From a3e98b1f3ec54755911f9a8efd3c11dc036a8656 Mon Sep 17 00:00:00 2001 From: codex Date: Fri, 16 Oct 2026 23:37:06 +0200 Subject: [PATCH] Advance security target with checker custody and recovery lifecycle proof --- .../browser-resume-r1/README.md | 85 ++++ .../canonical-integration.json | 112 ++++++ .../browser-resume-r1/coordinator-review.json | 48 +++ .../coordinator-r6-all-review.json | 86 ++++ .../publication-r7/review.json | 13 + .../r6-deadline-reaper.json | 1 + .../r6-hard-parent-loss-reaper.json | 1 + .../r6-nonzero-after-accept-reaper.json | 1 + ...r6-public-manifest-scanner-diagnostic.json | 45 +++ .../verify_r6_cleanup.py | 84 ++++ .../resume-audit-r1/README.md | 97 +++++ .../resume-audit-r1/daily-host-readiness.json | 29 ++ .../resume-audit-r1/measure_scanner.py | 114 ++++++ .../rein-profile-readiness.json | 12 + .../resume-audit-r1/scanner-baseline.json | 370 ++++++++++++++++++ docs/netkingdom-target-implementation.md | 85 +++- ...gdom-security-blueprint-and-gap-closure.md | 30 ++ 17 files changed, 1211 insertions(+), 2 deletions(-) create mode 100644 docs/changes/netkingdom-target-2026-10-16/browser-resume-r1/README.md create mode 100644 docs/changes/netkingdom-target-2026-10-16/browser-resume-r1/canonical-integration.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/browser-resume-r1/coordinator-review.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/coordinator-r6-all-review.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/publication-r7/review.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/r6-deadline-reaper.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/r6-hard-parent-loss-reaper.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/r6-nonzero-after-accept-reaper.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/r6-public-manifest-scanner-diagnostic.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/verify_r6_cleanup.py create mode 100644 docs/changes/netkingdom-target-2026-10-16/resume-audit-r1/README.md create mode 100644 docs/changes/netkingdom-target-2026-10-16/resume-audit-r1/daily-host-readiness.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/resume-audit-r1/measure_scanner.py create mode 100644 docs/changes/netkingdom-target-2026-10-16/resume-audit-r1/rein-profile-readiness.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/resume-audit-r1/scanner-baseline.json diff --git a/docs/changes/netkingdom-target-2026-10-16/browser-resume-r1/README.md b/docs/changes/netkingdom-target-2026-10-16/browser-resume-r1/README.md new file mode 100644 index 00000000..8c1667da --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/browser-resume-r1/README.md @@ -0,0 +1,85 @@ +# Browser registration executable snapshot candidate — R1 + +Source candidate only, 2026-10-16. No canonical repository edits, production +access, credentials, messages, owner assent or type acknowledgment occurred. + +Base: NetKingdom `cbabb6dc3611dc9b9a304b175b17e132ae057bac` (documentation +successor of implementation `916ba4b33e03179274d03b78bd898a4843e8653f`). +`manifest.json` records every preimage/postimage SHA-256, exact checker digest, +Warden revision, test commands/environment and descriptor composition digest. +Candidate checkout: `/tmp/netkingdom-browser-resume-r1`. + +## Change and evidence + +The existing registration adapter hashes a mutable file before the helper later +executes its pathname. Replacing that file in between can select different code. +The retained predecessor counterexample exercises the actual Go checker helper +boundary: replacement after selection makes the unchanged predecessor execute a +decoy and fail. It is not a successful native case or an observed production +exploit. Historical R1/R2/R3 and environment correction evidence remain untouched. + +The candidate opens the selected file with O_NOFOLLOW, O_NONBLOCK and CLOEXEC, +refuses non-regular or over-64-MiB input, verifies the original descriptor digest, +and snapshots exact bytes into a Linux memfd. Write/grow/shrink/seal-removal +seals are installed and read back before helper use. Both helper checker calls +inherit only that descriptor and execute `/proc/self/fd/N`, with the existing +empty environment and timeout. The fd closes before evidence publication and +also on exceptions. Snapshot failure still reaches existing parent-session +revocation and yields no success evidence. The redundant earlier unbounded path +read was removed following coordinator review; reachable adapter tests cover the +refusal paths rather than only testing the snapshot function. + +No fexecve dependency is introduced. The runtime must support Linux memfd seals, +allow executable memfds and provide usable procfs; refusal remains unavailable +rather than falling back to mutable execution. The compiled static Linux/amd64 +Go artifact from the existing verified build executes successfully this way. +This is a per-attempt immutable executable snapshot. It does not establish native +owner artifact storage, independently admitted executable provenance, protection +against a compromised interpreter/kernel, dynamic-library custody or agent +isolation. Final-component symlinks are refused; parent-directory trust is not +established by O_NOFOLLOW. The descriptor binds content, not a location claim. + +The existing descriptor structure, reference, fixed source filename closure, +owner callbacks and normal Warden producer pins remain unchanged. Changed adapter +and helper bytes change the source composition and descriptor digest. The +proposed successor descriptor in this packet requires separate source review and +ordinary owner/type admission; it is not written into an acknowledged type. + +Verification: 49 affected source checks pass, including ten new snapshot/adapter +refusal checks; 12 actual-artifact helper/kernel scenarios pass. These sets +overlap intentionally. Tests include read-only fd write/truncate refusal, +reopened proc fd write/shared writable mmap refusal even after mode changes, +symlink/FIFO/oversized-source refusal before helper, unavailable memfd revocation, +actual path replacement and in-place overwrite, config allow/deny, source drift, +CAS/readback, kernel rollback and uncertainty. The first expanded mutation test +failed because mode 0500 already blocked O_RDWR; its retained log records that +fixture mistake. The corrected fixture restores mode before proving the seals. + +## Remaining acceptance and next source steps + +- T16: select actual owner evidence publisher/authenticator and exact attempt + parent-session revoker. Warden's Executor still ships no native adapters or + verifier. A JSON reference, a successful fixture or this packet cannot replace + its independent purpose/source/evidence verifier. Review complete descriptor + and artifact/source/config pins and select an explicit type version normally. +- T12: Deployment env binding, exact config readback, restart/readiness remain + source integration work; a successful registry edit does not restart KeyCape. +- T14: `identity-provisioner/provisioner.py:230` returns only groups ensured and + preexisting-group coverage. It omits newly created memberships. Its revoke at + line 252 removes listed current memberships and can delete any empty listed + group. Do not expose it as reversible case creation. Next implementation must + retain prestate and exact created group/membership identities before effects, + preserve preexisting/shared state and bind rollback to authenticated provenance. +- T15: the adapter retains only process-local authenticated creation records and + intentionally has no reconcile callback. Next source work needs the selected + owner evidence holder and authenticated original-attempt lookup, current native + revision check and restart/lost-receipt fixtures. Do not reconstruct rollback + authority from unsigned JSON or replay an uncertain add. +- Platform