diff --git a/.kaizen/agents/custodian-codex/supervision.json b/.kaizen/agents/custodian-codex/supervision.json index 614e39e6..ebe2fb35 100644 --- a/.kaizen/agents/custodian-codex/supervision.json +++ b/.kaizen/agents/custodian-codex/supervision.json @@ -1068,7 +1068,12 @@ "execution_started_at": "2026-10-18T14:46:47.932140+00:00", "partial_verified_outcome": "Native exact stage and activation verified;166 scanner fragments,1328 protected hooks,old/new startup guard,inheritance,quarantine,unavailable/clean recovery and cleanup. Apps source2fdc198b published. Ordinary Custodian publication/readback pending.", "verified_outcome": "Exact admitted native activation plus ordinary publication of five queued Custodian commits through c1fcd948; all40 task UUID/status bindings match. Native166/1328 checks,inherited template,clean/blocked/unavailable/quarantine/cleanup proofs all verified; Apps2fdc198b declared/published. No rollback needed.", - "execution_finished_at": "2026-10-18T15:50:46.117328+00:00" + "execution_finished_at": "2026-10-18T15:50:46.117328+00:00", + "original_digest": "90bb3a1a35729396b02a377d8db62e1d1f8f38d8e24e601dbc3d4446cffd05e8", + "approved_digest": "90bb3a1a35729396b02a377d8db62e1d1f8f38d8e24e601dbc3d4446cffd05e8", + "executed_digest": "90bb3a1a35729396b02a377d8db62e1d1f8f38d8e24e601dbc3d4446cffd05e8", + "refinement_or_rescue": false, + "reporting_note": "Compatibility aliases for the existing summarizer; values copied exactly from original retained *_digest_sha256 fields and receipts. No new approval, trial, execution or authority." } ], "trials": [ diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/README.md b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/README.md new file mode 100644 index 00000000..234b529f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/README.md @@ -0,0 +1,81 @@ +# Working development delivery — 18 October 2026 + +The human and coding-agent Playwright trials both passed against the existing +managed provider on railiance01. Each completed 14 steps at 1280×800 and 390×844, +including Tab focus, Enter activation, counter assertion and screenshot download. +The founder actually ran the human command and supplied its passed output; the +local receipt agrees. These are actual browser runs against the provider's +synthetic fixture, not general application coverage. + +| Consumer | Run | Result | Receipt | +| --- | --- | --- | --- | +| Human | d81a5166-83d9-4382-a6e8-a90cfc3f0a51 | passed | [Human receipt](playwright-human/receipt.json) | +| Coding agent | 893a8bcb-9b7f-48f1-8a51-c116de3f3097 | passed | [Agent receipt](playwright-agent/receipt.json) | + +The provider client, job protocol, image and deployment already existed. We used +them directly. The immediate obstacle was an absent local connection, restored +with the documented port-forward. No new browser client, gateway or cluster +configuration was needed. Profile details and client source hash are in +[playwright-profile.json](playwright-profile.json). + +## Repeat the working commands + +From this workstation, establish the existing authenticated cluster connection +if needed, then leave this command running in one terminal: + +```sh +kubectl -n playwright port-forward deployment/playwright 18081:8080 --address 127.0.0.1 +``` + +The connection established for these trials is currently open. Do not start a +second listener on the same port. In another terminal: + +```sh +python3 /home/worsch/rapp-playwright/client/rapp_playwright.py preflight +python3 /home/worsch/rapp-playwright/client/rapp_playwright.py trial --out /tmp/my-new-playwright-trial +``` + +Use a new output directory for each trial. Python 3.10+ is sufficient; consumers +need no local browser installation. Expected output is `status: passed`, a receipt +path and screenshot hashes. `service_unreachable` means restore the connection; +an existing output directory means choose a new one. Stop the connection with +Ctrl-C when finished. Downloads stay in the output directory. The private +`run.json` contains a run capability: keep it private and out of Git and chat. + +Canonical client and contract: +[rapp-playwright client](/home/worsch/rapp-playwright/client/rapp_playwright.py), +[consumer contract](/home/worsch/rapp-playwright/docs/consumer-contract.md), +[provider operations](/home/worsch/rapp-playwright/docs/operations.md). +Reuse discovery stays in the existing `capability.infotech.headless-browser` +record; this packet is a delivery receipt, not another capability registry. +The fixture needs no new target grant. Existing application target restrictions +remain; changing targets is separate work. + +## Exact scope and next work + +This is the **supervised build profile** through an existing authenticated +workstation connection. It proves supported-command browser use for the actual +human and coding agent. It does not prove distinct human/agent Kubernetes +identities, agent credential isolation, JWT integration or full revocation. +Those original criteria remain in CUST-WP-0082-T21 and the existing owner plans. +No kubeconfig or credential was copied or distributed. + +The founder's [actual direction](founder-decision.json) changes sequencing: +Playwright first, everyday Forgejo next, later security hardening. The +[WP-80 overview](../../../../workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md) +shows delivered and remaining milestones. [WP-82](../../../../workplans/CUST-WP-0082-netkingdom-security-hardening.md) +retains 25 hardening acceptance checkpoints, with the existing implementation +owners. [hardening-handoff.json](hardening-handoff.json) preserves every original +task binding and all 116 requirement IDs; [workplan-before.txt](workplan-before.txt) +preserves the previous contract. Deferred tasks are not counted as completed. + +The unfinished deeper identity-client draft is explicitly set aside in +[deferred-draft.json](deferred-draft.json). It is uncompiled and untested, and is +not an accepted source candidate or deployed fix. The full security target is +unchanged. Close-down checklist row 25 records the deferred acceptance. + +Next: verify the deployed Forgejo release and supported positive sign-in/Git/API +flow before deciding whether a source change or rollout is needed. Publish its +working owner commands and bounded measurements, then audit both functional +milestones and the live hardening handoff. Source files remain authoritative; +normal consistency/publication and exact Hub readback must verify this revision. diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/deferred-draft.json b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/deferred-draft.json new file mode 100644 index 00000000..2de08073 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/deferred-draft.json @@ -0,0 +1,7 @@ +{ + "source_owner": "key-cape", + "source_base": "e2c5a947829568baf837543a6708fd0c3f6a863b", + "status": "unfinished/uncompiled/untested; not an accepted source candidate", + "reason": "Set aside under actual founder good-case-first direction; no canonical owner source or native changes", + "patch_sha256": "sha256:af75daabeace07607d9f18e01a074568a434e12ea2dab4ae3c06d68db6535f1e" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/deferred-userinfo-draft.patch b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/deferred-userinfo-draft.patch new file mode 100644 index 00000000..b395df7f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/deferred-userinfo-draft.patch @@ -0,0 +1,152 @@ +--- a/src/internal/authclient/online.go ++++ b/src/internal/authclient/online.go +@@ -22,6 +22,7 @@ + "strings" + "syscall" + "time" ++ "unicode/utf8" + + "keycape/internal/jose" + ) +@@ -64,6 +65,15 @@ + claims map[string]interface{} + } + ++// CurrentUserInfo joins current directory facts to the independently verified ++// access grant. Groups are observations, never a permission or policy verdict. ++// Missing groups remain distinct from an explicitly empty membership set. ++type CurrentUserInfo struct { ++ Token CurrentToken ++ Groups []string ++ GroupsPresent bool ++} ++ + // Claims returns a separate copy of the verified signed facts. Authentication + // assurance/age, tenant provenance, current groups and resource/effect policy + // remain the consumer's existing profile obligations, not a new client policy. +@@ -274,14 +284,11 @@ + if c == nil || ctx == nil || ctx.Err() != nil || len(raw) == 0 || len(raw) > 32768 || (endpoint != "/introspect" && endpoint != "/revoke") { + return out, ErrOnlineToken + } +- ca, err := readOnlineFile(c.admission.CAFile, false) +- if err != nil { +- return out, ErrOnlineToken +- } +- roots := x509.NewCertPool() +- if !roots.AppendCertsFromPEM(ca) { +- return out, ErrOnlineToken +- } ++ client, transport, err := c.httpClient() ++ if err != nil { ++ return out, ErrOnlineToken ++ } ++ defer transport.CloseIdleConnections() + secretRaw, err := readOnlineFile(c.admission.SecretFile, true) + if err != nil { + return out, ErrOnlineToken +@@ -298,9 +305,6 @@ + req.Header.Set("Content-Type", "application/x-www-form-urlencoded") + req.Header.Set("Cache-Control", "no-cache") + req.SetBasicAuth(url.QueryEscape(c.admission.ClientID), url.QueryEscape(secret)) +- transport := &http.Transport{Proxy: nil, TLSClientConfig: &tls.Config{RootCAs: roots, MinVersion: tls.VersionTLS12}, DisableKeepAlives: true, DialContext: c.dialContext} +- defer transport.CloseIdleConnections() +- client := &http.Client{Transport: transport, Timeout: 5 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return ErrOnlineToken }} + response, err := client.Do(req) + if err != nil { + return out, ErrOnlineToken +@@ -324,6 +328,95 @@ + return out, ErrOnlineToken + } + return decodeOnlineStatus(body) ++} ++ ++// One transport profile serves status, cleanup and UserInfo. Every operation ++// rereads admitted CA material; proxies, redirects and retained connections ++// cannot introduce another bearer or confidential-client delivery path. ++func (c *OnlineClient) httpClient() (*http.Client, *http.Transport, error) { ++ if c == nil { ++ return nil, nil, ErrOnlineToken ++ } ++ ca, err := readOnlineFile(c.admission.CAFile, false) ++ if err != nil { ++ return nil, nil, ErrOnlineToken ++ } ++ roots := x509.NewCertPool() ++ if !roots.AppendCertsFromPEM(ca) { ++ return nil, nil, ErrOnlineToken ++ } ++ transport := &http.Transport{Proxy: nil, TLSClientConfig: &tls.Config{RootCAs: roots, MinVersion: tls.VersionTLS12}, DisableKeepAlives: true, DialContext: c.dialContext} ++ return &http.Client{Transport: transport, Timeout: 5 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return ErrOnlineToken }}, transport, nil ++} ++ ++type userInfoWire struct { ++ Subject string `json:"sub"` ++ PreferredUsername string `json:"preferred_username"` ++ Name string `json:"name"` ++ Email string `json:"email"` ++ Groups *[]string `json:"groups"` ++} ++ ++// UserInfo observes the current canonical subject and directory groups through ++// the admitted issuer, never discovery-supplied endpoints or token URL claims. ++// Signed grant/trust, owning client and issuer status are checked before bearer ++// delivery and again after the directory response. Nothing positive is cached. ++// Consumers still bind ID-token assurance, local account/source and exact effect ++// policy; the returned groups cannot authorize a later operation by themselves. ++func (c *OnlineClient) UserInfo(ctx context.Context, raw string, expected ExpectedIdentity) (CurrentUserInfo, error) { ++ var refused CurrentUserInfo ++ before, err := c.Check(ctx, raw, expected) ++ if err != nil { ++ return refused, ErrOnlineToken ++ } ++ client, transport, err := c.httpClient() ++ if err != nil { ++ return refused, ErrOnlineToken ++ } ++ defer transport.CloseIdleConnections() ++ req, err := http.NewRequestWithContext(ctx, http.MethodGet, c.admission.Issuer+"/userinfo", nil) ++ if err != nil { ++ return refused, ErrOnlineToken ++ } ++ req.Header.Set("Authorization", "Bearer "+raw) ++ req.Header.Set("Cache-Control", "no-cache") ++ response, err := client.Do(req) ++ if err != nil { ++ return refused, ErrOnlineToken ++ } ++ defer response.Body.Close() ++ media, _, mediaErr := mime.ParseMediaType(response.Header.Get("Content-Type")) ++ if response.StatusCode != http.StatusOK || response.Header.Get("Cache-Control") != "no-store" || mediaErr != nil || media != "application/json" { ++ return refused, ErrOnlineToken ++ } ++ body, err := io.ReadAll(io.LimitReader(response.Body, 65537)) ++ if err != nil || len(body) > 65536 || !utf8.Valid(body) { ++ return refused, ErrOnlineToken ++ } ++ var wire userInfoWire ++ seen, err := decodeOnlineObject(body, &wire) ++ if err != nil || !seen["sub"] || wire.Subject != before.Subject { ++ return refused, ErrOnlineToken ++ } ++ if wire.Groups != nil { ++ if len(*wire.Groups) > 1024 { ++ return refused, ErrOnlineToken ++ } ++ for _, group := range *wire.Groups { ++ if group == "" { ++ return refused, ErrOnlineToken ++ } ++ } ++ } ++ after, err := c.Check(ctx, raw, expected) ++ if err != nil || after.TokenDigest != before.TokenDigest || after.TokenID != before.TokenID { ++ return refused, ErrOnlineToken ++ } ++ out := CurrentUserInfo{Token: after, GroupsPresent: wire.Groups != nil} ++ if wire.Groups != nil { ++ out.Groups = append([]string{}, (*wire.Groups)...) ++ } ++ return out, nil + } + + // Check verifies expected identity before accessing the private client credential, diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/founder-decision.json b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/founder-decision.json new file mode 100644 index 00000000..f09dcb32 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/founder-decision.json @@ -0,0 +1,8 @@ +{ + "id": "9663d4ca-3793-4ad7-9dc1-954001d43596", + "status": "resolved", + "decided_by": "Bernd Worsch", + "direction": "Record actual founder direction18October2026: security findings may be deferred to a later hardening workplan to restore efficient development and focus on the working good case. The founder selected Playwright access for a human and coding agent using supported commands as first priority; Forgejo remains the next functional milestone. CUST-WP-0082 will retain full security acceptance, owners, original checkpoints and requirement mappings. Existing implementation owners remain canonical; no parallel auth/PDP/client is created.", + "actual_quote": "Actual founder wording: It is ok to defer security fixes to a hardening workplan, that we follow up on later, if that helps to keep progress on the good case in focus. Actual priority reply: Playwright access for a human and coding agent, using supported commands (Recommended). This approves sequencing and explicit deferrals, not a security-conformance claim or a new native change/credential grant. Build-profile transport and authentication used in functional receipts must be stated truthfully; stronger per-caller isolation/revocation/negative matrices and final16-gate/116-requirement acceptance remain in the hardening follow-up. Security work that actually blocks the selected working flow may be promoted narrowly; no need to complete the entire security architecture first.", + "native_authority_granted": false +} diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/hardening-handoff.json b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/hardening-handoff.json new file mode 100644 index 00000000..89174f7e --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/hardening-handoff.json @@ -0,0 +1,2536 @@ +{ + "decision_id": "9663d4ca-3793-4ad7-9dc1-954001d43596", + "source_snapshot": "workplan-before.txt", + "hardening_workplan": "CUST-WP-0082", + "full_task_transfers": 19, + "additional_security_scopes": 6, + "original_bindings": [ + { + "original_task": "CUST-WP-0080-T01", + "original_hub_task_id": "c770f7e1-25eb-53ec-9a37-1f7794077ff8", + "disposition": "retained", + "hardening_checkpoint": null + }, + { + "original_task": "CUST-WP-0080-T02", + "original_hub_task_id": "5973026f-8ca9-5882-99fe-65a54bc250ac", + "disposition": "retained", + "hardening_checkpoint": null + }, + { + "original_task": "CUST-WP-0080-T03", + "original_hub_task_id": "87637402-02f1-57c1-8fbc-4141598af8e3", + "disposition": "retained", + "hardening_checkpoint": null + }, + { + "original_task": "CUST-WP-0080-T04", + "original_hub_task_id": "82378b0f-7004-5c2f-9683-b356a1227576", + "disposition": "functional_scope_with_remaining_security_transferred", + "hardening_checkpoint": "CUST-WP-0082-T25" + }, + { + "original_task": "CUST-WP-0080-T05", + "original_hub_task_id": "ed8b909a-23bf-5e5f-b600-e477fbae136b", + "disposition": "retained", + "hardening_checkpoint": null + }, + { + "original_task": "CUST-WP-0080-T06", + "original_hub_task_id": "6aca534c-5c7a-556f-b6b6-406433670c29", + "disposition": "retained", + "hardening_checkpoint": null + }, + { + "original_task": "CUST-WP-0080-T07", + "original_hub_task_id": "bb236dea-30f7-5437-b01c-f14d2509e061", + "disposition": "retained", + "hardening_checkpoint": null + }, + { + "original_task": "CUST-WP-0080-T08", + "original_hub_task_id": "18b885fe-503f-5ebc-b390-808f71316264", + "disposition": "retained", + "hardening_checkpoint": null + }, + { + "original_task": "CUST-WP-0080-T09", + "original_hub_task_id": "a1f2dbe0-13d4-57a2-a2b5-c0137cd48410", + "disposition": "retained", + "hardening_checkpoint": null + }, + { + "original_task": "CUST-WP-0080-T10", + "original_hub_task_id": "1f3c78af-5686-58ea-9133-8afc2df36b8f", + "disposition": "retained", + "hardening_checkpoint": null + }, + { + "original_task": "CUST-WP-0080-T11", + "original_hub_task_id": "bffd4e10-2cf0-5835-a8d0-ae1763ca3873", + "disposition": "retained", + "hardening_checkpoint": null + }, + { + "original_task": "CUST-WP-0080-T12", + "original_hub_task_id": "bb09e414-6d79-5dcd-b8e6-b73a046a4dda", + "disposition": "retained", + "hardening_checkpoint": null + }, + { + "original_task": "CUST-WP-0080-T13", + "original_hub_task_id": "793e78f0-7782-5e48-bdc0-b65127b32ecb", + "disposition": "retained", + "hardening_checkpoint": null + }, + { + "original_task": "CUST-WP-0080-T14", + "original_hub_task_id": "7ecbd622-03a8-5b49-9621-8d21d7d15890", + "disposition": "transferred_not_implemented", + "hardening_checkpoint": "CUST-WP-0082-T01" + }, + { + "original_task": "CUST-WP-0080-T15", + "original_hub_task_id": "434d9c78-7789-5b78-8d9d-d87b0638b469", + "disposition": "transferred_not_implemented", + "hardening_checkpoint": "CUST-WP-0082-T02" + }, + { + "original_task": "CUST-WP-0080-T16", + "original_hub_task_id": "e6183073-cc8e-5c6f-8fbd-db50bb1a466c", + "disposition": "transferred_not_implemented", + "hardening_checkpoint": "CUST-WP-0082-T03" + }, + { + "original_task": "CUST-WP-0080-T17", + "original_hub_task_id": "4de46468-7ae2-59e3-be2b-1a32506153a5", + "disposition": "transferred_not_implemented", + "hardening_checkpoint": "CUST-WP-0082-T04" + }, + { + "original_task": "CUST-WP-0080-T18", + "original_hub_task_id": "fd796e9c-dd70-5c65-a6fe-eafe3911bc8f", + "disposition": "transferred_not_implemented", + "hardening_checkpoint": "CUST-WP-0082-T05" + }, + { + "original_task": "CUST-WP-0080-T19", + "original_hub_task_id": "4ffd2e33-d887-5686-bad1-7f32a56191a8", + "disposition": "functional_scope_with_remaining_security_transferred", + "hardening_checkpoint": "CUST-WP-0082-T20" + }, + { + "original_task": "CUST-WP-0080-T20", + "original_hub_task_id": "0d9df435-b9a2-5b89-833d-799785c969a9", + "disposition": "retained", + "hardening_checkpoint": null + }, + { + "original_task": "CUST-WP-0080-T21", + "original_hub_task_id": "fa11a2a4-4dbd-5dfb-ad29-bc7a99cc6258", + "disposition": "transferred_not_implemented", + "hardening_checkpoint": "CUST-WP-0082-T06" + }, + { + "original_task": "CUST-WP-0080-T22", + "original_hub_task_id": "88588db8-8c6e-5d15-a85b-2c068f4e8a2a", + "disposition": "transferred_not_implemented", + "hardening_checkpoint": "CUST-WP-0082-T07" + }, + { + "original_task": "CUST-WP-0080-T23", + "original_hub_task_id": "266e228b-7754-5323-b0c6-37f860592d90", + "disposition": "functional_scope_with_remaining_security_transferred", + "hardening_checkpoint": "CUST-WP-0082-T20" + }, + { + "original_task": "CUST-WP-0080-T24", + "original_hub_task_id": "a4f06ce0-69a5-5cbb-9d78-6c5b89ba9853", + "disposition": "transferred_not_implemented", + "hardening_checkpoint": "CUST-WP-0082-T08" + }, + { + "original_task": "CUST-WP-0080-T25", + "original_hub_task_id": "3be1c76d-a5f3-5dea-9777-349dc97e836e", + "disposition": "functional_scope_with_remaining_security_transferred", + "hardening_checkpoint": "CUST-WP-0082-T21" + }, + { + "original_task": "CUST-WP-0080-T26", + "original_hub_task_id": "0491b6b4-a238-58ef-bf3a-505749e5655c", + "disposition": "functional_scope_with_remaining_security_transferred", + "hardening_checkpoint": "CUST-WP-0082-T21" + }, + { + "original_task": "CUST-WP-0080-T27", + "original_hub_task_id": "19540d29-c4df-5f1a-acf7-127965c9a396", + "disposition": "transferred_not_implemented", + "hardening_checkpoint": "CUST-WP-0082-T09" + }, + { + "original_task": "CUST-WP-0080-T28", + "original_hub_task_id": "5ac99f55-0dde-5d1c-b88c-b85f34469abc", + "disposition": "transferred_not_implemented", + "hardening_checkpoint": "CUST-WP-0082-T10" + }, + { + "original_task": "CUST-WP-0080-T29", + "original_hub_task_id": "3ec89fb2-fe97-50f5-a3c9-88b731b0d2ec", + "disposition": "transferred_not_implemented", + "hardening_checkpoint": "CUST-WP-0082-T11" + }, + { + "original_task": "CUST-WP-0080-T30", + "original_hub_task_id": "457400ad-6c44-5160-a77a-63c6ad5acabc", + "disposition": "transferred_not_implemented", + "hardening_checkpoint": "CUST-WP-0082-T12" + }, + { + "original_task": "CUST-WP-0080-T31", + "original_hub_task_id": "cbf32375-279a-5bf3-b867-06333a1ff2ca", + "disposition": "transferred_not_implemented", + "hardening_checkpoint": "CUST-WP-0082-T13" + }, + { + "original_task": "CUST-WP-0080-T32", + "original_hub_task_id": "5a0cb7f7-1cd8-50ba-8af2-a2b13ed34a18", + "disposition": "transferred_not_implemented", + "hardening_checkpoint": "CUST-WP-0082-T14" + }, + { + "original_task": "CUST-WP-0080-T33", + "original_hub_task_id": "4547ac4c-8893-54fe-ae6e-362682bb7920", + "disposition": "functional_scope_with_remaining_security_transferred", + "hardening_checkpoint": "CUST-WP-0082-T22" + }, + { + "original_task": "CUST-WP-0080-T34", + "original_hub_task_id": "393b9fcc-323b-5182-92c6-44530fce7efb", + "disposition": "transferred_not_implemented", + "hardening_checkpoint": "CUST-WP-0082-T15" + }, + { + "original_task": "CUST-WP-0080-T35", + "original_hub_task_id": "db274192-07d6-5be7-9c1e-d63c5a9fb57f", + "disposition": "transferred_not_implemented", + "hardening_checkpoint": "CUST-WP-0082-T16" + }, + { + "original_task": "CUST-WP-0080-T36", + "original_hub_task_id": "586232a1-57b0-5e04-a61b-fb687bcc8999", + "disposition": "transferred_not_implemented", + "hardening_checkpoint": "CUST-WP-0082-T17" + }, + { + "original_task": "CUST-WP-0080-T37", + "original_hub_task_id": "d533ca34-a691-5f8e-8cc2-5f408b679538", + "disposition": "functional_scope_with_remaining_security_transferred", + "hardening_checkpoint": "CUST-WP-0082-T23" + }, + { + "original_task": "CUST-WP-0080-T38", + "original_hub_task_id": "2350a829-bd8c-5c3b-9f39-07bfa1c3f228", + "disposition": "functional_scope_with_remaining_security_transferred", + "hardening_checkpoint": "CUST-WP-0082-T24" + }, + { + "original_task": "CUST-WP-0080-T39", + "original_hub_task_id": "da6ae9a3-9107-5ca7-adb2-c9d85b3c529c", + "disposition": "transferred_not_implemented", + "hardening_checkpoint": "CUST-WP-0082-T18" + }, + { + "original_task": "CUST-WP-0080-T40", + "original_hub_task_id": "8e71f6f0-9fc3-509b-8f1b-768f7d9cbd0e", + "disposition": "transferred_not_implemented", + "hardening_checkpoint": "CUST-WP-0082-T19" + } + ], + "ledger_sha256": "ad81f7186ada04aa1cc410932fc8669d69dc2232f3c0be00657b17f3aa3a8184", + "requirements": [ + { + "requirement_id": "DSM-TRANS-001", + "original_status": "unverified", + "gap_refs": [ + "G03", + "G04", + "G10", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T24" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-TRANS-002", + "original_status": "incomplete", + "gap_refs": [ + "G03", + "G04", + "G10", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T24" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-TRANS-003", + "original_status": "unverified", + "gap_refs": [ + "G03", + "G04", + "G10", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T24" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-TRANS-004", + "original_status": "unverified", + "gap_refs": [ + "G03", + "G04", + "G10", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T24" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-TRANS-005", + "original_status": "unverified", + "gap_refs": [ + "G03", + "G04", + "G10", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T24" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-TRANS-006", + "original_status": "unverified", + "gap_refs": [ + "G03", + "G04", + "G10", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T24" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-ARCH-001", + "original_status": "unverified", + "gap_refs": [ + "G03", + "G04", + "G10", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T24" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-ARCH-002", + "original_status": "unverified", + "gap_refs": [ + "G03", + "G04", + "G10", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T24" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-ARCH-003", + "original_status": "unverified", + "gap_refs": [ + "G03", + "G04", + "G10", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T24" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-ARCH-004", + "original_status": "unverified", + "gap_refs": [ + "G03", + "G04", + "G10", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T24" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-ARCH-005", + "original_status": "unverified", + "gap_refs": [ + "G03", + "G04", + "G10", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T24" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-DX-001", + "original_status": "unverified", + "gap_refs": [ + "G01", + "G02", + "G05", + "G08" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T01", + "CUST-WP-0082-T02", + "CUST-WP-0082-T03", + "CUST-WP-0082-T04", + "CUST-WP-0082-T05", + "CUST-WP-0082-T08", + "CUST-WP-0082-T09", + "CUST-WP-0082-T11", + "CUST-WP-0082-T13", + "CUST-WP-0082-T20" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-DX-002", + "original_status": "unverified", + "gap_refs": [ + "G01", + "G02", + "G05", + "G08" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T01", + "CUST-WP-0082-T02", + "CUST-WP-0082-T03", + "CUST-WP-0082-T04", + "CUST-WP-0082-T05", + "CUST-WP-0082-T08", + "CUST-WP-0082-T09", + "CUST-WP-0082-T11", + "CUST-WP-0082-T13", + "CUST-WP-0082-T20" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-DX-003", + "original_status": "unverified", + "gap_refs": [ + "G01", + "G02", + "G05", + "G08" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T01", + "CUST-WP-0082-T02", + "CUST-WP-0082-T03", + "CUST-WP-0082-T04", + "CUST-WP-0082-T05", + "CUST-WP-0082-T08", + "CUST-WP-0082-T09", + "CUST-WP-0082-T11", + "CUST-WP-0082-T13", + "CUST-WP-0082-T20" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-DX-004", + "original_status": "unverified", + "gap_refs": [ + "G01", + "G02", + "G05", + "G08" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T01", + "CUST-WP-0082-T02", + "CUST-WP-0082-T03", + "CUST-WP-0082-T04", + "CUST-WP-0082-T05", + "CUST-WP-0082-T08", + "CUST-WP-0082-T09", + "CUST-WP-0082-T11", + "CUST-WP-0082-T13", + "CUST-WP-0082-T20" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-DX-005", + "original_status": "unverified", + "gap_refs": [ + "G01", + "G02", + "G05", + "G08" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T01", + "CUST-WP-0082-T02", + "CUST-WP-0082-T03", + "CUST-WP-0082-T04", + "CUST-WP-0082-T05", + "CUST-WP-0082-T08", + "CUST-WP-0082-T09", + "CUST-WP-0082-T11", + "CUST-WP-0082-T13", + "CUST-WP-0082-T20" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-DX-006", + "original_status": "unverified", + "gap_refs": [ + "G01", + "G02", + "G05", + "G08" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T01", + "CUST-WP-0082-T02", + "CUST-WP-0082-T03", + "CUST-WP-0082-T04", + "CUST-WP-0082-T05", + "CUST-WP-0082-T08", + "CUST-WP-0082-T09", + "CUST-WP-0082-T11", + "CUST-WP-0082-T13", + "CUST-WP-0082-T20" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-ID-001", + "original_status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G05", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T01", + "CUST-WP-0082-T02", + "CUST-WP-0082-T03", + "CUST-WP-0082-T04", + "CUST-WP-0082-T05", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T20" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-ID-002", + "original_status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G05", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T01", + "CUST-WP-0082-T02", + "CUST-WP-0082-T03", + "CUST-WP-0082-T04", + "CUST-WP-0082-T05", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T20" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-ID-003", + "original_status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G05", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T01", + "CUST-WP-0082-T02", + "CUST-WP-0082-T03", + "CUST-WP-0082-T04", + "CUST-WP-0082-T05", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T20" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-ID-004", + "original_status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G05", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T01", + "CUST-WP-0082-T02", + "CUST-WP-0082-T03", + "CUST-WP-0082-T04", + "CUST-WP-0082-T05", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T20" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-AUTH-001", + "original_status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G05", + "G12", + "G13" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T01", + "CUST-WP-0082-T02", + "CUST-WP-0082-T03", + "CUST-WP-0082-T04", + "CUST-WP-0082-T05", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T20" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-AUTH-002", + "original_status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G05", + "G12", + "G13" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T01", + "CUST-WP-0082-T02", + "CUST-WP-0082-T03", + "CUST-WP-0082-T04", + "CUST-WP-0082-T05", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T20" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-AUTH-003", + "original_status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G05", + "G12", + "G13" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T01", + "CUST-WP-0082-T02", + "CUST-WP-0082-T03", + "CUST-WP-0082-T04", + "CUST-WP-0082-T05", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T20" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-AUTH-004", + "original_status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G05", + "G12", + "G13" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T01", + "CUST-WP-0082-T02", + "CUST-WP-0082-T03", + "CUST-WP-0082-T04", + "CUST-WP-0082-T05", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T20" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-ISSUE-001", + "original_status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G05" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T01", + "CUST-WP-0082-T02", + "CUST-WP-0082-T03", + "CUST-WP-0082-T04", + "CUST-WP-0082-T05", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T20" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-ISSUE-002", + "original_status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G05" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T01", + "CUST-WP-0082-T02", + "CUST-WP-0082-T03", + "CUST-WP-0082-T04", + "CUST-WP-0082-T05", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T20" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-ISSUE-003", + "original_status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G05" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T01", + "CUST-WP-0082-T02", + "CUST-WP-0082-T03", + "CUST-WP-0082-T04", + "CUST-WP-0082-T05", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T20" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-ISSUE-004", + "original_status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G05" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T01", + "CUST-WP-0082-T02", + "CUST-WP-0082-T03", + "CUST-WP-0082-T04", + "CUST-WP-0082-T05", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T20" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-STORE-001", + "original_status": "unverified", + "gap_refs": [ + "G04", + "G08", + "G11", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T13" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-STORE-002", + "original_status": "incomplete", + "gap_refs": [ + "G04", + "G08", + "G11", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T13" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-STORE-003", + "original_status": "unverified", + "gap_refs": [ + "G04", + "G08", + "G11", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T13" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-STORE-004", + "original_status": "unverified", + "gap_refs": [ + "G04", + "G08", + "G11", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T13" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-STORE-005", + "original_status": "incomplete", + "gap_refs": [ + "G04", + "G08", + "G11", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T13" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-DELIV-001", + "original_status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T01", + "CUST-WP-0082-T02", + "CUST-WP-0082-T03", + "CUST-WP-0082-T04", + "CUST-WP-0082-T05", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T20" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-DELIV-002", + "original_status": "incomplete", + "gap_refs": [ + "G02", + "G03", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T01", + "CUST-WP-0082-T02", + "CUST-WP-0082-T03", + "CUST-WP-0082-T04", + "CUST-WP-0082-T05", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T20" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-DELIV-003", + "original_status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T01", + "CUST-WP-0082-T02", + "CUST-WP-0082-T03", + "CUST-WP-0082-T04", + "CUST-WP-0082-T05", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T20" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-DELIV-004", + "original_status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T01", + "CUST-WP-0082-T02", + "CUST-WP-0082-T03", + "CUST-WP-0082-T04", + "CUST-WP-0082-T05", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T20" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-DELIV-005", + "original_status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T01", + "CUST-WP-0082-T02", + "CUST-WP-0082-T03", + "CUST-WP-0082-T04", + "CUST-WP-0082-T05", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T20" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-ROT-001", + "original_status": "unverified", + "gap_refs": [ + "G04", + "G09" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T24" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-ROT-002", + "original_status": "unverified", + "gap_refs": [ + "G04", + "G09" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T24" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-ROT-003", + "original_status": "incomplete", + "gap_refs": [ + "G04", + "G09" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T24" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-ROT-004", + "original_status": "unverified", + "gap_refs": [ + "G04", + "G09" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T24" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-ROT-005", + "original_status": "unverified", + "gap_refs": [ + "G04", + "G09" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T24" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-REV-001", + "original_status": "unverified", + "gap_refs": [ + "G04", + "G09" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T24" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-REV-002", + "original_status": "unverified", + "gap_refs": [ + "G04", + "G09" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T24" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-REV-003", + "original_status": "unverified", + "gap_refs": [ + "G04", + "G09" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T24" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-REV-004", + "original_status": "unverified", + "gap_refs": [ + "G04", + "G09" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T24" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-DETECT-001", + "original_status": "incomplete", + "gap_refs": [ + "G07" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T10", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-DETECT-002", + "original_status": "incomplete", + "gap_refs": [ + "G07" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T10", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-DETECT-003", + "original_status": "incomplete", + "gap_refs": [ + "G07" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T10", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-DETECT-004", + "original_status": "incomplete", + "gap_refs": [ + "G07" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T10", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-CI-001", + "original_status": "unverified", + "gap_refs": [ + "G07", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-CI-002", + "original_status": "unverified", + "gap_refs": [ + "G07", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-CI-003", + "original_status": "unverified", + "gap_refs": [ + "G07", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-CI-004", + "original_status": "unverified", + "gap_refs": [ + "G07", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-CI-005", + "original_status": "unverified", + "gap_refs": [ + "G07", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-KEY-001", + "original_status": "unverified", + "gap_refs": [ + "G08", + "G11", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T13" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-KEY-002", + "original_status": "unverified", + "gap_refs": [ + "G08", + "G11", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T13" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-KEY-003", + "original_status": "unverified", + "gap_refs": [ + "G08", + "G11", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T13" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-KEY-004", + "original_status": "unverified", + "gap_refs": [ + "G08", + "G11", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T13" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-KEY-005", + "original_status": "unverified", + "gap_refs": [ + "G08", + "G11", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T13" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-HUM-001", + "original_status": "unverified", + "gap_refs": [ + "G01", + "G03", + "G08", + "G11" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T08", + "CUST-WP-0082-T11", + "CUST-WP-0082-T13" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-HUM-002", + "original_status": "incomplete", + "gap_refs": [ + "G01", + "G03", + "G08", + "G11" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T08", + "CUST-WP-0082-T11", + "CUST-WP-0082-T13" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-HUM-003", + "original_status": "unverified", + "gap_refs": [ + "G01", + "G03", + "G08", + "G11" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T08", + "CUST-WP-0082-T11", + "CUST-WP-0082-T13" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-AGENT-001", + "original_status": "unverified", + "gap_refs": [ + "G03", + "G05" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-AGENT-002", + "original_status": "unverified", + "gap_refs": [ + "G03", + "G05" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-AGENT-003", + "original_status": "unverified", + "gap_refs": [ + "G03", + "G05" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-AGENT-004", + "original_status": "unverified", + "gap_refs": [ + "G03", + "G05" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-AGENT-005", + "original_status": "unverified", + "gap_refs": [ + "G03", + "G05" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-AGENT-006", + "original_status": "unverified", + "gap_refs": [ + "G03", + "G05" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-AGENT-007", + "original_status": "unverified", + "gap_refs": [ + "G03", + "G05" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-AGENT-008", + "original_status": "unverified", + "gap_refs": [ + "G03", + "G05" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-AUDIT-001", + "original_status": "unverified", + "gap_refs": [ + "G06" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T14" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-AUDIT-002", + "original_status": "unverified", + "gap_refs": [ + "G06" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T14" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-AUDIT-003", + "original_status": "unverified", + "gap_refs": [ + "G06" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T14" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-AUDIT-004", + "original_status": "unverified", + "gap_refs": [ + "G06" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T14" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-AUDIT-005", + "original_status": "unverified", + "gap_refs": [ + "G06" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T14" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-ROOT-001", + "original_status": "unverified", + "gap_refs": [ + "G08", + "G11" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T11", + "CUST-WP-0082-T13" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-ROOT-002", + "original_status": "unverified", + "gap_refs": [ + "G08", + "G11" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T11", + "CUST-WP-0082-T13" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-ROOT-003", + "original_status": "incomplete", + "gap_refs": [ + "G08", + "G11" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T11", + "CUST-WP-0082-T13" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-ROOT-004", + "original_status": "incomplete", + "gap_refs": [ + "G08", + "G11" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T11", + "CUST-WP-0082-T13" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-ROOT-005", + "original_status": "unverified", + "gap_refs": [ + "G08", + "G11" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T11", + "CUST-WP-0082-T13" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-INV-001", + "original_status": "unverified", + "gap_refs": [ + "G04" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T11", + "CUST-WP-0082-T12" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-INV-002", + "original_status": "unverified", + "gap_refs": [ + "G04" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T11", + "CUST-WP-0082-T12" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-INV-003", + "original_status": "unverified", + "gap_refs": [ + "G04" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T11", + "CUST-WP-0082-T12" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-INV-004", + "original_status": "unverified", + "gap_refs": [ + "G04" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T11", + "CUST-WP-0082-T12" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-INV-005", + "original_status": "unverified", + "gap_refs": [ + "G04" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T11", + "CUST-WP-0082-T12" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-INV-006", + "original_status": "unverified", + "gap_refs": [ + "G04" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T11", + "CUST-WP-0082-T12" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-INV-007", + "original_status": "unverified", + "gap_refs": [ + "G04" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T11", + "CUST-WP-0082-T12" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-EXC-001", + "original_status": "unverified", + "gap_refs": [ + "G09", + "G10" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T12", + "CUST-WP-0082-T24" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-EXC-002", + "original_status": "unverified", + "gap_refs": [ + "G09", + "G10" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T12", + "CUST-WP-0082-T24" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-EXC-003", + "original_status": "unverified", + "gap_refs": [ + "G09", + "G10" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T12", + "CUST-WP-0082-T24" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-EXC-004", + "original_status": "unverified", + "gap_refs": [ + "G09", + "G10" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T12", + "CUST-WP-0082-T24" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-AP-001", + "original_status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T13", + "CUST-WP-0082-T14", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19", + "CUST-WP-0082-T24" + ], + "disposition": "reference_preserved" + }, + { + "requirement_id": "DSM-AP-002", + "original_status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T13", + "CUST-WP-0082-T14", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19", + "CUST-WP-0082-T24" + ], + "disposition": "reference_preserved" + }, + { + "requirement_id": "DSM-AP-003", + "original_status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T13", + "CUST-WP-0082-T14", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19", + "CUST-WP-0082-T24" + ], + "disposition": "reference_preserved" + }, + { + "requirement_id": "DSM-AP-004", + "original_status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T13", + "CUST-WP-0082-T14", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19", + "CUST-WP-0082-T24" + ], + "disposition": "reference_preserved" + }, + { + "requirement_id": "DSM-AP-005", + "original_status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T13", + "CUST-WP-0082-T14", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19", + "CUST-WP-0082-T24" + ], + "disposition": "reference_preserved" + }, + { + "requirement_id": "DSM-AP-006", + "original_status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T13", + "CUST-WP-0082-T14", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19", + "CUST-WP-0082-T24" + ], + "disposition": "reference_preserved" + }, + { + "requirement_id": "DSM-AP-007", + "original_status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T13", + "CUST-WP-0082-T14", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19", + "CUST-WP-0082-T24" + ], + "disposition": "reference_preserved" + }, + { + "requirement_id": "DSM-AP-008", + "original_status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T13", + "CUST-WP-0082-T14", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19", + "CUST-WP-0082-T24" + ], + "disposition": "reference_preserved" + }, + { + "requirement_id": "DSM-AP-009", + "original_status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T13", + "CUST-WP-0082-T14", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19", + "CUST-WP-0082-T24" + ], + "disposition": "reference_preserved" + }, + { + "requirement_id": "DSM-AP-010", + "original_status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T13", + "CUST-WP-0082-T14", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19", + "CUST-WP-0082-T24" + ], + "disposition": "reference_preserved" + }, + { + "requirement_id": "DSM-AP-011", + "original_status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T13", + "CUST-WP-0082-T14", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19", + "CUST-WP-0082-T24" + ], + "disposition": "reference_preserved" + }, + { + "requirement_id": "DSM-AP-012", + "original_status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T13", + "CUST-WP-0082-T14", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19", + "CUST-WP-0082-T24" + ], + "disposition": "reference_preserved" + }, + { + "requirement_id": "DSM-AP-013", + "original_status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T13", + "CUST-WP-0082-T14", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19", + "CUST-WP-0082-T24" + ], + "disposition": "reference_preserved" + }, + { + "requirement_id": "DSM-AP-014", + "original_status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T13", + "CUST-WP-0082-T14", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19", + "CUST-WP-0082-T24" + ], + "disposition": "reference_preserved" + }, + { + "requirement_id": "DSM-AP-015", + "original_status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T13", + "CUST-WP-0082-T14", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19", + "CUST-WP-0082-T24" + ], + "disposition": "reference_preserved" + }, + { + "requirement_id": "DSM-AP-016", + "original_status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T13", + "CUST-WP-0082-T14", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19", + "CUST-WP-0082-T24" + ], + "disposition": "reference_preserved" + }, + { + "requirement_id": "DSM-AP-017", + "original_status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T13", + "CUST-WP-0082-T14", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19", + "CUST-WP-0082-T24" + ], + "disposition": "reference_preserved" + }, + { + "requirement_id": "DSM-AP-018", + "original_status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T13", + "CUST-WP-0082-T14", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19", + "CUST-WP-0082-T24" + ], + "disposition": "reference_preserved" + }, + { + "requirement_id": "DSM-AP-019", + "original_status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T13", + "CUST-WP-0082-T14", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19", + "CUST-WP-0082-T24" + ], + "disposition": "reference_preserved" + }, + { + "requirement_id": "DSM-AP-020", + "original_status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T03", + "CUST-WP-0082-T06", + "CUST-WP-0082-T07", + "CUST-WP-0082-T09", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T13", + "CUST-WP-0082-T14", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19", + "CUST-WP-0082-T24" + ], + "disposition": "reference_preserved" + }, + { + "requirement_id": "DSM-CORE-1", + "original_status": "unverified", + "gap_refs": [ + "G04", + "G05", + "G07", + "G09", + "G10", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T09", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19", + "CUST-WP-0082-T24" + ], + "disposition": "deferred_acceptance_not_conformant" + }, + { + "requirement_id": "DSM-CORE-2", + "original_status": "unverified", + "gap_refs": [ + "G04", + "G05", + "G07", + "G09", + "G10", + "G12" + ], + "hardening_checkpoints": [ + "CUST-WP-0082-T09", + "CUST-WP-0082-T10", + "CUST-WP-0082-T11", + "CUST-WP-0082-T12", + "CUST-WP-0082-T18", + "CUST-WP-0082-T19", + "CUST-WP-0082-T24" + ], + "disposition": "deferred_acceptance_not_conformant" + } + ], + "review_trigger": "Promote after functional flows, earlier concrete demand/risk, and revalidate before customer production.", + "security_target_unchanged": true, + "native_authority_granted": false +} diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/measurements.json b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/measurements.json new file mode 100644 index 00000000..3568870b --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/measurements.json @@ -0,0 +1,26 @@ +{ + "scope": "Playwright working build profile only", + "measurements": [ + { + "consumer": "human", + "run_id": "d81a5166-83d9-4382-a6e8-a90cfc3f0a51", + "completed_steps": 14, + "run_duration_seconds": 3.801, + "keyboard_and_responsive": true + }, + { + "consumer": "agent", + "run_id": "893a8bcb-9b7f-48f1-8a51-c116de3f3097", + "completed_steps": 14, + "run_duration_seconds": 3.938, + "keyboard_and_responsive": true + } + ], + "consumer_commands_after_connection": 2, + "connection_commands": 1, + "manual_connection_setup_required": true, + "local_browser_install_required": false, + "baseline_comparison": "No comparable prior end-to-end baseline measured; no percentage improvement claimed.", + "forgejo_measurement": "pending T37", + "reuse": "Existing rapp-playwright client and Kubernetes port-forward, zero new clients or deployments." +} diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-agent/desktop-final.png b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-agent/desktop-final.png new file mode 100644 index 00000000..91a20404 Binary files /dev/null and b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-agent/desktop-final.png differ diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-agent/narrow-final.png b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-agent/narrow-final.png new file mode 100644 index 00000000..c2ad4e93 Binary files /dev/null and b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-agent/narrow-final.png differ diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-agent/preflight.json b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-agent/preflight.json new file mode 100644 index 00000000..202091f2 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-agent/preflight.json @@ -0,0 +1,24 @@ +{ + "available": true, + "error": null, + "checked_at": "2026-10-18T16:15:46.222Z", + "browser_version": "156.0.8078.4", + "api_version": "1", + "service_version": "0.1.0", + "playwright_version": "1.64.0", + "execution_location": "railiance01/playwright", + "release": "forgejo.coulomb.social/coulomb/rapp-playwright@sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441", + "allowed_origins": [ + "https://onco.cc" + ], + "fixture": true, + "active": 0, + "queued": 0, + "limits": { + "concurrency": 1, + "max_queue": 4, + "max_timeout_ms": 120000, + "retention_ms": 3600000, + "max_runs": 64 + } +} diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-agent/receipt.json b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-agent/receipt.json new file mode 100644 index 00000000..70dfc00c --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-agent/receipt.json @@ -0,0 +1,184 @@ +{ + "id": "893a8bcb-9b7f-48f1-8a51-c116de3f3097", + "api_version": "1", + "status": "passed", + "error": null, + "label": "independent-browser-trial", + "target": "fixture", + "viewports": [ + { + "name": "desktop", + "width": 1280, + "height": 800 + }, + { + "name": "narrow", + "width": 390, + "height": 844 + } + ], + "timeout_ms": 60000, + "created_at": "2026-10-18T16:16:02.516Z", + "expires_at": "2026-10-18T17:16:02.516Z", + "service_version": "0.1.0", + "playwright_version": "1.64.0", + "release": "forgejo.coulomb.social/coulomb/rapp-playwright@sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441", + "execution_location": "railiance01/playwright", + "browser_version": "156.0.8078.4", + "completed_steps": 14, + "steps": [ + { + "viewport": "desktop", + "index": 0, + "action": "visible", + "status": "passed", + "at": "2026-10-18T16:16:04.655Z", + "selector": "h1" + }, + { + "viewport": "desktop", + "index": 1, + "action": "text", + "status": "passed", + "at": "2026-10-18T16:16:04.773Z", + "selector": "#count" + }, + { + "viewport": "desktop", + "index": 2, + "action": "press", + "status": "passed", + "at": "2026-10-18T16:16:04.865Z", + "key": "Tab" + }, + { + "viewport": "desktop", + "index": 3, + "action": "focused", + "status": "passed", + "at": "2026-10-18T16:16:04.882Z", + "selector": "#increment" + }, + { + "viewport": "desktop", + "index": 4, + "action": "press", + "status": "passed", + "at": "2026-10-18T16:16:04.891Z", + "key": "Enter" + }, + { + "viewport": "desktop", + "index": 5, + "action": "text", + "status": "passed", + "at": "2026-10-18T16:16:04.907Z", + "selector": "#count" + }, + { + "viewport": "desktop", + "index": 6, + "action": "screenshot", + "status": "passed", + "at": "2026-10-18T16:16:04.942Z" + }, + { + "viewport": "narrow", + "index": 0, + "action": "visible", + "status": "passed", + "at": "2026-10-18T16:16:05.847Z", + "selector": "h1" + }, + { + "viewport": "narrow", + "index": 1, + "action": "text", + "status": "passed", + "at": "2026-10-18T16:16:05.959Z", + "selector": "#count" + }, + { + "viewport": "narrow", + "index": 2, + "action": "press", + "status": "passed", + "at": "2026-10-18T16:16:06.052Z", + "key": "Tab" + }, + { + "viewport": "narrow", + "index": 3, + "action": "focused", + "status": "passed", + "at": "2026-10-18T16:16:06.062Z", + "selector": "#increment" + }, + { + "viewport": "narrow", + "index": 4, + "action": "press", + "status": "passed", + "at": "2026-10-18T16:16:06.070Z", + "key": "Enter" + }, + { + "viewport": "narrow", + "index": 5, + "action": "text", + "status": "passed", + "at": "2026-10-18T16:16:06.099Z", + "selector": "#count" + }, + { + "viewport": "narrow", + "index": 6, + "action": "screenshot", + "status": "passed", + "at": "2026-10-18T16:16:06.105Z" + } + ], + "artifacts": [ + { + "name": "desktop-6-keyboard-result.png", + "bytes": 26622 + }, + { + "name": "desktop-final.png", + "bytes": 26622 + }, + { + "name": "narrow-6-keyboard-result.png", + "bytes": 24280 + }, + { + "name": "narrow-final.png", + "bytes": 24280 + } + ], + "started_at": "2026-10-18T16:16:02.519Z", + "blocked_requests": 12, + "finished_at": "2026-10-18T16:16:06.457Z", + "downloads": [ + { + "name": "desktop-6-keyboard-result.png", + "bytes": 26622, + "sha256": "b15998824256b86c74f2bbb75f061061be65db0b4f3bb5444529ac69a723cdad" + }, + { + "name": "desktop-final.png", + "bytes": 26622, + "sha256": "b15998824256b86c74f2bbb75f061061be65db0b4f3bb5444529ac69a723cdad" + }, + { + "name": "narrow-6-keyboard-result.png", + "bytes": 24280, + "sha256": "49d27cb169b8e180ce93969c6d2b8619a7684cf035bb9dcae9cd91d8bd9952e8" + }, + { + "name": "narrow-final.png", + "bytes": 24280, + "sha256": "49d27cb169b8e180ce93969c6d2b8619a7684cf035bb9dcae9cd91d8bd9952e8" + } + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-human/desktop-final.png b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-human/desktop-final.png new file mode 100644 index 00000000..91a20404 Binary files /dev/null and b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-human/desktop-final.png differ diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-human/narrow-final.png b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-human/narrow-final.png new file mode 100644 index 00000000..c2ad4e93 Binary files /dev/null and b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-human/narrow-final.png differ diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-human/preflight.json b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-human/preflight.json new file mode 100644 index 00000000..b0bc439b --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-human/preflight.json @@ -0,0 +1,24 @@ +{ + "available": true, + "error": null, + "checked_at": "2026-10-18T16:16:48.083Z", + "browser_version": "156.0.8078.4", + "api_version": "1", + "service_version": "0.1.0", + "playwright_version": "1.64.0", + "execution_location": "railiance01/playwright", + "release": "forgejo.coulomb.social/coulomb/rapp-playwright@sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441", + "allowed_origins": [ + "https://onco.cc" + ], + "fixture": true, + "active": 0, + "queued": 0, + "limits": { + "concurrency": 1, + "max_queue": 4, + "max_timeout_ms": 120000, + "retention_ms": 3600000, + "max_runs": 64 + } +} diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-human/receipt.json b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-human/receipt.json new file mode 100644 index 00000000..33c0c7b0 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-human/receipt.json @@ -0,0 +1,184 @@ +{ + "id": "d81a5166-83d9-4382-a6e8-a90cfc3f0a51", + "api_version": "1", + "status": "passed", + "error": null, + "label": "independent-browser-trial", + "target": "fixture", + "viewports": [ + { + "name": "desktop", + "width": 1280, + "height": 800 + }, + { + "name": "narrow", + "width": 390, + "height": 844 + } + ], + "timeout_ms": 60000, + "created_at": "2026-10-18T16:17:42.400Z", + "expires_at": "2026-10-18T17:17:42.400Z", + "service_version": "0.1.0", + "playwright_version": "1.64.0", + "release": "forgejo.coulomb.social/coulomb/rapp-playwright@sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441", + "execution_location": "railiance01/playwright", + "browser_version": "156.0.8078.4", + "completed_steps": 14, + "steps": [ + { + "viewport": "desktop", + "index": 0, + "action": "visible", + "status": "passed", + "at": "2026-10-18T16:17:44.301Z", + "selector": "h1" + }, + { + "viewport": "desktop", + "index": 1, + "action": "text", + "status": "passed", + "at": "2026-10-18T16:17:44.448Z", + "selector": "#count" + }, + { + "viewport": "desktop", + "index": 2, + "action": "press", + "status": "passed", + "at": "2026-10-18T16:17:44.505Z", + "key": "Tab" + }, + { + "viewport": "desktop", + "index": 3, + "action": "focused", + "status": "passed", + "at": "2026-10-18T16:17:44.510Z", + "selector": "#increment" + }, + { + "viewport": "desktop", + "index": 4, + "action": "press", + "status": "passed", + "at": "2026-10-18T16:17:44.544Z", + "key": "Enter" + }, + { + "viewport": "desktop", + "index": 5, + "action": "text", + "status": "passed", + "at": "2026-10-18T16:17:44.548Z", + "selector": "#count" + }, + { + "viewport": "desktop", + "index": 6, + "action": "screenshot", + "status": "passed", + "at": "2026-10-18T16:17:44.551Z" + }, + { + "viewport": "narrow", + "index": 0, + "action": "visible", + "status": "passed", + "at": "2026-10-18T16:17:45.508Z", + "selector": "h1" + }, + { + "viewport": "narrow", + "index": 1, + "action": "text", + "status": "passed", + "at": "2026-10-18T16:17:45.699Z", + "selector": "#count" + }, + { + "viewport": "narrow", + "index": 2, + "action": "press", + "status": "passed", + "at": "2026-10-18T16:17:45.749Z", + "key": "Tab" + }, + { + "viewport": "narrow", + "index": 3, + "action": "focused", + "status": "passed", + "at": "2026-10-18T16:17:45.755Z", + "selector": "#increment" + }, + { + "viewport": "narrow", + "index": 4, + "action": "press", + "status": "passed", + "at": "2026-10-18T16:17:45.759Z", + "key": "Enter" + }, + { + "viewport": "narrow", + "index": 5, + "action": "text", + "status": "passed", + "at": "2026-10-18T16:17:45.801Z", + "selector": "#count" + }, + { + "viewport": "narrow", + "index": 6, + "action": "screenshot", + "status": "passed", + "at": "2026-10-18T16:17:45.804Z" + } + ], + "artifacts": [ + { + "name": "desktop-6-keyboard-result.png", + "bytes": 26622 + }, + { + "name": "desktop-final.png", + "bytes": 26622 + }, + { + "name": "narrow-6-keyboard-result.png", + "bytes": 24280 + }, + { + "name": "narrow-final.png", + "bytes": 24280 + } + ], + "started_at": "2026-10-18T16:17:42.401Z", + "blocked_requests": 12, + "finished_at": "2026-10-18T16:17:46.202Z", + "downloads": [ + { + "name": "desktop-6-keyboard-result.png", + "bytes": 26622, + "sha256": "b15998824256b86c74f2bbb75f061061be65db0b4f3bb5444529ac69a723cdad" + }, + { + "name": "desktop-final.png", + "bytes": 26622, + "sha256": "b15998824256b86c74f2bbb75f061061be65db0b4f3bb5444529ac69a723cdad" + }, + { + "name": "narrow-6-keyboard-result.png", + "bytes": 24280, + "sha256": "49d27cb169b8e180ce93969c6d2b8619a7684cf035bb9dcae9cd91d8bd9952e8" + }, + { + "name": "narrow-final.png", + "bytes": 24280, + "sha256": "49d27cb169b8e180ce93969c6d2b8619a7684cf035bb9dcae9cd91d8bd9952e8" + } + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-profile.json b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-profile.json new file mode 100644 index 00000000..9e69c85a --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-profile.json @@ -0,0 +1,13 @@ +{ + "profile": "supervised-build-mode", + "human_run": "d81a5166-83d9-4382-a6e8-a90cfc3f0a51", + "agent_run": "893a8bcb-9b7f-48f1-8a51-c116de3f3097", + "human_execution_confirmed_by": "Actual founder reply with passed output; local receipt readback agrees", + "transport": "Existing authenticated workstation kubectl port-forward; no kubeconfig or secret distribution", + "independent_per_caller_identity_accepted": false, + "new_native_configuration": false, + "security_followup": "CUST-WP-0082-T21", + "capability_files": "run.json stays private in original /tmp directories and is not included", + "client_source": "/home/worsch/rapp-playwright/client/rapp_playwright.py", + "client_sha256": "9967a0831ed04e27fde419098af707722d5c81c993e4c294b3677ffb75729c12" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/validation.json b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/validation.json new file mode 100644 index 00000000..ad0830dc --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/validation.json @@ -0,0 +1,15 @@ +{ + "verified": true, + "original_task_bindings_preserved": 40, + "new_hardening_task_bindings": 25, + "requirements_preserved_unchanged": 116, + "full_transfers_not_implemented": 19, + "wp80_status_counts": { + "done": 14, + "progress": 4, + "todo": 3, + "cancel": 19 + }, + "playwright_real_human_and_agent": "passed", + "security_conformance_claimed": false +} diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/workplan-before.txt b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/workplan-before.txt new file mode 100644 index 00000000..997ddefe --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/workplan-before.txt @@ -0,0 +1,661 @@ +--- +id: CUST-WP-0080 +type: workplan +title: "NetKingdom target security architecture and SEC-DSM implementation" +domain: infotech +repo: the-custodian +status: active +owner: codex +topic_slug: custodian +created: "2026-10-12" +updated: "2026-10-18" +flavor: implementation +depends_on: [] +state_hub_workstream_id: "dfadb19b-445e-59c6-bcd6-48e87b912c52" +--- + + +# WP-80 delivery overview + +Updated 18 October 2026 after the founder requested clearer progress and smaller tasks. + +| Measure | Current state | Meaning | +| --- | --- | --- | +| Completed source evidence checkpoints | **7 of 7**: T07-T13 | Published/reviewed foundations at their stated scope; no native acceptance inferred. | +| Remaining integration/build checkpoints | **0 of 6**: T14-T19 | Current ongoing access, protected operation/inverse, writer exclusion and final build still need completion. | +| Delivery checkpoints overall | **8 done, 0 in progress, 26 todo**: T07-T40 | Discrete Custodian evidence checkpoints linked to existing owner implementation work. | +| Complete native architecture gates | **0 of 16**: TSA-01-TSA-16 | Each requires its full deployed/consumer evidence. This is not 0% engineering progress. | +| Original coordination records | **2 of 6 done**: T01-T06 | Stable umbrella IDs/UUIDs retained for existing callers; not a delivery percentage. | + +**Completed - T20:** the founder-admitted scanner revision passed native activation, +including 166 scanner fragments, 1,328 protected hook files, both-version startup +custody, actual template inheritance, receive-pack refusal/recovery and cleanup. +Normal publication pushed all five queued Custodian commits; exact Hub readback +verified all 40 task UUID/status bindings. The publication blocker is cleared. +This scoped scanner acceptance does not close a complete architecture gate. + +**Next - T14/T15:** implement and verify the selected current KeyCape checks on +ongoing browser/API/Git HTTP and SSH paths, using the existing producer clients. +Then T16-T19 finish exact operation/inverse, writer exclusion and the final release. +While one native checkpoint awaits a concrete approval/owner return, one independent +source checkpoint may progress. Limit active delivery work to two checkpoints. + +**Already delivered:** shared signed-decision/approval foundations; the current-token +client and fresh inverse-session verification; actual issuer-to-Forgejo login; +PostgreSQL crash/restart and inverse mechanics; the bounded scanner correction; +provider index/parity repairs; workload-isolation fixture proof. T07-T13 carry the +scope and evidence for each. The new completed records expose existing delivered +work; they do not represent seven newly deployed systems. + +**Publication and Hub view:** normal source publication is working again. +The five queued Custodian commits were published through c1fcd948; all 40 task +records (six original coordination records plus 34 delivery checkpoints) are +present in the Hub with verified source bindings. T20 is now complete. The Hub +remains the derived view; this file owns checkpoint status. Subsequent source +changes use the same ordinary commit/consistency path. + +**Scope:** all 16 gates, G01-G13 and all 116 SEC-DSM ledger entries remain required. +[Target and acceptance contract](../docs/netkingdom-target-security-architecture.md), +[owner implementation record](../docs/netkingdom-target-implementation.md), +[gap register](../docs/netkingdom-security-gaps.md), +[requirement ledger](../docs/evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json). +Existing scoped approvals, deferrals, independent owner assent and explicit residual +promotion rules remain effective. This refinement grants no runtime authority. + +**Ownership and updates:** T07-T40 are Custodian review/acceptance checkpoints, not +replacement owner implementation tasks. Owner files own implementation status; +this file owns coordination/evidence-checkpoint status; the Hub is its derived view. +Every progress update names the checkpoint, concrete output, exact evidence scope, +remaining acceptance and next action. Link original evidence rather than recopying +it. Re-run checks only for changed inputs, failures or a specific unresolved concern. +Route new findings into the existing owner record and mapped checkpoint before +adding another workplan. Do not infer an overall percentage from mixed-stage counts. + +The complete prior task/session history is preserved byte-for-byte in the +[pre-refinement snapshot](../docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/workplan-before-refinement.txt). +No old task binding or status was replaced; history is evidence, not a second live backlog. + +## Review canon and map actual architecture + +```task +id: CUST-WP-0080-T01 +status: done +priority: high +state_hub_task_id: "c770f7e1-25eb-53ec-9a37-1f7794077ff8" +``` + +Completed the SecurityCanon SEC-DSM and existing-owner architecture review. Delivered [security blueprint](../docs/netkingdom-security-blueprint.md). The inventory distinguishes reference/documentation capabilities from runtime enforcement. This record is retained unchanged in status and identity. + +## Inspect and optimize the blueprint before planning closure + +```task +id: CUST-WP-0080-T02 +status: done +priority: high +state_hub_task_id: "5973026f-8ca9-5882-99fe-65a54bc250ac" +``` + +Completed trust-boundary, owner, lifecycle and dependency inspection. Delivered the [gap analysis](../docs/netkingdom-security-gaps.md) and target direction. This completed design review does not claim native conformance. + +## Close source defects and reconcile uncovered lifecycle gaps + +```task +id: CUST-WP-0080-T03 +status: progress +priority: high +state_hub_task_id: "87637402-02f1-57c1-8fbc-4141598af8e3" +``` + +Coordination umbrella. Drive remaining source/lifecycle closure through the existing owners and specific checkpoints, especially T14-T19, T29-T31 and T38-T40. Preserve G04/G07/G08/G10/G12/G13, original source defects and all existing owner obligations. T07-T13 expose completed bounded source reviews; they do not close this umbrella. Close only when all source/lifecycle findings have verified completion or a valid governed handoff consistent with the full target. + +## Verify native closure against every requirement + +```task +id: CUST-WP-0080-T04 +status: todo +depends_on: [CUST-WP-0080-T03] +priority: high +state_hub_task_id: "82378b0f-7004-5c2f-9683-b356a1227576" +``` + +Final acceptance audit. Reconcile every TSA-01-TSA-16 gate, G01-G13 and all 116 individual requirements with exact current evidence or an actually approved applicable exception. Require the human/agent journeys, second real consumer, clean installation and operational acceptance. Plans, source tests and owner handoffs are insufficient. Transfer any permitted residuals into live records before finishing; preserve required work and explicit deferrals. + +## Coordinate self-service Playwright identity delivery + +```task +id: CUST-WP-0080-T05 +status: progress +priority: high +depends_on: [RPF-WP-0056, RAPP-PLAYWRIGHT-WP-0004] +state_hub_task_id: "ed8b909a-23bf-5e5f-b600-e477fbae136b" +``` + +Coordination umbrella for T25/T26 and supported consumer/discovery evidence. Retain incoming request `1b279bad-a159-43da-8709-1167882e62f8`, [existing delivery case](../infra/security-flow/playwright-delivery.json), RPF-WP-0056-T03 and RAPP-PLAYWRIGHT-WP-0004-T01/T03. Existing eligible platform humans/coding agents need no renewed membership decision. Collect exact registration/custody/authenticator/per-caller transport returns and Platform/provider native acceptance. Do not substitute a deployed browser, shared admin kubeconfig or accepted provider-only crash proof for the actual human/agent journeys. + +## Establish the target architecture and drive the restructuring + +```task +id: CUST-WP-0080-T06 +status: progress +priority: high +state_hub_task_id: "6aca534c-5c7a-556f-b6b6-406433670c29" +``` + +Coordination umbrella for the full target and owner sequencing. Preserve independently owned security meaning, identity, authorization, approval, custody and audit; reuse producer clients, case templates and owner workplans. Keep all sixteen gates and the complete ledger in scope. This task closes with the target exit condition and T04 audit, not another source wave. Prior delegation is historical evidence, not an inherited runtime/autopilot grant. + +## T07 - Review signed decision and approval interoperability + +```task +id: CUST-WP-0080-T07 +status: done +priority: high +state_hub_task_id: "bb236dea-30f7-5437-b01c-f14d2509e061" +``` + +Stage: source evidence. Owner implementation: Access Engine / Secrets / Approval; FLEX-WP-0024, SECRETS-WP-0014, APPROVAL-WP-0004. + +Completed source review of actual producer-to-consumer signing, strict handoff, precise approval consumption and independent confirmation. Published implementations and local/disposable cross-owner proofs exist. Live signer, caller, policy and package admission remain T21/T22. + +[Evidence](../docs/changes/netkingdom-target-2026-10-16/coordinator-source-review.json). + +## T08 - Review the shared current-token client and fresh inverse session + +```task +id: CUST-WP-0080-T08 +status: done +priority: high +state_hub_task_id: "18b885fe-503f-5ebc-b390-808f71316264" +``` + +Stage: source evidence. Owner implementation: KeyCape / Warden; KEY-WP-0042-T04, WARDEN-WP-0044. + +Published producer-owned current-token client, generated adapter/drift check and fresh inverse-session verification. The actual cross-owner fixture passed 45 assertions. Immutable original provenance grants no replay authority. Actual target operation/inverse remains T16/T17. + +[Evidence](../docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/README.md). + +## T09 - Review actual issuer-to-Forgejo current-token login + +```task +id: CUST-WP-0080-T09 +status: done +priority: high +state_hub_task_id: "a1f2dbe0-13d4-57a2-a2b5-c0137cd48410" +``` + +Stage: source evidence. Owner implementation: KeyCape / Apps; KEY-WP-0042, RAPPS-WP-0016-T09. + +Actual issuer/provider/callback passed five process scenarios: two current grants accepted; mixed pair, revoked grant and suspended human refused. The selected composed suite passed 116 test/subtest results without skips. MFA/PDP admissions were synthetic. Ongoing operations remain T14/T15; live acceptance remains T23. + +[Evidence](../docs/changes/netkingdom-target-2026-10-18/forgejo-current-token-r1/validation-summary.json). + +## T10 - Review Forgejo PostgreSQL recovery and inverse mechanics + +```task +id: CUST-WP-0080-T10 +status: done +priority: high +state_hub_task_id: "1f3c78af-5686-58ea-9133-8afc2df36b8f" +``` + +Stage: source evidence. Owner implementation: Apps / NetKingdom; RAPPS-WP-0016-T07/T08, NK-WP-0048. + +Actual Forgejo model/schema tests passed 37 results across three PostgreSQL profiles, including process death and actual database restart, exact inverse, drift and writer-lock counterexamples. This is disposable database/source proof. Fresh operation authority, durable journal custody and exclusion of every release writer remain T16-T18. + +[Evidence](../docs/changes/netkingdom-target-2026-10-18/forgejo-postgres-source-r1/README.md). + +## T11 - Review the bounded receive-scanner correction + +```task +id: CUST-WP-0080-T11 +status: done +priority: high +state_hub_task_id: "bffd4e10-2cf0-5835-a8d0-ae1763ca3873" +``` + +Stage: source evidence. Owner implementation: Forge / Repo Manager; FORGE-WP-0010-T01. + +Forge ea65606c is published. The exact refused 141-object/one-ref delta passes in 52.53 seconds under the unchanged 90-second deadline. There are 54 distinct passing leaf cases and no skips. Original failures are retained. Native rollout and ordinary publication remain T20. + +[Evidence](../docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/README.md). + +## T12 - Review provider discovery and source/index parity repairs + +```task +id: CUST-WP-0080-T12 +status: done +priority: high +state_hub_task_id: "bb09e414-6d79-5dcd-b8e6-b73a046a4dda" +``` + +Stage: source evidence. Owner implementation: Reuse / Bootstrap / NetKingdom; existing provider records. + +Verified published provider index/parity changes and owner source bindings. This closes the dated source review, not ongoing hosted freshness, source-link/version correctness or recurring drift acceptance; those remain T33. + +[Evidence](../docs/changes/netkingdom-target-2026-10-16/source-wave12-coordinator-review.json). + +## T13 - Review workload-credential isolation in the sandbox fixture + +```task +id: CUST-WP-0080-T13 +status: done +priority: high +state_hub_task_id: "793e78f0-7782-5e48-bdc0-b65127b32ecb" +``` + +Stage: source evidence. Owner implementation: Glas / rein; GLAS-WP-0012, CUST-WP-0073. + +Published workload-only credential delivery passed 141 tests and actual disposable bwrap host/environment/subprocess denial, redaction and teardown checks. The current interactive Custodian assignment is not admitted by that fixture. Real assignment and runner acceptance remain T27/T28. + +[Evidence](../docs/changes/netkingdom-target-2026-10-16/coordinator-source-review.json). + +## T14 - Verify current identity on browser, API and Git HTTP paths + +```task +id: CUST-WP-0080-T14 +status: todo +priority: high +depends_on: [CUST-WP-0080-T09] +state_hub_task_id: "7ecbd622-03a8-5b49-9621-8d21d7d15890" +``` + +Stage: source integration. Owner implementation: Apps / KeyCape / Access; RAPPS-WP-0016-T09, NK-WP-0048-T43. + +Completion test: Actual shared authentication routes enforce current linked account/source/subject/application-tenant bindings, current groups and exact resource/action policy. Tests must cover revoked, suspended, expired, unavailable and mismatched identity, plus terminal refusal without fallback. Preserve the separate local break-glass path and prevent federated unlink/downgrade escape. + +## T15 - Verify current identity on the independent SSH path + +```task +id: CUST-WP-0080-T15 +status: todo +priority: high +depends_on: [CUST-WP-0080-T14] +state_hub_task_id: "434d9c78-7789-5b78-8d9d-d87b0638b469" +``` + +Stage: source integration. Owner implementation: Apps / KeyCape / Access; RAPPS-WP-0016-T09, NK-WP-0048-T43. + +Completion test: The actual private SSH service checks the same producer-owned identity and policy contract before repository creation or effects. Native SSH keys cannot bypass current linked identity. Positive, denial, revocation, unavailable and account/source mismatch cases pass; local break-glass behavior is covered. + +## T16 - Verify exact current authority for the protected Forgejo operation + +```task +id: CUST-WP-0080-T16 +status: todo +priority: high +depends_on: [CUST-WP-0080-T07, CUST-WP-0080-T08, CUST-WP-0080-T09] +state_hub_task_id: "e6183073-cc8e-5c6f-8fbd-db50bb1a466c" +``` + +Stage: source integration. Owner implementation: NetKingdom / Warden / Apps / Approval / Access; existing NK-WP-0048 operation tasks. + +Completion test: The actual operation entry path authenticates the current actor/session and binds tenant, exact target/action, payload/source revision, decision and required approval before journal writes or owner effects. Wrong actor/body/tenant, expired authority, unavailable producers and business replay refuse. Existing producer contracts remain authoritative. + +## T17 - Verify the fresh inverse and durable private recovery journal + +```task +id: CUST-WP-0080-T17 +status: todo +priority: high +depends_on: [CUST-WP-0080-T16] +state_hub_task_id: "4de46468-7ae2-59e3-be2b-1a32506153a5" +``` + +Stage: source integration. Owner implementation: Apps / Warden / NetKingdom; RAPPS-WP-0016-T07/T08 and existing NK-WP-0048 inverse tasks. + +Completion test: An exact prior operation can be reconciled and inversed with fresh current authority while retaining original provenance and unknown outcomes. Private journal custody, permissions, persistence, retention and recovery are explicit. Cover public client, unchanged secret delivery and failure before hand-over receipt; receipt deletion alone is not the inverse. + +## T18 - Verify exclusion of every Forgejo release writer + +```task +id: CUST-WP-0080-T18 +status: todo +priority: high +depends_on: [CUST-WP-0080-T10, CUST-WP-0080-T16] +state_hub_task_id: "fd796e9c-dd70-5c65-a6fe-eafe3911bc8f" +``` + +Stage: source integration. Owner implementation: Apps / NetKingdom / deployment owners; existing NK-WP-0048 writer obligations. + +Completion test: Inventory and constrain every actual release/configuration writer for prepare/check/effect/inverse, including uncooperative writers. Demonstrate target drift and concurrent-write refusals at the declared database/release scope. A local advisory lock or the earlier source transaction test alone cannot close this checkpoint. + +## T19 - Verify the complete final Forgejo release and OCI artifact + +```task +id: CUST-WP-0080-T19 +status: todo +priority: high +depends_on: [CUST-WP-0080-T14, CUST-WP-0080-T15, CUST-WP-0080-T16, CUST-WP-0080-T17, CUST-WP-0080-T18] +state_hub_task_id: "4ffd2e33-d887-5686-bad1-7f32a56191a8" +``` + +Stage: artifact build. Owner implementation: Apps; RAPPS-WP-0016 build/operation tasks. + +Completion test: Build the final integrated revision with pinned source/tool/dependency inputs, all frontend/static assets and the static backend. Verify release CLI/source parity, complete required checks, artifact hashes and the local OCI package. Prior 40-path build evidence does not establish a later integrated release. Independent admission and live acceptance remain T23. + +## T20 - Accept the native receive-scanner correction and ordinary publication + +```task +id: CUST-WP-0080-T20 +status: done +priority: high +depends_on: [CUST-WP-0080-T11] +state_hub_task_id: "0d9df435-b9a2-5b89-833d-799785c969a9" +``` + +Stage: native acceptance. Owner implementation: Forge / Apps / Repo Manager; FORGE-WP-0010-T02/T03. + +Completed: [exact revision 1](../docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/README.md) received founder go cb9a20f9 after independent Forge/Apps approval. Native stage and activation verified exact binaries/startup, 166 scanner fragments, 1,328 protected hook files, actual inherited executable hook, clean/blocked/unavailable receive-pack, quarantine and cleanup. Apps declaration 2fdc198b is published. Normal Custodian publication pushed five queued commits through c1fcd948 and exact Hub readback matched all 40 task UUID/status bindings. See publication-readback-r1.json in that packet. Independent Forge owner accepted the native/publication returns against FORGE-WP-0010-T02/T03; that existing owner workplan remains the implementation record. Other target gates and existing residual boundaries remain open. + +## T21 - Accept signed decisions at the native privileged consumers + +```task +id: CUST-WP-0080-T21 +status: todo +priority: high +depends_on: [CUST-WP-0080-T07] +state_hub_task_id: "fa11a2a4-4dbd-5dfb-ad29-bc7a99cc6258" +``` + +Stage: native acceptance. Owner implementation: Secrets / Access / Platform; SECRETS-WP-0014, FLEX-WP-0024. + +Completion test: Admit exact producer package, signer/channel, independent consumer trust and caller/policy bindings. Account for the privileged PEP denominator and prove native forged, altered, wrong-key, unsigned/downgrade, expired, unavailable and rotation refusals. Source fixtures do not close TSA-01. + +## T22 - Accept one native approved operation and crash recovery + +```task +id: CUST-WP-0080-T22 +status: todo +priority: high +depends_on: [CUST-WP-0080-T21, CUST-WP-0080-T16, CUST-WP-0080-T17, CUST-WP-0080-T18] +state_hub_task_id: "88588db8-8c6e-5d15-a85b-2c068f4e8a2a" +``` + +Stage: native acceptance. Owner implementation: Platform / Secrets / Approval / Audit; RPF-WP-0035-T12, SECRETS-WP-0013, APPROVAL-WP-0004. + +Completion test: One exact approved effect passes authoritative consume/confirmation, target precondition/readback and independently verified cleanup. Native crash/restart/concurrency preserves unknown outcomes and forbids blind replay; actor/tenant/body/replay/expiry/unavailable negatives pass. Admit real custody and recovery grants. Closes only the declared TSA-02/TSA-03 scope. + +## T23 - Accept the complete first Forgejo browser security case + +```task +id: CUST-WP-0080-T23 +status: todo +priority: high +depends_on: [CUST-WP-0080-T19] +state_hub_task_id: "266e228b-7754-5323-b0c6-37f860592d90" +``` + +Stage: native acceptance. Owner implementation: NetKingdom / Mason / Warden / KeyCape / Apps; NK-WP-0048. + +Completion test: Admit exact case/type/provider/package revisions and private execution custody. Independently verify native structure, contained registration/delivery, sign-in, denied groups/actions, current ongoing API/Git/SSH access, revocation, exact inverse and rollback. Owner assent and actual deployed receipts are mandatory; a compiled patch or acknowledged case is insufficient. + +## T24 - Accept attended U08 factor recovery and fresh sign-in + +```task +id: CUST-WP-0080-T24 +status: todo +priority: high +state_hub_task_id: "a4f06ce0-69a5-5cbb-9d78-6c5b89ba9853" +``` + +Stage: human journey. Owner implementation: User / KeyCape; USER-WP-0028-T03, KEY-WP-0040. + +Completion test: Requalify the existing User task to the actual founder-attended disable/re-enroll/fresh-login window and obtain its value-free acceptance. KEY-WP-0040 preview/help-link corrections are already accepted; do not request or repeat that preview. No factor mutation is authorized by this plan refinement. + +## T25 - Accept the real human Playwright journey + +```task +id: CUST-WP-0080-T25 +status: todo +priority: high +state_hub_task_id: "3be1c76d-a5f3-5dea-9777-349dc97e836e" +``` + +Stage: consumer acceptance. Owner implementation: Platform / Playwright / NetKingdom / cluster / bridge; RPF-WP-0056-T03, RAPP-PLAYWRIGHT-WP-0004, NK-WP-0050. + +Completion test: Collect exact registration/custody/JWT-authenticator/per-caller transport owner returns, then run the supported command as one real human. Verify sign-in, scope/permission denial, browser operation, renewal/revocation and recovery, accepted by Platform and provider. Existing qualified humans need no new membership decision. + +## T26 - Accept the registered agent Playwright journey + +```task +id: CUST-WP-0080-T26 +status: todo +priority: high +state_hub_task_id: "0491b6b4-a238-58ef-bf3a-505749e5655c" +``` + +Stage: consumer acceptance. Owner implementation: Platform / Playwright / NetKingdom / cluster / bridge; same existing consumer case as T25. + +Completion test: Use one distinguishable registered agent and its admitted per-caller transport, not a shared admin kubeconfig or workstation identity. Verify the supported command, allowed/denied browser/API actions, expiry/cancellation, revocation and cleanup, with Platform/provider acceptance and supported consumer documentation. + +## T27 - Accept the actual interactive agent isolation profile + +```task +id: CUST-WP-0080-T27 +status: todo +priority: high +depends_on: [CUST-WP-0080-T13] +state_hub_task_id: "19540d29-c4df-5f1a-acf7-127965c9a396" +``` + +Stage: runtime acceptance. Owner implementation: Glas / selected rein / Platform / Warden; GLAS-WP-0012, CUST-WP-0073-T02/T04. + +Completion test: Admit this identified running assignment and verify admin-material read denial through files, mounts, environment, subprocesses and available tools, plus allowed task effects, expiry/cancel cleanup and no cross-task credential accumulation. Fixture success or another agent's authority record cannot substitute. + +## T28 - Accept per-job runner authority and workflow-abuse refusals + +```task +id: CUST-WP-0080-T28 +status: todo +priority: high +state_hub_task_id: "5ac99f55-0dde-5d1c-b88c-b85f34469abc" +``` + +Stage: runtime acceptance. Owner implementation: Forge / Platform / enablement; existing runner and CI owner work. + +Completion test: Verify actual job-specific credential/repository/deployment scope, teardown and abuse tests using repository-controlled workflows. Reuse the accepted Docker listener repair; do not repeat it as new progress. Prove jobs cannot disable the independent receive control or reach unrelated deployment credentials. + +## T29 - Reconcile the current credential and consumer metadata inventory + +```task +id: CUST-WP-0080-T29 +status: todo +priority: high +state_hub_task_id: "3ec89fb2-fe97-50f5-a3c9-88b731b0d2ec" +``` + +Stage: lifecycle evidence. Owner implementation: Secrets / Mason / Platform / NetKingdom; MASON-WP-0004, NK-WP-0049. + +Completion test: Produce a current metadata-only denominator with owner, purpose, exact scope, issuer/delivery, consumers, copies, expiry/rotation/revocation and recovery/deletion procedures. Unknown/orphan entries remain findings. Identify native-identity elimination candidates. Never retrieve values to improve the inventory. + +## T30 - Accept sampled credential replacement, revocation and copy deletion + +```task +id: CUST-WP-0080-T30 +status: todo +priority: high +depends_on: [CUST-WP-0080-T29] +state_hub_task_id: "457400ad-6c44-5160-a77a-63c6ad5acabc" +``` + +Stage: lifecycle acceptance. Owner implementation: Secrets / Platform / credential consumers; existing lifecycle plans. + +Completion test: For the admitted samples, demonstrate replacement adoption, old-credential refusal, refresh/deletion semantics and reconciled delivery copies. Preserve the founder-deferred exposure rotation; it requires its actual governing exception/decision rather than silent execution or a completion claim. + +## T31 - Accept independent root recovery with the normal issuer unavailable + +```task +id: CUST-WP-0080-T31 +status: todo +priority: high +depends_on: [CUST-WP-0080-T29] +state_hub_task_id: "cbf32375-279a-5bf3-b867-06333a1ff2ca" +``` + +Stage: recovery acceptance. Owner implementation: NetKingdom / Warden / Platform / recovery owners; NK-WP-0049, WARDEN-WP-0027. + +Completion test: In a fresh authorized scenario verify independent/off-host custody and access, restore, existing MFA/service/consumer continuity, reconnect and audit continuity; measure RTO/RPO. Reuse accepted archive/source proofs without equating them to complete native recovery. Honor scoped authority and the build-mode single-holder decision. + +## T32 - Accept independent effect-to-outbox-to-audit reconciliation + +```task +id: CUST-WP-0080-T32 +status: todo +priority: high +depends_on: [CUST-WP-0080-T22] +state_hub_task_id: "5a0cb7f7-1cd8-50ba-8af2-a2b13ed34a18" +``` + +Stage: audit acceptance. Owner implementation: Audit Core / emitting owners; AUDIT-WP-0013/0014/0015 and existing emission tasks. + +Completion test: Admit actual sender/source/class inventory and reconcile the first protected effect, atomic outbox and durable independent receiver readback. Account for lag, duplicates, missing classes and failure recovery. Archive custody alone is not source completeness; State Hub remains an index, not credential/evidence custody. + +## T33 - Accept current discovery, version and package-family accuracy + +```task +id: CUST-WP-0080-T33 +status: todo +priority: high +depends_on: [CUST-WP-0080-T12] +state_hub_task_id: "4547ac4c-8893-54fe-ae6e-362682bb7920" +``` + +Stage: discovery acceptance. Owner implementation: Reuse / Repo Manager / capability owners. + +Completion test: Recheck all 70 reviewed capability IDs exactly once against owner source, usable links, truthful limits, versions/aliases and package-family disposition. Verify hosted/provider index parity and recurring drift behavior. Source owners remain authoritative; do not create another capability catalog. + +## T34 - Accept the first unassisted security-flow run + +```task +id: CUST-WP-0080-T34 +status: todo +priority: high +state_hub_task_id: "393b9fcc-323b-5182-92c6-44530fce7efb" +``` + +Stage: operational acceptance. Owner implementation: Activity / Coordination / Custodian; ACTIVITY-WP-0047, CUST-WP-0079. + +Completion test: Admit and activate the existing schedule through its owner path, observe an unassisted firing, checkpoint and changed-state notification, and verify adopted cadence at runtime and receiver. A schedule acknowledgement or source cadence constant does not count. Scheduling never creates action authority. + +## T35 - Accept a second real consumer using the shared adapters + +```task +id: CUST-WP-0080-T35 +status: todo +priority: high +depends_on: [CUST-WP-0080-T23] +state_hub_task_id: "db274192-07d6-5be7-9c1e-d63c5a9fb57f" +``` + +Stage: reuse acceptance. Owner implementation: NetKingdom / provider owners / selected second consumer. + +Completion test: The second actual consumer uses the same producer-owned identity/decision/approval adapters and case contracts. Verify allowed/denied-path parity, version compatibility, upgrade and rollback without a second PDP, token registry or independently copied evaluator. Record the per-consumer integration work. + +## T36 - Accept a clean second installation of the minimal profile + +```task +id: CUST-WP-0080-T36 +status: todo +priority: high +depends_on: [CUST-WP-0080-T23] +state_hub_task_id: "586232a1-57b0-5e04-a61b-fb687bcc8999" +``` + +Stage: installation acceptance. Owner implementation: NetKingdom / provider and installation owners. + +Completion test: Use locked versions/providers and declared optional dependencies to install a minimal profile from clean state. Complete positive/negative journeys and upgrade/recovery instructions with independently checked results. Source reuse alone does not prove installability or portability. + +## T37 - Measure delivery time, runtime cost and performance improvement + +```task +id: CUST-WP-0080-T37 +status: todo +priority: high +state_hub_task_id: "d533ca34-a691-5f8e-8cc2-5f408b679538" +``` + +Stage: measurement. Owner implementation: Resource / telemetry / consumer owners; CUST-WP-0071 where applicable. + +Completion test: Record baseline and comparable after measurements for onboarding time/manual touches, p50/p95 decision/effect latency, scanner throughput/failures, resource/headroom and owner effort with unchanged control coverage. Retain the measured scanner correction as one completed sample; do not generalize it to all workflows. + +## T38 - Reconcile requirement-level exceptions and explicit deferrals + +```task +id: CUST-WP-0080-T38 +status: todo +priority: high +state_hub_task_id: "2350a829-bd8c-5c3b-9f39-07bfa1c3f228" +``` + +Stage: governance evidence. Owner implementation: Custodian / governance / affected owners; close-down checklist and actual founder decisions. + +Completion test: Map each remaining exception/deferral to the exact SEC-DSM requirement, scope, real approval reference, risk, compensating controls, owner and review/revalidation. Preserve missing approvals as open; never invent assent, backfill a scored success or promote all residuals. Required leftovers become live work records before finishing. + +## T39 - Accept declared source and delivery entry-path coverage + +```task +id: CUST-WP-0080-T39 +status: todo +priority: high +depends_on: [CUST-WP-0080-T20, CUST-WP-0080-T28] +state_hub_task_id: "da6ae9a3-9107-5ca7-adb2-c9d85b3c529c" +``` + +Stage: delivery acceptance. Owner implementation: Forge / Repo Manager / enablement; RMGR-WP-0021 and existing Forge owner work. + +Completion test: Reconcile the production-repository denominator and actual SSH/HTTP/UI/new-repository/import/mirror entry paths, required checks and artifact provenance. Keep the external-submodule compatibility exception visible. Assess any necessary FORGE-WP-0008 residual dependency for explicit owner-scoped promotion before implementation; existing hook presence alone cannot close TSA-10. + +## T40 - Accept a private finding through classification and response + +```task +id: CUST-WP-0080-T40 +status: todo +priority: high +depends_on: [CUST-WP-0080-T39] +state_hub_task_id: "8e71f6f0-9fc3-509b-8f1b-768f7d9cbd0e" +``` + +Stage: response acceptance. Owner implementation: Repo Manager / Forge / incident and credential-custody owners; RMGR-WP-0021-T04. + +Completion test: Run an admitted private synthetic finding through the actual detection, classification, custody/response and resolution path with sanitized independent receipts. Establish owner responsibility for revocation where relevant. Rejecting a push or deleting source material does not itself prove incident resolution; do not send raw findings or credentials through coordination messages. + +## Acceptance coverage and close-down + +| Architecture gate | Custodian evidence checkpoints | +| --- | --- | +| TSA-01 | T07, T21 | +| TSA-02 | T07, T16, T22 | +| TSA-03 | T08, T10, T17, T18, T22 | +| TSA-04 | T09, T10, T14, T15, T16, T17, T18, T19, T23 | +| TSA-05 | T24, T25, T26 | +| TSA-06 | T13, T27, T28 | +| TSA-07 | T29, T30 | +| TSA-08 | T31 | +| TSA-09 | T32 | +| TSA-10 | T11, T20, T28, T39, T40 | +| TSA-11 | T12, T33 | +| TSA-12 | T34 | +| TSA-13 | T07, T08, T09, T35 | +| TSA-14 | T36 | +| TSA-15 | T37 | +| TSA-16 | T04, T38 | + +| Gap | Custodian evidence checkpoints | +| --- | --- | +| G01 | T24 | +| G02 | T08-T10, T14-T19, T23 | +| G03 | T07, T16, T21, T22 | +| G04 | T29, T30 | +| G05 | T13, T27 | +| G06 | T32 | +| G07 | T11, T20, T28, T39, T40 | +| G08 | T29, T31 | +| G09 | T30, T38 | +| G10 | T38 | +| G11 | T31 | +| G12 | T28-T30 | +| G13 | T07, T21 | + +All mapped checkpoints retain their stated scope. A completed source checkpoint +does not close a gate that also requires native or consumer evidence. The original +requirement ledger remains the requirement-level denominator. Uncovered work +stays live; no required gate becomes a residual merely to finish this plan. diff --git a/docs/netkingdom-security-gaps.md b/docs/netkingdom-security-gaps.md index b3ef32f9..72635b59 100644 --- a/docs/netkingdom-security-gaps.md +++ b/docs/netkingdom-security-gaps.md @@ -6,6 +6,12 @@ Coordinator: CUST-WP-0080. Existing owner work remains authoritative. Statuses below distinguish actual defects, incomplete integration and missing verification. No whole-estate SEC-DSM conformance or maturity level is claimed. +**18 October sequencing:** the founder authorized good-case-first delivery. +WP-80 leads with Playwright human/agent use, then everyday Forgejo. The security +gaps below remain open under [CUST-WP-0082](../workplans/CUST-WP-0082-netkingdom-security-hardening.md), +with [all original task and requirement mappings](changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/hardening-handoff.json). +Their deferral does not mean they were fixed. Close-down row 25 records the scope. + ## Gaps ordered for execution | ID | Gap and current evidence | Existing owner work | Closure evidence | diff --git a/docs/netkingdom-target-implementation.md b/docs/netkingdom-target-implementation.md index 979e7df2..92ff0718 100644 --- a/docs/netkingdom-target-implementation.md +++ b/docs/netkingdom-target-implementation.md @@ -4,6 +4,15 @@ Coordinator: CUST-WP-0080. Target: [security architecture](netkingdom-target-sec Started 16 October 2026 under the founder's explicit implementation and GPT-6.1-Sol medium subagent request. The full architecture remains the goal. +**Current sequencing, 18 October:** actual founder direction +`9663d4ca-3793-4ad7-9dc1-954001d43596` puts working Playwright human/agent access +first and everyday Forgejo development next. Both supervised-build Playwright +trials passed. Full security acceptance and its original criteria now live in +[CUST-WP-0082](../workplans/CUST-WP-0082-netkingdom-security-hardening.md). +[Receipts and exact handoff](changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/README.md). +Historical requirements below remain evidence of the target, not prerequisites +that silently override the founder's revised functional exit. + For current delivery checkpoints, completed outputs and the next action, use the [WP-80 delivery overview](../workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md). This implementation record retains detailed history. The workplan separates diff --git a/docs/netkingdom-target-security-architecture.md b/docs/netkingdom-target-security-architecture.md index 166caff1..5a878da9 100644 --- a/docs/netkingdom-target-security-architecture.md +++ b/docs/netkingdom-target-security-architecture.md @@ -2,6 +2,12 @@ Version 1, 16 October 2026. Implementation coordinator: [CUST-WP-0080](../workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md). +**18 October delivery sequencing:** the founder prioritized working Playwright +human/agent access, then everyday Forgejo use. WP-80 now accepts those functional +flows under their stated build profile. The full security acceptance contract +below remains the target in [CUST-WP-0082](../workplans/CUST-WP-0082-netkingdom-security-hardening.md). +This defers work; it does not establish conformance or change the target. + NetKingdom will provide a small set of reusable, independently verified security workflows. Identity, access decisions, approvals, credential custody and audit retain their existing owners. Consumers share adapters and case templates instead diff --git a/docs/security-close-down-checklist.md b/docs/security-close-down-checklist.md index 2f6079ae..671d7a81 100644 --- a/docs/security-close-down-checklist.md +++ b/docs/security-close-down-checklist.md @@ -31,3 +31,4 @@ Add a row whenever you loosen, shortcut or leave unarmed a control. Remove nothi | 22 | CI runner authority boundary (CUST-WP-0080 G12) | Reproduced unauthenticated cross-pod Docker access is closed: same-image generation 4 listens on loopback only, local ping and heartbeat pass, peer pod denied. [Evidence](evidence/2026-10-13-netkingdom-security/forge-runner-loopback-activation.json). Host-mode jobs still share the privileged runner; no full isolation or job-scoped credential claim. | Complete native workflow authority, required detection checks, job identity/expiry and privileged runner trust boundaries under FORGE-WP-0006 / RMGR-WP-0021. Preserve loopback-only listener across deployments. | railiance-forge, railiance-enablement, railiance-platform; source railiance-apps | 2026-10-13 | | 23 | Traefik HTTPS upload read budget | Activated 2026-10-13 under the founder-approved publication fix: shared websecure readTimeout raised from 60s to bounded 600s. Traefik generation 2 Ready; five previously failing Forgejo OCI blobs completed in 85–183s, exact tested image digest published. Evidence: railiance-cluster RCLUSTER-WP-0016 and rapp-playwright/docs/evidence/2026-10-13-publication.md. TLS and registry authentication stay enforced. | At production close-down review the 600s body-read budget and slow-upload exposure; retain a measured artifact-upload budget or isolate the registry entry point. Do not disable timeouts. | railiance-cluster / railiance-forge | 2026-10-13 | | 24 | Metered spend settlement (rein-aharness spend envelopes) | Opt-in per envelope since 2026-10-14 (rein-aharness `c7dceee`, `c04d1c6`; owner decision `a93619a9`): `settlement: observed-usage` charges a completed provider request its gateway-metered cost (provider-reported tokens at admitted rates) instead of its full hold, and a run max(metered requests, reported/attested cost). Unfinished requests keep full hold; overrun still freezes the envelope; `full-hold` stays the default. First use: memo `infd-20261014-b01` (3 attempts, EUR 10). Provider-reported usage is trusted until billing is compared. | Compare each observed-usage envelope's charges with provider billing before renewal; decide whether observed-usage stays allowed or envelopes return to full-hold. | rein-aharness, owner | 2026-10-14 | +| 25 | WP-80 functional delivery before full security acceptance | Founder decision `9663d4ca-3793-4ad7-9dc1-954001d43596` prioritizes working development flows and permits later hardening. Actual Playwright human/agent commands pass through the existing authenticated workstation port-forward; this is a supervised build profile, without independent per-caller identity acceptance. No credentials distributed, new target enabled or installed control disabled. Nineteen full checkpoints and six remaining acceptance scopes transfer to live CUST-WP-0082; ledger statuses and the full target stay unchanged. [Scope and evidence](changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/README.md). | Promote/revalidate relevant hardening before customer production, target expansion or broader unattended authority. Verify the full current-identity, per-caller transport/isolation, lifecycle, recovery and audit criteria in CUST-WP-0082; close all 16 target gates and reconcile all 116 ledger entries. No automatic production approval or blanket formal requirement exception. | Custodian coordinates; existing KeyCape / Platform / NetKingdom / Forge / Apps / custody and audit owners implement | 2026-10-18 | diff --git a/infra/security-flow/playwright-delivery.json b/infra/security-flow/playwright-delivery.json index 252e0024..2af22e36 100644 --- a/infra/security-flow/playwright-delivery.json +++ b/infra/security-flow/playwright-delivery.json @@ -1,15 +1,15 @@ { "case_id": "case:cross-owner:CUST-WP-0080-T05:playwright-delivery", "scenario_type": "cross_owner_wait", - "observed_at": "2026-10-13", + "observed_at": "2026-10-18", "coordinating_owner": "the-custodian / custodian-codex", "beneficiary_workplan_id": "CUST-WP-0080", "beneficiary_task_id": "CUST-WP-0080-T05", "obligor_repo": "railiance-platform", "obligor_workplan_id": "RPF-WP-0056", "obligor_task_id": "RPF-WP-0056-T03", - "state": "waiting", - "reason": "Pilot and scoped RBAC delivered; same-image abrupt recovery now verified by provider receipts. Remaining delivery: exact owner registration/custody/authenticator/transport revisions, real human/agent trials, provider acceptance and managed discovery; cross-version rollback remains unproven in provider T01.", + "state": "functional_build_profile_delivered", + "reason": "Actual founder good-case-first direction9663d4ca: human and coding-agent supported-command Playwright runs passed. Full distinct-caller security delivery remains in CUST-WP-0082-T21 and existing owners.", "request_message_id": "1b279bad-a159-43da-8709-1167882e62f8", "driver_lookup": { "local_project_workplans_scanned": 10, @@ -129,44 +129,33 @@ ], "dependency_order": [ { - "milestone": "M1", + "milestone": "B1", "requires": [], - "deliverable": "Collect reviewed owner source tasks, exact registration/claim contract, governed per-agent custody route, supported per-caller transport and authenticator rollback proposal. Reviews can proceed independently; do not infer rollout authority." + "deliverable": "Delivered: existing connection and provider client; actual human and agent responsive/keyboard trials passed." }, { - "milestone": "M2", + "milestone": "B2", "requires": [ - "M1" + "B1" ], - "deliverable": "Owners activate reviewed issuer/registration, API authenticator and per-caller transport in dependency order. Platform integrates one-command login/connect/trial with renewal, actionable failures and cleanup." + "deliverable": "Publish repeatable owner commands, exact build-profile limits and measured steps; retain existing owner security records." }, { - "milestone": "M3", - "requires": [ - "M2" - ], - "deliverable": "Real human and registered agent independently prove API-returned identity, least-privilege permissions and responsive/keyboard browser trials. Native wrong-audience, missing-scope, expired/tampered and ineligible-identity attempts fail. Prove revocation/active connection termination and retain remaining JWT lifetime limits." - }, - { - "milestone": "M4", - "requires": [ - "M3" - ], - "deliverable": "Platform/provider accept real consumer receipts, retain delivered same-image abrupt recovery and explicit cross-version rollback limitation; publish docs and update existing capability.infotech.headless-browser managed availability; read back discovery." + "milestone": "H1", + "requires": [], + "deliverable": "Deferred: promote CUST-WP-0082-T21 for original registration/custody/JWT-authenticator/per-caller transport and full consumer security acceptance." } ], - "first_executable_milestone": "M1: NetKingdom registration preparation delivered in NK-WP-0050-T01; finish T02 custody/guarded activation integration, and obtain KeyCape, cluster and ops-bridge exact owner source revisions before M2 live activation.", + "first_executable_milestone": "B1 delivered: supported client trials passed; Forgejo positive development flow is the next WP-80 milestone.", "unresolved_user_policy_decision": null, "eligibility": "All identified platform humans and coding agents already admitted; no repeat membership approval.", "constraints": [ - "First delivery uses scoped port-forward and supported per-caller API transport; no new gateway required.", - "No shared admin kubeconfig/workstation SSH identity; no Secrets/exec/workload writes/other namespaces or new targets.", - "Human platform login and distinct registered governed agent identities.", - "No synthetic token/admin impersonation acceptance substitute.", - "Client disablement stops issuance; existing JWTs persist to expiry and active connections require termination.", - "No foreign task statuses changed or owner approvals invented; no workers injected." + "Supervised build profile uses the existing authenticated workstation connection; no credential distribution or independent agent-identity claim.", + "No new cluster configuration, target grant, gateway or browser client.", + "Original security constraints remain in security_delivery_before_build_mode and CUST-WP-0082-T21.", + "Do not change owner task statuses or infer owner approvals from functional receipts." ], - "availability_observed": "Managed pilot and same-image abrupt recovery verified; real consumer identity/transport and final managed availability remain pending. Local provider discovery is published.", + "availability_observed": "Actual human and agent browser operation verified through existing supervised connection. General independently authenticated self-service remains unaccepted.", "owner_progress": [ { "message_id": "a2449fe0-ba12-47b8-9ca3-d7deedc089c3", @@ -197,5 +186,52 @@ "live_activated": false, "identity_acceptance": false } - ] + ], + "security_delivery_before_build_mode": { + "observed_at": "2026-10-13", + "state": "waiting", + "reason": "Pilot and scoped RBAC delivered; same-image abrupt recovery now verified by provider receipts. Remaining delivery: exact owner registration/custody/authenticator/transport revisions, real human/agent trials, provider acceptance and managed discovery; cross-version rollback remains unproven in provider T01.", + "dependency_order": [ + { + "milestone": "M1", + "requires": [], + "deliverable": "Collect reviewed owner source tasks, exact registration/claim contract, governed per-agent custody route, supported per-caller transport and authenticator rollback proposal. Reviews can proceed independently; do not infer rollout authority." + }, + { + "milestone": "M2", + "requires": [ + "M1" + ], + "deliverable": "Owners activate reviewed issuer/registration, API authenticator and per-caller transport in dependency order. Platform integrates one-command login/connect/trial with renewal, actionable failures and cleanup." + }, + { + "milestone": "M3", + "requires": [ + "M2" + ], + "deliverable": "Real human and registered agent independently prove API-returned identity, least-privilege permissions and responsive/keyboard browser trials. Native wrong-audience, missing-scope, expired/tampered and ineligible-identity attempts fail. Prove revocation/active connection termination and retain remaining JWT lifetime limits." + }, + { + "milestone": "M4", + "requires": [ + "M3" + ], + "deliverable": "Platform/provider accept real consumer receipts, retain delivered same-image abrupt recovery and explicit cross-version rollback limitation; publish docs and update existing capability.infotech.headless-browser managed availability; read back discovery." + } + ], + "first_executable_milestone": "M1: NetKingdom registration preparation delivered in NK-WP-0050-T01; finish T02 custody/guarded activation integration, and obtain KeyCape, cluster and ops-bridge exact owner source revisions before M2 live activation.", + "constraints": [ + "First delivery uses scoped port-forward and supported per-caller API transport; no new gateway required.", + "No shared admin kubeconfig/workstation SSH identity; no Secrets/exec/workload writes/other namespaces or new targets.", + "Human platform login and distinct registered governed agent identities.", + "No synthetic token/admin impersonation acceptance substitute.", + "Client disablement stops issuance; existing JWTs persist to expiry and active connections require termination.", + "No foreign task statuses changed or owner approvals invented; no workers injected." + ], + "availability_observed": "Managed pilot and same-image abrupt recovery verified; real consumer identity/transport and final managed availability remain pending. Local provider discovery is published." + }, + "functional_receipts": "docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/README.md", + "hardening_workplan": "CUST-WP-0082", + "hardening_task": "CUST-WP-0082-T21", + "founder_sequencing_decision": "9663d4ca-3793-4ad7-9dc1-954001d43596" } diff --git a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md index 997ddefe..53e74506 100644 --- a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md +++ b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md @@ -1,7 +1,7 @@ --- id: CUST-WP-0080 type: workplan -title: "NetKingdom target security architecture and SEC-DSM implementation" +title: "NetKingdom working development flows and explicit hardening handoff" domain: infotech repo: the-custodian status: active @@ -17,63 +17,58 @@ state_hub_workstream_id: "dfadb19b-445e-59c6-bcd6-48e87b912c52" # WP-80 delivery overview -Updated 18 October 2026 after the founder requested clearer progress and smaller tasks. +Updated 18 October 2026 under the founder's explicit good-case-first direction, +decision `9663d4ca-3793-4ad7-9dc1-954001d43596`. -| Measure | Current state | Meaning | +| Delivery milestone | Status | Observable result / remaining work | | --- | --- | --- | -| Completed source evidence checkpoints | **7 of 7**: T07-T13 | Published/reviewed foundations at their stated scope; no native acceptance inferred. | -| Remaining integration/build checkpoints | **0 of 6**: T14-T19 | Current ongoing access, protected operation/inverse, writer exclusion and final build still need completion. | -| Delivery checkpoints overall | **8 done, 0 in progress, 26 todo**: T07-T40 | Discrete Custodian evidence checkpoints linked to existing owner implementation work. | -| Complete native architecture gates | **0 of 16**: TSA-01-TSA-16 | Each requires its full deployed/consumer evidence. This is not 0% engineering progress. | -| Original coordination records | **2 of 6 done**: T01-T06 | Stable umbrella IDs/UUIDs retained for existing callers; not a delivery percentage. | +| 1. Playwright for a human and coding agent | **Delivered in the supervised build profile** | Both actual supported-command trials passed on railiance01, each with 14 steps, keyboard interaction and desktop/mobile screenshots. T25/T26. | +| 2. Everyday Forgejo development | **Next; not yet accepted** | Record the actual release, verify supported sign-in and everyday Git/API use, then publish the entry commands. T19/T23. | +| 3. Repeatable entry points and close-out | **In progress** | Supported commands, measured steps/manual touches, exact source/Hub readback and final functional audit. T33/T37/T38/T04. | +| Earlier delivered engineering | **8 checkpoints** | Seven bounded source reviews T07-T13 plus the native scanner/publication repair T20. These retain their original scope. | +| Security hardening | **Deferred, not fixed** | 19 complete checkpoints and 6 remaining acceptance scopes transferred to live CUST-WP-0082. All 16 full architecture gates remain unaccepted. | -**Completed - T20:** the founder-admitted scanner revision passed native activation, -including 166 scanner fragments, 1,328 protected hook files, both-version startup -custody, actual template inheritance, receive-pack refusal/recovery and cleanup. -Normal publication pushed all five queued Custodian commits; exact Hub readback -verified all 40 task UUID/status bindings. The publication blocker is cleared. -This scoped scanner acceptance does not close a complete architecture gate. +**What works now:** the existing Playwright service, provider client and loopback +port-forward delivered actual agent and human trials. See the +[commands and receipts](../docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/README.md). +This is a supervised development connection; independently authenticated human +and registered-agent transport remains hardening work. No new service, gateway, +identity evaluator or browser client was built. -**Next - T14/T15:** implement and verify the selected current KeyCape checks on -ongoing browser/API/Git HTTP and SSH paths, using the existing producer clients. -Then T16-T19 finish exact operation/inverse, writer exclusion and the final release. -While one native checkpoint awaits a concrete approval/owner return, one independent -source checkpoint may progress. Limit active delivery work to two checkpoints. +**Next:** T19 first checks whether the already deployed Forgejo release supports +the selected positive flow. Build or integrate only a demonstrated functional +blocker; then T23 verifies actual sign-in and everyday Git/API use. Broader current +identity, inverse, writer-exclusion and negative matrices are no longer blanket +prerequisites for the good case. Keep at most two delivery checkpoints active. -**Already delivered:** shared signed-decision/approval foundations; the current-token -client and fresh inverse-session verification; actual issuer-to-Forgejo login; -PostgreSQL crash/restart and inverse mechanics; the bounded scanner correction; -provider index/parity repairs; workload-isolation fixture proof. T07-T13 carry the -scope and evidence for each. The new completed records expose existing delivered -work; they do not represent seven newly deployed systems. +**Scope and exit:** finish the two working flows, supported owner entry commands, +bounded measurements and final source/Hub consistency check, with every remaining +security obligation linked to the live +[hardening plan](CUST-WP-0082-netkingdom-security-hardening.md). +The full [target](../docs/netkingdom-target-security-architecture.md), G01-G13, +all 116 ledger entries and the founder's choice of current KeyCape checks on each +API/Git/SSH operation remain the security target. Sequencing does not establish +conformance or approve a permanent weaker architecture. -**Publication and Hub view:** normal source publication is working again. -The five queued Custodian commits were published through c1fcd948; all 40 task -records (six original coordination records plus 34 delivery checkpoints) are -present in the Hub with verified source bindings. T20 is now complete. The Hub -remains the derived view; this file owns checkpoint status. Subsequent source -changes use the same ordinary commit/consistency path. +**Progress accounting:** transferred original tasks retain their IDs/UUIDs and +use `cancel` with an explicit handoff, rather than `done`. Narrowed functional +tasks retain their original security criteria in WP-82. The exact +[handoff map](../docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/hardening-handoff.json) +preserves every original binding and every requirement. Do not calculate a +completion percentage from cancelled tasks or mix source proof with deployment. -**Scope:** all 16 gates, G01-G13 and all 116 SEC-DSM ledger entries remain required. -[Target and acceptance contract](../docs/netkingdom-target-security-architecture.md), -[owner implementation record](../docs/netkingdom-target-implementation.md), -[gap register](../docs/netkingdom-security-gaps.md), -[requirement ledger](../docs/evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json). -Existing scoped approvals, deferrals, independent owner assent and explicit residual -promotion rules remain effective. This refinement grants no runtime authority. +**Reuse and ownership:** existing owner workplans own implementation. Custodian +owns these evidence checkpoints and the Hub derives them from files. Discover an +existing capability before coding, use its producer client and canonical owner +entry point, and route a missing feature to that owner. WP-82 coordinates the +existing backlogs rather than duplicating them. No new owner approvals or runtime +authority are inferred from the founder's sequencing decision. -**Ownership and updates:** T07-T40 are Custodian review/acceptance checkpoints, not -replacement owner implementation tasks. Owner files own implementation status; -this file owns coordination/evidence-checkpoint status; the Hub is its derived view. -Every progress update names the checkpoint, concrete output, exact evidence scope, -remaining acceptance and next action. Link original evidence rather than recopying -it. Re-run checks only for changed inputs, failures or a specific unresolved concern. -Route new findings into the existing owner record and mapped checkpoint before -adding another workplan. Do not infer an overall percentage from mixed-stage counts. - -The complete prior task/session history is preserved byte-for-byte in the -[pre-refinement snapshot](../docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/workplan-before-refinement.txt). -No old task binding or status was replaced; history is evidence, not a second live backlog. +**Publication:** the native scanner repair and ordinary source publication are +complete; all 40 original task bindings were verified after T20. Every later plan +edit must pass the same normal consistency/publication path and current readback. +The [before-change snapshot](../docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/workplan-before.txt) +retains the previous acceptance contract and task bodies verbatim. ## Review canon and map actual architecture @@ -97,7 +92,7 @@ state_hub_task_id: "5973026f-8ca9-5882-99fe-65a54bc250ac" Completed trust-boundary, owner, lifecycle and dependency inspection. Delivered the [gap analysis](../docs/netkingdom-security-gaps.md) and target direction. This completed design review does not claim native conformance. -## Close source defects and reconcile uncovered lifecycle gaps +## Drive functional blockers and preserve the hardening handoff ```task id: CUST-WP-0080-T03 @@ -106,9 +101,9 @@ priority: high state_hub_task_id: "87637402-02f1-57c1-8fbc-4141598af8e3" ``` -Coordination umbrella. Drive remaining source/lifecycle closure through the existing owners and specific checkpoints, especially T14-T19, T29-T31 and T38-T40. Preserve G04/G07/G08/G10/G12/G13, original source defects and all existing owner obligations. T07-T13 expose completed bounded source reviews; they do not close this umbrella. Close only when all source/lifecycle findings have verified completion or a valid governed handoff consistent with the full target. +Coordination umbrella. Complete demonstrated functional blockers for Playwright first and Forgejo next using existing owners. Security closure moves to CUST-WP-0082 with original criteria and requirement mappings. Close after functional blockers are resolved and the live handoff is verified; do not imply full security closure. -## Verify native closure against every requirement +## Audit the working development flows and live handoff ```task id: CUST-WP-0080-T04 @@ -118,21 +113,20 @@ priority: high state_hub_task_id: "82378b0f-7004-5c2f-9683-b356a1227576" ``` -Final acceptance audit. Reconcile every TSA-01-TSA-16 gate, G01-G13 and all 116 individual requirements with exact current evidence or an actually approved applicable exception. Require the human/agent journeys, second real consumer, clean installation and operational acceptance. Plans, source tests and owner handoffs are insufficient. Transfer any permitted residuals into live records before finishing; preserve required work and explicit deferrals. +Final WP-80 acceptance: actual human and coding-agent Playwright trials; actual positive Forgejo sign-in and everyday Git/API use; usable owner commands, bounded measurements, source/Hub readback and all deferred requirements linked to CUST-WP-0082. The original full sixteen-gate/116-requirement audit is retained in CUST-WP-0082-T25. No security conformance is inferred. -## Coordinate self-service Playwright identity delivery +## Coordinate working Playwright access ```task id: CUST-WP-0080-T05 -status: progress +status: done priority: high -depends_on: [RPF-WP-0056, RAPP-PLAYWRIGHT-WP-0004] state_hub_task_id: "ed8b909a-23bf-5e5f-b600-e477fbae136b" ``` -Coordination umbrella for T25/T26 and supported consumer/discovery evidence. Retain incoming request `1b279bad-a159-43da-8709-1167882e62f8`, [existing delivery case](../infra/security-flow/playwright-delivery.json), RPF-WP-0056-T03 and RAPP-PLAYWRIGHT-WP-0004-T01/T03. Existing eligible platform humans/coding agents need no renewed membership decision. Collect exact registration/custody/authenticator/per-caller transport returns and Platform/provider native acceptance. Do not substitute a deployed browser, shared admin kubeconfig or accepted provider-only crash proof for the actual human/agent journeys. +Coordination umbrella for T25/T26. Reuse the deployed provider, client and documented connection. Accept the real human and coding-agent supported-command trials with their actual build profile stated. The registration/custody/JWT-authenticator/per-caller identity acceptance remains in CUST-WP-0082-T21 and existing RPF-WP-0056 / NK-WP-0050 / RAPP-PLAYWRIGHT-WP-0004 owner records. Incoming request 1b279bad-a159-43da-8709-1167882e62f8 and infra/security-flow/playwright-delivery.json retain the history; no new membership decision is needed. -## Establish the target architecture and drive the restructuring +## Deliver the good cases using the existing owner architecture ```task id: CUST-WP-0080-T06 @@ -141,7 +135,7 @@ priority: high state_hub_task_id: "6aca534c-5c7a-556f-b6b6-406433670c29" ``` -Coordination umbrella for the full target and owner sequencing. Preserve independently owned security meaning, identity, authorization, approval, custody and audit; reuse producer clients, case templates and owner workplans. Keep all sixteen gates and the complete ledger in scope. This task closes with the target exit condition and T04 audit, not another source wave. Prior delegation is historical evidence, not an inherited runtime/autopilot grant. +Coordination umbrella. Complete the revised functional exit and T04 audit, preserve producer ownership and shared adapters, and retain the full target in CUST-WP-0082. This sequencing does not grant runtime/autopilot authority or mark the security architecture complete. ## T07 - Review signed decision and approval interoperability @@ -252,85 +246,68 @@ Published workload-only credential delivery passed 141 tests and actual disposab ```task id: CUST-WP-0080-T14 -status: todo +status: cancel priority: high -depends_on: [CUST-WP-0080-T09] state_hub_task_id: "7ecbd622-03a8-5b49-9621-8d21d7d15890" ``` -Stage: source integration. Owner implementation: Apps / KeyCape / Access; RAPPS-WP-0016-T09, NK-WP-0048-T43. - -Completion test: Actual shared authentication routes enforce current linked account/source/subject/application-tenant bindings, current groups and exact resource/action policy. Tests must cover revoked, suspended, expired, unavailable and mismatched identity, plus terminal refusal without fallback. Preserve the separate local break-glass path and prevent federated unlink/downgrade escape. +Transferred, not implemented: the original security acceptance and implementation-owner references now live in CUST-WP-0082-T01 in [WP-82](CUST-WP-0082-netkingdom-security-hardening.md). Founder sequencing decision 9663d4ca-3793-4ad7-9dc1-954001d43596. Original identity and history are retained; this cancellation counts as deferred work, not completed delivery. ## T15 - Verify current identity on the independent SSH path ```task id: CUST-WP-0080-T15 -status: todo +status: cancel priority: high -depends_on: [CUST-WP-0080-T14] state_hub_task_id: "434d9c78-7789-5b78-8d9d-d87b0638b469" ``` -Stage: source integration. Owner implementation: Apps / KeyCape / Access; RAPPS-WP-0016-T09, NK-WP-0048-T43. - -Completion test: The actual private SSH service checks the same producer-owned identity and policy contract before repository creation or effects. Native SSH keys cannot bypass current linked identity. Positive, denial, revocation, unavailable and account/source mismatch cases pass; local break-glass behavior is covered. +Transferred, not implemented: the original security acceptance and implementation-owner references now live in CUST-WP-0082-T02 in [WP-82](CUST-WP-0082-netkingdom-security-hardening.md). Founder sequencing decision 9663d4ca-3793-4ad7-9dc1-954001d43596. Original identity and history are retained; this cancellation counts as deferred work, not completed delivery. ## T16 - Verify exact current authority for the protected Forgejo operation ```task id: CUST-WP-0080-T16 -status: todo +status: cancel priority: high -depends_on: [CUST-WP-0080-T07, CUST-WP-0080-T08, CUST-WP-0080-T09] state_hub_task_id: "e6183073-cc8e-5c6f-8fbd-db50bb1a466c" ``` -Stage: source integration. Owner implementation: NetKingdom / Warden / Apps / Approval / Access; existing NK-WP-0048 operation tasks. - -Completion test: The actual operation entry path authenticates the current actor/session and binds tenant, exact target/action, payload/source revision, decision and required approval before journal writes or owner effects. Wrong actor/body/tenant, expired authority, unavailable producers and business replay refuse. Existing producer contracts remain authoritative. +Transferred, not implemented: the original security acceptance and implementation-owner references now live in CUST-WP-0082-T03 in [WP-82](CUST-WP-0082-netkingdom-security-hardening.md). Founder sequencing decision 9663d4ca-3793-4ad7-9dc1-954001d43596. Original identity and history are retained; this cancellation counts as deferred work, not completed delivery. ## T17 - Verify the fresh inverse and durable private recovery journal ```task id: CUST-WP-0080-T17 -status: todo +status: cancel priority: high -depends_on: [CUST-WP-0080-T16] state_hub_task_id: "4de46468-7ae2-59e3-be2b-1a32506153a5" ``` -Stage: source integration. Owner implementation: Apps / Warden / NetKingdom; RAPPS-WP-0016-T07/T08 and existing NK-WP-0048 inverse tasks. - -Completion test: An exact prior operation can be reconciled and inversed with fresh current authority while retaining original provenance and unknown outcomes. Private journal custody, permissions, persistence, retention and recovery are explicit. Cover public client, unchanged secret delivery and failure before hand-over receipt; receipt deletion alone is not the inverse. +Transferred, not implemented: the original security acceptance and implementation-owner references now live in CUST-WP-0082-T04 in [WP-82](CUST-WP-0082-netkingdom-security-hardening.md). Founder sequencing decision 9663d4ca-3793-4ad7-9dc1-954001d43596. Original identity and history are retained; this cancellation counts as deferred work, not completed delivery. ## T18 - Verify exclusion of every Forgejo release writer ```task id: CUST-WP-0080-T18 -status: todo +status: cancel priority: high -depends_on: [CUST-WP-0080-T10, CUST-WP-0080-T16] state_hub_task_id: "fd796e9c-dd70-5c65-a6fe-eafe3911bc8f" ``` -Stage: source integration. Owner implementation: Apps / NetKingdom / deployment owners; existing NK-WP-0048 writer obligations. +Transferred, not implemented: the original security acceptance and implementation-owner references now live in CUST-WP-0082-T05 in [WP-82](CUST-WP-0082-netkingdom-security-hardening.md). Founder sequencing decision 9663d4ca-3793-4ad7-9dc1-954001d43596. Original identity and history are retained; this cancellation counts as deferred work, not completed delivery. -Completion test: Inventory and constrain every actual release/configuration writer for prepare/check/effect/inverse, including uncooperative writers. Demonstrate target drift and concurrent-write refusals at the declared database/release scope. A local advisory lock or the earlier source transaction test alone cannot close this checkpoint. - -## T19 - Verify the complete final Forgejo release and OCI artifact +## T19 - Record the Forgejo release needed for the positive flow ```task id: CUST-WP-0080-T19 -status: todo +status: progress priority: high -depends_on: [CUST-WP-0080-T14, CUST-WP-0080-T15, CUST-WP-0080-T16, CUST-WP-0080-T17, CUST-WP-0080-T18] +depends_on: [CUST-WP-0080-T25, CUST-WP-0080-T26] state_hub_task_id: "4ffd2e33-d887-5686-bad1-7f32a56191a8" ``` -Stage: artifact build. Owner implementation: Apps; RAPPS-WP-0016 build/operation tasks. - -Completion test: Build the final integrated revision with pinned source/tool/dependency inputs, all frontend/static assets and the static backend. Verify release CLI/source parity, complete required checks, artifact hashes and the local OCI package. Prior 40-path build evidence does not establish a later integrated release. Independent admission and live acceptance remain T23. +Stage: functional release readiness. Owner implementation: Apps / Forge; existing release records. First identify the current deployed image, source revision and supported sign-in/Git/API behavior. Reuse it if it delivers the selected good case. Build an exact owner revision with required assets and ordinary checks only if a demonstrated functional blocker requires it. No automatic new rollout. The complete integrated security artifact acceptance remains CUST-WP-0082-T20. ## T20 - Accept the native receive-scanner correction and ordinary publication @@ -350,31 +327,25 @@ Completed: [exact revision 1](../docs/changes/netkingdom-target-2026-10-18/recei ```task id: CUST-WP-0080-T21 -status: todo +status: cancel priority: high -depends_on: [CUST-WP-0080-T07] state_hub_task_id: "fa11a2a4-4dbd-5dfb-ad29-bc7a99cc6258" ``` -Stage: native acceptance. Owner implementation: Secrets / Access / Platform; SECRETS-WP-0014, FLEX-WP-0024. - -Completion test: Admit exact producer package, signer/channel, independent consumer trust and caller/policy bindings. Account for the privileged PEP denominator and prove native forged, altered, wrong-key, unsigned/downgrade, expired, unavailable and rotation refusals. Source fixtures do not close TSA-01. +Transferred, not implemented: the original security acceptance and implementation-owner references now live in CUST-WP-0082-T06 in [WP-82](CUST-WP-0082-netkingdom-security-hardening.md). Founder sequencing decision 9663d4ca-3793-4ad7-9dc1-954001d43596. Original identity and