coulomb/the-custodian
5
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

Close WP-80 T20 after native and ordinary publication acceptance cb9a20f9
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Reject generated-only commits / generated-commit-guard (push) Successful in 9s
Details

Browse source
This commit is contained in:
codex 2026-10-18 17:52:18 +02:00
parent c1fcd94812
commit 6dd619fdc7
4 changed files with 41 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

10
.kaizen/agents/custodian-codex/supervision.json
View file

@ -1048,25 +1048,27 @@
"protected_hook_files": 1328
},
"expected_result": "Exact corrected scanner with unchanged provider/rules/budgets, old/new startup custody, 166 scanner fragments, protected hooks unchanged, inherited hook and clean/blocked/unavailable probes; ordinary publication and Hub projection verified separately before T20 closes.",
"verification_ref": "docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/README.md",
"verification_ref": "docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/publication-readback-r1.json",
"rollback": "Restore exact Deployment fields using fresh conditional tests, wait for original template ready, restore only known old/new scanner fragments to original bytes/modes, verify protected metadata, then reverse only exact Apps source postimages and publish normally. Retain inert public new binaries/ConfigMap. Refuse unknown drift; retain failed/unverified outcomes.",
"cost_estimate_eur": 0,
"risk_estimate_eur": null,
"cost_note": "No added infrastructure or paid service; human effort and availability risk are unpriced.",
"risk_estimate": "Moderate availability risk: one Recreate restart, another if rollback is needed. No Secret, policy, image, database or credential changes. Existing single uncovered repository remains out of scope.",
"disposition": "accepted_unchanged",
"outcome": "unverified",
"outcome": "succeeded",
"approval_ref": "cb9a20f9-5f8d-411f-b034-b15856c0efb5",
"approved_revision": 1,
"approved_digest_sha256": "90bb3a1a35729396b02a377d8db62e1d1f8f38d8e24e601dbc3d4446cffd05e8",
"executed_revision": 1,
"reason": "Exact admitted native phases verified; overall publication/checkpoint acceptance still pending. No authority promotion.",
"reason": "Same exact original approved/executed revision1; actual foundergo and independent ownerreviews retained beforeexecution. All required action/readback phases verified. Offline preparation failures remain in packet; no authority promotion.",
"decision_request_ref": "cb9a20f9-5f8d-411f-b034-b15856c0efb5",
"owner_reviews_ref": "docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/owner-reviews.json",
"executed_digest_sha256": "90bb3a1a35729396b02a377d8db62e1d1f8f38d8e24e601dbc3d4446cffd05e8",
"execution_ref": "docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/activation-r1.json",
"execution_started_at": "2026-10-18T14:46:47.932140+00:00",
"partial_verified_outcome": "Native exact stage and activation verified;166 scanner fragments,1328 protected hooks,old/new startup guard,inheritance,quarantine,unavailable/clean recovery and cleanup. Apps source2fdc198b published. Ordinary Custodian publication/readback pending."
"partial_verified_outcome": "Native exact stage and activation verified;166 scanner fragments,1328 protected hooks,old/new startup guard,inheritance,quarantine,unavailable/clean recovery and cleanup. Apps source2fdc198b published. Ordinary Custodian publication/readback pending.",
"verified_outcome": "Exact admitted native activation plus ordinary publication of five queued Custodian commits through c1fcd948; all40 task UUID/status bindings match. Native166/1328 checks,inherited template,clean/blocked/unavailable/quarantine/cleanup proofs all verified; Apps2fdc198b declared/published. No rollback needed.",
"execution_finished_at": "2026-10-18T15:50:46.117328+00:00"
}
],
"trials": [

7
docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/README.md
View file

@ -1,6 +1,6 @@
# T20: exact receive-scanner activation and recovery
Status: **native stage and activation verified; ordinary Custodian publication/readback pending**.
Status: **T20 complete: native activation, ordinary publication and 40-task readback verified**.
Founder decision `cb9a20f9-5f8d-411f-b034-b15856c0efb5` records the actual
conditional go, now satisfied by the two independent owner approvals in
@ -8,6 +8,11 @@ conditional go, now satisfied by the two independent owner approvals in
The two Apps declarations are published at `2fdc198b2bb8e6d4ad50768c22cf99328828eb4f`.
The prepared proposal remains byte-for-byte unchanged.
Normal publication pushed all five queued Custodian commits through `c1fcd948`.
`publication-readback-r1.json` verifies all 40 Hub UUID/status bindings against
the source and confirms the publication blocker is cleared. Other WP-80 gates
remain required. Original unrelated worktree and index state was restored exactly.
Stable proposal `FORGE10-RECEIVE-BATCH-20261018`, revision **1**, exact
[`proposal.json`](proposal.json) digest:

14
docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/publication-readback-r1.json Normal file
View file

@ -0,0 +1,14 @@
{
"published_commit": "c1fcd94812e60b950b3be90312c5dbd2dfe62d44",
"remote_commit": "c1fcd94812e60b950b3be90312c5dbd2dfe62d44",
"hub_tasks": 40,
"all_uuid_status_bindings_match_source": true,
"statuses": {
"done": 9,
"progress": 4,
"todo": 27
},
"original_eight_states_preserved": true,
"publication_blocker_cleared": true,
"delivery_checkpoint_T20_still_progress_until_this_readback": true
}

35
workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md
View file

@ -23,17 +23,16 @@ Updated 18 October 2026 after the founder requested clearer progress and smaller
| --- | --- | --- |
| Completed source evidence checkpoints | **7 of 7**: T07-T13 | Published/reviewed foundations at their stated scope; no native acceptance inferred. |
| Remaining integration/build checkpoints | **0 of 6**: T14-T19 | Current ongoing access, protected operation/inverse, writer exclusion and final build still need completion. |
| Delivery checkpoints overall | **7 done, 1 in progress, 26 todo**: T07-T40 | Discrete Custodian evidence checkpoints linked to existing owner implementation work. |
| Delivery checkpoints overall | **8 done, 0 in progress, 26 todo**: T07-T40 | Discrete Custodian evidence checkpoints linked to existing owner implementation work. |
| Complete native architecture gates | **0 of 16**: TSA-01-TSA-16 | Each requires its full deployed/consumer evidence. This is not 0% engineering progress. |
| Original coordination records | **2 of 6 done**: T01-T06 | Stable umbrella IDs/UUIDs retained for existing callers; not a delivery percentage. |
**Now - T20:** the exact founder-admitted revision has passed native activation:
166 scanner fragments updated, 1,328 protected hook files preserved, both-version
startup custody and actual template inheritance verified, clean/blocked/unavailable
receive-pack and cleanup proofs passed. The two Apps declarations are published at
2fdc198b. Ordinary Custodian publication and 40-task Hub readback remain before
this checkpoint closes. No complete architecture gate is inferred from this scoped
scanner migration.
**Completed - T20:** the founder-admitted scanner revision passed native activation,
including 166 scanner fragments, 1,328 protected hook files, both-version startup
custody, actual template inheritance, receive-pack refusal/recovery and cleanup.
Normal publication pushed all five queued Custodian commits; exact Hub readback
verified all 40 task UUID/status bindings. The publication blocker is cleared.
This scoped scanner acceptance does not close a complete architecture gate.
**Next - T14/T15:** implement and verify the selected current KeyCape checks on
ongoing browser/API/Git HTTP and SSH paths, using the existing producer clients.
@ -48,16 +47,12 @@ provider index/parity repairs; workload-isolation fixture proof. T07-T13 carry t
scope and evidence for each. The new completed records expose existing delivered
work; they do not represent seven newly deployed systems.
**Publication:** the owner source commits named below are published. Recent
Custodian evidence is locally committed/prepared but its remote publication remains
blocked by the unchanged live receive scanner. A local checkpoint is not a published
or deployed result.
**Hub view:** the last readback still contains the six original task records.
Normal consistency sync attempted publication and skipped task writes after that
push failed. The 34 new delivery records and counts above are verified in this
source file and await normal projection; they are not yet visible as Hub tasks.
T20 removes this publication blocker as part of its acceptance test.
**Publication and Hub view:** normal source publication is working again.
The five queued Custodian commits were published through c1fcd948; all 40 task
records (six original coordination records plus 34 delivery checkpoints) are
present in the Hub with verified source bindings. T20 is now complete. The Hub
remains the derived view; this file owns checkpoint status. Subsequent source
changes use the same ordinary commit/consistency path.
**Scope:** all 16 gates, G01-G13 and all 116 SEC-DSM ledger entries remain required.
[Target and acceptance contract](../docs/netkingdom-target-security-architecture.md),
@ -341,7 +336,7 @@ Completion test: Build the final integrated revision with pinned source/tool/dep
```task
id: CUST-WP-0080-T20
status: progress
status: done
priority: high
depends_on: [CUST-WP-0080-T11]
state_hub_task_id: "0d9df435-b9a2-5b89-833d-799785c969a9"
@ -349,7 +344,7 @@ state_hub_task_id: "0d9df435-b9a2-5b89-833d-799785c969a9"
Stage: native acceptance. Owner implementation: Forge / Apps / Repo Manager; FORGE-WP-0010-T02/T03.
Completion test: [Exact revision 1](../docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/README.md) received founder go cb9a20f9 after independent Forge/Apps approval. Native stage and activation passed: exact binaries/startup, 166 hook fragments, 1,328 protected hook files, inherited executable hook, clean/blocked/unavailable receive-pack, quarantine and cleanup. Apps declaration 2fdc198b is published. Remaining: ordinary Custodian source publication and exact 40-task Hub readback; keep progress until both pass.
Completed: [exact revision 1](../docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/README.md) received founder go cb9a20f9 after independent Forge/Apps approval. Native stage and activation verified exact binaries/startup, 166 scanner fragments, 1,328 protected hook files, actual inherited executable hook, clean/blocked/unavailable receive-pack, quarantine and cleanup. Apps declaration 2fdc198b is published. Normal Custodian publication pushed five queued commits through c1fcd948 and exact Hub readback matched all 40 task UUID/status bindings. See publication-readback-r1.json in that packet. Independent Forge owner accepted the native/publication returns against FORGE-WP-0010-T02/T03; that existing owner workplan remains the implementation record. Other target gates and existing residual boundaries remain open.
## T21 - Accept signed decisions at the native privileged consumers