Record reviewed browser adapter publication and recovery findings
This commit is contained in:
codex
parent
5a50901d9a
commit
86a5b0dd99
16 changed files with 541 additions and 3 deletions
|
|
@ -0,0 +1,77 @@
|
|||
{
|
||||
"schema": "custodian.netkingdom.registration-source-integration.v1",
|
||||
"source_commit": "0775c2bfa41af236301155bb5a69bbf088bdf823",
|
||||
"publication_record_commit": "0394484b924c82abaaa4b01716d84a0930cc4fdf",
|
||||
"published_origin": "0394484b924c82abaaa4b01716d84a0930cc4fdf",
|
||||
"reviewed_r3_manifest_sha256": "sha256:f62fe2e3a7622899b5c57dd42922c477f063ac8abb97c4d44b9d6ce8ece933a3",
|
||||
"root_review": "coordinator-review-r3.json",
|
||||
"source_integration": true,
|
||||
"normal_syncs": {
|
||||
"normal-sync": {
|
||||
"exit_code": 0,
|
||||
"summary": {
|
||||
"fail": 0,
|
||||
"automation_error": 0,
|
||||
"warn": 35,
|
||||
"info": 5
|
||||
},
|
||||
"result": "warn",
|
||||
"stderr": "WARN: git commit failed for writeback: Generated-only commits rejected: staged\n"
|
||||
},
|
||||
"normal-writeback": {
|
||||
"exit_code": 0,
|
||||
"summary": {
|
||||
"fail": 0,
|
||||
"automation_error": 0,
|
||||
"warn": 28,
|
||||
"info": 5
|
||||
},
|
||||
"result": "warn",
|
||||
"stderr": "WARN: git commit failed for writeback: Generated-only commits rejected: staged\n"
|
||||
},
|
||||
"normal-final": {
|
||||
"exit_code": 0,
|
||||
"summary": {
|
||||
"fail": 0,
|
||||
"automation_error": 0,
|
||||
"warn": 25,
|
||||
"info": 5
|
||||
},
|
||||
"result": "warn",
|
||||
"stderr": "WARN: git commit failed for writeback: Generated-only commits rejected: staged\n"
|
||||
}
|
||||
},
|
||||
"file_task_count": 16,
|
||||
"projected_task_count": 16,
|
||||
"status_counts": {
|
||||
"done": 10,
|
||||
"wait": 2,
|
||||
"todo": 4
|
||||
},
|
||||
"prior_T10_T11_T12_UUIDs_preserved": true,
|
||||
"reviewed_source_hashes_preserved": true,
|
||||
"exact_original_staged_brief_preserved": true,
|
||||
"exact_original_working_brief_preserved": true,
|
||||
"final_source_hashes": {
|
||||
"sso-mfa/k8s/keycape/keycape-registration-adapter.py": "sha256:8a6bd0ea111d67a0df89c7e3cd968e7bf81d29c2f2a70adf08eb747e1d1a5bdc",
|
||||
"sso-mfa/k8s/keycape/test_keycape_registration_adapter.py": "sha256:beabe9fe3d2c43d296fcac475d1d0c97ebb9829debdf68846c7f32b15958641c",
|
||||
"sso-mfa/k8s/keycape/registration-adapter.md": "sha256:5dc28ecc87d029d42a7bd5a02501ee2665b956e1201b8fceddb5854214d26bf8",
|
||||
"workplans/NK-WP-0048-security-case-types.md": "sha256:ae4293e3b90aa6a58bb31c72ff9391be1a57bb877fca2c067d31b9625a79b74e"
|
||||
},
|
||||
"status_after": "MM .custodian-brief.md\n M WORK-RECORDS.md\n?? docs/evidence/2026-10-15-cadence-adoption/hourly-observation-capture/\n?? docs/evidence/2026-10-15-cadence-adoption/hourly-observation-inventory.jsonl\n?? docs/evidence/2026-10-15-cadence-adoption/hourly-observation-monitor.json\n?? intakes/NET-IN-0005-single-use-setup-link-mail-handoff.md\n",
|
||||
"tests": {
|
||||
"passed": 36,
|
||||
"synthetic": true,
|
||||
"producer_pins_overridden": false
|
||||
},
|
||||
"native_acceptance": false,
|
||||
"new_credential_or_live_action": false,
|
||||
"next_tasks": [
|
||||
"NK-WP-0048-T12",
|
||||
"NK-WP-0048-T14",
|
||||
"NK-WP-0048-T15",
|
||||
"NK-WP-0048-T16"
|
||||
],
|
||||
"retained_failed_revision": "rejected-r1/",
|
||||
"progress_id": "500aa2a3-21ca-4bb5-93ab-278f24fcaf32"
|
||||
}
|
||||
|
|
@ -0,0 +1,51 @@
|
|||
{
|
||||
"schema": "custodian.browser-registration-publication-review.v1",
|
||||
"owner_commit": "0775c2bfa41af236301155bb5a69bbf088bdf823",
|
||||
