Preserve NetKingdom implementation pause checkpoint and recovery failure
This commit is contained in:
codex
parent
86a5b0dd99
commit
3607d3e08f
26 changed files with 16216 additions and 2 deletions
|
|
@ -0,0 +1,58 @@
|
|||
# Exact offline checker artifact candidate
|
||||
|
||||
Prepared for NK-WP-0048-T16. This replaces the synthetic executable only in
|
||||
disposable adapter tests. It does not change canonical adapters, type/case bytes,
|
||||
source pins, credentials, cluster state or any native admission.
|
||||
|
||||
The existing KeyCape build target is `src/cmd/keycape`, selected from published
|
||||
clean source revision `3c71226a1a7b8a2bdb710e9c497e1a1f7f8a3987`, source tree
|
||||
`f0010b9cab17dbc3a787628a29657d98b900320f`. The existing source Makefile and
|
||||
Dockerfile build this same command. Its early `check-config` dispatch uses
|
||||
config validation and placeholder secret lookup, with no key-file or upstream
|
||||
access. This is inspection of owner source, not owner endorsement.
|
||||
|
||||
`build_checker.py` archives that exact source into `/tmp`, uses the already
|
||||
cached Go 1.23.0 toolchain with CGO disabled and fixed Linux/amd64 v1 target,
|
||||
`-trimpath`, `-buildvcs=false`, read-only module selection, and no proxy/checksum
|
||||
network access. All environment inputs are explicitly retained. Complete file
|
||||
hashes cover 108 source files, 9876 toolchain files and the ten module source
|
||||
directories used by the actual package dependency graph. The resulting static
|
||||
checker is 13633409 bytes, SHA256
|
||||
`be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5`.
|
||||
Three separately located isolated builds produced identical artifact hashes.
|
||||
|
||||
`test_real_checker_adapter.py` runs eight checks with this exact executable and
|
||||
complete synthetic configuration. No config-checker stub remains. The checks
|
||||
cover actual helper byte-preserving add/removal, actual Warden pinned producer
|
||||
admission/run/rollback, lost-readback uncertainty/replay refusal, rollback drift,
|
||||
stale CAS, substituted checker refusal, invalid startup config and missing
|
||||
secret-env refusal. Owner evidence/session trust and Kubernetes objects remain
|
||||
synthetic. The attended registration procedure remains unexercised.
|
||||
|
||||
Retained failures matter: the first closure command (`go list -m all`) required
|
||||
unused lazy-module graph metadata absent offline; the second package-list
|
||||
command omitted the build's `-buildvcs=false` flag and failed on the archived
|
||||
tree. Both builds succeeded; closure collection was corrected without downloading
|
||||
modules. Their scripts/receipts remain in `closure-collection-r1/` and `r2/`.
|
||||
`minimal-fixture-refusal.json` records the real checker rejecting the original
|
||||
incomplete synthetic fixture; only the new disposable fixture was completed.
|
||||
|
||||
Review dependencies remain concrete: KeyCape owns endorsement of this exact
|
||||
source/checker behavior; NetKingdom owns selection of its exact executable and
|
||||
new descriptor composition; Warden owns global evidence and parent-session
|
||||
revocation admission. Host storage/executable custody, per-attempt native
|
||||
callbacks, full descriptor step set, acknowledged type/version integration,
|
||||
structural/mint/delivery and consumer login/group acceptance remain separate.
|
||||
The new `proposed-descriptor.json` is an artifact-bound source proposal only.
|
||||
|
||||
Reproduction uses no production input:
|
||||
|
||||
```bash
|
||||
PYTHONPATH=/home/worsch/ops-warden/src python3 docs/changes/netkingdom-target-2026-10-16/browser-checker-artifact-next/test_real_checker_adapter.py
|
||||
```
|
||||
|
||||
The default test artifact is `/tmp/nk-checker-artifact-next-r3/keycape`; build
|
||||
reproduction requires a fresh isolated output directory and the pinned cached
|
||||
module/toolchain sources. See the exact retained build script/receipt, closure
|
||||
manifest and artifact build information. No production checker installation or
|
||||
execution is authorized by these receipts.
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
{
|
||||
"schema": "custodian.checker-artifact-independent-build.v1",
|
||||
"source_revision": "3c71226a1a7b8a2bdb710e9c497e1a1f7f8a3987",
|
||||
"source_archive_hash_matches": true,
|
||||
"all_declared_source_toolchain_module_hashes_match": true,
|
||||
"source_files": 108,
|
||||
"toolchain_files": 9876,
|
||||
"modules": 10,
|
||||
"output_root": "/tmp/nk-checker-root-35lh_ax1",
|
||||
"artifact_sha256": "sha256:be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5",
|
||||
"artifact_bytes": 13633409,
|
||||
"independent_build_matches": true,
|
||||
"initial_verification_failure": "Root initially derived mixed-case Go module cache paths without required case escaping; corrected path derivation, no source/build change.",
|
||||
"native_acceptance": false,
|
||||
"independent_real_checker_tests": {
|
||||
"passed": 8,
|
||||
"failed": 0,
|
||||
"checker_mocked": false,
|
||||
"native_acceptance": false
|
||||
},
|
||||
"caller_followup": "KeyCape owner review identifies two public config environment overrides. Existing helper inherits ambient environment; successor must explicitly constrain checker environment before integration."
|
||||
}
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,28 @@
|
|||
{
|
||||
"schema": "netkingdom.exact-checker-source-fixture.v1",
|
||||
"source_build_receipt_sha256": "sha256:cc227c17375cd89edb9a1b0304e2cf277a8c8d46370cd71f1c071da57931d3de",
|
||||
"descriptor_sha256": "sha256:76b1153d188062ece53fcd5e8d35290fdbfd02a69dd79d4b001fc42781afcdc3",
|
||||
"adapter_source_composition": "sha256:ea63efd04b4b92dc7cf52a775c6e0362b61f57783a5009d42972697e1cfaf2cd",
|
||||
"owner_adapter_source_sha256": "sha256:8a6bd0ea111d67a0df89c7e3cd968e7bf81d29c2f2a70adf08eb747e1d1a5bdc",
|
||||
"canonical_netkingdom_revision": "0394484b924c82abaaa4b01716d84a0930cc4fdf",
|
||||
"warden_revision": "d97652a3bb5fa733b063d71a1b74068efcccf572",
|
||||
"test_command": "env -i PATH=/usr/bin:/bin PYTHONPATH=/home/worsch/ops-warden/src /usr/bin/python3 docs/changes/netkingdom-target-2026-10-16/browser-checker-artifact-next/test_real_checker_adapter.py",
|
||||
"passed": 8,
|
||||
"checker_mocked": false,
|
||||
"producer_pins_overridden": false,
|
||||
"native": false,
|
||||
"owner_endorsement": false,
|
||||
"canonical_writes": false,
|
||||
"artifact": "sha256:be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5",
|
||||
"artifact_bytes": 13633409,
|
||||
"retained_failures": [
|
||||
"closure-collection-r1",
|
||||
"closure-collection-r2",
|
||||
"minimal-fixture-refusal.json"
|
||||
],
|
||||
"test_environment": {
|
||||
"PATH": "/usr/bin:/bin",
|
||||
"PYTHONPATH": "/home/worsch/ops-warden/src"
|
||||
},
|
||||
"test_exit_code": 0
|
||||
}
|
||||
|
|
@ -0,0 +1,55 @@
|
|||
# Config-checker environment and executable selection correction
|
||||
|
||||
Source-only candidate for independent root review; no canonical owner writes.
|
||||
The historical registration R3 and checker-artifact proposal remain unchanged.
|
||||
|
||||
KeyCape's existing config.Load reads two non-secret environment overrides,
|
||||
KEYCAPE_ACCOUNT_PORTAL_URL and KEYCAPE_BROWSER_LOGOUT_URL. The old helper passed
|
||||
its ambient environment to the checker, so supplied invalid URL configuration
|
||||
could be replaced by valid ambient URLs, and supplied valid configuration could
|
||||
be rejected by invalid ambient URLs. A selected bare relative filename could
|
||||
also be hashed locally by the adapter but resolved differently through PATH by
|
||||
the subprocess. `pre-fix-counterexample.txt` retains all three failures against
|
||||
the actual historical helper and exact real checker artifact.
