "id": "catalog:synthetic", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "attributes": { + "stage": "prod" + } + }, + "subject": { + "id": "secrets-engine", + "type": "service", + "tenant": "tenant:platform" + }, + "binding": { + "tenant": "tenant:platform", + "subject": { + "id": "secrets-engine", + "type": "service", + "tenant": "tenant:platform" + }, + "action": "execute-ccr", + "resource": { + "id": "catalog:synthetic", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "attributes": { + "stage": "prod" + } + }, + "context": { + "approval": { + "approval_id": "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee", + "binding": { + "action": "execute-ccr", + "actor": "secrets-engine", + "digest": "sha256:19cfbe20e156cef1f4c0a37842c47666d2f5b2164d803d77a12346ed38a9444d", + "human_control": true, + "pdp_digest": "sha256:9683b49e53006e36ea4813e631ecd688df5a7a6242a8734c2cc5dca1887fb090", + "pdp_path": true, + "principal": "secrets-engine", + "purpose": "actual Python App source-only synthetic proof", + "target": { + "attributes": { + "stage": "prod" + }, + "id": "catalog:synthetic", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + } + }, + "consumed": false, + "freshness": { + "not_after": "2026-10-16T14:20:53+00:00", + "observed_at": "2026-10-16T14:19:53+00:00", + "ttl_seconds": 60 + }, + "issuer": "approval-engine", + "kind": "approval-claim", + "reason_code": "ok", + "schema_version": "0.1", + "state": "valid", + "valid_now": true, + "validity": { + "expires_at": "2026-10-16T14:22:53.492254+00:00", + "not_before": "2026-10-16T14:18:53.492254+00:00" + }, + "yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)" + }, + "catalog_target": { + "lane": "synthetic", + "stage": "prod" + }, + "execution_contract": { + "backend_budget": { + "ttl_seconds": 120, + "uses": 12 + }, + "backend_origin": "http://127.0.0.1:18200", + "catalog_sha256": "sha256:290e55b2258d66980f9443ba7d1436adfc77b8814bd161004d5af2ba272bc9cc", + "ccr_id": "CCR-2099-0001", + "ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "cluster_uid": "synthetic-not-native", + "contract_version": "SECRETS-EXEC-20261011-v1", + "execution_actor": "service:secrets-engine", + "execution_grant_ccr_id": "CCR-2099-0002", + "expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "operation": "metadata-apply-ccr", + "operation_deadline": "2026-10-16T14:21:33.683190+00:00", + "operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153", + "operations": [ + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + ], + "source_bundle": { + "engine_dispatcher": { + "path": "/synthetic/engine_dispatcher.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "platform_mediator": { + "path": "/synthetic/platform_mediator.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "policy_auth": { + "path": "/synthetic/policy_auth.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "typed_ccr": { + "path": "/synthetic/typed_ccr.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + } + }, + "human_control": true, + "purpose": "actual Python App source-only synthetic proof", + "service_actor_binding": { + "subject_id": "secrets-engine", + "subject_type": "service", + "tenant": "tenant:platform", + "transport_principal": "system:serviceaccount:secrets-engine:secrets-engine", + "version": "proposed-service-task-caller/v1" + } + }, + "request_digest": "sha256:38925892a5f3e3ff93a7e1b21bddf3556ca037c4a473466172ecceea3f0db628", + "approval_binding_digest": "sha256:9683b49e53006e36ea4813e631ecd688df5a7a6242a8734c2cc5dca1887fb090", + "submitted_request_digest": "sha256:38925892a5f3e3ff93a7e1b21bddf3556ca037c4a473466172ecceea3f0db628" + }, + "lifetime": { + "kind": "ttl", + "ttl": "15s", + "not_before": "2026-10-16T14:19:53Z", + "expires_at": "2026-10-16T14:20:08Z" + }, + "diagnostics": { + "action": "execute-ccr", + "matched_relationship": "", + "policy_package": "secrets-engine.task-execution.service-pilot", + "policy_status": "proposed", + "registry_overrode": [], + "registry_resource": false, + "registry_subject": false + }, + "provenance": { + "evaluator": "flex-auth/local", + "mode": "standalone", + "policy_package": "secrets-engine.task-execution.service-pilot", + "policy_version": "v2", + "policy_package_digest": "sha256:fc5a8769886b72006ba298bc0799741d0f1ed327dde9e36a6c35d26be4ea0bdc", + "registry_snapshot_digest": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "input_claim_digests": { + "context": "sha256:29a4d2e1ccb1ffed60d7e84bade5e719ed39d1eebbfa9ee80c8ca46d7d38062e" + }, + "decision_time": "2026-10-16T14:19:53Z", + "approval_observation": { + "source_id": "synthetic-actual-approval-app", + "source_revision": "actual-owner-python-source-fixture", + "configuration_digest": "sha256:f886cf108e79530e83dcc0f1fd127a39479dddaf5039014c2d7ed8f795b92947", + "claim_digest": "sha256:547015020ab77d8c179216c21141b1ffd47072124e97de848f16cea5ec9719f8", + "native_binding_digest": "sha256:19cfbe20e156cef1f4c0a37842c47666d2f5b2164d803d77a12346ed38a9444d", + "observed_at": "2026-10-16T14:19:53Z", + "not_after": "2026-10-16T14:20:53Z", + "validated_at": "2026-10-16T14:19:53.8556608Z" + }, + "caller": { + "mode": "enforce", + "principal": "system:serviceaccount:secrets-engine:secrets-engine", + "audience": "flex-auth", + "not_after": "2026-10-16T14:21:53Z" + } + }, + "signature": { + "mode": "signed", + "alg": "ed25519", + "kid": "synthetic-v2", + "value": "tVf1ppYrKsvLHJL-7Q9c9IEegJYIHql3s2Xvw8vjucz2KyufnMBArzEnK9J5k9BBtfWpDgP8OEEj7Dw6QjVrBg" + }, + "caring": { + "profile": "caring-0.4.0-rc2", + "conformance_findings": [ + { + "code": "CARING-DESCRIPTOR-MISSING", + "severity": "warning", + "message": "no CARING descriptor matched the request", + "fields": [ + "caring_context" + ] + } + ] + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-source-signature/source-record.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-source-signature/source-record.json new file mode 100644 index 00000000..0b79da1a --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-source-signature/source-record.json @@ -0,0 +1,229 @@ +{ + "id": "decision:974ba42d31e13fe2", + "contract_version": "flex-auth.decision-record.v1", + "effect": "allow", + "reason": "exact_task_execution_matched", + "matched_policy_version": "v2", + "matched_rule": "exact_task_execution_matched", + "resource": { + "id": "catalog:synthetic", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "attributes": { + "stage": "prod" + } + }, + "subject": { + "id": "secrets-engine", + "type": "service", + "tenant": "tenant:platform" + }, + "binding": { + "tenant": "tenant:platform", + "subject": { + "id": "secrets-engine", + "type": "service", + "tenant": "tenant:platform" + }, + "action": "execute-ccr", + "resource": { + "id": "catalog:synthetic", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "attributes": { + "stage": "prod" + } + }, + "context": { + "approval": { + "approval_id": "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee", + "binding": { + "action": "execute-ccr", + "actor": "secrets-engine", + "digest": "sha256:19cfbe20e156cef1f4c0a37842c47666d2f5b2164d803d77a12346ed38a9444d", + "human_control": true, + "pdp_digest": "sha256:9683b49e53006e36ea4813e631ecd688df5a7a6242a8734c2cc5dca1887fb090", + "pdp_path": true, + "principal": "secrets-engine", + "purpose": "actual Python App source-only synthetic proof", + "target": { + "attributes": { + "stage": "prod" + }, + "id": "catalog:synthetic", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + } + }, + "consumed": false, + "freshness": { + "not_after": "2026-10-16T14:20:53+00:00", + "observed_at": "2026-10-16T14:19:53+00:00", + "ttl_seconds": 60 + }, + "issuer": "approval-engine", + "kind": "approval-claim", + "reason_code": "ok", + "schema_version": "0.1", + "state": "valid", + "valid_now": true, + "validity": { + "expires_at": "2026-10-16T14:22:53.492254+00:00", + "not_before": "2026-10-16T14:18:53.492254+00:00" + }, + "yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)" + }, + "catalog_target": { + "lane": "synthetic", + "stage": "prod" + }, + "execution_contract": { + "backend_budget": { + "ttl_seconds": 120, + "uses": 12 + }, + "backend_origin": "http://127.0.0.1:18200", + "catalog_sha256": "sha256:290e55b2258d66980f9443ba7d1436adfc77b8814bd161004d5af2ba272bc9cc", + "ccr_id": "CCR-2099-0001", + "ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "cluster_uid": "synthetic-not-native", + "contract_version": "SECRETS-EXEC-20261011-v1", + "execution_actor": "service:secrets-engine", + "execution_grant_ccr_id": "CCR-2099-0002", + "expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "operation": "metadata-apply-ccr", + "operation_deadline": "2026-10-16T14:21:33.683190+00:00", + "operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153", + "operations": [ + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + ], + "source_bundle": { + "engine_dispatcher": { + "path": "/synthetic/engine_dispatcher.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "platform_mediator": { + "path": "/synthetic/platform_mediator.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "policy_auth": { + "path": "/synthetic/policy_auth.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "typed_ccr": { + "path": "/synthetic/typed_ccr.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + } + }, + "human_control": true, + "purpose": "actual Python App source-only synthetic proof", + "service_actor_binding": { + "subject_id": "secrets-engine", + "subject_type": "service", + "tenant": "tenant:platform", + "transport_principal": "system:serviceaccount:secrets-engine:secrets-engine", + "version": "proposed-service-task-caller/v1" + } + }, + "request_digest": "sha256:38925892a5f3e3ff93a7e1b21bddf3556ca037c4a473466172ecceea3f0db628", + "approval_binding_digest": "sha256:9683b49e53006e36ea4813e631ecd688df5a7a6242a8734c2cc5dca1887fb090", + "submitted_request_digest": "sha256:38925892a5f3e3ff93a7e1b21bddf3556ca037c4a473466172ecceea3f0db628" + }, + "lifetime": { + "kind": "ttl", + "ttl": "15s", + "not_before": "2026-10-16T14:19:53Z", + "expires_at": "2026-10-16T14:20:08Z" + }, + "diagnostics": { + "action": "execute-ccr", + "matched_relationship": "", + "policy_package": "secrets-engine.task-execution.service-pilot", + "policy_status": "proposed", + "registry_overrode": [], + "registry_resource": false, + "registry_subject": false + }, + "provenance": { + "evaluator": "flex-auth/local", + "mode": "standalone", + "policy_package": "secrets-engine.task-execution.service-pilot", + "policy_version": "v2", + "policy_package_digest": "sha256:fc5a8769886b72006ba298bc0799741d0f1ed327dde9e36a6c35d26be4ea0bdc", + "registry_snapshot_digest": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "input_claim_digests": { + "context": "sha256:29a4d2e1ccb1ffed60d7e84bade5e719ed39d1eebbfa9ee80c8ca46d7d38062e" + }, + "decision_time": "2026-10-16T14:19:53Z", + "approval_observation": { + "source_id": "synthetic-actual-approval-app", + "source_revision": "actual-owner-python-source-fixture", + "configuration_digest": "sha256:f886cf108e79530e83dcc0f1fd127a39479dddaf5039014c2d7ed8f795b92947", + "claim_digest": "sha256:547015020ab77d8c179216c21141b1ffd47072124e97de848f16cea5ec9719f8", + "native_binding_digest": "sha256:19cfbe20e156cef1f4c0a37842c47666d2f5b2164d803d77a12346ed38a9444d", + "observed_at": "2026-10-16T14:19:53Z", + "not_after": "2026-10-16T14:20:53Z", + "validated_at": "2026-10-16T14:19:53.8556608Z" + }, + "caller": { + "mode": "enforce", + "principal": "system:serviceaccount:secrets-engine:secrets-engine", + "audience": "flex-auth", + "not_after": "2026-10-16T14:21:53Z" + } + }, + "signature": { + "mode": "signed", + "alg": "ed25519", + "kid": "synthetic-v2", + "value": "tVf1ppYrKsvLHJL-7Q9c9IEegJYIHql3s2Xvw8vjucz2KyufnMBArzEnK9J5k9BBtfWpDgP8OEEj7Dw6QjVrBg" + }, + "caring": { + "profile": "caring-0.4.0-rc2", + "conformance_findings": [ + { + "code": "CARING-DESCRIPTOR-MISSING", + "severity": "warning", + "message": "no CARING descriptor matched the request", + "fields": [ + "caring_context" + ] + } + ] + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-attempt1-r2.txt b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-attempt1-r2.txt new file mode 100644 index 00000000..04d3d8d9 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-attempt1-r2.txt @@ -0,0 +1,5 @@ +Traceback (most recent call last): + File "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-source-smoke-r2.py", line 121, in + assert status==200 and confirmed['request_digest']==handoff['request_digest'] and confirmed['decision_id']==handoff['decision_id'] + ~~~~~~~~~^^^^^^^^^^^^^^^^^^ +KeyError: 'request_digest' diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-attempt1-r3.txt b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-attempt1-r3.txt new file mode 100644 index 00000000..ba9a76de --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-attempt1-r3.txt @@ -0,0 +1,5 @@ +Traceback (most recent call last): + File "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-source-smoke-r3.py", line 105, in + assert handoff['decision_expires_at']==contract.as_dict()['operation_deadline'] + ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +AssertionError diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-fast-cas-refusal-r3.txt b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-fast-cas-refusal-r3.txt new file mode 100644 index 00000000..ec06353e --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-fast-cas-refusal-r3.txt @@ -0,0 +1,9 @@ +Traceback (most recent call last): + File "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-source-smoke-r3.py", line 137, in + consumption=consume_task_execution(cfg,authorization) + ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + File "/tmp/netkingdom-secrets-trusted-successor/src/secrets_engine/task_execution_handoff.py", line 206, in consume_task_execution + _refuse() + File "/tmp/netkingdom-secrets-trusted-successor/src/secrets_engine/task_execution_handoff.py", line 34, in _refuse + raise DecisionError('strict task execution handoff correspondence refused') +secrets_engine.errors.DecisionError: strict task execution handoff correspondence refused diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r2/handoff.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r2/handoff.json new file mode 100644 index 00000000..9bffc7aa --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r2/handoff.json @@ -0,0 +1,98 @@ +{ + "approval_binding_digest": "sha256:7568d4dd53da932730b5e83bc03d821b612bb5ba4b53992940b08d805d03ea19", + "approval_expires_at": "2026-10-16T14:31:11.162458+00:00", + "approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8", + "decision_expires_at": "2026-10-16T14:28:23Z", + "decision_id": "decision:65b3e4594d0e3af8", + "decision_not_before": "2026-10-16T14:28:11Z", + "execution_contract": { + "backend_budget": { + "ttl_seconds": 120, + "uses": 12 + }, + "backend_origin": "http://127.0.0.1:18200", + "catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f", + "ccr_id": "CCR-2099-0001", + "ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "cluster_uid": "test-estate-not-live", + "contract_version": "SECRETS-EXEC-20261011-v1", + "execution_actor": "service:secrets-engine", + "execution_grant_ccr_id": "CCR-2099-0002", + "expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "operation": "metadata-apply-ccr", + "operation_deadline": "2026-10-16T14:28:23+00:00", + "operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153", + "operations": [ + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + ], + "source_bundle": { + "engine_dispatcher": { + "path": "/owner/engine_dispatcher.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "platform_mediator": { + "path": "/owner/platform_mediator.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "policy_auth": { + "path": "/owner/policy_auth.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "typed_ccr": { + "path": "/owner/typed_ccr.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + } + }, + "native_binding": { + "action": "execute-ccr", + "actor": "secrets-engine", + "principal": "secrets-engine", + "purpose": "metadata-test", + "target": { + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + }, + "id": "catalog:test-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + } + }, + "request_digest": "sha256:e47269c2c3458bb7c23fef40092e2bf5c084c705a13f72a1cbfeac0c6fbadc3e", + "submitted_request_digest": "sha256:e47269c2c3458bb7c23fef40092e2bf5c084c705a13f72a1cbfeac0c6fbadc3e" +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r2/negative-cases.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r2/negative-cases.json new file mode 100644 index 00000000..aefd9ca2 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r2/negative-cases.json @@ -0,0 +1,8 @@ +{ + "missing-service-binding": true, + "changed-descriptor": true, + "changed-native-target": true, + "expired-original": true, + "tampered-signature": true, + "prepared-replay": true +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r2/original-approval-claim.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r2/original-approval-claim.json new file mode 100644 index 00000000..d5fb10f3 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r2/original-approval-claim.json @@ -0,0 +1,42 @@ +{ + "approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8", + "binding": { + "action": "execute-ccr", + "actor": "secrets-engine", + "digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2", + "human_control": true, + "pdp_digest": "sha256:7568d4dd53da932730b5e83bc03d821b612bb5ba4b53992940b08d805d03ea19", + "pdp_path": true, + "principal": "secrets-engine", + "purpose": "metadata-test", + "target": { + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + }, + "id": "catalog:test-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + } + }, + "consumed": false, + "freshness": { + "not_after": "2026-10-16T14:29:11+00:00", + "observed_at": "2026-10-16T14:28:11+00:00", + "ttl_seconds": 60 + }, + "issuer": "approval-engine", + "kind": "approval-claim", + "reason_code": "ok", + "schema_version": "0.1", + "state": "valid", + "valid_now": true, + "validity": { + "expires_at": "2026-10-16T14:31:11.162458+00:00", + "not_before": "2026-10-16T14:27:11.162458+00:00" + }, + "yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)" +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r2/receipt.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r2/receipt.json new file mode 100644 index 00000000..307fcc79 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r2/receipt.json @@ -0,0 +1,22 @@ +{ + "scope": "disposable synthetic only", + "actual_source": "Approval App over TLS with authenticated create, configured synthetic human entry, read; actual SQLite engine", + "actual_access": "production serve binary from frozen B2/B3 R1", + "allow": true, + "original_context_unchanged": true, + "published_digest_match": true, + "returned_source_record_match": true, + "actual_source_consumed_refused": true, + "actual_strict_prepare_and_consume": true, + "no_record_after_refusal": true, + "native_admission": false, + "files_sha256": { + "negative-cases.json": "sha256:1bef572773c34f87a3c6587dbc60ebeb2835c01125f690e8d2f5b0d70a6abadd", + "receipt.json": "sha256:ef67d3235ac36e01f03c6b49e73f106f4fb328e954d71a6cfd84e1d8baac3b28", + "source-record.json": "sha256:3d85490777303e032ce371ec0e7de514ea8b5825ad9b9437e7ff06414551e7bd", + "handoff.json": "sha256:6156a5378ddfdd583ccafde75063165ead5e8df8c7114c94c3c4e44d637d813f", + "response.json": "sha256:3d85490777303e032ce371ec0e7de514ea8b5825ad9b9437e7ff06414551e7bd", + "original-approval-claim.json": "sha256:ecb921ebc1d836ab2a8fff9ec185011cdaf28f7c9341778107cae4605fc5f0e2", + "request.json": "sha256:c4d9c5fe344185a7361b605db0df9b9018cae03a2b54818fad33b8a131c67aa5" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r2/request.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r2/request.json new file mode 100644 index 00000000..29f1f68a --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r2/request.json @@ -0,0 +1,172 @@ +{ + "action": "execute-ccr", + "context": { + "approval": { + "approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8", + "binding": { + "action": "execute-ccr", + "actor": "secrets-engine", + "digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2", + "human_control": true, + "pdp_digest": "sha256:7568d4dd53da932730b5e83bc03d821b612bb5ba4b53992940b08d805d03ea19", + "pdp_path": true, + "principal": "secrets-engine", + "purpose": "metadata-test", + "target": { + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + }, + "id": "catalog:test-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + } + }, + "consumed": false, + "freshness": { + "not_after": "2026-10-16T14:29:11+00:00", + "observed_at": "2026-10-16T14:28:11+00:00", + "ttl_seconds": 60 + }, + "issuer": "approval-engine", + "kind": "approval-claim", + "reason_code": "ok", + "schema_version": "0.1", + "state": "valid", + "valid_now": true, + "validity": { + "expires_at": "2026-10-16T14:31:11.162458+00:00", + "not_before": "2026-10-16T14:27:11.162458+00:00" + }, + "yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)" + }, + "catalog_target": { + "auth_capability": {}, + "consumers": [ + { + "auth": "approle", + "claim": "role:c", + "name": "c" + } + ], + "delivery_auth": { + "management": "engine", + "method": "approle" + }, + "delivery_config": {}, + "delivery_modes": [ + "exec-env" + ], + "fields": [ + "api_token" + ], + "kind": "kv", + "mount": "secret", + "mount_management": "engine", + "org": "coulomb", + "path": "test/team/thing", + "repo": "team-repo", + "workload_delivery": [] + }, + "execution_contract": { + "backend_budget": { + "ttl_seconds": 120, + "uses": 12 + }, + "backend_origin": "http://127.0.0.1:18200", + "catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f", + "ccr_id": "CCR-2099-0001", + "ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "cluster_uid": "test-estate-not-live", + "contract_version": "SECRETS-EXEC-20261011-v1", + "execution_actor": "service:secrets-engine", + "execution_grant_ccr_id": "CCR-2099-0002", + "expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "operation": "metadata-apply-ccr", + "operation_deadline": "2026-10-16T14:28:23+00:00", + "operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153", + "operations": [ + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + ], + "source_bundle": { + "engine_dispatcher": { + "path": "/owner/engine_dispatcher.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "platform_mediator": { + "path": "/owner/platform_mediator.