coulomb/the-custodian
5
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

feat(security): record verified PostgreSQL custody and rollout readiness

Browse source
This commit is contained in:
codex 2026-10-17 01:47:19 +02:00
parent d834d0c4b7
commit 49cfbfed01
60 changed files with 6964 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

100
docs/netkingdom-target-implementation.md
View file

@ -15,7 +15,7 @@ GPT-6.1-Sol medium subagent request. The full architecture remains the goal.
| TSA-06 | Glas / Sand-boxer / rein / Platform / Forge; CUST-WP-0073, GLAS-WP-0012 | Workload-only credential delivery and combined rein runtime published; actual isolated manager proof reproduced; assignment and runner proof open | Bounded real-model acceptance, admitted runtime and actual assignment migration |
| TSA-07–08 | Secrets / NetKingdom / Platform; NK-WP-0049 and existing lifecycle plans | Inventory/lifecycle incomplete; independent identity archive recovery, retained token-material decryption and historical audit signature continuity verified 16 October | Existing-token MFA and service authentication; metadata denominator, elimination candidates and lifecycle receipts |
| TSA-09 | Audit / emitting owners; Approval T04 and current Audit work | Delivered custody; current source admission/reconciliation incomplete | Source/effect/outbox/receiver readback for first protected operation |
| TSA-10 | Forge / Repo Manager; FORGE-WP-0006, RMGR-WP-0021 | Broad receive coverage delivered; other paths and response incomplete | Coverage/reliability gaps and private response acceptance |
| TSA-10 | Forge / Repo Manager; FORGE-WP-0006, RMGR-WP-0021 | Broad receive coverage delivered; bounded actual-hook scanner refusal and cleanup accepted under T05 | Remaining coverage and private response acceptance |
| TSA-11 | Reuse / provider owners | 70/70 discovery freshly verified 16 October; two drifted owner descriptions corrected and native parity validation strengthened | Full source-link/version/package-family disposition and recurring drift acceptance |
| TSA-12 | Activity / Coordination / Custodian; CUST-WP-0079 | Schedule accepted but unassisted activation not proven; cadence source adoption underway | Actual activation and first independent observation |
| TSA-13–14 | NetKingdom / provider owners | Accepted reusable integration and second installation pending | Shared adapter conformance and minimal locked profiles |
@ -674,3 +674,101 @@ are grounded in 23 group/storage and 17 recovery public-source references. They
identify existing owner paths and a historical secrets-engine-openbao registration
without inventing current assent, independent TLS custody, production storage
admission or consumer continuity. Full frozen fixture packets remain workspace-local.
## Continued verification, 17 October 2026
The actual shared and Custodian hooks now pass all six clean, generated-key and
unavailable-scanner cases. A private mount namespace shadows the scanner only
inside each fixture; the host executable, real index and HEAD remain unchanged.
Ten fixture checks and an actual disposable parent-loss cleanup trial passed.
Failed R1/R2 trials remain retained; the reviewed successor explicitly verifies
the writable `/dev/null` device it needs. Exact host tmpfs identity and resource
absence were checked. [Hook results](changes/netkingdom-target-2026-10-17/scanner-unavailable-r1/namespace-hook-results.json)
and [cleanup results](changes/netkingdom-target-2026-10-17/scanner-unavailable-r1/namespace-lifecycle-results.json)
support RMGR-WP-0021-T05 completion, published at `9ebde0a9`. The first projection
returned `pending_push` despite exit zero; the follow-up authoritative projection
returned `applied` at that exact revision. Other Repo Manager coverage and private
response work remain open.
The previously skipped real-SOPS coverage now passes with generated material in
an isolated network/mount/PID namespace. All 61 prior cases passed, then four new
end-to-end sealed-descriptor decrypt/edit/rotate and wrong-key refusal cases
brought the successor to [65 passed](changes/netkingdom-target-2026-10-17/sops-real-regressions.json).
The fixture uses SOPS 3.13.3 with matching official release asset and checksum
digests; its Sigstore signature was not verified. The executable is not installed
system-wide and this does not admit native tool custody or actual owner-held
recovery. The earlier skipped result remains historical evidence.
SECRETS-WP-0015 is published at `c59bbf56`: the source-bound public registration
selector and offline checker are delivered. Outage-compatible consumption and
private/native admission remain separate open tasks. RCLUSTER-WP-0018's reviewed
TLS metadata tool and plan are prepared; publication stopped before mutation on
15 bare historical labels and five collisions across three frozen archives.
The exact receiver-first successor preserves the existing three parents and 15
task UUIDs. Independent candidate suites pass 26 receiver and 47 registrar tests;
the registrar guard remains active until receiving is deployed and verified.
Original TLS custody/reissue disposition is still unknown.
The proposed State Hub rollout must cover its full difference from deployed
`main-7d99282`, including an unrelated inbox migration already on `main`.
The receiver patch adds no migration, but that fact does not establish an
unchanged deployed schema. Normal CI artifact identity, full-change review,
fresh headroom/dry-run, verification/rollback and scoped founder approval remain
required. No production rollout or historical identity rewrite has occurred.
All sixteen target acceptance gates remain open.
PostgreSQL source `70f408ca` is now published with the SOPS test successor in
NetKingdom. The canonical provisioner suite passes 82 cases. All 21 real
disposable PostgreSQL oracles pass: migration/runtime-role refusal, restart and
revoke, full visible prestate preservation, exact reservation/CAS, divergent
same-counter database forks, lost acknowledgments and real dump/restore refusal.
LDAP remains the declared test double in this SQL fixture. The earlier separate
14-oracle actual LLDAP proof retains its own scope. Independent fixed-daemon
checks confirm both exact containers and their run label absent.
[SQL result](changes/netkingdom-target-2026-10-17/postgres-r5-result.json) and
[cleanup](changes/netkingdom-target-2026-10-17/postgres-r5-cleanup.json) retain the
actual return. Failed R2/R3/R4 trials remain recorded; review fixed a real nested
receipt-reference defect, then two snapshot-fixture defects before the pass.
NK-WP-0048-T21 records completed source/SQL proof; T14 retains native CNPG,
checkpoint/custody/scope/callback integration and all LDAP writer fencing.
NK-WP-0049-T37 records the 65 real-SOPS cases; its actual recovery gates stay open.
State Hub receiver source `51bc70d1` is published, independently hash-checked and
projected. Its normal CI task 12624 succeeded. Anonymous registry protocol
verified manifest `sha256:c802690ee1811b3d77df4077936f9cdced1385514e8673fcbc9232b84d645015`;
[read-only image inspection](changes/netkingdom-target-2026-10-17/statehub-public-image-inspection.json)
verified all 22 compressed layers, selected receiver/migration/hub-core files,
the exact build ID and 86 Python package metadata records without executing or
installing the image. Floating build origins remain unknown. Source readiness
follow-up `086d79a2` changes only Make/test/workplan files and preserves this
runtime artifact. Both command-fixture branches and the actual full server
dry-run pass with the annotation policy unchanged.
The [disposable migration check](changes/netkingdom-target-2026-10-17/migration-compat-r1-result.json)
passes ten old-model DDL/new-migration/old-write-shape oracles; independent
[cleanup](changes/netkingdom-target-2026-10-17/migration-compat-r1-cleanup.json)
confirms exact resource absence. The tiny synthetic migration timing does not
predict production lock duration or establish full HTTP/ORM acceptance.
Helm rollback retains the additive schema; the existing migration Job has no
active deadline, so Helm's three-minute timeout does not guarantee job termination.
The concrete rollout review must retain that recovery limitation. No live
deployment, registrar activation or native target gate closure is inferred.
The [exact rollout proposal, revision 4](changes/netkingdom-target-2026-10-16/cluster-historical-publication-r1/revisions/r4-rollout-review/FINAL-PROPOSAL.md)
is prepared and recorded as pending under the existing supervision record. The
packaged chart and image digest are fixed; its values-preserving server dry-run
keeps eight identities and changes only three image paths. Fresh observation
finds Helm 75, the original API/MCP images Ready, schema `b3c4d5e6f7a8`, no
migration Job and passing headroom. Approval must cover the full inbox migration
and exact conditional recovery limits. EUR cost/loss exposure and production
migration timing remain unpriced; unknown recovery mapping stops for attended
owner recovery. This record grants no authority.
Four [coordination receipts](changes/netkingdom-target-2026-10-17/coordination-receipts.json)
now project the explicit foreign-owner waits, using the existing retirement
driver for receiver/registrar sequencing and derived cases elsewhere. No new
driver, external message or worker wake was created. The
[publication readback](changes/netkingdom-target-2026-10-17/completed-deliverable-publication.json)
verifies all 58 NetKingdom and eight State Hub task IDs/UUIDs/statuses against
source, plus exact remote heads. Earlier Repo Manager/Secrets readback verifies
nine more owner bindings and the two Secrets dependency edges.