|
||||
|
||||
The existing helper now resolves the selected file to an absolute executable
|
||||
path and supplies `env={}`. No separate wrapper or service is introduced. Three
|
||||
new opt-in owner regression tests use the actual supplied checker artifact;
|
||||
helper-only test runs explicitly skip them without an artifact. All 39 affected
|
||||
checks pass with the exact artifact supplied, and 11 actual artifact/helper/
|
||||
kernel scenarios pass with synthetic Kubernetes and owner evidence/session trust.
|
||||
No checker stub or producer-pin override is used. The non-checker PATH decoy
|
||||
exits 27 and supplies no forged checker report; the selected real artifact must
|
||||
produce the successful config verdict.
|
||||
|
||||
Path resolution does not establish immutable executable custody or eliminate
|
||||
replacement races. Those remain native host-storage/execution admission
|
||||
requirements. The helper change alters successor source-composition pins;
|
||||
`proposed-descriptor.json` is a new source proposal, and historical descriptors
|
||||
are not rewritten. Native checker storage, callbacks, complete type/step
|
||||
selection, identity and browser acceptance remain open.
|
||||
|
||||
The improved `build_checker.py` accepts a required full commit, expected src
|
||||
tree, fresh output directory and expected artifact digest. It never substitutes
|
||||
HEAD or requires the working tree to match the archived historical revision.
|
||||
The revision must be reachable from the existing published origin/main ref.
|
||||
An actual fresh build reproduced the exact binary and byte-identical full
|
||||
source/toolchain/module closure. The original build script and receipts remain
|
||||
in `browser-checker-artifact-next/`. Mutable-ref refusal is retained separately.
|
||||
|
||||
```bash
|
||||
python3 docs/changes/netkingdom-target-2026-10-16/browser-checker-environment-r2/verify_candidate.py
|
||||
python3 docs/changes/netkingdom-target-2026-10-16/browser-checker-environment-r2/build_checker.py \
|
||||
--source-revision 3c71226a1a7b8a2bdb710e9c497e1a1f7f8a3987 \
|
||||
--source-tree f0010b9cab17dbc3a787628a29657d98b900320f \
|
||||
--output-dir /tmp/fresh-keycape-checker-review \
|
||||
--expected-artifact-sha256 sha256:be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5
|
||||
```
|
||||
|
||||
The four-file patch proposes the helper fix, three real-artifact regressions,
|
||||
updated source contract notes and work-record refinement. The prior reviewed
|
||||
T17 offline-artifact task proposal is preserved, T18 records the source boundary
|
||||
correction and counterexamples, and T16 retains exact owner review/native
|
||||
composition scope. All existing task UUIDs and native gates remain unchanged.
|
||||
The preimage/postimage hashes are in manifest.json; independent source review
|
||||
and integration/publication are separate from fixture completion.
|
||||
|
|
@ -0,0 +1,63 @@
|
|||
"""Isolated offline source build; never reads runtime configuration/credentials."""
|
||||
from pathlib import Path
|
||||
import argparse,hashlib,io,json,os,re,subprocess,tarfile
|
||||
parser=argparse.ArgumentParser(description=__doc__)
|
||||
parser.add_argument('--source-revision',required=True,help='exact 40-hex published commit; never HEAD')
|
||||
parser.add_argument('--source-tree',required=True,help='exact 40-hex expected src tree')
|
||||
parser.add_argument('--output-dir',type=Path,required=True,help='fresh disposable output; must not exist')
|
||||
parser.add_argument('--expected-artifact-sha256',required=True)
|
||||
parser.add_argument('--owner-root',type=Path,default=Path('/home/worsch/key-cape'))
|
||||
args=parser.parse_args()
|
||||
if not all(re.fullmatch('[0-9a-f]{40}',v) for v in (args.source_revision,args.source_tree)):
|
||||
parser.error('source revision/tree must be exact full hashes')
|
||||
if not re.fullmatch('sha256:[0-9a-f]{64}',args.expected_artifact_sha256):
|
||||
parser.error('expected artifact must be an exact sha256 digest')
|
||||
owner=args.owner_root.resolve();target=args.output_dir.resolve();target.mkdir(exist_ok=False)
|
||||
packet=target/'receipts';packet.mkdir()
|
||||
go=Path('/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.23.0.linux-amd64/bin/go')
|
||||
sha=lambda data:'sha256:'+hashlib.sha256(data).hexdigest()
|
||||
git=lambda *args:subprocess.check_output(['git','-C',str(owner),*args])
|
||||
revision=args.source_revision
|
||||
if git('rev-parse',revision+'^{commit}').decode().strip()!=revision:
|
||||
raise SystemExit('commit identity differs')
|
||||
if git('rev-parse',revision+':src').decode().strip()!=args.source_tree:
|
||||
raise SystemExit('source tree identity differs')
|
||||
origin=git('rev-parse','origin/main').decode().strip()
|
||||
subprocess.run(['git','-C',str(owner),'merge-base','--is-ancestor',revision,'origin/main'],check=True)
|
||||
archive=git('archive','--format=tar',revision,'src');(target/'source.tar').write_bytes(archive)
|
||||
with tarfile.open(fileobj=io.BytesIO(archive)) as tar:tar.extractall(target,filter='data')
|
||||
source=target/'src';binary=target/'keycape';toolchain=go.parent.parent
|
||||
buildenv={'PATH':str(go.parent)+':/usr/bin:/bin','HOME':str(target),'TMPDIR':str(target),'GOTOOLCHAIN':'local','GOPROXY':'off','GOSUMDB':'off','GOMODCACHE':'/home/worsch/go/pkg/mod','GOCACHE':str(target/'go-build-cache'),'CGO_ENABLED':'0','GOOS':'linux','GOARCH':'amd64','GOAMD64':'v1','GOFLAGS':'-mod=readonly'}
|
||||
version=subprocess.check_output([str(go),'version'],env=buildenv,text=True).strip()
|
||||
command=[str(go),'build','-trimpath','-buildvcs=false','-o',str(binary),'./cmd/keycape']
|
||||
result=subprocess.run(command,cwd=source,env=buildenv,capture_output=True,text=True)
|
||||
(packet/'build.stdout.txt').write_text(result.stdout);(packet/'build.stderr.txt').write_text(result.stderr)
|
||||
manifest={'schema':'netkingdom.offline-checker-artifact.v1','keycape_revision':revision,'keycape_published_origin':origin,'keycape_source_tree':git('rev-parse',revision+':src').decode().strip(),'archive_sha256':sha(archive),'worktree':str(target),'toolchain':version,'go_binary':str(go),'command':command,'environment':buildenv,'exit_code':result.returncode,'native_admission':False,'owner_endorsement':False,'production_config_access':False}
|
||||
(packet/'build-receipt.json').write_text(json.dumps(manifest,indent=2)+'\n')
|
||||
if result.returncode:raise SystemExit(result.returncode)
