docs: preserve reviewed NetKingdom session artifacts
This commit is contained in:
codex
parent
b4a753678a
commit
24e9be4f99
50 changed files with 3457 additions and 0 deletions
|
|
@ -0,0 +1,30 @@
|
|||
{
|
||||
"batch": 10,
|
||||
"commit": "30e41c948e7c5f29cf770ac63d50043a615171d9",
|
||||
"previous_remote": "285e5900091ee2f940b8fea5755aeddf78492b4f",
|
||||
"paths": [
|
||||
"docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/workplan.preimage.md",
|
||||
"docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/owner-source-state.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/prepare.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/candidate.patch",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/candidate/src/warden/case_run.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/candidate/src/warden/case_type.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/candidate/src/warden/routing/models.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/candidate/tests/test_case_1_3_integration.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/candidate/tests/test_case_admission_modes.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/candidate/tests/test_case_attended_boundary.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/evidence/run.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/evidence/sitecustomize.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/implementation-r1.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/test-isolation-proposal.patch",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review-r2/integration_runner.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review-r2/kernel-review-r2.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review-r2/reviewer-probes.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review-r2/run-baseline.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review-r2/run.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review-r2/setup.py"
|
||||
],
|
||||
"exit_code": 0,
|
||||
"stdout": "",
|
||||
"stderr": "remote: {\"status\":\"clean\",\"scope\":\"introduced-reachable-git-objects-and-updated-ref-names\",\"scanned_objects\":35,\"scanned_refs\":1,\"scanner_version\":\"8.30.1\"} \nTo forgejo-remote:coulomb/the-custodian.git\n 285e590..30e41c9 HEAD -> main\n"
|
||||
}
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
{
|
||||
"exit_code": 0,
|
||||
"stdout": "[detached HEAD df5765e] Record reviewed case source evidence (11/13)\n 20 files changed, 1552 insertions(+)\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review-r2/sitecustomize.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/commit.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/consistency-preimage.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/consistency.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/consistency.stderr.txt\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/focused-tests.txt\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/integrate.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/integration.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/normal-sync.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/normal-sync.stderr.txt\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/publish.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/verification.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/workplan.preimage.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/commit.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/consistency.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/consistency.stderr.txt\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/full-unit-result.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/integrate.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/integration.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/prepare_publication.py\n",
|
||||
"stderr": ""
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"blocked_blob_ids": [], "scanned_blobs": 18, "scanner_sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509", "scanner_version": "8.30.1", "scope": "changed-staged-blobs", "status": "clean"}
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
{
|
||||
"batch": 11,
|
||||
"commit": "df5765e0e18a2daa66cc1c684b6b88af6202e9fe",
|
||||
"previous_remote": "30e41c948e7c5f29cf770ac63d50043a615171d9",
|
||||
"paths": [
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review-r2/sitecustomize.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/commit.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/consistency-preimage.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/consistency.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/consistency.stderr.txt",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/focused-tests.txt",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/integrate.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/integration.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/normal-sync.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/normal-sync.stderr.txt",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/publish.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/verification.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/workplan.preimage.md",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/commit.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/consistency.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/consistency.stderr.txt",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/full-unit-result.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/integrate.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/integration.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/prepare_publication.py"
|
||||
],
|
||||
"exit_code": 0,
|
||||
"stdout": "",
|
||||
"stderr": "remote: {\"status\":\"clean\",\"scope\":\"introduced-reachable-git-objects-and-updated-ref-names\",\"scanned_objects\":25,\"scanned_refs\":1,\"scanner_version\":\"8.30.1\"} \nTo forgejo-remote:coulomb/the-custodian.git\n 30e41c9..df5765e HEAD -> main\n"
|
||||
}
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
{
|
||||
"exit_code": 0,
|
||||
"stdout": "[detached HEAD e9dc1a0] Record reviewed case source evidence (12/13)\n 20 files changed, 2477 insertions(+)\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/projection.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/projection.stderr.txt\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/publication-commit.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/publication-inputs.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/root-disposition.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/README.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate.patch\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/Makefile\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/docs/development/safe-unit-tests.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/scripts/run_unit_tests.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/fixtures/workload-coverage/provenance.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/fixtures/workload-coverage/rapp-core-hub/declarations/rapp.yaml\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/fixtures/workload-coverage/rapp-issue-core/declarations/rapp.yaml\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/fixtures/workload-coverage/rapp-qonto/declarations/rapp.yaml\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/test_case_plan.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/test_case_type.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/test_layer_conformance.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/test_safe_unit_runner.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/test_workload_join.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/unit_isolation_probe.py\n",
|
||||
"stderr": ""
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"blocked_blob_ids": [], "scanned_blobs": 20, "scanner_sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509", "scanner_version": "8.30.1", "scope": "changed-staged-blobs", "status": "clean"}
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
{
|
||||
"batch": 12,
|
||||
"commit": "e9dc1a0f90d07eb592c1f7b644d881c61c53c63e",
|
||||
"previous_remote": "df5765e0e18a2daa66cc1c684b6b88af6202e9fe",
|
||||
"paths": [
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/projection.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/projection.stderr.txt",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/publication-commit.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/publication-inputs.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/root-disposition.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/README.md",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate.patch",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/Makefile",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/docs/development/safe-unit-tests.md",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/scripts/run_unit_tests.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/fixtures/workload-coverage/provenance.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/fixtures/workload-coverage/rapp-core-hub/declarations/rapp.yaml",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/fixtures/workload-coverage/rapp-issue-core/declarations/rapp.yaml",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/fixtures/workload-coverage/rapp-qonto/declarations/rapp.yaml",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/test_case_plan.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/test_case_type.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/test_layer_conformance.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/test_safe_unit_runner.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/test_workload_join.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/unit_isolation_probe.py"
|
||||
],
|
||||
"exit_code": 0,
|
||||
"stdout": "",
|
||||
"stderr": "remote: {\"status\":\"clean\",\"scope\":\"introduced-reachable-git-objects-and-updated-ref-names\",\"scanned_objects\":39,\"scanned_refs\":1,\"scanner_version\":\"8.30.1\"} \nTo forgejo-remote:coulomb/the-custodian.git\n df5765e..e9dc1a0 HEAD -> main\n"
|
||||
}
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
{
|
||||
"exit_code": 0,
|
||||
"stdout": "[detached HEAD 0c21cf1] Record reviewed case source evidence (13/13)\n 16 files changed, 1954 insertions(+)\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/netkingdom-progress.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/platform-progress.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/publication-commit.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/scanner-blocked-paths.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/warden-progress.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r2/public-digest-derivation.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/workplans/WARDEN-WP-0044-security-case-follow-through.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/implementation.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/packet-hashes.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-review-r1/review-r1.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-review-r1/reviewer-correction.patch\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-review-r1/reviewer-probes.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-review-r1/run.py\n",
|
||||
"stderr": ""
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"blocked_blob_ids": [], "scanned_blobs": 16, "scanner_sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509", "scanner_version": "8.30.1", "scope": "changed-staged-blobs", "status": "clean"}
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
{
|
||||
"batch": 13,
|
||||
"commit": "0c21cf1b691b3c8a8ed0865caca5b777be782478",
|
||||
"previous_remote": "e9dc1a0f90d07eb592c1f7b644d881c61c53c63e",
|
||||
"paths": [
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/workplans/WARDEN-WP-0044-security-case-follow-through.md",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/implementation.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/packet-hashes.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-review-r1/review-r1.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-review-r1/reviewer-correction.patch",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-review-r1/reviewer-probes.py",
|
||||
"docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-review-r1/run.py",
|
||||
"docs/netkingdom-target-implementation.md",
|
||||
"docs/netkingdom-target-security-architecture.md",
|
||||
"docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r2/public-digest-derivation.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/scanner-blocked-paths.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/publication-commit.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/warden-progress.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/netkingdom-progress.json",
|
||||
"docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/platform-progress.json",
|
||||
"workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
],
|
||||
"exit_code": 0,
|
||||
"stdout": "",
|
||||
"stderr": "remote: {\"status\":\"clean\",\"scope\":\"introduced-reachable-git-objects-and-updated-ref-names\",\"scanned_objects\":28,\"scanned_refs\":1,\"scanner_version\":\"8.30.1\"} \nTo forgejo-remote:coulomb/the-custodian.git\n e9dc1a0..0c21cf1 HEAD -> main\n"
|
||||
}
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
{
|
||||
"workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52",
|
||||
"id": "455ca4b0-3521-4dfa-aeae-08c11ecbc760",
|
||||
"topic_id": null,
|
||||
"task_id": "87637402-02f1-57c1-8fbc-4141598af8e3",
|
||||
"decision_id": null,
|
||||
"event_type": "note",
|
||||
"summary": "Published/verified Custodian 05df7c3ee4d31879e7e0074e3210656b4f795794 (238 explicit evidence/architecture/workplan files) with owner source heads Warden b593c879, NetKingdom befb0bc6 and Platform104ed90. Kernel attended dispatch/catalog checks, exact proposed issuer reference, independent mint/correct-catalog fixtures and corrected ordinary unit-test accident guard are implemented in source. Root full make test785passed/4deselected; downstream31tests/53subtests and issuer8tests passed. Fresh primary source/UUID/status readback verifies48 task bindings across coordinator6,Warden4,NK35,KEY39three; all31 original NK bindings and all6 coordinator blocks preserved. NK T32/T33/T35done only their declared source outcomes, T34progress actual Apps inverse backend absent; T16/native firstcase and KEY39T02 stay open. All16native target gates remain unclosed. Initial safe-runner rejection, truncation/provenance regressions, unknown old ambient lookup and failed preparations preserved. Root scanner rejected3public-digest metadata blobs; verified43exactpublic artifacts, typed SHA256 values with byte-exact reversible originals and passed unchanged normal hook; no credential encoded/allowlist/scannerpolicy change. Server first rejected large push as unverified/scanner-failed. Thirteen bounded commits each passed the same pinned local scanner and unchanged server hook; final normal merge retains original a69be6c with byte-identical tree, no reset/amend/force push or hook/policy changes. Required consistency reused only for identical source tree. Normal primary projection applied without retirement;8preexistingroot worktree/index edits preserved exactly. Evidence source-corrections-publication-r3/final-verification.json and dated owner packets. Goal remains active; no new native, credential, runtime-profile,1.3pin or draft-lane promotion.",
|
||||
"detail": null,
|
||||
"author": "codex",
|
||||
"session_id": null,
|
||||
"created_at": "2026-10-17T20:38:12.234006Z",
|
||||
"workstream_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52"
|
||||
}
|
||||
|
|
@ -0,0 +1,289 @@
|
|||
{
|
||||
"status": "verified",
|
||||
"root_commit": "05df7c3ee4d31879e7e0074e3210656b4f795794",
|
||||
"root_changed_files_verified": 238,
|
||||
"owner_heads": {
|
||||
"ops-warden": "b593c879831378db7dc62adfabdfedf2d44ddd38",
|
||||
"net-kingdom": "befb0bc68cd25b625804fce559476eefd702521d",
|
||||
"railiance-platform": "104ed90f42a9a86bf9fda343b49b65a85c9ee4b9"
|
||||
},
|
||||
"source_primary_task_bindings": [
|
||||
{
|
||||
"owner": "the-custodian",
|
||||
"workplan_uuid": "dfadb19b-445e-59c6-bcd6-48e87b912c52",
|
||||
"task_count": 6,
|
||||
"source_primary_bindings": [
|
||||
{
|
||||
"record_id": "CUST-WP-0080-T01",
|
||||
"uuid": "c770f7e1-25eb-53ec-9a37-1f7794077ff8",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "CUST-WP-0080-T02",
|
||||
"uuid": "5973026f-8ca9-5882-99fe-65a54bc250ac",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "CUST-WP-0080-T03",
|
||||
"uuid": "87637402-02f1-57c1-8fbc-4141598af8e3",
|
||||
"status": "progress"
|
||||
},
|
||||
{
|
||||
"record_id": "CUST-WP-0080-T04",
|
||||
"uuid": "82378b0f-7004-5c2f-9683-b356a1227576",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"record_id": "CUST-WP-0080-T05",
|
||||
"uuid": "ed8b909a-23bf-5e5f-b600-e477fbae136b",
|
||||
"status": "progress"
|
||||
},
|
||||
{
|
||||
"record_id": "CUST-WP-0080-T06",
|
||||
"uuid": "6aca534c-5c7a-556f-b6b6-406433670c29",
|
||||
"status": "progress"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"owner": "ops-warden",
|
||||
"workplan_uuid": "f7e81013-6868-5d99-8528-ba75a442eca9",
|
||||
"task_count": 4,
|
||||
"source_primary_bindings": [
|
||||
{
|
||||
"record_id": "WARDEN-WP-0044-T01",
|
||||
"uuid": "ef0920fc-418e-52cb-acff-9a5c0c728bf5",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "WARDEN-WP-0044-T02",
|
||||
"uuid": "5f68c991-f490-58f8-a121-92f74073d272",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "WARDEN-WP-0044-T03",
|
||||
"uuid": "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89",
|
||||
"status": "progress"
|
||||
},
|
||||
{
|
||||
"record_id": "WARDEN-WP-0044-T04",
|
||||
"uuid": "4a0fa4a7-5ca9-518a-ab92-a79a5e2cf93e",
|
||||
"status": "wait"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"owner": "net-kingdom",
|
||||
"workplan_uuid": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb",
|
||||
"task_count": 35,
|
||||
"source_primary_bindings": [
|
||||
{
|
||||
"record_id": "NK-WP-0048-T01",
|
||||
"uuid": "930ac3e9-20ec-5473-98cd-3fe8fddb730f",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T02",
|
||||
"uuid": "19c25d96-a55c-58f0-9168-3fdbc4955fc2",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T03",
|
||||
"uuid": "e487975b-73b1-516c-971d-da4cbbb93063",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T04",
|
||||
"uuid": "2fffe112-7d55-5680-9952-78d74f44f87f",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T05",
|
||||
"uuid": "3d987d3d-0797-538b-86e4-51185a327ae2",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T06",
|
||||
"uuid": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c",
|
||||
"status": "wait"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T07",
|
||||
"uuid": "c3c9c3ae-4f23-5ba7-9e6f-e63bcf29b9f7",
|
||||
"status": "wait"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T08",
|
||||
"uuid": "8e519082-dc8b-5e46-b660-03d03e55dcf6",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T09",
|
||||
"uuid": "0ee12dfc-8260-5038-bd39-cc7fb4113be0",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T10",
|
||||
"uuid": "4b06ca97-c1e4-5680-bf22-ab75ab1646a4",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T11",
|
||||
"uuid": "ef2a0119-f59e-5e45-9519-115da9df7b85",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T12",
|
||||
"uuid": "7ce4eee3-cd47-55a9-bfa5-4f1835d4d6fd",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T13",
|
||||
"uuid": "b264c10b-565c-5d29-b788-03cf5fbd2883",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T14",
|
||||
"uuid": "fce95440-a25b-5f27-8ef3-a3d182099113",
|
||||
"status": "progress"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T15",
|
||||
"uuid": "1b825705-4848-5edc-832f-b1622cd9bdb7",
|
||||
"status": "wait"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T16",
|
||||
"uuid": "200bf500-5084-5ae7-be26-3033fe1f296e",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T17",
|
||||
"uuid": "8c3e4baa-a218-5996-af9e-fe1153a46dac",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T18",
|
||||
"uuid": "9c45da71-fb4c-5f20-9065-90f448f37c64",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T19",
|
||||
"uuid": "f50fdcd1-00be-5c3c-be0c-345aa2126032",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T20",
|
||||
"uuid": "863fcbdb-e246-51ba-87ca-a2f44d01d6f8",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T21",
|
||||
"uuid": "afe78e4d-408a-516a-ab92-e212e8a2d11d",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T22",
|
||||
"uuid": "ea50d93b-0d04-55d2-98c4-9b6c3fe925b1",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T23",
|
||||
"uuid": "6e7cd483-c7af-53a2-9d0a-3d76b6fb49ee",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T24",
|
||||
"uuid": "1a3931ee-3b5f-52fc-9295-4073804f4bd2",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T25",
|
||||
"uuid": "0de2a7d9-874d-578b-a076-f653fe42e30b",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T26",
|
||||
"uuid": "94b3cbf0-c908-5ac6-b0db-67385c3e021c",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T27",
|
||||
"uuid": "e56365f8-29b5-5c89-a329-8115f9f3b2a7",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T28",
|
||||
"uuid": "6dab281c-ea9a-5a17-a83f-e8e9a4d4484f",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T29",
|
||||
"uuid": "129db41d-4560-5e20-9f3b-c3c91e0a5601",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T30",
|
||||
"uuid": "6f6073ac-52dd-5b70-8874-6d76d4c072e4",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T31",
|
||||
"uuid": "ed1ccd87-89a0-5e69-885c-0eaf5ab0bb5a",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T32",
|
||||
"uuid": "c6d0a27e-f6a7-5df0-95f6-3e7473d38bb5",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T33",
|
||||
"uuid": "5ace28ff-a4cb-5647-a8f6-3cd54bb9d0a5",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T34",
|
||||
"uuid": "37f43c40-d014-544e-aa0b-5219dd4a6b93",
|
||||
"status": "progress"
|
||||
},
|
||||
{
|
||||
"record_id": "NK-WP-0048-T35",
|
||||
"uuid": "cf1d6ab3-846e-53ea-8575-d6347b6f4769",
|
||||
"status": "done"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"owner": "key-cape",
|
||||
"workplan_uuid": "09c3bddf-6058-5603-8488-cccdb7be4f86",
|
||||
"task_count": 3,
|
||||
"source_primary_bindings": [
|
||||
{
|
||||
"record_id": "KEY-WP-0039-T01",
|
||||
"uuid": "4d06b059-3768-53bb-83a4-a9a71c0850b8",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"record_id": "KEY-WP-0039-T02",
|
||||
"uuid": "03da4c38-1dac-53b1-8b0b-e697df48e9d3",
|
||||
"status": "wait"
|
||||
},
|
||||
{
|
||||
"record_id": "KEY-WP-0039-T03",
|
||||
"uuid": "54d37ad8-2352-51c2-bb2e-af6070dbbd73",
|
||||
"status": "done"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"preserved_original_root_dirt": 8,
|
||||
"projection": "primary/railiance01",
|
||||
"native_target_gates_closed_by_this_work": 0,
|
||||
"scanner_policy_changed": false,
|
||||
"failed_and_unknown_outcomes_retained": true,
|
||||
"goal_status": "active",
|
||||
"bounded_publication_commits": 13,
|
||||
"original_commit_retained": "a69be6cb0773efdc9c3bf214311d11998a6b438f",
|
||||
"observed_at": "2026-10-17T20:38:08.753681+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
{
|
||||
"exit_code": 0,
|
||||
"stdout": "[detached HEAD 05df7c3] Preserve original reviewed evidence after bounded source publication\n",
|
||||
"stderr": ""
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"blocked_blob_ids": [], "scanned_blobs": 0, "scanner_sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509", "scanner_version": "8.30.1", "scope": "changed-staged-blobs", "status": "clean"}
|
||||
|
|
@ -0,0 +1,292 @@
|
|||
{
|
||||
"ok": true,
|
||||
"status": "applied",
|
||||
"repo_slug": "the-custodian",
|
||||
"commit": "05df7c3ee4d31879e7e0074e3210656b4f795794",
|
||||
"requests": 2,
|
||||
"elapsed_ms": 13677.6,
|
||||
"git": {
|
||||
"upstream": "origin/main",
|
||||
"behind": 0,
|
||||
"ahead": 0
|
||||
},
|
||||
"identifiers": {
|
||||
"schema": "repo-manager.identifier-assignment.v1",
|
||||
"ok": true,
|
||||
"executed": true,
|
||||
"repo": "the-custodian",
|
||||
"namespace": "helixforge",
|
||||
"assignments": [],
|
||||
"historical_invalid_identifiers": [
|
||||
{
|
||||
"kind": "workplan",
|
||||
"id": "CUST-WP-ADHOC-2026-08-25-RETIRED",
|
||||
"source": "workplans/ADHOC-2026-08-25-retired.md"
|
||||
}
|
||||
],
|
||||
"historical_identity_collisions": [],
|
||||
"files_changed": []
|
||||
},
|
||||
"receipt": {
|
||||
"schema": "state-hub.repository-projection-reconcile.v1",
|
||||
"instance_role": "primary",
|
||||
"instance_label": "railiance01",
|
||||
"expected_commit": "05df7c3ee4d31879e7e0074e3210656b4f795794",
|
||||
"derived_commit": "05df7c3ee4d31879e7e0074e3210656b4f795794",
|
||||
"outcome": {
|
||||
"schema": "state-hub.projection-reset.v1",
|
||||
"repo_slug": "the-custodian",
|
||||
"commit": "05df7c3ee4d31879e7e0074e3210656b4f795794",
|
||||
"status": "applied",
|
||||
"counts": {
|
||||
"created": 0,
|
||||
"updated": 88,
|
||||
"retired": 0,
|
||||
"refused": 0,
|
||||
"released": 0,
|
||||
"created_tasks": 0,
|
||||
"updated_tasks": 0,
|
||||
"cancelled_tasks": 0,
|
||||
"created_edges": 0,
|
||||
"removed_edges": 0,
|
||||
"unresolved_edges": 0,
|
||||
"external_edges": 13
|
||||
},
|
||||
"created": [],
|
||||
"updated": [
|
||||
"CUST-WP-0000",
|
||||
"CUST-WP-0000b",
|
||||
"CUST-WP-0000c",
|
||||
"CUST-WP-0001",
|
||||
"CUST-WP-0002",
|
||||
"CUST-WP-0004",
|
||||
"CUST-WP-0005",
|
||||
"CUST-WP-0006",
|
||||
"CUST-WP-0007",
|
||||
"CUST-WP-0008",
|
||||
"CUST-WP-0009",
|
||||
"CUST-WP-0010",
|
||||
"CUST-WP-0010b",
|
||||
"CUST-WP-0013",
|
||||
"CUST-WP-0014",
|
||||
"CUST-WP-0015",
|
||||
"CUST-WP-0016",
|
||||
"CUST-WP-0017",
|
||||
"CUST-WP-0017-LEGACY",
|
||||
"CUST-WP-0018",
|
||||
"CUST-WP-0019",
|
||||
"CUST-WP-0020",
|
||||
"CUST-WP-0021",
|
||||
"CUST-WP-0022",
|
||||
"CUST-WP-0023",
|
||||
"CUST-WP-0024",
|
||||
"CUST-WP-0025",
|
||||
"CUST-WP-0026",
|
||||
"CUST-WP-0027",
|
||||
"CUST-WP-0028",
|
||||
"CUST-WP-0029",
|
||||
"CUST-WP-0030",
|
||||
"CUST-WP-0031",
|
||||
"CUST-WP-0032",
|
||||
"CUST-WP-0033",
|
||||
"CUST-WP-0034",
|
||||
"CUST-WP-0035",
|
||||
"CUST-WP-0036",
|
||||
"CUST-WP-0037",
|
||||
"CUST-WP-0039",
|
||||
"CUST-WP-0040",
|
||||
"CUST-WP-0041",
|
||||
"CUST-WP-0043",
|
||||
"CUST-WP-0044",
|
||||
"CUST-WP-0045",
|
||||
"CUST-WP-0046",
|
||||
"CUST-WP-0047",
|
||||
"CUST-WP-0048",
|
||||
"CUST-WP-0049",
|
||||
"CUST-WP-0050",
|
||||
"CUST-WP-0051",
|
||||
"CUST-WP-0052",
|
||||
"CUST-WP-0053",
|
||||
"CUST-WP-0053-LEGACY",
|
||||
"CUST-WP-0054",
|
||||
"CUST-WP-0055",
|
||||
"CUST-WP-0056",
|
||||
"CUST-WP-0057",
|
||||
"CUST-WP-0058",
|
||||
"CUST-WP-0059",
|
||||
"CUST-WP-0060",
|
||||
"CUST-WP-0061",
|
||||
"CUST-WP-0062",
|
||||
"CUST-WP-0063",
|
||||
"CUST-WP-0064",
|
||||
"CUST-WP-0065",
|
||||
"CUST-WP-0066",
|
||||
"CUST-WP-0067",
|
||||
"CUST-WP-0068",
|
||||
"CUST-WP-0069",
|
||||
"CUST-WP-0070",
|
||||
"CUST-WP-0071",
|
||||
"CUST-WP-0072",
|
||||
"CUST-WP-0073",
|
||||
"CUST-WP-0074",
|
||||
"CUST-WP-0075",
|
||||
"CUST-WP-0076",
|
||||
"CUST-WP-0077",
|
||||
"CUST-WP-0078",
|
||||
"CUST-WP-0079",
|
||||
"CUST-WP-0080",
|
||||
"CUST-WP-0081",
|
||||
"CUST-WP-ADHOC-2026-03-29",
|
||||
"CUST-WP-ADHOC-2026-05-02",
|
||||
"CUST-WP-ADHOC-2026-07-02",
|
||||
"CUST-WP-ADHOC-2026-08-25",
|
||||
"CUST-WP-ADHOC-2026-09-06",
|
||||
"THE-WP-0001"
|
||||
],
|
||||
"retired": [],
|
||||
"released": [],
|
||||
"created_tasks": [],
|
||||
"updated_tasks": [],
|
||||
"cancelled_tasks": [],
|
||||
"created_edges": [],
|
||||
"removed_edges": [],
|
||||
"unresolved_edges": [],
|
||||
"external_edges": [
|
||||
{
|
||||
"workplan": "CUST-WP-0071",
|
||||
"from": "CUST-WP-0071-T05",
|
||||
"target": "CUST-WP-0071-T04",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3",
|
||||
"from_task_id": "20ddd4d7-d85d-5b95-bb0a-7b0ca8af76ca",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "944f98e2-7e42-5894-925b-752423f3a1cc"
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0071",
|
||||
"from": "CUST-WP-0071-T03",
|
||||
"target": "CUST-WP-0071-T01",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3",
|
||||
"from_task_id": "6dc67558-eb1e-5bb6-a667-986f884dd495",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "4ae8eb8d-f8c5-5256-ae50-c323cfd73d7a"
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0071",
|
||||
"from": "CUST-WP-0071-T03",
|
||||
"target": "CUST-WP-0071-T02",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3",
|
||||
"from_task_id": "6dc67558-eb1e-5bb6-a667-986f884dd495",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "82192370-2fd7-5363-88d2-3c67889d3d68"
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0071",
|
||||
"from": "CUST-WP-0071-T02",
|
||||
"target": "CUST-WP-0071-T01",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3",
|
||||
"from_task_id": "82192370-2fd7-5363-88d2-3c67889d3d68",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "4ae8eb8d-f8c5-5256-ae50-c323cfd73d7a"
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0071",
|
||||
"from": "CUST-WP-0071-T02",
|
||||
"target": "RAPPS-WP-0014-T03",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3",
|
||||
"from_task_id": "82192370-2fd7-5363-88d2-3c67889d3d68",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "dd069c6d-fcc1-5bac-b233-976f2f0d5cd1"
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0071",
|
||||
"from": "CUST-WP-0071-T04",
|
||||
"target": "CUST-WP-0071-T03",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3",
|
||||
"from_task_id": "944f98e2-7e42-5894-925b-752423f3a1cc",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "6dc67558-eb1e-5bb6-a667-986f884dd495"
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0073",
|
||||
"from": "CUST-WP-0073-T02",
|
||||
"target": "GLAS-WP-0012",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "a98a9f34-83b4-5c8c-8107-e05f7806d50d",
|
||||
"from_task_id": "4b88b0b7-dc7e-5612-aa5d-1a08f0530c35",
|
||||
"to_workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0073",
|
||||
"from": "CUST-WP-0073-T04",
|
||||
"target": "CUST-WP-0073-T02",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "a98a9f34-83b4-5c8c-8107-e05f7806d50d",
|
||||
"from_task_id": "90725511-4e31-549f-b567-47feff1a9ca4",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "4b88b0b7-dc7e-5612-aa5d-1a08f0530c35"
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0079",
|
||||
"from": "CUST-WP-0079-T03",
|
||||
"target": "ACTIVITY-WP-0047",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "ab288f92-d364-5c24-9362-aee451f266c3",
|
||||
"from_task_id": "1be0569c-221d-5925-a0ff-fd2af88e52b1",
|
||||
"to_workplan_id": "ee97869b-dca2-54c9-aa18-0b479c244fb3",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0079",
|
||||
"from": "CUST-WP-0079-T04",
|
||||
"target": "PNEX-WP-0006",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "ab288f92-d364-5c24-9362-aee451f266c3",
|
||||
"from_task_id": "5dd52156-09a8-5781-b288-99ae822f59a6",
|
||||
"to_workplan_id": "774c5037-a3d0-5e65-893c-d18970acd66a",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0080",
|
||||
"from": "CUST-WP-0080-T04",
|
||||
"target": "CUST-WP-0080-T03",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52",
|
||||
"from_task_id": "82378b0f-7004-5c2f-9683-b356a1227576",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "87637402-02f1-57c1-8fbc-4141598af8e3"
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0080",
|
||||
"from": "CUST-WP-0080-T05",
|
||||
"target": "RPF-WP-0056",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52",
|
||||
"from_task_id": "ed8b909a-23bf-5e5f-b600-e477fbae136b",
|
||||
"to_workplan_id": "31933d08-c877-5fda-aff9-6220c3705c92",
|
||||
"to_task_id": null
|
||||
},
|
||||
{
|
||||
"workplan": "CUST-WP-0080",
|
||||
"from": "CUST-WP-0080-T05",
|
||||
"target": "RAPP-PLAYWRIGHT-WP-0004",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52",
|
||||
"from_task_id": "ed8b909a-23bf-5e5f-b600-e477fbae136b",
|
||||
"to_workplan_id": "f9280c40-201e-59b5-a6f0-1aace8e0e2e2",
|
||||
"to_task_id": null
|
||||
}
|
||||
],
|
||||
"refused": [],
|
||||
"notes": [
|
||||
"Preserved bound historical row and task UUIDs: CUST-WP-ADHOC-2026-08-25-RETIRED"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,989 @@
|
|||
{
|
||||
"schema": "custodian.bounded-source-publication.v1",
|
||||
"original_commit": "a69be6cb0773efdc9c3bf214311d11998a6b438f",
|
||||
"remote_base": "d68d131e32c523fcf989fa0e7ad44b60b33c6067",
|
||||
"batches": [
|
||||
[
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/key39-infra-finalization-r1/finalization-recheck-progress.json",
|
||||
"sha256": "a8a2142632f0bf5adc0148542c71b68a9a95e6b98730f5f3b825d6ca945f2d69"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/key39-infra-finalization-r1/finalization-recheck.json",
|
||||
"sha256": "de18dc982213742c86d9b1e21af778a587275d84da128f76d8768204d3f6fee4"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r1/apply_prepare.py",
|
||||
"sha256": "b294e6339e8c9af9ba911667646dd0ab52e75cf798de93238d84d1057c8a9e70"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r1/candidate.patch",
|
||||
"sha256": "df69fb2ec9f1e1cf0dd94194e3c046c995ed8a7deabf65a8e9bec34662adb501"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r1/preparation.json",
|
||||
"sha256": "c6fc0d7393fc40607ee8157ad2c1f92c73549fb8b52abedc517aac27c9137370"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r1/publication-inputs.json",
|
||||
"sha256": "d9bf5555013aa9e399037672c80a72af23c6815db03088bee3db4c8583197146"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r1/run_validation.py",
|
||||
"sha256": "16236aa55a774f8ea6d66da4ee17f7737c6d1b013d844ca9b9759e02b615af51"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r1/task-T35.md",
|
||||
"sha256": "7d14d261ffbab2a930c4a3ff962cec786060cad6177280773cf1c0b0f006127f"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r1/validation-child.py",
|
||||
"sha256": "6bd4e3cda22e65f90bbb4006b403270405947293be2ae8bf8fdade0abed61f45"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r1/validation-guard.py",
|
||||
"sha256": "13611f4de25dc7d01348905c4b365a0ffbb95fd93a61c75c8faf38d705c54f50"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r1/workplan.candidate.md",
|
||||
"sha256": "3bce122c5b83d9044b142fc2cabc48de5558ab0d65dc0223a8ed0325f219e981"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r1/workplan.preimage.md",
|
||||
"sha256": "f92962c5aa21aade0fc2f6b4f8d9a95932fe85b107413cdd2824b6ebe72c36d9"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/apply_prepare.py",
|
||||
"sha256": "b294e6339e8c9af9ba911667646dd0ab52e75cf798de93238d84d1057c8a9e70"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/candidate.patch",
|
||||
"sha256": "df69fb2ec9f1e1cf0dd94194e3c046c995ed8a7deabf65a8e9bec34662adb501"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/canonical-validation.json",
|
||||
"sha256": "12748c25e4177a7e8e38edce9e53ae683c6f4b4369314a5db0d7e2cc1659fc29"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/identifier-assignment.json",
|
||||
"sha256": "1f78bf76592aea84c50dbb3b7181d703b41abdb60937833db30632395cf06673"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/identifier-preview.json",
|
||||
"sha256": "5f28c6fa85de2e9bafbbd5f567c8c755aabfb3fdf4224cac05c1762910ccd512"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/preparation.json",
|
||||
"sha256": "c6fc0d7393fc40607ee8157ad2c1f92c73549fb8b52abedc517aac27c9137370"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/publication-inputs.allocated.json",
|
||||
"sha256": "33dac5218d7b54756b05fea6e1ea885dfc45634896fa3a45b543f9a46dc7afe9"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/publication-inputs.json",
|
||||
"sha256": "0820bbf9c40eda750e2fc374b43745a0ca82c076c9467f1f3e5c26350dd8db9f"
|
||||
}
|
||||
],
|
||||
[
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/revision-refresh.json",
|
||||
"sha256": "a5b341694aaeb84ef8cc7b76eeff3ba7a97f7cc24eb1e2158d3e85ed901c5667"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/run_validation.py",
|
||||
"sha256": "16236aa55a774f8ea6d66da4ee17f7737c6d1b013d844ca9b9759e02b615af51"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/task-T35.md",
|
||||
"sha256": "7d14d261ffbab2a930c4a3ff962cec786060cad6177280773cf1c0b0f006127f"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/validation-child.py",
|
||||
"sha256": "6bd4e3cda22e65f90bbb4006b403270405947293be2ae8bf8fdade0abed61f45"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/validation-guard.py",
|
||||
"sha256": "13611f4de25dc7d01348905c4b365a0ffbb95fd93a61c75c8faf38d705c54f50"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/workplan.allocated.md",
|
||||
"sha256": "53f9e5826bd7e34287d59f46089ee50c31598ba1a56bcf6d3249525f7e23bb9b"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/workplan.candidate.md",
|
||||
"sha256": "3bce122c5b83d9044b142fc2cabc48de5558ab0d65dc0223a8ed0325f219e981"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2/workplan.preimage.md",
|
||||
"sha256": "f92962c5aa21aade0fc2f6b4f8d9a95932fe85b107413cdd2824b6ebe72c36d9"
|
||||
}
|
||||
],
|
||||
[
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-update-r1/candidate.patch",
|
||||
"sha256": "df69fb2ec9f1e1cf0dd94194e3c046c995ed8a7deabf65a8e9bec34662adb501"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-update-r1/edit.py",
|
||||
"sha256": "da1fef62073b92b59307e9f52115fa4fa784b260b5202db9d28fc62938982040"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-update-r1/implementation-r1.json",
|
||||
"sha256": "be1e23dc29be795fb9cdd96172d288a83338c2c0f0cef45d6f29f974d83857df"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-update-r1/run.py",
|
||||
"sha256": "8ad707bd9bb509e4b27503c284cee8aff3a7205882ca87febdace0a050c5f749"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-update-r1/test_runner.py",
|
||||
"sha256": "d6f4e8f0f5c34557bf678543ae2c69202dc321f1226c2e1a2d462b2d81efc9c5"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/canonical-validation.json",
|
||||
"sha256": "0e3cf1ad47f8aa486e8a6704563dfb548a59b7c19f1c7c639e0599a1cc026cb9"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/consistency.json",
|
||||
"sha256": "b76e4abfa87880dedb40f3bc87caed622237678c8745a26d34f4a70cb06ed242"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/consistency.stderr.txt",
|
||||
"sha256": "f4a6aa1609a13600a0b97cbb08bbc03b3e247b619ff37912d37f7e109ce798ba"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/projection.json",
|
||||
"sha256": "454680e758b154d8439cd9d458e9fb8b29dbff4fc501eaf2ea9b6b3c5147b057"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/projection.stderr.txt",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/publication-commit.json",
|
||||
"sha256": "0e51461bb6934d3bf68d9c49023b0f2d7f10f451137cfe6e36a9c1000aa0972a"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/publication-inputs.final.json",
|
||||
"sha256": "8885f9a3561d5a48dc1cde11a86b374d65d5d81f32b8ef684e73a22bd0200c1c"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/publication-inputs.json",
|
||||
"sha256": "a0dcaecd1af428c4bfe6176d77d4595f260f351b4ddb61766141f6e8ba5db62c"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/run_validation.py",
|
||||
"sha256": "16236aa55a774f8ea6d66da4ee17f7737c6d1b013d844ca9b9759e02b615af51"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/validation-child.py",
|
||||
"sha256": "6bd4e3cda22e65f90bbb4006b403270405947293be2ae8bf8fdade0abed61f45"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/validation-guard.py",
|
||||
"sha256": "13611f4de25dc7d01348905c4b365a0ffbb95fd93a61c75c8faf38d705c54f50"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/validation-inputs-refresh.json",
|
||||
"sha256": "7c359c9c05b1d5737166b59686eb765e4ba2e34497290a921704e0becdceb4a3"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/verified-task-bindings.json",
|
||||
"sha256": "610ef9e256a8be8ada2af16d71675af53aecd9340436140936f93b1432fd1c43"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-issuer-reference-integration-r1/apply.py",
|
||||
"sha256": "98285ff57389e37fa1f5d8d0f1b3fcbea9c7fad7927e6ee29fb890c4696e3877"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-issuer-reference-integration-r1/composition-regenerated.json",
|
||||
"sha256": "773daa1df72cc7cf6a6d8aa082208181ca2438cdecc9179b1bc5b1c3a09099c2"
|
||||
}
|
||||
],
|
||||
[
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-issuer-reference-integration-r1/initial-syntax-failure.py.txt",
|
||||
"sha256": "2f9d6e97df945195225573e976b4d809c784d51a59bc1611db8ad0b9fff92fd3"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-issuer-reference-integration-r1/type.preimage.yaml",
|
||||
"sha256": "e75fe94110ef9fb7fb18072fe2856941b33507c99cb406d36576046481485d0a"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-issuer-reference-integration-r1/verification.json",
|
||||
"sha256": "9092dc8d772155b1a68fb23095b45233727d718eb8e255dd6894a518bd50f01c"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-issuer-reference-integration-r1/workplan.preimage.md",
|
||||
"sha256": "53f9e5826bd7e34287d59f46089ee50c31598ba1a56bcf6d3249525f7e23bb9b"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/README.md",
|
||||
"sha256": "78a4dbef0088f18db2b9c1dbe701b3e8a2c20516ae6d2039420a82b8d6b1fe66"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/canonical-application.json",
|
||||
"sha256": "f3e08764dac6d407beb33b22afe9c154efd761c4f12f6b3d4941fc6b9076a233"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/canonical-net-kingdom-status-after.txt",
|
||||
"sha256": "354b3dd65c711df0855c22ba053a4ca295d5491941c5a64c1157a0b7d43cf4cb"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/canonical-validation.json",
|
||||
"sha256": "232416ea6fc095e868ec0f2af34a6b9c44885561b98cba2576ff72a49fc71bb4"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/implementation.json",
|
||||
"sha256": "33d51784fe3ab7d9307292a265b0e684a8bc2fc77564ba58099833e41c849306"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/manifest.json",
|
||||
"sha256": "9e137321abde7c2997f30a4ae7978883879c194a4c70c80ebf64d1972ecd66d5"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/preimage-frozen.txt",
|
||||
"sha256": "63dd3d754896c0e8578d82f98ae6f8e460a6ac43f3937a95fa61f65f8aa4accf"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/preimage-mutant.txt",
|
||||
"sha256": "6c823ed279c355a34169d7753817256890d56fe4a1996ea59aa01fb19e5a5e1f"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/reproduce-scratch-checks.py",
|
||||
"sha256": "8f0b01e606c03b3b27b178df60eab664a758df6fa3f9b1bc62ef8b58122c2cd8"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/scratch-kernel-mutation.patch",
|
||||
"sha256": "dd12c63bd331b8f127149c402077e49fc66d62a452f48044486f58e79e0e29f7"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/scratch.json",
|
||||
"sha256": "7e329154c5c60528d9f4387f0bbc9cfb4167c79decd49b14497e67d59e21e469"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/successor-frozen.txt",
|
||||
"sha256": "275324dcf33eb852eb467832ff18fe9dd09f09d64d6ac37b43bf01766ea745d3"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/successor-mutant.txt",
|
||||
"sha256": "9f03083de5863b3855e533b94671cfbab6fd0dd565e0a0b8c385d51d9510d97c"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/test-admit-1-3-agent-mint-coverage.patch",
|
||||
"sha256": "5bc1da176836eea65195cfe5fae965284c1f38809a502a0be58c231b60111a75"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/test-results.json",
|
||||
"sha256": "2aab986ed96fb9fa683992051ffe6ec7b2a9327d816542b908dcc66f9dd8df23"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/test_admit_1_3_type.after.py",
|
||||
"sha256": "c512ba00513d066fd1ca8af08fd6bf106fbd7a132981b1dcc5af80a745ab03f0"
|
||||
}
|
||||
],
|
||||
[
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f1-implementation-r1/test_admit_1_3_type.before.py",
|
||||
"sha256": "f4f6a35cfbada462c939fe357e51fa5d03efc9d20c17a511f224c1359ca0faa5"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/OWNER-REVIEW.md",
|
||||
"sha256": "7983fd841f09bc7584047426912c33d568c97b4c1126776f99aac42b34d2b742"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/canonical-source-readonly-state.json",
|
||||
"sha256": "129d6926bb996e510ab4b41d30e738096b53b71de1fb2dd470fe0ac94848cbec"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/focused-tests.json",
|
||||
"sha256": "8de5862a8d752dce0b3b96a9275e42952a99415a18d3f67c06bf9f5b6008d0e3"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/focused-tests.txt",
|
||||
"sha256": "aab46c51d87198ad4be6dd3078f61286e2faf1ef4d76fa14298698388f78ab24"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/manifest.json",
|
||||
"sha256": "cfbc40890f94302764b7b6302a90ea07e975d1eadad91b9dd9642c45a5b13717"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/netkingdom-entry-point.conditional.patch",
|
||||
"sha256": "6784a21fbd10bd62712be2e0f4929034601c94629aa74ccaa2e93fc815eecd61"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/platform-candidate/docs/keycape-issuer-eso-contract.md",
|
||||
"sha256": "7f59e59b17c58252982931ac61fe50dd7a07340add6c437fe48af36971eafe68"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/platform-candidate/manifests/templates/keycape-issuer-eso.yaml",
|
||||
"sha256": "e17498bd8a4c820041a4105e4efe9c60c6a50953db8f621ff54887080065c743"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/platform-candidate/scripts/keycape_issuer_eso.py",
|
||||
"sha256": "21c5797280c2a7825dbda8ac970d34a0cdef4c6458f68bce0b1c12407f122a87"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/platform-candidate/tests/test_keycape_issuer_eso.py",
|
||||
"sha256": "223d4c5b349062b9f93e6af79e8d5feda44377ba41a11726f6f2b762691e8308"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/platform.candidate.patch",
|
||||
"sha256": "a490df7dee41e15351da8d2906e1342edebb533984befe3d9ae74d952dbb091b"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/review.json",
|
||||
"sha256": "d99db9ab4f326308cde464129bbbb7573434e500fd03c130a37a590bac3643a4"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/source-pins.json",
|
||||
"sha256": "6e896b6196a0aca01ddaf433b4d14cc041fc0296c5dd6404c3a698b941b61bd8"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/structural-and-patch-checks.json",
|
||||
"sha256": "a3dc4cd405c412d4369986cc6736cd2d9eed02d4b86d95d62d5a9914106fdb14"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/type.before.yaml",
|
||||
"sha256": "e75fe94110ef9fb7fb18072fe2856941b33507c99cb406d36576046481485d0a"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-implementation-r1/type.candidate.yaml",
|
||||
"sha256": "ef02ddae3167bdd1558193a5f6db0379fb8cc84207531706d5ef35caabc3684f"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/README.md",
|
||||
"sha256": "522392bd35d2e0b22fd097509361d1476200a361c2ced22603d43e5758aa691d"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/canonical-validation.json",
|
||||
"sha256": "2f81d70761b154b042d09321cb3b04e0d30d5f9ce79be05503870d245423bbf5"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/consistency.json",
|
||||
"sha256": "1543d1dcd86706889463e3d0915d1a9aa02b72c3861400a010df44ed4c9b392a"
|
||||
}
|
||||
],
|
||||
[
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/consistency.stderr.txt",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/integrate_platform.py",
|
||||
"sha256": "ef8a1647e54013c0c6f2c11c8f74ef43fc97ceaca99e8f8caa89ee16ff80efba"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/integration-checks.json",
|
||||
"sha256": "0ab8b058414dde1be9c7fd6ee2cb3f246e4deef2036d17472e846fae23bba4b9"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/manifest.json",
|
||||
"sha256": "c52692fb154cd46f1bfa62e7a0cda73241716b1024d992449e24e87e18750bbb"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/netkingdom-entry-point.conditional.patch",
|
||||
"sha256": "6784a21fbd10bd62712be2e0f4929034601c94629aa74ccaa2e93fc815eecd61"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/packet-hashes.json",
|
||||
"sha256": "057f7cf2a6ea98ddd5963cf2608cd8d7a43847048e77aa2c2a571e7f3a3c53d2"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/platform-source/docs/keycape-issuer-eso-contract.md",
|
||||
"sha256": "7f59e59b17c58252982931ac61fe50dd7a07340add6c437fe48af36971eafe68"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/platform-source/manifests/templates/keycape-issuer-eso.yaml",
|
||||
"sha256": "e17498bd8a4c820041a4105e4efe9c60c6a50953db8f621ff54887080065c743"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/platform-source/scripts/keycape_issuer_eso.py",
|
||||
"sha256": "21c5797280c2a7825dbda8ac970d34a0cdef4c6458f68bce0b1c12407f122a87"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/platform-source/tests/test_keycape_issuer_eso.py",
|
||||
"sha256": "223d4c5b349062b9f93e6af79e8d5feda44377ba41a11726f6f2b762691e8308"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/progress-paragraph.md",
|
||||
"sha256": "151199597ba37225e5d46922ae90453f7338c5602ff81b3d870b579278bef2d4"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/projection.json",
|
||||
"sha256": "b52dee68c6dd1d6c6fe6cb412a372f919af53fdab39c116d070ded6f2067af0b"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/projection.stderr.txt",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/publication-commit.json",
|
||||
"sha256": "4d7bfca9479f4fbf57a9ce3b9f737749f47d9e1ecae3afb07897cd16b43e4645"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-publication-r1/publication-inputs.json",
|
||||
"sha256": "fb2893c6a95566849b30aa8ab61bf5f2d24a6ccf61e2242b6bff8a2e05b0004e"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-review-r1/REVIEW.md",
|
||||
"sha256": "508afd5695eda998cf651874c00bcaa14725afd7a52b54a5c27854b0bfc44978"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-review-r1/evidence.json",
|
||||
"sha256": "cc8cf37c1d4f56dfb16233b31e293c158d68cd4c49a1ab1b730205cb325531b6"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-review-r1/focused-tests.txt",
|
||||
"sha256": "fd09c39d8434d0a9ed746dcddd0acd11657d67541c59ab632ef36be1f9cc7ec2"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-review-r1/reproduce.py",
|
||||
"sha256": "61633872de8244db3bc94e32d406479605eceef1f2c6f415164e1b6c0680068b"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f2-review-r1/review.json",
|
||||
"sha256": "99b78098a6eb257b2e58c22b076d43c687cc2708560bba46b82f50129d72aecb"
|
||||
}
|
||||
],
|
||||
[
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/README.md",
|
||||
"sha256": "bff0eb23ce4920da6058bf71a3dace209baca69a97c94bd9db4f765f71044eb2"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/candidate-validation.json",
|
||||
"sha256": "17ed30550f7330beb49b5f866c634e78fbcbf98088fcc3e0ce92faa7b9042524"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/failure_inverse_omitted.txt",
|
||||
"sha256": "543906e345b1b5daa28f0f3cfc620b3e06253cfb65c3a861586630dc63b57608"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/focused-tests-before-admission-binding.json",
|
||||
"sha256": "c11b15e97b3da1c9b4819fec539b17823f98f4e6f39ece9bc5c8422325ddbc8e"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/focused-tests-before-admission-binding.txt",
|
||||
"sha256": "9fb7e13b0e58942d2dc1921fd303ad372b1385841e3df88f5a23365a4a4b95bf"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/focused-tests.json",
|
||||
"sha256": "8b1f7ecf75fedee9c03d1421efc6a6e9dd89eb99da70df5e8e4d47027b5fe331"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/focused-tests.txt",
|
||||
"sha256": "99ddd55245e57dd9047793bd206158c66b723a7fe79cc8e7b785f8183f1e4654"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/implementation.json",
|
||||
"sha256": "fce244e7a8bd1f1b9911c632de4831de291f358375183ff7959dc5615560f6d0"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/manifest.json",
|
||||
"sha256": "5a6c08e13422cd2d21d5df5d9dce41685a6cf1cf1cdcd3a64f807806602f1dfd"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/negative-controls.json",
|
||||
"sha256": "d13a0cf8b22abef1cba502b3fd3fd10c9f40955a3ffa8fee473d6189bfb25783"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/net-kingdom-unchanged-owner-status.txt",
|
||||
"sha256": "354b3dd65c711df0855c22ba053a4ca295d5491941c5a64c1157a0b7d43cf4cb"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/owner-contract-candidate.md",
|
||||
"sha256": "dfdc6573df76647790aabb26e4b228b04047dffd032fc33821024f8bbc9ba941"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/owner_configuration_contract.py",
|
||||
"sha256": "62752f518b78fa7713bdb4d47e68decbf3aa89ecbc7950549ffdc3d08e01c554"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/post_revision_guard_removed.txt",
|
||||
"sha256": "e9e4a134ece9095af5dbf790858b6e3ed44ae9388dde98cbb9a25b4183a16f50"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/railiance-apps-unchanged-owner-status.txt",
|
||||
"sha256": "251b0eb219198e4ad334a76e0b39f23848242354105e97f3f61701168817cdd3"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/test_owner_configuration_contract.py",
|
||||
"sha256": "51482fc5bad6af5c52d736ded7e7031291b18bc4949b9ff43d7dea78f3a8ad94"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/type-owner-configuration-inverse.candidate.patch",
|
||||
"sha256": "6e23967d768759fc10203bcc25d81cb32c3d9222ed6fcb4a510a7cfe90e579bf"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/type.before.yaml",
|
||||
"sha256": "e75fe94110ef9fb7fb18072fe2856941b33507c99cb406d36576046481485d0a"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r1/type.candidate.yaml",
|
||||
"sha256": "739c927ab494f4e0f6618e6e55394dd8dc4b720db428cd4973f7a81524e1ecd9"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/README.md",
|
||||
"sha256": "168b80f6cc0d50650a484d24696022cac8a4cf8279c2fb4da0c112cfbf10fd08"
|
||||
}
|
||||
],
|
||||
[
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/candidate-validation.json",
|
||||
"sha256": "200132ab91899f6cfb2782b19ff59c72056f05197690cecdda708ccbdd343edc"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/focused-tests.json",
|
||||
"sha256": "2f48369c3d00f9a43989486882519ee5c09d4eb1f5be599a92b06ca0d7cc8581"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/focused-tests.txt",
|
||||
"sha256": "436459ced69db381f44a0f14d2ebcf00a4067f596a9881cfdcca7146c237d3a1"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/fresh-inverse-session.candidate.patch",
|
||||
"sha256": "0b4a466c23cdeeb34789ab79c3d7cdc4a186495a910e23bc6491a29b5ff9cff8"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/fresh-session-guard-omitted.txt",
|
||||
"sha256": "f47357c3303b026dcd9edcce564725a1c7d0d77969dd2857a6f1c008f169c1e1"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/implementation.json",
|
||||
"sha256": "8517713a130f23cb38c597d333f65ec27700f347c16dca617e988f1cbc948abf"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/manifest.json",
|
||||
"sha256": "14058734b40a0394a5d26b5063ba60ea343b1ad3ad47b789b9e640637c4e8c4b"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/negative-controls.json",
|
||||
"sha256": "8f96396f3d342f505d1dc6ac235a7f37a7c2481d51d100125f05b26619d3d314"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/owner-backend-next.md",
|
||||
"sha256": "6243d7a70868224cb89fd30818c23ac379f37b6576e4947e444ef5057d06aea8"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/owner-contract-candidate.md",
|
||||
"sha256": "4f9b91a2389acbc52558347a794da02faa6de4fb189373a11feeac10ae7e7c4f"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/owner-source-inventory.json",
|
||||
"sha256": "4510ce7b2f9eb9f4695ef4c57bba888c3839d3adcc397f4b4024be0fa71767bb"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/owner_configuration_contract.py",
|
||||
"sha256": "2cd04432cf3681afc126736f7daacfab46630441aeb223b3e222d6951d24ce2e"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/test_owner_configuration_contract.py",
|
||||
"sha256": "0f4246fea95bd3139c604da8712e6f6ac08976dd34d73e56ba83663ecba42761"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/type-owner-configuration-inverse.candidate.patch",
|
||||
"sha256": "949ef6d3e0acc574e1d69c251d6d09e3da636bc73d043dec1c5677f30de29947"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/type.before.yaml",
|
||||
"sha256": "e75fe94110ef9fb7fb18072fe2856941b33507c99cb406d36576046481485d0a"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-implementation-r2/type.candidate.yaml",
|
||||
"sha256": "6e744be190c4f047e609bef7670ff987fe1606b4d7dac3f740f164bebc205a13"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-review-r1/README.md",
|
||||
"sha256": "659ce8da07ef4f16077b9b2fcf5e89c5c1ed177603f589acf344e57b12ace18f"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-review-r1/fresh-inverse-session.candidate.patch",
|
||||
"sha256": "0b4a466c23cdeeb34789ab79c3d7cdc4a186495a910e23bc6491a29b5ff9cff8"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-review-r1/original-authority-tests.txt",
|
||||
"sha256": "6c5326d4a189509e823110e748a2e6baed9a8b809b15bc0aa61cc247f2a8df35"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-review-r1/patched-authority-tests.txt",
|
||||
"sha256": "2d5029651d5d31355683da0f774a17eb418355714ae42af60b6a7b901b65676e"
|
||||
}
|
||||
],
|
||||
[
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-review-r1/review.json",
|
||||
"sha256": "8199a9937c1091de5101c9a3c6bb0bcc3742677e0b5830e1b6a0b00c06fe85e1"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-f3-review-r1/test_inverse_authority.py",
|
||||
"sha256": "4c83407535dd37e571f293a9cc6b47d787b02b925402741d52c70a5532d76e1c"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/apply_prepare.py",
|
||||
"sha256": "e759865139078a6ea7509fa80c8521d81446a3f6fc236550628df3d1b14a9e50"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/consistency.json",
|
||||
"sha256": "6eae09358f008c873345b417f33e606a70a862786a29cca1e870ed7f48a232b3"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/consistency.stderr.txt",
|
||||
"sha256": "f4a6aa1609a13600a0b97cbb08bbc03b3e247b619ff37912d37f7e109ce798ba"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/identifier-assignment.json",
|
||||
"sha256": "50c3ef9b95557fd01af751a84ee99e17b868fc128f4101c268cee8157f8b72b2"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/identifier-preview.json",
|
||||
"sha256": "5f3bda9eeccf3dd639c2d0bd2315ff1c71e79de021200c53e136559ad658d67e"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/preimage.json",
|
||||
"sha256": "93a300b5e744764221671b4a3534aad0bdf511b7b4b45643dd8c3b1e357b541f"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/projection.json",
|
||||
"sha256": "11cf3e0838f914a2aab970950dbe0d7f32846c11fc7b593791957d3f8381b497"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/projection.stderr.txt",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/publication-commit.json",
|
||||
"sha256": "b692f5d2487bcf5f9a8d6db09bc6b0d4fe4a69ae39a6bf79184a26e32ef5f44a"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/publication-inputs.json",
|
||||
"sha256": "ebb1f954932140654291c0d9ddd6fcd8448e0edabb1dd194e82bd7633d2a71ea"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/workplan.allocated.md",
|
||||
"sha256": "f92962c5aa21aade0fc2f6b4f8d9a95932fe85b107413cdd2824b6ebe72c36d9"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/workplan.candidate.md",
|
||||
"sha256": "f1e5245f565da2cc35b5e2d0adfcad42325c64205525d3f96171e604d8935708"
|
||||
}
|
||||
],
|
||||
[
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/nk48-r5-source-followthrough-r1/workplan.preimage.md",
|
||||
"sha256": "1502f1f474856172d969489cab8c0642d9456d93d326f6660df3772a4716d30b"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/owner-source-state.json",
|
||||
"sha256": "c9d3d3ae1372007b35526d592d3a7ea2d2bc6374d34840ef02fdda9535973785"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/prepare.py",
|
||||
"sha256": "749703026767ccb196c01ac8b4c9fafbcdbd564d20ae73b468e297a114f073d6"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/candidate.patch",
|
||||
"sha256": "1a3530a1e469fc03c2c29f1b66fa3ba1904e56bf2abcfb242c7a2ed015fb3e74"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/candidate/src/warden/case_run.py",
|
||||
"sha256": "1bc73e30ac718fd75bbaff2a739495fc051aeaec73802ac71f0583cb2d53ab0a"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/candidate/src/warden/case_type.py",
|
||||
"sha256": "7b659b8d682863cd28df24025be4b10dd7ca3df724350a22d360c6af9615bca7"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/candidate/src/warden/routing/models.py",
|
||||
"sha256": "b85372b2572a49af62e9534f26a33963b894633c7cd43dd2a28416b8959cba3e"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/candidate/tests/test_case_1_3_integration.py",
|
||||
"sha256": "4862c5a004075eb18733d354bee7dda3f55e04a6ee8ecb44b76166347c121158"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/candidate/tests/test_case_admission_modes.py",
|
||||
"sha256": "9110d6b6286cf0f85268d4970d1fd403250da3f04351d70b1fd2d9d7a93e2d89"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/candidate/tests/test_case_attended_boundary.py",
|
||||
"sha256": "4615e653f06144305ea1a84e98bc6260e16ed41ef9e5db2d0f162ef9f723ef2d"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/evidence/run.py",
|
||||
"sha256": "19746062528f63909a268e8d97e801c9d116d57e5a1c0e148b2a22ec0ecd0f8f"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/evidence/sitecustomize.py",
|
||||
"sha256": "ffaa62732340efd8d40bb54a3c4499cb62a89896e5ee825c8fe7b5d2bf93db22"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/implementation-r1.json",
|
||||
"sha256": "b9ee843bba417c82ad77ac8a221cf64dd5088aa640528524b2e0ef0c129d3184"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-fixes-r1/test-isolation-proposal.patch",
|
||||
"sha256": "0f6c46303ec24f337e4190ec84773ccefb4833241233b4b7d56bd1927eba838c"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review-r2/integration_runner.py",
|
||||
"sha256": "d77da107d67ec827f19e0c46045a2802081a62283c3bdb5bfec35feabb454234"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review-r2/kernel-review-r2.json",
|
||||
"sha256": "9002efdac67f451ef4fc59c02056c8e3ed23de57677ee9974d7477614960e515"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review-r2/reviewer-probes.py",
|
||||
"sha256": "e52025893ca0755b3a62e2585cf2f16002a5b705f7cfb0582b05435d3b9e336a"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review-r2/run-baseline.py",
|
||||
"sha256": "02e2a409cd23fb52f518c202c923877fdcc381f708b4e8d77bad04e034b46e73"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review-r2/run.py",
|
||||
"sha256": "c6f931ba4ff9b0ef42627030a016dd7ebe3f353b3024f1c40b80df890aefe59f"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review-r2/setup.py",
|
||||
"sha256": "fcdeb50a196ce5afda6243b9fb51584af58ba5d55e75a4caed017f742d560500"
|
||||
}
|
||||
],
|
||||
[
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review-r2/sitecustomize.py",
|
||||
"sha256": "6b7cec873fa1fca6767b77f514bec499adb5e1e7745dbc8eddf36771917ad4f4"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/commit.json",
|
||||
"sha256": "16883619d6ae1433b30c61ea2fbb8ada44f4423d1102a9390867efa580d15de2"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/consistency-preimage.json",
|
||||
"sha256": "9c8d006e95c32bbd689c16a5ee575e3d54c46b327d5f2f47a697570480d8e9fb"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/consistency.json",
|
||||
"sha256": "8032a9d073c6334bc7136ca88a2878b2525f552c4e25266884d45456f4152fb6"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/consistency.stderr.txt",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/focused-tests.txt",
|
||||
"sha256": "a25e2b6355475168ff5a9dba6deec605584711d5c63de8ddc3da4644c93f6a5e"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/integrate.py",
|
||||
"sha256": "8eab2d72e67a9af5230d7978d9533d964b8162a85a7fc053a210da05b3a5219d"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/integration.json",
|
||||
"sha256": "0781a745e9bcb4e052c80818a71695a1c91672345c7cfd7628fb0a56a7075d82"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/normal-sync.json",
|
||||
"sha256": "00a81cede4636a8adcbb2315a3a79c69d472accbab83f5d99cbb51a5ffa48653"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/normal-sync.stderr.txt",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/publish.py",
|
||||
"sha256": "c632d670d3b53efbf7a1b5c2c29402e3e5d57cce3a40f119e672153e3fe21189"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/verification.json",
|
||||
"sha256": "f6d9efb1f3118a80945465b08ba17e26b76ab14d017e7fba56ab3e911767b2ac"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-kernel-source-integration-r1/workplan.preimage.md",
|
||||
"sha256": "721a90b2ed8c896257c34a1451eb642cb8824c8263e37c483fb61b36adc54088"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/commit.json",
|
||||
"sha256": "7bf38dbd9c4b6c59f6b1b45e86abeba8bff2a7a0e847da85f7e7e6f422a99186"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/consistency.json",
|
||||
"sha256": "b70a0b6356d42b173b9d11af7c0f4df6850e4c3bc186dee69a7348f2d66e62bc"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/consistency.stderr.txt",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/full-unit-result.json",
|
||||
"sha256": "9f9460f8b0f06e5f5668e554a059300ed5b40fbb1ea0ffc3e1092fe0ac11a4f0"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/integrate.py",
|
||||
"sha256": "333d24d6f01d6d23b571e02846d71938ae8b78fee63aefbe90d7a7c1888cf7e1"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/integration.json",
|
||||
"sha256": "663628195799e298e47e01cf9067fddc0f21a1c06967d11266c2fdc8a9e68bf0"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/prepare_publication.py",
|
||||
"sha256": "5a22d66b1986c5b17414ea5d70dbd42bda1f69c24941bc80a6aeca86c79d4795"
|
||||
}
|
||||
],
|
||||
[
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/projection.json",
|
||||
"sha256": "1d63a42ddbe4055fb70035948f3e2dea2dd167498bad87282f095ecfcdb32a89"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/projection.stderr.txt",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/publication-commit.json",
|
||||
"sha256": "ced6545c22193dd4d8dc272bf16603a9ed9cf0973e21c94a97ede68f289dc423"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/publication-inputs.json",
|
||||
"sha256": "bc2f8fd65e7517849f52c888baf89f7f160b20027a946d3aacbf1e5c5aa5102f"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-integration-r1/root-disposition.json",
|
||||
"sha256": "190780394f6b062be7483c40da28ab1d28a6a29794fb88dc2e77264faa60b9f7"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/README.md",
|
||||
"sha256": "7322316db3fdd7107efe82d42166a25dd494161f8062aaa833b4497392fd04bb"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate.patch",
|
||||
"sha256": "1fe65076ce7e633be304fc779bf2c87b7ee1e4e460de55ca74355b5842d036f5"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/Makefile",
|
||||
"sha256": "8cf08ec680ed6bd323a1ce8475ade731dbeebcd64ffd43ecd169308f8a727940"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/docs/development/safe-unit-tests.md",
|
||||
"sha256": "b157c3e6956a41dcd9fc3912d0c7d09a664f11f08f0f8a8e4cae57fac9747cf7"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/scripts/run_unit_tests.py",
|
||||
"sha256": "8157e44df298fa4c47c6c08b2dc68e3ac945c4beb3f47a251a7afbbc55eb1bd2"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/fixtures/workload-coverage/provenance.json",
|
||||
"sha256": "a4a203c1bd7bc5b8039d1b2525bea65dbae288a3f552969e4218cd5abda96990"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/fixtures/workload-coverage/rapp-core-hub/declarations/rapp.yaml",
|
||||
"sha256": "9ce902da0c77809f1094a634244652835b162f59682e9fa6923d8c8aa4ed4a3c"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/fixtures/workload-coverage/rapp-issue-core/declarations/rapp.yaml",
|
||||
"sha256": "a1956deecf2f0fbca44549e5ea5e8f1c4b74ebf91a9482c64c982491af0d923b"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/fixtures/workload-coverage/rapp-qonto/declarations/rapp.yaml",
|
||||
"sha256": "15aa9809e8d6a120c516be5ce9adfb72c00382140c171e791083ad117f503b3f"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/test_case_plan.py",
|
||||
"sha256": "944bc2a725ca1b7a10f4516c3ceed65f99627057dd15a859da4f8ffb3d97e71f"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/test_case_type.py",
|
||||
"sha256": "5a217a172e7e2ffbea66f1beee9a1c18bf5e97f9fb25b83cb96b6ba976cbb2a5"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/test_layer_conformance.py",
|
||||
"sha256": "3edf0a0d49c3560278a564c477834335cfaf5243341cb9345f0d4bf8994db56c"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/test_safe_unit_runner.py",
|
||||
"sha256": "6b623d18879e7564dd11447c16d3ec9f80321a25a525fcd0306b6a903a68031a"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/test_workload_join.py",
|
||||
"sha256": "1828908a5cd1f0bc13ca367dbd1245221c52d1ac60789c9e3bd51dd36cb8beb9"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/tests/unit_isolation_probe.py",
|
||||
"sha256": "726d3e01ae21c1379588e1f08459449908cc8a75ffea1b337c33a1a888c66f59"
|
||||
}
|
||||
],
|
||||
[
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/candidate/workplans/WARDEN-WP-0044-security-case-follow-through.md",
|
||||
"sha256": "074bfcf2f7841e78bcd404bf573982d244b00f2f500e198b7fe80fea660de991"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/implementation.json",
|
||||
"sha256": "8033b323178e1d3b031a45466687fe05479627e99559d9de7b3baef52ab8671f"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1/packet-hashes.json",
|
||||
"sha256": "1567ff1ad558fdb464818bb555dab79152477c85113f89874daa3049029733a8"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-review-r1/review-r1.json",
|
||||
"sha256": "6cb7e3d1af81ffbf9bd4908841ae5c4772a96c909965f077e5ffd8dc57f0b8b4"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-review-r1/reviewer-correction.patch",
|
||||
"sha256": "9407289f8da41ed6fff367baf566ad30f5510a2627c14e0ac0cf971bf9b465c9"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-review-r1/reviewer-probes.py",
|
||||
"sha256": "0b49fc2ad7aeeca0cabb0961b06d8cdc85ae5109f36bf81e4245e55127357574"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-review-r1/run.py",
|
||||
"sha256": "f7fc81b8acbcd0712ee5f79a16b27aa1cdd0af11db761f9e94fba8b91e51ec8a"
|
||||
},
|
||||
{
|
||||
"path": "docs/netkingdom-target-implementation.md",
|
||||
"sha256": "8452750de483b79a2cbb09b192d18cf6dc421ad736dd06c738af0727c3d74854"
|
||||
},
|
||||
{
|
||||
"path": "docs/netkingdom-target-security-architecture.md",
|
||||
"sha256": "ec2079be18c7cdb8a1e4fdbd22131c08c83721d7a1bf18b4802bc5e229520f35"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r2/public-digest-derivation.json",
|
||||
"sha256": "534790dec14d324cd2e0f3a81b5becc82504e54c5af3ad7b32282dc1e39a542f"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/scanner-blocked-paths.json",
|
||||
"sha256": "0038027e83923e08b426b5e172445331e134e15edd2877999d3005ce06e351a9"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/publication-commit.json",
|
||||
"sha256": "a39a1c5824d72f3ee0008d140656b0f4005b051353948f1237a9b47f9aa4f14f"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/warden-progress.json",
|
||||
"sha256": "5c791f3d5e784a71ac79fce1c75b922956e70a92cbcd2bedd50a3ac8e7bbfd78"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/netkingdom-progress.json",
|
||||
"sha256": "b36b3916f4726d98af6711591f207d1401266ecd3d8b2b1382df42ceb948378d"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/source-corrections-publication-r1/platform-progress.json",
|
||||
"sha256": "f795c81b8fbcf71313d5dd29a98c53d845d976bb8aead76cadeafaedb60b57d5"
|
||||
},
|
||||
{
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md",
|
||||
"sha256": "2f4adf4348346e31c4581754352f0d3329231af75333b988d2dc336d4f4b8a35"
|
||||
}
|
||||
]
|
||||
],
|
||||
"source_tree_unchanged": true,
|
||||
"history": "Publish bounded commits from existing remote base, then retain original local commit in a normal merge with identical tree; no reset/amend/force push.",
|
||||
"controls": "Every batch runs same pinned local staged scanner explicitly plus normal commit hooks and unchanged server pre-receive. Fixed-path local hook does not select the scanner for /tmp worktrees, so explicit identical scanner invocation compensates without altering hooks.",
|
||||
"final_projection": "Normal rmgr sync --push; primary expected/derived commit and task bindings verified. Required prior consistency applies to byte-identical source tree."
|
||||
}
|
||||
|
|
@ -0,0 +1,79 @@
|
|||
{
|
||||
"status": "published-and-projected",
|
||||
"commit": "05df7c3ee4d31879e7e0074e3210656b4f795794",
|
||||
"original_commit_retained": "a69be6cb0773efdc9c3bf214311d11998a6b438f",
|
||||
"bounded_commits": [
|
||||
{
|
||||
"batch": 1,
|
||||
"commit": "d8d63778f66c97ebc0d46fa767299f9ea877e9dd",
|
||||
"files": 20
|
||||
},
|
||||
{
|
||||
"batch": 2,
|
||||
"commit": "0543257514ddee7d760ae1d366d9e818e10cb0f1",
|
||||
"files": 8
|
||||
},
|
||||
{
|
||||
"batch": 3,
|
||||
"commit": "935aed2bcb2db3b2213c4de0489eb59658fa7c6c",
|
||||
"files": 20
|
||||
},
|
||||
{
|
||||
"batch": 4,
|
||||
"commit": "42e18ef0c827e981bdee823bd80d4e5d7a048127",
|
||||
"files": 20
|
||||
},
|
||||
{
|
||||
"batch": 5,
|
||||
"commit": "5c456215ea2eea89015e36e48cedfc95385c304b",
|
||||
"files": 20
|
||||
},
|
||||
{
|
||||
"batch": 6,
|
||||
"commit": "a4c1f893de931ad648e9b6455b0e44ab81eeab2f",
|
||||
"files": 20
|
||||
},
|
||||
{
|
||||
"batch": 7,
|
||||
"commit": "474354493884c3f1304ef5fab5796d837ac52948",
|
||||
"files": 20
|
||||
},
|
||||
{
|
||||
"batch": 8,
|
||||
"commit": "2d4401a4258d5340b071f9a126d344e9328fd7b8",
|
||||
"files": 20
|
||||
},
|
||||
{
|
||||
"batch": 9,
|
||||
"commit": "285e5900091ee2f940b8fea5755aeddf78492b4f",
|
||||
"files": 14
|
||||
},
|
||||
{
|
||||
"batch": 10,
|
||||
"commit": "30e41c948e7c5f29cf770ac63d50043a615171d9",
|
||||
"files": 20
|
||||
},
|
||||
{
|
||||
"batch": 11,
|
||||
"commit": "df5765e0e18a2daa66cc1c684b6b88af6202e9fe",
|
||||
"files": 20
|
||||
},
|
||||
{
|
||||
"batch": 12,
|
||||
"commit": "e9dc1a0f90d07eb592c1f7b644d881c61c53c63e",
|
||||
"files": 20
|
||||
},
|
||||
{
|
||||
"batch": 13,
|
||||
"commit": "0c21cf1b691b3c8a8ed0865caca5b777be782478",
|
||||
"files": 16
|
||||
}
|
||||
],
|
||||
"source_tree_identical_to_original_and_required_consistency": true,
|
||||
"same_local_scanner_explicit_on_every_worktree_batch": true,
|
||||
"same_server_pre_receive_on_every_push": true,
|
||||
"scanner_policy_or_hooks_changed": false,
|
||||
"preserved_root_paths": 8,
|
||||
"projection": "primary/railiance01",
|
||||
"native_actions": false
|
||||
}
|
||||
|
|
@ -0,0 +1,75 @@
|
|||
from pathlib import Path
|
||||
import hashlib,json,os,stat,subprocess
|
||||
p=Path(__file__).resolve().parent;r=Path('/home/worsch/the-custodian');plan=json.loads((p/'plan.json').read_text())
|
||||
w=Path('/tmp/custodian-source-batches-r3');m=Path('/tmp/custodian-source-merge-r3')
|
||||
original=plan['original_commit'];published=plan['remote_base']
|
||||
protected=json.loads((p.parent/'source-corrections-publication-r1/protected-state.json').read_text())
|
||||
def git(root,*a):return subprocess.check_output(['git','-C',str(root),*a],stderr=subprocess.PIPE,text=True,timeout=90).strip()
|
||||
def preserve():
|
||||
assert git(r,'rev-parse','HEAD')==original
|
||||
for row in protected:
|
||||
assert hashlib.sha256((r/row['path']).read_bytes()).hexdigest()==row['sha256']
|
||||
assert git(r,'ls-files','--stage','--',row['path'])==row['index']
|
||||
def scan(root,label):
|
||||
result=subprocess.run(['python3','/home/worsch/repo-manager/src/repo_manager/secret_scan.py','--path',str(root),'--binary','/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks'],cwd=root,capture_output=True,text=True,timeout=180)
|
||||
(p/(label+'-local-scan.json')).write_text(result.stdout);(p/(label+'-local-scan.stderr.txt')).write_text(result.stderr)
|
||||
assert result.returncode==0 and json.loads(result.stdout)['status']=='clean','same pinned local scanner refused'
|
||||
def normal_commit(root,argv,label):
|
||||
result=subprocess.run(['git','-C',str(root),'commit',*argv],capture_output=True,text=True,timeout=240)
|
||||
(p/(label+'-commit.json')).write_text(json.dumps({'exit_code':result.returncode,'stdout':result.stdout,'stderr':result.stderr},indent=2)+'\n')
|
||||
assert result.returncode==0,'normal commit hook refused'
|
||||
preserve();assert not w.exists() and not m.exists()
|
||||
assert git(r,'ls-remote','origin','refs/heads/main').split()[0]==published
|
||||
git(r,'worktree','add','--detach',str(w),published)
|
||||
receipts=[]
|
||||
for index,batch in enumerate(plan['batches'],1):
|
||||
label=f'batch-{index:02d}';preserve()
|
||||
assert git(r,'ls-remote','origin','refs/heads/main').split()[0]==published
|
||||
names=[]
|
||||
for row in batch:
|
||||
src=r/row['path'];assert not src.is_symlink()
|
||||
raw=src.read_bytes();assert hashlib.sha256(raw).hexdigest()==row['sha256']
|
||||
target=w/row['path'];target.parent.mkdir(parents=True,exist_ok=True);target.write_bytes(raw)
|
||||
os.chmod(target,stat.S_IMODE(src.stat().st_mode));names.append(row['path'])
|
||||
git(w,'add','--',*names)
|
||||
assert set(git(w,'diff','--cached','--name-only').splitlines())==set(names)
|
||||
scan(w,label)
|
||||
normal_commit(w,['--only','-m',f'Record reviewed case source evidence ({index}/{len(plan["batches"])})','--',*names],label)
|
||||
head=git(w,'rev-parse','HEAD')
|
||||
assert set(git(w,'diff-tree','--no-commit-id','--name-only','-r',head).splitlines())==set(names)
|
||||
result=subprocess.run(['git','-C',str(w),'push','origin','HEAD:refs/heads/main'],capture_output=True,text=True,timeout=180)
|
||||
receipt={'batch':index,'commit':head,'previous_remote':published,'paths':names,'exit_code':result.returncode,'stdout':result.stdout,'stderr':result.stderr}
|
||||
(p/(label+'-push.json')).write_text(json.dumps(receipt,indent=2)+'\n')
|
||||
assert result.returncode==0,'unchanged server pre-receive refused bounded batch; stop'
|
||||
assert git(r,'ls-remote','origin','refs/heads/main').split()[0]==head
|
||||
published=head;receipts.append({'batch':index,'commit':head,'files':len(names)})
|
||||
print(json.dumps({'published_batch':index,'of':len(plan['batches']),'commit':head,'files':len(names)}),flush=True)
|
||||
assert git(w,'rev-parse','HEAD^{tree}')==git(r,'rev-parse',original+'^{tree}')
|
||||
preserve()
|
||||
# Keep the original local reviewed commit; no reset, amend or discarded history.
|
||||
git(r,'worktree','add','--detach',str(m),original)
|
||||
git(m,'merge','--no-ff','--no-commit',published)
|
||||
assert git(m,'write-tree')==git(r,'rev-parse',original+'^{tree}')
|
||||
scan(m,'merge')
|
||||
normal_commit(m,['-m','Preserve original reviewed evidence after bounded source publication'],'merge')
|
||||
merged=git(m,'rev-parse','HEAD');assert git(m,'rev-parse','HEAD^{tree}')==git(r,'rev-parse',original+'^{tree}')
|
||||
preserve();git(r,'merge','--ff-only',merged)
|
||||
for row in protected:
|
||||
assert hashlib.sha256((r/row['path']).read_bytes()).hexdigest()==row['sha256']
|
||||
assert git(r,'ls-files','--stage','--',row['path'])==row['index']
|
||||
# Full source tree is identical to the already-passed required consistency run.
|
||||
result=subprocess.run(['/home/worsch/repo-manager/.venv/bin/rmgr','sync','--path',str(r),'--push'],capture_output=True,text=True,timeout=180)
|
||||
(p/'normal-sync.json').write_text(result.stdout);(p/'normal-sync.stderr.txt').write_text(result.stderr)
|
||||
assert result.returncode==0,'normal final publication/projection refused; retain state'
|
||||
data=json.loads(result.stdout);receipt=data['receipt']
|
||||
assert data['ok'] and data['status'] in {'applied','noop'} and data['commit']==merged
|
||||
assert receipt['expected_commit']==receipt['derived_commit']==merged
|
||||
assert (receipt['instance_role'],receipt['instance_label'])==('primary','railiance01')
|
||||
assert receipt['outcome']['counts']['retired']==0
|
||||
assert git(r,'ls-remote','origin','refs/heads/main').split()[0]==merged
|
||||
for row in protected:
|
||||
assert hashlib.sha256((r/row['path']).read_bytes()).hexdigest()==row['sha256']
|
||||
assert git(r,'ls-files','--stage','--',row['path'])==row['index']
|
||||
summary={'status':'published-and-projected','commit':merged,'original_commit_retained':original,'bounded_commits':receipts,'source_tree_identical_to_original_and_required_consistency':True,'same_local_scanner_explicit_on_every_worktree_batch':True,'same_server_pre_receive_on_every_push':True,'scanner_policy_or_hooks_changed':False,'preserved_root_paths':len(protected),'projection':'primary/railiance01','native_actions':False}
|
||||
(p/'publication-result.json').write_text(json.dumps(summary,indent=2)+'\n')
|
||||
print(json.dumps({'status':summary['status'],'commit':merged,'bounded_commits':len(receipts),'source_tree_unchanged':True,'protected_paths':len(protected)}),flush=True)
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
from pathlib import Path
|
||||
import hashlib,json,re,subprocess,urllib.request,datetime
|
||||
r=Path('/home/worsch/the-custodian');p=Path(__file__).resolve().parent;dated=p.parent
|
||||
cfg=json.loads((p.parent/'source-corrections-publication-r2/publication-inputs.json').read_text());publication=json.loads((p/'publication-result.json').read_text());head=publication['commit']
|
||||
assert publication['source_tree_identical_to_original_and_required_consistency']
|
||||
assert len(publication['bounded_commits'])==13
|
||||
def git(root,*a):return subprocess.check_output(['git','-C',str(root),*a],text=True).strip()
|
||||
assert git(r,'rev-parse','HEAD')==head and git(r,'ls-remote','origin','refs/heads/main').split()[0]==head
|
||||
projection=json.loads((p/'normal-sync.json').read_text());rp=projection['receipt']
|
||||
assert git(r,'rev-parse','HEAD^{tree}')==git(r,'rev-parse',publication['original_commit_retained']+'^{tree}')
|
||||
subprocess.run(['git','-C',str(r),'merge-base','--is-ancestor',publication['original_commit_retained'],head],check=True)
|
||||
assert projection['ok'] and projection['status']=='applied' and projection['commit']==head
|
||||
assert rp['expected_commit']==rp['derived_commit']==head and (rp['instance_role'],rp['instance_label'])==('primary','railiance01')
|
||||
assert rp['outcome']['counts']['retired']==0
|
||||
for row in cfg['files']:
|
||||
assert hashlib.sha256((r/row['path']).read_bytes()).hexdigest()==row['sha256']
|
||||
committed=subprocess.check_output(['git','-C',str(r),'show',head+':'+row['path']])
|
||||
assert hashlib.sha256(committed).hexdigest()==row['sha256']
|
||||
protected=json.loads((dated/'source-corrections-publication-r1/protected-state.json').read_text())
|
||||
for row in protected:
|
||||
assert hashlib.sha256((r/row['path']).read_bytes()).hexdigest()==row['sha256']
|
||||
assert git(r,'ls-files','--stage','--',row['path'])==row['index']
|
||||
source_status=git(r,'diff','--name-only','HEAD').splitlines();assert set(source_status)=={x['path'] for x in protected}
|
||||
owners={'ops-warden':'b593c879831378db7dc62adfabdfedf2d44ddd38','net-kingdom':'befb0bc68cd25b625804fce559476eefd702521d','railiance-platform':'104ed90f42a9a86bf9fda343b49b65a85c9ee4b9'}
|
||||
for owner,want in owners.items():
|
||||
rr=r.parent/owner;assert git(rr,'rev-parse','HEAD')==want and git(rr,'ls-remote','origin','refs/heads/main').split()[0]==want
|
||||
checks=[]
|
||||
for owner,name,expected_count in [('the-custodian','workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md',6),('ops-warden','workplans/WARDEN-WP-0044-security-case-follow-through.md',4),('net-kingdom','workplans/NK-WP-0048-security-case-types.md',35),('key-cape','workplans/KEY-WP-0039-openbao-negative-probe-tokens.md',3)]:
|
||||
text=(r.parent/owner/name).read_text();wp=re.search(r'state_hub_workstream_id: "(.*?)"',text).group(1)
|
||||
with urllib.request.urlopen('http://127.0.0.1:8000/tasks/?workplan_id='+wp,timeout=20) as response:tasks=json.load(response)
|
||||
assert len(tasks)==expected_count;by_uuid={x['id']:x for x in tasks}
|
||||
rows=[]
|
||||
for block in re.findall(r'```task\n.*?```',text,re.S):
|
||||
id=re.search(r'^id: (.+)$',block,re.M).group(1);uid=re.search(r'state_hub_task_id: "(.*?)"',block).group(1);status=re.search(r'^status: (.+)$',block,re.M).group(1)
|
||||
task=by_uuid[uid];assert (task['record_id'],task['status'],task['workplan_id'])==(id,status,wp)
|
||||
rows.append({'record_id':id,'uuid':uid,'status':status})
|
||||
assert len(rows)==expected_count
|
||||
checks.append({'owner':owner,'workplan_uuid':wp,'task_count':expected_count,'source_primary_bindings':rows})
|
||||
result={'status':'verified','root_commit':head,'root_changed_files_verified':len(cfg['files']),'owner_heads':owners,'source_primary_task_bindings':checks,'preserved_original_root_dirt':len(protected),'projection':'primary/railiance01','native_target_gates_closed_by_this_work':0,'scanner_policy_changed':False,'failed_and_unknown_outcomes_retained':True,'goal_status':'active','bounded_publication_commits':13,'original_commit_retained':publication['original_commit_retained'],'observed_at':datetime.datetime.now(datetime.timezone.utc).isoformat()}
|
||||
(p/'final-verification.json').write_text(json.dumps(result,indent=2)+'\n')
|
||||
body={'summary':'Published/verified Custodian '+head+' (238 explicit evidence/architecture/workplan files) with owner source heads Warden b593c879, NetKingdom befb0bc6 and Platform104ed90. Kernel attended dispatch/catalog checks, exact proposed issuer reference, independent mint/correct-catalog fixtures and corrected ordinary unit-test accident guard are implemented in source. Root full make test785passed/4deselected; downstream31tests/53subtests and issuer8tests passed. Fresh primary source/UUID/status readback verifies48 task bindings across coordinator6,Warden4,NK35,KEY39three; all31 original NK bindings and all6 coordinator blocks preserved. NK T32/T33/T35done only their declared source outcomes, T34progress actual Apps inverse backend absent; T16/native firstcase and KEY39T02 stay open. All16native target gates remain unclosed. Initial safe-runner rejection, truncation/provenance regressions, unknown old ambient lookup and failed preparations preserved. Root scanner rejected3public-digest metadata blobs; verified43exactpublic artifacts, typed SHA256 values with byte-exact reversible originals and passed unchanged normal hook; no credential encoded/allowlist/scannerpolicy change. Server first rejected large push as unverified/scanner-failed. Thirteen bounded commits each passed the same pinned local scanner and unchanged server hook; final normal merge retains original a69be6c with byte-identical tree, no reset/amend/force push or hook/policy changes. Required consistency reused only for identical source tree. Normal primary projection applied without retirement;8preexistingroot worktree/index edits preserved exactly. Evidence source-corrections-publication-r3/final-verification.json and dated owner packets. Goal remains active; no new native, credential, runtime-profile,1.3pin or draft-lane promotion.','event_type':'note','author':'codex','workplan_id':'dfadb19b-445e-59c6-bcd6-48e87b912c52','task_id':'87637402-02f1-57c1-8fbc-4141598af8e3'}
|
||||
assert not (p/'close-progress.json').exists()
|
||||
request=urllib.request.Request('http://127.0.0.1:8000/progress/',data=json.dumps(body).encode(),headers={'Content-Type':'application/json'},method='POST')
|
||||
with urllib.request.urlopen(request,timeout=20) as response:receipt=json.load(response)
|
||||
(p/'close-progress.json').write_text(json.dumps(receipt,indent=2)+'\n')
|
||||
print(json.dumps({'status':'verified','root_commit':head,'files_verified':len(cfg['files']),'task_bindings':sum(x['task_count'] for x in checks),'protected_root_paths':len(protected),'progress_id':receipt['id'],'goal':'active'}))
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
[
|
||||
{
|
||||
"path": "container/state-hub/main-51bc70d",
|
||||
"status": 401
|
||||
},
|
||||
{
|
||||
"path": "?type=container&q=state-hub&limit=10",
|
||||
"status": 401
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
{
|
||||
"status": 401,
|
||||
"challenge": "Bearer realm=\"https://forgejo.coulomb.social/v2/token\",service=\"container_registry\",scope=\"*\""
|
||||
}
|
||||
33
docs/changes/netkingdom-target-2026-10-17/sync_custodian.py
Normal file
33
docs/changes/netkingdom-target-2026-10-17/sync_custodian.py
Normal file
|
|
@ -0,0 +1,33 @@
|
|||
"""Required consistency/projection with exact restoration of unrelated work."""
|
||||
from pathlib import Path
|
||||
import hashlib
|
||||
import json
|
||||
import subprocess
|
||||
|
||||
ROOT = Path('/home/worsch/the-custodian')
|
||||
BASE = Path(__file__).resolve().parent
|
||||
BACKUP = BASE / 'custodian-publication-backup'
|
||||
originals = json.loads((BACKUP / 'originals.json').read_text())
|
||||
other = json.loads((BACKUP / 'other-dirty-hashes.json').read_text())
|
||||
def git(*argv):
|
||||
return subprocess.check_output(['git', '-C', str(ROOT), *argv], stderr=subprocess.PIPE)
|
||||
try:
|
||||
for label, argv, timeout in [
|
||||
('consistency', ['statehub', 'fix-consistency', '--repo', 'the-custodian', '--json'], 300),
|
||||
('projection', ['/home/worsch/repo-manager/.venv/bin/rmgr', 'sync', '--path', str(ROOT), '--push'], 180),
|
||||
]:
|
||||
result = subprocess.run(argv, cwd=ROOT, capture_output=True, text=True, timeout=timeout)
|
||||
(BASE / ('custodian-' + label + '.json')).write_text(result.stdout)
|
||||
(BASE / ('custodian-' + label + '.stderr.txt')).write_text(result.stderr)
|
||||
assert result.returncode == 0, label + ' failed; receipt retained'
|
||||
finally:
|
||||
for name, entry in originals.items():
|
||||
(ROOT / name).write_bytes((BACKUP / (name + '.worktree')).read_bytes())
|
||||
mode, oid, stage, path = entry.split()
|
||||
assert stage == '0'
|
||||
git('update-index', '--cacheinfo', mode, oid, path)
|
||||
assert git('ls-files', '--stage', '--', name).decode() == entry
|
||||
assert all(hashlib.sha256((ROOT / name).read_bytes()).hexdigest() == pin for name, pin in other.items())
|
||||
receipt = json.loads((BASE / 'custodian-projection.json').read_text())
|
||||
assert receipt['status'] == 'applied'
|
||||
print(json.dumps({'status': 'applied', 'commit': receipt['commit'], 'other_work_preserved': True}))
|
||||
32
docs/changes/netkingdom-target-2026-10-17/sync_receiver.py
Normal file
32
docs/changes/netkingdom-target-2026-10-17/sync_receiver.py
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
"""Required owner projection; retain the sandbox failure and unrelated state."""
|
||||
from pathlib import Path
|
||||
import hashlib
|
||||
import json
|
||||
import subprocess
|
||||
|
||||
BASE = Path(__file__).resolve().parent
|
||||
ROOT = Path('/home/worsch/state-hub')
|
||||
def git(*argv):
|
||||
return subprocess.check_output(['git', '-C', str(ROOT), *argv], stderr=subprocess.PIPE)
|
||||
names = ['.custodian-brief.md', 'WORK-RECORDS.md', 'docs/evidence/legacy-meter-weekly-review-20261014.json']
|
||||
before = {name: hashlib.sha256((ROOT / name).read_bytes()).hexdigest() for name in names}
|
||||
index = git('ls-files', '--stage', '-z')
|
||||
head = git('rev-parse', 'HEAD').decode().strip()
|
||||
assert head in {'51bc70d1ff8f25450a8650d8e50caf053093a02e', '086d79a2736e34b916bd7de3c8a65e2ea38a3d64'}
|
||||
label = 'state-hub-source-projection' if head.startswith('51bc70d') else 'state-hub-readiness-projection'
|
||||
for name in [label + '.json', label + '.stderr.txt']:
|
||||
old = BASE / name
|
||||
saved = BASE / ('sandbox-failed-' + name)
|
||||
if old.exists() and not saved.exists():
|
||||
saved.write_bytes(old.read_bytes())
|
||||
r = subprocess.run(['/home/worsch/repo-manager/.venv/bin/rmgr', 'sync', '--path', str(ROOT), '--push'],
|
||||
cwd=ROOT, capture_output=True, text=True, timeout=180)
|
||||
(BASE / (label + '.json')).write_text(r.stdout)
|
||||
(BASE / (label + '.stderr.txt')).write_text(r.stderr)
|
||||
assert all(hashlib.sha256((ROOT / name).read_bytes()).hexdigest() == pin for name, pin in before.items())
|
||||
assert git('ls-files', '--stage', '-z') == index
|
||||
assert r.returncode == 0, 'projection failed; retained receipt'
|
||||
value = json.loads(r.stdout)
|
||||
assert value['status'] == 'applied' and value['commit'] == head
|
||||
print(json.dumps({'status': value['status'], 'commit': value['commit'],
|
||||
'preserved_other_changes': True, 'counts': value['receipt']['outcome']['counts']}))
|
||||
|
|
@ -0,0 +1,134 @@
|
|||
# TLS recovery disposition proposal
|
||||
|
||||
The existing cert-manager lifecycle supplies a concrete trusted reissue option
|
||||
for a separately approved standalone isolated KeyCape drill. It does not establish
|
||||
cluster-loss independence. This packet proposes that disposition for the actual
|
||||
owners to review; no owner/founder acceptance, certificate request, private key
|
||||
generation, Secret access, tool installation or production change occurred.
|
||||
|
||||
## Identity invariants
|
||||
|
||||
The immutable recovery identity is the archived KeyCape OIDC issuer URL,
|
||||
original RS256 signing key/JWKS, registration and policy state. The HTTPS leaf
|
||||
certificate and its TLS private key are separate, renewable transport material.
|
||||
Neither the identity-only Storage Share archive nor the current admission source
|
||||
contains an archive-time ingress leaf fingerprint. Requiring that unavailable
|
||||
historical leaf's exact bytes is not an existing source invariant.
|
||||
|
||||
The admission **does** require an exact `tls_cert_sha256` and `trust_sha256` for
|
||||
the material selected for this attempt. The session compares those bytes, checks
|
||||
the certificate/key pair, and uses the supplied trust for native hostname/chain
|
||||
validation. Archived config must still equal the admitted issuer; the restored
|
||||
original signing key must still match live JWKS. Reissuing a leaf changes none of
|
||||
those requirements. Existing `original_https_issuer_and_trust_preserved` evidence
|
||||
describes the issuer origin and admitted trust, not archival TLS leaf equality.
|
||||
|
||||
Three bounded checks against the actual existing metadata validator show that
|
||||
two separately supplied synthetic leaf hashes are accepted and a missing leaf
|
||||
hash refuses before any source/private-content read. They are metadata evidence,
|
||||
not CA, key pairing, issuance or native proof. No new mode/approval field,
|
||||
fallback, permanent test or redundant certificate framework was added.
|
||||
|
||||
## Actual public lifecycle and trust evidence
|
||||
|
||||
Read-only observations are timestamped independently in
|
||||
live-public-resource-observations.json. On the verified node 92.205.62.239:
|
||||
|
||||
- `sso/Certificate/kc-tls` is controlled by Ingress/keycape, Ready at revision 4,
|
||||
with SAN kc.coulomb.social, ClusterIssuer/letsencrypt-prod, validity
|
||||
25 September–24 December 2026 and scheduled renewal 24 November.
|
||||
- The Ready issuer uses the production Let's Encrypt ACME directory, HTTP-01
|
||||
with ingressClassName traefik. Only the ACME account Secret **name** was read.
|
||||
- Controller v1.18.2 has the HTTP-01 solver and resolver 1.1.1.1:53. Existing
|
||||
NetworkPolicy permits Traefik to solver pods on TCP 8089. DNS resolves the
|
||||
hostname to the cluster's IPv4/IPv6 addresses from the workstation.
|
||||
- The issuer/ingress field managers include kubectl-client-side-apply. No Argo
|
||||
tracking annotation or source Application mapping for this ingress/issuer was
|
||||
observed in the projected fields. This is a bounded observation, not proof
|
||||
that no other GitOps source exists. Canonical namespace intent is NetKingdom's
|
||||
ingress/issuers YAML; Railiance Cluster owns certificate/ingress plumbing.
|
||||
|
||||
The current public endpoint passes normal hostname/system-CA verification.
|
||||
Its leaf issuer is Let's Encrypt YR1. Public chain, public leaf and independent
|
||||
pre-existing system trust anchor are retained with hashes; no key or Secret was
|
||||
read. This demonstrates today's trusted path, not original private-key custody
|
||||
or a successful future issuance. The source and trust observations are separate.
|
||||
|
||||
## Proposed standard issuance action
|
||||
|
||||
Use the existing cert-manager [cmctl CertificateRequest command](https://cert-manager.io/v1.18-docs/reference/cmctl/).
|
||||
It creates a local key and public CSR, submits a CertificateRequest and saves
|
||||
the resulting certificate locally. This avoids exporting the production
|
||||
kc-tls Secret or renewing/replacing it. The reviewed
|
||||
[v2.6.1 source](https://github.com/cert-manager/cmctl/blob/7e56321dbec4f62ea5428b8656c871c6dc0cc112/pkg/create/certificaterequest/certificaterequest.go)
|
||||
writes local key material before request creation; staging protection must
|
||||
therefore precede invocation. Its exact flags and released Linux amd64 checksum
|
||||
are retained in cmctl-primary-source.json. The binary is absent locally and was
|
||||
neither downloaded nor executed. The published checksum was checked against
|
||||
release metadata; the available Cosign bundle was not verified, and no runtime
|
||||
admission is claimed.
|
||||
|
||||
reissue-command-proposal.json binds the candidate tool/version/hash, exact
|
||||
namespace, dedicated request, public Certificate **template**, output paths,
|
||||
timeout and verification/cleanup obligations. The template is consumed locally
|
||||
by cmctl; it is not a proposed apply of a Certificate or TLS Secret. The action
|
||||
creates a public CertificateRequest and normal transient ACME Order/Challenge/
|
||||
solver resources. This still requires the actual owner's scoped live authority
|
||||
and founder go through the existing T35/RCLUSTER18 process.
|
||||
|
||||
HTTP-01 requires domain routing and external TCP 80 reachability, cert-manager,
|
||||
its webhook/controller, Traefik/solver networking, Kubernetes API, DNS resolution,
|
||||
ACME service availability and CA limits. The exact existing configuration is
|
||||
HTTP-01; switching to DNS-01 or a new off-cluster issuer is not proposed.
|
||||
[HTTP-01 documentation](https://cert-manager.io/v1.18-docs/configuration/acme/http01/)
|
||||
and [CA validation requirements](https://letsencrypt.org/docs/challenge-types/)
|
||||
support these dependencies. Today's Ready status is not a future validation
|
||||
guarantee or an external-vantage port-80 test.
|
||||
|
||||
## Protected private staging and remaining review
|
||||
|
||||
Before cmctl writes any key, the existing owner process must register a fresh
|
||||
0700 owner-owned directory on actual tmpfs, with exact device/inode/run binding,
|
||||
an independent surviving cleanup observer, exact child identities and a bounded
|
||||
deadline. The existing isolated session has relevant register_workdir,
|
||||
start_reaper and cleanup_workdir seams, but its current reaper is bound to the
|
||||
Docker recovery execution. It has not been admitted for an earlier networked
|
||||
certificate-issuance child. A shell exit trap alone is insufficient for hard
|
||||
parent loss. RCLUSTER-WP-0018-T03 owns that bounded staging/command adaptation
|
||||
and generated success/failure/timeout/parent-loss proof before an actual key.
|
||||
|
||||
After issuance, verify public hostname/validity/CA provenance and independent
|
||||
trust, record exact selected certificate-chain/trust hashes, and retain the
|
||||
matching TLS key only in that private custody boundary through the original
|
||||
six-argument isolated launcher. Record the accepted standalone-drill disposition
|
||||
in the exact reviewed T33 packet; no new runtime approval flag is required.
|
||||
Keep native issuer/signer/registration and negative checks unchanged. If any
|
||||
step fails or becomes uncertain, quiesce the exact child before inode-guarded
|
||||
local deletion, retain sanitized failure obligations, and reconcile only the
|
||||
dedicated CertificateRequest and its actual UID/owned descendants through the
|
||||
owner's Kubernetes deletion-precondition path. Do not use wildcard cleanup,
|
||||
delete production kc-tls or call an unverified request outcome successful.
|
||||
|
||||
For **genuine cluster loss**, this surviving-cluster command is unavailable.
|
||||
The owner must independently recover original TLS custody or establish an
|
||||
approved replacement validation/provider path with actual domain control,
|
||||
private staging and trust. A new ACME account may be a separate provider
|
||||
disposition; this packet does not assume access to the existing account key.
|
||||
That independent capability remains RCLUSTER18-T02/T03/T04 and NK49-T35 scope.
|
||||
An accepted standalone drill does not close the larger outage claim.
|
||||
|
||||
## Source amendment and task disposition
|
||||
|
||||
owner-doc-task-proposal.patch adds this identity distinction and concrete
|
||||
reissue path to the existing Cluster boundary, records the completed source
|
||||
inventory as proposed T06, and leaves exact original custody/reissue acceptance
|
||||
and staging/native work open under T02–T04. These are proposed owner source
|
||||
bytes only. No canonical workplan or doc was edited while root publication was
|
||||
active, no UUID was assigned and no task was marked done in the Hub.
|
||||
|
||||
The next exact deliverables are actual source-owner review of the standalone
|
||||
drill disposition, admission of the pinned cmctl artifact via the existing tool
|
||||
process, and T03's bounded private staging/child/remote-request cleanup source
|
||||
proof. An actual certificate request remains separately supervised. This is a
|
||||
specific implementation prerequisite, not a request to locate an unspecified
|
||||
historical backup or invent a new credential service.
|
||||
|
|
@ -0,0 +1,68 @@
|
|||
{
|
||||
"tag": "v2.6.1",
|
||||
"commit": "7e56321dbec4f62ea5428b8656c871c6dc0cc112",
|
||||
"release_url": "https://github.com/cert-manager/cmctl/releases/tag/v2.6.1",
|
||||
"assets": [
|
||||
{
|
||||
"name": "checksums.txt",
|
||||
"url": "https://github.com/cert-manager/cmctl/releases/download/v2.6.1/checksums.txt",
|
||||
"digest": "sha256:7c1daa59eeb7c70299013b53e60b9a2176089aefbd5757dedb0187954f2b20a5"
|
||||
},
|
||||
{
|
||||
"name": "checksums.txt.cosign.bundle",
|
||||
"url": "https://github.com/cert-manager/cmctl/releases/download/v2.6.1/checksums.txt.cosign.bundle",
|
||||
"digest": "sha256:f684207d99792f1049329a6c7e1f40ff8c7a55f4b56216cd59c7abfca9f16301"
|
||||
},
|
||||
{
|
||||
"name": "cmctl_linux_amd64",
|
||||
"url": "https://github.com/cert-manager/cmctl/releases/download/v2.6.1/cmctl_linux_amd64",
|
||||
"digest": "sha256:0af054c26a2b64ce286fa868d029164867695a93c3eb893662ce16f35e708db0"
|
||||
}
|
||||
],
|
||||
"published_checksum_line": "0af054c26a2b64ce286fa868d029164867695a93c3eb893662ce16f35e708db0 cmctl_linux_amd64",
|
||||
"checksum_file_sha256": "sha256:7c1daa59eeb7c70299013b53e60b9a2176089aefbd5757dedb0187954f2b20a5",
|
||||
"source_url": "https://raw.githubusercontent.com/cert-manager/cmctl/7e56321dbec4f62ea5428b8656c871c6dc0cc112/pkg/create/certificaterequest/certificaterequest.go",
|
||||
"source_sha256": "sha256:0ba0c2d3d4f8530514c8d864b2a9e056f14f763a0b314aa05998f3169ee5bc32",
|
||||
"tool_downloaded": false,
|
||||
"tool_installed": false,
|
||||
"tool_executed": false,
|
||||
"signature_bundle_verified": false,
|
||||
"local_cmctl_available": false,
|
||||
"reviewed_line_numbers": [
|
||||
59,
|
||||
66,
|
||||
81,
|
||||
82,
|
||||
88,
|
||||
90,
|
||||
92,
|
||||
93,
|
||||
95,
|
||||
96,
|
||||
98,
|
||||
99,
|
||||
101,
|
||||
102,
|
||||
104,
|
||||
105,
|
||||
116,
|
||||
118,
|
||||
120,
|
||||
122,
|
||||
142,
|
||||
150,
|
||||
215,
|
||||
217,
|
||||
219,
|
||||
222,
|
||||
234,
|
||||
334
|
||||
],
|
||||
"reviewed_behavior": {
|
||||
"flags": "certificate template, private output path, public certificate output path, fetch and timeout",
|
||||
"key_output": "local 0600 file is written before API creation",
|
||||
"api_effect": "only a CertificateRequest create; not a Certificate or TLS Secret",
|
||||
"certificate_output": "requested signed public certificate is saved locally at 0600",
|
||||
"diagnostics": "local output paths are reported; raw operator diagnostics must not enter public receipts"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIE/TCCA+WgAwIBAgISBmV+SgCgbd7gJ1RjLeus1fJGMA0GCSqGSIb3DQEBCwUA
|
||||
MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD
|
||||
EwNZUjEwHhcNMjYwOTI1MTc1NzIyWhcNMjYxMjI0MTc1NzIxWjAcMRowGAYDVQQD
|
||||
ExFrYy5jb3Vsb21iLnNvY2lhbDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
|
||||
ggEBALugU1hh+5AA1zly/E9LE0BJhm+XqQqzPLx2RtT1KhnZS+NPbxCHwp8sqbzX
|
||||
XGJztn0sLTWRpUk/lBeucBspBFHDD90QKAsuvpUffZMImfcDX4VkAyDtHts4tPg0
|
||||
U7IH2QsooWihkpyQuzoBIQeufojX3QdCIbhjdC9VanygkKCftUo/wNk356n6YAuv
|
||||
TmffePvhppw166aBSSV/QKxMhXcUp14pDOR/1M8uRjGXItjFhEBZpje/ZOqMH2cG
|
||||
X6mYUK/w/RoZJtME4ZAQ2c5zbJDbAn3ooioKLIgScrk/mDzuU5oRNWXVJSKsD5MK
|
||||
tLqi5689z6hZq9DLJg8HoezNWqcCAwEAAaOCAiAwggIcMA4GA1UdDwEB/wQEAwIF
|
||||
oDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBQW
|
||||
Fd3HF2Hldj0Y7Zmp81E1LzQIXDAfBgNVHSMEGDAWgBQfLzW+RhSCzUCxrnksVXj6
|
||||
99Ro+zAzBggrBgEFBQcBAQQnMCUwIwYIKwYBBQUHMAKGF2h0dHA6Ly95cjEuaS5s
|
||||
ZW5jci5vcmcvMBwGA1UdEQQVMBOCEWtjLmNvdWxvbWIuc29jaWFsMBMGA1UdIAQM
|
||||
MAowCAYGZ4EMAQIBMC4GA1UdHwQnMCUwI6AhoB+GHWh0dHA6Ly95cjEuYy5sZW5j
|
||||
ci5vcmcvNzEuY3JsMIIBDQYKKwYBBAHWeQIEAgSB/gSB+wD5AHcAr2eIO1ewTt2P
|
||||
ptl+9i6o64EKx3Fg8CReVdYML+eFhzoAAAGg2eyIzAAABAMASDBGAiEA2WamiKud
|
||||
XhSQjD88kkUTS8zhWqV9YyPkreU9jRI0vdQCIQD1iAb8ekWAArxPPh/SUpoMknpJ
|
||||
/yl16SXko3Ne0c4NsAB+ABqLnWsP/r+BtHk5xtIxCobW0QLU8EbiGCyd419eJiXv
|
||||
AAABoNnsjB0ACAAABQBFJglkBAMARzBFAiBGdDneKdJfaBAgYLcnRriQDF1YArO3
|
||||
YXFpmtvwsc5mPQIhAJOgFR0Jb0miJeAQ8KTFPxp2M3X397TdpnlVT4CnSjCaMA0G
|
||||
CSqGSIb3DQEBCwUAA4IBAQCcqZbf+vx7viZDVOZI+2L8TPpKN86jbCd+0s9QwIPN
|
||||
PEadm/1YPcorGcQi1F5jmRpgRStVpoJOz1LV/Ww8we3Y4boVp5l2B32GkWg05uFb
|
||||
h/9bjhVHGrNBVpz1tPFBNXnG0Vxw+YMtb0h5tNeECRVuDce6q8LHXHuts27Uu2Kg
|
||||
nZabfD0VpxW0+V+NN9aHcuXsGL/NHhVjTH7pQL5z8kOnhG/DzDYaRFAma7HVyQ9Y
|
||||
LL/Eadr2f8wSi+H/CV60vedlzeUMmgBombcpS59VbcTcv8Z7j3hm7zaQZPRo1o8z
|
||||
cg4ItufoP3ZpNMghgKEvKmA94rVtsGKsGLK1aIJ/Ntut
|
||||
-----END CERTIFICATE-----
|
||||
|
|
@ -0,0 +1,122 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIE/TCCA+WgAwIBAgISBmV+SgCgbd7gJ1RjLeus1fJGMA0GCSqGSIb3DQEBCwUA
|
||||
MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD
|
||||
EwNZUjEwHhcNMjYwOTI1MTc1NzIyWhcNMjYxMjI0MTc1NzIxWjAcMRowGAYDVQQD
|
||||
ExFrYy5jb3Vsb21iLnNvY2lhbDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
|
||||
ggEBALugU1hh+5AA1zly/E9LE0BJhm+XqQqzPLx2RtT1KhnZS+NPbxCHwp8sqbzX
|
||||
XGJztn0sLTWRpUk/lBeucBspBFHDD90QKAsuvpUffZMImfcDX4VkAyDtHts4tPg0
|
||||
U7IH2QsooWihkpyQuzoBIQeufojX3QdCIbhjdC9VanygkKCftUo/wNk356n6YAuv
|
||||
TmffePvhppw166aBSSV/QKxMhXcUp14pDOR/1M8uRjGXItjFhEBZpje/ZOqMH2cG
|
||||
X6mYUK/w/RoZJtME4ZAQ2c5zbJDbAn3ooioKLIgScrk/mDzuU5oRNWXVJSKsD5MK
|
||||
tLqi5689z6hZq9DLJg8HoezNWqcCAwEAAaOCAiAwggIcMA4GA1UdDwEB/wQEAwIF
|
||||
oDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBQW
|
||||
Fd3HF2Hldj0Y7Zmp81E1LzQIXDAfBgNVHSMEGDAWgBQfLzW+RhSCzUCxrnksVXj6
|
||||
99Ro+zAzBggrBgEFBQcBAQQnMCUwIwYIKwYBBQUHMAKGF2h0dHA6Ly95cjEuaS5s
|
||||
ZW5jci5vcmcvMBwGA1UdEQQVMBOCEWtjLmNvdWxvbWIuc29jaWFsMBMGA1UdIAQM
|
||||
MAowCAYGZ4EMAQIBMC4GA1UdHwQnMCUwI6AhoB+GHWh0dHA6Ly95cjEuYy5sZW5j
|
||||
ci5vcmcvNzEuY3JsMIIBDQYKKwYBBAHWeQIEAgSB/gSB+wD5AHcAr2eIO1ewTt2P
|
||||
ptl+9i6o64EKx3Fg8CReVdYML+eFhzoAAAGg2eyIzAAABAMASDBGAiEA2WamiKud
|
||||
XhSQjD88kkUTS8zhWqV9YyPkreU9jRI0vdQCIQD1iAb8ekWAArxPPh/SUpoMknpJ
|
||||
/yl16SXko3Ne0c4NsAB+ABqLnWsP/r+BtHk5xtIxCobW0QLU8EbiGCyd419eJiXv
|
||||
AAABoNnsjB0ACAAABQBFJglkBAMARzBFAiBGdDneKdJfaBAgYLcnRriQDF1YArO3
|
||||
YXFpmtvwsc5mPQIhAJOgFR0Jb0miJeAQ8KTFPxp2M3X397TdpnlVT4CnSjCaMA0G
|
||||
CSqGSIb3DQEBCwUAA4IBAQCcqZbf+vx7viZDVOZI+2L8TPpKN86jbCd+0s9QwIPN
|
||||
PEadm/1YPcorGcQi1F5jmRpgRStVpoJOz1LV/Ww8we3Y4boVp5l2B32GkWg05uFb
|
||||
h/9bjhVHGrNBVpz1tPFBNXnG0Vxw+YMtb0h5tNeECRVuDce6q8LHXHuts27Uu2Kg
|
||||
nZabfD0VpxW0+V+NN9aHcuXsGL/NHhVjTH7pQL5z8kOnhG/DzDYaRFAma7HVyQ9Y
|
||||
LL/Eadr2f8wSi+H/CV60vedlzeUMmgBombcpS59VbcTcv8Z7j3hm7zaQZPRo1o8z
|
||||
cg4ItufoP3ZpNMghgKEvKmA94rVtsGKsGLK1aIJ/Ntut
|
||||
-----END CERTIFICATE-----
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIE2zCCAsOgAwIBAgIRAKICU/FfJpHAXcHOE7m8yk4wDQYJKoZIhvcNAQELBQAw
|
||||
LjELMAkGA1UEBhMCVVMxDTALBgNVBAoTBElTUkcxEDAOBgNVBAMTB1Jvb3QgWVIw
|
||||
HhcNMjUwOTAzMDAwMDAwWhcNMjgwOTAyMjM1OTU5WjAzMQswCQYDVQQGEwJVUzEW
|
||||
MBQGA1UEChMNTGV0J3MgRW5jcnlwdDEMMAoGA1UEAxMDWVIxMIIBIjANBgkqhkiG
|
||||
9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoVi8X2xCYgMXvJxNPKp/oF13UMgmPABB07VC
|
||||
LNDtoXmt9luEZNJSBV10VyT1Pz6LD8Zq1d2gc43WNl1AdRrj4sEnazbOiz0nPpmG
|
||||
Bp2hui49oZtDIY6wdKeZAi5BbNU20CH6RSBBMLSQ9cXrH8dxdv4PAJ45ssGML68U
|
||||
SE3BsjC2a6cAN9L5CgXVIQi5tfNiTPoFZZ3S0OlXqLmmtdV95udWAb5b6e/F49Di
|
||||
CsH0Y00Ag72BVIb1hzynmKe+X0mERBTtsb3BwmpV9ipeBjMLoR/D9cHxHQCWoi5l
|
||||
TmXwY015J5rGelz1nZjJuxc2kioaX29XJBnhMkP531rSdG5uMwIDAQABo4HuMIHr
|
||||
MA4GA1UdDwEB/wQEAwIBhjATBgNVHSUEDDAKBggrBgEFBQcDATASBgNVHRMBAf8E
|
||||
CDAGAQH/AgEAMB0GA1UdDgQWBBQfLzW+RhSCzUCxrnksVXj699Ro+zAfBgNVHSME
|
||||
GDAWgBTe51tg0CJtQCh9Pw0B/qS1UrRRlDAyBggrBgEFBQcBAQQmMCQwIgYIKwYB
|
||||
BQUHMAKGFmh0dHA6Ly95ci5pLmxlbmNyLm9yZy8wEwYDVR0gBAwwCjAIBgZngQwB
|
||||
AgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3lyLmMubGVuY3Iub3JnLzANBgkq
|
||||
hkiG9w0BAQsFAAOCAgEA0+zvMq3kHig1ddTmmm+RibTr9/RpX7k4buanMMRqbV/y
|
||||
IvP82zAHN3mvaw+cASuVsdpd0ikjhr4hnhJQLQOzOp2ccKrsdGOAgo0vddeISFAq
|
||||
EWEV4lmUM3vFF796up+bSgmJ1u6RupDCMxDgF8M3eLvGuj6L0lu3zkQ0KuQLnKxL
|
||||
tB0oQqn1Idg5CuuGpMvQzk29Pa3D/qHurc0EIM9SxukQuJqq63lxsYyRQFU8yMBO
|
||||
hq1w5LbfaWNRrz1uklOfI/pYkAb2E2MTZrAMQkBIE2S8Jt1F8gRc96o/xOsrgvSk
|
||||
a84AisX6xq1lz1Z7jGvrnXc4TMcjxZTjiTaihcYI1JIXZiLtEMSCa5l3cu8YWd6z
|
||||
dLRQlqRdclVjuQfNHawRJ6GWlkK0QJosivTKwdBw3KxEtzGo8yMHERbsy57gP1UX
|
||||
HOMcmZYQC0gtyR3SxfenIM/MxC3Ia2Ypab/kQ/CTnlIn2KQ5JUC6NYrGCbhFN9bp
|
||||
5lKJStEwCUnLpntcrXk5XVDCNv/5RyWpRThkGOV7GetKkQ0qAY8hCzWK6oqnAhDZ
|
||||
cjlYVdWfqOw3DIOX6EDNBgAqHarRVxyF9QZdOaXSyPJ0ueD2BYJEBgaCGQ8rAaU/
|
||||
Qc123V5LTXDZW4CcsPBDyhy4v+c8hClAyw/IkJlfBqxB9D+/wvIMHgECZ4ptP6o=
|
||||
-----END CERTIFICATE-----
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIF9DCCA9ygAwIBAgIRAPJLbRf52a18scn+p4eCaZ8wDQYJKoZIhvcNAQELBQAw
|
||||
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
|
||||
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjYwNTEzMDAwMDAw
|
||||
WhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQ
|
||||
MA4GA1UEAxMHUm9vdCBZUjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB
|
||||
ANvGJnN78CTJdWL3+eGfsLN5TrNBJs+VH9hRXqRbwxu9sGNiB0BD1fcOxbSUQCJI
|
||||
M1xE13Db+5Cw1w0s0EBYsvuIP/6joF0w8cuImbgR1OGgYbSQ4OpzI+DG8SGuTlcE
|
||||
873OCS+kh3srlo6vl43M5OJg4Aeo1sfHp6kTJDoIiFBNJAY+OKfX/FUvYKuhjT+n
|
||||
o49lmqmupSBI5PkBQiqrEGtWU5uxU/cQWHGu8jSjFBznZqvbNPLMXMLFxCb3WTfr
|
||||
JBXXjqvWG+v4bjzxjjeAtOlU7qarRDvNOyAuQYLln904M+faKx8hnLCpJ15ZqaEg
|
||||
cNlY+9MMWcC5yvL2A2j3l9+2buggZX+dOE91zYmIdawTvSZuVvlbRrAlLxIB6pwM
|
||||
BjneXCjYQ8+3BCCjssbSNpZU3hTcBDdhfAlEDlYr6pEatnMdmDT5BqnKC92bd0Eh
|
||||
M1fbLHioLccLCuievT8ZkPhZrq7Mii7gNXAcUEAR8+lzYal+9zTg7C5DALyVOeG/
|
||||
CqfRAMn1KSHCR0NSA6P8tn/mGRlnCct5rtVCLnVySVpU6H1qGg3DgTOuskf8eahT
|
||||
MiYbI5ezPJmO5ertalskQ1utp74+eDy92PI4ftHKTbq9IWhH4YZKh3WnJEIt+oQv
|
||||
lYZbY8tpEroKrFB6PFGzrJIDRyts4HqvuH52RFj2zv/BAgMBAAGjgeswgegwDgYD
|
||||
VR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMB
|
||||
Af8wHQYDVR0OBBYEFN7nW2DQIm1AKH0/DQH+pLVStFGUMB8GA1UdIwQYMBaAFHm0
|
||||
WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYW
|
||||
aHR0cDovL3gxLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNV
|
||||
HR8EIDAeMBygGqAYhhZodHRwOi8veDEuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEB
|
||||
CwUAA4ICAQA8spSI95KKfn2W6GMmDpHBJSPaLbsS3W93cijJCRCYAc1fsJgL1FIL
|
||||
7C0C9ecPOdcwB2fi0Dk2p94j9iTJCxmt5CFSKLRWwnXT2MMSXexVxqoVB79BdWPx
|
||||
VXETkVme/qYSAuKVHh5Ps+5BixgmwS1JkjSAc+MfrUbNssVEEnH0aEiAh+rotXAV
|
||||
JSP/Ye7LJPEwD9DWG72vVWbhAcuOf5OLjz57Ctk7MgQHynZ7+PlHJtajroCaIbtC
|
||||
r6tcZZaAwUQm+jQyeWdV+2hv9deOYFmKeQyjjcSrN5Nadrw+L9DZJLbA1HqeNvLh
|
||||
BgqpP0fvJq2N6EtD574N6eMI7uMsJTnji2UDz9el5XLSv9fqJMuDQtYVb2oTNoKp
|
||||
oUqhxPVC0aq4eG5MESaIdn8b5ZGSSeAJLMHXljEdlNza+ncfkviXk1POLnnFdvx8
|
||||
/gk6M374WbLWFXw8N141B/Rl/tINGfl1TxOIiqtiMYkL02RSGb1kq34BL9NPP27z
|
||||
RGMuHGnzS3hFIrRTfKxrzUZ9RzQWzEG3K6fJ3r2nqSltkeytis9DIBoFY9VmVyjL
|
||||
M71DMi+y1+TRSJVClEMwvA4yL++7q9XZx5r5wBRWB4kQTKH5qyoZnDw7iiuh1lID
|
||||
yDFx8r7i9vIJU5HS3moZLkYWAOilMaV9N56A9Bgb6dNcHkvg3NoaYA==
|
||||
-----END CERTIFICATE-----
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw
|
||||
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
|
||||
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4
|
||||
WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu
|
||||
ZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY
|
||||
MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc
|
||||
h77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+
|
||||
0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U
|
||||
A5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW
|
||||
T8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH
|
||||
B5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC
|
||||
B5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv
|
||||
KBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn
|
||||
OlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn
|
||||
jh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw
|
||||
qHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI
|
||||
rU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV
|
||||
HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq
|
||||
hkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL
|
||||
ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ
|
||||
3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK
|
||||
NFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5
|
||||
ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur
|
||||
TkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC
|
||||
jNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc
|
||||
oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq
|
||||
4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA
|
||||
mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d
|
||||
emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc=
|
||||
-----END CERTIFICATE-----
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
{
|
||||
"status": "three_bounded_metadata_checks_passed",
|
||||
"observed_at": "2026-10-17T02:30:31.911305+00:00",
|
||||
"validator_sha256": "sha256:5098bdfa4e0ad30627c1716e5e355a2c78dca6ccc607bd2148a2e06126632288",
|
||||
"fixture_factory": "tests/test_prepare_isolated_keycape.py:PreparationTests.setUp",
|
||||
"checks": [
|
||||
{
|
||||
"case": "independent_per_attempt_leaf_hash",
|
||||
"tls_cert_sha256": "sha256:35faa755b30380ae381676b5cbb1780ba67ab552fa07e44844da8f028f4ca754",
|
||||
"metadata_admitted": true
|
||||
},
|
||||
{
|
||||
"case": "independent_per_attempt_leaf_hash",
|
||||
"tls_cert_sha256": "sha256:74c0fff5a618a12d71e7c78d97dc12ae6d509b276ed2a254a6303b7694c26744",
|
||||
"metadata_admitted": true
|
||||
},
|
||||
{
|
||||
"case": "missing_leaf_hash",
|
||||
"refused_before_source_or_private_content_read": true
|
||||
}
|
||||
],
|
||||
"limit": "Synthetic digest strings only; proves metadata preflight does not compare against an archived TLS leaf pin. It proves no certificate/key/CA validity, owner assent, issuance, decryption, native issuer or consumer result. Existing private/runtime TLS verification remains required.",
|
||||
"actual_archive_content_read": false,
|
||||
"private_key_created_or_read": false,
|
||||
"provider_calls": false,
|
||||
"canonical_test_added": false
|
||||
}
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw
|
||||
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
|
||||
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4
|
||||
WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu
|
||||
ZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY
|
||||
MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc
|
||||
h77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+
|
||||
0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U
|
||||
A5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW
|
||||
T8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH
|
||||
B5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC
|
||||
B5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv
|
||||
KBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn
|
||||
OlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn
|
||||
jh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw
|
||||
qHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI
|
||||
rU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV
|
||||
HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq
|
||||
hkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL
|
||||
ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ
|
||||
3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK
|
||||
NFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5
|
||||
ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur
|
||||
TkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC
|
||||
jNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc
|
||||
oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq
|
||||
4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA
|
||||
mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d
|
||||
emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc=
|
||||
-----END CERTIFICATE-----
|
||||
|
|
@ -0,0 +1,98 @@
|
|||
{
|
||||
"status": "read_only_public_projection_not_owner_assent",
|
||||
"secret_objects_requested": false,
|
||||
"queries": [
|
||||
{
|
||||
"observed_at": "2026-10-17T02:28:03.932075+00:00",
|
||||
"argv": [
|
||||
"kubectl",
|
||||
"get",
|
||||
"nodes",
|
||||
"-o",
|
||||
"jsonpath={range .items[*]}{.metadata.name}{\" \"}{range .status.addresses[*]}{.type}{\"=\"}{.address}{\" \"}{end}{\"\\n\"}{end}"
|
||||
],
|
||||
"projected_public_metadata": "239.62.205.92.host.secureserver.net InternalIP=92.205.62.239 InternalIP=2a00:1169:111:6d70:: Hostname=239.62.205.92.host.secureserver.net \n"
|
||||
},
|
||||
{
|
||||
"observed_at": "2026-10-17T02:28:04.186302+00:00",
|
||||
"argv": [
|
||||
"kubectl",
|
||||
"-n",
|
||||
"sso",
|
||||
"get",
|
||||
"certificate",
|
||||
"kc-tls",
|
||||
"-o",
|
||||
"jsonpath={.metadata.name}{\"\\n\"}{.metadata.uid}{\"\\n\"}{.metadata.ownerReferences}{\"\\n\"}{.spec}{\"\\n\"}{.status.conditions}{\"\\n\"}{.status.notBefore}{\"\\n\"}{.status.notAfter}{\"\\n\"}{.status.renewalTime}{\"\\n\"}{.status.revision}{\"\\n\"}"
|
||||
],
|
||||
"projected_public_metadata": "kc-tls\ne3ad7140-0ba2-4e5a-b2f7-87dd453d5828\n[{\"apiVersion\":\"networking.k8s.io/v1\",\"blockOwnerDeletion\":true,\"controller\":true,\"kind\":\"Ingress\",\"name\":\"keycape\",\"uid\":\"52625ec1-429d-4041-b54c-d3bb92a87cb6\"}]\n{\"dnsNames\":[\"kc.coulomb.social\"],\"issuerRef\":{\"group\":\"cert-manager.io\",\"kind\":\"ClusterIssuer\",\"name\":\"letsencrypt-prod\"},\"secretName\":\"kc-tls\",\"usages\":[\"digital signature\",\"key encipherment\"]}\n[{\"lastTransitionTime\":\"2026-03-25T00:44:13Z\",\"message\":\"Certificate is up to date and has not expired\",\"observedGeneration\":1,\"reason\":\"Ready\",\"status\":\"True\",\"type\":\"Ready\"}]\n2026-09-25T17:57:22Z\n2026-12-24T17:57:21Z\n2026-11-24T17:57:21Z\n4\n"
|
||||
},
|
||||
{
|
||||
"observed_at": "2026-10-17T02:28:04.435984+00:00",
|
||||
"argv": [
|
||||
"kubectl",
|
||||
"get",
|
||||
"clusterissuer",
|
||||
"letsencrypt-prod",
|
||||
"-o",
|
||||
"jsonpath={.metadata.name}{\"\\n\"}{.spec.acme.server}{\"\\n\"}{.spec.acme.privateKeySecretRef.name}{\"\\n\"}{.spec.acme.solvers}{\"\\n\"}{.status.conditions}{\"\\n\"}{range .metadata.managedFields[*]}{.manager}{\" \"}{.operation}{\" \"}{.time}{\"\\n\"}{end}"
|
||||
],
|
||||
"projected_public_metadata": "letsencrypt-prod\nhttps://acme-v02.api.letsencrypt.org/directory\nletsencrypt-prod-account-key\n[{\"http01\":{\"ingress\":{\"ingressClassName\":\"traefik\"}}}]\n[{\"lastTransitionTime\":\"2026-07-16T09:55:24Z\",\"message\":\"The ACME account was registered with the ACME server\",\"observedGeneration\":1,\"reason\":\"ACMEAccountRegistered\",\"status\":\"True\",\"type\":\"Ready\"}]\nkubectl-client-side-apply Update 2026-03-25T00:12:32Z\ncert-manager-clusterissuers Update 2026-07-16T09:55:24Z\n"
|
||||
},
|
||||
{
|
||||
"observed_at": "2026-10-17T02:28:04.686322+00:00",
|
||||
"argv": [
|
||||
"kubectl",
|
||||
"-n",
|
||||
"sso",
|
||||
"get",
|
||||
"ingress",
|
||||
"keycape",
|
||||
"-o",
|
||||
"jsonpath={.spec}{\"\\n\"}{.metadata.annotations.argocd\\.argoproj\\.io/tracking-id}{\"\\n\"}{.status.loadBalancer}{\"\\n\"}{range .metadata.managedFields[*]}{.manager}{\" \"}{.operation}{\" \"}{.time}{\"\\n\"}{end}"
|
||||
],
|
||||
"projected_public_metadata": "{\"ingressClassName\":\"traefik\",\"rules\":[{\"host\":\"kc.coulomb.social\",\"http\":{\"paths\":[{\"backend\":{\"service\":{\"name\":\"keycape\",\"port\":{\"number\":8080}}},\"path\":\"/\",\"pathType\":\"Prefix\"}]}}],\"tls\":[{\"hosts\":[\"kc.coulomb.social\"],\"secretName\":\"kc-tls\"}]}\n\n{\"ingress\":[{\"ip\":\"92.205.62.239\"}]}\nkubectl-client-side-apply Update 2026-03-25T00:37:10Z\ntraefik Update 2026-03-25T00:37:10Z\n"
|
||||
},
|
||||
{
|
||||
"observed_at": "2026-10-17T02:28:04.941740+00:00",
|
||||
"argv": [
|
||||
"kubectl",
|
||||
"-n",
|
||||
"cert-manager",
|
||||
"get",
|
||||
"deployment",
|
||||
"cert-manager",
|
||||
"-o",
|
||||
"jsonpath={range .spec.template.spec.containers[*]}{.name}{\" \"}{.image}{\"\\n\"}{end}{.spec.template.spec.containers[0].args}{\"\\n\"}"
|
||||
],
|
||||
"projected_public_metadata": "cert-manager-controller quay.io/jetstack/cert-manager-controller:v1.18.2\n[\"--v=2\",\"--cluster-resource-namespace=$(POD_NAMESPACE)\",\"--leader-election-namespace=kube-system\",\"--acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.18.2\",\"--max-concurrent-challenges=60\",\"--acme-http01-solver-nameservers=1.1.1.1:53\"]\n"
|
||||
},
|
||||
{
|
||||
"observed_at": "2026-10-17T02:28:05.195086+00:00",
|
||||
"argv": [
|
||||
"kubectl",
|
||||
"-n",
|
||||
"sso",
|
||||
"get",
|
||||
"networkpolicy",
|
||||
"allow-traefik-to-acme-solver",
|
||||
"-o",
|
||||
"jsonpath={.spec}{\"\\n\"}"
|
||||
],
|
||||
"projected_public_metadata": "{\"ingress\":[{\"from\":[{\"namespaceSelector\":{\"matchLabels\":{\"kubernetes.io/metadata.name\":\"kube-system\"}},\"podSelector\":{\"matchLabels\":{\"app.kubernetes.io/name\":\"traefik\"}}}],\"ports\":[{\"port\":8089,\"protocol\":\"TCP\"}]}],\"podSelector\":{\"matchLabels\":{\"acme.cert-manager.io/http01-solver\":\"true\"}},\"policyTypes\":[\"Ingress\"]}\n"
|
||||
},
|
||||
{
|
||||
"observed_at": "2026-10-17T02:28:05.607183+00:00",
|
||||
"argv": [
|
||||
"kubectl",
|
||||
"-n",
|
||||
"argocd",
|
||||
"get",
|
||||
"applications.argoproj.io",
|
||||
"-o",
|
||||
"jsonpath={range .items[*]}{.metadata.name}{\" \"}{.spec.source.path}{\" \"}{.spec.destination.namespace}{\"\\n\"}{end}"
|
||||
],
|
||||
"projected_public_metadata": "activity-core k8s/gitops activity-core\nbao-notice argocd/platform-addons/bao-notice bao-notice\neso-token-renewer argocd/platform-addons/eso-token-renewer external-secrets\ninformed-decision deploy/lifecycle informed-decision\ninformed-decision-requester argocd/platform-addons/informed-decision-requester informed-decision\nopenbao-secretstore argocd/platform-addons/openbao-secretstore external-secrets\nrailiance-apps-root argocd/railiance01/applications argocd\nsecret-annotation-guard argocd/platform-addons/secret-annotation-guard default\nstate-hub-memo-dispatch deploy/informed-decision state-hub\ntarget-revenue k8s/railiance target-revenue\n"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,28 @@
|
|||
{
|
||||
"schema": "custodian.tls-recovery-disposition.v1",
|
||||
"created_at": "2026-10-17T02:32:35.568494+00:00",
|
||||
"proposal_id": "nk49-tls-standalone-reissue-20261017",
|
||||
"revision": 1,
|
||||
"proposal_sha256": "sha256:377f33dee19eeb5e8c70c5c22b029f32e9b9f6e72dde8071bbcd406d99966b75",
|
||||
"status": "source_prepared_not_executed_not_approved",
|
||||
"files": {
|
||||
"README.md": "sha256:990b5ef9f0eeab6e0fc1cbc9713ae234642a9cb86230b6aaa202e67960b724af",
|
||||
"cmctl-primary-source.json": "sha256:df27782314e0982f6cb66a7c86286d0b879535b3f3870fe4ea4fa1d1d9d04399",
|
||||
"current-public-leaf.pem": "sha256:e43bbfb97c294ef235082316e39bbfb5377d86025eb4324b4115f2a9048e9e5d",
|
||||
"current-verified-public-chain.pem": "sha256:17d78ed170cd64eef01693eb65a7a197c7068297f23b565c3e28159b1f000b0b",
|
||||
"existing-validator-fixture.json": "sha256:7998d41ecda1f7dcd4deae9fac9c966aa182f4fb397202ec09106087564d1bb4",
|
||||
"independent-system-trust-anchor.pem": "sha256:22b557a27055b33606b6559f37703928d3e4ad79f110b407d04986e1843543d1",
|
||||
"live-public-resource-observations.json": "sha256:30bb6f24a8a465e6f33309272b99f83106603b3d05d7452321a5047b52d35e67",
|
||||
"owner-doc-task-proposal.patch": "sha256:f9a92d3f6d341996537fff08fac3a83cc4d14ec0e6d2fb2af41e0955147ef175",
|
||||
"postimages/docs/keycape-tls-recovery-boundary.md": "sha256:4b2359ae59fde016188d776bafb928700171d8f337cc927af8b8d66cfedc6bf8",
|
||||
"postimages/workplans/RCLUSTER-WP-0018-keycape-original-tls-recovery.md": "sha256:de60c6a2b48f853d7f91eef233a6795561e79770d07af2fd792c66142de9e28b",
|
||||
"preimages/docs/keycape-tls-recovery-boundary.md": "sha256:f4bcb1d1832c566f9c87793ed2a461c8cd8a00859dc4ae66cd3c160d7ceefa70",
|
||||
"preimages/workplans/RCLUSTER-WP-0018-keycape-original-tls-recovery.md": "sha256:96d52b6dbae056399159632d50b32ccc6662e4f6d3677af154f7c8a3d618334b",
|
||||
"primary-source-references.json": "sha256:d347abb545d1bdbdf729bc414787830bc7761ced600569c84b95447fcc5e474b",
|
||||
"public-tls-observation.json": "sha256:f1199720b2fb02d53eb8c6bdc92701465f36fd295d1fc297ec38c31b60d4e4a6",
|
||||
"reissue-certificate.template.yaml": "sha256:8a31b39b52e3f711e9e6584c2ad31ba23937eac61741fc252ce83e47a990bd3f",
|
||||
"reissue-command-proposal.json": "sha256:377f33dee19eeb5e8c70c5c22b029f32e9b9f6e72dde8071bbcd406d99966b75",
|
||||
"review.json": "sha256:229437f92a00c15fa31abb5764993fd4282207e91495cbda2759b7d65c9bf4b9",
|
||||
"source-references.json": "sha256:2e99e41ee03a56089395ff6bcd289e5f0f46f0b5d4d6fe05f40f5b5763a4c88d"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,104 @@
|
|||
--- a/docs/keycape-tls-recovery-boundary.md
|
||||
+++ b/docs/keycape-tls-recovery-boundary.md
|
||||
@@ -49,3 +49,55 @@
|
||||
scoped capture/read permissions, retention and native verification. Merely adding
|
||||
`kc-tls` to secret_refs would change capture/permission/custody scope and is not
|
||||
authorized by this source review. It cannot repair the current archive retroactively.
|
||||
+
|
||||
+## Renewable TLS leaf and original OIDC signing identity
|
||||
+
|
||||
+The archived KeyCape RS256 signing key, issuer URL, service registrations and
|
||||
+policy state are distinct from the public HTTPS leaf and its TLS private key.
|
||||
+The current identity archive has no ingress TLS leaf to compare. A separately
|
||||
+reviewed trusted reissue can preserve kc.coulomb.social and the archived OIDC
|
||||
+signing identity without reproducing historical TLS leaf/key bytes. This is an
|
||||
+explicit owner continuity disposition under NK49-T35, not implicit permission
|
||||
+to replace custody, trust or an outage claim.
|
||||
+
|
||||
+The existing isolated admission pins the exact certificate-chain and trust PEM
|
||||
+bytes selected for that attempt; it does not compare them with an archived leaf
|
||||
+fingerprint. Those hashes, certificate/key pairing, hostname/CA/validity checks,
|
||||
+archived issuer equality and original signer/JWKS verification remain required.
|
||||
+The receipt's original HTTPS issuer/trust wording does not assert original leaf
|
||||
+byte equality. The selected consumer owner must separately disposition any
|
||||
+consumer-specific certificate/key pin; normal source-selector correspondence
|
||||
+alone is not current consumer assent.
|
||||
+
|
||||
+Current source and public resource inventory establish a concrete standard path:
|
||||
+ClusterIssuer/letsencrypt-prod uses ACME HTTP-01 with Traefik. Upstream cmctl
|
||||
+create certificaterequest can generate a dedicated TLS key locally, send only a
|
||||
+public CSR to that existing issuer and return the signed certificate locally,
|
||||
+without reading or replacing sso/kc-tls. This creates a new public request and
|
||||
+normal temporary ACME resources and requires separate actual owner/founder
|
||||
+live authority. A Certificate YAML used as cmctl input is a local template, not
|
||||
+an apply of a Certificate or Secret. No issuance occurred in this source work.
|
||||
+
|
||||
+The reviewed candidate is cmctl v2.6.1 Linux amd64, published checksum
|
||||
+sha256:0af054c26a2b64ce286fa868d029164867695a93c3eb893662ce16f35e708db0,
|
||||
+source commit 7e56321dbec4f62ea5428b8656c871c6dc0cc112. It is not installed or
|
||||
+admitted by this document; signature-bundle verification remains unperformed.
|
||||
+Its key file is written before API submission, so protected tmpfs staging and
|
||||
+independent cleanup must precede invocation. T03 must admit the existing session
|
||||
+staging/reaper adaptation for that earlier networked child, with success,
|
||||
+refusal, timeout and parent-loss proof; a shell trap alone is insufficient.
|
||||
+
|
||||
+This is a supported candidate for a standalone drill while the cluster, DNS,
|
||||
+external HTTP-01 port 80, Traefik, cert-manager and ACME provider are available.
|
||||
+It proves no independence during cluster loss. Do not switch to DNS-01 or a new
|
||||
+provider, read an account key, delete the production Secret or call a surviving-
|
||||
+cluster reissue an independent cluster-loss recovery. T02/T03/T04 retain that
|
||||
+actual independent custody/provider/domain-control and native acceptance scope.
|
||||
+
|
||||
+Timestamped current public Certificate/issuer/controller/solver metadata, public
|
||||
+CA/hostname observation, source hashes, upstream contract and exact unexecuted
|
||||
+command/lifecycle proposal are retained in Custodian
|
||||
+`docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/`.
|
||||
+This source inventory is neither historical original-key custody nor owner
|
||||
+acceptance of reissue; T35 requires the explicit reviewed disposition before
|
||||
+T33 can bind the selected TLS material to an actual owner-held attempt.
|
||||
--- a/workplans/RCLUSTER-WP-0018-keycape-original-tls-recovery.md
|
||||
+++ b/workplans/RCLUSTER-WP-0018-keycape-original-tls-recovery.md
|
||||
@@ -143,6 +143,43 @@
|
||||
the future contract requirement has an exact tracked disposition/handoff; it is
|
||||
not proof of current archive coverage or actual future capture.
|
||||
|
||||
+## Inventory standard TLS lifecycle and separate transport renewal invariants
|
||||
+
|
||||
+```task
|
||||
+id: RCLUSTER-WP-0018-T06
|
||||
+status: done
|
||||
+priority: high
|
||||
+assignee: codex
|
||||
+```
|
||||
+
|
||||
+Completed 2026-10-17 as bounded source/public-metadata preparation. Inspected the
|
||||
+existing issuer/ingress source and timestamped public Certificate, ClusterIssuer,
|
||||
+controller and solver-network metadata on the verified 92.205.62.239 node. The
|
||||
+current public endpoint passed ordinary independent system-CA/hostname validation;
|
||||
+public leaf/chain/anchor metadata was retained without any Secret or key access.
|
||||
+
|
||||
+Established the existing standard cmctl CertificateRequest path and exact v2.6.1
|
||||
+upstream source/checksum: key material stays local, only a public CSR is submitted,
|
||||
+and production kc-tls need not be read, renewed or replaced. The utility remains
|
||||
+absent/unadmitted locally and was not downloaded/executed. Existing-validator
|
||||
+fixtures accept two independent synthetic per-attempt leaf hashes and refuse a
|
||||
+missing hash before content access. This is metadata correspondence, not public
|
||||
+CA/key/native proof. No permanent mirror tests or runtime policy field was added.
|
||||
+
|
||||
+The completed inventory is extracted from T02's source discovery. T02 retains
|
||||
+actual independent original custody/provider metadata or an explicitly reviewed
|
||||
+reissue/continuity disposition. T03 retains exact admitted tool, private tmpfs
|
||||
+staging/child/request cleanup preparation and generated failure/parent-loss proof;
|
||||
+T04 retains separately authorized native recovery/acceptance. A standalone drill
|
||||
+using a surviving cluster cannot close the cluster-loss independence claim.
|
||||
+No original TLS custody, reissue assent, human approval, private key generation,
|
||||
+certificate request, production mutation, token exchange or rotation occurred.
|
||||
+
|
||||
+Evidence: Custodian
|
||||
+`docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/`.
|
||||
+Canonical owner publication/normal missing-UUID allocation and Hub projection
|
||||
+remain separate; no UUID is supplied by this prepared source task.
|
||||
+
|
||||
## Coordination and completion
|
||||
|
||||
Beneficiary NK-WP-0049-T35/CUST-WP-0080 remains linked to this obligor record by
|
||||
|
|
@ -0,0 +1,103 @@
|
|||
# Original KeyCape TLS recovery boundary
|
||||
|
||||
Source disposition, 2026-10-17, scoped to railiance-cluster INTENT: cluster runtime,
|
||||
ingress/certificate plumbing and backup posture. This is source preparation only.
|
||||
It is not native acceptance, an issuer/key custody assent, a reissue decision or
|
||||
permission to mutate the cluster.
|
||||
|
||||
NetKingdom's ingress source names `kc.coulomb.social`, `sso/kc-tls`,
|
||||
`ClusterIssuer/letsencrypt-prod` and Traefik termination before KeyCape8080.
|
||||
NetKingdom owns that namespace intent; railiance-cluster owns cert-manager,
|
||||
ingress controller and cluster backup posture. No inspected source establishes
|
||||
who independently holds the original private TLS recovery material when the
|
||||
ordinary issuer/cluster is unavailable. A missing exact routing-catalog entry
|
||||
cannot prove absence of an owning subsystem.
|
||||
|
||||
The identity archive excludes `kc-tls`. Current S2 backup source encrypts SQLite
|
||||
state, Helm values and kubeconfig to the same host's `/opt/backup/railiance/cluster`
|
||||
and retains seven versions. No inspected source proves an actually fresh,
|
||||
independent offsite object or original certificate/key/trust recovery. Archived
|
||||
RAIL-BS-WP-0004 is historical local-backup delivery; backlog RCLUSTER-WP-0007-T05
|
||||
is gated HA issuance/renewal; active RCLUSTER-WP-0017 is signer runtime/storage.
|
||||
None is an existing live task for this original TLS recovery demand.
|
||||
|
||||
`railiance-backup-s2` also stages raw state/Helm output in named `/tmp` paths
|
||||
without early hard-loss cleanup; `railiance-restore-s2` prints whole-state restore
|
||||
instructions. Do not use either as an isolated TLS extraction path. RCLUSTER-WP-0018
|
||||
tracks exact inventory, safe private staging/extraction preparation where required,
|
||||
independent outage proof and future archive-boundary disposition. No original
|
||||
ciphertext or historical outcome is rewritten by that work.
|
||||
|
||||
`tools/public-tls-metadata.py` is an offline public-only step. After the source
|
||||
owner identifies independent original **public certificate/chain and trust files**:
|
||||
|
||||
```sh
|
||||
python3 tools/public-tls-metadata.py --public-cert ORIGINAL_PUBLIC_CERT_CHAIN.pem --public-trust ORIGINAL_PUBLIC_TRUST.pem
|
||||
```
|
||||
|
||||
It accepts no private-key argument, bounds regular-file reads, refuses symlinks and
|
||||
non-certificate PEM material, and reports public hashes/SANs/validity/counts only.
|
||||
The file names are owner-local placeholders, not a key request. Output establishes
|
||||
public metadata, not originality, hostname/chain acceptance, reissue permission or
|
||||
custody. Do not supply a Secret object or combined certificate/key PEM. Fail closed
|
||||
when original source, trust or exact bindings are missing; no fresh self-signed
|
||||
trust workaround is admitted.
|
||||
|
||||
For FUTURE NetKingdom archives, the source owners must explicitly disposition
|
||||
original TLS coverage or a reviewed reissue contract: producer/custody owner,
|
||||
private artifact boundary, offline recovery independence, original public hashes,
|
||||
scoped capture/read permissions, retention and native verification. Merely adding
|
||||
`kc-tls` to secret_refs would change capture/permission/custody scope and is not
|
||||
authorized by this source review. It cannot repair the current archive retroactively.
|
||||
|
||||
## Renewable TLS leaf and original OIDC signing identity
|
||||
|
||||
The archived KeyCape RS256 signing key, issuer URL, service registrations and
|
||||
policy state are distinct from the public HTTPS leaf and its TLS private key.
|
||||
The current identity archive has no ingress TLS leaf to compare. A separately
|
||||
reviewed trusted reissue can preserve kc.coulomb.social and the archived OIDC
|
||||
signing identity without reproducing historical TLS leaf/key bytes. This is an
|
||||
explicit owner continuity disposition under NK49-T35, not implicit permission
|
||||
to replace custody, trust or an outage claim.
|
||||
|
||||
The existing isolated admission pins the exact certificate-chain and trust PEM
|
||||
bytes selected for that attempt; it does not compare them with an archived leaf
|
||||
fingerprint. Those hashes, certificate/key pairing, hostname/CA/validity checks,
|
||||
archived issuer equality and original signer/JWKS verification remain required.
|
||||
The receipt's original HTTPS issuer/trust wording does not assert original leaf
|
||||
byte equality. The selected consumer owner must separately disposition any
|
||||
consumer-specific certificate/key pin; normal source-selector correspondence
|
||||
alone is not current consumer assent.
|
||||
|
||||
Current source and public resource inventory establish a concrete standard path:
|
||||
ClusterIssuer/letsencrypt-prod uses ACME HTTP-01 with Traefik. Upstream cmctl
|
||||
create certificaterequest can generate a dedicated TLS key locally, send only a
|
||||
public CSR to that existing issuer and return the signed certificate locally,
|
||||
without reading or replacing sso/kc-tls. This creates a new public request and
|
||||
normal temporary ACME resources and requires separate actual owner/founder
|
||||
live authority. A Certificate YAML used as cmctl input is a local template, not
|
||||
an apply of a Certificate or Secret. No issuance occurred in this source work.
|
||||
|
||||
The reviewed candidate is cmctl v2.6.1 Linux amd64, published checksum
|
||||
sha256:0af054c26a2b64ce286fa868d029164867695a93c3eb893662ce16f35e708db0,
|
||||
source commit 7e56321dbec4f62ea5428b8656c871c6dc0cc112. It is not installed or
|
||||
admitted by this document; signature-bundle verification remains unperformed.
|
||||
Its key file is written before API submission, so protected tmpfs staging and
|
||||
independent cleanup must precede invocation. T03 must admit the existing session
|
||||
staging/reaper adaptation for that earlier networked child, with success,
|
||||
refusal, timeout and parent-loss proof; a shell trap alone is insufficient.
|
||||
|
||||
This is a supported candidate for a standalone drill while the cluster, DNS,
|
||||
external HTTP-01 port 80, Traefik, cert-manager and ACME provider are available.
|
||||
It proves no independence during cluster loss. Do not switch to DNS-01 or a new
|
||||
provider, read an account key, delete the production Secret or call a surviving-
|
||||
cluster reissue an independent cluster-loss recovery. T02/T03/T04 retain that
|
||||
actual independent custody/provider/domain-control and native acceptance scope.
|
||||
|
||||
Timestamped current public Certificate/issuer/controller/solver metadata, public
|
||||
CA/hostname observation, source hashes, upstream contract and exact unexecuted
|
||||
command/lifecycle proposal are retained in Custodian
|
||||
`docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/`.
|
||||
This source inventory is neither historical original-key custody nor owner
|
||||
acceptance of reissue; T35 requires the explicit reviewed disposition before
|
||||
T33 can bind the selected TLS material to an actual owner-held attempt.
|
||||
|
|
@ -0,0 +1,189 @@
|
|||
---
|
||||
id: RCLUSTER-WP-0018
|
||||
type: workplan
|
||||
title: "Establish original KeyCape TLS recovery and future archive boundary"
|
||||
domain: financials
|
||||
repo: railiance-cluster
|
||||
status: active
|
||||
owner: codex
|
||||
topic_slug: railiance
|
||||
created: "2026-10-17"
|
||||
updated: "2026-10-17"
|
||||
flavor: implementation
|
||||
depends_on: []
|
||||
related: [CUST-WP-0080, NK-WP-0049, RCLUSTER-WP-0007, RCLUSTER-WP-0017]
|
||||
state_hub_workstream_id: "e0a7813d-c916-5e49-84b2-5e5b30441891"
|
||||
---
|
||||
|
||||
Required owner source work for NK-WP-0049-T35 and CUST-WP-0080 G08. Reviewed
|
||||
against current INTENT/SCOPE, backup sources and existing work records; ready
|
||||
means work can proceed, not privileged execute authority. This does not promote
|
||||
HA/backlog work, reopen archived local backup delivery or duplicate signer0017.
|
||||
Source-owner scope is certificate plumbing/backup posture; NetKingdom owns
|
||||
namespace ingress, while exact original independent TLS custody remains to be
|
||||
established. No secret read, reissue, live change or native assent occurred.
|
||||
|
||||
## Record source boundary and public-only metadata preparation
|
||||
|
||||
```task
|
||||
id: RCLUSTER-WP-0018-T01
|
||||
status: done
|
||||
priority: high
|
||||
assignee: codex
|
||||
state_hub_task_id: "7280193d-0d59-5b78-a2d3-96ebd127127f"
|
||||
```
|
||||
|
||||
Completed 2026-10-17 as isolated source preparation. Independently reviewed the
|
||||
17 public source references against current owner bytes, checked current owner
|
||||
instructions/environment/supervision and existing plans, and recorded the exact
|
||||
boundary in docs/keycape-tls-recovery-boundary.md. Prepared bounded public-only
|
||||
certificate/trust metadata projection with generated-certificate tests; no actual
|
||||
certificate/key read. Source integration/publication and task projection remain
|
||||
separate receipts, not claimed by this completed preparation task.
|
||||
|
||||
Evidence: the-custodian docs/changes/netkingdom-target-2026-10-16/
|
||||
recovery-owner-handoffs-r1/ and prior recovery-attempt-r1/t35-t36-source-next/.
|
||||
|
||||
Publication return, 2026-10-17: normal owner source publication at
|
||||
c562d7134c38679952a8ffd17a8a893a900aef0d was applied on primary/railiance01
|
||||
with expected and derived commits equal. Read-only source/remote/Hub proof
|
||||
verified this workplan's five exact task ID/UUID/status bindings and three
|
||||
internal dependency edges. Receipts are retained in the Custodian packet
|
||||
docs/changes/netkingdom-target-2026-10-17/railiance-cluster-projection.json and
|
||||
cluster-publication-readback.json. The later legitimate C23 lifecycle repair
|
||||
at 26671d33600e218316d29c9cd020f115ebfb35b2 changed ready to active; active
|
||||
is retained. This return records publication separately from the completed
|
||||
source preparation above. Original TLS artifact/provider custody, extraction
|
||||
and native admission remain T02–T05 obligations; publication proves no TLS
|
||||
recovery, private-key custody or native acceptance.
|
||||
|
||||
The whole maintenance pipeline's historical-row guard failed for three parent
|
||||
rows while 15 task full-row hashes remained unchanged. STATE-WP-0095-T07 and
|
||||
RMGR-WP-0019-T06 remain wait; neither publication nor this memo asserts full
|
||||
historical-row preservation or restoration. The subsequent forward correction
|
||||
restores the brief's committed content to its pre-accident version while restoring
|
||||
the original staged/worktree change for its owner; history is not rewound. No legacy deep consistency fix is run by the correction.
|
||||
|
||||
## Establish exact independent original TLS artifact and provider custody metadata
|
||||
|
||||
```task
|
||||
id: RCLUSTER-WP-0018-T02
|
||||
status: todo
|
||||
priority: high
|
||||
assignee: codex
|
||||
state_hub_task_id: "90836435-917f-504c-a711-3f29ece348e3"
|
||||
```
|
||||
|
||||
Next: identify the actual original sso/kc-tls custody owner and independent public
|
||||
provenance through existing owner processes. Record artifact/provider, timestamp,
|
||||
public certificate/trust hashes, private custody entry point and outage dependencies
|
||||
without values. Source review cannot infer a fresh backup, original key coverage
|
||||
or independent decryption custody from a local backup script. Use credential
|
||||
routing before any later credential need; missing route is not proof of absence.
|
||||
Done when exact independent recovery or an explicitly owned unavailable capability
|
||||
is evidenced as metadata and a reviewed next action, with no guessed assent.
|
||||
|
||||
## Prepare safe isolated original extraction or explicit reissue alternative
|
||||
|
||||
```task
|
||||
id: RCLUSTER-WP-0018-T03
|
||||
status: wait
|
||||
priority: high
|
||||
assignee: codex
|
||||
depends_on: [RCLUSTER-WP-0018-T02]
|
||||
blocking_reason: "Exact original artifact/provider/custody disposition is required before selecting extraction or reissue source."
|
||||
state_hub_task_id: "5dfa9a3a-2639-5cf6-b0a4-13eef417d47a"
|
||||
```
|
||||
|
||||
From T02, reuse the actual owner path to prepare an exact attended private-only
|
||||
recovery command and full dependency/cleanup proof. Do not run whole-state restore
|
||||
or expose raw state/Secret output. If existing backup staging is required, correct
|
||||
only the needed path with bounded memory-only staging and early exact cleanup,
|
||||
including error/parent-loss tests before use. Original recovery and accepted
|
||||
reissue are distinct claims; no self-signed trust substitute, new broker or
|
||||
implicit production action. Done when the exact source proposal, public metadata
|
||||
preflight, negatives, timeout, abort and custody obligations are reviewed.
|
||||
|
||||
## Verify admitted original TLS recovery through the actual owner boundary
|
||||
|
||||
```task
|
||||
id: RCLUSTER-WP-0018-T04
|
||||
status: wait
|
||||
priority: high
|
||||
assignee: codex
|
||||
needs_human: true
|
||||
depends_on: [RCLUSTER-WP-0018-T02, RCLUSTER-WP-0018-T03]
|
||||
blocking_reason: "Await exact reviewed attended owner custody path and its existing scoped authority; no private input or native attempt requested yet."
|
||||
state_hub_task_id: "021b07bb-65bc-5743-bac5-4294b4be74f6"
|
||||
```
|
||||
|
||||
Only the actual admitted owner action can prove recovered certificate/key pairing,
|
||||
original hostname/trust and independent outage operation, or the expressly accepted
|
||||
reissue result. Retain exact source/artifact/target/identity/negative/cleanup receipts.
|
||||
Human custody/authority gates are not worker wakeups. Source and historical local
|
||||
backup proof never fill native assent. Return bounded public proof to NK49T35;
|
||||
no production mutation, credential retrieval or approval is granted by this task.
|
||||
|
||||
## Disposition original TLS coverage in the future identity archive contract
|
||||
|
||||
```task
|
||||
id: RCLUSTER-WP-0018-T05
|
||||
status: todo
|
||||
priority: high
|
||||
assignee: codex
|
||||
state_hub_task_id: "5bc67a22-0991-5625-86a6-f749560d8a0e"
|
||||
```
|
||||
|
||||
Next: deliver the source-owned requirement in docs/keycape-tls-recovery-boundary.md
|
||||
to NetKingdom's existing contract process: original TLS custody or accepted reissue,
|
||||
independent provider/key recovery, public identity hashes, scoped capture/read
|
||||
permissions and verification/retention. Record named owner dependencies as live
|
||||
work before closure. Do not append kc-tls to secret_refs, expand capture credentials
|
||||
or rewrite a historical archive without those owner reviews/authority. Done when
|
||||
the future contract requirement has an exact tracked disposition/handoff; it is
|
||||
not proof of current archive coverage or actual future capture.
|
||||
|
||||
## Inventory standard TLS lifecycle and separate transport renewal invariants
|
||||
|
||||
```task
|
||||
id: RCLUSTER-WP-0018-T06
|
||||
status: done
|
||||
priority: high
|
||||
assignee: codex
|
||||
```
|
||||
|
||||
Completed 2026-10-17 as bounded source/public-metadata preparation. Inspected the
|
||||
existing issuer/ingress source and timestamped public Certificate, ClusterIssuer,
|
||||
controller and solver-network metadata on the verified 92.205.62.239 node. The
|
||||
current public endpoint passed ordinary independent system-CA/hostname validation;
|
||||
public leaf/chain/anchor metadata was retained without any Secret or key access.
|
||||
|
||||
Established the existing standard cmctl CertificateRequest path and exact v2.6.1
|
||||
upstream source/checksum: key material stays local, only a public CSR is submitted,
|
||||
and production kc-tls need not be read, renewed or replaced. The utility remains
|
||||
absent/unadmitted locally and was not downloaded/executed. Existing-validator
|
||||
fixtures accept two independent synthetic per-attempt leaf hashes and refuse a
|
||||
missing hash before content access. This is metadata correspondence, not public
|
||||
CA/key/native proof. No permanent mirror tests or runtime policy field was added.
|
||||
|
||||
The completed inventory is extracted from T02's source discovery. T02 retains
|
||||
actual independent original custody/provider metadata or an explicitly reviewed
|
||||
reissue/continuity disposition. T03 retains exact admitted tool, private tmpfs
|
||||
staging/child/request cleanup preparation and generated failure/parent-loss proof;
|
||||
T04 retains separately authorized native recovery/acceptance. A standalone drill
|
||||
using a surviving cluster cannot close the cluster-loss independence claim.
|
||||
No original TLS custody, reissue assent, human approval, private key generation,
|
||||
certificate request, production mutation, token exchange or rotation occurred.
|
||||
|
||||
Evidence: Custodian
|
||||
`docs/changes/netkingdom-target-2026-10-17/tls-recovery-disposition-r1/`.
|
||||
Canonical owner publication/normal missing-UUID allocation and Hub projection
|
||||
remain separate; no UUID is supplied by this prepared source task.
|
||||
|
||||
## Coordination and completion
|
||||
|
||||
Beneficiary NK-WP-0049-T35/CUST-WP-0080 remains linked to this obligor record by
|
||||
derived cross_owner_wait case nk49-t35-rcluster18 in the packet. No new project
|
||||
driver, live worker injection or message was created. Own T03 wait has an explicit
|
||||
local prerequisite; T04 is a human gate. Close only after source/native obligations
|
||||
are proved or an explicit bounded scope disposition hands off remaining live work.
|
||||
|
|
@ -0,0 +1,51 @@
|
|||
# Original KeyCape TLS recovery boundary
|
||||
|
||||
Source disposition, 2026-10-17, scoped to railiance-cluster INTENT: cluster runtime,
|
||||
ingress/certificate plumbing and backup posture. This is source preparation only.
|
||||
It is not native acceptance, an issuer/key custody assent, a reissue decision or
|
||||
permission to mutate the cluster.
|
||||
|
||||
NetKingdom's ingress source names `kc.coulomb.social`, `sso/kc-tls`,
|
||||
`ClusterIssuer/letsencrypt-prod` and Traefik termination before KeyCape8080.
|
||||
NetKingdom owns that namespace intent; railiance-cluster owns cert-manager,
|
||||
ingress controller and cluster backup posture. No inspected source establishes
|
||||
who independently holds the original private TLS recovery material when the
|
||||
ordinary issuer/cluster is unavailable. A missing exact routing-catalog entry
|
||||
cannot prove absence of an owning subsystem.
|
||||
|
||||
The identity archive excludes `kc-tls`. Current S2 backup source encrypts SQLite
|
||||
state, Helm values and kubeconfig to the same host's `/opt/backup/railiance/cluster`
|
||||
and retains seven versions. No inspected source proves an actually fresh,
|
||||
independent offsite object or original certificate/key/trust recovery. Archived
|
||||
RAIL-BS-WP-0004 is historical local-backup delivery; backlog RCLUSTER-WP-0007-T05
|
||||
is gated HA issuance/renewal; active RCLUSTER-WP-0017 is signer runtime/storage.
|
||||
None is an existing live task for this original TLS recovery demand.
|
||||
|
||||
`railiance-backup-s2` also stages raw state/Helm output in named `/tmp` paths
|
||||
without early hard-loss cleanup; `railiance-restore-s2` prints whole-state restore
|
||||
instructions. Do not use either as an isolated TLS extraction path. RCLUSTER-WP-0018
|
||||
tracks exact inventory, safe private staging/extraction preparation where required,
|
||||
independent outage proof and future archive-boundary disposition. No original
|
||||
ciphertext or historical outcome is rewritten by that work.
|
||||
|
||||
`tools/public-tls-metadata.py` is an offline public-only step. After the source
|
||||
owner identifies independent original **public certificate/chain and trust files**:
|
||||
|
||||
```sh
|
||||
python3 tools/public-tls-metadata.py --public-cert ORIGINAL_PUBLIC_CERT_CHAIN.pem --public-trust ORIGINAL_PUBLIC_TRUST.pem
|
||||
```
|
||||
|
||||
It accepts no private-key argument, bounds regular-file reads, refuses symlinks and
|
||||
non-certificate PEM material, and reports public hashes/SANs/validity/counts only.
|
||||
The file names are owner-local placeholders, not a key request. Output establishes
|
||||
public metadata, not originality, hostname/chain acceptance, reissue permission or
|
||||
custody. Do not supply a Secret object or combined certificate/key PEM. Fail closed
|
||||
when original source, trust or exact bindings are missing; no fresh self-signed
|
||||
trust workaround is admitted.
|
||||
|
||||
For FUTURE NetKingdom archives, the source owners must explicitly disposition
|
||||
original TLS coverage or a reviewed reissue contract: producer/custody owner,
|
||||
private artifact boundary, offline recovery independence, original public hashes,
|
||||
scoped capture/read permissions, retention and native verification. Merely adding
|
||||
`kc-tls` to secret_refs would change capture/permission/custody scope and is not
|
||||
authorized by this source review. It cannot repair the current archive retroactively.
|
||||
|
|
@ -0,0 +1,152 @@
|
|||
---
|
||||
id: RCLUSTER-WP-0018
|
||||
type: workplan
|
||||
title: "Establish original KeyCape TLS recovery and future archive boundary"
|
||||
domain: financials
|
||||
repo: railiance-cluster
|
||||
status: active
|
||||
owner: codex
|
||||
topic_slug: railiance
|
||||
created: "2026-10-17"
|
||||
updated: "2026-10-17"
|
||||
flavor: implementation
|
||||
depends_on: []
|
||||
related: [CUST-WP-0080, NK-WP-0049, RCLUSTER-WP-0007, RCLUSTER-WP-0017]
|
||||
state_hub_workstream_id: "e0a7813d-c916-5e49-84b2-5e5b30441891"
|
||||
---
|
||||
|
||||
Required owner source work for NK-WP-0049-T35 and CUST-WP-0080 G08. Reviewed
|
||||
against current INTENT/SCOPE, backup sources and existing work records; ready
|
||||
means work can proceed, not privileged execute authority. This does not promote
|
||||
HA/backlog work, reopen archived local backup delivery or duplicate signer0017.
|
||||
Source-owner scope is certificate plumbing/backup posture; NetKingdom owns
|
||||
namespace ingress, while exact original independent TLS custody remains to be
|
||||
established. No secret read, reissue, live change or native assent occurred.
|
||||
|
||||
## Record source boundary and public-only metadata preparation
|
||||
|
||||
```task
|
||||
id: RCLUSTER-WP-0018-T01
|
||||
status: done
|
||||
priority: high
|
||||
assignee: codex
|
||||
state_hub_task_id: "7280193d-0d59-5b78-a2d3-96ebd127127f"
|
||||
```
|
||||
|
||||
Completed 2026-10-17 as isolated source preparation. Independently reviewed the
|
||||
17 public source references against current owner bytes, checked current owner
|
||||
instructions/environment/supervision and existing plans, and recorded the exact
|
||||
boundary in docs/keycape-tls-recovery-boundary.md. Prepared bounded public-only
|
||||
certificate/trust metadata projection with generated-certificate tests; no actual
|
||||
certificate/key read. Source integration/publication and task projection remain
|
||||
separate receipts, not claimed by this completed preparation task.
|
||||
|
||||
Evidence: the-custodian docs/changes/netkingdom-target-2026-10-16/
|
||||
recovery-owner-handoffs-r1/ and prior recovery-attempt-r1/t35-t36-source-next/.
|
||||
|
||||
Publication return, 2026-10-17: normal owner source publication at
|
||||
c562d7134c38679952a8ffd17a8a893a900aef0d was applied on primary/railiance01
|
||||
with expected and derived commits equal. Read-only source/remote/Hub proof
|
||||
verified this workplan's five exact task ID/UUID/status bindings and three
|
||||
internal dependency edges. Receipts are retained in the Custodian packet
|
||||
docs/changes/netkingdom-target-2026-10-17/railiance-cluster-projection.json and
|
||||
cluster-publication-readback.json. The later legitimate C23 lifecycle repair
|
||||
at 26671d33600e218316d29c9cd020f115ebfb35b2 changed ready to active; active
|
||||
is retained. This return records publication separately from the completed
|
||||
source preparation above. Original TLS artifact/provider custody, extraction
|
||||
and native admission remain T02–T05 obligations; publication proves no TLS
|
||||
recovery, private-key custody or native acceptance.
|
||||
|
||||
The whole maintenance pipeline's historical-row guard failed for three parent
|
||||
rows while 15 task full-row hashes remained unchanged. STATE-WP-0095-T07 and
|
||||
RMGR-WP-0019-T06 remain wait; neither publication nor this memo asserts full
|
||||
historical-row preservation or restoration. The subsequent forward correction
|
||||
restores the brief's committed content to its pre-accident version while restoring
|
||||
the original staged/worktree change for its owner; history is not rewound. No legacy deep consistency fix is run by the correction.
|
||||
|
||||
## Establish exact independent original TLS artifact and provider custody metadata
|
||||
|
||||
```task
|
||||
id: RCLUSTER-WP-0018-T02
|
||||
status: todo
|
||||
priority: high
|
||||
assignee: codex
|
||||
state_hub_task_id: "90836435-917f-504c-a711-3f29ece348e3"
|
||||
```
|
||||
|
||||
Next: identify the actual original sso/kc-tls custody owner and independent public
|
||||
provenance through existing owner processes. Record artifact/provider, timestamp,
|
||||
public certificate/trust hashes, private custody entry point and outage dependencies
|
||||
without values. Source review cannot infer a fresh backup, original key coverage
|
||||
or independent decryption custody from a local backup script. Use credential
|
||||
routing before any later credential need; missing route is not proof of absence.
|
||||
Done when exact independent recovery or an explicitly owned unavailable capability
|
||||
is evidenced as metadata and a reviewed next action, with no guessed assent.
|
||||
|
||||
## Prepare safe isolated original extraction or explicit reissue alternative
|
||||
|
||||
```task
|
||||
id: RCLUSTER-WP-0018-T03
|
||||
status: wait
|
||||
priority: high
|
||||
assignee: codex
|
||||
depends_on: [RCLUSTER-WP-0018-T02]
|
||||
blocking_reason: "Exact original artifact/provider/custody disposition is required before selecting extraction or reissue source."
|
||||
state_hub_task_id: "5dfa9a3a-2639-5cf6-b0a4-13eef417d47a"
|
||||
```
|
||||
|
||||
From T02, reuse the actual owner path to prepare an exact attended private-only
|
||||
recovery command and full dependency/cleanup proof. Do not run whole-state restore
|
||||
or expose raw state/Secret output. If existing backup staging is required, correct
|
||||
only the needed path with bounded memory-only staging and early exact cleanup,
|
||||
including error/parent-loss tests before use. Original recovery and accepted
|
||||
reissue are distinct claims; no self-signed trust substitute, new broker or
|
||||
implicit production action. Done when the exact source proposal, public metadata
|
||||
preflight, negatives, timeout, abort and custody obligations are reviewed.
|
||||
|
||||
## Verify admitted original TLS recovery through the actual owner boundary
|
||||
|
||||
```task
|
||||
id: RCLUSTER-WP-0018-T04
|
||||
status: wait
|
||||
priority: high
|
||||
assignee: codex
|
||||
needs_human: true
|
||||
depends_on: [RCLUSTER-WP-0018-T02, RCLUSTER-WP-0018-T03]
|
||||
blocking_reason: "Await exact reviewed attended owner custody path and its existing scoped authority; no private input or native attempt requested yet."
|
||||
state_hub_task_id: "021b07bb-65bc-5743-bac5-4294b4be74f6"
|
||||
```
|
||||
|
||||
Only the actual admitted owner action can prove recovered certificate/key pairing,
|
||||
original hostname/trust and independent outage operation, or the expressly accepted
|
||||
reissue result. Retain exact source/artifact/target/identity/negative/cleanup receipts.
|
||||
Human custody/authority gates are not worker wakeups. Source and historical local
|
||||
backup proof never fill native assent. Return bounded public proof to NK49T35;
|
||||
no production mutation, credential retrieval or approval is granted by this task.
|
||||
|
||||
## Disposition original TLS coverage in the future identity archive contract
|
||||
|
||||
```task
|
||||
id: RCLUSTER-WP-0018-T05
|
||||
status: todo
|
||||
priority: high
|
||||
assignee: codex
|
||||
state_hub_task_id: "5bc67a22-0991-5625-86a6-f749560d8a0e"
|
||||
```
|
||||
|
||||
Next: deliver the source-owned requirement in docs/keycape-tls-recovery-boundary.md
|
||||
to NetKingdom's existing contract process: original TLS custody or accepted reissue,
|
||||
independent provider/key recovery, public identity hashes, scoped capture/read
|
||||
permissions and verification/retention. Record named owner dependencies as live
|
||||
work before closure. Do not append kc-tls to secret_refs, expand capture credentials
|
||||
or rewrite a historical archive without those owner reviews/authority. Done when
|
||||
the future contract requirement has an exact tracked disposition/handoff; it is
|
||||
not proof of current archive coverage or actual future capture.
|
||||
|
||||
## Coordination and completion
|
||||
|
||||
Beneficiary NK-WP-0049-T35/CUST-WP-0080 remains linked to this obligor record by
|
||||
derived cross_owner_wait case nk49-t35-rcluster18 in the packet. No new project
|
||||
driver, live worker injection or message was created. Own T03 wait has an explicit
|
||||
local prerequisite; T04 is a human gate. Close only after source/native obligations
|
||||
are proved or an explicit bounded scope disposition hands off remaining live work.
|
||||
|
|
@ -0,0 +1,36 @@
|
|||
{
|
||||
"retrieved_at": "2026-10-17T02:32:35.535346+00:00",
|
||||
"primary_sources_only": true,
|
||||
"references": [
|
||||
{
|
||||
"title": "cert-manager v1.18 Certificate",
|
||||
"url": "https://cert-manager.io/v1.18-docs/usage/certificate/",
|
||||
"supports": "Ordinary managed issuance/renewal; transport certificate/key separate from application signing key."
|
||||
},
|
||||
{
|
||||
"title": "cert-manager v1.18 HTTP01",
|
||||
"url": "https://cert-manager.io/v1.18-docs/configuration/acme/http01/",
|
||||
"supports": "Traefik ingressClassName selects challenge routing; cert-manager creates solver resources and self-checks."
|
||||
},
|
||||
{
|
||||
"title": "cert-manager v1.18 cmctl",
|
||||
"url": "https://cert-manager.io/v1.18-docs/reference/cmctl/",
|
||||
"supports": "CertificateRequest creation with local key and public certificate output files; public template is not applied as Certificate."
|
||||
},
|
||||
{
|
||||
"title": "Let\u2019s Encrypt challenge types",
|
||||
"url": "https://letsencrypt.org/docs/challenge-types/",
|
||||
"supports": "Public HTTP01 validation on TCP80 with domain routing dependencies."
|
||||
},
|
||||
{
|
||||
"title": "Let\u2019s Encrypt CA chains",
|
||||
"url": "https://letsencrypt.org/certificates/",
|
||||
"supports": "Public CA chain/independent anchor provenance; no secret recovery implied."
|
||||
},
|
||||
{
|
||||
"title": "cmctl v2.6.1 release",
|
||||
"url": "https://github.com/cert-manager/cmctl/releases/tag/v2.6.1",
|
||||
"supports": "Pinned candidate release and published assets; digest metadata independently matched checksum text."
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
{
|
||||
"observed_at": "2026-10-17T02:28:14.352694+00:00",
|
||||
"host": "kc.coulomb.social",
|
||||
"dns_addresses_at_workstation": [
|
||||
"92.205.62.239"
|
||||
],
|
||||
"hostname_and_system_ca_verification": true,
|
||||
"tls_protocol": "TLSv1.3",
|
||||
"leaf_der_sha256": "sha256:d5db2b555e74f7fbcd56dda3285dffffb86ac164bf6c28881b3efe580fc4ce5c",
|
||||
"leaf_pem_sha256": "sha256:e43bbfb97c294ef235082316e39bbfb5377d86025eb4324b4115f2a9048e9e5d",
|
||||
"subject": "CN=kc.coulomb.social",
|
||||
"issuer": "CN=YR1,O=Let's Encrypt,C=US",
|
||||
"not_before": "2026-09-25T17:57:22+00:00",
|
||||
"not_after": "2026-12-24T17:57:21+00:00",
|
||||
"dns_sans": [
|
||||
"kc.coulomb.social"
|
||||
],
|
||||
"verified_chain_count": 4,
|
||||
"chain_source": "public TLS peer plus independent pre-existing system CA trust store; not a Kubernetes Secret read",
|
||||
"limit": "Current public identity/trust only; not original archive-time key custody, reissue success, independent outage recovery or owner assent.",
|
||||
"metadata_preparation_history": "Initial observer failed on unavailable cryptography not_valid_before_utc attribute; successor uses existing UTC-normalized legacy property. No certificate or private operation failed.",
|
||||
"independent_system_anchor_sha256": "sha256:22b557a27055b33606b6559f37703928d3e4ad79f110b407d04986e1843543d1",
|
||||
"system_ca_bundle_sha256": "sha256:ecd9dc38bc3efb7dbd6431f57e29d2f8d6a0f0d211e1464b3fef2cbfe266fcd2"
|
||||
}
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
# LOCAL INPUT TEMPLATE ONLY: do not kubectl apply this Certificate.
|
||||
# cmctl uses its public specification to create one CertificateRequest.
|
||||
# The dedicated TLS private key and resulting certificate stay local to custody.
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: nk49-kc-drill-20261017-r1
|
||||
namespace: sso
|
||||
spec:
|
||||
secretName: nk49-kc-drill-not-created-by-cmctl
|
||||
dnsNames:
|
||||
- kc.coulomb.social
|
||||
issuerRef:
|
||||
group: cert-manager.io
|
||||
kind: ClusterIssuer
|
||||
name: letsencrypt-prod
|
||||
privateKey:
|
||||
algorithm: RSA
|
||||
encoding: PKCS8
|
||||
size: 2048
|
||||
usages:
|
||||
- digital signature
|
||||
- key encipherment
|
||||
- server auth
|
||||
|
|
@ -0,0 +1,71 @@
|
|||
{
|
||||
"proposal_id": "nk49-tls-standalone-reissue-20261017",
|
||||
"revision": 1,
|
||||
"status": "source_prepared_not_executable_not_approved",
|
||||
"target": {
|
||||
"cluster_node_ip": "92.205.62.239",
|
||||
"observed_context": "default",
|
||||
"namespace": "sso",
|
||||
"existing_issuer": "ClusterIssuer/letsencrypt-prod",
|
||||
"dedicated_request": "nk49-kc-drill-20261017-r1"
|
||||
},
|
||||
"proposed_tool_path": "/home/worsch/.local/lib/net-kingdom/cmctl/2.6.1/cmctl",
|
||||
"tool_sha256": "sha256:0af054c26a2b64ce286fa868d029164867695a93c3eb893662ce16f35e708db0",
|
||||
"tool_source_commit": "7e56321dbec4f62ea5428b8656c871c6dc0cc112",
|
||||
"proposed_command_argv": [
|
||||
"/home/worsch/.local/lib/net-kingdom/cmctl/2.6.1/cmctl",
|
||||
"--context",
|
||||
"default",
|
||||
"--namespace",
|
||||
"sso",
|
||||
"create",
|
||||
"certificaterequest",
|
||||
"nk49-kc-drill-20261017-r1",
|
||||
"--from-certificate-file",
|
||||
"<registered-private-tmpfs>/reissue-certificate.template.yaml",
|
||||
"--fetch-certificate",
|
||||
"--timeout",
|
||||
"5m",
|
||||
"--output-key-file",
|
||||
"<registered-private-tmpfs>/server-key.pem",
|
||||
"--output-certificate-file",
|
||||
"<registered-private-tmpfs>/server.pem"
|
||||
],
|
||||
"template_sha256": "sha256:8a31b39b52e3f711e9e6584c2ad31ba23937eac61741fc252ce83e47a990bd3f",
|
||||
"exact_private_directory_binding": null,
|
||||
"authority": "Existing owner/founder reviewed ADMINISTER @ realm:kubernetes/railiance01 action; this document grants none.",
|
||||
"owner_review_reference": null,
|
||||
"founder_disposition_reference": null,
|
||||
"request_create_effect": "One dedicated public CertificateRequest; cert-manager may create transient owned Order/Challenge/solver resources. No production Certificate or Secret apply.",
|
||||
"private_material": "Dedicated newly generated TLS key stays only in admitted owner-local private tmpfs through consumption/cleanup; no KeyCape OIDC signing-key rotation.",
|
||||
"preconditions": [
|
||||
"Exact tool pin admitted, no current install assumed",
|
||||
"Verify target node and issuer/controller/public DNS/HTTP01 solver path; do not request credentials from unknown routes",
|
||||
"Exact request name absent; stop on collision or uncertainty; never overwrite/reuse a previous request",
|
||||
"Public template/source/command reviewed; independent private tmpfs observer and child identities ready before key output",
|
||||
"Actual domain-control/CA/provider limits and live resource authority admitted by owner",
|
||||
"Specific standalone-drill continuity disposition reviewed; no cluster-loss claim"
|
||||
],
|
||||
"verification": [
|
||||
"Exact created request UID, spec and selected issuer; approval/Ready conditions through existing owner policy",
|
||||
"Returned public certificate chain matches held private key; hostname kc.coulomb.social, valid time, independently reviewed public CA anchor",
|
||||
"Exact selected per-attempt TLS/trust hashes in existing admission; unchanged archived issuer and signing key/JWKS via existing isolated native checks",
|
||||
"Actual request/owned child resources and private staging cleanup independently verified; no production TLS replacement"
|
||||
],
|
||||
"abort_and_recovery": [
|
||||
"No issuance if staging observer or registration fails",
|
||||
"On timeout/failure/parent loss quiesce exact known child; no blind retry or false success",
|
||||
"Remote submission uncertainty retains exact name/UID reconciliation duty through owner API path; no wildcard or unconditional name-only delete",
|
||||
"Remove only registered private tmpfs inode after child quiescence; preserve failure metadata and outstanding obligations"
|
||||
],
|
||||
"scope": "standalone isolated drill with surviving cluster and ACME prerequisites; not independently executable during cluster loss",
|
||||
"tool_installed": false,
|
||||
"certificate_request_created": false,
|
||||
"private_key_generated": false,
|
||||
"cost_estimate_eur": null,
|
||||
"credible_loss_bound_eur": null,
|
||||
"estimate_note": "Local source work creates no spend; actual issuance exposes public domain-control/CA limit and cluster/request cleanup effects, requiring owner-reviewed estimates.",
|
||||
"remaining_source_task": "RCLUSTER-WP-0018-T03 exact tool/staging/child/remote-request cleanup adaptation and generated lifecycle proof",
|
||||
"approved_revision_digest": null,
|
||||
"executed_revision_digest": null
|
||||
}
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
{
|
||||
"status": "source_disposition_proposal_ready_for_owner_review_not_executable",
|
||||
"canonical_edits": false,
|
||||
"existing_metadata_validator_checks_passed": 3,
|
||||
"permanent_tests_added": false,
|
||||
"old_cluster_task_blocks_preserved": true,
|
||||
"new_proposed_source_task": "RCLUSTER-WP-0018-T06",
|
||||
"original_tls_archive_bytes_required_by_current_source": false,
|
||||
"per_attempt_tls_and_trust_hashes_required": true,
|
||||
"archived_oidc_signer_and_issuer_invariants_unchanged": true,
|
||||
"ca_native_or_private_pairing_proof_from_metadata_fixture": false,
|
||||
"public_endpoint_ca_hostname_verified": true,
|
||||
"secret_objects_or_private_keys_read": false,
|
||||
"new_certificate_request": false,
|
||||
"tool_installed_or_executed": false,
|
||||
"live_writes": false,
|
||||
"owner_or_founder_assent": false,
|
||||
"blocked_execution_prerequisites": [
|
||||
"Actual owner standalone-drill disposition, target/domain-control and live authority",
|
||||
"Pinned cmctl artifact admission; checksum is not signature verification",
|
||||
"T03 owner source adaptation of pre-key tmpfs observer, exact child and remote public-request cleanup; generated timeout/parent-loss proof",
|
||||
"Original six-argument recovery attempt complete reviewed admission/current owner selector acceptance"
|
||||
],
|
||||
"separate_cluster_loss_gap": "Independent original private TLS custody or owner-reviewed off-cluster validation/provider path; surviving cluster reissue is insufficient.",
|
||||
"knowledge_orientation": {
|
||||
"package": "0.2.6",
|
||||
"digest": "sha256:8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02",
|
||||
"status": "withheld_source_changed",
|
||||
"direct_source_review": "Current relevant AGENTS, environment orientation, Security Companion, identity card and owner source reviewed; no authority granted."
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,132 @@
|
|||
{
|
||||
"observed_at": "2026-10-17T02:32:35.534547+00:00",
|
||||
"status": "public_source_only_no_private_inputs",
|
||||
"references": [
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "AGENTS.md",
|
||||
"head_observed": "503a4f617502baf38f9a09be11308a015072ef92",
|
||||
"worktree_sha256": "sha256:95158b1d5c15e6cf8be980f5c0e3b48aeef252654846273887f40516b3fa6a78"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "CONFIG.md",
|
||||
"head_observed": "503a4f617502baf38f9a09be11308a015072ef92",
|
||||
"worktree_sha256": "sha256:fa5a165378a19282f781393759191abee89f0d66fd29d1fac794fb9f4c615c65"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "sso-mfa/k8s/cert-manager/issuers.yaml",
|
||||
"head_observed": "503a4f617502baf38f9a09be11308a015072ef92",
|
||||
"worktree_sha256": "sha256:9871e0bc98c46a5dbdd144c5de8b196e3cc6c71a23b8657d50df846a9b00d8c1"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "sso-mfa/k8s/keycape/ingress.yaml",
|
||||
"head_observed": "503a4f617502baf38f9a09be11308a015072ef92",
|
||||
"worktree_sha256": "sha256:bc5c7524a82de5e8b9755e7d7d408b4a66e034424cb2663c1d21352d292d5a72"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "sso-mfa/k8s/network-policies/netpol-sso.yaml",
|
||||
"head_observed": "503a4f617502baf38f9a09be11308a015072ef92",
|
||||
"worktree_sha256": "sha256:78445887834cf876901a7b807f8753ed078501b21bff814d89071673b0281d4f"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "tools/bootstrap-recovery/identity-backup-profile.json",
|
||||
"head_observed": "503a4f617502baf38f9a09be11308a015072ef92",
|
||||
"worktree_sha256": "sha256:40f9e5b5bb957e5b23e03b31701702b850502d16a92a0fa0ebf92618cc3f18a1"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "tools/bootstrap-recovery/prepare-isolated-keycape.py",
|
||||
"head_observed": "503a4f617502baf38f9a09be11308a015072ef92",
|
||||
"worktree_sha256": "sha256:5098bdfa4e0ad30627c1716e5e355a2c78dca6ccc607bd2148a2e06126632288"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "tools/bootstrap-recovery/isolated-keycape-session.py",
|
||||
"head_observed": "503a4f617502baf38f9a09be11308a015072ef92",
|
||||
"worktree_sha256": "sha256:8fa38efe28167b59a6307f342b2ac8fcda78ecda60e6228f22017424d2343c22"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "tools/bootstrap-recovery/isolated-keycape.py",
|
||||
"head_observed": "503a4f617502baf38f9a09be11308a015072ef92",
|
||||
"worktree_sha256": "sha256:86f37add7221e4c73e3f9d878c09a3cc81061627cbf024ed6887d973d929b718"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "tools/bootstrap-recovery/run-isolated-keycape.sh",
|
||||
"head_observed": "503a4f617502baf38f9a09be11308a015072ef92",
|
||||
"worktree_sha256": "sha256:0d994c9c14ebdffdbf7879bd7562042531083d0e8955424d0ae099898a141668"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "tests/test_prepare_isolated_keycape.py",
|
||||
"head_observed": "503a4f617502baf38f9a09be11308a015072ef92",
|
||||
"worktree_sha256": "sha256:4b0871f9a11a3940983464f1b40eca1613110b1cb3cb9694f4891d58e14c700a"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "docs/bootstrap-recovery-ceremony.md",
|
||||
"head_observed": "503a4f617502baf38f9a09be11308a015072ef92",
|
||||
"worktree_sha256": "sha256:7df8d220a236d4e955e2d1daa88fdf2a94d1c11720d29ad4c0d2490e46f6dc2c"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"path": "workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md",
|
||||
"head_observed": "503a4f617502baf38f9a09be11308a015072ef92",
|
||||
"worktree_sha256": "sha256:cba3233883e9a5b429aaea1b8eacd250c6efcf5e484c4284ddc97e8e52697085"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-cluster",
|
||||
"path": "AGENTS.md",
|
||||
"head_observed": "6ae3f847c83da3402883453ee7110457bfb2d0d6",
|
||||
"worktree_sha256": "sha256:5cc7808a6d0e5cdebc7b3f13a0d7dce9cee5441ed6de4703b67cf3fe1800d45b"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-cluster",
|
||||
"path": "docs/keycape-tls-recovery-boundary.md",
|
||||
"head_observed": "6ae3f847c83da3402883453ee7110457bfb2d0d6",
|
||||
"worktree_sha256": "sha256:f4bcb1d1832c566f9c87793ed2a461c8cd8a00859dc4ae66cd3c160d7ceefa70"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-cluster",
|
||||
"path": "tools/public-tls-metadata.py",
|
||||
"head_observed": "6ae3f847c83da3402883453ee7110457bfb2d0d6",
|
||||
"worktree_sha256": "sha256:87c167e44f0fcf154c9f2afae2187bebd33e5f220c05f579c1233b58bfe4f30b"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-cluster",
|
||||
"path": "workplans/RCLUSTER-WP-0018-keycape-original-tls-recovery.md",
|
||||
"head_observed": "6ae3f847c83da3402883453ee7110457bfb2d0d6",
|
||||
"worktree_sha256": "sha256:96d52b6dbae056399159632d50b32ccc6662e4f6d3677af154f7c8a3d618334b"
|
||||
},
|
||||
{
|
||||
"repo": "secrets-engine",
|
||||
"path": "AGENTS.md",
|
||||
"head_observed": "691dc742362eeec45d5bd32d2b468f31a959748e",
|
||||
"worktree_sha256": "sha256:1b98e24f9eb35c4c56b96ee7cbac21919bbe3b928144bfa7f29cca1c3249d5d0"
|
||||
},
|
||||
{
|
||||
"repo": "secrets-engine",
|
||||
"path": "src/secrets_engine/service_auth.py",
|
||||
"head_observed": "691dc742362eeec45d5bd32d2b468f31a959748e",
|
||||
"worktree_sha256": "sha256:c0ade429edf452ad17f05d690b7ebef091db7f1a42b5ac350f1e40955c8586c0"
|
||||
},
|
||||
{
|
||||
"repo": "secrets-engine",
|
||||
"path": "src/secrets_engine/engine_auth.py",
|
||||
"head_observed": "691dc742362eeec45d5bd32d2b468f31a959748e",
|
||||
"worktree_sha256": "sha256:e0479cf6d8c13233cf99dc39491143478c021597941ae8b6ba0e37957a42f330"
|
||||
},
|
||||
{
|
||||
"repo": "secrets-engine",
|
||||
"path": "docs/keycape-isolated-recovery-selector.md",
|
||||
"head_observed": "691dc742362eeec45d5bd32d2b468f31a959748e",
|
||||
"worktree_sha256": "sha256:ed23b0df3d4b49e4b76df795455153c805971ccd37886836c960f550709e0739"
|
||||
}
|
||||
]
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue