diff --git a/docs/changes/netkingdom-target-2026-10-16/access-native-admission/cluster-review-r1/formal-platform-r5-source-review.json b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/cluster-review-r1/formal-platform-r5-source-review.json new file mode 100644 index 00000000..34277741 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/cluster-review-r1/formal-platform-r5-source-review.json @@ -0,0 +1,37 @@ +{ + "schema": "railiance-cluster.formal-source-owner-review.v1", + "review_id": "RCLUSTER17-SIGNER-OWNER-BOUNDARY-R5-20261016", + "reviewer": "railiance-cluster-owner (agent railiance-cluster, codex)", + "native_review_role": "cluster-runtime-storage-owner", + "decision": "approved", + "scope": "exact R5 source owner-boundary correction only; not CCR/read-lane/custody/rollout/native admission approval", + "own_work_item": "RCLUSTER-WP-0017-T01", + "own_checkout": "/home/worsch/railiance-cluster", + "own_record_commit": "523669fba57c3785afc30b934ccdcb34a8871bf6", + "reviewed_at": "2026-10-16T18:27:16.097227+00:00", + "reviewed_proposal_id": "RPF35-PDP-SIGNER-OWNER-BOUNDARY-20261016-R5", + "reviewed_manifest_sha256": "sha256:78003b1b4da481ce20b194062ddde10fa94147dbffc4c8e74a42850bf1dacfe0", + "reviewed_full_patch_sha256": "sha256:43264f13da5ff20267dea424a7c7d8d911f7601edca6871f31394e0c292fcd59", + "platform_source_commit": "84c529f239c81e6d3ca337015700b03e3a862f53", + "exact_files_sha256": { + "scripts/flex_auth_signer_native.py": "sha256:4fb9ce6608ad04c4f5dc98a95796dc88a08a2453dc15c0d40c5c688fc02f573f", + "credential-change-requests/CCR-2026-0050-flex-auth-envelope-signing.yaml": "sha256:44bbbf4aff84c3b085afdb14708106fd9a12ac03a0c47774913931a87fb94ada", + "docs/credential-lane-designs/flex-auth-envelope-signing-native-plan.json": "sha256:22306d50e082fc35c5ff22c31e739a53c7584176969063f7907bc01d77e506e5", + "docs/credential-lane-designs/flex-auth-envelope-signing-native-adapter.md": "sha256:0e2e431dcd2df66e65434ce4060a4d5b52941f50928be80a075e4f972229d3a9", + "tests/test_flex_auth_signer_native.py": "sha256:f74a2316506737966e2ea539799cb477a9cec2718a6679f417478f9972731b3e", + "workplans/RPF-WP-0035-credential-lane-implementation.md": "sha256:20451474d84be986f7be1e2ff8c48e3a754e981718949f0e9d771081ae15d25b" + }, + "comment": "INTENT Core Principles1 Runtime Not Workloads and2 Healthy by Verification support the precise runtime/storage/headroom/PV-retention role, excluding workload and GitOps Application ownership. Exact R5 manifest sha256:78003b1b4da481ce20b194062ddde10fa94147dbffc4c8e74a42850bf1dacfe0 and full patch sha256:43264f13da5ff20267dea424a7c7d8d911f7601edca6871f31394e0c292fcd59 reviewed fresh from the ownrepo checkout under RCLUSTER-WP-0017-T01 after canonical record523669fb. Executable role set now rejects legacy conflated role/missing/extra dispositions; Platform Applications/freeze and Access Helm/workload remain their own reviews. R5 changes typed Git/OCI prose only versus independently tested R4; six canonical source hashes match. This approves only source role correction, supplies no completed admission-scope disposition, no other-owner assent, no founder decision, and no runtime approval. Exact successor Access stopped render/window/projection and actual native preflight/Retain remain outstanding.", + "verification": { + "r5_artifact_hashes": true, + "canonical_six_source_hashes": true, + "r5_vs_r4_only_typed_public_refs": true, + "r4_independent_focused_tests": "54passed39.29s; executor/tests byte-identical to R5, no rerun needed for metadata prose" + }, + "completed_native_scope_sha256": null, + "native_admission": false, + "founder_approval": false, + "other_owner_assent": false, + "frozen_r1_p2_changed": false, + "workplan_task_status_proposed": "progress; exact rollout successor review still outstanding" +} diff --git a/docs/changes/netkingdom-target-2026-10-16/access-native-admission/cluster-review-r1/prefix-identity-assessment.json b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/cluster-review-r1/prefix-identity-assessment.json new file mode 100644 index 00000000..53101281 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/cluster-review-r1/prefix-identity-assessment.json @@ -0,0 +1,55 @@ +{ + "schema": "railiance-cluster.prefix-identity-scope-assessment.v1", + "canonical_prefix": "RCLUSTER-WP", + "preserve_workplan_id": "RCLUSTER-WP-0017", + "preserve_projection_workstream_uuid": "f383557d-c8a8-553e-adcd-9f82ff9c2929", + "preserve_projection_task_uuids": [ + "6ee408cd-c055-532d-bc80-f64c9bdf143b", + "7f4320c6-8bb5-598e-9b9a-65565091276f", + "747a8d77-5c02-5b26-ba9c-385f75f3ac1c" + ], + "finding": "C26 db_value is an output field containing locally inferred prefix, not evidence of authoritative DB prefix assignment. Historical majority inference conflicts with explicit prefix assignment.", + "authority_sources": [ + { + "path": "/home/worsch/the-custodian/canon/architecture/adr-007-workplan-identity-and-repo-worker-topology.md", + "section": "Prefix assignments", + "ruling": "RAIL-BS-WP retired2026-08-17; cluster adopts RCLUSTER-WP active/future; finished/archive remain historical." + }, + { + "path": "/home/worsch/repo-manager/workplans/RMGR-WP-0004-repository-standards-conformance.md", + "section": "T09 assignments/execution", + "ruling": "Same assignment and completed active-file migration." + } + ], + "implementation_sources": [ + { + "path": "/home/worsch/state-hub/scripts/consistency_check.py:2770", + "behavior": "infer_wp_prefix counts on-disk IDs via iter_workplan_files, including historical files; returns most_common(1)." + }, + { + "path": "/home/worsch/state-hub/scripts/consistency_check.py:3149", + "behavior": "_check_workplan_prefixes uses inference and puts inferred canonical in report db_value; no prefix registry read." + }, + { + "path": "/home/worsch/repo-manager/src/repo_manager/record_identity.py", + "behavior": "Canonical patterns and global qualified-identifier collision check; historical local aliases separately scoped." + }, + { + "path": "/home/worsch/repo-manager/src/repo_manager/identifiers.py:69", + "behavior": "UUIDv5 uses exact namespace+identifier; renaming would change deterministic identity, so do not rename established0017." + }, + { + "path": "/home/worsch/repo-manager/src/repo_manager/commands/registrar_reconcile.py:145", + "behavior": "Normal reconcile scopes defects to requested missing projections; does not require blanket historical repair." + } + ], + "recommended_bounded_followup": [ + "Keep RCLUSTER0017 and all assigned UUIDs; source identity is correct per canon.", + "Align stale AGENTS top Workplan prefix and frontmatter example to RCLUSTER-WP in separate narrow source edit; retain historical record identities unchanged.", + "Owner-owned consistency inference correction must respect explicit canonical prefix assignments instead of historical majority; do not silence C26 by renaming correct new records or rewriting retired history.", + "Any generator correction belongs to its current source owner/RepoManager handoff; this review does not implement foreign owner tooling." + ], + "mutations_performed": false, + "hub_writes": false, + "blanket_historical_repair": false +} diff --git a/docs/changes/netkingdom-target-2026-10-16/access-native-admission/cluster-review-r1/work-record-integration.json b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/cluster-review-r1/work-record-integration.json new file mode 100644 index 00000000..0c9ea22f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/cluster-review-r1/work-record-integration.json @@ -0,0 +1,27 @@ +{ + "repo": "railiance-cluster", + "base": "750c3e5b9b4623c52bce2b8fbd758f423f81f6c1", + "commit": "523669fba57c3785afc30b934ccdcb34a8871bf6", + "patch_sha256": "sha256:40313328d2fd67496705b7369d56f072020222929e91942626ebb9cb82acc7ac", + "files_sha256": { + "workplans/RCLUSTER-WP-0017-netkingdom-signer-runtime-storage-review.md": "sha256:91121c972379fbaf92a4fa66e01bef9a36a7aea11986168a0fdc79f7cce9422f" + }, + "observed_at": "2026-10-16T18:25:09.283020+00:00", + "source_reviewed": true, + "published": true, + "native_accepted": false, + "execution_authorized": false, + "normal_sync": { + "session_id": 80811, + "exit_code": 0, + "bindings": "21/21", + "assessment_fail": 0, + "automation_error": 0, + "warn": 42, + "info": 8, + "generated_only_commit_refused": true, + "prefix_mismatch": "Historical-majority inference reporting defect; ADR007 explicitly assigns RCLUSTER-WP. IDs/UUIDs preserved." + }, + "publication_verified_at": "2026-10-16T18:28:18.107141+00:00", + "committed_file_hashes_verified": true +} diff --git a/docs/changes/netkingdom-target-2026-10-16/access-native-admission/image-84c78e0/candidate-receipt.json b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/image-84c78e0/candidate-receipt.json new file mode 100644 index 00000000..f04d06bf --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/image-84c78e0/candidate-receipt.json @@ -0,0 +1,66 @@ +{ + "schema": "access-engine.ordinary-ci-published-candidate.v1", + "observed_at": "2026-10-16T17:55:53.102623+00:00", + "source_revision": "84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0", + "ordinary_push": true, + "run_url": "https://forgejo.coulomb.social/coulomb/access-engine/actions/runs/402", + "job_url": "https://forgejo.coulomb.social/coulomb/access-engine/actions/runs/402/jobs/0", + "terminal_status": "success", + "latest_commit_statuses": [ + { + "id": 6, + "status": "success", + "context": "Build and Publish Container Image / build-and-push (push)", + "description": "Successful in 58s", + "target_url": "/coulomb/access-engine/actions/runs/402/jobs/0", + "created_at": "2026-10-16T17:55:15Z", + "updated_at": "2026-10-16T17:55:15Z" + }, + { + "id": 5, + "status": "success", + "context": "CI Smoke / container-smoke (push)", + "description": "Successful in 2s", + "target_url": "/coulomb/access-engine/actions/runs/401/jobs/1", + "created_at": "2026-10-16T17:54:17Z", + "updated_at": "2026-10-16T17:54:17Z" + }, + { + "id": 4, + "status": "success", + "context": "CI Smoke / host-smoke (push)", + "description": "Successful in 0s", + "target_url": "/coulomb/access-engine/actions/runs/401/jobs/0", + "created_at": "2026-10-16T17:54:14Z", + "updated_at": "2026-10-16T17:54:14Z" + } + ], + "registry_repository": "forgejo.coulomb.social/coulomb/flex-auth", + "immutable_image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f", + "manifest_digest": "sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f", + "publisher_receipt": { + "mode": "legacy", + "revision": "84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0", + "manifest_digest": "sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f", + "verified_repositories": 1, + "pulled_revision_label_check": "Passed by reviewed publisher before this final receipt; exact84 source script captured in source-facts.json.", + "logs_url": "https://forgejo.coulomb.social/coulomb/access-engine/actions/runs/402/jobs/0/logs", + "response_sha256": "e86883ca7b2d2c4fd9dc63be49b6840ea6e2e6f03807c97e0af52825631a8e42", + "raw_log_retained": false + }, + "independent_public_registry_package": { + "url": "https://forgejo.coulomb.social/coulomb/-/packages/container/flex-auth/main-84c78e0", + "http_status": 200, + "sole_manifest_digest": "sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f", + "explicit_revision_label": "84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0", + "response_sha256": "4e7b2487509b1e58d12388db2a4c48b0c9c2df88ceaeeb53fde2d79ded5c677b" + }, + "scope": { + "published_by": "Existing normal main-push legacy publisher, not observer", + "observer_actions": "Anonymous public metadata reads only; no dispatch/push/credential/login/deploy/trust operation.", + "native_admitted": false, + "limits": "Published source/image provenance is verified; exact runtime package/config/mount/caller/trust/record/PVC and owner scope admission remain separate.", + "package_extraction_unchanged": "source2b064ee/current05a frozen; future84 adoption is a separate reviewed package/config revision.", + "historical_failure_retained": "../image-0a05383/normal-ci-run400-failure.json" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/access-native-admission/image-84c78e0/coordinator-review.json b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/image-84c78e0/coordinator-review.json new file mode 100644 index 00000000..622d46ad --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/image-84c78e0/coordinator-review.json @@ -0,0 +1,16 @@ +{ + "schema": "custodian.independent-image-publication-review.v1", + "checked_at": "2026-10-16T17:57:17.410312+00:00", + "source_revision": "84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0", + "image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f", + "publisher_job": 402, + "smoke_run": 401, + "latest_three_contexts_success": true, + "independent_package_unique_digest_matches": true, + "independent_package_explicit_revision_label_matches": true, + "all_source_facts_hashes_match_committed_bytes": true, + "candidate_receipt_sha256": "sha256:af8e032d28776722ccf2bfe0f884577e568d8d0fb3713aa869e1d7d1c77c576f", + "scope": "Anonymous public metadata plus committed source verification; no runtime acceptance or credential admission", + "native_accepted": false, + "historical_failed_run": 400 +} diff --git a/docs/changes/netkingdom-target-2026-10-16/access-native-admission/image-84c78e0/publication-manifest.json b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/image-84c78e0/publication-manifest.json new file mode 100644 index 00000000..8e2af38f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/image-84c78e0/publication-manifest.json @@ -0,0 +1,13 @@ +{ + "schema": "custodian.ordinary-ci-candidate-publication.v1", + "source_revision": "84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0", + "immutable_image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f", + "files_sha256": { + "candidate-receipt.json": "af8e032d28776722ccf2bfe0f884577e568d8d0fb3713aa869e1d7d1c77c576f", + "status-history.json": "fe10d700543cf49c0b10fc7e92df0d2af8abb722093b287804f7be669c5a19f4", + "source-facts-typed.json": "ea074d52bb9af4c3dee0cf409598d87cb9411b5e7699540f03a71b268f404d46" + }, + "predecessor_manifest_sha256": "sha256:4f71eec333ee9bea798f22dc9190a08e0c3251f2f303d6bec636d1e82842efa5", + "predecessor_source_facts_sha256": "sha256:7a9d0b2de1aef344f1ab25cf30640709a13de39403799701e220db32855154aa", + "publication_refinement": "Normal scanner flagged bare public file hash after authenticity path. Source facts use explicit sha256 type prefixes; all8 hashes reverified against committed bytes. Original frozen files retained locally; no scanner suppression." +} diff --git a/docs/changes/netkingdom-target-2026-10-16/access-native-admission/image-84c78e0/source-facts-typed.json b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/image-84c78e0/source-facts-typed.json new file mode 100644 index 00000000..6c6e3980 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/image-84c78e0/source-facts-typed.json @@ -0,0 +1,25 @@ +{ + "source_revision": "84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0", + "source_tree": "6ac6cd1453c05beb2a8096e1bd6781071d1f12ca", + "reviewed_predecessor": "0a05383195213e7eaacd08388ce1d7892ce756df", + "exact_changed_files": [ + "docs/native-signer-workload.json", + "tests/test_image_publisher.py", + "tools/publish-runtime-images.sh", + "workplans/FLEX-WP-0024-decision-envelope-authenticity.md" + ], + "files_sha256": { + "docs/native-signer-workload.json": "sha256:3246ede928d4adc3b540aa4e5e5e5472deb5f15084ea83ebde19071b26212533", + "tests/test_image_publisher.py": "sha256:d5a95cfd0923f9b899ef795d9cd34dee698b0846c831bd3124cb7707c5bfaa91", + "tools/publish-runtime-images.sh": "sha256:1e95ed70e55b04943613f89e241ad4c25094a26cabefbed6c1bdedb8deedf630", + "workplans/FLEX-WP-0024-decision-envelope-authenticity.md": "sha256:def6f73745d02ea88aa334db3239d2ef22984ebefa8853a5573496a08ed1592c", + "Containerfile": "sha256:8ff6dc27d632d4f889b2cd527fc14c9dd1f79359b63384600088c87a47943a98", + ".forgejo/workflows/image.yaml": "sha256:18307ce17027b263ac0703a9e82fba8d14b672ca8bc9dee4c90b3aed2decd58e", + "examples/secrets-engine/policy_package.md": "sha256:657fa9312c9dcabee059ec31c89ee13396fe9aa54d852edc9e6559a74bbc139a", + "examples/secrets-engine/registry_snapshot.json": "sha256:37fba44ec0e0fd9b1e17a05ad1b7e4f9bb6ec9e0fc0bb3133e8af2ac6f832d7c" + }, + "unchanged_runtime_source": "No Go implementation, API/sign, policy, registry, chart or Containerfile changes relative to reviewed hardening0a; publisher parsing/revision-label verification and two owner metadata/workplan files only.", + "publication_scope": "Existing ordinary main push workflow, legacy forgejo.coulomb.social/coulomb/flex-auth only; observer performed no dispatch/push/login/credential operation.", + "package_extraction": "Source2b064ee/current image05a frozen independently; observed84 image is a separate future native-admission candidate.", + "historical_failure": "../image-0a05383/normal-ci-run400-failure.json retains failed post-push parser run; no previous failure converted into success." +} diff --git a/docs/changes/netkingdom-target-2026-10-16/access-native-admission/image-84c78e0/status-history.json b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/image-84c78e0/status-history.json new file mode 100644 index 00000000..49311c0a --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/image-84c78e0/status-history.json @@ -0,0 +1,336 @@ +{ + "source_revision": "84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0", + "snapshots": [ + { + "observed_at": "2026-10-16T17:53:08.586295+00:00", + "statuses": [], + "latest_by_context": {} + }, + { + "observed_at": "2026-10-16T17:53:31.606868+00:00", + "statuses": [], + "latest_by_context": {} + }, + { + "observed_at": "2026-10-16T17:53:54.638499+00:00", + "statuses": [], + "latest_by_context": {} + }, + { + "observed_at": "2026-10-16T17:54:14.750894+00:00", + "statuses": [ + { + "id": 4, + "status": "success", + "context": "CI Smoke / host-smoke (push)", + "description": "Successful in 0s", + "target_url": "/coulomb/access-engine/actions/runs/401/jobs/0", + "created_at": "2026-10-16T17:54:14Z", + "updated_at": "2026-10-16T17:54:14Z" + }, + { + "id": 1, + "status": "pending", + "context": "CI Smoke / host-smoke (push)", + "description": "Waiting to run", + "target_url": "/coulomb/access-engine/actions/runs/401/jobs/0", + "created_at": "2026-10-16T17:54:13Z", + "updated_at": "2026-10-16T17:54:13Z" + }, + { + "id": 2, + "status": "pending", + "context": "CI Smoke / container-smoke (push)", + "description": "Waiting to run", + "target_url": "/coulomb/access-engine/actions/runs/401/jobs/1", + "created_at": "2026-10-16T17:54:13Z", + "updated_at": "2026-10-16T17:54:13Z" + }, + { + "id": 3, + "status": "pending", + "context": "Build and Publish Container Image / build-and-push (push)", + "description": "Waiting to run", + "target_url": "/coulomb/access-engine/actions/runs/402/jobs/0", + "created_at": "2026-10-16T17:54:13Z", + "updated_at": "2026-10-16T17:54:13Z" + } + ], + "latest_by_context": { + "CI Smoke / host-smoke (push)": { + "id": 4, + "status": "success", + "context": "CI Smoke / host-smoke (push)", + "description": "Successful in 0s", + "target_url": "/coulomb/access-engine/actions/runs/401/jobs/0", + "created_at": "2026-10-16T17:54:14Z", + "updated_at": "2026-10-16T17:54:14Z" + }, + "CI Smoke / container-smoke (push)": { + "id": 2, + "status": "pending", + "context": "CI Smoke / container-smoke (push)", + "description": "Waiting to run", + "target_url": "/coulomb/access-engine/actions/runs/401/jobs/1", + "created_at": "2026-10-16T17:54:13Z", + "updated_at": "2026-10-16T17:54:13Z" + }, + "Build and Publish Container Image / build-and-push (push)": { + "id": 3, + "status": "pending", + "context": "Build and Publish Container Image / build-and-push (push)", + "description": "Waiting to run", + "target_url": "/coulomb/access-engine/actions/runs/402/jobs/0", + "created_at": "2026-10-16T17:54:13Z", + "updated_at": "2026-10-16T17:54:13Z" + } + } + }, + { + "observed_at": "2026-10-16T17:54:37.814925+00:00", + "statuses": [ + { + "id": 5, + "status": "success", + "context": "CI Smoke / container-smoke (push)", + "description": "Successful in 2s", + "target_url": "/coulomb/access-engine/actions/runs/401/jobs/1", + "created_at": "2026-10-16T17:54:17Z", + "updated_at": "2026-10-16T17:54:17Z" + }, + { + "id": 4, + "status": "success", + "context": "CI Smoke / host-smoke (push)", + "description": "Successful in 0s", + "target_url": "/coulomb/access-engine/actions/runs/401/jobs/0", + "created_at": "2026-10-16T17:54:14Z", + "updated_at": "2026-10-16T17:54:14Z" + }, + { + "id": 1, + "status": "pending", + "context": "CI Smoke / host-smoke (push)", + "description": "Waiting to run", + "target_url": "/coulomb/access-engine/actions/runs/401/jobs/0", + "created_at": "2026-10-16T17:54:13Z", + "updated_at": "2026-10-16T17:54:13Z" + }, + { + "id": 2, + "status": "pending", + "context": "CI Smoke / container-smoke (push)", + "description": "Waiting to run", + "target_url": "/coulomb/access-engine/actions/runs/401/jobs/1", + "created_at": "2026-10-16T17:54:13Z", + "updated_at": "2026-10-16T17:54:13Z" + }, + { + "id": 3, + "status": "pending", + "context": "Build and Publish Container Image / build-and-push (push)", + "description": "Waiting to run", + "target_url": "/coulomb/access-engine/actions/runs/402/jobs/0", + "created_at": "2026-10-16T17:54:13Z", + "updated_at": "2026-10-16T17:54:13Z" + } + ], + "latest_by_context": { + "CI Smoke / container-smoke (push)": { + "id": 5, + "status": "success", + "context": "CI Smoke / container-smoke (push)", + "description": "Successful in 2s", + "target_url": "/coulomb/access-engine/actions/runs/401/jobs/1", + "created_at": "2026-10-16T17:54:17Z", + "updated_at": "2026-10-16T17:54:17Z" + }, + "CI Smoke / host-smoke (push)": { + "id": 4, + "status": "success", + "context": "CI Smoke / host-smoke (push)", + "description": "Successful in 0s", + "target_url": "/coulomb/access-engine/actions/runs/401/jobs/0", + "created_at": "2026-10-16T17:54:14Z", + "updated_at": "2026-10-16T17:54:14Z" + }, + "Build and Publish Container Image / build-and-push (push)": { + "id": 3, + "status": "pending", + "context": "Build and Publish Container Image / build-and-push (push)", + "description": "Waiting to run", + "target_url": "/coulomb/access-engine/actions/runs/402/jobs/0", + "created_at": "2026-10-16T17:54:13Z", + "updated_at": "2026-10-16T17:54:13Z" + } + } + }, + { + "observed_at": "2026-10-16T17:54:57.913284+00:00", + "statuses": [ + { + "id": 5, + "status": "success", + "context": "CI Smoke / container-smoke (push)", + "description": "Successful in 2s", + "target_url": "/coulomb/access-engine/actions/runs/401/jobs/1", + "created_at": "2026-10-16T17:54:17Z", + "updated_at": "2026-10-16T17:54:17Z" + }, + { + "id": 4, + "status": "success", + "context": "CI Smoke / host-smoke (push)", + "description": "Successful in 0s", + "target_url": "/coulomb/access-engine/actions/runs/401/jobs/0", + "created_at": "2026-10-16T17:54:14Z", + "updated_at": "2026-10-16T17:54:14Z" + }, + { + "id": 1, + "status": "pending", + "context": "CI Smoke / host-smoke (push)", + "description": "Waiting to run", + "target_url": "/coulomb/access-engine/actions/runs/401/jobs/0", + "created_at": "2026-10-16T17:54:13Z", + "updated_at": "2026-10-16T17:54:13Z" + }, + { + "id": 2, + "status": "pending", + "context": "CI Smoke / container-smoke (push)", + "description": "Waiting to run", + "target_url": "/coulomb/access-engine/actions/runs/401/jobs/1", + "created_at": "2026-10-16T17:54:13Z", + "updated_at": "2026-10-16T17:54:13Z" + }, + { + "id": 3, + "status": "pending", + "context": "Build and Publish Container Image / build-and-push (push)", + "description": "Waiting to run", + "target_url": "/coulomb/access-engine/actions/runs/402/jobs/0", + "created_at": "2026-10-16T17:54:13Z", + "updated_at": "2026-10-16T17:54:13Z" + } + ], + "latest_by_context": { + "CI Smoke / container-smoke (push)": { + "id": 5, + "status": "success", + "context": "CI Smoke / container-smoke (push)", + "description": "Successful in 2s", + "target_url": "/coulomb/access-engine/actions/runs/401/jobs/1", + "created_at": "2026-10-16T17:54:17Z", + "updated_at": "2026-10-16T17:54:17Z" + }, + "CI Smoke / host-smoke (push)": { + "id": 4, + "status": "success", + "context": "CI Smoke / host-smoke (push)", + "description": "Successful in 0s", + "target_url": "/coulomb/access-engine/actions/runs/401/jobs/0", + "created_at": "2026-10-16T17:54:14Z", + "updated_at": "2026-10-16T17:54:14Z" + }, + "Build and Publish Container Image / build-and-push (push)": { + "id": 3, + "status": "pending", + "context": "Build and Publish Container Image / build-and-push (push)", + "description": "Waiting to run", + "target_url": "/coulomb/access-engine/actions/runs/402/jobs/0", + "created_at": "2026-10-16T17:54:13Z", + "updated_at": "2026-10-16T17:54:13Z" + } + } + }, + { + "observed_at": "2026-10-16T17:55:20.944463+00:00", + "statuses": [ + { + "id": 6, + "status": "success", + "context": "Build and Publish Container Image / build-and-push (push)", + "description": "Successful in 58s", + "target_url": "/coulomb/access-engine/actions/runs/402/jobs/0", + "created_at": "2026-10-16T17:55:15Z", + "updated_at": "2026-10-16T17:55:15Z" + }, + { + "id": 5, + "status": "success", + "context": "CI Smoke / container-smoke (push)", + "description": "Successful in 2s", + "target_url": "/coulomb/access-engine/actions/runs/401/jobs/1", + "created_at": "2026-10-16T17:54:17Z", + "updated_at": "2026-10-16T17:54:17Z" + }, + { + "id": 4, + "status": "success", + "context": "CI Smoke / host-smoke (push)", + "description": "Successful in 0s", + "target_url": "/coulomb/access-engine/actions/runs/401/jobs/0", + "created_at": "2026-10-16T17:54:14Z", + "updated_at": "2026-10-16T17:54:14Z" + }, + { + "id": 1, + "status": "pending", + "context": "CI Smoke / host-smoke (push)", + "description": "Waiting to run", + "target_url": "/coulomb/access-engine/actions/runs/401/jobs/0", + "created_at": "2026-10-16T17:54:13Z", + "updated_at": "2026-10-16T17:54:13Z" + }, + { + "id": 2, + "status": "pending", + "context": "CI Smoke / container-smoke (push)", + "description": "Waiting to run", + "target_url": "/coulomb/access-engine/actions/runs/401/jobs/1", + "created_at": "2026-10-16T17:54:13Z", + "updated_at": "2026-10-16T17:54:13Z" + }, + { + "id": 3, + "status": "pending", + "context": "Build and Publish Container Image / build-and-push (push)", + "description": "Waiting to run", + "target_url": "/coulomb/access-engine/actions/runs/402/jobs/0", + "created_at": "2026-10-16T17:54:13Z", + "updated_at": "2026-10-16T17:54:13Z" + } + ], + "latest_by_context": { + "Build and Publish Container Image / build-and-push (push)": { + "id": 6, + "status": "success", + "context": "Build and Publish Container Image / build-and-push (push)", + "description": "Successful in 58s", + "target_url": "/coulomb/access-engine/actions/runs/402/jobs/0", + "created_at": "2026-10-16T17:55:15Z", + "updated_at": "2026-10-16T17:55:15Z" + }, + "CI Smoke / container-smoke (push)": { + "id": 5, + "status": "success", + "context": "CI Smoke / container-smoke (push)", + "description": "Successful in 2s", + "target_url": "/coulomb/access-engine/actions/runs/401/jobs/1", + "created_at": "2026-10-16T17:54:17Z", + "updated_at": "2026-10-16T17:54:17Z" + }, + "CI Smoke / host-smoke (push)": { + "id": 4, + "status": "success", + "context": "CI Smoke / host-smoke (push)", + "description": "Successful in 0s", + "target_url": "/coulomb/access-engine/actions/runs/401/jobs/0", + "created_at": "2026-10-16T17:54:14Z", + "updated_at": "2026-10-16T17:54:14Z" + } + } + } + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-16/access-native-admission/stopped-chart-r2/canonical-integration.json b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/stopped-chart-r2/canonical-integration.json new file mode 100644 index 00000000..e2dda580 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/stopped-chart-r2/canonical-integration.json @@ -0,0 +1,28 @@ +{ + "repo": "access-engine", + "base": "84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0", + "commit": "dc042022f7c30671cf0a7605cf43ef6d96d04242", + "patch_sha256": "sha256:14f1a8de20105760340d212b579d669a0e770d20accc433876f024601f206be1", + "files_sha256": { + "charts/flex-auth/templates/deployment.yaml": "sha256:26e29618b9110bdd9d8aa73aae432a95c757a4f46e567ce4fe429c60bd519026", + "charts/access-engine/templates/deployment.yaml": "sha256:04f1fa3c0378f1f28b11438549e0542a85c0604fb19d7ea814eeddf8d99de29b", + "tests/test_outbox_replicas_chart.py": "sha256:dde2b054fa0355cf88034c3482aae45b4116d8ebdb9b0b9b28075960ebc244f0", + "workplans/FLEX-WP-0024-decision-envelope-authenticity.md": "sha256:3a3fc05528eb869204811d90d12ef5a3ac3b6d537b5b7a8cccbc15b6483a002f" + }, + "observed_at": "2026-10-16T18:25:08.992513+00:00", + "source_reviewed": true, + "published": true, + "native_accepted": false, + "execution_authorized": false, + "normal_sync": { + "session_id": 67234, + "exit_code": 0, + "bindings": "38/38", + "assessment_fail": 0, + "automation_error": 0, + "warn": 10, + "info": 0 + }, + "publication_verified_at": "2026-10-16T18:28:18.107141+00:00", + "committed_file_hashes_verified": true +} diff --git a/docs/changes/netkingdom-target-2026-10-16/access-package-identity/family-review/disposition.md b/docs/changes/netkingdom-target-2026-10-16/access-package-identity/family-review/disposition.md new file mode 100644 index 00000000..1e4fd5be --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-package-identity/family-review/disposition.md @@ -0,0 +1,17 @@ +# Railiance Master family source disposition + +2026-10-16 — Accepted for bounded source integration, with no required family-contract corrections. This is the Railiance Master family-owner review only. + +Reviewed the independently unpacked 13-file archive `rapp-flex-auth-secrets-engine.tar` at SHA256 `766279e86749bde4e25aafcb3989134e9879564667dd46a55be29bc995f66d8d`; every manifest file hash matches. Declaration SHA256 is `0b722431bc5162dd86f72b15f12424e149aca8f2a8790adf2c57e8511ea73b4c`. Exact local normative source hashes and Master HEAD are in `review.json`. + +ADR-0007 accepted-2 permits this one-member bounded package: the retained lifecycle PDP has an independent Helm rollback boundary, and no other Access deployment is grouped with it. `ownership_repo: access-engine` preserves lifecycle accountability; the package does not acquire PDP semantics, credentials, or another owner's capability. The exact package/workload/deployable reference is `(rapp-flex-auth-secrets-engine, flex-auth-secrets-engine, flex-auth-secrets-engine)`. Declared runtime dependencies consume capabilities and do not claim those providers as members. + +The declaration conforms to the current normative schema, including rollout default/commands, named smoke outcomes and ordered rollback strategies. The operations contract requires exact approved source/image/config, prechange Helm revision, independent identity/caller/policy smoke, fencing and compatible rollback, with unavailable as recovery when safe return cannot be proven. The current source `2b064eee510640224274ccdc7cefceb1ae13162e` and retained `sha256:05a03a8790c2210c48ea92391441c77ddf640d0cd32f5ec09838f5393171fcbd` image are separate extraction pins. The package explicitly excludes native signer/outbox activation and requires a separately reviewed successor for that change. + +Independent focused family validation reports two declarations with zero errors or warnings. Global validation reports 18 declarations with the same pre-existing `rapp-forgejo` missing-declaration error and derived-reef warning as the 17-declaration baseline; the overlay adds no duplicate-deployable or new family finding. The global estate is therefore not certified clean. Validator self-tests pass. Both package render tests pass, including six mutation refusal cases; independent rendered SHA256 `f979f7d05d5b0a54e3b8ac7c413aa4d401139f991b43412cdbde3d63249b0dd9` equals the submitted rendering. + +Readiness remains `draft`; empty reef bindings claim no placement. Until an authoritative declaration is committed/published and included in resolver inventory, the retained runtime remains `unknown` to managed-workload controls. This acceptance grants no production admission, custody/catalog binding, public exposure, signed-consumer trust, hardening image acceptance or native action. Those owner returns remain separate. + +Existing work ownership remains Access `FLEX-WP-0024-T06`; Master `RMASTER-WP-0025-T03` supplies the already-completed coverage-contract ruling. The accompanying supplemental work-record patch records this review without reopening that framework task or creating implementation work in Master. Canonical owner checkouts, remote repos, native runtime and credentials were untouched. + +The Emergent Security orientation package 0.2.6 digest `8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02` was withheld due to changed sources; current local Master normative sources and NetKingdom/Gate House sources were read instead. No admission authority is inferred from that orientation. diff --git a/docs/changes/netkingdom-target-2026-10-16/access-package-identity/family-review/review.json b/docs/changes/netkingdom-target-2026-10-16/access-package-identity/family-review/review.json new file mode 100644 index 00000000..f8f35c6c --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-package-identity/family-review/review.json @@ -0,0 +1,51 @@ +{ + "schema": "railiance-master.rapp-family-source-review.v1", + "date": "2026-10-16", + "review_role": "Railiance Master normative family owner (delegated source review only)", + "disposition": "accepted-source-only", + "package": "rapp-flex-auth-secrets-engine", + "workload": "flex-auth-secrets-engine", + "deployable": "flex-auth-secrets-engine", + "ownership_repo": "access-engine", + "reviewed_tar_sha256": "766279e86749bde4e25aafcb3989134e9879564667dd46a55be29bc995f66d8d", + "reviewed_declaration_sha256": "0b722431bc5162dd86f72b15f12424e149aca8f2a8790adf2c57e8511ea73b4c", + "master_head": "a0be0d3142b5392f1fb6271cf91325ce91a0f9d4", + "normative_files_sha256": { + "docs/adr/ADR-0007-rapp-declaration-contract.md": "b1185388ded53188dc624fbda9bee517dd3ac80b35e881cd4a7962531bec52ff", + "schemas/rapp.schema.json": "46c86e8fd391de5e4287dc7053e3d905ca87b5c4a68cd21c76b40cddd26c3ecd", + "schemas/rail.schema.json": "20252bfd4d5fad9874d9b78c00214de57ca41ff789f06564413bc14cb8bf3f15", + "schemas/reef.schema.json": "0731bc22638dffab733f4daea154bdbe692b0f5bfdb70181a13a6218f3741d2b", + "tools/validate-family-declarations.py": "59f768b5a327c78b30b6e18ed2609af63da23879464613d067597f79d1753574", + "schemas/README.md": "d581e64d4e1e6e9e3b939a879bec95a80009736f27bdef10b0a6d87532458fc6", + "INTENT.md": "dacbc59b7d42412e3e65d3d16ce058d0bde486e16435112c7abf83b696572eda" + }, + "source_revision": "2b064eee510640224274ccdc7cefceb1ae13162e", + "readiness_state": "draft", + "bound_reefs": [], + "required_source_corrections": [], + "checks": { + "tar_and_all_13_hashes": "pass", + "normative_focused_validation": "2 declarations; zero errors/warnings", + "normative_global_validation": "18 declarations; pre-existing missing rapp-forgejo declaration and reef projection warning; no new findings", + "normative_baseline_validation": "17 declarations; same missing rapp-forgejo declaration and reef projection warning", + "validator_self_test": "pass", + "render_tests": "2 tests pass; six mutation subcases refuse", + "independent_render_matches_submitted_sha256": "f979f7d05d5b0a54e3b8ac7c413aa4d401139f991b43412cdbde3d63249b0dd9" + }, + "existing_owner_work_records": { + "framework_contract": "RMASTER-WP-0025-T03 (finished; cited as existing contract provenance, not reopened)", + "implementation": "FLEX-WP-0024-T06 (Access owner; integration remains there)" + }, + "authority_limits": [ + "Source package semantics and normative family contracts only.", + "No canonical declaration commit/publication/registered resolver inventory is established by this review.", + "No workload runtime admission, custody, placement, exposure grant, signer trust, hardening-image approval or native rollout approval.", + "No canonical or remote repository mutation or credential read." + ], + "orientation": { + "emergent_knowledge_version": "0.2.6", + "package_digest": "8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02", + "source_status": "withheld; source review used instead", + "source_review": "current local Railiance Master INTENT/ADR/schema, NetKingdom companion v0.3, Gate House INTENT; no authority inferred from orientation" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/checkpoint-sync-fa0fc15.json b/docs/changes/netkingdom-target-2026-10-16/checkpoint-sync-fa0fc15.json new file mode 100644 index 00000000..672fd13c --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/checkpoint-sync-fa0fc15.json @@ -0,0 +1,16 @@ +{ + "session_id": 78002, + "exit_code": 0, + "source_revision": "fa0fc15d299c305bc5115d237bfdcaed1144b14b", + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 7, + "info": 4 + }, + "bindings": "89/89", + "pushed": true, + "generated_only_commit_refused": true, + "unrelated_staging_preserved": true, + "native_acceptance": false +} diff --git a/docs/changes/netkingdom-target-2026-10-16/native-preparation-coordinator-review.json b/docs/changes/netkingdom-target-2026-10-16/native-preparation-coordinator-review.json new file mode 100644 index 00000000..d25063a2 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/native-preparation-coordinator-review.json @@ -0,0 +1,26 @@ +{ + "checked_at": "2026-10-16T18:01:56.907199+00:00", + "rollout_r1": { + "fresh_disposable_render_byte_identical": true, + "source_projection": "sha256:8ce375f065552c551538f3acc7300c427407057eeff1d0b43755bfdf8a46169c", + "native_fence_verified": false + }, + "consumer_r1": { + "configuration_hashes_verified": 17, + "baseline_sha256": "sha256:72521ff7729f8ddf5176092f3949cd50ac5f9241b0a5d1d30f3c63ce1d83091b", + "actual_installed_authorize_action_empty_trust_refusal": true, + "minimal_environment": true, + "audit_hooks_confirm_no_caller_file_open_or_socket_connect": true, + "native_accepted": false + }, + "platform_p2": { + "root_tests_passed": 7, + "output_mode": "0600", + "scope": "Offline preparation; source projection and empty-key baseline are proposed, not native observations or admission", + "missing": "Actual CCR approval/binding, stopped fence/exclusive window, attended founder entity, expiry and exact owner dispositions" + }, + "followup_source_reviews": [ + "Allow chart numeric replicas0or1 for governed maintenance without bespoke stopped derivative", + "Resolve combined cluster-gitops reviewer slot against actual owner responsibility boundaries" + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-16/platform-signer-custody/native-owner-boundary-r4/canonical-commit-refusal.json b/docs/changes/netkingdom-target-2026-10-16/platform-signer-custody/native-owner-boundary-r4/canonical-commit-refusal.json new file mode 100644 index 00000000..e8d7cdf9 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/platform-signer-custody/native-owner-boundary-r4/canonical-commit-refusal.json @@ -0,0 +1,12 @@ +{ + "stage": "normal-precommit", + "committed": false, + "changed_paths": 6, + "blocked_blob_ids": [ + "400ca179870edde92ab2f441646f173cf1a6e7f8", + "7878feba9ac2e83dbd9ec7d7082dc7c19b504c34" + ], + "rule": "generic-api-key", + "finding": "Public immutable image reference in prose; successor R5 uses typed complete OCI reference. No scanner configuration or bypass.", + "full_ccr_validation": "Unchanged baseline CCR0035 errors; focused CCR0050 passes with unconfirmed-claims warning" +} diff --git a/docs/changes/netkingdom-target-2026-10-16/platform-signer-custody/native-owner-boundary-r5/canonical-integration.json b/docs/changes/netkingdom-target-2026-10-16/platform-signer-custody/native-owner-boundary-r5/canonical-integration.json new file mode 100644 index 00000000..a1280752 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/platform-signer-custody/native-owner-boundary-r5/canonical-integration.json @@ -0,0 +1,33 @@ +{ + "repo": "railiance-platform", + "base": "a3e8eb64bae110393ba0aeab043de03a92b8421a", + "commit": "84c529f239c81e6d3ca337015700b03e3a862f53", + "patch_sha256": "sha256:43264f13da5ff20267dea424a7c7d8d911f7601edca6871f31394e0c292fcd59", + "files_sha256": { + "scripts/flex_auth_signer_native.py": "sha256:4fb9ce6608ad04c4f5dc98a95796dc88a08a2453dc15c0d40c5c688fc02f573f", + "credential-change-requests/CCR-2026-0050-flex-auth-envelope-signing.yaml": "sha256:44bbbf4aff84c3b085afdb14708106fd9a12ac03a0c47774913931a87fb94ada", + "docs/credential-lane-designs/flex-auth-envelope-signing-native-plan.json": "sha256:22306d50e082fc35c5ff22c31e739a53c7584176969063f7907bc01d77e506e5", + "docs/credential-lane-designs/flex-auth-envelope-signing-native-adapter.md": "sha256:0e2e431dcd2df66e65434ce4060a4d5b52941f50928be80a075e4f972229d3a9", + "tests/test_flex_auth_signer_native.py": "sha256:f74a2316506737966e2ea539799cb477a9cec2718a6679f417478f9972731b3e", + "workplans/RPF-WP-0035-credential-lane-implementation.md": "sha256:20451474d84be986f7be1e2ff8c48e3a754e981718949f0e9d771081ae15d25b" + }, + "observed_at": "2026-10-16T18:26:33.521836+00:00", + "source_reviewed": true, + "published": true, + "native_accepted": false, + "execution_authorized": false, + "prior_refusal": "../native-owner-boundary-r4/canonical-commit-refusal.json", + "normal_sync": { + "session_id": 3820, + "exit_code": 0, + "status": "applied", + "instance_role": "primary", + "instance_label": "railiance01", + "updated_workstreams": 64, + "updated_tasks": 1, + "refused": 0, + "unresolved_edges": 12 + }, + "publication_verified_at": "2026-10-16T18:28:18.107141+00:00", + "committed_file_hashes_verified": true +} diff --git a/docs/changes/netkingdom-target-2026-10-16/source-wave-status.json b/docs/changes/netkingdom-target-2026-10-16/source-wave-status.json index f1c5ace4..0eeb65a0 100644 --- a/docs/changes/netkingdom-target-2026-10-16/source-wave-status.json +++ b/docs/changes/netkingdom-target-2026-10-16/source-wave-status.json @@ -1,6 +1,6 @@ { "schema": "custodian.netkingdom-source-wave.v1", - "observed_at": "2026-10-16T17:55:15.923336+00:00", + "observed_at": "2026-10-16T18:28:18.107141+00:00", "coordinator": "CUST-WP-0080-T06", "source_slices": [ { @@ -323,6 +323,24 @@ "published": true, "native_accepted": false, "receipt": "access-native-admission/image-0a05383/publisher-fix/canonical-integration.json" + }, + { + "repo": "access-engine", + "slice": "access-native-admission/stopped-chart-r2", + "commit": "dc042022f7c30671cf0a7605cf43ef6d96d04242", + "published": true, + "native_accepted": false, + "receipt": "access-native-admission/stopped-chart-r2/canonical-integration.json", + "patch_sha256": "sha256:14f1a8de20105760340d212b579d669a0e770d20accc433876f024601f206be1" + }, + { + "repo": "railiance-platform", + "slice": "platform-signer-custody/native-owner-boundary-r5", + "commit": "84c529f239c81e6d3ca337015700b03e3a862f53", + "published": true, + "native_accepted": false, + "receipt": "platform-signer-custody/native-owner-boundary-r5/canonical-integration.json", + "patch_sha256": "sha256:43264f13da5ff20267dea424a7c7d8d911f7601edca6871f31394e0c292fcd59" } ], "integrity_note": "Canonical owner commits are the durable source. Raw patches and temporary reconstructions are workspace-local review artifacts; their hashes retain revision identity. No runtime admission follows from these commits.", @@ -335,14 +353,14 @@ "Historical (resolved by Access B1 reconciliation): Access follow-up task-index repair timed out again; producer source remains published. Owner admission preparation also tracks qualified wait metadata." ], "remaining_critical_path": [ - "Exact native producer image, committed managed package declaration, independently approved signer custody/public trust, consumer bundle/config and caller admission", + "Admit independently approved signer custody/public trust, actual stopped fence and PV retention, consumer bundle/config/caller; verified image and local draft package are preparation evidence", "Admit actual recovery custody/actor/audit and resolve lost issuance without accessor; source tests do not establish runtime authority", "Native audit source/class admission, durable storage and independent receiver reconciliation", "Actual browser identity/case, agent isolation, runner isolation, independent service recovery and all sixteen TSA gates" ], "canonical_receipt_verification": { - "checked_at": "2026-10-16T16:54:23.811310+00:00", - "scope": "four wave8 source slices", + "checked_at": "2026-10-16T18:28:18.107141+00:00", + "scope": "two new source slices plus cluster own-review work record", "all_commit_file_hashes_match": true, "all_commits_ancestor_of_origin_main": true, "native_acceptance": false diff --git a/docs/changes/netkingdom-target-2026-10-16/source-wave10-coordinator-review.json b/docs/changes/netkingdom-target-2026-10-16/source-wave10-coordinator-review.json new file mode 100644 index 00000000..49d504e2 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/source-wave10-coordinator-review.json @@ -0,0 +1,28 @@ +{ + "checked_at": "2026-10-16T18:28:18.107141+00:00", + "access": { + "commit": "access-native-admission/stopped-chart-r2/canonical-integration.json", + "root_actual_helm_cases": 86, + "existing_outbox_suite": "passed", + "r2_only_workplan_delta": true, + "all_postimage_hashes_match": true, + "native_deployment": false + }, + "platform": { + "commit": "platform-signer-custody/native-owner-boundary-r5/canonical-integration.json", + "root_native_preparation_tests": 45, + "independent_cluster_native_custody_tests": 54, + "r4_r5_executor_tests_unchanged": true, + "focused_ccr_validation": "pass; claims unconfirmed", + "full_ccr_validation": "baseline CCR0035 errors retained", + "scanner_refusal": "native-owner-boundary-r4/canonical-commit-refusal.json", + "successor_normal_scanner": "6 blobs clean" + }, + "cluster": { + "work_record": "RCLUSTER-WP-0017", + "source_commit": "523669fba57c3785afc30b934ccdcb34a8871bf6", + "formal_review": "Exact Platform R5 source-role correction approved only; native scopes withheld", + "prefix_discrepancy": "ADR007 confirms RCLUSTER; C26 historically inferred retired prefix" + }, + "tsa_gates_closed": 0 +} diff --git a/docs/netkingdom-target-implementation.md b/docs/netkingdom-target-implementation.md index 3dad40a7..1e3951a9 100644 --- a/docs/netkingdom-target-implementation.md +++ b/docs/netkingdom-target-implementation.md @@ -230,8 +230,12 @@ receipt parsing because the runner lacks Python. Public package metadata and the run's push/pull evidence identify the published digest and exact revision; the failed run remains failed. Access `84c78e0` replaces that parser with existing Bash/Docker facilities, verifies the pulled revision label, and records the local -package reference. Three independent publisher tests pass. Normal source publication and synchronization passed; successor CI is being -observed. No deployment follows automatically. +package reference. Three independent publisher tests pass. Normal source publication +and synchronization passed. Ordinary publisher run402 and both smoke jobs in run401 +succeeded for exact `84c78e0`; independent public package metadata confirms image +`sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f` +and its revision label. The [independent image review](changes/netkingdom-target-2026-10-16/access-native-admission/image-84c78e0/coordinator-review.json) +retains this evidence separately from failed run400. No deployment follows automatically. Audit `64509d2` defines the first pin's admission and complete-ledger reconciliation using existing receiver APIs. Independent root checks passed 17 tests plus the @@ -266,6 +270,35 @@ The [source wave receipt](changes/netkingdom-target-2026-10-16/source-wave-statu records exact publication and synchronization results. Temporary review checkouts and agent handles remain preparation artifacts, not runtime deployments. +Two preparation dependencies are now simplified in published source. Access +`dc04202` permits exactly zero or one outbox writer through the ordinary Helm +chart, removing the separate hand-derived stopped manifest. Both charts reject +unsafe replica values; 86 actual Helm render cases and the existing outbox suite +pass. The chart successor explicitly retains the independently verified `84c78e0` +image; chart and binary revisions remain distinct. + +Platform `84c529f` replaces the conflated cluster/GitOps reviewer with the exact +runtime/storage owner. Access owns workload and Helm release changes; Platform +owns existing GitOps Applications and their sync/freeze integration; cluster +owns runtime, headroom and storage review. Enablement participates if an actual +controller installation change is proposed. Independent checks passed 45 native +preparation tests and 54 overlapping cluster custody tests. The focused CCR +validates but remains proposed with unconfirmed claims. A normal scanner refusal +on ambiguous public image references was corrected with complete typed OCI +references; the unchanged scanner then accepted all six files. The full CCR +validator retains unrelated baseline CCR0035 errors. + +Both commits have verified publication and normal synchronization receipts. +Cluster's own review record was published as `RCLUSTER-WP-0017`. Its source-only +review accepts the exact Platform role correction. The sync prefix warning is a +reporting defect: ADR-007 explicitly assigns `RCLUSTER-WP`, while the checker +infers the retired prefix from the historical file majority. Existing identifiers +and UUIDs remain correct and unchanged. This review grants no native action. +Frozen rollout R1 and custody P2 remain historical preparation; +their successors must bind the new source revisions and distinct owner scopes. +The [coordinator checks](changes/netkingdom-target-2026-10-16/source-wave10-coordinator-review.json) +retain the source proofs separately from deployment acceptance. + ## Dependency and residual handling The current implementation demand selects necessary target dependencies for diff --git a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md index e04e37e4..821d1139 100644 --- a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md +++ b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md @@ -727,3 +727,27 @@ retained producer ledger, with independent contract tests. Its sender/cadence an operational observer gates remain open. Platform prepared exact custody source pins and distinct missing owner inputs; no approval or native scope was invented. All sixteen target gates remain open pending scope-matched native acceptance. + +The ordinary successor publisher run402 and both smoke401 jobs succeeded for +exact `84c78e0`. Root independently verified public commit statuses, the unique +registry digest `sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f` +and explicit source revision label. Exact rollout values, stopped/ready source +renders and Platform projection are prepared separately from native evidence; +consumer pre-key trust and custody P2 remain proposed. Checkpoint `fa0fc15` +published and synchronized 89/89 with no failures; generated-only writeback was +refused without bypass. Original failures and all native gates remain retained. + +2026-10-16 source simplification checkpoint: Access `dc04202` adds exact zero/one +writer Helm maintenance states; Platform `84c529f` separates runtime/storage +review from GitOps ownership. Both are published with normal sync receipts and +exact committed-file hash verification. Independent checks cover 86 actual Helm +renders plus existing outbox tests, 45 Platform native/preparation tests and 54 +overlapping cluster custody tests. Focused CCR0050 validation passes; unconfirmed +claims and unrelated baseline CCR0035 errors remain. The initial public-digest +scanner refusal is retained; typed OCI metadata passed the unchanged scanner. +Cluster own-review record `RCLUSTER-WP-0017` was published at `523669f`; the source +role correction received a bounded owner review. Its prefix warning conflicts +with ADR-007 because the checker infers the retired prefix from historical files; +the correct IDs and assigned UUIDs are preserved. Successor rollout/custody packets are being +prepared. No custody, deployment, trust, storage or protected effect occurred; +all sixteen target gates remain open.