diff --git a/docs/changes/netkingdom-target-2026-10-16/browser-adapter-next/canonical-integration.json b/docs/changes/netkingdom-target-2026-10-16/browser-adapter-next/canonical-integration.json new file mode 100644 index 00000000..a513b1f8 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/browser-adapter-next/canonical-integration.json @@ -0,0 +1,77 @@ +{ + "schema": "custodian.netkingdom.registration-source-integration.v1", + "source_commit": "0775c2bfa41af236301155bb5a69bbf088bdf823", + "publication_record_commit": "0394484b924c82abaaa4b01716d84a0930cc4fdf", + "published_origin": "0394484b924c82abaaa4b01716d84a0930cc4fdf", + "reviewed_r3_manifest_sha256": "sha256:f62fe2e3a7622899b5c57dd42922c477f063ac8abb97c4d44b9d6ce8ece933a3", + "root_review": "coordinator-review-r3.json", + "source_integration": true, + "normal_syncs": { + "normal-sync": { + "exit_code": 0, + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 35, + "info": 5 + }, + "result": "warn", + "stderr": "WARN: git commit failed for writeback: Generated-only commits rejected: staged\n" + }, + "normal-writeback": { + "exit_code": 0, + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 28, + "info": 5 + }, + "result": "warn", + "stderr": "WARN: git commit failed for writeback: Generated-only commits rejected: staged\n" + }, + "normal-final": { + "exit_code": 0, + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 25, + "info": 5 + }, + "result": "warn", + "stderr": "WARN: git commit failed for writeback: Generated-only commits rejected: staged\n" + } + }, + "file_task_count": 16, + "projected_task_count": 16, + "status_counts": { + "done": 10, + "wait": 2, + "todo": 4 + }, + "prior_T10_T11_T12_UUIDs_preserved": true, + "reviewed_source_hashes_preserved": true, + "exact_original_staged_brief_preserved": true, + "exact_original_working_brief_preserved": true, + "final_source_hashes": { + "sso-mfa/k8s/keycape/keycape-registration-adapter.py": "sha256:8a6bd0ea111d67a0df89c7e3cd968e7bf81d29c2f2a70adf08eb747e1d1a5bdc", + "sso-mfa/k8s/keycape/test_keycape_registration_adapter.py": "sha256:beabe9fe3d2c43d296fcac475d1d0c97ebb9829debdf68846c7f32b15958641c", + "sso-mfa/k8s/keycape/registration-adapter.md": "sha256:5dc28ecc87d029d42a7bd5a02501ee2665b956e1201b8fceddb5854214d26bf8", + "workplans/NK-WP-0048-security-case-types.md": "sha256:ae4293e3b90aa6a58bb31c72ff9391be1a57bb877fca2c067d31b9625a79b74e" + }, + "status_after": "MM .custodian-brief.md\n M WORK-RECORDS.md\n?? docs/evidence/2026-10-15-cadence-adoption/hourly-observation-capture/\n?? docs/evidence/2026-10-15-cadence-adoption/hourly-observation-inventory.jsonl\n?? docs/evidence/2026-10-15-cadence-adoption/hourly-observation-monitor.json\n?? intakes/NET-IN-0005-single-use-setup-link-mail-handoff.md\n", + "tests": { + "passed": 36, + "synthetic": true, + "producer_pins_overridden": false + }, + "native_acceptance": false, + "new_credential_or_live_action": false, + "next_tasks": [ + "NK-WP-0048-T12", + "NK-WP-0048-T14", + "NK-WP-0048-T15", + "NK-WP-0048-T16" + ], + "retained_failed_revision": "rejected-r1/", + "progress_id": "500aa2a3-21ca-4bb5-93ab-278f24fcaf32" +} diff --git a/docs/changes/netkingdom-target-2026-10-16/browser-adapter-next/coordinator-publication-review.json b/docs/changes/netkingdom-target-2026-10-16/browser-adapter-next/coordinator-publication-review.json new file mode 100644 index 00000000..57610bb5 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/browser-adapter-next/coordinator-publication-review.json @@ -0,0 +1,51 @@ +{ + "schema": "custodian.browser-registration-publication-review.v1", + "owner_commit": "0775c2bfa41af236301155bb5a69bbf088bdf823", + "published_ancestor_of_origin_main": true, + "reviewed_manifest_sha256": "sha256:f62fe2e3a7622899b5c57dd42922c477f063ac8abb97c4d44b9d6ce8ece933a3", + "files": [ + { + "path": "sso-mfa/k8s/keycape/keycape-registration-adapter.py", + "committed_sha256": "sha256:8a6bd0ea111d67a0df89c7e3cd968e7bf81d29c2f2a70adf08eb747e1d1a5bdc", + "reviewed_sha256": "sha256:8a6bd0ea111d67a0df89c7e3cd968e7bf81d29c2f2a70adf08eb747e1d1a5bdc", + "exact_match": true + }, + { + "path": "sso-mfa/k8s/keycape/test_keycape_registration_adapter.py", + "committed_sha256": "sha256:beabe9fe3d2c43d296fcac475d1d0c97ebb9829debdf68846c7f32b15958641c", + "reviewed_sha256": "sha256:beabe9fe3d2c43d296fcac475d1d0c97ebb9829debdf68846c7f32b15958641c", + "exact_match": true + }, + { + "path": "sso-mfa/k8s/keycape/registration-adapter.md", + "committed_sha256": "sha256:5dc28ecc87d029d42a7bd5a02501ee2665b956e1201b8fceddb5854214d26bf8", + "reviewed_sha256": "sha256:5dc28ecc87d029d42a7bd5a02501ee2665b956e1201b8fceddb5854214d26bf8", + "exact_match": true + }, + { + "path": "workplans/NK-WP-0048-security-case-types.md", + "committed_sha256": "sha256:c6ef142267f4232fe99d13edc9c9b02eb78ea89e2f3aff0bddf5436d09440e30", + "reviewed_sha256": "sha256:1a3eb6e7bf8753dfe40869284ee78fea2ebce2f0bcab30d47e0903d28fdada2d", + "exact_match": false + } + ], + "workplan_delta": "T13 integration wording records canonical reviewed source; remaining owner/native tasks stay open.", + "source_checks_independently_passed": 36, + "native_acceptance": false, + "scope": "Exact source publication; no checker artifact, owner callbacks, case identity or native operations admitted.", + "owner_record_followup": { + "commit": "0394484b924c82abaaa4b01716d84a0930cc4fdf", + "published_ancestor_of_origin_main": true, + "committed_file": "workplans/NK-WP-0048-security-case-types.md", + "committed_sha256": "sha256:ae4293e3b90aa6a58bb31c72ff9391be1a57bb877fca2c067d31b9625a79b74e", + "reviewed_delta": "Four normal State Hub task UUIDs and eight lines recording completed source publication/projection and retained generated-only hook refusals. Adapter source unchanged." + }, + "owner_sync_receipt_sha256": "sha256:001b0a2c002bf21a9159b4335a1393ec885c8448ed74e60fab26bd0e0dd70c2a", + "all_three_sync_summaries_verified": true, + "final_owner_sync_summary": { + "fail": 0, + "automation_error": 0, + "warn": 25, + "info": 5 + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/browser-adapter-next/coordinator-review-r3.json b/docs/changes/netkingdom-target-2026-10-16/browser-adapter-next/coordinator-review-r3.json new file mode 100644 index 00000000..2b78e645 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/browser-adapter-next/coordinator-review-r3.json @@ -0,0 +1,11 @@ +{ + "schema": "custodian.browser-registration-source-review.v1", + "revision": "r3", + "manifest_sha256": "sha256:f62fe2e3a7622899b5c57dd42922c477f063ac8abb97c4d44b9d6ce8ece933a3", + "source_review": "Exact descriptor binds checker executable and helper source; fixed adapter installed before independent kernel admission; creation-only rollback; uncertainty retained; no synthetic producer pin overrides.", + "independent_reconstruction_passed": 36, + "rejected_r1": "Checker executable digest was outside descriptor binding; corrected in R2/R3 and regression tested.", + "canonical_integration": "approved for four exact reviewed source/work-record files, subject to unchanged source preimages and normal publication", + "native_acceptance": false, + "remaining": "Native checker selection; owner evidence/revocation callbacks; full step set; durable restart reconciliation; native browser acceptance." +} diff --git a/docs/changes/netkingdom-target-2026-10-16/browser-adapter-next/manifest.json b/docs/changes/netkingdom-target-2026-10-16/browser-adapter-next/manifest.json new file mode 100644 index 00000000..4fa8706c --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/browser-adapter-next/manifest.json @@ -0,0 +1,63 @@ +{ + "schema": "netkingdom.registration-adapter-source-candidate.v1", + "date": "2026-10-16", + "owner": "net-kingdom", + "candidate": "/tmp/nk-browser-adapter-next", + "owner_revision_at_packaging": "015694ee414c802dc2ef1fa0120dfed610086e69", + "owner_status_at_packaging": "MM .custodian-brief.md\n M WORK-RECORDS.md\n M workplans/NK-WP-0048-security-case-types.md\n?? docs/evidence/2026-10-15-cadence-adoption/hourly-observation-capture/\n?? docs/evidence/2026-10-15-cadence-adoption/hourly-observation-inventory.jsonl\n?? docs/evidence/2026-10-15-cadence-adoption/hourly-observation-monitor.json\n?? intakes/NET-IN-0005-single-use-setup-link-mail-handoff.md\n", + "owner_diff_digest_at_packaging": "sha256:7ed1cfaf24a0b154180c93c7491ae7274e508d8f2258c6e741bf69f3768d74eb", + "warden_revision": "d97652a3bb5fa733b063d71a1b74068efcccf572", + "adapter_source": "sha256:284e1d70b56461c6190ea634dea63d1b55890d657df8379f2459dfc882260142", + "postimages": { + "sso-mfa/k8s/keycape/keycape-registration-adapter.py": "sha256:8a6bd0ea111d67a0df89c7e3cd968e7bf81d29c2f2a70adf08eb747e1d1a5bdc", + "sso-mfa/k8s/keycape/test_keycape_registration_adapter.py": "sha256:beabe9fe3d2c43d296fcac475d1d0c97ebb9829debdf68846c7f32b15958641c", + "sso-mfa/k8s/keycape/registration-adapter.md": "sha256:5dc28ecc87d029d42a7bd5a02501ee2665b956e1201b8fceddb5854214d26bf8", + "workplans/NK-WP-0048-security-case-types.md": "sha256:1a3eb6e7bf8753dfe40869284ee78fea2ebce2f0bcab30d47e0903d28fdada2d" + }, + "helper_dependency_hashes": { + "keycape-client.py": "sha256:e31ee2883fad4f93635700608ad98e05984c9e0453515dd7710c897ca856b8c8", + "portal-client-rollout.py": "sha256:158e1d36eb881cdd0a2eda91b472adea5e8fde5061e00d26dda368580aeb871f", + "openbao-client-config.py": "sha256:1b908b4c36134212d78f9fbe7a2a201eb3ced06d31bb1dcea4a59d80689d84b1", + "register-user-engine-portal.py": "sha256:67173edc44f5457e7b6a3e0fb2321b398159cfce5dea8ead01eabf835fb38d76" + }, + "tests": { + "new": 