"published_ancestor_of_origin_main": true,
|
||||
"reviewed_manifest_sha256": "sha256:f62fe2e3a7622899b5c57dd42922c477f063ac8abb97c4d44b9d6ce8ece933a3",
|
||||
"files": [
|
||||
{
|
||||
"path": "sso-mfa/k8s/keycape/keycape-registration-adapter.py",
|
||||
"committed_sha256": "sha256:8a6bd0ea111d67a0df89c7e3cd968e7bf81d29c2f2a70adf08eb747e1d1a5bdc",
|
||||
"reviewed_sha256": "sha256:8a6bd0ea111d67a0df89c7e3cd968e7bf81d29c2f2a70adf08eb747e1d1a5bdc",
|
||||
"exact_match": true
|
||||
},
|
||||
{
|
||||
"path": "sso-mfa/k8s/keycape/test_keycape_registration_adapter.py",
|
||||
"committed_sha256": "sha256:beabe9fe3d2c43d296fcac475d1d0c97ebb9829debdf68846c7f32b15958641c",
|
||||
"reviewed_sha256": "sha256:beabe9fe3d2c43d296fcac475d1d0c97ebb9829debdf68846c7f32b15958641c",
|
||||
"exact_match": true
|
||||
},
|
||||
{
|
||||
"path": "sso-mfa/k8s/keycape/registration-adapter.md",
|
||||
"committed_sha256": "sha256:5dc28ecc87d029d42a7bd5a02501ee2665b956e1201b8fceddb5854214d26bf8",
|
||||
"reviewed_sha256": "sha256:5dc28ecc87d029d42a7bd5a02501ee2665b956e1201b8fceddb5854214d26bf8",
|
||||
"exact_match": true
|
||||
},
|
||||
{
|
||||
"path": "workplans/NK-WP-0048-security-case-types.md",
|
||||
"committed_sha256": "sha256:c6ef142267f4232fe99d13edc9c9b02eb78ea89e2f3aff0bddf5436d09440e30",
|
||||
"reviewed_sha256": "sha256:1a3eb6e7bf8753dfe40869284ee78fea2ebce2f0bcab30d47e0903d28fdada2d",
|
||||
"exact_match": false
|
||||
}
|
||||
],
|
||||
"workplan_delta": "T13 integration wording records canonical reviewed source; remaining owner/native tasks stay open.",
|
||||
"source_checks_independently_passed": 36,
|
||||
"native_acceptance": false,
|
||||
"scope": "Exact source publication; no checker artifact, owner callbacks, case identity or native operations admitted.",
|
||||
"owner_record_followup": {
|
||||
"commit": "0394484b924c82abaaa4b01716d84a0930cc4fdf",
|
||||
"published_ancestor_of_origin_main": true,
|
||||
"committed_file": "workplans/NK-WP-0048-security-case-types.md",
|
||||
"committed_sha256": "sha256:ae4293e3b90aa6a58bb31c72ff9391be1a57bb877fca2c067d31b9625a79b74e",
|
||||
"reviewed_delta": "Four normal State Hub task UUIDs and eight lines recording completed source publication/projection and retained generated-only hook refusals. Adapter source unchanged."
|
||||
},
|
||||
"owner_sync_receipt_sha256": "sha256:001b0a2c002bf21a9159b4335a1393ec885c8448ed74e60fab26bd0e0dd70c2a",
|
||||
"all_three_sync_summaries_verified": true,
|
||||
"final_owner_sync_summary": {
|
||||
"fail": 0,
|
||||
"automation_error": 0,
|
||||
"warn": 25,
|
||||
"info": 5
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
{
|
||||
"schema": "custodian.browser-registration-source-review.v1",
|
||||
"revision": "r3",
|
||||
"manifest_sha256": "sha256:f62fe2e3a7622899b5c57dd42922c477f063ac8abb97c4d44b9d6ce8ece933a3",
|
||||
"source_review": "Exact descriptor binds checker executable and helper source; fixed adapter installed before independent kernel admission; creation-only rollback; uncertainty retained; no synthetic producer pin overrides.",
|
||||
"independent_reconstruction_passed": 36,
|
||||
"rejected_r1": "Checker executable digest was outside descriptor binding; corrected in R2/R3 and regression tested.",
|
||||
"canonical_integration": "approved for four exact reviewed source/work-record files, subject to unchanged source preimages and normal publication",
|
||||
"native_acceptance": false,
|
||||
"remaining": "Native checker selection; owner evidence/revocation callbacks; full step set; durable restart reconciliation; native browser acceptance."
|
||||
}
|
||||
|
|
@ -0,0 +1,63 @@
|
|||
{
|
||||
"schema": "netkingdom.registration-adapter-source-candidate.v1",
|
||||
"date": "2026-10-16",
|
||||
"owner": "net-kingdom",
|
||||
"candidate": "/tmp/nk-browser-adapter-next",
|
||||
"owner_revision_at_packaging": "015694ee414c802dc2ef1fa0120dfed610086e69",
|
||||
"owner_status_at_packaging": "MM .custodian-brief.md\n M WORK-RECORDS.md\n M workplans/NK-WP-0048-security-case-types.md\n?? docs/evidence/2026-10-15-cadence-adoption/hourly-observation-capture/\n?? docs/evidence/2026-10-15-cadence-adoption/hourly-observation-inventory.jsonl\n?? docs/evidence/2026-10-15-cadence-adoption/hourly-observation-monitor.json\n?? intakes/NET-IN-0005-single-use-setup-link-mail-handoff.md\n",
|
||||
"owner_diff_digest_at_packaging": "sha256:7ed1cfaf24a0b154180c93c7491ae7274e508d8f2258c6e741bf69f3768d74eb",
|
||||
"warden_revision": "d97652a3bb5fa733b063d71a1b74068efcccf572",
|
||||
"adapter_source": "sha256:284e1d70b56461c6190ea634dea63d1b55890d657df8379f2459dfc882260142",
|
||||
"postimages": {
|
||||
"sso-mfa/k8s/keycape/keycape-registration-adapter.py": "sha256:8a6bd0ea111d67a0df89c7e3cd968e7bf81d29c2f2a70adf08eb747e1d1a5bdc",
|
||||
"sso-mfa/k8s/keycape/test_keycape_registration_adapter.py": "sha256:beabe9fe3d2c43d296fcac475d1d0c97ebb9829debdf68846c7f32b15958641c",
|
||||
"sso-mfa/k8s/keycape/registration-adapter.md": "sha256:5dc28ecc87d029d42a7bd5a02501ee2665b956e1201b8fceddb5854214d26bf8",
|
||||
"workplans/NK-WP-0048-security-case-types.md": "sha256:1a3eb6e7bf8753dfe40869284ee78fea2ebce2f0bcab30d47e0903d28fdada2d"
|
||||
},
|
||||
"helper_dependency_hashes": {
|
||||
"keycape-client.py": "sha256:e31ee2883fad4f93635700608ad98e05984c9e0453515dd7710c897ca856b8c8",
|
||||
"portal-client-rollout.py": "sha256:158e1d36eb881cdd0a2eda91b472adea5e8fde5061e00d26dda368580aeb871f",
|
||||
"openbao-client-config.py": "sha256:1b908b4c36134212d78f9fbe7a2a201eb3ced06d31bb1dcea4a59d80689d84b1",
|
||||
"register-user-engine-portal.py": "sha256:67173edc44f5457e7b6a3e0fb2321b398159cfce5dea8ead01eabf835fb38d76"
|
||||
},
|
||||
"tests": {
|
||||
"new": 16,
|
||||
"existing": 20,
|
||||
"total": 36,
|
||||
"passed": true,
|
||||
"native": false,
|
||||
"producer_pin_override": false,
|
||||
"producer_admission": "normal published Warden d97652a exact source pins"
|
||||
},
|
||||
"canonical_owner_writes": false,
|
||||
"published": false,
|
||||
"review_status": "r1 rejected: unbound checker; r2 checker corrected; r3 removes synthetic pin override, awaiting independent root review",
|
||||
"native_acceptance": false,
|
||||
"revision": "r3",
|
||||
"fixture_checker_digest": "sha256:bb8a8e3d1ff5176c3f7da3144b55fea2effc9e4e29790146e2ae58d7f8363fb0",
|
||||
"descriptor_scope": "synthetic fixture only; no native checker artifact selected or admitted",
|
||||
"fixture_dependencies": {
|
||||
"sso-mfa/k8s/keycape/keycape-client.py": "sha256:e31ee2883fad4f93635700608ad98e05984c9e0453515dd7710c897ca856b8c8",
|
||||
"sso-mfa/k8s/keycape/portal-client-rollout.py": "sha256:158e1d36eb881cdd0a2eda91b472adea5e8fde5061e00d26dda368580aeb871f",
|
||||
"sso-mfa/k8s/keycape/openbao-client-config.py": "sha256:1b908b4c36134212d78f9fbe7a2a201eb3ced06d31bb1dcea4a59d80689d84b1",
|
||||
"sso-mfa/k8s/keycape/register-user-engine-portal.py": "sha256:67173edc44f5457e7b6a3e0fb2321b398159cfce5dea8ead01eabf835fb38d76",
|
||||
"sso-mfa/k8s/keycape/test_keycape_client.py": "sha256:9572044679feaedfe732e15a2b6f8ef6b41a8fe2e4430257f309a3e83e97736c",
|
||||
"sso-mfa/k8s/keycape/vergabe-client-rollout.py": "sha256:8cee6cc5ff3e3e8617304055263d04b393d0e005c34d9af12cb7e8bc685bac1a",
|
||||
"tools/security-case-types/security_case_evidence.py": "sha256:da8efa59c52ad73283397ebe639ae259d0cb9c6348b5cb829135c24230dcdc75",
|
||||
"tools/security-case-types/security_case_validator.py": "sha256:1bcc62e9bc374c711363295549f3cd5bb0b32952671ed4b08fddc7f74742959b",
|
||||
