coulomb/the-custodian
5
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

Request independent review of the NK-WP-0048 seven-step 1.2 adapter set (r1)

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
codex 2026-10-17 10:36:50 +02:00
parent 6f61224f12
commit 3cf2fd1ea4
1 changed files with 87 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

87
docs/changes/netkingdom-target-2026-10-17/nk48-adapters-1.2-review/README.md Normal file
View file

@ -0,0 +1,87 @@
# Review request: NK-WP-0048 seven-step 1.2 adapter set (r1)
Requested 2026-10-17 by the founder. This asks for an independent coordinator source
review of the NetKingdom adapter set, following the T13 precedent in
`../../netkingdom-target-2026-10-16/browser-adapter-next/` (coordinator-review-r3.json).
## Provenance, so the reviewer can judge independence
One Claude Code orchestration session wrote all of the code under review, through
subagent workers. Run this review in a **separate session** that has none of that
session's context. Do not ask the authoring session for explanations; read the
source.
## Frozen review target
Repository `net-kingdom`, commit `582ab9fad063a43730c9cd0aaa0dc48b700b1248`
(work since `2019e82`; 22 commits). All files are in `sso-mfa/k8s/keycape/`.
sha256 at that commit:
| File | Task | sha256 |
|---|---|---|
| keycape-registration-adapter.py | T13, changed by T15 source | 021eee262ea5d23d46258ed819da57b331f07b814adcafd60e0941214be02aea |
| ensure-groups-adapter.py | T24 | 19325fc599ae76e7ec2b54c132b1cf7dea1b5e931bb5263031dbdf8f4c0bcc7f |
| mint-secret-adapter.py | T25 | 1242902a8366e5837d1a24c742a2dff84efb195cd8d3e25382fa4e971d732499 |
| deliver-secret-adapter.py | T26 | b97df5710e388ca57b9f239a2900bc29e0b1c1fe1740a1f7987636b44343cf80 |
| bind-env-adapter.py | T27 | 3f1c6426e31806d969336b6fdfecd8dd321ec0ca43b50b20213cc9f7637f7c7e |
| deliver-consumer-secret-adapter.py | T28 | d046eed63090d4e0849a931e2650ccfd89d3b686843aed9e5cb35a0e18e513ee |
| handover-adapter.py | T29 | 0efc300a7b2765bce8da140d5c4666d9cb30daf02b4cbf0e0df96cba7c33d026 |
| compose-1.2-descriptors.py | T30 | 4316f23cfdb312212aa688006c1169f29ff27eb4fbd1eba9368cce7cb0095ce8 |
| descriptor-composition-1.2.candidate.json | T30 | 1f5bf6d10ca3bbf8e06d3a755ecafeb47179327715d7b1d096e0685d167aa471 |
The tests and `.md` contract notes next to each adapter are in scope as evidence,
not as review targets. The Warden kernel they run against is ops-warden `a45cf47`
(`src/warden/case_run.py`), which needs its own review and is out of scope here.
The authors report 98 tests passing:
```bash
cd ~/net-kingdom/sso-mfa/k8s/keycape
PYTHONPATH=$HOME/ops-warden/src ~/ops-warden/.venv/bin/python -m pytest -q \
test_*adapter*.py test_registration_original_intent_reconcile.py test_compose_1_2_descriptors.py
```
Reproduce this yourself at the frozen commit. Don't take it on trust.
## What to check (from the T13 precedent and the NK-WP-0048 task texts)
1. Each descriptor binds the exact source it runs (source digest covers every file
the step executes), and any drift is refused before tooling.
2. Value-free: no secret, token or credential value can enter a receipt, evidence
record or log. Closed receipt schemas refuse extra fields.
3. Created-only rollback: only objects this process created, with owner-authenticated
evidence, can be removed. Pre-existing objects give NO_CHANGE and are never removed.
4. Parent-session revocation runs on every attempt, including failures.
5. Pins (case, descriptor, acceptance), the admitted invocation and attempt binding
are checked. Wrong lane, owner or target refuses.
6. Version selection: canonical 1.1 stays the default. 1.2 is reachable only by an
explicit version root, and there is no `--allow-unimplemented` path.
7. T15 reconcile (registration adapter): original intent stays separate from the
reconcile attempt, nothing is replayed, rollback after a restart is refused,
and missing, ambiguous or changed state stays uncertain.
8. The composer refuses partial, duplicate, unknown and mismatched maps, and the
committed artifact equals a fresh regeneration.
Known, recorded limits (confirm or reject; these are not defects to fix here):
bind-env has no kernel-level fixture tests like T13's; ensure-groups carries its
own copy of the provisioner's group binding, checked by a parity test; all owner
capabilities (custody, ESO, holder, consumer verifier) are injected stand-ins.
## Founder decisions already made (2026-10-17)
- The mint-secret actor is `agent`, and the Warden kernel is unchanged.
- The lane and schema names for T25–T29 are confirmed as-is. They appear as
`names_confirmed` in the artifact.
## Expected output
Write `coordinator-review-r1.json` in this directory, shaped like T13's
`coordinator-review-r3.json`: schema, revision, the frozen commit and the hashes
above, a per-adapter verdict (approved / rejected with finding), an independent
reconstruction count, `native_acceptance: false` and what remains. If anything is
rejected, record it and stop. Defects are fixed in net-kingdom as a new revision
and reviewed as r2, never edited during review.
Hard limits: no live or native action, no kubectl, SSH or secret access, and no
edits to net-kingdom or ops-warden. This review grants no owner admission, pin or
native authority. Those stay with NK-WP-0048-T16 and the founder.