From 94827c3de288081f08582c19c5a90c5c603132b7 Mon Sep 17 00:00:00 2001 From: codex Date: Sat, 17 Oct 2026 10:52:20 +0200 Subject: [PATCH] Request independent r2 review of the NK-WP-0048 1.2 adapter set at 68f4bbb Co-Authored-By: Claude Opus 5.5 --- .../nk48-adapters-1.2-review/README-r2.md | 126 ++++++++++++++++++ 1 file changed, 126 insertions(+) create mode 100644 docs/changes/netkingdom-target-2026-10-17/nk48-adapters-1.2-review/README-r2.md diff --git a/docs/changes/netkingdom-target-2026-10-17/nk48-adapters-1.2-review/README-r2.md b/docs/changes/netkingdom-target-2026-10-17/nk48-adapters-1.2-review/README-r2.md new file mode 100644 index 00000000..169c78dc --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/nk48-adapters-1.2-review/README-r2.md @@ -0,0 +1,126 @@ +# Review request: NK-WP-0048 seven-step 1.2 adapter set (r2) + +Requested 2026-10-17 by the founder. This is the full independent coordinator +source review that r1 did not finish. r1 (`coordinator-review-r1.json`) rejected +the set on finding NK48-R1-F1 and stopped there. The other six adapters, the +composer and the known limits were never reviewed. The r1 request (`README.md`) +still holds except where this file changes it. + +## Provenance, so the reviewer can judge independence + +Two sessions have touched this code, and neither should review it: + +- One Claude Code orchestration session wrote the original adapter set through + subagent workers (up to `582ab9f`). +- A second session did review r1 and then, at the founder's request, wrote both + fix commits (`410d523`, `68f4bbb`). + +Run r2 in a **third, separate session** with none of either session's context. +Do not ask either session for explanations; read the source. + +## Frozen review target + +Repository `net-kingdom`, commit `68f4bbb8ca613940505d72523319a2f6281067d3` +(work since `2019e82`; 24 commits, the 22 reviewed in r1 plus two fix commits). +All files are in `sso-mfa/k8s/keycape/`. sha256 at that commit: + +| File | Task | sha256 | Since r1 | +|---|---|---|---| +| keycape-registration-adapter.py | T13, changed by T15 source | 021eee262ea5d23d46258ed819da57b331f07b814adcafd60e0941214be02aea | unchanged | +| ensure-groups-adapter.py | T24 | 19325fc599ae76e7ec2b54c132b1cf7dea1b5e931bb5263031dbdf8f4c0bcc7f | unchanged | +| mint-secret-adapter.py | T25 | b4b0cc7f6d7b922256aaa7b66b7a8c0b37cf916928ced4834c1beb7a21454955 | **changed** | +| deliver-secret-adapter.py | T26 | b97df5710e388ca57b9f239a2900bc29e0b1c1fe1740a1f7987636b44343cf80 | unchanged | +| bind-env-adapter.py | T27 | 3f1c6426e31806d969336b6fdfecd8dd321ec0ca43b50b20213cc9f7637f7c7e | unchanged | +| deliver-consumer-secret-adapter.py | T28 | d046eed63090d4e0849a931e2650ccfd89d3b686843aed9e5cb35a0e18e513ee | unchanged | +| handover-adapter.py | T29 | 0efc300a7b2765bce8da140d5c4666d9cb30daf02b4cbf0e0df96cba7c33d026 | unchanged | +| compose-1.2-descriptors.py | T30 | 8755f479f13f8978592a1346bcf8fdbb642eaece99ec29d31cc18091c655cffc | **changed** (comment only) | +| descriptor-composition-1.2.candidate.json | T30 | 9dc5606d6e823084b7d1c1ace2a06408197c23de5ed31a05ba21787e5458d2d2 | **changed** (regenerated) | + +Review every file in full, unchanged ones included: r1 reviewed none of them to a +verdict. Tests and `.md` contract notes are in scope as evidence, not as review +targets. The Warden kernel is still ops-warden `a45cf47` +(`src/warden/case_run.py`, `src/warden/case_inputs.py`), out of scope for review +but the admission contract to check against. + +## What changed since r1 + +- **Founder decision, 2026-10-17:** the mint-secret actor is `human`. This + replaces the earlier `agent` decision, because the unchanged kernel refuses an + `effect: mint` admission whose actor is not `human` ("agent mint is forbidden"). + The kernel is still unchanged. +- `410d523`: mint-secret descriptor actor `agent` to `human`; its test, the + composer comment and composer test updated; artifact regenerated. Only the + mint-secret entry changed: actor, `adapter_source` and descriptor digest (now + `sha256:8c40c2884f8ba15e8cb6c98f33419c395e54fce8ef33d6e1a34782cf3f1fcfa9`). +- `68f4bbb`: new `test_admit_1_2_adapter_descriptors.py` (sha256 + `7ca824283564f3ac381b9145b0ca80a052dd9b70c2cce4a95c8dce544882a684`). It runs + `Executor.admit` on all seven composed descriptors with the real 1.2 type, the + 1.2 forgejo example case, the kernel's `BrowserInputs` validator and + fixture-only trust (stand-in adapters, nothing dispatched). It also pins the + agent-mint and wrong-lane refusals. Its acceptance block is a fixture, not an + owner record. + +Decide for yourself whether this test proves what it claims. In particular, +check that it fails against the old `agent` revision, that stand-in adapters do +not hide a real source-pin mismatch, and that fixture admission is not mistaken +for owner admission. + +## Reproduce + +The tests need the full repository tree, because ensure-groups imports +`identity-provisioner/group_provenance_postgres.py`. A keycape-only export fails +at collection. Use clean exports of both frozen commits rather than the working +checkouts, which carry unrelated uncommitted changes: + +```bash +mkdir -p "$SCRATCH/nk" "$SCRATCH/ow" +git -C ~/net-kingdom archive 68f4bbb | tar -x -C "$SCRATCH/nk" +git -C ~/ops-warden archive a45cf47 src | tar -x -C "$SCRATCH/ow" +cd "$SCRATCH/nk/sso-mfa/k8s/keycape" +PYTHONPATH="$SCRATCH/ow/src" ~/ops-warden/.venv/bin/python -m pytest -q -p no:cacheprovider \ + test_*adapter*.py test_registration_original_intent_reconcile.py test_compose_1_2_descriptors.py +``` + +The authors report 102 passed, 85 subtests passed. Don't take it on trust. + +## What to check + +1. **NK48-R1-F1 resolution.** The mint-secret descriptor passes `Executor.admit` + under a45cf47 with actor `human`, and an agent actor is still refused. The + artifact's `complete_executable_descriptor_set: true` is now true at + admission, not only at `Descriptor.decode`. +2. **Checks 1-8 from the r1 request, for every adapter and the composer:** + source binding and drift refusal (including import closures such as + ensure-groups' identity-provisioner files); value-free receipts with closed + schemas; created-only rollback with owner-authenticated evidence and + NO_CHANGE for pre-existing objects; parent-session revocation on every + attempt; pins, admitted invocation and attempt binding, with wrong lane, + owner or target refused; canonical 1.1 as default with 1.2 only by explicit + version root and no `--allow-unimplemented`; the T15 reconcile properties of + the registration adapter; the composer's refusals and fresh-regeneration + equality. +3. **Known limits.** Confirm or reject each: bind-env has no kernel-level fixture + tests like T13's; ensure-groups carries its own copy of the provisioner's group + binding, checked by a parity test; all owner capabilities are injected + stand-ins. +4. **r1 observation, not yet a finding.** In mint-secret's `finally` block, + `revoke_session(inv)` and `revoke_grant(inv)` are called in one expression. + If session revocation raises, broker-grant revocation is skipped for that + attempt. Decide whether this is a defect, and check whether other adapters + with more than one revocation scope share the pattern. + +## Expected output + +Write `coordinator-review-r2.json` in this directory, shaped like +`coordinator-review-r1.json`: schema, revision `r2`, the frozen commit and the +hashes above (verified), a per-file verdict (approved / rejected with finding), +an independent reconstruction count, the disposition of NK48-R1-F1, the +known-limit verdicts, `native_acceptance: false` and what remains. + +Unlike r1, **review every file before stopping**, so one revision can fix all +defects. Record every rejection; don't fix anything during review. Defects are +fixed in net-kingdom as a new revision and reviewed as r3. + +Hard limits: no live or native action, no kubectl, SSH or secret access, and no +edits to net-kingdom or ops-warden. This review grants no owner admission, pin or +native authority. Those stay with NK-WP-0048-T16 and the founder.