coulomb/the-custodian
5
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

Refine WP-80 around working flows and record passed human/agent Playwright trials
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Reject generated-only commits / generated-commit-guard (push) Successful in 10s
Details

Browse source
This commit is contained in:
codex 2026-10-18 18:29:20 +02:00
parent 6dd619fdc7
commit 4367456d29
25 changed files with 4573 additions and 220 deletions
Download patch file Download diff file Expand all files Collapse all files

81
docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/README.md Normal file
View file

@ -0,0 +1,81 @@
# Working development delivery — 18 October 2026
The human and coding-agent Playwright trials both passed against the existing
managed provider on railiance01. Each completed 14 steps at 1280×800 and 390×844,
including Tab focus, Enter activation, counter assertion and screenshot download.
The founder actually ran the human command and supplied its passed output; the
local receipt agrees. These are actual browser runs against the provider's
synthetic fixture, not general application coverage.
| Consumer | Run | Result | Receipt |
| --- | --- | --- | --- |
| Human | d81a5166-83d9-4382-a6e8-a90cfc3f0a51 | passed | [Human receipt](playwright-human/receipt.json) |
| Coding agent | 893a8bcb-9b7f-48f1-8a51-c116de3f3097 | passed | [Agent receipt](playwright-agent/receipt.json) |
The provider client, job protocol, image and deployment already existed. We used
them directly. The immediate obstacle was an absent local connection, restored
with the documented port-forward. No new browser client, gateway or cluster
configuration was needed. Profile details and client source hash are in
[playwright-profile.json](playwright-profile.json).
## Repeat the working commands
From this workstation, establish the existing authenticated cluster connection
if needed, then leave this command running in one terminal:
```sh
kubectl -n playwright port-forward deployment/playwright 18081:8080 --address 127.0.0.1
```
The connection established for these trials is currently open. Do not start a
second listener on the same port. In another terminal:
```sh
python3 /home/worsch/rapp-playwright/client/rapp_playwright.py preflight
python3 /home/worsch/rapp-playwright/client/rapp_playwright.py trial --out /tmp/my-new-playwright-trial
```
Use a new output directory for each trial. Python 3.10+ is sufficient; consumers
need no local browser installation. Expected output is `status: passed`, a receipt
path and screenshot hashes. `service_unreachable` means restore the connection;
an existing output directory means choose a new one. Stop the connection with
Ctrl-C when finished. Downloads stay in the output directory. The private
`run.json` contains a run capability: keep it private and out of Git and chat.
Canonical client and contract:
[rapp-playwright client](/home/worsch/rapp-playwright/client/rapp_playwright.py),
[consumer contract](/home/worsch/rapp-playwright/docs/consumer-contract.md),
[provider operations](/home/worsch/rapp-playwright/docs/operations.md).
Reuse discovery stays in the existing `capability.infotech.headless-browser`
record; this packet is a delivery receipt, not another capability registry.
The fixture needs no new target grant. Existing application target restrictions
remain; changing targets is separate work.
## Exact scope and next work
This is the **supervised build profile** through an existing authenticated
workstation connection. It proves supported-command browser use for the actual
human and coding agent. It does not prove distinct human/agent Kubernetes
identities, agent credential isolation, JWT integration or full revocation.
Those original criteria remain in CUST-WP-0082-T21 and the existing owner plans.
No kubeconfig or credential was copied or distributed.
The founder's [actual direction](founder-decision.json) changes sequencing:
Playwright first, everyday Forgejo next, later security hardening. The
[WP-80 overview](../../../../workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md)
shows delivered and remaining milestones. [WP-82](../../../../workplans/CUST-WP-0082-netkingdom-security-hardening.md)
retains 25 hardening acceptance checkpoints, with the existing implementation
owners. [hardening-handoff.json](hardening-handoff.json) preserves every original
task binding and all 116 requirement IDs; [workplan-before.txt](workplan-before.txt)
preserves the previous contract. Deferred tasks are not counted as completed.
The unfinished deeper identity-client draft is explicitly set aside in
[deferred-draft.json](deferred-draft.json). It is uncompiled and untested, and is
not an accepted source candidate or deployed fix. The full security target is
unchanged. Close-down checklist row 25 records the deferred acceptance.
Next: verify the deployed Forgejo release and supported positive sign-in/Git/API
flow before deciding whether a source change or rollout is needed. Publish its
working owner commands and bounded measurements, then audit both functional
milestones and the live hardening handoff. Source files remain authoritative;
normal consistency/publication and exact Hub readback must verify this revision.

7
docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/deferred-draft.json Normal file
View file

@ -0,0 +1,7 @@
{
"source_owner": "key-cape",
"source_base": "e2c5a947829568baf837543a6708fd0c3f6a863b",
"status": "unfinished/uncompiled/untested; not an accepted source candidate",
"reason": "Set aside under actual founder good-case-first direction; no canonical owner source or native changes",
"patch_sha256": "sha256:af75daabeace07607d9f18e01a074568a434e12ea2dab4ae3c06d68db6535f1e"
}

152
docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/deferred-userinfo-draft.patch Normal file
View file

