diff --git a/docs/changes/netkingdom-target-2026-10-16/access-native-source/b2-b3/r3/canonical-integration.json b/docs/changes/netkingdom-target-2026-10-16/access-native-source/b2-b3/r3/canonical-integration.json new file mode 100644 index 00000000..dd4dfc3e --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-native-source/b2-b3/r3/canonical-integration.json @@ -0,0 +1,61 @@ +{ + "repo": "access-engine", + "base": "4f6946bbb338f61e4ee19efe32dcfe2757c22dcc", + "patches": [ + { + "path": "access-native-source/b2-b3/r3/trusted-source-r3-over-b1-r2.patch", + "sha256": "sha256:46bfeb706d3a88bf6054309cc9303eb360a91e57dda3b0fcbb7b80d551a75db6" + } + ], + "files_sha256": { + ".forgejo/workflows/image.yaml": "sha256:18307ce17027b263ac0703a9e82fba8d14b672ca8bc9dee4c90b3aed2decd58e", + "Containerfile": "sha256:8ff6dc27d632d4f889b2cd527fc14c9dd1f79359b63384600088c87a47943a98", + "cmd/access-engine/main.go": "sha256:3f799c39843967e7b087e439f73f8ff8718f3153ef418356244379e9b6a997cb", + "cmd/access-engine/trusted_service_http_test.go": "sha256:a8248b5cdda21f576f1a8e5d674d6c4ee1a0d128991fdb95d2bcba53192f1f33", + "docs/trusted-service-task-source.md": "sha256:d8bb98219e3f54129da4f0b5d3a8465b8d59cf68b0f2d61045ac7482cdfbca42", + "examples/secrets-engine-service-task-execution-v2/policy_fixtures.yaml": "sha256:542bf9be8bcd11b58e0a92e41730304a9b7203fb7cf1b2558665f71a469fc469", + "examples/secrets-engine-service-task-execution-v2/policy_package.md": "sha256:95def8495596520a286a62dc48aca3f232668534ff687a2f4d47a46805eaac15", + "examples/secrets-engine-service-task-execution-v2/resource_manifest.yaml": "sha256:fccf6ab7345e93893ab335fa34f2c180dde2edc708519a88bb39e73ebfc0fd48", + "go.mod": "sha256:af40d3ad78d6edad8495766f483ae5a857fc320db340a75d7b3be04236e0cf78", + "internal/audit/log.go": "sha256:e47ef2c0e6be529d51e8c0c270759af8e988261437d890254f317cd5c0f0a238", + "internal/decision/engine.go": "sha256:be6ea0e81422dba6b6d2124530263bf6fd4025c8dcac9360c619adbff0ac0bbd", + "internal/decision/trusted_service.go": "sha256:a4d76130c90b75b6a734877d8031943d5d6f6d64b02e4dc8295c497ec894f635", + "internal/decision/trusted_service_time_test.go": "sha256:b72fd3744df23a0e4cf30529c6b31a316d0ce2f0f0a8abc027966db7044b0c83", + "internal/emission/delivery.go": "sha256:ac90171af3c2957b6877b7334d3dbaed671f63b8335c36034c7a1bde9a0d8265", + "internal/emission/numeric_replay_test.go": "sha256:a7420ed712ee8e446995ce8440cf7fcc558fc9d254388b425e61d675f61e493c", + "internal/emission/outbox.go": "sha256:e347dd5b2e8cc1f64d4d231ecf30fe931f1524b6689338ee208c1c15281b09dc", + "internal/policy/package.go": "sha256:6b94f34917fcc344c12d6ff7a9465f712c026bd35cd5bc64a115ab5287b42e13", + "internal/registry/numeric_source_test.go": "sha256:d7b57e0d3fc11a51a6bf249258ccae6eb50dae41a038ff4d588f86ef41bd8698", + "internal/registry/store.go": "sha256:0ccbb6ed6c8d2097009096936e92c2eba7073126cd46b124880e694b84cf2114", + "internal/sign/numeric_decode_test.go": "sha256:d45b4b1708359e32da108d011735c8b4916f817d266d1c5f7059d9cde136fe95", + "internal/sign/sign.go": "sha256:0df9515922e90775ebbfac798361dcafb20da8a4213796b44e246b8a92046cde", + "internal/taskexecution/approval_source.go": "sha256:046ebd094a160d8c4a1dd07b73123fb6fce1c6fd45258a2edb99043f10001848", + "internal/taskexecution/approval_source_test.go": "sha256:d1ab01a76dc7f9738a25c20535dd43d892c477a19cdabba0f4c35eb54e36a043", + "internal/taskexecution/service_input.go": "sha256:4dac272cbbe06a6c0ad9d8fc103f03828e01e02568b59c94c733d4de8395928c", + "pkg/api/canonical.go": "sha256:a122a2e8cd524333b13c5939c7a3685e41efbe47497a64e0c7297c92b7f10d19", + "third_party/approvalfact/README.md": "sha256:5d936b7f3de87bbf4e946f0dc44823d2f69b62b4122b55b9064791b7a19fd4f5", + "third_party/approvalfact/SOURCE.json": "sha256:2ec250061aa70ab48c275feeb77f7a4b71ced8268c1064a6f170f59950504d92", + "third_party/approvalfact/canonical.go": "sha256:d48588fb26e9037c8e83421586b8a818f4c0a52afb874f3fadf7229fc971c282", + "third_party/approvalfact/claim.go": "sha256:007a2494f79c47c104635402407e9e68f17d8599d23e0f2c8ebf6cb1b47e3621", + "third_party/approvalfact/go.mod": "sha256:bb09c53ffea926fbfba6e580ed3bd71ca358575401717389b3c7c49c0c674b43", + "workplans/FLEX-WP-0024-decision-envelope-authenticity.md": "sha256:cc1479ce3a986b8d2a2027aee0343f883ba972418193fc64911ab49e9f868e9b" + }, + "receipt": "access-native-source/b2-b3/r3/canonical-integration.json", + "managed_id_preservation": "Canonical workplan retains existing T05 and T06 state_hub_task_id lines absent from temporary review snapshot. Exact diff inspected; all remaining bytes equal.", + "integrated_at": "2026-10-16T15:27:02.282136+00:00", + "source_integrated": true, + "committed": true, + "published": true, + "native_accepted": false, + "scope": "Reviewed source only; native custody and admission remain open", + "commit": "2b064eee510640224274ccdc7cefceb1ae13162e", + "published_at": "2026-10-16T15:36:21.184252+00:00", + "publication": "Normal owner sync completed; exact commit verified ancestor of origin/main; unrelated dirty files preserved", + "sync": { + "bindings": 38, + "fail": 0, + "automation_error": 0, + "warnings": 10, + "info": 0 + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/approval-timestamp-precision/canonical-integration.json b/docs/changes/netkingdom-target-2026-10-16/approval-timestamp-precision/canonical-integration.json new file mode 100644 index 00000000..28e8d782 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/approval-timestamp-precision/canonical-integration.json @@ -0,0 +1,44 @@ +{ + "repo": "approval-engine", + "base": "3485415b823faf4f3b682079195e186666b0ed2b", + "patches": [ + { + "path": "approval-timestamp-precision/implementation.patch", + "sha256": "sha256:74eb0ff67d14508c2a2cee14d055790321ee171a96d5290ad6d037ce8f61dbcd" + }, + { + "path": "approval-timestamp-precision/owner-review-record.patch", + "sha256": "sha256:fd69252bfa12825158eb2333d4d3816a1cdde5f67b58e937dd4f8bd321627073" + }, + { + "path": "approval-timestamp-precision/formatting-r1/review-sha256-prefix.patch", + "sha256": "sha256:7ff222f5a0968d8b580382d21246c987f03990aa152aec6f61edeb3a367963be" + } + ], + "files_sha256": { + "adapters/go/approvalfact/README.md": "sha256:ac8f85d83c50a59c74a0d6ffa5f2bba9a414b2aab4e11a49c3dcc16e1b5201fc", + "approval_engine/store.py": "sha256:866b275ed2d844d0aa9090ce9899ce955c6bfe32a493c2645c86e72efa343e86", + "docs/approval-consumption.md": "sha256:31eee8a1a975bc1ad6a77ca0973208b2fc636c68cb0c748cb8aa666d5618be85", + "docs/reviews/2026-10-16-fractional-consumption-temporal-approval-owner-review.json": "sha256:2bfc6122456737918f5cf5f2c5f62eb30886b7ea911b601589ab08fc6225e98c", + "tests/test_timestamp_precision.py": "sha256:cbffa9265546a685b802702f5baf4e9d9ee822aaacab83c9a15c6c7316ee989b", + "workplans/APPROVAL-WP-0006-fractional-consumption-time.md": "sha256:fbaabd40ee6ab2283a1612d21a9317b55d85493af3394f27297f04c11e63010a" + }, + "receipt": "approval-timestamp-precision/canonical-integration.json", + "integrated_at": "2026-10-16T15:27:02.339937+00:00", + "source_integrated": true, + "committed": true, + "published": true, + "native_accepted": false, + "scope": "Reviewed source only; native custody and admission remain open", + "formatting_delta": "Approval owner reaffirmed seven sha256: prefixes only; exact digest bytes and review meaning preserved. Original scanner refusal retained; unchanged scanner passed final6blobs.", + "commit": "d40e842052f449ce2b5aa68abae1351720dbf41e", + "publication": "Normal fix-consistency pushed exact source commit;8/8 bindings;new WP0006/task IDs generated;zero failures/errors. Unrelated dirty workplans prevent exact whole-repository projection revision. Generated-only writeback commit refused and retained without bypass.", + "sync": { + "fail": 0, + "automation_error": 0, + "warn": 7, + "bindings": 8, + "source_revision": null, + "source_revision_reason": "dirty_workplans" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/approval-timestamp-precision/coordinator-counterexample.json b/docs/changes/netkingdom-target-2026-10-16/approval-timestamp-precision/coordinator-counterexample.json new file mode 100644 index 00000000..a4cdd026 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/approval-timestamp-precision/coordinator-counterexample.json @@ -0,0 +1,9 @@ +{ + "expired_fractional_approval_consumed": true, + "actual_clock": "2026-10-16T12:00:00.750000+00:00", + "approval_expiry": "2026-10-16T12:00:00.500000+00:00", + "recorded_consumed_at": "2026-10-16T12:00:00+00:00", + "scope": "isolated in-memory actual canonical Approval Engine; deterministic clock; no credentials/network", + "source_revision": "3485415b823faf4f3b682079195e186666b0ed2b", + "source_sha256": "sha256:cb1b4c92dc3f40c517fde60e7d3a1facac1286c146d76b79c1ba44630d224b7a" +} diff --git a/docs/changes/netkingdom-target-2026-10-16/checkpoint-sync-cd940b8.json b/docs/changes/netkingdom-target-2026-10-16/checkpoint-sync-cd940b8.json new file mode 100644 index 00000000..189e28c3 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/checkpoint-sync-cd940b8.json @@ -0,0 +1,14 @@ +{ + "source_revision": "cd940b87d4b3b0828413edfb64b2b63eadf5bf43", + "command": "statehub fix-consistency --repo the-custodian --no-writeback --json", + "session_id": 56115, + "terminal_exit": 0, + "bindings_synced": "89/89", + "pushed": true, + "fail": 0, + "automation_error": 0, + "warnings": 7, + "info": 4, + "generated_only_commit": "rejected by existing guard; preserved and not bypassed", + "scope": "source and workplan projection only; no native acceptance" +} diff --git a/docs/changes/netkingdom-target-2026-10-16/coordinator-source-review.json b/docs/changes/netkingdom-target-2026-10-16/coordinator-source-review.json index 9dfba15b..520d5c93 100644 --- a/docs/changes/netkingdom-target-2026-10-16/coordinator-source-review.json +++ b/docs/changes/netkingdom-target-2026-10-16/coordinator-source-review.json @@ -1,5 +1,5 @@ { - "checked_at": "2026-10-16T14:52:11.591469+00:00", + "checked_at": "2026-10-16T15:29:47.365221+00:00", "review_scope": "independent source reconstruction, focused regression tests and canonical integrated hash verification; not foreign owner approval or native acceptance", "checks": { "platform": { @@ -184,6 +184,94 @@ "operation ceiling, actual credential expiry and cleanup reserve require consistent owner contracts and absolute per-call enforcement" ], "acceptance": "actual retained-registry producer/consumer/native path; no empty registry, blind replay, timestamp waiver or implicit trust" + }, + "access_trusted_temporal_r2": { + "state": "focused independent source checks passed; pending successor integration", + "reconstruction": "/tmp/netkingdom-target-root-review/access-trusted-r2", + "patch_sha256": "sha256:f44fce1bc4190e70cf9488f7319f6384b723f4dd2e1e791a4a0d8ee2557d0f9b", + "command": "GOCACHE=/tmp/netkingdom-root-go-cache go test ./internal/decision ./cmd/access-engine -run 'TestTrusted(TaskWholeOperationLifetime|ServiceActualHTTPPositiveAndRefusals)' -count=1", + "result": "decision and command packages passed; exact operation deadline, cleanup reserve, source cap and original/fresh authority cases", + "retained_attempt": "initial command cwd was predecessor R1, where decision selection had no tests; corrected R2 command passed actual new tests" + }, + "approval_timestamp_precision": { + "state": "canonical defect independently reproduced; owner repair pending", + "evidence": "approval-timestamp-precision/coordinator-counterexample.json", + "result": "approval expiry .500, actual clock .750; native consume incorrectly succeeds after expiry and records whole-second timestamp", + "scope": "actual canonical in-memory Engine deterministic clock; no production probing" + }, + "access_trusted_r3": { + "result": "All seven affected Go packages passed independently", + "command": "go test ./cmd/access-engine ./internal/decision ./internal/taskexecution ./internal/sign ./internal/audit ./internal/emission ./internal/registry -count=1", + "reconstruction": "/tmp/netkingdom-target-root-review/access-trusted-r3", + "patch_sha256": "sha256:46bfeb706d3a88bf6054309cc9303eb360a91e57dda3b0fcbb7b80d551a75db6", + "native_accepted": false + }, + "secrets_trusted_r4": { + "result": "193 focused tests passed in20.31s", + "reconstruction": "/tmp/netkingdom-target-root-review/secrets-trusted-r4", + "patch_sha256": "sha256:759bf5c7b89169ddd32761d36ce1ae71735bb4c471213f5bbb8cd9af25350b86", + "owner_full_suite": "784passed16failed7skipped; exact16 failures reproduce on retained baseline", + "native_accepted": false + }, + "approval_precision_r1": { + "result": "98 tests passed in2.02s", + "reconstruction": "/tmp/netkingdom-target-root-review/approval-precision-r1", + "patch_sha256": "sha256:74eb0ff67d14508c2a2cee14d055790321ee171a96d5290ad6d037ce8f61dbcd", + "covers": [ + "timestamp precision", + "atomic consumption", + "independent confirmation", + "outbox", + "claim contract", + "human control" + ], + "native_accepted": false + }, + "platform_budget_r1": { + "result": "28 tests passed in129.95s", + "reconstruction": "/tmp/netkingdom-target-root-review/platform-budget-r1", + "commit": "76fdc0b861ec2ee7f6512dc5023ffc0cee5940f9", + "scope": "Absolute per-call and whole-operation deadlines, actual credential expiry and immutable source bytes; disposable fixture only" + }, + "platform_fullchain_r1": { + "result": "8 tests passed in128.41s", + "reconstruction": "/tmp/netkingdom-target-root-review/platform-fullchain-r1", + "patch_sha256": "sha256:a26c68ff224663129757fd43d0a5364762180131030e4dda22975935be89f99d", + "scope": "Real local Access and Approval services, strict Secrets R4, root-built binaries, actual retained registry and disposable OpenBao; synthetic distinct identities and admission", + "proves": [ + "Immediate precise CAS and authoritative GET before native effect", + "Six positive native calls, complete readback and cleanup", + "Signed DENY/ALLOW parity with durable source recording", + "Changed source, foreign caller, revoked approval, denied reader, registry drift and expiry refuse", + "Revocation after ALLOW before CAS permits zero native effect" + ], + "native_accepted": false + }, + "platform_signer_writer_r3": { + "result": "12 tests passed in12.14s on writer R2; R3 changes metadata only", + "reconstruction": "/tmp/netkingdom-target-root-review/platform-signer-r2", + "patch_sha256": "sha256:b0c190060f5a41d6002e1fb7b49f047fd4874a51576f29f3c127a8634c2616f6", + "metadata_delta_sha256": "sha256:a29cdbd2ac92fd09bc6c79144e9aeb84bb6abcd303df997c0f01c0223cf1a508", + "scope": "Disposable OpenBao, durable private receipt, exact KV CAS/readback, unknown outcomes retained; production entry deliberately unavailable", + "native_accepted": false + }, + "wave7_preflight": { + "result": "All four owner source reconstructions matched expected final bytes before owner mutations", + "retained_difference": "Access canonical workplan retains existing T05/T06 managed UUID lines absent in review snapshot; exact two-line diff inspected; no source behavior difference", + "scope": "Unrelated owner dirty files preserved" + }, + "approval_precision_publication_scan": { + "result": "First commit refused by unchanged scanner", + "blocked_file": "docs/reviews/2026-10-16-fractional-consumption-temporal-approval-owner-review.json", + "blocked_blob": "deefaac30c988de61ee26a08f29482ae76b39a0b", + "next_action": "Approval owner preparing explicit sha256 metadata formatting; no scanner bypass or review meaning change", + "resolution": "Approval owner prefix-only metadata repair; exact hashes/review meaning preserved. Unchanged normal scanner passed all6blobs;d40e842 published." + }, + "wave7_publication": { + "result": "All five new canonical commits published (budget plus four-owner wave); exact committed file hashes independently verified and commits are origin/main ancestors", + "native_accepted": false, + "approval_limit": "Whole-repository projection revision unavailable due to retained unrelated dirty workplans; generated-only writeback refused without bypass", + "platform_sync": "Exact7be8b6e applied at primary/railiance01;64records,12historical unresolvededges" } } } diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/canonical-integration-r4.json b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/canonical-integration-r4.json new file mode 100644 index 00000000..764e15cf --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/canonical-integration-r4.json @@ -0,0 +1,47 @@ +{ + "repo": "secrets-engine", + "base": "5a2099f400fb0c97fed2d991832c0e31513bbdfb", + "patches": [ + { + "path": "decision-trusted-successor/successor-r4-full.patch", + "sha256": "sha256:759bf5c7b89169ddd32761d36ce1ae71735bb4c471213f5bbb8cd9af25350b86" + } + ], + "files_sha256": { + "docs/task-execution-handoff.md": "sha256:ef049e0601a97bfcf41d8d639d85aa07e2f2bdd8b4c0dfd42b4a62b552c8e88a", + "docs/task-scoped-openbao-execution-contract.md": "sha256:54b4027ead9dde176d99305f5b21f6450305da7ec1a57f212fd694d7ba74ef12", + "src/secrets_engine/approval_consume.py": "sha256:4e3de16ed77bca3023993065556edd635d35073668f1a3b0d079284969111d37", + "src/secrets_engine/decision_signature.py": "sha256:74a9caa43f93aae5c9e945c0a872c0e58c83aea00e9b970a4dbda673af2df805", + "src/secrets_engine/execution_contract.py": "sha256:ca62bfb1716c0e882eac6512320b127405511affdc1ebd46f9496ce030c0ed01", + "src/secrets_engine/task_execution_handoff.py": "sha256:f673443dc5f3a796a09db5ad51bcdf59d83d718cc00912489dbb8d43df95aefe", + "tests/fixtures/pdp-signature/approval-native-vectors.json": "sha256:fbfe3726d9ba2cffd8cc5d35aa6a0cf0729e5b3f1a684ade36d25dccb53d240a", + "tests/test_execution_context.py": "sha256:ee633f5638c3b9972bd2865ae106975a129f1af557d41718841a13dd2a8ab26b", + "tests/test_task_approval_preparation.py": "sha256:10c2de83f6cc5a6d7dfdefd0214da7f51b82c51aa0cd55ab679da685787af0f7", + "tests/test_trusted_successor.py": "sha256:a167cfc7a7445c5631b607aa8a2ae8bf5cae0ac47219eda8244d5e1833399ddb", + "verifier/README.md": "sha256:b6b96e097503e04e4407836e973159dd1ff09c5654f4378fbc95b1f214b6c77f", + "verifier/internal/sign/sign.go": "sha256:0df9515922e90775ebbfac798361dcafb20da8a4213796b44e246b8a92046cde", + "verifier/main.go": "sha256:8cb508d7e6d3692cfb7ea1c386ff0354c550ad9be1707d251f0db8b3b6411448", + "verifier/pkg/api/canonical.go": "sha256:a122a2e8cd524333b13c5939c7a3685e41efbe47497a64e0c7297c92b7f10d19", + "verifier/producer-source.json": "sha256:7be4a07c11ca2d8610736b768c39a2611533fb72e87e75980cd9ae4673620124", + "verifier/testsupport/signer/main.go": "sha256:8e1e90a00622ab01ff8f9aae5d93a05a14304cecc6c011c48b9927299b80a304", + "workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md": "sha256:04c9f7432216205b0ded3abc49042988e7730d1a3014f919d60456192fa7fd6c", + "workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md": "sha256:4b9e6f2acb9bd1f085331ac9152ec2658bc0aefd43fd51152a8d535a0073187c" + }, + "receipt": "decision-trusted-successor/canonical-integration-r4.json", + "integrated_at": "2026-10-16T15:27:02.313142+00:00", + "source_integrated": true, + "committed": true, + "published": true, + "native_accepted": false, + "scope": "Reviewed source only; native custody and admission remain open", + "commit": "4dd004a2250104ba56293b2d7b0d96f4e076ea99", + "published_at": "2026-10-16T15:36:21.266223+00:00", + "publication": "Normal owner sync completed; exact commit verified ancestor of origin/main; unrelated dirty files preserved", + "sync": { + "bindings": 16, + "fail": 0, + "automation_error": 0, + "warnings": 5, + "info": 1 + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/platform-signer-custody/canonical-integration-r3.json b/docs/changes/netkingdom-target-2026-10-16/platform-signer-custody/canonical-integration-r3.json new file mode 100644 index 00000000..0f837b49 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/platform-signer-custody/canonical-integration-r3.json @@ -0,0 +1,51 @@ +{ + "repo": "railiance-platform", + "base": "76fdc0b861ec2ee7f6512dc5023ffc0cee5940f9", + "patches": [ + { + "path": "protected-execution-trusted-successor/fullchain-r1/implementation.patch", + "sha256": "sha256:a26c68ff224663129757fd43d0a5364762180131030e4dda22975935be89f99d" + }, + { + "path": "platform-signer-custody/writer-r2/implementation.patch", + "sha256": "sha256:b0c190060f5a41d6002e1fb7b49f047fd4874a51576f29f3c127a8634c2616f6" + }, + { + "path": "platform-signer-custody/writer-r3/r2-to-r3.patch", + "sha256": "sha256:a29cdbd2ac92fd09bc6c79144e9aeb84bb6abcd303df997c0f01c0223cf1a508" + } + ], + "files_sha256": { + "docs/credential-lane-designs/flex-auth-envelope-signing-policy.hcl.proposed": "sha256:a8ae0ea97e5bde8a9e5d785fc87b8095e4cc24b5fcf358a4b7b1568ab1dd07ee", + "docs/credential-lane-designs/flex-auth-envelope-signing-projection.yaml.proposed": "sha256:74be3565948d4a70c5b01c24d2e5886c06e8c1a884e4e355517cbcf77a03f514", + "docs/credential-lane-designs/flex-auth-envelope-signing.md": "sha256:35a2ad5b86e54c5432eeb28f755086f057ba889a44412ab83ac1a52ea8548ac6", + "docs/credential-lane-designs/flex-auth-envelope-signing.proposal.json": "sha256:de7855693c424246c2e6c63e5b15f1d5d4509e6b64f3f1b234d10e675525d314", + "docs/task-execution-native-fixture.md": "sha256:055cc0c00fb18e90f0421512737687a0634279f630b4a483b0524b0c6102b5f6", + "scripts/flex_auth_signer_custody.py": "sha256:8ed281a49c1f1cdb23772efe3593e75c62572a12b8d7a6a4c574f27b38722e75", + "tests/task_execution_trusted_servers.py": "sha256:bdaf847b882ef570cd01bb84b338225d61281f949d72cee9c91cb556d04719d7", + "tests/test_flex_auth_signer_custody.py": "sha256:cd47c33bda7a2a18808e0daa027e8a66b2a55eaf0ee79e603337f3c2eb2c3761", + "tests/test_task_execution_trusted_whole.py": "sha256:55040c7c4c89d62818308d75c81c071e1292ed83425e4124d18b8ba5e2d2c22a", + "workplans/RPF-WP-0035-credential-lane-implementation.md": "sha256:d3cbe2ba5e344c1e8fc7e9f422d89030616b98abd53df4b9327f44fcaca865d3" + }, + "receipt": "platform-signer-custody/canonical-integration-r3.json", + "integrated_at": "2026-10-16T15:27:02.380693+00:00", + "source_integrated": true, + "committed": true, + "published": true, + "native_accepted": false, + "scope": "Reviewed source only; native custody and admission remain open", + "commit": "7be8b6e76d602a5306052f9e42881fbea250ede8", + "published_at": "2026-10-16T15:36:21.316228+00:00", + "publication": "Normal owner sync completed; exact commit verified ancestor of origin/main; unrelated dirty files preserved", + "sync": { + "status": "applied", + "instance_role": "primary", + "instance_label": "railiance01", + "expected_commit": "7be8b6e76d602a5306052f9e42881fbea250ede8", + "derived_commit": "7be8b6e76d602a5306052f9e42881fbea250ede8", + "records": 64, + "unresolved_historical_edges": 12, + "ahead": 0, + "behind": 0 + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/protected-execution-trusted-successor/canonical-integration.json b/docs/changes/netkingdom-target-2026-10-16/protected-execution-trusted-successor/canonical-integration.json new file mode 100644 index 00000000..941360af --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/protected-execution-trusted-successor/canonical-integration.json @@ -0,0 +1,20 @@ +{ + "repo": "railiance-platform", + "base_commit": "b9eaa200601f1226d13efe82472dfec81c2999aa", + "patch_sha256": "sha256:7c17f607dacc9ed4f24fd8032ddac5f4fc9ae2f24555cf87a0b73c871ec8eb19", + "integrated_at": "2026-10-16T15:14:08.764520+00:00", + "files_sha256": { + "scripts/task_execution_native_fixture.py": "sha256:6d4e4132cd749aafd07c608c261902a2c347a9782f51fe275466f5bb800c68e8", + "scripts/task_execution_mediator.py": "sha256:2951093d9ae86064018098c4ccd763af47d93599f9f0671376ffca114824c0fd", + "tests/test_task_execution_native_budget.py": "sha256:8ebd920f509258a41f3a34a4cc5b3897bc7496229dedd9f3c8c545525d7cf3d4", + "docs/task-execution-native-fixture.md": "sha256:2c6ce199364b9a5a69544553dfeea4a897b642caf768d5d5f2784a88a64dd618", + "workplans/RPF-WP-0035-credential-lane-implementation.md": "sha256:0739fca0207fcecb4c7ffa7d9a671a11804fa6ae0c3005948c6e3d278b8b7dd3" + }, + "source_integrated": true, + "committed": true, + "published": true, + "native_accepted": false, + "review_scope": "Independent28tests pass; subsequent wholechain proof recorded separately; no production admission", + "commit": "76fdc0b861ec2ee7f6512dc5023ffc0cee5940f9", + "publication": "Normal rmgr sync --push applied exact commit at primary/railiance01;64 records,12 historical unresolved edges; ahead/behind0" +} diff --git a/docs/changes/netkingdom-target-2026-10-16/source-wave-status.json b/docs/changes/netkingdom-target-2026-10-16/source-wave-status.json index 67ec9976..43203ef0 100644 --- a/docs/changes/netkingdom-target-2026-10-16/source-wave-status.json +++ b/docs/changes/netkingdom-target-2026-10-16/source-wave-status.json @@ -1,6 +1,6 @@ { "schema": "custodian.netkingdom-source-wave.v1", - "observed_at": "2026-10-16T14:52:11.590806+00:00", + "observed_at": "2026-10-16T15:38:05.312185+00:00", "coordinator": "CUST-WP-0080-T06", "source_slices": [ { @@ -162,6 +162,87 @@ "patch_sha256": "sha256:61f516c876fd612b83300e9913f0e80aad836a50014310797913c7c4505e3114", "published": true, "native_accepted": false + }, + { + "repo": "railiance-platform", + "slice": "protected-execution-budget", + "commit": "76fdc0b861ec2ee7f6512dc5023ffc0cee5940f9", + "published": true, + "native_accepted": false, + "receipt": "protected-execution-trusted-successor/canonical-integration.json", + "patch_sha256": "sha256:7c17f607dacc9ed4f24fd8032ddac5f4fc9ae2f24555cf87a0b73c871ec8eb19" + }, + { + "repo": "access-engine", + "slice": "trusted-task-source-r3", + "commit": "2b064eee510640224274ccdc7cefceb1ae13162e", + "published": true, + "native_accepted": false, + "receipt": "access-native-source/b2-b3/r3/canonical-integration.json", + "patches": [ + { + "path": "access-native-source/b2-b3/r3/trusted-source-r3-over-b1-r2.patch", + "sha256": "sha256:46bfeb706d3a88bf6054309cc9303eb360a91e57dda3b0fcbb7b80d551a75db6" + } + ] + }, + { + "repo": "secrets-engine", + "slice": "trusted-task-consumer-r4", + "commit": "4dd004a2250104ba56293b2d7b0d96f4e076ea99", + "published": true, + "native_accepted": false, + "receipt": "decision-trusted-successor/canonical-integration-r4.json", + "patches": [ + { + "path": "decision-trusted-successor/successor-r4-full.patch", + "sha256": "sha256:759bf5c7b89169ddd32761d36ce1ae71735bb4c471213f5bbb8cd9af25350b86" + } + ] + }, + { + "repo": "approval-engine", + "slice": "fractional-consumption-time", + "commit": "d40e842052f449ce2b5aa68abae1351720dbf41e", + "published": true, + "native_accepted": false, + "receipt": "approval-timestamp-precision/canonical-integration.json", + "patches": [ + { + "path": "approval-timestamp-precision/implementation.patch", + "sha256": "sha256:74eb0ff67d14508c2a2cee14d055790321ee171a96d5290ad6d037ce8f61dbcd" + }, + { + "path": "approval-timestamp-precision/owner-review-record.patch", + "sha256": "sha256:fd69252bfa12825158eb2333d4d3816a1cdde5f67b58e937dd4f8bd321627073" + }, + { + "path": "approval-timestamp-precision/formatting-r1/review-sha256-prefix.patch", + "sha256": "sha256:7ff222f5a0968d8b580382d21246c987f03990aa152aec6f61edeb3a367963be" + } + ] + }, + { + "repo": "railiance-platform", + "slice": "trusted-wholechain-and-signer-writer", + "commit": "7be8b6e76d602a5306052f9e42881fbea250ede8", + "published": true, + "native_accepted": false, + "receipt": "platform-signer-custody/canonical-integration-r3.json", + "patches": [ + { + "path": "protected-execution-trusted-successor/fullchain-r1/implementation.patch", + "sha256": "sha256:a26c68ff224663129757fd43d0a5364762180131030e4dda22975935be89f99d" + }, + { + "path": "platform-signer-custody/writer-r2/implementation.patch", + "sha256": "sha256:b0c190060f5a41d6002e1fb7b49f047fd4874a51576f29f3c127a8634c2616f6" + }, + { + "path": "platform-signer-custody/writer-r3/r2-to-r3.patch", + "sha256": "sha256:a29cdbd2ac92fd09bc6c79144e9aeb84bb6abcd303df997c0f01c0223cf1a508" + } + ] } ], "integrity_note": "Canonical owner commits are the durable source. Raw patches and temporary reconstructions are workspace-local review artifacts; their hashes retain revision identity. No runtime admission follows from these commits.", diff --git a/docs/netkingdom-target-implementation.md b/docs/netkingdom-target-implementation.md index fcba4c63..e9699406 100644 --- a/docs/netkingdom-target-implementation.md +++ b/docs/netkingdom-target-implementation.md @@ -13,7 +13,7 @@ GPT-6.1-Sol medium subagent request. The full architecture remains the goal. | TSA-04 | NetKingdom / Mason / Warden / KeyCape; NK-WP-0048 | Browser evidence checker, Warden pinned metadata validation and Mason versioned source selection published | Admitted machine descriptors, real owner receipts and consumer acceptance | | TSA-05 | KeyCape / User / NetKingdom / Playwright; KEY-WP-0040, NK-WP-0050, CUST-WP-0080-T05 | Native human and agent journey gates open | Actual recovery and browser consumer acceptance | | TSA-06 | Glas / Sand-boxer / rein / Platform / Forge; CUST-WP-0073, GLAS-WP-0012 | Workload-only credential delivery published; disposable bwrap proof reproduced; actual assignment and runner proof open | Admitted corrected runtime, combined rein acceptance and actual assignment migration | -| TSA-07–08 | Secrets / NetKingdom / Platform; NK-WP-0049 and existing lifecycle plans | Inventory, lifecycle and independent recovery incomplete | Metadata denominator, elimination candidates, scoped recovery and lifecycle receipts | +| TSA-07–08 | Secrets / NetKingdom / Platform; NK-WP-0049 and existing lifecycle plans | Inventory/lifecycle incomplete; actual independent identity archive recovery verified 16 October | Complete service authentication, existing-token decryption and audit continuity; metadata denominator, elimination candidates and lifecycle receipts | | TSA-09 | Audit / emitting owners; Approval T04 and current Audit work | Delivered custody; current source admission/reconciliation incomplete | Source/effect/outbox/receiver readback for first protected operation | | TSA-10 | Forge / Repo Manager; FORGE-WP-0006, RMGR-WP-0021 | Broad receive coverage delivered; other paths and response incomplete | Coverage/reliability gaps and private response acceptance | | TSA-11 | Reuse / provider owners | 70/70 discovery verified 15 October; stale descriptive fields remain | Correct source metadata and repeat drift/hosted checks | @@ -153,16 +153,79 @@ remain unadmitted. Whole-stack successor work exposed a temporal contradiction: the first v2 source allowed 15 seconds while native token lifetime requires at least 30 seconds plus -cleanup reserve. Owner temporal revision now binds expiry to the exact operation -deadline within declared hard limits and all original/fresh/caller authority; -it is pending independent integration. Retained registry enrichment also needs -exact approval-free digest correspondence. Empty-registry proof cannot close that -gate. Immediate consumption also exposed a precision mismatch: Approval receipts -use whole seconds while the new decision start has fractional precision. A -positive proof that waits across that boundary does not establish immediate-path -acceptance; the producer owners are resolving it without weakening verification. +cleanup reserve. Integrated Access `2b064ee` now binds expiry to the exact operation +deadline within declared hard limits and all original/fresh/caller authority. +Its signed, claim-free DENY supplies producer-evaluated approval facts under the +existing enrichment contract; Secrets `4dd004a` verifies them before approval +preparation. This receipt grants no execution authority. Final evaluation refuses +registry drift instead of silently changing an approved request. Exact producer +numeric types survive verification and recording without a copied normalizer. + +Approval `d40e842` preserves fractional time and uses one post-lock timestamp for +validity, consumption and its outbox event. The immediate path needs no sleep, +backdating or consumer tolerance. Independent verification passed all seven +affected Access Go packages, 193 focused Secrets tests and 98 Approval tests. +Platform `76fdc0b` adds absolute call/operation/credential deadlines and exact +source-byte checks; 28 independent tests passed. Platform `7be8b6e` adds the +complete successor proof: all eight independent tests passed using real local +Access and Approval services, retained registry, strict Secrets verification and +disposable OpenBao. The positive case verifies six native calls, complete readback, +cleanup and signed source-record parity; refusal cases preserve zero effect. +These use synthetic admission and do not establish production acceptance. All sixteen target acceptance gates remain open. +The independent [identity archive recovery receipt](../../net-kingdom/docs/evidence/2026-10-16-identity-backup-live/actual-full-recovery-review.json) +now proves artifact integrity, original key pairs, SQLite integrity, native +PostgreSQL restore and cleanup. It explicitly does not prove full service +authentication, existing-token decryption or audit signature continuity. Reuse +that completed archive proof and drive the remaining native service recovery; +TSA-08 remains open. + +Coordinator review independently reproduced a second timestamp failure in the +canonical Approval Engine: a fractional expiry at `.500` was consumed at actual +clock `.750`, while `consumed_at` reported the whole second. The isolated +[counterexample](changes/netkingdom-target-2026-10-16/approval-timestamp-precision/coordinator-counterexample.json) +is retained alongside the verified repair in `d40e842`; expiry remains exclusive, +including when the database lock is acquired after the deadline. The original +publication scanner refusal is also retained: the Approval owner labeled seven +public SHA-256 references explicitly, preserving digest bytes and review meaning. +The unchanged scanner then passed all six committed files. + +The same Platform revision includes a bounded signer custody primitive and an +explicitly proposed custody design. Twelve independent tests passed against +disposable OpenBao. Exact KV CAS/readback, a private durable receipt before effect +and retained uncertainty are source properties. Production execution deliberately +remains unavailable pending an admitted adapter, independent owner reviews and +the exact custody decision. No key, credential grant or live deployment was made. + +## Next native admission work + +Use existing owner paths and retain the deployed lifecycle policy while preparing +the first native acceptance package. The task-execution pilot remains unadmitted. + +- Access owns an immutable image, signer projection, retained caller binding and + durable outbox. Metadata inspection found no existing namespace PVC. A proposed + 1 GiB local-path claim is new storage; its requested capacity is not a filesystem + quota. OS-enforced single-writer locking, bounded append/startup and fail-closed + storage failure behavior are being implemented in the existing outbox. Recreate + with one pod alone does not establish those properties. +- Platform owns proposed CCR-2026-0050 for the exact read lane, separate attended + signer writing, fencing and private recovery receipts. Native role naming must + satisfy the real delegated-applier policy. The current free-text Warden plan + selected a survey route instead of the required admin-login route; preserve that + dispatch mismatch as a blocker rather than silently choosing another credential. +- Secrets owns the release bundle, fixed verifier, independently admitted public + trust and actual caller delivery. Clean installation and lifecycle ALLOW/DENY + capture are preparatory evidence; they do not establish effects at the inventoried + eleven privileged call sites across ten handlers. Those effects remain unaccepted. +- Retained Access deployment lacks an established managed-package identity tuple. + Resolve that with the package owner; another application's declaration cannot + supply its authority. Native audit receiver reconciliation also remains required. + +The [source wave receipt](changes/netkingdom-target-2026-10-16/source-wave-status.json) +records exact publication and synchronization results. Temporary review checkouts +and agent handles remain preparation artifacts, not runtime deployments. + ## Dependency and residual handling The current implementation demand selects necessary target dependencies for diff --git a/docs/netkingdom-target-security-architecture.md b/docs/netkingdom-target-security-architecture.md index e6e6573c..cddb984f 100644 --- a/docs/netkingdom-target-security-architecture.md +++ b/docs/netkingdom-target-security-architecture.md @@ -89,6 +89,13 @@ tenant, action, target, payload/source digest, policy revision, approval binding and catalog fingerprint. Exact envelope field names and canonical bytes come from the owner contracts, not a second Custodian schema. +When producer-owned enrichment changes the facts to be approved, obtain and +authenticate those exact evaluated facts before human approval. A signed refusal +may carry such preparation facts, but grants no effect or retry authority. Final +evaluation must still bind the original request and approved facts, and refuse +drift. Preserve producer numeric types and timestamp precision across languages; +the Approval owner checks current validity after acquiring its consumption lock. + Readiness and durable reservation are established before spending the approval. The journal records consume and confirmation call intents before each request; independent authoritative confirmation precedes the protected effect. Approval diff --git a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md index 61ab7a94..36918495 100644 --- a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md +++ b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md @@ -689,3 +689,22 @@ match their owner commits and every commit is an ancestor of origin/main. The actual immediate-consumption path also exposes whole-second Approval receipt precision against fractional decision start times; owner resolution is required. Access, Secrets and Platform continue the retained-registry end-to-end repair. + +Coordinator independently reproduced expired fractional Approval consumption +against canonical `3485415`: expiry .500, actual clock .750, consumed_at .000. +Owner repair is part of the protected-operation gate. NK-WP-0049 now supplies +actual independent identity archive recovery evidence; remaining service +authentication, token decryption and audit continuity are still required. + +2026-10-16 successor source integration: Access `2b064ee` and Secrets `4dd004a` +now preserve producer-evaluated approval facts and exact numeric types across the +retained-registry join. Approval `d40e842` fixes fractional expiry with a single +post-lock instant; the original counterexample and scanner refusal are retained. +Platform `76fdc0b` adds absolute budgets; `7be8b6e` supplies the complete successor +proof and bounded signer custody source. Root independently passed seven affected +Go packages, 193 Secrets tests, 98 Approval tests, 28 budget tests, eight complete +provider-to-OpenBao cases and twelve disposable signer tests (overlapping suites, +not an estate coverage score). Native issuer/key/grant/deployment/audit gates stay +open. Access outbox process locking and capacity limits, Platform exact native +writer preparation, and Secrets immutable release/install proof are active owner +follow-through. No existing PVC or managed-package identity is assumed.