|
||||
# Bind the entire archived source and installed toolchain; module dependency
|
||||
# closure is obtained from the exact same offline module/build configuration.
|
||||
def files(root):return {str(p.relative_to(root)):sha(p.read_bytes()) for p in sorted(root.rglob('*')) if p.is_file()}
|
||||
closure={'source':files(source),'toolchain':files(toolchain)}
|
||||
modules=subprocess.check_output([str(go),'list','-buildvcs=false','-deps','-json','./cmd/keycape'],cwd=source,env=buildenv,text=True)
|
||||
(target/'packages.json-stream').write_text(modules)
|
||||
decoder=json.JSONDecoder();remaining=modules;selected=[];seen=set();packages=[]
|
||||
while remaining.strip():
|
||||
package,end=decoder.raw_decode(remaining.lstrip());remaining=remaining.lstrip()[end:]
|
||||
packages.append({'import_path':package['ImportPath'],'go_files':package.get('GoFiles',[]),
|
||||
'embed_files':package.get('EmbedFiles',[]),'imports':package.get('Imports',[])})
|
||||
module=package.get('Module')
|
||||
if module and not module.get('Main') and module['Path'] not in seen:
|
||||
seen.add(module['Path']);directory=module.get('Dir')
|
||||
if not directory:raise SystemExit('offline module source missing '+module['Path'])
|
||||
selected.append({'path':module['Path'],'version':module['Version'],
|
||||
'go_mod_sum':module.get('GoModSum'),'sum':module.get('Sum'),'files':files(Path(directory))})
|
||||
closure['built_packages']=packages
|
||||
closure['modules']=selected
|
||||
(packet/'source-toolchain-module-closure.json').write_text(json.dumps(closure,sort_keys=True,indent=2)+'\n')
|
||||
manifest.update(artifact_sha256=sha(binary.read_bytes()),artifact_bytes=binary.stat().st_size,closure_sha256=sha((packet/'source-toolchain-module-closure.json').read_bytes()),module_count=len(selected),toolchain_file_count=len(closure['toolchain']),source_file_count=len(closure['source']))
|
||||
manifest['expected_artifact_sha256']=args.expected_artifact_sha256
|
||||
manifest['expected_artifact_matches']=manifest['artifact_sha256']==args.expected_artifact_sha256
|
||||
(packet/'build-receipt.json').write_text(json.dumps(manifest,indent=2)+'\n')
|
||||
if not manifest['expected_artifact_matches']:raise SystemExit('artifact identity differs')
|
||||
print(json.dumps({k:manifest[k] for k in ('keycape_revision','toolchain','artifact_sha256','artifact_bytes','module_count','toolchain_file_count','source_file_count')}))
|
||||
|
|
@ -0,0 +1,107 @@
|
|||
{
|
||||
"schema": "custodian.netkingdom.checker-boundary-source-integration.v1",
|
||||
"source_commit": "916ba4b33e03179274d03b78bd898a4843e8653f",
|
||||
"publication_record_commit": "cbabb6dc3611dc9b9a304b175b17e132ae057bac",
|
||||
"published_origin": "cbabb6dc3611dc9b9a304b175b17e132ae057bac",
|
||||
"source_review": "coordinator-review.json",
|
||||
"reviewed_postimages": {
|
||||
"sso-mfa/k8s/keycape/keycape-client.py": "sha256:08f5143b7d76b0a9b1debca0334e641e1e43f018554a07471cf22d0e874161a9",
|
||||
"sso-mfa/k8s/keycape/registration-adapter.md": "sha256:0caacaf717a62da6e6c8e9acc3d4b2c4b87560941e21f9561c10271d2895acba",
|
||||
"sso-mfa/k8s/keycape/test_keycape_checker_environment.py": "sha256:35f316eed168d3df588498faf24ab9377733a7d857ddfa5e0e4322a6287c93ff",
|
||||
"workplans/NK-WP-0048-security-case-types.md": "sha256:7879584f11ccfd69ac50de23e7e94afb8be84de3939c3cd6885c7649bc9bcb7a"
|
||||
},
|
||||
"final_source_hashes": {
|
||||
"sso-mfa/k8s/keycape/keycape-client.py": "sha256:08f5143b7d76b0a9b1debca0334e641e1e43f018554a07471cf22d0e874161a9",
|
||||
"sso-mfa/k8s/keycape/registration-adapter.md": "sha256:0caacaf717a62da6e6c8e9acc3d4b2c4b87560941e21f9561c10271d2895acba",
|
||||
"sso-mfa/k8s/keycape/test_keycape_checker_environment.py": "sha256:35f316eed168d3df588498faf24ab9377733a7d857ddfa5e0e4322a6287c93ff",
|
||||
"workplans/NK-WP-0048-security-case-types.md": "sha256:6765312428c4bb78380d7736de1132f0d005e6059dc17008792d0b3f2999d441"
|
||||
},
|
||||
"normal_syncs": {
|
||||
"normal-source": {
|
||||
"exit_code": 0,
|
||||
"summary": {
|
||||
"fail": 0,
|
||||
"automation_error": 0,
|
||||
"warn": 30,
|
||||
"info": 5
|
||||
},
|
||||
"result": "warn",
|
||||
"stderr": "WARN: git commit failed for writeback: Generated-only commits rejected: staged\n",
|
||||
"fixes_applied": [
|
||||
"bindings: synced 64/64",
|
||||
"C-33 fixed: regenerated WORK-RECORDS.md",
|
||||
"C-22 fixed: task 200bf500\u2026 description updated",
|
||||
"C-11 fixed: task 'NK-WP-0048-T17' \u2192 8c3e4baa\u2026",
|
||||
"C-11 fixed: task 'NK-WP-0048-T18' \u2192 9c45da71\u2026",
|
||||
"brief: .custodian-brief.md updated",
|
||||
"push: pushed"
|
||||
]
|
||||
},
|
||||
"normal-final": {
|
||||
"exit_code": 0,
|
||||
"summary": {
|
||||
"fail": 0,
|
||||
"automation_error": 0,
|
||||
"warn": 27,
|
||||
"info": 5
|
||||
},
|
||||
"result": "warn",
|
||||
"stderr": "WARN: git commit failed for writeback: Generated-only commits rejected: staged\n",
|
||||
"fixes_applied": [
|
||||
"bindings: synced 64/64",
|
||||
"C-20 fixed: dependency e31f3f9d\u2026 starts_after \u2192 8c3e4baa\u2026",
|
||||
"C-20 fixed: dependency e31f3f9d\u2026 starts_after \u2192 9c45da71\u2026",
|
||||
"C-22 fixed: task 9c45da71\u2026 description updated",
|
||||
"brief: .custodian-brief.md updated",
|
||||
"push: pushed"
|
||||
]
|
||||
}
|
||||
},
|
||||
"file_task_count": 18,
|
||||
"projected_task_count": 18,
|
||||
"status_counts": {
|
||||
"done": 12,
|
||||
"wait": 2,
|
||||
"todo": 4
|
||||
},
|
||||
"all_prior_UUIDs_preserved": true,
|
||||
"dependency_edges_verified": [
|
||||
"NK-WP-0048-T06 -> NK-WP-0048-T05",
|
||||
"NK-WP-0048-T06 -> NK-WP-0048-T08",
|
||||
"NK-WP-0048-T06 -> NK-WP-0048-T09",
|
||||
"NK-WP-0048-T06 -> NK-WP-0048-T12",
|
||||
"NK-WP-0048-T06 -> NK-WP-0048-T13",
|
||||
"NK-WP-0048-T06 -> NK-WP-0048-T14",
|
||||
"NK-WP-0048-T06 -> NK-WP-0048-T15",
|
||||
"NK-WP-0048-T06 -> NK-WP-0048-T16",
|
||||
"NK-WP-0048-T06 -> NK-WP-0048-T17",
|
||||
"NK-WP-0048-T06 -> NK-WP-0048-T18",
|
||||
"NK-WP-0048-T06 -> MASON-WP-0010-T03",
|
||||
"NK-WP-0048-T06 -> WARDEN-WP-0044-T03",
|
||||
"NK-WP-0048-T07 -> NK-WP-0048-T06"
|
||||
],
|
||||
"dependency_audit_scope": "all open task dependencies; completed historical-task edges were outside this current admission audit",
|
||||
"retained_verification_refinement": "initial broader audit refused absent completed T03->T01 historical edge; current T06/T07 open acceptance edges are verified individually",
|
||||
"exact_original_staged_brief_preserved": true,
|
||||
"exact_original_working_brief_preserved": true,
|
||||
"post_sync_race_observation": "brief-post-sync-observation.json",
|
||||
"status_after": "MM .custodian-brief.md\n M WORK-RECORDS.md\n?? docs/evidence/2026-10-15-cadence-adoption/hourly-observation-capture/\n?? docs/evidence/2026-10-15-cadence-adoption/hourly-observation-inventory.jsonl\n?? docs/evidence/2026-10-15-cadence-adoption/hourly-observation-monitor.json\n?? intakes/NET-IN-0005-single-use-setup-link-mail-handoff.md\n",
|
||||
"tests": {
|
||||
"affected": 39,
|
||||
"real_artifact_scenarios": 11,
|
||||
"producer_pins_overridden": false,
|
||||
"checker_mocked": false
|
||||
},
|
||||
"checker_artifact": "sha256:be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5",
|
||||
"retained_predecessor_failures": "pre-fix-counterexample.txt",