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "policy_auth": { + "path": "/owner/policy_auth.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "typed_ccr": { + "path": "/owner/typed_ccr.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + } + }, + "human_control": true, + "purpose": "metadata-test", + "service_actor_binding": { + "subject_id": "secrets-engine", + "subject_type": "service", + "tenant": "tenant:platform", + "transport_principal": "system:serviceaccount:secrets-engine:secrets-engine", + "version": "proposed-service-task-caller/v1" + } + }, + "resource": { + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + }, + "id": "catalog:test-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + }, + "subject": { + "id": "secrets-engine", + "tenant": "tenant:platform", + "type": "service" + }, + "tenant": "tenant:platform" +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r2/response.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r2/response.json new file mode 100644 index 00000000..5d917f1d --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r2/response.json @@ -0,0 +1,262 @@ +{ + "id": "decision:65b3e4594d0e3af8", + "contract_version": "flex-auth.decision-record.v1", + "effect": "allow", + "reason": "exact_task_execution_matched", + "matched_policy_version": "v2", + "matched_rule": "exact_task_execution_matched", + "resource": { + "id": "catalog:test-lane", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + } + }, + "subject": { + "id": "secrets-engine", + "type": "service", + "tenant": "tenant:platform" + }, + "binding": { + "tenant": "tenant:platform", + "subject": { + "id": "secrets-engine", + "type": "service", + "tenant": "tenant:platform" + }, + "action": "execute-ccr", + "resource": { + "id": "catalog:test-lane", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + } + }, + "context": { + "approval": { + "approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8", + "binding": { + "action": "execute-ccr", + "actor": "secrets-engine", + "digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2", + "human_control": true, + "pdp_digest": "sha256:7568d4dd53da932730b5e83bc03d821b612bb5ba4b53992940b08d805d03ea19", + "pdp_path": true, + "principal": "secrets-engine", + "purpose": "metadata-test", + "target": { + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + }, + "id": "catalog:test-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + } + }, + "consumed": false, + "freshness": { + "not_after": "2026-10-16T14:29:11+00:00", + "observed_at": "2026-10-16T14:28:11+00:00", + "ttl_seconds": 60 + }, + "issuer": "approval-engine", + "kind": "approval-claim", + "reason_code": "ok", + "schema_version": "0.1", + "state": "valid", + "valid_now": true, + "validity": { + "expires_at": "2026-10-16T14:31:11.162458+00:00", + "not_before": "2026-10-16T14:27:11.162458+00:00" + }, + "yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)" + }, + "catalog_target": { + "auth_capability": {}, + "consumers": [ + { + "auth": "approle", + "claim": "role:c", + "name": "c" + } + ], + "delivery_auth": { + "management": "engine", + "method": "approle" + }, + "delivery_config": {}, + "delivery_modes": [ + "exec-env" + ], + "fields": [ + "api_token" + ], + "kind": "kv", + "mount": "secret", + "mount_management": "engine", + "org": "coulomb", + "path": "test/team/thing", + "repo": "team-repo", + "workload_delivery": [] + }, + "execution_contract": { + "backend_budget": { + "ttl_seconds": 120, + "uses": 12 + }, + "backend_origin": "http://127.0.0.1:18200", + "catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f", + "ccr_id": "CCR-2099-0001", + "ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "cluster_uid": "test-estate-not-live", + "contract_version": "SECRETS-EXEC-20261011-v1", + "execution_actor": "service:secrets-engine", + "execution_grant_ccr_id": "CCR-2099-0002", + "expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "operation": "metadata-apply-ccr", + "operation_deadline": "2026-10-16T14:28:23+00:00", + "operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153", + "operations": [ + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + ], + "source_bundle": { + "engine_dispatcher": { + "path": "/owner/engine_dispatcher.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "platform_mediator": { + "path": "/owner/platform_mediator.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "policy_auth": { + "path": "/owner/policy_auth.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "typed_ccr": { + "path": "/owner/typed_ccr.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + } + }, + "human_control": true, + "purpose": "metadata-test", + "service_actor_binding": { + "subject_id": "secrets-engine", + "subject_type": "service", + "tenant": "tenant:platform", + "transport_principal": "system:serviceaccount:secrets-engine:secrets-engine", + "version": "proposed-service-task-caller/v1" + } + }, + "request_digest": "sha256:e47269c2c3458bb7c23fef40092e2bf5c084c705a13f72a1cbfeac0c6fbadc3e", + "approval_binding_digest": "sha256:7568d4dd53da932730b5e83bc03d821b612bb5ba4b53992940b08d805d03ea19", + "submitted_request_digest": "sha256:e47269c2c3458bb7c23fef40092e2bf5c084c705a13f72a1cbfeac0c6fbadc3e" + }, + "lifetime": { + "kind": "ttl", + "ttl": "15s", + "not_before": "2026-10-16T14:28:11Z", + "expires_at": "2026-10-16T14:28:23Z" + }, + "diagnostics": { + "action": "execute-ccr", + "matched_relationship": "", + "policy_package": "secrets-engine.task-execution.service-pilot", + "policy_status": "proposed", + "registry_overrode": [], + "registry_resource": false, + "registry_subject": false + }, + "provenance": { + "evaluator": "flex-auth/local", + "mode": "standalone", + "policy_package": "secrets-engine.task-execution.service-pilot", + "policy_version": "v2", + "policy_package_digest": "sha256:fc5a8769886b72006ba298bc0799741d0f1ed327dde9e36a6c35d26be4ea0bdc", + "registry_snapshot_digest": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "input_claim_digests": { + "context": "sha256:096701cc4eba7e263fa0f5ea3952215c5cc5058efc7100fa5496f8600ccd8628" + }, + "decision_time": "2026-10-16T14:28:11Z", + "approval_observation": { + "source_id": "synthetic-actual-approval-app", + "source_revision": "actual-owner-python-source-fixture", + "configuration_digest": "sha256:ab433ef1edc7ebfba886f8fb8884aee18216aa85785c8e92e7ef5ef8cae362c6", + "claim_digest": "sha256:db787ffa2d8b44c72455938af1fd086d5909167be5cc5c987252065a34d58381", + "native_binding_digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2", + "observed_at": "2026-10-16T14:28:11Z", + "not_after": "2026-10-16T14:29:11Z", + "validated_at": "2026-10-16T14:28:11.442090034Z" + }, + "caller": { + "mode": "enforce", + "principal": "system:serviceaccount:secrets-engine:secrets-engine", + "audience": "flex-auth", + "not_after": "2026-10-16T14:30:11Z" + } + }, + "signature": { + "mode": "signed", + "alg": "ed25519", + "kid": "synthetic-v2", + "value": "XjHoJQkkPktnYV41DqOaoRWxS9m0IP3NjGGTLHav6GG7fS7mDXjYfoNDxYdf-DgI6IeBPDMfKHvHVz7niWY3CA" + }, + "caring": { + "profile": "caring-0.4.0-rc2", + "conformance_findings": [ + { + "code": "CARING-DESCRIPTOR-MISSING", + "severity": "warning", + "message": "no CARING descriptor matched the request", + "fields": [ + "caring_context" + ] + } + ] + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r2/source-record.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r2/source-record.json new file mode 100644 index 00000000..5d917f1d --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r2/source-record.json @@ -0,0 +1,262 @@ +{ + "id": "decision:65b3e4594d0e3af8", + "contract_version": "flex-auth.decision-record.v1", + "effect": "allow", + "reason": "exact_task_execution_matched", + "matched_policy_version": "v2", + "matched_rule": "exact_task_execution_matched", + "resource": { + "id": "catalog:test-lane", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + } + }, + "subject": { + "id": "secrets-engine", + "type": "service", + "tenant": "tenant:platform" + }, + "binding": { + "tenant": "tenant:platform", + "subject": { + "id": "secrets-engine", + "type": "service", + "tenant": "tenant:platform" + }, + "action": "execute-ccr", + "resource": { + "id": "catalog:test-lane", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + } + }, + "context": { + "approval": { + "approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8", + "binding": { + "action": "execute-ccr", + "actor": "secrets-engine", + "digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2", + "human_control": true, + "pdp_digest": "sha256:7568d4dd53da932730b5e83bc03d821b612bb5ba4b53992940b08d805d03ea19", + "pdp_path": true, + "principal": "secrets-engine", + "purpose": "metadata-test", + "target": { + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + }, + "id": "catalog:test-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + } + }, + "consumed": false, + "freshness": { + "not_after": "2026-10-16T14:29:11+00:00", + "observed_at": "2026-10-16T14:28:11+00:00", + "ttl_seconds": 60 + }, + "issuer": "approval-engine", + "kind": "approval-claim", + "reason_code": "ok", + "schema_version": "0.1", + "state": "valid", + "valid_now": true, + "validity": { + "expires_at": "2026-10-16T14:31:11.162458+00:00", + "not_before": "2026-10-16T14:27:11.162458+00:00" + }, + "yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)" + }, + "catalog_target": { + "auth_capability": {}, + "consumers": [ + { + "auth": "approle", + "claim": "role:c", + "name": "c" + } + ], + "delivery_auth": { + "management": "engine", + "method": "approle" + }, + "delivery_config": {}, + "delivery_modes": [ + "exec-env" + ], + "fields": [ + "api_token" + ], + "kind": "kv", + "mount": "secret", + "mount_management": "engine", + "org": "coulomb", + "path": "test/team/thing", + "repo": "team-repo", + "workload_delivery": [] + }, + "execution_contract": { + "backend_budget": { + "ttl_seconds": 120, + "uses": 12 + }, + "backend_origin": "http://127.0.0.1:18200", + "catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f", + "ccr_id": "CCR-2099-0001", + "ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "cluster_uid": "test-estate-not-live", + "contract_version": "SECRETS-EXEC-20261011-v1", + "execution_actor": "service:secrets-engine", + "execution_grant_ccr_id": "CCR-2099-0002", + "expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "operation": "metadata-apply-ccr", + "operation_deadline": "2026-10-16T14:28:23+00:00", + "operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153", + "operations": [ + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + ], + "source_bundle": { + "engine_dispatcher": { + "path": "/owner/engine_dispatcher.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "platform_mediator": { + "path": "/owner/platform_mediator.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "policy_auth": { + "path": "/owner/policy_auth.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "typed_ccr": { + "path": "/owner/typed_ccr.