structural/mint/broker/delivery receipts, Apps login/group denial, + session/revocation proof, native rollback and separately authorized attended + recovery remain required. This candidate closes none of those gates. + +The knowledge package reported 0.2.6, digest +`8d1d6a9d4d07fec7b619618de7dfe2254c1790f85f4198c7fe19db9751c02`, with guidance +withheld because source changed. Direct NetKingdom/KeyCape/Warden source and +instructions were reviewed instead; no offline guidance was treated as authority. diff --git a/docs/changes/netkingdom-target-2026-10-16/browser-resume-r1/canonical-integration.json b/docs/changes/netkingdom-target-2026-10-16/browser-resume-r1/canonical-integration.json new file mode 100644 index 00000000..6418a256 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/browser-resume-r1/canonical-integration.json @@ -0,0 +1,112 @@ +{ + "source_commit": "8790dd18ae83c4651ef3d1d923312a118a5b436b", + "published_remote_main": "8790dd18ae83c4651ef3d1d923312a118a5b436b", + "canonical_source_hashes_match": true, + "normal_sync_exit": 0, + "normal_sync_summary": { + "fail": 0, + "automation_error": 0, + "warn": 27, + "info": 5 + }, + "tasks": [ + { + "id": "NK-WP-0048-T01", + "status": "done", + "matches": true + }, + { + "id": "NK-WP-0048-T02", + "status": "done", + "matches": true + }, + { + "id": "NK-WP-0048-T03", + "status": "done", + "matches": true + }, + { + "id": "NK-WP-0048-T04", + "status": "done", + "matches": true + }, + { + "id": "NK-WP-0048-T05", + "status": "done", + "matches": true + }, + { + "id": "NK-WP-0048-T06", + "status": "wait", + "matches": true + }, + { + "id": "NK-WP-0048-T07", + "status": "wait", + "matches": true + }, + { + "id": "NK-WP-0048-T08", + "status": "done", + "matches": true + }, + { + "id": "NK-WP-0048-T09", + "status": "done", + "matches": true + }, + { + "id": "NK-WP-0048-T10", + "status": "done", + "matches": true + }, + { + "id": "NK-WP-0048-T11", + "status": "done", + "matches": true + }, + { + "id": "NK-WP-0048-T12", + "status": "todo", + "matches": true + }, + { + "id": "NK-WP-0048-T13", + "status": "done", + "matches": true + }, + { + "id": "NK-WP-0048-T14", + "status": "todo", + "matches": true + }, + { + "id": "NK-WP-0048-T15", + "status": "todo", + "matches": true + }, + { + "id": "NK-WP-0048-T16", + "status": "todo", + "matches": true + }, + { + "id": "NK-WP-0048-T17", + "status": "done", + "matches": true + }, + { + "id": "NK-WP-0048-T18", + "status": "done", + "matches": true + }, + { + "id": "NK-WP-0048-T19", + "status": "done", + "matches": true + } + ], + "original_staged_and_working_brief_restored": true, + "subagent_limit": "Agent exhausted model usage after source sync completed; coordinator verified actual receipts and projection.", + "native_acceptance": false +} diff --git a/docs/changes/netkingdom-target-2026-10-16/browser-resume-r1/coordinator-review.json b/docs/changes/netkingdom-target-2026-10-16/browser-resume-r1/coordinator-review.json new file mode 100644 index 00000000..c749a520 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/browser-resume-r1/coordinator-review.json @@ -0,0 +1,48 @@ +{ + "observed_at": "2026-10-16T21:18:15.001232+00:00", + "reviewer": "custodian-coordinator", + "scope": "source integration only; no native admission or custody", + "patch_sha256": "5ad1202976684a9fc8ced266a0148c0660e355301c9e6e6df25cdaff92e01337", + "independent_checks": { + "affected_source": { + "tests": 49, + "exit_code": 0 + }, + "real_checker_helper_kernel": { + "tests": 12, + "exit_code": 0 + }, + "canonical_apply_check": true + }, + "canonical_applied": true, + "files": [ + { + "path": "sso-mfa/k8s/keycape/keycape-registration-adapter.py", + "sha256": "d7e3643cc794223dfaa310775eacbbeb4d353f9382e4481322d704d6b7ab1c51" + }, + { + "path": "sso-mfa/k8s/keycape/keycape-client.py", + "sha256": "4b63161cf3365d34dd684a3116e2c935baaf7f6aa4b30983f6883546db3d6591" + }, + { + "path": "sso-mfa/k8s/keycape/registration-adapter.md", + "sha256": "2fadcbd28e34566173428bcb92e42ac464ef73c03909072d0fc2ee988b175e29" + }, + { + "path": "sso-mfa/k8s/keycape/test_keycape_registration_adapter.py", + "sha256": "cc5956d811db031e437ebca60bf70eb41177c87db75cc9478fe84075ad224464" + }, + { + "path": "sso-mfa/k8s/keycape/test_keycape_checker_snapshot.py", + "sha256": "9271f25c760ad732c257d59d259b5c767436a2dc2d5ba24fca259bc57761d6d1" + } + ], + "refinement": "Initial candidate kept unbounded read_bytes in binding; removed and reachable symlink/FIFO/oversize refusal regressions passed.", + "remaining": [ + "native descriptor and artifact custody admission", + "owner evidence and session revocation callbacks", + "group provenance", + "durable restart reconciliation", + "native browser acceptance" + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/coordinator-r6-all-review.json b/docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/coordinator-r6-all-review.json new file mode 100644 index 00000000..525b0233 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/coordinator-r6-all-review.json @@ -0,0 +1,86 @@ +{ + "observed_at": "2026-10-16T21:27:29.368669+00:00", + "engine": { + "id": "74f93783-6cef-43a8-a3c4-f62586cd3bc1", + "name": "bnt-lap001" + }, + "manifest_sha256": "3f39a33891f25c36adcdc8137afac3be064a3011e15d9a06da60a3155bacea56", + "cases": [ + { + "case": "positive", + "containers_absent": [ + "nk49-kc-2d751a5178a143a582e9258fcf587370-transport", + "nk49-kc-2d751a5178a143a582e9258fcf587370-issuer", + "nk49-kc-2d751a5178a143a582e9258fcf587370-image-probe" + ], + "volumes_absent": [ + "nk49-kc-2d751a5178a143a582e9258fcf587370-v0", + "nk49-kc-2d751a5178a143a582e9258fcf587370-v1", + "nk49-kc-2d751a5178a143a582e9258fcf587370-v2", + "nk49-kc-2d751a5178a143a582e9258fcf587370-v3" + ], + "plaintext_absent": true, + "label_inventories_empty": true + }, + { + "case": "hard-parent-loss", + "containers_absent": [ + "nk49-kc-279dd8bb0c83428a961da8833dbdbe07-transport", + "nk49-kc-279dd8bb0c83428a961da8833dbdbe07-issuer", + "nk49-kc-279dd8bb0c83428a961da8833dbdbe07-image-probe" + ], + "volumes_absent": [ + "nk49-kc-279dd8bb0c83428a961da8833dbdbe07-v0", + "nk49-kc-279dd8bb0c83428a961da8833dbdbe07-v1", + "nk49-kc-279dd8bb0c83428a961da8833dbdbe07-v2", + "nk49-kc-279dd8bb0c83428a961da8833dbdbe07-v3" + ], + "plaintext_absent": true, + "label_inventories_empty": true, + "reaper_status": "bounded_cleanup_verified", + "reaper_sha256": "ff177a85a0f2fe21cf78cada1d453f5e312fcd5e8eb5992350267bfc3c3d9be0" + }, + { + "case": "deadline", + "containers_absent": [ + "nk49-kc-b4de71b2e3fd4a42a3c4ff4a592735c4-transport", + "nk49-kc-b4de71b2e3fd4a42a3c4ff4a592735c4-issuer", + "nk49-kc-b4de71b2e3fd4a42a3c4ff4a592735c4-image-probe" + ], + "volumes_absent": [ + "nk49-kc-b4de71b2e3fd4a42a3c4ff4a592735c4-v0", + "nk49-kc-b4de71b2e3fd4a42a3c4ff4a592735c4-v1", + "nk49-kc-b4de71b2e3fd4a42a3c4ff4a592735c4-v2", + "nk49-kc-b4de71b2e3fd4a42a3c4ff4a592735c4-v3" + ], + "plaintext_absent": true, + "label_inventories_empty": true, + "reaper_status": "bounded_cleanup_verified", + "reaper_sha256": "00e65562e2dfacfd4aa70cb6f5f3d9f6b6259a5c7314e29ac91311513f4f21f1" + }, + { + "case": "nonzero-after-accept", + "containers_absent": [ + "nk49-kc-4e758a13c1424cdb9253e492fb650755-transport", + "nk49-kc-4e758a13c1424cdb9253e492fb650755-issuer", + "nk49-kc-4e758a13c1424cdb9253e492fb650755-image-probe" + ], + "volumes_absent": [ + "nk49-kc-4e758a13c1424cdb9253e492fb650755-v0", + "nk49-kc-4e758a13c1424cdb9253e492fb650755-v1", + "nk49-kc-4e758a13c1424cdb9253e492fb650755-v2", + "nk49-kc-4e758a13c1424cdb9253e492fb650755-v3" + ], + "plaintext_absent": true, + "label_inventories_empty": true, + "reaper_status": "bounded_cleanup_uncertain", + "reaper_sha256": "2b04a7bb5a5bae9ce5bd13331a6125df4ac8f8f35e1a236903d8ffff04edc1af" + } + ], + "mount_namespace": "mnt:[4026532210]", + "shm_device": 