From 6f61224f12f0be060d2686f0466c80d7274f77cb Mon Sep 17 00:00:00 2001 From: codex Date: Sat, 17 Oct 2026 07:53:57 +0200 Subject: [PATCH] Record native security preparation and owner checkpoints (7/7) --- .../custodian-publication-inputs.json | 478 ++++++++++++++++++ .../publish_custodian.py | 93 ++++ .../root-source-review.json | 21 + .../verification-refusals.json | 17 + .../verified-bindings.json | 339 +++++++++++++ docs/netkingdom-target-implementation.md | 50 ++ ...gdom-security-blueprint-and-gap-closure.md | 48 ++ 7 files changed, 1046 insertions(+) create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-publication-inputs.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/publish_custodian.py create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/root-source-review.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/verification-refusals.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/verified-bindings.json diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-publication-inputs.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-publication-inputs.json new file mode 100644 index 00000000..1b871b1b --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-publication-inputs.json @@ -0,0 +1,478 @@ +{ + "schema": "custodian.native-source-publication.v1", + "base": "ceaeef1ee79eeba37e7cacf73ba8aed3357a5e7c", + "purpose": "Publish exact source-owner evidence and native preparation through ordinary unchanged local/remote gates in bounded batches; no native deployment or security gate closure.", + "files": 114, + "batches": [ + [ + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-gates-r1/native-gate-audit.json", + "sha256": "ab803e795af61fd027f5930d127592316133de38b68a8fe61b89a1f9803a9ff2" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/README.md", + "sha256": "fae49e17e652226c024ac0eae9d5fd967a82fa3b37441a448380edfe2ba07879" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/consumer-proof-plan.md", + "sha256": "0d47336d44c2e354a7e1c862fcb96bb097fdae7042e9c85caf1c978fba314693" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/focused-regressions.stderr.txt", + "sha256": "c28f2305fc55ba0571b9e23fd7fd7482b50e85e352c25be0677b9d86882f1ec1" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/focused-regressions.stdout.txt", + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/hub-readback.json", + "sha256": "f01ff4e13bf8aad12cb042607ed7ca96ec58673e47edb343176addc45467d5f8" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/manifest.json", + "sha256": "6821e650a4ca07087697b5091a3db26b722456170c1c4816ca8c49bdf527fce4" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/next-attempt-proposal.json", + "sha256": "8cc9ee58131d41c9bd2951c233c3d2c5916fb6ea0572e73cc99b287adc61f858" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/original-behavior-regression.txt", + "sha256": "1da5266b47ce0be90bfd4056a7b019fde31566654180bc1be4bedd6805e6cb3d" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/owner-declaration.template.json", + "sha256": "57268212a2f1d1c34fdc2f6587a26724468ee2045c9a88d8523b74452f8f3c09" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/owner-source.patch", + "sha256": "d02de220d28a293ad22e1781b9d0f42b0bf69456de785a30022851eb723b83e7" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/postimages/tests/isolated-keycape-native-fixture-manifest.json", + "sha256": "936ee435be04b27f391391e7dda02def69e153bde3adcce92d569f33f308db2e" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/postimages/tests/test_isolated_keycape_recovery.py", + "sha256": "5f729e077db51dd6b17d00dc3eb71c0e652849f55fe68505a07befa663c91dea" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/postimages/tools/bootstrap-recovery/isolated-keycape.py", + "sha256": "86f37add7221e4c73e3f9d878c09a3cc81061627cbf024ed6887d973d929b718" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/postimages/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md", + "sha256": "5830c429f58a0317b28c7b4bcf22a1b46e6d01b41378cdae95f947c6d9317e44" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/preimages/tests/isolated-keycape-native-fixture-manifest.json", + "sha256": "1dcefbc7ca7b0c2be33135b1b7977b89ba657223ecbb1310cc691d151b3d916e" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/preimages/tests/test_isolated_keycape_recovery.py", + "sha256": "247e9a87f5be2ee9f20f7edbb4a9f612ab7cb0cd940392c3caeca8b046605f55" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/preimages/tools/bootstrap-recovery/isolated-keycape.py", + "sha256": "f67627b7d1647d75187dd899874efe22383bc91de5d97dabb9801076668ab3c2" + } + ], + [ + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/preimages/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md", + "sha256": "678ec04b73b57c026001791706c05c5d4d5a508a32f17210ae8ad03ab15d53b8" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/refinement-r2/NK-WP-0049.postimage.md", + "sha256": "e0cd01320b366ab8961a0a52a908edc1524f98b3cfab7382a14fa915da2f60a2" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/refinement-r2/NK-WP-0049.preimage.md", + "sha256": "5830c429f58a0317b28c7b4bcf22a1b46e6d01b41378cdae95f947c6d9317e44" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/refinement-r2/manifest.json", + "sha256": "86704b3ce76d5f65bec8a6fa85894b867ae753bd81f18beeec2b216d1e5c3d51" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/refinement-r2/task-refinement.patch", + "sha256": "a2e17aa51eb0313f1370ff366afb1198ce93624bb7451445dd62be9b663e70f0" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/refinement-r2/updated-owner-source.patch", + "sha256": "552484c86a7ac8b443faea6222aeb6d660eb0148f5d596c90f94ac9c60c2a6b0" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/routing-discovery.json", + "sha256": "763a36b7da8a6476d50e4f377eee3415b7e1460deea1d3827064a200955350e4" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/selector-preflight.json", + "sha256": "b3946e11ce91b7a9d3e24e4e218e21739f12216cf4621fc216fccc2147439d41" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/selector-uniqueness.patch", + "sha256": "55aa1efad828e6c466ec92430e94eb4366b0b8470bc790ccfa056fb0b3125853" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/source-references.json", + "sha256": "a6484b77be832733ceba7b11563ca73b472b9f17f02c89002575d9a0e1e3a42b" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/verification.json", + "sha256": "4d2beb8cd1871c13de7f6b5fe0ffe6c2d20b5ff5c1e39537200f9fc0e8d04b43" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-registration-r1/assemble_review.py", + "sha256": "554cc213824098e3b3599d9e801330a28aea72f19336b7492adacebbf84d62f4" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-registration-r1/descriptor-composition.json", + "sha256": "e097abe5f7b149e5688850cfb0ef7793a1b3206388b52f069b51137f6ca92170" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-registration-r1/manifest.json", + "sha256": "9c9b055cb7983706e7bccb13acf335180c4343c8a05de5ef63f97548c9f5021a" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-registration-r1/original-attempt-review.json", + "sha256": "d0df5c45f53f7d61ac54589e55b09f1c9cff098ade63e5853e434ced8f83fe3c" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-registration-r1/register-client.proposed-descriptor.json", + "sha256": "1b86e9032845ec35a58d88a9f1108dbb7d8cee0c9c9176d4a694b893d9d7a3fa" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-registration-r1/source-manifest.json", + "sha256": "33c475045cfe958bab5b7545783dea497427373448c83c1859888550e965c104" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-registration-r1/source-verification.json", + "sha256": "2ed179ecdcda85a29b0e86e7e19274fdce408d154e4e79f61bbccc80304c8dfd" + } + ], + [ + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-registration-r1/summary.json", + "sha256": "3ede75b2d55190fb41236a92c4d2ed157be04c819ab5226e5d9c404d87d51bdd" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-registration-r1/work-record-proposal.json", + "sha256": "0aec5c8a8473232d1800c6c3b70661dd1412271e57effe0d7f19242201897134" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-registration-refinement-r2/manifest.json", + "sha256": "2162578418e2baa1b0ab08434d2e8c4d66c1da718d77bca085c953271f97d356" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-registration-refinement-r2/postimage.md", + "sha256": "0fdc263a5b23d376a2c6e908e955c91fdaf8121144da59ebc6e5aee8ef727f5e" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-registration-refinement-r2/preimage.md", + "sha256": "b737bfae4802c122b21619695a169d7d082672af96314b1709860dd5aff2a60f" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-registration-refinement-r2/t22-applied-intermediate.md", + "sha256": "a756cf34eb0398312a8e11035b7b1b21d2b97a847f015b888063bd80549b6fc2" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-registration-refinement-r2/workplan.patch", + "sha256": "714a345e601588eacaccdc559d864553f21a7cceb1fcebddf305404680019906" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-storage-r1/OWNER-REVIEW.md", + "sha256": "9a12392030ae5bd46dbed95718e3b51e6df15f52ce0fa2411704ddd8f2b1e91f" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-storage-r1/artifact-manifest.json", + "sha256": "103d26a35c78fa32e8d1ecf9d43b797874f9e6d9392e2e8d576d298284bb3dfb" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-storage-r1/identity-provisioner.consumer.PROPOSED.yaml", + "sha256": "f1964bf13b9e8d7189eeb66b6a5cec092562b90a325e30c6c5d889c733ff1355" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-storage-r1/rapp-identity-provisioner.PROPOSED.yaml", + "sha256": "7d7ab31e8f65f70695c79c8305ae70eb666181ad1ee34ea4f0c9e29300072f83" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-storage-r1/rendered/identity-provisioner.sql", + "sha256": "476738b3b863ec67fedc0c672e6678350a7f73580d953157a22631f28c3263c8" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-storage-r1/rendered/identity-provisioner.yaml", + "sha256": "0d05211e02cddce2d7ccfdf29ac4dfad8163df62abe93b3c2e39aac0d5ac75d7" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-storage-r1/source-references.json", + "sha256": "8530100cd820d397da023114076bc33ead9ea5f9983bf39864d041a73b4b77fb" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-storage-r1/source-validation.json", + "sha256": "fe57add4e819661b7ef4df98f5166d0147f6b5e5912be0d6ec7c0a7da2090d9c" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/FINAL-PROPOSAL.md", + "sha256": "8488a2ead0bca62f22cbac40bd1381b006f11901997c5463ea8fc9fa4847b237" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/artifact-manifest.json", + "sha256": "0490f2a7866aa1753027d5253592247ed70794a038763a1e036040a6927899de" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/exec-owner.REVIEW.json", + "sha256": "bad5be9da40627b0cf2ab5ef5f4a4129573eb7493c3284e4517d772ee0eaf50d" + } + ], + [ + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/one-task.REVIEW.json", + "sha256": "0f8ac0533f5d7eb039c9173715e3bb7a85edda08ff6d60dff739d73ab5a90605" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/pricing-observation.json", + "sha256": "92db4445fff1544f091a38d3a9cb07b45b1ae2080ff34552b76a21a086e26863" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/runtime-pins.json", + "sha256": "5c5daa145d714bec0828477699ac1e9002977502e9e8f1056b59846b7d7adaea" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/source-references.json", + "sha256": "1d87c5f7d33ff6256d4660e3bc3d166159c58c39d6072f9271f13acc9b615b60" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/source-review.json", + "sha256": "2a7dd446cc1f139ba195d0a02c6f93daecaf88c552247ea7fb880c95e17f93c3" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/access-need.json", + "sha256": "f44fd946d036295cff71da173987feaaa718e11d84641f54c3c623ef8d8f75b0" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/capabilities-evidence.json", + "sha256": "e35ff049dca1b69b420f563bd08acf3fa0d36e74311af43fde84ab7f6f589e78" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/findings.json", + "sha256": "77f43bfa03444e31ae85e26f48b7dcd661e000cb63336e1287cbebc8ad9fed46" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/manifest.json", + "sha256": "0d19f9646a042cc290e4e5a828fe4f1e37f8b01ee951df4a373edc493b6793ab" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/routing-evidence.json", + "sha256": "c45fd55fd344a47eb8563bd08ea4975b3363d3ebd45e1fa7eec722fceb789c77" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/source-history-followthrough-r2.json", + "sha256": "51a6cf3547f0b9aac1620c472c933bd3eb7213200d78397bf8d851ea4f3f861a" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/source-references.json", + "sha256": "474188ae4bf49388f137fdb9077890d3063b83e17ce157e99c8010b0076c8dcb" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/README.md", + "sha256": "79be07d7648957d00de4ed5aaa82e5c9b976bda0b7d38cf13fc0f6935fbda7ff" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/hub-readback.json", + "sha256": "947864938c88edd1de53733ac2585665a87e56e70b9bec6c63bd854489e49b6f" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/manifest.json", + "sha256": "28c9696d193f980016c9fdbcb391613a1c027a8095d506e36d72eef0305ab1ee" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/metadata-handoff.template.json", + "sha256": "ec686984ea9533be1089bc943c72838f9c41e1a1db0643932440f3b222accfb7" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/rehearsal-cases.json", + "sha256": "8f682da4d81dd3c966e1b8d9c69a17f92723537abd0a2033f44f45b7c5655546" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/review.json", + "sha256": "46b1409da26df70fc6e7917fc1d50354050d211992848fa663418830f08524ce" + } + ], + [ + { + "path": "docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/source-references.json", + "sha256": "91cba1c8578fffa8c59b516496f2c57db3aea1afca535f37cf450b50dc781560" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/OWNER-PLAN.md", + "sha256": "d358aaeedc18c42c591d3301ec34f493e63bf579bf5a17b6ccc7e32ec88ea8ed" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/artifact-manifest.json", + "sha256": "e557347945780f2ae81782a64af0cb976e43aca9c25b0f7444167473adccb0a2" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/consumer-proof-interface.json", + "sha256": "50ea7080133f27a690e2fb559ea6e4686b1990ce725809419a0768081832406f" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/consumer-source-manifest.json", + "sha256": "5b0409d7141514295e7d0f636ff6fa5dbe9d1f0d4d23b2f9ebce84a174d69499" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/consumer_contract_observer.py", + "sha256": "23467730be61625d53b34c09e62f737a35e3def10d22a3a64664835961d3f4bd" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/existing-selector-preflight.json", + "sha256": "831e631bbb45bfe7e8cf196e0044601668a5e6800b8e4b56ae417045e9869d18" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/source-checks.json", + "sha256": "83604266a79a9fbc41790fb0ffdb5ab90b7d991971aaa5df16acac22a87e8c48" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/source-references.json", + "sha256": "f488eeab35504656c6f3b3c2721ca1c46b19eb529b9b0f05e9424cddf6913335" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/test_consumer_contract_observer.py", + "sha256": "34984176c281a3aa123b0ce6138e18e7dda5fae631e277e5b1726b223458f5a2" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/artifact-manifest.json", + "sha256": "245b1874e8df9633920afdfc4714a80773a1893afb8d8ee2fa66c40132742380" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/integration-manifest.json", + "sha256": "97c9d28bb094e6089b2b24ce4e1ae4ba90d319f1042cd83871429953e9eda97d" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/integration-result.json", + "sha256": "cb081438de0b8ffc2c8e47464699b4d0ba9f88af61c25c852b8078dc867d86ce" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/owner-plan.post.md", + "sha256": "b984425e043e08e5bd1e53dbef90839af5258b8fdeee057d2293a93b78bb492d" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/publish_owner.py", + "sha256": "da7d81b262cae60731952899c881ef02837ebce333071e3e1e045e890ae70756" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/secrets-engine-commit.json", + "sha256": "b4806141bfcd8701daefa6a09e21505fcbe2b24ab2d793a976e52d53c27f4567" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/secrets-engine-consistency.json", + "sha256": "6b26d33296a3371b73742e6fd0d72d8fda677e0be266c671e66047993a75327c" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/secrets-engine-consistency.stderr.txt", + "sha256": "f4a6aa1609a13600a0b97cbb08bbc03b3e247b619ff37912d37f7e109ce798ba" + } + ], + [ + { + "path": "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/secrets-engine-projection.json", + "sha256": "72686bb6242687d4021d39ecea17e4bf5fd1f873482018a874e7751b13e48b21" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/secrets-engine-projection.stderr.txt", + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/secrets-integration.json", + "sha256": "bd1bccd7fa9c8286acf533abdd38f2bdbaa5776249f6672ea991787f3992facd" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/source.patch", + "sha256": "682dd10dcd39e148e84dacd91e29c5b6016d30029e0d7c2c82f3cd3f82739261" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/verification.json", + "sha256": "8cc33b5f431b4b4d206a17da4e96ecba8e5a12cb3e88092bc82710a12bd8374d" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/verified-bindings.json", + "sha256": "5a90e6eabb9aad18e13eaeb42d74e532c56e508e5fc021290f8222e9bae37037" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/workplan.post.md", + "sha256": "c35019a8609e52fc4a7f5cc14e7b12cdc17dffbc8cd0b564a48a6b9fb6b5035d" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/workplan.pre.md", + "sha256": "b3cab4e8d14b3b03179fc72a6e9ce1c0ee840cfa3247c022c1324d60378bde5b" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/checkpoint-progress.json", + "sha256": "e08fa207f6c4edc2de28e533e806b48360e863318439dcdea98e55e995b04025" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/commit.json", + "sha256": "12bede8246179bd7849c27781e7ea1848fbb9b709de9306ff37a61b2e5a127ee" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/commit.stderr.txt", + "sha256": "a2dd72d3036ae76611a79800ddd7d3b9be1a900752e1740a9adc25db4ae9e1c4" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/commit.stdout.txt", + "sha256": "f74ce47aa06d51586b604ebf4dfb51f59c32e5da1538222ec56f78745c9bd5c8" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/consistency.json", + "sha256": "0c2580c0642d6b5ec3968b1e22e69313b6fb6350f35780cd0733baf01fe3e602" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/consistency.stderr.txt", + "sha256": "f4a6aa1609a13600a0b97cbb08bbc03b3e247b619ff37912d37f7e109ce798ba" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/projection.json", + "sha256": "93dde04e2728918c49de6244df284aa34850dfdb6cd9a1ba10b5b11f04ca288f" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/projection.stderr.txt", + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/publish-before-verifier-refinement.py", + "sha256": "6c6b77a2e2a45a9c6e0251c7a03ccac798b2fa377b63ae4dc598c1aafa223286" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/publish.py", + "sha256": "0fbff4a97b01fffde86796b06166b0845bbd7894620f76f82910e31e66fbc179" + } + ], + [ + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/publish_custodian.py", + "sha256": "88a27a88b4ad7d31bc0447e201addf306ae09cb7de7f8fb691b49a8169038fa9" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/root-source-review.json", + "sha256": "ea2bba1b42ae8d869155bec0cc4ec1b5747511e8c24f3577a7aa58c30ac86432" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/verification-refusals.json", + "sha256": "63d43852f30e05bdc380bd1644610381698ae91e8ad14479fb9864b048b33007" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/verified-bindings.json", + "sha256": "e287ff699b51eb9036139d5840591f5782434dc5d07adeff81219e5a0aced0ad" + }, + { + "path": "docs/netkingdom-target-implementation.md", + "sha256": "9f29a0cc51d885913eb0813019afb966b2adb6604be1b252b4ec5ceb17724cd7" + }, + { + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md", + "sha256": "0ee4c832e9d1d086b2319971a74ac1cd983e9c26ce024e24a41e4a840eaea744" + } + ] + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/publish_custodian.py b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/publish_custodian.py new file mode 100644 index 00000000..1e9d455a --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/publish_custodian.py @@ -0,0 +1,93 @@ +"""Publish small explicit source-evidence batches through ordinary Git gates.""" +from pathlib import Path +import argparse +import hashlib +import json +import subprocess + +ROOT = Path('/home/worsch/the-custodian') +HERE = Path(__file__).resolve().parent +BACKUP = HERE.parent / 'custodian-publication-backup' +BASE = 'ceaeef1ee79eeba37e7cacf73ba8aed3357a5e7c' + +def git(*args, timeout=40): + return subprocess.check_output(['git', '-C', str(ROOT), *args], stderr=subprocess.PIPE, timeout=timeout) + +def preserve(): + for name, entry in json.loads((BACKUP / 'originals.json').read_text()).items(): + assert (ROOT / name).read_bytes() == (BACKUP / (name + '.worktree')).read_bytes() + assert git('ls-files', '--stage', '--', name).decode() == entry + for name, pin in json.loads((BACKUP / 'other-dirty-hashes.json').read_text()).items(): + assert hashlib.sha256((ROOT / name).read_bytes()).hexdigest() == pin + +def batch(number): + plan = json.loads((HERE / 'custodian-publication-inputs.json').read_text()) + expected = BASE if number == 0 else json.loads((HERE / f'custodian-batch-{number - 1}.json').read_text())['commit'] + assert git('rev-parse', 'HEAD').decode().strip() == expected + assert git('ls-remote', 'origin', 'refs/heads/main').decode().split()[0] == expected + preserve() + rows = plan['batches'][number] + paths = [r['path'] for r in rows] + for row in rows: + assert hashlib.sha256((ROOT / row['path']).read_bytes()).hexdigest() == row['sha256'] + if number == len(plan['batches']) - 1: + paths.append(str((HERE / 'custodian-publication-inputs.json').relative_to(ROOT))) + git('add', '--', *paths) + result = subprocess.run(['git', '-C', str(ROOT), 'commit', '--only', '-m', + f'Record native security preparation and owner checkpoints ({number + 1}/{len(plan["batches"])})', '--', *paths], + capture_output=True, text=True, timeout=240) + head = git('rev-parse', 'HEAD').decode().strip() + receipt = {'exit_code': result.returncode, 'commit': head, 'parent': expected, + 'paths': paths, 'stdout': result.stdout, 'stderr': result.stderr} + (HERE / f'custodian-batch-{number}.json').write_text(json.dumps(receipt, indent=2) + '\n') + preserve() + assert result.returncode == 0, 'normal commit refused; retained result' + assert set(git('diff-tree', '--no-commit-id', '--name-only', '-r', head).decode().splitlines()) == set(paths) + try: + pushed = subprocess.run(['git', '-C', str(ROOT), 'push', 'origin', 'main'], + capture_output=True, text=True, timeout=150) + receipt['push_exit_code'] = pushed.returncode + receipt['push_stdout'] = pushed.stdout + receipt['push_stderr'] = pushed.stderr + except subprocess.TimeoutExpired: + receipt['push_exit_code'] = None + receipt['push_status'] = 'timeout_unverified' + remote = git('ls-remote', 'origin', 'refs/heads/main').decode().split()[0] + receipt['remote_exact'] = remote == head + (HERE / f'custodian-batch-{number}.json').write_text(json.dumps(receipt, indent=2) + '\n') + assert receipt.get('push_exit_code') == 0 and receipt['remote_exact'], 'push failed/unverified; no automatic retry' + preserve() + print(json.dumps({'status': 'published', 'batch': number, 'commit': head, 'paths': len(paths)})) + +def sync(): + preserve() + originals = json.loads((BACKUP / 'originals.json').read_text()) + try: + for label, argv, timeout in [ + ('custodian-consistency', ['statehub', 'fix-consistency', '--repo', 'the-custodian', '--json'], 300), + ('custodian-projection', ['/home/worsch/repo-manager/.venv/bin/rmgr', 'sync', '--path', str(ROOT), '--push'], 180)]: + result = subprocess.run(argv, cwd=ROOT, capture_output=True, text=True, timeout=timeout) + (HERE / (label + '.json')).write_text(result.stdout) + (HERE / (label + '.stderr.txt')).write_text(result.stderr) + assert result.returncode == 0, label + ' refused; result retained' + finally: + for name, entry in originals.items(): + (ROOT / name).write_bytes((BACKUP / (name + '.worktree')).read_bytes()) + mode, oid, stage, path = entry.split() + assert stage == '0' + git('update-index', '--cacheinfo', mode, oid, path) + preserve() + projection = json.loads((HERE / 'custodian-projection.json').read_text()) + head = git('rev-parse', 'HEAD').decode().strip() + assert projection['status'] == 'applied' and projection['commit'] == head + assert projection['receipt']['expected_commit'] == projection['receipt']['derived_commit'] == head + assert projection['receipt']['instance_role'] == 'primary' and projection['receipt']['instance_label'] == 'railiance01' + assert git('ls-remote', 'origin', 'refs/heads/main').decode().split()[0] == head + print(json.dumps({'status': 'applied', 'commit': head, 'unrelated_work_preserved': True})) + +if __name__ == '__main__': + parser = argparse.ArgumentParser() + parser.add_argument('action', choices=['batch', 'sync']) + parser.add_argument('number', nargs='?', type=int) + args = parser.parse_args() + batch(args.number) if args.action == 'batch' else sync() diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/root-source-review.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/root-source-review.json new file mode 100644 index 00000000..97f2bd38 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/root-source-review.json @@ -0,0 +1,21 @@ +{ + "schema": "custodian.native-source-review.v1", + "review_date": "2026-10-17", + "status": "source_changes_accepted", + "adapter_sha256": "86f37add7221e4c73e3f9d878c09a3cc81061627cbf024ed6887d973d929b718", + "reviewed_paths": 5, + "independent_check": { + "command": "PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tests -p test_isolated_keycape_recovery.py -k OriginalSelectorTests", + "working_directory": "/home/worsch/net-kingdom", + "exit_code": 0, + "tests": 4, + "result": "passed" + }, + "source_review": "Exact-one selection from already-restored configuration precedes further runtime/private inputs. Missing and duplicate registrations refuse. Existing native Go validation also rejects duplicates. The initial archive/key step precedes this guard; no pre-decryption or native exploit claim.", + "manifest_scope": "Only two affected source hashes and explicit unexecuted-successor scope refreshed; original manifests, refused stale-hash run and frozen actual native receipts retained.", + "task_refinement": "T38 records the completed guard proof; T22 and T23 separately record registration and storage integration reviews. All 58 existing task blocks remain unchanged, including UUIDs, statuses and dependencies; native completion stays with original owner tasks.", + "premature_projection_check": "A read-only verification while the normal owner push was still running refused the not-yet-current remote ref. It supplied no acceptance and caused no source/runtime mutation. Final verification is recorded separately after normal sync completion.", + "native_actions": false, + "native_target_gates_closed": 0, + "privileged_approval_or_owner_assent_inferred": false +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/verification-refusals.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/verification-refusals.json new file mode 100644 index 00000000..c383c444 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/verification-refusals.json @@ -0,0 +1,17 @@ +{ + "status": "retained_verifier_refusals", + "native_effects": false, + "attempts": [ + { + "condition": "normal push not complete; remote ref differs", + "outcome": "read-only premature refusal" + }, + { + "condition": "verifier incorrectly required historical edges from completed source tasks", + "outcome": "read-only refusal; no task binding mismatch observed" + } + ], + "original_verifier_sha256": "6c6b77a2e2a45a9c6e0251c7a03ccac798b2fa377b63ae4dc598c1aafa223286", + "actual_owner_rule": "state-hub/api/services/forge_projection.py:_iter_edge_declarations excludes done/cancel task-block edges; C20 parity", + "refinement": "Check every active source internal dependency; retain historical declarations separately and all existing IDs, statuses and source dependencies unchanged." +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/verified-bindings.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/verified-bindings.json new file mode 100644 index 00000000..20f8464b --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/verified-bindings.json @@ -0,0 +1,339 @@ +{ + "status": "verified", + "commit": "c52ca7f405416d437951844c0640b86e677c3523", + "primary": "primary/railiance01", + "task_bindings": 61, + "old_bindings_preserved": 58, + "new_completed_source_deliverables": [ + "NK-WP-0048-T22", + "NK-WP-0048-T23", + "NK-WP-0049-T38" + ], + "rows": [ + { + "workplan": "NK-WP-0048", + "status": "active", + "task_count": 23, + "tasks": [ + { + "record_id": "NK-WP-0048-T09", + "uuid": "0ee12dfc-8260-5038-bd39-cc7fb4113be0", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T02", + "uuid": "19c25d96-a55c-58f0-9168-3fdbc4955fc2", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T15", + "uuid": "1b825705-4848-5edc-832f-b1622cd9bdb7", + "status": "todo" + }, + { + "record_id": "NK-WP-0048-T16", + "uuid": "200bf500-5084-5ae7-be26-3033fe1f296e", + "status": "todo" + }, + { + "record_id": "NK-WP-0048-T04", + "uuid": "2fffe112-7d55-5680-9952-78d74f44f87f", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T05", + "uuid": "3d987d3d-0797-538b-86e4-51185a327ae2", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T10", + "uuid": "4b06ca97-c1e4-5680-bf22-ab75ab1646a4", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T23", + "uuid": "6e7cd483-c7af-53a2-9d0a-3d76b6fb49ee", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T12", + "uuid": "7ce4eee3-cd47-55a9-bfa5-4f1835d4d6fd", + "status": "todo" + }, + { + "record_id": "NK-WP-0048-T20", + "uuid": "863fcbdb-e246-51ba-87ca-a2f44d01d6f8", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T17", + "uuid": "8c3e4baa-a218-5996-af9e-fe1153a46dac", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T08", + "uuid": "8e519082-dc8b-5e46-b660-03d03e55dcf6", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T01", + "uuid": "930ac3e9-20ec-5473-98cd-3fe8fddb730f", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T18", + "uuid": "9c45da71-fb4c-5f20-9065-90f448f37c64", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T21", + "uuid": "afe78e4d-408a-516a-ab92-e212e8a2d11d", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T13", + "uuid": "b264c10b-565c-5d29-b788-03cf5fbd2883", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T07", + "uuid": "c3c9c3ae-4f23-5ba7-9e6f-e63bcf29b9f7", + "status": "wait" + }, + { + "record_id": "NK-WP-0048-T06", + "uuid": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "status": "wait" + }, + { + "record_id": "NK-WP-0048-T03", + "uuid": "e487975b-73b1-516c-971d-da4cbbb93063", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T22", + "uuid": "ea50d93b-0d04-55d2-98c4-9b6c3fe925b1", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T11", + "uuid": "ef2a0119-f59e-5e45-9519-115da9df7b85", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T19", + "uuid": "f50fdcd1-00be-5c3c-be0c-345aa2126032", + "status": "done" + }, + { + "record_id": "NK-WP-0048-T14", + "uuid": "fce95440-a25b-5f27-8ef3-a3d182099113", + "status": "progress" + } + ], + "active_internal_dependencies_verified": 14, + "historical_source_dependency_declarations": 5 + }, + { + "workplan": "NK-WP-0049", + "status": "active", + "task_count": 38, + "tasks": [ + { + "record_id": "NK-WP-0049-T04", + "uuid": "04c4e8be-5bd8-5d5c-99b1-79d8ae758462", + "status": "done" + }, + { + "record_id": "NK-WP-0049-T10", + "uuid": "0519444c-d559-5455-aa27-8c5dc8b832b0", + "status": "done" + }, + { + "record_id": "NK-WP-0049-T18", + "uuid": "141dd773-c1fa-56c1-a852-bbe2372e5125", + "status": "wait" + }, + { + "record_id": "NK-WP-0049-T35", + "uuid": "1bfd1703-589f-5511-bad5-812d860e4a71", + "status": "progress" + }, + { + "record_id": "NK-WP-0049-T25", + "uuid": "1c5ea7a1-edf7-5072-b36b-8be7f827957a", + "status": "done" + }, + { + "record_id": "NK-WP-0049-T15", + "uuid": "1d1eb903-a4b0-5bc4-a421-0b842d7f68ae", + "status": "progress" + }, + { + "record_id": "NK-WP-0049-T23", + "uuid": "1ec537ee-dfee-5576-be36-a81bdba417d1", + "status": "done" + }, + { + "record_id": "NK-WP-0049-T31", + "uuid": "26383841-8076-5c53-bbd1-9db64e32544a", + "status": "done" + }, + { + "record_id": "NK-WP-0049-T07", + "uuid": "2d7302a2-319a-5633-bf58-d51ccd25ebf6", + "status": "done" + }, + { + "record_id": "NK-WP-0049-T29", + "uuid": "2f8c73b0-1cdd-5b22-99b6-017ccde4454b", + "status": "done" + }, + { + "record_id": "NK-WP-0049-T08", + "uuid": "317ca173-c784-5329-9810-5e3d300604b8", + "status": "done" + }, + { + "record_id": "NK-WP-0049-T37", + "uuid": "3403e266-d63b-5ce1-b891-3bfeac93d28c", + "status": "done" + }, + { + "record_id": "NK-WP-0049-T20", + "uuid": "375fa8f9-b8a5-5048-97a7-ec141aa7c45d", + "status": "done" + }, + { + "record_id": "NK-WP-0049-T22", + "uuid": "3ea6bf00-a87f-58ea-bdce-328c13a03a55", + "status": "wait" + }, + { + "record_id": "NK-WP-0049-T24", + "uuid": "474f5a78-a643-59c6-bcf9-fc4a908dfcb0", + "status": "todo" + }, + { + "record_id": "NK-WP-0049-T02", + "uuid": "479d6970-6516-50f5-9436-bb5b56d58aad", + "status": "progress" + }, + { + "record_id": "NK-WP-0049-T28", + "uuid": "4829b091-76d2-5b10-bdfc-032800190c0a", + "status": "done" + }, + { + "record_id": "NK-WP-0049-T09", + "uuid": "4a47eb2a-7e42-5ae7-9df1-f5ede746eca1", + "status": "done" + }, + { + "record_id": "NK-WP-0049-T33", + "uuid": "56c8d469-7a10-5d50-a30e-95cbf3cd4756", + "status": "wait" + }, + { + "record_id": "NK-WP-0049-T13", + "uuid": "602d4921-cfac-5e5b-9993-4fbf67195c7d", + "status": "done" + }, + { + "record_id": "NK-WP-0049-T30", + "uuid": "6e4a43db-9be2-5662-bdbf-1595fce03052", + "status": "done" + }, + { + "record_id": "NK-WP-0049-T19", + "uuid": "6f8af1a7-2a3f-5fa8-8202-83103ebd55b2", + "status": "wait" + }, + { + "record_id": "NK-WP-0049-T38", + "uuid": "76dde6b9-5ee8-50d3-bf15-461d6d5f29b8", + "status": "done" + }, + { + "record_id": "NK-WP-0049-T21", + "uuid": "77aa42be-7a39-5d93-8042-03d78b4094b4", + "status": "wait" + }, + { + "record_id": "NK-WP-0049-T34", + "uuid": "821b3a56-6f36-5812-abc9-5a00e37cb2e7", + "status": "done" + }, + { + "record_id": "NK-WP-0049-T36", + "uuid": "8b72334b-fc27-5707-a189-bad345eaf3bc", + "status": "progress" + }, + { + "record_id": "NK-WP-0049-T26", + "uuid": "94d054fe-e5d8-5ddf-8e48-80714123d184", + "status": "done" + }, + { + "record_id": "NK-WP-0049-T06", + "uuid": "a5f50891-c5b2-513b-8670-e1915ee52015", + "status": "done" + }, + { + "record_id": "NK-WP-0049-T17", + "uuid": "b47f9975-d6d7-5bb8-93ce-886deb1dfa70", + "status": "wait" + }, + { + "record_id": "NK-WP-0049-T16", + "uuid": "b64d4d6a-e851-58d1-9929-f03343147de0", + "status": "done" + }, + { + "record_id": "NK-WP-0049-T32", + "uuid": "cd78dbb7-a8f2-5754-8788-6eb1b7d97741", + "status": "done" + }, + { + "record_id": "NK-WP-0049-T03", + "uuid": "d68cd4d3-1ba3-530e-88f9-26ebb8dd6eac", + "status": "wait" + }, + { + "record_id": "NK-WP-0049-T11", + "uuid": "d69af493-4026-56a8-a526-c267d90dce18", + "status": "done" + }, + { + "record_id": "NK-WP-0049-T01", + "uuid": "d7ca8d5f-c5ff-5cba-bd25-038cb53ffe4e", + "status": "done" + }, + { + "record_id": "NK-WP-0049-T12", + "uuid": "decb415a-8012-521c-9dbe-d73c6ff0bbfb", + "status": "done" + }, + { + "record_id": "NK-WP-0049-T27", + "uuid": "e273e803-bee7-5d90-bc51-ecc08c0c8eff", + "status": "done" + }, + { + "record_id": "NK-WP-0049-T05", + "uuid": "e8e38f42-609e-5c07-a8e6-e73c8eb4ae95", + "status": "done" + }, + { + "record_id": "NK-WP-0049-T14", + "uuid": "eaf0708f-b3b7-5531-8172-95edf30c3a19", + "status": "done" + } + ], + "active_internal_dependencies_verified": 38, + "historical_source_dependency_declarations": 38 + } + ], + "unrelated_index_and_worktree_preserved": true, + "native_target_gates_closed": 0 +} diff --git a/docs/netkingdom-target-implementation.md b/docs/netkingdom-target-implementation.md index d2d6f60e..863565f4 100644 --- a/docs/netkingdom-target-implementation.md +++ b/docs/netkingdom-target-implementation.md @@ -932,3 +932,53 @@ The supervision record retains original revision 1, the approved/executed revisi 2, exact digests and successful refined outcome; it grants no autopilot authority. Source follow-through: State Hub `200cbd0a61a805d0fe29f9d6d1c49a6cf1f1703a` finishes STATE-WP-0095 with all ten tasks done and declared image pins matching the verified deployment; Repo Manager `3bcb1e1cf3e58b263f690534f7f28024d75cdbf6` finishes RMGR-WP-0019 with all six tasks done. Task UUIDs remain unchanged. The existing binding-guard successor coordination case is satisfied; independent native-owner work remains live, and no worker was woken. + +## Native preparation and source-owner checkpoints, 2026-10-17 + +NetKingdom `c52ca7f405416d437951844c0640b86e677c3523` requires exactly one +original client registration before the isolated KeyCape verifier reads further +runtime/private inputs. The guard runs after archive decryption. Four added +refusal cases pass independently; the owner's 39 adapter checks and four affected +fixture-plan checks pass. The earlier stale-source manifest refusal and original +fixture receipts remain intact. No new native execution is inferred. + +Completed source deliverables are recorded as NK-WP-0049-T38 and +NK-WP-0048-T22/T23. All 58 preexisting task blocks retain their UUIDs, statuses +and dependencies; normal source publication and primary readback verify 61 task +bindings. T14 retains native storage/protected-caller/checkpoint/directory-writer +integration. T15 retains authenticated original-attempt recovery. T16 retains +six missing owner descriptors and exact type/admission review. The draft dedicated +package and renderer-valid PostgreSQL consumer are owner-review candidates. + +Secrets Engine `691dc742362eeec45d5bd32d2b468f31a959748e` completes +SECRETS-WP-0015-T03's reviewable original-consumer custody plan. All four task +UUIDs and T04's human-wait dependencies are verified. Its candidate claim +observer has synthetic source proof only: it verifies neither signatures nor +original-token provenance and establishes no secret acquisition, OpenBao login +or downstream reconnect. Original OpenBao recovery and exact native authority +remain separate prerequisites. No consumer fallback was added. + +The GLAS bounded model-run review retains the existing Claude profile and +immutable runtime; missing native approvals, spend acceptance, renewal/catalog +pins and queue/observer bindings prevent execution. The scanner-response review +identifies the content-silent existing handoff and required private-review owner +contract; it installs no exception or response authority. All sixteen native +target gates remain open; APPROVAL-WP-0002 remains unpromoted residual work. + +User-directed source/history lookup locates the recovery guide publication in +NetKingdom `31f483966cdfca4df1d326dee3ec0b6d33ea0e5e`. Its actual receipt records +the guide, standalone tools ZIP and checksum uploaded/read back on 16 October +at 18:01 UTC under StorageShare account Backup, +`railiance-backups/net-kingdom-identity/`. The guide is +`net-kingdom-recovery-57d1940947aa25ff-START-HERE.md`; current local bytes match +the recorded published guide. Current remote/account visibility is unverified. +The retained guide covers identity recovery, excludes whole-host/OpenBao recovery, +and does not establish original TLS certificate/key custody. Later source work +does not imply a newer offline-kit publication. + +Evidence: dated 17 October `native-identity-r1`, `native-registration-r1`, +`native-registration-refinement-r2`, `native-storage-r1`, `native-runtime-r1`, +`scanner-response-r1`, `consumer-outage-r1`, +`consumer-outage-owner-followthrough-r1/verified-bindings.json`, +`native-source-publication-r1/verified-bindings.json`, and +`storage-share-tls-r1/source-history-followthrough-r2.json`. diff --git a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md index 9eb014d3..d34c1970 100644 --- a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md +++ b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md @@ -1121,3 +1121,51 @@ The supervision record retains original revision 1, the approved/executed revisi 2, exact digests and successful refined outcome; it grants no autopilot authority. Source follow-through: State Hub `200cbd0a61a805d0fe29f9d6d1c49a6cf1f1703a` finishes STATE-WP-0095 with all ten tasks done and declared image pins matching the verified deployment; Repo Manager `3bcb1e1cf3e58b263f690534f7f28024d75cdbf6` finishes RMGR-WP-0019 with all six tasks done. Task UUIDs remain unchanged. The existing binding-guard successor coordination case is satisfied; independent native-owner work remains live, and no worker was woken. + +## Source-owner follow-through and native preparation, 2026-10-17 + +NetKingdom `c52ca7f405416d437951844c0640b86e677c3523` publishes the exact-one +original client selector guard, four early-refusal regressions and the scoped +unexecuted fixture-manifest successor. Root independently passes those four +checks; the owner's 39 adapter checks and four affected manifest checks pass. +The prior stale-hash refusal and original frozen native receipts stay retained. +This guard acts after decryption and before further runtime inputs; it supplies +no archive/TLS/consumer/native acceptance. NK49-T38 records this completed source +outcome. NK48-T22/T23 record the distinct registration and storage owner reviews. +All 58 old task blocks are preserved; 61 actual source/remote/primary task +bindings and active internal dependencies are verified after normal publication. +Initial overly broad historical-edge verification refused; the corrected check +uses the actual C20 source rule, preserving the refusal and original verifier. + +Secrets Engine `691dc742362eeec45d5bd32d2b468f31a959748e` publishes its exact +original-consumer custody plan and marks SECRETS-WP-0015-T03 done for source +preparation. Four task UUIDs and T04's human-wait dependencies on T03/NK49-T33 +are verified. The candidate observer remains unwired/unexecuted on real input; +five synthetic checks establish only claim parsing/source/input refusals. +Original TLS/archive/private admission, original OpenBao/custody/MFA recovery, +actual signed-token/resource-server denials and revocation remain native owner +work. Existing protected-backend scopes stay in SECRETS0008/0013. + +The completed owner reviews leave NK48-T14/T15/T16 implementation/native gates +open. The proposed package/SQL candidate, original-context seam and six missing +descriptors do not create native authority. GLAS's bounded real-model proposal +retains its existing Claude profile, spend/metering/native approval requirements +and immutable runtime; it does not migrate this Custodian assignment. The private +scanner-response lane still needs an actual owner contract. APPROVAL-WP-0002 +remains residual and was not promoted. All sixteen target native gates are open. + +User-directed NetKingdom source/history investigation locates the requested +StorageShare recovery guide: publication commit +`31f483966cdfca4df1d326dee3ec0b6d33ea0e5e`, actual readback 16 October 18:01 UTC, +Backup account, `railiance-backups/net-kingdom-identity/`, filename +`net-kingdom-recovery-57d1940947aa25ff-START-HERE.md`, with ZIP/checksum. +The local guide matches that recorded publication. Current remote visibility, +original TLS custody and whole-estate recovery are not established by this +identity-only guide. No share, credential, backup or current remote file changed. + +Evidence: dated 17 October native/source/consumer packets listed in +`docs/netkingdom-target-implementation.md`, especially each owner's verified +bindings and `storage-share-tls-r1/source-history-followthrough-r2.json`. +All current task statuses remain appropriate: T03/T05/T06 progress, T04 todo, +T01/T02 done. No completion percentage or native closure is inferred from the +new completed source-review tasks. This remains the active implementation goal.