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + } + }, + "human_control": true, + "purpose": "metadata-test", + "service_actor_binding": { + "subject_id": "secrets-engine", + "subject_type": "service", + "tenant": "tenant:platform", + "transport_principal": "system:serviceaccount:secrets-engine:secrets-engine", + "version": "proposed-service-task-caller/v1" + } + }, + "request_digest": "sha256:e47269c2c3458bb7c23fef40092e2bf5c084c705a13f72a1cbfeac0c6fbadc3e", + "approval_binding_digest": "sha256:7568d4dd53da932730b5e83bc03d821b612bb5ba4b53992940b08d805d03ea19", + "submitted_request_digest": "sha256:e47269c2c3458bb7c23fef40092e2bf5c084c705a13f72a1cbfeac0c6fbadc3e" + }, + "lifetime": { + "kind": "ttl", + "ttl": "15s", + "not_before": "2026-10-16T14:28:11Z", + "expires_at": "2026-10-16T14:28:23Z" + }, + "diagnostics": { + "action": "execute-ccr", + "matched_relationship": "", + "policy_package": "secrets-engine.task-execution.service-pilot", + "policy_status": "proposed", + "registry_overrode": [], + "registry_resource": false, + "registry_subject": false + }, + "provenance": { + "evaluator": "flex-auth/local", + "mode": "standalone", + "policy_package": "secrets-engine.task-execution.service-pilot", + "policy_version": "v2", + "policy_package_digest": "sha256:fc5a8769886b72006ba298bc0799741d0f1ed327dde9e36a6c35d26be4ea0bdc", + "registry_snapshot_digest": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "input_claim_digests": { + "context": "sha256:096701cc4eba7e263fa0f5ea3952215c5cc5058efc7100fa5496f8600ccd8628" + }, + "decision_time": "2026-10-16T14:28:11Z", + "approval_observation": { + "source_id": "synthetic-actual-approval-app", + "source_revision": "actual-owner-python-source-fixture", + "configuration_digest": "sha256:ab433ef1edc7ebfba886f8fb8884aee18216aa85785c8e92e7ef5ef8cae362c6", + "claim_digest": "sha256:db787ffa2d8b44c72455938af1fd086d5909167be5cc5c987252065a34d58381", + "native_binding_digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2", + "observed_at": "2026-10-16T14:28:11Z", + "not_after": "2026-10-16T14:29:11Z", + "validated_at": "2026-10-16T14:28:11.442090034Z" + }, + "caller": { + "mode": "enforce", + "principal": "system:serviceaccount:secrets-engine:secrets-engine", + "audience": "flex-auth", + "not_after": "2026-10-16T14:30:11Z" + } + }, + "signature": { + "mode": "signed", + "alg": "ed25519", + "kid": "synthetic-v2", + "value": "XjHoJQkkPktnYV41DqOaoRWxS9m0IP3NjGGTLHav6GG7fS7mDXjYfoNDxYdf-DgI6IeBPDMfKHvHVz7niWY3CA" + }, + "caring": { + "profile": "caring-0.4.0-rc2", + "conformance_findings": [ + { + "code": "CARING-DESCRIPTOR-MISSING", + "severity": "warning", + "message": "no CARING descriptor matched the request", + "fields": [ + "caring_context" + ] + } + ] + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r3/handoff.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r3/handoff.json new file mode 100644 index 00000000..a24feea5 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r3/handoff.json @@ -0,0 +1,98 @@ +{ + "approval_binding_digest": "sha256:628214785b65ab29635aa49c23fe44005dd9cf6a383dc2eb8a537a2b03812998", + "approval_expires_at": "2026-10-16T14:49:01.265708+00:00", + "approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8", + "decision_expires_at": "2026-10-16T14:47:01Z", + "decision_id": "decision:ad3121ba5791bf53", + "decision_not_before": "2026-10-16T14:46:01.504124217Z", + "execution_contract": { + "backend_budget": { + "ttl_seconds": 30, + "uses": 12 + }, + "backend_origin": "http://127.0.0.1:18200", + "catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f", + "ccr_id": "CCR-2099-0001", + "ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "cluster_uid": "test-estate-not-live", + "contract_version": "SECRETS-EXEC-20261011-v1", + "execution_actor": "service:secrets-engine", + "execution_grant_ccr_id": "CCR-2099-0002", + "expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "operation": "metadata-apply-ccr", + "operation_deadline": "2026-10-16T14:47:01+00:00", + "operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153", + "operations": [ + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + ], + "source_bundle": { + "engine_dispatcher": { + "path": "/owner/engine_dispatcher.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "platform_mediator": { + "path": "/owner/platform_mediator.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "policy_auth": { + "path": "/owner/policy_auth.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "typed_ccr": { + "path": "/owner/typed_ccr.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + } + }, + "native_binding": { + "action": "execute-ccr", + "actor": "secrets-engine", + "principal": "secrets-engine", + "purpose": "metadata-test", + "target": { + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + }, + "id": "catalog:test-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + } + }, + "request_digest": "sha256:14737221b7e4bd7e4d0b0ea4f3c5cdca77c1e5cf7696bebdce02d41a938b8c7a", + "submitted_request_digest": "sha256:14737221b7e4bd7e4d0b0ea4f3c5cdca77c1e5cf7696bebdce02d41a938b8c7a" +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r3/negative-cases.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r3/negative-cases.json new file mode 100644 index 00000000..aefd9ca2 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r3/negative-cases.json @@ -0,0 +1,8 @@ +{ + "missing-service-binding": true, + "changed-descriptor": true, + "changed-native-target": true, + "expired-original": true, + "tampered-signature": true, + "prepared-replay": true +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r3/original-approval-claim.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r3/original-approval-claim.json new file mode 100644 index 00000000..cf6d81e7 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r3/original-approval-claim.json @@ -0,0 +1,42 @@ +{ + "approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8", + "binding": { + "action": "execute-ccr", + "actor": "secrets-engine", + "digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2", + "human_control": true, + "pdp_digest": "sha256:628214785b65ab29635aa49c23fe44005dd9cf6a383dc2eb8a537a2b03812998", + "pdp_path": true, + "principal": "secrets-engine", + "purpose": "metadata-test", + "target": { + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + }, + "id": "catalog:test-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + } + }, + "consumed": false, + "freshness": { + "not_after": "2026-10-16T14:48:01+00:00", + "observed_at": "2026-10-16T14:46:01+00:00", + "ttl_seconds": 120 + }, + "issuer": "approval-engine", + "kind": "approval-claim", + "reason_code": "ok", + "schema_version": "0.1", + "state": "valid", + "valid_now": true, + "validity": { + "expires_at": "2026-10-16T14:49:01.265708+00:00", + "not_before": "2026-10-16T14:45:01.265708+00:00" + }, + "yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)" +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r3/receipt.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r3/receipt.json new file mode 100644 index 00000000..410a7a52 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r3/receipt.json @@ -0,0 +1,21 @@ +{ + "scope": "disposable synthetic only", + "actual_source": "Approval App over TLS with authenticated create, configured synthetic human entry, read; actual SQLite engine", + "actual_access": "production serve binary from frozen B2/B3 temporal R2", + "allow": true, + "original_context_unchanged": true, + "published_digest_match": true, + "returned_source_record_match": true, + "actual_source_consumed_refused": true, + "actual_strict_prepare_and_consume": true, + "no_record_after_refusal": true, + "native_admission": false, + "files_sha256": { + "negative-cases.json": "sha256:1bef572773c34f87a3c6587dbc60ebeb2835c01125f690e8d2f5b0d70a6abadd", + "source-record.json": "sha256:e7e9f7a0ecfc86c7cd449de7443f615e9ba19cecab1cf85f67ec03267e949e64", + "handoff.json": "sha256:ef9739fce5d6be84f0a9e5a593499d4289fcc8bda79573c7d21316a45310234a", + "response.json": "sha256:e7e9f7a0ecfc86c7cd449de7443f615e9ba19cecab1cf85f67ec03267e949e64", + "original-approval-claim.json": "sha256:9e62510e1599d9bc61b15ebb24099e48a6992b808451af4fb3ce26a4b3338f1e", + "request.json": "sha256:d65fb473885c9d6fbb089f5b7dcdcecb75cf31cf20e60a9158e562cb0eb3af4d" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r3/request.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r3/request.json new file mode 100644 index 00000000..2609b863 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r3/request.json @@ -0,0 +1,172 @@ +{ + "action": "execute-ccr", + "context": { + "approval": { + "approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8", + "binding": { + "action": "execute-ccr", + "actor": "secrets-engine", + "digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2", + "human_control": true, + "pdp_digest": "sha256:628214785b65ab29635aa49c23fe44005dd9cf6a383dc2eb8a537a2b03812998", + "pdp_path": true, + "principal": "secrets-engine", + "purpose": "metadata-test", + "target": { + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + }, + "id": "catalog:test-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + } + }, + "consumed": false, + "freshness": { + "not_after": "2026-10-16T14:48:01+00:00", + "observed_at": "2026-10-16T14:46:01+00:00", + "ttl_seconds": 120 + }, + "issuer": "approval-engine", + "kind": "approval-claim", + "reason_code": "ok", + "schema_version": "0.1", + "state": "valid", + "valid_now": true, + "validity": { + "expires_at": "2026-10-16T14:49:01.265708+00:00", + "not_before": "2026-10-16T14:45:01.265708+00:00" + }, + "yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)" + }, + "catalog_target": { + "auth_capability": {}, + "consumers": [ + { + "auth": "approle", + "claim": "role:c", + "name": "c" + } + ], + "delivery_auth": { + "management": "engine", + "method": "approle" + }, + "delivery_config": {}, + "delivery_modes": [ + "exec-env" + ], + "fields": [ + "api_token" + ], + "kind": "kv", + "mount": "secret", + "mount_management": "engine", + "org": "coulomb", + "path": "test/team/thing", + "repo": "team-repo", + "workload_delivery": [] + }, + "execution_contract": { + "backend_budget": { + "ttl_seconds": 30, + "uses": 12 + }, + "backend_origin": "http://127.0.0.1:18200", + "catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f", + "ccr_id": "CCR-2099-0001", + "ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "cluster_uid": "test-estate-not-live", + "contract_version": "SECRETS-EXEC-20261011-v1", + "execution_actor": "service:secrets-engine", + "execution_grant_ccr_id": "CCR-2099-0002", + "expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "operation": "metadata-apply-ccr", + "operation_deadline": "2026-10-16T14:47:01+00:00", + "operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153", + "operations": [ + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + ], + "source_bundle": { + "engine_dispatcher": { + "path": "/owner/engine_dispatcher.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "platform_mediator": { + "path": "/owner/platform_mediator.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "policy_auth": { + "path": "/owner/policy_auth.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "typed_ccr": { + "path": "/owner/typed_ccr.