65, + "fixture_source_directories_absent": true, + "real_credentials_used": false, + "native_acceptance": false, + "retained_observation_failure": "Initial sandbox lookup could not find reaper receipts: sandbox /dev/shm device97 differs from trial host device65. Host-bound verification supersedes sandbox plaintext absence observations." +} diff --git a/docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/publication-r7/review.json b/docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/publication-r7/review.json new file mode 100644 index 00000000..cbb46e91 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/publication-r7/review.json @@ -0,0 +1,13 @@ +{ + "scope": "publication encoding only", + "scanner_exit_code": 0, + "runtime_adapter_bytes_unchanged": true, + "source_digests_changed_only_for": [ + "tests/run_isolated_keycape_native_fixture.py", + "tests/test_isolated_keycape_fixture_plan.py" + ], + "preserved_original_refusal": "../r6-public-manifest-scanner-diagnostic.json", + "manifest_sha256": "975fc395e7df2e8ee942c2068aeb5b78f38023ce4a933380c03e7dec5ebad3e2", + "native_runtime_proof": "../actual-fixture-r6-all.json", + "strict_digest_guard_test_added": true +} diff --git a/docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/r6-deadline-reaper.json b/docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/r6-deadline-reaper.json new file mode 100644 index 00000000..5d0c8a54 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/r6-deadline-reaper.json @@ -0,0 +1 @@ +{"status": "bounded_cleanup_verified", "execution_quiescence_verified": true, "cleanup_trigger": "execution_deadline", "in_flight_daemon_request_uncertain": false, "container_cleanup_obligations": [{"container": "nk49-kc-b4de71b2e3fd4a42a3c4ff4a592735c4-image-probe", "status": "absence_verified"}, {"container": "nk49-kc-b4de71b2e3fd4a42a3c4ff4a592735c4-issuer", "status": "absence_verified"}, {"container": "nk49-kc-b4de71b2e3fd4a42a3c4ff4a592735c4-transport", "status": "absence_verified"}], "tmpfs_volume_cleanup_obligations": [{"volume": "nk49-kc-b4de71b2e3fd4a42a3c4ff4a592735c4-v0", "status": "absence_verified"}, {"volume": "nk49-kc-b4de71b2e3fd4a42a3c4ff4a592735c4-v1", "status": "absence_verified"}, {"volume": "nk49-kc-b4de71b2e3fd4a42a3c4ff4a592735c4-v2", "status": "absence_verified"}, {"volume": "nk49-kc-b4de71b2e3fd4a42a3c4ff4a592735c4-v3", "status": "absence_verified"}], "container_cleanup_verified": true, "plaintext_cleanup_obligation": {"path": "/dev/shm/nk49-keycape-b4de71b2e3fd4a42a3c4ff4a592735c4-xet3pr5k", "device": 65, "inode": 715, "status": "absence_verified"}, "temporary_plaintext_cleanup_verified": true} \ No newline at end of file diff --git a/docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/r6-hard-parent-loss-reaper.json b/docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/r6-hard-parent-loss-reaper.json new file mode 100644 index 00000000..3fa8e254 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/r6-hard-parent-loss-reaper.json @@ -0,0 +1 @@ +{"status": "bounded_cleanup_verified", "execution_quiescence_verified": true, "cleanup_trigger": "parent_exit", "in_flight_daemon_request_uncertain": false, "container_cleanup_obligations": [{"container": "nk49-kc-279dd8bb0c83428a961da8833dbdbe07-image-probe", "status": "absence_verified"}, {"container": "nk49-kc-279dd8bb0c83428a961da8833dbdbe07-issuer", "status": "absence_verified"}, {"container": "nk49-kc-279dd8bb0c83428a961da8833dbdbe07-transport", "status": "absence_verified"}], "tmpfs_volume_cleanup_obligations": [{"volume": "nk49-kc-279dd8bb0c83428a961da8833dbdbe07-v0", "status": "absence_verified"}, {"volume": "nk49-kc-279dd8bb0c83428a961da8833dbdbe07-v1", "status": "absence_verified"}, {"volume": "nk49-kc-279dd8bb0c83428a961da8833dbdbe07-v2", "status": "absence_verified"}, {"volume": "nk49-kc-279dd8bb0c83428a961da8833dbdbe07-v3", "status": "absence_verified"}], "container_cleanup_verified": true, "plaintext_cleanup_obligation": {"path": "/dev/shm/nk49-keycape-279dd8bb0c83428a961da8833dbdbe07-fmc3l8gz", "device": 65, "inode": 631, "status": "absence_verified"}, "temporary_plaintext_cleanup_verified": true} \ No newline at end of file diff --git a/docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/r6-nonzero-after-accept-reaper.json b/docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/r6-nonzero-after-accept-reaper.json new file mode 100644 index 00000000..5d0a9fa9 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/r6-nonzero-after-accept-reaper.json @@ -0,0 +1 @@ +{"status": "bounded_cleanup_uncertain", "execution_quiescence_verified": true, "cleanup_trigger": "parent_exit", "in_flight_daemon_request_uncertain": true, "container_cleanup_obligations": [{"container": "nk49-kc-4e758a13c1424cdb9253e492fb650755-image-probe", "status": "absence_verified"}, {"container": "nk49-kc-4e758a13c1424cdb9253e492fb650755-issuer", "status": "absence_verified"}, {"container": "nk49-kc-4e758a13c1424cdb9253e492fb650755-transport", "status": "absence_verified"}], "tmpfs_volume_cleanup_obligations": [{"volume": "nk49-kc-4e758a13c1424cdb9253e492fb650755-v0", "status": "absence_verified"}, {"volume": "nk49-kc-4e758a13c1424cdb9253e492fb650755-v1", "status": "absence_verified"}, {"volume": "nk49-kc-4e758a13c1424cdb9253e492fb650755-v2", "status": "absence_verified"}, {"volume": "nk49-kc-4e758a13c1424cdb9253e492fb650755-v3", "status": "absence_verified"}], "container_cleanup_verified": true, "plaintext_cleanup_obligation": {"path": "/dev/shm/nk49-keycape-4e758a13c1424cdb9253e492fb650755-ha60s8tc", "device": 65, "inode": 799, "status": "absence_verified"}, "temporary_plaintext_cleanup_verified": true} \ No newline at end of file diff --git a/docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/r6-public-manifest-scanner-diagnostic.json b/docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/r6-public-manifest-scanner-diagnostic.json new file mode 100644 index 00000000..e05340f3 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/r6-public-manifest-scanner-diagnostic.json @@ -0,0 +1,45 @@ +{ + "exit_code": 20, + "findings": [ + { + "RuleID": "generic-api-key", + "StartLine": 6, + "EndLine": 6 + }, + { + "RuleID": "generic-api-key", + "StartLine": 9, + "EndLine": 9 + }, + { + "RuleID": "generic-api-key", + "StartLine": 10, + "EndLine": 10 + }, + { + "RuleID": "generic-api-key", + "StartLine": 11, + "EndLine": 11 + }, + { + "RuleID": "generic-api-key", + "StartLine": 17, + "EndLine": 17 + }, + { + "RuleID": "generic-api-key", + "StartLine": 27, + "EndLine": 27 + }, + { + "RuleID": "generic-api-key", + "StartLine": 28, + "EndLine": 28 + }, + { + "RuleID": "generic-api-key", + "StartLine": 35, + "EndLine": 35 + } + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/verify_r6_cleanup.py b/docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/verify_r6_cleanup.py new file mode 100644 index 00000000..1ec1e680 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/verify_r6_cleanup.py @@ -0,0 +1,84 @@ +"""Read-only fixture resource checks; retain safe reaper outcomes on the host.""" +from datetime import datetime, timezone +import hashlib +import json +import os +from pathlib import Path +import re +import subprocess + +BASE = Path(__file__).resolve().parent +SOURCE = Path('/tmp/nk49-keycape-native-fixture-review-djek4ev1/result.json') +ENDPOINT = 'unix:///var/run/docker.sock' + + +def require(value): + if not value: + raise RuntimeError('bounded fixture verification refused') + + +def docker(args): + result = subprocess.run(['docker', '--host', ENDPOINT, *args], + capture_output=True, timeout=20) + require(result.returncode == 0) + return result.stdout.decode() + + +def main(): + result = json.loads(SOURCE.read_bytes()) + require(result['status'] == 'synthetic_native_fixture_passed') + require(result['manifest_sha256'] == '3f39a33891f25c36adcdc8137afac3be064a3011e15d9a06da60a3155bacea56') + engine = json.loads(docker(['info', '--format', '{"id":{{json .ID}},"name":{{json .Name}}}'])) + require(engine == {'id': '74f93783-6cef-43a8-a3c4-f62586cd3bc1', 'name': 'bnt-lap001'}) + rows = [] + for case, receipt in result['receipts'].items(): + require(case in ('positive', 'hard-parent-loss', 'deadline', 'nonzero-after-accept')) + row = {'case': case, 'containers_absent': [], 'volumes_absent': []} + for name in receipt['registered_cleanup']['containers']: + require(re.fullmatch('nk49-kc-[a-f0-9]{32}-[a-z-]+', name)) + require(not docker(['container', 'ls', '--all', '--filter', 'name=^/'+name+'$', '--format', '{{.Names}}']).strip()) + row['containers_absent'].append(name) + for name in receipt['registered_cleanup']['tmpfs_volumes']: + require(re.fullmatch('nk49-kc-[a-f0-9]{32}-v[0-3]', name)) + require(not docker(['volume', 'ls', '--filter', 'name=^'+name+'$', '--format', '{{.Name}}']).strip()) + row['volumes_absent'].append(name) + run_id = receipt['registered_cleanup']['containers'][0].split('-')[2] + for args in ( + ['container', 'ls', '--all', '--filter', 'label=net-kingdom.recovery-run='+run_id, '--format', '{{.Names}}'], + ['volume', 'ls', '--filter', 'label=net-kingdom.recovery-run='+run_id, '--format', '{{.Name}}'], + ): + require(not docker(args).strip()) + work = Path(receipt['plaintext_cleanup_obligation']['path']) + # The sandbox has a different /dev/shm. Its absence is not host evidence. + require(work.parent == Path('/dev/shm')) + require(os.stat(work.parent).st_dev == receipt['plaintext_cleanup_obligation']['device']) + require(not work.exists() and not work.is_symlink()) + row.update(plaintext_absent=True, label_inventories_empty=True) + if case != 'positive': + reaper = Path(receipt['reaper_outcome_path']) + require(reaper == Path(str(work)+'-reaper.json')) + data = reaper.read_bytes() + outcome = json.loads(data) + require(outcome['execution_quiescence_verified']) + require(outcome['temporary_plaintext_cleanup_verified']) + require(outcome['container_cleanup_verified']) + expected = 'bounded_cleanup_uncertain' if case == 'nonzero-after-accept' else 'bounded_cleanup_verified' + require(outcome['status'] == expected) + (BASE/('r6-'+case+'-reaper.json')).write_bytes(data) + row.update(reaper_status=outcome['status'], reaper_sha256=hashlib.sha256(data).hexdigest()) + rows.append(row) + require(not list(Path('/dev/shm').glob('nk49-keycape-fixture-*'))) + review = {'observed_at': datetime.now(timezone.utc).isoformat(), 'engine': engine, + 'manifest_sha256': result['manifest_sha256'], 'cases': rows, + 'mount_namespace': os.readlink('/proc/self/ns/mnt'), + 'shm_device': os.stat('/dev/shm').st_dev, + 'fixture_source_directories_absent': True, + 'real_credentials_used': False, 'native_acceptance': False, + 'retained_observation_failure': 'Initial sandbox lookup could not find reaper receipts: sandbox /dev/shm device97 differs from trial host device65. Host-bound verification supersedes sandbox plaintext absence observations.'} + (BASE/'actual-fixture-r6-all.json').write_bytes(SOURCE.read_bytes()) + (BASE/'coordinator-r6-all-review.json').write_text(json.dumps(review, indent=2)+'\n') + print(json.dumps({'cases_verified': len(rows), 'host_cleanup_verified': True, 'reaper_outcomes_retained': 3})) + + +if __name__ == '__main__': + main() diff --git a/docs/changes/netkingdom-target-2026-10-16/resume-audit-r1/README.md b/docs/changes/netkingdom-target-2026-10-16/resume-audit-r1/README.md new file mode 100644 index 00000000..ff87f095 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/resume-audit-r1/README.md @@ -0,0 +1,97 @@ +# Independent resume audit, 16 October 2026 + +All TSA gates remain open. This audit reads the target contract, coordinator +record and actual owner work records/source. Historical receipts establish only +their recorded observation; this audit does not reassert present remote runtime. +Recovery and browser implementation belong to the other current assignments. + +| Gate | Existing evidence and precise remaining acceptance | Next executable preparation or actual gate | +| --- | --- | --- | +| TSA-01 | Secrets WP14 T02/T03 retains strict fixed-verifier source, inert installed release and zero accepted protected effects at 11 sites/10 handlers. Access WP24 T06 retains signed producer/image/storage preparation. | Independently admit actual signer/public trust/caller and complete native negatives/rotation. Maintenance window, approved CCR and exact owner dispositions remain real gates; fixture keys cannot replace them. | +| TSA-02 | Platform successor whole-stack fixture uses real local Access/Approval, synthetic admission and disposable OpenBao. | Bind the actual CCR/catalog/plan/grant/journal and exact owner-mediated native effect. Approval issuer/tenant provenance and actual caller remain requirements. | +| TSA-03 | Journal consume/confirm seam, metadata readback and recovery source/fixture proofs exist. | Native durable restart/concurrency, uncertain issuance reconciliation and scoped revocation/cleanup need actual owner admission. No lost-response replay. | +| TSA-04 | Registration adapter, Warden pins, exact offline checker build and contained helper correction published. | Other assignment owns descriptor/callback/executable custody/restart/group work, then native positive/negative/revocation/rollback acceptance. | +| TSA-05 | Human and agent browser journeys remain open; archive proofs do not establish existing-token MFA/service continuation. | Other assignments own identity recovery and browser proof; real human factor/OIDC act remains attended. | +| TSA-06 | Canonical combined runtime manager/gateway proof denies synthetic host/environment access, scopes delivery and cleans cancellation/expiry. It explicitly reports zero model calls and no assignment migration. | Prepare exact admitted assignment/runner proof; actual model spend/provider and runtime authority must use existing scoped owner path. CI job credentials/workflow abuse remain separate. | +| TSA-07 | Existing lifecycle hardening source preserves KV custody on ordinary revoke; target inventory/consumer denominator is incomplete. | Reconcile public catalog, CCR and owner delivery metadata into current owner/purpose/scope/expiry/revocation/recovery/elimination rows. Mark unknown/orphan rows explicitly. No secret read or deferred rotation is needed for this preparation. | +| TSA-08 | Independent archive restore and continuity slices exist; isolated restore adapter's failed Docker positive is preserved. | Recovery assignment owns corrected disposable positive then loss/deadline trials. Actual independent owner-held root recovery, ordinary issuer unavailable, reconnect/audit and measured RTO/RPO remain required. | +| TSA-09 | Audit owner has native receiver capability history plus a precise first-pin admission/full-ledger reconciliation packet. Initial Access signer rollout keeps delivery disabled. | Prepare exact per-pin class/cadence/retention payload from owner source, independently retain complete ledger and every-ID/all-class accepted-time reconciliation inputs; custody/reader/source activation remains separately admitted. No selected-success-ID shortcut. | +| TSA-10 | Forge WP6 reports 166/167 admitted receive profiles, retained failed lifecycle trial and repaired mode guard. One gitlink repository, authenticated remote HTTP/UI, imports/mirrors, CI and response remain open. | Existing attended route command is prepared; credential-free source work can map clone/fetch paths and CI authority, and prepare RMGR WP21 T04 synthetic finding/private response. Actual OIDC/MFA gate belongs to native authenticated route execution. | +| TSA-11 | Retained hosted readback at 19:25 UTC shows 70 reviewed IDs exactly once, correct owners and corrected descriptions; strengthened validator passed 60 provider indexes. | Enumerate usable links/version aliases/package-family dispositions and obtain recurring drift evidence. One successful refresh does not prove a running loop or runtime capabilities. | +| TSA-12 | ACTIVITY WP47 accepted source schedule but definition remains disabled. This audit's actual daily host dry-run succeeds against real hub/checkouts; selected rein startup readiness check fails because profile is unverified. | Owner preparation must reconcile deterministic fixed command with model-backed pinned profile, admit runner filesystem/hub/checkpoint/queue scope, then Activity activation/manual trigger and first unassisted fire. This is owner execution preparation, not a new founder gate. See below. | +| TSA-13 | Producer Go fact adapter and 14,114 cross-language canonical comparisons exist; no two real accepted consumers. | Keep producer-format verifier code pinned; enumerate actual consumer compatibility/denied-path matrix and migration rollback. Real admitted consumers remain the acceptance boundary. | +| TSA-14 | Type/provider locks and installed package proofs exist; first accepted complete integration and second clean installation remain absent. | Prepare minimal required/optional provider lock and second clean-install journey without promoting plan-only materialization to acceptance. Native identities/effects remain governed. | +| TSA-15 | Prior bounded node snapshot reports 3580m/4000m requested CPU and 9760Mi memory, with dated headroom not reserved. Complete comparable optimization baseline is absent. | This audit measures the actual admitted workstation scanner against disposable generated workloads; retain p50/p95 and failed/unavailable refusals. Baseline is not improvement or production receive-path performance. Measure onboarding/touches/effect latency only on admitted consumers. | +| TSA-16 | Requirement ledger and close-down records exist; all 16 target gates remain open and original failed fixtures/publication refusals remain retained. | Reconcile exact evidence/owner task denominator and stable proposed revisions, without manufacturing assent, changing deferrals or bulk promoting residuals. | + +## Actual no-spend scheduling prerequisite checks + +`daily-host-readiness.json` records the existing script run **without** `--apply`, +using only this audit directory for state. It completed exit 0 in 0.809 seconds, +read the real local hub and workstation work records, generated a report and sent +zero messages. Report classifications were READY 25, UNBLOCKED 2, ATTENDED 12, +STALLED 16 and DEPENDENT 9. Raw notification stdout was hashed and discarded; +the generated local report remains a local preparation artifact. This confirms +host prerequisites only, not an admitted rein or actual checkpoint delivery. + +`rein-profile-readiness.json` records the canonical rein environment's actual +`readiness._profile_checks` with +`AGENT_HARNESS_REQUIRED_PROFILE_REFS=harness.agent-dev-local@1.1.1`. +It returns `ok: false`, `readiness=unverified`. No worker token, provider key, +claim, model request or runtime owner configuration was read. + +The exact current source explains the outstanding owner action: + +1. `claim_loop.py` chooses `glas-profile` whenever `harness_profile_ref` exists, + before consulting legacy approach selection. A proposed `approach_hint` cannot + replace the pinned runtime semantics. +2. The selected profile binds Anthropic `claude-sonnet-5`, `claude-code-cli` and + USD 5 per-run maximum. Its ordinary execution starts the selected rein and + dispatches `run_task`; the fixed command in the task description does not + create a deterministic, zero-model executor. +3. Startup readiness requires `ready`; gateway `require_operational` rejects + `blocked` but deliberately allows `unverified` proof attempts. A direct proof + invocation therefore does not establish authoritative worker startup readiness. +4. The adopted fixed daily command resolves the script from the target checkout, + uses `Path.home()` for estate root and durable state by default, and expects + local hub reachability. Existing namespace/private-home proof cannot be + assumed to mount the entire estate or preserve delivery state. Define the + exact read-only roots, script/source pins, durable checkpoint root and scoped + hub writes; validate them inside the actual selected worker boundary. + +The highest-value next owner preparation is a reviewed fixed-operation contract +for this existing daily command, either admitted by the current governed runtime +or via an explicitly supported deterministic runner. It must bind trusted script +bytes and arguments, estate roots, per-recipient state, lock, queue lease and hub +write scope, forbid repository mutation and model/provider access, and retain +failure/overlap/retry receipts. This is a concrete missing execution contract; +merely toggling the Activity definition or adding an arbitrary shell runner +would not satisfy it. No replacement scheduler is proposed. Activity retains +activation/ops_run ownership and an unassisted scheduled fire is still required. + +## Scanner baseline + +Run `python3 measure_scanner.py` from this directory or the repository root. +The script imports the real current Repo Manager adapter, checks the exact +installed scanner pin, stages distinct generated blobs in disposable Git roots, +and exercises clean, generated-private-key and unavailable/wrong-digest cases. +It captures only statuses/counts/timing/public hashes and removes the entire +fixture scope, including generated key material and Git objects. No user source, +index, branch, hook or scanner installation changes. + +`scanner-baseline.json` is the actual measurement receipt when the bounded run +finishes. Seven warm repetitions plus the first call are descriptive samples; +nearest-rank sample p95 is not a production tail estimate. The benchmark preserves +the current profile and does not tune scanner policy or owner source. + +Actual source explains the quantity to measure before proposing optimization: +`secret_scan.scan_staged` validates and hashes the complete 21,958,840-byte +scanner on every invocation. For each distinct changed blob it separately runs +`git cat-file -s`, `git cat-file blob` and one scanner subprocess with a fresh +default-rule initialization. Object deduplication already exists. Tiny-blob +workloads therefore scale with distinct object count, not only byte volume. +The receive adapter already batches Git object metadata but likewise invokes +the scanner separately per object; these local timing samples cannot establish +its remote wall time. A proposed persistent/batch scanner or cache would change +the current per-object attribution and executable-custody assumptions and needs +owner review plus unchanged refusal coverage; this audit changes neither. diff --git a/docs/changes/netkingdom-target-2026-10-16/resume-audit-r1/daily-host-readiness.json b/docs/changes/netkingdom-target-2026-10-16/resume-audit-r1/daily-host-readiness.json new file mode 100644 index 00000000..36a4fdcc --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/resume-audit-r1/daily-host-readiness.json @@ -0,0 +1,29 @@ +{ + "exit_code": 0, + "stdout_sha256": "9e85a9df19a574d4281da28d5b22cf3f374dd4d1455d97776ea333a3a17f615b", + "stderr_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", + "stderr_bytes": 0, + "stdout_bytes": 25897, + "report_categories": { + "READY": 25, + "UNBLOCKED": 2, + "ATTENDED": 12, + "STALLED": 16, + "DEPENDENT": 9 + }, + "report_sha256": "a972948fa2947f213290f84fb2c89463736008c4499e6866c2c8d682b48b55be", + "observed_at": "2026-10-16T21:13:31.451341+00:00", + "wall_seconds": 0.809, + "command": [ + "python3", + "scripts/security_flow_daily.py", + "--state-dir", + "docs/changes/netkingdom-target-2026-10-16/resume-audit-r1/daily-dry-run-state" + ], + "source_sha256": "4a4e84702b3fb38d086695bb6d601430d8914bd79286b4f683794206f110c353", + "hub": "http://127.0.0.1:8000", + "apply": false, + "messages_sent": false, + "provider_calls": 0, + "scope": "Host filesystem and read-only hub/report preparation only; not claiming rein runtime or Activity owner acceptance." +} diff --git a/docs/changes/netkingdom-target-2026-10-16/resume-audit-r1/measure_scanner.py b/docs/changes/netkingdom-target-2026-10-16/resume-audit-r1/measure_scanner.py new file mode 100644 index 00000000..0093cc65 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/resume-audit-r1/measure_scanner.py @@ -0,0 +1,114 @@ +#!/usr/bin/env python3 +"""Bounded synthetic baseline of the actual admitted workstation adapter. + +Never reads a real repository index or credential. All fixture Git objects and +generated key material live in an automatically removed disposable directory. +Only fixed statuses, timings, counts and public source hashes are retained. +""" +import hashlib +import importlib.util +import json +import math +import os +from pathlib import Path +import resource +import statistics +import subprocess +import sys +import tempfile +import time +from datetime import datetime, timezone + +sys.dont_write_bytecode = True +HERE = Path(__file__).resolve().parent +SOURCE = Path('/home/worsch/repo-manager/src/repo_manager/secret_scan.py') +BINARY = Path('/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks') + + +def sha(path): + return hashlib.sha256(path.read_bytes()).hexdigest() + + +def command(argv, cwd, *, env=None): + subprocess.run(argv, cwd=cwd, env=env, check=True, timeout=20, + stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL) + + +def main(): + source_before = sha(SOURCE) + binary_before = sha(BINARY) + spec = importlib.util.spec_from_file_location('admitted_scanner', SOURCE) + adapter = importlib.util.module_from_spec(spec) + spec.loader.exec_module(adapter) + if sha(BINARY) != adapter.BINARY_SHA256: + raise RuntimeError('public scanner pin mismatch') + observations = [] + with tempfile.TemporaryDirectory(prefix='synthetic-scanner-', dir=HERE) as td: + root = Path(td) + env = {'PATH': '/usr/bin:/bin', 'HOME': td, 'LANG': 'C', + 'GIT_CONFIG_NOSYSTEM': '1', 'GIT_CONFIG_GLOBAL': '/dev/null'} + for name, count, size, expected in [ + ('clean-1x1KiB', 1, 1024, 'clean'), + ('clean-16x1KiB', 16, 1024, 'clean'), + ('clean-64x1KiB', 64, 1024, 'clean'), + ('clean-1x1MiB', 1, 1024*1024, 'clean'), + ('synthetic-private-key', 1, None, 'blocked'), + ]: + repo = root / name + repo.mkdir() + command(['git', '-c', 'core.hooksPath=/dev/null', 'init', '-q', str(repo)], root, env=env) + if size is None: + command(['openssl', 'genrsa', '-traditional', '-out', str(repo/'fixture.txt'), '2048'], repo, env=env) + byte_count = (repo/'fixture.txt').stat().st_size + else: + for i in range(count): + # Distinct contents avoid Git-object deduplication. + prefix = f'public synthetic baseline row {i:03d}\n'.encode() + (repo/f'fixture-{i}.txt').write_bytes(prefix + b'a'*(size-len(prefix))) + byte_count = count * size + command(['git', '-C', str(repo), 'add', '--all'], repo, env=env) + samples = [] + # The first call is retained separately, not silently discarded. + for repeat in range(8): + cpu_before = resource.getrusage(resource.RUSAGE_CHILDREN) + start = time.perf_counter_ns() + result = adapter.scan_staged(repo, BINARY) + wall_ms = (time.perf_counter_ns()-start)/1e6 + cpu_after = resource.getrusage(resource.RUSAGE_CHILDREN) + sample = {'repeat': repeat, 'wall_ms': round(wall_ms, 3), + 'child_cpu_ms': round(1000*((cpu_after.ru_utime+cpu_after.ru_stime)-(cpu_before.ru_utime+cpu_before.ru_stime)), 3), + 'status': result['status'], 'scanned_blobs': result['scanned_blobs']} + samples.append(sample) + if result['status'] != expected or result['scanned_blobs'] != count: + raise RuntimeError('synthetic baseline expectation failed') + ordered = sorted(item['wall_ms'] for item in samples[1:]) + observations.append({'case': name, 'bytes': byte_count, 'unique_blobs': count, + 'samples': samples, 'warm_samples': len(ordered), + 'warm_p50_ms': statistics.median(ordered), + 'warm_p95_nearest_rank_ms': ordered[math.ceil(.95*len(ordered))-1], + 'warm_median_MiB_per_second': round(byte_count/(1024*1024)/(statistics.median(ordered)/1000), 3)}) + negative = [] + for label, binary in [('missing-scanner', root/'absent-scanner'), ('wrong-scanner-digest', Path('/usr/bin/true'))]: + start = time.perf_counter_ns() + result = adapter.scan_staged(repo, binary) + negative.append({'case': label, 'status': result['status'], 'reason': result.get('reason'), + 'scanned_blobs': result['scanned_blobs'], 'wall_ms': round((time.perf_counter_ns()-start)/1e6, 3)}) + if result['status'] != 'unverified' or adapter.exit_code(result) != 2: + raise RuntimeError('unavailable scanner did not refuse') + receipt = {'observed_at': datetime.now(timezone.utc).isoformat(), + 'scope': 'Actual local repo-manager staged-object adapter; generated disposable fixtures only. Not receive-path, CI, native remote coverage, workload latency, performance improvement or TSA-15 closure.', + 'benchmark_sha256': sha(Path(__file__)), 'adapter_path': str(SOURCE), + 'adapter_sha256': sha(SOURCE), 'scanner_sha256': sha(BINARY), + 'scanner_version': adapter.VERSION, 'platform': os.uname().sysname+' '+os.uname().machine, + 'timer': 'perf_counter_ns; child CPU from RUSAGE_CHILDREN deltas', + 'percentile_method': 'nearest rank, seven warm repetitions; descriptive sample, not production tail estimate', + 'observations': observations, 'negative_cases': negative, + 'fixture_removed': not root.exists(), 'provider_calls': 0, 'real_credentials_read': False, + 'owner_source_unchanged': sha(SOURCE) == source_before, + 'scanner_unchanged': sha(BINARY) == binary_before} + (HERE/'scanner-baseline.json').write_text(json.dumps(receipt, indent=2)+'\n') + print(json.dumps({'ok': True, 'cases': len(observations), 'negative_cases': len(negative), 'fixture_removed': not root.exists()})) + + +if __name__ == '__main__': + main() diff --git a/docs/changes/netkingdom-target-2026-10-16/resume-audit-r1/rein-profile-readiness.json b/docs/changes/netkingdom-target-2026-10-16/resume-audit-r1/rein-profile-readiness.json new file mode 100644 index 00000000..ec493e7a --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/resume-audit-r1/rein-profile-readiness.json @@ -0,0 +1,12 @@ +{ + "scope": "Actual canonical read-only startup profile check only; not model execution, worker queue or owner admission.", + "checks": [ + { + "name": "profile:harness.agent-dev-local@1.1.1", + "ok": false, + "detail": "readiness=unverified rein=rein-aharness@0.1.0 sandbox=profile.bwrap-local" + } + ], + "provider_calls": 0, + "credentials_read": false +} diff --git a/docs/changes/netkingdom-target-2026-10-16/resume-audit-r1/scanner-baseline.json b/docs/changes/netkingdom-target-2026-10-16/resume-audit-r1/scanner-baseline.json new file mode 100644 index 00000000..0092513d --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/resume-audit-r1/scanner-baseline.json @@ -0,0 +1,370 @@ +{ + "observed_at": "2026-10-16T21:22:55.040291+00:00", + "scope": "Actual local repo-manager staged-object adapter; generated disposable fixtures only. Not receive-path, CI, native remote coverage, workload latency, performance improvement or TSA-15 closure.", + "benchmark_sha256": "d6e4bd0976a3cf54de242414e33289a0e1820bd04d341da171eae64bf8968264", + "adapter_path": "/home/worsch/repo-manager/src/repo_manager/secret_scan.py", + "adapter_sha256": "4559d7714308eaa70ce5f8fa91dfcc6b10fe74b607e9f2a94269d31ff76bce9d", + "scanner_sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509", + "scanner_version": "8.30.1", + "platform": "Linux x86_64", + "timer": "perf_counter_ns; child CPU from RUSAGE_CHILDREN deltas", + "percentile_method": "nearest rank, seven warm repetitions; descriptive sample, not production tail estimate", + "observations": [ + { + "case": "clean-1x1KiB", + "bytes": 1024, + "unique_blobs": 1, + "samples": [ + { + "repeat": 0, + "wall_ms": 