|
||||
"publication_failure": {
|
||||
"action": "initial git commit --only",
|
||||
"reason": "new regression test not staged; pathspec refusal before commit",
|
||||
"recovery": "staged only four reviewed files; normal scanner and source commit/push passed"
|
||||
},
|
||||
"historical_descriptors_unchanged": true,
|
||||
"native_acceptance": false,
|
||||
"new_credential_or_live_action": false,
|
||||
"progress_id": "d801aba6-6f8c-49ce-b770-005e1fdd18fe",
|
||||
"pause_point": "publication and normal final sync complete; no new work begun"
|
||||
}
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
{
|
||||
"schema": "custodian.checker-environment-publication.v1",
|
||||
"commit": "916ba4b33e03179274d03b78bd898a4843e8653f",
|
||||
"published_ancestor_of_origin_main": true,
|
||||
"all_four_reviewed_postimages_match": true,
|
||||
"native_acceptance": false
|
||||
}
|
||||
|
|
@ -0,0 +1,25 @@
|
|||
{
|
||||
"schema": "custodian.checker-environment-source-review.v1",
|
||||
"reviewed_postimages": {
|
||||
"sso-mfa/k8s/keycape/keycape-client.py": "sha256:08f5143b7d76b0a9b1debca0334e641e1e43f018554a07471cf22d0e874161a9",
|
||||
"sso-mfa/k8s/keycape/registration-adapter.md": "sha256:0caacaf717a62da6e6c8e9acc3d4b2c4b87560941e21f9561c10271d2895acba",
|
||||
"sso-mfa/k8s/keycape/test_keycape_checker_environment.py": "sha256:35f316eed168d3df588498faf24ab9377733a7d857ddfa5e0e4322a6287c93ff",
|
||||
"workplans/NK-WP-0048-security-case-types.md": "sha256:7879584f11ccfd69ac50de23e7e94afb8be84de3939c3cd6885c7649bc9bcb7a"
|
||||
},
|
||||
"independent_test_results": [
|
||||
{
|
||||
"exit_code": 0,
|
||||
"output": "coordinator-tests-0.txt"
|
||||
},
|
||||
{
|
||||
"exit_code": 0,
|
||||
"output": "coordinator-tests-1.txt"
|
||||
}
|
||||
],
|
||||
"affected_tests": 39,
|
||||
"real_artifact_scenarios": 11,
|
||||
"root_reconstruction": "/tmp/nk-checker-environment-root-0x3vn0pg",
|
||||
"source_review": "Two-line existing helper change fixes ambient URL override and PATH executable substitution. Explicit env={} and absolute selected path; native immutable executable custody remains separate.",
|
||||
"source_integration": "approved for exact four reviewed files subject to unchanged preimages and normal owner publication",
|
||||
"native_acceptance": false
|
||||
}
|
||||
|
|
@ -0,0 +1,65 @@
|
|||
{
|
||||
"schema": "netkingdom.checker-environment-source-candidate.v1",
|
||||
"owner": "net-kingdom",
|
||||
"candidate": "/tmp/nk-checker-environment-r2",
|
||||
"canonical_owner_revision": "0394484b924c82abaaa4b01716d84a0930cc4fdf",
|
||||
"postimages": {
|
||||
"sso-mfa/k8s/keycape/keycape-client.py": "sha256:08f5143b7d76b0a9b1debca0334e641e1e43f018554a07471cf22d0e874161a9",
|
||||
"sso-mfa/k8s/keycape/registration-adapter.md": "sha256:0caacaf717a62da6e6c8e9acc3d4b2c4b87560941e21f9561c10271d2895acba",
|
||||
"sso-mfa/k8s/keycape/test_keycape_checker_environment.py": "sha256:35f316eed168d3df588498faf24ab9377733a7d857ddfa5e0e4322a6287c93ff",
|
||||
"workplans/NK-WP-0048-security-case-types.md": "sha256:7879584f11ccfd69ac50de23e7e94afb8be84de3939c3cd6885c7649bc9bcb7a"
|
||||
},
|
||||
"preimages": {
|
||||
"sso-mfa/k8s/keycape/keycape-client.py": "sha256:e31ee2883fad4f93635700608ad98e05984c9e0453515dd7710c897ca856b8c8",
|
||||
"sso-mfa/k8s/keycape/registration-adapter.md": "sha256:5dc28ecc87d029d42a7bd5a02501ee2665b956e1201b8fceddb5854214d26bf8",
|
||||
"workplans/NK-WP-0048-security-case-types.md": "sha256:ae4293e3b90aa6a58bb31c72ff9391be1a57bb877fca2c067d31b9625a79b74e"
|
||||
},
|
||||
"fixture_dependencies": {
|
||||
"security-case-types/oidc-browser-relying-party/type.yaml": "sha256:f705c64e4875e9b8e18a912fb51c135e77898926d6a451f5cb74ab3c0cbe4d1c",
|
||||
"security-cases/forgejo-netkingdom-oidc.yaml": "sha256:bcc2c6d5bae0d28242b3cdb71e74d8ca297c2afe04766b55d53597f86893351d",
|
||||
"sso-mfa/k8s/keycape/keycape-registration-adapter.py": "sha256:8a6bd0ea111d67a0df89c7e3cd968e7bf81d29c2f2a70adf08eb747e1d1a5bdc",
|
||||
"sso-mfa/k8s/keycape/openbao-client-config.py": "sha256:1b908b4c36134212d78f9fbe7a2a201eb3ced06d31bb1dcea4a59d80689d84b1",
|
||||
"sso-mfa/k8s/keycape/portal-client-rollout.py": "sha256:158e1d36eb881cdd0a2eda91b472adea5e8fde5061e00d26dda368580aeb871f",
|
||||
"sso-mfa/k8s/keycape/register-user-engine-portal.py": "sha256:67173edc44f5457e7b6a3e0fb2321b398159cfce5dea8ead01eabf835fb38d76",
|
||||
"sso-mfa/k8s/keycape/test_keycape_client.py": "sha256:9572044679feaedfe732e15a2b6f8ef6b41a8fe2e4430257f309a3e83e97736c",
|
||||
"sso-mfa/k8s/keycape/test_keycape_registration_adapter.py": "sha256:beabe9fe3d2c43d296fcac475d1d0c97ebb9829debdf68846c7f32b15958641c",
|
||||
"sso-mfa/k8s/keycape/vergabe-client-rollout.py": "sha256:8cee6cc5ff3e3e8617304055263d04b393d0e005c34d9af12cb7e8bc685bac1a",
|
||||
"tools/playbook-capability-contract/playbook_contract_validator.py": "sha256:2e1e0c809d4bc9d64c2d974cc23fecd1c5636785154c2554edd9191852fd926d",
|
||||
"tools/security-case-types/security_case_evidence.py": "sha256:da8efa59c52ad73283397ebe639ae259d0cb9c6348b5cb829135c24230dcdc75",
|
||||
"tools/security-case-types/security_case_validator.py": "sha256:1bcc62e9bc374c711363295549f3cd5bb0b32952671ed4b08fddc7f74742959b",
|
||||
"tools/security-scenario-composer/security_scenario_composer.py": "sha256:9f0cc69930aa8ee2cc3fb92236e6a99728df17b8c0fe36e1250241c38fc01c4f"
|
||||
},
|
||||
"checker_artifact": "sha256:be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5",
|
||||
"successor_descriptor": "sha256:c2059fc332b587a1df9a85dcd66b0dce28ba4d5767169c7f177633f48d7a541b",
|
||||
"successor_source_composition": "sha256:6c7818ccc864869b3f98fa3b619fbb06a139722aa00907455507c92dcef7f666",
|
||||
"affected_tests": 39,
|
||||
"real_artifact_scenarios": 11,
|
||||
"predecessor_counterexamples": {
|
||||
"failed": 1,
|
||||
"errors": 2,
|
||||
"scope": "three new regression scenarios fail against unchanged historical helper"
|
||||
},
|
||||
"canonical_writes": false,
|
||||
"native_acceptance": false,
|
||||
"review_status": "awaiting independent root source review",
|
||||
"evidence_hashes": {
|
||||
"reproduction-comparison.json": "sha256:6376455c74f6cf0edbb2868e223272e8d6418a47200bb4b7e861e6c5816e16df",
|
||||
"test_real_checker_adapter.py": "sha256:f7878265f06d67821e228a14686edebb34973ed94f4d3b954f0c7093b8392ea8",
|
||||
"build.stderr.txt": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
|
||||
"README.md": "sha256:d595c038cb28a62c84512e5a136f49de3eb83b3cd8dc6bc057a06043bf5f497f",
|
||||
"build_checker.py": "sha256:b5fdf9d0c77460deadfe16346b42c2040d73fd6de787db48c0c5fc76c4413727",
|
||||
"reconstruction-tests.txt": "sha256:9212ab64851f2a745a8d3668927d7c3d779d286778f9ad771dc94c370c98e7da",
|
||||
"coordinator-tests-1.txt": "sha256:77e64dbad4512a45f1a279a3491ae13254a7854e922e62e13298389735d1d349",
|
||||
"build-receipt.json": "sha256:1a3bb61a958afdbe46664384963a53e275a5a6b53741bda9244e28f58b4453ff",
|
||||
"pre-fix-counterexample.txt": "sha256:7e251f44bd0d52068867083d53ed85900d40fffb24c4d1116621816879ccf8bd",
|
||||
"implementation.patch": "sha256:7281f3b4f11a726f4ffb2d5b8ddf6bdeaecbfc25f956c98f4262b77abb9f8c50",
|
||||
"coordinator-tests-0.txt": "sha256:a122dc8641707ad9f42cbc6cbfa4dcb9bd23d3d080ebd25fcf4db8e550db382d",
|
||||