"tools/security-scenario-composer/security_scenario_composer.py": "sha256:9f0cc69930aa8ee2cc3fb92236e6a99728df17b8c0fe36e1250241c38fc01c4f",
|
||||
"tools/playbook-capability-contract/playbook_contract_validator.py": "sha256:2e1e0c809d4bc9d64c2d974cc23fecd1c5636785154c2554edd9191852fd926d",
|
||||
"security-case-types/oidc-browser-relying-party/type.yaml": "sha256:f705c64e4875e9b8e18a912fb51c135e77898926d6a451f5cb74ab3c0cbe4d1c",
|
||||
"security-cases/forgejo-netkingdom-oidc.yaml": "sha256:bcc2c6d5bae0d28242b3cdb71e74d8ca297c2afe04766b55d53597f86893351d"
|
||||
},
|
||||
"preimages": {
|
||||
"workplans/NK-WP-0048-security-case-types.md": "sha256:40e15d545768d41e953904f7a63ef14fa5ab5cb5d78f9f69cec60547cb1f04b2"
|
||||
},
|
||||
"packet_hashes": {
|
||||
"implementation.patch": "sha256:f900f026441dd6fe8f83ceca2bb79212f5643e1f96ded21c190890d1f85dbab0",
|
||||
"proposed-descriptor.json": "sha256:53bc48959ae9fcb7f2927f34558e55275dcdb512efba116f75d54eca36a375c4",
|
||||
"README.md": "sha256:0ec6df7b586f95b7919a2daacde97e7b929dec24a370b55dab0982e3e0b938b8",
|
||||
"verify_candidate.py": "sha256:00c7b20d049c579b393539d343dbcb0f0dd560de16d5a43593888f32c8fc18ac",
|
||||
"tests.txt": "sha256:154850fd30c3fb32a8b54da1eed852c0337fffecc432dae4fe19a4ca4b17f8cd"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,34 @@
|
|||
{
|
||||
"schema": "netkingdom.registration-adapter-source-candidate.v1",
|
||||
"date": "2026-10-16",
|
||||
"owner": "net-kingdom",
|
||||
"candidate": "/tmp/nk-browser-adapter-next",
|
||||
"owner_revision_at_packaging": "015694ee414c802dc2ef1fa0120dfed610086e69",
|
||||
"owner_status_at_packaging": "MM .custodian-brief.md\n M WORK-RECORDS.md\n M workplans/NK-WP-0048-security-case-types.md\n?? docs/evidence/2026-10-15-cadence-adoption/hourly-observation-capture/\n?? docs/evidence/2026-10-15-cadence-adoption/hourly-observation-inventory.jsonl\n?? docs/evidence/2026-10-15-cadence-adoption/hourly-observation-monitor.json\n?? intakes/NET-IN-0005-single-use-setup-link-mail-handoff.md\n",
|
||||
"owner_diff_digest_at_packaging": "sha256:7ed1cfaf24a0b154180c93c7491ae7274e508d8f2258c6e741bf69f3768d74eb",
|
||||
"warden_revision": "d79f06595545f2b66631ffbcee14a382e96bc293",
|
||||
"adapter_source": "sha256:5a920f62400a09a0e597c7895e275dae2876cff6737aae92963eff3ae1fb8cec",
|
||||
"postimages": {
|
||||
"sso-mfa/k8s/keycape/keycape-registration-adapter.py": "sha256:952e0e3e4d9ae27701c2999e1e1220f600a8de5f2a4c600beff88e89e8f9abc3",
|
||||
"sso-mfa/k8s/keycape/test_keycape_registration_adapter.py": "sha256:7cdf5b30d9ced10fbc367b7c30d05052a72fd0d866c97a51f916f6dae484edbe",
|
||||
"sso-mfa/k8s/keycape/registration-adapter.md": "sha256:f906258c19ebefa6450e9c3044a4ab71865b378724a7bff0d0d380f605c77e72"
|
||||
},
|
||||
"helper_dependency_hashes": {
|
||||
"keycape-client.py": "sha256:e31ee2883fad4f93635700608ad98e05984c9e0453515dd7710c897ca856b8c8",
|
||||
"portal-client-rollout.py": "sha256:158e1d36eb881cdd0a2eda91b472adea5e8fde5061e00d26dda368580aeb871f",
|
||||
"openbao-client-config.py": "sha256:1b908b4c36134212d78f9fbe7a2a201eb3ced06d31bb1dcea4a59d80689d84b1",
|
||||
"register-user-engine-portal.py": "sha256:67173edc44f5457e7b6a3e0fb2321b398159cfce5dea8ead01eabf835fb38d76"
|
||||
},
|
||||
"tests": {
|
||||
"new": 15,
|
||||
"existing": 20,
|
||||
"total": 35,
|
||||
"passed": true,
|
||||
"native": false,
|
||||
"producer_pin_override": "explicit synthetic integration fixture only"
|
||||
},
|
||||
"canonical_owner_writes": false,
|
||||
"published": false,
|
||||
"review_status": "awaiting independent root review",
|
||||
"native_acceptance": false
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
R1 rejected by root source review: caller-selected check-config binary digest was checked locally but absent from independently admitted descriptor/source pin. The full registry travels to that binary. R2 binds the exact checker digest in the source-composition pin and refuses replacement under the original descriptor. This is one revised review trial, not another native success.
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
{
|
||||
"schema": "custodian.netkingdom-checkpoint-publication.v1",
|
||||
"commit": "5a50901d9a0e94e4b708a94ca5dfead0ac999e98",
|
||||
"head_equals_origin_at_completion": true,
|
||||
"normal_statehub_sync_exit_code": 0,
|
||||
"source_revision": "5a50901d9a0e94e4b708a94ca5dfead0ac999e98",
|
||||
"source_revision_reason": null,
|
||||
"summary": {
|
||||
"fail": 0,
|
||||
"automation_error": 0,
|
||||
"warn": 7,
|
||||
"info": 4
|
||||
},
|
||||
"fixes_applied": [
|
||||
"bindings: synced 89/89",
|
||||
"C-17 cleared: pushed 1 backlogged commit(s)",
|
||||
"C-22 fixed: task 6aca534c\u2026 description updated",
|
||||
"push: pushed"
|
||||
],
|
||||
"original_staged_brief_and_worktree_restored": true,
|
||||
"scope": "Installed inert Secrets consumer, isolated canonical runtime proof, registry parity/hosted readback, exact owner source commits, current implementation/workplan checkpoint.",
|
||||
"native_gate_completion": false
|
||||
}
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
{
|
||||
"schema": "custodian.identity-restore-source-review.v1",
|
||||
"revision": 2,
|
||||
"reviewed_session_sha256": "sha256:b9602f0af0614c6abdc77e6a9a44ef2e5b40cff3df176e769a8fde536c517cb1",
|
||||
"disposition": "revision_required_before_integration_or_native_fixture",
|
||||
"findings": [
|
||||
{
|
||||
"id": "plaintext-hard-loss-cleanup",
|
||||
"severity": "high",
|
||||
"detail": "Detached cleanup starts after restore and lacks the host tmpfs directory obligation. Hard parent loss before or after restore can retain decrypted archive/files. Establish exact inode/owner-bound cleanup before plaintext creation and preserve uncertain outcomes."
|
||||
},
|
||||
{
|
||||
"id": "consistent-docker-target",
|
||||
"severity": "high",
|
||||
"detail": "Most Docker commands inherit routing while issuer/reaper set the default socket. Bind every creation/readback/verification/cleanup command to one inspected daemon and refuse conflicting ambient routing."
|
||||
},
|
||||
{
|
||||
"id": "issuer-host-resolution",
|
||||
"severity": "verification_required",
|
||||
"detail": "Sharing a network namespace does not itself prove that original hostname resolution reaches loopback in both helper and issuer. Verify actual pinned-image behavior in a scoped fixture."
|
||||
}
|
||||
],
|
||||
"native_operations_performed": false,
|
||||
"canonical_integration_approved": false,
|
||||
"remaining": "Review successor source and execute a scoped synthetic pinned-image fixture before proposing actual owner-held recovery credentials."
|
||||
}
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
{
|
||||
"schema": "custodian.identity-restore-source-review.v1",
|
||||
"revision": 3,
|
||||
"dependency_manifest_sha256": "sha256:e0c10a31aac1ac170be1f13fdb22001b862357403a4b5f309c50fc6f221f56a4",
|
||||
"all_14_dependency_hashes_verified_after_tests": true,
|
||||
"independent_synthetic_tests": {
|
||||
"passed": 52,
|
||||
"failed": 0,
|
||||
"native_docker": false,
|
||||
"credentials": false
|
||||
},
|
||||
"corrected": [
|
||||
"Plaintext cleanup registered before decryption with exact directory identity",
|
||||
"All Docker paths use one exact local endpoint with conflicting routing refused",
|
||||
"Public probe included in retained cleanup obligations"
|
||||
],
|
||||
"remaining_finding": "1800-second reaper may clean resources while the parent can still create/import afterward. Enforce and observe exact parent termination before cleanup; preserve in-flight daemon uncertainty.",
|
||||
"disposition": "revision_required_before_canonical_integration_or_native_fixture",
|
||||
"native_acceptance": false
|
||||
}
|
||||
|
|
@ -69,6 +69,26 @@
|
|||
"C-17 cleared: pushed 1 backlogged commit(s)",
|
||||
"push: pushed"
|
||||
]
|
||||
},
|
||||
"net_final_combined": {
|
||||
"exit": 0,
|
||||
"source_revision": "015694ee414c802dc2ef1fa0120dfed610086e69",
|
||||
"summary": {
|
||||
"fail": 0,
|
||||
"automation_error": 0,
|
||||
"warn": 29,
|
||||
"info": 5
|
||||
},
|
||||
"result": "warn",
|
||||
"fixes_applied": [
|
||||
"bindings: synced 64/64",
|
||||
"C-33 fixed: regenerated WORK-RECORDS.md",
|
||||
"C-11 fixed: task 'NK-WP-0048-T10' \u2192 4b06ca97\u2026",
|
||||
"C-11 fixed: task 'NK-WP-0048-T11' \u2192 ef2a0119\u2026",
|
||||
"C-11 fixed: task 'NK-WP-0048-T12' \u2192 7ce4eee3\u2026",
|
||||
"brief: .custodian-brief.md updated",
|
||||
"push: pushed"
|
||||
]
|
||||
}
|
||||
},
|
||||
"limits": "No production deployment, model spend, credential access or external messages. Root independently refreshed/read hosted federation after normal source publication. This bounded parity/uniqueness repair does not close all TSA-11 requirements or the TSA-12 runtime schedule.",
|
||||
|
|
@ -76,7 +96,8 @@
|
|||
"net-kingdom_brief": "Exact original staged blob/mode and worktree restored after observed post-sync hash/index race checks. Other staging untouched.",
|
||||
"net-kingdom_work_records": "Current file preserved amid concurrent recovery owner sync; original preimage retained in /tmp/netkingdom-discovery-preexisting-state.",
|
||||
"test_generated_outputs": "Six originally clean Reuse graph/catalog/federation outputs restored after checks; no generated test output staged.",
|
||||
"guard_refusal": "Automatic brief-only commit refusals retained without bypass. Generated brief/WORK-RECORDS changes may remain from normal sync."
|
||||
"guard_refusal": "Automatic brief-only commit refusals retained without bypass. Generated brief/WORK-RECORDS changes may remain from normal sync.",
|
||||
"final_combined_net_sync": "Separate fresh brief preimage at /tmp/netkingdom-parity-final-brief; exact staged blob/mode and worktree restored with observed post-sync hash/index race checks; current WORK-RECORDS preserved."
|
||||
},
|
||||
"hosted_readback": {
|
||||
"root_receipt": "coordinator-hosted-refresh.json",
|
||||
|
|
@ -92,5 +113,23 @@
|
|||
"status": "unverified",
|
||||
"public_actions_api_http_status": 404,
|
||||
"receipt": "public-ci-readback.json"
|
||||
}
|
||||
},
|
||||
"final_state": {
|
||||
"reuse-surface": {
|
||||
"head": "01af18964b170eaa87f8560ce9285518e8dc6d7e",
|
||||
"origin_main": "01af18964b170eaa87f8560ce9285518e8dc6d7e",
|
||||
"status": "M .custodian-brief.md\n M WORK-RECORDS.md\n"
|
||||
},
|
||||
"net-kingdom": {
|
||||
"head": "015694ee414c802dc2ef1fa0120dfed610086e69",
|
||||
"origin_main": "015694ee414c802dc2ef1fa0120dfed610086e69",
|
||||
"status": "MM .custodian-brief.md\n M WORK-RECORDS.md\n M workplans/NK-WP-0048-security-case-types.md\n?? docs/evidence/2026-10-15-cadence-adoption/hourly-observation-capture/\n?? docs/evidence/2026-10-15-cadence-adoption/hourly-observation-inventory.jsonl\n?? docs/evidence/2026-10-15-cadence-adoption/hourly-observation-monitor.json\n?? intakes/NET-IN-0005-single-use-setup-link-mail-handoff.md\n"
|
||||
},
|
||||
"railiance-bootstrap": {
|
||||
"head": "8d23103af2d5ff0da4eb5f612ea2bf09d8ff7344",
|
||||
"origin_main": "8d23103af2d5ff0da4eb5f612ea2bf09d8ff7344",
|
||||
"status": "M .custodian-brief.md\n M WORK-RECORDS.md\n"
|
||||
}
|
||||
},
|
||||
"bootstrap_failures": "11 C-03 stale DB workstream references in pre-existing RAIL-BS/RAILIANCE historical workplans; no failure references the new RAIL-BOOT-WP ad hoc record."
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{
|
||||
"schema": "custodian.netkingdom-source-wave.v1",
|
||||
"observed_at": "2026-10-16T19:30:27.788551+00:00",
|
||||
"observed_at": "2026-10-16T19:54:07.932809+00:00",
|
||||
"coordinator": "CUST-WP-0080-T06",
|
||||
"source_slices": [
|
||||
{
|
||||
|
|
@ -445,6 +445,30 @@
|
|||
"published": true,
|
||||
"native_accepted": false,
|
||||
"receipt": "source-wave12-coordinator-review.json"
|
||||
},
|
||||
{
|
||||
"repo": "ops-warden",
|
||||
"slice": "browser-producer-pin-refresh",
|
||||
"commit": "d97652a3bb5fa733b063d71a1b74068efcccf572",
|
||||
"published": true,
|
||||
"native_accepted": false,
|
||||
"receipt": "warden-browser-pin-refresh/validation.json"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"slice": "descriptor-bound-client-registration-adapter",
|
||||
"commit": "0775c2bfa41af236301155bb5a69bbf088bdf823",
|
||||
"published": true,
|
||||
"native_accepted": false,
|
||||
"receipt": "browser-adapter-next/coordinator-publication-review.json"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"slice": "registration-adapter-publication-record",
|
||||
"commit": "0394484b924c82abaaa4b01716d84a0930cc4fdf",
|
||||
"published": true,
|
||||
"native_accepted": false,
|
||||
"receipt": "browser-adapter-next/coordinator-publication-review.json"
|
||||
}
|
||||
],
|
||||
"integrity_note": "Canonical owner commits are the durable source. Raw patches and temporary reconstructions are workspace-local review artifacts; their hashes retain revision identity. No runtime admission follows from these commits.",
|
||||
|
|
|
|||
|
|
@ -0,0 +1,37 @@
|
|||
# Browser producer pin refresh — 2026-10-16
|
||||
|
||||
WARDEN-WP-0044-T03 source review, scoped to NetKingdom commit
|
||||
`015694ee414c802dc2ef1fa0120dfed610086e69`, against Warden `d79f065`.
|
||||
|
||||
Reviewed the exact committed schema, validator, evidence changes and the 21
|
||||
producer contract tests. The optional bounded `execution_descriptors` map now
|
||||
requires lowercase exact SHA-256 byte pins keyed to declared steps. The direct
|
||||
evidence API refuses malformed maps. Absent and incomplete maps retain plan-only
|
||||
behavior; the repair supplies no descriptor, adapter or execution authority.
|
||||
This is compatible with Warden's independently authenticated admission gates.
|
||||
|
||||
Refresh only the validator and evidence module pins. Composer/capability module
|
||||
hashes and both reviewed parameter-definition hashes remain exact and unchanged.
|
||||
All four copied module bytes match the named NetKingdom commit and canonical
|
||||
checkout. No fallback, wildcard or allowed-drift path is added.
|
||||
|
||||
Before the refresh, explicit canonical producer integration failed both positive
|
||||
version tests (1.1/1.2), with 20 refusals passing. After refresh, 87 producer,
|
||||
Executor and reducer checks pass, including 14 new malformed descriptor cases
|
||||
and existing missing/changed-source checks across all four pinned modules.
|
||||
The 21 producer descriptor-contract checks and focused Ruff checks also pass.
|
||||
Use `WARDEN_TEST_NETKINGDOM_ROOT=/home/worsch/net-kingdom` explicitly: the
|
||||
isolated checkout's default sibling can resolve another checkout.
|
||||
|
||||
Emergent knowledge 0.2.6 digest
|
||||
`8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02`
|
||||
was withheld due to source drift; start/local-work cards and actual source were
|
||||
reviewed directly. It conveys no authority.
|
||||
|
||||
No new browser or identity-restore adapter was admitted or attested. No credential
|
||||
or privileged execution occurred. Native structural receipts, authenticated owner
|
||||
provenance, descriptor assent, attended sessions, ordered verification and the
|
||||
first native case run remain open. T03 stays progress; T04 stays wait.
|
||||
|
||||
Exact pin hashes, tests and publication identity are retained under the Custodian
|
||||
`docs/changes/netkingdom-target-2026-10-16/warden-browser-pin-refresh/` directory.
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
{
|
||||
"observed_at": "2026-10-16T19:36:51.849303+00:00",
|
||||
"warden_commit": "d97652a3bb5fa733b063d71a1b74068efcccf572",
|
||||
"producer_commit": "015694ee414c802dc2ef1fa0120dfed610086e69",
|
||||
"exact_committed_hashes_verified": true,
|
||||
"actual_producer_source_pins_verified": true,
|
||||
"independent_command": "PYTHONDONTWRITEBYTECODE=1 .venv/bin/python -m pytest -q -p no:cacheprovider tests/test_case_inputs.py tests/test_case_run.py tests/test_case_receipt_state.py",
|
||||
"independent_passed": 87,
|
||||
"no_pin_overrides": true,
|
||||
"native_acceptance": false
|
||||
}
|
||||
|
|
@ -0,0 +1,64 @@
|
|||
{
|
||||
"schema": "warden.browser-source-review.v1",
|
||||
"netkingdom_commit": "015694ee414c802dc2ef1fa0120dfed610086e69",
|
||||
"warden_base": "d79f06595545f2b66631ffbcee14a382e96bc293",
|
||||
"source_pins": {
|
||||
"tools/security-case-types/security_case_evidence.py": "da8efa59c52ad73283397ebe639ae259d0cb9c6348b5cb829135c24230dcdc75",
|
||||
"tools/security-case-types/security_case_validator.py": "1bcc62e9bc374c711363295549f3cd5bb0b32952671ed4b08fddc7f74742959b",
|
||||
"tools/security-scenario-composer/security_scenario_composer.py": "9f0cc69930aa8ee2cc3fb92236e6a99728df17b8c0fe36e1250241c38fc01c4f",
|
||||
"tools/playbook-capability-contract/playbook_contract_validator.py": "2e1e0c809d4bc9d64c2d974cc23fecd1c5636785154c2554edd9191852fd926d"
|
||||
},
|
||||
"exact_worktree_and_commit_bytes_verified": true,
|
||||
"parameter_pins_changed": false,
|
||||
"before": {
|
||||
"failed": 2,
|
||||
"passed": 20
|
||||
},
|
||||
"after": {
|
||||
"focused_suite_passed": 87,
|
||||
"new_malformed_descriptor_checks": 14,
|
||||
"producer_contract_checks_passed": 21,
|
||||
"ruff": "passed"
|
||||
},
|
||||
"producer_root": "/home/worsch/net-kingdom",
|
||||
"native_acceptance": false,
|
||||
"adapter_attestation": false,
|
||||
"knowledge": {
|
||||
"version": "0.2.6",
|
||||
"digest": "8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02",
|
||||
"status": "withheld; directly reviewed source cards and exact producer changes"
|
||||
},
|
||||
"warden_commit": "d97652a3bb5fa733b063d71a1b74068efcccf572",
|
||||
"canonical_focused_suite_passed": 87,
|
||||
"implementation_patch_sha256": "a769ce765ad99328a61747a74353d11d7373817addb34a7fbf9384326eebbd00",
|
||||
"committed_file_hashes": {
|
||||
"src/warden/case_inputs.py": "1334b0cd9897e763cfea2d306e997c659f3f284ecc3f9612140c2104835da7c7",
|
||||
"tests/test_case_inputs.py": "ce87e4b4e1cf07d8b86a1bed310cb55f28a4f30c4cda45d37c01d8538ce5da27",
|
||||
"docs/reviews/2026-10-16-browser-producer-pin-refresh.md": "0279fc83885e94ead2048afa1564b8c46d879365402807df357281abcdcc7631",
|
||||
"workplans/WARDEN-WP-0044-security-case-follow-through.md": "1df57687200f6a60a2a6f26a4066ce1e93ae663fc4e43db3884d04dc1d6e874e"
|
||||
},
|
||||
"preserved_preexisting_changes": [
|
||||
"M .custodian-brief.md",
|
||||
" M WORK-RECORDS.md"
|
||||
],
|
||||
"publication": {
|
||||
"remote_main": "d97652a3bb5fa733b063d71a1b74068efcccf572",
|
||||
"staged_scanner": "clean; four blobs",
|
||||
"receive_scanner": "clean; twelve objects / one ref",
|
||||
"preexisting_staging_preserved": [
|
||||
".custodian-brief.md"
|
||||
],
|
||||
"preexisting_unstaged_preserved": [
|
||||
"WORK-RECORDS.md"
|
||||
]
|
||||
},
|
||||
"statehub_fix_consistency": {
|
||||
"exit_code": 0,
|
||||
"result": "PASS with warnings",
|
||||
"automation_error": 0,
|
||||
"assessment_fail": 0,
|
||||
"warnings": 8,
|
||||
"bindings_synced": "51/51",
|
||||
"unrelated_finished_task_missing_id": "skipped by CLI"
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue