diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-adapters-1.2-review/coordinator-review-r5.json b/docs/changes/netkingdom-target-2026-10-17/nk48-adapters-1.2-review/coordinator-review-r5.json new file mode 100644 index 00000000..064c67d8 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-adapters-1.2-review/coordinator-review-r5.json @@ -0,0 +1,469 @@ +{ + "schema": "custodian.nk48-adapter-set-source-review.v1", + "revision": "r5", + "reviewed_on": "2026-10-17", + "reviewer": "custodian coordinator (Codex; independent new session, no participation in authoring or earlier review sessions; frozen source inspected through git archives; no author consultation)", + "scope": "Complete README-r5 independent source review: all five changed adapters, the re-frozen proposed 1.3 type and canon, both regenerated artifacts, owner-required changes and replacement admission-test coverage. Kernel/catalog implementation review remains in the separate warden-1.3-kernel-review request.", + "overall_verdict": "rejected", + "frozen_target": { + "repository": "net-kingdom", + "commit": "001a38ca2aa85155ce4840c4da22aca6e2346171", + "r4_target": "1920b134e2b577e74aaac6b59db5fd785f505a3d", + "kernel": "ops-warden 117fec9241e7b985dfb187b992e173d0a5dc3700 (archived src; contract/test dependency, not kernel acceptance)", + "source_handling": "Full net-kingdom archives for r5 and r4, plus frozen Warden src, extracted under /tmp. Owner working trees were not used as review inputs or edited." + }, + "hashes_verified": { + "sso-mfa/k8s/keycape/keycape-registration-adapter.py": "sha256:a53beea4dbbe373ce7a5b84d55e79be8407ab9688037c7ee057afcc7be576047", + "sso-mfa/k8s/keycape/ensure-groups-adapter.py": "sha256:6cba5b07a9262a8e0bf445dc4095ba03b31ddc15e2efbfe374e93f4f78b6aed4", + "sso-mfa/k8s/keycape/bind-env-adapter.py": "sha256:fa17fae21776b5c620ee9782adf050649c3a28719a6687d2524ff67ca7ad1925", + "sso-mfa/k8s/keycape/deliver-consumer-secret-adapter.py": "sha256:65db5386cdf08a1aa932886c046abed20330a36c96e63d4267adb8341b23da42", + "sso-mfa/k8s/keycape/handover-adapter.py": "sha256:bad7c1132258f2140b0d83548031ac86eecea4f4019f34adedc1e9e3774a3832", + "security-case-type-revisions/1.3/oidc-browser-relying-party/type.yaml": "sha256:e75fe94110ef9fb7fb18072fe2856941b33507c99cb406d36576046481485d0a", + "canon/standards/security-case-types_v0.1.md": "sha256:db2de5108c0f911648e223e6fdba4fb530471250c539b35865e1e0726e3240c4", + "sso-mfa/k8s/keycape/descriptor-composition-1.3.candidate.json": "sha256:773daa1df72cc7cf6a6d8aa082208181ca2438cdecc9179b1bc5b1c3a09099c2", + "sso-mfa/k8s/keycape/descriptor-composition-1.2.candidate.json": "sha256:5f68a101132eb3a7532c16535109f693c6a66a80817a8084a5464abde44990c6", + "sso-mfa/k8s/keycape/test_admit_1_3_type.py": "sha256:f4f6a35cfbada462c939fe357e51fa5d03efc9d20c17a511f224c1359ca0faa5", + "sso-mfa/k8s/keycape/test_compose_1_2_descriptors.py": "sha256:9a4b9fb0141221d6e5bcb72b3656613afda54d16ede300bffa8f71956ae6fd2c", + "sso-mfa/k8s/keycape/mint-secret-adapter.py": "sha256:246323c7243ded18229ab063956577e151d56d9be485d3bd44fc38e5af0edf3c", + "sso-mfa/k8s/keycape/deliver-secret-adapter.py": "sha256:cd1a515a1ae2def2093660ed2a810a9c66d1d4cf7126f573ee7e9c4c42afb98d", + "sso-mfa/k8s/keycape/compose-1.2-descriptors.py": "sha256:39021cac900b11a59d00c5a1d5491b1ee4c639955cde07d07854c3db8bc04958", + "sso-mfa/k8s/keycape/keycape-client.py": "sha256:4b63161cf3365d34dd684a3116e2c935baaf7f6aa4b30983f6883546db3d6591", + "sso-mfa/k8s/keycape/portal-client-rollout.py": "sha256:158e1d36eb881cdd0a2eda91b472adea5e8fde5061e00d26dda368580aeb871f", + "sso-mfa/k8s/keycape/openbao-client-config.py": "sha256:1b908b4c36134212d78f9fbe7a2a201eb3ced06d31bb1dcea4a59d80689d84b1", + "sso-mfa/k8s/keycape/register-user-engine-portal.py": "sha256:67173edc44f5457e7b6a3e0fb2321b398159cfce5dea8ead01eabf835fb38d76" + }, + "hashes_match": true, + "unchanged_files_byte_identical_to_r4": { + "result": true, + "files": [ + "mint-secret-adapter.py", + "deliver-secret-adapter.py", + "compose-1.2-descriptors.py", + "keycape-client.py", + "portal-client-rollout.py", + "openbao-client-config.py", + "register-user-engine-portal.py" + ], + "canonical_and_1_2_and_provisioner": "git diff 1920b13 001a38c has no change under security-case-types/, security-case-type-revisions/1.2/ or identity-provisioner/." + }, + "independent_reconstruction_passed": 129, + "independent_reconstruction_subtests_passed": 115, + "package_tests_passed": { + "1.3": 22 + }, + "reconstruction": { + "type_validator": "OK oidc-browser-relying-party@1.3 (proposed)", + "package_command": "NET_KINGDOM_ROOT=/net-kingdom python3 -m pytest -q -p no:cacheprovider security-case-type-revisions/1.3/oidc-browser-relying-party/tests", + "adapter_command": "PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=/ow/src /home/worsch/ops-warden/.venv/bin/python -m pytest -q -p no:cacheprovider test_*adapter*.py test_registration_original_intent_reconcile.py test_compose_1_2_descriptors.py test_admit_1_3_type.py test_adapter_source_closure.py", + "results": "Matches reported 22 package tests and 129 tests / 115 subtests. Test pass does not clear F1-F3.", + "additional_reviewer_probes": { + "malformed_observation_reports_refused_before_record_or_publish_with_session_revoked": 37, + "observation_digest_independently_reconstructed": true, + "agent_descriptor_original_map": "refused at map lookup", + "agent_descriptor_fixture_map": "refused at agent mint guard", + "admission_guard_mutation": "8 tests / 31 subtests still pass with only the admission mint guard removed in a separate scratch kernel; reviewer fixture-map agent descriptor then admitted", + "public_example_handover": "success and receipt-only rollback reproduced using 1.3 public example parameters; inverse gap F3" + } + }, + "owner_requirement_assessment": { + "OW-1.3-C1": { + "result": "implemented in source candidate", + "evidence": "register-client, ensure-groups and bind-env all declare keycape-attended-case-change in descriptors and type; all three remain human and attended. Catalog creation/activation is separate." + }, + "NK-1.3-C1": { + "result": "implemented subject to F2/F3 owner-path contract gaps", + "evidence": "All seven step entries name the reviewed adapters and dispatch paths; the three NetKingdom entries state human attended authority, lane and per-attempt revocation. Parameters untouched." + }, + "NK-1.3-C2": { + "result": "implemented", + "evidence": "Canon section 3 adds map admission independent of warden_executes, human attended authority, parent-session revocation, owner delegation and no owner credential custody; caller-proxy meaning retained." + }, + "RPF-1.3-C1": { + "result": "incomplete", + "finding": "NK48-R5-F2", + "evidence": "Lane, human aal2 owner delivery path, mode false/false, value_handling none and Ready check are present; exact ESO store is not named." + }, + "RPF-1.3-C2": { + "result": "implemented", + "evidence": "mint-secret explicitly says a human net-kingdom-admins aal2 caller starts the unattended broker operation; true/false and generated_in_custody retained." + }, + "RAPPS-1.3-C1": { + "result": "implemented", + "evidence": "deliver-consumer-secret descriptor actor is human; type marks both Apps steps attended in one consumer-owner session." + }, + "RAPPS-1.3-C2": { + "result": "implemented", + "evidence": "Closed report and exactly four unique {probe,evidence} records with IDENTIFIER evidence; existing booleans/groups/client checks retained; canonicalized observations included in digest. 37 additional malformed cases refused and revoked." + }, + "RAPPS-1.3-C3": { + "result": "literal requested text implemented, combined inverse incomplete", + "finding": "NK48-R5-F3", + "evidence": "Both lanes and human attended modes present; consumer Helm configuration precedes verification; hand-over removes only receipt; Helm removal assigned to owner_remove, leaving skipped/NO_CHANGE delivery paths uncovered." + }, + "KC-1.3-C1": { + "result": "implemented", + "evidence": "register-client attended_justification names checker sha256:be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5 and key-cape 3c71226, matching the owner record and composed checker pin. No checker rebuild or native custody proof claimed." + }, + "KERNEL-1": { + "result": "test dependency advanced as requested; independent kernel review separate", + "evidence": "All requested adapter/admission/original-intent tests executed against archived 117fec9 src. Does not clear KERNEL-2/3, catalog, pin or native gates." + } + }, + "check_2_type_diff": { + "result": "confirmed within the requested structural boundary; findings F2/F3 concern completeness of the allowed text changes", + "evidence": [ + "Direct 1.2 versus 1.3 structural diff changes only spec.version, status, execution_descriptors, follow_through fields (including the owner-requested Apps attended flags/justifications) and rollback[hand-over].action. Composition, materialization, verification, acceptance and other rollback entries are unchanged.", + "Raw parameters block bytes are identical between 1.2 and 1.3; independently computed parameter fingerprint is c04385d176f5f70257fb0fa6fef7e48ab26ed7cf26f6b1c7f14b16237b0ebea6, equal to frozen Warden 1.2 pin. Canonical 1.1 and 1.2 revision bytes remain unchanged." + ] + }, + "check_3_lanes_and_modes": { + "result": "confirmed", + "steps": [ + { + "step": "ensure-groups", + "descriptor": { + "actor": "human", + "adapter": "net-kingdom/ensure-groups@v1", + "adapter_source": "sha256:f93e68e1932c7ca293c9e69e2d0e1843d58d06a8d4892158fe7d1e0393a21ba0", + "allowed_created": [ + "service-group", + "service-group-membership" + ], + "effect": "change", + "lane": "keycape-attended-case-change", + "owner": "net-kingdom", + "retry_safe": false, + "revocation_scopes": [ + "parent-session" + ], + "step": "ensure-groups", + "target_parameter": "client_id", + "version": "warden.case.execution.v1" + }, + "type_lane": "keycape-attended-case-change" + }, + { + "step": "mint-secret", + "descriptor": { + "actor": "human", + "adapter": "net-kingdom/keycape-mint-secret@v1", + "adapter_source": "sha256:34f79944204a2cf5b2a22baecbee4bde77cbdc0e3f9fc87bc98fa12a9c2c0bc1", + "allowed_created": [ + "custody-secret-version" + ], + "effect": "mint", + "lane": "keycape-client-secret-generate", + "owner": "railiance-platform", + "retry_safe": false, + "revocation_scopes": [ + "parent-session", + "broker-grant" + ], + "step": "mint-secret", + "target_parameter": "client_id", + "version": "warden.case.execution.v1" + }, + "type_lane": "keycape-client-secret-generate" + }, + { + "step": "deliver-secret", + "descriptor": { + "actor": "human", + "adapter": "net-kingdom/deliver-secret@v1", + "adapter_source": "sha256:df609bb93ebdfffb12cde213381a77eb7ac82670f814ff73623c1d98262cc90e", + "allowed_created": [ + "delivered-secret" + ], + "effect": "change", + "lane": "platform-secret-delivery", + "owner": "railiance-platform", + "retry_safe": false, + "revocation_scopes": [ + "parent-session" + ], + "step": "deliver-secret", + "target_parameter": "client_id", + "version": "warden.case.execution.v1" + }, + "type_lane": "platform-secret-delivery" + }, + { + "step": "bind-env", + "descriptor": { + "actor": "human", + "adapter": "net-kingdom/keycape-bind-env@v1", + "adapter_source": "sha256:dcd43f5ce1c4e829e1198faffc6bfb9cc610509f5176658f42c133accc0a7305", + "allowed_created": [ + "keycape-env-binding" + ], + "effect": "change", + "lane": "keycape-attended-case-change", + "owner": "net-kingdom", + "retry_safe": false, + "revocation_scopes": [ + "parent-session" + ], + "step": "bind-env", + "target_parameter": "client_id", + "version": "warden.case.execution.v1" + }, + "type_lane": "keycape-attended-case-change" + }, + { + "step": "register-client", + "descriptor": { + "actor": "human", + "adapter": "net-kingdom/keycape-registration@v1", + "adapter_source": "sha256:b30f7abfbb5bf439c5ce067325b01c8b711076a38a6fb8484f55d5c8912921f3", + "allowed_created": [ + "keycape-client" + ], + "effect": "change", + "lane": "keycape-attended-case-change", + "owner": "net-kingdom", + "retry_safe": false, + "revocation_scopes": [ + "parent-session" + ], + "step": "register-client", + "target_parameter": "client_id", + "version": "warden.case.execution.v1" + }, + "type_lane": "keycape-attended-case-change" + }, + { + "step": "deliver-consumer-secret", + "descriptor": { + "actor": "human", + "adapter": "net-kingdom/deliver-consumer-secret@v1", + "adapter_source": "sha256:66f16dcb665216d09ef63a5ca654283a0292005ba4fb4d79c27eeb54b886a385", + "allowed_created": [ + "consumer-eso-sa", + "consumer-secretstore", + "consumer-externalsecret" + ], + "effect": "change", + "lane": "consumer-owner-deployment", + "owner": "railiance-apps", + "retry_safe": false, + "revocation_scopes": [ + "parent-session" + ], + "step": "deliver-consumer-secret", + "target_parameter": "client_id", + "version": "warden.case.execution.v1" + }, + "type_lane": "consumer-owner-deployment" + }, + { + "step": "hand-over", + "descriptor": { + "actor": "human", + "adapter": "net-kingdom/apps-handover@v1", + "adapter_source": "sha256:4439305b3edcd5d51c73e6438744d8895d69c1ccb58854aac79bb489d868cf48", + "allowed_created": [ + "handover-receipt" + ], + "effect": "change", + "lane": "apps-consumer-handover", + "owner": "railiance-apps", + "retry_safe": false, + "revocation_scopes": [ + "parent-session" + ], + "step": "hand-over", + "target_parameter": "client_id", + "version": "warden.case.execution.v1" + }, + "type_lane": "apps-consumer-handover" + } + ], + "mode_summary": "All descriptors human. mint-secret: warden_executes true / attended false; deliver-secret: false / false; ensure-groups, bind-env, register-client, deliver-consumer-secret and hand-over: false / true. Every descriptor step now has an explicit matching lane. These are declarations, not proof of enforcement by 117fec9." + }, + "check_4_composer_and_artifacts": { + "result": "confirmed", + "evidence": [ + "Fresh CLI regeneration with each committed artifact's checker digest and consumer_owner_repo is byte-identical to that artifact. Explicit 1.3 exits 0; explicit 1.2 exits 2 with a refusal artifact.", + "1.3 execution_descriptors equals the live composed seven descriptors and the map in the frozen type. 1.2 execution_descriptors is null, complete_executable_descriptor_set false, and per-step findings identify exactly ensure-groups, bind-env and register-client lane mismatches. The top-level refusal is the first mismatch (ensure-groups), as compose is fail-fast; review enumerates all three.", + "Composer itself is byte-identical to r4; partial, duplicate, unknown step, mismatched step/owner/lane, invalid descriptor, changed canonical digest and invalid explicit roots all remain covered by reproduced tests." + ] + }, + "check_5_observations": { + "result": "confirmed", + "evidence": "_observations accepts only a list of length four, exact record keys, known string probe names, bounded IDENTIFIER strings and a set of probes equal to all four expected names. Duplicate/unknown/missing/extra probes and value-bearing keys refuse. Records are sorted by probe before constructing the complete report digest. Independent malformed probes refused without recording/publishing and revoked their attempt sessions; independent digest equals the record_handover argument and the published observation field. Changing evidence changes the digest; input order does not." + }, + "check_6_removed_test_coverage": { + "result": "rejected", + "finding": "NK48-R5-F1", + "retained": "Committed map equality, seven-descriptor fixture admission, caller actor mismatch and wrong caller lane refusals. Proposed/unpinned-type refusals and out-of-map descriptor mutations are also present.", + "dropped": "Independent agent-actor mint descriptor prohibition after acknowledging the changed descriptor in the fixture map. The new map blocks that descriptor before the guard." + }, + "check_7_r1_checks_1_through_8": { + "1_source_binding": { + "result": "confirmed with carried import-time limit", + "evidence": "Registration and bind-env bind their four executed local helpers; ensure-groups binds provisioner and both provenance modules; the Apps adapters bind their own source. All five changed sources are in regenerated descriptor digests. Source-closure tests and per-attempt drift refusal pass; registration additionally snapshots and verifies the sealed checker artifact before helper tooling." + }, + "2_value_free": { + "result": "confirmed for these injection contracts", + "evidence": "Consumer delivery validates a closed receipt and fixed metadata; hand-over validates the closed report and bounded observation references and publishes only a digest/receipt id. Registration projects helper readback to metadata; bind-env publishes env name/revisions; ensure-groups publishes journal names/ids. Capability output is contained. No real credential or secret was supplied in this review. Owner evidence authenticity and honest capability implementations remain mandatory native gates." + }, + "3_created_only_rollback": { + "result": "adapter guards confirmed; type inverse rejected at F3", + "evidence": "Registration/bind-env require this process's authenticated creation plus unchanged post-creation revision; delivery removes only authenticated created UIDs in reverse dependency order; hand-over removes only its authenticated created receipt; ensure-groups delegates to owner journal provenance. Existing objects return NO_CHANGE and are not given new removal authority. F3 does not justify weakening these guards." + }, + "4_revocation": { + "result": "confirmed", + "evidence": "All five execute paths revoke in finally, including failed attempts and rollback; registration reconcile revokes its separate attempt. Missing revocation evidence prevents success publication. This proves capability invocation and receipt binding in fixtures, not actual native revocation." + }, + "5_pins_and_invocation": { + "result": "confirmed at adapter boundary; admission evidence gap F1", + "evidence": "Source, case and descriptor pins, target, exact admitted invocation and separate attempt operation/id are checked. Registration/bind-env/hand-over verify their separately supplied acceptance token against its pin. Delivery/ensure-groups have no separate acceptance argument and rely on their already-admitted Invocation pins. Fixed NetKingdom owner/lane and case-derived consumer-owner checks remain. Wrong lane/actor/owner/target tests reproduce." + }, + "6_version_selection": { + "result": "confirmed with existing owner-accepted selection limits", + "evidence": "Canonical 1.1 default root is unchanged. ensure-groups and hand-over default to 1.1 and require explicit matching 1.2/1.3 roots. Delivery accepts exactly case types 1.2/1.3. Registration/bind-env select through the helper case parser and kernel case/type pin; they have no new adapter version-root switch. There is no newly enabled allow-unimplemented path; bind-env explicitly refuses it." + }, + "7_original_intent": { + "result": "confirmed against 117fec9 fixtures; independent kernel review remains separate", + "evidence": "Registration source differs from r4 only in its descriptor lane. Reproduced restart/lost-receipt tests show separate original/reconcile attempts, owner-authenticated holder/readback, no replay, no post-restart rollback authority, and uncertainty on missing/ambiguous/wrong/changed evidence. Warden local intent is not treated as owner creation proof." + }, + "8_composition": { + "result": "confirmed", + "evidence": "See check_4: complete seven-step 1.3 map, exact three 1.2 lane refusals, fresh byte-identical artifacts and negative composition fixtures." + } + }, + "artifact_assessment": { + "descriptor-composition-1.2.candidate.json": { + "fresh_regeneration_equal": true, + "complete_executable_descriptor_set": false, + "expected_exit_code": 2, + "refused_steps": [ + "ensure-groups", + "bind-env", + "register-client" + ], + "admitted": false, + "dispatch_permitted": false, + "owner_review": false + }, + "descriptor-composition-1.3.candidate.json": { + "fresh_regeneration_equal": true, + "complete_executable_descriptor_set": true, + "expected_exit_code": 0, + "map_equals_type": true, + "admitted": false, + "dispatch_permitted": false, + "owner_review": false + } + }, + "verdicts": { + "keycape-registration-adapter.py": { + "verdict": "approved", + "checks": "Only descriptor lane changes since r4. Source closure, checker snapshot, created-only undo and original-intent reconciliation tests reproduce against 117fec9; no helper/provenance change." + }, + "ensure-groups-adapter.py": { + "verdict": "approved", + "checks": "Only descriptor lane changes since r4. Provenance journal, binding parity, per-attempt source check and finally revocation retained. Deferred public group-binding API was not folded into this revision." + }, + "bind-env-adapter.py": { + "verdict": "approved", + "checks": "Only descriptor lane changes since r4. Reference-only env/CAS, no-change preservation, authenticated creation and post-creation revision checks retained." + }, + "deliver-consumer-secret-adapter.py": { + "verdict": "approved", + "checks": "Only actor changes agent to human. Closed metadata/UID receipt, owner case binding and created-only rollback retained. Its legitimate refusal of no-creation rollback exposes the type-level gap F3." + }, + "handover-adapter.py": { + "verdict": "approved", + "checks": "Four exact bounded observations are required and hashed. Existing boolean/client/group and creation/authentication/revocation boundaries retained. Receipt-only inverse matches its owner contract; whole consumer Helm inverse is a separate type defect F3." + }, + "security-case-type-revisions/1.3/oidc-browser-relying-party/type.yaml": { + "verdict": "rejected", + "findings": [ + "NK48-R5-F2", + "NK48-R5-F3" + ], + "checks": "Parameter and version/mode/map checks pass, but Platform store requirement and reachable consumer rollback are incomplete." + }, + "canon/standards/security-case-types_v0.1.md": { + "verdict": "approved (source wording)", + "checks": "NK-1.3-C2 dispatch/authority clarification implemented. The wording does not grant admission or prove runtime enforcement." + }, + "descriptor-composition-1.2.candidate.json": { + "verdict": "approved (expected refusal artifact)", + "checks": "Byte-identical refusal with exactly three lane mismatches; not an executable map." + }, + "descriptor-composition-1.3.candidate.json": { + "verdict": "approved (composition evidence only)", + "checks": "Byte-identical seven-step candidate matching type map; no admission/dispatch grant. Type remains rejected at F2/F3." + }, + "test_admit_1_3_type.py": { + "verdict": "rejected (evidence coverage)", + "finding": "NK48-R5-F1" + }, + "test_compose_1_2_descriptors.py": { + "verdict": "approved (evidence)", + "checks": "Updated expectations correctly require 1.2 refusal and seven-step 1.3 candidate; reproduced." + }, + "mint-secret-adapter.py, deliver-secret-adapter.py, compose-1.2-descriptors.py": { + "verdict": "unchanged from r4; no new source rejection", + "checks": "Byte comparison verified. Used in full reconstruction and fresh artifact regeneration." + } + }, + "findings": [ + { + "id": "NK48-R5-F1", + "severity": "medium", + "target": "sso-mfa/k8s/keycape/test_admit_1_3_type.py:133", + "verdict": "rejected", + "requirement": "README-r5 check 6: removal of test_admit_1_2_adapter_descriptors.py must retain its unique checks, especially an agent-actor descriptor reaching the mint guard.", + "finding": "The replacement tests cover a human mint descriptor with caller actor agent, but omit the old test of replace(mint, actor=\"agent\") under a fixture type map that acknowledges that changed descriptor. An agent descriptor tested against the unmodified 1.3 map is refused at map lookup before the kernel mint guard. That proves map integrity, not the independent prohibition on agent mint.", + "independent_evidence": [ + "The old test_mint_secret_admits_only_a_human_actor includes both changed descriptor and changed caller branches; the new test at lines 133-139 contains only the changed caller branch.", + "Against frozen kernel 117fec9, the reviewer agent descriptor is refused with \"type has no exact acknowledged machine descriptor; plan only\" under the committed map. With only its fixture map entry updated to that descriptor digest, it reaches \"agent mint is forbidden\".", + "In a separate scratch copy of 117fec9, removing only the admission mint guard leaves all 8 tests and 31 subtests in test_admit_1_3_type.py passing. The reviewer probe with the fixture map updated then ADMITs the agent descriptor. Neither owner repository was modified." + ], + "required_follow_up": "Retain the committed-map refusal test and restore a separate fixture-map test admitting the agent-actor descriptor far enough to assert the mint prohibition. Also exercise a human descriptor with WARDEN_AGENT_ID set without having the helper clear it. Re-review the evidence at a new revision; no fix made here." + }, + { + "id": "NK48-R5-F2", + "severity": "medium", + "target": "security-case-type-revisions/1.3/oidc-browser-relying-party/type.yaml:270", + "verdict": "rejected", + "requirement": "RPF-1.3-C1 explicitly says: \"Name the ESO store in entry_point.\"", + "finding": "deliver-secret names an ExternalSecret and the OpenBao role external-secrets-keycape-{client_id}, but calls its store only \"the ESO store for role ...\". A role is not a SecretStore/ClusterSecretStore reference. The frozen type supplies no store name or store template for this issuer-side delivery, so this owner requirement is incomplete.", + "independent_evidence": [ + "Read the Platform owner review required_changes_to_1_3_candidate entry RPF-1.3-C1 and the deliver-secret implementation obligations: Platform must ensure the store is the fixed one for that client/role; the adapter cannot inspect that spec.", + "Type lines 270-273 give only \"through the ESO store for role external-secrets-keycape-{client_id}\". The materialization eso-role entry describes the Kubernetes-auth role; it does not define an ESO store. The separately named openbao-keycape-{client_id}-consumer store belongs to deliver-consumer-secret and does not supply this issuer-side reference." + ], + "required_follow_up": "Have Platform provide the exact fixed ESO store kind/name (and namespace where applicable), or an explicit owner-controlled template/reference, and put it in the issuer-side entry_point as requested. Do not invent the owner store during coordinator review." + }, + { + "id": "NK48-R5-F3", + "severity": "medium", + "target": "security-case-type-revisions/1.3/oidc-browser-relying-party/type.yaml:432", + "verdict": "rejected", + "requirement": "r1 check 3 and canon section 3: describe the inverse of the consumer configuration while preserving created-only removal; RAPPS-1.3-C3 assigns the Helm inverse to owner_remove.", + "finding": "The new rollback text assigns removal of the consumer OIDC source exclusively to deliver-consumer-secret.owner_remove. That callback cannot run for public clients (delivery is confidential-only), or for confidential deliveries where every object was preexisting-matched (NO_CHANGE records no created authority). hand-over still applies, and its rollback removes only its receipt. Thus the type has no reachable owner Helm inverse for these supported paths. This is a defect in the combined type contract, although the text implements Apps' requested relocation literally and the hand-over adapter correctly limits itself to its own receipt.", + "independent_evidence": [ + "The committed example-public-portal.yaml declares a public client with access_groups and a consumer owner. hand-over has no when condition, while deliver-consumer-secret at line 327 and its rollback at line 438 are conditional on confidential.", + "Reviewer synthetic execution using the public example parameters and version_root=\"1.3\" produced verified-success followed by verified-rolled-back in hand-over; only the receipt was removed. No applicable deliver-consumer-secret step exists to carry the promised Helm inverse. This is a local fixture, not a native result.", + "deliver-consumer-secret-adapter.py:155 refuses rollback before owner_remove when there is no authenticated created set. Lines 181-182 store rollback authority only when apply created objects. The passing test_no_change_has_nothing_to_roll_back confirms that preexisting-matched resources cannot be used to call owner_remove." + ], + "required_follow_up": "Agree an explicit consumer-owner Helm inverse that remains reachable when delivery is skipped or NO_CHANGE, with its own provenance for configuration changed by the case. Preserve preexisting resources and keep hand-over receipt rollback scoped to the receipt. Add public and preexisting-delivery rollback evidence in the successor review; do not weaken created-only guards." + } + ], + "observations_not_findings": [ + "Five owner reviews were read for their own requirements and carried limits. Owner capability binding, checker publication/custody, quiet-window procedure, ESO support/RBAC, broker revision acceptance and actual evidence trust remain owner/native work; this review does not turn their absence into newly authorized implementation.", + "117fec9 still does not supply the separately required catalog lane/mode admission enforcement or a 1.3 parameter pin. The fixtures use arbitrary catalog bytes, fixture trust, a status-reserialized acknowledged type and a memory-only pin. Seven fixture admissions therefore do not prove KERNEL-2/3, catalog acceptance, acknowledgment or native authority.", + "Import-time helper loading versus build/per-attempt drift checks, import-only source closure evidence, case/type version binding for adapters without explicit roots, stand-in owner capabilities and uncertain effects after revocation failure remain the documented owner-accepted limits. No claim of real credential isolation or safe replay is added.", + "The observation references are syntactically bounded owner evidence identifiers. These adapters do not independently authenticate each referenced probe; the real verifier and evidence store must bind the observations to this case and actual probes. Injection fixtures establish the contract, not actual logins.", + "README-r5 corrects the extraction-directory requirement; the package ran under a directory named net-kingdom. No -I/PYTHONPATH combination was used.", + "No workplan file or task status was changed by this bounded review, so no workplan reconciliation or sync was needed." + ], + "canonical_integration": "No canonical type, 1.2 acknowledgment, 1.3 status/pin, catalog or execution authority changed. Proposed 1.3 remains unacknowledged.", + "native_acceptance": false, + "grants": "none", + "hard_limits_observed": "Source-only review and synthetic local reconstruction. No kubectl, SSH, OpenBao, credential retrieval, real owner tool/capability, live/native owner action, owner-repo edit or grant. Only the requested coordinator-review-r5.json is written in the Custodian working tree; scratch exports and reviewer probes are under /tmp. Routine State Hub orientation/progress metadata is separate from native security execution.", + "remaining": "Resolve F1-F3 in owner source/evidence as a new frozen revision and commission another independent review; no fixes made here. Finish the separate kernel/catalog review and owner follow-through, re-freeze owner reviews on the final type/descriptors/kernel/catalog, obtain the exact Decision Memo/founder acknowledgment, add the owner-controlled 1.3 pin only in the required order, then perform separately authorized native acceptance. This review completes the requested source assessment and rejects the set; it grants none of those next actions." +}