From a856698b03d3eca265aef0e997caad9ae3f2d915 Mon Sep 17 00:00:00 2001 From: codex Date: Sun, 1 Nov 2026 22:58:57 +0100 Subject: [PATCH] docs: preserve reviewed NetKingdom session artifacts --- .../consumer-admission-r1/manifest.json | 40 ++ .../platform-packet-consumer-review.json | 56 ++ .../consumer-admission-r1/scanner-proof.json | 1 + .../transport-proposal.json | 64 +++ .../consumer-admission-r1/validation.json | 17 + .../consumer-metadata-r1.json | 32 ++ .../implementation-r1.patch | 461 ++++++++++++++++ .../normal-sync.json | 7 + .../original-owner-dirty.patch | 96 ++++ .../platform-public-trust-review-r1.json | 65 +++ .../platform-public-trust-review-r2.json | 73 +++ .../r2/allow-request.proposed.json | 22 + .../r2/canonical-build-one.txt | 4 + .../r2/canonical-build-two.txt | 4 + .../r2/canonical-owner-metadata.diff | 96 ++++ .../r2/canonical-seven-packaging-tests.txt | 2 + .../r2/deny-request.proposed.json | 22 + .../r2/disposable-cli-help.txt | 35 ++ .../r2/disposable-install-output.txt | 9 + .../r2/disposable-install-receipt.json | 8 + .../r2/installed-empty-trust-refusal.txt | 1 + .../r2/local-entrypoint-observation.json | 39 ++ .../r2/native-admission-proposal-r2.json | 127 +++++ .../r2/native-cli-admission-docs-r2.patch | 177 ++++++ .../r2/native-probe-plan.md | 98 ++++ .../r2/observed-build-receipt.json | 5 + .../r2/pep-denominator.json | 87 +++ .../proposals/native-cli-admission/README.md | 158 ++++++ .../native-cli-admission/proposal.json | 133 +++++ ...-transport-and-responder-authentication.md | 177 ++++++ .../r3/coordinator-bundle-review.json | 18 + .../proposals/native-cli-admission/README.md | 205 +++++++ .../native-cli-admission/proposal.json | 141 +++++ ...-transport-and-responder-authentication.md | 192 +++++++ .../r3/verification.json | 10 + .../r4/manifest.json | 26 + .../r4/native-cli-admission-r4-full.patch | 202 +++++++ .../r4/normal-scanner.json | 1 + .../r4/redacted-finding-metadata.json | 24 + .../scanner-r1.json | 1 + .../verification-r1.json | 94 ++++ .../decision-package/README.md | 17 + .../decision-package/implementation-r1.patch | 502 ++++++++++++++++++ .../original-owner-dirty.patch | 96 ++++ .../decision-package/proof-build-r1.json | 1 + .../decision-package/scanner-r1.json | 1 + .../decision-package/source-provenance.json | 8 + .../actual-retained-drift-test-r4.txt | 9 + .../claimfree-request.json | 130 +++++ .../consumption-confirmation.json | 6 + 50 files changed, 3800 insertions(+) create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-admission-r1/manifest.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-admission-r1/platform-packet-consumer-review.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-admission-r1/scanner-proof.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-admission-r1/transport-proposal.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-admission-r1/validation.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-metadata-r1.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/implementation-r1.patch create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/normal-sync.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/original-owner-dirty.patch create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/platform-public-trust-review-r1.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/platform-public-trust-review-r2.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/allow-request.proposed.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/canonical-build-one.txt create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/canonical-build-two.txt create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/canonical-owner-metadata.diff create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/canonical-seven-packaging-tests.txt create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/deny-request.proposed.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/disposable-cli-help.txt create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/disposable-install-output.txt create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/disposable-install-receipt.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/installed-empty-trust-refusal.txt create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/local-entrypoint-observation.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/native-admission-proposal-r2.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/native-cli-admission-docs-r2.patch create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/native-probe-plan.md create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/observed-build-receipt.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/pep-denominator.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/preimages/docs/proposals/native-cli-admission/README.md create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/preimages/docs/proposals/native-cli-admission/proposal.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/preimages/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/coordinator-bundle-review.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/r2-preimages/docs/proposals/native-cli-admission/README.md create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/r2-preimages/docs/proposals/native-cli-admission/proposal.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/r2-preimages/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/verification.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/manifest.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/native-cli-admission-r4-full.patch create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/normal-scanner.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/redacted-finding-metadata.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/scanner-r1.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/verification-r1.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-package/README.md create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-package/implementation-r1.patch create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-package/original-owner-dirty.patch create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-package/proof-build-r1.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-package/scanner-r1.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-package/source-provenance.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-drift-test-r4.txt create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/claimfree-request.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/consumption-confirmation.json diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-admission-r1/manifest.json b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-admission-r1/manifest.json new file mode 100644 index 00000000..20d094d8 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-admission-r1/manifest.json @@ -0,0 +1,40 @@ +{ + "schema": "secrets-engine.consumer-admission-preparation.v1", + "proposal_id": "SECRETS14-CONSUMER-ADMISSION-20261016-R1", + "consumer_trust_sha256_proposal": "sha256:72521ff7729f8ddf5176092f3949cd50ac5f9241b0a5d1d30f3c63ce1d83091b", + "public_only": true, + "native_install_or_key_admission": false, + "source_runtime_revision": "4dd004a2250104ba56293b2d7b0d96f4e076ea99", + "source_documentation_revision": "3718e60d7385db091d3423352f44e922863087de", + "files_sha256": { + "README.md": "sha256:9f73fa8b8cbda513ba4ade67ace79c00afee515b536382907742c35d234c1c7b", + "configuration/catalog/activity-core-metered-worker-token.yaml": "sha256:67d6235bbf6e28b7d1392ff26fd13ce4933843d11407a8fe2b1c793b3748a1f5", + "configuration/catalog/email-connect-transactional.yaml": "sha256:7869e96a7fca4c508f8a2a11a9b614db8c8a4100c2402597bde48a06aef77f97", + "configuration/catalog/example-build-test-token.yaml": "sha256:6e2396af8c711c10a5af83edb3925227c251e82d16a5d5a7b7a87948e2229f54", + "configuration/catalog/forgejo-admin-api-token.yaml": "sha256:193e231c5dbc175e82614fe35092ab649cf4152878f2679332b37888f176a991", + "configuration/catalog/glas-claude-agent-dev-anthropic.yaml": "sha256:61f40b124d937516b18b77b3ae3253079f024f4522191e22a81fae3d859abb63", + "configuration/catalog/issue-core-ingestion-api-key.yaml": "sha256:401b8c7a57d3e9a54e98711387577ecc6fc0674f2e32759a5c675e1d4adf176f", + "configuration/catalog/openrouter-llm-connect.yaml": "sha256:3d46e4896aa3b2a9838f72d4f2e3b1afc9deb2c7b1be0c62ae1900eb9cb1713b", + "configuration/catalog/reuse-surface-hub-write-token.yaml": "sha256:6f2ab0e31ba71bffb5d48b8ac787dee52b73f865af1c9f155d5046067a841111", + "configuration/catalog/warden-sign.yaml": "sha256:54a9ec01bf87fa3cc6ab75fa6c818c4977f2f70800a16890a836a509ad5c73c9", + "configuration/catalog/whynot-design-npm-publish.yaml": "sha256:18ada66f109a5532462b70b4d213bb73c7ab2e0ef9a4a2a149b7f9fcd77b034f", + "configuration/environment.proposed.json": "sha256:78a19a1a33f1faf61353ce674048826c89c45e84f15467992fca347679c4908d", + "configuration/pep-stance.yaml": "sha256:969ffd12506e2954c273e19ed6505692c1bacbe97a262a85862793254263e737", + "configuration/policies/netkingdom-publication-scope.yaml": "sha256:018000cb29edf7707f3885bec2f54285adef1e5a71c749b6b7ab6044203de89b", + "configuration/policies/secrets-engine-build.hcl": "sha256:ec5ce1987fbf2818f1ecd612d280cc419990dce12f85d7f5f38b621f4f9dbf69", + "configuration/policies/secrets-engine-prod.hcl": "sha256:1d12ca47e4f3ab234370ddfadad2aca8ae0943d95833798be5af0ea09860c6ce", + "configuration/policies/secrets-engine-test.hcl": "sha256:53c1d4146116784ba0024cc2c9f318e6443471ee97b7b1d2056ea840eb4ff6f6", + "configuration/trust/lifecycle-pre-key.json": "sha256:5f01b418cccef03326c424a1de649a4bde42811aa1e2041a6d0417c8d65a3f6a", + "consumer-baseline.json": "sha256:72521ff7729f8ddf5176092f3949cd50ac5f9241b0a5d1d30f3c63ce1d83091b", + "disposable-baseline-refusal.txt": "sha256:e4e4e516baeae294717382386667e2ded21314bb1956d8dce93f5040944c8d9a", + "platform-packet-consumer-review.json": "sha256:80e4751e97a991fdb321b018e203e0156e73ae9fc3a6706eb17c49a7c0c8c7c0", + "transport-proposal.json": "sha256:3181dc3da2a8e3c2e72bffdbaa9dc680b49d709d69dc9a9d907846737f59ebb3", + "validation.json": "sha256:dbbd66e4d71825c2cc685fd51a0926c2100afe7afe2afd4c0bf9bd02a87659f3", + "scanner-proof.json": "sha256:9936fd3294106c964b405922074fee28757a5c13121e1704da3a9c3ab3b5bbc4" + }, + "existing_bundle_manifest": { + "path": "decision-native-preparation/r2/canonical-bundle-manifest.json", + "sha256": "sha256:105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e", + "unchanged": true + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-admission-r1/platform-packet-consumer-review.json b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-admission-r1/platform-packet-consumer-review.json new file mode 100644 index 00000000..05d0ddfd --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-admission-r1/platform-packet-consumer-review.json @@ -0,0 +1,56 @@ +{ + "schema": "secrets-engine.native-packet-consumer-source-review.v1", + "reviewer_role": "secrets-engine-owner", + "scope": "WP14 T02/T03 consumer/public provenance and source configuration proposal only", + "packet_pins": { + "README.md": "sha256:6238f96bfd19da1731f8b73d267e20013dc141d50d749e87c08b4d7042711fb1", + "evidence-pins.json": "sha256:22aa4e4dacea99dd9e77d2e7eae2a5916adcb6b75904001312254133e2b4b583", + "admission-scope.incomplete.json": "sha256:d5b1ec3b28d75995e96fb87785dceef773ded780ccf478ea08d96f41fe4926b3", + "manifest.json": "sha256:3064c06ac9ba0b02fb95caa5176ba349d589775f5cbc5314e5075197018bad35", + "assembler-r2-revision.json": "sha256:a91e5ceb261a84ac2f3591d9973782660235ae49ad7cdff0d2fd40a22c2ccaff", + "finalize.py": "sha256:085e179b76abdbb43b61d3e94a0b2efda23d8c943e9e49fbf5d78a7acbbd0385" + }, + "disposition": "consumer_preparation_recommendation; actual native admission withheld", + "consumer_baseline_proposal_sha256": "sha256:72521ff7729f8ddf5176092f3949cd50ac5f9241b0a5d1d30f3c63ce1d83091b", + "recommended_native_packet_fields_after_independent_owner_selection": { + "consumer_trust_sha256": "sha256:72521ff7729f8ddf5176092f3949cd50ac5f9241b0a5d1d30f3c63ce1d83091b", + "bindings.trust_sha256": "sha256:72521ff7729f8ddf5176092f3949cd50ac5f9241b0a5d1d30f3c63ce1d83091b" + }, + "meaning": "Exact public pre-key baseline manifest, including bundle integrity/configuration and empty-key trust. Not a claim newly generated public key is already trusted; installing/reviewing these bytes does not authenticate an owner or admit a key. Final public trust successor requires separate independent review and digest.", + "platform_packet_findings": [ + { + "id": "CONSUMER-P1-01", + "state": "acceptable_source_separation", + "detail": "P1 explicitly distinguishes pre-key baseline from independently authenticated post-custody receipt/key admission and holds consumer restart. Fingerprint convention matches existing consumer representation. No responder endpoint or private KV discovery is proposed." + }, + { + "id": "CONSUMER-P1-02", + "state": "required_before_exact_native_packet_review", + "detail": "P1 image pins preserve observed candidate0a and failed CI400. Root is preparing successful ordinary-CI successor. Replace image/release/projection bindings in a separately pinned packet revision; this consumer baseline excludes image deliberately. Do not copy exact five-owner approvals across changed packet bytes or claim P1 is executable." + }, + { + "id": "CONSUMER-P1-03", + "state": "required_independent_authenticated_public_return", + "detail": "Platform/founder must return closed public receipt through an independently authenticated owner channel, binding original action/admission/executed source/CCR/cluster/backend/image/deployment/lifecycle policy/purpose/sharing, actual kid/public key/fingerprint and version1 exact correspondence or exact recovery lineage. A hash, actor/native_custody flag or approval reference alone supplies no authentication. Reject absent/metadata-only/unstored-key recovery as key admission." + } + ], + "public_key_admission_sequence": [ + "Retain exact approved native packet/source and original receipt lineage independently before execution; do not read private receipt directory as agent intake.", + "Authenticate Platform public return independently; check proposed kid exact, canonical public key raw32/base64url43 and SHA256 of43ASCII, actual executed source/target/purpose/policy and pending-independent-admission outcome.", + "Prepare separate post-custody configuration revision with same reviewed baseline metadata and public key only in existing trust schema; independently retain final trust/config bytes/digests and owner disposition. No fixture substitution, automatic discovery or silent baseline overwrite.", + "Only under separately reviewed consumer/caller/rollout scope verify actual named-pod source/image/startup projection and capture actual signed allow/deny/source records. Run the one reviewed Access offline tool against fixed installed helper and final admitted trust.", + "Prove local negative cases, admitted-key removal and outage failclosed. Real rotation needs independently admitted overlap keys and owner lifecycle; no invented survivor key, unsigned rollback or removed-key restoration. Effects remain separate acceptance." + ], + "authority_granted": false, + "native_consumer_trust_admitted": false, + "may_populate_native_admission_owner_reviews": false, + "scope_digest_or_approval_reference_supplied": false, + "native_effects_accepted": 0, + "native_effect_denominator": 11, + "handlers": 10, + "prior_reviews_preserved": { + "platform-public-trust-review-r1.json": "sha256:30525ed0ac6b3e44affdac1ab23b80ef8dc7353c559d199db7cb689d1d0bf09d", + "platform-public-trust-review-r2.json": "sha256:867268d7f3fee8bac82f4b7730ae36bd20324253674e6f1b97ec5eb703d02436" + }, + "no_key_read_login_caller_mint_install_live_action": true +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-admission-r1/scanner-proof.json b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-admission-r1/scanner-proof.json new file mode 100644 index 00000000..28c6be52 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-admission-r1/scanner-proof.json @@ -0,0 +1 @@ +{"blocked_blob_ids": [], "scanned_blobs": 24, "scanner_sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509", "scanner_version": "8.30.1", "scope": "changed-staged-blobs", "status": "clean"} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-admission-r1/transport-proposal.json b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-admission-r1/transport-proposal.json new file mode 100644 index 00000000..87bf19db --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-admission-r1/transport-proposal.json @@ -0,0 +1,64 @@ +{ + "schema": "secrets-engine.consumer-transport-proposal.v1", + "baseline_sha256": "sha256:72521ff7729f8ddf5176092f3949cd50ac5f9241b0a5d1d30f3c63ce1d83091b", + "scope": "future separately approved signer receipt capture; no token mint or tunnel performed", + "execution_user": "worsch", + "uid": 1000, + "cluster_context": "primary", + "expected_cluster": "railiance01", + "expected_kube_system_namespace_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786", + "producer_namespace": "flex-auth", + "producer_deployment": "flex-auth-secrets-engine", + "pod_name": null, + "pod_selection": "after independently admitted rollout, Access/cluster owner returns exact ready pod name, UID, immutable image, signer projection/source and startup evidence; bind named pod only, no service/label-first discovery at invocation", + "loopback": { + "host": "127.0.0.1", + "local_port": 18081, + "pod_port": 8080, + "argv_shape": [ + "kubectl", + "--context", + "primary", + "-n", + "flex-auth", + "port-forward", + "pod/", + "18081:8080", + "--address", + "127.0.0.1" + ], + "lifetime": "single attended receipt-capture session; record owned PID; stop exact forward at end; no auto-port substitution" + }, + "caller": { + "principal": "system:serviceaccount:secrets-engine:secrets-engine", + "subject_id": "secrets-engine", + "subject_type": "service", + "audience": "flex-auth", + "delivery_contract": "existing docs/pdp-access-path.md historical bounded TokenRequest recipe, requires distinct cluster-owner approval and actor permission; local UID is not SA identity", + "proposed_duration_seconds": 600, + "path": "/run/user/1000/secrets-engine/lifecycle-20261016-r1/pdp-caller.token", + "mode": "0600", + "parent_mode": "0700", + "no_existing_credential_value_or_file_inspected": true, + "delivery_action_authorized": false, + "delivery_actor": null, + "receipt_required": "non-secret actor/custody/creation/expiry/audience/path/mode receipt; never token bytes", + "end_of_session": "custody owner removes bounded file and ends session; expiry remains authoritative, no standing refresh" + }, + "capture": "actual admitted signed allow+deny response and original decision records through existing /v1/check only; no Approval consume/backend call; source record export remains Access-owned", + "native_missing_exact_values": [ + "selected future admitted producer pod name/UID and accepted image/projection/startup receipt", + "independently admitted post-custody key-bearing trust revision", + "authorized TokenRequest delivery actor/session disposition", + "separately owner-reviewed exact signer-only allow/deny request pair and source-record capture/export" + ], + "offline_verifier": { + "source_revision": "2b064eee510640224274ccdc7cefceb1ae13162e", + "source_path": "tools/verify_native_signer_receipt.py", + "sha256": "sha256:33d3c50aba51b85cf85d2e234268e903004894299efc9b3745e0980c55578280", + "runtime": "/home/worsch/.local/share/secrets-engine/releases/4dd004a22501-105dcebe6f03/venv/bin/python", + "helper": "/home/worsch/.local/share/secrets-engine/releases/4dd004a22501-105dcebe6f03/libexec/secrets-engine-pdp-verify", + "canonicalization": "existing Secrets functions and pinned producer verifier only" + }, + "native_effect_acceptance": "0/11 sites across10 handlers; offline receipt success does not change this" +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-admission-r1/validation.json b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-admission-r1/validation.json new file mode 100644 index 00000000..6aa9ed48 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-admission-r1/validation.json @@ -0,0 +1,17 @@ +{ + "result": "pass", + "actual_installed_source_revision": "4dd004a2250104ba56293b2d7b0d96f4e076ea99", + "test": "actual installed authorize_action with pre-key baseline, minimal environment, no openers/injected authorizer", + "disposable_mapping": "only trust/helper path mapped to artifact and previously installed disposable bundle; proposed future configuration/prefix not created", + "expected_exception": "DecisionError: access-engine responder trust is missing or invalid; cause ValueError: missing admitted keys", + "prior_harness_attempt": "Production correctly refused; first harness assertion wrongly expected key in sanitized outer error. Corrected assertion checks exact public outer error and local cause. No runtime change.", + "credential_or_network_or_backend_access": false, + "native_install_or_admission": false, + "scanner_initial_pass": { + "status": "blocked", + "scanned_blobs": 25, + "blocked_blob_id": "48a16ffb32697e7b62e4b1f5449a3f05b42179b7", + "file": "reviewed-bundle-manifest.json", + "disposition": "Redundant copy of existing immutable programmatic bundle manifest removed from this proposal; original r2/canonical-bundle-manifest.json and release manifest remain byte-identical. This proposal references exact independently retained manifest digest, does not alter programmatic format, scanner or exclusions." + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-metadata-r1.json b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-metadata-r1.json new file mode 100644 index 00000000..d4e4e8a8 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-metadata-r1.json @@ -0,0 +1,32 @@ +{ + "source_commit": "ff1a13dabd44ba02ddd6bc26ad75568f6d2e6225", + "scope": "current invoking shell and installed entrypoint metadata only; no credential/private-config/process-environment inspection", + "shell_configuration_presence": { + "SECRETS_ENGINE_PDP_URL": false, + "SECRETS_ENGINE_PDP_TOKEN_FILE": false, + "SECRETS_ENGINE_PDP_TRUST_FILE": false, + "SECRETS_ENGINE_PDP_VERIFIER": false, + "SECRETS_ENGINE_APPROVAL_URL": false, + "SECRETS_ENGINE_APPROVAL_CLIENT_SECRET_FILE": false, + "SECRETS_ENGINE_APPROVAL_TOKEN_FILE": false, + "SECRETS_ENGINE_AUTHORIZATION_SUBJECT_ID": false, + "SECRETS_ENGINE_AUTHORIZATION_POLICY_PACKAGE": false, + "SECRETS_ENGINE_AUTHORIZATION_POLICY_VERSION": false, + "SECRETS_ENGINE_CATALOG": false, + "SECRETS_ENGINE_POLICIES": false, + "SECRETS_ENGINE_PEP_STANCE": false, + "SECRETS_ENGINE_EVIDENCE": false, + "SECRETS_ENGINE_OPENBAO_JWT_LOGIN": false + }, + "repo_venv_entrypoint_exists": true, + "global_entrypoint_exists": false, + "uv_managed_secrets_tool": false, + "uv_inventory_evidence": "successful uv tool list output showed no secrets-engine; unrelated tool inventory omitted", + "repo_venv_distribution": { + "version": "0.1.0", + "editable": true, + "source_path": "/home/worsch/secrets-engine", + "entrypoint_target": "secrets_engine.cli:main" + }, + "observed_at": "2026-10-16T07:41:40.394089+00:00" +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/implementation-r1.patch b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/implementation-r1.patch new file mode 100644 index 00000000..32ccd44b --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/implementation-r1.patch @@ -0,0 +1,461 @@ +diff --git a/docs/pdp-access-path.md b/docs/pdp-access-path.md +index 88eac9d..0cc31d4 100644 +--- a/docs/pdp-access-path.md ++++ b/docs/pdp-access-path.md +@@ -23,20 +23,20 @@ $ getent hosts this-service-does-not-exist.flex-auth.svc.cluster.local + `*.svc.cluster.local` name answers with one unrelated public address. Sending + there ships the CheckRequest body and our bearer token to a third party. + +-`flex-auth.decision-record.v1` supports a detached Ed25519 signature on the +-producer side (FLEX-WP-0024), but this consumer does not yet verify it against +-independently admitted keys. Without that verification, every binding digest +-is either sent by us or published in flex-auth's repo, so a forger can +-reproduce those digests. Digests establish integrity of the binding, never +-authenticity of the source. As flex-auth put it in `FLEX-DEC-2026-010`: +- +-> Fail-closed protects against a PDP that is ABSENT, not against one that LIES. +- +-The literal loopback address restriction limits the destination; it does not +-prove responder identity. The operator must verify the cluster and named pod +-behind the port-forward. Signed consumer enforcement, independently admitted +-verification keys, rotation and downgrade tests remain open in SECRETS-WP-0014 +-and Custodian G13. Producer support alone does not close that gap. ++As of source `ff1a13d` (2026-10-16), this consumer requires the producer's ++detached Ed25519 signature using independently admitted local keys and exact ++signed evaluator/mode/policy pin. The complete CLI wheel-plus-helper bundle and ++strict task handoff are implemented in source. Native signer custody, key/pin ++admission, installed placement and actual consumer receipts remain unaccepted; ++source enforcement does not establish those facts. See ++[the scoped native preparation](proposals/native-cli-admission/README.md). ++ ++Historical 2026-10-12 finding: prior consumer source did not verify producer ++signatures, so a forger could reproduce public request digests. The literal ++loopback address restriction limited the destination and did not prove responder ++identity. That source defect is repaired; FLEX-DEC-2026-010's historical warning that an absent ++PDP and a lying responder require different controls remains relevant. The ++independently admitted native trust and rollout obligations in SECRETS-WP-0014 T02/T03 remain open. + + The Check client disables automatic redirects, environment/system proxies and + the process-global urllib opener. A 3xx response fails closed without contacting +@@ -51,9 +51,12 @@ apply when the approval flow invokes the PDP client. + Regression tests use disposable local HTTP servers and synthetic credentials; + they do not demonstrate identity or signature verification on the native pin. + +-## The supported path ++## Historical transport procedure and current admission gate + +-Use literal loopback `kubectl port-forward` to the admitted named pod after ++The following transport example records the earlier supported access shape; it ++is incomplete for current native use without independently admitted signing trust, ++the reviewed CLI bundle and exact owner configuration. It grants no token mint, ++installation or live action. Use literal loopback `kubectl port-forward` to the admitted named pod after + verifying the cluster identity and pod identity. That path rides the Kubernetes + API server's TLS with the operator's cluster credentials; the client cannot infer + that binding from its local URL. Note this +@@ -92,8 +95,10 @@ false` and no role bindings — it exists to be a caller identity and nothing el + + v1 shipped and was deployed with no `input.tenant` rule at all; a `rotate` under + `tenant:coulomb` returned **allow**. v2 supersedes rather than amends it so the +-change is visible in the version string, and this engine refuses a v1 decision +-outright. See `docs/tenant-alignment.md`. ++change is visible in the version string. Current consumer configuration and signed ++trust must explicitly pin the admitted v2 artifact; the validator does not impose ++a universal hard-coded package/version default. A v1 configuration is not admitted ++by this proposal. See `docs/tenant-alignment.md`. + + ## The digest join, and why it is not a digest comparison + +@@ -114,19 +119,18 @@ and the fix follows it rather than inventing one: + > statement of what it hashed. To recompute independently, hash the same + > normalized tuple the binding carries. + +-`validate_decision_envelope` now does exactly that: +- +-- **Structured correspondence.** Everything we proposed — tenant, action, +- context, `subject.id`/`type`, `resource.id`/`type`/`system` and every +- attribute we sent — must survive unchanged in the binding. +-- **Enrichment only where the contract permits it.** A ref may gain `type`, +- `tenant` and `attributes`; any other added field is refused. An enriched +- `tenant` must be the request's tenant, so a cross-tenant binding cannot arrive +- wearing our request's clothes. +-- **Digest self-consistency.** `request_digest` is recomputed over the +- normalized tuple the binding carries, per the contract's own instruction. It +- is still checked — just for coherence of the binding rather than against +- material we never sent. ++The bullets in earlier revisions described the September structured-enrichment ++check. Current source has since moved to the producer's submitted-request replay ++contract: `validate_decision_envelope` validates the exact submitted digest, ++opaque enriched digest shape, approval-free correspondence, policy pin and ++lifetime on an authenticated envelope. It does not independently reconstruct the ++full enriched tuple or native five-field claim in the generic CLI path. ++ ++The separate strict `task_execution_handoff` additionally recomputes the evaluated ++and approval-free digests, verifies exact descriptor/context/native claim joins ++(including the served native digest), and binds signed enforced caller provenance. ++That source seam is not an `execute-ccr` CLI command and does not admit the proposed ++service caller mapping or enable either task policy's runtime false gate. + + The lesson worth keeping: the replay fixtures could not catch this, because + `_request_from()` rebuilds the request from the binding, so the tests hashed the +diff --git a/docs/proposals/native-cli-admission/README.md b/docs/proposals/native-cli-admission/README.md +new file mode 100644 +index 0000000..3729cf6 +--- /dev/null ++++ b/docs/proposals/native-cli-admission/README.md +@@ -0,0 +1,158 @@ ++# Native CLI signer and consumer admission preparation ++ ++This proposal covers the existing lifecycle CLI authentication path under ++SECRETS-WP-0014. It grants no installation, key retrieval, caller mint, approval ++consume, OpenBao effect or task-policy activation. All native acceptance counts ++below are zero. Exact missing owner inputs are in `proposal.json`. ++ ++## Current consumer and initial scope ++ ++At source `ff1a13d`, the workstation has the repository's editable v0.1.0 CLI ++entrypoint at `/home/worsch/secrets-engine/.venv/bin/secrets-engine`, importing ++`secrets_engine.cli:main`. There is no global `~/.local/bin/secrets-engine` or uv ++managed Secrets tool. Presence-only inspection of this session found none of the ++PDP/trust/approval/policy/configuration variables set. This says nothing about ++other sessions, private owner configuration or a remote installation. No credential ++file, private configuration or process environment was inspected. ++ ++Use a separately reviewed immutable wheel-plus-verifier bundle for proposed ++adoption. The canonical source for the candidate build is **ff1a13d**, containing ++both CLI packaging and strict R2 handoff; earlier c80-based proof bundles are ++intermediate source evidence. Custodian `decision-native-preparation/` retains the ++exact canonical bundle manifest and hashes. Nothing was installed by this step. ++ ++Initial stage is signer-only existing lifecycle-pin admission plus offline ++verification of captured native signed allow and deny records. Capturing those ++records later needs its own admitted caller and exact source operation; this ++proposal does not grant that capture. Use Access's one receipt verifier, ++`tools/verify_native_signer_receipt.py`, with its reviewed admission file rather ++than creating another consumer verifier or canonicalization implementation. ++That tool is separate Access source preparation; its exact integrated revision ++and reviewed admission file remain owner inputs, not part of this CLI install. ++ ++The producer-owned offline pin is `secrets-engine.catalog-lane.lifecycle` v2, ++`sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4`, ++evaluator `flex-auth/local`, mode `standalone`. A source digest is not proof of the ++live image's source or policy. Access's live metadata records the current pin has ++no signer arguments/mounts; no production kid/public key/fingerprint/custody ++receipt or candidate signed-runtime OCI digest is admitted. The proposed signer ++custody route is draft/nonresolvable. Do not fill those gaps from fixture keys or ++from the same responder's keys endpoint. The independent receipt must bind signer ++purpose/custody to this exact consumer pin and declare any sharing. A shared key ++plus the generic evaluator name cannot prove an individual pod's identity; the ++owner-bound tunnel and rollout identity still require separate verification. ++ ++`lifecycle-trust.template.json` uses the existing runtime trust schema and the ++producer-owned source pin, but deliberately has an empty key map. It **must ++refuse** before caller credential access. It is not a deployable trust file. A ++future owner-admitted copy must contain the independently authenticated actual ++kid/key and exact pin, with its public-key fingerprint/custody provenance retained ++outside this unadmitted template. The task-policy coordinate is not admitted here. ++ ++## Exact PEP denominator ++ ++The initial shared authentication implementation is one Check client reached ++through `authorize_action` and `_require_lane_approval`. Native protected-effect ++coverage remains **0 of 11 serving CLI call sites across 10 handlers**, not one ++PEP per catalog row. The current lifecycle policy's action vocabulary has twelve ++values; that is a separate count from handler/call-site coverage. ++ ++| CLI path | Handler / delegated authorization site | PDP action | ++| --- | --- | --- | ++| apply, live only | `cmd_apply` | apply | ++| provision | `cmd_provision` | provision | ++| rotate, live only | `cmd_rotate` | rotate | ++| verify | `cmd_verify` | verify | ++| handoff | `cmd_handoff` | handoff | ++| wrap | `cmd_wrap` | wrap | ++| exec primary | `cmd_exec`, primary gate | exec | ++| exec companion | `cmd_exec`, delegated companion gate | exec for each companion; separate claim/CAS, same call site | ++| revoke, live only | `cmd_revoke` | deactivate | ++| lifecycle compromise/reactivate, live only | `_cmd_lifecycle_state` | selected compromise/reactivate; local state mutation | ++| lifecycle suspend/deactivate/destroy, live only | `cmd_lifecycle` | selected operation | ++ ++`session revoke` is a separate stance/readiness-controlled backend path without ++this served Check/CAS chain; it is excluded from this signer acceptance and still ++refuses production under its stance. `service-auth probe-openbao` is an explicit ++identity/login-self probe, not protected task adoption. `route` performs existing ++backend readiness metadata probes through its ambient backend resolver; it is not ++closed by this signer proposal. Dry-run/plan/catalog/audit/source evidence commands ++are not protected-effect proof. These exclusions must remain visible in any claim ++about the whole repository's PEP coverage. ++ ++The existing CLI handlers still use the generic `require_production_consume` ++response contract. Strict R2 task consumption is a separate owner API, not a ++retrofit of all eleven CLI sites. Native effect acceptance must review the actual ++selected handler/consume contract and caller scope rather than borrow the task ++fixture proof. ++ ++No production effect is authorized merely because a handler shares the signed ++client. In particular, configured `service-jwt` still refuses protected CLI work ++before approval/CAS/backend because CCR38 is identity-only. Do not select ++bootstrap/env, alter the stance or enable unsafe-demo to manufacture acceptance. ++ ++## Owner-controlled placement and minimum configuration ++ ++The deploying owner must select the runtime UID, fresh release prefix, configuration ++parent and exact runtime paths; none is agreed by this proposal. The future ++admitted executable is `/bin/secrets-engine`, whose wrapper fixes the ++bundle helper and checks its digest before CLI import. The helper's source/binary ++hash is artifact integrity, not independent package or key admission. Do not use ++the editable checkout, a rolling alias, a synthetic test prefix or an internal ++venv entrypoint as if it were that admission. ++ ++Explicit absolute owner-admitted catalog, policy, `SECRETS_ENGINE_PEP_STANCE`, ++trust and evidence/outbox locations are needed. Installed-package defaults fall ++back to working-directory metadata and are not an admitted native configuration. ++The total existing stance remains prod fail_closed. Config needs the exact ++producer policy/version, service subject, loopback owner-bound PDP tunnel and ++separately admitted bounded audience `flex-auth` caller-file lifetime. Approval ++endpoint and its existing separately scoped credential delivery must be admitted ++independently. Both approval credential providers may not be configured together. ++The bundle helper is not selected by an ambient override. Runtime credentials and ++keys are not placed in this proposal or release bundle. ++ ++Acceptance order is: admit exact package/source/install/config; obtain independent ++signer/key/pin custody return and exact signed producer rollout candidate; under ++that separately reviewed rollout capture bounded native records; run Access's ++single offline receipt verifier against the fixed installed helper and admitted ++trust; prove forged/altered/unknown/unsigned/wrong-pin/expired refusal and exact ++old/new-key overlap then removed-key refusal. Also close the producer's missing ++native durable log/outbox/audit path under its owner. No install or rollout is ++performed here, and shared-source tests do not fill native effect coverage. ++ ++Rollback retains the reviewed signed producer and admitted overlap or stops the ++consumer. Rolling back to an unsigned image is an outage, not permission to turn ++off verification. Removing keys, changing policy pins or restoring removed keys ++needs exact owner review; no discovery/cached-key fallback or blind consume retry. ++ ++## Separate task-execution gap ++ ++Strict `task_execution_handoff` exists and Platform's independently confirmed ++journal/native fixture path has actual source-server proof. Neither creates an ++existing `execute-ccr` CLI command: the current parser has none. Proposed task ++caller mapping/request join, policy admission, production source/Plan/grant and ++installation/journal/cleanup placement remain separate owner decisions. Both ++Access task-policy runtime false gates remain unchanged; lifecycle apply is not ++a substitute for execute-ccr. Platform has selected no fresh approved real ++CCR/catalogue/descriptor/grant. CCR42 is in_flight and lacks a matching Secrets ++catalog; synthetic CCR2/issue-core fixture bytes and temporary paths are not native ++inputs. Actual before/after bytes for the exact metadata targets and independent ++readback/cleanup receipts must come from Platform's eventual owner-selected plan. ++ ++For future server-owned Approval facts, strict R2 deliberately requires the ++returned binding context to equal the originally submitted context. B1 caller ++join remains signed-DENY and must preserve that context. Replacing the carried ++claim with a freshly observed blob would refuse because its freshness fields ++change; no generic equality relaxation is proposed. Access's current review ++preference is to validate fresh authoritative facts out of band while retaining ++the submitted context, with reviewed producer-owned signed source/receipt evidence. ++Exact stable fact/freshness and provenance correspondence requires Approval and ++Access review before B2/B3; no new fields or behavior are implemented here. ++ ++The Approval owner's pending `approval-fact-contract/consumer-contract.md` and ++`golden-vectors.json` in the Custodian target evidence name this correspondence. ++They require both original/fresh windows and exact nonfreshness authority facts. ++Their Python native numeric canonical vectors still need producer conformance; ++no silent digest translation or new target numeric restriction is admitted. ++The proposal pins those owner artifacts for review, not as B2 implementation. +diff --git a/docs/proposals/native-cli-admission/lifecycle-trust.template.json b/docs/proposals/native-cli-admission/lifecycle-trust.template.json +new file mode 100644 +index 0000000..22fc99a +--- /dev/null ++++ b/docs/proposals/native-cli-admission/lifecycle-trust.template.json +@@ -0,0 +1,9 @@ ++{ ++ "schema": "secrets-engine.pdp-trust.v1", ++ "evaluator": "flex-auth/local", ++ "mode": "standalone", ++ "policy_package": "secrets-engine.catalog-lane.lifecycle", ++ "policy_version": "v2", ++ "policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4", ++ "keys": {} ++} +diff --git a/docs/proposals/native-cli-admission/proposal.json b/docs/proposals/native-cli-admission/proposal.json +new file mode 100644 +index 0000000..d5c50c2 +--- /dev/null ++++ b/docs/proposals/native-cli-admission/proposal.json +@@ -0,0 +1,133 @@ ++{ ++ "proposal_id": "SECRETS-WP-0014-native-cli-20261016", ++ "status": "preparation only; not installable or executable authorization", ++ "source_base": "ff1a13dabd44ba02ddd6bc26ad75568f6d2e6225", ++ "workplans": [ ++ "SECRETS-WP-0014-T02", ++ "SECRETS-WP-0014-T03", ++ "SECRETS-WP-0013-T01", ++ "SECRETS-WP-0013-T03" ++ ], ++ "initial_scope": { ++ "producer": "existing flex-auth/flex-auth-secrets-engine lifecycle pin", ++ "consumer": "existing Secrets CLI serving authorization workflow, prospective reviewed release-bundle entrypoint only", ++ "stage1": "independent signer/package/trust admission and offline captured native allow+deny verification; zero protected effects", ++ "native_effects_admitted": 0, ++ "task_execution_enabled": false ++ }, ++ "owner_returns": { ++ "access": "Custodian docs/changes/netkingdom-target-2026-10-16/access-native-preparation/native-admission-proposal-r1.json and source-policy-pins.json", ++ "platform": "No selected actual approved CCR/catalog/Plan/descriptor/grant/install placement; CCR-2026-0042 remains in_flight without matching catalog. Disposable source proofs are not production inputs." ++ }, ++ "producer_pin": { ++ "evaluator": "flex-auth/local", ++ "mode": "standalone", ++ "policy_package": "secrets-engine.catalog-lane.lifecycle", ++ "policy_version": "v2", ++ "policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4" ++ }, ++ "independent_admission": { ++ "production_kid": null, ++ "public_key": null, ++ "public_key_sha256": null, ++ "custody_receipt": null, ++ "candidate_producer_oci_digest": null, ++ "rule": "No responder keys endpoint, synthetic fixture key or deployment metadata substitutes for independent owner admission", ++ "receipt_verifier_integrated_revision": null, ++ "signer_purpose_pin_and_sharing_receipt": null ++ }, ++ "placement": { ++ "owner": "Secrets consumer/deploying owner; exact runtime UID and paths not yet agreed", ++ "cli_release_prefix": null, ++ "cli_entrypoint": "/bin/secrets-engine", ++ "fixed_verifier": "/libexec/secrets-engine-pdp-verify", ++ "config_parent": null, ++ "trust_file": null, ++ "catalog_directory": null, ++ "policy_directory": null, ++ "pep_stance_file": null, ++ "evidence_directory": null, ++ "constraints": [ ++ "new owner-controlled immutable release prefix; no overwrite or rolling source alias", ++ "absolute independently reviewed config/catalog/policy/stance/trust paths; no working-directory defaults for native use", ++ "trust regular non-symlink, not group/world writable; key admission not file-presence inference", ++ "owner retains manifest/admission/installation receipts and same-UID control boundary" ++ ] ++ }, ++ "configuration_contract": { ++ "SECRETS_ENGINE_PDP_URL": "literal loopback bare origin bound to independently verified cluster and named producer pod; exact native port awaiting owner placement", ++ "SECRETS_ENGINE_PDP_TOKEN_FILE": "admitted bounded Secrets ServiceAccount caller file outside Git; no mint/read here", ++ "SECRETS_ENGINE_PDP_TRUST_FILE": "absolute independently admitted lifecycle trust path; empty-key template deliberately refuses", ++ "SECRETS_ENGINE_PDP_VERIFIER": "bundle wrapper fixes installed helper; no ambient override or source-checkout helper", ++ "SECRETS_ENGINE_AUTHORIZATION_SUBJECT_ID": "secrets-engine", ++ "SECRETS_ENGINE_AUTHORIZATION_SUBJECT_TYPE": "service", ++ "SECRETS_ENGINE_AUTHORIZATION_POLICY_PACKAGE": "secrets-engine.catalog-lane.lifecycle", ++ "SECRETS_ENGINE_AUTHORIZATION_POLICY_VERSION": "v2", ++ "SECRETS_ENGINE_APPROVAL_URL": "independently admitted Approval endpoint/owner-bound tunnel; not yet supplied for this session", ++ "SECRETS_ENGINE_APPROVAL_CLIENT_SECRET_FILE": "separately admitted attended provider lifetime from existing custody contract; no read here", ++ "SECRETS_ENGINE_APPROVAL_TOKEN_FILE": "unset when client-secret provider selected; no simultaneous providers", ++ "SECRETS_ENGINE_CATALOG": "absolute owner-admitted metadata directory; initial actual lane unselected", ++ "SECRETS_ENGINE_POLICIES": "absolute owner-admitted metadata/policy directory", ++ "SECRETS_ENGINE_PEP_STANCE": "absolute hash-pinned existing total stance map; prod remains fail_closed", ++ "SECRETS_ENGINE_EVIDENCE": "absolute owner-private evidence/outbox path with declared custody/delivery", ++ "SECRETS_ENGINE_UNSAFE_DEMO": "unset; no native exception", ++ "backend_provider": "no new selection/entitlement; configured service-jwt protected handlers remain blocked; do not switch to bootstrap/env as workaround" ++ }, ++ "rotation": { ++ "admit": "owner reviews independent new kid/public key/custody receipt and bounded overlap, preserving exact issuer/policy artifact pin", ++ "roll": "separate exact producer candidate digest/seed projection rollout with native signed receipts; never fetch discovery keys", ++ "remove": "after new-key native receipt/consumer acceptance, remove old kid and prove old-key refusal", ++ "rollback": "retain reviewed signed producer/key overlap or stop/refuse. An unsigned old deployment is an outage; never disable consumer verification, restore removed key without review, relax pin, widen backend grants or blind retry consumed operation" ++ }, ++ "task_mapping_gap": { ++ "existing_cli_execute_ccr_command": false, ++ "source_handoff": "secrets_engine.task_execution_handoff authorize_task_execution/consume_task_execution", ++ "platform_source_mediator": "railiance-platform/scripts/task_execution_mediator.py run_native_fixture_task; source proof only", ++ "unadmitted_inputs": [ ++ "real service caller-to-subject server mapping and request/service binding join", ++ "actual task policy candidate and independently reviewed source/runtime admission; both false gates unchanged", ++ "owner-selected fresh approved CCR/catalog/execution-grant, compiled Plan/whole descriptor and operation UUID", ++ "independent expected-before/after bytes for exact two metadata targets and actual estate/backend origin", ++ "actual source/Plan/install/journal/cleanup placement and trusted provider endpoints/credentials/custody", ++ "load-bearing audit/outbox cadence and durable receipt correlation", ++ "Approval/Access reviewed out-of-band fresh-fact versus original carried-claim correspondence and signed provenance; strict context equality remains unchanged" ++ ], ++ "approval_fact_interface_review": { ++ "status": "review preference only; no implementation/admission", ++ "preserve": "strict binding.context equality and original submitted/approval-free/native joins", ++ "direction": "Access prefers out-of-band server-fetched authoritative fact checking while retaining original carried context, then reviewed producer-owned signed provenance/audit evidence", ++ "required_review": [ ++ "Approval fact/freshness semantic correspondence", ++ "Access source receipt/provenance binding and exact request digests" ++ ], ++ "b1": "signed-DENY caller join only; no context replacement", ++ "b2_b3": "not enabled or implemented here" ++ }, ++ "approval_fact_contract": { ++ "artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-fact-contract/consumer-contract.md", ++ "sha256": "3dfb7987a4d9fe461b917cfa5bae7beef61bc4d9a4561fdded3e90128f5966de", ++ "vectors_artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-fact-contract/golden-vectors.json", ++ "vectors_sha256": "dfb0a8810cd91847d7af6a7af6a51607a67a66fad7b86fc57365308c36bd9323", ++ "status": "owner source contract pending integration; no Go conformance or B2 behavior admitted", ++ "required": "preserve original fact/context/freshness, independently validate fresh fact window and exact nonfreshness authority; do not translate native numeric digests or invent target restrictions" ++ } ++ }, ++ "approval_state": "no owner assent, key admission, install, caller token, operation grant or live change requested/executed by this preparation", ++ "denominator": { ++ "shared_check_implementation": 1, ++ "serving_cli_call_sites": 11, ++ "serving_cli_handlers": 10, ++ "lifecycle_pdp_action_values": 12, ++ "native_effect_call_sites_accepted": 0, ++ "excluded": [ ++ "session revoke stance-only backend path", ++ "service-auth explicit identity probes", ++ "route ambient-backend readiness probes", ++ "dry-run/non-effect reporting" ++ ], ++ "task_cli_command_count": 0, ++ "platform_source_mediator_native_acceptance": false, ++ "generic_cli_consume_is_strict_task_handoff": false, ++ "effect_acceptance_required": "Review actual selected handler/generic consume response and caller scope separately; strict Platform fixture proof does not close existing CLI effects" ++ } ++} +diff --git a/src/secrets_engine/cli.py b/src/secrets_engine/cli.py +index d60988d..af65388 100644 +--- a/src/secrets_engine/cli.py ++++ b/src/secrets_engine/cli.py +@@ -119,13 +119,12 @@ def _require_lane_approval( + ): + """Apply published PEP stance, resolve lane approval, then CAS-consume. + +- Production ``fail_closed`` is read from ``pep-stance.yaml``. The durable +- access-engine decision record is not served yet, so that row refuses live +- production work. If that residue is ever bypassed, GH-DEC-2026-003 still +- requires a successful approval-engine consume before any OpenBao call. +- The three-factor unsafe-demo exception is not a stance row and is not a +- consume path. Build/test ``fail_open`` still requires the existing +- lane-approval check — a tracked gap until SECRETS-WP-0008-T02. ++ Production ``fail_closed`` is read from ``pep-stance.yaml``. A configured ++ serving path requires a fresh approval claim and independently authenticated ++ signed PDP envelope, then successful CAS before the backend. Missing runtime ++ trust/configuration still refuses production; source support is not native ++ admission. Build/test engine-unreachable residue retains the explicit legacy ++ lane check. The three-factor unsafe-demo exception grants no native adoption. + """ + # Steps 1 and 2 first: a validated claim and decision are what make the + # unreachable-engine residue inapplicable. Absent configuration returns +diff --git a/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md b/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md +index 886a0f6..28102cf 100644 +--- a/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md ++++ b/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md +@@ -102,3 +102,15 @@ admitted signer, reject forgery/downgrade, rotate without accepting removed keys + and preserve request/approval binding, lifetime and single-use consumption. + Retain rollback and failure evidence. Update CUST-WP-0080 G13 only with these + native receipts; do not equate passing transport tests with closure. ++ ++ ++2026-10-16 native preparation (no rollout): `docs/proposals/native-cli-admission/` ++now scopes the existing CLI/lifecycle signer stage, exact delegated PEP denominator, ++independent key/policy admission, owner-controlled bundle/config placement and ++rotation/rollback refusal. Canonical ff1a13d (packaging plus strict handoff) was ++rebuilt in an isolated clean checkout; artifact receipts are in Custodian ++`decision-native-preparation/`. Production kid/public fingerprint/custody receipt, ++producer candidate OCI and actual runtime/config placement remain missing. The ++empty-key trust template deliberately refuses. No install, key read, caller mint, ++protected effect, policy switch or trust admission occurred. T02 remains progress, ++T03 wait; task source/live obligations remain separately in SECRETS-WP-0013. diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/normal-sync.json b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/normal-sync.json new file mode 100644 index 00000000..f7660c94 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/normal-sync.json @@ -0,0 +1,7 @@ +{ + "chunk_id": "83f71f", + "wall_time_seconds": 0.000013382, + "exit_code": 0, + "original_token_count": 639, + "output": "{\n \"repo_slug\": \"secrets-engine\",\n \"repo_path\": \"/home/worsch/secrets-engine\",\n \"source_revision\": \"5a2099f400fb0c97fed2d991832c0e31513bbdfb\",\n \"source_revision_reason\": null,\n \"issues\": [\n {\n \"severity\": \"WARN\",\n \"check_id\": \"C-23\",\n \"message\": \"Lifecycle drift in 'secrets-wp-0013': workplan status 'proposed' has an active task \\u2014 report only (ADR-007: do not auto-promote proposed)\",\n \"file_path\": \"workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md\",\n \"db_id\": \"5e38aecc-85ca-5f55-94c6-9fbb08604819\",\n \"file_value\": \"proposed\",\n \"db_value\": \"active\",\n \"fixable\": false\n },\n {\n \"severity\": \"WARN\",\n \"check_id\": \"C-22\",\n \"message\": \"Task description drift 'SECRETS-WP-0014-T03': file content differs from DB (file wins)\",\n \"file_path\": \"workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md#SECRETS-WP-0014-T03\",\n \"db_id\": \"85aa4c78-b66d-5201-8e31-0ed50e7eaeec\",\n \"file_value\": \"Under an exact reviewed rollout, prove the real pin and consumer accept the\\nadmitted signer, reject forgery/downgrade, r\",\n \"db_value\": \"Under an exact reviewed rollout, prove the real pin and consumer accept the\\nadmitted signer, reject forgery/downgrade, r\",\n \"fixable\": true\n },\n {\n \"severity\": \"INFO\",\n \"check_id\": \"C-08\",\n \"message\": \"Closed DB workstream 'secrets-wp-0002' (id=7929a2d1\\u2026, status=finished) has no backing workplan file\",\n \"file_path\": \"\",\n \"db_id\": \"7929a2d1-3006-5d4b-85e4-c62da055ee9b\",\n \"file_value\": \"\",\n \"db_value\": \"\",\n \"fixable\": false\n },\n {\n \"severity\": \"WARN\",\n \"check_id\": \"C-28\",\n \"message\": \"3 unread inbox message(s) older than 3 day(s): railiance-platform:0490edcb, the-custodian:23172cb2, the-custodian:51e9eace\",\n \"file_path\": \"\",\n \"db_id\": \"\",\n \"file_value\": \"\",\n \"db_value\": \"\",\n \"fixable\": false\n },\n {\n \"severity\": \"WARN\",\n \"check_id\": \"C-28\",\n \"message\": \"2 unread message(s) lack thread_id for supersession tracking: the-custodian:23172cb2, the-custodian:51e9eace\",\n \"file_path\": \"\",\n \"db_id\": \"\",\n \"file_value\": \"\",\n \"db_value\": \"\",\n \"fixable\": false\n }\n ],\n \"fixes_applied\": [\n \"bindings: synced 16/16\",\n \"C-17 cleared: pushed 1 backlogged commit(s)\",\n \"C-22 fixed: task 85aa4c78\\u2026 description updated\",\n \"push: pushed\"\n ],\n \"summary\": {\n \"fail\": 0,\n \"automation_error\": 0,\n \"warn\": 4,\n \"info\": 1\n },\n \"result\": \"warn\"\n}\n" +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/original-owner-dirty.patch b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/original-owner-dirty.patch new file mode 100644 index 00000000..acf1eeaa --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/original-owner-dirty.patch @@ -0,0 +1,96 @@ +diff --git a/.custodian-brief.md b/.custodian-brief.md +index 0cb912a..ba794c8 100644 +--- a/.custodian-brief.md ++++ b/.custodian-brief.md +@@ -2,7 +2,7 @@ + # Custodian Brief — secrets-engine + + **Domain:** infotech +-**Last synced:** 2026-10-11 17:52 UTC ++**Last synced:** 2026-10-16 05:55 UTC + **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* + + ## Active Workstreams +@@ -11,8 +11,24 @@ + Progress: 1/3 done | workplan_id: `5e38aecc-85ca-5f55-94c6-9fbb08604819` + + **Open tasks:** ++- ! Define the exact mediated execution contract `b2f0d462` ++ *(wait: Independent Platform mediated-contract review and identity/approval/PDP owner returns remain required; D3 wrapped primitive source is implemented, no native entitlement is inferred.)* + - ! Implement and prove one native metadata action `5f8f7c41` +-- ► Define the exact mediated execution contract `b2f0d462` ++ ++### Constrain PDP transport and authenticate decision responses ++Progress: 1/3 done | workplan_id: `7252469d-d7a5-5c18-8911-b511b8c6a736` ++ ++**Open tasks:** ++- ! Verify the admitted native consumer and rotation path `85aa4c78` ++ *(wait: Requires reviewed verification-key admission, source enforcement and exact native rollout receipt; no production trust change is proposed yet.)* ++- ► Implement independently anchored responder authentication `877782e5` ++ ++### Production-safe provisioning, authorization, and lifecycle hardening ++Progress: 6/7 done | workplan_id: `68a39be1-bd9c-5133-ad64-e7bca892aaf3` ++ ++**Open tasks:** ++- ! Resume native production lane adoption `a0a1dd92` ++ *(wait: Engine approval hardening is complete. Remaining per-lane cutover includes native routing/proxy retirement with ops-warden under SECRETS-WP-0006-T05/T06; the exact OpenRouter key-check receipt does not establish broader recipient readiness.)* + + ### Activate native Claude credential delivery for Glas + Progress: 2/3 done | workplan_id: `40ccc3b4-d046-5a58-8649-e7935f45c974` +@@ -26,27 +42,20 @@ Progress: 4/6 done | workplan_id: `31f7f8ea-7f73-516c-8877-f03a13f1db82` + + **Open tasks:** + - ! Stage live apply and verification `fb103f1e` +- *(wait: OpenRouter key-check native acceptance is recorded in SECRETS-WP-0010-T03. Other lanes still need exact approvals, scoped attended apply and per-lane positive/negative/health/revocation evidence.)* ++ *(wait: Owner work first: publish a reviewed scoped-apply command per lane. Per-lane approvals are no longer needed (D1 standing rule); each lane with a command enters the attended window.)* + - ! Reconcile routing ownership and retire interim proxies `1431edae` + *(wait: Needs owner-agreed routing/proxy retirement for each verified lane and custody disposition of the legacy npm pointer; a single approved OpenRouter key-check does not authorize broader routing cutover.)* + +-### Production-safe provisioning, authorization, and lifecycle hardening +-Progress: 6/7 done | workplan_id: `68a39be1-bd9c-5133-ad64-e7bca892aaf3` +- +-**Open tasks:** +-- ! Resume native production lane adoption `a0a1dd92` +- *(wait: Engine approval hardening is complete. Remaining per-lane cutover includes native routing/proxy retirement with ops-warden under SECRETS-WP-0006-T05/T06; the exact OpenRouter key-check receipt does not establish broader recipient readiness.)* +- + ### Evolve the Lifecycle engine to the accepted security layer model + Progress: 5/6 done | workplan_id: `9c9e5164-b2f5-5ea2-a557-5368d65e9fe0` + + **Open tasks:** + - ! No standing engine credential `d7bc8bdc` +- *(wait: Positive service-JWT login proof passed 2026-10-10 (SECRETS-WP-0012-T03, docs/evidence/2026-10-10-keycape-openbao-probe.json). Waits on railiance-platform closing RPF-WP-0035-T02 with the CCR-2026-0038 negative checks, then on routing live engine actions through service-jwt instead of bootstrap/env.)* ++ *(wait: Published JWT contract and positive login/revocation are delivered. Native KEY-WP-0039-T02 claim negatives, CCR-2026-0038 effective-policy/capability/expiry/use checks and MASON-WP-0009-T05 remain. Login-self-only grants no protected-operation authority: agree and implement separately reviewed task-scoped backend execution entitlement, then prove functional steady-state service-identity adoption without bootstrap/env fallback.)* + + ## Inbox Hygiene + +-**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start. ++**Stale unread:** 3 message(s) older than 3 day(s) — triage at session start. + **Missing thread_id:** 2 unread message(s) lack supersession chains. + + --- +diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md +index 70e5831..4d1cfb6 100644 +--- a/WORK-RECORDS.md ++++ b/WORK-RECORDS.md +@@ -22,6 +22,7 @@ + | workplan | SECRETS-WP-0011 | finished | — | workplans/SECRETS-WP-0011-multi-lane-exec-owner-delivery.md | + | workplan | SECRETS-WP-0012 | finished | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md | + | workplan | SECRETS-WP-0013 | proposed | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md | ++| workplan | SECRETS-WP-0014 | active | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md | + | task | SECRETS-WP-ADHOC-2026-08-21-T01 | done | — | workplans/ADHOC-2026-08-21.md | + | task | SECRETS-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md | + | task | SECRETS-WP-0001-T01 | done | — | workplans/SECRETS-WP-0001-statehub-bootstrap.md | +@@ -83,9 +84,12 @@ + | task | SECRETS-WP-0012-T02 | cancel | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md | + | task | SECRETS-WP-0012-T03 | done | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md | + | task | SECRETS-WP-0012-T04 | done | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md | +-| task | SECRETS-WP-0013-T01 | progress | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md | ++| task | SECRETS-WP-0013-T01 | wait | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md | + | task | SECRETS-WP-0013-T02 | done | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md | + | task | SECRETS-WP-0013-T03 | wait | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md | ++| task | SECRETS-WP-0014-T01 | done | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md | ++| task | SECRETS-WP-0014-T02 | progress | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md | ++| task | SECRETS-WP-0014-T03 | wait | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md | + | intake | SECRETS-IN-0001 | closed | — | intakes/intakes.md | + | intake | SECRETS-IN-0002 | closed | — | intakes/intakes.md | + | intake | SECRETS-IN-0003 | closed | — | intakes/intakes.md | diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/platform-public-trust-review-r1.json b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/platform-public-trust-review-r1.json new file mode 100644 index 00000000..f882e540 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/platform-public-trust-review-r1.json @@ -0,0 +1,65 @@ +{ + "reviewer_role": "secrets-engine-owner", + "review_basis": [ + "Secrets AGENTS.md", + "Secrets INTENT.md Engine/Lifecycle and PEP consumer boundary", + "SECRETS-WP-0014-T02 independently anchored responder keys/pin", + "SECRETS-WP-0014-T03 native consumer/rotation acceptance" + ], + "scope": "independent Secrets consumer/public-trust provenance review only; no Platform custody, Access, founder, cluster/GitOps, credential-read or native action approval", + "reviewed_exact_patches": { + "native_preparation_R1": "sha256:a9d4631d3320ac3fa56f5a61965005c546eae241d2004cc1e6385e04668b7f7f", + "native_adapter_R1": "sha256:f316a53b604f4333414b832691968ede8056d49a61635f0f25831084b1d75f19" + }, + "disposition": "changes_requested", + "authority_granted": false, + "native_consumer_trust_admitted": false, + "may_populate_native_admission_owner_reviews": false, + "source_review_does_not_approve_exact_future_admission_digest": true, + "findings": [ + { + "id": "SECRETS-PUBLIC-TRUST-R1-F01", + "priority": "medium", + "owner": "Platform source/proposal owner", + "finding": "Native plan bootstrap.source_primitive_sha256 is sha256:8ed281a49c1f1cdb23772efe3593e75c62572a12b8d7a6a4c574f27b38722e75, while adapter R1 executes refactored custody module sha256:f169ad12f90d729b647085c3bed2c0d8d005db23a2341b6d3d5f1793bcfd110c. Source_bundle/writer receipt pin the latter, but checked_sources does not join the plan primitive field; the plan does not mark the former historical.", + "consumer_impact": "Independent public admission must identify an unambiguous actual custody primitive/executed source lineage. A stale current-looking source pin must not stand in for the executed revision.", + "requested_change": "In a frozen successor, make the plan current primitive reference agree with the exact executed source, or explicitly label the old pin historical and define/enforce the current source-bundle relationship. Preserve R1 and all failed observations.", + "independently_checked": true + }, + { + "id": "SECRETS-PUBLIC-TRUST-R1-F02", + "priority": "high", + "owner": "Platform recovery owner; coordinator implementation review", + "finding": "Coordinator actual fork counterexample after metadata POST leaves durable metadata-setup/write-intent-unknown, public_key null, metadata current_version0 and data404. Current recover rejects before target read.", + "consumer_impact": "No verified key or successful public receipt exists; this unknown stage cannot become admitted trust or an inferred absence/retry. Consumers/signers remain fenced pending an independently reviewed phase-appropriate result.", + "requested_change": "Address the coordinator requested phase-aware read-only metadata-only reconciliation. Preserve original unknown and require a separate exact reviewed action for any subsequent generation/write; no remint or implicit bootstrap replay.", + "evidence": "platform-signer-custody/native-adapter-r1/coordinator-review.json", + "evidence_sha256": "sha256:6e5b58d0c1fcb4f8bcb1dccb5b0e97cc99e2ba908f81a8750572e6e6b762162a", + "independently_reproduced_by": "coordinator; Secrets read/attributed the retained exact-digest evidence and did not execute custody code" + } + ], + "acceptable_source_interface_facts": [ + "Canonical public key is unpadded base64url43 encoding of32 raw Ed25519 public bytes; fingerprint explicitly sha256 over those43 ASCII bytes. This is a reproducible representation agreement only, not key/custody admission.", + "Receipt/source/admission/policy/image/deployment hashes can bind public facts to exact independently reviewed artifacts when those actual artifacts and authenticated owner return are supplied. A JSON shape, digest, actor/native_custody flag or review string authenticates no owner by itself.", + "Docs explicitly define consumer_trust_sha256 as pre-generation verifier/policy/trust baseline, not a claim that the newly generated key is already online. Final independently admitted post-generation trust file requires its own exact bytes/digest, kid and public-key correspondence.", + "Declared scope is retained lifecycle pin only: evaluator flex-auth/local, mode standalone, policy secrets-engine.catalog-lane.lifecycle versionv2, artifact sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4. No taskpilot or caller-policy activation follows.", + "Public siblings in the document do not become consumer discovery trust; dedicated document-reader ESO scope is not field-level authorization. Secrets needs no KV/Secret/private seed lookup." + ], + "independent_returns_required_before_any_native_consumer_admission": [ + "Authenticated Platform/founder public return through a specifically reviewed owner channel/export, binding operation/native admission/executed revision, exact kid/public key/fingerprint, KV version/readback/recovery outcome, target cluster/backend, lifecycle purpose and allowed key sharing. Do not read the private custody directory as an agent intake or use the responder keys endpoint.", + "Exact actual post-generation consumer trust file and digest, independently validated against that public return, exact evaluator/mode/package/version/artifact pin and explicit removal/rotation policy. The baseline digest does not attest the new key.", + "Independent owner-selected signer runtime image/source and projection plus cluster/pod/tunnel identity and retained enforced caller provenance. A shared key/generic evaluator name does not identify an individual pod or prove current startup loading/ESO version.", + "Separate Access/cluster/founder returns for hardened durable log/outbox/storage, exclusive stop/restart/controller fence, read CCR0050 approved/binding-confirmed scope and corrected attended Warden routing. This review supplies none of those dispositions.", + "Independent admitted CLI package/prefix/config/caller/Approval delivery and current native captured allow+deny source records verified by existing Access receipt tool with exact installed Secrets helper. Genuine old/new key overlap and removed-key refusal need independently admitted real public keys; never invent a survivor key or restore unsigned/removed trust.", + "Each actual privileged CLI handler/backend/effect still needs its own exact scope and readback/cleanup acceptance; signer-only offline verification leaves native effect acceptance0of11sites/10handlers. Task-native Plan/grant/runtime remains separate." + ], + "native_plan_assessment": "Concrete enough to review targets/kid/CAS0/methods/metadata/fence/receipt directory/forward-only intent, but not executable/admitted: two requested source-lineage/recovery corrections and explicitly missing exact public/owner/native inputs remain. Scope-limited source review cannot be reused as a native admission approval.", + "validation": { + "both_patch_hashes_verified": true, + "all_frozen_manifest_after_source_hashes_verified": true, + "custody_or_private_read_tests_run_by_Secrets": false, + "coordinator_existing_tests_report": "44passed; implementation review remains coordinator-owned", + "own_frozen_native_R3_and_all_runtime_source_unchanged": true, + "no_key_read_login_or_live_action": true + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/platform-public-trust-review-r2.json b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/platform-public-trust-review-r2.json new file mode 100644 index 00000000..d9aaf193 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/platform-public-trust-review-r2.json @@ -0,0 +1,73 @@ +{ + "schema": "secrets-engine.public-trust-source-review.v1", + "reviewer_role": "secrets-engine-owner", + "review_basis": [ + "Secrets AGENTS.md", + "Secrets INTENT.md Engine/Lifecycle and PEP consumer boundary", + "SECRETS-WP-0014-T02 independently anchored responder keys/pin", + "SECRETS-WP-0014-T03 native consumer/rotation acceptance" + ], + "scope": "independent Secrets consumer/public-trust provenance review only; no Platform custody, Access, founder, cluster/GitOps, credential-read or native action approval", + "supersedes_source_findings_only": { + "review": "decision-native-preparation/platform-public-trust-review-r1.json", + "sha256": "sha256:30525ed0ac6b3e44affdac1ab23b80ef8dc7353c559d199db7cb689d1d0bf09d", + "preserved_unchanged": true + }, + "reviewed_exact_patches": { + "native_preparation_R1": "sha256:a9d4631d3320ac3fa56f5a61965005c546eae241d2004cc1e6385e04668b7f7f", + "native_adapter_R2_full": "sha256:c5b8f0d10650f13eb5939874bda1fb457b3dc5835e63e043af9824e43edb9f80", + "native_adapter_R2_over_R1": "sha256:81f4c2867d09accc33a22f7537526c0bcf86c4e45803639af0c602b6446c9ab1" + }, + "reviewed_manifest_sha256": "sha256:697a3d23cde5cd96c09c2edfb4187a0a42965d65932543b82bd4ac0ec3f617d9", + "disposition": "no_remaining_F01_F02_source_interface_objections", + "authority_granted": false, + "native_consumer_trust_admitted": false, + "may_populate_native_admission_owner_reviews": false, + "source_review_does_not_approve_exact_future_admission_digest": true, + "finding_dispositions": [ + { + "id": "SECRETS-PUBLIC-TRUST-R1-F01", + "status": "addressed_in_exact_R2_source", + "evidence": "Plan source_primitive_sha256 now matches actual shared custody module sha256:f169ad12f90d729b647085c3bed2c0d8d005db23a2341b6d3d5f1793bcfd110c. Prior pin explicitly historical; checked_sources joins current plan primitive to independently admitted source_bundle. The external bundle pins executor source without a self-hash cycle. Recovery original_execution separately binds original receipt bindings/writer/CCR; current source checks remain enforced. Image/deployment/policy/trust cannot change through recovery." + }, + { + "id": "SECRETS-PUBLIC-TRUST-R1-F02", + "status": "addressed_for_consumer_public_provenance_in_exact_R2_source", + "evidence": "Recovery accepts exact metadata-setup null-public original and reserves independent recovery intent before target reads. Exact current metadata absence plus data absence yields current-custody-absent; exact configured metadata current_version0 plus data absence yields metadata-only-confirmed. Both have null public key/fingerprint/version, key_custody_verified false, historical_effect unresolved and explicit fresh independently reviewed next-action requirement. Original receipt remains untouched. Denied, misleading, malformed, timeout and unexpected-version cases remain unconfirmed; version1 after no-public metadata phase refuses. Generated but unstored public key is not admitted. Successful seed-cas version1 reconciliation separately verifies private/public/receipt correspondence and remains pending independent public admission. No recovery write/remint path added.", + "validation_attribution": "Secrets inspected exact implementation/delta and regression assertions. Platform reports 56 passing tests including actual fork metadata process-loss cases. Coordinator independently tests implementation; Secrets did not execute custody/private-read code." + } + ], + "acceptable_source_interface_facts": [ + "Canonical public key is unpadded base64url43 encoding of32 raw Ed25519 public bytes; fingerprint explicitly sha256 over those43 ASCII bytes. This is a reproducible representation agreement only, not key/custody admission.", + "Receipt/source/admission/policy/image/deployment hashes can bind public facts to exact independently reviewed artifacts when those actual artifacts and authenticated owner return are supplied. A JSON shape, digest, actor/native_custody flag or review string authenticates no owner by itself.", + "Docs explicitly define consumer_trust_sha256 as pre-generation verifier/policy/trust baseline, not a claim that the newly generated key is already online. Final independently admitted post-generation trust file requires its own exact bytes/digest, kid and public-key correspondence.", + "Declared scope is retained lifecycle pin only: evaluator flex-auth/local, mode standalone, policy secrets-engine.catalog-lane.lifecycle versionv2, artifact sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4. No taskpilot or caller-policy activation follows.", + "Public siblings in the document do not become consumer discovery trust; dedicated document-reader ESO scope is not field-level authorization. Secrets needs no KV/Secret/private seed lookup." + ], + "independent_returns_required_before_any_native_consumer_admission": [ + "Authenticated Platform/founder public return through a specifically reviewed owner channel/export, binding operation/native admission/executed revision, exact kid/public key/fingerprint, KV version/readback/recovery outcome, target cluster/backend, lifecycle purpose and allowed key sharing. Do not read the private custody directory as an agent intake or use the responder keys endpoint.", + "Exact actual post-generation consumer trust file and digest, independently validated against that public return, exact evaluator/mode/package/version/artifact pin and explicit removal/rotation policy. The baseline digest does not attest the new key.", + "Independent owner-selected signer runtime image/source and projection plus cluster/pod/tunnel identity and retained enforced caller provenance. A shared key/generic evaluator name does not identify an individual pod or prove current startup loading/ESO version.", + "Separate Access/cluster/founder returns for hardened durable log/outbox/storage, exclusive stop/restart/controller fence, read CCR0050 approved/binding-confirmed scope and corrected attended Warden routing. This review supplies none of those dispositions.", + "Independent admitted CLI package/prefix/config/caller/Approval delivery and current native captured allow+deny source records verified by existing Access receipt tool with exact installed Secrets helper. Genuine old/new key overlap and removed-key refusal need independently admitted real public keys; never invent a survivor key or restore unsigned/removed trust.", + "Each actual privileged CLI handler/backend/effect still needs its own exact scope and readback/cleanup acceptance; signer-only offline verification leaves native effect acceptance0of11sites/10handlers. Task-native Plan/grant/runtime remains separate." + ], + "native_plan_assessment": "Source targets and public receipt lineage are concrete enough for the scoped consumer interface review after F01/F02 corrections. Native admission remains unapproved: exact public key/kid/custody export, authenticated owner return, final independently admitted consumer trust file, hardened runtime image/storage/outbox/caller provenance, founder/exclusive fences and approved bound CCR remain separate required inputs. The fixed 120-second expiry is unchanged; pre-reviewed exact scheduling is a documented proposal, not demonstrated human timing acceptance. No source review fills native owner_reviews or authorizes key access, generation, installation, grants, writes or effects.", + "native_effect_acceptance": { + "accepted_authorization_sites": 0, + "denominator_authorization_sites": 11, + "handlers": 10, + "offline_lifecycle_verification_is_separate": true + }, + "validation": { + "full_and_delta_patch_hashes_verified": true, + "all_full_manifest_after_file_hashes_verified": true, + "prior_review_hash_unchanged": true, + "source_and_test_assertions_reviewed": true, + "platform_reported_validation": "56 passed in 39.87s", + "platform_validation_sha256": "sha256:143e784727f3daecbb3162cbbc2ac6363b1b895dd010703b22f8196988672140", + "custody_or_private_read_tests_run_by_Secrets": false, + "own_frozen_R3_and_runtime_source_unchanged": true, + "no_key_read_login_or_live_action": true + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/allow-request.proposed.json b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/allow-request.proposed.json new file mode 100644 index 00000000..c80da7b7 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/allow-request.proposed.json @@ -0,0 +1,22 @@ +{ + "tenant": "tenant:platform", + "subject": { + "id": "secrets-engine", + "type": "service" + }, + "action": "apply", + "resource": { + "id": "catalog:whynot-design-npm-publish", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "attributes": { + "stage": "prod", + "fields": [], + "policy_targets": [], + "auth_targets": [] + } + }, + "context": { + "purpose": "native signer receipt only; no Approval consume or backend operation" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/canonical-build-one.txt b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/canonical-build-one.txt new file mode 100644 index 00000000..408c9fb7 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/canonical-build-one.txt @@ -0,0 +1,4 @@ +producer source and fixture hashes match the admitted source snapshot +Building wheel... +Successfully built /tmp/secrets-native-cli-4dd004a-one/wheels/secrets_engine-0.1.0-py3-none-any.whl +{"bundle": "/tmp/secrets-native-cli-4dd004a-one", "helper_sha256": "ed922b62533e4d33ae2d5f11175111f6f28e684a19e63ac704d43b63f0e0e12e", "manifest_sha256": "105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e"} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/canonical-build-two.txt b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/canonical-build-two.txt new file mode 100644 index 00000000..1b149730 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/canonical-build-two.txt @@ -0,0 +1,4 @@ +producer source and fixture hashes match the admitted source snapshot +Building wheel... +Successfully built /tmp/secrets-native-cli-4dd004a-two/wheels/secrets_engine-0.1.0-py3-none-any.whl +{"bundle": "/tmp/secrets-native-cli-4dd004a-two", "helper_sha256": "ed922b62533e4d33ae2d5f11175111f6f28e684a19e63ac704d43b63f0e0e12e", "manifest_sha256": "105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e"} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/canonical-owner-metadata.diff b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/canonical-owner-metadata.diff new file mode 100644 index 00000000..acf1eeaa --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/canonical-owner-metadata.diff @@ -0,0 +1,96 @@ +diff --git a/.custodian-brief.md b/.custodian-brief.md +index 0cb912a..ba794c8 100644 +--- a/.custodian-brief.md ++++ b/.custodian-brief.md +@@ -2,7 +2,7 @@ + # Custodian Brief — secrets-engine + + **Domain:** infotech +-**Last synced:** 2026-10-11 17:52 UTC ++**Last synced:** 2026-10-16 05:55 UTC + **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* + + ## Active Workstreams +@@ -11,8 +11,24 @@ + Progress: 1/3 done | workplan_id: `5e38aecc-85ca-5f55-94c6-9fbb08604819` + + **Open tasks:** ++- ! Define the exact mediated execution contract `b2f0d462` ++ *(wait: Independent Platform mediated-contract review and identity/approval/PDP owner returns remain required; D3 wrapped primitive source is implemented, no native entitlement is inferred.)* + - ! Implement and prove one native metadata action `5f8f7c41` +-- ► Define the exact mediated execution contract `b2f0d462` ++ ++### Constrain PDP transport and authenticate decision responses ++Progress: 1/3 done | workplan_id: `7252469d-d7a5-5c18-8911-b511b8c6a736` ++ ++**Open tasks:** ++- ! Verify the admitted native consumer and rotation path `85aa4c78` ++ *(wait: Requires reviewed verification-key admission, source enforcement and exact native rollout receipt; no production trust change is proposed yet.)* ++- ► Implement independently anchored responder authentication `877782e5` ++ ++### Production-safe provisioning, authorization, and lifecycle hardening ++Progress: 6/7 done | workplan_id: `68a39be1-bd9c-5133-ad64-e7bca892aaf3` ++ ++**Open tasks:** ++- ! Resume native production lane adoption `a0a1dd92` ++ *(wait: Engine approval hardening is complete. Remaining per-lane cutover includes native routing/proxy retirement with ops-warden under SECRETS-WP-0006-T05/T06; the exact OpenRouter key-check receipt does not establish broader recipient readiness.)* + + ### Activate native Claude credential delivery for Glas + Progress: 2/3 done | workplan_id: `40ccc3b4-d046-5a58-8649-e7935f45c974` +@@ -26,27 +42,20 @@ Progress: 4/6 done | workplan_id: `31f7f8ea-7f73-516c-8877-f03a13f1db82` + + **Open tasks:** + - ! Stage live apply and verification `fb103f1e` +- *(wait: OpenRouter key-check native acceptance is recorded in SECRETS-WP-0010-T03. Other lanes still need exact approvals, scoped attended apply and per-lane positive/negative/health/revocation evidence.)* ++ *(wait: Owner work first: publish a reviewed scoped-apply command per lane. Per-lane approvals are no longer needed (D1 standing rule); each lane with a command enters the attended window.)* + - ! Reconcile routing ownership and retire interim proxies `1431edae` + *(wait: Needs owner-agreed routing/proxy retirement for each verified lane and custody disposition of the legacy npm pointer; a single approved OpenRouter key-check does not authorize broader routing cutover.)* + +-### Production-safe provisioning, authorization, and lifecycle hardening +-Progress: 6/7 done | workplan_id: `68a39be1-bd9c-5133-ad64-e7bca892aaf3` +- +-**Open tasks:** +-- ! Resume native production lane adoption `a0a1dd92` +- *(wait: Engine approval hardening is complete. Remaining per-lane cutover includes native routing/proxy retirement with ops-warden under SECRETS-WP-0006-T05/T06; the exact OpenRouter key-check receipt does not establish broader recipient readiness.)* +- + ### Evolve the Lifecycle engine to the accepted security layer model + Progress: 5/6 done | workplan_id: `9c9e5164-b2f5-5ea2-a557-5368d65e9fe0` + + **Open tasks:** + - ! No standing engine credential `d7bc8bdc` +- *(wait: Positive service-JWT login proof passed 2026-10-10 (SECRETS-WP-0012-T03, docs/evidence/2026-10-10-keycape-openbao-probe.json). Waits on railiance-platform closing RPF-WP-0035-T02 with the CCR-2026-0038 negative checks, then on routing live engine actions through service-jwt instead of bootstrap/env.)* ++ *(wait: Published JWT contract and positive login/revocation are delivered. Native KEY-WP-0039-T02 claim negatives, CCR-2026-0038 effective-policy/capability/expiry/use checks and MASON-WP-0009-T05 remain. Login-self-only grants no protected-operation authority: agree and implement separately reviewed task-scoped backend execution entitlement, then prove functional steady-state service-identity adoption without bootstrap/env fallback.)* + + ## Inbox Hygiene + +-**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start. ++**Stale unread:** 3 message(s) older than 3 day(s) — triage at session start. + **Missing thread_id:** 2 unread message(s) lack supersession chains. + + --- +diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md +index 70e5831..4d1cfb6 100644 +--- a/WORK-RECORDS.md ++++ b/WORK-RECORDS.md +@@ -22,6 +22,7 @@ + | workplan | SECRETS-WP-0011 | finished | — | workplans/SECRETS-WP-0011-multi-lane-exec-owner-delivery.md | + | workplan | SECRETS-WP-0012 | finished | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md | + | workplan | SECRETS-WP-0013 | proposed | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md | ++| workplan | SECRETS-WP-0014 | active | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md | + | task | SECRETS-WP-ADHOC-2026-08-21-T01 | done | — | workplans/ADHOC-2026-08-21.md | + | task | SECRETS-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md | + | task | SECRETS-WP-0001-T01 | done | — | workplans/SECRETS-WP-0001-statehub-bootstrap.md | +@@ -83,9 +84,12 @@ + | task | SECRETS-WP-0012-T02 | cancel | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md | + | task | SECRETS-WP-0012-T03 | done | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md | + | task | SECRETS-WP-0012-T04 | done | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md | +-| task | SECRETS-WP-0013-T01 | progress | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md | ++| task | SECRETS-WP-0013-T01 | wait | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md | + | task | SECRETS-WP-0013-T02 | done | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md | + | task | SECRETS-WP-0013-T03 | wait | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md | ++| task | SECRETS-WP-0014-T01 | done | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md | ++| task | SECRETS-WP-0014-T02 | progress | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md | ++| task | SECRETS-WP-0014-T03 | wait | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md | + | intake | SECRETS-IN-0001 | closed | — | intakes/intakes.md | + | intake | SECRETS-IN-0002 | closed | — | intakes/intakes.md | + | intake | SECRETS-IN-0003 | closed | — | intakes/intakes.md | diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/canonical-seven-packaging-tests.txt b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/canonical-seven-packaging-tests.txt new file mode 100644 index 00000000..1991e402 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/canonical-seven-packaging-tests.txt @@ -0,0 +1,2 @@ +....... [100%] +7 passed in 3.99s diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/deny-request.proposed.json b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/deny-request.proposed.json new file mode 100644 index 00000000..cc99246e --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/deny-request.proposed.json @@ -0,0 +1,22 @@ +{ + "tenant": "tenant:platform", + "subject": { + "id": "secrets-engine", + "type": "service" + }, + "action": "destroy", + "resource": { + "id": "catalog:whynot-design-npm-publish", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "attributes": { + "stage": "prod", + "fields": [], + "policy_targets": [], + "auth_targets": [] + } + }, + "context": { + "purpose": "native signer receipt only; no Approval consume or backend operation" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/disposable-cli-help.txt b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/disposable-cli-help.txt new file mode 100644 index 00000000..42ff5895 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/disposable-cli-help.txt @@ -0,0 +1,35 @@ +usage: secrets-engine [-h] [--version] + {catalog,decision,plan,apply,provision,rotate,verify,handoff,wrap,exec,policy,route,revoke,session,lifecycle,state,secret-use,audit,evidence,service-auth} + ... + +secrets-engine command-line interface. + +positional arguments: + {catalog,decision,plan,apply,provision,rotate,verify,handoff,wrap,exec,policy,route,revoke,session,lifecycle,state,secret-use,audit,evidence,service-auth} + catalog catalog operations + decision decision operations + plan render a guarded plan (no mutation) + apply apply approved metadata to OpenBao + provision provision a value without printing it + rotate replace a declared KV field without printing it + verify positive/negative verification (no value printed) + handoff write AppRole role_id/secret_id handoff files + wrap write a single-use OpenBao wrap token to a file (never + printed) + exec run a command with the secret injected for the child + only + policy inspect secrets-engine policies + route ops-warden routing pointer for a lane + revoke deactivate native policy/AppRole access (preserves KV + custody) + session issued-session operator commands + lifecycle explicit lane lifecycle operations + state show persistent non-secret lane lifecycle state + secret-use read-only secret-use evidence surface + audit summarize non-secret local lane evidence + evidence load-bearing evidence heartbeat and outbox + service-auth KeyCape service-auth consumer checks + +options: + -h, --help show this help message and exit + --version show program's version number and exit diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/disposable-install-output.txt b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/disposable-install-output.txt new file mode 100644 index 00000000..70aaa536 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/disposable-install-output.txt @@ -0,0 +1,9 @@ +{"admission": "artifact integrity only; trust and keys not admitted", "helper_sha256": "ed922b62533e4d33ae2d5f11175111f6f28e684a19e63ac704d43b63f0e0e12e", "launcher_sha256": "8f366784b0ff6e1809826afe4c619007234a9f2427e9a0e5afa90c064694923e", "manifest_sha256": "105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e", "prefix": "/tmp/secrets-native-cli-4dd004a-installed", "schema": "secrets-engine.cli-install.v1"} +Using CPython 3.12.3 interpreter at: /home/worsch/secrets-engine/.venv/bin/python +Creating virtual environment at: /tmp/secrets-native-cli-4dd004a-installed/venv +Using Python 3.12.3 environment at: /tmp/secrets-native-cli-4dd004a-installed/venv +Resolved 2 packages in 6ms +Prepared 2 packages in 21ms +Installed 2 packages in 7ms + + pyyaml==6.0.3 + + secrets-engine==0.1.0 (from file:///tmp/secrets-native-cli-4dd004a-one/wheels/secrets_engine-0.1.0-py3-none-any.whl) diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/disposable-install-receipt.json b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/disposable-install-receipt.json new file mode 100644 index 00000000..6f80c1d7 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/disposable-install-receipt.json @@ -0,0 +1,8 @@ +{ + "admission": "artifact integrity only; trust and keys not admitted", + "helper_sha256": "ed922b62533e4d33ae2d5f11175111f6f28e684a19e63ac704d43b63f0e0e12e", + "launcher_sha256": "8f366784b0ff6e1809826afe4c619007234a9f2427e9a0e5afa90c064694923e", + "manifest_sha256": "105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e", + "prefix": "/tmp/secrets-native-cli-4dd004a-installed", + "schema": "secrets-engine.cli-install.v1" +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/installed-empty-trust-refusal.txt b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/installed-empty-trust-refusal.txt new file mode 100644 index 00000000..081a9295 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/installed-empty-trust-refusal.txt @@ -0,0 +1 @@ +empty unadmitted trust refuses before caller read/network diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/local-entrypoint-observation.json b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/local-entrypoint-observation.json new file mode 100644 index 00000000..fc67f24f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/local-entrypoint-observation.json @@ -0,0 +1,39 @@ +{ + "source_observed": "5a2099f400fb0c97fed2d991832c0e31513bbdfb", + "PATH_cli": null, + "editable_cli": { + "path": "/home/worsch/secrets-engine/.venv/bin/secrets-engine", + "exists": true, + "admitted_bundle_entrypoint": false + }, + "global_cli_exists": false, + "relevant_env_presence_only": { + "SECRETS_ENGINE_PDP_URL": false, + "SECRETS_ENGINE_PDP_TOKEN_FILE": false, + "SECRETS_ENGINE_PDP_TRUST_FILE": false, + "SECRETS_ENGINE_PDP_VERIFIER": false, + "SECRETS_ENGINE_APPROVAL_URL": false, + "SECRETS_ENGINE_APPROVAL_TOKEN_FILE": false, + "SECRETS_ENGINE_APPROVAL_CLIENT_SECRET_FILE": false, + "SECRETS_ENGINE_PEP_STANCE": false, + "SECRETS_ENGINE_CATALOG": false, + "SECRETS_ENGINE_POLICIES": false, + "SECRETS_ENGINE_EVIDENCE": false, + "SECRETS_ENGINE_CLOCK_TRUST_FILE": false + }, + "no_private_config_credential_file_or_process_environment_read": true, + "declared_config_defaults_source_sha256": "228f548822620d538ad0c025eb68d88091be542819ed571be06c9e69c5e912c6", + "source_PATH_invocations": [ + "scripts/demo-e2e.sh", + "scripts/npm-publish-demo.sh" + ], + "source_preflight_fallback": "scripts/whynot-real-publish-preflight.sh activates .venv/PATH, otherwise python -m secrets_engine.cli; not admitted release invocation", + "canonical_followup": { + "source": "4dd004a2250104ba56293b2d7b0d96f4e076ea99", + "PATH_cli": null, + "global_cli_exists": false, + "disposable_prefix_only": "/tmp/secrets-native-cli-4dd004a-installed", + "native_installed_prefix_selected": false, + "no_private_config_or_credential_read": true + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/native-admission-proposal-r2.json b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/native-admission-proposal-r2.json new file mode 100644 index 00000000..f29aff4e --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/native-admission-proposal-r2.json @@ -0,0 +1,127 @@ +{ + "proposal_id": "SECRETS-WP-0014-native-cli-20261016-r2", + "status": "preparation; no installation, key/trust admission, credential read, live capture or protected effect authorized", + "work_records": [ + "SECRETS-WP-0014-T02", + "SECRETS-WP-0014-T03" + ], + "canonical_source_commit": "4dd004a2250104ba56293b2d7b0d96f4e076ea99", + "canonical_bundle_manifest_sha256": "105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e", + "initial_scope": { + "producer": "retained flex-auth/flex-auth-secrets-engine lifecycle pin only", + "policy_package": "secrets-engine.catalog-lane.lifecycle", + "policy_version": "v2", + "policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4", + "evaluator": "flex-auth/local", + "mode": "standalone", + "consumer": "exact reviewed PREFIX/bin/secrets-engine and fixed bundled helper", + "source_serving_sites": 11, + "source_handlers": 10, + "native_protected_effects_accepted": 0, + "offline_lifecycle_signer_receipt_verification_is_not_privileged_handler_acceptance": true, + "task_policy_or_native_task_enablement": false + }, + "independent_public_trust": { + "kid": null, + "canonical_public_key_base64url43": null, + "public_fingerprint": null, + "fingerprint_convention": "Platform proposal: sha256(canonical unpadded base64url43 public-key ASCII); exact owner public receipt required", + "owner_custody_receipt": null, + "scope_and_key_sharing_receipt": null, + "signed_candidate_oci_digest": null, + "native_durable_log_outbox_receipt": null, + "source": "Access owner confirms no native key/kid/public fingerprint/custody admitted; Platform signer lane proposed only", + "prohibited_substitutes": [ + "fixture seed/key", + "same-responder keys endpoint", + "image metadata without independent public custody receipt", + "arbitrary additional trusted key" + ] + }, + "placement_owner_inputs": { + "runtime_uid": null, + "fresh_release_prefix": null, + "admitted_cli_absolute_path": null, + "config_parent": null, + "trust_file_absolute": null, + "catalog_directory_absolute": null, + "policy_directory_absolute": null, + "stance_file_absolute": null, + "evidence_directory_absolute": null, + "evidence_outbox_cadence_owner": null, + "bounded_PDP_caller_delivery_path": null, + "owner_bound_literal_loopback_PDP_origin": null, + "approval_endpoint_and_separate_credential_delivery": null, + "clock_basis_and_optional_clock_dependency_admission": null, + "backend_entitlement_for_each_actual_handler": null + }, + "delivery_contract": { + "install": "existing bundle install.py only, fresh prefix and independently retained manifest digest; no overwrite/global uv tool/symlink/second wrapper", + "invocation": "exact absolute PREFIX/bin/secrets-engine; internal venv console entrypoint, editable checkout, ambient PATH demo and python -m fallbacks are not admitted effect entrypoints", + "helper": "PREFIX/libexec/secrets-engine-pdp-verify, fixed by wrapper and digest-checked before import; no runtime compilation/ambient helper override", + "config": "existing environment variables only, delivered by owner-selected invocation context; explicit absolute metadata/trust/evidence paths, no working-directory defaults", + "credentials": "existing scoped file/provider delivery outside release/Git; no credential bytes in config proposal; never configure both Approval token and client-secret providers", + "evidence": "SECRETS_ENGINE_EVIDENCE plus its outbox child, owner-private parent and exact replay/cadence owner; source evidence is not audit custody", + "stance": "published prod fail_closed unchanged; unsafe-demo unset; no service-jwt/backend readiness bypass", + "clock": "base release excludes optional clock extras; no clock-trust selection implies independent trusted-time acceptance" + }, + "offline_native_receipt_verifier": { + "owner": "Access", + "canonical_source_observed": "2b064eee510640224274ccdc7cefceb1ae13162e", + "path": "tools/verify_native_signer_receipt.py", + "uses": "installed Secrets authenticate_response/load_trust/validate_decision_envelope; no second crypto implementation", + "admission_file_schema": "access-engine.signer-receipt-check.v1", + "inputs": "exact captured native allow/deny requests, original signed envelopes and corresponding durable source records, admitted trust and independently pinned installed helper", + "not_authority_for": "Approval consume, OpenBao effect or native task", + "source_sha256": "33d3c50aba51b85cf85d2e234268e903004894299efc9b3745e0980c55578280" + }, + "next_gates": [ + "completed source preparation: published4dd004a, two exact clean-source builds, disposable installation/help/empty-native-trust refusal; no native prefix admitted", + "independent package/prefix/config admission with exact source/manifest/artifact hashes", + "Access/Platform independent real public signer/kid/fingerprint/custody and candidate immutable image/log/storage returns", + "owner-approved bounded literal-loopback transport/caller delivery and exact proposed capture vectors", + "capture native allow/deny records, verify offline with existing Access tool and installed helper, then forgery/downgrade/key-removal/outage cases", + "separate exact handler/backend/Approval/effect acceptance before changing0of11" + ], + "remaining_task_work_records": [ + "SECRETS-WP-0013-T01", + "SECRETS-WP-0013-T03", + "SECRETS-WP-0008-T06" + ], + "proposed_workstation_placement_for_owner_review": { + "status": "concrete proposal only; no path selected/admitted/created", + "runtime_uid_candidate": 1000, + "release_prefix": "/home/worsch/.local/share/secrets-engine/releases/4dd004a22501-105dcebe6f03", + "entrypoint": "/bin/secrets-engine", + "config_parent": "/home/worsch/.config/secrets-engine/native-lifecycle/", + "trust_file": "/pdp-trust.json", + "catalog_directory": "/catalog", + "policy_directory": "/policies", + "stance_file": "/pep-stance.yaml", + "evidence_directory": "/home/worsch/.local/state/secrets-engine/native-lifecycle/evidence", + "temporary_caller_file_candidate": "/run/user/1000/secrets-engine/native-lifecycle/pdp-caller.token", + "constraints": [ + "no writes performed or native UID/host selection inferred", + "owner must select exact config revision and metadata hashes/Approval provider before any install", + "fresh release prefix only; no replacement/global PATH alias/editable checkout", + "config/evidence/credential parents owner-private; trust regular nonsymlink/non-group/world-writable", + "credentials remain separate reviewed scoped delivery; template file names are not routing/admission", + "existing same-UID controls do not establish credential isolation or agent autopilot" + ], + "pdp_origin_candidate": "http://127.0.0.1:18081; only after owner verifies free port and exact admitted namedpod/cluster; not a created tunnel" + }, + "caller_public_source_provenance": { + "Secrets_source": "docs/pdp-access-path.md; historical transport procedure and current admission gate", + "Access_source": "docs/operator-caller-access-path.md; final2026-09-06 live execution update supersedes earlier warn/missing-SA observations", + "historical_serving_receipt": "SECRETS-WP-0008 dated2026-09-07 real Check decision:0f9c98f14545c42d", + "issuer": "Kubernetes TokenRequest/TokenReview, not OpenBao or signer private-key custody", + "identity": "system:serviceaccount:secrets-engine:secrets-engine", + "audience": "flex-auth", + "documented_session_duration": "10m; any concrete new capture needs exact owner-approved bounded lifetime", + "documented_delivery": "per-session owner-private regular file outsideGit, mode0600; shred/end only own transport at session close", + "current_admitted_file_path": null, + "local_cli_is_not_automatically_that_ServiceAccount": true, + "operator_TokenRequest_authority_or_pod_workload_identity_not_inferred": true + }, + "canonical_fixed_helper_sha256": "ed922b62533e4d33ae2d5f11175111f6f28e684a19e63ac704d43b63f0e0e12e" +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/native-cli-admission-docs-r2.patch b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/native-cli-admission-docs-r2.patch new file mode 100644 index 00000000..4f22487c --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/native-cli-admission-docs-r2.patch @@ -0,0 +1,177 @@ +diff --git a/docs/proposals/native-cli-admission/README.md b/docs/proposals/native-cli-admission/README.md +index 3729cf6..08a7e74 100644 +--- a/docs/proposals/native-cli-admission/README.md ++++ b/docs/proposals/native-cli-admission/README.md +@@ -1,5 +1,52 @@ + # Native CLI signer and consumer admission preparation + ++## Current release preparation — 2026-10-16 R2 ++ ++Published canonical Secrets `4dd004a2250104ba56293b2d7b0d96f4e076ea99` was ++built twice from an isolated clean checkout. Artifacts and deterministic bundle ++manifest match exactly: manifest SHA256 ++`105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e`, ++fixed helper SHA256 ++`ed922b62533e4d33ae2d5f11175111f6f28e684a19e63ac704d43b63f0e0e12e`. ++Disposable installation/help and empty native trust refusal pass; no native ++prefix, trust/key, caller credential, protected effect or rollout was admitted. ++Artifact integrity is not independent package admission. Full receipts and a ++concrete probe/placement proposal are in Custodian `decision-native-preparation/r2/`. ++ ++Initial native scope remains the existing lifecycle pin and **0/11 protected ++sites across10 handlers**. Runtime UID/release/config/catalog/stance/trust/evidence ++and scoped caller/Approval delivery paths remain owner-unselected. A concrete ++workstation candidate uses a new release prefix ending ++`4dd004a22501-105dcebe6f03`; it is a proposal, not an installed/admitted path. ++Only its exact future `bin/secrets-engine` wrapper is the effect entrypoint. ++The current repo editable invocation and ambient demo/preflight fallbacks do not ++constitute release admission. A local CLI does not automatically hold the named ++ServiceAccount identity: existing docs describe separately authorized per-session ++TokenRequest delivery, not a standing credential or pod identity grant. ++ ++Access's single offline signer-receipt tool is published at ++`2b064eee510640224274ccdc7cefceb1ae13162e`; verified API/sign source matches this ++consumer. Native producer rollout still awaits independent public kid/key/custody ++and immutable candidate image/log/storage returns, including the Access owner's ++separate durable-log hardening review. Published source alone is not that image. ++The lifecycle pin stays v2/bd11c5fe...; task v2 is a separate unadmitted pin. ++ ++Source task correspondence is now implemented and cross-owner source-server ++proved: fixed typed service mapping before issue, retained-registry signed-DENY ++preapproval, original claim/context preservation, independent fresh source facts, ++precise Approval CAS and independent confirmation/journal/native disposable proof. ++This supersedes the historical source gaps below; it neither adds an execute-ccr ++CLI command nor selects a real CCR/catalogue/Plan/grant/backend/journal runtime. ++All native effect, caller/key/config and task-entitlement gates remain open under ++existing WP14/WP13/WP8 records. `service-jwt` still refuses protected CLI work. ++ ++## Historical ff1a13d preparation (preserved) ++ ++The following draft records the earlier source/admission observations. References ++to absent B2/B3/request/source-fact implementation are superseded by R2 above; ++missing native keys, runtime placement and actual task inputs remain unresolved. ++ ++ + This proposal covers the existing lifecycle CLI authentication path under + SECRETS-WP-0014. It grants no installation, key retrieval, caller mint, approval + consume, OpenBao effect or task-policy activation. All native acceptance counts +diff --git a/docs/proposals/native-cli-admission/proposal.json b/docs/proposals/native-cli-admission/proposal.json +index d5c50c2..d953ada 100644 +--- a/docs/proposals/native-cli-admission/proposal.json ++++ b/docs/proposals/native-cli-admission/proposal.json +@@ -1,7 +1,7 @@ + { + "proposal_id": "SECRETS-WP-0014-native-cli-20261016", + "status": "preparation only; not installable or executable authorization", +- "source_base": "ff1a13dabd44ba02ddd6bc26ad75568f6d2e6225", ++ "source_base": "4dd004a2250104ba56293b2d7b0d96f4e076ea99", + "workplans": [ + "SECRETS-WP-0014-T02", + "SECRETS-WP-0014-T03", +@@ -33,8 +33,10 @@ + "custody_receipt": null, + "candidate_producer_oci_digest": null, + "rule": "No responder keys endpoint, synthetic fixture key or deployment metadata substitutes for independent owner admission", +- "receipt_verifier_integrated_revision": null, +- "signer_purpose_pin_and_sharing_receipt": null ++ "receipt_verifier_integrated_revision": "2b064eee510640224274ccdc7cefceb1ae13162e", ++ "signer_purpose_pin_and_sharing_receipt": null, ++ "public_fingerprint_convention": "Platform proposal: sha256(canonical unpadded base64url43 public-key ASCII); independent owner receipt required", ++ "candidate_producer_prerequisite": "Access durable-log hardening source and immutable image/storage/custody awaiting separate root/Platform review; published2b064ee alone is not native candidate admission" + }, + "placement": { + "owner": "Secrets consumer/deploying owner; exact runtime UID and paths not yet agreed", +@@ -52,7 +54,9 @@ + "absolute independently reviewed config/catalog/policy/stance/trust paths; no working-directory defaults for native use", + "trust regular non-symlink, not group/world writable; key admission not file-presence inference", + "owner retains manifest/admission/installation receipts and same-UID control boundary" +- ] ++ ], ++ "candidate_cli_release_prefix": "/home/worsch/.local/share/secrets-engine/releases/4dd004a22501-105dcebe6f03", ++ "candidate_status": "proposal only; no path selected/created/admitted" + }, + "configuration_contract": { + "SECRETS_ENGINE_PDP_URL": "literal loopback bare origin bound to independently verified cluster and named producer pod; exact native port awaiting owner placement", +@@ -81,27 +85,20 @@ + }, + "task_mapping_gap": { + "existing_cli_execute_ccr_command": false, +- "source_handoff": "secrets_engine.task_execution_handoff authorize_task_execution/consume_task_execution", ++ "source_handoff": "secrets_engine.task_execution_handoff prepare_task_approval/authorize_task_execution/consume_task_execution", + "platform_source_mediator": "railiance-platform/scripts/task_execution_mediator.py run_native_fixture_task; source proof only", + "unadmitted_inputs": [ +- "real service caller-to-subject server mapping and request/service binding join", +- "actual task policy candidate and independently reviewed source/runtime admission; both false gates unchanged", ++ "native admission of the existing exact service-caller-to-subject request mapping and immutable original-claim/source join", + "owner-selected fresh approved CCR/catalog/execution-grant, compiled Plan/whole descriptor and operation UUID", + "independent expected-before/after bytes for exact two metadata targets and actual estate/backend origin", + "actual source/Plan/install/journal/cleanup placement and trusted provider endpoints/credentials/custody", + "load-bearing audit/outbox cadence and durable receipt correlation", +- "Approval/Access reviewed out-of-band fresh-fact versus original carried-claim correspondence and signed provenance; strict context equality remains unchanged" ++ "exact native task v2 policy/caller/source/config/placement/key/runtime admission; v1 hard DENY retained" + ], + "approval_fact_interface_review": { +- "status": "review preference only; no implementation/admission", +- "preserve": "strict binding.context equality and original submitted/approval-free/native joins", +- "direction": "Access prefers out-of-band server-fetched authoritative fact checking while retaining original carried context, then reviewed producer-owned signed provenance/audit evidence", +- "required_review": [ +- "Approval fact/freshness semantic correspondence", +- "Access source receipt/provenance binding and exact request digests" +- ], +- "b1": "signed-DENY caller join only; no context replacement", +- "b2_b3": "not enabled or implemented here" ++ "status": "implemented/source-proved; native source/config/identity/trust admission remains missing", ++ "preserve": "type-sensitive original context/native/request/descriptor correspondence; original and independently fresh fact deadlines; no numeric translation", ++ "receipt": "Custodian decision-trusted-successor/verification-final-r4.json" + }, + "approval_fact_contract": { + "artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-fact-contract/consumer-contract.md", +@@ -110,7 +107,8 @@ + "vectors_sha256": "dfb0a8810cd91847d7af6a7af6a51607a67a66fad7b86fc57365308c36bd9323", + "status": "owner source contract pending integration; no Go conformance or B2 behavior admitted", + "required": "preserve original fact/context/freshness, independently validate fresh fact window and exact nonfreshness authority; do not translate native numeric digests or invent target restrictions" +- } ++ }, ++ "source_status": "implemented and cross-owner source-server proved, including retained registry and precise CAS; no native adoption" + }, + "approval_state": "no owner assent, key admission, install, caller token, operation grant or live change requested/executed by this preparation", + "denominator": { +@@ -129,5 +127,15 @@ + "platform_source_mediator_native_acceptance": false, + "generic_cli_consume_is_strict_task_handoff": false, + "effect_acceptance_required": "Review actual selected handler/generic consume response and caller scope separately; strict Platform fixture proof does not close existing CLI effects" ++ }, ++ "historical_source_base": "ff1a13dabd44ba02ddd6bc26ad75568f6d2e6225", ++ "release_candidate": { ++ "bundle_manifest_sha256": "105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e", ++ "helper_sha256": "ed922b62533e4d33ae2d5f11175111f6f28e684a19e63ac704d43b63f0e0e12e", ++ "two_clean_builds_equal": true, ++ "disposable_install_passed": true, ++ "native_install_admitted": false, ++ "artifact_integrity_is_not_package_admission": true, ++ "receipt": "Custodian decision-native-preparation/r2/canonical-build-install-receipt.json" + } + } +diff --git a/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md b/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md +index f65ac96..08e3e01 100644 +--- a/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md ++++ b/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md +@@ -175,3 +175,18 @@ bool/int/float substitution while allowing extra authoritative registry facts. + Actual provider proof preparation is separately waiting on frozen Access source + and Approval's timestamp/transaction-clock repair; source native/trust/custody and + actual task admission remain open. T02 remains progress and T03 wait; no native adoption is claimed. ++ ++2026-10-16 canonical native CLI release preparation: published4dd004a was built ++twice offline from a clean isolated checkout, with identical artifacts/manifest ++105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e. ++Disposable installation uses its fixed helper and empty native trust refuses ++before caller access. Exact invocation/config/delivery candidates, public signer ++provenance requirements, native lifecycle allow/deny capture, rotation/removal and ++isolated-transport outage probes are reviewable in Custodian ++`decision-native-preparation/r2/`. Real public kid/key/custody, candidate signed ++producer/log/storage, native UID/prefix/config/caller/Approval delivery and each ++actual handler/backend entitlement remain missing. No seed/token read, mint, ++production installation/trust/policy change or effect occurred. Native effect ++coverage remains0/11 across10handlers; T02 progress/T03 wait and task-native ++WP13/WP8 gates remain open. Published Access receipt-tool2b064ee and verified ++source APIs do not substitute for the separately reviewed hardened native image. diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/native-probe-plan.md b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/native-probe-plan.md new file mode 100644 index 00000000..41a68e65 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/native-probe-plan.md @@ -0,0 +1,98 @@ +# Existing CLI/native signer admission plan + +This prepares SECRETS-WP-0014-T02/T03. Nothing below runs against the estate here. +Protected-effect acceptance remains **0/11 authorization sites across10 handlers**. +The separately proved task API is not an existing execute-ccr CLI command and does +not admit any of these lifecycle effects. Each privileged handler still needs its +exact metadata lane, Approval consume contract, backend entitlement and evidence. + +The current authoritative development invocation is the repository editable +`.venv/bin/secrets-engine`; this shell has no PATH/global installed Secrets CLI. +Demo scripts invoke ambient PATH; the publish preflight activates `.venv` or falls +back to `python -m`. They are not admitted release invocations. The proposed native +entrypoint is exactly the new owner-selected release's `bin/secrets-engine`. +Its existing wrapper pins `libexec/secrets-engine-pdp-verify` before import and +ignores ambient helper selection. The internal venv script is not a second effect +entrypoint. No new launcher, service, credential broker or retired rapp is added. + +## Admission inputs before execution + +`native-admission-proposal-r2.json` separates known configuration from missing +owner inputs and supplies concrete workstation placement candidates for review. +No proposed path is created/selected/admitted. The owner must bind runtime UID, +fresh prefix, source+bundle manifest, metadata/catalog/policy/stance hashes, +config revision, evidence/outbox cadence and exact scoped credential delivery. +Existing Config environment variables remain the interface; no config framework +is introduced. Installed-package cwd defaults are inadequate native placement. +Neither this source package nor artifact SHA integrity independently admits a +package, signer, config or prefix. Base bundles omit optional clock dependencies; +any required clock source/extras need an exact separate owner return. + +Access must return the actual immutable signed image, retained lifecycle pin, +owner-bound pod/cluster/tunnel, durable decision record/log/outbox custody, and +independent public signer receipt. Platform's draft seed mount/public fingerprint +proposal is not custody/key admission. No private key/seed is read. Public kid/key/ +fingerprint and exact key purpose/sharing remain missing. Synthetic fixture trust, +responder-discovered keys and new arbitrary trusted keys cannot fill these fields. + +## Concrete capture and verification sequence + +1. After independently admitted package/config/signer rollout, retain original + native request bytes, signed HTTP response bytes and corresponding durable + producer record for each proposed vector. `allow-request.proposed.json` uses + lifecycle `apply`; `deny-request.proposed.json` uses `destroy` without a claim. + The retained v2 policy allows well-formed non-dual-control apply and denies + destroy without Approval. The public catalog reference is a proposal requiring + exact owner assent, not a selected real effect lane. These are PDP-only capture + requests: no Approval consume, OpenBao call, token mint or metadata mutation. + The exact enforced consumer principal is + `system:serviceaccount:secrets-engine:secrets-engine`, audience `flex-auth`. +2. Access owns the single existing offline verifier + `tools/verify_native_signer_receipt.py` (published canonical source2b064eee510640224274ccdc7cefceb1ae13162e). + Run it with the reviewed bundle Python environment and its existing + `access-engine.signer-receipt-check.v1` admission file: absolute captured + allow/deny request/envelope/record paths, admitted public trust, exact fixed + installed-helper path+SHA, and expected caller. No token/network input is used + by this verifier. This establishes native signer/record/client verification, + not generic CLI CAS correctness or any protected-effect handler acceptance. +3. Retain the verifier's exact current allow+deny result, input/source/artifact + hashes and checked lifetime/caller deadline. Native record/response mismatch, + altered payload/signature, unsigned mode, wrong issuer/pin, unknown kid and + expired allow must refuse. Negative mutations are marked derived cases, not + presented as genuine native producer records. Never turn a failed request into + an allow by replacing original context, identity, digest or clock. +4. Rotation requires independently admitted old/new public keys and exact bounded + overlap/producer candidate receipts. Accept genuine native records under both + during admitted overlap, then remove old kid and reject an original old-signed + record with a valid surviving admitted key set. With only one admitted key, + removing it yields invalid empty trust and config refusal; that is fail-closed + evidence, not a cryptographic multi-key rotation proof. Do not invent a second + key to make the test run. Never restore a removed key/unsigned producer or relax + a pin as rollback. Retain the signed admitted producer/overlap or stop. +5. Outage probe requires the owner's exact separately controlled consumer tunnel + PID/origin/target and restart recipe. Interrupt only that dedicated transport, + never scale a shared deployment, interrupt a shared tunnel or alter backend + policy. Exercise the installed shared `check_decision` against the same exact + request and owner-delivered caller file; expect transport DecisionError, zero + CAS/backend calls and no fabricated decision. Missing/tampered helper and absent + trust separately refuse before credential access. A closed arbitrary local + port is a disposable transport test, not evidence of a native producer outage. + The installed library diagnostic is not another privileged CLI entrypoint. +6. Privileged handler tests follow only under a separate exact owner action and + backend entitlement. `service-jwt` currently refuses protected CLI before + PIP/PDP/CAS because CCR38 is identity-only. Do not switch to bootstrap/env or + unsafe-demo to get past that boundary. Such readiness refusal proves no effect, + not reachability of the signed authorization site. For each selected actual + handler, retain exact request/claim/consume/effect/readback/cleanup evidence; + leave remaining sites unaccepted. Generic CLI consume remains distinct from + strict task handoff+independent confirmation/journal. Session revoke, route + readiness and identity probes remain visible exclusions. + +## Gates and rollback + +Missing current native inputs block this sequence before installation/capture. +Record them under existing WP14-T02/T03, with task-native/entitlement gates still +in WP13-T01/T03 and WP8-T06. Keep artifact build time separate from deterministic +manifest fields. No production native counts change from source or disposable +proofs. An unavailable or unsigned producer remains refusal/outage, never a reason +to bypass verification or retry a potentially consumed operation. diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/observed-build-receipt.json b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/observed-build-receipt.json new file mode 100644 index 00000000..273b1b50 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/observed-build-receipt.json @@ -0,0 +1,5 @@ +{ + "receipt_recorded_at_utc": "2026-10-16 15:37:49 UTC", + "note": "observed receipt timestamp kept separately; deterministic bundle manifest has only commit-derived SOURCE_DATE_EPOCH", + "no_production_install_or_trust_admission": true +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/pep-denominator.json b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/pep-denominator.json new file mode 100644 index 00000000..f0952951 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/pep-denominator.json @@ -0,0 +1,87 @@ +{ + "source_observed": "5a2099f400fb0c97fed2d991832c0e31513bbdfb", + "cli_sha256": "b7f74330732fd991f080adb6d1c4ef576c81884809103812612652cafe3ee4d0", + "shared_production_check_client": "secrets_engine.decision_check.check_decision via approval_consume.authorize_action", + "serving_authorization_sites": 11, + "handlers": 10, + "native_effect_acceptance": 0, + "sites": [ + { + "handler": "cmd_apply", + "line": 312, + "action_expression": "'apply'", + "native_effect_accepted": false + }, + { + "handler": "cmd_provision", + "line": 339, + "action_expression": "'provision'", + "native_effect_accepted": false + }, + { + "handler": "cmd_rotate", + "line": 377, + "action_expression": "'rotate'", + "native_effect_accepted": false + }, + { + "handler": "cmd_verify", + "line": 420, + "action_expression": "'verify'", + "native_effect_accepted": false + }, + { + "handler": "cmd_handoff", + "line": 494, + "action_expression": "'handoff'", + "native_effect_accepted": false + }, + { + "handler": "cmd_wrap", + "line": 534, + "action_expression": "'wrap'", + "native_effect_accepted": false + }, + { + "handler": "cmd_exec", + "line": 587, + "action_expression": "'exec'", + "native_effect_accepted": false + }, + { + "handler": "cmd_exec", + "line": 610, + "action_expression": "'exec'", + "native_effect_accepted": false + }, + { + "handler": "cmd_revoke", + "line": 741, + "action_expression": "'deactivate'", + "native_effect_accepted": false + }, + { + "handler": "_cmd_lifecycle_state", + "line": 778, + "action_expression": "args.operation", + "native_effect_accepted": false + }, + { + "handler": "cmd_lifecycle", + "line": 846, + "action_expression": "args.operation", + "native_effect_accepted": false + } + ], + "not_denominator": [ + "catalog row count", + "12 lifecycle policy action values", + "strict task execution API/source fixture", + "session revoke", + "service-auth identity probe", + "route metadata readiness", + "dry-run/report commands" + ], + "canonical_followup_source": "4dd004a2250104ba56293b2d7b0d96f4e076ea99", + "canonical_cli_byte_identical_to_observed": true +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/preimages/docs/proposals/native-cli-admission/README.md b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/preimages/docs/proposals/native-cli-admission/README.md new file mode 100644 index 00000000..3729cf6c --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/preimages/docs/proposals/native-cli-admission/README.md @@ -0,0 +1,158 @@ +# Native CLI signer and consumer admission preparation + +This proposal covers the existing lifecycle CLI authentication path under +SECRETS-WP-0014. It grants no installation, key retrieval, caller mint, approval +consume, OpenBao effect or task-policy activation. All native acceptance counts +below are zero. Exact missing owner inputs are in `proposal.json`. + +## Current consumer and initial scope + +At source `ff1a13d`, the workstation has the repository's editable v0.1.0 CLI +entrypoint at `/home/worsch/secrets-engine/.venv/bin/secrets-engine`, importing +`secrets_engine.cli:main`. There is no global `~/.local/bin/secrets-engine` or uv +managed Secrets tool. Presence-only inspection of this session found none of the +PDP/trust/approval/policy/configuration variables set. This says nothing about +other sessions, private owner configuration or a remote installation. No credential +file, private configuration or process environment was inspected. + +Use a separately reviewed immutable wheel-plus-verifier bundle for proposed +adoption. The canonical source for the candidate build is **ff1a13d**, containing +both CLI packaging and strict R2 handoff; earlier c80-based proof bundles are +intermediate source evidence. Custodian `decision-native-preparation/` retains the +exact canonical bundle manifest and hashes. Nothing was installed by this step. + +Initial stage is signer-only existing lifecycle-pin admission plus offline +verification of captured native signed allow and deny records. Capturing those +records later needs its own admitted caller and exact source operation; this +proposal does not grant that capture. Use Access's one receipt verifier, +`tools/verify_native_signer_receipt.py`, with its reviewed admission file rather +than creating another consumer verifier or canonicalization implementation. +That tool is separate Access source preparation; its exact integrated revision +and reviewed admission file remain owner inputs, not part of this CLI install. + +The producer-owned offline pin is `secrets-engine.catalog-lane.lifecycle` v2, +`sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4`, +evaluator `flex-auth/local`, mode `standalone`. A source digest is not proof of the +live image's source or policy. Access's live metadata records the current pin has +no signer arguments/mounts; no production kid/public key/fingerprint/custody +receipt or candidate signed-runtime OCI digest is admitted. The proposed signer +custody route is draft/nonresolvable. Do not fill those gaps from fixture keys or +from the same responder's keys endpoint. The independent receipt must bind signer +purpose/custody to this exact consumer pin and declare any sharing. A shared key +plus the generic evaluator name cannot prove an individual pod's identity; the +owner-bound tunnel and rollout identity still require separate verification. + +`lifecycle-trust.template.json` uses the existing runtime trust schema and the +producer-owned source pin, but deliberately has an empty key map. It **must +refuse** before caller credential access. It is not a deployable trust file. A +future owner-admitted copy must contain the independently authenticated actual +kid/key and exact pin, with its public-key fingerprint/custody provenance retained +outside this unadmitted template. The task-policy coordinate is not admitted here. + +## Exact PEP denominator + +The initial shared authentication implementation is one Check client reached +through `authorize_action` and `_require_lane_approval`. Native protected-effect +coverage remains **0 of 11 serving CLI call sites across 10 handlers**, not one +PEP per catalog row. The current lifecycle policy's action vocabulary has twelve +values; that is a separate count from handler/call-site coverage. + +| CLI path | Handler / delegated authorization site | PDP action | +| --- | --- | --- | +| apply, live only | `cmd_apply` | apply | +| provision | `cmd_provision` | provision | +| rotate, live only | `cmd_rotate` | rotate | +| verify | `cmd_verify` | verify | +| handoff | `cmd_handoff` | handoff | +| wrap | `cmd_wrap` | wrap | +| exec primary | `cmd_exec`, primary gate | exec | +| exec companion | `cmd_exec`, delegated companion gate | exec for each companion; separate claim/CAS, same call site | +| revoke, live only | `cmd_revoke` | deactivate | +| lifecycle compromise/reactivate, live only | `_cmd_lifecycle_state` | selected compromise/reactivate; local state mutation | +| lifecycle suspend/deactivate/destroy, live only | `cmd_lifecycle` | selected operation | + +`session revoke` is a separate stance/readiness-controlled backend path without +this served Check/CAS chain; it is excluded from this signer acceptance and still +refuses production under its stance. `service-auth probe-openbao` is an explicit +identity/login-self probe, not protected task adoption. `route` performs existing +backend readiness metadata probes through its ambient backend resolver; it is not +closed by this signer proposal. Dry-run/plan/catalog/audit/source evidence commands +are not protected-effect proof. These exclusions must remain visible in any claim +about the whole repository's PEP coverage. + +The existing CLI handlers still use the generic `require_production_consume` +response contract. Strict R2 task consumption is a separate owner API, not a +retrofit of all eleven CLI sites. Native effect acceptance must review the actual +selected handler/consume contract and caller scope rather than borrow the task +fixture proof. + +No production effect is authorized merely because a handler shares the signed +client. In particular, configured `service-jwt` still refuses protected CLI work +before approval/CAS/backend because CCR38 is identity-only. Do not select +bootstrap/env, alter the stance or enable unsafe-demo to manufacture acceptance. + +## Owner-controlled placement and minimum configuration + +The deploying owner must select the runtime UID, fresh release prefix, configuration +parent and exact runtime paths; none is agreed by this proposal. The future +admitted executable is `/bin/secrets-engine`, whose wrapper fixes the +bundle helper and checks its digest before CLI import. The helper's source/binary +hash is artifact integrity, not independent package or key admission. Do not use +the editable checkout, a rolling alias, a synthetic test prefix or an internal +venv entrypoint as if it were that admission. + +Explicit absolute owner-admitted catalog, policy, `SECRETS_ENGINE_PEP_STANCE`, +trust and evidence/outbox locations are needed. Installed-package defaults fall +back to working-directory metadata and are not an admitted native configuration. +The total existing stance remains prod fail_closed. Config needs the exact +producer policy/version, service subject, loopback owner-bound PDP tunnel and +separately admitted bounded audience `flex-auth` caller-file lifetime. Approval +endpoint and its existing separately scoped credential delivery must be admitted +independently. Both approval credential providers may not be configured together. +The bundle helper is not selected by an ambient override. Runtime credentials and +keys are not placed in this proposal or release bundle. + +Acceptance order is: admit exact package/source/install/config; obtain independent +signer/key/pin custody return and exact signed producer rollout candidate; under +that separately reviewed rollout capture bounded native records; run Access's +single offline receipt verifier against the fixed installed helper and admitted +trust; prove forged/altered/unknown/unsigned/wrong-pin/expired refusal and exact +old/new-key overlap then removed-key refusal. Also close the producer's missing +native durable log/outbox/audit path under its owner. No install or rollout is +performed here, and shared-source tests do not fill native effect coverage. + +Rollback retains the reviewed signed producer and admitted overlap or stops the +consumer. Rolling back to an unsigned image is an outage, not permission to turn +off verification. Removing keys, changing policy pins or restoring removed keys +needs exact owner review; no discovery/cached-key fallback or blind consume retry. + +## Separate task-execution gap + +Strict `task_execution_handoff` exists and Platform's independently confirmed +journal/native fixture path has actual source-server proof. Neither creates an +existing `execute-ccr` CLI command: the current parser has none. Proposed task +caller mapping/request join, policy admission, production source/Plan/grant and +installation/journal/cleanup placement remain separate owner decisions. Both +Access task-policy runtime false gates remain unchanged; lifecycle apply is not +a substitute for execute-ccr. Platform has selected no fresh approved real +CCR/catalogue/descriptor/grant. CCR42 is in_flight and lacks a matching Secrets +catalog; synthetic CCR2/issue-core fixture bytes and temporary paths are not native +inputs. Actual before/after bytes for the exact metadata targets and independent +readback/cleanup receipts must come from Platform's eventual owner-selected plan. + +For future server-owned Approval facts, strict R2 deliberately requires the +returned binding context to equal the originally submitted context. B1 caller +join remains signed-DENY and must preserve that context. Replacing the carried +claim with a freshly observed blob would refuse because its freshness fields +change; no generic equality relaxation is proposed. Access's current review +preference is to validate fresh authoritative facts out of band while retaining +the submitted context, with reviewed producer-owned signed source/receipt evidence. +Exact stable fact/freshness and provenance correspondence requires Approval and +Access review before B2/B3; no new fields or behavior are implemented here. + +The Approval owner's pending `approval-fact-contract/consumer-contract.md` and +`golden-vectors.json` in the Custodian target evidence name this correspondence. +They require both original/fresh windows and exact nonfreshness authority facts. +Their Python native numeric canonical vectors still need producer conformance; +no silent digest translation or new target numeric restriction is admitted. +The proposal pins those owner artifacts for review, not as B2 implementation. diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/preimages/docs/proposals/native-cli-admission/proposal.json b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/preimages/docs/proposals/native-cli-admission/proposal.json new file mode 100644 index 00000000..d5c50c22 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/preimages/docs/proposals/native-cli-admission/proposal.json @@ -0,0 +1,133 @@ +{ + "proposal_id": "SECRETS-WP-0014-native-cli-20261016", + "status": "preparation only; not installable or executable authorization", + "source_base": "ff1a13dabd44ba02ddd6bc26ad75568f6d2e6225", + "workplans": [ + "SECRETS-WP-0014-T02", + "SECRETS-WP-0014-T03", + "SECRETS-WP-0013-T01", + "SECRETS-WP-0013-T03" + ], + "initial_scope": { + "producer": "existing flex-auth/flex-auth-secrets-engine lifecycle pin", + "consumer": "existing Secrets CLI serving authorization workflow, prospective reviewed release-bundle entrypoint only", + "stage1": "independent signer/package/trust admission and offline captured native allow+deny verification; zero protected effects", + "native_effects_admitted": 0, + "task_execution_enabled": false + }, + "owner_returns": { + "access": "Custodian docs/changes/netkingdom-target-2026-10-16/access-native-preparation/native-admission-proposal-r1.json and source-policy-pins.json", + "platform": "No selected actual approved CCR/catalog/Plan/descriptor/grant/install placement; CCR-2026-0042 remains in_flight without matching catalog. Disposable source proofs are not production inputs." + }, + "producer_pin": { + "evaluator": "flex-auth/local", + "mode": "standalone", + "policy_package": "secrets-engine.catalog-lane.lifecycle", + "policy_version": "v2", + "policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4" + }, + "independent_admission": { + "production_kid": null, + "public_key": null, + "public_key_sha256": null, + "custody_receipt": null, + "candidate_producer_oci_digest": null, + "rule": "No responder keys endpoint, synthetic fixture key or deployment metadata substitutes for independent owner admission", + "receipt_verifier_integrated_revision": null, + "signer_purpose_pin_and_sharing_receipt": null + }, + "placement": { + "owner": "Secrets consumer/deploying owner; exact runtime UID and paths not yet agreed", + "cli_release_prefix": null, + "cli_entrypoint": "/bin/secrets-engine", + "fixed_verifier": "/libexec/secrets-engine-pdp-verify", + "config_parent": null, + "trust_file": null, + "catalog_directory": null, + "policy_directory": null, + "pep_stance_file": null, + "evidence_directory": null, + "constraints": [ + "new owner-controlled immutable release prefix; no overwrite or rolling source alias", + "absolute independently reviewed config/catalog/policy/stance/trust paths; no working-directory defaults for native use", + "trust regular non-symlink, not group/world writable; key admission not file-presence inference", + "owner retains manifest/admission/installation receipts and same-UID control boundary" + ] + }, + "configuration_contract": { + "SECRETS_ENGINE_PDP_URL": "literal loopback bare origin bound to independently verified cluster and named producer pod; exact native port awaiting owner placement", + "SECRETS_ENGINE_PDP_TOKEN_FILE": "admitted bounded Secrets ServiceAccount caller file outside Git; no mint/read here", + "SECRETS_ENGINE_PDP_TRUST_FILE": "absolute independently admitted lifecycle trust path; empty-key template deliberately refuses", + "SECRETS_ENGINE_PDP_VERIFIER": "bundle wrapper fixes installed helper; no ambient override or source-checkout helper", + "SECRETS_ENGINE_AUTHORIZATION_SUBJECT_ID": "secrets-engine", + "SECRETS_ENGINE_AUTHORIZATION_SUBJECT_TYPE": "service", + "SECRETS_ENGINE_AUTHORIZATION_POLICY_PACKAGE": "secrets-engine.catalog-lane.lifecycle", + "SECRETS_ENGINE_AUTHORIZATION_POLICY_VERSION": "v2", + "SECRETS_ENGINE_APPROVAL_URL": "independently admitted Approval endpoint/owner-bound tunnel; not yet supplied for this session", + "SECRETS_ENGINE_APPROVAL_CLIENT_SECRET_FILE": "separately admitted attended provider lifetime from existing custody contract; no read here", + "SECRETS_ENGINE_APPROVAL_TOKEN_FILE": "unset when client-secret provider selected; no simultaneous providers", + "SECRETS_ENGINE_CATALOG": "absolute owner-admitted metadata directory; initial actual lane unselected", + "SECRETS_ENGINE_POLICIES": "absolute owner-admitted metadata/policy directory", + "SECRETS_ENGINE_PEP_STANCE": "absolute hash-pinned existing total stance map; prod remains fail_closed", + "SECRETS_ENGINE_EVIDENCE": "absolute owner-private evidence/outbox path with declared custody/delivery", + "SECRETS_ENGINE_UNSAFE_DEMO": "unset; no native exception", + "backend_provider": "no new selection/entitlement; configured service-jwt protected handlers remain blocked; do not switch to bootstrap/env as workaround" + }, + "rotation": { + "admit": "owner reviews independent new kid/public key/custody receipt and bounded overlap, preserving exact issuer/policy artifact pin", + "roll": "separate exact producer candidate digest/seed projection rollout with native signed receipts; never fetch discovery keys", + "remove": "after new-key native receipt/consumer acceptance, remove old kid and prove old-key refusal", + "rollback": "retain reviewed signed producer/key overlap or stop/refuse. An unsigned old deployment is an outage; never disable consumer verification, restore removed key without review, relax pin, widen backend grants or blind retry consumed operation" + }, + "task_mapping_gap": { + "existing_cli_execute_ccr_command": false, + "source_handoff": "secrets_engine.task_execution_handoff authorize_task_execution/consume_task_execution", + "platform_source_mediator": "railiance-platform/scripts/task_execution_mediator.py run_native_fixture_task; source proof only", + "unadmitted_inputs": [ + "real service caller-to-subject server mapping and request/service binding join", + "actual task policy candidate and independently reviewed source/runtime admission; both false gates unchanged", + "owner-selected fresh approved CCR/catalog/execution-grant, compiled Plan/whole descriptor and operation UUID", + "independent expected-before/after bytes for exact two metadata targets and actual estate/backend origin", + "actual source/Plan/install/journal/cleanup placement and trusted provider endpoints/credentials/custody", + "load-bearing audit/outbox cadence and durable receipt correlation", + "Approval/Access reviewed out-of-band fresh-fact versus original carried-claim correspondence and signed provenance; strict context equality remains unchanged" + ], + "approval_fact_interface_review": { + "status": "review preference only; no implementation/admission", + "preserve": "strict binding.context equality and original submitted/approval-free/native joins", + "direction": "Access prefers out-of-band server-fetched authoritative fact checking while retaining original carried context, then reviewed producer-owned signed provenance/audit evidence", + "required_review": [ + "Approval fact/freshness semantic correspondence", + "Access source receipt/provenance binding and exact request digests" + ], + "b1": "signed-DENY caller join only; no context replacement", + "b2_b3": "not enabled or implemented here" + }, + "approval_fact_contract": { + "artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-fact-contract/consumer-contract.md", + "sha256": "3dfb7987a4d9fe461b917cfa5bae7beef61bc4d9a4561fdded3e90128f5966de", + "vectors_artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-fact-contract/golden-vectors.json", + "vectors_sha256": "dfb0a8810cd91847d7af6a7af6a51607a67a66fad7b86fc57365308c36bd9323", + "status": "owner source contract pending integration; no Go conformance or B2 behavior admitted", + "required": "preserve original fact/context/freshness, independently validate fresh fact window and exact nonfreshness authority; do not translate native numeric digests or invent target restrictions" + } + }, + "approval_state": "no owner assent, key admission, install, caller token, operation grant or live change requested/executed by this preparation", + "denominator": { + "shared_check_implementation": 1, + "serving_cli_call_sites": 11, + "serving_cli_handlers": 10, + "lifecycle_pdp_action_values": 12, + "native_effect_call_sites_accepted": 0, + "excluded": [ + "session revoke stance-only backend path", + "service-auth explicit identity probes", + "route ambient-backend readiness probes", + "dry-run/non-effect reporting" + ], + "task_cli_command_count": 0, + "platform_source_mediator_native_acceptance": false, + "generic_cli_consume_is_strict_task_handoff": false, + "effect_acceptance_required": "Review actual selected handler/generic consume response and caller scope separately; strict Platform fixture proof does not close existing CLI effects" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/preimages/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/preimages/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md new file mode 100644 index 00000000..f65ac963 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/preimages/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md @@ -0,0 +1,177 @@ +--- +id: SECRETS-WP-0014 +type: workplan +title: "Constrain PDP transport and authenticate decision responses" +domain: infotech +repo: secrets-engine +status: active +owner: codex +topic_slug: secrets-engine +created: "2026-10-12" +updated: "2026-10-16" +flavor: implementation +depends_on: [] +state_hub_workstream_id: "7252469d-d7a5-5c18-8911-b511b8c6a736" +--- + +Native owner work for CUST-WP-0080 G13. Reuses the accepted Check contract and +FLEX-WP-0024 producer signature surface; does not create another PDP or grant +any catalog-lane execution authority. SECRETS-WP-0013 still owns task-scoped +protected execution. Transport review is complete; key admission and native +rollout remain separate gates below. + +## Prevent the Check credential from leaving the admitted local transport + +```task +id: SECRETS-WP-0014-T01 +status: done +priority: high +state_hub_task_id: "8baba9a3-3513-5f02-bafe-ed9dce743173" +``` + +Reproduced redirects (301/302/303), environment proxy forwarding, malformed URL +handling, oversized-body truncation and invalid UTF-8 against the prior source. +The bounded fix disables redirects and ambient proxies/global openers, requires +a literal loopback bare origin before credential access, caps the complete +response body and rejects invalid UTF-8 as a DecisionError. The approval consumer +no longer overrides this safe default with urlopen. Synthetic local-server tests +cover both entry points, all five redirect status codes and proxy forwarding. +No real credentials or protected backend were touched. Source verification is +recorded in the Custodian evidence directory for 2026-10-12, pdp-transport.json. +This closes the source transport defects only; T02/T03 remain mandatory. + +## Implement independently anchored responder authentication + +```task +id: SECRETS-WP-0014-T02 +status: progress +priority: high +state_hub_task_id: "877782e5-045b-5186-8b95-82e25db21a5a" +``` + +Review producer canonical signature bytes and the native pin's unsigned/signed +mode. Establish independently admitted verification keys and exact issuer/pin +binding with AccessEngine and Platform; an unauthenticated keys endpoint on the +same responder is not a trust anchor. Reuse the native producer fixtures rather +than inventing a Python canonicalization. Require valid signed envelopes on the +production consumer path; prove forged allow, altered payload, unknown key, +wrong issuer/pin, unsigned/downgrade, expired and rotation overlap/refusal cases. +Track any temporary exception using all required SEC-DSM-EXC fields and actual +approval; neither source support nor a loopback URL is that approval. + +2026-10-16 source preparation: production `authorize_action` now requires an +independently admitted local trust file and installed verifier before approval/PDP +credential reads. The Go helper vendors exact producer API/signature sources, +checks source hashes, authenticates the original response and returns only its +verified typed interpretation. Signed evaluator/mode and exact package/version/ +artifact digest are bound to admitted public keys. Unknown/unsigned/altered +responses refuse; existing request/approval/lifetime/CAS checks remain required. +Native replay, real producer signing and consumer-boundary tests cover downgrade, +issuer/pin, request joins, and distinct-key overlap/removal. Build/install and +source update procedures are documented in `verifier/README.md`. + +This is an isolated source implementation awaiting integration/independent review. +No production verification keys, native pin signed-mode change, trust admission, +owner assent or rollout has occurred. T02 stays progress because independent +key admission remains part of its scope; T03 stays wait. WP13 execution and +identity-only CCR38 are unchanged. Custodian source/verification handoff: +`docs/changes/netkingdom-target-2026-10-16/decision-auth/` in the Custodian repo. + +2026-10-16 packaging preparation: `scripts/build_release_bundle.py` and its +separate offline installer deliver the existing wheel plus the reviewed producer +verifier together into a new owner-controlled prefix. Source/hash drift checks, +artifact/toolchain receipts and a narrow fixed-helper launcher remove the silent +wheel-only deployment gap. Disposable build/install tests prove deterministic +artifacts, signed HTTP consumption and missing/tampered artifact refusal; they do +not admit packages, keys or a production prefix. T02 remains progress and T03 +wait; no native installation, trust change or protected entitlement is claimed. + +## Verify the admitted native consumer and rotation path + +```task +id: SECRETS-WP-0014-T03 +status: wait +priority: high +depends_on: [SECRETS-WP-0014-T02] +blocking_reason: "Requires reviewed verification-key admission, source enforcement and exact native rollout receipt; no production trust change is proposed yet." +state_hub_task_id: "85aa4c78-b66d-5201-8e31-0ed50e7eaeec" +``` + +Under an exact reviewed rollout, prove the real pin and consumer accept the +admitted signer, reject forgery/downgrade, rotate without accepting removed keys, +and preserve request/approval binding, lifetime and single-use consumption. +Retain rollback and failure evidence. Update CUST-WP-0080 G13 only with these +native receipts; do not equate passing transport tests with closure. + + +2026-10-16 native preparation (no rollout): `docs/proposals/native-cli-admission/` +now scopes the existing CLI/lifecycle signer stage, exact delegated PEP denominator, +independent key/policy admission, owner-controlled bundle/config placement and +rotation/rollback refusal. Canonical ff1a13d (packaging plus strict handoff) was +rebuilt in an isolated clean checkout; artifact receipts are in Custodian +`decision-native-preparation/`. Production kid/public fingerprint/custody receipt, +producer candidate OCI and actual runtime/config placement remain missing. The +empty-key trust template deliberately refuses. No install, key read, caller mint, +protected effect, policy switch or trust admission occurred. T02 remains progress, +T03 wait; task source/live obligations remain separately in SECRETS-WP-0013. + +2026-10-16 trusted successor source preparation: refreshed exact API/sign source +from frozen Access B2/B3 R1 proposal (patch SHA-256 +6079ed2ff40b131aa2c5efc8d33608ecb3475c8158f0486b44ec4469e9f222c1). +Producer DecodeEnvelope preserves signed numeric lexemes; strict CAS retains and +reauthenticates original producer JSON. Existing request/claim/native/caller joins +remain mandatory; signed source observation additionally binds the native digest +and caps decision lifetime. Fourteen Approval owner vectors, legacy signatures, +tamper/unknown provenance and source deadline refusals are locally checked. +Actual ApprovalApp-to-Access v2 signed response verifies with the consumer helper; +actual source revocation refuses. Actual builder-to-v2 strict positive execution +is separately blocked on missing owner-reviewed service_actor_binding mapping; +no caller context injection or equality relaxation hides that gap. +Artifacts: Custodian `decision-trusted-successor/`. T02 remains progress, T03 +wait; no package/key/policy/native admission or runtime installation occurred. + +2026-10-16 successor R2 source preparation resolves the preceding builder gap: +only typed prod/platform execute-ccr with exact secrets-engine service subject +emits Access's fixed five-field public service_actor_binding before approval +issue. Subject/resource platform tenants are explicit before issue, matching the +producer's existing normalization and native act; lifecycle requests are unchanged. +Original carried context is still immutable. Actual builder -> Approval App -> +Access v2 signed ALLOW -> strict preparation/CAS -> independent Approval confirmation +GET passes with synthetic scoped identities/trust. Missing declaration, descriptor/ +native changes, stale original claim, signature tamper and replay refuse. The +operation deadline is explicit whole seconds within v2's 15-second allow TTL; +no deadline is extended or waived. This resolves source correspondence only; +T02 remains progress/T03 wait, with no native trust/grant/policy admission. + +2026-10-16 temporal successor source proof: Access B2/B3 R2 replaces its earlier +15s lifetime with the exact immutable operation deadline, bounded by its 120s +hard cap, original/fresh source and caller bounds, and post-I/O backend TTL+5s +fit. Verifier API/sign bytes are unchanged; source provenance records R2. Secrets +runtime and strict entire-operation deadline checks are unchanged. Contract prose +now states the actual fixed backend TTL and conservative fit rather than dynamic +TTL recomputation, and permits native token expiry earlier than operation deadline. +The actual source proof uses explicit synthetic Approval freshness120/backendTTL30/ +operationdeadline60, without a consumer timing waiver or native admission. + +Temporal proof precision observation: Approval consumption receipts use whole +seconds while Access R2 not_before preserves subsecond precision. Fast CAS can +therefore refuse receipt-before-start even though live calls are correctly +ordered. The positive proof explicitly waits real time until the next whole +second before CAS, without injected clocks or relaxed checks. Fast-CAS failure +is retained for owner resolution; no Secrets runtime change conceals the seam. + +2026-10-16 retained-registry successor source preparation adds only the existing +signed Check/DENY preapproval flow. The original typed service proposal is sent +unchanged; normalized native act and evaluated approval-free digest from the +admitted producer record are used for normal Approval issuance. The original +proposal then receives only the original issued claim. Final Check re-normalizes +against retained owner registry/source facts, so authoritative drift refuses +before CAS. No local registry algorithm, new endpoint, empty-registry workaround +or consumer digest waiver is used. Signed DENY preparation has no independent +permission/freshness window and cannot consume or execute; current caller and +operation bounds are checked, and final signed ALLOW/source checks remain +mandatory. Exact original JSON kinds and requested-target subsets refuse +bool/int/float substitution while allowing extra authoritative registry facts. +Actual provider proof preparation is separately waiting on frozen Access source +and Approval's timestamp/transaction-clock repair; source native/trust/custody and +actual task admission remain open. T02 remains progress and T03 wait; no native adoption is claimed. diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/coordinator-bundle-review.json b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/coordinator-bundle-review.json new file mode 100644 index 00000000..c3cfc68c --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/coordinator-bundle-review.json @@ -0,0 +1,18 @@ +{ + "source_commit": "4dd004a2250104ba56293b2d7b0d96f4e076ea99", + "bundle_manifest_sha256": "sha256:105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e", + "independent_checks": { + "artifacts": 7, + "source_files": 53, + "producer_files": 5, + "two_existing_builds_byte_equal": true, + "fresh_disposable_install": true, + "installed_cli_help": true, + "installed_import_own_venv": true, + "missing_trust_refuses_before_caller_and_network": true + }, + "retained_failure": "Initial installation sandbox denied uv cache; incomplete prefix retained. Approved retry used fresh r2 prefix and passed.", + "prefix": "/tmp/netkingdom-root-secrets-native-4dd004a-r2", + "native_install": false, + "native_effects_accepted": 0 +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/r2-preimages/docs/proposals/native-cli-admission/README.md b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/r2-preimages/docs/proposals/native-cli-admission/README.md new file mode 100644 index 00000000..08a7e747 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/r2-preimages/docs/proposals/native-cli-admission/README.md @@ -0,0 +1,205 @@ +# Native CLI signer and consumer admission preparation + +## Current release preparation — 2026-10-16 R2 + +Published canonical Secrets `4dd004a2250104ba56293b2d7b0d96f4e076ea99` was +built twice from an isolated clean checkout. Artifacts and deterministic bundle +manifest match exactly: manifest SHA256 +`105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e`, +fixed helper SHA256 +`ed922b62533e4d33ae2d5f11175111f6f28e684a19e63ac704d43b63f0e0e12e`. +Disposable installation/help and empty native trust refusal pass; no native +prefix, trust/key, caller credential, protected effect or rollout was admitted. +Artifact integrity is not independent package admission. Full receipts and a +concrete probe/placement proposal are in Custodian `decision-native-preparation/r2/`. + +Initial native scope remains the existing lifecycle pin and **0/11 protected +sites across10 handlers**. Runtime UID/release/config/catalog/stance/trust/evidence +and scoped caller/Approval delivery paths remain owner-unselected. A concrete +workstation candidate uses a new release prefix ending +`4dd004a22501-105dcebe6f03`; it is a proposal, not an installed/admitted path. +Only its exact future `bin/secrets-engine` wrapper is the effect entrypoint. +The current repo editable invocation and ambient demo/preflight fallbacks do not +constitute release admission. A local CLI does not automatically hold the named +ServiceAccount identity: existing docs describe separately authorized per-session +TokenRequest delivery, not a standing credential or pod identity grant. + +Access's single offline signer-receipt tool is published at +`2b064eee510640224274ccdc7cefceb1ae13162e`; verified API/sign source matches this +consumer. Native producer rollout still awaits independent public kid/key/custody +and immutable candidate image/log/storage returns, including the Access owner's +separate durable-log hardening review. Published source alone is not that image. +The lifecycle pin stays v2/bd11c5fe...; task v2 is a separate unadmitted pin. + +Source task correspondence is now implemented and cross-owner source-server +proved: fixed typed service mapping before issue, retained-registry signed-DENY +preapproval, original claim/context preservation, independent fresh source facts, +precise Approval CAS and independent confirmation/journal/native disposable proof. +This supersedes the historical source gaps below; it neither adds an execute-ccr +CLI command nor selects a real CCR/catalogue/Plan/grant/backend/journal runtime. +All native effect, caller/key/config and task-entitlement gates remain open under +existing WP14/WP13/WP8 records. `service-jwt` still refuses protected CLI work. + +## Historical ff1a13d preparation (preserved) + +The following draft records the earlier source/admission observations. References +to absent B2/B3/request/source-fact implementation are superseded by R2 above; +missing native keys, runtime placement and actual task inputs remain unresolved. + + +This proposal covers the existing lifecycle CLI authentication path under +SECRETS-WP-0014. It grants no installation, key retrieval, caller mint, approval +consume, OpenBao effect or task-policy activation. All native acceptance counts +below are zero. Exact missing owner inputs are in `proposal.json`. + +## Current consumer and initial scope + +At source `ff1a13d`, the workstation has the repository's editable v0.1.0 CLI +entrypoint at `/home/worsch/secrets-engine/.venv/bin/secrets-engine`, importing +`secrets_engine.cli:main`. There is no global `~/.local/bin/secrets-engine` or uv +managed Secrets tool. Presence-only inspection of this session found none of the +PDP/trust/approval/policy/configuration variables set. This says nothing about +other sessions, private owner configuration or a remote installation. No credential +file, private configuration or process environment was inspected. + +Use a separately reviewed immutable wheel-plus-verifier bundle for proposed +adoption. The canonical source for the candidate build is **ff1a13d**, containing +both CLI packaging and strict R2 handoff; earlier c80-based proof bundles are +intermediate source evidence. Custodian `decision-native-preparation/` retains the +exact canonical bundle manifest and hashes. Nothing was installed by this step. + +Initial stage is signer-only existing lifecycle-pin admission plus offline +verification of captured native signed allow and deny records. Capturing those +records later needs its own admitted caller and exact source operation; this +proposal does not grant that capture. Use Access's one receipt verifier, +`tools/verify_native_signer_receipt.py`, with its reviewed admission file rather +than creating another consumer verifier or canonicalization implementation. +That tool is separate Access source preparation; its exact integrated revision +and reviewed admission file remain owner inputs, not part of this CLI install. + +The producer-owned offline pin is `secrets-engine.catalog-lane.lifecycle` v2, +`sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4`, +evaluator `flex-auth/local`, mode `standalone`. A source digest is not proof of the +live image's source or policy. Access's live metadata records the current pin has +no signer arguments/mounts; no production kid/public key/fingerprint/custody +receipt or candidate signed-runtime OCI digest is admitted. The proposed signer +custody route is draft/nonresolvable. Do not fill those gaps from fixture keys or +from the same responder's keys endpoint. The independent receipt must bind signer +purpose/custody to this exact consumer pin and declare any sharing. A shared key +plus the generic evaluator name cannot prove an individual pod's identity; the +owner-bound tunnel and rollout identity still require separate verification. + +`lifecycle-trust.template.json` uses the existing runtime trust schema and the +producer-owned source pin, but deliberately has an empty key map. It **must +refuse** before caller credential access. It is not a deployable trust file. A +future owner-admitted copy must contain the independently authenticated actual +kid/key and exact pin, with its public-key fingerprint/custody provenance retained +outside this unadmitted template. The task-policy coordinate is not admitted here. + +## Exact PEP denominator + +The initial shared authentication implementation is one Check client reached +through `authorize_action` and `_require_lane_approval`. Native protected-effect +coverage remains **0 of 11 serving CLI call sites across 10 handlers**, not one +PEP per catalog row. The current lifecycle policy's action vocabulary has twelve +values; that is a separate count from handler/call-site coverage. + +| CLI path | Handler / delegated authorization site | PDP action | +| --- | --- | --- | +| apply, live only | `cmd_apply` | apply | +| provision | `cmd_provision` | provision | +| rotate, live only | `cmd_rotate` | rotate | +| verify | `cmd_verify` | verify | +| handoff | `cmd_handoff` | handoff | +| wrap | `cmd_wrap` | wrap | +| exec primary | `cmd_exec`, primary gate | exec | +| exec companion | `cmd_exec`, delegated companion gate | exec for each companion; separate claim/CAS, same call site | +| revoke, live only | `cmd_revoke` | deactivate | +| lifecycle compromise/reactivate, live only | `_cmd_lifecycle_state` | selected compromise/reactivate; local state mutation | +| lifecycle suspend/deactivate/destroy, live only | `cmd_lifecycle` | selected operation | + +`session revoke` is a separate stance/readiness-controlled backend path without +this served Check/CAS chain; it is excluded from this signer acceptance and still +refuses production under its stance. `service-auth probe-openbao` is an explicit +identity/login-self probe, not protected task adoption. `route` performs existing +backend readiness metadata probes through its ambient backend resolver; it is not +closed by this signer proposal. Dry-run/plan/catalog/audit/source evidence commands +are not protected-effect proof. These exclusions must remain visible in any claim +about the whole repository's PEP coverage. + +The existing CLI handlers still use the generic `require_production_consume` +response contract. Strict R2 task consumption is a separate owner API, not a +retrofit of all eleven CLI sites. Native effect acceptance must review the actual +selected handler/consume contract and caller scope rather than borrow the task +fixture proof. + +No production effect is authorized merely because a handler shares the signed +client. In particular, configured `service-jwt` still refuses protected CLI work +before approval/CAS/backend because CCR38 is identity-only. Do not select +bootstrap/env, alter the stance or enable unsafe-demo to manufacture acceptance. + +## Owner-controlled placement and minimum configuration + +The deploying owner must select the runtime UID, fresh release prefix, configuration +parent and exact runtime paths; none is agreed by this proposal. The future +admitted executable is `/bin/secrets-engine`, whose wrapper fixes the +bundle helper and checks its digest before CLI import. The helper's source/binary +hash is artifact integrity, not independent package or key admission. Do not use +the editable checkout, a rolling alias, a synthetic test prefix or an internal +venv entrypoint as if it were that admission. + +Explicit absolute owner-admitted catalog, policy, `SECRETS_ENGINE_PEP_STANCE`, +trust and evidence/outbox locations are needed. Installed-package defaults fall +back to working-directory metadata and are not an admitted native configuration. +The total existing stance remains prod fail_closed. Config needs the exact +producer policy/version, service subject, loopback owner-bound PDP tunnel and +separately admitted bounded audience `flex-auth` caller-file lifetime. Approval +endpoint and its existing separately scoped credential delivery must be admitted +independently. Both approval credential providers may not be configured together. +The bundle helper is not selected by an ambient override. Runtime credentials and +keys are not placed in this proposal or release bundle. + +Acceptance order is: admit exact package/source/install/config; obtain independent +signer/key/pin custody return and exact signed producer rollout candidate; under +that separately reviewed rollout capture bounded native records; run Access's +single offline receipt verifier against the fixed installed helper and admitted +trust; prove forged/altered/unknown/unsigned/wrong-pin/expired refusal and exact +old/new-key overlap then removed-key refusal. Also close the producer's missing +native durable log/outbox/audit path under its owner. No install or rollout is +performed here, and shared-source tests do not fill native effect coverage. + +Rollback retains the reviewed signed producer and admitted overlap or stops the +consumer. Rolling back to an unsigned image is an outage, not permission to turn +off verification. Removing keys, changing policy pins or restoring removed keys +needs exact owner review; no discovery/cached-key fallback or blind consume retry. + +## Separate task-execution gap + +Strict `task_execution_handoff` exists and Platform's independently confirmed +journal/native fixture path has actual source-server proof. Neither creates an +existing `execute-ccr` CLI command: the current parser has none. Proposed task +caller mapping/request join, policy admission, production source/Plan/grant and +installation/journal/cleanup placement remain separate owner decisions. Both +Access task-policy runtime false gates remain unchanged; lifecycle apply is not +a substitute for execute-ccr. Platform has selected no fresh approved real +CCR/catalogue/descriptor/grant. CCR42 is in_flight and lacks a matching Secrets +catalog; synthetic CCR2/issue-core fixture bytes and temporary paths are not native +inputs. Actual before/after bytes for the exact metadata targets and independent +readback/cleanup receipts must come from Platform's eventual owner-selected plan. + +For future server-owned Approval facts, strict R2 deliberately requires the +returned binding context to equal the originally submitted context. B1 caller +join remains signed-DENY and must preserve that context. Replacing the carried +claim with a freshly observed blob would refuse because its freshness fields +change; no generic equality relaxation is proposed. Access's current review +preference is to validate fresh authoritative facts out of band while retaining +the submitted context, with reviewed producer-owned signed source/receipt evidence. +Exact stable fact/freshness and provenance correspondence requires Approval and +Access review before B2/B3; no new fields or behavior are implemented here. + +The Approval owner's pending `approval-fact-contract/consumer-contract.md` and +`golden-vectors.json` in the Custodian target evidence name this correspondence. +They require both original/fresh windows and exact nonfreshness authority facts. +Their Python native numeric canonical vectors still need producer conformance; +no silent digest translation or new target numeric restriction is admitted. +The proposal pins those owner artifacts for review, not as B2 implementation. diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/r2-preimages/docs/proposals/native-cli-admission/proposal.json b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/r2-preimages/docs/proposals/native-cli-admission/proposal.json new file mode 100644 index 00000000..d953ada0 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/r2-preimages/docs/proposals/native-cli-admission/proposal.json @@ -0,0 +1,141 @@ +{ + "proposal_id": "SECRETS-WP-0014-native-cli-20261016", + "status": "preparation only; not installable or executable authorization", + "source_base": "4dd004a2250104ba56293b2d7b0d96f4e076ea99", + "workplans": [ + "SECRETS-WP-0014-T02", + "SECRETS-WP-0014-T03", + "SECRETS-WP-0013-T01", + "SECRETS-WP-0013-T03" + ], + "initial_scope": { + "producer": "existing flex-auth/flex-auth-secrets-engine lifecycle pin", + "consumer": "existing Secrets CLI serving authorization workflow, prospective reviewed release-bundle entrypoint only", + "stage1": "independent signer/package/trust admission and offline captured native allow+deny verification; zero protected effects", + "native_effects_admitted": 0, + "task_execution_enabled": false + }, + "owner_returns": { + "access": "Custodian docs/changes/netkingdom-target-2026-10-16/access-native-preparation/native-admission-proposal-r1.json and source-policy-pins.json", + "platform": "No selected actual approved CCR/catalog/Plan/descriptor/grant/install placement; CCR-2026-0042 remains in_flight without matching catalog. Disposable source proofs are not production inputs." + }, + "producer_pin": { + "evaluator": "flex-auth/local", + "mode": "standalone", + "policy_package": "secrets-engine.catalog-lane.lifecycle", + "policy_version": "v2", + "policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4" + }, + "independent_admission": { + "production_kid": null, + "public_key": null, + "public_key_sha256": null, + "custody_receipt": null, + "candidate_producer_oci_digest": null, + "rule": "No responder keys endpoint, synthetic fixture key or deployment metadata substitutes for independent owner admission", + "receipt_verifier_integrated_revision": "2b064eee510640224274ccdc7cefceb1ae13162e", + "signer_purpose_pin_and_sharing_receipt": null, + "public_fingerprint_convention": "Platform proposal: sha256(canonical unpadded base64url43 public-key ASCII); independent owner receipt required", + "candidate_producer_prerequisite": "Access durable-log hardening source and immutable image/storage/custody awaiting separate root/Platform review; published2b064ee alone is not native candidate admission" + }, + "placement": { + "owner": "Secrets consumer/deploying owner; exact runtime UID and paths not yet agreed", + "cli_release_prefix": null, + "cli_entrypoint": "/bin/secrets-engine", + "fixed_verifier": "/libexec/secrets-engine-pdp-verify", + "config_parent": null, + "trust_file": null, + "catalog_directory": null, + "policy_directory": null, + "pep_stance_file": null, + "evidence_directory": null, + "constraints": [ + "new owner-controlled immutable release prefix; no overwrite or rolling source alias", + "absolute independently reviewed config/catalog/policy/stance/trust paths; no working-directory defaults for native use", + "trust regular non-symlink, not group/world writable; key admission not file-presence inference", + "owner retains manifest/admission/installation receipts and same-UID control boundary" + ], + "candidate_cli_release_prefix": "/home/worsch/.local/share/secrets-engine/releases/4dd004a22501-105dcebe6f03", + "candidate_status": "proposal only; no path selected/created/admitted" + }, + "configuration_contract": { + "SECRETS_ENGINE_PDP_URL": "literal loopback bare origin bound to independently verified cluster and named producer pod; exact native port awaiting owner placement", + "SECRETS_ENGINE_PDP_TOKEN_FILE": "admitted bounded Secrets ServiceAccount caller file outside Git; no mint/read here", + "SECRETS_ENGINE_PDP_TRUST_FILE": "absolute independently admitted lifecycle trust path; empty-key template deliberately refuses", + "SECRETS_ENGINE_PDP_VERIFIER": "bundle wrapper fixes installed helper; no ambient override or source-checkout helper", + "SECRETS_ENGINE_AUTHORIZATION_SUBJECT_ID": "secrets-engine", + "SECRETS_ENGINE_AUTHORIZATION_SUBJECT_TYPE": "service", + "SECRETS_ENGINE_AUTHORIZATION_POLICY_PACKAGE": "secrets-engine.catalog-lane.lifecycle", + "SECRETS_ENGINE_AUTHORIZATION_POLICY_VERSION": "v2", + "SECRETS_ENGINE_APPROVAL_URL": "independently admitted Approval endpoint/owner-bound tunnel; not yet supplied for this session", + "SECRETS_ENGINE_APPROVAL_CLIENT_SECRET_FILE": "separately admitted attended provider lifetime from existing custody contract; no read here", + "SECRETS_ENGINE_APPROVAL_TOKEN_FILE": "unset when client-secret provider selected; no simultaneous providers", + "SECRETS_ENGINE_CATALOG": "absolute owner-admitted metadata directory; initial actual lane unselected", + "SECRETS_ENGINE_POLICIES": "absolute owner-admitted metadata/policy directory", + "SECRETS_ENGINE_PEP_STANCE": "absolute hash-pinned existing total stance map; prod remains fail_closed", + "SECRETS_ENGINE_EVIDENCE": "absolute owner-private evidence/outbox path with declared custody/delivery", + "SECRETS_ENGINE_UNSAFE_DEMO": "unset; no native exception", + "backend_provider": "no new selection/entitlement; configured service-jwt protected handlers remain blocked; do not switch to bootstrap/env as workaround" + }, + "rotation": { + "admit": "owner reviews independent new kid/public key/custody receipt and bounded overlap, preserving exact issuer/policy artifact pin", + "roll": "separate exact producer candidate digest/seed projection rollout with native signed receipts; never fetch discovery keys", + "remove": "after new-key native receipt/consumer acceptance, remove old kid and prove old-key refusal", + "rollback": "retain reviewed signed producer/key overlap or stop/refuse. An unsigned old deployment is an outage; never disable consumer verification, restore removed key without review, relax pin, widen backend grants or blind retry consumed operation" + }, + "task_mapping_gap": { + "existing_cli_execute_ccr_command": false, + "source_handoff": "secrets_engine.task_execution_handoff prepare_task_approval/authorize_task_execution/consume_task_execution", + "platform_source_mediator": "railiance-platform/scripts/task_execution_mediator.py run_native_fixture_task; source proof only", + "unadmitted_inputs": [ + "native admission of the existing exact service-caller-to-subject request mapping and immutable original-claim/source join", + "owner-selected fresh approved CCR/catalog/execution-grant, compiled Plan/whole descriptor and operation UUID", + "independent expected-before/after bytes for exact two metadata targets and actual estate/backend origin", + "actual source/Plan/install/journal/cleanup placement and trusted provider endpoints/credentials/custody", + "load-bearing audit/outbox cadence and durable receipt correlation", + "exact native task v2 policy/caller/source/config/placement/key/runtime admission; v1 hard DENY retained" + ], + "approval_fact_interface_review": { + "status": "implemented/source-proved; native source/config/identity/trust admission remains missing", + "preserve": "type-sensitive original context/native/request/descriptor correspondence; original and independently fresh fact deadlines; no numeric translation", + "receipt": "Custodian decision-trusted-successor/verification-final-r4.json" + }, + "approval_fact_contract": { + "artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-fact-contract/consumer-contract.md", + "sha256": "3dfb7987a4d9fe461b917cfa5bae7beef61bc4d9a4561fdded3e90128f5966de", + "vectors_artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-fact-contract/golden-vectors.json", + "vectors_sha256": "dfb0a8810cd91847d7af6a7af6a51607a67a66fad7b86fc57365308c36bd9323", + "status": "owner source contract pending integration; no Go conformance or B2 behavior admitted", + "required": "preserve original fact/context/freshness, independently validate fresh fact window and exact nonfreshness authority; do not translate native numeric digests or invent target restrictions" + }, + "source_status": "implemented and cross-owner source-server proved, including retained registry and precise CAS; no native adoption" + }, + "approval_state": "no owner assent, key admission, install, caller token, operation grant or live change requested/executed by this preparation", + "denominator": { + "shared_check_implementation": 1, + "serving_cli_call_sites": 11, + "serving_cli_handlers": 10, + "lifecycle_pdp_action_values": 12, + "native_effect_call_sites_accepted": 0, + "excluded": [ + "session revoke stance-only backend path", + "service-auth explicit identity probes", + "route ambient-backend readiness probes", + "dry-run/non-effect reporting" + ], + "task_cli_command_count": 0, + "platform_source_mediator_native_acceptance": false, + "generic_cli_consume_is_strict_task_handoff": false, + "effect_acceptance_required": "Review actual selected handler/generic consume response and caller scope separately; strict Platform fixture proof does not close existing CLI effects" + }, + "historical_source_base": "ff1a13dabd44ba02ddd6bc26ad75568f6d2e6225", + "release_candidate": { + "bundle_manifest_sha256": "105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e", + "helper_sha256": "ed922b62533e4d33ae2d5f11175111f6f28e684a19e63ac704d43b63f0e0e12e", + "two_clean_builds_equal": true, + "disposable_install_passed": true, + "native_install_admitted": false, + "artifact_integrity_is_not_package_admission": true, + "receipt": "Custodian decision-native-preparation/r2/canonical-build-install-receipt.json" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/r2-preimages/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/r2-preimages/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md new file mode 100644 index 00000000..08e3e01b --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/r2-preimages/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md @@ -0,0 +1,192 @@ +--- +id: SECRETS-WP-0014 +type: workplan +title: "Constrain PDP transport and authenticate decision responses" +domain: infotech +repo: secrets-engine +status: active +owner: codex +topic_slug: secrets-engine +created: "2026-10-12" +updated: "2026-10-16" +flavor: implementation +depends_on: [] +state_hub_workstream_id: "7252469d-d7a5-5c18-8911-b511b8c6a736" +--- + +Native owner work for CUST-WP-0080 G13. Reuses the accepted Check contract and +FLEX-WP-0024 producer signature surface; does not create another PDP or grant +any catalog-lane execution authority. SECRETS-WP-0013 still owns task-scoped +protected execution. Transport review is complete; key admission and native +rollout remain separate gates below. + +## Prevent the Check credential from leaving the admitted local transport + +```task +id: SECRETS-WP-0014-T01 +status: done +priority: high +state_hub_task_id: "8baba9a3-3513-5f02-bafe-ed9dce743173" +``` + +Reproduced redirects (301/302/303), environment proxy forwarding, malformed URL +handling, oversized-body truncation and invalid UTF-8 against the prior source. +The bounded fix disables redirects and ambient proxies/global openers, requires +a literal loopback bare origin before credential access, caps the complete +response body and rejects invalid UTF-8 as a DecisionError. The approval consumer +no longer overrides this safe default with urlopen. Synthetic local-server tests +cover both entry points, all five redirect status codes and proxy forwarding. +No real credentials or protected backend were touched. Source verification is +recorded in the Custodian evidence directory for 2026-10-12, pdp-transport.json. +This closes the source transport defects only; T02/T03 remain mandatory. + +## Implement independently anchored responder authentication + +```task +id: SECRETS-WP-0014-T02 +status: progress +priority: high +state_hub_task_id: "877782e5-045b-5186-8b95-82e25db21a5a" +``` + +Review producer canonical signature bytes and the native pin's unsigned/signed +mode. Establish independently admitted verification keys and exact issuer/pin +binding with AccessEngine and Platform; an unauthenticated keys endpoint on the +same responder is not a trust anchor. Reuse the native producer fixtures rather +than inventing a Python canonicalization. Require valid signed envelopes on the +production consumer path; prove forged allow, altered payload, unknown key, +wrong issuer/pin, unsigned/downgrade, expired and rotation overlap/refusal cases. +Track any temporary exception using all required SEC-DSM-EXC fields and actual +approval; neither source support nor a loopback URL is that approval. + +2026-10-16 source preparation: production `authorize_action` now requires an +independently admitted local trust file and installed verifier before approval/PDP +credential reads. The Go helper vendors exact producer API/signature sources, +checks source hashes, authenticates the original response and returns only its +verified typed interpretation. Signed evaluator/mode and exact package/version/ +artifact digest are bound to admitted public keys. Unknown/unsigned/altered +responses refuse; existing request/approval/lifetime/CAS checks remain required. +Native replay, real producer signing and consumer-boundary tests cover downgrade, +issuer/pin, request joins, and distinct-key overlap/removal. Build/install and +source update procedures are documented in `verifier/README.md`. + +This is an isolated source implementation awaiting integration/independent review. +No production verification keys, native pin signed-mode change, trust admission, +owner assent or rollout has occurred. T02 stays progress because independent +key admission remains part of its scope; T03 stays wait. WP13 execution and +identity-only CCR38 are unchanged. Custodian source/verification handoff: +`docs/changes/netkingdom-target-2026-10-16/decision-auth/` in the Custodian repo. + +2026-10-16 packaging preparation: `scripts/build_release_bundle.py` and its +separate offline installer deliver the existing wheel plus the reviewed producer +verifier together into a new owner-controlled prefix. Source/hash drift checks, +artifact/toolchain receipts and a narrow fixed-helper launcher remove the silent +wheel-only deployment gap. Disposable build/install tests prove deterministic +artifacts, signed HTTP consumption and missing/tampered artifact refusal; they do +not admit packages, keys or a production prefix. T02 remains progress and T03 +wait; no native installation, trust change or protected entitlement is claimed. + +## Verify the admitted native consumer and rotation path + +```task +id: SECRETS-WP-0014-T03 +status: wait +priority: high +depends_on: [SECRETS-WP-0014-T02] +blocking_reason: "Requires reviewed verification-key admission, source enforcement and exact native rollout receipt; no production trust change is proposed yet." +state_hub_task_id: "85aa4c78-b66d-5201-8e31-0ed50e7eaeec" +``` + +Under an exact reviewed rollout, prove the real pin and consumer accept the +admitted signer, reject forgery/downgrade, rotate without accepting removed keys, +and preserve request/approval binding, lifetime and single-use consumption. +Retain rollback and failure evidence. Update CUST-WP-0080 G13 only with these +native receipts; do not equate passing transport tests with closure. + + +2026-10-16 native preparation (no rollout): `docs/proposals/native-cli-admission/` +now scopes the existing CLI/lifecycle signer stage, exact delegated PEP denominator, +independent key/policy admission, owner-controlled bundle/config placement and +rotation/rollback refusal. Canonical ff1a13d (packaging plus strict handoff) was +rebuilt in an isolated clean checkout; artifact receipts are in Custodian +`decision-native-preparation/`. Production kid/public fingerprint/custody receipt, +producer candidate OCI and actual runtime/config placement remain missing. The +empty-key trust template deliberately refuses. No install, key read, caller mint, +protected effect, policy switch or trust admission occurred. T02 remains progress, +T03 wait; task source/live obligations remain separately in SECRETS-WP-0013. + +2026-10-16 trusted successor source preparation: refreshed exact API/sign source +from frozen Access B2/B3 R1 proposal (patch SHA-256 +6079ed2ff40b131aa2c5efc8d33608ecb3475c8158f0486b44ec4469e9f222c1). +Producer DecodeEnvelope preserves signed numeric lexemes; strict CAS retains and +reauthenticates original producer JSON. Existing request/claim/native/caller joins +remain mandatory; signed source observation additionally binds the native digest +and caps decision lifetime. Fourteen Approval owner vectors, legacy signatures, +tamper/unknown provenance and source deadline refusals are locally checked. +Actual ApprovalApp-to-Access v2 signed response verifies with the consumer helper; +actual source revocation refuses. Actual builder-to-v2 strict positive execution +is separately blocked on missing owner-reviewed service_actor_binding mapping; +no caller context injection or equality relaxation hides that gap. +Artifacts: Custodian `decision-trusted-successor/`. T02 remains progress, T03 +wait; no package/key/policy/native admission or runtime installation occurred. + +2026-10-16 successor R2 source preparation resolves the preceding builder gap: +only typed prod/platform execute-ccr with exact secrets-engine service subject +emits Access's fixed five-field public service_actor_binding before approval +issue. Subject/resource platform tenants are explicit before issue, matching the +producer's existing normalization and native act; lifecycle requests are unchanged. +Original carried context is still immutable. Actual builder -> Approval App -> +Access v2 signed ALLOW -> strict preparation/CAS -> independent Approval confirmation +GET passes with synthetic scoped identities/trust. Missing declaration, descriptor/ +native changes, stale original claim, signature tamper and replay refuse. The +operation deadline is explicit whole seconds within v2's 15-second allow TTL; +no deadline is extended or waived. This resolves source correspondence only; +T02 remains progress/T03 wait, with no native trust/grant/policy admission. + +2026-10-16 temporal successor source proof: Access B2/B3 R2 replaces its earlier +15s lifetime with the exact immutable operation deadline, bounded by its 120s +hard cap, original/fresh source and caller bounds, and post-I/O backend TTL+5s +fit. Verifier API/sign bytes are unchanged; source provenance records R2. Secrets +runtime and strict entire-operation deadline checks are unchanged. Contract prose +now states the actual fixed backend TTL and conservative fit rather than dynamic +TTL recomputation, and permits native token expiry earlier than operation deadline. +The actual source proof uses explicit synthetic Approval freshness120/backendTTL30/ +operationdeadline60, without a consumer timing waiver or native admission. + +Temporal proof precision observation: Approval consumption receipts use whole +seconds while Access R2 not_before preserves subsecond precision. Fast CAS can +therefore refuse receipt-before-start even though live calls are correctly +ordered. The positive proof explicitly waits real time until the next whole +second before CAS, without injected clocks or relaxed checks. Fast-CAS failure +is retained for owner resolution; no Secrets runtime change conceals the seam. + +2026-10-16 retained-registry successor source preparation adds only the existing +signed Check/DENY preapproval flow. The original typed service proposal is sent +unchanged; normalized native act and evaluated approval-free digest from the +admitted producer record are used for normal Approval issuance. The original +proposal then receives only the original issued claim. Final Check re-normalizes +against retained owner registry/source facts, so authoritative drift refuses +before CAS. No local registry algorithm, new endpoint, empty-registry workaround +or consumer digest waiver is used. Signed DENY preparation has no independent +permission/freshness window and cannot consume or execute; current caller and +operation bounds are checked, and final signed ALLOW/source checks remain +mandatory. Exact original JSON kinds and requested-target subsets refuse +bool/int/float substitution while allowing extra authoritative registry facts. +Actual provider proof preparation is separately waiting on frozen Access source +and Approval's timestamp/transaction-clock repair; source native/trust/custody and +actual task admission remain open. T02 remains progress and T03 wait; no native adoption is claimed. + +2026-10-16 canonical native CLI release preparation: published4dd004a was built +twice offline from a clean isolated checkout, with identical artifacts/manifest +105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e. +Disposable installation uses its fixed helper and empty native trust refuses +before caller access. Exact invocation/config/delivery candidates, public signer +provenance requirements, native lifecycle allow/deny capture, rotation/removal and +isolated-transport outage probes are reviewable in Custodian +`decision-native-preparation/r2/`. Real public kid/key/custody, candidate signed +producer/log/storage, native UID/prefix/config/caller/Approval delivery and each +actual handler/backend entitlement remain missing. No seed/token read, mint, +production installation/trust/policy change or effect occurred. Native effect +coverage remains0/11 across10handlers; T02 progress/T03 wait and task-native +WP13/WP8 gates remain open. Published Access receipt-tool2b064ee and verified +source APIs do not substitute for the separately reviewed hardened native image. diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/verification.json b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/verification.json new file mode 100644 index 00000000..5d158752 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/verification.json @@ -0,0 +1,10 @@ +{ + "JSON_valid": true, + "current_nested_contract_source_status_consistent": true, + "initial_prehelper_provenance_preserved": true, + "all_public_SHA256_references_explicit_algorithm": true, + "git_commit_ids_unchanged": true, + "programmatic_bundle_manifest_and_installer_runtime_untouched": true, + "runtime_files_untouched": true, + "effect_acceptance_unchanged": "0/11sites10handlers" +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/manifest.json b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/manifest.json new file mode 100644 index 00000000..98d11f28 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/manifest.json @@ -0,0 +1,26 @@ +{ + "base": "4dd004a2250104ba56293b2d7b0d96f4e076ea99", + "predecessor_r3_full_patch_sha256": "87dbdf5498a4d2950a83db0cfd13e03cadfb4b9450271cc1aa4f24e14a7613f6", + "over_r3_patch_sha256": "4deb45d649221b2f303ba12e634d1213845410848af0f2919bee47a365b856c0", + "full_patch_sha256": "18867bfa44bd8e59f5a4b77cf5a243c0640f9d68b06d0fc512f7400795de2d18", + "old_blob": "8fbf62ad8693a70f1e814b453c1a7a8efbb77224", + "new_blob": "01766313945cf521ffbb342ee773eae47a26ca87", + "changed_file_sha256": "6a76c1156a5f142e247a42abe435b092eebbc09391948d78fcb6367f7fc34b9a", + "normal_scanner_result_sha256": "9b42633aa2cf99e44d89a4093dd4f4cf817e28f667bc85c83f61815e64c9cbc2", + "diagnosis": "generic-api-key lines116/117 were public Git commit IDs under ambiguous Access/Secrets labels, not remaining SHA256 values", + "correction": "rename only metadata labels to producer_git_commit/consumer_git_commit; original commit bytes/values and all other metadata preserved", + "scanner": { + "blocked_blob_ids": [], + "scanned_blobs": 3, + "scanner_sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509", + "scanner_version": "8.30.1", + "scope": "changed-staged-blobs", + "status": "clean" + }, + "checks": { + "inverse_key_rename_restores_exact_original_JSON_semantics": true, + "runtime_and_programmatic_bundle_formats_unchanged": true, + "frozen_R3_and_owner_review_unchanged": true, + "canonical_checkout_untouched": true + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/native-cli-admission-r4-full.patch b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/native-cli-admission-r4-full.patch new file mode 100644 index 00000000..8ebab353 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/native-cli-admission-r4-full.patch @@ -0,0 +1,202 @@ +diff --git a/docs/proposals/native-cli-admission/README.md b/docs/proposals/native-cli-admission/README.md +index 3729cf6..63c48f5 100644 +--- a/docs/proposals/native-cli-admission/README.md ++++ b/docs/proposals/native-cli-admission/README.md +@@ -1,5 +1,52 @@ + # Native CLI signer and consumer admission preparation + ++## Current release preparation — 2026-10-16 R2 ++ ++Published canonical Secrets `4dd004a2250104ba56293b2d7b0d96f4e076ea99` was ++built twice from an isolated clean checkout. Artifacts and deterministic bundle ++manifest match exactly: manifest SHA256 ++`sha256:105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e`, ++fixed helper SHA256 ++`sha256:ed922b62533e4d33ae2d5f11175111f6f28e684a19e63ac704d43b63f0e0e12e`. ++Disposable installation/help and empty native trust refusal pass; no native ++prefix, trust/key, caller credential, protected effect or rollout was admitted. ++Artifact integrity is not independent package admission. Full receipts and a ++concrete probe/placement proposal are in Custodian `decision-native-preparation/r2/`. ++ ++Initial native scope remains the existing lifecycle pin and **0/11 protected ++sites across10 handlers**. Runtime UID/release/config/catalog/stance/trust/evidence ++and scoped caller/Approval delivery paths remain owner-unselected. A concrete ++workstation candidate uses a new release prefix ending ++`4dd004a22501-105dcebe6f03`; it is a proposal, not an installed/admitted path. ++Only its exact future `bin/secrets-engine` wrapper is the effect entrypoint. ++The current repo editable invocation and ambient demo/preflight fallbacks do not ++constitute release admission. A local CLI does not automatically hold the named ++ServiceAccount identity: existing docs describe separately authorized per-session ++TokenRequest delivery, not a standing credential or pod identity grant. ++ ++Access's single offline signer-receipt tool is published at ++`2b064eee510640224274ccdc7cefceb1ae13162e`; verified API/sign source matches this ++consumer. Native producer rollout still awaits independent public kid/key/custody ++and immutable candidate image/log/storage returns, including the Access owner's ++separate durable-log hardening review. Published source alone is not that image. ++The lifecycle pin stays v2/bd11c5fe...; task v2 is a separate unadmitted pin. ++ ++Source task correspondence is now implemented and cross-owner source-server ++proved: fixed typed service mapping before issue, retained-registry signed-DENY ++preapproval, original claim/context preservation, independent fresh source facts, ++precise Approval CAS and independent confirmation/journal/native disposable proof. ++This supersedes the historical source gaps below; it neither adds an execute-ccr ++CLI command nor selects a real CCR/catalogue/Plan/grant/backend/journal runtime. ++All native effect, caller/key/config and task-entitlement gates remain open under ++existing WP14/WP13/WP8 records. `service-jwt` still refuses protected CLI work. ++ ++## Historical ff1a13d preparation (preserved) ++ ++The following draft records the earlier source/admission observations. References ++to absent B2/B3/request/source-fact implementation are superseded by R2 above; ++missing native keys, runtime placement and actual task inputs remain unresolved. ++ ++ + This proposal covers the existing lifecycle CLI authentication path under + SECRETS-WP-0014. It grants no installation, key retrieval, caller mint, approval + consume, OpenBao effect or task-policy activation. All native acceptance counts +diff --git a/docs/proposals/native-cli-admission/proposal.json b/docs/proposals/native-cli-admission/proposal.json +index d5c50c2..0176631 100644 +--- a/docs/proposals/native-cli-admission/proposal.json ++++ b/docs/proposals/native-cli-admission/proposal.json +@@ -1,7 +1,7 @@ + { + "proposal_id": "SECRETS-WP-0014-native-cli-20261016", + "status": "preparation only; not installable or executable authorization", +- "source_base": "ff1a13dabd44ba02ddd6bc26ad75568f6d2e6225", ++ "source_base": "4dd004a2250104ba56293b2d7b0d96f4e076ea99", + "workplans": [ + "SECRETS-WP-0014-T02", + "SECRETS-WP-0014-T03", +@@ -33,8 +33,10 @@ + "custody_receipt": null, + "candidate_producer_oci_digest": null, + "rule": "No responder keys endpoint, synthetic fixture key or deployment metadata substitutes for independent owner admission", +- "receipt_verifier_integrated_revision": null, +- "signer_purpose_pin_and_sharing_receipt": null ++ "receipt_verifier_integrated_revision": "2b064eee510640224274ccdc7cefceb1ae13162e", ++ "signer_purpose_pin_and_sharing_receipt": null, ++ "public_fingerprint_convention": "Platform proposal: sha256(canonical unpadded base64url43 public-key ASCII); independent owner receipt required", ++ "candidate_producer_prerequisite": "Access durable-log hardening source and immutable image/storage/custody awaiting separate root/Platform review; published2b064ee alone is not native candidate admission" + }, + "placement": { + "owner": "Secrets consumer/deploying owner; exact runtime UID and paths not yet agreed", +@@ -52,7 +54,9 @@ + "absolute independently reviewed config/catalog/policy/stance/trust paths; no working-directory defaults for native use", + "trust regular non-symlink, not group/world writable; key admission not file-presence inference", + "owner retains manifest/admission/installation receipts and same-UID control boundary" +- ] ++ ], ++ "candidate_cli_release_prefix": "/home/worsch/.local/share/secrets-engine/releases/4dd004a22501-105dcebe6f03", ++ "candidate_status": "proposal only; no path selected/created/admitted" + }, + "configuration_contract": { + "SECRETS_ENGINE_PDP_URL": "literal loopback bare origin bound to independently verified cluster and named producer pod; exact native port awaiting owner placement", +@@ -81,36 +85,41 @@ + }, + "task_mapping_gap": { + "existing_cli_execute_ccr_command": false, +- "source_handoff": "secrets_engine.task_execution_handoff authorize_task_execution/consume_task_execution", ++ "source_handoff": "secrets_engine.task_execution_handoff prepare_task_approval/authorize_task_execution/consume_task_execution", + "platform_source_mediator": "railiance-platform/scripts/task_execution_mediator.py run_native_fixture_task; source proof only", + "unadmitted_inputs": [ +- "real service caller-to-subject server mapping and request/service binding join", +- "actual task policy candidate and independently reviewed source/runtime admission; both false gates unchanged", ++ "native admission of the existing exact service-caller-to-subject request mapping and immutable original-claim/source join", + "owner-selected fresh approved CCR/catalog/execution-grant, compiled Plan/whole descriptor and operation UUID", + "independent expected-before/after bytes for exact two metadata targets and actual estate/backend origin", + "actual source/Plan/install/journal/cleanup placement and trusted provider endpoints/credentials/custody", + "load-bearing audit/outbox cadence and durable receipt correlation", +- "Approval/Access reviewed out-of-band fresh-fact versus original carried-claim correspondence and signed provenance; strict context equality remains unchanged" ++ "exact native task v2 policy/caller/source/config/placement/key/runtime admission; v1 hard DENY retained" + ], + "approval_fact_interface_review": { +- "status": "review preference only; no implementation/admission", +- "preserve": "strict binding.context equality and original submitted/approval-free/native joins", +- "direction": "Access prefers out-of-band server-fetched authoritative fact checking while retaining original carried context, then reviewed producer-owned signed provenance/audit evidence", +- "required_review": [ +- "Approval fact/freshness semantic correspondence", +- "Access source receipt/provenance binding and exact request digests" +- ], +- "b1": "signed-DENY caller join only; no context replacement", +- "b2_b3": "not enabled or implemented here" ++ "status": "implemented/source-proved; native source/config/identity/trust admission remains missing", ++ "preserve": "type-sensitive original context/native/request/descriptor correspondence; original and independently fresh fact deadlines; no numeric translation", ++ "receipt": "Custodian decision-trusted-successor/verification-final-r4.json" + }, + "approval_fact_contract": { + "artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-fact-contract/consumer-contract.md", +- "sha256": "3dfb7987a4d9fe461b917cfa5bae7beef61bc4d9a4561fdded3e90128f5966de", ++ "sha256": "sha256:3dfb7987a4d9fe461b917cfa5bae7beef61bc4d9a4561fdded3e90128f5966de", + "vectors_artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-fact-contract/golden-vectors.json", +- "vectors_sha256": "dfb0a8810cd91847d7af6a7af6a51607a67a66fad7b86fc57365308c36bd9323", +- "status": "owner source contract pending integration; no Go conformance or B2 behavior admitted", +- "required": "preserve original fact/context/freshness, independently validate fresh fact window and exact nonfreshness authority; do not translate native numeric digests or invent target restrictions" +- } ++ "vectors_sha256": "sha256:dfb0a8810cd91847d7af6a7af6a51607a67a66fad7b86fc57365308c36bd9323", ++ "status": "owner contract/helper source implemented and integrated; Go conformance and actual source-server B2 behavior proved; native identity/config/trust/custody/effect admission remains unaccepted", ++ "required": "preserve original fact/context/freshness, independently validate fresh fact window and exact nonfreshness authority; do not translate native numeric digests or invent target restrictions", ++ "historical_attribution": "artifact and golden vectors below identify the initial prehelper contract; their former pending status was historical source preparation, not current implementation", ++ "current_helper_package": { ++ "artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-go-fact/manifest.json", ++ "sha256": "sha256:6d67f0005d4642bc60ed3a5f8901442f10c7bbf3f6b5d9fb8dba621298ed3851" ++ }, ++ "integrated_source": { ++ "producer_git_commit": "2b064eee510640224274ccdc7cefceb1ae13162e", ++ "consumer_git_commit": "4dd004a2250104ba56293b2d7b0d96f4e076ea99", ++ "receipt": "the-custodian/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/verification-final-r4.json", ++ "receipt_sha256": "sha256:9ed4d80a7d1aa7353d7b57954b7924a146329d1bd18a3f9152c6055bd51b92b5" ++ } ++ }, ++ "source_status": "implemented and cross-owner source-server proved, including retained registry and precise CAS; no native adoption" + }, + "approval_state": "no owner assent, key admission, install, caller token, operation grant or live change requested/executed by this preparation", + "denominator": { +@@ -129,5 +138,15 @@ + "platform_source_mediator_native_acceptance": false, + "generic_cli_consume_is_strict_task_handoff": false, + "effect_acceptance_required": "Review actual selected handler/generic consume response and caller scope separately; strict Platform fixture proof does not close existing CLI effects" ++ }, ++ "historical_source_base": "ff1a13dabd44ba02ddd6bc26ad75568f6d2e6225", ++ "release_candidate": { ++ "bundle_manifest_sha256": "sha256:105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e", ++ "helper_sha256": "sha256:ed922b62533e4d33ae2d5f11175111f6f28e684a19e63ac704d43b63f0e0e12e", ++ "two_clean_builds_equal": true, ++ "disposable_install_passed": true, ++ "native_install_admitted": false, ++ "artifact_integrity_is_not_package_admission": true, ++ "receipt": "Custodian decision-native-preparation/r2/canonical-build-install-receipt.json" + } + } +diff --git a/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md b/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md +index f65ac96..20f3b17 100644 +--- a/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md ++++ b/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md +@@ -117,7 +117,7 @@ T03 wait; task source/live obligations remain separately in SECRETS-WP-0013. + + 2026-10-16 trusted successor source preparation: refreshed exact API/sign source + from frozen Access B2/B3 R1 proposal (patch SHA-256 +-6079ed2ff40b131aa2c5efc8d33608ecb3475c8158f0486b44ec4469e9f222c1). ++sha256:6079ed2ff40b131aa2c5efc8d33608ecb3475c8158f0486b44ec4469e9f222c1). + Producer DecodeEnvelope preserves signed numeric lexemes; strict CAS retains and + reauthenticates original producer JSON. Existing request/claim/native/caller joins + remain mandatory; signed source observation additionally binds the native digest +@@ -175,3 +175,18 @@ bool/int/float substitution while allowing extra authoritative registry facts. + Actual provider proof preparation is separately waiting on frozen Access source + and Approval's timestamp/transaction-clock repair; source native/trust/custody and + actual task admission remain open. T02 remains progress and T03 wait; no native adoption is claimed. ++ ++2026-10-16 canonical native CLI release preparation: published4dd004a was built ++twice offline from a clean isolated checkout, with identical artifacts/manifest ++sha256:105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e. ++Disposable installation uses its fixed helper and empty native trust refuses ++before caller access. Exact invocation/config/delivery candidates, public signer ++provenance requirements, native lifecycle allow/deny capture, rotation/removal and ++isolated-transport outage probes are reviewable in Custodian ++`decision-native-preparation/r2/`. Real public kid/key/custody, candidate signed ++producer/log/storage, native UID/prefix/config/caller/Approval delivery and each ++actual handler/backend entitlement remain missing. No seed/token read, mint, ++production installation/trust/policy change or effect occurred. Native effect ++coverage remains0/11 across10handlers; T02 progress/T03 wait and task-native ++WP13/WP8 gates remain open. Published Access receipt-tool2b064ee and verified ++source APIs do not substitute for the separately reviewed hardened native image. diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/normal-scanner.json b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/normal-scanner.json new file mode 100644 index 00000000..b099e02b --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/normal-scanner.json @@ -0,0 +1 @@ +{"blocked_blob_ids": [], "scanned_blobs": 3, "scanner_sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509", "scanner_version": "8.30.1", "scope": "changed-staged-blobs", "status": "clean"} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/redacted-finding-metadata.json b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/redacted-finding-metadata.json new file mode 100644 index 00000000..3fc658fb --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/redacted-finding-metadata.json @@ -0,0 +1,24 @@ +{ + "blob": "8fbf62ad8693a70f1e814b453c1a7a8efbb77224", + "scanner_sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509", + "scanner_version": "8.30.1", + "findings": [ + { + "RuleID": "generic-api-key", + "StartLine": 116, + "EndLine": 116, + "StartColumn": 11, + "EndColumn": 61, + "Fingerprint": ":generic-api-key:116" + }, + { + "RuleID": "generic-api-key", + "StartLine": 117, + "EndLine": 117, + "StartColumn": 11, + "EndColumn": 62, + "Fingerprint": ":generic-api-key:117" + } + ], + "secret_match_and_line_contents_omitted": true +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/scanner-r1.json b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/scanner-r1.json new file mode 100644 index 00000000..2f73e797 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/scanner-r1.json @@ -0,0 +1 @@ +{"blocked_blob_ids": [], "scanned_blobs": 6, "scanner_sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509", "scanner_version": "8.30.1", "scope": "changed-staged-blobs", "status": "clean"} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/verification-r1.json b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/verification-r1.json new file mode 100644 index 00000000..1d531d40 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/verification-r1.json @@ -0,0 +1,94 @@ +{ + "source_commit": "ff1a13dabd44ba02ddd6bc26ad75568f6d2e6225", + "canonical_build_checkout_clean": true, + "all_manifest_source_and_artifact_hashes_verified": true, + "bundle": { + "bundle": "/tmp/secrets-cli-ff1-native-proof", + "helper_sha256": "a6e4eeb5361c61a2db5526ba5648ef5e48143c1a453e158d2f62991ba7ba3a33", + "manifest_sha256": "ee07c0b8755788ad0894c679ee2ca125a1c24df3a895013755d4a965a879a1ec" + }, + "installed": false, + "public_signer_inputs_missing": { + "kid": null, + "public_key": null, + "fingerprint": null, + "custody_receipt": null + }, + "cli_runtime_ast_unchanged_except_docstring": true, + "denominator": { + "shared_check_client": 1, + "cli_call_sites": 11, + "cli_handlers": 10, + "native_effects_accepted": 0, + "call_sites": [ + { + "handler": "cmd_apply", + "line_at_ff1": 313, + "action": "'apply'" + }, + { + "handler": "cmd_provision", + "line_at_ff1": 340, + "action": "'provision'" + }, + { + "handler": "cmd_rotate", + "line_at_ff1": 378, + "action": "'rotate'" + }, + { + "handler": "cmd_verify", + "line_at_ff1": 421, + "action": "'verify'" + }, + { + "handler": "cmd_handoff", + "line_at_ff1": 495, + "action": "'handoff'" + }, + { + "handler": "cmd_wrap", + "line_at_ff1": 535, + "action": "'wrap'" + }, + { + "handler": "cmd_exec", + "line_at_ff1": 588, + "action": "'exec'" + }, + { + "handler": "cmd_exec", + "line_at_ff1": 611, + "action": "'exec'" + }, + { + "handler": "cmd_revoke", + "line_at_ff1": 742, + "action": "'deactivate'" + }, + { + "handler": "_cmd_lifecycle_state", + "line_at_ff1": 779, + "action": "args.operation" + }, + { + "handler": "cmd_lifecycle", + "line_at_ff1": 847, + "action": "args.operation" + } + ] + }, + "observed_at": "2026-10-16T07:39:19.779929+00:00", + "empty_key_template_refuses_before_credential_access": true, + "synthetic_key_substitution": false, + "network_called_by_template_test": false, + "scanner": { + "blocked_blob_ids": [], + "scanned_blobs": 6, + "scanner_sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509", + "scanner_version": "8.30.1", + "scope": "changed-staged-blobs", + "status": "clean" + }, + "whitespace": "pass" +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-package/README.md b/docs/changes/netkingdom-target-2026-10-16/decision-package/README.md new file mode 100644 index 00000000..55409869 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-package/README.md @@ -0,0 +1,17 @@ +# Secrets CLI packaging source handoff + +Review/apply `implementation-r1.patch` on c80a944. Source/source hashes, exact +changed paths, scanner and build receipts are in `integration-manifest-r1.json`. +The implementation delivers the existing wheel and exact producer verifier +through an explicit reproducible bundle and offline new-prefix installer. + +Seven disposable tests pass: two byte-identical builds; clean offline install and +installed signature boundary; unsigned/missing/tampered refusals; exact reviewed +manifest, existing-prefix and producer-source-drift refusals. Scanner is clean. +No test signer is installed. The launcher fixes the bundle helper and validates +its checksum before CLI import; no runtime compilation or service is added. + +Proof bundle is retained under `/tmp/secrets-cli-package-proof`; its exact manifest +is copied here. Artifact integrity is not independent package admission. No +production tool, key/trust configuration or backend privilege was changed. Root +owns canonical integration/consistency; the next strict task handoff is separate. diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-package/implementation-r1.patch b/docs/changes/netkingdom-target-2026-10-16/decision-package/implementation-r1.patch new file mode 100644 index 00000000..1363b9d8 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-package/implementation-r1.patch @@ -0,0 +1,502 @@ +diff --git a/README.md b/README.md +index 922f840..52e3f1e 100644 +--- a/README.md ++++ b/README.md +@@ -86,3 +86,5 @@ speaks in lanes and guarded plans. + not write. + - Temporary bootstrap OpenBao credentials must live outside repos, use mode + 0600, be revocable, and be removed after narrower auth is working. ++ ++Packaged CLI deployment uses the reviewed [wheel + verifier bundle](docs/cli-release-bundle.md). A Python wheel alone omits the mandatory signature helper. +diff --git a/docs/cli-release-bundle.md b/docs/cli-release-bundle.md +new file mode 100644 +index 0000000..8634eda +--- /dev/null ++++ b/docs/cli-release-bundle.md +@@ -0,0 +1,82 @@ ++# CLI release bundle with authenticated decision verifier ++ ++The supported packaged CLI path is an explicit wheel-plus-verifier bundle. The ++existing editable `uv` workflow remains for development. Installing the Python ++wheel alone omits the Go helper and is incomplete for production authorization; ++it continues to fail closed. This is a CLI package, not a service or the retired ++`rapp-secrets-engine` deployment. ++ ++The bundle contains the Secrets wheel, the existing PyYAML runtime wheel pinned ++by `uv.lock`, the verifier executable, producer license attribution, a narrow CLI ++entry point and an offline installer. It never contains the test signer, signing ++seed, caller credential, runtime trust/key config or backend entitlement. Optional ++`clock` extras are outside this base bundle; configuring clock trust without the ++separately reviewed extra continues to refuse, rather than fall back. ++ ++## Build ++ ++Use Python >=3.11, uv and the Go toolchain required by `verifier/go.mod` on the ++intended Linux architecture. Supply a local compatible PyYAML wheel whose exact ++filename and SHA-256 appear in `uv.lock`. The builder never discovers/downloads a ++runtime dependency. The existing Hatchling build backend is now version-pinned. ++ ++```bash ++python3 scripts/build_release_bundle.py \ ++ --output /tmp/secrets-cli-reviewed-build \ ++ --dependency-wheel /path/to/locked-compatible-pyyaml.whl ++``` ++ ++Builds are offline by default. In a reviewed build environment, the explicit ++`--allow-build-downloads` flag permits uv to fetch the existing pinned build ++backend and its build dependencies. It does not change the runtime dependency ++contract. Set writable uv/Go caches as required by that build environment. ++ ++The builder first verifies the exact producer API/signature source and native ++fixture hashes, builds only the verifier root package with CGO disabled, explicit ++host architecture, trimmed paths, disabled VCS stamping and an empty build ID, ++then builds the wheel with commit-derived `SOURCE_DATE_EPOCH`. Two builds using ++the same source snapshot/toolchain/dependency wheel produce matching artifacts ++and manifest. The manifest records exact source-file and artifact SHA-256s, base ++commit, producer snapshot, platform and tool versions. It contains no observed ++build timestamp; retain observed execution time in a separate receipt. ++ ++## Review and offline install ++ ++**Checksums prove artifact integrity, not independent package admission.** The ++owner must review/admit the source, toolchain, complete bundle and manifest hash, ++and control the bundle/install prefix. A manifest obtained from an untrusted ++bundle does not establish that admission. Key/trust admission remains a distinct ++WP14 gate. None of these steps authorizes protected OpenBao work. ++ ++Execute the reviewed installer with the independently retained manifest digest: ++ ++```bash ++python3 /path/to/reviewed-bundle/install.py \ ++ --prefix /path/to/new-owner-controlled-prefix \ ++ --manifest-sha256 REVIEWED_MANIFEST_SHA256 ++/path/to/new-owner-controlled-prefix/bin/secrets-engine --help ++``` ++ ++The parent directory must already be owner controlled. The installer validates ++platform, manifest and the entire artifact set before creating a private new ++prefix, creates its venv through the existing uv convention, and installs entirely ++offline from bundled wheels. It never replaces an existing prefix or installs ++into standard user/system tools. A failed partial prefix is retained and marked; ++retry with a new prefix after diagnosis. Removing a failed/disposable prefix is ++an explicit owner operation, not an automatic cleanup of an existing path. ++ ++Use `PREFIX/bin/secrets-engine` as the admitted CLI entry point. It checks the ++bundled helper's SHA-256 before CLI import or credential access and fixes ++`SECRETS_ENGINE_PDP_VERIFIER` to that helper; ambient executable overrides do not ++select another verifier. Missing or changed helpers refuse. There is no runtime ++compilation or unsigned fallback. The internal venv scripts/programmatic API are ++not a second admitted entry point and do not create package/trust admission. ++Catalog/policy and independently reviewed responder trust configuration still ++belong to the deploying owner. Neither is silently copied from a developer repo. ++ ++For source verification, supply `SECRETS_ENGINE_TEST_DEPENDENCY_WHEEL` and run ++`pytest tests/test_release_bundle.py`. The disposable proof compares two builds, ++installs offline, invokes the installed wheel's signed HTTP boundary with public ++synthetic fixtures, rejects unsigned decisions, checks helper/bundle tampering, ++source drift and existing-prefix refusal. No native credentials or protected ++backend are involved. +diff --git a/pyproject.toml b/pyproject.toml +index fd25de6..aa74fda 100644 +--- a/pyproject.toml ++++ b/pyproject.toml +@@ -20,7 +20,7 @@ dev = [ + secrets-engine = "secrets_engine.cli:main" + + [build-system] +-requires = ["hatchling"] ++requires = ["hatchling==1.27.0"] + build-backend = "hatchling.build" + + [tool.hatch.build.targets.wheel] +diff --git a/scripts/build_release_bundle.py b/scripts/build_release_bundle.py +new file mode 100644 +index 0000000..7f8f0df +--- /dev/null ++++ b/scripts/build_release_bundle.py +@@ -0,0 +1,86 @@ ++#!/usr/bin/env python3 ++"""Build wheel + pinned producer verifier; install is a separate reviewed step.""" ++import argparse ++import hashlib ++import json ++import os ++from pathlib import Path ++import platform ++import shutil ++import subprocess ++import sys ++import tomllib ++ ++ ++def digest(path): ++ return hashlib.sha256(path.read_bytes()).hexdigest() ++ ++ ++def run(command, **kwargs): ++ return subprocess.check_output(command,text=True,**kwargs).strip() ++ ++ ++def build(root, output, dependency_wheel, uv, allow_build_downloads=False): ++ if platform.system() != 'Linux': ++ raise ValueError('this bundle supports Linux CLI only') ++ # No discovered keys, source rewriting, or runtime compilation. ++ subprocess.run([sys.executable,str(root/'scripts/check_pdp_producer_source.py')],check=True,stdout=sys.stderr) ++ locked=next(p for p in tomllib.loads((root/'uv.lock').read_text())['package'] if p['name']=='pyyaml') ++ admitted={Path(item['url']).name:item['hash'].removeprefix('sha256:') for item in locked['wheels']} ++ if dependency_wheel.name not in admitted or digest(dependency_wheel)!=admitted[dependency_wheel.name]: ++ raise ValueError('supplied PyYAML wheel does not match uv.lock') ++ output.mkdir(mode=0o700,parents=False,exist_ok=False) ++ epoch=run(['git','log','-1','--format=%ct'],cwd=root) ++ commit=run(['git','rev-parse','HEAD'],cwd=root) ++ architecture={'x86_64':'amd64','aarch64':'arm64'}.get(platform.machine()) ++ if architecture is None: ++ raise ValueError('unsupported Linux architecture') ++ env={**os.environ,'CGO_ENABLED':'0','GOOS':'linux','GOARCH':architecture, ++ 'GOFLAGS':'','GOWORK':'off','SOURCE_DATE_EPOCH':epoch} ++ (output/'bin').mkdir();(output/'wheels').mkdir() ++ subprocess.run(['go','build','-trimpath','-buildvcs=false','-ldflags=-buildid=', ++ '-o',str(output/'bin/secrets-engine-pdp-verify'),'.'],cwd=root/'verifier',env=env,check=True) ++ command=[uv,'--no-config','build','--wheel','--out-dir',str(output/'wheels'),str(root)] ++ if not allow_build_downloads:command.append('--offline') ++ subprocess.run(command,env=env,check=True) ++ wheel,=list((output/'wheels').glob('secrets_engine-*.whl')) ++ shutil.copyfile(dependency_wheel,output/'wheels'/dependency_wheel.name) ++ helper_hash=digest(output/'bin/secrets-engine-pdp-verify') ++ launcher=(root/'scripts/release_cli.py').read_text().replace('@HELPER_SHA256@',helper_hash) ++ (output/'release_cli.py').write_text(launcher) ++ shutil.copyfile(root/'scripts/install_release_bundle.py',output/'install.py') ++ shutil.copyfile(root/'verifier/LICENSE.access-engine',output/'LICENSE.access-engine') ++ sources=[root/'pyproject.toml',root/'uv.lock',root/'verifier/producer-source.json'] ++ sources+=list((root/'src/secrets_engine').glob('*.py')) ++ sources+=list((root/'verifier/pkg/api').glob('*.go'))+list((root/'verifier/internal/sign').glob('*.go')) ++ sources+=[root/'verifier/main.go',root/'scripts/check_pdp_producer_source.py', ++ root/'scripts/build_release_bundle.py',root/'scripts/install_release_bundle.py',root/'scripts/release_cli.py'] ++ source_hashes={str(path.relative_to(root)):digest(path) for path in sorted(sources)} ++ manifest={"schema":"secrets-engine.cli-bundle.v1","source_commit":commit,"source_files":source_hashes, ++ "source_date_epoch":int(epoch),"system":platform.system(),"machine":platform.machine(), ++ "python":platform.python_version(),"go":run(['go','version']),"uv":run([uv,'--version']), ++ "build_backend":"hatchling==1.27.0","wheel":str(wheel.relative_to(output)), ++ "producer":json.loads((root/'verifier/producer-source.json').read_text()), ++ "artifacts":{str(path.relative_to(output)):digest(path) for path in sorted(output.rglob('*')) if path.is_file()}, ++ "admission":"checksums are integrity evidence; owner must admit the bundle/prefix independently"} ++ (output/'manifest.json').write_text(json.dumps(manifest,sort_keys=True,indent=2)+'\n') ++ return {'bundle':str(output),'manifest_sha256':digest(output/'manifest.json'),'helper_sha256':helper_hash} ++ ++ ++def main(): ++ parser=argparse.ArgumentParser(description=__doc__) ++ parser.add_argument('--output',type=Path,required=True) ++ parser.add_argument('--dependency-wheel',type=Path,required=True) ++ parser.add_argument('--uv',default='uv') ++ parser.add_argument('--allow-build-downloads',action='store_true',help='permit uv to fetch existing build-system dependencies') ++ args=parser.parse_args() ++ try: ++ print(json.dumps(build(Path(__file__).resolve().parents[1],args.output.resolve(),args.dependency_wheel.resolve(), ++ args.uv,args.allow_build_downloads),sort_keys=True)) ++ except (OSError,ValueError,KeyError,subprocess.SubprocessError) as exc: ++ print('bundle build refused: '+str(exc),file=sys.stderr);return 1 ++ return 0 ++ ++ ++if __name__=='__main__': ++ raise SystemExit(main()) +diff --git a/scripts/install_release_bundle.py b/scripts/install_release_bundle.py +new file mode 100644 +index 0000000..9d718fc +--- /dev/null ++++ b/scripts/install_release_bundle.py +@@ -0,0 +1,82 @@ ++#!/usr/bin/env python3 ++"""Install one reviewed CLI bundle offline into a new owner-controlled prefix.""" ++import argparse ++import hashlib ++import json ++from pathlib import Path ++import platform ++import shutil ++import subprocess ++import sys ++ ++ ++def digest(path): ++ return hashlib.sha256(path.read_bytes()).hexdigest() ++ ++ ++def install(bundle, prefix, expected_manifest, python, uv): ++ manifest_path = bundle / "manifest.json" ++ if digest(manifest_path) != expected_manifest: ++ raise ValueError("bundle manifest differs from reviewed digest") ++ manifest = json.loads(manifest_path.read_text()) ++ if manifest["schema"] != "secrets-engine.cli-bundle.v1": ++ raise ValueError("unsupported bundle") ++ if manifest['system'] != platform.system() or manifest['machine'] != platform.machine(): ++ raise ValueError("bundle platform differs from installer host") ++ expected_files = set(manifest['artifacts']) | {'manifest.json'} ++ actual_files = {str(p.relative_to(bundle)) for p in bundle.rglob('*') if p.is_file()} ++ if actual_files != expected_files: ++ raise ValueError("bundle file set differs") ++ for name, expected in manifest['artifacts'].items(): ++ relative = Path(name) ++ if relative.is_absolute() or '..' in relative.parts: ++ raise ValueError("invalid artifact path") ++ artifact = bundle / relative ++ if any(parent.is_symlink() for parent in (artifact,*artifact.parents)) or digest(artifact) != expected: ++ raise ValueError("bundle artifact missing or changed") ++ # Reserve once; never replace an installed prefix or follow an existing link. ++ prefix.mkdir(mode=0o700, parents=False, exist_ok=False) ++ try: ++ subprocess.run([uv,'--no-config','venv','--python',python,'--no-python-downloads',str(prefix/'venv')],check=True) ++ subprocess.run([uv,'--no-config','pip','install','--python',str(prefix/'venv/bin/python'), ++ '--no-index','--find-links',str(bundle/'wheels'),str(bundle/manifest['wheel'])],check=True) ++ (prefix/'libexec').mkdir(mode=0o700) ++ helper=prefix/'libexec/secrets-engine-pdp-verify' ++ shutil.copyfile(bundle/'bin/secrets-engine-pdp-verify',helper);helper.chmod(0o700) ++ (prefix/'bin').mkdir(mode=0o700) ++ launcher=prefix/'bin/secrets-engine' ++ # An absolute venv interpreter fixes the installed dependency environment. ++ launcher.write_text('#!'+str(prefix/'venv/bin/python')+'\n'+(bundle/'release_cli.py').read_text()) ++ launcher.chmod(0o700) ++ receipt={"schema":"secrets-engine.cli-install.v1","manifest_sha256":expected_manifest, ++ "helper_sha256":digest(helper),"launcher_sha256":digest(launcher),"prefix":str(prefix), ++ "admission":"artifact integrity only; trust and keys not admitted"} ++ (prefix/'install-receipt.json').write_text(json.dumps(receipt,sort_keys=True,indent=2)+'\n') ++ return receipt ++ except BaseException: ++ # Preserve a failed prefix as evidence; never retry into a partial install. ++ (prefix/'INSTALL-FAILED').write_text('Incomplete installation; use a new prefix.\n') ++ raise ++ ++ ++def main(): ++ parser=argparse.ArgumentParser(description=__doc__) ++ parser.add_argument('--bundle',type=Path,default=Path(__file__).resolve().parent) ++ parser.add_argument('--prefix',type=Path,required=True) ++ parser.add_argument('--manifest-sha256',required=True) ++ parser.add_argument('--python',default=sys.executable) ++ parser.add_argument('--uv',default='uv') ++ args=parser.parse_args() ++ try: ++ if not args.prefix.is_absolute() or args.prefix.parent.is_symlink(): ++ raise ValueError('prefix must be absolute with an admitted parent') ++ receipt=install(args.bundle.resolve(),args.prefix,args.manifest_sha256,args.python,args.uv) ++ print(json.dumps(receipt,sort_keys=True)) ++ except (OSError,ValueError,KeyError,subprocess.SubprocessError) as exc: ++ print('bundle install refused: '+str(exc),file=sys.stderr) ++ return 1 ++ return 0 ++ ++ ++if __name__=='__main__': ++ raise SystemExit(main()) +diff --git a/scripts/release_cli.py b/scripts/release_cli.py +new file mode 100644 +index 0000000..c7a2d08 +--- /dev/null ++++ b/scripts/release_cli.py +@@ -0,0 +1,29 @@ ++"""Narrow installed CLI entry point; rendered by build_release_bundle.py.""" ++import hashlib ++import os ++from pathlib import Path ++import sys ++ ++EXPECTED_HELPER_SHA256 = "@HELPER_SHA256@" ++ ++ ++def main(): ++ prefix = Path(__file__).resolve().parent.parent ++ helper = prefix / "libexec" / "secrets-engine-pdp-verify" ++ try: ++ if helper.is_symlink() or not helper.is_file(): ++ raise ValueError("missing helper") ++ if hashlib.sha256(helper.read_bytes()).hexdigest() != EXPECTED_HELPER_SHA256: ++ raise ValueError("changed helper") ++ except (OSError, ValueError): ++ print("secrets-engine: installed verifier missing or changed", file=sys.stderr) ++ return 1 ++ # The bundle always uses its reviewed helper; ambient overrides do not select ++ # another executable. The owner admits runtime trust separately. ++ os.environ["SECRETS_ENGINE_PDP_VERIFIER"] = str(helper) ++ from secrets_engine.cli import main as cli_main ++ return cli_main() ++ ++ ++if __name__ == "__main__": ++ raise SystemExit(main()) +diff --git a/tests/test_release_bundle.py b/tests/test_release_bundle.py +new file mode 100644 +index 0000000..c481cd5 +--- /dev/null ++++ b/tests/test_release_bundle.py +@@ -0,0 +1,137 @@ ++"""Actual offline installation proof; only supplied locked public dependency wheel. ++ ++Set SECRETS_ENGINE_TEST_DEPENDENCY_WHEEL to a local PyYAML wheel from uv.lock. ++No production install, trust admission, backend or credential is used. ++""" ++import hashlib ++import json ++import os ++from pathlib import Path ++import shutil ++import subprocess ++import sys ++ ++import pytest ++ ++from tests.test_decision_signature import FIXTURE, PUBLIC ++from tests.test_decision_transport import server ++ ++ROOT = Path(__file__).resolve().parents[1] ++ ++ ++def run(command, **kwargs): ++ return subprocess.run(command, text=True, capture_output=True, timeout=120, **kwargs) ++ ++ ++@pytest.fixture(scope='module') ++def bundles(tmp_path_factory): ++ dependency=os.environ.get('SECRETS_ENGINE_TEST_DEPENDENCY_WHEEL') ++ if not dependency: ++ pytest.skip('provide the locked public PyYAML wheel for actual bundle build/install tests') ++ directory=tmp_path_factory.mktemp('cli-bundles') ++ result=[] ++ for name in ['one','two']: ++ bundle=directory/name ++ built=run([sys.executable,str(ROOT/'scripts/build_release_bundle.py'),'--output',str(bundle), ++ '--dependency-wheel',dependency]) ++ assert built.returncode==0,built.stderr ++ result.append(bundle) ++ return result ++ ++ ++def manifest_hash(bundle): ++ return hashlib.sha256((bundle/'manifest.json').read_bytes()).hexdigest() ++ ++ ++def install(bundle,prefix): ++ return run([sys.executable,str(bundle/'install.py'),'--bundle',str(bundle),'--prefix',str(prefix), ++ '--manifest-sha256',manifest_hash(bundle)]) ++ ++ ++@pytest.fixture ++def installed(bundles,tmp_path): ++ prefix=tmp_path/'installed' ++ result=install(bundles[0],prefix) ++ assert result.returncode==0,result.stderr ++ return prefix ++ ++ ++def test_two_builds_match_and_contain_no_signer(bundles): ++ one,two=bundles ++ names={str(path.relative_to(one)) for path in one.rglob('*') if path.is_file()} ++ assert names=={str(path.relative_to(two)) for path in two.rglob('*') if path.is_file()} ++ for name in names: ++ assert (one/name).read_bytes()==(two/name).read_bytes(),name ++ assert not any('signer' in name or 'testsupport' in name for name in names) ++ assert (one/'bin/secrets-engine-pdp-verify').is_file() ++ assert len(list((one/'wheels').glob('secrets_engine-*.whl')))==1 ++ ++ ++def test_clean_install_uses_installed_wheel_and_signed_boundary(installed,tmp_path): ++ env={**os.environ,'SECRETS_ENGINE_PDP_VERIFIER':'/must-not-use-ambient-override'} ++ help_result=run([str(installed/'bin/secrets-engine'),'--help'],env=env,cwd='/tmp') ++ assert help_result.returncode==0,help_result.stderr ++ envelope=json.loads(FIXTURE.read_bytes()) ++ trust={name:envelope['provenance'][name] for name in ('evaluator','mode','policy_package','policy_version','policy_package_digest')} ++ trust.update(schema='secrets-engine.pdp-trust.v1',keys={'testdata-ed25519':PUBLIC}) ++ trust_file=tmp_path/'synthetic-trust.json';trust_file.write_text(json.dumps(trust)) ++ token=tmp_path/'synthetic.token';token.write_text('synthetic-pdp-credential');token.chmod(0o600) ++ script='''import pathlib,sys ++import secrets_engine.decision_check as installed ++from secrets_engine.errors import DecisionError ++assert str(pathlib.Path(installed.__file__).resolve()).startswith(sys.argv[1]+'/venv/') ++try: ++ result=installed.check_decision(base_url=sys.argv[2],token_file=pathlib.Path(sys.argv[3]),request={},trust_file=pathlib.Path(sys.argv[4]),verifier=pathlib.Path(sys.argv[1]+'/libexec/secrets-engine-pdp-verify')) ++except DecisionError: ++ if sys.argv[5]=='refuse':sys.exit(0) ++ raise ++assert sys.argv[5]=='accept' and result['effect']=='allow' ++''' ++ clean_env={key:value for key,value in os.environ.items() if key not in ('PYTHONPATH','PYTHONHOME')} ++ for body,expect in [(FIXTURE.read_bytes(),'accept'),(b'{"effect":"allow"}','refuse')]: ++ with server(body=body) as (origin,seen): ++ result=run([str(installed/'venv/bin/python'),'-c',script,str(installed),origin,str(token),str(trust_file),expect],env=clean_env,cwd='/tmp') ++ assert result.returncode==0,result.stderr ++ assert seen==[True] ++ ++ ++@pytest.mark.parametrize('change',['missing','tampered']) ++def test_installed_cli_refuses_missing_or_tampered_helper(installed,change): ++ helper=installed/'libexec/secrets-engine-pdp-verify' ++ if change=='missing':helper.rename(helper.with_suffix('.held')) ++ else:helper.write_bytes(helper.read_bytes()+b'tampered') ++ result=run([str(installed/'bin/secrets-engine'),'--help'],cwd='/tmp') ++ assert result.returncode==1 ++ assert 'verifier missing or changed' in result.stderr ++ assert not result.stdout ++ ++ ++def test_installer_refuses_changed_artifact_and_existing_prefix(bundles,tmp_path): ++ altered=tmp_path/'altered';shutil.copytree(bundles[0],altered) ++ helper=altered/'bin/secrets-engine-pdp-verify';helper.write_bytes(helper.read_bytes()+b'tampered') ++ prefix=tmp_path/'must-not-create' ++ result=install(altered,prefix) ++ assert result.returncode==1 and not prefix.exists() ++ existing=tmp_path/'existing';existing.mkdir();marker=existing/'keep';marker.write_text('unchanged') ++ result=install(bundles[0],existing) ++ assert result.returncode==1 and marker.read_text()=='unchanged' ++ assert sorted(path.name for path in existing.iterdir())==['keep'] ++ ++ ++def test_installer_requires_exact_reviewed_manifest(bundles,tmp_path): ++ prefix=tmp_path/'must-not-create' ++ result=run([sys.executable,str(bundles[0]/'install.py'),'--prefix',str(prefix),'--manifest-sha256','0'*64]) ++ assert result.returncode==1 and not prefix.exists() ++ ++ ++def test_changed_producer_source_stops_before_build(tmp_path): ++ root=tmp_path/'source';(root/'scripts').mkdir(parents=True) ++ for name in ['build_release_bundle.py','check_pdp_producer_source.py']: ++ shutil.copyfile(ROOT/'scripts'/name,root/'scripts'/name) ++ shutil.copytree(ROOT/'verifier',root/'verifier') ++ shutil.copytree(ROOT/'tests/fixtures/pdp-signature',root/'tests/fixtures/pdp-signature') ++ source=root/'verifier/internal/sign/sign.go';source.write_bytes(source.read_bytes()+b'// drift\n') ++ output=tmp_path/'must-not-build' ++ result=run([sys.executable,str(root/'scripts/build_release_bundle.py'),'--output',str(output), ++ '--dependency-wheel',str(tmp_path/'not-reached.whl')]) ++ assert result.returncode==1 and not output.exists() +diff --git a/verifier/README.md b/verifier/README.md +index 073cace..a63b2a0 100644 +--- a/verifier/README.md ++++ b/verifier/README.md +@@ -28,3 +28,8 @@ The Check API defaults to mandatory authentication. Its deliberately named + `allow_unsigned_test_fixture` argument is used only by synthetic transport tests; + production `authorize_action` never passes it. The helper runs with an empty + environment, so ambient backend and identity credentials cannot reach it. ++ ++For the complete reproducible CLI build and offline fresh-prefix installation, ++use [the release bundle contract](../docs/cli-release-bundle.md). This replaces ++manual helper copying for packaged deployments; package and key admission remain ++separate owner decisions. +diff --git a/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md b/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md +index a3e55a9..886a0f6 100644 +--- a/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md ++++ b/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md +@@ -77,6 +77,15 @@ key admission remains part of its scope; T03 stays wait. WP13 execution and + identity-only CCR38 are unchanged. Custodian source/verification handoff: + `docs/changes/netkingdom-target-2026-10-16/decision-auth/` in the Custodian repo. + ++2026-10-16 packaging preparation: `scripts/build_release_bundle.py` and its ++separate offline installer deliver the existing wheel plus the reviewed producer ++verifier together into a new owner-controlled prefix. Source/hash drift checks, ++artifact/toolchain receipts and a narrow fixed-helper launcher remove the silent ++wheel-only deployment gap. Disposable build/install tests prove deterministic ++artifacts, signed HTTP consumption and missing/tampered artifact refusal; they do ++not admit packages, keys or a production prefix. T02 remains progress and T03 ++wait; no native installation, trust change or protected entitlement is claimed. ++ + ## Verify the admitted native consumer and rotation path + + ```task diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-package/original-owner-dirty.patch b/docs/changes/netkingdom-target-2026-10-16/decision-package/original-owner-dirty.patch new file mode 100644 index 00000000..acf1eeaa --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-package/original-owner-dirty.patch @@ -0,0 +1,96 @@ +diff --git a/.custodian-brief.md b/.custodian-brief.md +index 0cb912a..ba794c8 100644 +--- a/.custodian-brief.md ++++ b/.custodian-brief.md +@@ -2,7 +2,7 @@ + # Custodian Brief — secrets-engine + + **Domain:** infotech +-**Last synced:** 2026-10-11 17:52 UTC ++**Last synced:** 2026-10-16 05:55 UTC + **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* + + ## Active Workstreams +@@ -11,8 +11,24 @@ + Progress: 1/3 done | workplan_id: `5e38aecc-85ca-5f55-94c6-9fbb08604819` + + **Open tasks:** ++- ! Define the exact mediated execution contract `b2f0d462` ++ *(wait: Independent Platform mediated-contract review and identity/approval/PDP owner returns remain required; D3 wrapped primitive source is implemented, no native entitlement is inferred.)* + - ! Implement and prove one native metadata action `5f8f7c41` +-- ► Define the exact mediated execution contract `b2f0d462` ++ ++### Constrain PDP transport and authenticate decision responses ++Progress: 1/3 done | workplan_id: `7252469d-d7a5-5c18-8911-b511b8c6a736` ++ ++**Open tasks:** ++- ! Verify the admitted native consumer and rotation path `85aa4c78` ++ *(wait: Requires reviewed verification-key admission, source enforcement and exact native rollout receipt; no production trust change is proposed yet.)* ++- ► Implement independently anchored responder authentication `877782e5` ++ ++### Production-safe provisioning, authorization, and lifecycle hardening ++Progress: 6/7 done | workplan_id: `68a39be1-bd9c-5133-ad64-e7bca892aaf3` ++ ++**Open tasks:** ++- ! Resume native production lane adoption `a0a1dd92` ++ *(wait: Engine approval hardening is complete. Remaining per-lane cutover includes native routing/proxy retirement with ops-warden under SECRETS-WP-0006-T05/T06; the exact OpenRouter key-check receipt does not establish broader recipient readiness.)* + + ### Activate native Claude credential delivery for Glas + Progress: 2/3 done | workplan_id: `40ccc3b4-d046-5a58-8649-e7935f45c974` +@@ -26,27 +42,20 @@ Progress: 4/6 done | workplan_id: `31f7f8ea-7f73-516c-8877-f03a13f1db82` + + **Open tasks:** + - ! Stage live apply and verification `fb103f1e` +- *(wait: OpenRouter key-check native acceptance is recorded in SECRETS-WP-0010-T03. Other lanes still need exact approvals, scoped attended apply and per-lane positive/negative/health/revocation evidence.)* ++ *(wait: Owner work first: publish a reviewed scoped-apply command per lane. Per-lane approvals are no longer needed (D1 standing rule); each lane with a command enters the attended window.)* + - ! Reconcile routing ownership and retire interim proxies `1431edae` + *(wait: Needs owner-agreed routing/proxy retirement for each verified lane and custody disposition of the legacy npm pointer; a single approved OpenRouter key-check does not authorize broader routing cutover.)* + +-### Production-safe provisioning, authorization, and lifecycle hardening +-Progress: 6/7 done | workplan_id: `68a39be1-bd9c-5133-ad64-e7bca892aaf3` +- +-**Open tasks:** +-- ! Resume native production lane adoption `a0a1dd92` +- *(wait: Engine approval hardening is complete. Remaining per-lane cutover includes native routing/proxy retirement with ops-warden under SECRETS-WP-0006-T05/T06; the exact OpenRouter key-check receipt does not establish broader recipient readiness.)* +- + ### Evolve the Lifecycle engine to the accepted security layer model + Progress: 5/6 done | workplan_id: `9c9e5164-b2f5-5ea2-a557-5368d65e9fe0` + + **Open tasks:** + - ! No standing engine credential `d7bc8bdc` +- *(wait: Positive service-JWT login proof passed 2026-10-10 (SECRETS-WP-0012-T03, docs/evidence/2026-10-10-keycape-openbao-probe.json). Waits on railiance-platform closing RPF-WP-0035-T02 with the CCR-2026-0038 negative checks, then on routing live engine actions through service-jwt instead of bootstrap/env.)* ++ *(wait: Published JWT contract and positive login/revocation are delivered. Native KEY-WP-0039-T02 claim negatives, CCR-2026-0038 effective-policy/capability/expiry/use checks and MASON-WP-0009-T05 remain. Login-self-only grants no protected-operation authority: agree and implement separately reviewed task-scoped backend execution entitlement, then prove functional steady-state service-identity adoption without bootstrap/env fallback.)* + + ## Inbox Hygiene + +-**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start. ++**Stale unread:** 3 message(s) older than 3 day(s) — triage at session start. + **Missing thread_id:** 2 unread message(s) lack supersession chains. + + --- +diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md +index 70e5831..4d1cfb6 100644 +--- a/WORK-RECORDS.md ++++ b/WORK-RECORDS.md +@@ -22,6 +22,7 @@ + | workplan | SECRETS-WP-0011 | finished | — | workplans/SECRETS-WP-0011-multi-lane-exec-owner-delivery.md | + | workplan | SECRETS-WP-0012 | finished | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md | + | workplan | SECRETS-WP-0013 | proposed | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md | ++| workplan | SECRETS-WP-0014 | active | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md | + | task | SECRETS-WP-ADHOC-2026-08-21-T01 | done | — | workplans/ADHOC-2026-08-21.md | + | task | SECRETS-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md | + | task | SECRETS-WP-0001-T01 | done | — | workplans/SECRETS-WP-0001-statehub-bootstrap.md | +@@ -83,9 +84,12 @@ + | task | SECRETS-WP-0012-T02 | cancel | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md | + | task | SECRETS-WP-0012-T03 | done | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md | + | task | SECRETS-WP-0012-T04 | done | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md | +-| task | SECRETS-WP-0013-T01 | progress | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md | ++| task | SECRETS-WP-0013-T01 | wait | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md | + | task | SECRETS-WP-0013-T02 | done | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md | + | task | SECRETS-WP-0013-T03 | wait | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md | ++| task | SECRETS-WP-0014-T01 | done | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md | ++| task | SECRETS-WP-0014-T02 | progress | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md | ++| task | SECRETS-WP-0014-T03 | wait | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md | + | intake | SECRETS-IN-0001 | closed | — | intakes/intakes.md | + | intake | SECRETS-IN-0002 | closed | — | intakes/intakes.md | + | intake | SECRETS-IN-0003 | closed | — | intakes/intakes.md | diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-package/proof-build-r1.json b/docs/changes/netkingdom-target-2026-10-16/decision-package/proof-build-r1.json new file mode 100644 index 00000000..4e706846 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-package/proof-build-r1.json @@ -0,0 +1 @@ +{"bundle": "/tmp/secrets-cli-package-proof", "helper_sha256": "a6e4eeb5361c61a2db5526ba5648ef5e48143c1a453e158d2f62991ba7ba3a33", "manifest_sha256": "aa8e54a3c6ee903e2a9048c4d186b08f37a006fe6f74926a9ea4a1e6bda8bc3d"} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-package/scanner-r1.json b/docs/changes/netkingdom-target-2026-10-16/decision-package/scanner-r1.json new file mode 100644 index 00000000..c5acd30c --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-package/scanner-r1.json @@ -0,0 +1 @@ +{"blocked_blob_ids": [], "scanned_blobs": 9, "scanner_sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509", "scanner_version": "8.30.1", "scope": "changed-staged-blobs", "status": "clean"} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-package/source-provenance.json b/docs/changes/netkingdom-target-2026-10-16/decision-package/source-provenance.json new file mode 100644 index 00000000..2092beb7 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-package/source-provenance.json @@ -0,0 +1,8 @@ +{ + "owner": "secrets-engine", + "base_commit": "c80a944105a00220cd3c1a007709e72d830dd08d", + "dirty_metadata_sha256": "a5ef64f28f7c30e7b71a8f26160e820dfa809407d8cc21336032c61fed70c4c5", + "status": "M .custodian-brief.md\n M WORK-RECORDS.md\n", + "isolated_source": "/tmp/netkingdom-secrets-decision-package", + "original_metadata_not_overlaid": "No relevant dirty source; only existing generated brief/work-record metadata. Canonical checkout not modified." +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-drift-test-r4.txt b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-drift-test-r4.txt new file mode 100644 index 00000000..ce12ed2f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-drift-test-r4.txt @@ -0,0 +1,9 @@ +Traceback (most recent call last): + File "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-registry-smoke-r4.py", line 168, in + consumption=consume_task_execution(cfg,authorization) + ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + File "/tmp/netkingdom-secrets-trusted-successor/src/secrets_engine/task_execution_handoff.py", line 277, in consume_task_execution + _refuse() + File "/tmp/netkingdom-secrets-trusted-successor/src/secrets_engine/task_execution_handoff.py", line 35, in _refuse + raise DecisionError('strict task execution handoff correspondence refused') +secrets_engine.errors.DecisionError: strict task execution handoff correspondence refused diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/claimfree-request.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/claimfree-request.json new file mode 100644 index 00000000..741e83bc --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/claimfree-request.json @@ -0,0 +1,130 @@ +{ + "action": "execute-ccr", + "context": { + "catalog_target": { + "auth_capability": {}, + "consumers": [ + { + "auth": "approle", + "claim": "role:c", + "name": "c" + } + ], + "delivery_auth": { + "management": "engine", + "method": "approle" + }, + "delivery_config": {}, + "delivery_modes": [ + "exec-env" + ], + "fields": [ + "api_token" + ], + "kind": "kv", + "mount": "secret", + "mount_management": "engine", + "org": "coulomb", + "path": "test/team/thing", + "repo": "team-repo", + "workload_delivery": [] + }, + "execution_contract": { + "backend_budget": { + "ttl_seconds": 30, + "uses": 12 + }, + "backend_origin": "http://127.0.0.1:18200", + "catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f", + "ccr_id": "CCR-2099-0001", + "ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "cluster_uid": "test-estate-not-live", + "contract_version": "SECRETS-EXEC-20261011-v1", + "execution_actor": "service:secrets-engine", + "execution_grant_ccr_id": "CCR-2099-0002", + "expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "operation": "metadata-apply-ccr", + "operation_deadline": "2026-10-16T15:06:43+00:00", + "operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153", + "operations": [ + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "sys/policies/acl/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "PUT", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + { + "method": "GET", + "path": "auth/synthetic/role/synthetic", + "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + ], + "source_bundle": { + "engine_dispatcher": { + "path": "/owner/engine_dispatcher.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "platform_mediator": { + "path": "/owner/platform_mediator.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "policy_auth": { + "path": "/owner/policy_auth.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "typed_ccr": { + "path": "/owner/typed_ccr.py", + "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + } + }, + "human_control": true, + "purpose": "metadata-test", + "service_actor_binding": { + "subject_id": "secrets-engine", + "subject_type": "service", + "tenant": "tenant:platform", + "transport_principal": "system:serviceaccount:secrets-engine:secrets-engine", + "version": "proposed-service-task-caller/v1" + } + }, + "resource": { + "attributes": { + "auth_targets": [], + "fields": [], + "policy_targets": [], + "stage": "prod" + }, + "id": "catalog:test-lane", + "system": "secrets-engine", + "tenant": "tenant:platform", + "type": "secret-catalog-lane" + }, + "subject": { + "id": "secrets-engine", + "tenant": "tenant:platform", + "type": "service" + }, + "tenant": "tenant:platform" +} diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/consumption-confirmation.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/consumption-confirmation.json new file mode 100644 index 00000000..4b79712d --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/consumption-confirmation.json @@ -0,0 +1,6 @@ +{ + "approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8", + "request_digest": "sha256:ac65003b1b527d2194d7a50872f3dda3a9a4824fd3f8ba61721ba20c475ae645", + "decision_id": "decision:9da2b8442a192d6d", + "consumed_at": "2026-10-16T15:05:44.235319+00:00" +}