history are retained; this cancellation counts as deferred work, not completed delivery. ## T22 - Accept one native approved operation and crash recovery ```task id: CUST-WP-0080-T22 -status: todo +status: cancel priority: high -depends_on: [CUST-WP-0080-T21, CUST-WP-0080-T16, CUST-WP-0080-T17, CUST-WP-0080-T18] state_hub_task_id: "88588db8-8c6e-5d15-a85b-2c068f4e8a2a" ``` -Stage: native acceptance. Owner implementation: Platform / Secrets / Approval / Audit; RPF-WP-0035-T12, SECRETS-WP-0013, APPROVAL-WP-0004. +Transferred, not implemented: the original security acceptance and implementation-owner references now live in CUST-WP-0082-T07 in [WP-82](CUST-WP-0082-netkingdom-security-hardening.md). Founder sequencing decision 9663d4ca-3793-4ad7-9dc1-954001d43596. Original identity and history are retained; this cancellation counts as deferred work, not completed delivery. -Completion test: One exact approved effect passes authoritative consume/confirmation, target precondition/readback and independently verified cleanup. Native crash/restart/concurrency preserves unknown outcomes and forbids blind replay; actor/tenant/body/replay/expiry/unavailable negatives pass. Admit real custody and recovery grants. Closes only the declared TSA-02/TSA-03 scope. - -## T23 - Accept the complete first Forgejo browser security case +## T23 - Accept everyday Forgejo sign-in and Git/API use ```task id: CUST-WP-0080-T23 @@ -384,132 +355,108 @@ depends_on: [CUST-WP-0080-T19] state_hub_task_id: "266e228b-7754-5323-b0c6-37f860592d90" ``` -Stage: native acceptance. Owner implementation: NetKingdom / Mason / Warden / KeyCape / Apps; NK-WP-0048. - -Completion test: Admit exact case/type/provider/package revisions and private execution custody. Independently verify native structure, contained registration/delivery, sign-in, denied groups/actions, current ongoing API/Git/SSH access, revocation, exact inverse and rollback. Owner assent and actual deployed receipts are mandatory; a compiled patch or acknowledged case is insufficient. +Stage: functional acceptance. Owners: NetKingdom / KeyCape / Apps / Forge; existing NK-WP-0048 and owner release paths. Use the supported entry points to demonstrate actual sign-in, an everyday permitted Git operation and an API operation under the stated build profile. Record concrete results, limitations and cleanup of any trial objects. Prepare an exact reviewable change if needed; do not deploy without its actual authorization. Full per-operation current identity, denied cases, revocation, exact inverse and rollback remain CUST-WP-0082-T01-T05 and T20. ## T24 - Accept attended U08 factor recovery and fresh sign-in ```task id: CUST-WP-0080-T24 -status: todo +status: cancel priority: high state_hub_task_id: "a4f06ce0-69a5-5cbb-9d78-6c5b89ba9853" ``` -Stage: human journey. Owner implementation: User / KeyCape; USER-WP-0028-T03, KEY-WP-0040. +Transferred, not implemented: the original security acceptance and implementation-owner references now live in CUST-WP-0082-T08 in [WP-82](CUST-WP-0082-netkingdom-security-hardening.md). Founder sequencing decision 9663d4ca-3793-4ad7-9dc1-954001d43596. Original identity and history are retained; this cancellation counts as deferred work, not completed delivery. -Completion test: Requalify the existing User task to the actual founder-attended disable/re-enroll/fresh-login window and obtain its value-free acceptance. KEY-WP-0040 preview/help-link corrections are already accepted; do not request or repeat that preview. No factor mutation is authorized by this plan refinement. - -## T25 - Accept the real human Playwright journey +## T25 - Accept the human Playwright good case ```task id: CUST-WP-0080-T25 -status: todo +status: done priority: high state_hub_task_id: "3be1c76d-a5f3-5dea-9777-349dc97e836e" ``` -Stage: consumer acceptance. Owner implementation: Platform / Playwright / NetKingdom / cluster / bridge; RPF-WP-0056-T03, RAPP-PLAYWRIGHT-WP-0004, NK-WP-0050. +Completed in the supervised build profile. The founder ran the existing provider client and reported passed run d81a5166-83d9-4382-a6e8-a90cfc3f0a51. The local receipt independently confirms 14 passing steps at 1280x800 and 390x844, keyboard focus/Enter interaction and downloaded screenshots. See wp80-build-mode-r1. Uses the existing authenticated workstation connection; no new per-caller identity claim. Complete identity/transport/renewal/revocation acceptance remains CUST-WP-0082-T21. -Completion test: Collect exact registration/custody/JWT-authenticator/per-caller transport owner returns, then run the supported command as one real human. Verify sign-in, scope/permission denial, browser operation, renewal/revocation and recovery, accepted by Platform and provider. Existing qualified humans need no new membership decision. - -## T26 - Accept the registered agent Playwright journey +## T26 - Accept the coding-agent Playwright good case ```task id: CUST-WP-0080-T26 -status: todo +status: done priority: high state_hub_task_id: "0491b6b4-a238-58ef-bf3a-505749e5655c" ``` -Stage: consumer acceptance. Owner implementation: Platform / Playwright / NetKingdom / cluster / bridge; same existing consumer case as T25. - -Completion test: Use one distinguishable registered agent and its admitted per-caller transport, not a shared admin kubeconfig or workstation identity. Verify the supported command, allowed/denied browser/API actions, expiry/cancellation, revocation and cleanup, with Platform/provider acceptance and supported consumer documentation. +Completed in the supervised build profile. The coding agent ran the canonical rapp-playwright client against the deployed railiance01 provider; run 893a8bcb-9b7f-48f1-8a51-c116de3f3097 passed all 14 steps with responsive and keyboard screenshots and matching downloaded hashes. The run capability stays private outside Git. Existing authenticated workstation port-forward was used; no independent registered-agent identity/isolation claim. Those original requirements remain CUST-WP-0082-T21. ## T27 - Accept the actual interactive agent isolation profile ```task id: CUST-WP-0080-T27 -status: todo +status: cancel priority: high -depends_on: [CUST-WP-0080-T13] state_hub_task_id: "19540d29-c4df-5f1a-acf7-127965c9a396" ``` -Stage: runtime acceptance. Owner implementation: Glas / selected rein / Platform / Warden; GLAS-WP-0012, CUST-WP-0073-T02/T04. - -Completion test: Admit this identified running assignment and verify admin-material read denial through files, mounts, environment, subprocesses and available tools, plus allowed task effects, expiry/cancel cleanup and no cross-task credential accumulation. Fixture success or another agent's authority record cannot substitute. +Transferred, not implemented: the original security acceptance and implementation-owner references now live in CUST-WP-0082-T09 in [WP-82](CUST-WP-0082-netkingdom-security-hardening.md). Founder sequencing decision 9663d4ca-3793-4ad7-9dc1-954001d43596. Original identity and history are retained; this cancellation counts as deferred work, not completed delivery. ## T28 - Accept per-job runner authority and workflow-abuse refusals ```task id: CUST-WP-0080-T28 -status: todo +status: cancel priority: high state_hub_task_id: "5ac99f55-0dde-5d1c-b88c-b85f34469abc" ``` -Stage: runtime acceptance. Owner implementation: Forge / Platform / enablement; existing runner and CI owner work. - -Completion test: Verify actual job-specific credential/repository/deployment scope, teardown and abuse tests using repository-controlled workflows. Reuse the accepted Docker listener repair; do not repeat it as new progress. Prove jobs cannot disable the independent receive control or reach unrelated deployment credentials. +Transferred, not implemented: the original security acceptance and implementation-owner references now live in CUST-WP-0082-T10 in [WP-82](CUST-WP-0082-netkingdom-security-hardening.md). Founder sequencing decision 9663d4ca-3793-4ad7-9dc1-954001d43596. Original identity and history are retained; this cancellation counts as deferred work, not completed delivery. ## T29 - Reconcile the current credential and consumer metadata inventory ```task id: CUST-WP-0080-T29 -status: todo +status: cancel priority: high state_hub_task_id: "3ec89fb2-fe97-50f5-a3c9-88b731b0d2ec" ``` -Stage: lifecycle evidence. Owner implementation: Secrets / Mason / Platform / NetKingdom; MASON-WP-0004, NK-WP-0049. - -Completion test: Produce a current metadata-only denominator with owner, purpose, exact scope, issuer/delivery, consumers, copies, expiry/rotation/revocation and recovery/deletion procedures. Unknown/orphan entries remain findings. Identify native-identity elimination candidates. Never retrieve values to improve the inventory. +Transferred, not implemented: the original security acceptance and implementation-owner references now live in CUST-WP-0082-T11 in [WP-82](CUST-WP-0082-netkingdom-security-hardening.md). Founder sequencing decision 9663d4ca-3793-4ad7-9dc1-954001d43596. Original identity and history are retained; this cancellation counts as deferred work, not completed delivery. ## T30 - Accept sampled credential replacement, revocation and copy deletion ```task id: CUST-WP-0080-T30 -status: todo +status: cancel priority: high -depends_on: [CUST-WP-0080-T29] state_hub_task_id: "457400ad-6c44-5160-a77a-63c6ad5acabc" ``` -Stage: lifecycle acceptance. Owner implementation: Secrets / Platform / credential consumers; existing lifecycle plans. - -Completion test: For the admitted samples, demonstrate replacement adoption, old-credential refusal, refresh/deletion semantics and reconciled delivery copies. Preserve the founder-deferred exposure rotation; it requires its actual governing exception/decision rather than silent execution or a completion claim. +Transferred, not implemented: the original security acceptance and implementation-owner references now live in CUST-WP-0082-T12 in [WP-82](CUST-WP-0082-netkingdom-security-hardening.md). Founder sequencing decision 9663d4ca-3793-4ad7-9dc1-954001d43596. Original identity and history are retained; this cancellation counts as deferred work, not completed delivery. ## T31 - Accept independent root recovery with the normal issuer unavailable ```task id: CUST-WP-0080-T31 -status: todo +status: cancel priority: high -depends_on: [CUST-WP-0080-T29] state_hub_task_id: "cbf32375-279a-5bf3-b867-06333a1ff2ca" ``` -Stage: recovery acceptance. Owner implementation: NetKingdom / Warden / Platform / recovery owners; NK-WP-0049, WARDEN-WP-0027. - -Completion test: In a fresh authorized scenario verify independent/off-host custody and access, restore, existing MFA/service/consumer continuity, reconnect and audit continuity; measure RTO/RPO. Reuse accepted archive/source proofs without equating them to complete native recovery. Honor scoped authority and the build-mode single-holder decision. +Transferred, not implemented: the original security acceptance and implementation-owner references now live in CUST-WP-0082-T13 in [WP-82](CUST-WP-0082-netkingdom-security-hardening.md). Founder sequencing decision 9663d4ca-3793-4ad7-9dc1-954001d43596. Original identity and history are retained; this cancellation counts as deferred work, not completed delivery. ## T32 - Accept independent effect-to-outbox-to-audit reconciliation ```task id: CUST-WP-0080-T32 -status: todo +status: cancel priority: high -depends_on: [CUST-WP-0080-T22] state_hub_task_id: "5a0cb7f7-1cd8-50ba-8af2-a2b13ed34a18" ``` -Stage: audit acceptance. Owner implementation: Audit Core / emitting owners; AUDIT-WP-0013/0014/0015 and existing emission tasks. +Transferred, not implemented: the original security acceptance and implementation-owner references now live in CUST-WP-0082-T14 in [WP-82](CUST-WP-0082-netkingdom-security-hardening.md). Founder sequencing decision 9663d4ca-3793-4ad7-9dc1-954001d43596. Original identity and history are retained; this cancellation counts as deferred work, not completed delivery. -Completion test: Admit actual sender/source/class inventory and reconcile the first protected effect, atomic outbox and durable independent receiver readback. Account for lag, duplicates, missing classes and failure recovery. Archive custody alone is not source completeness; State Hub remains an index, not credential/evidence custody. - -## T33 - Accept current discovery, version and package-family accuracy +## T33 - Publish the working owner entry commands ```task id: CUST-WP-0080-T33 @@ -519,106 +466,86 @@ depends_on: [CUST-WP-0080-T12] state_hub_task_id: "4547ac4c-8893-54fe-ae6e-362682bb7920" ``` -Stage: discovery acceptance. Owner implementation: Reuse / Repo Manager / capability owners. - -Completion test: Recheck all 70 reviewed capability IDs exactly once against owner source, usable links, truthful limits, versions/aliases and package-family disposition. Verify hosted/provider index parity and recurring drift behavior. Source owners remain authoritative; do not create another capability catalog. +Completion test: verify canonical Playwright and Forgejo owner commands, links, actual profile/availability and expected outputs, then publish a short delivery runbook linking their source-owned clients and existing reuse-surface capability records. Do not copy clients or create another catalog. Broader all-70 capability/version/package-family reconciliation remains CUST-WP-0082-T22. ## T34 - Accept the first unassisted security-flow run ```task id: CUST-WP-0080-T34 -status: todo +status: cancel priority: high state_hub_task_id: "393b9fcc-323b-5182-92c6-44530fce7efb" ``` -Stage: operational acceptance. Owner implementation: Activity / Coordination / Custodian; ACTIVITY-WP-0047, CUST-WP-0079. - -Completion test: Admit and activate the existing schedule through its owner path, observe an unassisted firing, checkpoint and changed-state notification, and verify adopted cadence at runtime and receiver. A schedule acknowledgement or source cadence constant does not count. Scheduling never creates action authority. +Transferred, not implemented: the original security acceptance and implementation-owner references now live in CUST-WP-0082-T15 in [WP-82](CUST-WP-0082-netkingdom-security-hardening.md). Founder sequencing decision 9663d4ca-3793-4ad7-9dc1-954001d43596. Original identity and history are retained; this cancellation counts as deferred work, not completed delivery. ## T35 - Accept a second real consumer using the shared adapters ```task id: CUST-WP-0080-T35 -status: todo +status: cancel priority: high -depends_on: [CUST-WP-0080-T23] state_hub_task_id: "db274192-07d6-5be7-9c1e-d63c5a9fb57f" ``` -Stage: reuse acceptance. Owner implementation: NetKingdom / provider owners / selected second consumer. - -Completion test: The second actual consumer uses the same producer-owned identity/decision/approval adapters and case contracts. Verify allowed/denied-path parity, version compatibility, upgrade and rollback without a second PDP, token registry or independently copied evaluator. Record the per-consumer integration work. +Transferred, not implemented: the original security acceptance and implementation-owner references now live in CUST-WP-0082-T16 in [WP-82](CUST-WP-0082-netkingdom-security-hardening.md). Founder sequencing decision 9663d4ca-3793-4ad7-9dc1-954001d43596. Original identity and history are retained; this cancellation counts as deferred work, not completed delivery. ## T36 - Accept a clean second installation of the minimal profile ```task id: CUST-WP-0080-T36 -status: todo +status: cancel priority: high -depends_on: [CUST-WP-0080-T23] state_hub_task_id: "586232a1-57b0-5e04-a61b-fb687bcc8999" ``` -Stage: installation acceptance. Owner implementation: NetKingdom / provider and installation owners. +Transferred, not implemented: the original security acceptance and implementation-owner references now live in CUST-WP-0082-T17 in [WP-82](CUST-WP-0082-netkingdom-security-hardening.md). Founder sequencing decision 9663d4ca-3793-4ad7-9dc1-954001d43596. Original identity and history are retained; this cancellation counts as deferred work, not completed delivery. -Completion test: Use locked versions/providers and declared optional dependencies to install a minimal profile from clean state. Complete positive/negative journeys and upgrade/recovery instructions with independently checked results. Source reuse alone does not prove installability or portability. - -## T37 - Measure delivery time, runtime cost and performance improvement +## T37 - Measure the working development flows ```task id: CUST-WP-0080-T37 -status: todo +status: progress priority: high state_hub_task_id: "d533ca34-a691-5f8e-8cc2-5f408b679538" ``` -Stage: measurement. Owner implementation: Resource / telemetry / consumer owners; CUST-WP-0071 where applicable. +Completion test: record supported-command steps, manual touches and observed run time for the human/agent Playwright flow and everyday Forgejo flow. Retain the measured native scanner/publication repair as one bounded sample. Do not invent an unmeasured baseline or generalize to security latency/resource acceptance; that original full profile remains CUST-WP-0082-T23. -Completion test: Record baseline and comparable after measurements for onboarding time/manual touches, p50/p95 decision/effect latency, scanner throughput/failures, resource/headroom and owner effort with unchanged control coverage. Retain the measured scanner correction as one completed sample; do not generalize it to all workflows. - -## T38 - Reconcile requirement-level exceptions and explicit deferrals +## T38 - Record the founder sequencing and exact hardening handoff ```task id: CUST-WP-0080-T38 -status: todo +status: done priority: high state_hub_task_id: "2350a829-bd8c-5c3b-9f39-07bfa1c3f228" ``` -Stage: governance evidence. Owner implementation: Custodian / governance / affected owners; close-down checklist and actual founder decisions. - -Completion test: Map each remaining exception/deferral to the exact SEC-DSM requirement, scope, real approval reference, risk, compensating controls, owner and review/revalidation. Preserve missing approvals as open; never invent assent, backfill a scored success or promote all residuals. Required leftovers become live work records before finishing. +Completed scope: record the actual founder decision and priority, preserve all original task bindings and criteria, transfer pending security acceptance to live CUST-WP-0082, map all 116 unchanged requirement IDs and add close-down row 25. Normal file-to-Hub readback is required in T04. This is sequencing, not formal exception acceptance; original risk/compensating-control/approval/revalidation completeness remains CUST-WP-0082-T24. ## T39 - Accept declared source and delivery entry-path coverage ```task id: CUST-WP-0080-T39 -status: todo +status: cancel priority: high -depends_on: [CUST-WP-0080-T20, CUST-WP-0080-T28] state_hub_task_id: "da6ae9a3-9107-5ca7-adb2-c9d85b3c529c" ``` -Stage: delivery acceptance. Owner implementation: Forge / Repo Manager / enablement; RMGR-WP-0021 and existing Forge owner work. - -Completion test: Reconcile the production-repository denominator and actual SSH/HTTP/UI/new-repository/import/mirror entry paths, required checks and artifact provenance. Keep the external-submodule compatibility exception visible. Assess any necessary FORGE-WP-0008 residual dependency for explicit owner-scoped promotion before implementation; existing hook presence alone cannot close TSA-10. +Transferred, not implemented: the original security acceptance and implementation-owner references now live in CUST-WP-0082-T18 in [WP-82](CUST-WP-0082-netkingdom-security-hardening.md). Founder sequencing decision 9663d4ca-3793-4ad7-9dc1-954001d43596. Original identity and history are retained; this cancellation counts as deferred work, not completed delivery. ## T40 - Accept a private finding through classification and response ```task id: CUST-WP-0080-T40 -status: todo +status: cancel priority: high -depends_on: [CUST-WP-0080-T39] state_hub_task_id: "8e71f6f0-9fc3-509b-8f1b-768f7d9cbd0e" ``` -Stage: response acceptance. Owner implementation: Repo Manager / Forge / incident and credential-custody owners; RMGR-WP-0021-T04. +Transferred, not implemented: the original security acceptance and implementation-owner references now live in CUST-WP-0082-T19 in [WP-82](CUST-WP-0082-netkingdom-security-hardening.md). Founder sequencing decision 9663d4ca-3793-4ad7-9dc1-954001d43596. Original identity and history are retained; this cancellation counts as deferred work, not completed delivery. -Completion test: Run an admitted private synthetic finding through the actual detection, classification, custody/response and resolution path with sanitized independent receipts. Establish owner responsibility for revocation where relevant. Rejecting a push or deleting source material does not itself prove incident resolution; do not send raw findings or credentials through coordination messages. - -## Acceptance coverage and close-down +## Original security acceptance mapping retained for WP-82 | Architecture gate | Custodian evidence checkpoints | | --- | --- | @@ -655,7 +582,4 @@ Completion test: Run an admitted private synthetic finding through the actual de | G12 | T28-T30 | | G13 | T07, T21 | -All mapped checkpoints retain their stated scope. A completed source checkpoint -does not close a gate that also requires native or consumer evidence. The original -requirement ledger remains the requirement-level denominator. Uncovered work -stays live; no required gate becomes a residual merely to finish this plan. +These are the original target mappings. Resolve transferred and split checkpoints through hardening-handoff.json and CUST-WP-0082. The founder explicitly changed sequencing on 18 October; transferred work remains unaccepted. No completed source or build-mode good-case checkpoint closes the full native security gate. diff --git a/workplans/CUST-WP-0082-netkingdom-security-hardening.md b/workplans/CUST-WP-0082-netkingdom-security-hardening.md new file mode 100644 index 00000000..8b340e8f --- /dev/null +++ b/workplans/CUST-WP-0082-netkingdom-security-hardening.md @@ -0,0 +1,451 @@ +--- +id: CUST-WP-0082 +type: workplan +title: "NetKingdom hardening after the working development flows" +domain: infotech +repo: the-custodian +status: backlog +owner: codex +topic_slug: custodian +created: "2026-10-18" +updated: "2026-10-18" +flavor: residual +origin_ref: CUST-WP-0080 +depends_on: [] +state_hub_workstream_id: "b29f9f25-b508-5c2c-98fd-2f6877f109cf" +--- + +# Hardening follow-up + +The founder explicitly prioritized working development flows on 18 October 2026 +and permitted security findings to move to later hardening. Actual decision: +`9663d4ca-3793-4ad7-9dc1-954001d43596`, recorded