"mutable-ref-refusal.json": "sha256:e428cfe6c7856d530ab1dc95672cc18751e911e6d3243c2ebabfd5b7966543d3",
|
||||
"real-artifact-tests.txt": "sha256:e47c287ece4f0d8516847c86c61e24b211a1060ffaf7ae13c86ee56c6e8ec131",
|
||||
"coordinator-review.json": "sha256:5a6e4fa25488cc6d97bc1160a7658fdc885c7539da182f32f3ffe801393ec3c4",
|
||||
"verify_candidate.py": "sha256:7896c6e83b2469407d5b75f4bcb91a9e6f997beafdc3e561766fd5c21c78f3ae",
|
||||
"build.stdout.txt": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
|
||||
"affected-source-tests.txt": "sha256:ebe48ef125123c079560e732330814aef169369d98b63ac04befc770bbbdd9f7",
|
||||
"proposed-descriptor.json": "sha256:c2059fc332b587a1df9a85dcd66b0dce28ba4d5767169c7f177633f48d7a541b"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
{
|
||||
"revised_reproducer_artifact_matches_historical": true,
|
||||
"closure_bytes_identical": true,
|
||||
"reproduced_closure_sha256": "sha256:cb2f8ce0a3ee1efb7099ce00d139ebe00a23a8b356fba160ab8c4b067f5818f9",
|
||||
"historical_closure_sha256": "sha256:cb2f8ce0a3ee1efb7099ce00d139ebe00a23a8b356fba160ab8c4b067f5818f9"
|
||||
}
|
||||
|
|
@ -0,0 +1,25 @@
|
|||
{
|
||||
"schema": "netkingdom.checker-boundary-resume.v1",
|
||||
"stopped_at": "2026-10-16T20:32:33.880738+00:00",
|
||||
"reason": "user requested good pause point; current publication and sync finished",
|
||||
"owner_revision": "cbabb6dc3611dc9b9a304b175b17e132ae057bac",
|
||||
"no_running_child_operation": true,
|
||||
"source_tasks_done": [
|
||||
"NK-WP-0048-T13",
|
||||
"NK-WP-0048-T17",
|
||||
"NK-WP-0048-T18"
|
||||
],
|
||||
"remaining_todo": {
|
||||
"NK-WP-0048-T12": "env/config/restart source adapters",
|
||||
"NK-WP-0048-T14": "created-only group/membership provenance",
|
||||
"NK-WP-0048-T15": "authenticated durable registration recovery",
|
||||
"NK-WP-0048-T16": "exact owner/native executable storage and callback/type composition admission"
|
||||
},
|
||||
"native_reference_gate": "NK-WP-0048-T06 remains wait",
|
||||
"next_action": "At resume, read current owner records and exact review/native prerequisites before choosing one remaining source task. No current native authority is granted.",
|
||||
"historical_packets_preserved": [
|
||||
"browser-adapter-next",
|
||||
"browser-checker-artifact-next"
|
||||
],
|
||||
"no_production_config_or_credential_access": true
|
||||
}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
{
|
||||
"schema": "custodian.netkingdom-checkpoint-publication.v1",
|
||||
"commit": "86a5b0dd9971ba44f912b98296ecf8b41ec215b4",
|
||||
"head_equals_origin_at_completion": true,
|
||||
"normal_statehub_sync_exit_code": 0,
|
||||
"source_revision": "86a5b0dd9971ba44f912b98296ecf8b41ec215b4",
|
||||
"source_revision_reason": null,
|
||||
"summary": {
|
||||
"fail": 0,
|
||||
"automation_error": 0,
|
||||
"warn": 7,
|
||||
"info": 4
|
||||
},
|
||||
"fixes_applied": [
|
||||
"bindings: synced 89/89",
|
||||
"C-17 cleared: pushed 1 backlogged commit(s)",
|
||||
"C-22 fixed: task 6aca534c\u2026 description updated",
|
||||
"push: pushed"
|
||||
],
|
||||
"original_staged_brief_and_worktree_restored": true,
|
||||
"scope": "Reviewed browser adapter and Warden compatibility publication, owner work-record reconciliation, rejected recovery revisions and independent source tests.",
|
||||
"native_gate_completion": false
|
||||
}
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
{
|
||||
"schema": "custodian.recovery-daemon-nonzero-counterexample.v1",
|
||||
"revision": 4,
|
||||
"synthetic_subprocess_only": true,
|
||||
"nonzero_docker_status_refused": true,
|
||||
"uncertainty_marker_present": false,
|
||||
"finding": "A Docker CLI transport failure can return nonzero after a request reaches the daemon. process() removes inflight marker without recording uncertainty for nonzero results; later cleanup can overclaim verified absence."
|
||||
}
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
{
|
||||
"schema": "custodian.identity-restore-source-review.v1",
|
||||
"revision": 4,
|
||||
"dependency_manifest_sha256": "sha256:5da048da121904b5cae5980843d80010dca70d40d665a354cd3f40632b9e66a9",
|
||||
"dependency_files_verified": 14,
|
||||
"independent_tests": {
|
||||
"passed": 61,
|
||||
"failed": 0,
|
||||
"real_disposable_process_tests": 2,
|
||||
"native_docker": false,
|
||||
"credentials": false
|
||||
},
|
||||
"source_review": "Fresh exclusive parent execution with pidfd-bound quiescence before reaper cleanup; exact local daemon routing; plaintext and future resource obligations registered before decryption.",
|
||||
"remaining_finding": "Nonzero Docker subprocess return drops inflight marker without retaining uncertainty; reproduced and recorded in coordinator-r4-nonzero-counterexample.json.",
|
||||
"disposition": "minimal_successor_required_before_canonical_integration_or_native_fixture",
|
||||
"native_acceptance": false
|
||||
}
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
{
|
||||
"schema": "custodian.identity-restore-disposable-fixture-review.v1",
|
||||
"proposal_id": "CUST-WP-0080-T06-keycape-synthetic-fixture-r5",
|
||||
"revision": 5,
|
||||
"fixture_manifest_sha256": "sha256:6a4e3f47fc9a647d813dfbe75851d1ef62ebac7cfc7a7818b587ad56bf919c7a",
|
||||
"all_manifest_source_hashes_verified": true,
|
||||
"independent_tests_passed": 67,
|
||||
"reviewed_corrections": [
|
||||
"Nonzero Docker exit preserves uncertainty",
|
||||
"Policy-only shared mount writable for original lockfile; remaining issuer inputs read-only",
|
||||
"Bounded public readiness failure returned as data without hiding Docker transport errors"
|
||||
],
|
||||
"reviewed_execution_scope": "Positive disposable local fixture only, exact cached images/engine, generated materials, network-none/loopback namespace; resource and cleanup inventory in manifest. Extended cases require positive result review first.",
|
||||
"authorization_scope": "Routine local testing within the existing implementation goal; no production trust/custody, real credentials or native architecture acceptance authorized.",
|
||||
"expected_result": "Original-image issuer native verification and wrong-secret/excess-scope refusal; exact preserved bytes and verified cleanup, otherwise retain failure/uncertainty.",
|
||||
"rollback": "Exact label-owned containers/verified tmpfs volumes and inode-bound temporary plaintext cleanup; no wildcard removal.",
|
||||
"cost_risk": "No provider/model spend, at most two new local service containers/4x32MiB tmpfs; generated test material only.",
|
||||
"native_acceptance": false
|
||||
}
|
||||
|
|
@ -0,0 +1,94 @@
|
|||
# KeyCape owner review: exact offline configuration checker
|
||||
|
||||
Reviewer: `key-cape-owner (agent key-cape, codex)`
|
||||
Decision: `approved` for the bounded source/artifact behavior below
|
||||
Work item: `KEY-WP-0038-T02` (remains `wait`)
|
||||
Date: 2026-10-16
|
||||
|
||||
KeyCape endorses the offline configuration validation behavior of published
|
||||
source `3c71226a1a7b8a2bdb710e9c497e1a1f7f8a3987`, `src` tree
|
||||
`f0010b9cab17dbc3a787628a29657d98b900320f`, and the Linux/amd64 Go 1.23.0
|
||||
artifact SHA256 `be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5`
|
||||
(13,633,409 bytes). This review is an owner judgement, not human approval,
|
||||
production authorization or native admission.
