diff --git a/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-10-local-scan.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-10-local-scan.stderr.txt new file mode 100644 index 00000000..e69de29b diff --git a/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-10-push.json b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-10-push.json new file mode 100644 index 00000000..69c6de29 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-10-push.json @@ -0,0 +1,30 @@ +{ + "batch": 10, + "commit": "30e41c948e7c5f29cf770ac63d50043a615171d9", + "previous_remote": "285e5900091ee2f940b8fea5755aeddf78492b4f", + "paths": [ + "docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/workplan.preimage.md", + "docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/owner-source-state.json", + "docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/prepare.py", + "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/candidate.patch", + "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/candidate/src/warden/case_run.py", + "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/candidate/src/warden/case_type.py", + "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/candidate/src/warden/routing/models.py", + "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/candidate/tests/test_case_1_3_integration.py", + "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/candidate/tests/test_case_admission_modes.py", + "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/candidate/tests/test_case_attended_boundary.py", + "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/evidence/run.py", + "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/evidence/sitecustomize.py", + "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/implementation-r1.json", + "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/test-isolation-proposal.patch", + "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review-r2/integration_runner.py", + "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review-r2/kernel-review-r2.json", + "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review-r2/reviewer-probes.py", + "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review-r2/run-baseline.py", + "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review-r2/run.py", + "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review-r2/setup.py" + ], + "exit_code": 0, + "stdout": "", + "stderr": "remote: {\"status\":\"clean\",\"scope\":\"introduced-reachable-git-objects-and-updated-ref-names\",\"scanned_objects\":35,\"scanned_refs\":1,\"scanner_version\":\"8.30.1\"} \nTo forgejo-remote:coulomb/the-custodian.git\n 285e590..30e41c9 HEAD -> main\n" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-11-commit.json b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-11-commit.json new file mode 100644 index 00000000..3e931862 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-11-commit.json @@ -0,0 +1,5 @@ +{ + "exit_code": 0, + "stdout": "[detached HEAD df5765e] Record reviewed case source evidence (11/13)\n 20 files changed, 1552 insertions(+)\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review-r2/sitecustomize.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/commit.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/consistency-preimage.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/consistency.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/consistency.stderr.txt\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/focused-tests.txt\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/integrate.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/integration.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/normal-sync.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/normal-sync.stderr.txt\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/publish.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/verification.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/workplan.preimage.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/commit.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/consistency.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/consistency.stderr.txt\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/full-unit-result.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/integrate.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/integration.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/prepare_publication.py\n", + "stderr": "" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-11-local-scan.json b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-11-local-scan.json new file mode 100644 index 00000000..f7b1298d --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-11-local-scan.json @@ -0,0 +1 @@ +{"blocked_blob_ids": [], "scanned_blobs": 18, "scanner_sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509", "scanner_version": "8.30.1", "scope": "changed-staged-blobs", "status": "clean"} diff --git a/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-11-local-scan.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-11-local-scan.stderr.txt new file mode 100644 index 00000000..e69de29b diff --git a/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-11-push.json b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-11-push.json new file mode 100644 index 00000000..caa74e1d --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-11-push.json @@ -0,0 +1,30 @@ +{ + "batch": 11, + "commit": "df5765e0e18a2daa66cc1c684b6b88af6202e9fe", + "previous_remote": "30e41c948e7c5f29cf770ac63d50043a615171d9", + "paths": [ + "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review-r2/sitecustomize.py", + "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/commit.json", + "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/consistency-preimage.json", + "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/consistency.json", + "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/consistency.stderr.txt", + "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/focused-tests.txt", + "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/integrate.py", + "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/integration.json", + "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/normal-sync.json", + "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/normal-sync.stderr.txt", + "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/publish.py", + "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/verification.json", + "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/workplan.preimage.md", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/commit.json", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/consistency.json", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/consistency.stderr.txt", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/full-unit-result.json", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/integrate.py", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/integration.json", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/prepare_publication.py" + ], + "exit_code": 0, + "stdout": "", + "stderr": "remote: {\"status\":\"clean\",\"scope\":\"introduced-reachable-git-objects-and-updated-ref-names\",\"scanned_objects\":25,\"scanned_refs\":1,\"scanner_version\":\"8.30.1\"} \nTo forgejo-remote:coulomb/the-custodian.git\n 30e41c9..df5765e HEAD -> main\n" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-12-commit.json b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-12-commit.json new file mode 100644 index 00000000..7b845dd5 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-12-commit.json @@ -0,0 +1,5 @@ +{ + "exit_code": 0, + "stdout": "[detached HEAD e9dc1a0] Record reviewed case source evidence (12/13)\n 20 files changed, 2477 insertions(+)\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/projection.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/projection.stderr.txt\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/publication-commit.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/publication-inputs.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/root-disposition.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/README.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate.patch\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/Makefile\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/docs/development/safe-unit-tests.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/scripts/run_unit_tests.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/fixtures/workload-coverage/provenance.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/fixtures/workload-coverage/rapp-core-hub/declarations/rapp.yaml\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/fixtures/workload-coverage/rapp-issue-core/declarations/rapp.yaml\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/fixtures/workload-coverage/rapp-qonto/declarations/rapp.yaml\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/test_case_plan.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/test_case_type.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/test_layer_conformance.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/test_safe_unit_runner.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/test_workload_join.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/unit_isolation_probe.py\n", + "stderr": "" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-12-local-scan.json b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-12-local-scan.json new file mode 100644 index 00000000..75e5ec13 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-12-local-scan.json @@ -0,0 +1 @@ +{"blocked_blob_ids": [], "scanned_blobs": 20, "scanner_sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509", "scanner_version": "8.30.1", "scope": "changed-staged-blobs", "status": "clean"} diff --git a/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-12-local-scan.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-12-local-scan.stderr.txt new file mode 100644 index 00000000..e69de29b diff --git a/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-12-push.json b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-12-push.json new file mode 100644 index 00000000..23c1ecbe --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-12-push.json @@ -0,0 +1,30 @@ +{ + "batch": 12, + "commit": "e9dc1a0f90d07eb592c1f7b644d881c61c53c63e", + "previous_remote": "df5765e0e18a2daa66cc1c684b6b88af6202e9fe", + "paths": [ + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/projection.json", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/projection.stderr.txt", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/publication-commit.json", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/publication-inputs.json", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/root-disposition.json", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/README.md", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate.patch", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/Makefile", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/docs/development/safe-unit-tests.md", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/scripts/run_unit_tests.py", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/fixtures/workload-coverage/provenance.json", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/fixtures/workload-coverage/rapp-core-hub/declarations/rapp.yaml", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/fixtures/workload-coverage/rapp-issue-core/declarations/rapp.yaml", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/fixtures/workload-coverage/rapp-qonto/declarations/rapp.yaml", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/test_case_plan.py", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/test_case_type.py", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/test_layer_conformance.py", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/test_safe_unit_runner.py", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/test_workload_join.py", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/unit_isolation_probe.py" + ], + "exit_code": 0, + "stdout": "", + "stderr": "remote: {\"status\":\"clean\",\"scope\":\"introduced-reachable-git-objects-and-updated-ref-names\",\"scanned_objects\":39,\"scanned_refs\":1,\"scanner_version\":\"8.30.1\"} \nTo forgejo-remote:coulomb/the-custodian.git\n df5765e..e9dc1a0 HEAD -> main\n" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-13-commit.json b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-13-commit.json new file mode 100644 index 00000000..8649fbc5 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-13-commit.json @@ -0,0 +1,5 @@ +{ + "exit_code": 0, + "stdout": "[detached HEAD 0c21cf1] Record reviewed case source evidence (13/13)\n 16 files changed, 1954 insertions(+)\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/netkingdom-progress.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/platform-progress.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/publication-commit.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/scanner-blocked-paths.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/warden-progress.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r2/public-digest-derivation.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/workplans/WARDEN-WP-0044-security-case-follow-through.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/implementation.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/packet-hashes.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-review-r1/review-r1.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-review-r1/reviewer-correction.patch\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-review-r1/reviewer-probes.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-review-r1/run.py\n", + "stderr": "" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-13-local-scan.json b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-13-local-scan.json new file mode 100644 index 00000000..c160917f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-13-local-scan.json @@ -0,0 +1 @@ +{"blocked_blob_ids": [], "scanned_blobs": 16, "scanner_sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509", "scanner_version": "8.30.1", "scope": "changed-staged-blobs", "status": "clean"} diff --git a/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-13-local-scan.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-13-local-scan.stderr.txt new file mode 100644 index 00000000..e69de29b diff --git a/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-13-push.json b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-13-push.json new file mode 100644 index 00000000..d167e463 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/batch-13-push.json @@ -0,0 +1,26 @@ +{ + "batch": 13, + "commit": "0c21cf1b691b3c8a8ed0865caca5b777be782478", + "previous_remote": "e9dc1a0f90d07eb592c1f7b644d881c61c53c63e", + "paths": [ + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/workplans/WARDEN-WP-0044-security-case-follow-through.md", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/implementation.json", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/packet-hashes.json", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-review-r1/review-r1.json", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-review-r1/reviewer-correction.patch", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-review-r1/reviewer-probes.py", + "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-review-r1/run.py", + "docs/netkingdom-target-implementation.md", + "docs/netkingdom-target-security-architecture.md", + "docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r2/public-digest-derivation.json", + "docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/scanner-blocked-paths.json", + "docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/publication-commit.json", + "docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/warden-progress.json", + "docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/netkingdom-progress.json", + "docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/platform-progress.json", + "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + ], + "exit_code": 0, + "stdout": "", + "stderr": "remote: {\"status\":\"clean\",\"scope\":\"introduced-reachable-git-objects-and-updated-ref-names\",\"scanned_objects\":28,\"scanned_refs\":1,\"scanner_version\":\"8.30.1\"} \nTo forgejo-remote:coulomb/the-custodian.git\n e9dc1a0..0c21cf1 HEAD -> main\n" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/close-progress.json b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/close-progress.json new file mode 100644 index 00000000..c48373b1 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/close-progress.json @@ -0,0 +1,14 @@ +{ + "workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52", + "id": "455ca4b0-3521-4dfa-aeae-08c11ecbc760", + "topic_id": null, + "task_id": "87637402-02f1-57c1-8fbc-4141598af8e3", + "decision_id": null, + "event_type": "note", + "summary": "Published/verified Custodian 05df7c3ee4d31879e7e0074e3210656b4f795794 (238 explicit evidence/architecture/workplan files) with owner source heads Warden b593c879, NetKingdom befb0bc6 and Platform104ed90. Kernel attended dispatch/catalog checks, exact proposed issuer reference, independent mint/correct-catalog fixtures and corrected ordinary unit-test accident guard are implemented in source. Root full make test785passed/4deselected; downstream31tests/53subtests and issuer8tests passed. Fresh primary source/UUID/status readback verifies48 task bindings across coordinator6,Warden4,NK35,KEY39three; all31 original NK bindings and all6 coordinator blocks preserved. NK T32/T33/T35done only their declared source outcomes, T34progress actual Apps inverse backend absent; T16/native firstcase and KEY39T02 stay open. All16native target gates remain unclosed. Initial safe-runner rejection, truncation/provenance regressions, unknown old ambient lookup and failed preparations preserved. Root scanner rejected3public-digest metadata blobs; verified43exactpublic artifacts, typed SHA256 values with byte-exact reversible originals and passed unchanged normal hook; no credential encoded/allowlist/scannerpolicy change. Server first rejected large push as unverified/scanner-failed. Thirteen bounded commits each passed the same pinned local scanner and unchanged server hook; final normal merge retains original a69be6c with byte-identical tree, no reset/amend/force push or hook/policy changes. Required consistency reused only for identical source tree. Normal primary projection applied without retirement;8preexistingroot worktree/index edits preserved exactly. Evidence source-corrections-publication-r3/final-verification.json and dated owner packets. Goal remains active; no new native, credential, runtime-profile,1.3pin or draft-lane promotion.", + "detail": null, + "author": "codex", + "session_id": null, + "created_at": "2026-10-17T20:38:12.234006Z", + "workstream_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/final-verification.json b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/final-verification.json new file mode 100644 index 00000000..a84abd47 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/final-verification.json @@ -0,0 +1,289 @@ +{ + "status": "verified", + "root_commit": "05df7c3ee4d31879e7e0074e3210656b4f795794", + "root_changed_files_verified": 238, + "owner_heads": { + "ops-warden": "b593c879831378db7dc62adfabdfedf2d44ddd38", + "net-kingdom": "befb0bc68cd25b625804fce559476eefd702521d", + "railiance-platform": "104ed90f42a9a86bf9fda343b49b65a85c9ee4b9" + }, + "source_primary_task_bindings": [ + { + "owner": "the-custodian", + "workplan_uuid": "dfadb19b-445e-59c6-bcd6-48e87b912c52", + "task_count": 6, + "source_primary_bindings": [ + { + "record_id": "CUST-WP-0080-T01", + "uuid": "c770f7e1-25eb-53ec-9a37-1f7794077ff8", + "status": "done" + }, + { + "record_id": "CUST-WP-0080-T02", + "uuid": "5973026f-8ca9-5882-99fe-65a54bc250ac", + "status": "done" + }, + { + "record_id": "CUST-WP-0080-T03", + "uuid": "87637402-02f1-57c1-8fbc-4141598af8e3", + "status": "progress" + }, + { + "record_id": "CUST-WP-0080-T04", + "uuid": "82378b0f-7004-5c2f-9683-b356a1227576", + "status": "todo" + }, + { + "record_id": "CUST-WP-0080-T05", + "uuid": "ed8b909a-23bf-5e5f-b600-e477fbae136b", + "status": "progress" + }, + { + "record_id": "CUST-WP-0080-T06", + "uuid": "6aca534c-5c7a-556f-b6b6-406433670c29", + "status": "progress" + } + ] + }, + { + "owner": "ops-warden", + "workplan_uuid": "f7e81013-6868-5d99-8528-ba75a442eca9", + "task_count": 4, + "source_primary_bindings": [ + { + "record_id": "WARDEN-WP-0044-T01", + "uuid": "ef0920fc-418e-52cb-acff-9a5c0c728bf5", + "status": "done" + }, + { + "record_id": "WARDEN-WP-0044-T02", + "uuid": "5f68c991-f490-58f8-a121-92f74073d272", + "status": "done" + }, + { + "record_id": "WARDEN-WP-0044-T03", + "uuid": "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89", + "status": "progress" + }, + { + "record_id": "WARDEN-WP-0044-T04", + "uuid": "4a0fa4a7-5ca9-518a-ab92-a79a5e2cf93e", + "status": "wait" + } + ] + }, + { + "owner": "net-kingdom", + "workplan_uuid": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "task_count": 35, + "source_primary_bindings": [ + { + "record_id": "NK-WP-0048-T01", + "uuid": "930ac3e9-20ec-5473-98cd-3fe8fddb730f", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T02", + "uuid": "19c25d96-a55c-58f0-9168-3fdbc4955fc2", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T03", + "uuid": "e487975b-73b1-516c-971d-da4cbbb93063", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T04", + "uuid": "2fffe112-7d55-5680-9952-78d74f44f87f", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T05", + "uuid": "3d987d3d-0797-538b-86e4-51185a327ae2", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T06", + "uuid": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "status": "wait" + }, + { + "record_id": "NK-WP-0048-T07", + "uuid": "c3c9c3ae-4f23-5ba7-9e6f-e63bcf29b9f7", + "status": "wait" + }, + { + "record_id": "NK-WP-0048-T08", + "uuid": "8e519082-dc8b-5e46-b660-03d03e55dcf6", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T09", + "uuid": "0ee12dfc-8260-5038-bd39-cc7fb4113be0", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T10", + "uuid": "4b06ca97-c1e4-5680-bf22-ab75ab1646a4", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T11", + "uuid": "ef2a0119-f59e-5e45-9519-115da9df7b85", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T12", + "uuid": "7ce4eee3-cd47-55a9-bfa5-4f1835d4d6fd", + "status": "todo" + }, + { + "record_id": "NK-WP-0048-T13", + "uuid": "b264c10b-565c-5d29-b788-03cf5fbd2883", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T14", + "uuid": "fce95440-a25b-5f27-8ef3-a3d182099113", + "status": "progress" + }, + { + "record_id": "NK-WP-0048-T15", + "uuid": "1b825705-4848-5edc-832f-b1622cd9bdb7", + "status": "wait" + }, + { + "record_id": "NK-WP-0048-T16", + "uuid": "200bf500-5084-5ae7-be26-3033fe1f296e", + "status": "todo" + }, + { + "record_id": "NK-WP-0048-T17", + "uuid": "8c3e4baa-a218-5996-af9e-fe1153a46dac", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T18", + "uuid": "9c45da71-fb4c-5f20-9065-90f448f37c64", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T19", + "uuid": "f50fdcd1-00be-5c3c-be0c-345aa2126032", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T20", + "uuid": "863fcbdb-e246-51ba-87ca-a2f44d01d6f8", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T21", + "uuid": "afe78e4d-408a-516a-ab92-e212e8a2d11d", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T22", + "uuid": "ea50d93b-0d04-55d2-98c4-9b6c3fe925b1", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T23", + "uuid": "6e7cd483-c7af-53a2-9d0a-3d76b6fb49ee", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T24", + "uuid": "1a3931ee-3b5f-52fc-9295-4073804f4bd2", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T25", + "uuid": "0de2a7d9-874d-578b-a076-f653fe42e30b", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T26", + "uuid": "94b3cbf0-c908-5ac6-b0db-67385c3e021c", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T27", + "uuid": "e56365f8-29b5-5c89-a329-8115f9f3b2a7", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T28", + "uuid": "6dab281c-ea9a-5a17-a83f-e8e9a4d4484f", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T29", + "uuid": "129db41d-4560-5e20-9f3b-c3c91e0a5601", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T30", + "uuid": "6f6073ac-52dd-5b70-8874-6d76d4c072e4", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T31", + "uuid": "ed1ccd87-89a0-5e69-885c-0eaf5ab0bb5a", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T32", + "uuid": "c6d0a27e-f6a7-5df0-95f6-3e7473d38bb5", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T33", + "uuid": "5ace28ff-a4cb-5647-a8f6-3cd54bb9d0a5", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T34", + "uuid": "37f43c40-d014-544e-aa0b-5219dd4a6b93", + "status": "progress" + }, + { + "record_id": "NK-WP-0048-T35", + "uuid": "cf1d6ab3-846e-53ea-8575-d6347b6f4769", + "status": "done" + } + ] + }, + { + "owner": "key-cape", + "workplan_uuid": "09c3bddf-6058-5603-8488-cccdb7be4f86", + "task_count": 3, + "source_primary_bindings": [ + { + "record_id": "KEY-WP-0039-T01", + "uuid": "4d06b059-3768-53bb-83a4-a9a71c0850b8", + "status": "done" + }, + { + "record_id": "KEY-WP-0039-T02", + "uuid": "03da4c38-1dac-53b1-8b0b-e697df48e9d3", + "status": "wait" + }, + { + "record_id": "KEY-WP-0039-T03", + "uuid": "54d37ad8-2352-51c2-bb2e-af6070dbbd73", + "status": "done" + } + ] + } + ], + "preserved_original_root_dirt": 8, + "projection": "primary/railiance01", + "native_target_gates_closed_by_this_work": 0, + "scanner_policy_changed": false, + "failed_and_unknown_outcomes_retained": true, + "goal_status": "active", + "bounded_publication_commits": 13, + "original_commit_retained": "a69be6cb0773efdc9c3bf214311d11998a6b438f", + "observed_at": "2026-10-17T20:38:08.753681+00:00" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/merge-commit.json b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/merge-commit.json new file mode 100644 index 00000000..807c2e74 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/merge-commit.json @@ -0,0 +1,5 @@ +{ + "exit_code": 0, + "stdout": "[detached HEAD 05df7c3] Preserve original reviewed evidence after bounded source publication\n", + "stderr": "" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/merge-local-scan.json b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/merge-local-scan.json new file mode 100644 index 00000000..1dea50bc --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/merge-local-scan.json @@ -0,0 +1 @@ +{"blocked_blob_ids": [], "scanned_blobs": 0, "scanner_sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509", "scanner_version": "8.30.1", "scope": "changed-staged-blobs", "status": "clean"} diff --git a/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/merge-local-scan.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/merge-local-scan.stderr.txt new file mode 100644 index 00000000..e69de29b diff --git a/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/normal-sync.json b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/normal-sync.json new file mode 100644 index 00000000..edac39c9 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/normal-sync.json @@ -0,0 +1,292 @@ +{ + "ok": true, + "status": "applied", + "repo_slug": "the-custodian", + "commit": "05df7c3ee4d31879e7e0074e3210656b4f795794", + "requests": 2, + "elapsed_ms": 13677.6, + "git": { + "upstream": "origin/main", + "behind": 0, + "ahead": 0 + }, + "identifiers": { + "schema": "repo-manager.identifier-assignment.v1", + "ok": true, + "executed": true, + "repo": "the-custodian", + "namespace": "helixforge", + "assignments": [], + "historical_invalid_identifiers": [ + { + "kind": "workplan", + "id": "CUST-WP-ADHOC-2026-08-25-RETIRED", + "source": "workplans/ADHOC-2026-08-25-retired.md" + } + ], + "historical_identity_collisions": [], + "files_changed": [] + }, + "receipt": { + "schema": "state-hub.repository-projection-reconcile.v1", + "instance_role": "primary", + "instance_label": "railiance01", + "expected_commit": "05df7c3ee4d31879e7e0074e3210656b4f795794", + "derived_commit": "05df7c3ee4d31879e7e0074e3210656b4f795794", + "outcome": { + "schema": "state-hub.projection-reset.v1", + "repo_slug": "the-custodian", + "commit": "05df7c3ee4d31879e7e0074e3210656b4f795794", + "status": "applied", + "counts": { + "created": 0, + "updated": 88, + "retired": 0, + "refused": 0, + "released": 0, + "created_tasks": 0, + "updated_tasks": 0, + "cancelled_tasks": 0, + "created_edges": 0, + "removed_edges": 0, + "unresolved_edges": 0, + "external_edges": 13 + }, + "created": [], + "updated": [ + "CUST-WP-0000", + "CUST-WP-0000b", + "CUST-WP-0000c", + "CUST-WP-0001", + "CUST-WP-0002", + "CUST-WP-0004", + "CUST-WP-0005", + "CUST-WP-0006", + "CUST-WP-0007", + "CUST-WP-0008", + "CUST-WP-0009", + "CUST-WP-0010", + "CUST-WP-0010b", + "CUST-WP-0013", + "CUST-WP-0014", + "CUST-WP-0015", + "CUST-WP-0016", + "CUST-WP-0017", + "CUST-WP-0017-LEGACY", + "CUST-WP-0018", + "CUST-WP-0019", + "CUST-WP-0020", + "CUST-WP-0021", + "CUST-WP-0022", + "CUST-WP-0023", + "CUST-WP-0024", + "CUST-WP-0025", + "CUST-WP-0026", + "CUST-WP-0027", + "CUST-WP-0028", + "CUST-WP-0029", + "CUST-WP-0030", + "CUST-WP-0031", + "CUST-WP-0032", + "CUST-WP-0033", + "CUST-WP-0034", + "CUST-WP-0035", + "CUST-WP-0036", + "CUST-WP-0037", + "CUST-WP-0039", + "CUST-WP-0040", + "CUST-WP-0041", + "CUST-WP-0043", + "CUST-WP-0044", + "CUST-WP-0045", + "CUST-WP-0046", + "CUST-WP-0047", + "CUST-WP-0048", + "CUST-WP-0049", + "CUST-WP-0050", + "CUST-WP-0051", + "CUST-WP-0052", + "CUST-WP-0053", + "CUST-WP-0053-LEGACY", + "CUST-WP-0054", + "CUST-WP-0055", + "CUST-WP-0056", + "CUST-WP-0057", + "CUST-WP-0058", + "CUST-WP-0059", + "CUST-WP-0060", + "CUST-WP-0061", + "CUST-WP-0062", + "CUST-WP-0063", + "CUST-WP-0064", + "CUST-WP-0065", + "CUST-WP-0066", + "CUST-WP-0067", + "CUST-WP-0068", + "CUST-WP-0069", + "CUST-WP-0070", + "CUST-WP-0071", + "CUST-WP-0072", + "CUST-WP-0073", + "CUST-WP-0074", + "CUST-WP-0075", + "CUST-WP-0076", + "CUST-WP-0077", + "CUST-WP-0078", + "CUST-WP-0079", + "CUST-WP-0080", + "CUST-WP-0081", + "CUST-WP-ADHOC-2026-03-29", + "CUST-WP-ADHOC-2026-05-02", + "CUST-WP-ADHOC-2026-07-02", + "CUST-WP-ADHOC-2026-08-25", + "CUST-WP-ADHOC-2026-09-06", + "THE-WP-0001" + ], + "retired": [], + "released": [], + "created_tasks": [], + "updated_tasks": [], + "cancelled_tasks": [], + "created_edges": [], + "removed_edges": [], + "unresolved_edges": [], + "external_edges": [ + { + "workplan": "CUST-WP-0071", + "from": "CUST-WP-0071-T05", + "target": "CUST-WP-0071-T04", + "relationship_type": "starts_after", + "from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3", + "from_task_id": "20ddd4d7-d85d-5b95-bb0a-7b0ca8af76ca", + "to_workplan_id": null, + "to_task_id": "944f98e2-7e42-5894-925b-752423f3a1cc" + }, + { + "workplan": "CUST-WP-0071", + "from": "CUST-WP-0071-T03", + "target": "CUST-WP-0071-T01", + "relationship_type": "starts_after", + "from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3", + "from_task_id": "6dc67558-eb1e-5bb6-a667-986f884dd495", + "to_workplan_id": null, + "to_task_id": "4ae8eb8d-f8c5-5256-ae50-c323cfd73d7a" + }, + { + "workplan": "CUST-WP-0071", + "from": "CUST-WP-0071-T03", + "target": "CUST-WP-0071-T02", + "relationship_type": "starts_after", + "from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3", + "from_task_id": "6dc67558-eb1e-5bb6-a667-986f884dd495", + "to_workplan_id": null, + "to_task_id": "82192370-2fd7-5363-88d2-3c67889d3d68" + }, + { + "workplan": "CUST-WP-0071", + "from": "CUST-WP-0071-T02", + "target": "CUST-WP-0071-T01", + "relationship_type": "starts_after", + "from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3", + "from_task_id": "82192370-2fd7-5363-88d2-3c67889d3d68", + "to_workplan_id": null, + "to_task_id": "4ae8eb8d-f8c5-5256-ae50-c323cfd73d7a" + }, + { + "workplan": "CUST-WP-0071", + "from": "CUST-WP-0071-T02", + "target": "RAPPS-WP-0014-T03", + "relationship_type": "starts_after", + "from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3", + "from_task_id": "82192370-2fd7-5363-88d2-3c67889d3d68", + "to_workplan_id": null, + "to_task_id": "dd069c6d-fcc1-5bac-b233-976f2f0d5cd1" + }, + { + "workplan": "CUST-WP-0071", + "from": "CUST-WP-0071-T04", + "target": "CUST-WP-0071-T03", + "relationship_type": "starts_after", + "from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3", + "from_task_id": "944f98e2-7e42-5894-925b-752423f3a1cc", + "to_workplan_id": null, + "to_task_id": "6dc67558-eb1e-5bb6-a667-986f884dd495" + }, + { + "workplan": "CUST-WP-0073", + "from": "CUST-WP-0073-T02", + "target": "GLAS-WP-0012", + "relationship_type": "blocks", + "from_workplan_id": "a98a9f34-83b4-5c8c-8107-e05f7806d50d", + "from_task_id": "4b88b0b7-dc7e-5612-aa5d-1a08f0530c35", + "to_workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f", + "to_task_id": null + }, + { + "workplan": "CUST-WP-0073", + "from": "CUST-WP-0073-T04", + "target": "CUST-WP-0073-T02", + "relationship_type": "starts_after", + "from_workplan_id": "a98a9f34-83b4-5c8c-8107-e05f7806d50d", + "from_task_id": "90725511-4e31-549f-b567-47feff1a9ca4", + "to_workplan_id": null, + "to_task_id": "4b88b0b7-dc7e-5612-aa5d-1a08f0530c35" + }, + { + "workplan": "CUST-WP-0079", + "from": "CUST-WP-0079-T03", + "target": "ACTIVITY-WP-0047", + "relationship_type": "blocks", + "from_workplan_id": "ab288f92-d364-5c24-9362-aee451f266c3", + "from_task_id": "1be0569c-221d-5925-a0ff-fd2af88e52b1", + "to_workplan_id": "ee97869b-dca2-54c9-aa18-0b479c244fb3", + "to_task_id": null + }, + { + "workplan": "CUST-WP-0079", + "from": "CUST-WP-0079-T04", + "target": "PNEX-WP-0006", + "relationship_type": "blocks", + "from_workplan_id": "ab288f92-d364-5c24-9362-aee451f266c3", + "from_task_id": "5dd52156-09a8-5781-b288-99ae822f59a6", + "to_workplan_id": "774c5037-a3d0-5e65-893c-d18970acd66a", + "to_task_id": null + }, + { + "workplan": "CUST-WP-0080", + "from": "CUST-WP-0080-T04", + "target": "CUST-WP-0080-T03", + "relationship_type": "starts_after", + "from_workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52", + "from_task_id": "82378b0f-7004-5c2f-9683-b356a1227576", + "to_workplan_id": null, + "to_task_id": "87637402-02f1-57c1-8fbc-4141598af8e3" + }, + { + "workplan": "CUST-WP-0080", + "from": "CUST-WP-0080-T05", + "target": "RPF-WP-0056", + "relationship_type": "blocks", + "from_workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52", + "from_task_id": "ed8b909a-23bf-5e5f-b600-e477fbae136b", + "to_workplan_id": "31933d08-c877-5fda-aff9-6220c3705c92", + "to_task_id": null + }, + { + "workplan": "CUST-WP-0080", + "from": "CUST-WP-0080-T05", + "target": "RAPP-PLAYWRIGHT-WP-0004", + "relationship_type": "blocks", + "from_workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52", + "from_task_id": "ed8b909a-23bf-5e5f-b600-e477fbae136b", + "to_workplan_id": "f9280c40-201e-59b5-a6f0-1aace8e0e2e2", + "to_task_id": null + } + ], + "refused": [], + "notes": [ + "Preserved bound historical row and task UUIDs: CUST-WP-ADHOC-2026-08-25-RETIRED" + ] + } + } +} diff --git a/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/normal-sync.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/normal-sync.stderr.txt new file mode 100644 index 00000000..e69de29b diff --git a/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/plan.json b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/plan.json new file mode 100644 index 00000000..0913ca0d --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/plan.json @@ -0,0 +1,989 @@ +{ + "schema": "custodian.bounded-source-publication.v1", + "original_commit": "a69be6cb0773efdc9c3bf214311d11998a6b438f", + "remote_base": "d68d131e32c523fcf989fa0e7ad44b60b33c6067", + "batches": [ + [ + { + "path": "docs/changes/netkingdom-target-2026-10-17/key39-infra-finalization-r1/finalization-recheck-progress.json", + "sha256": "a8a2142632f0bf5adc0148542c71b68a9a95e6b98730f5f3b825d6ca945f2d69" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/key39-infra-finalization-r1/finalization-recheck.json", + "sha256": "de18dc982213742c86d9b1e21af778a587275d84da128f76d8768204d3f6fee4" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r1/apply_prepare.py", + "sha256": "b294e6339e8c9af9ba911667646dd0ab52e75cf798de93238d84d1057c8a9e70" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r1/candidate.patch", + "sha256": "df69fb2ec9f1e1cf0dd94194e3c046c995ed8a7deabf65a8e9bec34662adb501" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r1/preparation.json", + "sha256": "c6fc0d7393fc40607ee8157ad2c1f92c73549fb8b52abedc517aac27c9137370" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r1/publication-inputs.json", + "sha256": "d9bf5555013aa9e399037672c80a72af23c6815db03088bee3db4c8583197146" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r1/run_validation.py", + "sha256": "16236aa55a774f8ea6d66da4ee17f7737c6d1b013d844ca9b9759e02b615af51" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r1/task-T35.md", + "sha256": "7d14d261ffbab2a930c4a3ff962cec786060cad6177280773cf1c0b0f006127f" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r1/validation-child.py", + "sha256": "6bd4e3cda22e65f90bbb4006b403270405947293be2ae8bf8fdade0abed61f45" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r1/validation-guard.py", + "sha256": "13611f4de25dc7d01348905c4b365a0ffbb95fd93a61c75c8faf38d705c54f50" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r1/workplan.candidate.md", + "sha256": "3bce122c5b83d9044b142fc2cabc48de5558ab0d65dc0223a8ed0325f219e981" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r1/workplan.preimage.md", + "sha256": "f92962c5aa21aade0fc2f6b4f8d9a95932fe85b107413cdd2824b6ebe72c36d9" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/apply_prepare.py", + "sha256": "b294e6339e8c9af9ba911667646dd0ab52e75cf798de93238d84d1057c8a9e70" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/candidate.patch", + "sha256": "df69fb2ec9f1e1cf0dd94194e3c046c995ed8a7deabf65a8e9bec34662adb501" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/canonical-validation.json", + "sha256": "12748c25e4177a7e8e38edce9e53ae683c6f4b4369314a5db0d7e2cc1659fc29" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/identifier-assignment.json", + "sha256": "1f78bf76592aea84c50dbb3b7181d703b41abdb60937833db30632395cf06673" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/identifier-preview.json", + "sha256": "5f28c6fa85de2e9bafbbd5f567c8c755aabfb3fdf4224cac05c1762910ccd512" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/preparation.json", + "sha256": "c6fc0d7393fc40607ee8157ad2c1f92c73549fb8b52abedc517aac27c9137370" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/publication-inputs.allocated.json", + "sha256": "33dac5218d7b54756b05fea6e1ea885dfc45634896fa3a45b543f9a46dc7afe9" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/publication-inputs.json", + "sha256": "0820bbf9c40eda750e2fc374b43745a0ca82c076c9467f1f3e5c26350dd8db9f" + } + ], + [ + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/revision-refresh.json", + "sha256": "a5b341694aaeb84ef8cc7b76eeff3ba7a97f7cc24eb1e2158d3e85ed901c5667" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/run_validation.py", + "sha256": "16236aa55a774f8ea6d66da4ee17f7737c6d1b013d844ca9b9759e02b615af51" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/task-T35.md", + "sha256": "7d14d261ffbab2a930c4a3ff962cec786060cad6177280773cf1c0b0f006127f" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/validation-child.py", + "sha256": "6bd4e3cda22e65f90bbb4006b403270405947293be2ae8bf8fdade0abed61f45" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/validation-guard.py", + "sha256": "13611f4de25dc7d01348905c4b365a0ffbb95fd93a61c75c8faf38d705c54f50" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/workplan.allocated.md", + "sha256": "53f9e5826bd7e34287d59f46089ee50c31598ba1a56bcf6d3249525f7e23bb9b" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/workplan.candidate.md", + "sha256": "3bce122c5b83d9044b142fc2cabc48de5558ab0d65dc0223a8ed0325f219e981" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/workplan.preimage.md", + "sha256": "f92962c5aa21aade0fc2f6b4f8d9a95932fe85b107413cdd2824b6ebe72c36d9" + } + ], + [ + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-update-r1/candidate.patch", + "sha256": "df69fb2ec9f1e1cf0dd94194e3c046c995ed8a7deabf65a8e9bec34662adb501" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-update-r1/edit.py", + "sha256": "da1fef62073b92b59307e9f52115fa4fa784b260b5202db9d28fc62938982040" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-update-r1/implementation-r1.json", + "sha256": "be1e23dc29be795fb9cdd96172d288a83338c2c0f0cef45d6f29f974d83857df" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-update-r1/run.py", + "sha256": "8ad707bd9bb509e4b27503c284cee8aff3a7205882ca87febdace0a050c5f749" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-update-r1/test_runner.py", + "sha256": "d6f4e8f0f5c34557bf678543ae2c69202dc321f1226c2e1a2d462b2d81efc9c5" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/canonical-validation.json", + "sha256": "0e3cf1ad47f8aa486e8a6704563dfb548a59b7c19f1c7c639e0599a1cc026cb9" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/consistency.json", + "sha256": "b76e4abfa87880dedb40f3bc87caed622237678c8745a26d34f4a70cb06ed242" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/consistency.stderr.txt", + "sha256": "f4a6aa1609a13600a0b97cbb08bbc03b3e247b619ff37912d37f7e109ce798ba" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/projection.json", + "sha256": "454680e758b154d8439cd9d458e9fb8b29dbff4fc501eaf2ea9b6b3c5147b057" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/projection.stderr.txt", + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/publication-commit.json", + "sha256": "0e51461bb6934d3bf68d9c49023b0f2d7f10f451137cfe6e36a9c1000aa0972a" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/publication-inputs.final.json", + "sha256": "8885f9a3561d5a48dc1cde11a86b374d65d5d81f32b8ef684e73a22bd0200c1c" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/publication-inputs.json", + "sha256": "a0dcaecd1af428c4bfe6176d77d4595f260f351b4ddb61766141f6e8ba5db62c" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/run_validation.py", + "sha256": "16236aa55a774f8ea6d66da4ee17f7737c6d1b013d844ca9b9759e02b615af51" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/validation-child.py", + "sha256": "6bd4e3cda22e65f90bbb4006b403270405947293be2ae8bf8fdade0abed61f45" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/validation-guard.py", + "sha256": "13611f4de25dc7d01348905c4b365a0ffbb95fd93a61c75c8faf38d705c54f50" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/validation-inputs-refresh.json", + "sha256": "7c359c9c05b1d5737166b59686eb765e4ba2e34497290a921704e0becdceb4a3" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/verified-task-bindings.json", + "sha256": "610ef9e256a8be8ada2af16d71675af53aecd9340436140936f93b1432fd1c43" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-issuer-reference-integration-r1/apply.py", + "sha256": "98285ff57389e37fa1f5d8d0f1b3fcbea9c7fad7927e6ee29fb890c4696e3877" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-issuer-reference-integration-r1/composition-regenerated.json", + "sha256": "773daa1df72cc7cf6a6d8aa082208181ca2438cdecc9179b1bc5b1c3a09099c2" + } + ], + [ + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-issuer-reference-integration-r1/initial-syntax-failure.py.txt", + "sha256": "2f9d6e97df945195225573e976b4d809c784d51a59bc1611db8ad0b9fff92fd3" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-issuer-reference-integration-r1/type.preimage.yaml", + "sha256": "e75fe94110ef9fb7fb18072fe2856941b33507c99cb406d36576046481485d0a" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-issuer-reference-integration-r1/verification.json", + "sha256": "9092dc8d772155b1a68fb23095b45233727d718eb8e255dd6894a518bd50f01c" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-issuer-reference-integration-r1/workplan.preimage.md", + "sha256": "53f9e5826bd7e34287d59f46089ee50c31598ba1a56bcf6d3249525f7e23bb9b" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/README.md", + "sha256": "78a4dbef0088f18db2b9c1dbe701b3e8a2c20516ae6d2039420a82b8d6b1fe66" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/canonical-application.json", + "sha256": "f3e08764dac6d407beb33b22afe9c154efd761c4f12f6b3d4941fc6b9076a233" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/canonical-net-kingdom-status-after.txt", + "sha256": "354b3dd65c711df0855c22ba053a4ca295d5491941c5a64c1157a0b7d43cf4cb" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/canonical-validation.json", + "sha256": "232416ea6fc095e868ec0f2af34a6b9c44885561b98cba2576ff72a49fc71bb4" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/implementation.json", + "sha256": "33d51784fe3ab7d9307292a265b0e684a8bc2fc77564ba58099833e41c849306" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/manifest.json", + "sha256": "9e137321abde7c2997f30a4ae7978883879c194a4c70c80ebf64d1972ecd66d5" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/preimage-frozen.txt", + "sha256": "63dd3d754896c0e8578d82f98ae6f8e460a6ac43f3937a95fa61f65f8aa4accf" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/preimage-mutant.txt", + "sha256": "6c823ed279c355a34169d7753817256890d56fe4a1996ea59aa01fb19e5a5e1f" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/reproduce-scratch-checks.py", + "sha256": "8f0b01e606c03b3b27b178df60eab664a758df6fa3f9b1bc62ef8b58122c2cd8" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/scratch-kernel-mutation.patch", + "sha256": "dd12c63bd331b8f127149c402077e49fc66d62a452f48044486f58e79e0e29f7" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/scratch.json", + "sha256": "7e329154c5c60528d9f4387f0bbc9cfb4167c79decd49b14497e67d59e21e469" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/successor-frozen.txt", + "sha256": "275324dcf33eb852eb467832ff18fe9dd09f09d64d6ac37b43bf01766ea745d3" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/successor-mutant.txt", + "sha256": "9f03083de5863b3855e533b94671cfbab6fd0dd565e0a0b8c385d51d9510d97c" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/test-admit-1-3-agent-mint-coverage.patch", + "sha256": "5bc1da176836eea65195cfe5fae965284c1f38809a502a0be58c231b60111a75" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/test-results.json", + "sha256": "2aab986ed96fb9fa683992051ffe6ec7b2a9327d816542b908dcc66f9dd8df23" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/test_admit_1_3_type.after.py", + "sha256": "c512ba00513d066fd1ca8af08fd6bf106fbd7a132981b1dcc5af80a745ab03f0" + } + ], + [ + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/test_admit_1_3_type.before.py", + "sha256": "f4f6a35cfbada462c939fe357e51fa5d03efc9d20c17a511f224c1359ca0faa5" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/OWNER-REVIEW.md", + "sha256": "7983fd841f09bc7584047426912c33d568c97b4c1126776f99aac42b34d2b742" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/canonical-source-readonly-state.json", + "sha256": "129d6926bb996e510ab4b41d30e738096b53b71de1fb2dd470fe0ac94848cbec" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/focused-tests.json", + "sha256": "8de5862a8d752dce0b3b96a9275e42952a99415a18d3f67c06bf9f5b6008d0e3" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/focused-tests.txt", + "sha256": "aab46c51d87198ad4be6dd3078f61286e2faf1ef4d76fa14298698388f78ab24" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/manifest.json", + "sha256": "cfbc40890f94302764b7b6302a90ea07e975d1eadad91b9dd9642c45a5b13717" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/netkingdom-entry-point.conditional.patch", + "sha256": "6784a21fbd10bd62712be2e0f4929034601c94629aa74ccaa2e93fc815eecd61" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/platform-candidate/docs/keycape-issuer-eso-contract.md", + "sha256": "7f59e59b17c58252982931ac61fe50dd7a07340add6c437fe48af36971eafe68" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/platform-candidate/manifests/templates/keycape-issuer-eso.yaml", + "sha256": "e17498bd8a4c820041a4105e4efe9c60c6a50953db8f621ff54887080065c743" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/platform-candidate/scripts/keycape_issuer_eso.py", + "sha256": "21c5797280c2a7825dbda8ac970d34a0cdef4c6458f68bce0b1c12407f122a87" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/platform-candidate/tests/test_keycape_issuer_eso.py", + "sha256": "223d4c5b349062b9f93e6af79e8d5feda44377ba41a11726f6f2b762691e8308" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/platform.candidate.patch", + "sha256": "a490df7dee41e15351da8d2906e1342edebb533984befe3d9ae74d952dbb091b" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/review.json", + "sha256": "d99db9ab4f326308cde464129bbbb7573434e500fd03c130a37a590bac3643a4" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/source-pins.json", + "sha256": "6e896b6196a0aca01ddaf433b4d14cc041fc0296c5dd6404c3a698b941b61bd8" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/structural-and-patch-checks.json", + "sha256": "a3dc4cd405c412d4369986cc6736cd2d9eed02d4b86d95d62d5a9914106fdb14" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/type.before.yaml", + "sha256": "e75fe94110ef9fb7fb18072fe2856941b33507c99cb406d36576046481485d0a" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/type.candidate.yaml", + "sha256": "ef02ddae3167bdd1558193a5f6db0379fb8cc84207531706d5ef35caabc3684f" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/README.md", + "sha256": "522392bd35d2e0b22fd097509361d1476200a361c2ced22603d43e5758aa691d" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/canonical-validation.json", + "sha256": "2f81d70761b154b042d09321cb3b04e0d30d5f9ce79be05503870d245423bbf5" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/consistency.json", + "sha256": "1543d1dcd86706889463e3d0915d1a9aa02b72c3861400a010df44ed4c9b392a" + } + ], + [ + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/consistency.stderr.txt", + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/integrate_platform.py", + "sha256": "ef8a1647e54013c0c6f2c11c8f74ef43fc97ceaca99e8f8caa89ee16ff80efba" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/integration-checks.json", + "sha256": "0ab8b058414dde1be9c7fd6ee2cb3f246e4deef2036d17472e846fae23bba4b9" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/manifest.json", + "sha256": "c52692fb154cd46f1bfa62e7a0cda73241716b1024d992449e24e87e18750bbb" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/netkingdom-entry-point.conditional.patch", + "sha256": "6784a21fbd10bd62712be2e0f4929034601c94629aa74ccaa2e93fc815eecd61" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/packet-hashes.json", + "sha256": "057f7cf2a6ea98ddd5963cf2608cd8d7a43847048e77aa2c2a571e7f3a3c53d2" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/platform-source/docs/keycape-issuer-eso-contract.md", + "sha256": "7f59e59b17c58252982931ac61fe50dd7a07340add6c437fe48af36971eafe68" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/platform-source/manifests/templates/keycape-issuer-eso.yaml", + "sha256": "e17498bd8a4c820041a4105e4efe9c60c6a50953db8f621ff54887080065c743" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/platform-source/scripts/keycape_issuer_eso.py", + "sha256": "21c5797280c2a7825dbda8ac970d34a0cdef4c6458f68bce0b1c12407f122a87" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/platform-source/tests/test_keycape_issuer_eso.py", + "sha256": "223d4c5b349062b9f93e6af79e8d5feda44377ba41a11726f6f2b762691e8308" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/progress-paragraph.md", + "sha256": "151199597ba37225e5d46922ae90453f7338c5602ff81b3d870b579278bef2d4" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/projection.json", + "sha256": "b52dee68c6dd1d6c6fe6cb412a372f919af53fdab39c116d070ded6f2067af0b" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/projection.stderr.txt", + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/publication-commit.json", + "sha256": "4d7bfca9479f4fbf57a9ce3b9f737749f47d9e1ecae3afb07897cd16b43e4645" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/publication-inputs.json", + "sha256": "fb2893c6a95566849b30aa8ab61bf5f2d24a6ccf61e2242b6bff8a2e05b0004e" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-review-r1/REVIEW.md", + "sha256": "508afd5695eda998cf651874c00bcaa14725afd7a52b54a5c27854b0bfc44978" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-review-r1/evidence.json", + "sha256": "cc8cf37c1d4f56dfb16233b31e293c158d68cd4c49a1ab1b730205cb325531b6" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-review-r1/focused-tests.txt", + "sha256": "fd09c39d8434d0a9ed746dcddd0acd11657d67541c59ab632ef36be1f9cc7ec2" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-review-r1/reproduce.py", + "sha256": "61633872de8244db3bc94e32d406479605eceef1f2c6f415164e1b6c0680068b" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-review-r1/review.json", + "sha256": "99b78098a6eb257b2e58c22b076d43c687cc2708560bba46b82f50129d72aecb" + } + ], + [ + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/README.md", + "sha256": "bff0eb23ce4920da6058bf71a3dace209baca69a97c94bd9db4f765f71044eb2" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/candidate-validation.json", + "sha256": "17ed30550f7330beb49b5f866c634e78fbcbf98088fcc3e0ce92faa7b9042524" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/failure_inverse_omitted.txt", + "sha256": "543906e345b1b5daa28f0f3cfc620b3e06253cfb65c3a861586630dc63b57608" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/focused-tests-before-admission-binding.json", + "sha256": "c11b15e97b3da1c9b4819fec539b17823f98f4e6f39ece9bc5c8422325ddbc8e" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/focused-tests-before-admission-binding.txt", + "sha256": "9fb7e13b0e58942d2dc1921fd303ad372b1385841e3df88f5a23365a4a4b95bf" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/focused-tests.json", + "sha256": "8b1f7ecf75fedee9c03d1421efc6a6e9dd89eb99da70df5e8e4d47027b5fe331" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/focused-tests.txt", + "sha256": "99ddd55245e57dd9047793bd206158c66b723a7fe79cc8e7b785f8183f1e4654" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/implementation.json", + "sha256": "fce244e7a8bd1f1b9911c632de4831de291f358375183ff7959dc5615560f6d0" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/manifest.json", + "sha256": "5a6c08e13422cd2d21d5df5d9dce41685a6cf1cf1cdcd3a64f807806602f1dfd" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/negative-controls.json", + "sha256": "d13a0cf8b22abef1cba502b3fd3fd10c9f40955a3ffa8fee473d6189bfb25783" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/net-kingdom-unchanged-owner-status.txt", + "sha256": "354b3dd65c711df0855c22ba053a4ca295d5491941c5a64c1157a0b7d43cf4cb" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/owner-contract-candidate.md", + "sha256": "dfdc6573df76647790aabb26e4b228b04047dffd032fc33821024f8bbc9ba941" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/owner_configuration_contract.py", + "sha256": "62752f518b78fa7713bdb4d47e68decbf3aa89ecbc7950549ffdc3d08e01c554" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/post_revision_guard_removed.txt", + "sha256": "e9e4a134ece9095af5dbf790858b6e3ed44ae9388dde98cbb9a25b4183a16f50" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/railiance-apps-unchanged-owner-status.txt", + "sha256": "251b0eb219198e4ad334a76e0b39f23848242354105e97f3f61701168817cdd3" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/test_owner_configuration_contract.py", + "sha256": "51482fc5bad6af5c52d736ded7e7031291b18bc4949b9ff43d7dea78f3a8ad94" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/type-owner-configuration-inverse.candidate.patch", + "sha256": "6e23967d768759fc10203bcc25d81cb32c3d9222ed6fcb4a510a7cfe90e579bf" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/type.before.yaml", + "sha256": "e75fe94110ef9fb7fb18072fe2856941b33507c99cb406d36576046481485d0a" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/type.candidate.yaml", + "sha256": "739c927ab494f4e0f6618e6e55394dd8dc4b720db428cd4973f7a81524e1ecd9" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/README.md", + "sha256": "168b80f6cc0d50650a484d24696022cac8a4cf8279c2fb4da0c112cfbf10fd08" + } + ], + [ + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/candidate-validation.json", + "sha256": "200132ab91899f6cfb2782b19ff59c72056f05197690cecdda708ccbdd343edc" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/focused-tests.json", + "sha256": "2f48369c3d00f9a43989486882519ee5c09d4eb1f5be599a92b06ca0d7cc8581" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/focused-tests.txt", + "sha256": "436459ced69db381f44a0f14d2ebcf00a4067f596a9881cfdcca7146c237d3a1" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/fresh-inverse-session.candidate.patch", + "sha256": "0b4a466c23cdeeb34789ab79c3d7cdc4a186495a910e23bc6491a29b5ff9cff8" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/fresh-session-guard-omitted.txt", + "sha256": "f47357c3303b026dcd9edcce564725a1c7d0d77969dd2857a6f1c008f169c1e1" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/implementation.json", + "sha256": "8517713a130f23cb38c597d333f65ec27700f347c16dca617e988f1cbc948abf" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/manifest.json", + "sha256": "14058734b40a0394a5d26b5063ba60ea343b1ad3ad47b789b9e640637c4e8c4b" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/negative-controls.json", + "sha256": "8f96396f3d342f505d1dc6ac235a7f37a7c2481d51d100125f05b26619d3d314" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/owner-backend-next.md", + "sha256": "6243d7a70868224cb89fd30818c23ac379f37b6576e4947e444ef5057d06aea8" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/owner-contract-candidate.md", + "sha256": "4f9b91a2389acbc52558347a794da02faa6de4fb189373a11feeac10ae7e7c4f" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/owner-source-inventory.json", + "sha256": "4510ce7b2f9eb9f4695ef4c57bba888c3839d3adcc397f4b4024be0fa71767bb" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/owner_configuration_contract.py", + "sha256": "2cd04432cf3681afc126736f7daacfab46630441aeb223b3e222d6951d24ce2e" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/test_owner_configuration_contract.py", + "sha256": "0f4246fea95bd3139c604da8712e6f6ac08976dd34d73e56ba83663ecba42761" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/type-owner-configuration-inverse.candidate.patch", + "sha256": "949ef6d3e0acc574e1d69c251d6d09e3da636bc73d043dec1c5677f30de29947" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/type.before.yaml", + "sha256": "e75fe94110ef9fb7fb18072fe2856941b33507c99cb406d36576046481485d0a" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/type.candidate.yaml", + "sha256": "6e744be190c4f047e609bef7670ff987fe1606b4d7dac3f740f164bebc205a13" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-review-r1/README.md", + "sha256": "659ce8da07ef4f16077b9b2fcf5e89c5c1ed177603f589acf344e57b12ace18f" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-review-r1/fresh-inverse-session.candidate.patch", + "sha256": "0b4a466c23cdeeb34789ab79c3d7cdc4a186495a910e23bc6491a29b5ff9cff8" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-review-r1/original-authority-tests.txt", + "sha256": "6c5326d4a189509e823110e748a2e6baed9a8b809b15bc0aa61cc247f2a8df35" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-review-r1/patched-authority-tests.txt", + "sha256": "2d5029651d5d31355683da0f774a17eb418355714ae42af60b6a7b901b65676e" + } + ], + [ + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-review-r1/review.json", + "sha256": "8199a9937c1091de5101c9a3c6bb0bcc3742677e0b5830e1b6a0b00c06fe85e1" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-review-r1/test_inverse_authority.py", + "sha256": "4c83407535dd37e571f293a9cc6b47d787b02b925402741d52c70a5532d76e1c" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/apply_prepare.py", + "sha256": "e759865139078a6ea7509fa80c8521d81446a3f6fc236550628df3d1b14a9e50" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/consistency.json", + "sha256": "6eae09358f008c873345b417f33e606a70a862786a29cca1e870ed7f48a232b3" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/consistency.stderr.txt", + "sha256": "f4a6aa1609a13600a0b97cbb08bbc03b3e247b619ff37912d37f7e109ce798ba" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/identifier-assignment.json", + "sha256": "50c3ef9b95557fd01af751a84ee99e17b868fc128f4101c268cee8157f8b72b2" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/identifier-preview.json", + "sha256": "5f3bda9eeccf3dd639c2d0bd2315ff1c71e79de021200c53e136559ad658d67e" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/preimage.json", + "sha256": "93a300b5e744764221671b4a3534aad0bdf511b7b4b45643dd8c3b1e357b541f" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/projection.json", + "sha256": "11cf3e0838f914a2aab970950dbe0d7f32846c11fc7b593791957d3f8381b497" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/projection.stderr.txt", + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/publication-commit.json", + "sha256": "b692f5d2487bcf5f9a8d6db09bc6b0d4fe4a69ae39a6bf79184a26e32ef5f44a" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/publication-inputs.json", + "sha256": "ebb1f954932140654291c0d9ddd6fcd8448e0edabb1dd194e82bd7633d2a71ea" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/workplan.allocated.md", + "sha256": "f92962c5aa21aade0fc2f6b4f8d9a95932fe85b107413cdd2824b6ebe72c36d9" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/workplan.candidate.md", + "sha256": "f1e5245f565da2cc35b5e2d0adfcad42325c64205525d3f96171e604d8935708" + } + ], + [ + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/workplan.preimage.md", + "sha256": "1502f1f474856172d969489cab8c0642d9456d93d326f6660df3772a4716d30b" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/owner-source-state.json", + "sha256": "c9d3d3ae1372007b35526d592d3a7ea2d2bc6374d34840ef02fdda9535973785" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/prepare.py", + "sha256": "749703026767ccb196c01ac8b4c9fafbcdbd564d20ae73b468e297a114f073d6" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/candidate.patch", + "sha256": "1a3530a1e469fc03c2c29f1b66fa3ba1904e56bf2abcfb242c7a2ed015fb3e74" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/candidate/src/warden/case_run.py", + "sha256": "1bc73e30ac718fd75bbaff2a739495fc051aeaec73802ac71f0583cb2d53ab0a" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/candidate/src/warden/case_type.py", + "sha256": "7b659b8d682863cd28df24025be4b10dd7ca3df724350a22d360c6af9615bca7" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/candidate/src/warden/routing/models.py", + "sha256": "b85372b2572a49af62e9534f26a33963b894633c7cd43dd2a28416b8959cba3e" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/candidate/tests/test_case_1_3_integration.py", + "sha256": "4862c5a004075eb18733d354bee7dda3f55e04a6ee8ecb44b76166347c121158" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/candidate/tests/test_case_admission_modes.py", + "sha256": "9110d6b6286cf0f85268d4970d1fd403250da3f04351d70b1fd2d9d7a93e2d89" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/candidate/tests/test_case_attended_boundary.py", + "sha256": "4615e653f06144305ea1a84e98bc6260e16ed41ef9e5db2d0f162ef9f723ef2d" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/evidence/run.py", + "sha256": "19746062528f63909a268e8d97e801c9d116d57e5a1c0e148b2a22ec0ecd0f8f" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/evidence/sitecustomize.py", + "sha256": "ffaa62732340efd8d40bb54a3c4499cb62a89896e5ee825c8fe7b5d2bf93db22" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/implementation-r1.json", + "sha256": "b9ee843bba417c82ad77ac8a221cf64dd5088aa640528524b2e0ef0c129d3184" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/test-isolation-proposal.patch", + "sha256": "0f6c46303ec24f337e4190ec84773ccefb4833241233b4b7d56bd1927eba838c" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review-r2/integration_runner.py", + "sha256": "d77da107d67ec827f19e0c46045a2802081a62283c3bdb5bfec35feabb454234" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review-r2/kernel-review-r2.json", + "sha256": "9002efdac67f451ef4fc59c02056c8e3ed23de57677ee9974d7477614960e515" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review-r2/reviewer-probes.py", + "sha256": "e52025893ca0755b3a62e2585cf2f16002a5b705f7cfb0582b05435d3b9e336a" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review-r2/run-baseline.py", + "sha256": "02e2a409cd23fb52f518c202c923877fdcc381f708b4e8d77bad04e034b46e73" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review-r2/run.py", + "sha256": "c6f931ba4ff9b0ef42627030a016dd7ebe3f353b3024f1c40b80df890aefe59f" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review-r2/setup.py", + "sha256": "fcdeb50a196ce5afda6243b9fb51584af58ba5d55e75a4caed017f742d560500" + } + ], + [ + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review-r2/sitecustomize.py", + "sha256": "6b7cec873fa1fca6767b77f514bec499adb5e1e7745dbc8eddf36771917ad4f4" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/commit.json", + "sha256": "16883619d6ae1433b30c61ea2fbb8ada44f4423d1102a9390867efa580d15de2" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/consistency-preimage.json", + "sha256": "9c8d006e95c32bbd689c16a5ee575e3d54c46b327d5f2f47a697570480d8e9fb" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/consistency.json", + "sha256": "8032a9d073c6334bc7136ca88a2878b2525f552c4e25266884d45456f4152fb6" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/consistency.stderr.txt", + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/focused-tests.txt", + "sha256": "a25e2b6355475168ff5a9dba6deec605584711d5c63de8ddc3da4644c93f6a5e" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/integrate.py", + "sha256": "8eab2d72e67a9af5230d7978d9533d964b8162a85a7fc053a210da05b3a5219d" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/integration.json", + "sha256": "0781a745e9bcb4e052c80818a71695a1c91672345c7cfd7628fb0a56a7075d82" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/normal-sync.json", + "sha256": "00a81cede4636a8adcbb2315a3a79c69d472accbab83f5d99cbb51a5ffa48653" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/normal-sync.stderr.txt", + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/publish.py", + "sha256": "c632d670d3b53efbf7a1b5c2c29402e3e5d57cce3a40f119e672153e3fe21189" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/verification.json", + "sha256": "f6d9efb1f3118a80945465b08ba17e26b76ab14d017e7fba56ab3e911767b2ac" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/workplan.preimage.md", + "sha256": "721a90b2ed8c896257c34a1451eb642cb8824c8263e37c483fb61b36adc54088" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/commit.json", + "sha256": "7bf38dbd9c4b6c59f6b1b45e86abeba8bff2a7a0e847da85f7e7e6f422a99186" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/consistency.json", + "sha256": "b70a0b6356d42b173b9d11af7c0f4df6850e4c3bc186dee69a7348f2d66e62bc" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/consistency.stderr.txt", + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/full-unit-result.json", + "sha256": "9f9460f8b0f06e5f5668e554a059300ed5b40fbb1ea0ffc3e1092fe0ac11a4f0" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/integrate.py", + "sha256": "333d24d6f01d6d23b571e02846d71938ae8b78fee63aefbe90d7a7c1888cf7e1" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/integration.json", + "sha256": "663628195799e298e47e01cf9067fddc0f21a1c06967d11266c2fdc8a9e68bf0" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/prepare_publication.py", + "sha256": "5a22d66b1986c5b17414ea5d70dbd42bda1f69c24941bc80a6aeca86c79d4795" + } + ], + [ + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/projection.json", + "sha256": "1d63a42ddbe4055fb70035948f3e2dea2dd167498bad87282f095ecfcdb32a89" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/projection.stderr.txt", + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/publication-commit.json", + "sha256": "ced6545c22193dd4d8dc272bf16603a9ed9cf0973e21c94a97ede68f289dc423" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/publication-inputs.json", + "sha256": "bc2f8fd65e7517849f52c888baf89f7f160b20027a946d3aacbf1e5c5aa5102f" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/root-disposition.json", + "sha256": "190780394f6b062be7483c40da28ab1d28a6a29794fb88dc2e77264faa60b9f7" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/README.md", + "sha256": "7322316db3fdd7107efe82d42166a25dd494161f8062aaa833b4497392fd04bb" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate.patch", + "sha256": "1fe65076ce7e633be304fc779bf2c87b7ee1e4e460de55ca74355b5842d036f5" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/Makefile", + "sha256": "8cf08ec680ed6bd323a1ce8475ade731dbeebcd64ffd43ecd169308f8a727940" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/docs/development/safe-unit-tests.md", + "sha256": "b157c3e6956a41dcd9fc3912d0c7d09a664f11f08f0f8a8e4cae57fac9747cf7" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/scripts/run_unit_tests.py", + "sha256": "8157e44df298fa4c47c6c08b2dc68e3ac945c4beb3f47a251a7afbbc55eb1bd2" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/fixtures/workload-coverage/provenance.json", + "sha256": "a4a203c1bd7bc5b8039d1b2525bea65dbae288a3f552969e4218cd5abda96990" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/fixtures/workload-coverage/rapp-core-hub/declarations/rapp.yaml", + "sha256": "9ce902da0c77809f1094a634244652835b162f59682e9fa6923d8c8aa4ed4a3c" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/fixtures/workload-coverage/rapp-issue-core/declarations/rapp.yaml", + "sha256": "a1956deecf2f0fbca44549e5ea5e8f1c4b74ebf91a9482c64c982491af0d923b" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/fixtures/workload-coverage/rapp-qonto/declarations/rapp.yaml", + "sha256": "15aa9809e8d6a120c516be5ce9adfb72c00382140c171e791083ad117f503b3f" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/test_case_plan.py", + "sha256": "944bc2a725ca1b7a10f4516c3ceed65f99627057dd15a859da4f8ffb3d97e71f" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/test_case_type.py", + "sha256": "5a217a172e7e2ffbea66f1beee9a1c18bf5e97f9fb25b83cb96b6ba976cbb2a5" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/test_layer_conformance.py", + "sha256": "3edf0a0d49c3560278a564c477834335cfaf5243341cb9345f0d4bf8994db56c" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/test_safe_unit_runner.py", + "sha256": "6b623d18879e7564dd11447c16d3ec9f80321a25a525fcd0306b6a903a68031a" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/test_workload_join.py", + "sha256": "1828908a5cd1f0bc13ca367dbd1245221c52d1ac60789c9e3bd51dd36cb8beb9" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/unit_isolation_probe.py", + "sha256": "726d3e01ae21c1379588e1f08459449908cc8a75ffea1b337c33a1a888c66f59" + } + ], + [ + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/workplans/WARDEN-WP-0044-security-case-follow-through.md", + "sha256": "074bfcf2f7841e78bcd404bf573982d244b00f2f500e198b7fe80fea660de991" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/implementation.json", + "sha256": "8033b323178e1d3b031a45466687fe05479627e99559d9de7b3baef52ab8671f" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/packet-hashes.json", + "sha256": "1567ff1ad558fdb464818bb555dab79152477c85113f89874daa3049029733a8" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-review-r1/review-r1.json", + "sha256": "6cb7e3d1af81ffbf9bd4908841ae5c4772a96c909965f077e5ffd8dc57f0b8b4" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-review-r1/reviewer-correction.patch", + "sha256": "9407289f8da41ed6fff367baf566ad30f5510a2627c14e0ac0cf971bf9b465c9" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-review-r1/reviewer-probes.py", + "sha256": "0b49fc2ad7aeeca0cabb0961b06d8cdc85ae5109f36bf81e4245e55127357574" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-review-r1/run.py", + "sha256": "f7fc81b8acbcd0712ee5f79a16b27aa1cdd0af11db761f9e94fba8b91e51ec8a" + }, + { + "path": "docs/netkingdom-target-implementation.md", + "sha256": "8452750de483b79a2cbb09b192d18cf6dc421ad736dd06c738af0727c3d74854" + }, + { + "path": "docs/netkingdom-target-security-architecture.md", + "sha256": "ec2079be18c7cdb8a1e4fdbd22131c08c83721d7a1bf18b4802bc5e229520f35" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r2/public-digest-derivation.json", + "sha256": "534790dec14d324cd2e0f3a81b5becc82504e54c5af3ad7b32282dc1e39a542f" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/scanner-blocked-paths.json", + "sha256": "0038027e83923e08b426b5e172445331e134e15edd2877999d3005ce06e351a9" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/publication-commit.json", + "sha256": "a39a1c5824d72f3ee0008d140656b0f4005b051353948f1237a9b47f9aa4f14f" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/warden-progress.json", + "sha256": "5c791f3d5e784a71ac79fce1c75b922956e70a92cbcd2bedd50a3ac8e7bbfd78" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/netkingdom-progress.json", + "sha256": "b36b3916f4726d98af6711591f207d1401266ecd3d8b2b1382df42ceb948378d" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/platform-progress.json", + "sha256": "f795c81b8fbcf71313d5dd29a98c53d845d976bb8aead76cadeafaedb60b57d5" + }, + { + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md", + "sha256": "2f4adf4348346e31c4581754352f0d3329231af75333b988d2dc336d4f4b8a35" + } + ] + ], + "source_tree_unchanged": true, + "history": "Publish bounded commits from existing remote base, then retain original local commit in a normal merge with identical tree; no reset/amend/force push.", + "controls": "Every batch runs same pinned local staged scanner explicitly plus normal commit hooks and unchanged server pre-receive. Fixed-path local hook does not select the scanner for /tmp worktrees, so explicit identical scanner invocation compensates without altering hooks.", + "final_projection": "Normal rmgr sync --push; primary expected/derived commit and task bindings verified. Required prior consistency applies to byte-identical source tree." +} diff --git a/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/publication-result.json b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/publication-result.json new file mode 100644 index 00000000..1a594249 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/publication-result.json @@ -0,0 +1,79 @@ +{ + "status": "published-and-projected", + "commit": "05df7c3ee4d31879e7e0074e3210656b4f795794", + "original_commit_retained": "a69be6cb0773efdc9c3bf214311d11998a6b438f", + "bounded_commits": [ + { + "batch": 1, + "commit": "d8d63778f66c97ebc0d46fa767299f9ea877e9dd", + "files": 20 + }, + { + "batch": 2, + "commit": "0543257514ddee7d760ae1d366d9e818e10cb0f1", + "files": 8 + }, + { + "batch": 3, + "commit": "935aed2bcb2db3b2213c4de0489eb59658fa7c6c", + "files": 20 + }, + { + "batch": 4, + "commit": "42e18ef0c827e981bdee823bd80d4e5d7a048127", + "files": 20 + }, + { + "batch": 5, + "commit": "5c456215ea2eea89015e36e48cedfc95385c304b", + "files": 20 + }, + { + "batch": 6, + "commit": "a4c1f893de931ad648e9b6455b0e44ab81eeab2f", + "files": 20 + }, + { + "batch": 7, + "commit": "474354493884c3f1304ef5fab5796d837ac52948", + "files": 20 + }, + { + "batch": 8, + "commit": "2d4401a4258d5340b071f9a126d344e9328fd7b8", + "files": 20 + }, + { + "batch": 9, + "commit": "285e5900091ee2f940b8fea5755aeddf78492b4f", + "files": 14 + }, + { + "batch": 10, + "commit": "30e41c948e7c5f29cf770ac63d50043a615171d9", + "files": 20 + }, + { + "batch": 11, + "commit": "df5765e0e18a2daa66cc1c684b6b88af6202e9fe", + "files": 20 + }, + { + "batch": 12, + "commit": "e9dc1a0f90d07eb592c1f7b644d881c61c53c63e", + "files": 20 + }, + { + "batch": 13, + "commit": "0c21cf1b691b3c8a8ed0865caca5b777be782478", + "files": 16 + } + ], + "source_tree_identical_to_original_and_required_consistency": true, + "same_local_scanner_explicit_on_every_worktree_batch": true, + "same_server_pre_receive_on_every_push": true, + "scanner_policy_or_hooks_changed": false, + "preserved_root_paths": 8, + "projection": "primary/railiance01", + "native_actions": false +} diff --git a/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/publish_batches.py b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/publish_batches.py new file mode 100644 index 00000000..679828a8 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/publish_batches.py @@ -0,0 +1,75 @@ +from pathlib import Path +import hashlib,json,os,stat,subprocess +p=Path(__file__).resolve().parent;r=Path('/home/worsch/the-custodian');plan=json.loads((p/'plan.json').read_text()) +w=Path('/tmp/custodian-source-batches-r3');m=Path('/tmp/custodian-source-merge-r3') +original=plan['original_commit'];published=plan['remote_base'] +protected=json.loads((p.parent/'source-corrections-publication-r1/protected-state.json').read_text()) +def git(root,*a):return subprocess.check_output(['git','-C',str(root),*a],stderr=subprocess.PIPE,text=True,timeout=90).strip() +def preserve(): + assert git(r,'rev-parse','HEAD')==original + for row in protected: + assert hashlib.sha256((r/row['path']).read_bytes()).hexdigest()==row['sha256'] + assert git(r,'ls-files','--stage','--',row['path'])==row['index'] +def scan(root,label): + result=subprocess.run(['python3','/home/worsch/repo-manager/src/repo_manager/secret_scan.py','--path',str(root),'--binary','/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks'],cwd=root,capture_output=True,text=True,timeout=180) + (p/(label+'-local-scan.json')).write_text(result.stdout);(p/(label+'-local-scan.stderr.txt')).write_text(result.stderr) + assert result.returncode==0 and json.loads(result.stdout)['status']=='clean','same pinned local scanner refused' +def normal_commit(root,argv,label): + result=subprocess.run(['git','-C',str(root),'commit',*argv],capture_output=True,text=True,timeout=240) + (p/(label+'-commit.json')).write_text(json.dumps({'exit_code':result.returncode,'stdout':result.stdout,'stderr':result.stderr},indent=2)+'\n') + assert result.returncode==0,'normal commit hook refused' +preserve();assert not w.exists() and not m.exists() +assert git(r,'ls-remote','origin','refs/heads/main').split()[0]==published +git(r,'worktree','add','--detach',str(w),published) +receipts=[] +for index,batch in enumerate(plan['batches'],1): + label=f'batch-{index:02d}';preserve() + assert git(r,'ls-remote','origin','refs/heads/main').split()[0]==published + names=[] + for row in batch: + src=r/row['path'];assert not src.is_symlink() + raw=src.read_bytes();assert hashlib.sha256(raw).hexdigest()==row['sha256'] + target=w/row['path'];target.parent.mkdir(parents=True,exist_ok=True);target.write_bytes(raw) + os.chmod(target,stat.S_IMODE(src.stat().st_mode));names.append(row['path']) + git(w,'add','--',*names) + assert set(git(w,'diff','--cached','--name-only').splitlines())==set(names) + scan(w,label) + normal_commit(w,['--only','-m',f'Record reviewed case source evidence ({index}/{len(plan["batches"])})','--',*names],label) + head=git(w,'rev-parse','HEAD') + assert set(git(w,'diff-tree','--no-commit-id','--name-only','-r',head).splitlines())==set(names) + result=subprocess.run(['git','-C',str(w),'push','origin','HEAD:refs/heads/main'],capture_output=True,text=True,timeout=180) + receipt={'batch':index,'commit':head,'previous_remote':published,'paths':names,'exit_code':result.returncode,'stdout':result.stdout,'stderr':result.stderr} + (p/(label+'-push.json')).write_text(json.dumps(receipt,indent=2)+'\n') + assert result.returncode==0,'unchanged server pre-receive refused bounded batch; stop' + assert git(r,'ls-remote','origin','refs/heads/main').split()[0]==head + published=head;receipts.append({'batch':index,'commit':head,'files':len(names)}) + print(json.dumps({'published_batch':index,'of':len(plan['batches']),'commit':head,'files':len(names)}),flush=True) +assert git(w,'rev-parse','HEAD^{tree}')==git(r,'rev-parse',original+'^{tree}') +preserve() +# Keep the original local reviewed commit; no reset, amend or discarded history. +git(r,'worktree','add','--detach',str(m),original) +git(m,'merge','--no-ff','--no-commit',published) +assert git(m,'write-tree')==git(r,'rev-parse',original+'^{tree}') +scan(m,'merge') +normal_commit(m,['-m','Preserve original reviewed evidence after bounded source publication'],'merge') +merged=git(m,'rev-parse','HEAD');assert git(m,'rev-parse','HEAD^{tree}')==git(r,'rev-parse',original+'^{tree}') +preserve();git(r,'merge','--ff-only',merged) +for row in protected: + assert hashlib.sha256((r/row['path']).read_bytes()).hexdigest()==row['sha256'] + assert git(r,'ls-files','--stage','--',row['path'])==row['index'] +# Full source tree is identical to the already-passed required consistency run. +result=subprocess.run(['/home/worsch/repo-manager/.venv/bin/rmgr','sync','--path',str(r),'--push'],capture_output=True,text=True,timeout=180) +(p/'normal-sync.json').write_text(result.stdout);(p/'normal-sync.stderr.txt').write_text(result.stderr) +assert result.returncode==0,'normal final publication/projection refused; retain state' +data=json.loads(result.stdout);receipt=data['receipt'] +assert data['ok'] and data['status'] in {'applied','noop'} and data['commit']==merged +assert receipt['expected_commit']==receipt['derived_commit']==merged +assert (receipt['instance_role'],receipt['instance_label'])==('primary','railiance01') +assert receipt['outcome']['counts']['retired']==0 +assert git(r,'ls-remote','origin','refs/heads/main').split()[0]==merged +for row in protected: + assert hashlib.sha256((r/row['path']).read_bytes()).hexdigest()==row['sha256'] + assert git(r,'ls-files','--stage','--',row['path'])==row['index'] +summary={'status':'published-and-projected','commit':merged,'original_commit_retained':original,'bounded_commits':receipts,'source_tree_identical_to_original_and_required_consistency':True,'same_local_scanner_explicit_on_every_worktree_batch':True,'same_server_pre_receive_on_every_push':True,'scanner_policy_or_hooks_changed':False,'preserved_root_paths':len(protected),'projection':'primary/railiance01','native_actions':False} +(p/'publication-result.json').write_text(json.dumps(summary,indent=2)+'\n') +print(json.dumps({'status':summary['status'],'commit':merged,'bounded_commits':len(receipts),'source_tree_unchanged':True,'protected_paths':len(protected)}),flush=True) diff --git a/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/verify_close.py b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/verify_close.py new file mode 100644 index 00000000..73d1e1c9 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r3/verify_close.py @@ -0,0 +1,46 @@ +from pathlib import Path +import hashlib,json,re,subprocess,urllib.request,datetime +r=Path('/home/worsch/the-custodian');p=Path(__file__).resolve().parent;dated=p.parent +cfg=json.loads((p.parent/'source-corrections-publication-r2/publication-inputs.json').read_text());publication=json.loads((p/'publication-result.json').read_text());head=publication['commit'] +assert publication['source_tree_identical_to_original_and_required_consistency'] +assert len(publication['bounded_commits'])==13 +def git(root,*a):return subprocess.check_output(['git','-C',str(root),*a],text=True).strip() +assert git(r,'rev-parse','HEAD')==head and git(r,'ls-remote','origin','refs/heads/main').split()[0]==head +projection=json.loads((p/'normal-sync.json').read_text());rp=projection['receipt'] +assert git(r,'rev-parse','HEAD^{tree}')==git(r,'rev-parse',publication['original_commit_retained']+'^{tree}') +subprocess.run(['git','-C',str(r),'merge-base','--is-ancestor',publication['original_commit_retained'],head],check=True) +assert projection['ok'] and projection['status']=='applied' and projection['commit']==head +assert rp['expected_commit']==rp['derived_commit']==head and (rp['instance_role'],rp['instance_label'])==('primary','railiance01') +assert rp['outcome']['counts']['retired']==0 +for row in cfg['files']: + assert hashlib.sha256((r/row['path']).read_bytes()).hexdigest()==row['sha256'] + committed=subprocess.check_output(['git','-C',str(r),'show',head+':'+row['path']]) + assert hashlib.sha256(committed).hexdigest()==row['sha256'] +protected=json.loads((dated/'source-corrections-publication-r1/protected-state.json').read_text()) +for row in protected: + assert hashlib.sha256((r/row['path']).read_bytes()).hexdigest()==row['sha256'] + assert git(r,'ls-files','--stage','--',row['path'])==row['index'] +source_status=git(r,'diff','--name-only','HEAD').splitlines();assert set(source_status)=={x['path'] for x in protected} +owners={'ops-warden':'b593c879831378db7dc62adfabdfedf2d44ddd38','net-kingdom':'befb0bc68cd25b625804fce559476eefd702521d','railiance-platform':'104ed90f42a9a86bf9fda343b49b65a85c9ee4b9'} +for owner,want in owners.items(): + rr=r.parent/owner;assert git(rr,'rev-parse','HEAD')==want and git(rr,'ls-remote','origin','refs/heads/main').split()[0]==want +checks=[] +for owner,name,expected_count in [('the-custodian','workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md',6),('ops-warden','workplans/WARDEN-WP-0044-security-case-follow-through.md',4),('net-kingdom','workplans/NK-WP-0048-security-case-types.md',35),('key-cape','workplans/KEY-WP-0039-openbao-negative-probe-tokens.md',3)]: + text=(r.parent/owner/name).read_text();wp=re.search(r'state_hub_workstream_id: "(.*?)"',text).group(1) + with urllib.request.urlopen('http://127.0.0.1:8000/tasks/?workplan_id='+wp,timeout=20) as response:tasks=json.load(response) + assert len(tasks)==expected_count;by_uuid={x['id']:x for x in tasks} + rows=[] + for block in re.findall(r'```task\n.*?```',text,re.S): + id=re.search(r'^id: (.+)$',block,re.M).group(1);uid=re.search(r'state_hub_task_id: "(.*?)"',block).group(1);status=re.search(r'^status: (.+)$',block,re.M).group(1) + task=by_uuid[uid];assert (task['record_id'],task['status'],task['workplan_id'])==(id,status,wp) + rows.append({'record_id':id,'uuid':uid,'status':status}) + assert len(rows)==expected_count + checks.append({'owner':owner,'workplan_uuid':wp,'task_count':expected_count,'source_primary_bindings':rows}) +result={'status':'verified','root_commit':head,'root_changed_files_verified':len(cfg['files']),'owner_heads':owners,'source_primary_task_bindings':checks,'preserved_original_root_dirt':len(protected),'projection':'primary/railiance01','native_target_gates_closed_by_this_work':0,'scanner_policy_changed':False,'failed_and_unknown_outcomes_retained':True,'goal_status':'active','bounded_publication_commits':13,'original_commit_retained':publication['original_commit_retained'],'observed_at':datetime.datetime.now(datetime.timezone.utc).isoformat()} +(p/'final-verification.json').write_text(json.dumps(result,indent=2)+'\n') +body={'summary':'Published/verified Custodian '+head+' (238 explicit evidence/architecture/workplan files) with owner source heads Warden b593c879, NetKingdom befb0bc6 and Platform104ed90. Kernel attended dispatch/catalog checks, exact proposed issuer reference, independent mint/correct-catalog fixtures and corrected ordinary unit-test accident guard are implemented in source. Root full make test785passed/4deselected; downstream31tests/53subtests and issuer8tests passed. Fresh primary source/UUID/status readback verifies48 task bindings across coordinator6,Warden4,NK35,KEY39three; all31 original NK bindings and all6 coordinator blocks preserved. NK T32/T33/T35done only their declared source outcomes, T34progress actual Apps inverse backend absent; T16/native firstcase and KEY39T02 stay open. All16native target gates remain unclosed. Initial safe-runner rejection, truncation/provenance regressions, unknown old ambient lookup and failed preparations preserved. Root scanner rejected3public-digest metadata blobs; verified43exactpublic artifacts, typed SHA256 values with byte-exact reversible originals and passed unchanged normal hook; no credential encoded/allowlist/scannerpolicy change. Server first rejected large push as unverified/scanner-failed. Thirteen bounded commits each passed the same pinned local scanner and unchanged server hook; final normal merge retains original a69be6c with byte-identical tree, no reset/amend/force push or hook/policy changes. Required consistency reused only for identical source tree. Normal primary projection applied without retirement;8preexistingroot worktree/index edits preserved exactly. Evidence source-corrections-publication-r3/final-verification.json and dated owner packets. Goal remains active; no new native, credential, runtime-profile,1.3pin or draft-lane promotion.','event_type':'note','author':'codex','workplan_id':'dfadb19b-445e-59c6-bcd6-48e87b912c52','task_id':'87637402-02f1-57c1-8fbc-4141598af8e3'} +assert not (p/'close-progress.json').exists() +request=urllib.request.Request('http://127.0.0.1:8000/progress/',data=json.dumps(body).encode(),headers={'Content-Type':'application/json'},method='POST') +with urllib.request.urlopen(request,timeout=20) as response:receipt=json.load(response) +(p/'close-progress.json').write_text(json.dumps(receipt,indent=2)+'\n') +print(json.dumps({'status':'verified','root_commit':head,'files_verified':len(cfg['files']),'task_bindings':sum(x['task_count'] for x in checks),'protected_root_paths':len(protected),'progress_id':receipt['id'],'goal':'active'})) diff --git a/docs/changes/netkingdom-target-2026-10-17/state-hub-readiness-projection.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/state-hub-readiness-projection.stderr.txt new file mode 100644 index 00000000..e69de29b diff --git a/docs/changes/netkingdom-target-2026-10-17/state-hub-source-projection.