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + } + }, + "human_control": true, + "purpose": "metadata-test", + "service_actor_binding": { + "subject_id": "secrets-engine", + "subject_type": "service", + "tenant": "tenant:platform", + "transport_principal": "system:serviceaccount:secrets-engine:secrets-engine", + "version": "proposed-service-task-caller/v1" + } + }, + "resource": { + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + }, + "id": "catalog:test-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + }, + "subject": { + "id": "secrets-engine", + "tenant": "tenant:platform", + "type": "service" + }, + "tenant": "tenant:platform" +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r3/response.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r3/response.json new file mode 100644 index 00000000..fe422646 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r3/response.json @@ -0,0 +1,262 @@ +{ + "id": "decision:ad3121ba5791bf53", + "contract_version": "flex-auth.decision-record.v1", + "effect": "allow", + "reason": "exact_task_execution_matched", + "matched_policy_version": "v2", + "matched_rule": "exact_task_execution_matched", + "resource": { + "id": "catalog:test-lane", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + } + }, + "subject": { + "id": "secrets-engine", + "type": "service", + "tenant": "tenant:platform" + }, + "binding": { + "tenant": "tenant:platform", + "subject": { + "id": "secrets-engine", + "type": "service", + "tenant": "tenant:platform" + }, + "action": "execute-ccr", + "resource": { + "id": "catalog:test-lane", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + } + }, + "context": { + "approval": { + "approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8", + "binding": { + "action": "execute-ccr", + "actor": "secrets-engine", + "digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2", + "human_control": true, + "pdp_digest": "sha256:628214785b65ab29635aa49c23fe44005dd9cf6a383dc2eb8a537a2b03812998", + "pdp_path": true, + "principal": "secrets-engine", + "purpose": "metadata-test", + "target": { + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + }, + "id": "catalog:test-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + } + }, + "consumed": false, + "freshness": { + "not_after": "2026-10-16T14:48:01+00:00", + "observed_at": "2026-10-16T14:46:01+00:00", + "ttl_seconds": 120 + }, + "issuer": "approval-engine", + "kind": "approval-claim", + "reason_code": "ok", + "schema_version": "0.1", + "state": "valid", + "valid_now": true, + "validity": { + "expires_at": "2026-10-16T14:49:01.265708+00:00", + "not_before": "2026-10-16T14:45:01.265708+00:00" + }, + "yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)" + }, + "catalog_target": { + "auth_capability": {}, + "consumers": [ + { + "auth": "approle", + "claim": "role:c", + "name": "c" + } + ], + "delivery_auth": { + "management": "engine", + "method": "approle" + }, + "delivery_config": {}, + "delivery_modes": [ + "exec-env" + ], + "fields": [ + "api_token" + ], + "kind": "kv", + "mount": "secret", + "mount_management": "engine", + "org": "coulomb", + "path": "test/team/thing", + "repo": "team-repo", + "workload_delivery": [] + }, + "execution_contract": { + "backend_budget": { + "ttl_seconds": 30, + "uses": 12 + }, + "backend_origin": "http://127.0.0.1:18200", + "catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f", + "ccr_id": "CCR-2099-0001", + "ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "cluster_uid": "test-estate-not-live", + "contract_version": "SECRETS-EXEC-20261011-v1", + "execution_actor": "service:secrets-engine", + "execution_grant_ccr_id": "CCR-2099-0002", + "expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "operation": "metadata-apply-ccr", + "operation_deadline": "2026-10-16T14:47:01+00:00", + "operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153", + "operations": [ + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + ], + "source_bundle": { + "engine_dispatcher": { + "path": "/owner/engine_dispatcher.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "platform_mediator": { + "path": "/owner/platform_mediator.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "policy_auth": { + "path": "/owner/policy_auth.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "typed_ccr": { + "path": "/owner/typed_ccr.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + } + }, + "human_control": true, + "purpose": "metadata-test", + "service_actor_binding": { + "subject_id": "secrets-engine", + "subject_type": "service", + "tenant": "tenant:platform", + "transport_principal": "system:serviceaccount:secrets-engine:secrets-engine", + "version": "proposed-service-task-caller/v1" + } + }, + "request_digest": "sha256:14737221b7e4bd7e4d0b0ea4f3c5cdca77c1e5cf7696bebdce02d41a938b8c7a", + "approval_binding_digest": "sha256:628214785b65ab29635aa49c23fe44005dd9cf6a383dc2eb8a537a2b03812998", + "submitted_request_digest": "sha256:14737221b7e4bd7e4d0b0ea4f3c5cdca77c1e5cf7696bebdce02d41a938b8c7a" + }, + "lifetime": { + "kind": "ttl", + "ttl": "59.495875783s", + "not_before": "2026-10-16T14:46:01.504124217Z", + "expires_at": "2026-10-16T14:47:01Z" + }, + "diagnostics": { + "action": "execute-ccr", + "matched_relationship": "", + "policy_package": "secrets-engine.task-execution.service-pilot", + "policy_status": "proposed", + "registry_overrode": [], + "registry_resource": false, + "registry_subject": false + }, + "provenance": { + "evaluator": "flex-auth/local", + "mode": "standalone", + "policy_package": "secrets-engine.task-execution.service-pilot", + "policy_version": "v2", + "policy_package_digest": "sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d", + "registry_snapshot_digest": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "input_claim_digests": { + "context": "sha256:31feadf96c5282ca5963f1d4412c85daf6c892f058b10bbb92f73c7154967443" + }, + "decision_time": "2026-10-16T14:46:01Z", + "approval_observation": { + "source_id": "synthetic-actual-approval-app", + "source_revision": "actual-owner-python-source-fixture", + "configuration_digest": "sha256:cc14058ab8fccb20af522c8e81e1c910b189301ccba8f318035a3bc0e3d6151c", + "claim_digest": "sha256:250d0a45171435aa58ee79d68aadde8a5fc67100ea4aad920bd43022eba2288e", + "native_binding_digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2", + "observed_at": "2026-10-16T14:46:01Z", + "not_after": "2026-10-16T14:48:01Z", + "validated_at": "2026-10-16T14:46:01.489860006Z" + }, + "caller": { + "mode": "enforce", + "principal": "system:serviceaccount:secrets-engine:secrets-engine", + "audience": "flex-auth", + "not_after": "2026-10-16T14:48:01Z" + } + }, + "signature": { + "mode": "signed", + "alg": "ed25519", + "kid": "synthetic-v2", + "value": "V86xS5ODlLLZK466slLjn652QkqzsOXoNIesK2MOYo38bC_8UIPNZCOJTGCRbXeTpVzcGEXgOgGCuhRWvwErBg" + }, + "caring": { + "profile": "caring-0.4.0-rc2", + "conformance_findings": [ + { + "code": "CARING-DESCRIPTOR-MISSING", + "severity": "warning", + "message": "no CARING descriptor matched the request", + "fields": [ + "caring_context" + ] + } + ] + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r3/source-record.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r3/source-record.json new file mode 100644 index 00000000..fe422646 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-r3/source-record.json @@ -0,0 +1,262 @@ +{ + "id": "decision:ad3121ba5791bf53", + "contract_version": "flex-auth.decision-record.v1", + "effect": "allow", + "reason": "exact_task_execution_matched", + "matched_policy_version": "v2", + "matched_rule": "exact_task_execution_matched", + "resource": { + "id": "catalog:test-lane", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + } + }, + "subject": { + "id": "secrets-engine", + "type": "service", + "tenant": "tenant:platform" + }, + "binding": { + "tenant": "tenant:platform", + "subject": { + "id": "secrets-engine", + "type": "service", + "tenant": "tenant:platform" + }, + "action": "execute-ccr", + "resource": { + "id": "catalog:test-lane", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + } + }, + "context": { + "approval": { + "approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8", + "binding": { + "action": "execute-ccr", + "actor": "secrets-engine", + "digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2", + "human_control": true, + "pdp_digest": "sha256:628214785b65ab29635aa49c23fe44005dd9cf6a383dc2eb8a537a2b03812998", + "pdp_path": true, + "principal": "secrets-engine", + "purpose": "metadata-test", + "target": { + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + }, + "id": "catalog:test-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + } + }, + "consumed": false, + "freshness": { + "not_after": "2026-10-16T14:48:01+00:00", + "observed_at": "2026-10-16T14:46:01+00:00", + "ttl_seconds": 120 + }, + "issuer": "approval-engine", + "kind": "approval-claim", + "reason_code": "ok", + "schema_version": "0.1", + "state": "valid", + "valid_now": true, + "validity": { + "expires_at": "2026-10-16T14:49:01.265708+00:00", + "not_before": "2026-10-16T14:45:01.265708+00:00" + }, + "yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)" + }, + "catalog_target": { + "auth_capability": {}, + "consumers": [ + { + "auth": "approle", + "claim": "role:c", + "name": "c" + } + ], + "delivery_auth": { + "management": "engine", + "method": "approle" + }, + "delivery_config": {}, + "delivery_modes": [ + "exec-env" + ], + "fields": [ + "api_token" + ], + "kind": "kv", + "mount": "secret", + "mount_management": "engine", + "org": "coulomb", + "path": "test/team/thing", + "repo": "team-repo", + "workload_delivery": [] + }, + "execution_contract": { + "backend_budget": { + "ttl_seconds": 30, + "uses": 12 + }, + "backend_origin": "http://127.0.0.1:18200", + "catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f", + "ccr_id": "CCR-2099-0001", + "ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "cluster_uid": "test-estate-not-live", + "contract_version": "SECRETS-EXEC-20261011-v1", + "execution_actor": "service:secrets-engine", + "execution_grant_ccr_id": "CCR-2099-0002", + "expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "operation": "metadata-apply-ccr", + "operation_deadline": "2026-10-16T14:47:01+00:00", + "operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153", + "operations": [ + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + ], + "source_bundle": { + "engine_dispatcher": { + "path": "/owner/engine_dispatcher.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "platform_mediator": { + "path": "/owner/platform_mediator.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "policy_auth": { + "path": "/owner/policy_auth.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "typed_ccr": { + "path": "/owner/typed_ccr.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + } + }, + "human_control": true, + "purpose": "metadata-test", + "service_actor_binding": { + "subject_id": "secrets-engine", + "subject_type": "service", + "tenant": "tenant:platform", + "transport_principal": "system:serviceaccount:secrets-engine:secrets-engine", + "version": "proposed-service-task-caller/v1" + } + }, + "request_digest": "sha256:14737221b7e4bd7e4d0b0ea4f3c5cdca77c1e5cf7696bebdce02d41a938b8c7a", + "approval_binding_digest": "sha256:628214785b65ab29635aa49c23fe44005dd9cf6a383dc2eb8a537a2b03812998", + "submitted_request_digest": "sha256:14737221b7e4bd7e4d0b0ea4f3c5cdca77c1e5cf7696bebdce02d41a938b8c7a" + }, + "lifetime": { + "kind": "ttl", + "ttl": "59.495875783s", + "not_before": "2026-10-16T14:46:01.504124217Z", + "expires_at": "2026-10-16T14:47:01Z" + }, + "diagnostics": { + "action": "execute-ccr", + "matched_relationship": "", + "policy_package": "secrets-engine.task-execution.service-pilot", + "policy_status": "proposed", + "registry_overrode": [], + "registry_resource": false, + "registry_subject": false + }, + "provenance": { + "evaluator": "flex-auth/local", + "mode": "standalone", + "policy_package": "secrets-engine.task-execution.service-pilot", + "policy_version": "v2", + "policy_package_digest": "sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d", + "registry_snapshot_digest": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "input_claim_digests": { + "context": "sha256:31feadf96c5282ca5963f1d4412c85daf6c892f058b10bbb92f73c7154967443" + }, + "decision_time": "2026-10-16T14:46:01Z", + "approval_observation": { + "source_id": "synthetic-actual-approval-app", + "source_revision": "actual-owner-python-source-fixture", + "configuration_digest": "sha256:cc14058ab8fccb20af522c8e81e1c910b189301ccba8f318035a3bc0e3d6151c", + "claim_digest": "sha256:250d0a45171435aa58ee79d68aadde8a5fc67100ea4aad920bd43022eba2288e", + "native_binding_digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2", + "observed_at": "2026-10-16T14:46:01Z", + "not_after": "2026-10-16T14:48:01Z", + "validated_at": "2026-10-16T14:46:01.489860006Z" + }, + "caller": { + "mode": "enforce", + "principal": "system:serviceaccount:secrets-engine:secrets-engine", + "audience": "flex-auth", + "not_after": "2026-10-16T14:48:01Z" + } + }, + "signature": { + "mode": "signed", + "alg": "ed25519", + "kid": "synthetic-v2", + "value": "V86xS5ODlLLZK466slLjn652QkqzsOXoNIesK2MOYo38bC_8UIPNZCOJTGCRbXeTpVzcGEXgOgGCuhRWvwErBg" + }, + "caring": { + "profile": "caring-0.4.0-rc2", + "conformance_findings": [ + { + "code": "CARING-DESCRIPTOR-MISSING", + "severity": "warning", + "message": "no CARING descriptor matched the request", + "fields": [ + "caring_context" + ] + } + ] + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-source-smoke-r2.py b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-source-smoke-r2.py new file mode 100644 index 00000000..501f9dc5 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-source-smoke-r2.py @@ -0,0 +1,151 @@ +"""Disposable synthetic proof: actual Approval App HTTPS -> actual Access serve. +No native config, credential environment, approval or backend effect is used. +""" +import copy, base64, hashlib, http.server, io, json, os, pathlib, socket, ssl, subprocess, sys, tempfile, threading, time +from datetime import datetime, timedelta, timezone +from wsgiref.simple_server import make_server, WSGIRequestHandler +from cryptography import x509 +from cryptography.x509.oid import NameOID +from cryptography.hazmat.primitives import hashes, serialization +from cryptography.hazmat.primitives.asymmetric import rsa +sys.path.insert(0, '/home/worsch/approval-engine') +sys.path.insert(0, '/tmp/netkingdom-secrets-trusted-successor/src') +from approval_engine.api import App +from approval_engine.auth import Identity, StaticTokenAuthenticator +from approval_engine.store import Engine +from secrets_engine.authorization import request_digest, approval_binding_digest +from secrets_engine.approval_consume import _expected_request +from secrets_engine.approval_claim import binding_from_check_request +from secrets_engine.execution_contract import ExecutionContract +from secrets_engine.task_execution_handoff import authorize_task_execution,consume_task_execution +sys.path.insert(0,'/tmp/netkingdom-secrets-trusted-successor') +from tests.test_execution_context import entry,descriptor +from types import SimpleNamespace +from urllib.request import Request, urlopen +from urllib.error import HTTPError + +OUT=pathlib.Path(sys.argv[1]);OUT.mkdir(exist_ok=True) +def digest(raw):return 'sha256:'+hashlib.sha256(raw).hexdigest() +def write(path,raw,mode=0o600):path.write_bytes(raw);path.chmod(mode) +def identity(subject,kind,scopes):return Identity(subject=subject,issuer='synthetic-test-only',audiences=('approval-engine',),principal_type=kind,tenant='tenant:platform',roles=frozenset(),scopes=frozenset(scopes),assurance={'level':'synthetic'},evidence_ref='synthetic-test-only',tenant_source='directory') +class Quiet(WSGIRequestHandler): + def log_message(self,*args):pass +class Review(http.server.BaseHTTPRequestHandler): + def do_POST(self): + raw=self.rfile.read(int(self.headers['Content-Length']));body=json.loads(raw) + assert self.path=='/apis/authentication.k8s.io/v1/tokenreviews' + assert self.headers['Authorization']=='Bearer synthetic-reviewer' + assert body['spec']['audiences']==['flex-auth','access-engine'] + self.send_response(200);self.send_header('Content-Type','application/json');self.end_headers();self.wfile.write(json.dumps({'status':{'authenticated':True,'audiences':['flex-auth'],'user':{'username':'system:serviceaccount:secrets-engine:secrets-engine'}}}).encode()) + def log_message(self,*args):pass +with tempfile.TemporaryDirectory(prefix='access-actual-python-source-') as folder: + root=pathlib.Path(folder);now=datetime.now(timezone.utc) + key=rsa.generate_private_key(public_exponent=65537,key_size=2048);name=x509.Name([x509.NameAttribute(NameOID.COMMON_NAME,'localhost')]);cert=(x509.CertificateBuilder().subject_name(name).issuer_name(name).public_key(key.public_key()).serial_number(x509.random_serial_number()).not_valid_before(now-timedelta(minutes=1)).not_valid_after(now+timedelta(hours=1)).add_extension(x509.SubjectAlternativeName([x509.DNSName('localhost')]),critical=False).sign(key,hashes.SHA256())) + ca=root/'ca.pem';private=root/'tls-key.pem';write(ca,cert.public_bytes(serialization.Encoding.PEM));write(private,key.private_bytes(serialization.Encoding.PEM,serialization.PrivateFormat.PKCS8,serialization.NoEncryption())) + tls=ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER);tls.load_cert_chain(ca,private) + ctx=ssl.create_default_context(cafile=str(ca)) + def start(server):server.socket=tls.wrap_socket(server.socket,server_side=True);threading.Thread(target=server.serve_forever,daemon=True).start();return 'https://localhost:'+str(server.server_port) + review=http.server.HTTPServer(('127.0.0.1',0),Review);review_origin=start(review) + engine=Engine(root/'approval.sqlite3',freshness_ttl=60) + auth=StaticTokenAuthenticator({'synthetic-creator':identity('secrets-engine','service',{'approval:create'}),'synthetic-human':identity('synthetic-human','human',{'approval:approve'}),'synthetic-reader':identity('synthetic-access-reader','service',{'approval:read'}),'synthetic-consumer':identity('secrets-engine','service',{'approval:read','approval:consume'})}) + app=App(engine,auth) + source=make_server('127.0.0.1',0,app,handler_class=Quiet);origin=start(source) + consumer=make_server('127.0.0.1',0,app,handler_class=Quiet);threading.Thread(target=consumer.serve_forever,daemon=True).start() + def source_call(method,path,body,token): + request=Request(origin+path,data=json.dumps(body).encode() if body is not None else None,method=method,headers={'Authorization':'Bearer '+token,'Content-Type':'application/json'}) + with urlopen(request,context=ctx,timeout=3) as response:return response.status,json.load(response) + # Actual production builder, before issue: no caller approval enrichment. + aid='8bfc20be-47a4-4fb0-97a2-bf0a920afad8' + e=entry();d=descriptor(e) + d['operation_deadline']=(now+timedelta(seconds=12)).replace(microsecond=0).isoformat() + h='sha256:'+'a'*64 + d['operations']=[{'method':method,'path':path,'payload_sha256':h} for path in ['sys/policies/acl/synthetic','auth/synthetic/role/synthetic'] for method in ['GET','PUT','GET']] + contract=ExecutionContract.parse(d) + cfg=SimpleNamespace(authorization_subject_id='secrets-engine',authorization_subject_type='service',authorization_policy_package='secrets-engine.task-execution.service-pilot',authorization_policy_version='v2',approval_url='http://127.0.0.1:'+str(consumer.server_port)) + request=_expected_request(cfg,e,'execute-ccr',execution_contract=contract) + native=binding_from_check_request(request) + status,created=source_call('POST','/v1/approvals',{'id':aid,'binding':native,'validity':{'not_before':(now-timedelta(minutes=1)).isoformat(),'expires_at':(now+timedelta(minutes=3)).isoformat()},'required_count':1,'pdp_digest':approval_binding_digest(request),'pdp_path':True,'human_control':True},'synthetic-creator');assert status==201 + status,_=source_call('POST',f'/v1/approvals/{aid}/entries',{},'synthetic-human');assert status==200 + status,claim=source_call('GET',f'/v1/approvals/{aid}/claim',None,'synthetic-reader');assert status==200 and claim['valid_now'] is True and claim['binding']['human_control'] is True + request['context']['approval']=claim + seed=root/'seed';write(seed,base64.urlsafe_b64encode(bytes([19])*32).rstrip(b'='),0o440) + reviewer_token=root/'review-token';write(reviewer_token,b'synthetic-reviewer',0o440) + reader_token=root/'reader-token';write(reader_token,b'synthetic-reader',0o440) + registry=root/'registry.json';write(registry,b'{}') + config=root/'source.json';write(config,json.dumps({'source_id':'synthetic-actual-approval-app','source_revision':'actual-owner-python-source-fixture','origin':origin,'store_tenant':'tenant:platform','ca_file':str(ca),'token_file':str(reader_token)}).encode()) + listener=socket.socket();listener.bind(('127.0.0.1',0));port=listener.getsockname()[1];listener.close() + record=root/'record.jsonl';url=f'http://127.0.0.1:{port}' + command=['/tmp/netkingdom-access-trusted-r1','serve','--addr',f'127.0.0.1:{port}','--registry',str(registry),'--policy','/tmp/access-trusted-b2-b3/examples/secrets-engine-service-task-execution-v2/policy_package.md','--log',str(record),'--caller-auth-mode','enforce','--caller-audience','flex-auth','--caller-kubernetes-url',review_origin,'--caller-reviewer-token-file',str(reviewer_token),'--caller-ca-file',str(ca),'--caller-binding','secrets-engine=system:serviceaccount:secrets-engine:secrets-engine','--envelope-signing-key-file',str(seed),'--envelope-signing-kid','synthetic-v2','--approval-source-file',str(config)] + child=subprocess.Popen(command,env={},stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL) + try: + for _ in range(100): + try: + with urlopen(url+'/healthz',timeout=.2):break + except Exception:time.sleep(.02) + jwt='synthetic.'+base64.urlsafe_b64encode(json.dumps({'exp':int((now+timedelta(minutes=2)).timestamp())}).encode()).decode().rstrip('=')+'.synthetic' + def check(value): + req=Request(url+'/v1/check',data=json.dumps(value).encode(),headers={'Authorization':'Bearer '+jwt,'Content-Type':'application/json'}) + try: + with urlopen(req,timeout=5) as response:return response.status,response.read() + except HTTPError as error:return error.code,error.read() + from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey + public=Ed25519PrivateKey.from_private_bytes(bytes([19])*32).public_key().public_bytes(serialization.Encoding.Raw,serialization.PublicFormat.Raw) + trust={'schema':'secrets-engine.pdp-trust.v1','evaluator':'flex-auth/local','mode':'standalone','policy_package':cfg.authorization_policy_package,'policy_version':'v2','policy_package_digest':'sha256:fc5a8769886b72006ba298bc0799741d0f1ed327dde9e36a6c35d26be4ea0bdc','keys':{'synthetic-v2':base64.urlsafe_b64encode(public).decode().rstrip('=')}} + trustfile=root/'synthetic-trust.json';write(trustfile,json.dumps(trust).encode()) + pdptoken=root/'consumer-pdp-token';write(pdptoken,jwt.encode()) + approvaltoken=root/'consumer-approval-token';write(approvaltoken,b'synthetic-consumer') + cfg.pdp_url=url;cfg.pdp_token_file=pdptoken;cfg.approval_token_file=approvaltoken;cfg.pdp_trust_file=trustfile;cfg.pdp_verifier=pathlib.Path('/tmp/secrets-trusted-successor-verifier') + authorization=authorize_task_execution(cfg,e,execution_contract=contract) + handoff=authorization.as_owner_handoff() + artifacts=json.loads(authorization._action.artifacts) + request=artifacts['request'];claim=artifacts['claim'];raw=artifacts['authenticated_envelope_json'].encode() + assert handoff['native_binding']==native + assert handoff['execution_contract']==contract.as_dict() + assert handoff['request_digest']==request_digest(artifacts['envelope']['binding']) + assert handoff['submitted_request_digest']==request_digest(request) + response=json.loads(raw);assert response['effect']=='allow' and response['signature']['mode']=='signed' + assert response['binding']['context']==request['context'];assert response['binding']['submitted_request_digest']==request_digest(request);assert response['binding']['approval_binding_digest']==approval_binding_digest(request) + assert response['provenance']['approval_observation']['source_id']=='synthetic-actual-approval-app' + from secrets_engine.decision_signature import authenticate_response + from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey + public=Ed25519PrivateKey.from_private_bytes(bytes([19])*32).public_key().public_bytes(serialization.Encoding.Raw,serialization.PublicFormat.Raw) + trust={k:response['provenance'][k] for k in ('evaluator','mode','policy_package','policy_version','policy_package_digest')} + trust['keys']={'synthetic-v2':base64.urlsafe_b64encode(public).decode().rstrip('=')} + authenticated=authenticate_response(raw,trust=trust,verifier=pathlib.Path('/tmp/secrets-trusted-successor-verifier')) + assert authenticated['binding']['context']==request['context'] + assert authenticate_response(authenticated.authenticated_json.encode(),trust=trust,verifier=pathlib.Path('/tmp/secrets-trusted-successor-verifier'))==authenticated + saved=record.read_bytes();assert json.loads(saved)==response + from secrets_engine.errors import DecisionError + negative={} + for case in ['missing-service-binding','changed-descriptor','changed-native-target','expired-original']: + changed=copy.deepcopy(request) + if case=='missing-service-binding':del changed['context']['service_actor_binding'] + elif case=='changed-descriptor':changed['context']['execution_contract']['expected_after']='sha256:'+'b'*64 + elif case=='changed-native-target':changed['resource']['attributes']['synthetic_extra']=1.0 + else:changed['context']['approval']['freshness']['not_after']='2000-01-01T00:00:00Z' + refused_case,_=check(changed) + assert refused_case!=200 and record.read_bytes()==saved,case + negative[case]=True + tampered=raw.replace(b'"effect":"allow"',b'"effect":"deny"') + assert tampered!=raw + try:authenticate_response(tampered,trust=trust,verifier=cfg.pdp_verifier) + except DecisionError:negative['tampered-signature']=True + else:raise AssertionError('tampered envelope accepted') + consumption=consume_task_execution(cfg,authorization) + assert consumption.idempotent is False and consumption.request_digest==handoff['request_digest'] and consumption.decision_id==handoff['decision_id'] + from approval_engine.execution_confirmation import ExecutionConfirmationClient + confirmed=ExecutionConfirmationClient(cfg.approval_url,approvaltoken).confirm_consumption(aid,handoff['request_digest'],handoff['decision_id'],expected_binding=handoff['native_binding'],expected_pdp_digest=handoff['approval_binding_digest']) + assert confirmed['request_digest']==handoff['request_digest'] and confirmed['decision_id']==handoff['decision_id'] + try:consume_task_execution(cfg,authorization) + except DecisionError:negative['prepared-replay']=True + else:raise AssertionError('prepared replay accepted') + write(OUT/'negative-cases.json',(json.dumps(negative,indent=2)+'\n').encode(),0o644) + write(OUT/'handoff.json' ,(json.dumps(handoff,indent=2)+'\n').encode(),0o644) + # Consumed provider state cannot be rescued by the original carried claim. + + refused,_=check(request);assert refused!=200 and record.read_bytes()==saved + for name,value in [('request.json',request),('response.json',response),('source-record.json',json.loads(saved)),('original-approval-claim.json',claim)]:write(OUT/name,(json.dumps(value,indent=2)+'\n').encode(),0o644) + receipt={'scope':'disposable synthetic only','actual_source':'Approval App over TLS with authenticated create, configured synthetic human entry, read; actual SQLite engine','actual_access':'production serve binary from frozen B2/B3 R1','allow':True,'original_context_unchanged':True,'published_digest_match':True,'returned_source_record_match':True,'actual_source_consumed_refused':True,'actual_strict_prepare_and_consume':True,'no_record_after_refusal':True,'native_admission':False,'files_sha256':{p.name:digest(p.read_bytes()) for p in OUT.iterdir() if p.suffix=='.json'}} + write(OUT/'receipt.json',(json.dumps(receipt,indent=2)+'\n').encode(),0o644);print(json.dumps(receipt,indent=2)) + finally: + child.terminate();child.wait(timeout=5);source.shutdown();consumer.shutdown();review.shutdown();engine.close() diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-source-smoke-r3.py b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-source-smoke-r3.py new file mode 100644 index 00000000..2eb0b3eb --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-source-smoke-r3.py @@ -0,0 +1,161 @@ +"""Disposable synthetic proof: actual Approval App HTTPS -> actual Access serve. +No native config, credential environment, approval or backend effect is used. +""" +import copy, base64, hashlib, http.server, io, json, os, pathlib, socket, ssl, subprocess, sys, tempfile, threading, time +from datetime import datetime, timedelta, timezone +from wsgiref.simple_server import make_server, WSGIRequestHandler +from cryptography import x509 +from cryptography.x509.oid import NameOID +from cryptography.hazmat.primitives import hashes, serialization +from cryptography.hazmat.primitives.asymmetric import rsa +sys.path.insert(0, '/home/worsch/approval-engine') +sys.path.insert(0, '/tmp/netkingdom-secrets-trusted-successor/src') +from approval_engine.api import App +from approval_engine.auth import Identity, StaticTokenAuthenticator +from approval_engine.store import Engine +from secrets_engine.authorization import request_digest, approval_binding_digest +from secrets_engine.approval_consume import _expected_request +from secrets_engine.approval_claim import binding_from_check_request +from secrets_engine.execution_contract import ExecutionContract +from secrets_engine.task_execution_handoff import authorize_task_execution,consume_task_execution +sys.path.insert(0,'/tmp/netkingdom-secrets-trusted-successor') +from tests.test_execution_context import entry,descriptor +from types import SimpleNamespace +from urllib.request import Request, urlopen +from urllib.error import HTTPError + +OUT=pathlib.Path(sys.argv[1]);OUT.mkdir(exist_ok=True) +def digest(raw):return 'sha256:'+hashlib.sha256(raw).hexdigest() +def write(path,raw,mode=0o600):path.write_bytes(raw);path.chmod(mode) +def identity(subject,kind,scopes):return Identity(subject=subject,issuer='synthetic-test-only',audiences=('approval-engine',),principal_type=kind,tenant='tenant:platform',roles=frozenset(),scopes=frozenset(scopes),assurance={'level':'synthetic'},evidence_ref='synthetic-test-only',tenant_source='directory') +class Quiet(WSGIRequestHandler): + def log_message(self,*args):pass +class Review(http.server.BaseHTTPRequestHandler): + def do_POST(self): + raw=self.rfile.read(int(self.headers['Content-Length']));body=json.loads(raw) + assert self.path=='/apis/authentication.k8s.io/v1/tokenreviews' + assert self.headers['Authorization']=='Bearer synthetic-reviewer' + assert body['spec']['audiences']==['flex-auth','access-engine'] + self.send_response(200);self.send_header('Content-Type','application/json');self.end_headers();self.wfile.write(json.dumps({'status':{'authenticated':True,'audiences':['flex-auth'],'user':{'username':'system:serviceaccount:secrets-engine:secrets-engine'}}}).encode()) + def log_message(self,*args):pass +with tempfile.TemporaryDirectory(prefix='access-actual-python-source-') as folder: + root=pathlib.Path(folder);now=datetime.now(timezone.utc) + key=rsa.generate_private_key(public_exponent=65537,key_size=2048);name=x509.Name([x509.NameAttribute(NameOID.COMMON_NAME,'localhost')]);cert=(x509.CertificateBuilder().subject_name(name).issuer_name(name).public_key(key.public_key()).serial_number(x509.random_serial_number()).not_valid_before(now-timedelta(minutes=1)).not_valid_after(now+timedelta(hours=1)).add_extension(x509.SubjectAlternativeName([x509.DNSName('localhost')]),critical=False).sign(key,hashes.SHA256())) + ca=root/'ca.pem';private=root/'tls-key.pem';write(ca,cert.public_bytes(serialization.Encoding.PEM));write(private,key.private_bytes(serialization.Encoding.PEM,serialization.PrivateFormat.PKCS8,serialization.NoEncryption())) + tls=ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER);tls.load_cert_chain(ca,private) + ctx=ssl.create_default_context(cafile=str(ca)) + def start(server):server.socket=tls.wrap_socket(server.socket,server_side=True);threading.Thread(target=server.serve_forever,daemon=True).start();return 'https://localhost:'+str(server.server_port) + review=http.server.HTTPServer(('127.0.0.1',0),Review);review_origin=start(review) + engine=Engine(root/'approval.sqlite3',freshness_ttl=120) + auth=StaticTokenAuthenticator({'synthetic-creator':identity('secrets-engine','service',{'approval:create'}),'synthetic-human':identity('synthetic-human','human',{'approval:approve'}),'synthetic-reader':identity('synthetic-access-reader','service',{'approval:read'}),'synthetic-consumer':identity('secrets-engine','service',{'approval:read','approval:consume'})}) + app=App(engine,auth) + source=make_server('127.0.0.1',0,app,handler_class=Quiet);origin=start(source) + consumer=make_server('127.0.0.1',0,app,handler_class=Quiet);threading.Thread(target=consumer.serve_forever,daemon=True).start() + def source_call(method,path,body,token): + request=Request(origin+path,data=json.dumps(body).encode() if body is not None else None,method=method,headers={'Authorization':'Bearer '+token,'Content-Type':'application/json'}) + with urlopen(request,context=ctx,timeout=3) as response:return response.status,json.load(response) + # Actual production builder, before issue: no caller approval enrichment. + aid='8bfc20be-47a4-4fb0-97a2-bf0a920afad8' + e=entry();d=descriptor(e) + d['operation_deadline']=(now+timedelta(seconds=60)).replace(microsecond=0).isoformat() + h='sha256:'+'a'*64 + d['backend_budget']={'ttl_seconds':30,'uses':12} + d['operations']=[{'method':method,'path':path,'payload_sha256':h} for path in ['sys/policies/acl/synthetic','auth/synthetic/role/synthetic'] for method in ['GET','PUT','GET']] + contract=ExecutionContract.parse(d) + cfg=SimpleNamespace(authorization_subject_id='secrets-engine',authorization_subject_type='service',authorization_policy_package='secrets-engine.task-execution.service-pilot',authorization_policy_version='v2',approval_url='http://127.0.0.1:'+str(consumer.server_port)) + request=_expected_request(cfg,e,'execute-ccr',execution_contract=contract) + native=binding_from_check_request(request) + status,created=source_call('POST','/v1/approvals',{'id':aid,'binding':native,'validity':{'not_before':(now-timedelta(minutes=1)).isoformat(),'expires_at':(now+timedelta(minutes=3)).isoformat()},'required_count':1,'pdp_digest':approval_binding_digest(request),'pdp_path':True,'human_control':True},'synthetic-creator');assert status==201 + status,_=source_call('POST',f'/v1/approvals/{aid}/entries',{},'synthetic-human');assert status==200 + status,claim=source_call('GET',f'/v1/approvals/{aid}/claim',None,'synthetic-reader');assert status==200 and claim['valid_now'] is True and claim['binding']['human_control'] is True + request['context']['approval']=claim + seed=root/'seed';write(seed,base64.urlsafe_b64encode(bytes([19])*32).rstrip(b'='),0o440) + reviewer_token=root/'review-token';write(reviewer_token,b'synthetic-reviewer',0o440) + reader_token=root/'reader-token';write(reader_token,b'synthetic-reader',0o440) + registry=root/'registry.json';write(registry,b'{}') + config=root/'source.json';write(config,json.dumps({'source_id':'synthetic-actual-approval-app','source_revision':'actual-owner-python-source-fixture','origin':origin,'store_tenant':'tenant:platform','ca_file':str(ca),'token_file':str(reader_token)}).encode()) + listener=socket.socket();listener.bind(('127.0.0.1',0));port=listener.getsockname()[1];listener.close() + record=root/'record.jsonl';url=f'http://127.0.0.1:{port}' + command=['/tmp/netkingdom-access-trusted-r2','serve','--addr',f'127.0.0.1:{port}','--registry',str(registry),'--policy','/tmp/access-trusted-b2-b3-r2/examples/secrets-engine-service-task-execution-v2/policy_package.md','--log',str(record),'--caller-auth-mode','enforce','--caller-audience','flex-auth','--caller-kubernetes-url',review_origin,'--caller-reviewer-token-file',str(reviewer_token),'--caller-ca-file',str(ca),'--caller-binding','secrets-engine=system:serviceaccount:secrets-engine:secrets-engine','--envelope-signing-key-file',str(seed),'--envelope-signing-kid','synthetic-v2','--approval-source-file',str(config)] + child=subprocess.Popen(command,env={},stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL) + try: + for _ in range(100): + try: + with urlopen(url+'/healthz',timeout=.2):break + except Exception:time.sleep(.02) + jwt='synthetic.'+base64.urlsafe_b64encode(json.dumps({'exp':int((now+timedelta(minutes=2)).timestamp())}).encode()).decode().rstrip('=')+'.synthetic' + def check(value): + req=Request(url+'/v1/check',data=json.dumps(value).encode(),headers={'Authorization':'Bearer '+jwt,'Content-Type':'application/json'}) + try: + with urlopen(req,timeout=5) as response:return response.status,response.read() + except HTTPError as error:return error.code,error.read() + from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey + public=Ed25519PrivateKey.from_private_bytes(bytes([19])*32).public_key().public_bytes(serialization.Encoding.Raw,serialization.PublicFormat.Raw) + trust={'schema':'secrets-engine.pdp-trust.v1','evaluator':'flex-auth/local','mode':'standalone','policy_package':cfg.authorization_policy_package,'policy_version':'v2','policy_package_digest':'sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d','keys':{'synthetic-v2':base64.urlsafe_b64encode(public).decode().rstrip('=')}} + trustfile=root/'synthetic-trust.json';write(trustfile,json.dumps(trust).encode()) + pdptoken=root/'consumer-pdp-token';write(pdptoken,jwt.encode()) + approvaltoken=root/'consumer-approval-token';write(approvaltoken,b'synthetic-consumer') + cfg.pdp_url=url;cfg.pdp_token_file=pdptoken;cfg.approval_token_file=approvaltoken;cfg.pdp_trust_file=trustfile;cfg.pdp_verifier=pathlib.Path('/tmp/secrets-trusted-successor-verifier') + authorization=authorize_task_execution(cfg,e,execution_contract=contract) + handoff=authorization.as_owner_handoff() + artifacts=json.loads(authorization._action.artifacts) + request=artifacts['request'];claim=artifacts['claim'];raw=artifacts['authenticated_envelope_json'].encode() + assert handoff['native_binding']==native + assert handoff['execution_contract']==contract.as_dict() + assert datetime.fromisoformat(handoff['decision_expires_at'].replace('Z','+00:00'))==datetime.fromisoformat(contract.as_dict()['operation_deadline']) + assert handoff['execution_contract']['backend_budget']=={'ttl_seconds':30,'uses':12} + assert handoff['request_digest']==request_digest(artifacts['envelope']['binding']) + assert handoff['submitted_request_digest']==request_digest(request) + response=json.loads(raw);assert response['effect']=='allow' and response['signature']['mode']=='signed' + assert response['binding']['context']==request['context'];assert response['binding']['submitted_request_digest']==request_digest(request);assert response['binding']['approval_binding_digest']==approval_binding_digest(request) + assert response['provenance']['approval_observation']['source_id']=='synthetic-actual-approval-app' + from secrets_engine.decision_signature import authenticate_response + from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey + public=Ed25519PrivateKey.from_private_bytes(bytes([19])*32).public_key().public_bytes(serialization.Encoding.Raw,serialization.PublicFormat.Raw) + trust={k:response['provenance'][k] for k in ('evaluator','mode','policy_package','policy_version','policy_package_digest')} + trust['keys']={'synthetic-v2':base64.urlsafe_b64encode(public).decode().rstrip('=')} + authenticated=authenticate_response(raw,trust=trust,verifier=pathlib.Path('/tmp/secrets-trusted-successor-verifier')) + assert authenticated['binding']['context']==request['context'] + assert authenticate_response(authenticated.authenticated_json.encode(),trust=trust,verifier=pathlib.Path('/tmp/secrets-trusted-successor-verifier'))==authenticated + saved=record.read_bytes();assert json.loads(saved)==response + from secrets_engine.errors import DecisionError + negative={} + for case in ['missing-service-binding','changed-descriptor','changed-native-target','expired-original']: + changed=copy.deepcopy(request) + if case=='missing-service-binding':del changed['context']['service_actor_binding'] + elif case=='changed-descriptor':changed['context']['execution_contract']['expected_after']='sha256:'+'b'*64 + elif case=='changed-native-target':changed['resource']['attributes']['synthetic_extra']=1.0 + else:changed['context']['approval']['freshness']['not_after']='2000-01-01T00:00:00Z' + refused_case,_=check(changed) + assert refused_case!=200 and record.read_bytes()==saved,case + negative[case]=True + tampered=raw.replace(b'"effect":"allow"',b'"effect":"deny"') + assert tampered!=raw + try:authenticate_response(tampered,trust=trust,verifier=cfg.pdp_verifier) + except DecisionError:negative['tampered-signature']=True + else:raise AssertionError('tampered envelope accepted') + # Real elapsed time, no injected clock or consumer waiver: provider receipts + # use whole seconds, so this proof sequences CAS after the signed start's + # next whole second. Fast-CAS precision mismatch remains separately reported. + signed_start=datetime.fromisoformat(handoff['decision_not_before'].replace('Z','+00:00')) + earliest_receipt=signed_start.replace(microsecond=0)+timedelta(seconds=1) + delay=(earliest_receipt-datetime.now(timezone.utc)).total_seconds() + if delay>0:time.sleep(delay) + consumption=consume_task_execution(cfg,authorization) + assert consumption.idempotent is False and consumption.request_digest==handoff['request_digest'] and consumption.decision_id==handoff['decision_id'] + from approval_engine.execution_confirmation import ExecutionConfirmationClient + confirmed=ExecutionConfirmationClient(cfg.approval_url,approvaltoken).confirm_consumption(aid,handoff['request_digest'],handoff['decision_id'],expected_binding=handoff['native_binding'],expected_pdp_digest=handoff['approval_binding_digest']) + assert confirmed['request_digest']==handoff['request_digest'] and confirmed['decision_id']==handoff['decision_id'] + try:consume_task_execution(cfg,authorization) + except DecisionError:negative['prepared-replay']=True + else:raise AssertionError('prepared replay accepted') + write(OUT/'negative-cases.json',(json.dumps(negative,indent=2)+'\n').encode(),0o644) + write(OUT/'handoff.json' ,(json.dumps(handoff,indent=2)+'\n').encode(),0o644) + # Consumed provider state cannot be rescued by the original carried claim. + + refused,_=check(request);assert refused!=200 and record.read_bytes()==saved + for name,value in [('request.json',request),('response.json',response),('source-record.json',json.loads(saved)),('original-approval-claim.json',claim)]:write(OUT/name,(json.dumps(value,indent=2)+'\n').encode(),0o644) + receipt={'scope':'disposable synthetic only','actual_source':'Approval App over TLS with authenticated create, configured synthetic human entry, read; actual SQLite engine','actual_access':'production serve binary from frozen B2/B3 temporal R2','allow':True,'original_context_unchanged':True,'published_digest_match':True,'returned_source_record_match':True,'actual_source_consumed_refused':True,'actual_strict_prepare_and_consume':True,'no_record_after_refusal':True,'native_admission':False,'files_sha256':{p.name:digest(p.read_bytes()) for p in OUT.iterdir() if p.suffix=='.json'}} + write(OUT/'receipt.json',(json.dumps(receipt,indent=2)+'\n').encode(),0o644);print(json.dumps(receipt,indent=2)) + finally: + child.terminate();child.wait(timeout=5);source.shutdown();consumer.shutdown();review.shutdown();engine.close() diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-test-r2.txt b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-test-r2.txt new file mode 100644 index 00000000..307fcc79 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-test-r2.txt @@ -0,0 +1,22 @@ +{ + "scope": "disposable synthetic only", + "actual_source": "Approval App over TLS with authenticated create, configured synthetic human entry, read; actual SQLite engine", + "actual_access": "production serve binary from frozen B2/B3 R1", + "allow": true, + "original_context_unchanged": true, + "published_digest_match": true, + "returned_source_record_match": true, + "actual_source_consumed_refused": true, + "actual_strict_prepare_and_consume": true, + "no_record_after_refusal": true, + "native_admission": false, + "files_sha256": { + "negative-cases.json": "sha256:1bef572773c34f87a3c6587dbc60ebeb2835c01125f690e8d2f5b0d70a6abadd", + "receipt.json": "sha256:ef67d3235ac36e01f03c6b49e73f106f4fb328e954d71a6cfd84e1d8baac3b28", + "source-record.json": "sha256:3d85490777303e032ce371ec0e7de514ea8b5825ad9b9437e7ff06414551e7bd", + "handoff.json": "sha256:6156a5378ddfdd583ccafde75063165ead5e8df8c7114c94c3c4e44d637d813f", + "response.json": "sha256:3d85490777303e032ce371ec0e7de514ea8b5825ad9b9437e7ff06414551e7bd", + "original-approval-claim.json": "sha256:ecb921ebc1d836ab2a8fff9ec185011cdaf28f7c9341778107cae4605fc5f0e2", + "request.json": "sha256:c4d9c5fe344185a7361b605db0df9b9018cae03a2b54818fad33b8a131c67aa5" + } +}