|
||||
|
||||
The INTENT.md basis is KeyCape's Tooling declaration, Purpose/Primary Utility and
|
||||
Strategic Boundaries: deterministic profile-constrained authentication tooling,
|
||||
explicit configuration checks, delivered secret references, and separation from
|
||||
authorization decisions. The review stays within these responsibilities.
|
||||
|
||||
## Source and build evidence
|
||||
|
||||
The candidate's source archive matches the exact published revision and src tree.
|
||||
Independent owner checks matched all 108 archived source files, 9876 cached
|
||||
Go toolchain files and every file in the ten selected module source trees against
|
||||
the closure. The closure JSON SHA256 is
|
||||
`cb2f8ce0a3ee1efb7099ce00d139ebe00a23a8b356fba160ab8c4b067f5818f9`;
|
||||
archive SHA256 is `770a15933e6c45d4b94beb37d4322fd4ae1436d8193dfb7f5655bbc851f3fc73`.
|
||||
The actual executable matches the artifact above. Its command is the existing
|
||||
`./cmd/keycape` target, also built by the owner Makefile/Dockerfile. The retained
|
||||
build uses explicit environment, cached Go 1.23.0, readonly module resolution,
|
||||
CGO disabled, fixed Linux/amd64/v1, trimpath and buildvcs=false, GOPROXY=off and
|
||||
GOSUMDB=off. These are deterministic local input checks, not independent
|
||||
attestation of upstream toolchain/module provenance or host custody.
|
||||
|
||||
`main.go` dispatches `check-config` first, before server config processing,
|
||||
private-key loading, adapter construction, policy-store opening or listener
|
||||
startup. `checkconfig.go` calls the same `config.Load`, `ValidateConfig`, global
|
||||
lifetime parse, and registry conversion used by startup, with a constant
|
||||
placeholder in place of client-secret lookup. `policy.CheckClients` checks
|
||||
registry shape without opening the policy store. Source inspection found no
|
||||
application init path that reads credentials or contacts an upstream for this
|
||||
command. No KeyCape private-key read, client-secret lookup, upstream request,
|
||||
listener, real authentication or signing occurs in this branch.
|
||||
|
||||
Fourteen direct executable checks passed: valid confidential/public registrations
|
||||
without any actual secret/key; bad port/lifetime/query redirect/browser roles;
|
||||
missing declared env name; omitted and empty env-name semantics; required policy
|
||||
client presence with and without policy assertion; non-secret URL environment
|
||||
overlay; synthetic secret non-emission; permissive unknown YAML field handling;
|
||||
and success with an unopened signing-key FIFO plus unused policy path. The three
|
||||
relevant package suites (`cmd/keycape`, `internal/config`, `internal/server/policy`)
|
||||
passed. The first package-suite attempt failed because the candidate src-only
|
||||
archive omitted two committed external config fixtures. It is retained. Rerun
|
||||
added only those fixture paths archived from the exact reviewed revision.
|
||||
The coordinator separately reports reproducing the same artifact and eight
|
||||
adapter fixture checks; that is supporting coordinator evidence, not an owner
|
||||
claim of native or caller integration acceptance.
|
||||
|
||||
## Contract and limitations
|
||||
|
||||
- Always pass the explicit synthetic/config path. This command loads the supplied
|
||||
YAML file; it cannot guarantee the caller supplied only non-secret contents.
|
||||
- `config.Load` reads the non-secret `KEYCAPE_ACCOUNT_PORTAL_URL` and
|
||||
`KEYCAPE_BROWSER_LOGOUT_URL` environment overrides. Validation therefore is not
|
||||
independent of the caller environment. The caller must intentionally supply
|
||||
the desired URL configuration in a minimal environment. This endorsement does
|
||||
not certify the current NetKingdom subprocess environment or its correction.
|
||||
- `--env-names` checks names only when its value is nonempty. Omitted/empty means
|
||||
list required names without proving their provision. Even nonempty assertions
|
||||
prove neither Secret existence, values, mount/ESO delivery nor readable custody.
|
||||
- `--policy-store` asserts the target enables that store and checks its required
|
||||
clients. It proves no path permissions, lock availability or stored state.
|
||||
- The loader follows existing server YAML semantics, including acceptance of
|
||||
unknown fields. Validation is the implemented startup subset, not a complete
|
||||
OIDC/profile policy or schema audit. It does not strengthen every currently
|
||||
accepted redirect/grant/client field.
|
||||
- No key existence/parsing, policy-file access, port binding, upstream readiness,
|
||||
live config equivalence, browser flow, token claims, group enforcement, secret
|
||||
minting/delivery, consumer login or actual human/agent/service identity is proved.
|
||||
- Exact byte identity does not establish immutable executable storage, safe file
|
||||
descriptors, launch custody, type/version acknowledgement, descriptor step-set
|
||||
composition, Warden admission or parent-session revocation. Those remain with
|
||||
the respective owners. No other owner role is endorsed here.
|
||||
|
||||
No blocking defect was found within this exact offline checker scope. The broader
|
||||
browser registration and identity tasks remain open. No production configuration,
|
||||
credentials, cluster mutations, external messages or paid calls were used.
|
||||
|
||||
Reproduction and detailed local receipts are in
|
||||
`the-custodian/docs/changes/netkingdom-target-2026-10-16/keycape-checker-owner-review/`:
|
||||
`review_checks.py`, `owner-checks.json`, `source-tests.json`, `source-tests.txt`
|
||||
and `source-tests-first-attempt.txt`. Original candidate build/closure receipts
|
||||
remain in the adjacent `browser-checker-artifact-next/` packet, including failed
|
||||
closure collection attempts.