@ -0,0 +1,152 @@
--- a/src/internal/authclient/online.go
+++ b/src/internal/authclient/online.go
@@ -22,6 +22,7 @@
"strings"
"syscall"
"time"
+ "unicode/utf8"
"keycape/internal/jose"
)
@@ -64,6 +65,15 @@
claims map[string]interface{}
}
+// CurrentUserInfo joins current directory facts to the independently verified
+// access grant. Groups are observations, never a permission or policy verdict.
+// Missing groups remain distinct from an explicitly empty membership set.
+type CurrentUserInfo struct {
+ Token CurrentToken
+ Groups []string
+ GroupsPresent bool
+}
+
// Claims returns a separate copy of the verified signed facts. Authentication
// assurance/age, tenant provenance, current groups and resource/effect policy
// remain the consumer's existing profile obligations, not a new client policy.
@@ -274,14 +284,11 @@
if c == nil || ctx == nil || ctx.Err() != nil || len(raw) == 0 || len(raw) > 32768 || (endpoint != "/introspect" && endpoint != "/revoke") {
return out, ErrOnlineToken
}
- ca, err := readOnlineFile(c.admission.CAFile, false)
- if err != nil {
- return out, ErrOnlineToken
- }
- roots := x509.NewCertPool()
- if !roots.AppendCertsFromPEM(ca) {
- return out, ErrOnlineToken
- }
+ client, transport, err := c.httpClient()
+ if err != nil {
+ return out, ErrOnlineToken
+ }
+ defer transport.CloseIdleConnections()
secretRaw, err := readOnlineFile(c.admission.SecretFile, true)
if err != nil {
return out, ErrOnlineToken
@@ -298,9 +305,6 @@
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
req.Header.Set("Cache-Control", "no-cache")
req.SetBasicAuth(url.QueryEscape(c.admission.ClientID), url.QueryEscape(secret))
- transport := &http.Transport{Proxy: nil, TLSClientConfig: &tls.Config{RootCAs: roots, MinVersion: tls.VersionTLS12}, DisableKeepAlives: true, DialContext: c.dialContext}
- defer transport.CloseIdleConnections()
- client := &http.Client{Transport: transport, Timeout: 5 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return ErrOnlineToken }}
response, err := client.Do(req)
if err != nil {
return out, ErrOnlineToken
@@ -324,6 +328,95 @@
return out, ErrOnlineToken
}
return decodeOnlineStatus(body)
+}
+
+// One transport profile serves status, cleanup and UserInfo. Every operation
+// rereads admitted CA material; proxies, redirects and retained connections
+// cannot introduce another bearer or confidential-client delivery path.
+func (c *OnlineClient) httpClient() (*http.Client, *http.Transport, error) {
+ if c == nil {
+ return nil, nil, ErrOnlineToken
+ }
+ ca, err := readOnlineFile(c.admission.CAFile, false)
+ if err != nil {
+ return nil, nil, ErrOnlineToken
+ }
+ roots := x509.NewCertPool()
+ if !roots.AppendCertsFromPEM(ca) {
+ return nil, nil, ErrOnlineToken
+ }
+ transport := &http.Transport{Proxy: nil, TLSClientConfig: &tls.Config{RootCAs: roots, MinVersion: tls.VersionTLS12}, DisableKeepAlives: true, DialContext: c.dialContext}
+ return &http.Client{Transport: transport, Timeout: 5 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return ErrOnlineToken }}, transport, nil
+}
+
+type userInfoWire struct {
+ Subject string `json:"sub"`
+ PreferredUsername string `json:"preferred_username"`
+ Name string `json:"name"`
+ Email string `json:"email"`
+ Groups *[]string `json:"groups"`
+}
+
+// UserInfo observes the current canonical subject and directory groups through
+// the admitted issuer, never discovery-supplied endpoints or token URL claims.
+// Signed grant/trust, owning client and issuer status are checked before bearer
+// delivery and again after the directory response. Nothing positive is cached.
+// Consumers still bind ID-token assurance, local account/source and exact effect
+// policy; the returned groups cannot authorize a later operation by themselves.
+func (c *OnlineClient) UserInfo(ctx context.Context, raw string, expected ExpectedIdentity) (CurrentUserInfo, error) {
+ var refused CurrentUserInfo
+ before, err := c.Check(ctx, raw, expected)
+ if err != nil {
+ return refused, ErrOnlineToken
+ }
+ client, transport, err := c.httpClient()
+ if err != nil {
+ return refused, ErrOnlineToken
+ }
+ defer transport.CloseIdleConnections()
+ req, err := http.NewRequestWithContext(ctx, http.MethodGet, c.admission.Issuer+"/userinfo", nil)
+ if err != nil {
+ return refused, ErrOnlineToken
+ }
+ req.Header.Set("Authorization", "Bearer "+raw)
+ req.Header.Set("Cache-Control", "no-cache")
+ response, err := client.Do(req)
+ if err != nil {
+ return refused, ErrOnlineToken
+ }
+ defer response.Body.Close()
+ media, _, mediaErr := mime.ParseMediaType(response.Header.Get("Content-Type"))
+ if response.StatusCode != http.StatusOK || response.Header.Get("Cache-Control") != "no-store" || mediaErr != nil || media != "application/json" {
+ return refused, ErrOnlineToken
+ }
+ body, err := io.ReadAll(io.LimitReader(response.Body, 65537))
+ if err != nil || len(body) > 65536 || !utf8.Valid(body) {
+ return refused, ErrOnlineToken
+ }
+ var wire userInfoWire
+ seen, err := decodeOnlineObject(body, &wire)
+ if err != nil || !seen["sub"] || wire.Subject != before.Subject {
+ return refused, ErrOnlineToken
+ }
+ if wire.Groups != nil {
+ if len(*wire.Groups) > 1024 {
+ return refused, ErrOnlineToken
+ }
+ for _, group := range *wire.Groups {
+ if group == "" {
+ return refused, ErrOnlineToken
+ }
+ }
+ }
+ after, err := c.Check(ctx, raw, expected)
+ if err != nil || after.TokenDigest != before.TokenDigest || after.TokenID != before.TokenID {
+ return refused, ErrOnlineToken
+ }
+ out := CurrentUserInfo{Token: after, GroupsPresent: wire.Groups != nil}
+ if wire.Groups != nil {
+ out.Groups = append([]string{}, (*wire.Groups)...)
+ }
+ return out, nil
}
// Check verifies expected identity before accessing the private client credential,

8
docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/founder-decision.json Normal file
View file

@ -0,0 +1,8 @@
{
"id": "9663d4ca-3793-4ad7-9dc1-954001d43596",
"status": "resolved",
"decided_by": "Bernd Worsch",
"direction": "Record actual founder direction18October2026: security findings may be deferred to a later hardening workplan to restore efficient development and focus on the working good case. The founder selected Playwright access for a human and coding agent using supported commands as first priority; Forgejo remains the next functional milestone. CUST-WP-0082 will retain full security acceptance, owners, original checkpoints and requirement mappings. Existing implementation owners remain canonical; no parallel auth/PDP/client is created.",
"actual_quote": "Actual founder wording: It is ok to defer security fixes to a hardening workplan, that we follow up on later, if that helps to keep progress on the good case in focus. Actual priority reply: Playwright access for a human and coding agent, using supported commands (Recommended). This approves sequencing and explicit deferrals, not a security-conformance claim or a new native change/credential grant. Build-profile transport and authentication used in functional receipts must be stated truthfully; stronger per-caller isolation/revocation/negative matrices and final16-gate/116-requirement acceptance remain in the hardening follow-up. Security work that actually blocks the selected working flow may be promoted narrowly; no need to complete the entire security architecture first.",
"native_authority_granted": false
}

2536
docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/hardening-handoff.json Normal file
View file

File diff suppressed because it is too large Load diff

26
docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/measurements.json Normal file
View file

@ -0,0 +1,26 @@
{
"scope": "Playwright working build profile only",
"measurements": [
{
"consumer": "human",
"run_id": "d81a5166-83d9-4382-a6e8-a90cfc3f0a51",
"completed_steps": 14,
"run_duration_seconds": 3.801,
"keyboard_and_responsive": true
},
{
"consumer": "agent",
"run_id": "893a8bcb-9b7f-48f1-8a51-c116de3f3097",
"completed_steps": 14,
"run_duration_seconds": 3.938,
"keyboard_and_responsive": true
}
],
"consumer_commands_after_connection": 2,
"connection_commands": 1,
"manual_connection_setup_required": true,
"local_browser_install_required": false,
"baseline_comparison": "No comparable prior end-to-end baseline measured; no percentage improvement claimed.",
"forgejo_measurement": "pending T37",
"reuse": "Existing rapp-playwright client and Kubernetes port-forward, zero new clients or deployments."
}

BIN
docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-agent/desktop-final.png Normal file
View file

Binary file not shown.
Side by side

After

Width:  |  Height:  |  Size: 26 KiB

BIN
docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-agent/narrow-final.png Normal file
View file

Binary file not shown.
Side by side

After

Width:  |  Height:  |  Size: 24 KiB

24
docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-agent/preflight.json Normal file
View file

@ -0,0 +1,24 @@
{
"available": true,
"error": null,
"checked_at": "2026-10-18T16:15:46.222Z",
"browser_version": "156.0.8078.4",
"api_version": "1",
"service_version": "0.1.0",
"playwright_version": "1.64.0",
"execution_location": "railiance01/playwright",
"release": "forgejo.coulomb.social/coulomb/rapp-playwright@sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441",
"allowed_origins": [
"https://onco.cc"
],
"fixture": true,
"active": 0,
"queued": 0,
"limits": {
"concurrency": 1,
"max_queue": 4,
"max_timeout_ms": 120000,
"retention_ms": 3600000,
"max_runs": 64
}
}

184
docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-agent/receipt.json Normal file
View file