in +[the direction receipt](../docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/founder-decision.json). +Playwright human/agent access leads WP-80; everyday Forgejo use follows. + +This live record retains the full security acceptance work. It does not assert +completion, formal requirement exceptions or assent by other owners. Promote +the required scope when demand or risk calls for it, and review before customer +production, expanding targets or granting broader unattended authority. Until +promotion, do not implement this residual backlog merely because it exists. +Any security defect actually blocking the selected functional flow can be +promoted narrowly by an explicit change to the live plans. + +Custodian owns coordination and acceptance here. The existing owner workplans +named below remain the implementation backlogs; do not create parallel identity, +policy, approval, credential, transport or browser clients. Resolve capabilities +through reuse-surface and credential ownership through warden route. Use producer +adapters and preserve their version/drift checks. No owner status is changed here. + +The [handoff map](../docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/hardening-handoff.json) +preserves all 40 original task bindings and maps every one of the 116 ledger IDs, +including 20 reference entries which are not remediation tasks. Ledger statuses +remain unchanged: 84 unverified, 12 incomplete, 20 reference. The 16 architecture +gates and G01-G13 remain the hardening target, with their original evidence. +Default active Hub views omit residuals: WP-80 links this plan visibly so this +work cannot disappear from the current delivery report. + +Review trigger for every checkpoint below: selected good case is delivered and +hardening is promoted, or a concrete blocker/risk needs earlier attention; +revalidate the relevant scope before customer production. Existing controls stay +enabled. Close-down checklist row 25 tracks this build-mode sequencing. + +## T01 - Verify current identity on browser, API and Git HTTP paths + +```task +id: CUST-WP-0082-T01 +status: todo +priority: high +depends_on: [CUST-WP-0080-T09] +state_hub_task_id: "2ac61e1a-5a01-5ff9-ae35-017efe1e987c" +``` + +Transferred from CUST-WP-0080-T14; not implemented by the transfer. + +Stage: source integration. Owner implementation: Apps / KeyCape / Access; RAPPS-WP-0016-T09, NK-WP-0048-T43. + +Completion test: Actual shared authentication routes enforce current linked account/source/subject/application-tenant bindings, current groups and exact resource/action policy. Tests must cover revoked, suspended, expired, unavailable and mismatched identity, plus terminal refusal without fallback. Preserve the separate local break-glass path and prevent federated unlink/downgrade escape. + +## T02 - Verify current identity on the independent SSH path + +```task +id: CUST-WP-0082-T02 +status: todo +priority: high +depends_on: [CUST-WP-0082-T01] +state_hub_task_id: "a88d7bbe-49d8-5dc0-a613-eeebb756bd0c" +``` + +Transferred from CUST-WP-0080-T15; not implemented by the transfer. + +Stage: source integration. Owner implementation: Apps / KeyCape / Access; RAPPS-WP-0016-T09, NK-WP-0048-T43. + +Completion test: The actual private SSH service checks the same producer-owned identity and policy contract before repository creation or effects. Native SSH keys cannot bypass current linked identity. Positive, denial, revocation, unavailable and account/source mismatch cases pass; local break-glass behavior is covered. + +## T03 - Verify exact current authority for the protected Forgejo operation + +```task +id: CUST-WP-0082-T03 +status: todo +priority: high +depends_on: [CUST-WP-0080-T07, CUST-WP-0080-T08, CUST-WP-0080-T09] +state_hub_task_id: "55e99c7e-69de-523a-88f1-660c3f69edb0" +``` + +Transferred from CUST-WP-0080-T16; not implemented by the transfer. + +Stage: source integration. Owner implementation: NetKingdom / Warden / Apps / Approval / Access; existing NK-WP-0048 operation tasks. + +Completion test: The actual operation entry path authenticates the current actor/session and binds tenant, exact target/action, payload/source revision, decision and required approval before journal writes or owner effects. Wrong actor/body/tenant, expired authority, unavailable producers and business replay refuse. Existing producer contracts remain authoritative. + +## T04 - Verify the fresh inverse and durable private recovery journal + +```task +id: CUST-WP-0082-T04 +status: todo +priority: high +depends_on: [CUST-WP-0082-T03] +state_hub_task_id: "aa7112b1-e76e-520e-a59a-6aa4aa39b35d" +``` + +Transferred from CUST-WP-0080-T17; not implemented by the transfer. + +Stage: source integration. Owner implementation: Apps / Warden / NetKingdom; RAPPS-WP-0016-T07/T08 and existing NK-WP-0048 inverse tasks. + +Completion test: An exact prior operation can be reconciled and inversed with fresh current authority while retaining original provenance and unknown outcomes. Private journal custody, permissions, persistence, retention and recovery are explicit. Cover public client, unchanged secret delivery and failure before hand-over receipt; receipt deletion alone is not the inverse. + +## T05 - Verify exclusion of every Forgejo release writer + +```task +id: CUST-WP-0082-T05 +status: todo +priority: high +depends_on: [CUST-WP-0080-T10, CUST-WP-0082-T03] +state_hub_task_id: "8e9c5b9a-8315-5efa-9cd3-00a113c6ea81" +``` + +Transferred from CUST-WP-0080-T18; not implemented by the transfer. + +Stage: source integration. Owner implementation: Apps / NetKingdom / deployment owners; existing NK-WP-0048 writer obligations. + +Completion test: Inventory and constrain every actual release/configuration writer for prepare/check/effect/inverse, including uncooperative writers. Demonstrate target drift and concurrent-write refusals at the declared database/release scope. A local advisory lock or the earlier source transaction test alone cannot close this checkpoint. + +## T06 - Accept signed decisions at the native privileged consumers + +```task +id: CUST-WP-0082-T06 +status: todo +priority: high +depends_on: [CUST-WP-0080-T07] +state_hub_task_id: "a7cf387e-da06-5cca-8815-43a4ecbf8ea9" +``` + +Transferred from CUST-WP-0080-T21; not implemented by the transfer. + +Stage: native acceptance. Owner implementation: Secrets / Access / Platform; SECRETS-WP-0014, FLEX-WP-0024. + +Completion test: Admit exact producer package, signer/channel, independent consumer trust and caller/policy bindings. Account for the privileged PEP denominator and prove native forged, altered, wrong-key, unsigned/downgrade, expired, unavailable and rotation refusals. Source fixtures do not close TSA-01. + +## T07 - Accept one native approved operation and crash recovery + +```task +id: CUST-WP-0082-T07 +status: todo +priority: high +depends_on: [CUST-WP-0082-T06, CUST-WP-0082-T03, CUST-WP-0082-T04, CUST-WP-0082-T05] +state_hub_task_id: "c555c76a-00e8-5d07-9aef-7a4e6ac7ea11" +``` + +Transferred from CUST-WP-0080-T22; not implemented by the transfer. + +Stage: native acceptance. Owner implementation: Platform / Secrets / Approval / Audit; RPF-WP-0035-T12, SECRETS-WP-0013, APPROVAL-WP-0004. + +Completion test: One exact approved effect passes authoritative consume/confirmation, target precondition/readback and independently verified cleanup. Native crash/restart/concurrency preserves unknown outcomes and forbids blind replay; actor/tenant/body/replay/expiry/unavailable negatives pass. Admit real custody and recovery grants. Closes only the declared TSA-02/TSA-03 scope. + +## T08 - Accept attended U08 factor recovery and fresh sign-in + +```task +id: CUST-WP-0082-T08 +status: todo +priority: high +state_hub_task_id: "f1dbdb5d-30cb-5012-9fa5-e59520ba2aae" +``` + +Transferred from CUST-WP-0080-T24; not implemented by the transfer. + +Stage: human journey. Owner implementation: User / KeyCape; USER-WP-0028-T03, KEY-WP-0040. + +Completion test: Requalify the existing User task to the actual founder-attended disable/re-enroll/fresh-login window and obtain its value-free acceptance. KEY-WP-0040 preview/help-link corrections are already accepted; do not request or repeat that preview. No factor mutation is authorized by this plan refinement. + +## T09 - Accept the actual interactive agent isolation profile + +```task +id: CUST-WP-0082-T09 +status: todo +priority: high +depends_on: [CUST-WP-0080-T13] +state_hub_task_id: "88c0467d-b8b8-5972-b50a-2a87b51365fb" +``` + +Transferred from CUST-WP-0080-T27; not implemented by the transfer. + +Stage: runtime acceptance. Owner implementation: Glas / selected rein / Platform / Warden; GLAS-WP-0012, CUST-WP-0073-T02/T04. + +Completion test: Admit this identified running assignment and verify admin-material read denial through files, mounts, environment, subprocesses and available tools, plus allowed task effects, expiry/cancel cleanup and no cross-task credential accumulation. Fixture success or another agent's authority record cannot substitute. + +## T10 - Accept per-job runner authority and workflow-abuse refusals + +```task +id: CUST-WP-0082-T10 +status: todo +priority: high +state_hub_task_id: "5ddfe024-b823-51c9-ac4d-ec5e53c47346" +``` + +Transferred from CUST-WP-0080-T28; not implemented by the transfer. + +Stage: runtime acceptance. Owner implementation: Forge / Platform / enablement; existing runner and CI owner work. + +Completion test: Verify actual job-specific credential/repository/deployment scope, teardown and abuse tests using repository-controlled workflows. Reuse the accepted Docker listener repair; do not repeat it as new progress. Prove jobs cannot disable the independent receive control or reach unrelated deployment credentials. + +## T11 - Reconcile the current credential and consumer metadata inventory + +```task +id: CUST-WP-0082-T11 +status: todo +priority: high +state_hub_task_id: "5b3767a0-5657-5ae3-b094-70e429a26617" +``` + +Transferred from CUST-WP-0080-T29; not implemented by the transfer. + +Stage: lifecycle evidence. Owner implementation: Secrets / Mason / Platform / NetKingdom; MASON-WP-0004, NK-WP-0049. + +Completion test: Produce a current metadata-only denominator with owner, purpose, exact scope, issuer/delivery, consumers, copies, expiry/rotation/revocation and recovery/deletion procedures. Unknown/orphan entries remain findings. Identify native-identity elimination candidates. Never retrieve values to improve the inventory. + +## T12 - Accept sampled credential replacement, revocation and copy deletion + +```task +id: CUST-WP-0082-T12 +status: todo +priority: high +depends_on: [CUST-WP-0082-T11] +state_hub_task_id: "cbac0912-ac45-58d4-93db-8f49ac7750b2" +``` + +Transferred from CUST-WP-0080-T30; not implemented by the transfer. + +Stage: lifecycle acceptance. Owner implementation: Secrets / Platform / credential consumers; existing lifecycle plans. + +Completion test: For the admitted samples, demonstrate replacement adoption, old-credential refusal, refresh/deletion semantics and reconciled delivery copies. Preserve the founder-deferred exposure rotation; it requires its actual governing exception/decision rather than silent execution or a completion claim. + +## T13 - Accept independent root recovery with the normal issuer unavailable + +```task +id: CUST-WP-0082-T13 +status: todo +priority: high +depends_on: [CUST-WP-0082-T11] +state_hub_task_id: "1903466c-674f-5025-acd7-873396c6d2fe" +``` + +Transferred from CUST-WP-0080-T31; not implemented by the transfer. + +Stage: recovery acceptance. Owner implementation: NetKingdom / Warden / Platform / recovery owners; NK-WP-0049, WARDEN-WP-0027. + +Completion test: In a fresh authorized scenario verify independent/off-host custody and access, restore, existing MFA/service/consumer continuity, reconnect and audit continuity; measure RTO/RPO. Reuse accepted archive/source proofs without equating them to complete native recovery. Honor scoped authority and the build-mode single-holder decision. + +## T14 - Accept independent effect-to-outbox-to-audit reconciliation + +```task +id: CUST-WP-0082-T14 +status: todo +priority: high +depends_on: [CUST-WP-0082-T07] +state_hub_task_id: "38363478-e46b-54bd-972d-ce998f3b8dd0" +``` + +Transferred from CUST-WP-0080-T32; not implemented by the transfer. + +Stage: audit acceptance. Owner implementation: Audit Core / emitting owners; AUDIT-WP-0013/0014/0015 and existing emission tasks. + +Completion test: Admit actual sender/source/class inventory and reconcile the first protected effect, atomic outbox and durable independent receiver readback. Account for lag, duplicates, missing classes and failure recovery. Archive custody alone is not source completeness; State Hub remains an index, not credential/evidence custody. + +## T15 - Accept the first unassisted security-flow run + +```task +id: CUST-WP-0082-T15 +status: todo +priority: high +state_hub_task_id: "564a545a-b43d-5013-8f1b-e34cd54b52c7" +``` + +Transferred from CUST-WP-0080-T34; not implemented by the transfer. + +Stage: operational acceptance. Owner implementation: Activity / Coordination / Custodian; ACTIVITY-WP-0047, CUST-WP-0079. + +Completion test: Admit and activate the existing schedule through its owner path, observe an unassisted firing, checkpoint and changed-state notification, and verify adopted cadence at runtime and receiver. A schedule acknowledgement or source cadence constant does not count. Scheduling never creates action authority. + +## T16 - Accept a second real consumer using the shared adapters + +```task +id: CUST-WP-0082-T16 +status: todo +priority: high +depends_on: [CUST-WP-0082-T20] +state_hub_task_id: "90c8fb36-9032-57e7-85da-684d18e5c0b1" +``` + +Transferred from CUST-WP-0080-T35; not implemented by the transfer. + +Stage: reuse acceptance. Owner implementation: NetKingdom / provider owners / selected second consumer. + +Completion test: The second actual consumer uses the same producer-owned identity/decision/approval adapters and case contracts. Verify allowed/denied-path parity, version compatibility, upgrade and rollback without a second PDP, token registry or independently copied evaluator. Record the per-consumer integration work. + +## T17 - Accept a clean second installation of the minimal profile + +```task +id: CUST-WP-0082-T17 +status: todo +priority: high +depends_on: [CUST-WP-0082-T20] +state_hub_task_id: "9e35af30-ec53-58f4-8517-5a5df85b6c79" +``` + +Transferred from CUST-WP-0080-T36; not implemented by the transfer. + +Stage: installation acceptance. Owner implementation: NetKingdom / provider and installation owners. + +Completion test: Use locked versions/providers and declared optional dependencies to install a minimal profile from clean state. Complete positive/negative journeys and upgrade/recovery instructions with independently checked results. Source reuse alone does not prove installability or portability. + +## T18 - Accept declared source and delivery entry-path coverage + +```task +id: CUST-WP-0082-T18 +status: todo +priority: high +depends_on: [CUST-WP-0080-T20, CUST-WP-0082-T10] +state_hub_task_id: "316d9fc2-27e3-53ce-809d-a50769fa9734" +``` + +Transferred from CUST-WP-0080-T39; not implemented by the transfer. + +Stage: delivery acceptance. Owner implementation: Forge / Repo Manager / enablement; RMGR-WP-0021 and existing Forge owner work. + +Completion test: Reconcile the production-repository denominator and actual SSH/HTTP/UI/new-repository/import/mirror entry paths, required checks and artifact provenance. Keep the external-submodule compatibility exception visible. Assess any necessary FORGE-WP-0008 residual dependency for explicit owner-scoped promotion before implementation; existing hook presence alone cannot close TSA-10. + +## T19 - Accept a private finding through classification and response + +```task +id: CUST-WP-0082-T19 +status: todo +priority: high +depends_on: [CUST-WP-0082-T18] +state_hub_task_id: "9e26f419-0547-596a-bd0c-66b39f2d6ba8" +``` + +Transferred from CUST-WP-0080-T40; not implemented by the transfer. + +Stage: response acceptance. Owner implementation: Repo Manager / Forge / incident and credential-custody owners; RMGR-WP-0021-T04. + +Completion test: Run an admitted private synthetic finding through the actual detection, classification, custody/response and resolution path with sanitized independent receipts. Establish owner responsibility for revocation where relevant. Rejecting a push or deleting source material does not itself prove incident resolution; do not send raw findings or credentials through coordination messages. + +## T20 - Accept the complete native Forgejo security case and final artifact + +```task +id: CUST-WP-0082-T20 +status: todo +priority: high +state_hub_task_id: "eef7e3d9-9cfb-5525-af82-a8cc1bba6e67" +``` + +Remaining security acceptance from CUST-WP-0080-T19, CUST-WP-0080-T23. The build-mode functional receipts do not close this scope. + +Stage: artifact build. Owner implementation: Apps; RAPPS-WP-0016 build/operation tasks. + +Completion test: Build the final integrated revision with pinned source/tool/dependency inputs, all frontend/static assets and the static backend. Verify release CLI/source parity, complete required checks, artifact hashes and the local OCI package. Prior 40-path build evidence does not establish a later integrated release. Independent admission and live acceptance remain T23. + +Stage: native acceptance. Owner implementation: NetKingdom / Mason / Warden / KeyCape / Apps; NK-WP-0048. + +Completion test: Admit exact case/type/provider/package revisions and private execution custody. Independently verify native structure, contained registration/delivery, sign-in, denied groups/actions, current ongoing API/Git/SSH access, revocation, exact inverse and rollback. Owner assent and actual deployed receipts are mandatory; a compiled patch or acknowledged case is insufficient. + +## T21 - Accept independent human and registered-agent Playwright identity + +```task +id: CUST-WP-0082-T21 +status: todo +priority: high +state_hub_task_id: "d3dd8c35-284b-5035-a1a3-e0a0dbef86ba" +``` + +Remaining security acceptance from CUST-WP-0080-T25, CUST-WP-0080-T26. The build-mode functional receipts do not close this scope. + +Stage: consumer acceptance. Owner implementation: Platform / Playwright / NetKingdom / cluster / bridge; RPF-WP-0056-T03, RAPP-PLAYWRIGHT-WP-0004, NK-WP-0050. + +Completion test: Collect exact registration/custody/JWT-authenticator/per-caller transport owner returns, then run the supported command as one real human. Verify sign-in, scope/permission denial, browser operation, renewal/revocation and recovery, accepted by Platform and provider. Existing qualified humans need no new membership decision. + +Stage: consumer acceptance. Owner implementation: Platform / Playwright / NetKingdom / cluster / bridge; same existing consumer case as T25. + +Completion test: Use one distinguishable registered agent and its admitted per-caller transport, not a shared admin kubeconfig or workstation identity. Verify the supported command, allowed/denied browser/API actions, expiry/cancellation, revocation and cleanup, with Platform/provider acceptance and supported consumer documentation. + +Current build profile uses an existing authenticated workstation port-forward and the provider client, with no credential distribution. This proves browser usability, not distinct per-caller identity. Preserve RPF-WP-0056, NK-WP-0050 and provider owner acceptance; no registration/authenticator rollout is implied. + +## T22 - Reconcile all reviewed capabilities and package families + +```task +id: CUST-WP-0082-T22 +status: todo +priority: high +state_hub_task_id: "43a94f1e-e906-55ac-a837-d9ce5c495d6b" +``` + +Remaining security acceptance from CUST-WP-0080-T33. The build-mode functional receipts do not close this scope. + +Stage: discovery acceptance. Owner implementation: Reuse / Repo Manager / capability owners. + +Completion test: Recheck all 70 reviewed capability IDs exactly once against owner source, usable links, truthful limits, versions/aliases and package-family disposition. Verify hosted/provider index parity and recurring drift behavior. Source owners remain authoritative; do not create another capability catalog. + +## T23 - Measure the complete security and resource profile + +```task +id: CUST-WP-0082-T23 +status: todo +priority: high +state_hub_task_id: "4fda91f5-94c1-52fc-9dbd-c3693950165b" +``` + +Remaining security acceptance from CUST-WP-0080-T37. The build-mode functional receipts do not close this scope. + +Stage: measurement. Owner implementation: Resource / telemetry / consumer owners; CUST-WP-0071 where applicable. + +Completion test: Record baseline and comparable after measurements for onboarding time/manual touches, p50/p95 decision/effect latency, scanner throughput/failures, resource/headroom and owner effort with unchanged control coverage. Retain the measured scanner correction as one completed sample; do not generalize it to all workflows. + +## T24 - Reconcile formal requirement exceptions and remaining deferrals + +```task +id: CUST-WP-0082-T24 +status: todo +priority: high +state_hub_task_id: "2c92d61d-61ed-5813-a2e0-6e055c6cb564" +``` + +Remaining security acceptance from CUST-WP-0080-T38. The build-mode functional receipts do not close this scope. + +Stage: governance evidence. Owner implementation: Custodian / governance / affected owners; close-down checklist and actual founder decisions. + +Completion test: Map each remaining exception/deferral to the exact SEC-DSM requirement, scope, real approval reference, risk, compensating controls, owner and review/revalidation. Preserve missing approvals as open; never invent assent, backfill a scored success or promote all residuals. Required leftovers become live work records before finishing. + +## T25 - Audit every target gate and individual requirement + +```task +id: CUST-WP-0082-T25 +status: todo +priority: high +state_hub_task_id: "18cc3a93-f3ac-561c-84ce-8f009130c951" +``` + +Remaining security acceptance from CUST-WP-0080-T04. The build-mode functional receipts do not close this scope. + +Final acceptance audit. Reconcile every TSA-01-TSA-16 gate, G01-G13 and all 116 individual requirements with exact current evidence or an actually approved applicable exception. Require the human/agent journeys, second real consumer, clean installation and operational acceptance. Plans, source tests and owner handoffs are insufficient. Transfer any permitted residuals into live records before finishing; preserve required work and explicit deferrals. + +Use the original WP-80 acceptance tables and the handoff map to resolve moved checkpoint IDs. All 16 gates remain open until their complete acceptance evidence exists.