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
{
|
||||
"schema": "custodian.keycape-owner-review-publication.v1",
|
||||
"owner_commit": "834b0d06a13bb2ece9cc98392cb39ba0e2167ecb",
|
||||
"published_ancestor_of_origin_main": true,
|
||||
"committed_files": {
|
||||
"docs/offline-checker-owner-review-2026-10-16.md": "sha256:75ed6866b29cbb9f2c5c2a395da2afa25d021f248587c7055bd721e2c55b8685",
|
||||
"docs/offline-checker-owner-review-2026-10-16.json": "sha256:aa9083e77ea08d166e8cec7c5d73362c19058567c5e80a576766af3745958dc0",
|
||||
"workplans/KEY-WP-0038-forgejo-oidc-client.md": "sha256:dc8d88d462799e7e6e44da759a973d52e44102a271969a5daaa9d30ec015b064"
|
||||
},
|
||||
"review_scope": "Exact source/artifact offline configuration validation behavior only; empty/omitted env-names, public environment override, policy-store assertion, custody, upstream compiler provenance and native acceptance limitations preserved.",
|
||||
"native_acceptance": false
|
||||
}
|
||||
|
|
@ -0,0 +1,208 @@
|
|||
{
|
||||
"schema": "keycape.offline-checker-owner-checks.v1",
|
||||
"source_revision": "3c71226a1a7b8a2bdb710e9c497e1a1f7f8a3987",
|
||||
"source_tree": "f0010b9cab17dbc3a787628a29657d98b900320f",
|
||||
"artifact_sha256": "sha256:be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5",
|
||||
"closure_sha256": "sha256:cb2f8ce0a3ee1efb7099ce00d139ebe00a23a8b356fba160ab8c4b067f5818f9",
|
||||
"closure_verified_files": {
|
||||
"source": 108,
|
||||
"toolchain": 9876,
|
||||
"golang.org/x/sys": 537,
|
||||
"github.com/mattn/go-isatty": 17,
|
||||
"github.com/mattn/go-colorable": 16,
|
||||
"github.com/rs/zerolog": 83,
|
||||
"gopkg.in/yaml.v3": 24,
|
||||
"golang.org/x/crypto": 344,
|
||||
"github.com/Azure/go-ntlmssp": 17,
|
||||
"github.com/go-asn1-ber/asn1-ber": 73,
|
||||
"github.com/google/uuid": 31,
|
||||
"github.com/go-ldap/ldap/v3": 44
|
||||
},
|
||||
"checks": [
|
||||
{
|
||||
"name": "valid_without_secret_or_key",
|
||||
"exit_code": 0,
|
||||
"report": {
|
||||
"valid": true,
|
||||
"errors": [],
|
||||
"clients": 2,
|
||||
"required_env": [
|
||||
"SYNTHETIC_CLIENT_SECRET"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "bad_port",
|
||||
"exit_code": 1,
|
||||
"report": {
|
||||
"valid": false,
|
||||
"errors": [
|
||||
"port: must be between 1 and 65535, got 0"
|
||||
],
|
||||
"clients": 2,
|
||||
"required_env": [
|
||||
"SYNTHETIC_CLIENT_SECRET"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "bad_global_lifetime",
|
||||
"exit_code": 1,
|
||||
"report": {
|
||||
"valid": false,
|
||||
"errors": [
|
||||
"tokenLifetime must be a valid duration"
|
||||
],
|
||||
"clients": 2,
|
||||
"required_env": [
|
||||
"SYNTHETIC_CLIENT_SECRET"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "bad_redirect_query",
|
||||
"exit_code": 1,
|
||||
"report": {
|
||||
"valid": false,
|
||||
"errors": [
|
||||
"clients[0] (user-engine-portal): redirect_uri \"https://portal.example.invalid/cb?x=1\" must not contain wildcards"
|
||||
],
|
||||
"clients": 2,
|
||||
"required_env": [
|
||||
"SYNTHETIC_CLIENT_SECRET"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "ignored_browser_roles",
|
||||
"exit_code": 1,
|
||||
"report": {
|
||||
"valid": false,
|
||||
"errors": [
|
||||
"clients[0] (user-engine-portal): roles is only read for client_credentials clients; a browser client's roles come from the directory user"
|
||||
],
|
||||
"clients": 2,
|
||||
"required_env": [
|
||||
"SYNTHETIC_CLIENT_SECRET"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "missing_declared_env",
|
||||
"exit_code": 1,
|
||||
"report": {
|
||||
"valid": false,
|
||||
"errors": [
|
||||
"client \"vergabe-demo-company\": secret environment variable \"SYNTHETIC_CLIENT_SECRET\" is not provided"
|
||||
],
|
||||
"clients": 2,
|
||||
"required_env": [
|
||||
"SYNTHETIC_CLIENT_SECRET"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "omitted_env_names_only_lists",
|
||||
"exit_code": 0,
|
||||
"report": {
|
||||
"valid": true,
|
||||
"errors": [],
|
||||
"clients": 2,
|
||||
"required_env": [
|
||||
"SYNTHETIC_CLIENT_SECRET"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "empty_env_names_only_lists",
|
||||
"exit_code": 0,
|
||||
"report": {
|
||||
"valid": true,
|
||||
"errors": [],
|
||||
"clients": 2,
|
||||
"required_env": [
|
||||
"SYNTHETIC_CLIENT_SECRET"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "missing_policy_client",
|
||||
"exit_code": 1,
|
||||
"report": {
|
||||
"valid": false,
|
||||
"errors": [
|
||||
"policy store: vergabe-demo-company and user-engine-portal must be authorization_code clients without mfaRequired false"
|
||||
],
|
||||
"clients": 2,
|
||||
"required_env": [
|
||||
"SYNTHETIC_CLIENT_SECRET"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "policy_client_not_asserted",
|
||||
"exit_code": 0,
|
||||
"report": {
|
||||
"valid": true,
|
||||
"errors": [],
|
||||
"clients": 2,
|
||||
"required_env": [
|
||||
"SYNTHETIC_CLIENT_SECRET"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "nonsecret_environment_overlay",
|
||||
"exit_code": 1,
|
||||
"report": {
|
||||
"valid": false,
|
||||
"errors": [
|
||||
"accountPortalURL: must be an HTTPS URL without credentials, query or fragment",
|
||||
"accountPortalURL and browserLogoutURL must be configured together"
|
||||
],
|
||||
"clients": 2,
|
||||
"required_env": [
|
||||
"SYNTHETIC_CLIENT_SECRET"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "synthetic_secret_not_emitted",
|
||||
"exit_code": 0,
|
||||
"report": {
|
||||
"valid": true,
|
||||
"errors": [],
|
||||
"clients": 2,
|
||||
"required_env": [
|
||||
"SYNTHETIC_CLIENT_SECRET"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "unknown_yaml_field_same_loader",
|
||||
"exit_code": 0,
|
||||
"report": {
|
||||
"valid": true,
|
||||
"errors": [],
|
||||
"clients": 2,
|
||||
"required_env": [
|
||||
"SYNTHETIC_CLIENT_SECRET"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "key_fifo_and_policy_path_not_read",
|
||||
"exit_code": 0,
|
||||
"report": {
|
||||
"valid": true,
|
||||
"errors": [],
|
||||
"clients": 2,
|
||||
"required_env": [
|
||||
"SYNTHETIC_CLIENT_SECRET"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"passed": 14,
|
||||
"native_admission": false
|
||||
}
|
||||
|
|
@ -0,0 +1,34 @@
|
|||
{
|
||||
"reviewer": "key-cape-owner (agent key-cape, codex)",
|
||||
"decision": "approved",
|
||||
"scope": "exact source/artifact offline configuration validation behavior only",
|
||||
"comment": "INTENT.md Tooling declaration, Purpose/Primary Utility and Strategic Boundaries; deterministic constrained IAM config validation and delivered-reference boundary. KEY-WP-0038-T02 remains wait. See bound narrative for explicit limits; this is an owner review, not human approval or admission.",
|
||||
"work_item": "KEY-WP-0038-T02",
|
||||
"source_revision": "3c71226a1a7b8a2bdb710e9c497e1a1f7f8a3987",
|
||||
"source_tree": "f0010b9cab17dbc3a787628a29657d98b900320f",
|
||||
"artifact_sha256": "sha256:be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5",
|
||||
"artifact_bytes": 13633409,
|
||||
"closure_sha256": "sha256:cb2f8ce0a3ee1efb7099ce00d139ebe00a23a8b356fba160ab8c4b067f5818f9",
|
||||
"review_narrative_sha256": "sha256:75ed6866b29cbb9f2c5c2a395da2afa25d021f248587c7055bd721e2c55b8685",
|
||||
"owner_checks_sha256": "sha256:4669c8ac2fcee76926b1419a9fe6c5924abf354c7ebc1fd2ee1b697c6e4f5419",
|
||||
"source_tests_receipt_sha256": "sha256:e606adb20b943072d1052f8f9dffd89b78f73c4dd10bd761f29b6cec72fc21a0",
|
||||
"candidate_inputs": {
|
||||
"README.md": "sha256:0df0fd7f263481ef706433c320af0d908f1b763557c3b0f5e4beca57408d7d5a",
|
||||
"build_checker.py": "sha256:ea58117252e7cc5328307d3551580dc251780db12e9e8c1600de88633ea24179",
|
||||
"build-receipt.json": "sha256:cc227c17375cd89edb9a1b0304e2cf277a8c8d46370cd71f1c071da57931d3de",
|
||||
"source-toolchain-module-closure.json": "sha256:cb2f8ce0a3ee1efb7099ce00d139ebe00a23a8b356fba160ab8c4b067f5818f9",
|
||||
"artifact-build-info.txt": "sha256:025391cc0fc013352783eedadd34a9bdaf6dc6cf10d5d2cebec7099598a8300a",
|
||||
"verification.json": "sha256:1655501a3124cbb3ebd88cd440d96592ccfd1138e01724b79eaafff69031e464"
|
||||
},
|
||||
"limits": [
|
||||
"two non-secret URL environment overrides remain inputs",
|
||||
"omitted/empty env-names does not check provision",
|
||||
"policy-store flag is caller assertion",
|
||||
"permissive server YAML semantics",
|
||||
"no executable custody, launch descriptors or native/type admission",
