Request independent r2 review of the NK-WP-0048 1.2 adapter set at 68f4bbb

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/changes/netkingdom-target-2026-10-17/nk48-adapters-1.2-review/README-r2.md

@@ -0,0 +1,126 @@
+# Review request: NK-WP-0048 seven-step 1.2 adapter set (r2)
+
+Requested 2026-10-17 by the founder. This is the full independent coordinator
+source review that r1 did not finish. r1 (`coordinator-review-r1.json`) rejected
+the set on finding NK48-R1-F1 and stopped there. The other six adapters, the
+composer and the known limits were never reviewed. The r1 request (`README.md`)
+still holds except where this file changes it.
+
+## Provenance, so the reviewer can judge independence
+
+Two sessions have touched this code, and neither should review it:
+
+- One Claude Code orchestration session wrote the original adapter set through
+  subagent workers (up to `582ab9f`).
+- A second session did review r1 and then, at the founder's request, wrote both
+  fix commits (`410d523`, `68f4bbb`).
+
+Run r2 in a **third, separate session** with none of either session's context.
+Do not ask either session for explanations; read the source.
+
+## Frozen review target
+
+Repository `net-kingdom`, commit `68f4bbb8ca613940505d72523319a2f6281067d3`
+(work since `2019e82`; 24 commits, the 22 reviewed in r1 plus two fix commits).
+All files are in `sso-mfa/k8s/keycape/`. sha256 at that commit:
+
+| File | Task | sha256 | Since r1 |
+|---|---|---|---|
+| keycape-registration-adapter.py | T13, changed by T15 source | 021eee262ea5d23d46258ed819da57b331f07b814adcafd60e0941214be02aea | unchanged |
+| ensure-groups-adapter.py | T24 | 19325fc599ae76e7ec2b54c132b1cf7dea1b5e931bb5263031dbdf8f4c0bcc7f | unchanged |
+| mint-secret-adapter.py | T25 | b4b0cc7f6d7b922256aaa7b66b7a8c0b37cf916928ced4834c1beb7a21454955 | **changed** |
+| deliver-secret-adapter.py | T26 | b97df5710e388ca57b9f239a2900bc29e0b1c1fe1740a1f7987636b44343cf80 | unchanged |
+| bind-env-adapter.py | T27 | 3f1c6426e31806d969336b6fdfecd8dd321ec0ca43b50b20213cc9f7637f7c7e | unchanged |
+| deliver-consumer-secret-adapter.py | T28 | d046eed63090d4e0849a931e2650ccfd89d3b686843aed9e5cb35a0e18e513ee | unchanged |
+| handover-adapter.py | T29 | 0efc300a7b2765bce8da140d5c4666d9cb30daf02b4cbf0e0df96cba7c33d026 | unchanged |
+| compose-1.2-descriptors.py | T30 | 8755f479f13f8978592a1346bcf8fdbb642eaece99ec29d31cc18091c655cffc | **changed** (comment only) |
+| descriptor-composition-1.2.candidate.json | T30 | 9dc5606d6e823084b7d1c1ace2a06408197c23de5ed31a05ba21787e5458d2d2 | **changed** (regenerated) |
+
+Review every file in full, unchanged ones included: r1 reviewed none of them to a
+verdict. Tests and `.md` contract notes are in scope as evidence, not as review
+targets. The Warden kernel is still ops-warden `a45cf47`
+(`src/warden/case_run.py`, `src/warden/case_inputs.py`), out of scope for review
+but the admission contract to check against.
+
+## What changed since r1
+
+- **Founder decision, 2026-10-17:** the mint-secret actor is `human`. This
+  replaces the earlier `agent` decision, because the unchanged kernel refuses an
+  `effect: mint` admission whose actor is not `human` ("agent mint is forbidden").
+  The kernel is still unchanged.
+- `410d523`: mint-secret descriptor actor `agent` to `human`; its test, the
+  composer comment and composer test updated; artifact regenerated. Only the
+  mint-secret entry changed: actor, `adapter_source` and descriptor digest (now
+  `sha256:8c40c2884f8ba15e8cb6c98f33419c395e54fce8ef33d6e1a34782cf3f1fcfa9`).
+- `68f4bbb`: new `test_admit_1_2_adapter_descriptors.py` (sha256
+  `7ca824283564f3ac381b9145b0ca80a052dd9b70c2cce4a95c8dce544882a684`). It runs
+  `Executor.admit` on all seven composed descriptors with the real 1.2 type, the
+  1.2 forgejo example case, the kernel's `BrowserInputs` validator and
+  fixture-only trust (stand-in adapters, nothing dispatched). It also pins the
+  agent-mint and wrong-lane refusals. Its acceptance block is a fixture, not an
+  owner record.
+
+Decide for yourself whether this test proves what it claims. In particular,
+check that it fails against the old `agent` revision, that stand-in adapters do
+not hide a real source-pin mismatch, and that fixture admission is not mistaken
+for owner admission.
+
+## Reproduce
+
+The tests need the full repository tree, because ensure-groups imports
+`identity-provisioner/group_provenance_postgres.py`. A keycape-only export fails
+at collection. Use clean exports of both frozen commits rather than the working
+checkouts, which carry unrelated uncommitted changes:
+
+```bash
+mkdir -p "$SCRATCH/nk" "$SCRATCH/ow"
+git -C ~/net-kingdom archive 68f4bbb | tar -x -C "$SCRATCH/nk"
+git -C ~/ops-warden  archive a45cf47 src | tar -x -C "$SCRATCH/ow"
+cd "$SCRATCH/nk/sso-mfa/k8s/keycape"
+PYTHONPATH="$SCRATCH/ow/src" ~/ops-warden/.venv/bin/python -m pytest -q -p no:cacheprovider \
+  test_*adapter*.py test_registration_original_intent_reconcile.py test_compose_1_2_descriptors.py
+```
+
+The authors report 102 passed, 85 subtests passed. Don't take it on trust.
+
+## What to check
+
+1. **NK48-R1-F1 resolution.** The mint-secret descriptor passes `Executor.admit`
+   under a45cf47 with actor `human`, and an agent actor is still refused. The
+   artifact's `complete_executable_descriptor_set: true` is now true at
+   admission, not only at `Descriptor.decode`.
+2. **Checks 1-8 from the r1 request, for every adapter and the composer:**
+   source binding and drift refusal (including import closures such as
+   ensure-groups' identity-provisioner files); value-free receipts with closed
+   schemas; created-only rollback with owner-authenticated evidence and
+   NO_CHANGE for pre-existing objects; parent-session revocation on every
+   attempt; pins, admitted invocation and attempt binding, with wrong lane,
+   owner or target refused; canonical 1.1 as default with 1.2 only by explicit
+   version root and no `--allow-unimplemented`; the T15 reconcile properties of
+   the registration adapter; the composer's refusals and fresh-regeneration
+   equality.
+3. **Known limits.** Confirm or reject each: bind-env has no kernel-level fixture
+   tests like T13's; ensure-groups carries its own copy of the provisioner's group
+   binding, checked by a parity test; all owner capabilities are injected
+   stand-ins.
+4. **r1 observation, not yet a finding.** In mint-secret's `finally` block,
+   `revoke_session(inv)` and `revoke_grant(inv)` are called in one expression.
+   If session revocation raises, broker-grant revocation is skipped for that
+   attempt. Decide whether this is a defect, and check whether other adapters
+   with more than one revocation scope share the pattern.
+
+## Expected output
+
+Write `coordinator-review-r2.json` in this directory, shaped like
+`coordinator-review-r1.json`: schema, revision `r2`, the frozen commit and the
+hashes above (verified), a per-file verdict (approved / rejected with finding),
+an independent reconstruction count, the disposition of NK48-R1-F1, the
+known-limit verdicts, `native_acceptance: false` and what remains.
+
+Unlike r1, **review every file before stopping**, so one revision can fix all
+defects. Record every rejection; don't fix anything during review. Defects are
+fixed in net-kingdom as a new revision and reviewed as r3.
+
+Hard limits: no live or native action, no kubectl, SSH or secret access, and no
+edits to net-kingdom or ops-warden. This review grants no owner admission, pin or
+native authority. Those stay with NK-WP-0048-T16 and the founder.