16, + "existing": 20, + "total": 36, + "passed": true, + "native": false, + "producer_pin_override": false, + "producer_admission": "normal published Warden d97652a exact source pins" + }, + "canonical_owner_writes": false, + "published": false, + "review_status": "r1 rejected: unbound checker; r2 checker corrected; r3 removes synthetic pin override, awaiting independent root review", + "native_acceptance": false, + "revision": "r3", + "fixture_checker_digest": "sha256:bb8a8e3d1ff5176c3f7da3144b55fea2effc9e4e29790146e2ae58d7f8363fb0", + "descriptor_scope": "synthetic fixture only; no native checker artifact selected or admitted", + "fixture_dependencies": { + "sso-mfa/k8s/keycape/keycape-client.py": "sha256:e31ee2883fad4f93635700608ad98e05984c9e0453515dd7710c897ca856b8c8", + "sso-mfa/k8s/keycape/portal-client-rollout.py": "sha256:158e1d36eb881cdd0a2eda91b472adea5e8fde5061e00d26dda368580aeb871f", + "sso-mfa/k8s/keycape/openbao-client-config.py": "sha256:1b908b4c36134212d78f9fbe7a2a201eb3ced06d31bb1dcea4a59d80689d84b1", + "sso-mfa/k8s/keycape/register-user-engine-portal.py": "sha256:67173edc44f5457e7b6a3e0fb2321b398159cfce5dea8ead01eabf835fb38d76", + "sso-mfa/k8s/keycape/test_keycape_client.py": "sha256:9572044679feaedfe732e15a2b6f8ef6b41a8fe2e4430257f309a3e83e97736c", + "sso-mfa/k8s/keycape/vergabe-client-rollout.py": "sha256:8cee6cc5ff3e3e8617304055263d04b393d0e005c34d9af12cb7e8bc685bac1a", + "tools/security-case-types/security_case_evidence.py": "sha256:da8efa59c52ad73283397ebe639ae259d0cb9c6348b5cb829135c24230dcdc75", + "tools/security-case-types/security_case_validator.py": "sha256:1bcc62e9bc374c711363295549f3cd5bb0b32952671ed4b08fddc7f74742959b", + "tools/security-scenario-composer/security_scenario_composer.py": "sha256:9f0cc69930aa8ee2cc3fb92236e6a99728df17b8c0fe36e1250241c38fc01c4f", + "tools/playbook-capability-contract/playbook_contract_validator.py": "sha256:2e1e0c809d4bc9d64c2d974cc23fecd1c5636785154c2554edd9191852fd926d", + "security-case-types/oidc-browser-relying-party/type.yaml": "sha256:f705c64e4875e9b8e18a912fb51c135e77898926d6a451f5cb74ab3c0cbe4d1c", + "security-cases/forgejo-netkingdom-oidc.yaml": "sha256:bcc2c6d5bae0d28242b3cdb71e74d8ca297c2afe04766b55d53597f86893351d" + }, + "preimages": { + "workplans/NK-WP-0048-security-case-types.md": "sha256:40e15d545768d41e953904f7a63ef14fa5ab5cb5d78f9f69cec60547cb1f04b2" + }, + "packet_hashes": { + "implementation.patch": "sha256:f900f026441dd6fe8f83ceca2bb79212f5643e1f96ded21c190890d1f85dbab0", + "proposed-descriptor.json": "sha256:53bc48959ae9fcb7f2927f34558e55275dcdb512efba116f75d54eca36a375c4", + "README.md": "sha256:0ec6df7b586f95b7919a2daacde97e7b929dec24a370b55dab0982e3e0b938b8", + "verify_candidate.py": "sha256:00c7b20d049c579b393539d343dbcb0f0dd560de16d5a43593888f32c8fc18ac", + "tests.txt": "sha256:154850fd30c3fb32a8b54da1eed852c0337fffecc432dae4fe19a4ca4b17f8cd" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/browser-adapter-next/rejected-r1/manifest.json b/docs/changes/netkingdom-target-2026-10-16/browser-adapter-next/rejected-r1/manifest.json new file mode 100644 index 00000000..10e1c9ad --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/browser-adapter-next/rejected-r1/manifest.json @@ -0,0 +1,34 @@ +{ + "schema": "netkingdom.registration-adapter-source-candidate.v1", + "date": "2026-10-16", + "owner": "net-kingdom", + "candidate": "/tmp/nk-browser-adapter-next", + "owner_revision_at_packaging": "015694ee414c802dc2ef1fa0120dfed610086e69", + "owner_status_at_packaging": "MM .custodian-brief.md\n M WORK-RECORDS.md\n M workplans/NK-WP-0048-security-case-types.md\n?? docs/evidence/2026-10-15-cadence-adoption/hourly-observation-capture/\n?? docs/evidence/2026-10-15-cadence-adoption/hourly-observation-inventory.jsonl\n?? docs/evidence/2026-10-15-cadence-adoption/hourly-observation-monitor.json\n?? intakes/NET-IN-0005-single-use-setup-link-mail-handoff.md\n", + "owner_diff_digest_at_packaging": "sha256:7ed1cfaf24a0b154180c93c7491ae7274e508d8f2258c6e741bf69f3768d74eb", + "warden_revision": "d79f06595545f2b66631ffbcee14a382e96bc293", + "adapter_source": "sha256:5a920f62400a09a0e597c7895e275dae2876cff6737aae92963eff3ae1fb8cec", + "postimages": { + "sso-mfa/k8s/keycape/keycape-registration-adapter.py": "sha256:952e0e3e4d9ae27701c2999e1e1220f600a8de5f2a4c600beff88e89e8f9abc3", + "sso-mfa/k8s/keycape/test_keycape_registration_adapter.py": "sha256:7cdf5b30d9ced10fbc367b7c30d05052a72fd0d866c97a51f916f6dae484edbe", + "sso-mfa/k8s/keycape/registration-adapter.md": "sha256:f906258c19ebefa6450e9c3044a4ab71865b378724a7bff0d0d380f605c77e72" + }, + "helper_dependency_hashes": { + "keycape-client.py": "sha256:e31ee2883fad4f93635700608ad98e05984c9e0453515dd7710c897ca856b8c8", + "portal-client-rollout.py": "sha256:158e1d36eb881cdd0a2eda91b472adea5e8fde5061e00d26dda368580aeb871f", + "openbao-client-config.py": "sha256:1b908b4c36134212d78f9fbe7a2a201eb3ced06d31bb1dcea4a59d80689d84b1", + "register-user-engine-portal.py": "sha256:67173edc44f5457e7b6a3e0fb2321b398159cfce5dea8ead01eabf835fb38d76" + }, + "tests": { + "new": 15, + "existing": 20, + "total": 35, + "passed": true, + "native": false, + "producer_pin_override": "explicit synthetic integration fixture only" + }, + "canonical_owner_writes": false, + "published": false, + "review_status": "awaiting independent root review", + "native_acceptance": false +} diff --git a/docs/changes/netkingdom-target-2026-10-16/browser-adapter-next/rejected-r1/review-finding.md b/docs/changes/netkingdom-target-2026-10-16/browser-adapter-next/rejected-r1/review-finding.md new file mode 100644 index 00000000..419f0082 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/browser-adapter-next/rejected-r1/review-finding.md @@ -0,0 +1 @@ +R1 rejected by root source review: caller-selected check-config binary digest was checked locally but absent from independently admitted descriptor/source pin. The full registry travels to that binary. R2 binds the exact checker digest in the source-composition pin and refuses replacement under the original descriptor. This is one revised review trial, not another native success. diff --git a/docs/changes/netkingdom-target-2026-10-16/checkpoint-publication-r2.json b/docs/changes/netkingdom-target-2026-10-16/checkpoint-publication-r2.json new file mode 100644 index 00000000..a2df11b7 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/checkpoint-publication-r2.json @@ -0,0 +1,23 @@ +{ + "schema": "custodian.netkingdom-checkpoint-publication.v1", + "commit": "5a50901d9a0e94e4b708a94ca5dfead0ac999e98", + "head_equals_origin_at_completion": true, + "normal_statehub_sync_exit_code": 0, + "source_revision": "5a50901d9a0e94e4b708a94ca5dfead0ac999e98", + "source_revision_reason": null, + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 7, + "info": 4 + }, + "fixes_applied": [ + "bindings: synced 89/89", + "C-17 cleared: pushed 1 backlogged commit(s)", + "C-22 fixed: task 6aca534c\u2026 description updated", + "push: pushed" + ], + "original_staged_brief_and_worktree_restored": true, + "scope": "Installed inert Secrets consumer, isolated canonical runtime proof, registry parity/hosted readback, exact owner source commits, current implementation/workplan checkpoint.", + "native_gate_completion": false +} diff --git a/docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/coordinator-review-r2.json b/docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/coordinator-review-r2.json new file mode 100644 index 00000000..acf999df --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/coordinator-review-r2.json @@ -0,0 +1,26 @@ +{ + "schema": "custodian.identity-restore-source-review.v1", + "revision": 2, + "reviewed_session_sha256": "sha256:b9602f0af0614c6abdc77e6a9a44ef2e5b40cff3df176e769a8fde536c517cb1", + "disposition": "revision_required_before_integration_or_native_fixture", + "findings": [ + { + "id": "plaintext-hard-loss-cleanup", + "severity": "high", + "detail": "Detached cleanup starts after restore and lacks the host tmpfs directory obligation. Hard parent loss before or after restore can retain decrypted archive/files. Establish exact inode/owner-bound cleanup before plaintext creation and preserve uncertain outcomes." + }, + { + "id": "consistent-docker-target", + "severity": "high", + "detail": "Most Docker commands inherit routing while issuer/reaper set the default socket. Bind every creation/readback/verification/cleanup command to one inspected daemon and refuse conflicting ambient routing." + }, + { + "id": "issuer-host-resolution", + "severity": "verification_required", + "detail": "Sharing a network namespace does not itself prove that original hostname resolution reaches loopback in both helper and issuer. Verify actual pinned-image behavior in a scoped fixture." + } + ], + "native_operations_performed": false, + "canonical_integration_approved": false, + "remaining": "Review successor source and execute a scoped synthetic pinned-image fixture before proposing actual owner-held recovery credentials." +} diff --git a/docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/coordinator-review-r3.json b/docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/coordinator-review-r3.json new file mode 100644 index 00000000..d6b136b1 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/coordinator-review-r3.json @@ -0,0 +1,20 @@ +{ + "schema": "custodian.identity-restore-source-review.v1", + "revision": 3, + "dependency_manifest_sha256": "sha256:e0c10a31aac1ac170be1f13fdb22001b862357403a4b5f309c50fc6f221f56a4", + "all_14_dependency_hashes_verified_after_tests": true, + "independent_synthetic_tests": { + "passed": 52, + "failed": 0, + "native_docker": false, + "credentials": false + }, + "corrected": [ + "Plaintext cleanup registered before decryption with exact directory identity", + "All Docker paths use one exact local endpoint with conflicting routing refused", + "Public probe included in retained cleanup obligations" + ], + "remaining_finding": "1800-second reaper may clean resources while the parent can still create/import afterward. Enforce and observe exact parent termination before cleanup; preserve in-flight daemon uncertainty.", + "disposition": "revision_required_before_canonical_integration_or_native_fixture", + "native_acceptance": false +} diff --git a/docs/changes/netkingdom-target-2026-10-16/improvement-loop-next/integration-r2.json b/docs/changes/netkingdom-target-2026-10-16/improvement-loop-next/integration-r2.json index 3743bee6..eee20c5a 100644 --- a/docs/changes/netkingdom-target-2026-10-16/improvement-loop-next/integration-r2.json +++ b/docs/changes/netkingdom-target-2026-10-16/improvement-loop-next/integration-r2.json @@ -69,6 +69,26 @@ "C-17 cleared: pushed 1 backlogged commit(s)", "push: pushed" ] + }, + "net_final_combined": { + "exit": 0, + "source_revision": "015694ee414c802dc2ef1fa0120dfed610086e69", + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 29, + "info": 5 + }, + "result": "warn", + "fixes_applied": [ + "bindings: synced 64/64", + "C-33 fixed: regenerated WORK-RECORDS.md", + "C-11 fixed: task 'NK-WP-0048-T10' \u2192 4b06ca97\u2026", + "C-11 fixed: task 'NK-WP-0048-T11' \u2192 ef2a0119\u2026", + "C-11 fixed: task 'NK-WP-0048-T12' \u2192 7ce4eee3\u2026", + "brief: .custodian-brief.md updated", + "push: pushed" + ] } }, "limits": "No production deployment, model spend, credential access or external messages. Root independently refreshed/read hosted federation after normal source publication. This bounded parity/uniqueness repair does not close all TSA-11 requirements or the TSA-12 runtime schedule.", @@ -76,7 +96,8 @@ "net-kingdom_brief": "Exact original staged blob/mode and worktree restored after observed post-sync hash/index race checks. Other staging untouched.", "net-kingdom_work_records": "Current file preserved amid concurrent recovery owner sync; original preimage retained in /tmp/netkingdom-discovery-preexisting-state.", "test_generated_outputs": "Six originally clean Reuse graph/catalog/federation outputs restored after checks; no generated test output staged.", - "guard_refusal": "Automatic brief-only commit refusals retained without bypass. Generated brief/WORK-RECORDS changes may remain from normal sync." + "guard_refusal": "Automatic brief-only commit refusals retained without bypass. Generated brief/WORK-RECORDS changes may remain from normal sync.", + "final_combined_net_sync": "Separate fresh brief preimage at /tmp/netkingdom-parity-final-brief; exact staged blob/mode and worktree restored with observed post-sync hash/index race checks; current WORK-RECORDS preserved." }, "hosted_readback": { "root_receipt": "coordinator-hosted-refresh.json", @@ -92,5 +113,23 @@ "status": "unverified", "public_actions_api_http_status": 404, "receipt": "public-ci-readback.json" - } + }, + "final_state": { + "reuse-surface": { + "head": "01af18964b170eaa87f8560ce9285518e8dc6d7e", + "origin_main": "01af18964b170eaa87f8560ce9285518e8dc6d7e", + "status": "M .custodian-brief.md\n M WORK-RECORDS.md\n" + }, + "net-kingdom": { + "head": "015694ee414c802dc2ef1fa0120dfed610086e69", + "origin_main": "015694ee414c802dc2ef1fa0120dfed610086e69", + "status": "MM .custodian-brief.md\n M WORK-RECORDS.md\n M workplans/NK-WP-0048-security-case-types.md\n?? docs/evidence/2026-10-15-cadence-adoption/hourly-observation-capture/\n?? docs/evidence/2026-10-15-cadence-adoption/hourly-observation-inventory.jsonl\n?? docs/evidence/2026-10-15-cadence-adoption/hourly-observation-monitor.json\n?? intakes/NET-IN-0005-single-use-setup-link-mail-handoff.md\n" + }, + "railiance-bootstrap": { + "head": "8d23103af2d5ff0da4eb5f612ea2bf09d8ff7344", + "origin_main": "8d23103af2d5ff0da4eb5f612ea2bf09d8ff7344", + "status": "M .custodian-brief.md\n M WORK-RECORDS.md\n" + } + }, + "bootstrap_failures": "11 C-03 stale DB workstream references in pre-existing RAIL-BS/RAILIANCE historical workplans; no failure references the new RAIL-BOOT-WP ad hoc record." } diff --git a/docs/changes/netkingdom-target-2026-10-16/source-wave-status.json b/docs/changes/netkingdom-target-2026-10-16/source-wave-status.json index 30ca17ad..babf9ee3 100644 --- a/docs/changes/netkingdom-target-2026-10-16/source-wave-status.json +++ b/docs/changes/netkingdom-target-2026-10-16/source-wave-status.json @@ -1,6 +1,6 @@ { "schema": "custodian.netkingdom-source-wave.v1", - "observed_at": "2026-10-16T19:30:27.788551+00:00", + "observed_at": "2026-10-16T19:54:07.932809+00:00", "coordinator": "CUST-WP-0080-T06", "source_slices": [ { @@ -445,6 +445,30 @@ "published": true, "native_accepted": false, "receipt": "source-wave12-coordinator-review.json" + }, + { + "repo": "ops-warden", + "slice": "browser-producer-pin-refresh", + "commit": "d97652a3bb5fa733b063d71a1b74068efcccf572", + "published": true, + "native_accepted": false, + "receipt": "warden-browser-pin-refresh/validation.json" + }, + { + "repo": "net-kingdom", + "slice": "descriptor-bound-client-registration-adapter", + "commit": "0775c2bfa41af236301155bb5a69bbf088bdf823", + "published": true, + "native_accepted": false, + "receipt": "browser-adapter-next/coordinator-publication-review.json" + }, + { + "repo": "net-kingdom", + "slice": "registration-adapter-publication-record", + "commit": "0394484b924c82abaaa4b01716d84a0930cc4fdf", + "published": true, + "native_accepted": false, + "receipt": "browser-adapter-next/coordinator-publication-review.json" } ], "integrity_note": "Canonical owner commits are the durable source. Raw patches and temporary reconstructions are workspace-local review artifacts; their hashes retain revision identity. No runtime admission follows from these commits.", diff --git a/docs/changes/netkingdom-target-2026-10-16/warden-browser-pin-refresh/README.md b/docs/changes/netkingdom-target-2026-10-16/warden-browser-pin-refresh/README.md new file mode 100644 index 00000000..be35190d --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/warden-browser-pin-refresh/README.md @@ -0,0 +1,37 @@ +# Browser producer pin refresh — 2026-10-16 + +WARDEN-WP-0044-T03 source review, scoped to NetKingdom commit +`015694ee414c802dc2ef1fa0120dfed610086e69`, against Warden `d79f065`. + +Reviewed the exact committed schema, validator, evidence changes and the 21 +producer contract tests. The optional bounded `execution_descriptors` map now +requires lowercase exact SHA-256 byte pins keyed to declared steps. The direct +evidence API refuses malformed maps. Absent and incomplete maps retain plan-only +behavior; the repair supplies no descriptor, adapter or execution authority. +This is compatible with Warden's independently authenticated admission gates. + +Refresh only the validator and evidence module pins. Composer/capability module +hashes and both reviewed parameter-definition hashes remain exact and unchanged. +All four copied module bytes match the named NetKingdom commit and canonical +checkout. No fallback, wildcard or allowed-drift path is added. + +Before the refresh, explicit canonical producer integration failed both positive +version tests (1.1/1.2), with 20 refusals passing. After refresh, 87 producer, +Executor and reducer checks pass, including 14 new malformed descriptor cases +and existing missing/changed-source checks across all four pinned modules. +The 21 producer descriptor-contract checks and focused Ruff checks also pass. +Use `WARDEN_TEST_NETKINGDOM_ROOT=/home/worsch/net-kingdom` explicitly: the +isolated checkout's default sibling can resolve another checkout. + +Emergent knowledge 0.2.6 digest +`8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02` +was withheld due to source drift; start/local-work cards and actual source were +reviewed directly. It conveys no authority. + +No new browser or identity-restore adapter was admitted or attested. No credential +or privileged execution occurred. Native structural receipts, authenticated owner +provenance, descriptor assent, attended sessions, ordered verification and the +first native case run remain open. T03 stays progress; T04 stays wait. + +Exact pin hashes, tests and publication identity are retained under the Custodian +`docs/changes/netkingdom-target-2026-10-16/warden-browser-pin-refresh/` directory. diff --git a/docs/changes/netkingdom-target-2026-10-16/warden-browser-pin-refresh/coordinator-review.json b/docs/changes/netkingdom-target-2026-10-16/warden-browser-pin-refresh/coordinator-review.json new file mode 100644 index 00000000..e722c59a --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/warden-browser-pin-refresh/coordinator-review.json @@ -0,0 +1,11 @@ +{ + "observed_at": "2026-10-16T19:36:51.849303+00:00", + "warden_commit": "d97652a3bb5fa733b063d71a1b74068efcccf572", + "producer_commit": "015694ee414c802dc2ef1fa0120dfed610086e69", + "exact_committed_hashes_verified": true, + "actual_producer_source_pins_verified": true, + "independent_command": "PYTHONDONTWRITEBYTECODE=1 .venv/bin/python -m pytest -q -p no:cacheprovider tests/test_case_inputs.py tests/test_case_run.py tests/test_case_receipt_state.py", + "independent_passed": 87, + "no_pin_overrides": true, + "native_acceptance": false +} diff --git a/docs/changes/netkingdom-target-2026-10-16/warden-browser-pin-refresh/validation.json b/docs/changes/netkingdom-target-2026-10-16/warden-browser-pin-refresh/validation.json new file mode 100644 index 00000000..6a0a8e9f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/warden-browser-pin-refresh/validation.json @@ -0,0 +1,64 @@ +{ + "schema": "warden.browser-source-review.v1", + "netkingdom_commit": "015694ee414c802dc2ef1fa0120dfed610086e69", + "warden_base": "d79f06595545f2b66631ffbcee14a382e96bc293", + "source_pins": { + "tools/security-case-types/security_case_evidence.py": "da8efa59c52ad73283397ebe639ae259d0cb9c6348b5cb829135c24230dcdc75", + "tools/security-case-types/security_case_validator.py": "1bcc62e9bc374c711363295549f3cd5bb0b32952671ed4b08fddc7f74742959b", + "tools/security-scenario-composer/security_scenario_composer.py": "9f0cc69930aa8ee2cc3fb92236e6a99728df17b8c0fe36e1250241c38fc01c4f", + "tools/playbook-capability-contract/playbook_contract_validator.py": "2e1e0c809d4bc9d64c2d974cc23fecd1c5636785154c2554edd9191852fd926d" + }, + "exact_worktree_and_commit_bytes_verified": true, + "parameter_pins_changed": false, + "before": { + "failed": 2, + "passed": 20 + }, + "after": { + "focused_suite_passed": 87, + "new_malformed_descriptor_checks": 14, + "producer_contract_checks_passed": 21, + "ruff": "passed" + }, + "producer_root": "/home/worsch/net-kingdom", + "native_acceptance": false, + "adapter_attestation": false, + "knowledge": { + "version": "0.2.6", + "digest": "8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02", + "status": "withheld; directly reviewed source cards and exact producer changes" + }, + "warden_commit": "d97652a3bb5fa733b063d71a1b74068efcccf572", + "canonical_focused_suite_passed": 87, + "implementation_patch_sha256": "a769ce765ad99328a61747a74353d11d7373817addb34a7fbf9384326eebbd00", + "committed_file_hashes": { + "src/warden/case_inputs.py": "1334b0cd9897e763cfea2d306e997c659f3f284ecc3f9612140c2104835da7c7", + "tests/test_case_inputs.py": "ce87e4b4e1cf07d8b86a1bed310cb55f28a4f30c4cda45d37c01d8538ce5da27", + "docs/reviews/2026-10-16-browser-producer-pin-refresh.md": "0279fc83885e94ead2048afa1564b8c46d879365402807df357281abcdcc7631", + "workplans/WARDEN-WP-0044-security-case-follow-through.md": "1df57687200f6a60a2a6f26a4066ce1e93ae663fc4e43db3884d04dc1d6e874e" + }, + "preserved_preexisting_changes": [ + "M .custodian-brief.md", + " M WORK-RECORDS.md" + ], + "publication": { + "remote_main": "d97652a3bb5fa733b063d71a1b74068efcccf572", + "staged_scanner": "clean; four blobs", + "receive_scanner": "clean; twelve objects / one ref", + "preexisting_staging_preserved": [ + ".custodian-brief.md" + ], + "preexisting_unstaged_preserved": [ + "WORK-RECORDS.md" + ] + }, + "statehub_fix_consistency": { + "exit_code": 0, + "result": "PASS with warnings", + "automation_error": 0, + "assessment_fail": 0, + "warnings": 8, + "bindings_synced": "51/51", + "unrelated_finished_task_missing_id": "skipped by CLI" + } +} diff --git a/docs/netkingdom-target-implementation.md b/docs/netkingdom-target-implementation.md index 5b0d97a6..3f997881 100644 --- a/docs/netkingdom-target-implementation.md +++ b/docs/netkingdom-target-implementation.md @@ -398,6 +398,41 @@ zero errors/warnings. The [hosted readback](changes/netkingdom-target-2026-10-16 establishes current discovery parity; it does not prove package-family closure, an operating schedule, consumer reliability or runtime acceptance. +Warden `d97652a3` independently reviews and adopts the exact NetKingdom producer +validator/evidence hashes from `015694ee`. The prior pins correctly refused the +changed modules; the source update preserves that drift refusal and adds malformed +descriptor integration cases. The coordinator passed all 87 actual producer, +Executor and reducer checks with the canonical pins and no overrides. The +[verification](changes/netkingdom-target-2026-10-16/warden-browser-pin-refresh/coordinator-review.json) +establishes producer compatibility, not admission of the proposed registration +adapter or native browser execution. + +NetKingdom `0775c2bf` publishes the reviewed registration adapter around the +existing client-registration helper. Its execution descriptor binds the exact +checker executable and helper sources before kernel admission. Rollback requires +authenticated creation in the same process and unchanged object identity/version; +pre-existing registrations, lost readback and interrupted recovery confer no +rollback authority. The coordinator independently passed 36 checks and verified +that all three published source files match the reviewed candidate. The +[publication review](changes/netkingdom-target-2026-10-16/browser-adapter-next/coordinator-publication-review.json) +retains the rejected first revision's missing checker binding. Actual checker +selection, owner evidence/revocation callbacks, group provenance, durable restart +reconciliation and native browser acceptance remain tracked in NK-WP-0048. +Owner `0394484` records publication and normal task UUID writeback. All 16 tasks +are projected; normal synchronization retains zero failures/automation errors, +25 final warnings and the generated-only brief commit refusals. + +The isolated KeyCape restore adapter remains under source review. Its wrapper +reuses the existing archive/custody pipeline and original native verifier, with +private state in verified temporary memory mounts. Review has required correction +of optimized-away checks, signer ambiguity and launch/environment binding. The +third revision binds one daemon and registers plaintext cleanup before decryption; +the coordinator passed 52 checks and verified all 14 dependency hashes. A remaining +race requires stopping the exact parent execution before timed cleanup can begin. +Synthetic tests do not establish pinned-image runtime +compatibility, actual credential recovery or downstream consumer continuity; +NK-WP-0049-T18 and the identity recovery target remain open. + ## Dependency and residual handling The current implementation demand selects necessary target dependencies for diff --git a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md index f78c4499..b35a8cb4 100644 --- a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md +++ b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md @@ -802,3 +802,25 @@ continuity remain open. Exact owner commits and receipt scope are recorded in Separate GPT-6.1-Sol medium owner agents are implementing the missing browser registration and isolated KeyCape recovery adapters in temporary candidates; neither candidate is admitted for native execution. + +2026-10-16 checkpoint publication: `cf59a5f` and `5a50901` published the reviewed +native preflight, independent owner plans, inert installation, combined-runtime +proof and follow-up owner/discovery evidence. Both normal reconciliations synced +89/89 bindings with zero failures/automation errors; seven background warnings +and four informational findings remain. Original staged brief bytes/index and +unrelated work were preserved. The initial public-hash scanner refusal was +resolved by typed hash metadata without changing values or bypassing scanning. +Warden `d97652a3` subsequently refreshed its reviewed producer pins; coordinator +verification passed 87 actual integration/refusal checks without pin overrides. +The registration adapter independently passed 36 source checks after binding the +checker executable into its descriptor, and was published at `0775c2bf` with exact +source-file equality independently verified. Normal owner synchronization +reconciled all 16 task records, with four assigned UUIDs and publication evidence +retained in owner `0394484`. All three normal passes returned zero failures and +automation errors; generated-only hook refusals and 25 final warnings remain. +No native checker/callback/identity was admitted. +Recovery adapter revision three independently passed 52 synthetic checks, with +all 14 dependency hashes verified. Exact daemon routing and early plaintext +cleanup registration are corrected; the remaining cleanup-versus-parent-lifetime +race requires a successor before canonical integration or native proof. +All sixteen target gates remain open.