|
||||
"no actual identity, signing, upstream or group/consumer proof"
|
||||
],
|
||||
"native_admission": false,
|
||||
"production_authorization": false,
|
||||
"other_owner_roles_reviewed": []
|
||||
}
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
{
|
||||
"commit": "834b0d06a13bb2ece9cc98392cb39ba0e2167ecb",
|
||||
"published_origin": "834b0d06a13bb2ece9cc98392cb39ba0e2167ecb",
|
||||
"paths": [
|
||||
"docs/offline-checker-owner-review-2026-10-16.md",
|
||||
"docs/offline-checker-owner-review-2026-10-16.json",
|
||||
"workplans/KEY-WP-0038-forgejo-oidc-client.md"
|
||||
],
|
||||
"original_staged_patch_preserved": true,
|
||||
"original_generated_worktree_preserved": true,
|
||||
"post_status": "M .custodian-brief.md\n M WORK-RECORDS.md\n",
|
||||
"consistency_exit_code": 0,
|
||||
"hooks_bypassed": false,
|
||||
"native_admission": false
|
||||
}
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
{
|
||||
"command": [
|
||||
"/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.23.0.linux-amd64/bin/go",
|
||||
"test",
|
||||
"-buildvcs=false",
|
||||
"./cmd/keycape",
|
||||
"./internal/config",
|
||||
"./internal/server/policy"
|
||||
],
|
||||
"exit_code": 0,
|
||||
"config_fixture_archive_sha256": "sha256:b02e97fc806715196c7ccd5f2b532788177e8b9b03341159789c70d9356269c0",
|
||||
"config_fixture_source_revision": "3c71226a1a7b8a2bdb710e9c497e1a1f7f8a3987",
|
||||
"initial_attempt": "source-tests-first-attempt.txt",
|
||||
"initial_failure": "src-only archive omits committed fixtures needed by package tests; no checker failure",
|
||||
"fixture_paths": [
|
||||
"config/service-clients.example.yaml",
|
||||
"config/dev-config.yaml"
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,67 @@
|
|||
{
|
||||
"status": "pause_checkpoint_with_local_evidence",
|
||||
"reason": "Normal staged-blob scanner refused six evidence files. No bypass. Original files retained locally; complete frozen R5 source packet withheld together rather than publishing an incomplete closure.",
|
||||
"scanner_result": {
|
||||
"blocked_blob_ids": [
|
||||
"0826ed9dabd9a902c47fcf1dd23634b87629ff92",
|
||||
"2fd3a7db423d5283347434df3843fd071022170d",
|
||||
"602df96c91e67fbbc9db625f7f388937c54014f7",
|
||||
"93af4627bdaf2470da9943951ae4f022ab895a85",
|
||||
"b533980bb63bed7fadb4ce5e20d168d29cfa37b3",
|
||||
"e1d467e39499d00e78f0290b036b0595fb4ca2a2"
|
||||
],
|
||||
"scanned_blobs": 67,
|
||||
"scanner_sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509",
|
||||
"scanner_version": "8.30.1",
|
||||
"scope": "changed-staged-blobs",
|
||||
"status": "blocked"
|
||||
},
|
||||
"withheld_files": [
|
||||
"docs/changes/netkingdom-target-2026-10-16/browser-checker-artifact-next/build-receipt.json",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/actual-fixture-r5-failure.json",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/FIXTURE-R5.md",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/README.md",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/candidate.patch",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/dependency-closure-sha256.json",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/preparation.json",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/sso-mfa/bootstrap/sops-private.py",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/sso-mfa/k8s/privacyidea/key-custody-remote.py",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tests/isolated-keycape-native-fixture-manifest.json",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tests/run_isolated_keycape_native_fixture.py",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tests/test_identity_bundle.py",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tests/test_isolated_keycape_fixture_plan.py",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tests/test_isolated_keycape_recovery.py",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tests/test_isolated_keycape_session.py",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tools/bootstrap-recovery/capture-identity.py",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tools/bootstrap-recovery/check-privacyidea-database.py",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tools/bootstrap-recovery/fetch-privacyidea-backup.py",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tools/bootstrap-recovery/identity-backup-profile.json",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tools/bootstrap-recovery/identity-bundle.py",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tools/bootstrap-recovery/identity-credential-setup.py",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tools/bootstrap-recovery/identity-custody.json",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tools/bootstrap-recovery/identity-files.py",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tools/bootstrap-recovery/identity-isolation.py",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tools/bootstrap-recovery/identity-offsite.py",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tools/bootstrap-recovery/identity-retention.py",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tools/bootstrap-recovery/identity-runtime.py",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tools/bootstrap-recovery/install-identity-backup.py",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tools/bootstrap-recovery/inventory-scaleway.py",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tools/bootstrap-recovery/inventory-storage-share.py",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tools/bootstrap-recovery/isolated-keycape-session.py",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tools/bootstrap-recovery/isolated-keycape.py",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tools/bootstrap-recovery/isolated-lldap.py",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tools/bootstrap-recovery/isolated-privacyidea.py",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tools/bootstrap-recovery/prepare-identity-coverage.py",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tools/bootstrap-recovery/recovery-kit.py",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tools/bootstrap-recovery/retrieve-identity-offline.py",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tools/bootstrap-recovery/retrieve-identity.py",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tools/bootstrap-recovery/run-isolated-keycape.sh",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tools/bootstrap-recovery/verify-bundle.py",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tools/bootstrap-recovery/verify-identity-delivery.py",
|
||||
"docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tools/bootstrap-recovery/verify-identity.py"
|
||||
],
|
||||
"limitations": [
|
||||
"Frozen R5 fixture and original failed-trial receipt require local workspace or separately reviewed evidence transfer to resume.",
|
||||
"Published review summaries describe failed runtime trial and verified cleanup; no acceptance gate closed."
|
||||
]
|
||||
}
|
||||
|
|
@ -469,6 +469,30 @@
|
|||
"published": true,
|
||||
"native_accepted": false,
|
||||
"receipt": "browser-adapter-next/coordinator-publication-review.json"
|
||||
},
|
||||
{
|
||||
"repo": "key-cape",
|
||||
"slice": "offline-checker-owner-review",
|
||||
"commit": "834b0d06a13bb2ece9cc98392cb39ba0e2167ecb",
|
||||
"published": true,
|
||||
"native_accepted": false,
|
||||
"receipt": "keycape-checker-owner-review/coordinator-publication-review.json"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"slice": "deterministic-config-checker-inputs",
|
||||
"commit": "916ba4b33e03179274d03b78bd898a4843e8653f",
|
||||
"published": true,
|
||||
"native_accepted": false,
|
||||
"receipt": "browser-checker-environment-r2/coordinator-publication-review.json"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"slice": "deterministic-checker-owner-publication-record",
|
||||
"commit": "cbabb6dc3611dc9b9a304b175b17e132ae057bac",
|
||||
"published": true,
|
||||
"native_accepted": false,
|
||||
"receipt": "browser-checker-environment-r2/canonical-integration.json"
|
||||
}
|
||||
],
|
||||
"integrity_note": "Canonical owner commits are the durable source. Raw patches and temporary reconstructions are workspace-local review artifacts; their hashes retain revision identity. No runtime admission follows from these commits.",
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue