Complete NetKingdom review and verify all 70 hosted capabilities
This commit is contained in:
codex
parent
0e7bcd128b
commit
924a2d155e
30 changed files with 5100 additions and 26 deletions
|
|
@ -4,11 +4,11 @@ type: workplan
|
|||
title: "Review NetKingdom architecture and establish security reuse capabilities"
|
||||
domain: infotech
|
||||
repo: the-custodian
|
||||
status: blocked
|
||||
status: finished
|
||||
owner: codex
|
||||
topic_slug: custodian
|
||||
created: "2026-10-14"
|
||||
updated: "2026-10-14"
|
||||
updated: "2026-10-15"
|
||||
flavor: planning
|
||||
depends_on: []
|
||||
state_hub_workstream_id: "e8992815-389a-5c40-8569-a2b0ee3945f0"
|
||||
|
|
@ -41,11 +41,8 @@ Delivered `docs/netkingdom-security-architecture-review.md` and the linked inven
|
|||
|
||||
```task
|
||||
id: CUST-WP-0081-T02
|
||||
status: wait
|
||||
status: done
|
||||
priority: high
|
||||
needs_human: true
|
||||
blocking_reason: "Await owner-provisioned hub write access and private-source read/disclosure admission; OpenBao denied the current caller."
|
||||
decision_id: "5cd22087-e5d8-5d5e-a252-610a6ac13653"
|
||||
state_hub_task_id: "80b037cd-876d-53c2-9272-b1dfe0524446"
|
||||
```
|
||||
|
||||
|
|
@ -55,19 +52,50 @@ registries and compose a deterministic federation with no missing reviewed IDs.
|
|||
Verify publication and hosted discovery separately; local establishment alone
|
||||
does not prove hosted federation. Preserve unrelated worktree changes.
|
||||
|
||||
2026-10-14: 70 owner capability entries established across 60 repositories. All source registry commits published and exact remote heads verified. Native local federation and normal plan-check discover all 70; existing unrelated sources retained. Hosted federation exposes 32/70. Thirty-eight registrations remain (31 public, seven private sources). Warden routed the write lane, but OpenBao denied caller access with 403; no helper/hub writes occurred. Private-source credentials/metadata disclosure require owner admission. User selected "Arrange scoped owner access"; provisioning remains unverified. The scoped-access-handoff.json records the exact owner requirements without secret values. Exact plan, denial and verification evidence are in the assessment directory.
|
||||
2026-10-14 initial checkpoint: 70 owner capability entries established across 60 repositories. All source registry commits published and exact remote heads verified. Native local federation and normal plan-check discover all 70; existing unrelated sources retained. Hosted federation exposes 32/70. Thirty-eight registrations remain (31 public, seven private sources). At this checkpoint Warden routed the write lane but OpenBao denied the caller with 403, so no helper/hub writes occurred. Private-source credentials and metadata disclosure still required owner admission. User selected "Arrange scoped owner access"; the scoped-access-handoff.json records exact requirements without secret values. The later continuation below supersedes the writer-access status and records the remaining publication gates.
|
||||
|
||||
2026-10-14 continuation: Fresh hosted GET still composes 76 records from 61 sources, with 32/70 reviewed IDs present and no reviewed duplicates. Owner-approved CCR-2026-0044 provisions the dedicated `reuse-surface-hub-writer-workload-kv-read` role; member and non-member receipts pass, and ops-warden's route names that role. Custodian independently reverified ops-mason's changed capability and index at immutable commit `100558696f55e411849164c70aa9877fb4653037` and current main `92907919cdef6f644607e431eb61e0bdb10f1214`; exact byte hashes match. A supplemental source receipt preserves the original `6434877a44e20396dc85652ad22a55f0a89d16d0` record. The full publication verifier now has no public-source errors; its seven private-source HTTP errors are expected anonymous denials. The bounded public helper passes all 31 source checks and reports 31 `would_create` actions with no conflicts; no hub writes have occurred. Public registration now awaits the founder's attended scoped OIDC session. The seven private sources still require a separate reader and source-owner disclosure approvals. Asked railiance-platform to coordinate those approvals and restricted reader (State Hub message `14d94a0b-47e5-498b-a8f6-71bb2a607248`); requested exact-metadata disclosure decisions from rapp-openbao (`38896e49-a185-438f-8fc0-d6e983776458`), rapp-policy-nexus (`a7f4a4a0-bcfb-4746-b792-4b83af983bdc`), rapp-postgres (`66808aa0-b44f-4d3a-9d8e-850ceafc8a28`), rapp-sbom-nexus (`9f96a232-31b3-41f7-a7af-bbac90620315`), rapp-telemetry (`032e293d-142b-4ed1-9914-680058fdabbc`), rapp-tenant-engine (`b1703727-d658-4327-9932-0a4911b4d399`), and rapp-user-engine (`d55ba533-9073-4d48-89d4-b446b3c7504d`). Notified ops-mason that no owner refresh is needed (message `2612c440-4bc6-4f23-812f-ef5ffcdf6b9d`). Evidence is in `docs/assessments/netkingdom-2026-10-14/supplement/registry-publication.json`, `published-source-verification.json`, `publication-preflight.json`, `hosted-before-federated.json`, and `hub-public-resume-receipts.jsonl`.
|
||||
|
||||
2026-10-15: Verified the live KeyCape image update in KEY-WP-0041; the optional diagnosis page flag remains pending. Rechecked the public preflight successfully and prepared `attended_public_registration.py` to use ops-mason's named-role login contract, a new Windows Firefox private profile, an in-memory scoped token, the unchanged public registration helper and final self-revocation. Launched the attended login; it timed out before a token was obtained. No Warden or hub write execution occurred. Preserved the failed authentication receipt in `attended-public-registration-receipts.jsonl`. Corrected earlier supervision scoring that inferred exact-revision approval from broad task authorization; the action remains authorized by the user's task, unscored and not executed. The full goal remains incomplete pending attended login and the private source gates.
|
||||
|
||||
2026-10-15 public registration completion: User requested a retry after Firefox's update. The fresh-profile OIDC login succeeded for member entity `c204099b-cb94-363f-e207-5ff4d4aa6e94`, with exactly `workload-kv-read-reuse-surface-runtime` and a bounded lifetime. Warden executed public proposal R1 without modifying its plan/helper. Attempt `64044e01-2f96-4e63-bbba-ad53b1617f0c` records 31 POST intents, 31 applied registrations and a verified readback. The scoped login token was revoked. Forced hosted composition exposes all 63 reviewed public capabilities exactly once, with exactly the seven private package IDs missing. Evidence: `hosted-public-registration-verification.json` and `hosted-after-public-registration.json`. T02 and T03 remain wait for the seven private source admissions; the full objective is not achieved.
|
||||
|
||||
2026-10-15 private-source handoff: Prepared `private-source-disclosure-proposal-r1.json` (SHA256 `46ac4fe49a08054cc215aade2fbaf3b36ee334520997857ed84f530b52da9d35`) with exact index/entry hashes for the seven sources. Each local committed revision matches the published remote main; source-owner consent and native hub fetches are explicitly pending. Owner/platform review message receipts are in `private-source-review-handoff-receipts.json`. This packet is a review proposal, not a disclosure approval or credential grant.
|
||||
|
||||
2026-10-15 source-owner consent: Bernd Worsch explicitly approved public disclosure under `CUST81-PRIVATE-METADATA-DISCLOSURE-R1` as owner of all seven repositories. The reviewed packet remains unchanged at SHA256 `46ac4fe49a08054cc215aade2fbaf3b36ee334520997857ed84f530b52da9d35`. Separate receipt `private-source-owner-consent-r1.json` records the verbatim approval, all seven sources and resolved State Hub decision `d8f8f216-ac94-4295-97f3-825fd21254ea`. Consent was delivered to all seven source agents and railiance-platform; delivery IDs are in that receipt. Metadata consent is satisfied. Independent technical reviews are not inferred; restricted-reader provisioning, native hub fetches and the seven registrations remain pending. This consent does not approve credential provisioning, a rollout or repository visibility changes.
|
||||
|
||||
2026-10-15 reader preparation: Freshly reverified the approved committed index/entry bytes and remote main for all seven private sources (`private-source-consented-revision-preflight.json`). Forced native hosted composition remains 63/70 with no reviewed duplicates (`hosted-owner-consent-verification.json`). Prepared seven immutable-commit raw API registration requests in `hub-private-registration-preparation-r1.json`; they are not executable until confirmed auth_env/native fetch receipts are bound. Worker prepared concrete `private-reader-provisioning-preparation-r1.json` (SHA256 `7819eb51d249f5c7aff4df9fb520afcfb76603b05a4104439499102b6c20af99`), reusing the existing ESO identity/store/envFrom with a separate reader KV path and exact seven-repository Forgejo team. Verified all referenced source hashes and sent the exact artifact to platform, ops-mason and reuse-surface; IDs in `private-reader-preparation-handoff-receipts.json`. No existing reader CCR or live owner TAMQ worker was found; platform owner CCR/script/reviews and exact credential/rollout authorization remain required. Public disclosure is already approved.
|
||||
|
||||
2026-10-15 independent owner assembly: No related owner inbox response, reader CCR or live TAMQ endpoint existed. Started separate supervised local workers in isolated platform, ops-mason and reuse-surface checkouts under the user’s explicit worker-agent request. Their live assignment handles and base commits are in `private-reader-owner-assembly-receipt.json`. They prepare their own work items and review only their own owner roles; no live credential or deployment authority is inferred. Reuse worker found native urllib authenticated redirect forwarding and is preparing its owner fix/tests. A verified fixed hub image is required before new reader delivery; the earlier same-image proposal assumption is superseded. Platform CCR/bootstrap and mason SEC-DSM construction preparation are actually running; allocation IDs remain provisional.
|
||||
|
||||
2026-10-15 owner preparation validation: Retained platform bootstrap/CCR patch (17 mocked tests passed, independently repeated by custodian), mason same-proposal revision2 construction patch (R1 preserved), and reuse native fixes/verification patch (227 tests passed in task-owned60-index/39-cache fixture; both earlier environment failures retained). Source authorization now checks exact runtime-controlled environment-to-URL mapping before credential lookup, rejects authenticated HTTP/redirects; native verifier checks exact seven index+entry hashes directly without cache fallback. Root confirmed both owner allowlists represent exactly14 consented pinned URLs. Snapshots and stable digests are in `owner-assembly/` and `private-reader-owner-assembly-validation.json`. Separate supervised apps and Forgejo owner workers are running in isolated owner checkouts for rollout configuration and target API/Q1–Q3 review. No integration, live credential or deployment is approved or executed; hosted remains63/70.
|
||||
|
||||
2026-10-15 source/image publication: Reviewed native consumer fixes are published in reuse-surface at `d36fc463bc3d4752ec87a176ac900eb3b4be1cc8`; platform bootstrap and scoped ESO policy preparation at `6e8955fcd09b278a6f16c14beffd076b72d10c95`; independent Forge owner review at `62fdc8b1721c0845181818649375cef2a0057f20`. Normal owner projection receipts are retained. Hardened image `forgejo.coulomb.social/coulomb/reuse-surface:cust81-private-reader-r1` is published and registry digest independently verified as `sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0`; network-disabled/read-only container smoke passed. Apps local source publication was rejected by the normal secret scanner on its reviewed hash manifest; Mason normal sync refused an unrelated historical task identity. Workers are investigating bounded remedies without bypass. Publication status and exact receipts are in `private-reader-publication-state-r1.json`. Actual ready hub still runs the earlier image; no reader or live rollout executed. Attended execution commands and full-chart dry-run/recovery preparation remain before the exact founder execution proposal. Metadata consent remains satisfied; hosted63/70.
|
||||
|
||||
2026-10-15 exact execution proposal ready: `private-reader-execution-proposal-r1.json`, ID `CUST81-PRIVATE-READER-EXECUTION-R1`, revision1, SHA256 `704a9c932202fc14456652ea4dfdb3acb8b1db0ab3bbf5fff50e92b2c517c380`, binds39 exact artifacts. Published platform runner and independent Forge review include both fixed policy-race findings (45tests); apps phaseA/phaseB fullserverdryrun and semanticdiff pass, backupintegrity and revision10recovery verified. Private registration/helper runtimeOCI-membership refinement passes14tests and attended writer transport11tests; prior revisions/failures retained. Source-authoritative manual maintenance task RPF-WP-0058-T05 (`f0780e75-b0bd-5bf5-b926-c8413abb885c`) exists; planneddate2027-01-13 must bind actualactivation+90 beforedelivery; hub structureddate-null cachelimitation does not claim automaticreminders. The exact supervised packet covers hardenedrollout before reader, separate7repositorycode-read custody, oneESOitem, native14fileproof, sevenregistrations, strictfuture-proof receipt derivation and conditional dedicatedPATrecovery only. No metadata approval is requested again; no livechange or credential executed. Await actual founder disposition under environmentorientation§4/agentautonomydecision.
|
||||
|
||||
2026-10-15 approved live phaseA: Founder explicitly approved exact execution revision1 SHA256 `704a9c932202fc14456652ea4dfdb3acb8b1db0ab3bbf5fff50e92b2c517c380`; resolved decision `9833715e-a22a-45c0-ab6c-881f0f4f1a0e` and separate approval receipt retained. Fresh target/headroom/zeroauth/no-reader/currentrevision10/backup/serverdryrun checks passed. Root initial freshdiff omittednamespace and stopped beforeapply; corrected explicitreuse target yields onlyimage/exact14URL/generation change; originalownerpreflight hadcorrectnamespace. Exact approvedarchiveSHAverified onnode and atomicHelmupgrade succeeded. ActualreadyPod `reuse-surface-7d9bcb97b7-drgkn`, UID `cdd856a2-d833-466a-97c6-14a6e7f3b639`, runs approved image2364, actualnative hashesdbaa/c67 and exact14allowlist; prelookup refusal and same/cross-origin redirect checks pass. Freshhostedcomposition `2026-10-15T00:17:38+00:00` preserves63publicIDs exactonce. No readercredential available. Apps declared the approvedeffects in normal productionvalues and published `91f828b3c167c72ab9a0cec1263467345a7ab63c`; normalreapply cannotrestoreoldimage accidentally. Await actual founder attended OpenBao/MFA command; approval remainsvalid, no newpermission requested. Exactroutine sourcecounterpart and verificationrefinement are retained; fullproposal outcome remainsunverified until70.
|
||||
|
||||
2026-10-15 attended login failure: Founder executed approved wrapper; exit10 after121.2892seconds reports nonallowlistedloginoutput, failclosed beforecommandhandoff and revocationunconfirmed. Neither custodyreceipt exists. Wardenowner audit identifies two loginfailed events and initialized freshFirefoxprofiles at02:08:19Z/02:09:28Z; founder reports browser allfine. Browserlaunch is therefore established; finer callback/auth cause is not. InstalledBao2.5.5 source confirms `.vault-token` is correct, Warden appendsformatflag afterrole authdata, and recoverymatcher omits estate s. tokenprefix. Subsequent Bao main.go source proves globalformat scanning honors that trailingflag, so reordering is defensive rather than a proven functional defect. Neither finding establishes the121secondfailurecause. Wardenowner prepares narrow flags/recovery/fixederror-category sourcefix without outputallowlist relaxation; platformowner correlates captured/discarded serverlogs. Actualprivatehelper wasnotread; possibleadminsessionrevocation remainsunconfirmed. Rootreverified all39 approvedartifacts unchanged. Currentresume is progress with freshblocked audit; approval9833715e remainsvalid, no reader or privatewrites executed. Evidence `attended-custody-login-failure-r1.json`.
|
||||
|
||||
2026-10-15 bounded dependency repair published: ops-warden `d2cd3fa9405f0766eef67a8b0e897239d8817fb7` normalprimary/remoteverified and documentedlocalwheelinstallation complete. ActualinstalledproxySHA `69649bcf8979e4ed7f9104e927b458827a355c4846143367f4cd49c8b89b96da` independentlymatchescanonical; fakeestate s.token recovery and strictoutputrejection smoke pass withoutlogin/secretaccess. Eighty-four focusedproxytests/Ruff pass. Fullsuiteunverified, lastobservedsixfailures; first `tests/test_access.py::test_access_advisory_output` line124 reproducesunchangedbaseline withREAD_ONLY_FILESYSTEM, so thatfailureisnotcausedbyrepair. No broadergreenclaimed. Fixednonsecretcategories permit diagnosing next actualfailedlogin; original121secondcause remainsunknown. Existing39boundartifacts allstillmatch; actualfounderretryusesexistingcommand andapproval. Publication/review/failureclassification receipts retained. No newlogin, reader, orprivatewrites occurred.
|
||||
|
||||
2026-10-15 attended retry after dependency repair: Founder command exited10 after121.1726seconds with category `callback_timeout`, client_exit2, helper_presentFalse, stdout_allowedTrue and stderr_allowedFalse. Provisioning never started. This establishes callback timeout but not its underlying cause. Warden and platform owners are testing Windows-to-WSL loopback transport without OIDC credentials. Source role and KeyCape client both list CLI callback addresses. The first sandbox probe hit WSL interop denial; an elevated HTTP probe returned but its body comparison was inconclusive. Neither is represented as proof of callback failure. R2 receipt preserves this attempt; existing approval remains valid and resumed impasse count resets on new diagnostic progress.
|
||||
|
||||
2026-10-15 custody and phaseB verified: Founder separate-terminal execution succeeded, both custody/bootstrap terminal receipts verified and Warden exit0 confirms selfrevocation. Root checks38original artifacts unchanged plus exact approved CCR successor23039. Platform2951b69 binds actual activation2026-10-15T03:06:09.579844Z to manual maintenance2027-01-13T03:06:09.579844Z, source/index verified. Apps2b9f030 publishes approved onefield ES replacement; actual ESOReady/presence/restart and samepod native7indexes+7entries verified at03:12:46Z withoutcache. Ready Podreuse-surface-77c8c476f4-qs8mf UID4693401c-c97f-422f-a7d3-af8d0411ef5d runs approved image/source/helper/14URL config. Derived registration approval under originalconditional authority passed exactgates. Actual writer attempt4b8c8ddc failedbeforebrowser/login/registration: isolatedclosedport Bao reproduction proves trailing -no-store is malformed authdata. Preserved originalapproved helper, prepared one-line flagorder correction SHA1ec34b8cded859845dc29cedf55ff02fa4881bd4d6a3a264879efd5b3e706c88 and 25tests pass. Exact same-trial revision2 c8fa74ad6648af1c884a4c607e100097f917761af5d3a6e0c5e8ce9a53b809dc pending founderreview per supervisionrule; no modified writer execution yet. Existing preparations/failedattempts remainvisible, no promotioncredit.
|
||||
|
||||
## Audit coverage and record the result
|
||||
|
||||
```task
|
||||
id: CUST-WP-0081-T03
|
||||
status: wait
|
||||
status: done
|
||||
priority: high
|
||||
depends_on: [CUST-WP-0081-T02]
|
||||
blocking_reason: "Final coverage audit requires all reviewed capabilities established in hosted reuse-surface."
|
||||
state_hub_task_id: "9bccb18e-0501-5319-a18c-f1fb36312cb7"
|
||||
```
|
||||
|
||||
Check every inventory capability against its source, use cases, maturity and
|
||||
registry entry. Verify actual federation coverage and report any unresolved
|
||||
publication gate. Log progress and run statehub fix-consistency.
|
||||
|
||||
2026-10-15 final closure: Founder approved exact revision2 c8fa74ad6648af1c884a4c607e100097f917761af5d3a6e0c5e8ce9a53b809dc via resolved decision9f496e68. Corrected writer transport1ec34b8 was executed under that revision; its inherited journal revision=1 denotes transport schema, not the approved proposal revision (approval SHA binds actual revision2 receipt). Group-claim refusal and incorrect-OTP return-path attempt remain failed evidence. Actual member c204099b completed the final attempt8f23bb90; seven POST201 outcomes and fullSQLreadback verified, scoped selfrevocationTrue. Forced fresh hosted composition03:31:48Z proves all70reviewed IDs exactlyonce, correctsource, zero warnings; 114total capabilities/99sources. Documentation requirement audit verifies60provider repos/70entries/14usecases/SWOT/maturity/12ranked suggestions and no brokenlocal links. Handoff before closure: residual CUST-IN-0018 records incorrectOTPreturncontext ownertriage; manual90daymaintenance remains live RPF-WP-0058-T05. No residual implemented. Final review and completion audit updated; allthree tasks done.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue