From 935aed2bcb2db3b2213c4de0489eb59658fa7c6c Mon Sep 17 00:00:00 2001 From: codex Date: Sat, 17 Oct 2026 22:32:03 +0200 Subject: [PATCH] Record reviewed case source evidence (3/13) --- .../candidate.patch | 243 +++++ .../nk48-catalog-fixture-update-r1/edit.py | 46 + .../implementation-r1.json | 75 ++ .../nk48-catalog-fixture-update-r1/run.py | 8 + .../test_runner.py | 18 + .../canonical-validation.json | 15 + .../consistency.json | 365 +++++++ .../consistency.stderr.txt | 1 + .../projection.json | 989 ++++++++++++++++++ .../projection.stderr.txt | 0 .../publication-commit.json | 29 + .../publication-inputs.final.json | 27 + .../publication-inputs.json | 176 ++++ .../run_validation.py | 73 ++ .../validation-child.py | 43 + .../validation-guard.py | 35 + .../validation-inputs-refresh.json | 12 + .../verified-task-bindings.json | 30 + .../apply.py | 57 + .../composition-regenerated.json | 254 +++++ 20 files changed, 2496 insertions(+) create mode 100644 docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-update-r1/candidate.patch create mode 100644 docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-update-r1/edit.py create mode 100644 docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-update-r1/implementation-r1.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-update-r1/run.py create mode 100644 docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-update-r1/test_runner.py create mode 100644 docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/canonical-validation.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/consistency.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/consistency.stderr.txt create mode 100644 docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/projection.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/projection.stderr.txt create mode 100644 docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/publication-commit.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/publication-inputs.final.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/publication-inputs.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/run_validation.py create mode 100644 docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/validation-child.py create mode 100644 docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/validation-guard.py create mode 100644 docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/validation-inputs-refresh.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/verified-task-bindings.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/nk48-issuer-reference-integration-r1/apply.py create mode 100644 docs/changes/netkingdom-target-2026-10-17/nk48-issuer-reference-integration-r1/composition-regenerated.json diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-update-r1/candidate.patch b/docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-update-r1/candidate.patch new file mode 100644 index 0000000..671f3e2 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-update-r1/candidate.patch @@ -0,0 +1,243 @@ +diff --git a/sso-mfa/k8s/keycape/test_admit_1_3_type.py b/sso-mfa/k8s/keycape/test_admit_1_3_type.py +--- a/sso-mfa/k8s/keycape/test_admit_1_3_type.py ++++ b/sso-mfa/k8s/keycape/test_admit_1_3_type.py +@@ -8,7 +8,9 @@ + acknowledged 1.3 is still refused until ops-warden adds a 1.3 pin. That is an + ops-warden owner change, and it is not made here. The tests show that 1.3's + parameters carry 1.2's pinned fingerprint, and that with only that one pin added in +-memory the committed map admits exactly the composed descriptors and nothing else. ++memory the five resolvable steps admit. The two Apps attended steps remain refused ++because their establishing login is unresolved in the synthetic catalog. Four real ++draft lane shapes are hypothetically active in that fixture; no catalog is promoted. + Trust is fixture-only, nothing is dispatched, and none of this is owner admission + or an acknowledgment. + """ +@@ -37,6 +39,8 @@ + TYPE_DIR = REPO / 'security-case-type-revisions/1.3/oidc-browser-relying-party' + TYPE_BYTES = (TYPE_DIR / 'type.yaml').read_bytes() + ARTIFACT = json.loads((ROOT / 'descriptor-composition-1.3.candidate.json').read_text()) ++CATALOG = (ROOT / 'kernel-catalog.fixture.yaml').read_bytes() ++UNRESOLVED_APPS = {'deliver-consumer-secret', 'hand-over'} + EVIDENCE = {'fixture-acceptance', 'fixture-materialization', 'fixture-descriptor', 'fixture-session'} + + +@@ -74,12 +78,13 @@ + ARTIFACT['params']['consumer_owner_repo'], + version='1.3')) + +- def admit(self, desc, type_source, *, actor=None, lane=None, agent_id=None): ++ def admit(self, desc, type_source, *, actor=None, lane=None, agent_id=None, catalog=CATALOG): + desc_bytes = c.encode(desc) + adapter = Adapter(desc.adapter, desc.adapter_source, unused, unused) + executor = Executor(Journal(Path(self.temp.name) / desc.step), + {adapter.reference: adapter}, +- lambda purpose, source, evidence: evidence in EVIDENCE, ++ lambda purpose, source, evidence: (evidence in EVIDENCE and ++ (purpose != 'catalog-routing-acceptance' or source == digest(CATALOG))), + browser_inputs=inputs.BrowserInputs(REPO)) + with mock.patch.dict(os.environ): + if agent_id is None: +@@ -87,7 +92,7 @@ + else: + os.environ['WARDEN_AGENT_ID'] = agent_id + return executor.admit(self.case_source, type_source, desc_bytes, +- b'fixture-only-catalog', principal='founder', actor=actor or desc.actor, ++ catalog, principal='founder', actor=actor or desc.actor, + lane=lane or desc.lane, + acceptance_evidence='fixture-acceptance', + materialization_evidence='fixture-materialization', +@@ -112,18 +117,33 @@ + self.assertEqual(parameter_fingerprint(TYPE_BYTES), inputs.PARAMETER_PINS['1.2']) + acknowledged = with_status('acknowledged') + for step, desc in self.descriptors.items(): ++ if step in UNRESOLVED_APPS: ++ continue # The attended session gate correctly precedes parameter validation. + with self.subTest(step=step), self.assertRaisesRegex( + Refused, 'failed exact-version validation'): + self.admit(desc, acknowledged) + +- def test_committed_map_admits_every_descriptor_once_acknowledged_and_pinned(self): ++ def test_committed_map_conditionally_admits_five_resolvable_steps(self): + acknowledged = with_status('acknowledged') + for step, desc in self.descriptors.items(): ++ if step in UNRESOLVED_APPS: ++ continue + with self.subTest(step=step), pinned_13(): + admitted, invocation, _ = self.admit(desc, acknowledged) + self.assertEqual(admitted, desc) + self.assertEqual((invocation.step, invocation.actor, invocation.target), + (desc.step, desc.actor, 'forgejo')) ++ ++ def test_unresolved_apps_sessions_refused_even_once_acknowledged_and_pinned(self): ++ for step in sorted(UNRESOLVED_APPS): ++ with self.subTest(step=step), pinned_13(), self.assertRaisesRegex( ++ Refused, 'does not resolve to an active, reviewed login lane'): ++ self.admit(self.descriptors[step], with_status('acknowledged')) ++ ++ def test_catalog_evidence_is_bound_to_exact_fixture_bytes(self): ++ mint = self.descriptors['mint-secret'] ++ with pinned_13(), self.assertRaisesRegex(Refused, 'independent owner evidence not verified'): ++ self.admit(mint, with_status('acknowledged'), catalog=CATALOG + b'\n# changed source\n') + + def test_descriptor_outside_the_map_is_refused(self): + acknowledged = with_status('acknowledged') +diff --git a/sso-mfa/k8s/keycape/test_keycape_registration_adapter.py b/sso-mfa/k8s/keycape/test_keycape_registration_adapter.py +--- a/sso-mfa/k8s/keycape/test_keycape_registration_adapter.py ++++ b/sso-mfa/k8s/keycape/test_keycape_registration_adapter.py +@@ -259,8 +259,13 @@ + case_source = yaml.safe_dump(case).encode() + typ = yaml.safe_load((root / 'security-case-types/oidc-browser-relying-party/type.yaml').read_bytes()) + typ['spec']['execution_descriptors'] = {'register-client': digest(self.desc_bytes)} ++ # Fixture-only successor lane for the adapter's current descriptor. ++ # Canonical 1.1 still names the earlier login lane and is not edited. ++ typ['spec']['follow_through'] = [ ++ dict(step, lane=self.admitted.lane) if step['id'] == 'register-client' else step ++ for step in typ['spec']['follow_through']] + type_source = yaml.safe_dump(typ).encode() +- catalog = b'fixture-only-catalog' ++ catalog = (ROOT / 'kernel-catalog.fixture.yaml').read_bytes() + sheet = json.dumps(['register-client', 'net-kingdom', 'forgejo', 'human', + 'founder', 'keycape-attended-case-change', 'fixture-acceptance', 'fixture-materialization', + 'fixture-descriptor', 'fixture-session'], separators=(',', ':')).encode() +@@ -270,6 +275,8 @@ + adapter = a.build(**dict(self.kw, admitted=invocation, case_source=case_source, + case_acceptance='fixture-acceptance')) + def fixture_verifier(purpose, source, evidence): ++ if purpose == 'catalog-routing-acceptance': ++ return source == digest(catalog) and evidence == 'fixture-descriptor' + if purpose.startswith('session-revocation:'): + _, lane, operation, attempt = purpose.split(':') + return source == digest(case_source) and lane == invocation.lane and evidence == ( +diff --git a/sso-mfa/k8s/keycape/kernel-catalog.fixture.yaml b/sso-mfa/k8s/keycape/kernel-catalog.fixture.yaml +new file mode 100644 +--- /dev/null ++++ b/sso-mfa/k8s/keycape/kernel-catalog.fixture.yaml +@@ -0,0 +1,128 @@ ++# TEST ONLY: synthetic subset shaped after ops-warden 5abde817 catalog. ++# Four draft entries are hypothetically active; Apps session_lane remains unresolved. ++# Not an authenticated owner catalog, promotion, login choice or native authority. ++entries: ++- id: key-cape-oidc-login ++ risk: standard ++ owner_repo: key-cape ++ warden_executes: false ++ reviewed: '2026-06-27' ++ status: active ++ delegation: ++ mode: interim ++ intended_owner: key-cape ++ reviewed: '2026-09-08' ++ blocked_on: fixture-only; no native authority ++ lane: login ++ title: Synthetic key-cape-oidc-login ++ need_keywords: ++ - key-cape-oidc-login ++ subsystem: synthetic source test ++ wiki_ref: fixture-only ++ canon_ref: fixture-only ++ workload_ref: ++ applicability: not-applicable ++ reason: Synthetic source test; no workload or native authority. ++- id: keycape-client-secret-generate ++ risk: high ++ owner_repo: railiance-platform ++ warden_executes: false ++ reviewed: '2026-10-10' ++ status: active ++ delegation: ++ mode: native ++ intended_owner: railiance-platform ++ reviewed: '2026-10-10' ++ lane: secret ++ title: Synthetic keycape-client-secret-generate ++ need_keywords: ++ - keycape-client-secret-generate ++ subsystem: synthetic source test ++ wiki_ref: fixture-only ++ canon_ref: fixture-only ++ workload_ref: ++ applicability: not-applicable ++ reason: Synthetic source test; no workload or native authority. ++- id: keycape-attended-case-change ++ lane: attended-change ++ session_lane: key-cape-oidc-login ++ risk: high ++ owner_repo: key-cape/net-kingdom ++ warden_executes: false ++ reviewed: '2026-10-17' ++ status: active ++ delegation: ++ mode: interim ++ intended_owner: key-cape ++ reviewed: '2026-10-17' ++ blocked_on: fixture-only; no native authority ++ title: Synthetic keycape-attended-case-change ++ need_keywords: ++ - keycape-attended-case-change ++ subsystem: synthetic source test ++ wiki_ref: fixture-only ++ canon_ref: fixture-only ++ workload_ref: ++ applicability: not-applicable ++ reason: Synthetic source test; no workload or native authority. ++- id: platform-secret-delivery ++ risk: high ++ owner_repo: railiance-platform ++ warden_executes: false ++ reviewed: '2026-10-17' ++ status: active ++ delegation: ++ mode: native ++ intended_owner: railiance-platform ++ reviewed: '2026-10-17' ++ title: Synthetic platform-secret-delivery ++ need_keywords: ++ - platform-secret-delivery ++ subsystem: synthetic source test ++ wiki_ref: fixture-only ++ canon_ref: fixture-only ++ workload_ref: ++ applicability: not-applicable ++ reason: Synthetic source test; no workload or native authority. ++- id: consumer-owner-deployment ++ lane: attended-change ++ session_lane: pending-owner-confirmation ++ risk: high ++ owner_repo: railiance-apps ++ warden_executes: false ++ reviewed: '2026-10-17' ++ status: active ++ delegation: ++ mode: native ++ intended_owner: railiance-apps ++ reviewed: '2026-10-17' ++ title: Synthetic consumer-owner-deployment ++ need_keywords: ++ - consumer-owner-deployment ++ subsystem: synthetic source test ++ wiki_ref: fixture-only ++ canon_ref: fixture-only ++ workload_ref: ++ applicability: not-applicable ++ reason: Synthetic source test; no workload or native authority. ++- id: apps-consumer-handover ++ lane: attended-change ++ session_lane: pending-owner-confirmation ++ risk: high ++ owner_repo: railiance-apps ++ warden_executes: false ++ reviewed: '2026-10-17' ++ status: active ++ delegation: ++ mode: native ++ intended_owner: railiance-apps ++ reviewed: '2026-10-17' ++ title: Synthetic apps-consumer-handover ++ need_keywords: ++ - apps-consumer-handover ++ subsystem: synthetic source test ++ wiki_ref: fixture-only ++ canon_ref: fixture-only ++ workload_ref: ++ applicability: not-applicable ++ reason: Synthetic source test; no workload or native authority. diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-update-r1/edit.py b/docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-update-r1/edit.py new file mode 100644 index 0000000..8765080 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-update-r1/edit.py @@ -0,0 +1,46 @@ +from pathlib import Path +import yaml +r=Path('/tmp/nk48-catalog-fixture-update-r1/net-kingdom/sso-mfa/k8s/keycape') +original=Path('/tmp/warden-kernel-review-r2/candidate/registry/routing/catalog.yaml') +entries=yaml.safe_load(original.read_bytes())['entries'] +ids={'keycape-attended-case-change','keycape-client-secret-generate','key-cape-oidc-login','platform-secret-delivery','consumer-owner-deployment','apps-consumer-handover'} +keep=('id','lane','session_lane','owner_repo','risk','status','reviewed','warden_executes','delegation') +rows=[] +for entry in entries: + if entry['id'] not in ids:continue + item={k:v for k,v in entry.items() if k in keep} + item.update(title='Synthetic '+entry['id'],need_keywords=[entry['id']],subsystem='synthetic source test',wiki_ref='fixture-only',canon_ref='fixture-only',workload_ref={'applicability':'not-applicable','reason':'Synthetic source test; no workload or native authority.'}) + if item['status']=='draft':item['status']='active' + # Keep delegation mode/owner; do not copy actual runtime commands or claim owner acceptance. + item['delegation']={k:v for k,v in item['delegation'].items() if k in ('mode','intended_owner','reviewed')} + if item['delegation']['mode']=='interim':item['delegation']['blocked_on']='fixture-only; no native authority' + rows.append(item) +assert len(rows)==6 +(r/'kernel-catalog.fixture.yaml').write_text('# TEST ONLY: synthetic subset shaped after ops-warden 5abde817 catalog.\n# Four draft entries are hypothetically active; Apps session_lane remains unresolved.\n# Not an authenticated owner catalog, promotion, login choice or native authority.\n'+yaml.safe_dump({'entries':rows},sort_keys=False)) +p=r/'test_admit_1_3_type.py';s=p.read_text() +s=s.replace("memory the committed map admits exactly the composed descriptors and nothing else.","memory the five resolvable steps admit. The two Apps attended steps remain refused\nbecause their establishing login is unresolved in the synthetic catalog. Four real\ndraft lane shapes are hypothetically active in that fixture; no catalog is promoted.") +s=s.replace("EVIDENCE =", "CATALOG = (ROOT / 'kernel-catalog.fixture.yaml').read_bytes()\nUNRESOLVED_APPS = {'deliver-consumer-secret', 'hand-over'}\nEVIDENCE =") +s=s.replace("def admit(self, desc, type_source, *, actor=None, lane=None, agent_id=None):","def admit(self, desc, type_source, *, actor=None, lane=None, agent_id=None, catalog=CATALOG):") +s=s.replace("lambda purpose, source, evidence: evidence in EVIDENCE,", "lambda purpose, source, evidence: (evidence in EVIDENCE and\n (purpose != 'catalog-routing-acceptance' or source == digest(CATALOG))),") +s=s.replace("b'fixture-only-catalog', principal=", "catalog, principal=") +s=s.replace("for step, desc in self.descriptors.items():\n with self.subTest(step=step), self.assertRaisesRegex(\n Refused, 'failed exact-version validation'):","for step, desc in self.descriptors.items():\n if step in UNRESOLVED_APPS:\n continue # The attended session gate correctly precedes parameter validation.\n with self.subTest(step=step), self.assertRaisesRegex(\n Refused, 'failed exact-version validation'):") +s=s.replace("def test_committed_map_admits_every_descriptor_once_acknowledged_and_pinned(self):", "def test_committed_map_conditionally_admits_five_resolvable_steps(self):") +s=s.replace("with self.subTest(step=step), pinned_13():\n admitted, invocation, _ =", "with self.subTest(step=step), pinned_13():\n if step in UNRESOLVED_APPS:\n continue\n admitted, invocation, _ =") +pos=s.index(' def test_descriptor_outside_the_map_is_refused') +s=s[:pos]+''' def test_unresolved_apps_sessions_refused_even_once_acknowledged_and_pinned(self): + for step in sorted(UNRESOLVED_APPS): + with self.subTest(step=step), pinned_13(), self.assertRaisesRegex( + Refused, 'does not resolve to an active, reviewed login lane'): + self.admit(self.descriptors[step], with_status('acknowledged')) + + def test_catalog_evidence_is_bound_to_exact_fixture_bytes(self): + mint = self.descriptors['mint-secret'] + with pinned_13(), self.assertRaisesRegex(Refused, 'independent owner evidence not verified'): + self.admit(mint, with_status('acknowledged'), catalog=CATALOG + b'\\n# changed source\\n') + +'''+s[pos:] +p.write_text(s) +p=r/'test_keycape_registration_adapter.py';s=p.read_text() +s=s.replace(" catalog = b'fixture-only-catalog'", " # Fixture-only successor lane for the adapter's current descriptor.\n # Canonical 1.1 still names the earlier login lane and is not edited.\n typ['spec']['follow_through'] = [\n dict(step, lane=self.admitted.lane) if step['id'] == 'register-client' else step\n for step in typ['spec']['follow_through']]\n type_source = yaml.safe_dump(typ).encode()\n catalog = (ROOT / 'kernel-catalog.fixture.yaml').read_bytes()") +s=s.replace(" def fixture_verifier(purpose, source, evidence):\n", " def fixture_verifier(purpose, source, evidence):\n if purpose == 'catalog-routing-acceptance':\n return source == digest(catalog) and evidence == 'fixture-descriptor'\n") +p.write_text(s) diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-update-r1/implementation-r1.json b/docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-update-r1/implementation-r1.json new file mode 100644 index 0000000..284df3e --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-update-r1/implementation-r1.json @@ -0,0 +1,75 @@ +{ + "schema": "custodian.nk48-catalog-fixture-update.v1", + "date": "2026-10-17", + "role": "implementation proposal; this successor task is not independent review", + "status": "candidate prepared in scratch only; no canonical edits/commits", + "base_net_kingdom": "342a6f25af5cdc602841948f42759ea52ef1c8f5", + "kernel_current_candidate": "5abde817775d6304e3cf5a46948717a1606981bf plus reviewed candidate.patch SHA2561a3530a1e469fc03c2c29f1b66fa3ba1904e56bf2abcfb242c7a2ed015fb3e74", + "kernel_predecessor": "117fec9241e7b985dfb187b992e173d0a5dc3700", + "patch": { + "file": "candidate.patch", + "sha256": "sha256:df69fb2ec9f1e1cf0dd94194e3c046c995ed8a7deabf65a8e9bec34662adb501", + "check": "git apply --check passed against fresh frozen342a6f25 archive" + }, + "files": { + "sso-mfa/k8s/keycape/test_admit_1_3_type.py": { + "base": "sha256:c512ba00513d066fd1ca8af08fd6bf106fbd7a132981b1dcc5af80a745ab03f0", + "candidate": "sha256:2186eab00b000a534ab1452f14fa7b1a7ed352d5b27c400687c1c8ec7c4c3019" + }, + "sso-mfa/k8s/keycape/test_keycape_registration_adapter.py": { + "base": "sha256:4d0126416522e54eec1ae4c83b5488e09ff11ffb97ec1ee6d234548780c60f63", + "candidate": "sha256:86268e082763c388528e5175184fd32362167c3441716436e4b1cab150c3e79a" + }, + "sso-mfa/k8s/keycape/kernel-catalog.fixture.yaml": { + "base": null, + "candidate": "sha256:7885b8c380c03ccb0198e540532ce80c791c8e86698521d7173642e0c7a56e53" + } + }, + "changes": [ + "Replace both remaining fixture-only-catalog byte placeholders with one static well-formed synthetic catalog shaped after Warden5abde817. Four draft entries hypothetically active; no real catalog change. Preserve real owner/risk/delegation/lane/session kinds, including unresolved Apps sessions. Runtime commands and real workload paths are omitted.", + "Bind catalog-routing-acceptance fixture evidence to digest of the exact catalog bytes in both fixtures; add changed-source refusal test. Fixture trust remains synthetic and supplies no owner authentication.", + "For the current kernel expect five resolvable1.3 descriptors to admit under simulated acknowledgment/pin; expect both Apps attended descriptors to refuse unresolved establishing login. Missing-pin tests exercise the five descriptors that can reach parameter validation.", + "Keep every committed-map and mint-guard test: wrong actor, agent-actor descriptor after exact fixture-map acknowledgment, and agent runtime all reach their intended guard.", + "Registration fixture explicitly supplies its proposed current-descriptor lane in its in-memory type step; canonical1.1 remains unchanged. This fixes the previously unexamined canonical lane/descriptor disagreement for the mode-aware API. Existing synthetic kernel dispatch, rollback, lost-readback and external-revision tests pass." + ], + "path_correction": "test_admit_1_2_adapter_descriptors.py does not exist at342a6f25; its corrected mint tests already moved into test_admit_1_3_type.py. The second remaining fake catalog is test_keycape_registration_adapter.py, which is included.", + "validation": { + "command": "python3 /tmp/nk48-catalog-fixture-update-r1/run.py final", + "candidate": "31 passed,53 subtests passed (see candidate-final.log)", + "frozen117": "2 failed subtests,31 passed,51 subtests passed (see frozen117-final.log). Only unresolved Apps refusal assertions fail; predecessor117 lacks the attended lane/session enforcement added after it.", + "compatibility": "Selected tests now target the reviewed mode-aware catalog API.117 remains useful as a differential predecessor; no version-based skipping, expected-failure marking or weakened production parser is proposed. All common mint guard and registration execution tests still pass with117.", + "isolation": "Empty synthetic HOME; allowlisted environment. Python socket audit guard denies all network. Native subprocesses denied except exact pinned BrowserInputs offline validator child, launched with empty environment and injected child socket/process/ambient-home-read audit guards. Registration Kubernetes/checker owner calls are synthetic mocks. No ambient tokens, native credentials, live owner calls or owner acceptance.", + "full_suite": "Not run; focused scope only.", + "packaging_initial_attempt": "First generated diff omitted new file mode for synthetic YAML and git apply --check refused dev/null; corrected new-file metadata, no source change or canonical apply." + }, + "limitations": [ + "Four source draft lane statuses, unresolved Apps login choice, founder exact-type acknowledgment,1.3 PARAMETER_PINS, native T03 and downstream acceptance remain separate gates.", + "Synthetic catalog is deliberately hypothetical data; its fixture evidence and bytes do not imply authentic owner approval.", + "This implementation packet requires source review before canonical application.", + "No workplan edits or State Hub changes; parent handles task/progress records." + ], + "boundary": { + "canonical_edits": false, + "new_commits": false, + "catalog_promotion": false, + "parameter_pin_added": false, + "native_actions": false, + "credential_access": false, + "external_owner_assent": false + }, + "knowledge_orientation": { + "package": "0.2.6", + "digest": "8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02", + "status": "start withheld/orientation-only; actual owner AGENTS.md, scoped source and source contract reviewed directly; no inferred action authority" + }, + "packet_hashes": { + "edit.py": "sha256:da1fef62073b92b59307e9f52115fa4fa784b260b5202db9d28fc62938982040", + "candidate-tests.log": "sha256:dbc8706c1b29c6fb08821670d1e4a923e1b0a8db56b039937e346bd7581090c1", + "frozen117-final.log": "sha256:81185ef66ed4ed5f836dc214899911af3a7a8b9f53b25b12130d8d8b6d8eafcf", + "run.py": "sha256:8ad707bd9bb509e4b27503c284cee8aff3a7205882ca87febdace0a050c5f749", + "frozen117-tests.log": "sha256:bd012a45cfeb9bba992b79a89a12a1397eea22169740aca2830d136d4a410ea2", + "candidate-final.log": "sha256:2669471008859e15ce9b3bd92baf4e759672e96048ef221f90b19daf84dc3a28", + "candidate.patch": "sha256:df69fb2ec9f1e1cf0dd94194e3c046c995ed8a7deabf65a8e9bec34662adb501", + "test_runner.py": "sha256:d6f4e8f0f5c34557bf678543ae2c69202dc321f1226c2e1a2d462b2d81efc9c5" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-update-r1/run.py b/docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-update-r1/run.py new file mode 100644 index 0000000..84f1c7e --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-update-r1/run.py @@ -0,0 +1,8 @@ +from pathlib import Path +import os,subprocess,sys +r=Path('/tmp/nk48-catalog-fixture-update-r1');(r/'home').mkdir(exist_ok=True) +kernel='/tmp/warden-kernel-review-r2/candidate/src' if sys.argv[1]=='candidate' else str(r/'warden117/src') +env={'HOME':str(r/'home'),'PATH':'/usr/bin:/bin','PYTHONPATH':'/tmp/warden-kernel-review-r2/guard:'+kernel,'PYTHONDONTWRITEBYTECODE':'1','LANG':'C.UTF-8'} +with (r/(sys.argv[1]+'-'+sys.argv[2]+'.log')).open('w') as log: + result=subprocess.run(['/tmp/warden-kernel-review-r1/final/.venv/bin/python',str(r/'test_runner.py')],cwd=r/'net-kingdom',env=env,stdout=log,stderr=subprocess.STDOUT) +print(result.returncode);sys.exit(result.returncode) diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-update-r1/test_runner.py b/docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-update-r1/test_runner.py new file mode 100644 index 0000000..61c8a10 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-update-r1/test_runner.py @@ -0,0 +1,18 @@ +"""Invoke only pinned, offline validator child; keep socket/native denial in child.""" +from pathlib import Path +import sys +import subprocess +import warden.case_inputs as inputs +import pytest + +PREAMBLE = '''import sys as _review_sys\ndef _review_guard(event,args):\n if event.startswith('socket.') or event in {'subprocess.Popen','os.system','os.exec','os.posix_spawn'}:\n raise RuntimeError('review validator: network/native disabled')\n if event=='open' and isinstance(args[0],str) and (args[0].startswith('/home/') or args[0].startswith('/root/')):\n raise RuntimeError('review validator: ambient home denied')\n_review_sys.addaudithook(_review_guard)\n''' +old_run = subprocess.run + +def run_pinned(args,*pos,**kw): + if (type(args) is not list or len(args)!=5 or args[:3]!=[sys.executable,'-I','-c'] + or args[3]!=inputs._VALIDATE or not str(args[4]).startswith('/tmp/warden-case-validator-') + or kw.get('env')!={}): + raise RuntimeError('review validator: unexpected process refused') + return old_run([*args[:3],PREAMBLE+args[3],args[4]],*pos,**kw) +inputs.subprocess.run=run_pinned +raise SystemExit(pytest.main(['-q','sso-mfa/k8s/keycape/test_admit_1_3_type.py','sso-mfa/k8s/keycape/test_keycape_registration_adapter.py'])) diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/canonical-validation.json b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/canonical-validation.json new file mode 100644 index 0000000..eddeb77 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/canonical-validation.json @@ -0,0 +1,15 @@ +{ + "executed": true, + "counts_verified": true, + "returncode": 0, + "warden_revision": "922c26da0f3fcb0182352ea83e6ae06f29878580", + "net_kingdom_head": "342a6f25af5cdc602841948f42759ea52ef1c8f5", + "verified_public_source_files": 105, + "tests": [ + "sso-mfa/k8s/keycape/test_admit_1_3_type.py", + "sso-mfa/k8s/keycape/test_keycape_registration_adapter.py" + ], + "log_sha256": "sha256:7bb78da51b547a05c66ffeb1e592c23317be29f6705d3e359c2ae370b86aedd4", + "scratch": "/tmp/nk48-catalog-canonical-validation-5ghz6p1c", + "limitations": "Source fixture tests only; no native owner execution, acceptance, catalog promotion or pin." +} diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/consistency.json b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/consistency.json new file mode 100644 index 0000000..89ee1d9 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/consistency.json @@ -0,0 +1,365 @@ +{ + "repo_slug": "net-kingdom", + "repo_path": "/home/worsch/net-kingdom", + "source_revision": "befb0bc68cd25b625804fce559476eefd702521d", + "source_revision_reason": null, + "issues": [ + { + "severity": "WARN", + "check_id": "C-24", + "message": "Repo classification advisory: capability_tag 'security' is not a recommended family tag (allowed, check for synonym)", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager warning: workplans/: repository uses more than one workplan prefix: ['NET-WP', 'NK-WP']", + "file_path": "workplans/", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-33", + "message": "WORK-RECORDS.md is missing or stale \u2014 regenerate via fix-consistency (CUST-WP-0061-T04 generated work-record index)", + "file_path": "WORK-RECORDS.md", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-37", + "message": "Residual workplan 'nk-wp-0011' has no origin/origin_ref provenance (not invented)", + "file_path": "workplans/NK-WP-0011-enterprise-federation-saml.md", + "db_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'USER-WP-0020' is not linked to State Hub", + "file_path": "workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md", + "db_id": "", + "file_value": "USER-WP-0020", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'KEY-WP-0004' is not linked to State Hub", + "file_path": "workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md", + "db_id": "", + "file_value": "KEY-WP-0004", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'USER-WP-0020' is not linked to State Hub", + "file_path": "workplans/NK-WP-0023-user-engine-portal-platform-integration.md", + "db_id": "", + "file_value": "USER-WP-0020", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'KEY-WP-0004' is not linked to State Hub", + "file_path": "workplans/NK-WP-0023-user-engine-portal-platform-integration.md", + "db_id": "", + "file_value": "KEY-WP-0004", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'USER-WP-0021' is not linked to State Hub", + "file_path": "workplans/NK-WP-0024-user-engine-portal-integration-expansion.md", + "db_id": "", + "file_value": "USER-WP-0021", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'FLEX-WP-0009' is not linked to State Hub", + "file_path": "workplans/NK-WP-0024-user-engine-portal-integration-expansion.md", + "db_id": "", + "file_value": "FLEX-WP-0009", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'AUDIT-WP-0003' is not linked to State Hub", + "file_path": "workplans/NK-WP-0024-user-engine-portal-integration-expansion.md", + "db_id": "", + "file_value": "AUDIT-WP-0003", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'EMAIL-WP-0004' is not linked to State Hub", + "file_path": "workplans/NK-WP-0024-user-engine-portal-integration-expansion.md", + "db_id": "", + "file_value": "EMAIL-WP-0004", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'USER-WP-0022' is not linked to State Hub", + "file_path": "workplans/NK-WP-0025-public-self-registration-and-application-jit.md", + "db_id": "", + "file_value": "USER-WP-0022", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'KEY-WP-0008' is not linked to State Hub", + "file_path": "workplans/NK-WP-0025-public-self-registration-and-application-jit.md", + "db_id": "", + "file_value": "KEY-WP-0008", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'CSOC-WP-0003' is not linked to State Hub", + "file_path": "workplans/NK-WP-0025-public-self-registration-and-application-jit.md", + "db_id": "", + "file_value": "CSOC-WP-0003", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-37", + "message": "Residual workplan 'nk-wp-0027' has no origin/origin_ref provenance (not invented)", + "file_path": "workplans/NK-WP-0027-reef-placement-reconciliation.md", + "db_id": "965ad365-6b81-50a1-a2a3-2d0c1fcce0b4", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-37", + "message": "Residual workplan 'nk-wp-0031' has no origin/origin_ref provenance (not invented)", + "file_path": "workplans/NK-WP-0031-deterministic-posture-feedback.md", + "db_id": "9d7b04f9-3803-5613-b7a5-8bd606c77f5a", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-37", + "message": "Residual workplan 'nk-wp-0040' has no origin/origin_ref provenance (not invented)", + "file_path": "workplans/NK-WP-0040-execution-attribution-receipt.md", + "db_id": "e2533f3a-aa43-59b3-bff3-8e64b6149487", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-40", + "message": "blocker satisfied, task still wait: 'NK-WP-0048-T15' in workplan 'NK-WP-0048' \u2014 every depends_on target is terminal (NK-WP-0048-T31)", + "file_path": "workplans/NK-WP-0048-security-case-types.md#NK-WP-0048-T15", + "db_id": "", + "file_value": "NK-WP-0048-T31", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-10", + "message": "Task status drift 'NK-WP-0048-T33': file='done' db='todo' (file wins)", + "file_path": "workplans/NK-WP-0048-security-case-types.md#NK-WP-0048-T33", + "db_id": "5ace28ff-a4cb-5647-a8f6-3cd54bb9d0a5", + "file_value": "done", + "db_value": "todo", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-10", + "message": "Task status drift 'NK-WP-0048-T34': file='progress' db='todo' (file wins)", + "file_path": "workplans/NK-WP-0048-security-case-types.md#NK-WP-0048-T34", + "db_id": "37f43c40-d014-544e-aa0b-5219dd4a6b93", + "file_value": "progress", + "db_value": "todo", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'NK-WP-0048-T35' is absent from this projection", + "file_path": "workplans/NK-WP-0048-security-case-types.md#NK-WP-0048-T35", + "db_id": "cf1d6ab3-846e-53ea-8575-d6347b6f4769", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAIL-PL-WP-0002' is not linked to State Hub", + "file_path": "workplans/archived/260702-NET-WP-0017-it-security-readiness-for-user-onboarding.md", + "db_id": "", + "file_value": "RAIL-PL-WP-0002", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'nk-wp-0035@retired-20260908' (id=064c5e8b\u2026, status=archived) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "064c5e8b-7852-4d7f-a5fa-e26e406ab8e0", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'adhoc-2026-08-14@retired-20260827' (id=a5097121\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "a5097121-1461-59f8-81fa-e6ecef527337", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'adhoc-2026-08-23@retired-20260827' (id=e25ba5fa\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "e25ba5fa-eaae-5039-8d93-a69c6d837fc4", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'net-kingdom-adhoc-2026-07-02@retired-20260827' (id=67c1c7ac\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "67c1c7ac-d8b1-41dc-a81a-4e43f1afd068", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'net-kingdom-adhoc-2026-06-14@retired-20260827' (id=c6f3d6bf\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "c6f3d6bf-4916-490d-96ce-092d2776d7e7", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'NET-WP-0020' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform", + "file_path": "workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md", + "db_id": "", + "file_value": "NET-WP-0020", + "db_value": "NK-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'NET-WP-0015' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260603-NET-WP-0015-platform-root-custody-and-openbao-identity-bootstrap.md", + "db_id": "", + "file_value": "NET-WP-0015", + "db_value": "NK-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'NET-WP-0016' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260603-NET-WP-0016-guided-security-bootstrap-experience.md", + "db_id": "", + "file_value": "NET-WP-0016", + "db_value": "NK-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'NET-WP-0018' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260604-NET-WP-0018-bootstrap-automation-and-rebuild-readiness.md", + "db_id": "", + "file_value": "NET-WP-0018", + "db_value": "NK-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'NET-WP-0017' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260702-NET-WP-0017-it-security-readiness-for-user-onboarding.md", + "db_id": "", + "file_value": "NET-WP-0017", + "db_value": "NK-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'NET-WP-0019' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260702-NET-WP-0019-t06-adjacent-user-lifecycle-dry-run-polish.md", + "db_id": "", + "file_value": "NET-WP-0019", + "db_value": "NK-WP", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 64/64", + "C-17 cleared: pushed 1 backlogged commit(s)", + "C-33 fixed: regenerated WORK-RECORDS.md", + "C-10 fixed: task 5ace28ff\u2026 status \u2192 'done'", + "C-10 fixed: task 37f43c40\u2026 status \u2192 'progress'", + "C-11 fixed: task 'NK-WP-0048-T35' \u2192 cf1d6ab3\u2026", + "brief: .custodian-brief.md updated", + "push: pushed" + ], + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 29, + "info": 5 + }, + "result": "warn" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/consistency.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/consistency.stderr.txt new file mode 100644 index 0000000..3345563 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/consistency.stderr.txt @@ -0,0 +1 @@ +WARN: git commit failed for writeback: Generated-only commits rejected: staged diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/projection.json b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/projection.json new file mode 100644 index 0000000..c404fee --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/projection.json @@ -0,0 +1,989 @@ +{ + "ok": true, + "status": "applied", + "repo_slug": "net-kingdom", + "commit": "befb0bc68cd25b625804fce559476eefd702521d", + "requests": 2, + "elapsed_ms": 7743.0, + "git": { + "upstream": "origin/main", + "behind": 0, + "ahead": 0 + }, + "identifiers": { + "schema": "repo-manager.identifier-assignment.v1", + "ok": true, + "executed": true, + "repo": "net-kingdom", + "namespace": "helixforge", + "assignments": [], + "historical_invalid_identifiers": [], + "historical_identity_collisions": [], + "files_changed": [] + }, + "receipt": { + "schema": "state-hub.repository-projection-reconcile.v1", + "instance_role": "primary", + "instance_label": "railiance01", + "expected_commit": "befb0bc68cd25b625804fce559476eefd702521d", + "derived_commit": "befb0bc68cd25b625804fce559476eefd702521d", + "outcome": { + "schema": "state-hub.projection-reset.v1", + "repo_slug": "net-kingdom", + "commit": "befb0bc68cd25b625804fce559476eefd702521d", + "status": "applied", + "counts": { + "created": 0, + "updated": 64, + "retired": 0, + "refused": 0, + "released": 0, + "created_tasks": 0, + "updated_tasks": 1, + "cancelled_tasks": 0, + "created_edges": 0, + "removed_edges": 0, + "unresolved_edges": 1, + "external_edges": 85 + }, + "created": [], + "updated": [ + "NET-WP-0015", + "NET-WP-0016", + "NET-WP-0017", + "NET-WP-0018", + "NET-WP-0019", + "NET-WP-0020", + "NK-WP-0001", + "NK-WP-0002", + "NK-WP-0003", + "NK-WP-0004", + "NK-WP-0005", + "NK-WP-0006", + "NK-WP-0007", + "NK-WP-0008", + "NK-WP-0009", + "NK-WP-0010", + "NK-WP-0011", + "NK-WP-0012", + "NK-WP-0013", + "NK-WP-0014", + "NK-WP-0015", + "NK-WP-0016", + "NK-WP-0017", + "NK-WP-0018", + "NK-WP-0019", + "NK-WP-0021", + "NK-WP-0022", + "NK-WP-0023", + "NK-WP-0024", + "NK-WP-0025", + "NK-WP-0026", + "NK-WP-0027", + "NK-WP-0028", + "NK-WP-0029", + "NK-WP-0030", + "NK-WP-0031", + "NK-WP-0032", + "NK-WP-0033", + "NK-WP-0034", + "NK-WP-0035", + "NK-WP-0036", + "NK-WP-0037", + "NK-WP-0038", + "NK-WP-0039", + "NK-WP-0040", + "NK-WP-0041", + "NK-WP-0042", + "NK-WP-0043", + "NK-WP-0044", + "NK-WP-0045", + "NK-WP-0046", + "NK-WP-0047", + "NK-WP-0048", + "NK-WP-0049", + "NK-WP-0050", + "NK-WP-0051", + "NK-WP-ADHOC-2026-06-14", + "NK-WP-ADHOC-2026-07-02", + "NK-WP-ADHOC-2026-08-14", + "NK-WP-ADHOC-2026-08-23", + "NK-WP-ADHOC-2026-10-03", + "NK-WP-ADHOC-2026-10-10", + "NK-WP-ADHOC-2026-10-11", + "NK-WP-ADHOC-2026-10-16" + ], + "retired": [], + "released": [], + "created_tasks": [], + "updated_tasks": [ + "NK-WP-0048-T35" + ], + "cancelled_tasks": [], + "created_edges": [], + "removed_edges": [], + "unresolved_edges": [ + { + "workplan": "NK-WP-0006", + "from": "NK-WP-0006", + "target": "NK-WP-0001", + "reason": "missing" + } + ], + "external_edges": [ + { + "workplan": "NK-WP-0008", + "from": "NK-WP-0008", + "target": "NK-WP-0006", + "relationship_type": "blocks", + "from_workplan_id": "053c6d96-9396-40c9-a2e5-c36531e7810d", + "from_task_id": null, + "to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "to_task_id": null + }, + { + "workplan": "NK-WP-0050", + "from": "NK-WP-0050-T03", + "target": "RPF-WP-0056-T03", + "relationship_type": "starts_after", + "from_workplan_id": "06ba98d5-609e-5aaa-9bf7-4c4f4460e377", + "from_task_id": "5a3aaf57-de5c-5a03-bc99-9bcf2fc5d95e", + "to_workplan_id": null, + "to_task_id": "a82762eb-bb6d-5600-89ca-a81ada2eba9f" + }, + { + "workplan": "NK-WP-0050", + "from": "NK-WP-0050-T03", + "target": "NK-WP-0050-T02", + "relationship_type": "starts_after", + "from_workplan_id": "06ba98d5-609e-5aaa-9bf7-4c4f4460e377", + "from_task_id": "5a3aaf57-de5c-5a03-bc99-9bcf2fc5d95e", + "to_workplan_id": null, + "to_task_id": "a9dadd07-f136-5dc7-9229-7a9dbb941f0d" + }, + { + "workplan": "NK-WP-0050", + "from": "NK-WP-0050-T02", + "target": "NK-WP-0050-T01", + "relationship_type": "starts_after", + "from_workplan_id": "06ba98d5-609e-5aaa-9bf7-4c4f4460e377", + "from_task_id": "a9dadd07-f136-5dc7-9229-7a9dbb941f0d", + "to_workplan_id": null, + "to_task_id": "64893d94-9717-5812-b8e3-7cabe095fcdc" + }, + { + "workplan": "NK-WP-0017", + "from": "NK-WP-0017", + "target": "NK-WP-0015", + "relationship_type": "blocks", + "from_workplan_id": "08398d26-cadf-44bc-97ee-67da790040e6", + "from_task_id": null, + "to_workplan_id": "343e035d-41e1-4fc4-b209-6872e4a5fdc8", + "to_task_id": null + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011", + "target": "NK-WP-0006", + "relationship_type": "blocks", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": null, + "to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "to_task_id": null + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011", + "target": "NK-WP-0004", + "relationship_type": "blocks", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": null, + "to_workplan_id": "d9cf7c4b-886b-4cd1-ad7b-99c4e1929c9e", + "to_task_id": null + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011", + "target": "NK-WP-0003", + "relationship_type": "blocks", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": null, + "to_workplan_id": "f24cefd4-a09b-4fa1-9b25-94bf783b425e", + "to_task_id": null + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T03", + "target": "NK-WP-0011-T02", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908", + "to_workplan_id": null, + "to_task_id": "2fe6f100-3a5d-563e-b033-7d7b846ae487" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T07", + "target": "NK-WP-0011-T03", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "38998c68-29bf-50d2-8c8d-0c75184d5833", + "to_workplan_id": null, + "to_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T07", + "target": "NK-WP-0011-T04", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "38998c68-29bf-50d2-8c8d-0c75184d5833", + "to_workplan_id": null, + "to_task_id": "6697a994-7343-5ea8-8b37-bc3b921e5a9b" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T07", + "target": "NK-WP-0011-T05", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "38998c68-29bf-50d2-8c8d-0c75184d5833", + "to_workplan_id": null, + "to_task_id": "d845380d-3dbc-5e59-8f2b-5a4d1b32d89d" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T04", + "target": "NK-WP-0011-T03", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "6697a994-7343-5ea8-8b37-bc3b921e5a9b", + "to_workplan_id": null, + "to_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T06", + "target": "NK-WP-0011-T03", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "9cb7fd93-c16e-5102-83ce-195b3aa87446", + "to_workplan_id": null, + "to_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T06", + "target": "NK-WP-0011-T04", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "9cb7fd93-c16e-5102-83ce-195b3aa87446", + "to_workplan_id": null, + "to_task_id": "6697a994-7343-5ea8-8b37-bc3b921e5a9b" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T06", + "target": "NK-WP-0011-T05", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "9cb7fd93-c16e-5102-83ce-195b3aa87446", + "to_workplan_id": null, + "to_task_id": "d845380d-3dbc-5e59-8f2b-5a4d1b32d89d" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T05", + "target": "NK-WP-0011-T04", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "d845380d-3dbc-5e59-8f2b-5a4d1b32d89d", + "to_workplan_id": null, + "to_task_id": "6697a994-7343-5ea8-8b37-bc3b921e5a9b" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T09", + "target": "NK-WP-0011-T03", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "d9dc4292-6b66-5797-9ff9-a1a4a556278e", + "to_workplan_id": null, + "to_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T09", + "target": "NK-WP-0011-T07", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "d9dc4292-6b66-5797-9ff9-a1a4a556278e", + "to_workplan_id": null, + "to_task_id": "38998c68-29bf-50d2-8c8d-0c75184d5833" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T09", + "target": "NK-WP-0011-T08", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "d9dc4292-6b66-5797-9ff9-a1a4a556278e", + "to_workplan_id": null, + "to_task_id": "e5f44ddc-9645-5f61-b84c-da5ab9cccb6d" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T08", + "target": "NK-WP-0011-T02", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "e5f44ddc-9645-5f61-b84c-da5ab9cccb6d", + "to_workplan_id": null, + "to_task_id": "2fe6f100-3a5d-563e-b033-7d7b846ae487" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T08", + "target": "NK-WP-0011-T03", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "e5f44ddc-9645-5f61-b84c-da5ab9cccb6d", + "to_workplan_id": null, + "to_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908" + }, + { + "workplan": "NET-WP-0016", + "from": "NET-WP-0016", + "target": "NET-WP-0015", + "relationship_type": "blocks", + "from_workplan_id": "16069174-6698-4855-ad9e-5092c8571f38", + "from_task_id": null, + "to_workplan_id": "6b9c25e4-1008-429a-8de6-54361872c0dd", + "to_task_id": null + }, + { + "workplan": "NET-WP-0016", + "from": "NET-WP-0016", + "target": "NK-WP-0012", + "relationship_type": "blocks", + "from_workplan_id": "16069174-6698-4855-ad9e-5092c8571f38", + "from_task_id": null, + "to_workplan_id": "9b8e4afc-eb71-47d9-8750-799a082b320a", + "to_task_id": null + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T18", + "target": "NK-WP-0049-T33", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "141dd773-c1fa-56c1-a852-bbe2372e5125", + "to_workplan_id": null, + "to_task_id": "56c8d469-7a10-5d50-a30e-95cbf3cd4756" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T18", + "target": "NK-WP-0049-T32", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "141dd773-c1fa-56c1-a852-bbe2372e5125", + "to_workplan_id": null, + "to_task_id": "cd78dbb7-a8f2-5754-8788-6eb1b7d97741" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T35", + "target": "NK-WP-0049-T34", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "1bfd1703-589f-5511-bad5-812d860e4a71", + "to_workplan_id": null, + "to_task_id": "821b3a56-6f36-5812-abc9-5a00e37cb2e7" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T33", + "target": "NK-WP-0049-T35", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "56c8d469-7a10-5d50-a30e-95cbf3cd4756", + "to_workplan_id": null, + "to_task_id": "1bfd1703-589f-5511-bad5-812d860e4a71" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T33", + "target": "NK-WP-0049-T34", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "56c8d469-7a10-5d50-a30e-95cbf3cd4756", + "to_workplan_id": null, + "to_task_id": "821b3a56-6f36-5812-abc9-5a00e37cb2e7" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T33", + "target": "NK-WP-0049-T36", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "56c8d469-7a10-5d50-a30e-95cbf3cd4756", + "to_workplan_id": null, + "to_task_id": "8b72334b-fc27-5707-a189-bad345eaf3bc" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T33", + "target": "NK-WP-0049-T32", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "56c8d469-7a10-5d50-a30e-95cbf3cd4756", + "to_workplan_id": null, + "to_task_id": "cd78dbb7-a8f2-5754-8788-6eb1b7d97741" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T36", + "target": "NK-WP-0049-T34", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "8b72334b-fc27-5707-a189-bad345eaf3bc", + "to_workplan_id": null, + "to_task_id": "821b3a56-6f36-5812-abc9-5a00e37cb2e7" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T03", + "target": "NK-WP-0049-T02", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "d68cd4d3-1ba3-530e-88f9-26ebb8dd6eac", + "to_workplan_id": null, + "to_task_id": "479d6970-6516-50f5-9436-bb5b56d58aad" + }, + { + "workplan": "NK-WP-0025", + "from": "NK-WP-0025", + "target": "NK-WP-0024", + "relationship_type": "blocks", + "from_workplan_id": "2412a251-d6b5-5f05-8082-3eb7697c51dc", + "from_task_id": null, + "to_workplan_id": "635a73d4-b3cb-5c38-af22-56a6a66beb0e", + "to_task_id": null + }, + { + "workplan": "NK-WP-0016", + "from": "NK-WP-0016", + "target": "NK-WP-0015", + "relationship_type": "blocks", + "from_workplan_id": "2d592e18-e63d-4856-97a1-f8c3e019e150", + "from_task_id": null, + "to_workplan_id": "343e035d-41e1-4fc4-b209-6872e4a5fdc8", + "to_task_id": null + }, + { + "workplan": "NK-WP-0006", + "from": "NK-WP-0006", + "target": "NK-WP-0005", + "relationship_type": "blocks", + "from_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "from_task_id": null, + "to_workplan_id": "75bc472b-cc0a-48f2-afb6-62b896f7cc19", + "to_task_id": null + }, + { + "workplan": "NK-WP-0006", + "from": "NK-WP-0006", + "target": "NK-WP-0004", + "relationship_type": "blocks", + "from_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "from_task_id": null, + "to_workplan_id": "d9cf7c4b-886b-4cd1-ad7b-99c4e1929c9e", + "to_task_id": null + }, + { + "workplan": "NK-WP-0013", + "from": "NK-WP-0013", + "target": "NK-WP-0006", + "relationship_type": "blocks", + "from_workplan_id": "32a54d8e-8633-42a6-8ec1-104842c581c1", + "from_task_id": null, + "to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "to_task_id": null + }, + { + "workplan": "NK-WP-0015", + "from": "NK-WP-0015", + "target": "NK-WP-0014", + "relationship_type": "blocks", + "from_workplan_id": "343e035d-41e1-4fc4-b209-6872e4a5fdc8", + "from_task_id": null, + "to_workplan_id": "b9bf56bc-7ef6-43eb-badc-fa0f4896c63c", + "to_task_id": null + }, + { + "workplan": "NET-WP-0017", + "from": "NET-WP-0017", + "target": "NET-WP-0016", + "relationship_type": "blocks", + "from_workplan_id": "385de708-fd59-4bab-a4f4-28c1c476b3ea", + "from_task_id": null, + "to_workplan_id": "16069174-6698-4855-ad9e-5092c8571f38", + "to_task_id": null + }, + { + "workplan": "NET-WP-0017", + "from": "NET-WP-0017", + "target": "NET-WP-0015", + "relationship_type": "blocks", + "from_workplan_id": "385de708-fd59-4bab-a4f4-28c1c476b3ea", + "from_task_id": null, + "to_workplan_id": "6b9c25e4-1008-429a-8de6-54361872c0dd", + "to_task_id": null + }, + { + "workplan": "NK-WP-0007", + "from": "NK-WP-0007", + "target": "NK-WP-0006", + "relationship_type": "blocks", + "from_workplan_id": "3cbc81ec-7ad5-46cf-a4a0-fc5fe9873695", + "from_task_id": null, + "to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "to_task_id": null + }, + { + "workplan": "NK-WP-0007", + "from": "NK-WP-0007", + "target": "NK-WP-0005", + "relationship_type": "blocks", + "from_workplan_id": "3cbc81ec-7ad5-46cf-a4a0-fc5fe9873695", + "from_task_id": null, + "to_workplan_id": "75bc472b-cc0a-48f2-afb6-62b896f7cc19", + "to_task_id": null + }, + { + "workplan": "NK-WP-0007", + "from": "NK-WP-0007", + "target": "NK-WP-0004", + "relationship_type": "blocks", + "from_workplan_id": "3cbc81ec-7ad5-46cf-a4a0-fc5fe9873695", + "from_task_id": null, + "to_workplan_id": "d9cf7c4b-886b-4cd1-ad7b-99c4e1929c9e", + "to_task_id": null + }, + { + "workplan": "NK-WP-0024", + "from": "NK-WP-0024", + "target": "NK-WP-0023", + "relationship_type": "blocks", + "from_workplan_id": "635a73d4-b3cb-5c38-af22-56a6a66beb0e", + "from_task_id": null, + "to_workplan_id": "fdb3deee-06c3-5d12-91ce-9c50b2ac0618", + "to_task_id": null + }, + { + "workplan": "NET-WP-0015", + "from": "NET-WP-0015", + "target": "NK-WP-0006", + "relationship_type": "blocks", + "from_workplan_id": "6b9c25e4-1008-429a-8de6-54361872c0dd", + "from_task_id": null, + "to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "to_task_id": null + }, + { + "workplan": "NET-WP-0015", + "from": "NET-WP-0015", + "target": "NK-WP-0012", + "relationship_type": "blocks", + "from_workplan_id": "6b9c25e4-1008-429a-8de6-54361872c0dd", + "from_task_id": null, + "to_workplan_id": "9b8e4afc-eb71-47d9-8750-799a082b320a", + "to_task_id": null + }, + { + "workplan": "NK-WP-0018", + "from": "NK-WP-0018", + "target": "NK-WP-0017", + "relationship_type": "blocks", + "from_workplan_id": "6f75035a-e056-4eab-8fdb-00a18bacdf87", + "from_task_id": null, + "to_workplan_id": "08398d26-cadf-44bc-97ee-67da790040e6", + "to_task_id": null + }, + { + "workplan": "NK-WP-0018", + "from": "NK-WP-0018", + "target": "NK-WP-0016", + "relationship_type": "blocks", + "from_workplan_id": "6f75035a-e056-4eab-8fdb-00a18bacdf87", + "from_task_id": null, + "to_workplan_id": "2d592e18-e63d-4856-97a1-f8c3e019e150", + "to_task_id": null + }, + { + "workplan": "NK-WP-0005", + "from": "NK-WP-0005", + "target": "NK-WP-0004", + "relationship_type": "blocks", + "from_workplan_id": "75bc472b-cc0a-48f2-afb6-62b896f7cc19", + "from_task_id": null, + "to_workplan_id": "d9cf7c4b-886b-4cd1-ad7b-99c4e1929c9e", + "to_task_id": null + }, + { + "workplan": "NET-WP-0019", + "from": "NET-WP-0019", + "target": "NET-WP-0017", + "relationship_type": "blocks", + "from_workplan_id": "75d388b6-7ec1-4e1b-8c87-6ff44f953210", + "from_task_id": null, + "to_workplan_id": "385de708-fd59-4bab-a4f4-28c1c476b3ea", + "to_task_id": null + }, + { + "workplan": "NET-WP-0019", + "from": "NET-WP-0019", + "target": "NET-WP-0018", + "relationship_type": "blocks", + "from_workplan_id": "75d388b6-7ec1-4e1b-8c87-6ff44f953210", + "from_task_id": null, + "to_workplan_id": "800f9f16-bc44-4bbf-a771-58a630a3b698", + "to_task_id": null + }, + { + "workplan": "NET-WP-0018", + "from": "NET-WP-0018", + "target": "NET-WP-0017", + "relationship_type": "blocks", + "from_workplan_id": "800f9f16-bc44-4bbf-a771-58a630a3b698", + "from_task_id": null, + "to_workplan_id": "385de708-fd59-4bab-a4f4-28c1c476b3ea", + "to_task_id": null + }, + { + "workplan": "NET-WP-0018", + "from": "NET-WP-0018", + "target": "NET-WP-0015", + "relationship_type": "blocks", + "from_workplan_id": "800f9f16-bc44-4bbf-a771-58a630a3b698", + "from_task_id": null, + "to_workplan_id": "6b9c25e4-1008-429a-8de6-54361872c0dd", + "to_task_id": null + }, + { + "workplan": "NK-WP-0027", + "from": "NK-WP-0027-T03", + "target": "NK-WP-0027-T02", + "relationship_type": "starts_after", + "from_workplan_id": "965ad365-6b81-50a1-a2a3-2d0c1fcce0b4", + "from_task_id": "e3f0bb0f-0c85-5cb9-a5ab-75f668cd3447", + "to_workplan_id": null, + "to_task_id": "5b35b646-a525-55da-852a-6005613d42ea" + }, + { + "workplan": "NK-WP-0012", + "from": "NK-WP-0012", + "target": "NK-WP-0006", + "relationship_type": "blocks", + "from_workplan_id": "9b8e4afc-eb71-47d9-8750-799a082b320a", + "from_task_id": null, + "to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "to_task_id": null + }, + { + "workplan": "NK-WP-0014", + "from": "NK-WP-0014", + "target": "NK-WP-0013", + "relationship_type": "blocks", + "from_workplan_id": "b9bf56bc-7ef6-43eb-badc-fa0f4896c63c", + "from_task_id": null, + "to_workplan_id": "32a54d8e-8633-42a6-8ec1-104842c581c1", + "to_task_id": null + }, + { + "workplan": "NK-WP-0014", + "from": "NK-WP-0014", + "target": "NK-WP-0012", + "relationship_type": "blocks", + "from_workplan_id": "b9bf56bc-7ef6-43eb-badc-fa0f4896c63c", + "from_task_id": null, + "to_workplan_id": "9b8e4afc-eb71-47d9-8750-799a082b320a", + "to_task_id": null + }, + { + "workplan": "NK-WP-0019", + "from": "NK-WP-0019", + "target": "NK-WP-0018", + "relationship_type": "blocks", + "from_workplan_id": "d2daa8b4-8ecf-4377-b382-492e653735f7", + "from_task_id": null, + "to_workplan_id": "6f75035a-e056-4eab-8fdb-00a18bacdf87", + "to_task_id": null + }, + { + "workplan": "NK-WP-0009", + "from": "NK-WP-0009", + "target": "NK-WP-0008", + "relationship_type": "blocks", + "from_workplan_id": "d4d02dbf-3974-502d-8b87-b776fc63e17e", + "from_task_id": null, + "to_workplan_id": "053c6d96-9396-40c9-a2e5-c36531e7810d", + "to_task_id": null + }, + { + "workplan": "NK-WP-0022", + "from": "NK-WP-0022", + "target": "NK-WP-0023", + "relationship_type": "blocks", + "from_workplan_id": "d76ddccc-00c8-548a-b141-2cd660fa38da", + "from_task_id": null, + "to_workplan_id": "fdb3deee-06c3-5d12-91ce-9c50b2ac0618", + "to_task_id": null + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T15", + "target": "NK-WP-0048-T31", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "1b825705-4848-5edc-832f-b1622cd9bdb7", + "to_workplan_id": null, + "to_task_id": "ed1ccd87-89a0-5e69-885c-0eaf5ab0bb5a" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T16", + "target": "NK-WP-0048-T25", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e", + "to_workplan_id": null, + "to_task_id": "0de2a7d9-874d-578b-a076-f653fe42e30b" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T16", + "target": "NK-WP-0048-T29", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e", + "to_workplan_id": null, + "to_task_id": "129db41d-4560-5e20-9f3b-c3c91e0a5601" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T16", + "target": "NK-WP-0048-T24", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e", + "to_workplan_id": null, + "to_task_id": "1a3931ee-3b5f-52fc-9295-4073804f4bd2" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T16", + "target": "NK-WP-0048-T28", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e", + "to_workplan_id": null, + "to_task_id": "6dab281c-ea9a-5a17-a83f-e8e9a4d4484f" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T16", + "target": "NK-WP-0048-T30", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e", + "to_workplan_id": null, + "to_task_id": "6f6073ac-52dd-5b70-8874-6d76d4c072e4" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T16", + "target": "NK-WP-0048-T26", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e", + "to_workplan_id": null, + "to_task_id": "94b3cbf0-c908-5ac6-b0db-67385c3e021c" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T16", + "target": "NK-WP-0048-T27", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e", + "to_workplan_id": null, + "to_task_id": "e56365f8-29b5-5c89-a329-8115f9f3b2a7" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T07", + "target": "NK-WP-0048-T06", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "c3c9c3ae-4f23-5ba7-9e6f-e63bcf29b9f7", + "to_workplan_id": null, + "to_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T09", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "0ee12dfc-8260-5038-bd39-cc7fb4113be0" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T15", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "1b825705-4848-5edc-832f-b1622cd9bdb7" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T16", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T05", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "3d987d3d-0797-538b-86e4-51185a327ae2" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "MASON-WP-0010-T03", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "56cea6be-c613-586c-80cd-125340b374da" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T12", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "7ce4eee3-cd47-55a9-bfa5-4f1835d4d6fd" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T20", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "863fcbdb-e246-51ba-87ca-a2f44d01d6f8" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T17", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "8c3e4baa-a218-5996-af9e-fe1153a46dac" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T08", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "8e519082-dc8b-5e46-b660-03d03e55dcf6" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T18", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "9c45da71-fb4c-5f20-9065-90f448f37c64" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T13", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "b264c10b-565c-5d29-b788-03cf5fbd2883" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "WARDEN-WP-0044-T03", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T14", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "fce95440-a25b-5f27-8ef3-a3d182099113" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T14", + "target": "NK-WP-0048-T20", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "fce95440-a25b-5f27-8ef3-a3d182099113", + "to_workplan_id": null, + "to_task_id": "863fcbdb-e246-51ba-87ca-a2f44d01d6f8" + }, + { + "workplan": "NK-WP-0010", + "from": "NK-WP-0010", + "target": "NK-WP-0008", + "relationship_type": "blocks", + "from_workplan_id": "f4faf8b4-ae57-40cf-a881-6fe66ca6ad74", + "from_task_id": null, + "to_workplan_id": "053c6d96-9396-40c9-a2e5-c36531e7810d", + "to_task_id": null + } + ], + "refused": [], + "notes": [] + } + } +} diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/projection.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/projection.stderr.txt new file mode 100644 index 0000000..e69de29 diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/publication-commit.json b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/publication-commit.json new file mode 100644 index 0000000..c62e0c0 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/publication-commit.json @@ -0,0 +1,29 @@ +{ + "exit_code": 0, + "commit": "befb0bc68cd25b625804fce559476eefd702521d", + "base": "342a6f25af5cdc602841948f42759ea52ef1c8f5", + "files": [ + { + "path": "sso-mfa/k8s/keycape/test_admit_1_3_type.py", + "sha256": "2186eab00b000a534ab1452f14fa7b1a7ed352d5b27c400687c1c8ec7c4c3019" + }, + { + "path": "sso-mfa/k8s/keycape/test_keycape_registration_adapter.py", + "sha256": "86268e082763c388528e5175184fd32362167c3441716436e4b1cab150c3e79a" + }, + { + "path": "sso-mfa/k8s/keycape/kernel-catalog.fixture.yaml", + "sha256": "7885b8c380c03ccb0198e540532ce80c791c8e86698521d7173642e0c7a56e53" + }, + { + "path": "workplans/NK-WP-0048-security-case-types.md", + "sha256": "80279bbdf6d36e2321ecfeb5a3f996a8345e6da2ceb9b26167e52b3668ba7e85" + }, + { + "path": "security-case-type-revisions/1.3/oidc-browser-relying-party/type.yaml", + "sha256": "ef02ddae3167bdd1558193a5f6db0379fb8cc84207531706d5ef35caabc3684f" + } + ], + "stdout": "[main befb0bc] fix: bind issuer template exactly and align catalog admission fixtures\n 5 files changed, 209 insertions(+), 10 deletions(-)\n create mode 100644 sso-mfa/k8s/keycape/kernel-catalog.fixture.yaml\n", + "stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 5, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/publication-inputs.final.json b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/publication-inputs.final.json new file mode 100644 index 0000000..b39b864 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/publication-inputs.final.json @@ -0,0 +1,27 @@ +{ + "owner": "net-kingdom", + "base_revision": "342a6f25af5cdc602841948f42759ea52ef1c8f5", + "message": "fix: bind issuer template exactly and align catalog admission fixtures", + "files": [ + { + "path": "sso-mfa/k8s/keycape/test_admit_1_3_type.py", + "sha256": "2186eab00b000a534ab1452f14fa7b1a7ed352d5b27c400687c1c8ec7c4c3019" + }, + { + "path": "sso-mfa/k8s/keycape/test_keycape_registration_adapter.py", + "sha256": "86268e082763c388528e5175184fd32362167c3441716436e4b1cab150c3e79a" + }, + { + "path": "sso-mfa/k8s/keycape/kernel-catalog.fixture.yaml", + "sha256": "7885b8c380c03ccb0198e540532ce80c791c8e86698521d7173642e0c7a56e53" + }, + { + "path": "workplans/NK-WP-0048-security-case-types.md", + "sha256": "80279bbdf6d36e2321ecfeb5a3f996a8345e6da2ceb9b26167e52b3668ba7e85" + }, + { + "path": "security-case-type-revisions/1.3/oidc-browser-relying-party/type.yaml", + "sha256": "ef02ddae3167bdd1558193a5f6db0379fb8cc84207531706d5ef35caabc3684f" + } + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/publication-inputs.json b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/publication-inputs.json new file mode 100644 index 0000000..251ed01 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/publication-inputs.json @@ -0,0 +1,176 @@ +{ + "schema": "custodian.nk48-catalog-fixture-publication-inputs.v1", + "prepared_only": true, + "owner": "net-kingdom", + "base_revision": "342a6f25af5cdc602841948f42759ea52ef1c8f5", + "warden_revision": "922c26da0f3fcb0182352ea83e6ae06f29878580", + "message": "test: align security case fixtures with authenticated catalog admission", + "workplan": "workplans/NK-WP-0048-security-case-types.md", + "workplan_preimage_sha256": "sha256:f92962c5aa21aade0fc2f6b4f8d9a95932fe85b107413cdd2824b6ebe72c36d9", + "workplan_candidate_sha256": "sha256:3bce122c5b83d9044b142fc2cabc48de5558ab0d65dc0223a8ed0325f219e981", + "task_addition_sha256": "sha256:7d14d261ffbab2a930c4a3ff962cec786060cad6177280773cf1c0b0f006127f", + "patch_sha256": "sha256:df69fb2ec9f1e1cf0dd94194e3c046c995ed8a7deabf65a8e9bec34662adb501", + "files": [ + { + "path": "sso-mfa/k8s/keycape/test_admit_1_3_type.py", + "preimage_sha256": "sha256:c512ba00513d066fd1ca8af08fd6bf106fbd7a132981b1dcc5af80a745ab03f0", + "sha256": "sha256:2186eab00b000a534ab1452f14fa7b1a7ed352d5b27c400687c1c8ec7c4c3019" + }, + { + "path": "sso-mfa/k8s/keycape/test_keycape_registration_adapter.py", + "preimage_sha256": "sha256:4d0126416522e54eec1ae4c83b5488e09ff11ffb97ec1ee6d234548780c60f63", + "sha256": "sha256:86268e082763c388528e5175184fd32362167c3441716436e4b1cab150c3e79a" + }, + { + "path": "sso-mfa/k8s/keycape/kernel-catalog.fixture.yaml", + "preimage_sha256": null, + "sha256": "sha256:7885b8c380c03ccb0198e540532ce80c791c8e86698521d7173642e0c7a56e53" + } + ], + "allocation": { + "method": "repo_manager.identifiers.ensure_missing_work_record_identifiers", + "manual_uuid": false, + "preexisting_assignments": [], + "expected_new_record_ids": [ + "NK-WP-0048-T35" + ], + "expected_files_changed": [ + "workplans/NK-WP-0048-security-case-types.md" + ], + "expected_task_count": 35, + "concrete_postallocation_manifest": "publication-inputs.allocated.json" + }, + "protected_files": { + ".custodian-brief.md": "sha256:3eb7f91f2443090c9b859a716d83711310364897b6144dcf10d3254342fec3d1", + "WORK-RECORDS.md": "sha256:a1fec217a6e380f528778d781dbea1fc5a836fdefa1dd4dd0308100fbe08112a" + }, + "validation": { + "tests": [ + "sso-mfa/k8s/keycape/test_admit_1_3_type.py", + "sso-mfa/k8s/keycape/test_keycape_registration_adapter.py" + ], + "expected_result": "31 passed,53 subtests passed; no skipped or deselected tests", + "python": "/tmp/warden-kernel-review-r1/final/.venv/bin/python", + "source_hashes": { + "net-kingdom": { + "sso-mfa/k8s/keycape/test_vergabe_client_rollout.py": "sha256:f9b7defc312b0fea24ded92ef479dcc8aef063f7a66a8245760918bcf44c4af1", + "sso-mfa/k8s/keycape/test_compose_1_2_descriptors.py": "sha256:9a4b9fb0141221d6e5bcb72b3656613afda54d16ede300bffa8f71956ae6fd2c", + "sso-mfa/k8s/keycape/test_keycape_client.py": "sha256:9572044679feaedfe732e15a2b6f8ef6b41a8fe2e4430257f309a3e83e97736c", + "sso-mfa/k8s/keycape/openbao-negative-node-wrapper.py": "sha256:76ac013d1a676a0dfa58aea1ce87b0c3e72483ccd21f586a22c5475e9132f6c1", + "sso-mfa/k8s/keycape/portal-client-rollout.py": "sha256:158e1d36eb881cdd0a2eda91b472adea5e8fde5061e00d26dda368580aeb871f", + "sso-mfa/k8s/keycape/test_playwright_activation.py": "sha256:6fc22d091f27a76c32d2fb0a7fc3c6e18e54ff98d242699c518b2f9dc9fd4cbd", + "sso-mfa/k8s/keycape/exercise-approval-clients.py": "sha256:e2d3dd741ac52af28dce752344227a4443b78fedd4cfcc06ba902e679dfc9351", + "sso-mfa/k8s/keycape/keycape-client.py": "sha256:4b63161cf3365d34dd684a3116e2c935baaf7f6aa4b30983f6883546db3d6591", + "sso-mfa/k8s/keycape/test_openbao_negative_session.py": "sha256:01e23f2b4fc77824a161a57acb3a52d19aad846b3b6c0fd3abd81afa1dc2985c", + "sso-mfa/k8s/keycape/authentication-policy-rollout.py": "sha256:2c1bd23fded4855bae1eb3a08dbc4510d7f60f2bc4d625d60e471ab78f6f0251", + "sso-mfa/k8s/keycape/handover-adapter.py": "sha256:bad7c1132258f2140b0d83548031ac86eecea4f4019f34adedc1e9e3774a3832", + "sso-mfa/k8s/keycape/openbao-signin-diagnosis-rollout.py": "sha256:a57b957d6eed9e8fb09d2a7aa7405a39deeafd9aaf57a9e6dc907afabd380371", + "sso-mfa/k8s/keycape/test_handover_adapter.py": "sha256:cd1fb0eb64a777699221ebdfcd6fea96bafb9b27ec388e95dcfe66189eac8ca2", + "sso-mfa/k8s/keycape/test_authentication_policy_rollout.py": "sha256:11c10039d99a34d2819b09146a966c8b7cba6095e7a8b51c055a01e7167e3ed5", + "sso-mfa/k8s/keycape/test_deliver_consumer_secret_adapter.py": "sha256:f4e6c6acd75a36f675007d2f62a7c7c4f7bfe2951cbb5e3e4cdde8b53f17f473", + "sso-mfa/k8s/keycape/bind-env-adapter.py": "sha256:fa17fae21776b5c620ee9782adf050649c3a28719a6687d2524ff67ca7ad1925", + "sso-mfa/k8s/keycape/test_keycape_checker_snapshot.py": "sha256:9271f25c760ad732c257d59d259b5c767436a2dc2d5ba24fca259bc57761d6d1", + "sso-mfa/k8s/keycape/test_openbao_signin_diagnosis_rollout.py": "sha256:25d46fe7caca2ad4c262bd2a25188c91847304b6b051c4f3b3705c69f2803f01", + "sso-mfa/k8s/keycape/test_openbao_private_ready.py": "sha256:8a7a033b1c509ba21397d1d74580c44f24592045b2b9de50fe87638607224277", + "sso-mfa/k8s/keycape/test_mint_secret_adapter.py": "sha256:8110b6a8abd8e9a1f5e1feae11ec09c4e28cb7486c759b0e8459da1fb1b7144d", + "sso-mfa/k8s/keycape/playwright-activation.py": "sha256:5ac683b3324b00e6253f6040f4c73057027b1f98f7071160a6153794ba522757", + "sso-mfa/k8s/keycape/test_admit_1_3_type.py": "sha256:2186eab00b000a534ab1452f14fa7b1a7ed352d5b27c400687c1c8ec7c4c3019", + "sso-mfa/k8s/keycape/test_openbao_node_route.py": "sha256:1c57053be6e8472174e4034fdfbf34b3e1729f5e239b3a9af89d9e59a08d6cb6", + "sso-mfa/k8s/keycape/test_secrets_engine_openbao_client_rollout.py": "sha256:e6f86fb7712c1b9c01d9b684f26d5cc949649b823d2732eced132d59acd3fe01", + "sso-mfa/k8s/keycape/openbao-client-config.py": "sha256:1b908b4c36134212d78f9fbe7a2a201eb3ced06d31bb1dcea4a59d80689d84b1", + "sso-mfa/k8s/keycape/test_registration_original_intent_reconcile.py": "sha256:e2897b8200ec97445fc4a26c55ad82651fcb1a4d22efe7fe59d0fcfc5cd8ec71", + "sso-mfa/k8s/keycape/test_ensure_groups_adapter.py": "sha256:c8754a2ba735116edc6fe257aa993d0530cea9ca9f954ea5a621e38694906be2", + "sso-mfa/k8s/keycape/test_keycape_checker_environment.py": "sha256:35f316eed168d3df588498faf24ab9377733a7d857ddfa5e0e4322a6287c93ff", + "sso-mfa/k8s/keycape/test_bind_env_adapter.py": "sha256:a1e5e7a631a4843f9a0d2310a3942b26936103d786aeae47a142ff7c7b2fdbdb", + "sso-mfa/k8s/keycape/create-secrets.py": "sha256:5da672fff36eb94101741ad99e2a1a96ae81fea15ed1871304c40e63ce27c787", + "sso-mfa/k8s/keycape/approval-clients-rollout.py": "sha256:488d5cc59e081993dd2b5fc6d9e46bbddcaec4f5170b8f7a5ad0aae3a211a790", + "sso-mfa/k8s/keycape/vergabe-client-rollout.py": "sha256:8cee6cc5ff3e3e8617304055263d04b393d0e005c34d9af12cb7e8bc685bac1a", + "sso-mfa/k8s/keycape/keycape-registration-adapter.py": "sha256:a53beea4dbbe373ce7a5b84d55e79be8407ab9688037c7ee057afcc7be576047", + "sso-mfa/k8s/keycape/compose-1.2-descriptors.py": "sha256:39021cac900b11a59d00c5a1d5491b1ee4c639955cde07d07854c3db8bc04958", + "sso-mfa/k8s/keycape/test_approval_clients_rollout.py": "sha256:745316d42c3aba6b59b562d3bbcd4b2cb92871fb5e51a954e2254e2e550bb408", + "sso-mfa/k8s/keycape/register-user-engine-portal.py": "sha256:67173edc44f5457e7b6a3e0fb2321b398159cfce5dea8ead01eabf835fb38d76", + "sso-mfa/k8s/keycape/test_issuer_pin.py": "sha256:e471ed815af246633c0b21ac2cf5cae94d0dbdeff9e6ce801b4ddd033097dc20", + "sso-mfa/k8s/keycape/openbao-negative-session.py": "sha256:24b7b803e4eb7e6e7c0700a069dad0ec315ee7eb5538a88b9e56147f8fab5cdd", + "sso-mfa/k8s/keycape/test_keycape_registration_adapter.py": "sha256:86268e082763c388528e5175184fd32362167c3441716436e4b1cab150c3e79a", + "sso-mfa/k8s/keycape/deliver-consumer-secret-adapter.py": "sha256:65db5386cdf08a1aa932886c046abed20330a36c96e63d4267adb8341b23da42", + "sso-mfa/k8s/keycape/test_portal_client_rollout.py": "sha256:a16cd4bf278970c10de2e1b1025597b3872c9515713dd947ac6b50cb78feea1f", + "sso-mfa/k8s/keycape/test_deliver_secret_adapter.py": "sha256:24cedec29071b62fc2c2458950ed244feeff542bc20a7d480667dd99cda16b03", + "sso-mfa/k8s/keycape/deliver-secret-adapter.py": "sha256:cd1a515a1ae2def2093660ed2a810a9c66d1d4cf7126f573ee7e9c4c42afb98d", + "sso-mfa/k8s/keycape/test_openbao_private_input.py": "sha256:84277edb5bd7858885173dea802b6bdc4f0f0c7785d6e200ee9a98d8553891a1", + "sso-mfa/k8s/keycape/register-coulomb-social.py": "sha256:b40ff4bdba71b797f8f393e79cb3c9d73b790045a0f7df6ecea35803369793c7", + "sso-mfa/k8s/keycape/mint-secret-adapter.py": "sha256:246323c7243ded18229ab063956577e151d56d9be485d3bd44fc38e5af0edf3c", + "sso-mfa/k8s/keycape/test_adapter_source_closure.py": "sha256:63cb442636d996fcf1c36b7b746ed860106a7da35dbaeb1c5129a41420ca4155", + "sso-mfa/k8s/keycape/secrets-engine-openbao-client-rollout.py": "sha256:8b834e5f0353a5e11797637420609e06e7bf7de47777c7e78b774f74d4a6afbd", + "sso-mfa/k8s/keycape/test_openbao_client_config.py": "sha256:7104a73fb936aca4829ef8046e39497d0b7347d3e74810f672e4d4ddc3346457", + "sso-mfa/k8s/keycape/ensure-groups-adapter.py": "sha256:6cba5b07a9262a8e0bf445dc4095ba03b31ddc15e2efbfe374e93f4f78b6aed4", + "sso-mfa/k8s/keycape/verify-user-engine-portal.py": "sha256:ccd5106395bd5d7b4f3dbbcbad449e3793aff217d4429b5d5af9e52ab9a58103", + "sso-mfa/k8s/keycape/test_playwright_registration.py": "sha256:b97ea8619ac768f520e4058aeb50b0b1e8ef6d2e9a1a0fff932a151a3d4b61ae", + "sso-mfa/k8s/keycape/playwright-registration.py": "sha256:bf2d6b83d93629df8ddaf6c31d6c7408ae3866969d63895714df0e08a570da99", + "identity-provisioner/group_provenance_postgres.py": "sha256:2a0111e83ad7b611076a1b45634e7f698b3d2e9acc473320b4a8ba009ebd0932", + "identity-provisioner/password_setup.py": "sha256:53012fc708384fc9cd0fff4f3fa5f204ab85866db91d726457dd130799e88ca0", + "identity-provisioner/provisioner.py": "sha256:19d1b837cbafeeacb1aa815856cd68091e6702281d72b1d860230fa320e1725b", + "identity-provisioner/copy-client-secret.py": "sha256:0f1907a9f16688148aede9fceb53a55cfd0504bcb8552f158d0fa77e9ad960c8", + "identity-provisioner/group_provenance.py": "sha256:405e08eaaab7c21d618dff4db5970607806f32ab6c461effb81c737e32182b10", + "identity-provisioner/server.py": "sha256:b61c83da6c7ce20fa2790d5bb00aeca6a91dccd133526bc559ed26562f90eb29", + "security-case-types/oidc-browser-relying-party/type.yaml": "sha256:f705c64e4875e9b8e18a912fb51c135e77898926d6a451f5cb74ab3c0cbe4d1c", + "security-case-type-revisions/1.2/oidc-browser-relying-party/type.yaml": "sha256:9e60ff569fb0d860a2bbde7bbb0991a54d4b0688f62b56df0fa5d161fd624578", + "security-case-type-revisions/1.3/oidc-browser-relying-party/type.yaml": "sha256:ef02ddae3167bdd1558193a5f6db0379fb8cc84207531706d5ef35caabc3684f", + "security-case-type-revisions/1.3/oidc-browser-relying-party/examples/forgejo.yaml": "sha256:546aad5cf26842c484fc6ba99940d56697b85531afea11872556761008923c94", + "security-cases/forgejo-netkingdom-oidc.yaml": "sha256:bcc2c6d5bae0d28242b3cdb71e74d8ca297c2afe04766b55d53597f86893351d", + "sso-mfa/k8s/keycape/descriptor-composition-1.3.candidate.json": "sha256:773daa1df72cc7cf6a6d8aa082208181ca2438cdecc9179b1bc5b1c3a09099c2", + "sso-mfa/k8s/keycape/kernel-catalog.fixture.yaml": "sha256:7885b8c380c03ccb0198e540532ce80c791c8e86698521d7173642e0c7a56e53", + "tools/security-case-types/security_case_evidence.py": "sha256:da8efa59c52ad73283397ebe639ae259d0cb9c6348b5cb829135c24230dcdc75", + "tools/security-case-types/security_case_validator.py": "sha256:1bcc62e9bc374c711363295549f3cd5bb0b32952671ed4b08fddc7f74742959b", + "tools/security-scenario-composer/security_scenario_composer.py": "sha256:9f0cc69930aa8ee2cc3fb92236e6a99728df17b8c0fe36e1250241c38fc01c4f", + "tools/playbook-capability-contract/playbook_contract_validator.py": "sha256:2e1e0c809d4bc9d64c2d974cc23fecd1c5636785154c2554edd9191852fd926d" + }, + "ops-warden": { + "src/warden/ca.py": "sha256:d5282819c5d29386fd59a7dc46d1abdc01e99fc6838a1a6637f90868389fe557", + "src/warden/inventory.py": "sha256:9401db92d7cbf3bea962b97e83ef2c252a19c69ab94ce4836ba58f68638cb311", + "src/warden/memory.py": "sha256:ecf5f7ccabb669b56bfca3a109b10bbe8437bdd2ea30a47a4c08570f97d7be2a", + "src/warden/case_inputs.py": "sha256:1334b0cd9897e763cfea2d306e997c659f3f284ecc3f9612140c2104835da7c7", + "src/warden/audit.py": "sha256:6b5b8fe053064d3905294bfde1b691fcca8a0806c889e52a49494470d29c24a0", + "src/warden/case_type.py": "sha256:7b659b8d682863cd28df24025be4b10dd7ca3df724350a22d360c6af9615bca7", + "src/warden/vault.py": "sha256:860b8c9f498b3955b363a74dd74087b6d0c399599ef22b951a076ee33c95929f", + "src/warden/taint.py": "sha256:8c3d161d18d429d026aad715ac01e2d33e0f4e84ac03fbaea3cea15017ad39a1", + "src/warden/case_run.py": "sha256:1bc73e30ac718fd75bbaff2a739495fc051aeaec73802ac71f0583cb2d53ab0a", + "src/warden/vault_hints.py": "sha256:0d158ffcc3a93d5442df5fbe13d4c1e3b3159dd60301530bbdae6db9bc9c709e", + "src/warden/access.py": "sha256:258d45d2f84b54b2464373ad4d7d6df6ff95b8e8d60f5e85ceb2d962fcfa8a61", + "src/warden/clock_attribution.py": "sha256:5fcf07a2525a6a250442e14b6f6229f7db2a6ca02fc6aac23cdaa4c1a78c63eb", + "src/warden/case_plan.py": "sha256:9352ae8683d1181980c4ff38524582e4be448d33c85b558f60582c1e5bb5bbaa", + "src/warden/caller_identity.py": "sha256:747edfaceecd470981949253bda0c3bd2f487d40a9a2f77c2cc1eff3f34f04f7", + "src/warden/policy.py": "sha256:aac46f538e986731cd841581c91efe004b8c1940966b954ef635780a719dada4", + "src/warden/case_receipt_state.py": "sha256:a2cda7f187e77bd76d4d209505638de44a587fae0bc033ec75c23ee9ea9f73bc", + "src/warden/config.py": "sha256:8a857faa3811b00303d4d5c904d69255ebdaff3239e8516f97e6606e53b46924", + "src/warden/openbao_caller.py": "sha256:7e6d07827d00eae7de3b2367c97bdcda1a13d6559627201a4ba09a0e42d46a17", + "src/warden/doubles.py": "sha256:5460e07f5bd0f51a81d3f3c0ac84efde65ca9130b1039f94ee22ca484976a9de", + "src/warden/posture.py": "sha256:1bb60c4dd4634ea42cb130ae1325d7415adf43096906bde2515396c368256e33", + "src/warden/cli.py": "sha256:196cd829d3dbfbd2333598a983687bde1f9bcdfadef95b2fd1d237c4a5f060a9", + "src/warden/proxy.py": "sha256:69649bcf8979e4ed7f9104e927b458827a355c4846143367f4cd49c8b89b96da", + "src/warden/plan.py": "sha256:001b3197e644221344d52e6b1594eb8eae78d10e73d18ed31273505909f3916b", + "src/warden/worker.py": "sha256:d7c2b391b36033d44d8c6841b9bce18a05c74b41ef2910b91689820b6a1cb44e", + "src/warden/mask.py": "sha256:0876412d453fa84109dc8ee0468449f40cf4d3421b056f30fc205f0f59ec494b", + "src/warden/models.py": "sha256:f4100b02c5d96d537980e00d4b874159cd5822ba8219f1f533a2516912b7bd85", + "src/warden/__init__.py": "sha256:047e0feba479474235f0707a207655ecfddfb33cd4f54069134419b8ca4ea24a", + "src/warden/scorecard.py": "sha256:0fa5aef34aeb004fa7fcfabc287759cc47421ca5244c1f31fc467b22a653353c", + "src/warden/desk.py": "sha256:2499120392a5a1c0fd8f423d5b5c787c75a4efb9a986a1b7bcb85eae13423e85", + "src/warden/routing/scaffold.py": "sha256:5079c8e51f8d487eae3f322a66324bd70cefb637bb28f46c861032de8ec54aa2", + "src/warden/routing/models.py": "sha256:b85372b2572a49af62e9534f26a33963b894633c7cd43dd2a28416b8959cba3e", + "src/warden/routing/__init__.py": "sha256:e9124811ebe11ad32c98ab462b2eed634d4ddca08792981d0f353b223a239902", + "src/warden/routing/catalog.py": "sha256:5b95810df9e6102a33d3a116a096cd75292c8572bad721fe6baa772caacc9bc3", + "src/warden/scripts/ops_ssh_wrapper.py": "sha256:e8c289882f2ad439d2eb32f9a871967420fefaffe745c9271c1a2e948fbdfe50", + "src/warden/scripts/__init__.py": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + } + } + }, + "repo_manager_identifiers_sha256": "sha256:4e35fcd009c20822574fd33171176bd14a1ff2dd5af8b0bb2820954974593a2a", + "authorization": "Root accepted the exact source fixture patch for source integration. This packet adds no owner/native authority or catalog/pin promotion. No prepared script has been executed.", + "publishable": false, + "requires_allocated_manifest": true, + "publication_file_paths": [ + "sso-mfa/k8s/keycape/test_admit_1_3_type.py", + "sso-mfa/k8s/keycape/test_keycape_registration_adapter.py", + "sso-mfa/k8s/keycape/kernel-catalog.fixture.yaml", + "workplans/NK-WP-0048-security-case-types.md" + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/run_validation.py b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/run_validation.py new file mode 100644 index 0000000..12f783d --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/run_validation.py @@ -0,0 +1,73 @@ +"""Prepared canonical source validation; --execute launches only the two scoped tests.""" +from pathlib import Path +import argparse +import hashlib +import json +import re +import shutil +import subprocess +import tempfile + +PACKET = Path(__file__).resolve().parent +ROOTS = {'net-kingdom': Path('/home/worsch/net-kingdom'), 'ops-warden': Path('/home/worsch/ops-warden')} + +def sha(data): + return 'sha256:' + hashlib.sha256(data).hexdigest() + +def sources(manifest): + allowed = [] + for owner, rows in manifest['validation']['source_hashes'].items(): + for relative, expected in rows.items(): + path = ROOTS[owner] / relative + assert not path.is_symlink(), str(path) + assert sha(path.read_bytes()) == expected, str(path) + allowed.append(str(path.resolve())) + return allowed + +def main(): + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument('--execute', action='store_true') + args = parser.parse_args() + manifest = json.loads((PACKET / 'publication-inputs.json').read_text()) + allowed = sources(manifest) + revision = subprocess.check_output(['git', '-C', str(ROOTS['ops-warden']), 'rev-parse', 'HEAD'], text=True).strip() + assert revision == manifest['warden_revision'] + if not args.execute: + print(json.dumps({'prepared_only': True, 'public_source_files_verified': len(allowed), + 'tests': manifest['validation']['tests']})) + return + protected = {name: sha((ROOTS['net-kingdom'] / name).read_bytes()) for name in manifest['protected_files']} + scratch = Path(tempfile.mkdtemp(prefix='nk48-catalog-canonical-validation-')) + for name in ['home', 'tmp', 'guard', 'pycache']: + (scratch / name).mkdir() + shutil.copyfile(PACKET / 'validation-guard.py', scratch / 'guard/sitecustomize.py') + shutil.copyfile(PACKET / 'validation-child.py', scratch / 'child.py') + (scratch / 'allowed.json').write_text(json.dumps(allowed)) + (scratch / 'pytest.ini').write_text('[pytest]\n') + environment = { + 'HOME': str(scratch / 'home'), 'TMPDIR': str(scratch / 'tmp'), 'PATH': '/usr/bin:/bin', + 'PYTHONPATH': str(scratch / 'guard') + ':' + str(ROOTS['ops-warden'] / 'src'), + 'PYTHONDONTWRITEBYTECODE': '1', 'PYTHONPYCACHEPREFIX': str(scratch / 'pycache'), + 'LANG': 'C.UTF-8', 'WARDEN_REVIEW_ALLOWED_SOURCE_LIST': str(scratch / 'allowed.json'), + 'WARDEN_REVIEW_VALIDATOR_PREFIX': str(scratch / 'tmp/warden-case-validator-'), + } + with (PACKET / 'canonical-validation.log').open('w') as log: + result = subprocess.run([manifest['validation']['python'], str(scratch / 'child.py')], + cwd=ROOTS['net-kingdom'], env=environment, + stdout=log, stderr=subprocess.STDOUT) + sources(manifest) + assert protected == {name: sha((ROOTS['net-kingdom'] / name).read_bytes()) for name in manifest['protected_files']} + log_text = (PACKET / 'canonical-validation.log').read_text() + counts_verified = bool(re.search(r'\b31 passed, 53 subtests passed\b', log_text)) + counts_verified = counts_verified and not re.search(r'\b[1-9][0-9]* (?:skipped|deselected)\b', log_text) + receipt = {'executed': True, 'counts_verified': counts_verified, 'returncode': result.returncode, 'warden_revision': revision, + 'net_kingdom_head': subprocess.check_output(['git', '-C', str(ROOTS['net-kingdom']), 'rev-parse', 'HEAD'], text=True).strip(), + 'verified_public_source_files': len(allowed), 'tests': manifest['validation']['tests'], + 'log_sha256': sha((PACKET / 'canonical-validation.log').read_bytes()), 'scratch': str(scratch), + 'limitations': 'Source fixture tests only; no native owner execution, acceptance, catalog promotion or pin.'} + (PACKET / 'canonical-validation.json').write_text(json.dumps(receipt, indent=2) + '\n') + print(json.dumps(receipt, indent=2)) + raise SystemExit(result.returncode or (0 if counts_verified else 1)) + +if __name__ == '__main__': + main() diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/validation-child.py b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/validation-child.py new file mode 100644 index 0000000..7e659ae --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/validation-child.py @@ -0,0 +1,43 @@ +"""Focused canonical-source test process. Network/native/estate-read guard required.""" +from pathlib import Path +import os +import socket +import subprocess +import sys +import sitecustomize + +assert sitecustomize.ACTIVE is True +assert not {'BAO_TOKEN', 'VAULT_TOKEN', 'WARDEN_AGENT_ID'} & os.environ.keys() +assert list(Path.home().iterdir()) == [] +try: + socket.socket() +except RuntimeError as error: + assert str(error) == 'fixture validation: network disabled' +else: + raise AssertionError('network guard inactive') + +import warden.case_inputs as inputs +import pytest + +assert Path(inputs.__file__).resolve() == Path('/home/worsch/ops-warden/src/warden/case_inputs.py') +PREAMBLE = '''import sys as _review_sys\ndef _review_guard(event,args):\n if event.startswith('socket.') or event in {'subprocess.Popen','os.system','os.exec','os.posix_spawn'}:\n raise RuntimeError('review validator: network/native disabled')\n if event=='open' and isinstance(args[0],str) and (args[0].startswith('/home/') or args[0].startswith('/root/')):\n raise RuntimeError('review validator: ambient home denied')\n_review_sys.addaudithook(_review_guard)\n''' +old_run = subprocess.run + +def run_pinned(arguments, *positional, **keywords): + if (type(arguments) is not list or len(arguments) != 5 + or arguments[:3] != [sys.executable, '-I', '-c'] + or arguments[3] != inputs._VALIDATE + or not str(arguments[4]).startswith(sitecustomize.VALIDATOR_PREFIX) + or keywords.get('env') != {}): + raise RuntimeError('fixture validation: unexpected process refused') + return old_run([*arguments[:3], PREAMBLE + arguments[3], arguments[4]], + *positional, **keywords) + +inputs.subprocess.run = run_pinned +raise SystemExit(pytest.main([ + '-q', '-p', 'no:cacheprovider', '--noconftest', + '-c', str(Path(os.environ['TMPDIR']).parent / 'pytest.ini'), + '--rootdir=/home/worsch/net-kingdom', + '/home/worsch/net-kingdom/sso-mfa/k8s/keycape/test_admit_1_3_type.py', + '/home/worsch/net-kingdom/sso-mfa/k8s/keycape/test_keycape_registration_adapter.py', +])) diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/validation-guard.py b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/validation-guard.py new file mode 100644 index 0000000..05f7294 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/validation-guard.py @@ -0,0 +1,35 @@ +"""Copied as sitecustomize.py into a fresh scratch directory by run_validation.""" +import json +import os +from pathlib import Path +import sys + +ALLOWED = frozenset(json.loads(Path(os.environ['WARDEN_REVIEW_ALLOWED_SOURCE_LIST']).read_text())) +VALIDATOR_PREFIX = os.environ['WARDEN_REVIEW_VALIDATOR_PREFIX'] + +def guard(event, args): + if event.startswith('socket.'): + raise RuntimeError('fixture validation: network disabled') + if event == 'subprocess.Popen': + command = args[1] + if (type(command) is list and len(command) == 5 + and command[:3] == [sys.executable, '-I', '-c'] + and command[3].startswith('import sys as _review_sys\ndef _review_guard(') + and str(command[4]).startswith(VALIDATOR_PREFIX) and args[3] == {}): + return + raise RuntimeError('fixture validation: native process disabled') + if event in {'os.system', 'os.exec', 'os.posix_spawn'}: + raise RuntimeError('fixture validation: native process disabled') + if event == 'open' and isinstance(args[0], str): + path = str(Path(args[0]).absolute()) + if path.startswith(('/home/', '/root/')): + # Only exact prehashed public source may be read from the estate. + if str(Path(path).resolve()) not in ALLOWED: + raise PermissionError('fixture validation: unlisted estate file disabled') + mode, flags = args[1:3] + if ((isinstance(mode, str) and any(c in mode for c in 'wax+')) + or (flags & (os.O_WRONLY | os.O_RDWR | os.O_CREAT | os.O_TRUNC | os.O_APPEND))): + raise PermissionError('fixture validation: canonical source writes disabled') + +sys.addaudithook(guard) +ACTIVE = True diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/validation-inputs-refresh.json b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/validation-inputs-refresh.json new file mode 100644 index 0000000..79f1714 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/validation-inputs-refresh.json @@ -0,0 +1,12 @@ +{ + "previous": "docs/changes/netkingdom-target-2026-10-17/nk48-catalog-fixture-publication-r2", + "only_source_pin_deltas": [ + { + "repo": "net-kingdom", + "path": "security-case-type-revisions/1.3/oidc-browser-relying-party/type.yaml", + "before": "sha256:e75fe94110ef9fb7fb18072fe2856941b33507c99cb406d36576046481485d0a", + "after": "sha256:ef02ddae3167bdd1558193a5f6db0379fb8cc84207531706d5ef35caabc3684f" + } + ], + "reason": "Independently reviewed exact issuer-template entry text integrated; descriptors, parameters and artifact unchanged." +} diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/verified-task-bindings.json b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/verified-task-bindings.json new file mode 100644 index 0000000..48c7229 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-current-source-publication-r3/verified-task-bindings.json @@ -0,0 +1,30 @@ +{ + "status": "verified", + "commit": "befb0bc68cd25b625804fce559476eefd702521d", + "source_and_primary_task_count": 35, + "original31bindings_unchanged": true, + "new_records": [ + { + "record_id": "NK-WP-0048-T32", + "status": "done", + "uuid": "c6d0a27e-f6a7-5df0-95f6-3e7473d38bb5" + }, + { + "record_id": "NK-WP-0048-T33", + "status": "done", + "uuid": "5ace28ff-a4cb-5647-a8f6-3cd54bb9d0a5" + }, + { + "record_id": "NK-WP-0048-T34", + "status": "progress", + "uuid": "37f43c40-d014-544e-aa0b-5219dd4a6b93" + }, + { + "record_id": "NK-WP-0048-T35", + "status": "done", + "uuid": "cf1d6ab3-846e-53ea-8575-d6347b6f4769" + } + ], + "native_gates_closed": 0, + "source_corrections_only": true +} diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-issuer-reference-integration-r1/apply.py b/docs/changes/netkingdom-target-2026-10-17/nk48-issuer-reference-integration-r1/apply.py new file mode 100644 index 0000000..28e22f0 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-issuer-reference-integration-r1/apply.py @@ -0,0 +1,57 @@ +from pathlib import Path +import hashlib,json,subprocess,copy,yaml,re,importlib.util,sys +p=Path(__file__).resolve().parent;r=Path('/home/worsch/net-kingdom');base='342a6f25af5cdc602841948f42759ea52ef1c8f5' +def git(root,*a):return subprocess.check_output(['git','-C',str(root),*a],text=True).strip() +assert git(r,'rev-parse','HEAD')==base +assert git(Path('/home/worsch/railiance-platform'),'rev-parse','HEAD')=='104ed90f42a9a86bf9fda343b49b65a85c9ee4b9' +template=Path('/home/worsch/railiance-platform/manifests/templates/keycape-issuer-eso.yaml') +assert hashlib.sha256(template.read_bytes()).hexdigest()=='e17498bd8a4c820041a4105e4efe9c60c6a50953db8f621ff54887080065c743' +name='security-case-type-revisions/1.3/oidc-browser-relying-party/type.yaml';old=(r/name).read_bytes();old_doc=yaml.safe_load(old) +assert hashlib.sha256(old).hexdigest()=='e75fe94110ef9fb7fb18072fe2856941b33507c99cb406d36576046481485d0a' +(p/'type.preimage.yaml').write_bytes(old) +patch=p.parent/'nk48-r5-f2-publication-r1/netkingdom-entry-point.conditional.patch' +assert hashlib.sha256(patch.read_bytes()).hexdigest()=='6784a21fbd10bd62712be2e0f4929034601c94629aa74ccaa2e93fc815eecd61' +subprocess.run(['git','apply','--check',str(patch.resolve())],cwd=r,check=True) +subprocess.run(['git','apply',str(patch.resolve())],cwd=r,check=True) +new=(r/name).read_bytes();new_doc=yaml.safe_load(new) +a=copy.deepcopy(old_doc);b=copy.deepcopy(new_doc) +for doc in [a,b]: + step=next(x for x in doc['spec']['follow_through'] if x['id']=='deliver-secret');step['entry_point']='same-entry-removed-for-comparison' +assert a==b,'only entry_point may change' +assert old_doc['spec']['parameters']==new_doc['spec']['parameters'] +assert old_doc['spec']['execution_descriptors']==new_doc['spec']['execution_descriptors'] +assert new_doc.get('metadata',{}).get('status')==old_doc.get('metadata',{}).get('status') +# Compose by importing the read-only seven-adapter composer, never dispatch. +sys.path.insert(0,'/home/worsch/ops-warden/src');sys.dont_write_bytecode=True +module=r/'sso-mfa/k8s/keycape/compose-1.2-descriptors.py' +spec=importlib.util.spec_from_file_location('nk48_composer',module);c=importlib.util.module_from_spec(spec);spec.loader.exec_module(c) +artifact=r/'sso-mfa/k8s/keycape/descriptor-composition-1.3.candidate.json';before=artifact.read_bytes();doc=json.loads(before) +regenerated=(json.dumps(c.artifact(doc['check_config_digest'],doc['params'],'1.3'),indent=2,sort_keys=True)+'\n').encode() +assert regenerated==before,'Unexpected descriptor/artifact delta; inspect before writing' +(p/'composition-regenerated.json').write_bytes(regenerated) +wp=r/'workplans/NK-WP-0048-security-case-types.md';text=wp.read_text();(p/'workplan.preimage.md').write_text(text) +for task,status in [('NK-WP-0048-T33','done'),('NK-WP-0048-T34','progress')]: + match=re.search(r'```task\nid: '+task+r'\n.*?```',text,re.S);assert match + before_block=match.group();assert 'status: todo\n' in before_block + text=text[:match.start()]+before_block.replace('status: todo\n','status: '+status+'\n')+text[match.end():] +needle='## T34 — Close the consumer configuration inverse finding' +completion="""2026-10-17 completed exact proposed-source reference correction: Platform +published template, metadata helper and eight focused tests in +`104ed90f42a9a86bf9fda343b49b65a85c9ee4b9`; independent source review +`nk48-r5-f2-review-r1` found no blocking source-fit defect. The proposed 1.3 +entry now names ClusterSecretStore `openbao-keycape-{client_id}-issuer`, cluster +scope restricted to `sso`, and the exact Platform template digest. Only that +entry text changes; parameters and all seven descriptors are unchanged, and +regeneration produces the identical not-an-admission composition artifact. +This closes the coordinator's vague-reference source finding only. It supplies +no formal owner assent, existing live store, installed ESO compatibility, +real delivery/removal/session capability, grant or native acceptance; existing +RPF-1.3-T4 and T16 keep those obligations. F3 is independent and remains open. +Evidence: Custodian `nk48-r5-f2-publication-r1/` and +`nk48-issuer-reference-integration-r1/` under the existing 17 October packet. + +""" +assert text.count(needle)==1;text=text.replace('and `nk48-catalog-fixture-publication-r1/`. Canonical validation/publication\nreceipts belong in the latter packet when performed.','and `nk48-catalog-fixture-publication-r2/`. Root canonical validation passes\n31 tests / 53 subtests against Warden `922c26d` (the same reviewed code plus\none normal allocator-only source UUID commit). Publication receipts belong\nin that packet.') +wp.write_text(text) +(p/'verification.json').write_text(json.dumps({'status':'integrated-proposed-source-only','only_type_delta':'deliver-secret.entry_point','type_before_sha256':hashlib.sha256(old).hexdigest(),'type_after_sha256':hashlib.sha256(new).hexdigest(),'parameters_unchanged':True,'seven_descriptors_unchanged':True,'composition_byte_identical':True,'T33':'done: exact source reference only','T34':'progress: real owner backend absent','owner_assent':False,'native_action':False},indent=2)+'\n') +print('Applied exact issuer reference, verified unchanged descriptors/parameters/artifact; recorded bounded T33 completion and T34 progress.') diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-issuer-reference-integration-r1/composition-regenerated.json b/docs/changes/netkingdom-target-2026-10-17/nk48-issuer-reference-integration-r1/composition-regenerated.json new file mode 100644 index 0000000..d18b649 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-issuer-reference-integration-r1/composition-regenerated.json @@ -0,0 +1,254 @@ +{ + "admitted": false, + "canonical_default": { + "type": "oidc-browser-relying-party@1.1", + "type_yaml_digest": "sha256:f705c64e4875e9b8e18a912fb51c135e77898926d6a451f5cb74ab3c0cbe4d1c", + "unchanged": true + }, + "check_config_digest": "sha256:be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5", + "complete_executable_descriptor_set": true, + "dispatch_permitted": false, + "execution_descriptors": { + "bind-env": "sha256:d5fcb20cf15bf7454890d2529180c582218e3df12584a99162e4b664b899caa0", + "deliver-consumer-secret": "sha256:36281df8139fb1ec64b226d94f80eb592de5addab7063ff54c691c641e275fc7", + "deliver-secret": "sha256:75aaa7346aebdea2a0eb0ba993995515b5248ffefc34caf8e713525e9b58da85", + "ensure-groups": "sha256:ebc9d5b9167d18e6015f4bbeb9699e8d396d64fbfaf195142781f84f4f47a70a", + "hand-over": "sha256:1bce07a3229b7d0c7c730f35ce5b40fe471009a82de8dd53788ed970a9be1224", + "mint-secret": "sha256:c92957227235db04953809d92b260d32c8b947472a8e8fd17a258ade3ae8da70", + "register-client": "sha256:4ecc769f75433b66c7161f13c0fe7e5599633cf466d46cb6d8031f0456f426e7" + }, + "owner_review": false, + "params": { + "consumer_owner_repo": "railiance-apps" + }, + "refusal": null, + "review_requirement": "successor candidate only: new descriptor bytes need a reviewed successor revision under canon section 6 and owner review (NK-WP-0048-T16) before pinning", + "schema": "netkingdom.descriptor-composition-candidate.v1", + "selection": "explicit version root 1.3=security-case-type-revisions/1.3; default root unchanged", + "status": "not_an_admission", + "steps": [ + { + "candidate_descriptor_digest": "sha256:ebc9d5b9167d18e6015f4bbeb9699e8d396d64fbfaf195142781f84f4f47a70a", + "descriptor": { + "actor": "human", + "adapter": "net-kingdom/ensure-groups@v1", + "adapter_source": "sha256:f93e68e1932c7ca293c9e69e2d0e1843d58d06a8d4892158fe7d1e0393a21ba0", + "allowed_created": [ + "service-group", + "service-group-membership" + ], + "effect": "change", + "lane": "keycape-attended-case-change", + "owner": "net-kingdom", + "retry_safe": false, + "revocation_scopes": [ + "parent-session" + ], + "step": "ensure-groups", + "target_parameter": "client_id", + "version": "warden.case.execution.v1" + }, + "findings": [], + "names_confirmed": null, + "owner_confirmation_required": null, + "step": "ensure-groups", + "type_lane": "keycape-attended-case-change", + "type_owner": "net-kingdom" + }, + { + "candidate_descriptor_digest": "sha256:c92957227235db04953809d92b260d32c8b947472a8e8fd17a258ade3ae8da70", + "descriptor": { + "actor": "human", + "adapter": "net-kingdom/keycape-mint-secret@v1", + "adapter_source": "sha256:34f79944204a2cf5b2a22baecbee4bde77cbdc0e3f9fc87bc98fa12a9c2c0bc1", + "allowed_created": [ + "custody-secret-version" + ], + "effect": "mint", + "lane": "keycape-client-secret-generate", + "owner": "railiance-platform", + "retry_safe": false, + "revocation_scopes": [ + "parent-session", + "broker-grant" + ], + "step": "mint-secret", + "target_parameter": "client_id", + "version": "warden.case.execution.v1" + }, + "findings": [], + "names_confirmed": { + "by": "founder", + "on": "2026-10-17", + "schema": "railiance-platform.custody-mint.v1", + "task": "NK-WP-0048-T25" + }, + "owner_confirmation_required": null, + "step": "mint-secret", + "type_lane": "keycape-client-secret-generate", + "type_owner": "railiance-platform" + }, + { + "candidate_descriptor_digest": "sha256:75aaa7346aebdea2a0eb0ba993995515b5248ffefc34caf8e713525e9b58da85", + "descriptor": { + "actor": "human", + "adapter": "net-kingdom/deliver-secret@v1", + "adapter_source": "sha256:df609bb93ebdfffb12cde213381a77eb7ac82670f814ff73623c1d98262cc90e", + "allowed_created": [ + "delivered-secret" + ], + "effect": "change", + "lane": "platform-secret-delivery", + "owner": "railiance-platform", + "retry_safe": false, + "revocation_scopes": [ + "parent-session" + ], + "step": "deliver-secret", + "target_parameter": "client_id", + "version": "warden.case.execution.v1" + }, + "findings": [], + "names_confirmed": { + "by": "founder", + "lane": "platform-secret-delivery", + "on": "2026-10-17", + "schema": "netkingdom.deliver-secret.v1", + "task": "NK-WP-0048-T26" + }, + "owner_confirmation_required": null, + "step": "deliver-secret", + "type_lane": "platform-secret-delivery", + "type_owner": "railiance-platform" + }, + { + "candidate_descriptor_digest": "sha256:d5fcb20cf15bf7454890d2529180c582218e3df12584a99162e4b664b899caa0", + "descriptor": { + "actor": "human", + "adapter": "net-kingdom/keycape-bind-env@v1", + "adapter_source": "sha256:dcd43f5ce1c4e829e1198faffc6bfb9cc610509f5176658f42c133accc0a7305", + "allowed_created": [ + "keycape-env-binding" + ], + "effect": "change", + "lane": "keycape-attended-case-change", + "owner": "net-kingdom", + "retry_safe": false, + "revocation_scopes": [ + "parent-session" + ], + "step": "bind-env", + "target_parameter": "client_id", + "version": "warden.case.execution.v1" + }, + "findings": [], + "names_confirmed": { + "by": "founder", + "on": "2026-10-17", + "schema": "netkingdom.keycape-bind-env.attempt.v1", + "task": "NK-WP-0048-T27" + }, + "owner_confirmation_required": null, + "step": "bind-env", + "type_lane": "keycape-attended-case-change", + "type_owner": "net-kingdom" + }, + { + "candidate_descriptor_digest": "sha256:4ecc769f75433b66c7161f13c0fe7e5599633cf466d46cb6d8031f0456f426e7", + "descriptor": { + "actor": "human", + "adapter": "net-kingdom/keycape-registration@v1", + "adapter_source": "sha256:b30f7abfbb5bf439c5ce067325b01c8b711076a38a6fb8484f55d5c8912921f3", + "allowed_created": [ + "keycape-client" + ], + "effect": "change", + "lane": "keycape-attended-case-change", + "owner": "net-kingdom", + "retry_safe": false, + "revocation_scopes": [ + "parent-session" + ], + "step": "register-client", + "target_parameter": "client_id", + "version": "warden.case.execution.v1" + }, + "findings": [], + "names_confirmed": null, + "owner_confirmation_required": null, + "step": "register-client", + "type_lane": "keycape-attended-case-change", + "type_owner": "net-kingdom" + }, + { + "candidate_descriptor_digest": "sha256:36281df8139fb1ec64b226d94f80eb592de5addab7063ff54c691c641e275fc7", + "descriptor": { + "actor": "human", + "adapter": "net-kingdom/deliver-consumer-secret@v1", + "adapter_source": "sha256:66f16dcb665216d09ef63a5ca654283a0292005ba4fb4d79c27eeb54b886a385", + "allowed_created": [ + "consumer-eso-sa", + "consumer-secretstore", + "consumer-externalsecret" + ], + "effect": "change", + "lane": "consumer-owner-deployment", + "owner": "railiance-apps", + "retry_safe": false, + "revocation_scopes": [ + "parent-session" + ], + "step": "deliver-consumer-secret", + "target_parameter": "client_id", + "version": "warden.case.execution.v1" + }, + "findings": [], + "names_confirmed": { + "by": "founder", + "lane": "consumer-owner-deployment", + "on": "2026-10-17", + "schema": "netkingdom.consumer-secret-delivery.v1", + "task": "NK-WP-0048-T28" + }, + "owner_confirmation_required": null, + "step": "deliver-consumer-secret", + "type_lane": "consumer-owner-deployment", + "type_owner": "{consumer_owner_repo}" + }, + { + "candidate_descriptor_digest": "sha256:1bce07a3229b7d0c7c730f35ce5b40fe471009a82de8dd53788ed970a9be1224", + "descriptor": { + "actor": "human", + "adapter": "net-kingdom/apps-handover@v1", + "adapter_source": "sha256:4439305b3edcd5d51c73e6438744d8895d69c1ccb58854aac79bb489d868cf48", + "allowed_created": [ + "handover-receipt" + ], + "effect": "change", + "lane": "apps-consumer-handover", + "owner": "railiance-apps", + "retry_safe": false, + "revocation_scopes": [ + "parent-session" + ], + "step": "hand-over", + "target_parameter": "client_id", + "version": "warden.case.execution.v1" + }, + "findings": [], + "names_confirmed": { + "by": "founder", + "lane": "apps-consumer-handover", + "on": "2026-10-17", + "schema": "netkingdom.apps-handover.attempt.v1", + "task": "NK-WP-0048-T29" + }, + "owner_confirmation_required": null, + "step": "hand-over", + "type_lane": "apps-consumer-handover", + "type_owner": "{consumer_owner_repo}" + } + ], + "task": "NK-WP-0048-T30", + "type": "oidc-browser-relying-party@1.3" +}