coulomb/the-custodian
5
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

Complete NetKingdom review and verify all 70 hosted capabilities
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Reject generated-only commits / generated-commit-guard (push) Successful in 7s
Details

Browse source
This commit is contained in:
codex 2026-10-15 05:35:29 +02:00
parent 0e7bcd128b
commit 924a2d155e
30 changed files with 5100 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

124
.kaizen/agents/custodian-codex/supervision.json
View file

@ -707,6 +707,130 @@
"executed_digest_sha256": "9bd1e9f98a99298c810a47e9dffa0316fe235eff53bcd6cfa0dd6391e094f853",
"verified_at": "2026-10-13T16:46:23.659255+00:00",
"execution_note": "Process exited 0. Generation 4 Ready, exact prior image bytes retained, local Docker ping succeeds, other-pod ping refuses, actual listener is IPv4 loopback only. Zero queued/running jobs before and after. Revision 1 was preparation only; unscored standing grant, no promotion credit."
},
{
"proposal_id": "CUST81-REUSE-PUBLIC-REGISTRATION-R1",
"disposition": "unscored",
"outcome": "succeeded",
"proposal_ref": "docs/assessments/netkingdom-2026-10-14/hub-public-registration-proposal-r1.json",
"original_revision": 1,
"original_digest_sha256": "84811121ae8d00970927b97bd6125b6a91989cce46dbe6b75a24592e15c16ca1",
"original_digest": "84811121ae8d00970927b97bd6125b6a91989cce46dbe6b75a24592e15c16ca1",
"target": "https://reuse.coulomb.social/v1/repos; 31 public-only repository registrations",
"expected_result": "All 31 reviewed public repository registrations match the approved plan and the public capabilities become discoverable from fresh hosted federation readback.",
"verification_ref": "docs/assessments/netkingdom-2026-10-14/hub-public-registration-proposal-r1.json; docs/assessments/netkingdom-2026-10-14/hub-public-resume-receipts.jsonl; fresh hosted federation GET",
"rollback": "For only rows created by this attempt, PATCH enabled=false, then verify each row and confirm its capabilities disappear from a fresh federation. Reconcile any ambiguous POST before changing it; never delete or disable pre-existing matching registrations.",
"cost_estimate_eur": 0,
"risk_estimate": "High-risk credential route uses the 15-minute dedicated role on exact KV data and metadata paths. The helper requests only REUSE_SURFACE_TOKEN and does not expose or persist its value; because the policy is path-level, another field at that secret path may also be readable by the principal. 31 bounded metadata writes are individually receipted; conflicts halt the batch. Hub-write effects are reversible by disabling only rows attributable to this attempt. No private source, visibility change, deployment or resource commitment.",
"refinement_or_rescue": true,
"promotion_evidence": false,
"executed_revision": 1,
"execution_ref": "docs/assessments/netkingdom-2026-10-14/hub-public-resume-receipts.jsonl",
"verified_outcome": "31 public registrations applied and read back; all 63 public reviewed IDs appear exactly once after refresh. Scoped OpenBao session revoked. Seven private sources remain outside this proposal.",
"authorization_ref": "Founder active user objective: perform the NetKingdom security architecture review and establish all capabilities with reuse-surface; exact proposal R1 is limited to its 31 public repositories and excludes all seven private repositories.",
"reason": "Existing broad user authorization covers establishment; no exact-revision supervisor disposition was recorded. Earlier accepted_unchanged scoring inferred approval from the task objective and is corrected here; no promotion credit is claimed.",
"transport_ref": "docs/assessments/netkingdom-2026-10-14/attended_public_registration.py",
"transport_sha256": "be838f5da85d9aec4afed779d295548c739d6d1da670e13808bd804476663785",
"transport_note": "Fresh Windows Firefox private profile; scoped OpenBao token in memory only. Enforce recorded member entity, exact policies and max30m TTL before invoking unchanged Warden/helper. Revoke in finally; retain Warden audit and sanitized attempt receipt.",
"authentication_attempts": [
{
"at": "2026-10-14T22:13:41.969079+00:00",
"attempt_id": "8c160098-587b-426c-9f9f-33f57de30c92",
"finished_at": "2026-10-14T22:15:54.561630+00:00",
"login": false,
"login_error": "Error authenticating: timed out waiting for response from provider",
"proposal_id": "CUST81-REUSE-PUBLIC-REGISTRATION-R1",
"revision": 1,
"revoked": null,
"warden_exit": null,
"warden_state": "/tmp/custodian-warden-state-0x5_fd96"
},
{
"at": "2026-10-14T22:18:17.520607+00:00",
"attempt_id": "23c02e30-1a4c-4bc1-a3dc-45c9bf7ce962",
"entity_id": "c204099b-cb94-363f-e207-5ff4d4aa6e94",
"finished_at": "2026-10-14T22:19:26.523659+00:00",
"login": true,
"proposal_id": "CUST81-REUSE-PUBLIC-REGISTRATION-R1",
"revision": 1,
"revoked": true,
"warden_exit": 0,
"warden_state": "/tmp/custodian-warden-state-bpn99gi5"
}
],
"executed_digest_sha256": "84811121ae8d00970927b97bd6125b6a91989cce46dbe6b75a24592e15c16ca1",
"executed_digest": "84811121ae8d00970927b97bd6125b6a91989cce46dbe6b75a24592e15c16ca1",
"final_verification_ref": "docs/assessments/netkingdom-2026-10-14/hosted-public-registration-verification.json",
"verified_at": "2026-10-14T22:19:51.870244+00:00",
"refinement_note": "Freshened stale ops-mason publication proof and added a fresh-profile in-memory authentication transport. First login timed out during Firefox update; user-requested retry succeeded. Preserve both authentication attempts; no unchanged-success scoring."
}
],
"trials": [
{
"proposal_id": "CUST81-PRIVATE-READER-EXECUTION-R1",
"proposal_ref": "docs/assessments/netkingdom-2026-10-14/private-reader-execution-proposal-r1.json",
"original_revision": 1,
"original_digest_sha256": "704a9c932202fc14456652ea4dfdb3acb8b1db0ab3bbf5fff50e92b2c517c380",
"original_digest": "704a9c932202fc14456652ea4dfdb3acb8b1db0ab3bbf5fff50e92b2c517c380",
"disposition": "accepted_unchanged",
"outcome": "succeeded",
"trial_scope": "CUST-WP-0081 supervised exact private-reader rollout/provisioning/registration proposal; no scope grant inferred",
"target": "railiance01 reuse/reuse-surface; exact seven Forgejo private repositories; OpenBao exact newreader data path; hosted sevenregistrations",
"expected_result": "Verified hardened rollout before readeravailability, native14consentedfileproofs, hosted all70reviewedcapabilities exactlyonce",
"verification_ref": "docs/assessments/netkingdom-2026-10-14/private-reader-execution-proposal-r1.json verification/ordered_execution/prepared_artifacts",
"rollback_ref": "docs/assessments/netkingdom-2026-10-14/private-reader-execution-proposal-r1.json rollback/conditional_receipt_authority",
"cost_estimate_eur": null,
"incremental_infrastructure_cost_eur": 0,
"risk_estimate_eur": null,
"risk_estimate": "Qualitative supervised interruption/recovery and dedicated static seven-repository code-read exposure; exact guards, backup and recovery specified in packet; unpriced credible loss, no autopilot grant.",
"supervisor": "Bernd Worsch",
"approval_ref": "9833715e-a22a-45c0-ab6c-881f0f4f1a0e",
"approved_revision": 1,
"approved_digest": "704a9c932202fc14456652ea4dfdb3acb8b1db0ab3bbf5fff50e92b2c517c380",
"executed_revision": 1,
"executed_digest": "704a9c932202fc14456652ea4dfdb3acb8b1db0ab3bbf5fff50e92b2c517c380",
"refinement_or_rescue": true,
"verified_outcome": "All70reviewedcapabilities freshlyhosted exactlyonce/correctsource/no warnings; actual14privatefiles hashverified,7POST201/fullSQLreadback, admin/writerrevocationconfirmed. Executedapprovedrevision2 withcorrection/retries; not an unchanged execution success.",
"promotion_evidence": false,
"submitted_at": "2026-10-15T00:04:50.637439+00:00",
"approval_record_ref": "docs/assessments/netkingdom-2026-10-14/private-reader-execution-approval-r1.json",
"approved_at": "2026-10-15T00:07:05.087085+00:00",
"execution_preflight_refinement": "Freshrootdiff initiallyuseddefaultnamespace; stoppedbeforelivechange. Owneroriginaldryrun/diff correctlytargetedreuse. Correctedrootexplicitnamespace andrecordedproof; approvedliveeffect unchanged.",
"execution_ref": "docs/assessments/netkingdom-2026-10-14/phase-a-authorized-execution-r1.jsonl",
"partial_verified_outcome": "Hardenedrollout,custody,revocation,maintenance,readerESOdelivery,actualnative14fetch verified. Originalattendedwriter failed beforelogin dueconfirmedCLIflagorder; noregistrations. Correctedrevision2 pending exactsupervisorapproval.",
"partial_verification_ref": "docs/assessments/netkingdom-2026-10-14/phase-a-runtime-verification-r1.json",
"source_declaration_ref": "docs/assessments/netkingdom-2026-10-14/owner-assembly/active-phase-a-source-declaration-r1.json",
"attended_login_failure_ref": "docs/assessments/netkingdom-2026-10-14/attended-custody-login-failure-r1.json",
"dependency_repair_review_ref": "docs/assessments/netkingdom-2026-10-14/warden-dependency-repair-requester-review-r1.json",
"latest_attended_login_failure_ref": "docs/assessments/netkingdom-2026-10-14/attended-custody-login-failure-r2.json",
"custody_verification_refs": [
"docs/assessments/netkingdom-2026-10-14/cust81-policy-custody-r1.jsonl",
"docs/assessments/netkingdom-2026-10-14/cust81-forge-reader-r1.jsonl",
"docs/assessments/netkingdom-2026-10-14/warden-attended-custody-terminal-r1.json"
],
"revisions": [
{
"revision": 2,
"digest": "c8fa74ad6648af1c884a4c607e100097f917761af5d3a6e0c5e8ce9a53b809dc",
"proposal_ref": "docs/assessments/netkingdom-2026-10-14/private-reader-execution-proposal-r2.json",
"disposition": "accepted_unchanged",
"reason": "Actual writertransport refused beforebrowser: trailing-no-store treatedas malformedauthdata; one-lineordercorrection prepared",
"executed": true,
"approval_ref": "9f496e68-655e-4e08-aa57-c822cf731124",
"approved_digest": "c8fa74ad6648af1c884a4c607e100097f917761af5d3a6e0c5e8ce9a53b809dc",
"approved_at": "2026-10-15T03:23:56.611534+00:00",
"executed_digest": "c8fa74ad6648af1c884a4c607e100097f917761af5d3a6e0c5e8ce9a53b809dc",
"execution_started_at": "2026-10-15T03:24:57.316551+00:00",
"outcome": "verified_success_after_claim_and_OTP_retries"
}
],
"latest_writer_failure_ref": "docs/assessments/netkingdom-2026-10-14/private-writer-cli-order-failure-r1.json",
"latest_approved_revision": 2,
"latest_approval_ref": "9f496e68-655e-4e08-aa57-c822cf731124",
"latest_executed_revision": 2,
"latest_executed_digest": "c8fa74ad6648af1c884a4c607e100097f917761af5d3a6e0c5e8ce9a53b809dc",
"final_verification_ref": "docs/assessments/netkingdom-2026-10-14/hosted-private-registration-verification-r1.json",
"completed_at": "2026-10-15T03:33:16.165793+00:00"
}
]
}

8
docs/assessments/netkingdom-2026-10-14/attended-private-registration-receipts.jsonl Normal file
View file

@ -0,0 +1,8 @@
{"approval_sha256": "b607d704bf6e17714055bde44a942a9c9d7b17352ac5e1aba4a6a2d8102b9541", "at": "2026-10-15T03:17:51.755206+00:00", "attempt_id": "4b8c8ddc-3f05-49d5-96e6-b452fe3aebf9", "login": false, "outcome": "started", "proposal_id": "CUST81-PRIVATE-REGISTRATION-EXECUTION-R1", "revision": 1, "revoked": null, "warden_exit": null}
{"approval_sha256": "b607d704bf6e17714055bde44a942a9c9d7b17352ac5e1aba4a6a2d8102b9541", "at": "2026-10-15T03:17:51.755206+00:00", "attempt_id": "4b8c8ddc-3f05-49d5-96e6-b452fe3aebf9", "finished_at": "2026-10-15T03:17:51.903846+00:00", "login": false, "outcome": "login_refused", "proposal_id": "CUST81-PRIVATE-REGISTRATION-EXECUTION-R1", "revision": 1, "revoked": null, "warden_exit": null}
{"approval_sha256": "a07350935310b534f89d911e3fd14b9864f78317f46c7e78a996381cc3e48061", "at": "2026-10-15T03:24:45.125279+00:00", "attempt_id": "c6d3a395-9657-4392-a36c-98f3e93ede55", "login": false, "outcome": "started", "proposal_id": "CUST81-PRIVATE-REGISTRATION-EXECUTION-R1", "revision": 1, "revoked": null, "warden_exit": null}
{"approval_sha256": "a07350935310b534f89d911e3fd14b9864f78317f46c7e78a996381cc3e48061", "at": "2026-10-15T03:24:45.125279+00:00", "attempt_id": "c6d3a395-9657-4392-a36c-98f3e93ede55", "finished_at": "2026-10-15T03:25:23.186328+00:00", "login": false, "outcome": "login_refused", "proposal_id": "CUST81-PRIVATE-REGISTRATION-EXECUTION-R1", "revision": 1, "revoked": null, "warden_exit": null}
{"approval_sha256": "58127db91a9707ba1539f36fae79edaa7bd60ee6d8e54b4abd963e050bcaddfc", "at": "2026-10-15T03:27:39.392907+00:00", "attempt_id": "163dc2a3-54b1-40c7-ba00-d484398c7349", "login": false, "outcome": "started", "proposal_id": "CUST81-PRIVATE-REGISTRATION-EXECUTION-R1", "revision": 1, "revoked": null, "warden_exit": null}
{"approval_sha256": "58127db91a9707ba1539f36fae79edaa7bd60ee6d8e54b4abd963e050bcaddfc", "at": "2026-10-15T03:27:39.392907+00:00", "attempt_id": "163dc2a3-54b1-40c7-ba00-d484398c7349", "finished_at": "2026-10-15T03:29:51.314455+00:00", "login": false, "outcome": "login_refused", "proposal_id": "CUST81-PRIVATE-REGISTRATION-EXECUTION-R1", "revision": 1, "revoked": null, "warden_exit": null}
{"approval_sha256": "5d557a2706d477be7f4cd9f185e958d08c50dbd1e1c97489b46120c7de4ddf39", "at": "2026-10-15T03:30:37.461728+00:00", "attempt_id": "8f23bb90-aef9-405d-81b6-bf550400dd93", "login": false, "outcome": "started", "proposal_id": "CUST81-PRIVATE-REGISTRATION-EXECUTION-R1", "revision": 1, "revoked": null, "warden_exit": null}
{"approval_sha256": "5d557a2706d477be7f4cd9f185e958d08c50dbd1e1c97489b46120c7de4ddf39", "at": "2026-10-15T03:30:37.461728+00:00", "attempt_id": "8f23bb90-aef9-405d-81b6-bf550400dd93", "entity_id": "c204099b-cb94-363f-e207-5ff4d4aa6e94", "finished_at": "2026-10-15T03:31:24.886122+00:00", "login": true, "outcome": "writer_returned", "proposal_id": "CUST81-PRIVATE-REGISTRATION-EXECUTION-R1", "revision": 1, "revoked": true, "warden_exit": 0}

245
docs/assessments/netkingdom-2026-10-14/attended_private_registration.py Normal file
View file

@ -0,0 +1,245 @@
"""Attend the dedicated writer role, register seven approved sources, self-revoke.
No token persistence, raw child/error output, admin authority or browser reuse.
Preapproval and fresh actual-runtime proofs must pass before any login attempt.
"""
from pathlib import Path
import argparse
import hashlib
import importlib.util
import json
import os
import stat
import subprocess
import sys
import tempfile
import threading
import uuid
from datetime import datetime, timezone
import yaml
OUT = Path(__file__).resolve().parent
ROLE = 'reuse-surface-hub-writer-workload-kv-read'
POLICY = 'workload-kv-read-reuse-surface-runtime'
ENTITY = 'c204099b-cb94-363f-e207-5ff4d4aa6e94'
HASHES = {
'register_private_hub_r1.py': 'de431eb2942d469eaad0e7e167ebfb98a717c6fa2a92b7cd987333d764792113',
'hub-private-registration-plan-r1.json': 'ec0964addcc95a2f0509d70bb58c10006a3d00e1d2479d8678d3b7c6a15602b7',
}
MASON = Path('/home/worsch/ops-mason/src/ops_mason/attended_login.py')
MASON_SHA = '43f80ce86dbc32fcdb9f67d479f43077094ace66a618bde68ed858aa2f3e6e12'
BROWSER = OUT / 'warden-browser-opener-r1' / 'cmd.exe'
BROWSER_SHA = '4b91a4dc635e464143bfe1f484eccb2456ccd992326ac7a126b53d0a9a3c7f96'
MAX_BYTES = 65536
def module(path, name, expected):
if hashlib.sha256(path.read_bytes()).hexdigest() != expected:
raise ValueError('reviewed_input_changed')
spec = importlib.util.spec_from_file_location(name, path)
if spec is None:
from importlib.machinery import SourceFileLoader
spec = importlib.util.spec_from_loader(name, SourceFileLoader(name, str(path)))
result = importlib.util.module_from_spec(spec)
spec.loader.exec_module(result)
return result
def prepare(args):
for name, expected in HASHES.items():
if hashlib.sha256((OUT / name).read_bytes()).hexdigest() != expected:
raise ValueError('reviewed_input_changed')
helper = module(OUT / 'register_private_hub_r1.py', 'cust81_private_helper', HASHES['register_private_hub_r1.py'])
paths = [OUT / 'register_private_hub_r1.py', helper.PLAN, helper.PUBLIC,
helper.DISCLOSURE, helper.CONSENT, helper.IMAGE_PUBLICATION, args.rollout_proof, args.native_proof]
helper.public_tools()
helper.gates(helper.load(helper.PLAN), helper.load(args.approval),
helper.load(args.rollout_proof), helper.load(args.native_proof), paths)
if not args.kubeconfig.is_file():
raise ValueError('kubeconfig_unavailable')
mason = module(MASON, 'cust81_mason_attended_contract', MASON_SHA)
browser = module(BROWSER, 'cust81_private_browser_adapter', BROWSER_SHA)
return helper, mason, browser
def append(path, event):
fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_APPEND | os.O_NOFOLLOW, 0o600)
try:
info = os.fstat(fd)
if (not stat.S_ISREG(info.st_mode) or info.st_uid != os.getuid()
or stat.S_IMODE(info.st_mode) != 0o600):
raise ValueError('journal_custody')
data = memoryview((json.dumps(event, sort_keys=True) + '\n').encode())
while data:
count = os.write(fd, data)
if not count:
raise OSError('journal_write')
data = data[count:]
os.fsync(fd)
finally:
os.close(fd)
def verify_caller(raw):
if len(raw) > MAX_BYTES:
raise ValueError('lookup_size')
data = json.loads(raw)['data']
ttl = data.get('ttl')
if (data.get('policies') != [POLICY] or data.get('identity_policies') not in (None, [])
or data.get('entity_id') != ENTITY or type(ttl) is not int
or not 0 < ttl <= 1800):
raise ValueError('scoped_caller_mismatch')
def extract_token(raw, matcher):
# Extract for self-revocation even if surrounding login output is invalid.
if len(raw) > MAX_BYTES:
return ''
found = matcher.findall(raw)
return found[0] if len(found) == 1 else ''
def child_args(args):
return ['warden', 'access', 'reuse-surface-hub-write-token', '--exec', '--field',
'REUSE_SURFACE_TOKEN', '--', 'python3', str(OUT / 'register_private_hub_r1.py'),
'--apply', '--approval', str(args.approval), '--rollout-proof', str(args.rollout_proof),
'--native-proof', str(args.native_proof), '--kubeconfig', str(args.kubeconfig)]
def execute(args, helper, mason, browser, record):
env = os.environ.copy()
for key in ('BAO_TOKEN', 'VAULT_TOKEN', 'BAO_LOG_LEVEL', 'VAULT_LOG_LEVEL',
'BAO_LOG_FORMAT', 'VAULT_LOG_FORMAT', 'REUSE_SURFACE_TOKEN'):
env.pop(key, None)
env['BAO_ADDR'] = env['VAULT_ADDR'] = 'http://127.0.0.1:18200'
attempt = {'attempt_id': str(uuid.uuid4()), 'at': datetime.now(timezone.utc).isoformat(),
'proposal_id': 'CUST81-PRIVATE-REGISTRATION-EXECUTION-R1', 'revision': 1,
'approval_sha256': hashlib.sha256(args.approval.read_bytes()).hexdigest(),
'login': False, 'warden_exit': None, 'revoked': None, 'outcome': 'started'}
record(attempt.copy()) # Establish durable audit before any login.
token = ''
result_code = 1
proc = None
timer = None
with tempfile.TemporaryDirectory(prefix='cust81-private-warden-state-') as state:
config = yaml.safe_load(Path('/home/worsch/.config/warden/warden.yaml').read_text())
if not isinstance(config, dict):
raise ValueError('warden_config_shape')
config['state_dir'] = state
config_path = Path(state) / 'warden.yaml'
fd = os.open(config_path, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600)
with os.fdopen(fd, 'w') as stream:
stream.write(yaml.safe_dump(config, sort_keys=False))
stream.flush()
os.fsync(stream.fileno())
env['WARDEN_CONFIG'] = str(config_path)
try:
# token-only does not store; explicit no-store guards helper persistence.
proc = subprocess.Popen(['bao', 'login', '-no-store', *mason.login_args('netkingdom', ROLE)[1:]],
env=env, stdin=subprocess.DEVNULL, stdout=subprocess.PIPE,
stderr=subprocess.PIPE, text=True)
timer = threading.Timer(150, proc.kill)
timer.start()
failures = []
browser_opened = []
def pump():
while True:
line = proc.stderr.readline(MAX_BYTES + 1)
if not line:
break
if len(line) > MAX_BYTES:
failures.append('login_stream_size')
proc.kill()
break
kind = mason.classify_login_line(line)
if kind == 'url':
try:
if browser_opened:
raise ValueError('duplicate_browser_request')
browser_opened.append(True)
url = browser.parse_args('xdg-open', [line.strip()])
browser.launch(url)
print('Firefox opened in a fresh private profile; complete member login and MFA.', flush=True)
except Exception:
failures.append('browser_unavailable')
proc.kill()
break
elif kind == 'error':
# Raw error text never reaches receipts, stdout or exceptions.
if not failures:
failures.append('login_error')
reader = threading.Thread(target=pump, daemon=True)
reader.start()
raw = proc.stdout.read(MAX_BYTES + 1).strip()
token = extract_token(raw, mason.TOKEN_RE)
if len(raw) > MAX_BYTES:
proc.kill()
proc.wait(timeout=155)
timer.cancel()
reader.join(timeout=5)
if proc.returncode or mason.TOKEN_RE.fullmatch(raw) is None or failures or reader.is_alive():
attempt['outcome'] = 'login_refused'
else:
attempt['login'] = True
env['BAO_TOKEN'] = token
lookup = subprocess.run(['bao', 'token', 'lookup', '-format=json'], env=env,
capture_output=True, text=True, timeout=30)
if lookup.returncode:
raise ValueError('lookup_failed')
verify_caller(lookup.stdout)
attempt['entity_id'] = ENTITY
# Recheck proof freshness and exact artifact approval after OIDC.
paths = [OUT / 'register_private_hub_r1.py', helper.PLAN, helper.PUBLIC,
helper.DISCLOSURE, helper.CONSENT, helper.IMAGE_PUBLICATION, args.rollout_proof, args.native_proof]
helper.gates(helper.load(helper.PLAN), helper.load(args.approval),
helper.load(args.rollout_proof), helper.load(args.native_proof), paths)
print('Dedicated caller verified; registering the seven approved sources.', flush=True)
result = subprocess.run(child_args(args), env=env, capture_output=True, timeout=600)
attempt['warden_exit'] = result.returncode
result_code = result.returncode
attempt['outcome'] = 'writer_returned'
except Exception:
attempt['outcome'] = 'stopped_inspect_receipts_before_retry'
result_code = 1
finally:
if timer:
timer.cancel()
if proc and proc.poll() is None:
proc.kill()
proc.wait(timeout=10)
if token:
env['BAO_TOKEN'] = token
try:
revoked = subprocess.run(['bao', 'token', 'revoke', '-self'], env=env,
capture_output=True, timeout=30)
attempt['revoked'] = revoked.returncode == 0
except Exception:
attempt['revoked'] = False
env.pop('BAO_TOKEN', None)
token = ''
if attempt['revoked'] is not True:
result_code = 1
print('Scoped session revocation confirmed: ' + str(attempt['revoked']), flush=True)
attempt['finished_at'] = datetime.now(timezone.utc).isoformat()
record(attempt)
return result_code
def main():
parser = argparse.ArgumentParser(description=__doc__)
parser.add_argument('--apply', action='store_true', required=True)
for name in ('approval', 'rollout-proof', 'native-proof', 'kubeconfig'):
parser.add_argument('--' + name, type=Path, required=True)
args = parser.parse_args()
helper, mason, browser = prepare(args)
return execute(args, helper, mason, browser,
lambda event: append(OUT / 'attended-private-registration-receipts.jsonl', event))
if __name__ == '__main__':
try:
sys.exit(main())
except Exception:
print('Attended private registration refused; inspect bounded receipts.', file=sys.stderr)
sys.exit(1)

91
docs/assessments/netkingdom-2026-10-14/completion-audit.json
View file

@ -1,5 +1,5 @@
{
"objective_achieved": false,
"objective_achieved": true,
"requirements": [
{
"requirement": "All relevant repository and capability inventory",
@ -33,15 +33,21 @@
},
{
"requirement": "Hosted reuse-surface establishment",
"status": "incomplete",
"evidence": "32/70 hosted; 38 registrations pending caller access; seven also require private-source admission"
"status": "complete",
"evidence": "hosted-private-registration-verification-r1.json: freshforcedcomposition all70reviewed IDs exactlyonce/correctsource, zero warnings; seven actualPOST201 andfullSQLreadback, native14consentedfiles verified, scopedcallerrevoked."
}
],
"remaining_action": "Owner-approved hub-write access and private-source read/disclosure admission; apply exact plan and verify all 70 hosted IDs and source parity.",
"checked_at": "2026-10-14T09:04:58.199989+00:00",
"remaining_action": null,
"checked_at": "2026-10-15T03:33:16.165793+00:00",
"owner_gate": "5cd22087-e5d8-5d5e-a252-610a6ac13653",
"fresh_hosted_evidence": "hosted-current-verification.json",
"blocked_turn_audit": {
"fresh_hosted_evidence": "hosted-public-registration-verification.json",
"publication": {
"complete": true,
"commit": "a3b894eb42c177e97fd8885afce07b21ca36d416",
"receipt": "publication-batches-receipt.json",
"original_backup": "cust-wp-0081-original-unpublished"
},
"historical_blocked_turn_audit": {
"same_blocker": "Owner-provisioned hub write access and seven private-source admissions remain unavailable/unverified",
"consecutive_goal_turns": 3,
"turns": [
@ -51,10 +57,69 @@
],
"other_work": "Report publication recovered and verified with exact tree parity; final receipt/workplan publication and sync follow before goal status update."
},
"publication": {
"complete": true,
"commit": "a3b894eb42c177e97fd8885afce07b21ca36d416",
"receipt": "publication-batches-receipt.json",
"original_backup": "cust-wp-0081-original-unpublished"
}
"resumed_execution": "User resumed after KeyCape update and explicitly retried after Firefox update; public batch completed, private gates remain.",
"private_metadata_consent": {
"status": "approved",
"receipt": "private-source-owner-consent-r1.json",
"decision_id": "d8f8f216-ac94-4295-97f3-825fd21254ea"
},
"latest_hosted_verification": "hosted-private-registration-verification-r1.json",
"private_registration_preparation": "hub-private-registration-preparation-r1.json",
"previous_goal_turn_classification": "progress: explicit owner consent recorded in authoritative decision and delivered to all8 owners/platform",
"private_reader_preparation": {
"proposal": "private-reader-provisioning-preparation-r1.json",
"proposal_sha256": "7819eb51d249f5c7aff4df9fb520afcfb76603b05a4104439499102b6c20af99",
"handoff_receipts": "private-reader-preparation-handoff-receipts.json",
"status": "prepared and delivered; owner CCR/executable review pending"
},
"latest_goal_turn_classification": "progress: exactR2approved, scopedmember writer7registrations/readback/selfrevocation verified, freshhosted70coverage and documentationrequirements audited",
"owner_assembly": "private-reader-owner-assembly-receipt.json",
"latest_owner_preparation_validation": "private-reader-owner-assembly-validation.json",
"private_reader_publication_state": "private-reader-publication-state-r1.json",
"hardened_image_publication": "hardened-reader-image-publication-r1.json",
"private_reader_execution_proposal": {
"id": "CUST81-PRIVATE-READER-EXECUTION-R1",
"revision": 1,
"sha256": "704a9c932202fc14456652ea4dfdb3acb8b1db0ab3bbf5fff50e92b2c517c380",
"path": "private-reader-execution-proposal-r1.json",
"status": "approved_partial_execution_verified"
},
"private_reader_execution_approval": {
"decision": "approved",
"decision_ref": "9833715e-a22a-45c0-ab6c-881f0f4f1a0e",
"receipt": "private-reader-execution-approval-r1.json"
},
"phase_a": {
"status": "verified_live",
"execution_receipt": "phase-a-authorized-execution-r1.jsonl",
"runtime_receipt": "phase-a-runtime-verification-r1.json",
"active_source_commit": "91f828b3c167c72ab9a0cec1263467345a7ab63c"
},
"custody": {
"status": "provisioned_verified_delivery_pending",
"policy_receipt": "cust81-policy-custody-r1.jsonl",
"bootstrap_receipt": "cust81-forge-reader-r1.jsonl",
"revocation_receipt": "warden-attended-custody-terminal-r1.json"
},
"phase_b": {
"status": "delivered_native_verified",
"source_commit": "2b9f030c24cc084ea1b78913bab895420ed76e2c",
"rollout_proof": "phase-b-runtime-verification-r1.json",
"native_proof": "private-native-fetch-verification-r1.json",
"owner_receipt": "phase-b-owner-execution-r1.json"
},
"writer_transport": {
"status": "completed_verified",
"failure_receipt": "private-writer-cli-order-failure-r1.json",
"candidate_revision": 2,
"candidate_proposal_sha256": "c8fa74ad6648af1c884a4c607e100097f917761af5d3a6e0c5e8ce9a53b809dc",
"approval_status": "approved",
"approval_ref": "9f496e68-655e-4e08-aa57-c822cf731124",
"receipt": "attended-private-registration-receipts.jsonl"
},
"residual_handoffs": [
"CUST-IN-0018",
"RPF-WP-0058-T05"
],
"final_documentation_audit": "review-requirement-audit-final-r1.json"
}

30
docs/assessments/netkingdom-2026-10-14/cust81-forge-reader-r1.jsonl Normal file
View file

@ -0,0 +1,30 @@
{"at": "2026-10-15T03:05:59.301556+00:00", "attempt": "bb2693a7640f00b4e401467e", "ccr": "CCR-2026-0046", "event": "intent", "operation": "user_create"}
{"at": "2026-10-15T03:05:59.545757+00:00", "attempt": "bb2693a7640f00b4e401467e", "ccr": "CCR-2026-0046", "event": "outcome", "http_status": 201, "operation": "user_create", "status": "observed"}
{"at": "2026-10-15T03:05:59.548722+00:00", "attempt": "bb2693a7640f00b4e401467e", "ccr": "CCR-2026-0046", "event": "intent", "operation": "team_create"}
{"at": "2026-10-15T03:05:59.634933+00:00", "attempt": "bb2693a7640f00b4e401467e", "ccr": "CCR-2026-0046", "event": "outcome", "http_status": 201, "operation": "team_create", "status": "observed"}
{"at": "2026-10-15T03:05:59.637374+00:00", "attempt": "bb2693a7640f00b4e401467e", "ccr": "CCR-2026-0046", "event": "intent", "operation": "team_repo_rapp-openbao"}
{"at": "2026-10-15T03:05:59.729598+00:00", "attempt": "bb2693a7640f00b4e401467e", "ccr": "CCR-2026-0046", "event": "outcome", "http_status": 204, "operation": "team_repo_rapp-openbao", "status": "observed"}
{"at": "2026-10-15T03:05:59.732033+00:00", "attempt": "bb2693a7640f00b4e401467e", "ccr": "CCR-2026-0046", "event": "intent", "operation": "team_repo_rapp-policy-nexus"}
{"at": "2026-10-15T03:05:59.821596+00:00", "attempt": "bb2693a7640f00b4e401467e", "ccr": "CCR-2026-0046", "event": "outcome", "http_status": 204, "operation": "team_repo_rapp-policy-nexus", "status": "observed"}
{"at": "2026-10-15T03:05:59.824088+00:00", "attempt": "bb2693a7640f00b4e401467e", "ccr": "CCR-2026-0046", "event": "intent", "operation": "team_repo_rapp-postgres"}
{"at": "2026-10-15T03:05:59.913971+00:00", "attempt": "bb2693a7640f00b4e401467e", "ccr": "CCR-2026-0046", "event": "outcome", "http_status": 204, "operation": "team_repo_rapp-postgres", "status": "observed"}
{"at": "2026-10-15T03:05:59.916985+00:00", "attempt": "bb2693a7640f00b4e401467e", "ccr": "CCR-2026-0046", "event": "intent", "operation": "team_repo_rapp-sbom-nexus"}
{"at": "2026-10-15T03:06:00.011956+00:00", "attempt": "bb2693a7640f00b4e401467e", "ccr": "CCR-2026-0046", "event": "outcome", "http_status": 204, "operation": "team_repo_rapp-sbom-nexus", "status": "observed"}
{"at": "2026-10-15T03:06:00.014763+00:00", "attempt": "bb2693a7640f00b4e401467e", "ccr": "CCR-2026-0046", "event": "intent", "operation": "team_repo_rapp-telemetry"}
{"at": "2026-10-15T03:06:00.101506+00:00", "attempt": "bb2693a7640f00b4e401467e", "ccr": "CCR-2026-0046", "event": "outcome", "http_status": 204, "operation": "team_repo_rapp-telemetry", "status": "observed"}
{"at": "2026-10-15T03:06:00.104454+00:00", "attempt": "bb2693a7640f00b4e401467e", "ccr": "CCR-2026-0046", "event": "intent", "operation": "team_repo_rapp-tenant-engine"}
{"at": "2026-10-15T03:06:00.199178+00:00", "attempt": "bb2693a7640f00b4e401467e", "ccr": "CCR-2026-0046", "event": "outcome", "http_status": 204, "operation": "team_repo_rapp-tenant-engine", "status": "observed"}
{"at": "2026-10-15T03:06:00.201860+00:00", "attempt": "bb2693a7640f00b4e401467e", "ccr": "CCR-2026-0046", "event": "intent", "operation": "team_repo_rapp-user-engine"}
{"at": "2026-10-15T03:06:00.292196+00:00", "attempt": "bb2693a7640f00b4e401467e", "ccr": "CCR-2026-0046", "event": "outcome", "http_status": 204, "operation": "team_repo_rapp-user-engine", "status": "observed"}
{"at": "2026-10-15T03:06:00.295202+00:00", "attempt": "bb2693a7640f00b4e401467e", "ccr": "CCR-2026-0046", "event": "intent", "operation": "team_member_add"}
{"at": "2026-10-15T03:06:00.388675+00:00", "attempt": "bb2693a7640f00b4e401467e", "ccr": "CCR-2026-0046", "event": "outcome", "http_status": 204, "operation": "team_member_add", "status": "observed"}
{"at": "2026-10-15T03:06:02.699142+00:00", "attempt": "bb2693a7640f00b4e401467e", "ccr": "CCR-2026-0046", "event": "intent", "operation": "service_password_randomize"}
{"at": "2026-10-15T03:06:05.859196+00:00", "attempt": "bb2693a7640f00b4e401467e", "ccr": "CCR-2026-0046", "event": "outcome", "http_status": 200, "operation": "service_password_randomize", "status": "observed"}
{"at": "2026-10-15T03:06:05.862333+00:00", "attempt": "bb2693a7640f00b4e401467e", "ccr": "CCR-2026-0046", "event": "intent", "operation": "pat_create"}
{"at": "2026-10-15T03:06:06.085349+00:00", "attempt": "bb2693a7640f00b4e401467e", "ccr": "CCR-2026-0046", "event": "outcome", "http_status": 201, "operation": "pat_create", "status": "observed"}
{"at": "2026-10-15T03:06:06.088103+00:00", "attempt": "bb2693a7640f00b4e401467e", "ccr": "CCR-2026-0046", "event": "identified", "operation": "pat_create", "team_id": 5, "token_id": 72}
{"at": "2026-10-15T03:06:09.151956+00:00", "attempt": "bb2693a7640f00b4e401467e", "ccr": "CCR-2026-0046", "event": "verified", "operation": "reader_scope", "status": "seven_exact_no_extra_private_grants"}
{"at": "2026-10-15T03:06:09.155748+00:00", "attempt": "bb2693a7640f00b4e401467e", "ccr": "CCR-2026-0046", "event": "intent", "operation": "kv_create"}
{"at": "2026-10-15T03:06:09.383193+00:00", "attempt": "bb2693a7640f00b4e401467e", "ccr": "CCR-2026-0046", "event": "outcome", "operation": "kv_create", "status": "observed"}
{"at": "2026-10-15T03:06:09.579844+00:00", "attempt": "bb2693a7640f00b4e401467e", "ccr": "CCR-2026-0046", "event": "verified", "operation": "kv_create", "status": "matched"}
{"at": "2026-10-15T03:06:12.816932+00:00", "attempt": "bb2693a7640f00b4e401467e", "ccr": "CCR-2026-0046", "event": "terminal", "outcome": "provisioned_verified_delivery_pending"}

13
docs/assessments/netkingdom-2026-10-14/cust81-policy-custody-r1.jsonl Normal file
View file

@ -0,0 +1,13 @@
{"at": "2026-10-15T03:05:55.900943+00:00", "attempt": "93578ba93d6153fdb07c65db", "ccr": "CCR-2026-0046", "event": "verified", "operation": "installed_eso_role_and_policy", "status": "matched_immutable_role"}
{"at": "2026-10-15T03:05:55.904678+00:00", "attempt": "93578ba93d6153fdb07c65db", "ccr": "CCR-2026-0046", "event": "intent", "operation": "conditional_ccr_state_transition"}
{"at": "2026-10-15T03:05:55.913127+00:00", "attempt": "93578ba93d6153fdb07c65db", "ccr": "CCR-2026-0046", "event": "verified", "operation": "conditional_ccr_state_transition", "status": "exact_candidate_installed_after_claim_proof"}
{"at": "2026-10-15T03:05:56.078033+00:00", "attempt": "93578ba93d6153fdb07c65db", "ccr": "CCR-2026-0046", "event": "intent", "operation": "exact_eso_policy_update"}
{"at": "2026-10-15T03:05:56.255034+00:00", "attempt": "93578ba93d6153fdb07c65db", "ccr": "CCR-2026-0046", "event": "outcome", "operation": "exact_eso_policy_update", "status": "observed"}
{"at": "2026-10-15T03:05:56.444062+00:00", "attempt": "93578ba93d6153fdb07c65db", "ccr": "CCR-2026-0046", "event": "verified", "operation": "exact_eso_policy_update", "status": "matched"}
{"at": "2026-10-15T03:05:56.772477+00:00", "attempt": "93578ba93d6153fdb07c65db", "ccr": "CCR-2026-0046", "event": "verified", "operation": "installed_eso_role_and_policy", "status": "matched_immutable_role"}
{"at": "2026-10-15T03:05:56.775013+00:00", "attempt": "93578ba93d6153fdb07c65db", "ccr": "CCR-2026-0046", "event": "verified", "operation": "desired_acl_and_immutable_role", "status": "matched"}
{"at": "2026-10-15T03:05:56.777945+00:00", "attempt": "93578ba93d6153fdb07c65db", "ccr": "CCR-2026-0046", "event": "intent", "operation": "reviewed_forgejo_bootstrap_route"}
{"at": "2026-10-15T03:06:12.909800+00:00", "attempt": "93578ba93d6153fdb07c65db", "ccr": "CCR-2026-0046", "event": "outcome", "operation": "reviewed_forgejo_bootstrap_route", "status": "observed_success"}
{"at": "2026-10-15T03:06:13.277724+00:00", "attempt": "93578ba93d6153fdb07c65db", "ccr": "CCR-2026-0046", "event": "verified", "operation": "installed_eso_role_and_policy", "status": "matched_immutable_role"}
{"at": "2026-10-15T03:06:13.280478+00:00", "attempt": "93578ba93d6153fdb07c65db", "ccr": "CCR-2026-0046", "event": "verified", "operation": "desired_acl_and_immutable_role", "status": "matched"}
{"at": "2026-10-15T03:06:13.283133+00:00", "attempt": "93578ba93d6153fdb07c65db", "ccr": "CCR-2026-0046", "event": "terminal", "outcome": "policy_and_custody_verified_delivery_pending"}

3219
docs/assessments/netkingdom-2026-10-14/hosted-after-private-registration.json Normal file
View file

File diff suppressed because it is too large Load diff

36
docs/assessments/netkingdom-2026-10-14/hosted-private-registration-verification-r1.json Normal file
View file

@ -0,0 +1,36 @@
{
"checked_at": "2026-10-15T03:31:46.266841+00:00",
"composed_at": "2026-10-15T03:31:48+00:00",
"forced_refresh": true,
"stale": false,
"reviewed_expected": 70,
"reviewed_present": 70,
"missing_ids": [],
"duplicate_reviewed_ids": {},
"wrong_source_repo_ids": [],
"federated_records": 114,
"sources": 99,
"federation_warning_present": false,
"federation_warnings": "",
"registration_outcome_counts": {
"gates_verified": 1,
"post_intent": 7,
"applied": 7,
"full_sql_readback_verified": 1
},
"attended_terminal": {
"approval_sha256": "5d557a2706d477be7f4cd9f185e958d08c50dbd1e1c97489b46120c7de4ddf39",
"at": "2026-10-15T03:30:37.461728+00:00",
"attempt_id": "8f23bb90-aef9-405d-81b6-bf550400dd93",
"entity_id": "c204099b-cb94-363f-e207-5ff4d4aa6e94",
"finished_at": "2026-10-15T03:31:24.886122+00:00",
"login": true,
"outcome": "writer_returned",
"proposal_id": "CUST81-PRIVATE-REGISTRATION-EXECUTION-R1",
"revision": 1,
"revoked": true,
"warden_exit": 0
},
"federated_snapshot_sha256": "ef89ad92af74a653f0323b9084f1fb1eb723724167c11727255c2c825f6c0dc5",
"all_reviewed_hosted_exactly_once": true
}

50
docs/assessments/netkingdom-2026-10-14/hosted-public-registration-verification.json Normal file
View file

@ -0,0 +1,50 @@
{
"checked_at": "2026-10-14T22:19:51.870244+00:00",
"registered_repos": 95,
"sources": 92,
"federated_records": 107,
"composed_at": "2026-10-14T22:19:54+00:00",
"stale": false,
"reviewed_expected": 70,
"reviewed_present": 63,
"missing_ids": [
"capability.railiance.openbao-package",
"capability.railiance.policy-publication-package",
"capability.railiance.postgres-isolation-recovery",
"capability.railiance.sbom-runtime-package",
"capability.railiance.telemetry-package",
"capability.railiance.tenant-engine-package",
"capability.railiance.user-engine-package"
],
"duplicate_reviewed_ids": [],
"public_registration_conflicts": [],
"public_attempt_id": "64044e01-2f96-4e63-bbba-ad53b1617f0c",
"public_attempt_outcomes": {
"post_intent": 31,
"applied": 31,
"readback_verified": 1
},
"attended_attempt": {
"at": "2026-10-14T22:18:17.520607+00:00",
"attempt_id": "23c02e30-1a4c-4bc1-a3dc-45c9bf7ce962",
"entity_id": "c204099b-cb94-363f-e207-5ff4d4aa6e94",
"finished_at": "2026-10-14T22:19:26.523659+00:00",
"login": true,
"proposal_id": "CUST81-REUSE-PUBLIC-REGISTRATION-R1",
"revision": 1,
"revoked": true,
"warden_exit": 0,
"warden_state": "/tmp/custodian-warden-state-bpn99gi5"
},
"public_reviewed_expected": 63,
"public_reviewed_missing": [],
"pending_private_repos": [
"rapp-openbao",
"rapp-policy-nexus",
"rapp-postgres",
"rapp-sbom-nexus",
"rapp-telemetry",
"rapp-tenant-engine",
"rapp-user-engine"
]
}

93
docs/assessments/netkingdom-2026-10-14/hub-private-registration-plan-r1.json Normal file
View file

@ -0,0 +1,93 @@
[
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-openbao",
"url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/indexes/capabilities.yaml?ref=35672be138036c8433a5ac5de91e068c03c2b124",
"domain": "infotech",
"enabled": true,
"required": false,
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN",
"auth_header": "Authorization"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-policy-nexus",
"url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/indexes/capabilities.yaml?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3",
"domain": "infotech",
"enabled": true,
"required": false,
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN",
"auth_header": "Authorization"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-postgres",
"url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/indexes/capabilities.yaml?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5",
"domain": "infotech",
"enabled": true,
"required": false,
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN",
"auth_header": "Authorization"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-sbom-nexus",
"url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/indexes/capabilities.yaml?ref=adbedd349e8df97be43a1f57db7095af45ff29d1",
"domain": "infotech",
"enabled": true,
"required": false,
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN",
"auth_header": "Authorization"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-telemetry",
"url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/indexes/capabilities.yaml?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5",
"domain": "infotech",
"enabled": true,
"required": false,
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN",
"auth_header": "Authorization"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-tenant-engine",
"url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/indexes/capabilities.yaml?ref=9bdc86572728783a5ed94266f04f7b12d414c557",
"domain": "infotech",
"enabled": true,
"required": false,
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN",
"auth_header": "Authorization"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-user-engine",
"url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/indexes/capabilities.yaml?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738",
"domain": "infotech",
"enabled": true,
"required": false,
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN",
"auth_header": "Authorization"
}
}
]

16
docs/assessments/netkingdom-2026-10-14/hub-private-registration-r1-receipts.jsonl Normal file
View file

@ -0,0 +1,16 @@
{"apply": true, "approval_sha256": "5d557a2706d477be7f4cd9f185e958d08c50dbd1e1c97489b46120c7de4ddf39", "at": "2026-10-15T03:31:21.910411+00:00", "outcome": "gates_verified"}
{"at": "2026-10-15T03:31:23.036885+00:00", "attempt_id": "caf81e8b-3248-47ca-8353-f348f30e2089", "outcome": "post_intent", "plan_sha256": "ec0964addcc95a2f0509d70bb58c10006a3d00e1d2479d8678d3b7c6a15602b7", "repo": "rapp-openbao"}
{"at": "2026-10-15T03:31:23.036885+00:00", "attempt_id": "caf81e8b-3248-47ca-8353-f348f30e2089", "http_status": 201, "outcome": "applied", "plan_sha256": "ec0964addcc95a2f0509d70bb58c10006a3d00e1d2479d8678d3b7c6a15602b7", "repo": "rapp-openbao"}
{"at": "2026-10-15T03:31:23.157535+00:00", "attempt_id": "caf81e8b-3248-47ca-8353-f348f30e2089", "outcome": "post_intent", "plan_sha256": "ec0964addcc95a2f0509d70bb58c10006a3d00e1d2479d8678d3b7c6a15602b7", "repo": "rapp-policy-nexus"}
{"at": "2026-10-15T03:31:23.157535+00:00", "attempt_id": "caf81e8b-3248-47ca-8353-f348f30e2089", "http_status": 201, "outcome": "applied", "plan_sha256": "ec0964addcc95a2f0509d70bb58c10006a3d00e1d2479d8678d3b7c6a15602b7", "repo": "rapp-policy-nexus"}
{"at": "2026-10-15T03:31:23.264878+00:00", "attempt_id": "caf81e8b-3248-47ca-8353-f348f30e2089", "outcome": "post_intent", "plan_sha256": "ec0964addcc95a2f0509d70bb58c10006a3d00e1d2479d8678d3b7c6a15602b7", "repo": "rapp-postgres"}
{"at": "2026-10-15T03:31:23.264878+00:00", "attempt_id": "caf81e8b-3248-47ca-8353-f348f30e2089", "http_status": 201, "outcome": "applied", "plan_sha256": "ec0964addcc95a2f0509d70bb58c10006a3d00e1d2479d8678d3b7c6a15602b7", "repo": "rapp-postgres"}
{"at": "2026-10-15T03:31:23.370430+00:00", "attempt_id": "caf81e8b-3248-47ca-8353-f348f30e2089", "outcome": "post_intent", "plan_sha256": "ec0964addcc95a2f0509d70bb58c10006a3d00e1d2479d8678d3b7c6a15602b7", "repo": "rapp-sbom-nexus"}
{"at": "2026-10-15T03:31:23.370430+00:00", "attempt_id": "caf81e8b-3248-47ca-8353-f348f30e2089", "http_status": 201, "outcome": "applied", "plan_sha256": "ec0964addcc95a2f0509d70bb58c10006a3d00e1d2479d8678d3b7c6a15602b7", "repo": "rapp-sbom-nexus"}
{"at": "2026-10-15T03:31:23.475600+00:00", "attempt_id": "caf81e8b-3248-47ca-8353-f348f30e2089", "outcome": "post_intent", "plan_sha256": "ec0964addcc95a2f0509d70bb58c10006a3d00e1d2479d8678d3b7c6a15602b7", "repo": "rapp-telemetry"}
{"at": "2026-10-15T03:31:23.475600+00:00", "attempt_id": "caf81e8b-3248-47ca-8353-f348f30e2089", "http_status": 201, "outcome": "applied", "plan_sha256": "ec0964addcc95a2f0509d70bb58c10006a3d00e1d2479d8678d3b7c6a15602b7", "repo": "rapp-telemetry"}
{"at": "2026-10-15T03:31:23.579270+00:00", "attempt_id": "caf81e8b-3248-47ca-8353-f348f30e2089", "outcome": "post_intent", "plan_sha256": "ec0964addcc95a2f0509d70bb58c10006a3d00e1d2479d8678d3b7c6a15602b7", "repo": "rapp-tenant-engine"}
{"at": "2026-10-15T03:31:23.579270+00:00", "attempt_id": "caf81e8b-3248-47ca-8353-f348f30e2089", "http_status": 201, "outcome": "applied", "plan_sha256": "ec0964addcc95a2f0509d70bb58c10006a3d00e1d2479d8678d3b7c6a15602b7", "repo": "rapp-tenant-engine"}
{"at": "2026-10-15T03:31:23.701037+00:00", "attempt_id": "caf81e8b-3248-47ca-8353-f348f30e2089", "outcome": "post_intent", "plan_sha256": "ec0964addcc95a2f0509d70bb58c10006a3d00e1d2479d8678d3b7c6a15602b7", "repo": "rapp-user-engine"}
{"at": "2026-10-15T03:31:23.701037+00:00", "attempt_id": "caf81e8b-3248-47ca-8353-f348f30e2089", "http_status": 201, "outcome": "applied", "plan_sha256": "ec0964addcc95a2f0509d70bb58c10006a3d00e1d2479d8678d3b7c6a15602b7", "repo": "rapp-user-engine"}
{"at": "2026-10-15T03:31:24.580987+00:00", "attempt_id": "caf81e8b-3248-47ca-8353-f348f30e2089", "outcome": "full_sql_readback_verified", "plan_sha256": "ec0964addcc95a2f0509d70bb58c10006a3d00e1d2479d8678d3b7c6a15602b7", "repo_count": 7}

16
docs/assessments/netkingdom-2026-10-14/owner-assembly/cust81-platform-custody-maintenance-actual-binding-r1.json Normal file
View file

@ -0,0 +1,16 @@
{
"published_commit": "2951b69fc5bee8a748165a56d1a73d17abc40cb7",
"primary_projection": "applied expected=derived exact commit primary/railiance01",
"task_uuid": "f0780e75-b0bd-5bf5-b926-c8413abb885c",
"task_record_id": "RPF-WP-0058-T05",
"task_status": "wait",
"activation_at": "2026-10-15T03:06:09.579844+00:00",
"manual_due_at": "2027-01-13T03:06:09.579844+00:00",
"source_date_and_indexed_description_verified": true,
"structured_hub_due_date": null,
"expiry_or_reminder_automatic": false,
"ccr_approved_exact_sha256": "23039fae6137e7bdd71de0ed3278596b1ed60ae636018eb4bfcc83e53c4ada02",
"custody_evidence_path": "docs/evidence/2026-10-15-reuse-private-reader-custody-r1.json",
"custody_evidence_sha256": "3bc037fa91d357351b2860d27fd7c41aaf4fd8f2ec488cb24a0d9cda3756d5c5",
"raw_publication_receipt": "/tmp/cust81-platform-custody-actual-publication-raw-r1.json"
}

63
docs/assessments/netkingdom-2026-10-14/phase-b-owner-execution-r1.json Normal file
View file

@ -0,0 +1,63 @@
{
"id": "CUST81-APPS-PHASE-B-OWNER-EXECUTION-R1",
"checked_at": "2026-10-15T03:13:25.773472+00:00",
"status": "delivery_rollout_and_native_acquisition_verified",
"approval_decision": "9833715e-a22a-45c0-ab6c-881f0f4f1a0e",
"proposal_sha256": "704a9c932202fc14456652ea4dfdb3acb8b1db0ab3bbf5fff50e92b2c517c380",
"source_commit": "2b9f030c24cc084ea1b78913bab895420ed76e2c",
"primary_derived_commit": "2b9f030c24cc084ea1b78913bab895420ed76e2c",
"normal_source_sync": "applied",
"manifest_sha256": "adfb34c0ee4d01bc602f57cd2320f1658465fb8f8660978828fffa05a5b604b5",
"journal_path": "/tmp/cust81-apps-phase-b-execution-r1.jsonl",
"journal_sha256": "ccdce2fb35218d63a9c79c17a80ad16d841fc7fad9258fcc595842a441531e26",
"actual_events": [
{
"approved_manifest_sha256": "adfb34c0ee4d01bc602f57cd2320f1658465fb8f8660978828fffa05a5b604b5",
"checked_at": "2026-10-15T03:12:08.128949+00:00",
"stage": "phase_b_remote_manifest_hash_verified"
},
{
"approved_manifest_sha256": "adfb34c0ee4d01bc602f57cd2320f1658465fb8f8660978828fffa05a5b604b5",
"checked_at": "2026-10-15T03:12:08.132356+00:00",
"object": "ExternalSecret/reuse/reuse-surface-runtime",
"stage": "phase_b_apply_intent"
},
{
"checked_at": "2026-10-15T03:12:09.253728+00:00",
"exit_code": 0,
"raw_output_discarded": true,
"stage": "phase_b_apply_result"
},
{
"checked_at": "2026-10-15T03:12:14.770217+00:00",
"eso_ready": true,
"exact_approved_mapping_verified": true,
"raw_output_discarded": true,
"reader_key_present": true,
"stage": "phase_b_delivery_presence"
},
{
"checked_at": "2026-10-15T03:12:20.248739+00:00",
"deployment": "reuse-surface",
"namespace": "reuse",
"stage": "phase_b_restart_intent"
},
{
"checked_at": "2026-10-15T03:12:21.218416+00:00",
"exit_code": 0,
"raw_output_discarded": true,
"stage": "phase_b_restart_result"
},
{
"checked_at": "2026-10-15T03:12:37.401225+00:00",
"exit_code": 0,
"raw_output_discarded": true,
"stage": "phase_b_rollout_wait"
}
],
"runtime_proof_path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/phase-b-runtime-verification-r1.json",
"native_proof_path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/private-native-fetch-verification-r1.json",
"credential_values_emitted": false,
"registration_status": "pending_root_scoped_writer_action",
"goal_complete": false
}

23
docs/assessments/netkingdom-2026-10-14/phase-b-runtime-verification-r1.json Normal file
View file

@ -0,0 +1,23 @@
{
"id": "CUST81-PHASE-B-RUNTIME-VERIFICATION-R1",
"checked_at": "2026-10-15T03:30:20.559962+00:00",
"status": "verified",
"image_digest": "sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0",
"native_source_sha256": "dbaa40f25cc0f090143578cd1c7068cb2cb00960fafd17d5239bf8a5bac514dd",
"native_helper_sha256": "c67a284091cc4dd62dca56658a14b8ea1357e2b3df1518120da4c51e0ee8d85c",
"namespace": "reuse",
"container": "reuse-surface",
"exact_reader_allowlist_verified": true,
"oci_parent_membership_verified": true,
"oci_publication_sha256": "f4ba7eff3d34dd732876b6dbba619f8c901ce9c2519b6d660101330f935a6c14",
"kube_api_server": "https://127.0.0.1:16444",
"approval_decision": "9833715e-a22a-45c0-ab6c-881f0f4f1a0e",
"target_node_ip": "92.205.62.239",
"reader_key_present": true,
"raw_values_discarded": true,
"pod": "reuse-surface-77c8c476f4-qs8mf",
"pod_uid": "4693401c-c97f-422f-a7d3-af8d0411ef5d",
"ready": true,
"deployment_image": "forgejo.coulomb.social/coulomb/reuse-surface@sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0",
"runtime_image_id": "forgejo.coulomb.social/coulomb/reuse-surface@sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0"
}

82
docs/assessments/netkingdom-2026-10-14/private-native-fetch-verification-r1.json Normal file
View file

@ -0,0 +1,82 @@
{
"all_verified": true,
"cache_used": false,
"checked_at": "2026-10-15T03:30:20.627885+00:00",
"consent_sha256": "4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52",
"disclosure_sha256": "46ac4fe49a08054cc215aade2fbaf3b36ee334520997857ed84f530b52da9d35",
"id": "CUST81-PRIVATE-NATIVE-FETCH-RECEIPT-R1",
"proposal_sha256": "7819eb51d249f5c7aff4df9fb520afcfb76603b05a4104439499102b6c20af99",
"sources": [
{
"commit": "35672be138036c8433a5ac5de91e068c03c2b124",
"entry_sha256": [
"9de890da536c34ac2b50576e2c4a9c03792c8a07545d2a0566ace68ac10a293e"
],
"index_sha256": "044efa3d02b90e1872f2516c581159d388a8080a689f76fcd78bb4d048d6ee64",
"repo": "rapp-openbao",
"verified": true
},
{
"commit": "088b78ac03b0cebeec34a69aae3569eb7ec2f9c3",
"entry_sha256": [
"21415ed5e89dcf8bd2df0c8bc99b07d2c87173809c37fa2582de6d336918a126"
],
"index_sha256": "e68bdedf61eee9ca2026f46a2434ce384c26234616e74f7a5d08a06c75b3bb00",
"repo": "rapp-policy-nexus",
"verified": true
},
{
"commit": "a9f569c96d74aa384ac8d3ac4aa960e4061550b5",
"entry_sha256": [
"64503872abb24bb28f291264e860ab094c6abb721fbfe90b47258ad13b77af44"
],
"index_sha256": "d939333eed9d85172e006f526c445fbe2602a721d53f7c0d14bc68286ae08776",
"repo": "rapp-postgres",
"verified": true
},
{
"commit": "adbedd349e8df97be43a1f57db7095af45ff29d1",
"entry_sha256": [
"1a15e37bd3d19c4c89ef25803667937f549ade1cd27bedfa85132ac48ffe3f48"
],
"index_sha256": "d2ee0f193d2198bf8f16ce64c90ae7664e59a2bc307ad711426af3fd47deb057",
"repo": "rapp-sbom-nexus",
"verified": true
},
{
"commit": "f158307e24b86bab88a1af4830ff6b4f85afdeb5",
"entry_sha256": [
"a67dbf6905223c04b1c003d5f967841038743c8c1479812f5cf0bb55ad6cee77"
],
"index_sha256": "ee8801f143ed5cf064205710a61c2bb24efc6ea8585d5786d6b679426ec4c1d4",
"repo": "rapp-telemetry",
"verified": true
},
{
"commit": "9bdc86572728783a5ed94266f04f7b12d414c557",
"entry_sha256": [
"e7cf0485cfdb6f497281638d81f908b5c2fe1053125c6ef28130504909d1d49e"
],
"index_sha256": "d8e9c1282350b5d2fd4f4d69712aa7a5fbcd2367bb1a7fad1b6eb16a97e5d732",
"repo": "rapp-tenant-engine",
"verified": true
},
{
"commit": "f35108f9e1b8702fb6c526fe42b2fec5ca032738",
"entry_sha256": [
"84ec4fdce99134c88c110104cac93bdea36cffb5ba34e046b9ad161fb860dce2"
],
"index_sha256": "95b4ed2d0b189f6847b1c0899f740d1da46933a8f40491e1a02f2d4e57c819fc",
"repo": "rapp-user-engine",
"verified": true
}
],
"transport": "actual_native_hub_authenticated_fetch",
"hub_runtime": {
"pod": "reuse-surface-77c8c476f4-qs8mf",
"pod_uid": "4693401c-c97f-422f-a7d3-af8d0411ef5d",
"image_digest": "sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0",
"native_source_sha256": "dbaa40f25cc0f090143578cd1c7068cb2cb00960fafd17d5239bf8a5bac514dd",
"native_helper_sha256": "c67a284091cc4dd62dca56658a14b8ea1357e2b3df1518120da4c51e0ee8d85c"
}
}

21
docs/assessments/netkingdom-2026-10-14/private-reader-execution-approval-r1.json Normal file
View file

@ -0,0 +1,21 @@
{
"id": "CUST81-PRIVATE-READER-EXECUTION-APPROVAL-R1",
"proposal_id": "CUST81-PRIVATE-READER-EXECUTION-R1",
"proposal_revision": 1,
"proposal_sha256": "704a9c932202fc14456652ea4dfdb3acb8b1db0ab3bbf5fff50e92b2c517c380",
"decision": "approved",
"decided_by": "Bernd Worsch",
"decision_ref": "9833715e-a22a-45c0-ab6c-881f0f4f1a0e",
"decided_at": "2026-10-15T00:07:05.087085+00:00",
"user_statement": "Approve this exact proposal",
"question_reply_id": "call_58068e911e1041f781afecb812bfc12b",
"conditional_receipt_rules": {
"requires_actual_external_founder_decision": true,
"no_self_approval": true,
"custody": "Copy exact handoff schema artifact digests and actual resolved decision reference; conditional CCR candidate bytes may be activated only after actual installedclaim proof and predecessor guard.",
"runtime_proofs": "Record only actual whitelisted ready-pod/UID/cluster/spec-image/runtimeOCI-membership/source/helper/allowlist and native receipt fields using exact approved proof code. No fabricated provenance.",
"registration_approval": "After actual fresh samepod proof passes helpercontract, derive approved_artifacts only from the eight exact files required by helper.gates; six prepared artifacts are bound here and two runtime proof hashes are computed from actual successful receipts. Bind actual resolved founder decision to action register_exact_seven_private_sources and existing writer route; never mark fake/localtest receipts approved.",
"conditional_recovery": "If necessary authorize only exact dedicated PAT created by this approved bootstrap: target ID and name derived from verified successful journal plus strict unique current metadata, exact recovery helper/CCR/contract/provisioner bytes and actual same founder decision. Unknown/differing/ambiguous identity or PAT stops for separate owner disposition; no broader token or KV deletion."
},
"live_execution_complete": false
}

11
docs/assessments/netkingdom-2026-10-14/private-reader-execution-approval-r2.json Normal file
View file

@ -0,0 +1,11 @@
{
"proposal_id": "CUST81-PRIVATE-READER-EXECUTION-R1",
"proposal_revision": 2,
"proposal_sha256": "c8fa74ad6648af1c884a4c607e100097f917761af5d3a6e0c5e8ce9a53b809dc",
"decision": "approved",
"decided_by": "Bernd Worsch",
"decided_at": "2026-10-15T03:23:56.611534+00:00",
"decision_ref": "9f496e68-655e-4e08-aa57-c822cf731124",
"user_statement": "Approve this exact revision 2",
"corrected_helper_sha256": "1ec34b8cded859845dc29cedf55ff02fa4881bd4d6a3a264879efd5b3e706c88"
}

318
docs/assessments/netkingdom-2026-10-14/private-reader-execution-proposal-r1.json Normal file
View file

@ -0,0 +1,318 @@
{
"id": "CUST81-PRIVATE-READER-EXECUTION-R1",
"revision": 1,
"prepared_at": "2026-10-15T00:04:06.654694+00:00",
"status": "prepared_for_founder_decision_not_approved",
"scope": "Complete hosted establishment of exactly seven consented private capabilities after verified hardened consumer rollout; no repository visibility change.",
"requesting_agent": "custodian-codex",
"supervisor": "Bernd Worsch",
"mode": "supervised",
"authority": {
"production": "ADMINISTER @ realm:kubernetes/railiance01; activation only after founder APPROVED",
"credentials": "Exact CCR-2026-0046 conditional accepted state and dedicated seven-repository reader through existing attended OpenBao and nested Forgejo owner custody",
"rule_ref": "docs/agent-environment-orientation.md sections4-6; docs/agent-autonomy-decision.md",
"autopilot": false
},
"existing_metadata_consent": {
"decision_id": "d8f8f216-ac94-4295-97f3-825fd21254ea",
"proposal_sha256": "46ac4fe49a08054cc215aade2fbaf3b36ee334520997857ed84f530b52da9d35",
"request_again": false
},
"reader": {
"user": "reuse-surface-source",
"team": "coulomb/reuse-surface-source-readers",
"repositories": [
"rapp-openbao",
"rapp-policy-nexus",
"rapp-postgres",
"rapp-sbom-nexus",
"rapp-telemetry",
"rapp-tenant-engine",
"rapp-user-engine"
],
"permission": "repo.code read only; token scope read:repository; non-admin restricted private identity; no other private grants",
"important_scope": "Forgejo grants code-read over the whole seven repositories. Consumer fetches are separately limited to fourteen exact consented commit-pinned metadata URLs. This approval must cover that repository-read grant as well as already-approved metadata disclosure.",
"openbao_data_path": "platform/data/workloads/reuse/reuse-surface/forgejo-source-read",
"kv_field": "FORGEJO_SOURCE_TOKEN",
"consumer_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN",
"caller_writer_policy_unchanged": true,
"rotation": {
"manual_days": 90,
"work_record": "RPF-WP-0058-T05",
"task_uuid": "f0780e75-b0bd-5bf5-b926-c8413abb885c",
"planned_due_date": "2027-01-13",
"before_delivery": "Bind actual activation date plus90days in canonical owner task and indexed description; verify receipt.",
"no_automatic_expiry_or_reminder": true,
"hub_structured_due_date": "null cache limitation; source due-date and indexed description remain authoritative"
}
},
"image": {
"reference": "forgejo.coulomb.social/coulomb/reuse-surface@sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0",
"linux_amd64_child": "sha256:1a69354af2bc87d4baaecc4b02e13fda468efd3746024f440cc6d138beeee2ab",
"native_source_sha256": "dbaa40f25cc0f090143578cd1c7068cb2cb00960fafd17d5239bf8a5bac514dd",
"native_helper_sha256": "c67a284091cc4dd62dca56658a14b8ea1357e2b3df1518120da4c51e0ee8d85c",
"exact_allowlist_urls": 14
},
"source_publication": {
"reuse-surface": "d36fc463bc3d4752ec87a176ac900eb3b4be1cc8",
"platform_runner": "635daec6b4265ccbd066b96b53228919ac4cbd79",
"platform_maintenance": "352aeea5e9f3b5e6649ec00ba2b8003c10b472bc",
"apps_phase_a": "05f654e20f7ea68471e586d7892e25441c65875d",
"apps_phase_b": "ea2d4632a114c348c70b01d684cc5a2d4f413b91",
"forge_independent_review": "d322b9c9e8a1caa2b3479b270fff8a0e9f6c1f59"
},
"ordered_execution": [
{
"step": 1,
"action": "Recheck targetnode, currentrelease10, no reader delivery, zeroexistingauthregistrations, 100m/256Mi surge capacity, exact approved artifacts, recovery snapshot and fullchart dryrun/clientdiff; stop any drift."
},
{
"step": 2,
"action": "Deploy phaseA exact committed chart/archive with image digest and14URL config through owner atomic Helm command. Verify ready workload, actual image specification/runtimeOCI membership and native source/helper hashes plus routing refusal and all63publiccapabilities. No reader available yet.",
"commands_ref": "owner-assembly/apps-phase-a-current/exact-execution-proposal-r1.json"
},
{
"step": 3,
"action": "Founder attends sanctioned Warden OpenBao OIDC/MFA with tasklocalWindowsFirefox opener. Exactrunner validates installedimmutable900sESOclaims and expectedACL, then installs only prebound approved/confirmed CCR candidate and exactpolicy successor, invokes reviewedexistingForgejo bootstrap. Verify exact7grants/PAT/KV and negativeoutofscope/Admin/Actions proofs. Stopambiguousmutation and neverremint automatically.",
"command": "env PATH=\"/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/warden-browser-opener-r1:$PATH\" BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 warden access openbao-platform-admin-login --exec -- python3 /home/worsch/railiance-platform/scripts/apply-reuse-surface-reader-custody.py --execute --approval /tmp/cust81-approved-custody-r1.json --receipt /tmp/cust81-policy-custody-r1.jsonl --bootstrap-receipt /tmp/cust81-forge-reader-r1.jsonl",
"approval_receipt_schema": {
"ccr_id": "CCR-2026-0046",
"decision": "approved only after actual founder disposition",
"supervisor": "recorded supervisor identity",
"decision_ref": "resolved exact founder credential-change decision reference",
"approved_artifacts": {
"credential-change-requests/CCR-2026-0046-reuse-surface-forgejo-source-read.yaml": "23039fae6137e7bdd71de0ed3278596b1ed60ae636018eb4bfcc83e53c4ada02",
"docs/proposals/2026-10-15-reuse-private-reader/bootstrap-contract.json": "2bb72671e0a5f230497ab8ef2967a20ee68d1f2cf081f07c84f6db3442e18d8b",
"scripts/provision-reuse-surface-forgejo-source.py": "abf60a754596baa1610d23b1fd367385b0222ac8aeaebba0f2cfb7ec4c62055b",
"openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl": "6320f6c2d262d924ea16291d301d5f9eeb7efdb6ce7ea141c1a41d277d86b01b"
},
"runner_artifacts": {
"scripts/apply-reuse-surface-reader-custody.py": "934b421c357e154f6508ab4b7c30f1aadfea2bf9a2f187d83968928d5eecad42",
"openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl": "6320f6c2d262d924ea16291d301d5f9eeb7efdb6ce7ea141c1a41d277d86b01b",
"docs/proposals/2026-10-15-reuse-private-reader/conditional-approved-ccr-state-candidate-r1.json": "178dd2aeddf3544438d584fa16e3ceb1a541a357d4dff5b8b4b0e95db2f357ac"
}
}
},
{
"step": 4,
"action": "After successful platformcustody and maintenance-date evidence, owner commits exactly predecessor-guarded phaseB ESreplacement, normalpublishes/reconciles, applies approved onefield delta through SSH, checks ESOReady/keypresence without values, restarts currenthardened deployment with fresh headroom and verifies actualruntime."
},
{
"step": 5,
"action": "Run exact stdin nativeproofwrapper in current verifiedreadyhardenedpod; capture receipts only. Prove exact7indexes+7entries against consented commits/hashes/schema/owner withoutcache. Recheck fresh rollout/native proofs before writerlogin."
},
{
"step": 6,
"action": "Attend dedicated member writer OIDC via exactprivate transport; verify entity/exactpolicy/TTL, Warden injects only writer field, helper fullfieldSQLitechecks all conflicts beforePOST, submits seven exact registrations with durable intent/outcome, rereads allfields, selfrevokes caller. No sourcecredential retrieved by agent."
},
{
"step": 7,
"action": "Force fresh hostedcomposition and independently prove all70 reviewedIDs occur exactlyonce; retain private source warnings/fetch checks, update workplan/progress/sourceprojection. Only then complete goal."
}
],
"conditional_receipt_authority": {
"requires_actual_external_founder_decision": true,
"no_self_approval": true,
"custody": "Copy exact handoff schema artifact digests and actual resolved decision reference; conditional CCR candidate bytes may be activated only after actual installedclaim proof and predecessor guard.",
"runtime_proofs": "Record only actual whitelisted ready-pod/UID/cluster/spec-image/runtimeOCI-membership/source/helper/allowlist and native receipt fields using exact approved proof code. No fabricated provenance.",
"registration_approval": "After actual fresh samepod proof passes helpercontract, derive approved_artifacts only from the eight exact files required by helper.gates; six prepared artifacts are bound here and two runtime proof hashes are computed from actual successful receipts. Bind actual resolved founder decision to action register_exact_seven_private_sources and existing writer route; never mark fake/localtest receipts approved.",
"conditional_recovery": "If necessary authorize only exact dedicated PAT created by this approved bootstrap: target ID and name derived from verified successful journal plus strict unique current metadata, exact recovery helper/CCR/contract/provisioner bytes and actual same founder decision. Unknown/differing/ambiguous identity or PAT stops for separate owner disposition; no broader token or KV deletion."
},
"verification": {
"hosted_required": 70,
"duplicate_reviewed_ids": 0,
"private_source_files": 14,
"no_cache_for_native_proof": true,
"full_registration_fields": [
"repo",
"url",
"domain",
"enabled",
"required",
"auth_env",
"auth_header"
],
"fresh_proofs_max_seconds": 600,
"public_baseline_required": 63,
"credentials_printed_or_stored_in_evidence": false
},
"rollback": {
"phase_a_before_reader": "Owner atomic failure recovery or Helm rollback reuse revision10; preserve PVC; use verified local database snapshot only under separate exact data-recovery disposition.",
"after_reader": "Keep hardened image. Revoke only dedicatedPAT using reviewed Basic recovery, restore oldtwofieldESO manifest, removeonlymaterializedreaderkey using structured approved command, restart hardened workload and verify revoked/absent. Only then allow revision10 image rollback. Never restore vulnerable image while readeravailable.",
"registrations": "Disable only rows attributable to this attempt after exact fullfield ownership/readback; no deletion or alteration of unrelated/preexistingmatching sources.",
"ambiguity": "Stop and reconcile authoritative journal and providerstate; no observation-timeout retry/remint."
},
"cost_risk": {
"incremental_infrastructure_cost_eur": 0,
"execution_cost_eur": null,
"credible_loss_bound_eur": null,
"valuation": "Existing node/PVC/resources retained; execution cost and credible loss not priced. Supervised founder disposition accepts qualitative interruption/recovery risk and scoped7repositorycode disclosure exposure; no autopilot budget or EURrisk grant.",
"main_risks": [
"Hub rollout or SQLite/PVC concurrent-access failure requiring recovery",
"Dedicated static reader can read code in all seven grantedrepositories;14URLconsumerbinding limits runtimefetch, notForgejoPATscope",
"ACL has noCAS; owner recheck/snapshot/finalverification guard drift but do not imply atomicCAS",
"Manual90dayrotation requires ownerattention; PATdoesnotautomaticallyexpire"
]
},
"prepared_artifacts": [
{
"path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/private-source-disclosure-proposal-r1.json",
"sha256": "46ac4fe49a08054cc215aade2fbaf3b36ee334520997857ed84f530b52da9d35"
},
{
"path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/private-source-owner-consent-r1.json",
"sha256": "4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52"
},
{
"path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/private-reader-provisioning-preparation-r1.json",
"sha256": "7819eb51d249f5c7aff4df9fb520afcfb76603b05a4104439499102b6c20af99"
},
{
"path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/hardened-reader-image-publication-r1.json",
"sha256": "f4ba7eff3d34dd732876b6dbba619f8c901ce9c2519b6d660101330f935a6c14"
},
{
"path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/hub-private-registration-plan-r1.json",
"sha256": "ec0964addcc95a2f0509d70bb58c10006a3d00e1d2479d8678d3b7c6a15602b7"
},
{
"path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/register_private_hub_r1.py",
"sha256": "de431eb2942d469eaad0e7e167ebfb98a717c6fa2a92b7cd987333d764792113"
},
{
"path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/register_public_hub.py",
"sha256": "c6a5f08e01af3a5c4b1d6557859f4400eaba0d7eb0bb1976f45bba6bc5a05fda"
},
{
"path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/attended_private_registration.py",
"sha256": "56806b127b6a926361ef82c2b53732ef71fb385bcc0b918ae4e4d815015e6966"
},
{
"path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/private-registration-execution-contract-r1.md",
"sha256": "0e2b98f7de6f2079eebb8772d9e564b1506ad5703bf981b7ea3196aed8a4cd62"
},
{
"path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/private-registration-preparation-owner-review-r2.json",
"sha256": "67f158e49eca4e6d62797c1b35dc6115251b7b6e459498783d35748873f8075a"
},
{
"path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/attended-private-registration-owner-review-r1.json",
"sha256": "0d52bf1c4dd0d82cdfeb017b2722482a941a872fe2d7cb7eb5cfb5ec9081afc2"
},
{
"path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/warden-browser-opener-r1/cmd.exe",
"sha256": "4b91a4dc635e464143bfe1f484eccb2456ccd992326ac7a126b53d0a9a3c7f96"
},
{
"path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/warden-browser-opener-r1/xdg-open",
"sha256": "4b91a4dc635e464143bfe1f484eccb2456ccd992326ac7a126b53d0a9a3c7f96"
},
{
"path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/warden-browser-opener-r1/validation.json",
"sha256": "9cbd8be4d9acfc19241e70bcda5df93eb2eacc83cb00771a5543022acc4ed474"
},
{
"path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/phase-a-source-archive-r1.json",
"sha256": "11798ba996513ef6c6ce86f0e6542c327dc0ea51fd00ea3846a320f686b8148d"
},
{
"path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/reuse-database-recovery-preflight-r2.json",
"sha256": "c27c99cae46e7f1f0fb26fca91fdaec860d241966177432b3d55d391d10de84e"
},
{
"path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-a-current/exact-execution-proposal-r1.json",
"sha256": "c1dba0a6f77f4c6e76334e62ab0d23652c93dbf37234c0596e779313d7397ab2"
},
{
"path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-a-current/server-preflight-r1.json",
"sha256": "3ebaaab10c6e2e8469059ee5f05103cdd096c7f73167ad8251db04e9af754d93"
},
{
"path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-a-current/semantic-diff-r1.json",
"sha256": "9f453a3b106b2f78ba64040aa6ab42f1ad0d4de3924bec080ee6d6459ed6554d"
},
{
"path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-a-current/helm-recovery-revision-r1.json",
"sha256": "e71e335f0867688adb8ecdb60cb149809af7dba3992655790ab6ec2bed52896b"
},
{
"path": "/home/worsch/railiance-platform/credential-change-requests/CCR-2026-0046-reuse-surface-forgejo-source-read.yaml",
"sha256": "90522912fb78fed72e625382fb7114a0e9aafe76d59e36bffecab83c5bb7d643"
},
{
"path": "/home/worsch/railiance-platform/scripts/apply-reuse-surface-reader-custody.py",
"sha256": "934b421c357e154f6508ab4b7c30f1aadfea2bf9a2f187d83968928d5eecad42"
},
{
"path": "/home/worsch/railiance-platform/scripts/provision-reuse-surface-forgejo-source.py",
"sha256": "abf60a754596baa1610d23b1fd367385b0222ac8aeaebba0f2cfb7ec4c62055b"
},
{
"path": "/home/worsch/railiance-platform/scripts/revoke-reuse-surface-forgejo-source.py",
"sha256": "f78d1b26fbff93c6cc481a896d9fb9b9ce93049b8b3267fa41a64bc57dadb162"
},
{
"path": "/home/worsch/railiance-platform/openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl",
"sha256": "6320f6c2d262d924ea16291d301d5f9eeb7efdb6ce7ea141c1a41d277d86b01b"
},
{
"path": "/home/worsch/railiance-platform/docs/proposals/2026-10-15-reuse-private-reader/bootstrap-contract.json",
"sha256": "2bb72671e0a5f230497ab8ef2967a20ee68d1f2cf081f07c84f6db3442e18d8b"
},
{
"path": "/home/worsch/railiance-platform/docs/proposals/2026-10-15-reuse-private-reader/conditional-approved-ccr-state-candidate-r1.json",
"sha256": "178dd2aeddf3544438d584fa16e3ceb1a541a357d4dff5b8b4b0e95db2f357ac"
},
{
"path": "/home/worsch/railiance-platform/docs/proposals/2026-10-15-reuse-private-reader/attended-custody-handoff-r1.json",
"sha256": "1247ad5aa73289a26a48e999b870ce2d60abb409132783e14456ea318689acff"
},
{
"path": "/home/worsch/railiance-platform/docs/proposals/2026-10-15-reuse-private-reader/platform-attended-runner-review-r1.json",
"sha256": "2406b70ed5a0fe755fe967d3568fabffc84396bb5509c55417aa6900dbb9a4d9"
},
{
"path": "/home/worsch/railiance-apps/docs/assessments/cust81-private-reader/phase-b-r1/phase-b-execution-proposal-r1.json",
"sha256": "13f19158e09b0693a64ff400ecbc3e5ec09d28673731e87733d1e2fad9bd3222"
},
{
"path": "/home/worsch/railiance-apps/docs/assessments/cust81-private-reader/phase-b-r1/apps-owner-phase-b-review.md",
"sha256": "496c842f4a284d6b2904c027dfd1e8aab85567f19fa74a228f27c4cc578ce026"
},
{
"path": "/home/worsch/railiance-apps/docs/assessments/cust81-private-reader/phase-b-r1/manifest.json",
"sha256": "52ec35f1e150c1e2aca21bc138b523bf74423dd391e62daca8182d1b8924ed34"
},
{
"path": "/home/worsch/railiance-apps/docs/assessments/cust81-private-reader/phase-b-r1/native_runtime_proof_stdin.py",
"sha256": "1edc317e8563a120b62a6830eebb2875c144b45c57a491eb7da849095c5d1933"
},
{
"path": "/home/worsch/railiance-apps/docs/assessments/cust81-private-reader/phase-b-r1/eso-preflight-r1.json",
"sha256": "e39f07427af80fd036e6eec21202efe194fff2db67b8523bb07052e1388d8fab"
},
{
"path": "/home/worsch/railiance-apps/docs/assessments/cust81-private-reader/phase-b-r1/native-proof-wrapper-local-checks-r1.json",
"sha256": "c5fcee128f7b4653ecfc0c455aab57a7efa8f6a9de382af69d447d8065091bab"
},
{
"path": "/home/worsch/railiance-apps/docs/assessments/cust81-private-reader/reuse-surface-runtime-externalsecret.r1.yaml",
"sha256": "adfb34c0ee4d01bc602f57cd2320f1658465fb8f8660978828fffa05a5b604b5"
},
{
"path": "/home/worsch/railiance-forge/docs/proposals/cust81-private-reader/forge-owner-attended-runner-review-r3.json",
"sha256": "e4a17ee59fb1691f7b99a09d2473178740721aad0c1394cae79b503118c97040"
},
{
"path": "/home/worsch/reuse-surface/docs/assessments/cust81-private-reader/candidate-owner-review-r1.json",
"sha256": "853cb3b721d83ba5aeb0847111cc47f8094b733f870059cca9834b2c1a5a6219"
},
{
"path": "/home/worsch/reuse-surface/docs/assessments/cust81-private-reader/ccr0046-consumer-owner-review-r2.json",
"sha256": "f476605eb55fb329ef3cea8c091ff5f43eae79c18df0912c8cd76a8f7af568a6"
}
],
"live_actions_executed": false,
"credential_provision_executed": false,
"goal_complete": false
}

43
docs/assessments/netkingdom-2026-10-14/private-reader-execution-proposal-r2.json Normal file
View file

@ -0,0 +1,43 @@
{
"id": "CUST81-PRIVATE-READER-EXECUTION-R1",
"revision": 2,
"prepared_at": "2026-10-15T03:19:00.893235+00:00",
"status": "pending_founder_decision",
"amends": {
"revision": 1,
"sha256": "704a9c932202fc14456652ea4dfdb3acb8b1db0ab3bbf5fff50e92b2c517c380",
"path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/private-reader-execution-proposal-r1.json",
"decision_ref": "9833715e-a22a-45c0-ab6c-881f0f4f1a0e"
},
"change": "Move -no-store before all role/skip_browser authentication data; no other code changes",
"changed_artifacts": [
{
"path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/attended_private_registration.py",
"sha256": "1ec34b8cded859845dc29cedf55ff02fa4881bd4d6a3a264879efd5b3e706c88",
"supersedes_sha256": "56806b127b6a926361ef82c2b53732ef71fb385bcc0b918ae4e4d815015e6966"
}
],
"scope": "Continue the existing approved exact seven private-source registration and final70capability verification after refreshing actual samepod rollout/nativeproofs. All original source-reader limits, writeridentity/policy/TTL checks, metadata consent, exactregistrationpayloads, durablejournals and selfrevocation remain required. No provisioning replay or broader access.",
"already_verified": [
"Hardened hub rollout",
"Exact seven-repository reader scope and OpenBao custody",
"Admin session selfrevocation",
"Manual90daymaintenance binding",
"Approved ESO reader delivery and hardenedrestart",
"Native sevenindex plus sevenentry consentedhash fetch verification"
],
"remaining_execution": [
"Refresh actual runtime/nativeproofs if older than600seconds",
"Derive eightartifact registration approval from actual originalfounderdecision plus this exact amendment; six originalregistration artifacts unchanged, two actualfreshproofhashes",
"Run corrected scoped member attendedwriter transport; registerexactseven throughWarden, fullfieldreadback, selfrevoke",
"Force freshhostedcomposition and independently verify all70reviewedcapabilityIDs exactlyonce; update review/workplan/audit"
],
"verification": "Original exact registration helper and all gates unchanged; original proposal verification and rollback retained. CLI parse reproduction and unchanged25offline tests cover correction.",
"rollback": "Original approved dedicatedPAT-only recovery and readerdelivery rollback retained; no new rollback or broader credential action.",
"cost_risk": {
"incremental_infrastructure_eur": 0,
"risk_change": "No additional credential or repository scope. Original supervised qualitative risk retained; no autopilot.",
"approval_required_because": "Exact reviewed executable hash changed; agent-autonomy-decision requires review of revised privileged-action proposal."
},
"failure_receipt": "private-writer-cli-order-failure-r1.json"
}

24
docs/assessments/netkingdom-2026-10-14/private-registration-execution-approval-r2-retry2.json Normal file
View file

@ -0,0 +1,24 @@
{
"id": "CUST81-PRIVATE-REGISTRATION-EXECUTION-R1",
"decision": "approved",
"decided_by": "Bernd Worsch",
"decision_ref": "9f496e68-655e-4e08-aa57-c822cf731124",
"action": "register_exact_seven_private_sources",
"writer_route": "reuse-surface-hub-write-token",
"approved_artifacts": {
"register_private_hub_r1.py": "de431eb2942d469eaad0e7e167ebfb98a717c6fa2a92b7cd987333d764792113",
"hub-private-registration-plan-r1.json": "ec0964addcc95a2f0509d70bb58c10006a3d00e1d2479d8678d3b7c6a15602b7",
"register_public_hub.py": "c6a5f08e01af3a5c4b1d6557859f4400eaba0d7eb0bb1976f45bba6bc5a05fda",
"private-source-disclosure-proposal-r1.json": "46ac4fe49a08054cc215aade2fbaf3b36ee334520997857ed84f530b52da9d35",
"private-source-owner-consent-r1.json": "4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52",
"hardened-reader-image-publication-r1.json": "f4ba7eff3d34dd732876b6dbba619f8c901ce9c2519b6d660101330f935a6c14",
"phase-b-runtime-verification-r1.json": "0f7db53d2a956947ccb49729f349e47474775a587ef906ca91f1ccc9f8c6ba9a",
"private-native-fetch-verification-r1.json": "a30e28a282d464178ed608bec29d6d325d92355e5bc8c54b4e6e8c310eae1629"
},
"derived_at": "2026-10-15T03:30:35.069670+00:00",
"authority_proposal_revision": 2,
"authority_proposal_sha256": "c8fa74ad6648af1c884a4c607e100097f917761af5d3a6e0c5e8ce9a53b809dc",
"original_decision_ref": "9833715e-a22a-45c0-ab6c-881f0f4f1a0e",
"attended_transport_sha256": "1ec34b8cded859845dc29cedf55ff02fa4881bd4d6a3a264879efd5b3e706c88",
"retry_reason": "Founder reported incorrectOTP and accountpageredirect; previousattemptterminal withouttoken/writer. Sameapprovedrevision/scope, actualproofsrefreshed."
}

25
docs/assessments/netkingdom-2026-10-14/private-writer-cli-order-failure-r1.json Normal file
View file

@ -0,0 +1,25 @@
{
"checked_at": "2026-10-15T03:19:00.892876+00:00",
"actual_attempt": "4b8c8ddc-3f05-49d5-96e6-b452fe3aebf9",
"outcome": "login_refused_before_browser_or_registration",
"confirmed_cause": "Bao treats trailing -no-store after role=... as malformed key/value data",
"credential_free_reproduction": {
"destination": "127.0.0.1:9 closed port",
"isolated_empty_home": true,
"original": {
"exit": 1,
"invalid_key_value": true,
"network_attempt": false
},
"fixed": {
"exit": 2,
"invalid_key_value": false,
"connection_refused": true
}
},
"changed_file": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/attended_private_registration.py",
"original_sha256": "56806b127b6a926361ef82c2b53732ef71fb385bcc0b918ae4e4d815015e6966",
"candidate_sha256": "1ec34b8cded859845dc29cedf55ff02fa4881bd4d6a3a264879efd5b3e706c88",
"change": "Move -no-store before all role/skip_browser authentication data; no other code changes",
"live_fixed_execution": false
}

18
docs/assessments/netkingdom-2026-10-14/private-writer-member-login-failures-r1.json Normal file
View file

@ -0,0 +1,18 @@
{
"checked_at": "2026-10-15T03:30:17.993592+00:00",
"scope_unchanged": true,
"failures": [
{
"attempt": "c6d3a395-9657-4392-a36c-98f3e93ede55",
"founder_browser_error": "error validating claims: claim groups does not match any associated bound claim values",
"outcome": "login_refused_before_writer"
},
{
"attempt": "163dc2a3-54b1-40c7-ba00-d484398c7349",
"founder_observation": "OTP entered incorrectly once, then routed to users.coulomb.social",
"outcome": "login_refused_after132seconds_no_writer",
"cause": "Return-path loss suspected; not source-confirmed"
}
],
"credential_or_registration_effect": false
}

359
docs/assessments/netkingdom-2026-10-14/register_private_hub_r1.py Normal file
View file

@ -0,0 +1,359 @@
"""Bounded seven-source admission after exact external founder approval.
No import-time actions, source-token lookup, retries, credential acquisition or
rollout. Writer token is injected through the existing Warden route. Full-field
readback uses read-only SQLite metadata in an explicitly approved ready pod.
"""
from __future__ import annotations
import argparse
import fcntl
import hashlib
import importlib.util
import json
import os
import re
import shutil
import sqlite3
import stat
import subprocess
import sys
import urllib.request
import uuid
from datetime import datetime, timezone
from pathlib import Path
OUT = Path(__file__).resolve().parent
BASE = "https://reuse.coulomb.social"
PLAN = OUT / "hub-private-registration-plan-r1.json"
PUBLIC = OUT / "register_public_hub.py"
PUBLIC_SHA = "c6a5f08e01af3a5c4b1d6557859f4400eaba0d7eb0bb1976f45bba6bc5a05fda"
DISCLOSURE = OUT / "private-source-disclosure-proposal-r1.json"
CONSENT = OUT / "private-source-owner-consent-r1.json"
DISCLOSURE_SHA = "46ac4fe49a08054cc215aade2fbaf3b36ee334520997857ed84f530b52da9d35"
CONSENT_SHA = "4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52"
PREPARATION_SHA = "7819eb51d249f5c7aff4df9fb520afcfb76603b05a4104439499102b6c20af99"
IMAGE = "sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0"
IMAGE_REPO = "forgejo.coulomb.social/coulomb/reuse-surface"
IMAGE_CHILD = "sha256:1a69354af2bc87d4baaecc4b02e13fda468efd3746024f440cc6d138beeee2ab"
IMAGE_PUBLICATION = OUT / "hardened-reader-image-publication-r1.json"
IMAGE_PUBLICATION_SHA = "f4ba7eff3d34dd732876b6dbba619f8c901ce9c2519b6d660101330f935a6c14"
SOURCE_SHA = "dbaa40f25cc0f090143578cd1c7068cb2cb00960fafd17d5239bf8a5bac514dd"
NATIVE_HELPER_SHA = "c67a284091cc4dd62dca56658a14b8ea1357e2b3df1518120da4c51e0ee8d85c"
REPOS = frozenset({"rapp-openbao", "rapp-policy-nexus", "rapp-postgres", "rapp-sbom-nexus", "rapp-telemetry", "rapp-tenant-engine", "rapp-user-engine"})
FIELDS = ("repo", "url", "domain", "enabled", "required", "auth_env", "auth_header")
MAX_BYTES = 2 * 1024 * 1024
MAX_AGE = 600
def digest(path):
return hashlib.sha256(Path(path).read_bytes()).hexdigest()
def load(path):
raw = Path(path).read_bytes()
if len(raw) > MAX_BYTES:
raise ValueError("artifact_size")
return json.loads(raw)
def public_tools():
if digest(PUBLIC) != PUBLIC_SHA:
raise ValueError("public_helper_changed")
spec = importlib.util.spec_from_file_location("cust81_public_reconcile", PUBLIC)
module = importlib.util.module_from_spec(spec)
spec.loader.exec_module(module)
return module
def fresh(value, now):
stamp = datetime.fromisoformat(value)
if stamp.tzinfo is None or not -30 <= (now - stamp).total_seconds() <= MAX_AGE:
raise ValueError("stale_proof")
def validate_plan(plan, disclosure):
sources = disclosure["sources"]
expected = [{"method": "POST", "path": "/v1/repos", "body": {
"repo": row["repo"],
"url": f"https://forgejo.coulomb.social/api/v1/repos/coulomb/{row['repo']}/raw/registry/indexes/capabilities.yaml?ref={row['commit']}",
"domain": "infotech", "enabled": True, "required": False,
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN", "auth_header": "Authorization",
}} for row in sources]
if len(plan) != 7 or {a["body"]["repo"] for a in plan} != REPOS or plan != expected:
raise ValueError("private_plan_scope")
if any(type(a["body"]["enabled"]) is not bool or type(a["body"]["required"]) is not bool for a in plan):
raise ValueError("boolean_fields")
def gates(plan, approval, rollout, native, paths, now=None):
now = now or datetime.now(timezone.utc)
if digest(DISCLOSURE) != DISCLOSURE_SHA or digest(CONSENT) != CONSENT_SHA:
raise ValueError("consent_packet_changed")
if digest(IMAGE_PUBLICATION) != IMAGE_PUBLICATION_SHA:
raise ValueError("oci_publication_changed")
publication = load(IMAGE_PUBLICATION)
manifest = publication.get("registry_manifest", {})
children = [child for child in manifest.get("manifests", [])
if child.get("digest") == IMAGE_CHILD
and child.get("mediaType") == "application/vnd.oci.image.manifest.v1+json"
and child.get("platform") == {"architecture": "amd64", "os": "linux"}
and not child.get("annotations")]
if (
publication.get("status") != "published_digest_verified"
or publication.get("reference") != IMAGE_REPO + ":cust81-private-reader-r1"
or publication.get("expected_digest") != IMAGE
or manifest.get("digest") != IMAGE
or manifest.get("mediaType") != "application/vnd.oci.image.index.v1+json"
or len(children) != 1
):
raise ValueError("oci_runtime_child_membership_unverified")
disclosure = load(DISCLOSURE)
consent = load(CONSENT)
validate_plan(plan, disclosure)
if consent["consent_status"] != "approved" or consent["proposal_sha256"] != DISCLOSURE_SHA:
raise ValueError("consent_missing")
artifacts = {Path(path).name: digest(path) for path in paths}
if len(artifacts) != len(paths) or approval.get("approved_artifacts") != artifacts:
raise ValueError("exact_artifact_approval_missing")
if (
approval.get("id") != "CUST81-PRIVATE-REGISTRATION-EXECUTION-R1"
or approval.get("decision") != "approved"
or approval.get("decided_by") != "Bernd Worsch"
or not approval.get("decision_ref")
or approval.get("action") != "register_exact_seven_private_sources"
or approval.get("writer_route") != "reuse-surface-hub-write-token"
):
raise ValueError("founder_execution_approval_missing")
fresh(rollout["checked_at"], now)
fresh(native["checked_at"], now)
if (
rollout.get("status") != "verified"
or rollout.get("image_digest") != IMAGE
or rollout.get("native_source_sha256") != SOURCE_SHA
or rollout.get("native_helper_sha256") != NATIVE_HELPER_SHA
or rollout.get("namespace") != "reuse"
or rollout.get("container") != "reuse-surface"
or rollout.get("ready") is not True
or rollout.get("exact_reader_allowlist_verified") is not True
or rollout.get("deployment_image") != IMAGE_REPO + "@" + IMAGE
or rollout.get("oci_parent_membership_verified") is not True
or rollout.get("oci_publication_sha256") != IMAGE_PUBLICATION_SHA
or not re.fullmatch(r"reuse-surface-[a-z0-9-]{1,100}", rollout.get("pod", ""))
or not re.fullmatch(r"[a-zA-Z0-9-]{1,80}", rollout.get("pod_uid", ""))
or not re.fullmatch(r"https://[a-zA-Z0-9.:-]{1,180}", rollout.get("kube_api_server", ""))
):
raise ValueError("hardened_rollout_unverified")
if (
native.get("id") != "CUST81-PRIVATE-NATIVE-FETCH-RECEIPT-R1"
or native.get("all_verified") is not True
or native.get("cache_used") is not False
or native.get("disclosure_sha256") != DISCLOSURE_SHA
or native.get("consent_sha256") != CONSENT_SHA
or native.get("proposal_sha256") != PREPARATION_SHA
or native.get("transport") not in (None, "actual_native_hub_authenticated_fetch")
or native.get("hub_runtime") != {
"pod": rollout["pod"], "pod_uid": rollout["pod_uid"],
"image_digest": IMAGE, "native_source_sha256": SOURCE_SHA,
"native_helper_sha256": NATIVE_HELPER_SHA,
}
):
raise ValueError("actual_native_fetch_unverified")
rows = native.get("sources", [])
if len(rows) != 7 or {r.get("repo") for r in rows} != REPOS:
raise ValueError("native_source_scope")
by_repo = {r["repo"]: r for r in rows}
for source in disclosure["sources"]:
row = by_repo[source["repo"]]
files = {f["path"]: f["sha256"] for f in source["files"]}
if (
row.get("verified") is not True
or row.get("commit") != source["commit"]
or row.get("index_sha256") != files["registry/indexes/capabilities.yaml"]
or row.get("entry_sha256") != [f["sha256"] for f in source["files"] if f["path"].endswith(".md")]
or row.get("error")
):
raise ValueError("native_consented_hash_mismatch")
def sqlite_rows(db_path):
"""Only exact seven repo fields; never select the payload or env values."""
columns = sql_columns()
with sqlite3.connect("file:" + db_path + "?mode=ro", uri=True) as db:
return db.execute("SELECT repo," + columns + " FROM registrations WHERE repo IN (" + ",".join("?" for _ in REPOS) + ")", sorted(REPOS)).fetchall()
def sanitize_sql_rows(rows, plan):
expected = {a["body"]["repo"]: a["body"] for a in plan}
result = {}
if not isinstance(rows, list) or len(rows) > 7:
raise ValueError("sql_readback_scope")
for raw in rows:
if not isinstance(raw, (list, tuple)) or len(raw) != len(FIELDS):
raise ValueError("sql_readback_shape")
repo = raw[0]
if repo not in expected or repo in result:
raise ValueError("sql_readback_duplicate_or_foreign")
values = dict(zip(FIELDS, raw))
# SQLite json_extract represents JSON booleans as integer 0/1.
if type(values["enabled"]) is not int or type(values["required"]) is not int or values["enabled"] not in (0, 1) or values["required"] not in (0, 1):
raise ValueError("sql_boolean_shape")
values["enabled"] = bool(values["enabled"])
values["required"] = bool(values["required"])
if values != expected[repo]:
raise ValueError("sql_body_conflict")
# Return only planned whitelisted values, never untrusted row content.
result[repo] = dict(expected[repo])
return result
def pod_code():
columns = sql_columns()
sql = "SELECT repo," + columns + " FROM registrations WHERE repo IN (" + ",".join("?" for _ in REPOS) + ")"
return "import json,sqlite3\nwith sqlite3.connect('file:/data/reuse.db?mode=ro',uri=True) as db:\n rows=db.execute(" + repr(sql) + "," + repr(sorted(REPOS)) + ").fetchall()\n print(json.dumps(rows))\n"
def sql_columns():
# Bound metadata at the database boundary. Oversized/unexpected values become
# NULL and fail exact comparison; never truncate into an apparently valid row.
columns = []
for name in FIELDS[1:]:
expression = "json_extract(payload, '$." + name + "')"
columns.append("CASE WHEN length(CAST(" + expression + " AS TEXT)) <= 2048 THEN " + expression + " ELSE NULL END")
return ",".join(columns)
def bounded_process(argv):
# No writer token or arbitrary runtime credential inherited by kubectl.
proc = subprocess.run(argv, capture_output=True, timeout=35, env={"PATH": os.defpath, "LANG": "C.UTF-8"})
if proc.returncode or len(proc.stdout) > MAX_BYTES or len(proc.stderr) > MAX_BYTES:
raise RuntimeError("pod_observation_unavailable")
return proc.stdout
def full_readback(kubeconfig, rollout, plan):
executable = shutil.which("kubectl")
if not executable:
raise RuntimeError("kubectl_missing")
prefix = [executable, "--kubeconfig", str(kubeconfig)]
server = bounded_process(prefix + ["config", "view", "--minify", "-o", "jsonpath={.clusters[0].cluster.server}"]).decode()
if server != rollout["kube_api_server"]:
raise ValueError("wrong_cluster")
deployment_image = bounded_process(prefix + ["-n", "reuse", "get", "deployment", "reuse-surface", "-o", 'jsonpath={.spec.template.spec.containers[?(@.name=="reuse-surface")].image}']).decode()
if deployment_image != IMAGE_REPO + "@" + IMAGE:
raise ValueError("deployment_image_not_exact_oci_parent")
selector = 'jsonpath={"{\\"uid\\":\\""}{.metadata.uid}{"\\",\\"ready\\":\\""}{.status.containerStatuses[?(@.name=="reuse-surface")].ready}{"\\",\\"specImage\\":\\""}{.spec.containers[?(@.name=="reuse-surface")].image}{"\\",\\"imageID\\":\\""}{.status.containerStatuses[?(@.name=="reuse-surface")].imageID}{"\\"}"}'
metadata = json.loads(bounded_process(prefix + ["-n", "reuse", "get", "pod", rollout["pod"], "-o", selector]))
validate_pod_metadata(metadata, rollout)
raw = bounded_process(prefix + ["-n", "reuse", "exec", rollout["pod"], "-c", "reuse-surface", "--", "python3", "-c", pod_code()])
return sanitize_sql_rows(json.loads(raw), plan)
def validate_pod_metadata(metadata, rollout):
runtime = metadata.get("imageID", "")
if runtime.startswith("docker-pullable://"):
runtime = runtime[len("docker-pullable://"):]
permitted = {IMAGE_REPO + "@" + IMAGE, IMAGE_REPO + "@" + IMAGE_CHILD}
if (
metadata.get("uid") != rollout["pod_uid"]
or metadata.get("ready") != "true"
or metadata.get("specImage") != IMAGE_REPO + "@" + IMAGE
or runtime not in permitted
):
raise ValueError("ready_hardened_pod_unverified")
def append(path, event):
data = (json.dumps(event, sort_keys=True) + "\n").encode()
fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_APPEND | os.O_NOFOLLOW, 0o600)
try:
info = os.fstat(fd)
if info.st_uid != os.getuid() or stat.S_IMODE(info.st_mode) != 0o600:
raise ValueError("receipt_custody")
view = memoryview(data)
while view:
view = view[os.write(fd, view):]
os.fsync(fd)
finally:
os.close(fd)
def http_request(opener, method, path, body=None):
if (method, path) not in (("GET", "/v1/repos"), ("POST", "/v1/repos")):
raise ValueError("hub_route_not_permitted")
headers = {"Accept": "application/json"}
data = None
if method == "POST":
token = os.environ.get("REUSE_SURFACE_TOKEN")
if not token:
raise ValueError("writer_route_token_missing")
headers.update({"Authorization": "Bearer " + token, "Content-Type": "application/json"})
data = json.dumps(body).encode()
request = urllib.request.Request(BASE + path, data=data, headers=headers, method=method)
with opener.open(request, timeout=55) as response:
content = response.read(MAX_BYTES + 1)
if len(content) > MAX_BYTES:
raise ValueError("hub_response_too_large")
return response.status, json.loads(content) if content else None
def run(plan, tools, request, sql, record, apply, plan_sha, authorize=lambda: None):
status, listing = request("GET", "/v1/repos")
if status != 200 or not isinstance(listing, dict) or not isinstance(listing.get("repos"), list):
raise ValueError("invalid_public_listing")
public = {r["repo"]: r for r in listing["repos"]}
if len(public) != len(listing["repos"]):
raise ValueError("public_duplicate")
existing = sql()
for action in plan:
repo = action["body"]["repo"]
if (repo in public) != (repo in existing):
raise ValueError("public_sql_inventory_race")
if repo in existing and not tools.body_matches(action["body"], existing[repo]):
raise ValueError("existing_full_body_conflict")
attempt = str(uuid.uuid4())
authorize()
def post(body):
authorize() # Proof freshness may expire during preflight/batch.
return request("POST", "/v1/repos", body)[0]
tools.reconcile(plan, existing, post, record, apply=apply, plan_sha256=plan_sha, attempt_id=attempt)
if apply:
actual = sql()
tools.validate_readback(plan, list(actual.values()))
record({"attempt_id": attempt, "at": datetime.now(timezone.utc).isoformat(), "outcome": "full_sql_readback_verified", "repo_count": 7, "plan_sha256": plan_sha})
def main():
parser = argparse.ArgumentParser(description=__doc__)
parser.add_argument("--apply", action="store_true")
for name in ("approval", "rollout-proof", "native-proof", "kubeconfig"):
parser.add_argument("--" + name, type=Path, required=True)
args = parser.parse_args()
tools = public_tools()
plan = load(PLAN)
rollout, native = load(args.rollout_proof), load(args.native_proof)
paths = [Path(__file__).resolve(), PLAN, PUBLIC, DISCLOSURE, CONSENT, IMAGE_PUBLICATION, args.rollout_proof, args.native_proof]
gates(plan, load(args.approval), rollout, native, paths)
lock = os.open(OUT / "hub-private-registration-r1.lock", os.O_RDWR | os.O_CREAT | os.O_NOFOLLOW, 0o600)
try:
if os.fstat(lock).st_uid != os.getuid() or stat.S_IMODE(os.fstat(lock).st_mode) != 0o600:
raise ValueError("lock_custody")
fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
opener = urllib.request.build_opener(urllib.request.ProxyHandler({}), tools.NoRedirect())
record = lambda event: append(OUT / "hub-private-registration-r1-receipts.jsonl", event)
record({"at": datetime.now(timezone.utc).isoformat(), "outcome": "gates_verified", "apply": args.apply, "approval_sha256": digest(args.approval)})
run(plan, tools, lambda *a: http_request(opener, *a), lambda: full_readback(args.kubeconfig, rollout, plan), record, args.apply, digest(PLAN), lambda: gates(plan, load(args.approval), rollout, native, paths))
return 0
except Exception:
append(OUT / "hub-private-registration-r1-receipts.jsonl", {"at": datetime.now(timezone.utc).isoformat(), "outcome": "stopped_reconcile_before_retry"})
raise
finally:
os.close(lock)
if __name__ == "__main__":
try:
raise SystemExit(main())
except Exception:
print("private registration refused; inspect bounded receipts", file=sys.stderr)
raise SystemExit(1)

38
docs/assessments/netkingdom-2026-10-14/review-requirement-audit-final-r1.json Normal file
View file

@ -0,0 +1,38 @@
{
"checked_at": "2026-10-15T03:33:35.387769+00:00",
"provider_repositories": 60,
"reviewed_capabilities": 70,
"unique_capability_ids": 70,
"inspected_nonproviders": 2,
"source_entry_errors": [],
"supported_usecases": [
"U01",
"U02",
"U03",
"U04",
"U05",
"U06",
"U07",
"U08",
"U09",
"U10",
"U11",
"U12",
"U13",
"U14"
],
"review_usecase_rows": 14,
"ranked_recommendations": 12,
"swot_all_four_present": true,
"overall_maturity_explicit": true,
"broken_local_review_links": [],
"hosted_requirement": {
"status": "verified",
"receipt": "hosted-private-registration-verification-r1.json",
"reviewed_present": 70,
"all_exactly_once": true
},
"documentation_requirements_verified": true,
"review_sha256": "bc012e86caf11811c2752ccdd97309c4e9b5d6483523d8839dc6539f32df6418",
"all_objective_requirements_verified": true
}

20
docs/assessments/netkingdom-2026-10-14/supplement/registry-publication.json
View file

@ -20,5 +20,25 @@
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "ops-mason",
"commit": "100558696f55e411849164c70aa9877fb4653037",
"parent": "58fb21fa657fefdebc9258881711672c246765c6",
"paths": [
"registry/capabilities/capability.security.structure-construction.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false,
"supersedes_commit": "6434877a44e20396dc85652ad22a55f0a89d16d0",
"verified_at": "2026-10-14T21:55:00Z",
"verification": {
"immutable_and_stable_path_sha256": {
"registry/capabilities/capability.security.structure-construction.md": "000ceac5b4c71569aed1c9af970980a0c72a34db13fdca40671c9ddbfe97409d",
"registry/indexes/capabilities.yaml": "5eb499bc819c874835b8e6727ccbd5f9889ebb6f25a90018e3e574e5b6082b32"
},
"current_main": "92907919cdef6f644607e431eb61e0bdb10f1214"
}
}
]

37
docs/assessments/netkingdom-2026-10-14/warden-attended-custody-terminal-r1.json Normal file
View file

@ -0,0 +1,37 @@
{
"id": "CUST81-WARDEN-ATTENDED-CUSTODY-TERMINAL-R1",
"checked_at": "2026-10-15T03:07:03.709198+00:00",
"records": [
{
"file": "access-audit.log",
"latest": {
"timestamp": "2026-10-15T03:06:13.494014+00:00",
"action": "login",
"outcome": "ok",
"exit_code": 0,
"need_id": "openbao-platform-admin-login",
"owner_repo": "railiance-platform"
}
},
{
"file": "audit.jsonl",
"latest": {
"ts": "2026-10-15T03:06:13.495110+00:00",
"action": "login",
"outcome": "ok",
"exit_code": 0,
"target": "openbao-platform-admin-login",
"owner_repo": "railiance-platform"
}
}
],
"private_helpers_read": false,
"raw_login_or_secrets_read": false,
"terminal_verified": true,
"contract_result": {
"silent_child_succeeded": true,
"self_revocation_confirmed": true,
"private_helper_cleanup_succeeded": true,
"basis": "Installed Warden attended-envelope exit0 contract; both metadata audit records agree. No server token lookup or helper read."
}
}

19
docs/assessments/netkingdom-2026-10-14/warden-dependency-repair-requester-review-r1.json Normal file
View file

@ -0,0 +1,19 @@
{
"id": "CUST81-WARDEN-DEPENDENCY-REPAIR-REVIEW-R1",
"checked_at": "2026-10-15T02:27:06.677118+00:00",
"reviewer": "custodian-codex requesting-agent review",
"owner_commit": "d2cd3fa9405f0766eef67a8b0e897239d8817fb7",
"proxy_sha256": "69649bcf8979e4ed7f9104e927b458827a355c4846143367f4cd49c8b89b96da",
"scope": "Existing contained login argument normalization, exact s.token recovery, fixednonsecretfailurecategories",
"strict_allowlist": "unchanged by reviewed diff",
"new_credential_or_operation_authority": false,
"focused_tests_reported_passed": 84,
"full_suite": "unverified; notall sixinitialfailuresclassified; nofullsuitepassclaimed",
"installed": "Independently verified actual installed interpreter moduleSHA equals canonical69649bcf8979e4ed7f9104e927b458827a355c4846143367f4cd49c8b89b96da; fake s.token matcher and strictoutputrejection assertions pass withoutlogin/secretaccess",
"cause_of_founder_timeout": "unproven",
"new_login_launched": false,
"approved39artifacts": "unchanged",
"first_full_suite_failure": "tests/test_access.py::test_access_advisory_output failsline124 withREAD_ONLY_FILESYSTEM; samefailure reproduced withbaselineproxy in samefixture/environment",
"owner_publication_receipt": "warden-attended-dependency-repair-publication-r1.json",
"retry_scope": "Same approvedcommand and39artifacts, changedlocalWarden dependency reviewed; no login started byagents"
}

10
docs/netkingdom-security-architecture-review.md
View file

@ -155,10 +155,12 @@ Publication of this review exposed a concrete efficiency issue: the normal recei
## Capability establishment status
**Owner registries and local reuse-surface discovery are established; hosted establishment remains incomplete.** All 70 reviewed capabilities validate and occur exactly once in the composed local federation. The normal `plan-check` command finds Approval Engine for bound approval consumption and NetKingdom Posture Feedback for evidence expiry. The default local federation preserves unrelated sources: 99 source registrations compose 114 total capabilities without warnings. [Local verification](assessments/netkingdom-2026-10-14/verification-local.json), [normal CLI discovery](assessments/netkingdom-2026-10-14/local-discovery-receipt.json).
**All 70 reviewed capabilities are established in owner registries, local discovery and hosted reuse-surface.** The final forced hosted composition on 2026-10-15 exposes every reviewed ID exactly once, with the correct source repository, no missing IDs and no federation warnings. The hub composes 114 total capabilities from 99 sources, preserving unrelated capabilities. [Final hosted verification](assessments/netkingdom-2026-10-14/hosted-private-registration-verification-r1.json), [fresh hosted federation](assessments/netkingdom-2026-10-14/hosted-after-private-registration.json).
All 60 owner repositories have published registry-only commits with verified remote revisions. Valid stable IDs were preserved, missing entries added, the copied Secrets Engine template entry removed, malformed metadata normalized and concrete use cases and relations established. Existing unrelated staging was preserved. Maturity Engine had an unrelated unpublished local commit; its registry publication used a separate checkout based on the remote head and left that local commit untouched. [Publication receipts](assessments/netkingdom-2026-10-14/registry-publication.json), [additional providers](assessments/netkingdom-2026-10-14/supplement/registry-publication.json).
All 60 owner repositories published their registry changes with verified remote revisions. Valid stable IDs were retained, missing entries added, the copied Secrets Engine template removed and malformed metadata normalized. Each reviewed capability maps to supported use cases and conservative maturity estimates. Local native federation and normal CLI discovery also verify all reviewed IDs; existing unrelated staging and unpublished owner changes were preserved. [Provider publication](assessments/netkingdom-2026-10-14/registry-publication.json), [additional providers](assessments/netkingdom-2026-10-14/supplement/registry-publication.json), [local verification](assessments/netkingdom-2026-10-14/verification-local.json), [normal CLI discovery](assessments/netkingdom-2026-10-14/local-discovery-receipt.json).
The hosted hub currently exposes **32 of 70** reviewed capabilities after a fresh composition. **38 owner registrations remain:** 31 public indexes are ready; seven package indexes return 404 anonymously and need admitted private-source reading. The normal `reuse-surface-hub-write-token` Warden path received a PDP decision but OpenBao denied the current caller with **HTTP 403**. No registration helper ran and no hub write occurred. Repository visibility and credential policy were left intact. [Hosted readback and denial](assessments/netkingdom-2026-10-14/hosted-verification.json), [exact registration plan](assessments/netkingdom-2026-10-14/hub-registration-plan.json), [private-source gates](assessments/netkingdom-2026-10-14/hub-private-source-pending.json).
The 31 public registrations and seven private registrations passed independent full-field readback. The seven private packages use immutable source revisions and the founder's explicit metadata disclosure consent. A dedicated reader has verified code-read access to exactly those seven repositories; the hub binds its credential to fourteen exact HTTPS metadata URLs before credential lookup and rejects authenticated redirects. The hardened image, runtime source/helper hashes, ESO delivery and actual seven-index/seven-entry native fetches were verified without cache fallback. Production source declarations match the deployed image and delivery configuration. [Public verification](assessments/netkingdom-2026-10-14/hosted-public-registration-verification.json), [private registration receipts](assessments/netkingdom-2026-10-14/hub-private-registration-r1-receipts.jsonl), [native fetch proof](assessments/netkingdom-2026-10-14/private-native-fetch-verification-r1.json), [runtime verification](assessments/netkingdom-2026-10-14/phase-b-runtime-verification-r1.json), [owner execution](assessments/netkingdom-2026-10-14/phase-b-owner-execution-r1.json).
Verification also passed 23 local scenario/posture tests, 11 User Engine package tests, nine policy-package tests and Helm lint. The telemetry package rendered 93 resources successfully; its estate family check failed on the pre-existing `rapp-forgejo` declaration gap. Source hashes and report links were checked. These results establish the documentation and registry work, not native security conformance. [Check receipt](assessments/netkingdom-2026-10-14/source-test-receipt.json), [source integrity](assessments/netkingdom-2026-10-14/review-integrity.json).
The founder approved the exact supervised execution packet and its one-line writer CLI flag-order amendment. Admin custody and final member writer sessions were revoked; failed attempts remain recorded. The static reader's manual 90-day maintenance deadline is **2027-01-13 03:06:09 UTC**, tracked in RPF-WP-0058-T05; it has no automatic expiry or reminder claim. The observed incorrect-OTP return-path issue is handed off as residual CUST-IN-0018 for owner triage. [Exact execution approval](assessments/netkingdom-2026-10-14/private-reader-execution-approval-r1.json), [approved amendment](assessments/netkingdom-2026-10-14/private-reader-execution-approval-r2.json), [admin revocation](assessments/netkingdom-2026-10-14/warden-attended-custody-terminal-r1.json), [writer session receipts](assessments/netkingdom-2026-10-14/attended-private-registration-receipts.jsonl), [maintenance binding](assessments/netkingdom-2026-10-14/owner-assembly/cust81-platform-custody-maintenance-actual-binding-r1.json).
Verification passed 25 private registration/transport tests, 84 focused Warden tests, the earlier 23 scenario/posture tests, 11 User Engine package tests, nine policy-package tests and Helm lint. Broader Warden suite completion was not verified; its first observed failure reproduces on the unchanged baseline under a read-only filesystem. The telemetry package rendered 93 resources, while its estate family check retains the pre-existing rapp-forgejo declaration gap. Registry establishment does not establish whole-estate security conformance or raise the architecture's M2 integration estimate. [Source checks](assessments/netkingdom-2026-10-14/source-test-receipt.json), [dependency review](assessments/netkingdom-2026-10-14/warden-dependency-repair-requester-review-r1.json), [requirement audit](assessments/netkingdom-2026-10-14/review-requirement-audit-final-r1.json).

28
intakes.md
View file

@ -174,3 +174,31 @@ notes: >-
Do not infer new decommission/workstation-off work from that stale archive.
state_hub_intake_id: "01a073cf-51ca-7fa7-a432-658ba3718382"
```
## CUST-IN-0018 — Preserve OIDC return context after an incorrect OTP
```yaml
id: CUST-IN-0018
kind: intake
title: "Investigate OIDC return-context loss after an incorrect OTP"
status: open
lane: green
priority: medium
owner: key-cape
origin: residual
origin_ref: CUST-WP-0081
updated: "2026-10-15"
notes: >-
During the attended reuse-surface writer login, the founder reported entering
an incorrect OTP once and then landing on users.coulomb.social. The pending
Bao request timed out without a token or registration. A fresh attempt with
bernd.worsch-3 and aal2 completed the same unchanged approved transport and
registered all seven sources. This is an observed return-path issue, not a
source-confirmed defect or a request to weaken MFA. KeyCape/User Engine owners
should triage whether retry preserved the relying-party context and define a
safe synthetic reproduction. Evidence: private-writer-member-login-failures-r1.json
and attended-private-registration-receipts.jsonl under
docs/assessments/netkingdom-2026-10-14/. No OTP, authorization URL or token is
retained. Do not implement this residual until promoted.
state_hub_intake_id: "01a13da0-5178-7a12-ba2d-f6b49766af9f"
```

46
workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md
View file

@ -4,11 +4,11 @@ type: workplan
title: "Review NetKingdom architecture and establish security reuse capabilities"
domain: infotech
repo: the-custodian
status: blocked
status: finished
owner: codex
topic_slug: custodian
created: "2026-10-14"
updated: "2026-10-14"
updated: "2026-10-15"
flavor: planning
depends_on: []
state_hub_workstream_id: "e8992815-389a-5c40-8569-a2b0ee3945f0"
@ -41,11 +41,8 @@ Delivered `docs/netkingdom-security-architecture-review.md` and the linked inven
```task
id: CUST-WP-0081-T02
status: wait
status: done
priority: high
needs_human: true
blocking_reason: "Await owner-provisioned hub write access and private-source read/disclosure admission; OpenBao denied the current caller."
decision_id: "5cd22087-e5d8-5d5e-a252-610a6ac13653"
state_hub_task_id: "80b037cd-876d-53c2-9272-b1dfe0524446"
```
@ -55,19 +52,50 @@ registries and compose a deterministic federation with no missing reviewed IDs.
Verify publication and hosted discovery separately; local establishment alone
does not prove hosted federation. Preserve unrelated worktree changes.
2026-10-14: 70 owner capability entries established across 60 repositories. All source registry commits published and exact remote heads verified. Native local federation and normal plan-check discover all 70; existing unrelated sources retained. Hosted federation exposes 32/70. Thirty-eight registrations remain (31 public, seven private sources). Warden routed the write lane, but OpenBao denied caller access with 403; no helper/hub writes occurred. Private-source credentials/metadata disclosure require owner admission. User selected "Arrange scoped owner access"; provisioning remains unverified. The scoped-access-handoff.json records the exact owner requirements without secret values. Exact plan, denial and verification evidence are in the assessment directory.
2026-10-14 initial checkpoint: 70 owner capability entries established across 60 repositories. All source registry commits published and exact remote heads verified. Native local federation and normal plan-check discover all 70; existing unrelated sources retained. Hosted federation exposes 32/70. Thirty-eight registrations remain (31 public, seven private sources). At this checkpoint Warden routed the write lane but OpenBao denied the caller with 403, so no helper/hub writes occurred. Private-source credentials and metadata disclosure still required owner admission. User selected "Arrange scoped owner access"; the scoped-access-handoff.json records exact requirements without secret values. The later continuation below supersedes the writer-access status and records the remaining publication gates.
2026-10-14 continuation: Fresh hosted GET still composes 76 records from 61 sources, with 32/70 reviewed IDs present and no reviewed duplicates. Owner-approved CCR-2026-0044 provisions the dedicated `reuse-surface-hub-writer-workload-kv-read` role; member and non-member receipts pass, and ops-warden's route names that role. Custodian independently reverified ops-mason's changed capability and index at immutable commit `100558696f55e411849164c70aa9877fb4653037` and current main `92907919cdef6f644607e431eb61e0bdb10f1214`; exact byte hashes match. A supplemental source receipt preserves the original `6434877a44e20396dc85652ad22a55f0a89d16d0` record. The full publication verifier now has no public-source errors; its seven private-source HTTP errors are expected anonymous denials. The bounded public helper passes all 31 source checks and reports 31 `would_create` actions with no conflicts; no hub writes have occurred. Public registration now awaits the founder's attended scoped OIDC session. The seven private sources still require a separate reader and source-owner disclosure approvals. Asked railiance-platform to coordinate those approvals and restricted reader (State Hub message `14d94a0b-47e5-498b-a8f6-71bb2a607248`); requested exact-metadata disclosure decisions from rapp-openbao (`38896e49-a185-438f-8fc0-d6e983776458`), rapp-policy-nexus (`a7f4a4a0-bcfb-4746-b792-4b83af983bdc`), rapp-postgres (`66808aa0-b44f-4d3a-9d8e-850ceafc8a28`), rapp-sbom-nexus (`9f96a232-31b3-41f7-a7af-bbac90620315`), rapp-telemetry (`032e293d-142b-4ed1-9914-680058fdabbc`), rapp-tenant-engine (`b1703727-d658-4327-9932-0a4911b4d399`), and rapp-user-engine (`d55ba533-9073-4d48-89d4-b446b3c7504d`). Notified ops-mason that no owner refresh is needed (message `2612c440-4bc6-4f23-812f-ef5ffcdf6b9d`). Evidence is in `docs/assessments/netkingdom-2026-10-14/supplement/registry-publication.json`, `published-source-verification.json`, `publication-preflight.json`, `hosted-before-federated.json`, and `hub-public-resume-receipts.jsonl`.
2026-10-15: Verified the live KeyCape image update in KEY-WP-0041; the optional diagnosis page flag remains pending. Rechecked the public preflight successfully and prepared `attended_public_registration.py` to use ops-mason's named-role login contract, a new Windows Firefox private profile, an in-memory scoped token, the unchanged public registration helper and final self-revocation. Launched the attended login; it timed out before a token was obtained. No Warden or hub write execution occurred. Preserved the failed authentication receipt in `attended-public-registration-receipts.jsonl`. Corrected earlier supervision scoring that inferred exact-revision approval from broad task authorization; the action remains authorized by the user's task, unscored and not executed. The full goal remains incomplete pending attended login and the private source gates.
2026-10-15 public registration completion: User requested a retry after Firefox's update. The fresh-profile OIDC login succeeded for member entity `c204099b-cb94-363f-e207-5ff4d4aa6e94`, with exactly `workload-kv-read-reuse-surface-runtime` and a bounded lifetime. Warden executed public proposal R1 without modifying its plan/helper. Attempt `64044e01-2f96-4e63-bbba-ad53b1617f0c` records 31 POST intents, 31 applied registrations and a verified readback. The scoped login token was revoked. Forced hosted composition exposes all 63 reviewed public capabilities exactly once, with exactly the seven private package IDs missing. Evidence: `hosted-public-registration-verification.json` and `hosted-after-public-registration.json`. T02 and T03 remain wait for the seven private source admissions; the full objective is not achieved.
2026-10-15 private-source handoff: Prepared `private-source-disclosure-proposal-r1.json` (SHA256 `46ac4fe49a08054cc215aade2fbaf3b36ee334520997857ed84f530b52da9d35`) with exact index/entry hashes for the seven sources. Each local committed revision matches the published remote main; source-owner consent and native hub fetches are explicitly pending. Owner/platform review message receipts are in `private-source-review-handoff-receipts.json`. This packet is a review proposal, not a disclosure approval or credential grant.
2026-10-15 source-owner consent: Bernd Worsch explicitly approved public disclosure under `CUST81-PRIVATE-METADATA-DISCLOSURE-R1` as owner of all seven repositories. The reviewed packet remains unchanged at SHA256 `46ac4fe49a08054cc215aade2fbaf3b36ee334520997857ed84f530b52da9d35`. Separate receipt `private-source-owner-consent-r1.json` records the verbatim approval, all seven sources and resolved State Hub decision `d8f8f216-ac94-4295-97f3-825fd21254ea`. Consent was delivered to all seven source agents and railiance-platform; delivery IDs are in that receipt. Metadata consent is satisfied. Independent technical reviews are not inferred; restricted-reader provisioning, native hub fetches and the seven registrations remain pending. This consent does not approve credential provisioning, a rollout or repository visibility changes.
2026-10-15 reader preparation: Freshly reverified the approved committed index/entry bytes and remote main for all seven private sources (`private-source-consented-revision-preflight.json`). Forced native hosted composition remains 63/70 with no reviewed duplicates (`hosted-owner-consent-verification.json`). Prepared seven immutable-commit raw API registration requests in `hub-private-registration-preparation-r1.json`; they are not executable until confirmed auth_env/native fetch receipts are bound. Worker prepared concrete `private-reader-provisioning-preparation-r1.json` (SHA256 `7819eb51d249f5c7aff4df9fb520afcfb76603b05a4104439499102b6c20af99`), reusing the existing ESO identity/store/envFrom with a separate reader KV path and exact seven-repository Forgejo team. Verified all referenced source hashes and sent the exact artifact to platform, ops-mason and reuse-surface; IDs in `private-reader-preparation-handoff-receipts.json`. No existing reader CCR or live owner TAMQ worker was found; platform owner CCR/script/reviews and exact credential/rollout authorization remain required. Public disclosure is already approved.
2026-10-15 independent owner assembly: No related owner inbox response, reader CCR or live TAMQ endpoint existed. Started separate supervised local workers in isolated platform, ops-mason and reuse-surface checkouts under the user’s explicit worker-agent request. Their live assignment handles and base commits are in `private-reader-owner-assembly-receipt.json`. They prepare their own work items and review only their own owner roles; no live credential or deployment authority is inferred. Reuse worker found native urllib authenticated redirect forwarding and is preparing its owner fix/tests. A verified fixed hub image is required before new reader delivery; the earlier same-image proposal assumption is superseded. Platform CCR/bootstrap and mason SEC-DSM construction preparation are actually running; allocation IDs remain provisional.
2026-10-15 owner preparation validation: Retained platform bootstrap/CCR patch (17 mocked tests passed, independently repeated by custodian), mason same-proposal revision2 construction patch (R1 preserved), and reuse native fixes/verification patch (227 tests passed in task-owned60-index/39-cache fixture; both earlier environment failures retained). Source authorization now checks exact runtime-controlled environment-to-URL mapping before credential lookup, rejects authenticated HTTP/redirects; native verifier checks exact seven index+entry hashes directly without cache fallback. Root confirmed both owner allowlists represent exactly14 consented pinned URLs. Snapshots and stable digests are in `owner-assembly/` and `private-reader-owner-assembly-validation.json`. Separate supervised apps and Forgejo owner workers are running in isolated owner checkouts for rollout configuration and target API/Q1–Q3 review. No integration, live credential or deployment is approved or executed; hosted remains63/70.
2026-10-15 source/image publication: Reviewed native consumer fixes are published in reuse-surface at `d36fc463bc3d4752ec87a176ac900eb3b4be1cc8`; platform bootstrap and scoped ESO policy preparation at `6e8955fcd09b278a6f16c14beffd076b72d10c95`; independent Forge owner review at `62fdc8b1721c0845181818649375cef2a0057f20`. Normal owner projection receipts are retained. Hardened image `forgejo.coulomb.social/coulomb/reuse-surface:cust81-private-reader-r1` is published and registry digest independently verified as `sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0`; network-disabled/read-only container smoke passed. Apps local source publication was rejected by the normal secret scanner on its reviewed hash manifest; Mason normal sync refused an unrelated historical task identity. Workers are investigating bounded remedies without bypass. Publication status and exact receipts are in `private-reader-publication-state-r1.json`. Actual ready hub still runs the earlier image; no reader or live rollout executed. Attended execution commands and full-chart dry-run/recovery preparation remain before the exact founder execution proposal. Metadata consent remains satisfied; hosted63/70.
2026-10-15 exact execution proposal ready: `private-reader-execution-proposal-r1.json`, ID `CUST81-PRIVATE-READER-EXECUTION-R1`, revision1, SHA256 `704a9c932202fc14456652ea4dfdb3acb8b1db0ab3bbf5fff50e92b2c517c380`, binds39 exact artifacts. Published platform runner and independent Forge review include both fixed policy-race findings (45tests); apps phaseA/phaseB fullserverdryrun and semanticdiff pass, backupintegrity and revision10recovery verified. Private registration/helper runtimeOCI-membership refinement passes14tests and attended writer transport11tests; prior revisions/failures retained. Source-authoritative manual maintenance task RPF-WP-0058-T05 (`f0780e75-b0bd-5bf5-b926-c8413abb885c`) exists; planneddate2027-01-13 must bind actualactivation+90 beforedelivery; hub structureddate-null cachelimitation does not claim automaticreminders. The exact supervised packet covers hardenedrollout before reader, separate7repositorycode-read custody, oneESOitem, native14fileproof, sevenregistrations, strictfuture-proof receipt derivation and conditional dedicatedPATrecovery only. No metadata approval is requested again; no livechange or credential executed. Await actual founder disposition under environmentorientation§4/agentautonomydecision.
2026-10-15 approved live phaseA: Founder explicitly approved exact execution revision1 SHA256 `704a9c932202fc14456652ea4dfdb3acb8b1db0ab3bbf5fff50e92b2c517c380`; resolved decision `9833715e-a22a-45c0-ab6c-881f0f4f1a0e` and separate approval receipt retained. Fresh target/headroom/zeroauth/no-reader/currentrevision10/backup/serverdryrun checks passed. Root initial freshdiff omittednamespace and stopped beforeapply; corrected explicitreuse target yields onlyimage/exact14URL/generation change; originalownerpreflight hadcorrectnamespace. Exact approvedarchiveSHAverified onnode and atomicHelmupgrade succeeded. ActualreadyPod `reuse-surface-7d9bcb97b7-drgkn`, UID `cdd856a2-d833-466a-97c6-14a6e7f3b639`, runs approved image2364, actualnative hashesdbaa/c67 and exact14allowlist; prelookup refusal and same/cross-origin redirect checks pass. Freshhostedcomposition `2026-10-15T00:17:38+00:00` preserves63publicIDs exactonce. No readercredential available. Apps declared the approvedeffects in normal productionvalues and published `91f828b3c167c72ab9a0cec1263467345a7ab63c`; normalreapply cannotrestoreoldimage accidentally. Await actual founder attended OpenBao/MFA command; approval remainsvalid, no newpermission requested. Exactroutine sourcecounterpart and verificationrefinement are retained; fullproposal outcome remainsunverified until70.
2026-10-15 attended login failure: Founder executed approved wrapper; exit10 after121.2892seconds reports nonallowlistedloginoutput, failclosed beforecommandhandoff and revocationunconfirmed. Neither custodyreceipt exists. Wardenowner audit identifies two loginfailed events and initialized freshFirefoxprofiles at02:08:19Z/02:09:28Z; founder reports browser allfine. Browserlaunch is therefore established; finer callback/auth cause is not. InstalledBao2.5.5 source confirms `.vault-token` is correct, Warden appendsformatflag afterrole authdata, and recoverymatcher omits estate s. tokenprefix. Subsequent Bao main.go source proves globalformat scanning honors that trailingflag, so reordering is defensive rather than a proven functional defect. Neither finding establishes the121secondfailurecause. Wardenowner prepares narrow flags/recovery/fixederror-category sourcefix without outputallowlist relaxation; platformowner correlates captured/discarded serverlogs. Actualprivatehelper wasnotread; possibleadminsessionrevocation remainsunconfirmed. Rootreverified all39 approvedartifacts unchanged. Currentresume is progress with freshblocked audit; approval9833715e remainsvalid, no reader or privatewrites executed. Evidence `attended-custody-login-failure-r1.json`.
2026-10-15 bounded dependency repair published: ops-warden `d2cd3fa9405f0766eef67a8b0e897239d8817fb7` normalprimary/remoteverified and documentedlocalwheelinstallation complete. ActualinstalledproxySHA `69649bcf8979e4ed7f9104e927b458827a355c4846143367f4cd49c8b89b96da` independentlymatchescanonical; fakeestate s.token recovery and strictoutputrejection smoke pass withoutlogin/secretaccess. Eighty-four focusedproxytests/Ruff pass. Fullsuiteunverified, lastobservedsixfailures; first `tests/test_access.py::test_access_advisory_output` line124 reproducesunchangedbaseline withREAD_ONLY_FILESYSTEM, so thatfailureisnotcausedbyrepair. No broadergreenclaimed. Fixednonsecretcategories permit diagnosing next actualfailedlogin; original121secondcause remainsunknown. Existing39boundartifacts allstillmatch; actualfounderretryusesexistingcommand andapproval. Publication/review/failureclassification receipts retained. No newlogin, reader, orprivatewrites occurred.
2026-10-15 attended retry after dependency repair: Founder command exited10 after121.1726seconds with category `callback_timeout`, client_exit2, helper_presentFalse, stdout_allowedTrue and stderr_allowedFalse. Provisioning never started. This establishes callback timeout but not its underlying cause. Warden and platform owners are testing Windows-to-WSL loopback transport without OIDC credentials. Source role and KeyCape client both list CLI callback addresses. The first sandbox probe hit WSL interop denial; an elevated HTTP probe returned but its body comparison was inconclusive. Neither is represented as proof of callback failure. R2 receipt preserves this attempt; existing approval remains valid and resumed impasse count resets on new diagnostic progress.
2026-10-15 custody and phaseB verified: Founder separate-terminal execution succeeded, both custody/bootstrap terminal receipts verified and Warden exit0 confirms selfrevocation. Root checks38original artifacts unchanged plus exact approved CCR successor23039. Platform2951b69 binds actual activation2026-10-15T03:06:09.579844Z to manual maintenance2027-01-13T03:06:09.579844Z, source/index verified. Apps2b9f030 publishes approved onefield ES replacement; actual ESOReady/presence/restart and samepod native7indexes+7entries verified at03:12:46Z withoutcache. Ready Podreuse-surface-77c8c476f4-qs8mf UID4693401c-c97f-422f-a7d3-af8d0411ef5d runs approved image/source/helper/14URL config. Derived registration approval under originalconditional authority passed exactgates. Actual writer attempt4b8c8ddc failedbeforebrowser/login/registration: isolatedclosedport Bao reproduction proves trailing -no-store is malformed authdata. Preserved originalapproved helper, prepared one-line flagorder correction SHA1ec34b8cded859845dc29cedf55ff02fa4881bd4d6a3a264879efd5b3e706c88 and 25tests pass. Exact same-trial revision2 c8fa74ad6648af1c884a4c607e100097f917761af5d3a6e0c5e8ce9a53b809dc pending founderreview per supervisionrule; no modified writer execution yet. Existing preparations/failedattempts remainvisible, no promotioncredit.
## Audit coverage and record the result
```task
id: CUST-WP-0081-T03
status: wait
status: done
priority: high
depends_on: [CUST-WP-0081-T02]
blocking_reason: "Final coverage audit requires all reviewed capabilities established in hosted reuse-surface."
state_hub_task_id: "9bccb18e-0501-5319-a18c-f1fb36312cb7"
```
Check every inventory capability against its source, use cases, maturity and
registry entry. Verify actual federation coverage and report any unresolved
publication gate. Log progress and run statehub fix-consistency.
2026-10-15 final closure: Founder approved exact revision2 c8fa74ad6648af1c884a4c607e100097f917761af5d3a6e0c5e8ce9a53b809dc via resolved decision9f496e68. Corrected writer transport1ec34b8 was executed under that revision; its inherited journal revision=1 denotes transport schema, not the approved proposal revision (approval SHA binds actual revision2 receipt). Group-claim refusal and incorrect-OTP return-path attempt remain failed evidence. Actual member c204099b completed the final attempt8f23bb90; seven POST201 outcomes and fullSQLreadback verified, scoped selfrevocationTrue. Forced fresh hosted composition03:31:48Z proves all70reviewed IDs exactlyonce, correctsource, zero warnings; 114total capabilities/99sources. Documentation requirement audit verifies60provider repos/70entries/14usecases/SWOT/maturity/12ranked suggestions and no brokenlocal links. Handoff before closure: residual CUST-IN-0018 records incorrectOTPreturncontext ownertriage; manual90daymaintenance remains live RPF-WP-0058-T05. No residual implemented. Final review and completion audit updated; allthree tasks done.