@ -0,0 +1,184 @@
{
"id": "893a8bcb-9b7f-48f1-8a51-c116de3f3097",
"api_version": "1",
"status": "passed",
"error": null,
"label": "independent-browser-trial",
"target": "fixture",
"viewports": [
{
"name": "desktop",
"width": 1280,
"height": 800
},
{
"name": "narrow",
"width": 390,
"height": 844
}
],
"timeout_ms": 60000,
"created_at": "2026-10-18T16:16:02.516Z",
"expires_at": "2026-10-18T17:16:02.516Z",
"service_version": "0.1.0",
"playwright_version": "1.64.0",
"release": "forgejo.coulomb.social/coulomb/rapp-playwright@sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441",
"execution_location": "railiance01/playwright",
"browser_version": "156.0.8078.4",
"completed_steps": 14,
"steps": [
{
"viewport": "desktop",
"index": 0,
"action": "visible",
"status": "passed",
"at": "2026-10-18T16:16:04.655Z",
"selector": "h1"
},
{
"viewport": "desktop",
"index": 1,
"action": "text",
"status": "passed",
"at": "2026-10-18T16:16:04.773Z",
"selector": "#count"
},
{
"viewport": "desktop",
"index": 2,
"action": "press",
"status": "passed",
"at": "2026-10-18T16:16:04.865Z",
"key": "Tab"
},
{
"viewport": "desktop",
"index": 3,
"action": "focused",
"status": "passed",
"at": "2026-10-18T16:16:04.882Z",
"selector": "#increment"
},
{
"viewport": "desktop",
"index": 4,
"action": "press",
"status": "passed",
"at": "2026-10-18T16:16:04.891Z",
"key": "Enter"
},
{
"viewport": "desktop",
"index": 5,
"action": "text",
"status": "passed",
"at": "2026-10-18T16:16:04.907Z",
"selector": "#count"
},
{
"viewport": "desktop",
"index": 6,
"action": "screenshot",
"status": "passed",
"at": "2026-10-18T16:16:04.942Z"
},
{
"viewport": "narrow",
"index": 0,
"action": "visible",
"status": "passed",
"at": "2026-10-18T16:16:05.847Z",
"selector": "h1"
},
{
"viewport": "narrow",
"index": 1,
"action": "text",
"status": "passed",
"at": "2026-10-18T16:16:05.959Z",
"selector": "#count"
},
{
"viewport": "narrow",
"index": 2,
"action": "press",
"status": "passed",
"at": "2026-10-18T16:16:06.052Z",
"key": "Tab"
},
{
"viewport": "narrow",
"index": 3,
"action": "focused",
"status": "passed",
"at": "2026-10-18T16:16:06.062Z",
"selector": "#increment"
},
{
"viewport": "narrow",
"index": 4,
"action": "press",
"status": "passed",
"at": "2026-10-18T16:16:06.070Z",
"key": "Enter"
},
{
"viewport": "narrow",
"index": 5,
"action": "text",
"status": "passed",
"at": "2026-10-18T16:16:06.099Z",
"selector": "#count"
},
{
"viewport": "narrow",
"index": 6,
"action": "screenshot",
"status": "passed",
"at": "2026-10-18T16:16:06.105Z"
}
],
"artifacts": [
{
"name": "desktop-6-keyboard-result.png",
"bytes": 26622
},
{
"name": "desktop-final.png",
"bytes": 26622
},
{
"name": "narrow-6-keyboard-result.png",
"bytes": 24280
},
{
"name": "narrow-final.png",
"bytes": 24280
}
],
"started_at": "2026-10-18T16:16:02.519Z",
"blocked_requests": 12,
"finished_at": "2026-10-18T16:16:06.457Z",
"downloads": [
{
"name": "desktop-6-keyboard-result.png",
"bytes": 26622,
"sha256": "b15998824256b86c74f2bbb75f061061be65db0b4f3bb5444529ac69a723cdad"
},
{
"name": "desktop-final.png",
"bytes": 26622,
"sha256": "b15998824256b86c74f2bbb75f061061be65db0b4f3bb5444529ac69a723cdad"
},
{
"name": "narrow-6-keyboard-result.png",
"bytes": 24280,
"sha256": "49d27cb169b8e180ce93969c6d2b8619a7684cf035bb9dcae9cd91d8bd9952e8"
},
{
"name": "narrow-final.png",
"bytes": 24280,
"sha256": "49d27cb169b8e180ce93969c6d2b8619a7684cf035bb9dcae9cd91d8bd9952e8"
}
]
}

BIN
docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-human/desktop-final.png Normal file
View file

Binary file not shown.
Side by side

After

Width:  |  Height:  |  Size: 26 KiB

BIN
docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-human/narrow-final.png Normal file
View file

Binary file not shown.
Side by side

After

Width:  |  Height:  |  Size: 24 KiB

24
docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-human/preflight.json Normal file
View file

@ -0,0 +1,24 @@
{
"available": true,
"error": null,
"checked_at": "2026-10-18T16:16:48.083Z",
"browser_version": "156.0.8078.4",
"api_version": "1",
"service_version": "0.1.0",
"playwright_version": "1.64.0",
"execution_location": "railiance01/playwright",
"release": "forgejo.coulomb.social/coulomb/rapp-playwright@sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441",
"allowed_origins": [
"https://onco.cc"
],
"fixture": true,
"active": 0,
"queued": 0,
"limits": {
"concurrency": 1,
"max_queue": 4,
"max_timeout_ms": 120000,
"retention_ms": 3600000,
"max_runs": 64
}
}

184
docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-human/receipt.json Normal file
View file

@ -0,0 +1,184 @@
{
"id": "d81a5166-83d9-4382-a6e8-a90cfc3f0a51",
"api_version": "1",
"status": "passed",
"error": null,
"label": "independent-browser-trial",
"target": "fixture",
"viewports": [
{
"name": "desktop",
"width": 1280,
"height": 800
},
{
"name": "narrow",
"width": 390,
"height": 844
}
],
"timeout_ms": 60000,
"created_at": "2026-10-18T16:17:42.400Z",
"expires_at": "2026-10-18T17:17:42.400Z",
"service_version": "0.1.0",
"playwright_version": "1.64.0",
"release": "forgejo.coulomb.social/coulomb/rapp-playwright@sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441",
"execution_location": "railiance01/playwright",
"browser_version": "156.0.8078.4",
"completed_steps": 14,
"steps": [
{
"viewport": "desktop",
"index": 0,
"action": "visible",
"status": "passed",
"at": "2026-10-18T16:17:44.301Z",
"selector": "h1"
},
{
"viewport": "desktop",
"index": 1,
"action": "text",
"status": "passed",
"at": "2026-10-18T16:17:44.448Z",
"selector": "#count"
},
{
"viewport": "desktop",
"index": 2,
"action": "press",
"status": "passed",
"at": "2026-10-18T16:17:44.505Z",
"key": "Tab"
},
{
"viewport": "desktop",
"index": 3,
"action": "focused",
"status": "passed",
"at": "2026-10-18T16:17:44.510Z",
"selector": "#increment"
},
{
"viewport": "desktop",
"index": 4,
"action": "press",
"status": "passed",
"at": "2026-10-18T16:17:44.544Z",
"key": "Enter"
},
{
"viewport": "desktop",
"index": 5,
"action": "text",
"status": "passed",
"at": "2026-10-18T16:17:44.548Z",
"selector": "#count"
},
{
"viewport": "desktop",
"index": 6,
"action": "screenshot",
"status": "passed",
"at": "2026-10-18T16:17:44.551Z"
},
{
"viewport": "narrow",
"index": 0,
"action": "visible",
"status": "passed",
"at": "2026-10-18T16:17:45.508Z",
"selector": "h1"
},
{
"viewport": "narrow",
"index": 1,
"action": "text",
"status": "passed",
"at": "2026-10-18T16:17:45.699Z",
"selector": "#count"
},
{
"viewport": "narrow",
"index": 2,
"action": "press",
"status": "passed",
"at": "2026-10-18T16:17:45.749Z",
"key": "Tab"
},
{
"viewport": "narrow",
"index": 3,
"action": "focused",
"status": "passed",
"at": "2026-10-18T16:17:45.755Z",
"selector": "#increment"
},
{
"viewport": "narrow",
"index": 4,
"action": "press",
"status": "passed",
"at": "2026-10-18T16:17:45.759Z",
"key": "Enter"
},
{
"viewport": "narrow",
"index": 5,
"action": "text",
"status": "passed",
"at": "2026-10-18T16:17:45.801Z",
"selector": "#count"
},
{
"viewport": "narrow",
"index": 6,
"action": "screenshot",
"status": "passed",
"at": "2026-10-18T16:17:45.804Z"
}
],
"artifacts": [
{
"name": "desktop-6-keyboard-result.png",
"bytes": 26622
},
{
"name": "desktop-final.png",
"bytes": 26622
},
{
"name": "narrow-6-keyboard-result.png",
"bytes": 24280
},
{
"name": "narrow-final.png",
"bytes": 24280
}
],
"started_at": "2026-10-18T16:17:42.401Z",
"blocked_requests": 12,
"finished_at": "2026-10-18T16:17:46.202Z",
"downloads": [
{
"name": "desktop-6-keyboard-result.png",
"bytes": 26622,
"sha256": "b15998824256b86c74f2bbb75f061061be65db0b4f3bb5444529ac69a723cdad"
},
{
"name": "desktop-final.png",
"bytes": 26622,
"sha256": "b15998824256b86c74f2bbb75f061061be65db0b4f3bb5444529ac69a723cdad"
},
{
"name": "narrow-6-keyboard-result.png",
"bytes": 24280,
"sha256": "49d27cb169b8e180ce93969c6d2b8619a7684cf035bb9dcae9cd91d8bd9952e8"
},
{
"name": "narrow-final.png",
"bytes": 24280,
"sha256": "49d27cb169b8e180ce93969c6d2b8619a7684cf035bb9dcae9cd91d8bd9952e8"
}
]
}