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/state-hub-source-projection.stderr.txt new file mode 100644 index 00000000..e69de29b diff --git a/docs/changes/netkingdom-target-2026-10-17/statehub-public-package-metadata.json b/docs/changes/netkingdom-target-2026-10-17/statehub-public-package-metadata.json new file mode 100644 index 00000000..c980410e --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/statehub-public-package-metadata.json @@ -0,0 +1,10 @@ +[ + { + "path": "container/state-hub/main-51bc70d", + "status": 401 + }, + { + "path": "?type=container&q=state-hub&limit=10", + "status": 401 + } +] diff --git a/docs/changes/netkingdom-target-2026-10-17/statehub-public-registry-challenge.json b/docs/changes/netkingdom-target-2026-10-17/statehub-public-registry-challenge.json new file mode 100644 index 00000000..2cb35150 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/statehub-public-registry-challenge.json @@ -0,0 +1,4 @@ +{ + "status": 401, + "challenge": "Bearer realm=\"https://forgejo.coulomb.social/v2/token\",service=\"container_registry\",scope=\"*\"" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/sync_custodian.py b/docs/changes/netkingdom-target-2026-10-17/sync_custodian.py new file mode 100644 index 00000000..b1bd2948 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/sync_custodian.py @@ -0,0 +1,33 @@ +"""Required consistency/projection with exact restoration of unrelated work.""" +from pathlib import Path +import hashlib +import json +import subprocess + +ROOT = Path('/home/worsch/the-custodian') +BASE = Path(__file__).resolve().parent +BACKUP = BASE / 'custodian-publication-backup' +originals = json.loads((BACKUP / 'originals.json').read_text()) +other = json.loads((BACKUP / 'other-dirty-hashes.json').read_text()) +def git(*argv): + return subprocess.check_output(['git', '-C', str(ROOT), *argv], stderr=subprocess.PIPE) +try: + for label, argv, timeout in [ + ('consistency', ['statehub', 'fix-consistency', '--repo', 'the-custodian', '--json'], 300), + ('projection', ['/home/worsch/repo-manager/.venv/bin/rmgr', 'sync', '--path', str(ROOT), '--push'], 180), + ]: + result = subprocess.run(argv, cwd=ROOT, capture_output=True, text=True, timeout=timeout) + (BASE / ('custodian-' + label + '.json')).write_text(result.stdout) + (BASE / ('custodian-' + label + '.stderr.txt')).write_text(result.stderr) + assert result.returncode == 0, label + ' failed; receipt retained' +finally: + for name, entry in originals.items(): + (ROOT / name).write_bytes((BACKUP / (name + '.worktree')).read_bytes()) + mode, oid, stage, path = entry.split() + assert stage == '0' + git('update-index', '--cacheinfo', mode, oid, path) + assert git('ls-files', '--stage', '--', name).decode() == entry + assert all(hashlib.sha256((ROOT / name).read_bytes()).hexdigest() == pin for name, pin in other.items()) +receipt = json.loads((BASE / 'custodian-projection.json').read_text()) +assert receipt['status'] == 'applied' +print(json.dumps({'status': 'applied', 'commit': receipt['commit'], 'other_work_preserved': True})) diff --git a/docs/changes/netkingdom-target-2026-10-17/sync_receiver.py b/docs/changes/netkingdom-target-2026-10-17/sync_receiver.py new file mode 100644 index 00000000..f82e235c --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/sync_receiver.py @@ -0,0 +1,32 @@ +"""Required owner projection; retain the sandbox failure and unrelated state.""" +from pathlib import Path +import hashlib +import json +import subprocess + +BASE = Path(__file__).resolve().parent +ROOT = Path('/home/worsch/state-hub') +def git(*argv): + return subprocess.check_output(['git', '-C', str(ROOT), *argv], stderr=subprocess.PIPE) +names = ['.custodian-brief.md', 'WORK-RECORDS.md', 'docs/evidence/legacy-meter-weekly-review-20261014.json'] +before = {name: hashlib.sha256((ROOT / name).read_bytes()).hexdigest() for name in names} +index = git('ls-files', '--stage', '-z') +head = git('rev-parse', 'HEAD').decode().strip() +assert head in {'51bc70d1ff8f25450a8650d8e50caf053093a02e', '086d79a2736e34b916bd7de3c8a65e2ea38a3d64'} +label = 'state-hub-source-projection' if head.startswith('51bc70d') else 'state-hub-readiness-projection' +for name in [label + '.json', label + '.stderr.txt']: + old = BASE / name + saved = BASE / ('sandbox-failed-' + name) + if old.exists() and not saved.exists(): + saved.write_bytes(old.read_bytes()) +r = subprocess.run(['/home/worsch/repo-manager/.venv/bin/rmgr', 'sync', '--path', str(ROOT), '--push'], + cwd=ROOT, capture_output=True, text=True, timeout=180) +(BASE / (label + '.json')).write_text(r.stdout) +(BASE / (label + '.stderr.txt')).write_text(r.stderr) +assert all(hashlib.sha256((ROOT / name).read_bytes()).hexdigest() == pin for name, pin in before.items()) +assert git('ls-files', '--stage', '-z') == index +assert r.returncode == 0, 'projection failed; retained receipt' +value = json.loads(r.stdout) +assert value['status'] == 'applied' and value['commit'] == head +print(json.dumps({'status': value['status'], 'commit': value['commit'], + 'preserved_other_changes': True, 'counts': value['receipt']['outcome']['counts']})) diff --git a/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/README.md b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/README.md new file mode 100644 index 00000000..af9f6834 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/README.md @@ -0,0 +1,134 @@ +# TLS recovery disposition proposal + +The existing cert-manager lifecycle supplies a concrete trusted reissue option +for a separately approved standalone isolated KeyCape drill. It does not establish +cluster-loss independence. This packet proposes that disposition for the actual +owners to review; no owner/founder acceptance, certificate request, private key +generation, Secret access, tool installation or production change occurred. + +## Identity invariants + +The immutable recovery identity is the archived KeyCape OIDC issuer URL, +original RS256 signing key/JWKS, registration and policy state. The HTTPS leaf +certificate and its TLS private key are separate, renewable transport material. +Neither the identity-only Storage Share archive nor the current admission source +contains an archive-time ingress leaf fingerprint. Requiring that unavailable +historical leaf's exact bytes is not an existing source invariant. + +The admission **does** require an exact `tls_cert_sha256` and `trust_sha256` for +the material selected for this attempt. The session compares those bytes, checks +the certificate/key pair, and uses the supplied trust for native hostname/chain +validation. Archived config must still equal the admitted issuer; the restored +original signing key must still match live JWKS. Reissuing a leaf changes none of +those requirements. Existing `original_https_issuer_and_trust_preserved` evidence +describes the issuer origin and admitted trust, not archival TLS leaf equality. + +Three bounded checks against the actual existing metadata validator show that +two separately supplied synthetic leaf hashes are accepted and a missing leaf +hash refuses before any source/private-content read. They are metadata evidence, +not CA, key pairing, issuance or native proof. No new mode/approval field, +fallback, permanent test or redundant certificate framework was added. + +## Actual public lifecycle and trust evidence + +Read-only observations are timestamped independently in +live-public-resource-observations.json. On the verified node 92.205.62.239: + +- `sso/Certificate/kc-tls` is controlled by Ingress/keycape, Ready at revision 4, + with SAN kc.coulomb.social, ClusterIssuer/letsencrypt-prod, validity + 25 September–24 December 2026 and scheduled renewal 24 November. +- The Ready issuer uses the production Let's Encrypt ACME directory, HTTP-01 + with ingressClassName traefik. Only the ACME account Secret **name** was read. +- Controller v1.18.2 has the HTTP-01 solver and resolver 1.1.1.1:53. Existing + NetworkPolicy permits Traefik to solver pods on TCP 8089. DNS resolves the + hostname to the cluster's IPv4/IPv6 addresses from the workstation. +- The issuer/ingress field managers include kubectl-client-side-apply. No Argo + tracking annotation or source Application mapping for this ingress/issuer was + observed in the projected fields. This is a bounded observation, not proof + that no other GitOps source exists. Canonical namespace intent is NetKingdom's + ingress/issuers YAML; Railiance Cluster owns certificate/ingress plumbing. + +The current public endpoint passes normal hostname/system-CA verification. +Its leaf issuer is Let's Encrypt YR1. Public chain, public leaf and independent +pre-existing system trust anchor are retained with hashes; no key or Secret was +read. This demonstrates today's trusted path, not original private-key custody +or a successful future issuance. The source and trust observations are separate. + +## Proposed standard issuance action + +Use the existing cert-manager [cmctl CertificateRequest command](https://cert-manager.io/v1.18-docs/reference/cmctl/). +It creates a local key and public CSR, submits a CertificateRequest and saves +the resulting certificate locally. This avoids exporting the production +kc-tls Secret or renewing/replacing it. The reviewed +[v2.6.1 source](https://github.com/cert-manager/cmctl/blob/7e56321dbec4f62ea5428b8656c871c6dc0cc112/pkg/create/certificaterequest/certificaterequest.go) +writes local key material before request creation; staging protection must +therefore precede invocation. Its exact flags and released Linux amd64 checksum +are retained in cmctl-primary-source.json. The binary is absent locally and was +neither downloaded nor executed. The published checksum was checked against +release metadata; the available Cosign bundle was not verified, and no runtime +admission is claimed. + +reissue-command-proposal.json binds the candidate tool/version/hash, exact +namespace, dedicated request, public Certificate **template**, output paths, +timeout and verification/cleanup obligations. The template is consumed locally +by cmctl; it is not a proposed apply of a Certificate or TLS Secret. The action +creates a public CertificateRequest and normal transient ACME Order/Challenge/ +solver resources. This still requires the actual owner's scoped live authority +and founder go through the existing T35/RCLUSTER18 process. + +HTTP-01 requires domain routing and external TCP 80 reachability, cert-manager, +its webhook/controller, Traefik/solver networking, Kubernetes API, DNS resolution, +ACME service availability and CA limits. The exact existing configuration is +HTTP-01; switching to DNS-01 or a new off-cluster issuer is not proposed. +[HTTP-01 documentation](https://cert-manager.io/v1.18-docs/configuration/acme/http01/) +and [CA validation requirements](https://letsencrypt.org/docs/challenge-types/) +support these dependencies. Today's Ready status is not a future validation +guarantee or an external-vantage port-80 test. + +## Protected private staging and remaining review + +Before cmctl writes any key, the existing owner process must register a fresh +0700 owner-owned directory on actual tmpfs, with exact device/inode/run binding, +an independent surviving cleanup observer, exact child identities and a bounded +deadline. The existing isolated session has relevant register_workdir, +start_reaper and cleanup_workdir seams, but its current reaper is bound to the +Docker recovery execution. It has not been admitted for an earlier networked +certificate-issuance child. A shell exit trap alone is insufficient for hard +parent loss. RCLUSTER-WP-0018-T03 owns that bounded staging/command adaptation +and generated success/failure/timeout/parent-loss proof before an actual key. + +After issuance, verify public hostname/validity/CA provenance and independent +trust, record exact selected certificate-chain/trust hashes, and retain the +matching TLS key only in that private custody boundary through the original +six-argument isolated launcher. Record the accepted standalone-drill disposition +in the exact reviewed T33 packet; no new runtime approval flag is required. +Keep native issuer/signer/registration and negative checks unchanged. If any +step fails or becomes uncertain, quiesce the exact child before inode-guarded +local deletion, retain sanitized failure obligations, and reconcile only the +dedicated CertificateRequest and its actual UID/owned descendants through the +owner's Kubernetes deletion-precondition path. Do not use wildcard cleanup, +delete production kc-tls or call an unverified request outcome successful. + +For **genuine cluster loss**, this surviving-cluster command is unavailable. +The owner must independently recover original TLS custody or establish an +approved replacement validation/provider path with actual domain control, +private staging and trust. A new ACME account may be a separate provider +disposition; this packet does not assume access to the existing account key. +That independent capability remains RCLUSTER18-T02/T03/T04 and NK49-T35 scope. +An accepted standalone drill does not close the larger outage claim. + +## Source amendment and task disposition + +owner-doc-task-proposal.patch adds this identity distinction and concrete +reissue path to the existing Cluster boundary, records the completed source +inventory as proposed T06, and leaves exact original custody/reissue acceptance +and staging/native work open under T02–T04. These are proposed owner source +bytes only. No canonical workplan or doc was edited while root publication was +active, no UUID was assigned and no task was marked done in the Hub. + +The next exact deliverables are actual source-owner review of the standalone +drill disposition, admission of the pinned cmctl artifact via the existing tool +process, and T03's bounded private staging/child/remote-request cleanup source +proof. An actual certificate request remains separately supervised. This is a +specific implementation prerequisite, not a request to locate an unspecified +historical backup or invent a new credential service. diff --git a/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/cmctl-primary-source.json b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/cmctl-primary-source.json new file mode 100644 index 00000000..2e40b215 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/cmctl-primary-source.json @@ -0,0 +1,68 @@ +{ + "tag": "v2.6.1", + "commit": "7e56321dbec4f62ea5428b8656c871c6dc0cc112", + "release_url": "https://github.com/cert-manager/cmctl/releases/tag/v2.6.1", + "assets": [ + { + "name": "checksums.txt", + "url": "https://github.com/cert-manager/cmctl/releases/download/v2.6.1/checksums.txt", + "digest": "sha256:7c1daa59eeb7c70299013b53e60b9a2176089aefbd5757dedb0187954f2b20a5" + }, + { + "name": "checksums.txt.cosign.bundle", + "url": "https://github.com/cert-manager/cmctl/releases/download/v2.6.1/checksums.txt.cosign.bundle", + "digest": "sha256:f684207d99792f1049329a6c7e1f40ff8c7a55f4b56216cd59c7abfca9f16301" + }, + { + "name": "cmctl_linux_amd64", + "url": "https://github.com/cert-manager/cmctl/releases/download/v2.6.1/cmctl_linux_amd64", + "digest": "sha256:0af054c26a2b64ce286fa868d029164867695a93c3eb893662ce16f35e708db0" + } + ], + "published_checksum_line": "0af054c26a2b64ce286fa868d029164867695a93c3eb893662ce16f35e708db0 cmctl_linux_amd64", + "checksum_file_sha256": "sha256:7c1daa59eeb7c70299013b53e60b9a2176089aefbd5757dedb0187954f2b20a5", + "source_url": "https://raw.githubusercontent.com/cert-manager/cmctl/7e56321dbec4f62ea5428b8656c871c6dc0cc112/pkg/create/certificaterequest/certificaterequest.go", + "source_sha256": "sha256:0ba0c2d3d4f8530514c8d864b2a9e056f14f763a0b314aa05998f3169ee5bc32", + "tool_downloaded": false, + "tool_installed": false, + "tool_executed": false, + "signature_bundle_verified": false, + "local_cmctl_available": false, + "reviewed_line_numbers": [ + 59, + 66, + 81, + 82, + 88, + 90, + 92, + 93, + 95, + 96, + 98, + 99, + 101, + 102, + 104, + 105, + 116, + 118, + 120, + 122, + 142, + 150, + 215, + 217, + 219, + 222, + 234, + 334 + ], + "reviewed_behavior": { + "flags": "certificate template, private output path, public certificate output path, fetch and timeout", + "key_output": "local 0600 file is written before API creation", + "api_effect": "only a CertificateRequest create; not a Certificate or TLS Secret", + "certificate_output": "requested signed public certificate is saved locally at 0600", + "diagnostics": "local output paths are reported; raw operator diagnostics must not enter public receipts" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/current-public-leaf.pem b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/current-public-leaf.pem new file mode 100644 index 00000000..96a9d6e7 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/current-public-leaf.pem @@ -0,0 +1,29 @@ +-----BEGIN CERTIFICATE----- +MIIE/TCCA+WgAwIBAgISBmV+SgCgbd7gJ1RjLeus1fJGMA0GCSqGSIb3DQEBCwUA +MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD +EwNZUjEwHhcNMjYwOTI1MTc1NzIyWhcNMjYxMjI0MTc1NzIxWjAcMRowGAYDVQQD +ExFrYy5jb3Vsb21iLnNvY2lhbDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC +ggEBALugU1hh+5AA1zly/E9LE0BJhm+XqQqzPLx2RtT1KhnZS+NPbxCHwp8sqbzX +XGJztn0sLTWRpUk/lBeucBspBFHDD90QKAsuvpUffZMImfcDX4VkAyDtHts4tPg0 +U7IH2QsooWihkpyQuzoBIQeufojX3QdCIbhjdC9VanygkKCftUo/wNk356n6YAuv +TmffePvhppw166aBSSV/QKxMhXcUp14pDOR/1M8uRjGXItjFhEBZpje/ZOqMH2cG +X6mYUK/w/RoZJtME4ZAQ2c5zbJDbAn3ooioKLIgScrk/mDzuU5oRNWXVJSKsD5MK +tLqi5689z6hZq9DLJg8HoezNWqcCAwEAAaOCAiAwggIcMA4GA1UdDwEB/wQEAwIF +oDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBQW +Fd3HF2Hldj0Y7Zmp81E1LzQIXDAfBgNVHSMEGDAWgBQfLzW+RhSCzUCxrnksVXj6 +99Ro+zAzBggrBgEFBQcBAQQnMCUwIwYIKwYBBQUHMAKGF2h0dHA6Ly95cjEuaS5s +ZW5jci5vcmcvMBwGA1UdEQQVMBOCEWtjLmNvdWxvbWIuc29jaWFsMBMGA1UdIAQM +MAowCAYGZ4EMAQIBMC4GA1UdHwQnMCUwI6AhoB+GHWh0dHA6Ly95cjEuYy5sZW5j +ci5vcmcvNzEuY3JsMIIBDQYKKwYBBAHWeQIEAgSB/gSB+wD5AHcAr2eIO1ewTt2P +ptl+9i6o64EKx3Fg8CReVdYML+eFhzoAAAGg2eyIzAAABAMASDBGAiEA2WamiKud +XhSQjD88kkUTS8zhWqV9YyPkreU9jRI0vdQCIQD1iAb8ekWAArxPPh/SUpoMknpJ +/yl16SXko3Ne0c4NsAB+ABqLnWsP/r+BtHk5xtIxCobW0QLU8EbiGCyd419eJiXv +AAABoNnsjB0ACAAABQBFJglkBAMARzBFAiBGdDneKdJfaBAgYLcnRriQDF1YArO3 +YXFpmtvwsc5mPQIhAJOgFR0Jb0miJeAQ8KTFPxp2M3X397TdpnlVT4CnSjCaMA0G +CSqGSIb3DQEBCwUAA4IBAQCcqZbf+vx7viZDVOZI+2L8TPpKN86jbCd+0s9QwIPN +PEadm/1YPcorGcQi1F5jmRpgRStVpoJOz1LV/Ww8we3Y4boVp5l2B32GkWg05uFb +h/9bjhVHGrNBVpz1tPFBNXnG0Vxw+YMtb0h5tNeECRVuDce6q8LHXHuts27Uu2Kg +nZabfD0VpxW0+V+NN9aHcuXsGL/NHhVjTH7pQL5z8kOnhG/DzDYaRFAma7HVyQ9Y +LL/Eadr2f8wSi+H/CV60vedlzeUMmgBombcpS59VbcTcv8Z7j3hm7zaQZPRo1o8z +cg4ItufoP3ZpNMghgKEvKmA94rVtsGKsGLK1aIJ/Ntut +-----END CERTIFICATE----- diff --git a/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/current-verified-public-chain.pem b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/current-verified-public-chain.pem new file mode 100644 index 00000000..1290e287 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/current-verified-public-chain.pem @@ -0,0 +1,122 @@ +-----BEGIN CERTIFICATE----- +MIIE/TCCA+WgAwIBAgISBmV+SgCgbd7gJ1RjLeus1fJGMA0GCSqGSIb3DQEBCwUA +MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD +EwNZUjEwHhcNMjYwOTI1MTc1NzIyWhcNMjYxMjI0MTc1NzIxWjAcMRowGAYDVQQD +ExFrYy5jb3Vsb21iLnNvY2lhbDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC +ggEBALugU1hh+5AA1zly/E9LE0BJhm+XqQqzPLx2RtT1KhnZS+NPbxCHwp8sqbzX +XGJztn0sLTWRpUk/lBeucBspBFHDD90QKAsuvpUffZMImfcDX4VkAyDtHts4tPg0 +U7IH2QsooWihkpyQuzoBIQeufojX3QdCIbhjdC9VanygkKCftUo/wNk356n6YAuv +TmffePvhppw166aBSSV/QKxMhXcUp14pDOR/1M8uRjGXItjFhEBZpje/ZOqMH2cG +X6mYUK/w/RoZJtME4ZAQ2c5zbJDbAn3ooioKLIgScrk/mDzuU5oRNWXVJSKsD5MK +tLqi5689z6hZq9DLJg8HoezNWqcCAwEAAaOCAiAwggIcMA4GA1UdDwEB/wQEAwIF +oDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBQW +Fd3HF2Hldj0Y7Zmp81E1LzQIXDAfBgNVHSMEGDAWgBQfLzW+RhSCzUCxrnksVXj6 +99Ro+zAzBggrBgEFBQcBAQQnMCUwIwYIKwYBBQUHMAKGF2h0dHA6Ly95cjEuaS5s +ZW5jci5vcmcvMBwGA1UdEQQVMBOCEWtjLmNvdWxvbWIuc29jaWFsMBMGA1UdIAQM +MAowCAYGZ4EMAQIBMC4GA1UdHwQnMCUwI6AhoB+GHWh0dHA6Ly95cjEuYy5sZW5j +ci5vcmcvNzEuY3JsMIIBDQYKKwYBBAHWeQIEAgSB/gSB+wD5AHcAr2eIO1ewTt2P +ptl+9i6o64EKx3Fg8CReVdYML+eFhzoAAAGg2eyIzAAABAMASDBGAiEA2WamiKud +XhSQjD88kkUTS8zhWqV9YyPkreU9jRI0vdQCIQD1iAb8ekWAArxPPh/SUpoMknpJ +/yl16SXko3Ne0c4NsAB+ABqLnWsP/r+BtHk5xtIxCobW0QLU8EbiGCyd419eJiXv +AAABoNnsjB0ACAAABQBFJglkBAMARzBFAiBGdDneKdJfaBAgYLcnRriQDF1YArO3 +YXFpmtvwsc5mPQIhAJOgFR0Jb0miJeAQ8KTFPxp2M3X397TdpnlVT4CnSjCaMA0G +CSqGSIb3DQEBCwUAA4IBAQCcqZbf+vx7viZDVOZI+2L8TPpKN86jbCd+0s9QwIPN +PEadm/1YPcorGcQi1F5jmRpgRStVpoJOz1LV/Ww8we3Y4boVp5l2B32GkWg05uFb +h/9bjhVHGrNBVpz1tPFBNXnG0Vxw+YMtb0h5tNeECRVuDce6q8LHXHuts27Uu2Kg +nZabfD0VpxW0+V+NN9aHcuXsGL/NHhVjTH7pQL5z8kOnhG/DzDYaRFAma7HVyQ9Y +LL/Eadr2f8wSi+H/CV60vedlzeUMmgBombcpS59VbcTcv8Z7j3hm7zaQZPRo1o8z +cg4ItufoP3ZpNMghgKEvKmA94rVtsGKsGLK1aIJ/Ntut +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIE2zCCAsOgAwIBAgIRAKICU/FfJpHAXcHOE7m8yk4wDQYJKoZIhvcNAQELBQAw +LjELMAkGA1UEBhMCVVMxDTALBgNVBAoTBElTUkcxEDAOBgNVBAMTB1Jvb3QgWVIw +HhcNMjUwOTAzMDAwMDAwWhcNMjgwOTAyMjM1OTU5WjAzMQswCQYDVQQGEwJVUzEW +MBQGA1UEChMNTGV0J3MgRW5jcnlwdDEMMAoGA1UEAxMDWVIxMIIBIjANBgkqhkiG +9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoVi8X2xCYgMXvJxNPKp/oF13UMgmPABB07VC +LNDtoXmt9luEZNJSBV10VyT1Pz6LD8Zq1d2gc43WNl1AdRrj4sEnazbOiz0nPpmG +Bp2hui49oZtDIY6wdKeZAi5BbNU20CH6RSBBMLSQ9cXrH8dxdv4PAJ45ssGML68U +SE3BsjC2a6cAN9L5CgXVIQi5tfNiTPoFZZ3S0OlXqLmmtdV95udWAb5b6e/F49Di +CsH0Y00Ag72BVIb1hzynmKe+X0mERBTtsb3BwmpV9ipeBjMLoR/D9cHxHQCWoi5l +TmXwY015J5rGelz1nZjJuxc2kioaX29XJBnhMkP531rSdG5uMwIDAQABo4HuMIHr +MA4GA1UdDwEB/wQEAwIBhjATBgNVHSUEDDAKBggrBgEFBQcDATASBgNVHRMBAf8E +CDAGAQH/AgEAMB0GA1UdDgQWBBQfLzW+RhSCzUCxrnksVXj699Ro+zAfBgNVHSME +GDAWgBTe51tg0CJtQCh9Pw0B/qS1UrRRlDAyBggrBgEFBQcBAQQmMCQwIgYIKwYB +BQUHMAKGFmh0dHA6Ly95ci5pLmxlbmNyLm9yZy8wEwYDVR0gBAwwCjAIBgZngQwB +AgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3lyLmMubGVuY3Iub3JnLzANBgkq +hkiG9w0BAQsFAAOCAgEA0+zvMq3kHig1ddTmmm+RibTr9/RpX7k4buanMMRqbV/y +IvP82zAHN3mvaw+cASuVsdpd0ikjhr4hnhJQLQOzOp2ccKrsdGOAgo0vddeISFAq +EWEV4lmUM3vFF796up+bSgmJ1u6RupDCMxDgF8M3eLvGuj6L0lu3zkQ0KuQLnKxL +tB0oQqn1Idg5CuuGpMvQzk29Pa3D/qHurc0EIM9SxukQuJqq63lxsYyRQFU8yMBO +hq1w5LbfaWNRrz1uklOfI/pYkAb2E2MTZrAMQkBIE2S8Jt1F8gRc96o/xOsrgvSk +a84AisX6xq1lz1Z7jGvrnXc4TMcjxZTjiTaihcYI1JIXZiLtEMSCa5l3cu8YWd6z +dLRQlqRdclVjuQfNHawRJ6GWlkK0QJosivTKwdBw3KxEtzGo8yMHERbsy57gP1UX +HOMcmZYQC0gtyR3SxfenIM/MxC3Ia2Ypab/kQ/CTnlIn2KQ5JUC6NYrGCbhFN9bp +5lKJStEwCUnLpntcrXk5XVDCNv/5RyWpRThkGOV7GetKkQ0qAY8hCzWK6oqnAhDZ +cjlYVdWfqOw3DIOX6EDNBgAqHarRVxyF9QZdOaXSyPJ0ueD2BYJEBgaCGQ8rAaU/ +Qc123V5LTXDZW4CcsPBDyhy4v+c8hClAyw/IkJlfBqxB9D+/wvIMHgECZ4ptP6o= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIF9DCCA9ygAwIBAgIRAPJLbRf52a18scn+p4eCaZ8wDQYJKoZIhvcNAQELBQAw +TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh +cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjYwNTEzMDAwMDAw +WhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQ +MA4GA1UEAxMHUm9vdCBZUjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB +ANvGJnN78CTJdWL3+eGfsLN5TrNBJs+VH9hRXqRbwxu9sGNiB0BD1fcOxbSUQCJI +M1xE13Db+5Cw1w0s0EBYsvuIP/6joF0w8cuImbgR1OGgYbSQ4OpzI+DG8SGuTlcE +873OCS+kh3srlo6vl43M5OJg4Aeo1sfHp6kTJDoIiFBNJAY+OKfX/FUvYKuhjT+n +o49lmqmupSBI5PkBQiqrEGtWU5uxU/cQWHGu8jSjFBznZqvbNPLMXMLFxCb3WTfr +JBXXjqvWG+v4bjzxjjeAtOlU7qarRDvNOyAuQYLln904M+faKx8hnLCpJ15ZqaEg +cNlY+9MMWcC5yvL2A2j3l9+2buggZX+dOE91zYmIdawTvSZuVvlbRrAlLxIB6pwM +BjneXCjYQ8+3BCCjssbSNpZU3hTcBDdhfAlEDlYr6pEatnMdmDT5BqnKC92bd0Eh +M1fbLHioLccLCuievT8ZkPhZrq7Mii7gNXAcUEAR8+lzYal+9zTg7C5DALyVOeG/ +CqfRAMn1KSHCR0NSA6P8tn/mGRlnCct5rtVCLnVySVpU6H1qGg3DgTOuskf8eahT +MiYbI5ezPJmO5ertalskQ1utp74+eDy92PI4ftHKTbq9IWhH4YZKh3WnJEIt+oQv +lYZbY8tpEroKrFB6PFGzrJIDRyts4HqvuH52RFj2zv/BAgMBAAGjgeswgegwDgYD +VR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMB +Af8wHQYDVR0OBBYEFN7nW2DQIm1AKH0/DQH+pLVStFGUMB8GA1UdIwQYMBaAFHm0 +WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYW +aHR0cDovL3gxLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNV +HR8EIDAeMBygGqAYhhZodHRwOi8veDEuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEB +CwUAA4ICAQA8spSI95KKfn2W6GMmDpHBJSPaLbsS3W93cijJCRCYAc1fsJgL1FIL +7C0C9ecPOdcwB2fi0Dk2p94j9iTJCxmt5CFSKLRWwnXT2MMSXexVxqoVB79BdWPx +VXETkVme/qYSAuKVHh5Ps+5BixgmwS1JkjSAc+MfrUbNssVEEnH0aEiAh+rotXAV +JSP/Ye7LJPEwD9DWG72vVWbhAcuOf5OLjz57Ctk7MgQHynZ7+PlHJtajroCaIbtC +r6tcZZaAwUQm+jQyeWdV+2hv9deOYFmKeQyjjcSrN5Nadrw+L9DZJLbA1HqeNvLh +BgqpP0fvJq2N6EtD574N6eMI7uMsJTnji2UDz9el5XLSv9fqJMuDQtYVb2oTNoKp +oUqhxPVC0aq4eG5MESaIdn8b5ZGSSeAJLMHXljEdlNza+ncfkviXk1POLnnFdvx8 +/gk6M374WbLWFXw8N141B/Rl/tINGfl1TxOIiqtiMYkL02RSGb1kq34BL9NPP27z +RGMuHGnzS3hFIrRTfKxrzUZ9RzQWzEG3K6fJ3r2nqSltkeytis9DIBoFY9VmVyjL +M71DMi+y1+TRSJVClEMwvA4yL++7q9XZx5r5wBRWB4kQTKH5qyoZnDw7iiuh1lID +yDFx8r7i9vIJU5HS3moZLkYWAOilMaV9N56A9Bgb6dNcHkvg3NoaYA== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw +TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh +cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4 +WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu +ZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY +MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc +h77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+ +0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U +A5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW +T8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH +B5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC +B5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv +KBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn +OlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn +jh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw +qHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI +rU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV +HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq +hkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL +ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ +3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK +NFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5 +ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur +TkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC +jNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc +oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq +4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA +mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d +emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc= +-----END CERTIFICATE----- diff --git a/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/existing-validator-fixture.json b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/existing-validator-fixture.json new file mode 100644 index 00000000..00f6c08c --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/existing-validator-fixture.json @@ -0,0 +1,27 @@ +{ + "status": "three_bounded_metadata_checks_passed", + "observed_at": "2026-10-17T02:30:31.911305+00:00", + "validator_sha256": "sha256:5098bdfa4e0ad30627c1716e5e355a2c78dca6ccc607bd2148a2e06126632288", + "fixture_factory": "tests/test_prepare_isolated_keycape.py:PreparationTests.setUp", + "checks": [ + { + "case": "independent_per_attempt_leaf_hash", + "tls_cert_sha256": "sha256:35faa755b30380ae381676b5cbb1780ba67ab552fa07e44844da8f028f4ca754", + "metadata_admitted": true + }, + { + "case": "independent_per_attempt_leaf_hash", + "tls_cert_sha256": "sha256:74c0fff5a618a12d71e7c78d97dc12ae6d509b276ed2a254a6303b7694c26744", + "metadata_admitted": true + }, + { + "case": "missing_leaf_hash", + "refused_before_source_or_private_content_read": true + } + ], + "limit": "Synthetic digest strings only; proves metadata preflight does not compare against an archived TLS leaf pin. It proves no certificate/key/CA validity, owner assent, issuance, decryption, native issuer or consumer result. Existing private/runtime TLS verification remains required.", + "actual_archive_content_read": false, + "private_key_created_or_read": false, + "provider_calls": false, + "canonical_test_added": false +} diff --git a/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/independent-system-trust-anchor.pem b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/independent-system-trust-anchor.pem new file mode 100644 index 00000000..b85c8037 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/independent-system-trust-anchor.pem @@ -0,0 +1,31 @@ +-----BEGIN CERTIFICATE----- +MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw +TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh +cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4 +WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu +ZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY +MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc +h77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+ +0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U +A5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW +T8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH +B5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC +B5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv +KBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn +OlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn +jh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw +qHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI +rU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV +HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq +hkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL +ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ +3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK +NFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5 +ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur +TkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC +jNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc +oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq +4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA +mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d +emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc= +-----END CERTIFICATE----- diff --git a/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/live-public-resource-observations.json b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/live-public-resource-observations.json new file mode 100644 index 00000000..6eed6437 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/live-public-resource-observations.json @@ -0,0 +1,98 @@ +{ + "status": "read_only_public_projection_not_owner_assent", + "secret_objects_requested": false, + "queries": [ + { + "observed_at": "2026-10-17T02:28:03.932075+00:00", + "argv": [ + "kubectl", + "get", + "nodes", + "-o", + "jsonpath={range .items[*]}{.metadata.name}{\" \"}{range .status.addresses[*]}{.type}{\"=\"}{.address}{\" \"}{end}{\"\\n\"}{end}" + ], + "projected_public_metadata": "239.62.205.92.host.secureserver.net InternalIP=92.205.62.239 InternalIP=2a00:1169:111:6d70:: Hostname=239.62.205.92.host.secureserver.net \n" + }, + { + "observed_at": "2026-10-17T02:28:04.186302+00:00", + "argv": [ + "kubectl", + "-n", + "sso", + "get", + "certificate", + "kc-tls", + "-o", + "jsonpath={.metadata.name}{\"\\n\"}{.metadata.uid}{\"\\n\"}{.metadata.ownerReferences}{\"\\n\"}{.spec}{\"\\n\"}{.status.conditions}{\"\\n\"}{.status.notBefore}{\"\\n\"}{.status.notAfter}{\"\\n\"}{.status.renewalTime}{\"\\n\"}{.status.revision}{\"\\n\"}" + ], + "projected_public_metadata": "kc-tls\ne3ad7140-0ba2-4e5a-b2f7-87dd453d5828\n[{\"apiVersion\":\"networking.k8s.io/v1\",\"blockOwnerDeletion\":true,\"controller\":true,\"kind\":\"Ingress\",\"name\":\"keycape\",\"uid\":\"52625ec1-429d-4041-b54c-d3bb92a87cb6\"}]\n{\"dnsNames\":[\"kc.coulomb.social\"],\"issuerRef\":{\"group\":\"cert-manager.io\",\"kind\":\"ClusterIssuer\",\"name\":\"letsencrypt-prod\"},\"secretName\":\"kc-tls\",\"usages\":[\"digital signature\",\"key encipherment\"]}\n[{\"lastTransitionTime\":\"2026-03-25T00:44:13Z\",\"message\":\"Certificate is up to date and has not expired\",\"observedGeneration\":1,\"reason\":\"Ready\",\"status\":\"True\",\"type\":\"Ready\"}]\n2026-09-25T17:57:22Z\n2026-12-24T17:57:21Z\n2026-11-24T17:57:21Z\n4\n" + }, + { + "observed_at": "2026-10-17T02:28:04.435984+00:00", + "argv": [ + "kubectl", + "get", + "clusterissuer", + "letsencrypt-prod", + "-o", + "jsonpath={.metadata.name}{\"\\n\"}{.spec.acme.server}{\"\\n\"}{.spec.acme.privateKeySecretRef.name}{\"\\n\"}{.spec.acme.solvers}{\"\\n\"}{.status.conditions}{\"\\n\"}{range .metadata.managedFields[*]}{.manager}{\" \"}{.operation}{\" \"}{.time}{\"\\n\"}{end}" + ], + "projected_public_metadata": "letsencrypt-prod\nhttps://acme-v02.api.letsencrypt.org/directory\nletsencrypt-prod-account-key\n[{\"http01\":{\"ingress\":{\"ingressClassName\":\"traefik\"}}}]\n[{\"lastTransitionTime\":\"2026-07-16T09:55:24Z\",\"message\":\"The ACME account was registered with the ACME server\",\"observedGeneration\":1,\"reason\":\"ACMEAccountRegistered\",\"status\":\"True\",\"type\":\"Ready\"}]\nkubectl-client-side-apply Update 2026-03-25T00:12:32Z\ncert-manager-clusterissuers Update 2026-07-16T09:55:24Z\n" + }, + { + "observed_at": "2026-10-17T02:28:04.686322+00:00", + "argv": [ + "kubectl", + "-n", + "sso", + "get", + "ingress", + "keycape", + "-o", + "jsonpath={.spec}{\"\\n\"}{.metadata.annotations.argocd\\.argoproj\\.io/tracking-id}{\"\\n\"}{.status.loadBalancer}{\"\\n\"}{range .metadata.managedFields[*]}{.manager}{\" \"}{.operation}{\" \"}{.time}{\"\\n\"}{end}" + ], + "projected_public_metadata": "{\"ingressClassName\":\"traefik\",\"rules\":[{\"host\":\"kc.coulomb.social\",\"http\":{\"paths\":[{\"backend\":{\"service\":{\"name\":\"keycape\",\"port\":{\"number\":8080}}},\"path\":\"/\",\"pathType\":\"Prefix\"}]}}],\"tls\":[{\"hosts\":[\"kc.coulomb.social\"],\"secretName\":\"kc-tls\"}]}\n\n{\"ingress\":[{\"ip\":\"92.205.62.239\"}]}\nkubectl-client-side-apply Update 2026-03-25T00:37:10Z\ntraefik Update 2026-03-25T00:37:10Z\n" + }, + { + "observed_at": "2026-10-17T02:28:04.941740+00:00", + "argv": [ + "kubectl", + "-n", + "cert-manager", + "get", + "deployment", + "cert-manager", + "-o", + "jsonpath={range .spec.template.spec.containers[*]}{.name}{\" \"}{.image}{\"\\n\"}{end}{.spec.template.spec.containers[0].args}{\"\\n\"}" + ], + "projected_public_metadata": "cert-manager-controller quay.io/jetstack/cert-manager-controller:v1.18.2\n[\"--v=2\",\"--cluster-resource-namespace=$(POD_NAMESPACE)\",\"--leader-election-namespace=kube-system\",\"--acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.18.2\",\"--max-concurrent-challenges=60\",\"--acme-http01-solver-nameservers=1.1.1.1:53\"]\n" + }, + { + "observed_at": "2026-10-17T02:28:05.195086+00:00", + "argv": [ + "kubectl", + "-n", + "sso", + "get", + "networkpolicy", + "allow-traefik-to-acme-solver", + "-o", + "jsonpath={.spec}{\"\\n\"}" + ], + "projected_public_metadata": "{\"ingress\":[{\"from\":[{\"namespaceSelector\":{\"matchLabels\":{\"kubernetes.io/metadata.name\":\"kube-system\"}},\"podSelector\":{\"matchLabels\":{\"app.kubernetes.io/name\":\"traefik\"}}}],\"ports\":[{\"port\":8089,\"protocol\":\"TCP\"}]}],\"podSelector\":{\"matchLabels\":{\"acme.cert-manager.io/http01-solver\":\"true\"}},\"policyTypes\":[\"Ingress\"]}\n" + }, + { + "observed_at": "2026-10-17T02:28:05.607183+00:00", + "argv": [ + "kubectl", + "-n", + "argocd", + "get", + "applications.argoproj.io", + "-o", + "jsonpath={range .items[*]}{.metadata.name}{\" \"}{.spec.source.path}{\" \"}{.spec.destination.namespace}{\"\\n\"}{end}" + ], + "projected_public_metadata": "activity-core k8s/gitops activity-core\nbao-notice argocd/platform-addons/bao-notice bao-notice\neso-token-renewer argocd/platform-addons/eso-token-renewer external-secrets\ninformed-decision deploy/lifecycle informed-decision\ninformed-decision-requester argocd/platform-addons/informed-decision-requester informed-decision\nopenbao-secretstore argocd/platform-addons/openbao-secretstore external-secrets\nrailiance-apps-root argocd/railiance01/applications argocd\nsecret-annotation-guard argocd/platform-addons/secret-annotation-guard default\nstate-hub-memo-dispatch deploy/informed-decision state-hub\ntarget-revenue k8s/railiance target-revenue\n" + } + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/manifest.json b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/manifest.json new file mode 100644 index 00000000..098b62de --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/manifest.json @@ -0,0 +1,28 @@ +{ + "schema": "custodian.tls-recovery-disposition.v1", + "created_at": "2026-10-17T02:32:35.568494+00:00", + "proposal_id": "nk49-tls-standalone-reissue-20261017", + "revision": 1, + "proposal_sha256": "sha256:377f33dee19eeb5e8c70c5c22b029f32e9b9f6e72dde8071bbcd406d99966b75", + "status": "source_prepared_not_executed_not_approved", + "files": { + "README.md": "sha256:990b5ef9f0eeab6e0fc1cbc9713ae234642a9cb86230b6aaa202e67960b724af", + "cmctl-primary-source.json": "sha256:df27782314e0982f6cb66a7c86286d0b879535b3f3870fe4ea4fa1d1d9d04399", + "current-public-leaf.pem": "sha256:e43bbfb97c294ef235082316e39bbfb5377d86025eb4324b4115f2a9048e9e5d", + "current-verified-public-chain.pem": "sha256:17d78ed170cd64eef01693eb65a7a197c7068297f23b565c3e28159b1f000b0b", + "existing-validator-fixture.json": "sha256:7998d41ecda1f7dcd4deae9fac9c966aa182f4fb397202ec09106087564d1bb4", + "independent-system-trust-anchor.pem": "sha256:22b557a27055b33606b6559f37703928d3e4ad79f110b407d04986e1843543d1", + "live-public-resource-observations.json": "sha256:30bb6f24a8a465e6f33309272b99f83106603b3d05d7452321a5047b52d35e67", + "owner-doc-task-proposal.patch": "sha256:f9a92d3f6d341996537fff08fac3a83cc4d14ec0e6d2fb2af41e0955147ef175", + "postimages/docs/keycape-tls-recovery-boundary.md": "sha256:4b2359ae59fde016188d776bafb928700171d8f337cc927af8b8d66cfedc6bf8", + "postimages/workplans/RCLUSTER-WP-0018-keycape-original-tls-recovery.md": "sha256:de60c6a2b48f853d7f91eef233a6795561e79770d07af2fd792c66142de9e28b", + "preimages/docs/keycape-tls-recovery-boundary.md": "sha256:f4bcb1d1832c566f9c87793ed2a461c8cd8a00859dc4ae66cd3c160d7ceefa70", + "preimages/workplans/RCLUSTER-WP-0018-keycape-original-tls-recovery.md": "sha256:96d52b6dbae056399159632d50b32ccc6662e4f6d3677af154f7c8a3d618334b", + "primary-source-references.json": "sha256:d347abb545d1bdbdf729bc414787830bc7761ced600569c84b95447fcc5e474b", + "public-tls-observation.json": "sha256:f1199720b2fb02d53eb8c6bdc92701465f36fd295d1fc297ec38c31b60d4e4a6", + "reissue-certificate.template.yaml": "sha256:8a31b39b52e3f711e9e6584c2ad31ba23937eac61741fc252ce83e47a990bd3f", + "reissue-command-proposal.json": "sha256:377f33dee19eeb5e8c70c5c22b029f32e9b9f6e72dde8071bbcd406d99966b75", + "review.json": "sha256:229437f92a00c15fa31abb5764993fd4282207e91495cbda2759b7d65c9bf4b9", + "source-references.json": "sha256:2e99e41ee03a56089395ff6bcd289e5f0f46f0b5d4d6fe05f40f5b5763a4c88d" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/owner-doc-task-proposal.patch b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/owner-doc-task-proposal.patch new file mode 100644 index 00000000..c6ea853b --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/owner-doc-task-proposal.patch @@ -0,0 +1,104 @@ +--- a/docs/keycape-tls-recovery-boundary.md ++++ b/docs/keycape-tls-recovery-boundary.md +@@ -49,3 +49,55 @@ + scoped capture/read permissions, retention and native verification. Merely adding + `kc-tls` to secret_refs would change capture/permission/custody scope and is not + authorized by this source review. It cannot repair the current archive retroactively. ++ ++## Renewable TLS leaf and original OIDC signing identity ++ ++The archived KeyCape RS256 signing key, issuer URL, service registrations and ++policy state are distinct from the public HTTPS leaf and its TLS private key. ++The current identity archive has no ingress TLS leaf to compare. A separately ++reviewed trusted reissue can preserve kc.coulomb.social and the archived OIDC ++signing identity without reproducing historical TLS leaf/key bytes. This is an ++explicit owner continuity disposition under NK49-T35, not implicit permission ++to replace custody, trust or an outage claim. ++ ++The existing isolated admission pins the exact certificate-chain and trust PEM ++bytes selected for that attempt; it does not compare them with an archived leaf ++fingerprint. Those hashes, certificate/key pairing, hostname/CA/validity checks, ++archived issuer equality and original signer/JWKS verification remain required. ++The receipt's original HTTPS issuer/trust wording does not assert original leaf ++byte equality. The selected consumer owner must separately disposition any ++consumer-specific certificate/key pin; normal source-selector correspondence ++alone is not current consumer assent. ++ ++Current source and public resource inventory establish a concrete standard path: ++ClusterIssuer/letsencrypt-prod uses ACME HTTP-01 with Traefik. Upstream cmctl ++create certificaterequest can generate a dedicated TLS key locally, send only a ++public CSR to that existing issuer and return the signed certificate locally, ++without reading or replacing sso/kc-tls. This creates a new public request and ++normal temporary ACME resources and requires separate actual owner/founder ++live authority. A Certificate YAML used as cmctl input is a local template, not ++an apply of a Certificate or Secret. No issuance occurred in this source work. ++ ++The reviewed candidate is cmctl v2.6.1 Linux amd64, published checksum ++sha256:0af054c26a2b64ce286fa868d029164867695a93c3eb893662ce16f35e708db0, ++source commit 7e56321dbec4f62ea5428b8656c871c6dc0cc112. It is not installed or ++admitted by this document; signature-bundle verification remains unperformed. ++Its key file is written before API submission, so protected tmpfs staging and ++independent cleanup must precede invocation. T03 must admit the existing session ++staging/reaper adaptation for that earlier networked child, with success, ++refusal, timeout and parent-loss proof; a shell trap alone is insufficient. ++ ++This is a supported candidate for a standalone drill while the cluster, DNS, ++external HTTP-01 port 80, Traefik, cert-manager and ACME provider are available. ++It proves no independence during cluster loss. Do not switch to DNS-01 or a new ++provider, read an account key, delete the production Secret or call a surviving- ++cluster reissue an independent cluster-loss recovery. T02/T03/T04 retain that ++actual independent custody/provider/domain-control and native acceptance scope. ++ ++Timestamped current public Certificate/issuer/controller/solver metadata, public ++CA/hostname observation, source hashes, upstream contract and exact unexecuted ++command/lifecycle proposal are retained in Custodian ++`docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/`. ++This source inventory is neither historical original-key custody nor owner ++acceptance of reissue; T35 requires the explicit reviewed disposition before ++T33 can bind the selected TLS material to an actual owner-held attempt. +--- a/workplans/RCLUSTER-WP-0018-keycape-original-tls-recovery.md ++++ b/workplans/RCLUSTER-WP-0018-keycape-original-tls-recovery.md +@@ -143,6 +143,43 @@ + the future contract requirement has an exact tracked disposition/handoff; it is + not proof of current archive coverage or actual future capture. + ++## Inventory standard TLS lifecycle and separate transport renewal invariants ++ ++```task ++id: RCLUSTER-WP-0018-T06 ++status: done ++priority: high ++assignee: codex ++``` ++ ++Completed 2026-10-17 as bounded source/public-metadata preparation. Inspected the ++existing issuer/ingress source and timestamped public Certificate, ClusterIssuer, ++controller and solver-network metadata on the verified 92.205.62.239 node. The ++current public endpoint passed ordinary independent system-CA/hostname validation; ++public leaf/chain/anchor metadata was retained without any Secret or key access. ++ ++Established the existing standard cmctl CertificateRequest path and exact v2.6.1 ++upstream source/checksum: key material stays local, only a public CSR is submitted, ++and production kc-tls need not be read, renewed or replaced. The utility remains ++absent/unadmitted locally and was not downloaded/executed. Existing-validator ++fixtures accept two independent synthetic per-attempt leaf hashes and refuse a ++missing hash before content access. This is metadata correspondence, not public ++CA/key/native proof. No permanent mirror tests or runtime policy field was added. ++ ++The completed inventory is extracted from T02's source discovery. T02 retains ++actual independent original custody/provider metadata or an explicitly reviewed ++reissue/continuity disposition. T03 retains exact admitted tool, private tmpfs ++staging/child/request cleanup preparation and generated failure/parent-loss proof; ++T04 retains separately authorized native recovery/acceptance. A standalone drill ++using a surviving cluster cannot close the cluster-loss independence claim. ++No original TLS custody, reissue assent, human approval, private key generation, ++certificate request, production mutation, token exchange or rotation occurred. ++ ++Evidence: Custodian ++`docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/`. ++Canonical owner publication/normal missing-UUID allocation and Hub projection ++remain separate; no UUID is supplied by this prepared source task. ++ + ## Coordination and completion + + Beneficiary NK-WP-0049-T35/CUST-WP-0080 remains linked to this obligor record by diff --git a/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/postimages/docs/keycape-tls-recovery-boundary.md b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/postimages/docs/keycape-tls-recovery-boundary.md new file mode 100644 index 00000000..6dbfe04b --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/postimages/docs/keycape-tls-recovery-boundary.md @@ -0,0 +1,103 @@ +# Original KeyCape TLS recovery boundary + +Source disposition, 2026-10-17, scoped to railiance-cluster INTENT: cluster runtime, +ingress/certificate plumbing and backup posture. This is source preparation only. +It is not native acceptance, an issuer/key custody assent, a reissue decision or +permission to mutate the cluster. + +NetKingdom's ingress source names `kc.coulomb.social`, `sso/kc-tls`, +`ClusterIssuer/letsencrypt-prod` and Traefik termination before KeyCape8080. +NetKingdom owns that namespace intent; railiance-cluster owns cert-manager, +ingress controller and cluster backup posture. No inspected source establishes +who independently holds the original private TLS recovery material when the +ordinary issuer/cluster is unavailable. A missing exact routing-catalog entry +cannot prove absence of an owning subsystem. + +The identity archive excludes `kc-tls`. Current S2 backup source encrypts SQLite +state, Helm values and kubeconfig to the same host's `/opt/backup/railiance/cluster` +and retains seven versions. No inspected source proves an actually fresh, +independent offsite object or original certificate/key/trust recovery. Archived +RAIL-BS-WP-0004 is historical local-backup delivery; backlog RCLUSTER-WP-0007-T05 +is gated HA issuance/renewal; active RCLUSTER-WP-0017 is signer runtime/storage. +None is an existing live task for this original TLS recovery demand. + +`railiance-backup-s2` also stages raw state/Helm output in named `/tmp` paths +without early hard-loss cleanup; `railiance-restore-s2` prints whole-state restore +instructions. Do not use either as an isolated TLS extraction path. RCLUSTER-WP-0018 +tracks exact inventory, safe private staging/extraction preparation where required, +independent outage proof and future archive-boundary disposition. No original +ciphertext or historical outcome is rewritten by that work. + +`tools/public-tls-metadata.py` is an offline public-only step. After the source +owner identifies independent original **public certificate/chain and trust files**: + +```sh +python3 tools/public-tls-metadata.py --public-cert ORIGINAL_PUBLIC_CERT_CHAIN.pem --public-trust ORIGINAL_PUBLIC_TRUST.pem +``` + +It accepts no private-key argument, bounds regular-file reads, refuses symlinks and +non-certificate PEM material, and reports public hashes/SANs/validity/counts only. +The file names are owner-local placeholders, not a key request. Output establishes +public metadata, not originality, hostname/chain acceptance, reissue permission or +custody. Do not supply a Secret object or combined certificate/key PEM. Fail closed +when original source, trust or exact bindings are missing; no fresh self-signed +trust workaround is admitted. + +For FUTURE NetKingdom archives, the source owners must explicitly disposition +original TLS coverage or a reviewed reissue contract: producer/custody owner, +private artifact boundary, offline recovery independence, original public hashes, +scoped capture/read permissions, retention and native verification. Merely adding +`kc-tls` to secret_refs would change capture/permission/custody scope and is not +authorized by this source review. It cannot repair the current archive retroactively. + +## Renewable TLS leaf and original OIDC signing identity + +The archived KeyCape RS256 signing key, issuer URL, service registrations and +policy state are distinct from the public HTTPS leaf and its TLS private key. +The current identity archive has no ingress TLS leaf to compare. A separately +reviewed trusted reissue can preserve kc.coulomb.social and the archived OIDC +signing identity without reproducing historical TLS leaf/key bytes. This is an +explicit owner continuity disposition under NK49-T35, not implicit permission +to replace custody, trust or an outage claim. + +The existing isolated admission pins the exact certificate-chain and trust PEM +bytes selected for that attempt; it does not compare them with an archived leaf +fingerprint. Those hashes, certificate/key pairing, hostname/CA/validity checks, +archived issuer equality and original signer/JWKS verification remain required. +The receipt's original HTTPS issuer/trust wording does not assert original leaf +byte equality. The selected consumer owner must separately disposition any +consumer-specific certificate/key pin; normal source-selector correspondence +alone is not current consumer assent. + +Current source and public resource inventory establish a concrete standard path: +ClusterIssuer/letsencrypt-prod uses ACME HTTP-01 with Traefik. Upstream cmctl +create certificaterequest can generate a dedicated TLS key locally, send only a +public CSR to that existing issuer and return the signed certificate locally, +without reading or replacing sso/kc-tls. This creates a new public request and +normal temporary ACME resources and requires separate actual owner/founder +live authority. A Certificate YAML used as cmctl input is a local template, not +an apply of a Certificate or Secret. No issuance occurred in this source work. + +The reviewed candidate is cmctl v2.6.1 Linux amd64, published checksum +sha256:0af054c26a2b64ce286fa868d029164867695a93c3eb893662ce16f35e708db0, +source commit 7e56321dbec4f62ea5428b8656c871c6dc0cc112. It is not installed or +admitted by this document; signature-bundle verification remains unperformed. +Its key file is written before API submission, so protected tmpfs staging and +independent cleanup must precede invocation. T03 must admit the existing session +staging/reaper adaptation for that earlier networked child, with success, +refusal, timeout and parent-loss proof; a shell trap alone is insufficient. + +This is a supported candidate for a standalone drill while the cluster, DNS, +external HTTP-01 port 80, Traefik, cert-manager and ACME provider are available. +It proves no independence during cluster loss. Do not switch to DNS-01 or a new +provider, read an account key, delete the production Secret or call a surviving- +cluster reissue an independent cluster-loss recovery. T02/T03/T04 retain that +actual independent custody/provider/domain-control and native acceptance scope. + +Timestamped current public Certificate/issuer/controller/solver metadata, public +CA/hostname observation, source hashes, upstream contract and exact unexecuted +command/lifecycle proposal are retained in Custodian +`docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/`. +This source inventory is neither historical original-key custody nor owner +acceptance of reissue; T35 requires the explicit reviewed disposition before +T33 can bind the selected TLS material to an actual owner-held attempt. diff --git a/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/postimages/workplans/RCLUSTER-WP-0018-keycape-original-tls-recovery.md b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/postimages/workplans/RCLUSTER-WP-0018-keycape-original-tls-recovery.md new file mode 100644 index 00000000..14b54ae1 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/postimages/workplans/RCLUSTER-WP-0018-keycape-original-tls-recovery.md @@ -0,0 +1,189 @@ +--- +id: RCLUSTER-WP-0018 +type: workplan +title: "Establish original KeyCape TLS recovery and future archive boundary" +domain: financials +repo: railiance-cluster +status: active +owner: codex +topic_slug: railiance +created: "2026-10-17" +updated: "2026-10-17" +flavor: implementation +depends_on: [] +related: [CUST-WP-0080, NK-WP-0049, RCLUSTER-WP-0007, RCLUSTER-WP-0017] +state_hub_workstream_id: "e0a7813d-c916-5e49-84b2-5e5b30441891" +--- + +Required owner source work for NK-WP-0049-T35 and CUST-WP-0080 G08. Reviewed +against current INTENT/SCOPE, backup sources and existing work records; ready +means work can proceed, not privileged execute authority. This does not promote +HA/backlog work, reopen archived local backup delivery or duplicate signer0017. +Source-owner scope is certificate plumbing/backup posture; NetKingdom owns +namespace ingress, while exact original independent TLS custody remains to be +established. No secret read, reissue, live change or native assent occurred. + +## Record source boundary and public-only metadata preparation + +```task +id: RCLUSTER-WP-0018-T01 +status: done +priority: high +assignee: codex +state_hub_task_id: "7280193d-0d59-5b78-a2d3-96ebd127127f" +``` + +Completed 2026-10-17 as isolated source preparation. Independently reviewed the +17 public source references against current owner bytes, checked current owner +instructions/environment/supervision and existing plans, and recorded the exact +boundary in docs/keycape-tls-recovery-boundary.md. Prepared bounded public-only +certificate/trust metadata projection with generated-certificate tests; no actual +certificate/key read. Source integration/publication and task projection remain +separate receipts, not claimed by this completed preparation task. + +Evidence: the-custodian docs/changes/netkingdom-target-2026-10-16/ +recovery-owner-handoffs-r1/ and prior recovery-attempt-r1/t35-t36-source-next/. + +Publication return, 2026-10-17: normal owner source publication at +c562d7134c38679952a8ffd17a8a893a900aef0d was applied on primary/railiance01 +with expected and derived commits equal. Read-only source/remote/Hub proof +verified this workplan's five exact task ID/UUID/status bindings and three +internal dependency edges. Receipts are retained in the Custodian packet +docs/changes/netkingdom-target-2026-10-17/railiance-cluster-projection.json and +cluster-publication-readback.json. The later legitimate C23 lifecycle repair +at 26671d33600e218316d29c9cd020f115ebfb35b2 changed ready to active; active +is retained. This return records publication separately from the completed +source preparation above. Original TLS artifact/provider custody, extraction +and native admission remain T02–T05 obligations; publication proves no TLS +recovery, private-key custody or native acceptance. + +The whole maintenance pipeline's historical-row guard failed for three parent +rows while 15 task full-row hashes remained unchanged. STATE-WP-0095-T07 and +RMGR-WP-0019-T06 remain wait; neither publication nor this memo asserts full +historical-row preservation or restoration. The subsequent forward correction +restores the brief's committed content to its pre-accident version while restoring +the original staged/worktree change for its owner; history is not rewound. No legacy deep consistency fix is run by the correction. + +## Establish exact independent original TLS artifact and provider custody metadata + +```task +id: RCLUSTER-WP-0018-T02 +status: todo +priority: high +assignee: codex +state_hub_task_id: "90836435-917f-504c-a711-3f29ece348e3" +``` + +Next: identify the actual original sso/kc-tls custody owner and independent public +provenance through existing owner processes. Record artifact/provider, timestamp, +public certificate/trust hashes, private custody entry point and outage dependencies +without values. Source review cannot infer a fresh backup, original key coverage +or independent decryption custody from a local backup script. Use credential +routing before any later credential need; missing route is not proof of absence. +Done when exact independent recovery or an explicitly owned unavailable capability +is evidenced as metadata and a reviewed next action, with no guessed assent. + +## Prepare safe isolated original extraction or explicit reissue alternative + +```task +id: RCLUSTER-WP-0018-T03 +status: wait +priority: high +assignee: codex +depends_on: [RCLUSTER-WP-0018-T02] +blocking_reason: "Exact original artifact/provider/custody disposition is required before selecting extraction or reissue source." +state_hub_task_id: "5dfa9a3a-2639-5cf6-b0a4-13eef417d47a" +``` + +From T02, reuse the actual owner path to prepare an exact attended private-only +recovery command and full dependency/cleanup proof. Do not run whole-state restore +or expose raw state/Secret output. If existing backup staging is required, correct +only the needed path with bounded memory-only staging and early exact cleanup, +including error/parent-loss tests before use. Original recovery and accepted +reissue are distinct claims; no self-signed trust substitute, new broker or +implicit production action. Done when the exact source proposal, public metadata +preflight, negatives, timeout, abort and custody obligations are reviewed. + +## Verify admitted original TLS recovery through the actual owner boundary + +```task +id: RCLUSTER-WP-0018-T04 +status: wait +priority: high +assignee: codex +needs_human: true +depends_on: [RCLUSTER-WP-0018-T02, RCLUSTER-WP-0018-T03] +blocking_reason: "Await exact reviewed attended owner custody path and its existing scoped authority; no private input or native attempt requested yet." +state_hub_task_id: "021b07bb-65bc-5743-bac5-4294b4be74f6" +``` + +Only the actual admitted owner action can prove recovered certificate/key pairing, +original hostname/trust and independent outage operation, or the expressly accepted +reissue result. Retain exact source/artifact/target/identity/negative/cleanup receipts. +Human custody/authority gates are not worker wakeups. Source and historical local +backup proof never fill native assent. Return bounded public proof to NK49T35; +no production mutation, credential retrieval or approval is granted by this task. + +## Disposition original TLS coverage in the future identity archive contract + +```task +id: RCLUSTER-WP-0018-T05 +status: todo +priority: high +assignee: codex +state_hub_task_id: "5bc67a22-0991-5625-86a6-f749560d8a0e" +``` + +Next: deliver the source-owned requirement in docs/keycape-tls-recovery-boundary.md +to NetKingdom's existing contract process: original TLS custody or accepted reissue, +independent provider/key recovery, public identity hashes, scoped capture/read +permissions and verification/retention. Record named owner dependencies as live +work before closure. Do not append kc-tls to secret_refs, expand capture credentials +or rewrite a historical archive without those owner reviews/authority. Done when +the future contract requirement has an exact tracked disposition/handoff; it is +not proof of current archive coverage or actual future capture. + +## Inventory standard TLS lifecycle and separate transport renewal invariants + +```task +id: RCLUSTER-WP-0018-T06 +status: done +priority: high +assignee: codex +``` + +Completed 2026-10-17 as bounded source/public-metadata preparation. Inspected the +existing issuer/ingress source and timestamped public Certificate, ClusterIssuer, +controller and solver-network metadata on the verified 92.205.62.239 node. The +current public endpoint passed ordinary independent system-CA/hostname validation; +public leaf/chain/anchor metadata was retained without any Secret or key access. + +Established the existing standard cmctl CertificateRequest path and exact v2.6.1 +upstream source/checksum: key material stays local, only a public CSR is submitted, +and production kc-tls need not be read, renewed or replaced. The utility remains +absent/unadmitted locally and was not downloaded/executed. Existing-validator +fixtures accept two independent synthetic per-attempt leaf hashes and refuse a +missing hash before content access. This is metadata correspondence, not public +CA/key/native proof. No permanent mirror tests or runtime policy field was added. + +The completed inventory is extracted from T02's source discovery. T02 retains +actual independent original custody/provider metadata or an explicitly reviewed +reissue/continuity disposition. T03 retains exact admitted tool, private tmpfs +staging/child/request cleanup preparation and generated failure/parent-loss proof; +T04 retains separately authorized native recovery/acceptance. A standalone drill +using a surviving cluster cannot close the cluster-loss independence claim. +No original TLS custody, reissue assent, human approval, private key generation, +certificate request, production mutation, token exchange or rotation occurred. + +Evidence: Custodian +`docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/`. +Canonical owner publication/normal missing-UUID allocation and Hub projection +remain separate; no UUID is supplied by this prepared source task. + +## Coordination and completion + +Beneficiary NK-WP-0049-T35/CUST-WP-0080 remains linked to this obligor record by +derived cross_owner_wait case nk49-t35-rcluster18 in the packet. No new project +driver, live worker injection or message was created. Own T03 wait has an explicit +local prerequisite; T04 is a human gate. Close only after source/native obligations +are proved or an explicit bounded scope disposition hands off remaining live work. diff --git a/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/preimages/docs/keycape-tls-recovery-boundary.md b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/preimages/docs/keycape-tls-recovery-boundary.md new file mode 100644 index 00000000..40953976 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/preimages/docs/keycape-tls-recovery-boundary.md @@ -0,0 +1,51 @@ +# Original KeyCape TLS recovery boundary + +Source disposition, 2026-10-17, scoped to railiance-cluster INTENT: cluster runtime, +ingress/certificate plumbing and backup posture. This is source preparation only. +It is not native acceptance, an issuer/key custody assent, a reissue decision or +permission to mutate the cluster. + +NetKingdom's ingress source names `kc.coulomb.social`, `sso/kc-tls`, +`ClusterIssuer/letsencrypt-prod` and Traefik termination before KeyCape8080. +NetKingdom owns that namespace intent; railiance-cluster owns cert-manager, +ingress controller and cluster backup posture. No inspected source establishes +who independently holds the original private TLS recovery material when the +ordinary issuer/cluster is unavailable. A missing exact routing-catalog entry +cannot prove absence of an owning subsystem. + +The identity archive excludes `kc-tls`. Current S2 backup source encrypts SQLite +state, Helm values and kubeconfig to the same host's `/opt/backup/railiance/cluster` +and retains seven versions. No inspected source proves an actually fresh, +independent offsite object or original certificate/key/trust recovery. Archived +RAIL-BS-WP-0004 is historical local-backup delivery; backlog RCLUSTER-WP-0007-T05 +is gated HA issuance/renewal; active RCLUSTER-WP-0017 is signer runtime/storage. +None is an existing live task for this original TLS recovery demand. + +`railiance-backup-s2` also stages raw state/Helm output in named `/tmp` paths +without early hard-loss cleanup; `railiance-restore-s2` prints whole-state restore +instructions. Do not use either as an isolated TLS extraction path. RCLUSTER-WP-0018 +tracks exact inventory, safe private staging/extraction preparation where required, +independent outage proof and future archive-boundary disposition. No original +ciphertext or historical outcome is rewritten by that work. + +`tools/public-tls-metadata.py` is an offline public-only step. After the source +owner identifies independent original **public certificate/chain and trust files**: + +```sh +python3 tools/public-tls-metadata.py --public-cert ORIGINAL_PUBLIC_CERT_CHAIN.pem --public-trust ORIGINAL_PUBLIC_TRUST.pem +``` + +It accepts no private-key argument, bounds regular-file reads, refuses symlinks and +non-certificate PEM material, and reports public hashes/SANs/validity/counts only. +The file names are owner-local placeholders, not a key request. Output establishes +public metadata, not originality, hostname/chain acceptance, reissue permission or +custody. Do not supply a Secret object or combined certificate/key PEM. Fail closed +when original source, trust or exact bindings are missing; no fresh self-signed +trust workaround is admitted. + +For FUTURE NetKingdom archives, the source owners must explicitly disposition +original TLS coverage or a reviewed reissue contract: producer/custody owner, +private artifact boundary, offline recovery independence, original public hashes, +scoped capture/read permissions, retention and native verification. Merely adding +`kc-tls` to secret_refs would change capture/permission/custody scope and is not +authorized by this source review. It cannot repair the current archive retroactively. diff --git a/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/preimages/workplans/RCLUSTER-WP-0018-keycape-original-tls-recovery.md b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/preimages/workplans/RCLUSTER-WP-0018-keycape-original-tls-recovery.md new file mode 100644 index 00000000..f8ff4eb9 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/preimages/workplans/RCLUSTER-WP-0018-keycape-original-tls-recovery.md @@ -0,0 +1,152 @@ +--- +id: RCLUSTER-WP-0018 +type: workplan +title: "Establish original KeyCape TLS recovery and future archive boundary" +domain: financials +repo: railiance-cluster +status: active +owner: codex +topic_slug: railiance +created: "2026-10-17" +updated: "2026-10-17" +flavor: implementation +depends_on: [] +related: [CUST-WP-0080, NK-WP-0049, RCLUSTER-WP-0007, RCLUSTER-WP-0017] +state_hub_workstream_id: "e0a7813d-c916-5e49-84b2-5e5b30441891" +--- + +Required owner source work for NK-WP-0049-T35 and CUST-WP-0080 G08. Reviewed +against current INTENT/SCOPE, backup sources and existing work records; ready +means work can proceed, not privileged execute authority. This does not promote +HA/backlog work, reopen archived local backup delivery or duplicate signer0017. +Source-owner scope is certificate plumbing/backup posture; NetKingdom owns +namespace ingress, while exact original independent TLS custody remains to be +established. No secret read, reissue, live change or native assent occurred. + +## Record source boundary and public-only metadata preparation + +```task +id: RCLUSTER-WP-0018-T01 +status: done +priority: high +assignee: codex +state_hub_task_id: "7280193d-0d59-5b78-a2d3-96ebd127127f" +``` + +Completed 2026-10-17 as isolated source preparation. Independently reviewed the +17 public source references against current owner bytes, checked current owner +instructions/environment/supervision and existing plans, and recorded the exact +boundary in docs/keycape-tls-recovery-boundary.md. Prepared bounded public-only +certificate/trust metadata projection with generated-certificate tests; no actual +certificate/key read. Source integration/publication and task projection remain +separate receipts, not claimed by this completed preparation task. + +Evidence: the-custodian docs/changes/netkingdom-target-2026-10-16/ +recovery-owner-handoffs-r1/ and prior recovery-attempt-r1/t35-t36-source-next/. + +Publication return, 2026-10-17: normal owner source publication at +c562d7134c38679952a8ffd17a8a893a900aef0d was applied on primary/railiance01 +with expected and derived commits equal. Read-only source/remote/Hub proof +verified this workplan's five exact task ID/UUID/status bindings and three +internal dependency edges. Receipts are retained in the Custodian packet +docs/changes/netkingdom-target-2026-10-17/railiance-cluster-projection.json and +cluster-publication-readback.json. The later legitimate C23 lifecycle repair +at 26671d33600e218316d29c9cd020f115ebfb35b2 changed ready to active; active +is retained. This return records publication separately from the completed +source preparation above. Original TLS artifact/provider custody, extraction +and native admission remain T02–T05 obligations; publication proves no TLS +recovery, private-key custody or native acceptance. + +The whole maintenance pipeline's historical-row guard failed for three parent +rows while 15 task full-row hashes remained unchanged. STATE-WP-0095-T07 and +RMGR-WP-0019-T06 remain wait; neither publication nor this memo asserts full +historical-row preservation or restoration. The subsequent forward correction +restores the brief's committed content to its pre-accident version while restoring +the original staged/worktree change for its owner; history is not rewound. No legacy deep consistency fix is run by the correction. + +## Establish exact independent original TLS artifact and provider custody metadata + +```task +id: RCLUSTER-WP-0018-T02 +status: todo +priority: high +assignee: codex +state_hub_task_id: "90836435-917f-504c-a711-3f29ece348e3" +``` + +Next: identify the actual original sso/kc-tls custody owner and independent public +provenance through existing owner processes. Record artifact/provider, timestamp, +public certificate/trust hashes, private custody entry point and outage dependencies +without values. Source review cannot infer a fresh backup, original key coverage +or independent decryption custody from a local backup script. Use credential +routing before any later credential need; missing route is not proof of absence. +Done when exact independent recovery or an explicitly owned unavailable capability +is evidenced as metadata and a reviewed next action, with no guessed assent. + +## Prepare safe isolated original extraction or explicit reissue alternative + +```task +id: RCLUSTER-WP-0018-T03 +status: wait +priority: high +assignee: codex +depends_on: [RCLUSTER-WP-0018-T02] +blocking_reason: "Exact original artifact/provider/custody disposition is required before selecting extraction or reissue source." +state_hub_task_id: "5dfa9a3a-2639-5cf6-b0a4-13eef417d47a" +``` + +From T02, reuse the actual owner path to prepare an exact attended private-only +recovery command and full dependency/cleanup proof. Do not run whole-state restore +or expose raw state/Secret output. If existing backup staging is required, correct +only the needed path with bounded memory-only staging and early exact cleanup, +including error/parent-loss tests before use. Original recovery and accepted +reissue are distinct claims; no self-signed trust substitute, new broker or +implicit production action. Done when the exact source proposal, public metadata +preflight, negatives, timeout, abort and custody obligations are reviewed. + +## Verify admitted original TLS recovery through the actual owner boundary + +```task +id: RCLUSTER-WP-0018-T04 +status: wait +priority: high +assignee: codex +needs_human: true +depends_on: [RCLUSTER-WP-0018-T02, RCLUSTER-WP-0018-T03] +blocking_reason: "Await exact reviewed attended owner custody path and its existing scoped authority; no private input or native attempt requested yet." +state_hub_task_id: "021b07bb-65bc-5743-bac5-4294b4be74f6" +``` + +Only the actual admitted owner action can prove recovered certificate/key pairing, +original hostname/trust and independent outage operation, or the expressly accepted +reissue result. Retain exact source/artifact/target/identity/negative/cleanup receipts. +Human custody/authority gates are not worker wakeups. Source and historical local +backup proof never fill native assent. Return bounded public proof to NK49T35; +no production mutation, credential retrieval or approval is granted by this task. + +## Disposition original TLS coverage in the future identity archive contract + +```task +id: RCLUSTER-WP-0018-T05 +status: todo +priority: high +assignee: codex +state_hub_task_id: "5bc67a22-0991-5625-86a6-f749560d8a0e" +``` + +Next: deliver the source-owned requirement in docs/keycape-tls-recovery-boundary.md +to NetKingdom's existing contract process: original TLS custody or accepted reissue, +independent provider/key recovery, public identity hashes, scoped capture/read +permissions and verification/retention. Record named owner dependencies as live +work before closure. Do not append kc-tls to secret_refs, expand capture credentials +or rewrite a historical archive without those owner reviews/authority. Done when +the future contract requirement has an exact tracked disposition/handoff; it is +not proof of current archive coverage or actual future capture. + +## Coordination and completion + +Beneficiary NK-WP-0049-T35/CUST-WP-0080 remains linked to this obligor record by +derived cross_owner_wait case nk49-t35-rcluster18 in the packet. No new project +driver, live worker injection or message was created. Own T03 wait has an explicit +local prerequisite; T04 is a human gate. Close only after source/native obligations +are proved or an explicit bounded scope disposition hands off remaining live work. diff --git a/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/primary-source-references.json b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/primary-source-references.json new file mode 100644 index 00000000..3c648440 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/primary-source-references.json @@ -0,0 +1,36 @@ +{ + "retrieved_at": "2026-10-17T02:32:35.535346+00:00", + "primary_sources_only": true, + "references": [ + { + "title": "cert-manager v1.18 Certificate", + "url": "https://cert-manager.io/v1.18-docs/usage/certificate/", + "supports": "Ordinary managed issuance/renewal; transport certificate/key separate from application signing key." + }, + { + "title": "cert-manager v1.18 HTTP01", + "url": "https://cert-manager.io/v1.18-docs/configuration/acme/http01/", + "supports": "Traefik ingressClassName selects challenge routing; cert-manager creates solver resources and self-checks." + }, + { + "title": "cert-manager v1.18 cmctl", + "url": "https://cert-manager.io/v1.18-docs/reference/cmctl/", + "supports": "CertificateRequest creation with local key and public certificate output files; public template is not applied as Certificate." + }, + { + "title": "Let\u2019s Encrypt challenge types", + "url": "https://letsencrypt.org/docs/challenge-types/", + "supports": "Public HTTP01 validation on TCP80 with domain routing dependencies." + }, + { + "title": "Let\u2019s Encrypt CA chains", + "url": "https://letsencrypt.org/certificates/", + "supports": "Public CA chain/independent anchor provenance; no secret recovery implied." + }, + { + "title": "cmctl v2.6.1 release", + "url": "https://github.com/cert-manager/cmctl/releases/tag/v2.6.1", + "supports": "Pinned candidate release and published assets; digest metadata independently matched checksum text." + } + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/public-tls-observation.json b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/public-tls-observation.json new file mode 100644 index 00000000..a3625192 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/public-tls-observation.json @@ -0,0 +1,24 @@ +{ + "observed_at": "2026-10-17T02:28:14.352694+00:00", + "host": "kc.coulomb.social", + "dns_addresses_at_workstation": [ + "92.205.62.239" + ], + "hostname_and_system_ca_verification": true, + "tls_protocol": "TLSv1.3", + "leaf_der_sha256": "sha256:d5db2b555e74f7fbcd56dda3285dffffb86ac164bf6c28881b3efe580fc4ce5c", + "leaf_pem_sha256": "sha256:e43bbfb97c294ef235082316e39bbfb5377d86025eb4324b4115f2a9048e9e5d", + "subject": "CN=kc.coulomb.social", + "issuer": "CN=YR1,O=Let's Encrypt,C=US", + "not_before": "2026-09-25T17:57:22+00:00", + "not_after": "2026-12-24T17:57:21+00:00", + "dns_sans": [ + "kc.coulomb.social" + ], + "verified_chain_count": 4, + "chain_source": "public TLS peer plus independent pre-existing system CA trust store; not a Kubernetes Secret read", + "limit": "Current public identity/trust only; not original archive-time key custody, reissue success, independent outage recovery or owner assent.", + "metadata_preparation_history": "Initial observer failed on unavailable cryptography not_valid_before_utc attribute; successor uses existing UTC-normalized legacy property. No certificate or private operation failed.", + "independent_system_anchor_sha256": "sha256:22b557a27055b33606b6559f37703928d3e4ad79f110b407d04986e1843543d1", + "system_ca_bundle_sha256": "sha256:ecd9dc38bc3efb7dbd6431f57e29d2f8d6a0f0d211e1464b3fef2cbfe266fcd2" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/reissue-certificate.template.yaml b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/reissue-certificate.template.yaml new file mode 100644 index 00000000..142c58da --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/reissue-certificate.template.yaml @@ -0,0 +1,24 @@ +# LOCAL INPUT TEMPLATE ONLY: do not kubectl apply this Certificate. +# cmctl uses its public specification to create one CertificateRequest. +# The dedicated TLS private key and resulting certificate stay local to custody. +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: nk49-kc-drill-20261017-r1 + namespace: sso +spec: + secretName: nk49-kc-drill-not-created-by-cmctl + dnsNames: + - kc.coulomb.social + issuerRef: + group: cert-manager.io + kind: ClusterIssuer + name: letsencrypt-prod + privateKey: + algorithm: RSA + encoding: PKCS8 + size: 2048 + usages: + - digital signature + - key encipherment + - server auth diff --git a/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/reissue-command-proposal.json b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/reissue-command-proposal.json new file mode 100644 index 00000000..e749157f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/reissue-command-proposal.json @@ -0,0 +1,71 @@ +{ + "proposal_id": "nk49-tls-standalone-reissue-20261017", + "revision": 1, + "status": "source_prepared_not_executable_not_approved", + "target": { + "cluster_node_ip": "92.205.62.239", + "observed_context": "default", + "namespace": "sso", + "existing_issuer": "ClusterIssuer/letsencrypt-prod", + "dedicated_request": "nk49-kc-drill-20261017-r1" + }, + "proposed_tool_path": "/home/worsch/.local/lib/net-kingdom/cmctl/2.6.1/cmctl", + "tool_sha256": "sha256:0af054c26a2b64ce286fa868d029164867695a93c3eb893662ce16f35e708db0", + "tool_source_commit": "7e56321dbec4f62ea5428b8656c871c6dc0cc112", + "proposed_command_argv": [ + "/home/worsch/.local/lib/net-kingdom/cmctl/2.6.1/cmctl", + "--context", + "default", + "--namespace", + "sso", + "create", + "certificaterequest", + "nk49-kc-drill-20261017-r1", + "--from-certificate-file", + "/reissue-certificate.template.yaml", + "--fetch-certificate", + "--timeout", + "5m", + "--output-key-file", + "/server-key.pem", + "--output-certificate-file", + "/server.pem" + ], + "template_sha256": "sha256:8a31b39b52e3f711e9e6584c2ad31ba23937eac61741fc252ce83e47a990bd3f", + "exact_private_directory_binding": null, + "authority": "Existing owner/founder reviewed ADMINISTER @ realm:kubernetes/railiance01 action; this document grants none.", + "owner_review_reference": null, + "founder_disposition_reference": null, + "request_create_effect": "One dedicated public CertificateRequest; cert-manager may create transient owned Order/Challenge/solver resources. No production Certificate or Secret apply.", + "private_material": "Dedicated newly generated TLS key stays only in admitted owner-local private tmpfs through consumption/cleanup; no KeyCape OIDC signing-key rotation.", + "preconditions": [ + "Exact tool pin admitted, no current install assumed", + "Verify target node and issuer/controller/public DNS/HTTP01 solver path; do not request credentials from unknown routes", + "Exact request name absent; stop on collision or uncertainty; never overwrite/reuse a previous request", + "Public template/source/command reviewed; independent private tmpfs observer and child identities ready before key output", + "Actual domain-control/CA/provider limits and live resource authority admitted by owner", + "Specific standalone-drill continuity disposition reviewed; no cluster-loss claim" + ], + "verification": [ + "Exact created request UID, spec and selected issuer; approval/Ready conditions through existing owner policy", + "Returned public certificate chain matches held private key; hostname kc.coulomb.social, valid time, independently reviewed public CA anchor", + "Exact selected per-attempt TLS/trust hashes in existing admission; unchanged archived issuer and signing key/JWKS via existing isolated native checks", + "Actual request/owned child resources and private staging cleanup independently verified; no production TLS replacement" + ], + "abort_and_recovery": [ + "No issuance if staging observer or registration fails", + "On timeout/failure/parent loss quiesce exact known child; no blind retry or false success", + "Remote submission uncertainty retains exact name/UID reconciliation duty through owner API path; no wildcard or unconditional name-only delete", + "Remove only registered private tmpfs inode after child quiescence; preserve failure metadata and outstanding obligations" + ], + "scope": "standalone isolated drill with surviving cluster and ACME prerequisites; not independently executable during cluster loss", + "tool_installed": false, + "certificate_request_created": false, + "private_key_generated": false, + "cost_estimate_eur": null, + "credible_loss_bound_eur": null, + "estimate_note": "Local source work creates no spend; actual issuance exposes public domain-control/CA limit and cluster/request cleanup effects, requiring owner-reviewed estimates.", + "remaining_source_task": "RCLUSTER-WP-0018-T03 exact tool/staging/child/remote-request cleanup adaptation and generated lifecycle proof", + "approved_revision_digest": null, + "executed_revision_digest": null +} diff --git a/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/review.json b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/review.json new file mode 100644 index 00000000..d6d00d17 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/review.json @@ -0,0 +1,31 @@ +{ + "status": "source_disposition_proposal_ready_for_owner_review_not_executable", + "canonical_edits": false, + "existing_metadata_validator_checks_passed": 3, + "permanent_tests_added": false, + "old_cluster_task_blocks_preserved": true, + "new_proposed_source_task": "RCLUSTER-WP-0018-T06", + "original_tls_archive_bytes_required_by_current_source": false, + "per_attempt_tls_and_trust_hashes_required": true, + "archived_oidc_signer_and_issuer_invariants_unchanged": true, + "ca_native_or_private_pairing_proof_from_metadata_fixture": false, + "public_endpoint_ca_hostname_verified": true, + "secret_objects_or_private_keys_read": false, + "new_certificate_request": false, + "tool_installed_or_executed": false, + "live_writes": false, + "owner_or_founder_assent": false, + "blocked_execution_prerequisites": [ + "Actual owner standalone-drill disposition, target/domain-control and live authority", + "Pinned cmctl artifact admission; checksum is not signature verification", + "T03 owner source adaptation of pre-key tmpfs observer, exact child and remote public-request cleanup; generated timeout/parent-loss proof", + "Original six-argument recovery attempt complete reviewed admission/current owner selector acceptance" + ], + "separate_cluster_loss_gap": "Independent original private TLS custody or owner-reviewed off-cluster validation/provider path; surviving cluster reissue is insufficient.", + "knowledge_orientation": { + "package": "0.2.6", + "digest": "sha256:8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02", + "status": "withheld_source_changed", + "direct_source_review": "Current relevant AGENTS, environment orientation, Security Companion, identity card and owner source reviewed; no authority granted." + } +} diff --git a/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/source-references.json b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/source-references.json new file mode 100644 index 00000000..3f8cebd5 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/source-references.json @@ -0,0 +1,132 @@ +{ + "observed_at": "2026-10-17T02:32:35.534547+00:00", + "status": "public_source_only_no_private_inputs", + "references": [ + { + "repo": "net-kingdom", + "path": "AGENTS.md", + "head_observed": "503a4f617502baf38f9a09be11308a015072ef92", + "worktree_sha256": "sha256:95158b1d5c15e6cf8be980f5c0e3b48aeef252654846273887f40516b3fa6a78" + }, + { + "repo": "net-kingdom", + "path": "CONFIG.md", + "head_observed": "503a4f617502baf38f9a09be11308a015072ef92", + "worktree_sha256": "sha256:fa5a165378a19282f781393759191abee89f0d66fd29d1fac794fb9f4c615c65" + }, + { + "repo": "net-kingdom", + "path": "sso-mfa/k8s/cert-manager/issuers.yaml", + "head_observed": "503a4f617502baf38f9a09be11308a015072ef92", + "worktree_sha256": "sha256:9871e0bc98c46a5dbdd144c5de8b196e3cc6c71a23b8657d50df846a9b00d8c1" + }, + { + "repo": "net-kingdom", + "path": "sso-mfa/k8s/keycape/ingress.yaml", + "head_observed": "503a4f617502baf38f9a09be11308a015072ef92", + "worktree_sha256": "sha256:bc5c7524a82de5e8b9755e7d7d408b4a66e034424cb2663c1d21352d292d5a72" + }, + { + "repo": "net-kingdom", + "path": "sso-mfa/k8s/network-policies/netpol-sso.yaml", + "head_observed": "503a4f617502baf38f9a09be11308a015072ef92", + "worktree_sha256": "sha256:78445887834cf876901a7b807f8753ed078501b21bff814d89071673b0281d4f" + }, + { + "repo": "net-kingdom", + "path": "tools/bootstrap-recovery/identity-backup-profile.json", + "head_observed": "503a4f617502baf38f9a09be11308a015072ef92", + "worktree_sha256": "sha256:40f9e5b5bb957e5b23e03b31701702b850502d16a92a0fa0ebf92618cc3f18a1" + }, + { + "repo": "net-kingdom", + "path": "tools/bootstrap-recovery/prepare-isolated-keycape.py", + "head_observed": "503a4f617502baf38f9a09be11308a015072ef92", + "worktree_sha256": "sha256:5098bdfa4e0ad30627c1716e5e355a2c78dca6ccc607bd2148a2e06126632288" + }, + { + "repo": "net-kingdom", + "path": "tools/bootstrap-recovery/isolated-keycape-session.py", + "head_observed": "503a4f617502baf38f9a09be11308a015072ef92", + "worktree_sha256": "sha256:8fa38efe28167b59a6307f342b2ac8fcda78ecda60e6228f22017424d2343c22" + }, + { + "repo": "net-kingdom", + "path": "tools/bootstrap-recovery/isolated-keycape.py", + "head_observed": "503a4f617502baf38f9a09be11308a015072ef92", + "worktree_sha256": "sha256:86f37add7221e4c73e3f9d878c09a3cc81061627cbf024ed6887d973d929b718" + }, + { + "repo": "net-kingdom", + "path": "tools/bootstrap-recovery/run-isolated-keycape.sh", + "head_observed": "503a4f617502baf38f9a09be11308a015072ef92", + "worktree_sha256": "sha256:0d994c9c14ebdffdbf7879bd7562042531083d0e8955424d0ae099898a141668" + }, + { + "repo": "net-kingdom", + "path": "tests/test_prepare_isolated_keycape.py", + "head_observed": "503a4f617502baf38f9a09be11308a015072ef92", + "worktree_sha256": "sha256:4b0871f9a11a3940983464f1b40eca1613110b1cb3cb9694f4891d58e14c700a" + }, + { + "repo": "net-kingdom", + "path": "docs/bootstrap-recovery-ceremony.md", + "head_observed": "503a4f617502baf38f9a09be11308a015072ef92", + "worktree_sha256": "sha256:7df8d220a236d4e955e2d1daa88fdf2a94d1c11720d29ad4c0d2490e46f6dc2c" + }, + { + "repo": "net-kingdom", + "path": "workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md", + "head_observed": "503a4f617502baf38f9a09be11308a015072ef92", + "worktree_sha256": "sha256:cba3233883e9a5b429aaea1b8eacd250c6efcf5e484c4284ddc97e8e52697085" + }, + { + "repo": "railiance-cluster", + "path": "AGENTS.md", + "head_observed": "6ae3f847c83da3402883453ee7110457bfb2d0d6", + "worktree_sha256": "sha256:5cc7808a6d0e5cdebc7b3f13a0d7dce9cee5441ed6de4703b67cf3fe1800d45b" + }, + { + "repo": "railiance-cluster", + "path": "docs/keycape-tls-recovery-boundary.md", + "head_observed": "6ae3f847c83da3402883453ee7110457bfb2d0d6", + "worktree_sha256": "sha256:f4bcb1d1832c566f9c87793ed2a461c8cd8a00859dc4ae66cd3c160d7ceefa70" + }, + { + "repo": "railiance-cluster", + "path": "tools/public-tls-metadata.py", + "head_observed": "6ae3f847c83da3402883453ee7110457bfb2d0d6", + "worktree_sha256": "sha256:87c167e44f0fcf154c9f2afae2187bebd33e5f220c05f579c1233b58bfe4f30b" + }, + { + "repo": "railiance-cluster", + "path": "workplans/RCLUSTER-WP-0018-keycape-original-tls-recovery.md", + "head_observed": "6ae3f847c83da3402883453ee7110457bfb2d0d6", + "worktree_sha256": "sha256:96d52b6dbae056399159632d50b32ccc6662e4f6d3677af154f7c8a3d618334b" + }, + { + "repo": "secrets-engine", + "path": "AGENTS.md", + "head_observed": "691dc742362eeec45d5bd32d2b468f31a959748e", + "worktree_sha256": "sha256:1b98e24f9eb35c4c56b96ee7cbac21919bbe3b928144bfa7f29cca1c3249d5d0" + }, + { + "repo": "secrets-engine", + "path": "src/secrets_engine/service_auth.py", + "head_observed": "691dc742362eeec45d5bd32d2b468f31a959748e", + "worktree_sha256": "sha256:c0ade429edf452ad17f05d690b7ebef091db7f1a42b5ac350f1e40955c8586c0" + }, + { + "repo": "secrets-engine", + "path": "src/secrets_engine/engine_auth.py", + "head_observed": "691dc742362eeec45d5bd32d2b468f31a959748e", + "worktree_sha256": "sha256:e0479cf6d8c13233cf99dc39491143478c021597941ae8b6ba0e37957a42f330" + }, + { + "repo": "secrets-engine", + "path": "docs/keycape-isolated-recovery-selector.md", + "head_observed": "691dc742362eeec45d5bd32d2b468f31a959748e", + "worktree_sha256": "sha256:ed23b0df3d4b49e4b76df795455153c805971ccd37886836c960f550709e0739" + } + ] +}