703.927, + "child_cpu_ms": 776.155, + "status": "clean", + "scanned_blobs": 1 + }, + { + "repeat": 1, + "wall_ms": 702.395, + "child_cpu_ms": 750.066, + "status": "clean", + "scanned_blobs": 1 + }, + { + "repeat": 2, + "wall_ms": 702.358, + "child_cpu_ms": 740.743, + "status": "clean", + "scanned_blobs": 1 + }, + { + "repeat": 3, + "wall_ms": 655.772, + "child_cpu_ms": 727.378, + "status": "clean", + "scanned_blobs": 1 + }, + { + "repeat": 4, + "wall_ms": 702.463, + "child_cpu_ms": 747.63, + "status": "clean", + "scanned_blobs": 1 + }, + { + "repeat": 5, + "wall_ms": 701.337, + "child_cpu_ms": 739.513, + "status": "clean", + "scanned_blobs": 1 + }, + { + "repeat": 6, + "wall_ms": 701.727, + "child_cpu_ms": 755.673, + "status": "clean", + "scanned_blobs": 1 + }, + { + "repeat": 7, + "wall_ms": 703.201, + "child_cpu_ms": 769.852, + "status": "clean", + "scanned_blobs": 1 + } + ], + "warm_samples": 7, + "warm_p50_ms": 702.358, + "warm_p95_nearest_rank_ms": 703.201, + "warm_median_MiB_per_second": 0.001 + }, + { + "case": "clean-16x1KiB", + "bytes": 16384, + "unique_blobs": 16, + "samples": [ + { + "repeat": 0, + "wall_ms": 10853.446, + "child_cpu_ms": 12106.522, + "status": "clean", + "scanned_blobs": 16 + }, + { + "repeat": 1, + "wall_ms": 10644.5, + "child_cpu_ms": 11768.741, + "status": "clean", + "scanned_blobs": 16 + }, + { + "repeat": 2, + "wall_ms": 11361.227, + "child_cpu_ms": 12475.837, + "status": "clean", + "scanned_blobs": 16 + }, + { + "repeat": 3, + "wall_ms": 11559.776, + "child_cpu_ms": 12810.786, + "status": "clean", + "scanned_blobs": 16 + }, + { + "repeat": 4, + "wall_ms": 12222.433, + "child_cpu_ms": 13629.1, + "status": "clean", + "scanned_blobs": 16 + }, + { + "repeat": 5, + "wall_ms": 12065.334, + "child_cpu_ms": 13384.758, + "status": "clean", + "scanned_blobs": 16 + }, + { + "repeat": 6, + "wall_ms": 14989.135, + "child_cpu_ms": 16572.421, + "status": "clean", + "scanned_blobs": 16 + }, + { + "repeat": 7, + "wall_ms": 13941.789, + "child_cpu_ms": 15429.613, + "status": "clean", + "scanned_blobs": 16 + } + ], + "warm_samples": 7, + "warm_p50_ms": 12065.334, + "warm_p95_nearest_rank_ms": 14989.135, + "warm_median_MiB_per_second": 0.001 + }, + { + "case": "clean-64x1KiB", + "bytes": 65536, + "unique_blobs": 64, + "samples": [ + { + "repeat": 0, + "wall_ms": 52485.495, + "child_cpu_ms": 57977.359, + "status": "clean", + "scanned_blobs": 64 + }, + { + "repeat": 1, + "wall_ms": 44423.85, + "child_cpu_ms": 49219.204, + "status": "clean", + "scanned_blobs": 64 + }, + { + "repeat": 2, + "wall_ms": 49171.849, + "child_cpu_ms": 54522.182, + "status": "clean", + "scanned_blobs": 64 + }, + { + "repeat": 3, + "wall_ms": 49415.077, + "child_cpu_ms": 54741.074, + "status": "clean", + "scanned_blobs": 64 + }, + { + "repeat": 4, + "wall_ms": 44525.475, + "child_cpu_ms": 49252.97, + "status": "clean", + "scanned_blobs": 64 + }, + { + "repeat": 5, + "wall_ms": 45476.787, + "child_cpu_ms": 50531.704, + "status": "clean", + "scanned_blobs": 64 + }, + { + "repeat": 6, + "wall_ms": 53676.076, + "child_cpu_ms": 59559.115, + "status": "clean", + "scanned_blobs": 64 + }, + { + "repeat": 7, + "wall_ms": 57199.498, + "child_cpu_ms": 63448.939, + "status": "clean", + "scanned_blobs": 64 + } + ], + "warm_samples": 7, + "warm_p50_ms": 49171.849, + "warm_p95_nearest_rank_ms": 57199.498, + "warm_median_MiB_per_second": 0.001 + }, + { + "case": "clean-1x1MiB", + "bytes": 1048576, + "unique_blobs": 1, + "samples": [ + { + "repeat": 0, + "wall_ms": 2428.561, + "child_cpu_ms": 2617.579, + "status": "clean", + "scanned_blobs": 1 + }, + { + "repeat": 1, + "wall_ms": 2670.102, + "child_cpu_ms": 2900.615, + "status": "clean", + "scanned_blobs": 1 + }, + { + "repeat": 2, + "wall_ms": 2493.679, + "child_cpu_ms": 2716.212, + "status": "clean", + "scanned_blobs": 1 + }, + { + "repeat": 3, + "wall_ms": 2578.0, + "child_cpu_ms": 2824.688, + "status": "clean", + "scanned_blobs": 1 + }, + { + "repeat": 4, + "wall_ms": 2548.887, + "child_cpu_ms": 2792.171, + "status": "clean", + "scanned_blobs": 1 + }, + { + "repeat": 5, + "wall_ms": 2055.215, + "child_cpu_ms": 2259.514, + "status": "clean", + "scanned_blobs": 1 + }, + { + "repeat": 6, + "wall_ms": 2007.619, + "child_cpu_ms": 2182.369, + "status": "clean", + "scanned_blobs": 1 + }, + { + "repeat": 7, + "wall_ms": 2565.986, + "child_cpu_ms": 2807.337, + "status": "clean", + "scanned_blobs": 1 + } + ], + "warm_samples": 7, + "warm_p50_ms": 2548.887, + "warm_p95_nearest_rank_ms": 2670.102, + "warm_median_MiB_per_second": 0.392 + }, + { + "case": "synthetic-private-key", + "bytes": 1675, + "unique_blobs": 1, + "samples": [ + { + "repeat": 0, + "wall_ms": 1175.309, + "child_cpu_ms": 1245.314, + "status": "blocked", + "scanned_blobs": 1 + }, + { + "repeat": 1, + "wall_ms": 1064.51, + "child_cpu_ms": 1158.645, + "status": "blocked", + "scanned_blobs": 1 + }, + { + "repeat": 2, + "wall_ms": 1065.706, + "child_cpu_ms": 1155.864, + "status": "blocked", + "scanned_blobs": 1 + }, + { + "repeat": 3, + "wall_ms": 802.468, + "child_cpu_ms": 862.132, + "status": "blocked", + "scanned_blobs": 1 + }, + { + "repeat": 4, + "wall_ms": 752.66, + "child_cpu_ms": 822.679, + "status": "blocked", + "scanned_blobs": 1 + }, + { + "repeat": 5, + "wall_ms": 859.756, + "child_cpu_ms": 934.281, + "status": "blocked", + "scanned_blobs": 1 + }, + { + "repeat": 6, + "wall_ms": 854.193, + "child_cpu_ms": 907.219, + "status": "blocked", + "scanned_blobs": 1 + }, + { + "repeat": 7, + "wall_ms": 803.553, + "child_cpu_ms": 837.327, + "status": "blocked", + "scanned_blobs": 1 + } + ], + "warm_samples": 7, + "warm_p50_ms": 854.193, + "warm_p95_nearest_rank_ms": 1065.706, + "warm_median_MiB_per_second": 0.002 + } + ], + "negative_cases": [ + { + "case": "missing-scanner", + "status": "unverified", + "reason": "scan-unavailable", + "scanned_blobs": 0, + "wall_ms": 0.079 + }, + { + "case": "wrong-scanner-digest", + "status": "unverified", + "reason": "scanner-file-refused", + "scanned_blobs": 0, + "wall_ms": 0.047 + } + ], + "fixture_removed": true, + "provider_calls": 0, + "real_credentials_read": false, + "owner_source_unchanged": true, + "scanner_unchanged": true +} diff --git a/docs/netkingdom-target-implementation.md b/docs/netkingdom-target-implementation.md index 3a04c8e3..c750c094 100644 --- a/docs/netkingdom-target-implementation.md +++ b/docs/netkingdom-target-implementation.md @@ -479,12 +479,14 @@ requirements. It may record partial source delivery without closing a native gate. Work continues until the target's complete exit condition holds. The first wave is implementation progress, not the completion boundary. -## Requested pause, 16 October 2026 +## Requested pause checkpoint, 16 October 2026 The founder requested a progress report and a good pause point. Owner publication and final consistency sync are complete; retain this checkpoint and stop implementation; no new runtime trial is authorized by the pause. All sixteen target acceptance -gates remain open. The goal is paused, not complete. +gates remain open. The goal was paused at this checkpoint, not complete. The +subsequent explicit continuation resumes the full target; see the resume record +below. Published NetKingdom `916ba4b` contains the two-line existing-helper correction for an absolute selected executable and an empty checker environment, plus its @@ -524,3 +526,82 @@ Signer rollout/custody remains at the reviewed source packets: founder maintenan window, independently established entity, approved CCR and exact native owner assents are still required. Existing rotation deferral and supervised mode remain unchanged. Resume the full target architecture, not only these two lanes. + +## Resumed implementation, 16 October 2026 + +The founder explicitly resumed the active goal. The previous turn qualifies as +progress: published owner source, independently checked artifacts and a retained +failed native fixture changed the next action. Historical child handles and the +pause checkpoint are not evidence of current execution. + +Three new GPT-6.1-Sol medium assignments cover recovery startup diagnosis +(`/root/recovery_resume`), the remaining browser adapter source +(`/root/browser_resume`) and independent TSA-01–16 evidence review plus scanner +measurement (`/root/target_audit`). Frozen R5 and its failure remain unchanged; +successors receive independent review before another disposable fixture. Existing +supervised authority, attended custody requirements and rotation deferral remain +in force. Completion still requires the full target acceptance contract. + +Independent review reproduced the browser checker's mutable-path execution race. +The successor snapshots digest-verified bytes into a sealed Linux memfd and +passes only that descriptor to both checker subprocesses. Review removed an +earlier unbounded pathname read; reachable symlink, FIFO and oversized-file +refusals now precede the helper and still attempt parent-session revocation. +All 49 source checks and 12 actual-checker/helper/kernel scenarios passed +independently. The five reviewed source files are integrated into NetKingdom with +exact postimage equality; owner publication is tracked separately in the +[source review](changes/netkingdom-target-2026-10-16/browser-resume-r1/coordinator-review.json). +Native executable custody, callbacks, group provenance and restart reconciliation +remain required. + +Recovery R6 fixes a demonstrated conflict between the pinned helper image's +declared anonymous volume and the existing containment check, using an explicit +bounded tmpfs at that path. It adds public phase markers without disclosing +diagnostics or private payload. The coordinator passed 72 checks, then the exact +frozen R6 positive Docker fixture passed: original hostname/TLS/signer, native +service authentication, wrong-secret/excess-scope denial, unchanged durable bytes +and cleanup. The [actual receipt](changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/actual-fixture-r6-positive.json) +uses generated test material only. It is not actual owner-held recovery, human +MFA or downstream consumer acceptance. R5's failure remains retained; its missing +phase marker prevents a retrospective claim about the first failing check. + +The [independent target audit](changes/netkingdom-target-2026-10-16/resume-audit-r1/README.md) +maps all sixteen remaining acceptance obligations to current owner evidence. +The real daily report succeeds on the workstation without sending messages or +calling a provider. The selected rein startup readiness check fails; its existing +model-backed profile does not establish an admitted deterministic schedule runner. +Workstation reachability therefore does not justify enabling Activity's schedule. + +All four R6 Docker cases subsequently passed: positive, hard-parent-loss, +execution deadline and a nonzero response after Docker accepted a container. +The last case retains uncertainty despite cleanup. Independent verification +checks the same daemon and host tmpfs device as the trial, proves all exact +containers/volumes/plaintext absent and retains all three reaper outcomes. +An initial receipt lookup used the sandbox's different `/dev/shm`; that failed +observation is retained and superseded by the +[host-bound review](changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/coordinator-r6-all-review.json). + +The recovery source is integrated into the owner checkout. Normal publication +first refused eight public source-file hashes in the fixture manifest. R7 uses +explicit SHA-256-qualified checksums and a strict type/shape verifier, passing the +unchanged scanner and 73 checks. All recovery runtime bytes remain identical to +the four-case R6 proof. The original refusal and the +[publication encoding review](changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/publication-r7/review.json) +remain evidence. NK-WP-0049-T32 records bounded source/fixture delivery; +T33 prepares the exact owner-held attempt; T18 retains real recovery and consumer +acceptance. Neither a test archive nor these source tasks closes TSA-08. + +Browser source `8790dd18` is published; the coordinator completed the interrupted +worker's record at `85a54ab` and verified all 19 projected task statuses. Two +GPT-6.1-Sol workers reached their model usage limit after their substantive +commands completed. Their handles are terminal, and the coordinator inspected +actual command receipts rather than treating them as continuing execution. + +The scanner baseline also completed with disposable fixtures removed and owner +source unchanged. Warm median staged-scan time was 0.702 seconds for one 1-KiB +blob, 12.065 seconds for 16 distinct blobs and 49.172 seconds for 64; one 1-MiB +blob took 2.549 seconds. Generated-private-key refusal and unavailable/wrong-digest +refusal passed. The [measurement](changes/netkingdom-target-2026-10-16/resume-audit-r1/scanner-baseline.json) +is a local baseline, not a throughput improvement or remote receive-path result. +Per-blob process startup is a concrete owner optimization candidate; control +coverage and attribution must be preserved before claiming TSA-15 improvement. diff --git a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md index 198919e8..664aa9f5 100644 --- a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md +++ b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md @@ -847,3 +847,33 @@ independently checked. Retain the failed receipt and exact frozen R5; diagnose before another trial. No actual credential recovery or target acceptance was claimed. Full resume points and outstanding native gates are in the implementation record's requested-pause section. Workplan tasks stay open; pause is not completion. + + +2026-10-16 explicit resume: GPT-6.1-Sol medium agents resumed recovery, browser +source and independent target-audit lanes. Browser immutable checker snapshot +passed 49 source and 12 real-artifact integration checks independently, then the +exact five-file patch was applied to the NetKingdom owner checkout. Owner +publication remains a separate receipt. R6 recovery preserves the anonymous-volume +refusal while masking the pinned helper image's declared volume with bounded +tmpfs; 72 checks and the first actual synthetic Docker positive passed. Original +TLS/signer, native service allow/deny, stored bytes and cleanup passed; real +owner-held recovery and all sixteen target gates remain open. Independent +scheduling prerequisites prove host report/hub access but fail the selected rein +startup readiness check. Full evidence and next acceptance steps are linked from +the implementation record's resumed-implementation section. + + +Resume follow-through: all four synthetic R6 native Docker cases passed, including +exact process-loss/deadline quiescence and retained uncertain-response refusal. +Host-device-bound independent checks retained the three reaper outcomes and +confirmed every exact resource/plaintext absent. The sandbox's separate tmpfs +initially hid those receipts; that observation failure remains recorded. +Recovery source is integrated; publication encoding R7 preserves runtime bytes, +uses typed public checksums after a retained normal scanner refusal, and passes +73 checks. NK-WP-0049-T32/T33 separate delivered source proof from preparation of +the real owner-held attempt; T18 remains open. Browser source8790dd18 and record +85a54ab are committed, with19 projected owner tasks matching. Actual local scanner +baseline and refusal cases completed with temporary fixtures removed. Two model +workers hit their usage limit after completed commands; coordinator verified the +receipts and continued integration. No native target gate or rotation deferral +changed; the full goal remains active.