13
docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-profile.json Normal file
View file

@ -0,0 +1,13 @@
{
"profile": "supervised-build-mode",
"human_run": "d81a5166-83d9-4382-a6e8-a90cfc3f0a51",
"agent_run": "893a8bcb-9b7f-48f1-8a51-c116de3f3097",
"human_execution_confirmed_by": "Actual founder reply with passed output; local receipt readback agrees",
"transport": "Existing authenticated workstation kubectl port-forward; no kubeconfig or secret distribution",
"independent_per_caller_identity_accepted": false,
"new_native_configuration": false,
"security_followup": "CUST-WP-0082-T21",
"capability_files": "run.json stays private in original /tmp directories and is not included",
"client_source": "/home/worsch/rapp-playwright/client/rapp_playwright.py",
"client_sha256": "9967a0831ed04e27fde419098af707722d5c81c993e4c294b3677ffb75729c12"
}

15
docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/validation.json Normal file
View file

@ -0,0 +1,15 @@
{
"verified": true,
"original_task_bindings_preserved": 40,
"new_hardening_task_bindings": 25,
"requirements_preserved_unchanged": 116,
"full_transfers_not_implemented": 19,
"wp80_status_counts": {
"done": 14,
"progress": 4,
"todo": 3,
"cancel": 19
},
"playwright_real_human_and_agent": "passed",
"security_conformance_claimed": false
}

661
docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/workplan-before.txt Normal file
View file

@ -0,0 +1,661 @@
---
id: CUST-WP-0080
type: workplan
title: "NetKingdom target security architecture and SEC-DSM implementation"
domain: infotech
repo: the-custodian
status: active
owner: codex
topic_slug: custodian
created: "2026-10-12"
updated: "2026-10-18"
flavor: implementation
depends_on: []
state_hub_workstream_id: "dfadb19b-445e-59c6-bcd6-48e87b912c52"
---
# WP-80 delivery overview
Updated 18 October 2026 after the founder requested clearer progress and smaller tasks.
| Measure | Current state | Meaning |
| --- | --- | --- |
| Completed source evidence checkpoints | **7 of 7**: T07-T13 | Published/reviewed foundations at their stated scope; no native acceptance inferred. |
| Remaining integration/build checkpoints | **0 of 6**: T14-T19 | Current ongoing access, protected operation/inverse, writer exclusion and final build still need completion. |
| Delivery checkpoints overall | **8 done, 0 in progress, 26 todo**: T07-T40 | Discrete Custodian evidence checkpoints linked to existing owner implementation work. |
| Complete native architecture gates | **0 of 16**: TSA-01-TSA-16 | Each requires its full deployed/consumer evidence. This is not 0% engineering progress. |
| Original coordination records | **2 of 6 done**: T01-T06 | Stable umbrella IDs/UUIDs retained for existing callers; not a delivery percentage. |
**Completed - T20:** the founder-admitted scanner revision passed native activation,
including 166 scanner fragments, 1,328 protected hook files, both-version startup
custody, actual template inheritance, receive-pack refusal/recovery and cleanup.
Normal publication pushed all five queued Custodian commits; exact Hub readback
verified all 40 task UUID/status bindings. The publication blocker is cleared.
This scoped scanner acceptance does not close a complete architecture gate.
**Next - T14/T15:** implement and verify the selected current KeyCape checks on
ongoing browser/API/Git HTTP and SSH paths, using the existing producer clients.
Then T16-T19 finish exact operation/inverse, writer exclusion and the final release.
While one native checkpoint awaits a concrete approval/owner return, one independent
source checkpoint may progress. Limit active delivery work to two checkpoints.
**Already delivered:** shared signed-decision/approval foundations; the current-token
client and fresh inverse-session verification; actual issuer-to-Forgejo login;
PostgreSQL crash/restart and inverse mechanics; the bounded scanner correction;
provider index/parity repairs; workload-isolation fixture proof. T07-T13 carry the
scope and evidence for each. The new completed records expose existing delivered
work; they do not represent seven newly deployed systems.
**Publication and Hub view:** normal source publication is working again.
The five queued Custodian commits were published through c1fcd948; all 40 task
records (six original coordination records plus 34 delivery checkpoints) are
present in the Hub with verified source bindings. T20 is now complete. The Hub
remains the derived view; this file owns checkpoint status. Subsequent source
changes use the same ordinary commit/consistency path.
**Scope:** all 16 gates, G01-G13 and all 116 SEC-DSM ledger entries remain required.
[Target and acceptance contract](../docs/netkingdom-target-security-architecture.md),
[owner implementation record](../docs/netkingdom-target-implementation.md),
[gap register](../docs/netkingdom-security-gaps.md),
[requirement ledger](../docs/evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json).
Existing scoped approvals, deferrals, independent owner assent and explicit residual
promotion rules remain effective. This refinement grants no runtime authority.
**Ownership and updates:** T07-T40 are Custodian review/acceptance checkpoints, not
replacement owner implementation tasks. Owner files own implementation status;
this file owns coordination/evidence-checkpoint status; the Hub is its derived view.
Every progress update names the checkpoint, concrete output, exact evidence scope,
remaining acceptance and next action. Link original evidence rather than recopying
it. Re-run checks only for changed inputs, failures or a specific unresolved concern.
Route new findings into the existing owner record and mapped checkpoint before
adding another workplan. Do not infer an overall percentage from mixed-stage counts.
The complete prior task/session history is preserved byte-for-byte in the
[pre-refinement snapshot](../docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/workplan-before-refinement.txt).
No old task binding or status was replaced; history is evidence, not a second live backlog.
## Review canon and map actual architecture
```task
id: CUST-WP-0080-T01
status: done
priority: high
state_hub_task_id: "c770f7e1-25eb-53ec-9a37-1f7794077ff8"
```
Completed the SecurityCanon SEC-DSM and existing-owner architecture review. Delivered [security blueprint](../docs/netkingdom-security-blueprint.md). The inventory distinguishes reference/documentation capabilities from runtime enforcement. This record is retained unchanged in status and identity.
## Inspect and optimize the blueprint before planning closure
```task
id: CUST-WP-0080-T02
status: done
priority: high
state_hub_task_id: "5973026f-8ca9-5882-99fe-65a54bc250ac"
```
Completed trust-boundary, owner, lifecycle and dependency inspection. Delivered the [gap analysis](../docs/netkingdom-security-gaps.md) and target direction. This completed design review does not claim native conformance.
## Close source defects and reconcile uncovered lifecycle gaps
```task
id: CUST-WP-0080-T03
status: progress
priority: high
state_hub_task_id: "87637402-02f1-57c1-8fbc-4141598af8e3"
```
Coordination umbrella. Drive remaining source/lifecycle closure through the existing owners and specific checkpoints, especially T14-T19, T29-T31 and T38-T40. Preserve G04/G07/G08/G10/G12/G13, original source defects and all existing owner obligations. T07-T13 expose completed bounded source reviews; they do not close this umbrella. Close only when all source/lifecycle findings have verified completion or a valid governed handoff consistent with the full target.
## Verify native closure against every requirement
```task
id: CUST-WP-0080-T04
status: todo
depends_on: [CUST-WP-0080-T03]
priority: high
state_hub_task_id: "82378b0f-7004-5c2f-9683-b356a1227576"
```
Final acceptance audit. Reconcile every TSA-01-TSA-16 gate, G01-G13 and all 116 individual requirements with exact current evidence or an actually approved applicable exception. Require the human/agent journeys, second real consumer, clean installation and operational acceptance. Plans, source tests and owner handoffs are insufficient. Transfer any permitted residuals into live records before finishing; preserve required work and explicit deferrals.
## Coordinate self-service Playwright identity delivery
```task
id: CUST-WP-0080-T05
status: progress
priority: high
depends_on: [RPF-WP-0056, RAPP-PLAYWRIGHT-WP-0004]
state_hub_task_id: "ed8b909a-23bf-5e5f-b600-e477fbae136b"
```
Coordination umbrella for T25/T26 and supported consumer/discovery evidence. Retain incoming request `1b279bad-a159-43da-8709-1167882e62f8`, [existing delivery case](../infra/security-flow/playwright-delivery.json), RPF-WP-0056-T03 and RAPP-PLAYWRIGHT-WP-0004-T01/T03. Existing eligible platform humans/coding agents need no renewed membership decision. Collect exact registration/custody/authenticator/per-caller transport returns and Platform/provider native acceptance. Do not substitute a deployed browser, shared admin kubeconfig or accepted provider-only crash proof for the actual human/agent journeys.
## Establish the target architecture and drive the restructuring
```task
id: CUST-WP-0080-T06
status: progress
priority: high
state_hub_task_id: "6aca534c-5c7a-556f-b6b6-406433670c29"
```
Coordination umbrella for the full target and owner sequencing. Preserve independently owned security meaning, identity, authorization, approval, custody and audit; reuse producer clients, case templates and owner workplans. Keep all sixteen gates and the complete ledger in scope. This task closes with the target exit condition and T04 audit, not another source wave. Prior delegation is historical evidence, not an inherited runtime/autopilot grant.
## T07 - Review signed decision and approval interoperability
```task
id: CUST-WP-0080-T07
status: done
priority: high
state_hub_task_id: "bb236dea-30f7-5437-b01c-f14d2509e061"
```
Stage: source evidence. Owner implementation: Access Engine / Secrets / Approval; FLEX-WP-0024, SECRETS-WP-0014, APPROVAL-WP-0004.
Completed source review of actual producer-to-consumer signing, strict handoff, precise approval consumption and independent confirmation. Published implementations and local/disposable cross-owner proofs exist. Live signer, caller, policy and package admission remain T21/T22.
[Evidence](../docs/changes/netkingdom-target-2026-10-16/coordinator-source-review.json).
## T08 - Review the shared current-token client and fresh inverse session
```task
id: CUST-WP-0080-T08
status: done
priority: high
state_hub_task_id: "18b885fe-503f-5ebc-b390-808f71316264"
```
Stage: source evidence. Owner implementation: KeyCape / Warden; KEY-WP-0042-T04, WARDEN-WP-0044.
Published producer-owned current-token client, generated adapter/drift check and fresh inverse-session verification. The actual cross-owner fixture passed 45 assertions. Immutable original provenance grants no replay authority. Actual target operation/inverse remains T16/T17.
[Evidence](../docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/README.md).
## T09 - Review actual issuer-to-Forgejo current-token login
```task
id: CUST-WP-0080-T09
status: done
priority: high
state_hub_task_id: "a1f2dbe0-13d4-57a2-a2b5-c0137cd48410"
```
Stage: source evidence. Owner implementation: KeyCape / Apps; KEY-WP-0042, RAPPS-WP-0016-T09.
Actual issuer/provider/callback passed five process scenarios: two current grants accepted; mixed pair, revoked grant and suspended human refused. The selected composed suite passed 116 test/subtest results without skips. MFA/PDP admissions were synthetic. Ongoing operations remain T14/T15; live acceptance remains T23.
[Evidence](../docs/changes/netkingdom-target-2026-10-18/forgejo-current-token-r1/validation-summary.json).
## T10 - Review Forgejo PostgreSQL recovery and inverse mechanics
```task
id: CUST-WP-0080-T10
status: done
priority: high
state_hub_task_id: "1f3c78af-5686-58ea-9133-8afc2df36b8f"
```
Stage: source evidence. Owner implementation: Apps / NetKingdom; RAPPS-WP-0016-T07/T08, NK-WP-0048.
Actual Forgejo model/schema tests passed 37 results across three PostgreSQL profiles, including process death and actual database restart, exact inverse, drift and writer-lock counterexamples. This is disposable database/source proof. Fresh operation authority, durable journal custody and exclusion of every release writer remain T16-T18.
[Evidence](../docs/changes/netkingdom-target-2026-10-18/forgejo-postgres-source-r1/README.md).
## T11 - Review the bounded receive-scanner correction
```task
id: CUST-WP-0080-T11
status: done
priority: high
state_hub_task_id: "bffd4e10-2cf0-5835-a8d0-ae1763ca3873"
```
Stage: source evidence. Owner implementation: Forge / Repo Manager; FORGE-WP-0010-T01.
Forge ea65606c is published. The exact refused 141-object/one-ref delta passes in 52.53 seconds under the unchanged 90-second deadline. There are 54 distinct passing leaf cases and no skips. Original failures are retained. Native rollout and ordinary publication remain T20.
[Evidence](../docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/README.md).
## T12 - Review provider discovery and source/index parity repairs
```task
id: CUST-WP-0080-T12
status: done
priority: high
state_hub_task_id: "bb09e414-6d79-5dcd-b8e6-b73a046a4dda"
```
Stage: source evidence. Owner implementation: Reuse / Bootstrap / NetKingdom; existing provider records.
Verified published provider index/parity changes and owner source bindings. This closes the dated source review, not ongoing hosted freshness, source-link/version correctness or recurring drift acceptance; those remain T33.
[Evidence](../docs/changes/netkingdom-target-2026-10-16/source-wave12-coordinator-review.json).
## T13 - Review workload-credential isolation in the sandbox fixture
```task
id: CUST-WP-0080-T13
status: done
priority: high
state_hub_task_id: "793e78f0-7782-5e48-bdc0-b65127b32ecb"
```
Stage: source evidence. Owner implementation: Glas / rein; GLAS-WP-0012, CUST-WP-0073.
Published workload-only credential delivery passed 141 tests and actual disposable bwrap host/environment/subprocess denial, redaction and teardown checks. The current interactive Custodian assignment is not admitted by that fixture. Real assignment and runner acceptance remain T27/T28.
[Evidence](../docs/changes/netkingdom-target-2026-10-16/coordinator-source-review.json).
## T14 - Verify current identity on browser, API and Git HTTP paths
```task
id: CUST-WP-0080-T14
status: todo
priority: high
depends_on: [CUST-WP-0080-T09]
state_hub_task_id: "7ecbd622-03a8-5b49-9621-8d21d7d15890"
```
Stage: source integration. Owner implementation: Apps / KeyCape / Access; RAPPS-WP-0016-T09, NK-WP-0048-T43.
Completion test: Actual shared authentication routes enforce current linked account/source/subject/application-tenant bindings, current groups and exact resource/action policy. Tests must cover revoked, suspended, expired, unavailable and mismatched identity, plus terminal refusal without fallback. Preserve the separate local break-glass path and prevent federated unlink/downgrade escape.
## T15 - Verify current identity on the independent SSH path
```task
id: CUST-WP-0080-T15
status: todo
priority: high
depends_on: [CUST-WP-0080-T14]
state_hub_task_id: "434d9c78-7789-5b78-8d9d-d87b0638b469"
```
Stage: source integration. Owner implementation: Apps / KeyCape / Access; RAPPS-WP-0016-T09, NK-WP-0048-T43.
Completion test: The actual private SSH service checks the same producer-owned identity and policy contract before repository creation or effects. Native SSH keys cannot bypass current linked identity. Positive, denial, revocation, unavailable and account/source mismatch cases pass; local break-glass behavior is covered.
## T16 - Verify exact current authority for the protected Forgejo operation
```task
id: CUST-WP-0080-T16
status: todo
priority: high
depends_on: [CUST-WP-0080-T07, CUST-WP-0080-T08, CUST-WP-0080-T09]
state_hub_task_id: "e6183073-cc8e-5c6f-8fbd-db50bb1a466c"
```
Stage: source integration. Owner implementation: NetKingdom / Warden / Apps / Approval / Access; existing NK-WP-0048 operation tasks.
Completion test: The actual operation entry path authenticates the current actor/session and binds tenant, exact target/action, payload/source revision, decision and required approval before journal writes or owner effects. Wrong actor/body/tenant, expired authority, unavailable producers and business replay refuse. Existing producer contracts remain authoritative.
## T17 - Verify the fresh inverse and durable private recovery journal
```task
id: CUST-WP-0080-T17
status: todo
priority: high
depends_on: [CUST-WP-0080-T16]
state_hub_task_id: "4de46468-7ae2-59e3-be2b-1a32506153a5"
```
Stage: source integration. Owner implementation: Apps / Warden / NetKingdom; RAPPS-WP-0016-T07/T08 and existing NK-WP-0048 inverse tasks.
Completion test: An exact prior operation can be reconciled and inversed with fresh current authority while retaining original provenance and unknown outcomes. Private journal custody, permissions, persistence, retention and recovery are explicit. Cover public client, unchanged secret delivery and failure before hand-over receipt; receipt deletion alone is not the inverse.
## T18 - Verify exclusion of every Forgejo release writer
```task
id: CUST-WP-0080-T18
status: todo
priority: high
depends_on: [CUST-WP-0080-T10, CUST-WP-0080-T16]
state_hub_task_id: "fd796e9c-dd70-5c65-a6fe-eafe3911bc8f"
```
Stage: source integration. Owner implementation: Apps / NetKingdom / deployment owners; existing NK-WP-0048 writer obligations.
Completion test: Inventory and constrain every actual release/configuration writer for prepare/check/effect/inverse, including uncooperative writers. Demonstrate target drift and concurrent-write refusals at the declared database/release scope. A local advisory lock or the earlier source transaction test alone cannot close this checkpoint.
## T19 - Verify the complete final Forgejo release and OCI artifact
```task
id: CUST-WP-0080-T19
status: todo
priority: high
depends_on: [CUST-WP-0080-T14, CUST-WP-0080-T15, CUST-WP-0080-T16, CUST-WP-0080-T17, CUST-WP-0080-T18]
state_hub_task_id: "4ffd2e33-d887-5686-bad1-7f32a56191a8"
```
Stage: artifact build. Owner implementation: Apps; RAPPS-WP-0016 build/operation tasks.
Completion test: Build the final integrated revision with pinned source/tool/dependency inputs, all frontend/static assets and the static backend. Verify release CLI/source parity, complete required checks, artifact hashes and the local OCI package. Prior 40-path build evidence does not establish a later integrated release. Independent admission and live acceptance remain T23.
## T20 - Accept the native receive-scanner correction and ordinary publication
```task
id: CUST-WP-0080-T20
status: done
priority: high
depends_on: [CUST-WP-0080-T11]
state_hub_task_id: "0d9df435-b9a2-5b89-833d-799785c969a9"
```
Stage: native acceptance. Owner implementation: Forge / Apps / Repo Manager; FORGE-WP-0010-T02/T03.
Completed: [exact revision 1](../docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/README.md) received founder go cb9a20f9 after independent Forge/Apps approval. Native stage and activation verified exact binaries/startup, 166 scanner fragments, 1,328 protected hook files, actual inherited executable hook, clean/blocked/unavailable receive-pack, quarantine and cleanup. Apps declaration 2fdc198b is published. Normal Custodian publication pushed five queued commits through c1fcd948 and exact Hub readback matched all 40 task UUID/status bindings. See publication-readback-r1.json in that packet. Independent Forge owner accepted the native/publication returns against FORGE-WP-0010-T02/T03; that existing owner workplan remains the implementation record. Other target gates and existing residual boundaries remain open.
## T21 - Accept signed decisions at the native privileged consumers
```task
id: CUST-WP-0080-T21
status: todo
priority: high
depends_on: [CUST-WP-0080-T07]
state_hub_task_id: "fa11a2a4-4dbd-5dfb-ad29-bc7a99cc6258"
```
Stage: native acceptance. Owner implementation: Secrets / Access / Platform; SECRETS-WP-0014, FLEX-WP-0024.
Completion test: Admit exact producer package, signer/channel, independent consumer trust and caller/policy bindings. Account for the privileged PEP denominator and prove native forged, altered, wrong-key, unsigned/downgrade, expired, unavailable and rotation refusals. Source fixtures do not close TSA-01.
## T22 - Accept one native approved operation and crash recovery
```task
id: CUST-WP-0080-T22
status: todo
priority: high
depends_on: [CUST-WP-0080-T21, CUST-WP-0080-T16, CUST-WP-0080-T17, CUST-WP-0080-T18]
state_hub_task_id: "88588db8-8c6e-5d15-a85b-2c068f4e8a2a"
```
Stage: native acceptance. Owner implementation: Platform / Secrets / Approval / Audit; RPF-WP-0035-T12, SECRETS-WP-0013, APPROVAL-WP-0004.
Completion test: One exact approved effect passes authoritative consume/confirmation, target precondition/readback and independently verified cleanup. Native crash/restart/concurrency preserves unknown outcomes and forbids blind replay; actor/tenant/body/replay/expiry/unavailable negatives pass. Admit real custody and recovery grants. Closes only the declared TSA-02/TSA-03 scope.
## T23 - Accept the complete first Forgejo browser security case
```task
id: CUST-WP-0080-T23
status: todo
priority: high
depends_on: [CUST-WP-0080-T19]
state_hub_task_id: "266e228b-7754-5323-b0c6-37f860592d90"
```
Stage: native acceptance. Owner implementation: NetKingdom / Mason / Warden / KeyCape / Apps; NK-WP-0048.
Completion test: Admit exact case/type/provider/package revisions and private execution custody. Independently verify native structure, contained registration/delivery, sign-in, denied groups/actions, current ongoing API/Git/SSH access, revocation, exact inverse and rollback. Owner assent and actual deployed receipts are mandatory; a compiled patch or acknowledged case is insufficient.
## T24 - Accept attended U08 factor recovery and fresh sign-in
```task
id: CUST-WP-0080-T24
status: todo
priority: high
state_hub_task_id: "a4f06ce0-69a5-5cbb-9d78-6c5b89ba9853"
```
Stage: human journey. Owner implementation: User / KeyCape; USER-WP-0028-T03, KEY-WP-0040.
Completion test: Requalify the existing User task to the actual founder-attended disable/re-enroll/fresh-login window and obtain its value-free acceptance. KEY-WP-0040 preview/help-link corrections are already accepted; do not request or repeat that preview. No factor mutation is authorized by this plan refinement.
## T25 - Accept the real human Playwright journey
```task
id: CUST-WP-0080-T25
status: todo
priority: high
state_hub_task_id: "3be1c76d-a5f3-5dea-9777-349dc97e836e"
```
Stage: consumer acceptance. Owner implementation: Platform / Playwright / NetKingdom / cluster / bridge; RPF-WP-0056-T03, RAPP-PLAYWRIGHT-WP-0004, NK-WP-0050.
Completion test: Collect exact registration/custody/JWT-authenticator/per-caller transport owner returns, then run the supported command as one real human. Verify sign-in, scope/permission denial, browser operation, renewal/revocation and recovery, accepted by Platform and provider. Existing qualified humans need no new membership decision.
## T26 - Accept the registered agent Playwright journey
```task
id: CUST-WP-0080-T26
status: todo
priority: high
state_hub_task_id: "0491b6b4-a238-58ef-bf3a-505749e5655c"
```
Stage: consumer acceptance. Owner implementation: Platform / Playwright / NetKingdom / cluster / bridge; same existing consumer case as T25.
Completion test: Use one distinguishable registered agent and its admitted per-caller transport, not a shared admin kubeconfig or workstation identity. Verify the supported command, allowed/denied browser/API actions, expiry/cancellation, revocation and cleanup, with Platform/provider acceptance and supported consumer documentation.
## T27 - Accept the actual interactive agent isolation profile
```task
id: CUST-WP-0080-T27
status: todo
priority: high
depends_on: [CUST-WP-0080-T13]
state_hub_task_id: "19540d29-c4df-5f1a-acf7-127965c9a396"
```
Stage: runtime acceptance. Owner implementation: Glas / selected rein / Platform / Warden; GLAS-WP-0012, CUST-WP-0073-T02/T04.
Completion test: Admit this identified running assignment and verify admin-material read denial through files, mounts, environment, subprocesses and available tools, plus allowed task effects, expiry/cancel cleanup and no cross-task credential accumulation. Fixture success or another agent's authority record cannot substitute.
## T28 - Accept per-job runner authority and workflow-abuse refusals
```task
id: CUST-WP-0080-T28
status: todo
priority: high
state_hub_task_id: "5ac99f55-0dde-5d1c-b88c-b85f34469abc"
```
Stage: runtime acceptance. Owner implementation: Forge / Platform / enablement; existing runner and CI owner work.
Completion test: Verify actual job-specific credential/repository/deployment scope, teardown and abuse tests using repository-controlled workflows. Reuse the accepted Docker listener repair; do not repeat it as new progress. Prove jobs cannot disable the independent receive control or reach unrelated deployment credentials.
## T29 - Reconcile the current credential and consumer metadata inventory
```task
id: CUST-WP-0080-T29
status: todo
priority: high
state_hub_task_id: "3ec89fb2-fe97-50f5-a3c9-88b731b0d2ec"
```
Stage: lifecycle evidence. Owner implementation: Secrets / Mason / Platform / NetKingdom; MASON-WP-0004, NK-WP-0049.
Completion test: Produce a current metadata-only denominator with owner, purpose, exact scope, issuer/delivery, consumers, copies, expiry/rotation/revocation and recovery/deletion procedures. Unknown/orphan entries remain findings. Identify native-identity elimination candidates. Never retrieve values to improve the inventory.
## T30 - Accept sampled credential replacement, revocation and copy deletion
```task
id: CUST-WP-0080-T30
status: todo
priority: high
depends_on: [CUST-WP-0080-T29]
state_hub_task_id: "457400ad-6c44-5160-a77a-63c6ad5acabc"
```
Stage: lifecycle acceptance. Owner implementation: Secrets / Platform / credential consumers; existing lifecycle plans.
Completion test: For the admitted samples, demonstrate replacement adoption, old-credential refusal, refresh/deletion semantics and reconciled delivery copies. Preserve the founder-deferred exposure rotation; it requires its actual governing exception/decision rather than silent execution or a completion claim.
## T31 - Accept independent root recovery with the normal issuer unavailable
```task
id: CUST-WP-0080-T31
status: todo
priority: high
depends_on: [CUST-WP-0080-T29]
state_hub_task_id: "cbf32375-279a-5bf3-b867-06333a1ff2ca"
```
Stage: recovery acceptance. Owner implementation: NetKingdom / Warden / Platform / recovery owners; NK-WP-0049, WARDEN-WP-0027.
Completion test: In a fresh authorized scenario verify independent/off-host custody and access, restore, existing MFA/service/consumer continuity, reconnect and audit continuity; measure RTO/RPO. Reuse accepted archive/source proofs without equating them to complete native recovery. Honor scoped authority and the build-mode single-holder decision.
## T32 - Accept independent effect-to-outbox-to-audit reconciliation
```task
id: CUST-WP-0080-T32
status: todo
priority: high
depends_on: [CUST-WP-0080-T22]
state_hub_task_id: "5a0cb7f7-1cd8-50ba-8af2-a2b13ed34a18"
```
Stage: audit acceptance. Owner implementation: Audit Core / emitting owners; AUDIT-WP-0013/0014/0015 and existing emission tasks.
Completion test: Admit actual sender/source/class inventory and reconcile the first protected effect, atomic outbox and durable independent receiver readback. Account for lag, duplicates, missing classes and failure recovery. Archive custody alone is not source completeness; State Hub remains an index, not credential/evidence custody.
## T33 - Accept current discovery, version and package-family accuracy
```task
id: CUST-WP-0080-T33
status: todo
priority: high
depends_on: [CUST-WP-0080-T12]
state_hub_task_id: "4547ac4c-8893-54fe-ae6e-362682bb7920"
```
Stage: discovery acceptance. Owner implementation: Reuse / Repo Manager / capability owners.
Completion test: Recheck all 70 reviewed capability IDs exactly once against owner source, usable links, truthful limits, versions/aliases and package-family disposition. Verify hosted/provider index parity and recurring drift behavior. Source owners remain authoritative; do not create another capability catalog.
## T34 - Accept the first unassisted security-flow run
```task
id: CUST-WP-0080-T34
status: todo
priority: high
state_hub_task_id: "393b9fcc-323b-5182-92c6-44530fce7efb"
```
Stage: operational acceptance. Owner implementation: Activity / Coordination / Custodian; ACTIVITY-WP-0047, CUST-WP-0079.
Completion test: Admit and activate the existing schedule through its owner path, observe an unassisted firing, checkpoint and changed-state notification, and verify adopted cadence at runtime and receiver. A schedule acknowledgement or source cadence constant does not count. Scheduling never creates action authority.
## T35 - Accept a second real consumer using the shared adapters
```task
id: CUST-WP-0080-T35
status: todo
priority: high
depends_on: [CUST-WP-0080-T23]
state_hub_task_id: "db274192-07d6-5be7-9c1e-d63c5a9fb57f"
```
Stage: reuse acceptance. Owner implementation: NetKingdom / provider owners / selected second consumer.
Completion test: The second actual consumer uses the same producer-owned identity/decision/approval adapters and case contracts. Verify allowed/denied-path parity, version compatibility, upgrade and rollback without a second PDP, token registry or independently copied evaluator. Record the per-consumer integration work.
## T36 - Accept a clean second installation of the minimal profile
```task
id: CUST-WP-0080-T36
status: todo
priority: high
depends_on: [CUST-WP-0080-T23]
state_hub_task_id: "586232a1-57b0-5e04-a61b-fb687bcc8999"
```
Stage: installation acceptance. Owner implementation: NetKingdom / provider and installation owners.
Completion test: Use locked versions/providers and declared optional dependencies to install a minimal profile from clean state. Complete positive/negative journeys and upgrade/recovery instructions with independently checked results. Source reuse alone does not prove installability or portability.
## T37 - Measure delivery time, runtime cost and performance improvement
```task
id: CUST-WP-0080-T37
status: todo
priority: high
state_hub_task_id: "d533ca34-a691-5f8e-8cc2-5f408b679538"
```
Stage: measurement. Owner implementation: Resource / telemetry / consumer owners; CUST-WP-0071 where applicable.
Completion test: Record baseline and comparable after measurements for onboarding time/manual touches, p50/p95 decision/effect latency, scanner throughput/failures, resource/headroom and owner effort with unchanged control coverage. Retain the measured scanner correction as one completed sample; do not generalize it to all workflows.
## T38 - Reconcile requirement-level exceptions and explicit deferrals
```task
id: CUST-WP-0080-T38
status: todo
priority: high
state_hub_task_id: "2350a829-bd8c-5c3b-9f39-07bfa1c3f228"
```
Stage: governance evidence. Owner implementation: Custodian / governance / affected owners; close-down checklist and actual founder decisions.
Completion test: Map each remaining exception/deferral to the exact SEC-DSM requirement, scope, real approval reference, risk, compensating controls, owner and review/revalidation. Preserve missing approvals as open; never invent assent, backfill a scored success or promote all residuals. Required leftovers become live work records before finishing.
## T39 - Accept declared source and delivery entry-path coverage
```task
id: CUST-WP-0080-T39
status: todo
priority: high
depends_on: [CUST-WP-0080-T20, CUST-WP-0080-T28]
state_hub_task_id: "da6ae9a3-9107-5ca7-adb2-c9d85b3c529c"
```
Stage: delivery acceptance. Owner implementation: Forge / Repo Manager / enablement; RMGR-WP-0021 and existing Forge owner work.
Completion test: Reconcile the production-repository denominator and actual SSH/HTTP/UI/new-repository/import/mirror entry paths, required checks and artifact provenance. Keep the external-submodule compatibility exception visible. Assess any necessary FORGE-WP-0008 residual dependency for explicit owner-scoped promotion before implementation; existing hook presence alone cannot close TSA-10.
## T40 - Accept a private finding through classification and response
```task
id: CUST-WP-0080-T40
status: todo
priority: high
depends_on: [CUST-WP-0080-T39]
state_hub_task_id: "8e71f6f0-9fc3-509b-8f1b-768f7d9cbd0e"
```
Stage: response acceptance. Owner implementation: Repo Manager / Forge / incident and credential-custody owners; RMGR-WP-0021-T04.
Completion test: Run an admitted private synthetic finding through the actual detection, classification, custody/response and resolution path with sanitized independent receipts. Establish owner responsibility for revocation where relevant. Rejecting a push or deleting source material does not itself prove incident resolution; do not send raw findings or credentials through coordination messages.
## Acceptance coverage and close-down
| Architecture gate | Custodian evidence checkpoints |
| --- | --- |
| TSA-01 | T07, T21 |
| TSA-02 | T07, T16, T22 |
| TSA-03 | T08, T10, T17, T18, T22 |
| TSA-04 | T09, T10, T14, T15, T16, T17, T18, T19, T23 |
| TSA-05 | T24, T25, T26 |
| TSA-06 | T13, T27, T28 |
| TSA-07 | T29, T30 |
| TSA-08 | T31 |
| TSA-09 | T32 |
| TSA-10 | T11, T20, T28, T39, T40 |
| TSA-11 | T12, T33 |
| TSA-12 | T34 |
| TSA-13 | T07, T08, T09, T35 |
| TSA-14 | T36 |
| TSA-15 | T37 |
| TSA-16 | T04, T38 |
| Gap | Custodian evidence checkpoints |
| --- | --- |
| G01 | T24 |
| G02 | T08-T10, T14-T19, T23 |
| G03 | T07, T16, T21, T22 |
| G04 | T29, T30 |
| G05 | T13, T27 |
| G06 | T32 |
| G07 | T11, T20, T28, T39, T40 |
| G08 | T29, T31 |
| G09 | T30, T38 |
| G10 | T38 |
| G11 | T31 |
| G12 | T28-T30 |
| G13 | T07, T21 |
All mapped checkpoints retain their stated scope. A completed source checkpoint
does not close a gate that also requires native or consumer evidence. The original
requirement ledger remains the requirement-level denominator. Uncovered work
stays live; no required gate becomes a residual merely to finish this plan.

6
docs/netkingdom-security-gaps.md
View file

@ -6,6 +6,12 @@ Coordinator: CUST-WP-0080. Existing owner work remains authoritative. Statuses
below distinguish actual defects, incomplete integration and missing verification.
No whole-estate SEC-DSM conformance or maturity level is claimed.
**18 October sequencing:** the founder authorized good-case-first delivery.
WP-80 leads with Playwright human/agent use, then everyday Forgejo. The security
gaps below remain open under [CUST-WP-0082](../workplans/CUST-WP-0082-netkingdom-security-hardening.md),
with [all original task and requirement mappings](changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/hardening-handoff.json).
Their deferral does not mean they were fixed. Close-down row 25 records the scope.
## Gaps ordered for execution
| ID | Gap and current evidence | Existing owner work | Closure evidence |

9
docs/netkingdom-target-implementation.md
View file

@ -4,6 +4,15 @@ Coordinator: CUST-WP-0080. Target: [security architecture](netkingdom-target-sec
Started 16 October 2026 under the founder's explicit implementation and
GPT-6.1-Sol medium subagent request. The full architecture remains the goal.
**Current sequencing, 18 October:** actual founder direction
`9663d4ca-3793-4ad7-9dc1-954001d43596` puts working Playwright human/agent access
first and everyday Forgejo development next. Both supervised-build Playwright
trials passed. Full security acceptance and its original criteria now live in
[CUST-WP-0082](../workplans/CUST-WP-0082-netkingdom-security-hardening.md).
[Receipts and exact handoff](changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/README.md).
Historical requirements below remain evidence of the target, not prerequisites
that silently override the founder's revised functional exit.
For current delivery checkpoints, completed outputs and the next action, use the
[WP-80 delivery overview](../workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md).
This implementation record retains detailed history. The workplan separates

6
docs/netkingdom-target-security-architecture.md
View file

@ -2,6 +2,12 @@
Version 1, 16 October 2026. Implementation coordinator: [CUST-WP-0080](../workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md).
**18 October delivery sequencing:** the founder prioritized working Playwright
human/agent access, then everyday Forgejo use. WP-80 now accepts those functional
flows under their stated build profile. The full security acceptance contract
below remains the target in [CUST-WP-0082](../workplans/CUST-WP-0082-netkingdom-security-hardening.md).
This defers work; it does not establish conformance or change the target.
NetKingdom will provide a small set of reusable, independently verified security
workflows. Identity, access decisions, approvals, credential custody and audit
retain their existing owners. Consumers share adapters and case templates instead

1
docs/security-close-down-checklist.md
View file

@ -31,3 +31,4 @@ Add a row whenever you loosen, shortcut or leave unarmed a control. Remove nothi
| 22 | CI runner authority boundary (CUST-WP-0080 G12) | Reproduced unauthenticated cross-pod Docker access is closed: same-image generation 4 listens on loopback only, local ping and heartbeat pass, peer pod denied. [Evidence](evidence/2026-10-13-netkingdom-security/forge-runner-loopback-activation.json). Host-mode jobs still share the privileged runner; no full isolation or job-scoped credential claim. | Complete native workflow authority, required detection checks, job identity/expiry and privileged runner trust boundaries under FORGE-WP-0006 / RMGR-WP-0021. Preserve loopback-only listener across deployments. | railiance-forge, railiance-enablement, railiance-platform; source railiance-apps | 2026-10-13 |
| 23 | Traefik HTTPS upload read budget | Activated 2026-10-13 under the founder-approved publication fix: shared websecure readTimeout raised from 60s to bounded 600s. Traefik generation 2 Ready; five previously failing Forgejo OCI blobs completed in 85–183s, exact tested image digest published. Evidence: railiance-cluster RCLUSTER-WP-0016 and rapp-playwright/docs/evidence/2026-10-13-publication.md. TLS and registry authentication stay enforced. | At production close-down review the 600s body-read budget and slow-upload exposure; retain a measured artifact-upload budget or isolate the registry entry point. Do not disable timeouts. | railiance-cluster / railiance-forge | 2026-10-13 |
| 24 | Metered spend settlement (rein-aharness spend envelopes) | Opt-in per envelope since 2026-10-14 (rein-aharness `c7dceee`, `c04d1c6`; owner decision `a93619a9`): `settlement: observed-usage` charges a completed provider request its gateway-metered cost (provider-reported tokens at admitted rates) instead of its full hold, and a run max(metered requests, reported/attested cost). Unfinished requests keep full hold; overrun still freezes the envelope; `full-hold` stays the default. First use: memo `infd-20261014-b01` (3 attempts, EUR 10). Provider-reported usage is trusted until billing is compared. | Compare each observed-usage envelope's charges with provider billing before renewal; decide whether observed-usage stays allowed or envelopes return to full-hold. | rein-aharness, owner | 2026-10-14 |
| 25 | WP-80 functional delivery before full security acceptance | Founder decision `9663d4ca-3793-4ad7-9dc1-954001d43596` prioritizes working development flows and permits later hardening. Actual Playwright human/agent commands pass through the existing authenticated workstation port-forward; this is a supervised build profile, without independent per-caller identity acceptance. No credentials distributed, new target enabled or installed control disabled. Nineteen full checkpoints and six remaining acceptance scopes transfer to live CUST-WP-0082; ledger statuses and the full target stay unchanged. [Scope and evidence](changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/README.md). | Promote/revalidate relevant hardening before customer production, target expansion or broader unattended authority. Verify the full current-identity, per-caller transport/isolation, lifecycle, recovery and audit criteria in CUST-WP-0082; close all 16 target gates and reconcile all 116 ledger entries. No automatic production approval or blanket formal requirement exception. | Custodian coordinates; existing KeyCape / Platform / NetKingdom / Forge / Apps / custody and audit owners implement | 2026-10-18 |