Record failed runtime trial and reviewed verification proposal (4/4)
This commit is contained in:
codex
parent
4016f3bdee
commit
c034f59bef
17 changed files with 1193 additions and 0 deletions
|
|
@ -878,6 +878,134 @@
|
|||
"verified_at": "2026-10-17T01:55:19.742775+00:00",
|
||||
"verified_outcome": "Exactapprovedrevision2 deliveredHelm77; eightactualrollback/interceptedcasespass, all18CURRENTfullrows equalafterrolloutandnormalpipeline; archives/stagedworkpreserved. Originalthreeparentfailure retainedasfounder-approvedhistoricalexception, notrestored/backfilled.",
|
||||
"recovery_required": false
|
||||
},
|
||||
{
|
||||
"proposal_id": "REINAH-WP-0008-T07-install-f599-r1",
|
||||
"disposition": "accepted_revised",
|
||||
"outcome": "failed",
|
||||
"proposal_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/FINAL-PROPOSAL.md",
|
||||
"original_revision": 1,
|
||||
"original_digest_sha256": "408d779a19e0e83b3be9a80ad624c1f7b7be906d22c0a8efe6e629185cc0cd0a",
|
||||
"original_digest": "408d779a19e0e83b3be9a80ad624c1f7b7be906d22c0a8efe6e629185cc0cd0a",
|
||||
"current_revision": 3,
|
||||
"current_digest_sha256": "7d5741abc7da042d4de6cd36437801309b844760f606b3145d615fd75d6b2d30",
|
||||
"target": "railiance01/92.205.62.239 account tegwick UID/GID1000; exact protected runtimes store and new f599 immutable digest directory",
|
||||
"expected_result": "Exact dormant artifact append with full extracted/installed/post-rehearsal f599 digest equality; three credential-free empty-egress launcher checks pass; positively quiesced owned processes and staging gone. No provider, owner/catalog/profile/queue changes or native security-gate closure.",
|
||||
"verification_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/installed-partial-verification.json",
|
||||
"planned_execution_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/execution-receipt.json",
|
||||
"rollback_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/FINAL-PROPOSAL.md",
|
||||
"cost_estimate_eur": null,
|
||||
"risk_estimate_eur": null,
|
||||
"cost_estimate": "Zero provider requests and no new paid resource; infrastructure/energy/operator EUR cost unknown, explicitly supervised.",
|
||||
"risk_estimate": "Shared single-node CPU/IO interruption and recovery EUR loss unknown; exact fresh headroom, private process supervision and conditional staging cleanup required. Installed digest retained inactive on partial failure.",
|
||||
"supervisor": "Bernd Worsch",
|
||||
"approval_ref": "b6abb6ab-b182-4b4f-9f84-79ddc5ad91f3",
|
||||
"approved_revision": 2,
|
||||
"approved_digest_sha256": "44b17589c323e1a966caf6c1b1def123092ee289b929c8ea014bc84109103b1d",
|
||||
"executed_revision": 2,
|
||||
"executed_digest_sha256": "44b17589c323e1a966caf6c1b1def123092ee289b929c8ea014bc84109103b1d",
|
||||
"refinement_or_rescue": true,
|
||||
"promotion_evidence": false,
|
||||
"reason": "R1 held after root found descendant cleanup gap; founder approved exact R2 and it was executed once. R2 was partial/failed and requires review of separately prepared R3. No approval or success inferred for R3.",
|
||||
"revision_history": [
|
||||
{
|
||||
"revision": 1,
|
||||
"digest_sha256": "408d779a19e0e83b3be9a80ad624c1f7b7be906d22c0a8efe6e629185cc0cd0a",
|
||||
"outcome": "not_executed",
|
||||
"disposition": "not_submitted_or_unadjudicated",
|
||||
"root_review": "needs_refinement_descendant_cleanup"
|
||||
},
|
||||
{
|
||||
"revision": 2,
|
||||
"digest_sha256": "44b17589c323e1a966caf6c1b1def123092ee289b929c8ea014bc84109103b1d",
|
||||
"manifest_sha256": "aea5dbfe0742fe0bb6c36a41ca7b0d70473683b2731f92cc279d43929e5c35c9",
|
||||
"outcome": "failed",
|
||||
"disposition": "accepted_revised",
|
||||
"root_review": "accepted_for_founder_submission_after_independent_source_review_and_two_process_oracles",
|
||||
"approval_ref": "b6abb6ab-b182-4b4f-9f84-79ddc5ad91f3",
|
||||
"executed_digest_sha256": "44b17589c323e1a966caf6c1b1def123092ee289b929c8ea014bc84109103b1d",
|
||||
"execution_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/execution-receipt.json",
|
||||
"verification_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/installed-partial-verification.json"
|
||||
},
|
||||
{
|
||||
"revision": 3,
|
||||
"digest_sha256": "7d5741abc7da042d4de6cd36437801309b844760f606b3145d615fd75d6b2d30",
|
||||
"manifest_sha256": "19d3a74b124a9a7236bd4b8f6fe45656b4651d875017486f0dfa515f3f81d806",
|
||||
"outcome": "not_executed",
|
||||
"disposition": "accepted_revised",
|
||||
"root_review": "source_review_and_five_focused_root_checks_passed",
|
||||
"approval_ref": "bec667cc-15ea-4f87-ae16-111f08562e48",
|
||||
"approved_at": "2026-10-17T10:57:39.975862+00:00",
|
||||
"preflight": "refused_cpu_headroom_0.99248; zero native mutation"
|
||||
}
|
||||
],
|
||||
"pending_decision_ref": null,
|
||||
"approved_at": "2026-10-17T08:34:32.549418+00:00",
|
||||
"approval_record_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/approval-decision.json",
|
||||
"supervisor_disposition": "Founder approved exact R3; fresh read-only preflight refused CPU headroom before any remote write/launch. Completed R2 failed outcome and its approval/execution remain the scored trial state; latest R3 approval is retained separately. No authority promotion or automatic retry.",
|
||||
"execution_started_at": "2026-10-17T08:35:10.440830+00:00",
|
||||
"execution_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/execution-receipt.json",
|
||||
"execution_phase": "completed_failed_partial_install_independently_verified",
|
||||
"approved_digest": "44b17589c323e1a966caf6c1b1def123092ee289b929c8ea014bc84109103b1d",
|
||||
"executed_digest": "44b17589c323e1a966caf6c1b1def123092ee289b929c8ea014bc84109103b1d",
|
||||
"verified_outcome": "R2 installed exact inactive f599; independent readback verified full digest and owned staging absence. Three-launcher proof failed with phase_receipt_unavailable/leader_left_descendants. R2 watchdog receipt reports positive process quiescence; erased process trace prevents independent retrospective process classification. Native launcher acceptance remains unverified. No automatic retry.",
|
||||
"failure_receipt_sha256": "sha256:59969ad9992ac289a553e1076209ba0d04b6fa7cd171bfad83dcc1f96d80a1c6",
|
||||
"failure_cause_limit": "R2 source zombie-classification bug reproduced locally; native trace removed, so causal attribution of this native failure remains unproven.",
|
||||
"pending_revision": {
|
||||
"revision": 3,
|
||||
"digest_sha256": "7d5741abc7da042d4de6cd36437801309b844760f606b3145d615fd75d6b2d30",
|
||||
"manifest_sha256": "19d3a74b124a9a7236bd4b8f6fe45656b4651d875017486f0dfa515f3f81d806",
|
||||
"proposal_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/FINAL-PROPOSAL.md",
|
||||
"disposition": "accepted_revised",
|
||||
"outcome": "not_executed",
|
||||
"target": "railiance01/tegwick existing inactive f599; new exact verification staging and durable public precleanup receipt",
|
||||
"expected_result": "All three unchanged empty-egress offline launcher commands exit zero, full f599 digest before/after, durable public receipt before positive-quiescence conditional cleanup. No installation, model call, credential/profile/queue change or gate closure.",
|
||||
"verification_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/FINAL-PROPOSAL.md",
|
||||
"rollback_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/FINAL-PROPOSAL.md",
|
||||
"cost_estimate_eur": null,
|
||||
"risk_estimate_eur": null,
|
||||
"cost_risk_note": "Zero provider calls/new paid resources; infrastructure/operator cost and interruption loss EUR UNKNOWN. Fresh exact supervised exposure approval required.",
|
||||
"root_review_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/root-review.json",
|
||||
"decision_ref": "bec667cc-15ea-4f87-ae16-111f08562e48",
|
||||
"approval_ref": "bec667cc-15ea-4f87-ae16-111f08562e48",
|
||||
"approved_at": "2026-10-17T10:57:39.975862+00:00"
|
||||
},
|
||||
"execution_attempts": [
|
||||
{
|
||||
"revision": 2,
|
||||
"approved_revision": 2,
|
||||
"approved_digest_sha256": "44b17589c323e1a966caf6c1b1def123092ee289b929c8ea014bc84109103b1d",
|
||||
"approval_ref": "b6abb6ab-b182-4b4f-9f84-79ddc5ad91f3",
|
||||
"executed_digest_sha256": "44b17589c323e1a966caf6c1b1def123092ee289b929c8ea014bc84109103b1d",
|
||||
"outcome": "failed",
|
||||
"execution_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/execution-receipt.json",
|
||||
"verification_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/installed-partial-verification.json",
|
||||
"verified_outcome": "R2 installed exact inactive f599; independent readback verified full digest and owned staging absence. Three-launcher proof failed with phase_receipt_unavailable/leader_left_descendants. R2 watchdog receipt reports positive process quiescence; erased process trace prevents independent retrospective process classification. Native launcher acceptance remains unverified. No automatic retry.",
|
||||
"failure_receipt_sha256": "sha256:59969ad9992ac289a553e1076209ba0d04b6fa7cd171bfad83dcc1f96d80a1c6"
|
||||
}
|
||||
],
|
||||
"next_execution": {
|
||||
"revision": 3,
|
||||
"digest_sha256": "7d5741abc7da042d4de6cd36437801309b844760f606b3145d615fd75d6b2d30",
|
||||
"status": "approved_read_only_preflight_refused_cpu_headroom",
|
||||
"execution_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/execution-receipt.json",
|
||||
"approval_ref": "bec667cc-15ea-4f87-ae16-111f08562e48",
|
||||
"approval_record_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/approval-decision.json",
|
||||
"preflight_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/approved-preflight.json",
|
||||
"native_mutations": 0,
|
||||
"launcher_calls": 0,
|
||||
"automatic_polling_or_retry": false
|
||||
},
|
||||
"latest_approval": {
|
||||
"decision_id": "bec667cc-15ea-4f87-ae16-111f08562e48",
|
||||
"approved_at": "2026-10-17T10:57:39.975862+00:00",
|
||||
"approved_revision": 3,
|
||||
"approved_digest_sha256": "7d5741abc7da042d4de6cd36437801309b844760f606b3145d615fd75d6b2d30",
|
||||
"approval_source": "Actual user response: Approve exact revision 3",
|
||||
"status": "resolved",
|
||||
"decided_by": "Bernd Worsch",
|
||||
"scope": "Founder actual conversation reply: Approve exact revision 3. Approval is bound only to stable proposal REINAH-WP-0008-T07-install-f599-r1 revision3 SHA256 7d5741abc7da042d4de6cd36437801309b844760f606b3145d615fd75d6b2d30, verification-only of installed inactive f599, unchanged three empty-egress launcher commands, repaired dead-zombie handling, exclusive durable public precleanup receipt, fresh exact guards and reviewed conditional cleanup. Unknown infrastructure/operator EUR cost and interruption/recovery loss EUR explicitly accepted only for this supervised action. No reinstall/model/credential/profile/catalog/queue changes or autopilot grant. R2 failed partial outcome retained in the same trial."
|
||||
}
|
||||
}
|
||||
],
|
||||
"trials": [
|
||||
|
|
|
|||
|
|
@ -0,0 +1,74 @@
|
|||
# KEY39 finalization: infrastructure review
|
||||
|
||||
**Source work is complete; native T02 is not yet complete.** Keep the parent
|
||||
active. No new source protocol, policy gate or renewed source/registration
|
||||
approval is needed.
|
||||
|
||||
| Existing task | Current status | Evidence |
|
||||
|---|---|---|
|
||||
| KEY39-T01 design | done | [workplan:50](/home/worsch/key-cape/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md:50) |
|
||||
| KEY39-T02 native probes | wait | [workplan:100](/home/worsch/key-cape/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md:100) |
|
||||
| KEY39-T03 source inspection | done | [workplan:146](/home/worsch/key-cape/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md:146) |
|
||||
|
||||
The latest Platform ready-v9/handoff-v4 review is approved **source-only**:
|
||||
[scope:32](/home/worsch/railiance-platform/docs/reviews/2026-10-11-key39-ready-pair-v9-v4-platform-review.json:32).
|
||||
Its135 checks expressly contain no actual SSH/network/Kubernetes/credential/native
|
||||
action [result:74](/home/worsch/railiance-platform/docs/reviews/2026-10-11-key39-ready-pair-v9-v4-platform-review.json:74).
|
||||
All14 reviewed executable/test/producer-decision files and all3 Platform source
|
||||
pins match current bytes. Only the included KEY39 workplan hash differs, with
|
||||
later progress/owner-return text in its current chronology; the old staged
|
||||
workplan is unavailable, so no exact historical text diff is claimed.
|
||||
[current-pins.json](current-pins.json) retains the exact comparisons. Do not
|
||||
reopen corrected lifecycle/ready/delivery defects or rerun broad tests; bind
|
||||
coherent exact inputs when the existing execution packet is finalized.
|
||||
|
||||
Credit existing native evidence without enlarging it: CCR0038's founder apply
|
||||
and readback are complete, not a new apply task
|
||||
[CCR:103](/home/worsch/railiance-platform/credential-change-requests/CCR-2026-0038-secrets-engine-service-jwt-login.yaml:103).
|
||||
The7 October service-client receipt proves issuer registration/custody/issuance
|
||||
checks, but explicitly excludes OpenBao login and consumer proof
|
||||
[receipt:54](/home/worsch/key-cape/docs/evidence/2026-10-07-secrets-engine-openbao-issuance.json:54).
|
||||
Neither is KEY39's native negative-case receipt.
|
||||
|
||||
The latest17 October Platform return still states **source-prepared, not
|
||||
admitted** [return:1](/home/worsch/railiance-platform/docs/proposals/2026-10-17-key39-t02-owner-returns.md:1).
|
||||
Its coding-client proposal remains the existing proposal to admit, with no
|
||||
recorded custody/delivery/version/host binding
|
||||
[return:15](/home/worsch/railiance-platform/docs/proposals/2026-10-17-key39-t02-owner-returns.md:15).
|
||||
It also requires the existing sanitized node-local Bao origin and live role/
|
||||
config/plugin/effective-leeway confirmation
|
||||
[return:39](/home/worsch/railiance-platform/docs/proposals/2026-10-17-key39-t02-owner-returns.md:39).
|
||||
All3 leeway fields remain undeclared in role source; the150s default model is
|
||||
not observed native fact. Current deployment source lacks the coding-client env
|
||||
reference; this does not prove live absence. Existing exact route/readiness/
|
||||
Argo/private transport conditions remain the accepted review's native conditions,
|
||||
not new requirements introduced here.
|
||||
|
||||
Preserve existing authority: source acceptance is confirmed and its recorded
|
||||
SHA256 matches [receipt:30](/home/worsch/the-custodian/docs/evidence/2026-10-10-security-consolidation/key39-source-design-publication/founder-source-disposition-readback-r1.json:30).
|
||||
Registration go `caafe4be-4f68-47b4-9567-316d47b94992` is already resolved
|
||||
[KEY39:107](/home/worsch/key-cape/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md:107).
|
||||
The [standing attended rule](/home/worsch/the-custodian/docs/decisions/2026-10-11-security-unblock-decisions.md:38)
|
||||
remains valid. Do not ask for these again. This review request itself is not
|
||||
permission to issue tokens or widen custody.
|
||||
|
||||
The existing roadmap is:
|
||||
|
||||
1. Complete KEY38's first SecurityCase registration and claims proof; its
|
||||
[T02:94](/home/worsch/key-cape/workplans/KEY-WP-0038-forgejo-oidc-client.md:94) and
|
||||
[T03:157](/home/worsch/key-cape/workplans/KEY-WP-0038-forgejo-oidc-client.md:157)
|
||||
still wait and are explicit KEY39 dependencies.
|
||||
2. Admit/return the existing coding-client proposal and finish its already
|
||||
required owner readiness/route/role/private handoff returns.
|
||||
3. Run the existing attended negative probe and cleanup within existing authority.
|
||||
KEY39's actual acceptance is every case refused, committed value-free receipt,
|
||||
and probe clients gone [KEY39:122](/home/worsch/key-cape/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md:122).
|
||||
Preserve inconclusive/unknown outcomes, unexpected acceptance/revoke and exact
|
||||
baseline/resource cleanup until resolved. No such native receipt was found.
|
||||
|
||||
A bounded public Markdown/JSON/YAML search of cluster/enablement/infra/master
|
||||
source found no later KEY39/openbao-negative approval or native receipt that
|
||||
supersedes these limits. This is not proof of absent external/live authority.
|
||||
MASON/full Secrets adoption, execution entitlement and unrelated TLS/estate
|
||||
completion are not added as KEY39 closure gates. No canonical edits, native or
|
||||
credential action, live metadata read, transport launch or test rerun occurred.
|
||||
|
|
@ -0,0 +1,68 @@
|
|||
{
|
||||
"schema": "custodian.key39-infrastructure-finalization-assessment.v1",
|
||||
"observed_at": "2026-10-17T11:02:49.971298+00:00",
|
||||
"parent_can_finish": false,
|
||||
"task_statuses": {
|
||||
"KEY-WP-0039-T01": "done",
|
||||
"KEY-WP-0039-T02": "wait",
|
||||
"KEY-WP-0039-T03": "done"
|
||||
},
|
||||
"current_executable_test_decision_pins_matching": 14,
|
||||
"platform_source_pins_matching": 3,
|
||||
"workplan_entry_changed": true,
|
||||
"source_approval_confirmed_sha256": "453213194d605336e9c424976f1ac27691def39e225026f0a99628d1cfc97d1d",
|
||||
"registration_go_preserved": "caafe4be-4f68-47b4-9567-316d47b94992",
|
||||
"ccr0038_metadata_apply": "already passed2026-10-08, not negative probe proof",
|
||||
"native_key39_negative_cleanup_receipt_found": false,
|
||||
"receipt_search_limit": "bounded public owner evidence filenames and cluster/enablement/infra/master source; not proof of external absence",
|
||||
"existing_next_sequence": [
|
||||
"KEY38-T02/T03 first SecurityCase registration/claims proof",
|
||||
"admit existing coding-client proposal and return existing owner readiness/route/role/private custody facts",
|
||||
"existing attended negative probe, committed value-free receipt and probe-client cleanup"
|
||||
],
|
||||
"new_gate_or_protocol": false,
|
||||
"canonical_edits": false,
|
||||
"native_credential_transport_or_test_actions": 0,
|
||||
"source_refs": [
|
||||
{
|
||||
"path": "/home/worsch/railiance-platform/docs/reviews/2026-10-11-key39-ready-pair-v9-v4-platform-review.json",
|
||||
"sha256": "sha256:cb2729781cfce7637d7a4ba29412edde64d337c5efe3148600bd39fb12166894"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/railiance-platform/docs/reviews/2026-10-11-key39-lifecycle-v5-platform-review.json",
|
||||
"sha256": "sha256:ba872dc53061b1dcca9dea1e8897597c394c1f9365e0fc49ee6f2095f57f11e0"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/railiance-platform/docs/reviews/2026-10-11-key39-coding-client-custody-platform-source-assessment.json",
|
||||
"sha256": "sha256:a3709a74cebeb809a67818578b376ef794e4ca9e3e420acdd00b1a3d3c2c51c3"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/railiance-platform/docs/proposals/2026-10-17-key39-t02-owner-returns.md",
|
||||
"sha256": "sha256:1d292078cf9625cbac8f332668aa3138c653f7b5a64f0066015ced8785a08d26"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/railiance-platform/docs/proposals/2026-10-11-key39-coding-client-custody-proposal.json",
|
||||
"sha256": "sha256:959a924adc12283405c529ecd573cad5e16f4dd9c96c258c44cab8df014dc8c0"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/railiance-platform/credential-change-requests/CCR-2026-0038-secrets-engine-service-jwt-login.yaml",
|
||||
"sha256": "sha256:65b2cfb772623da59c351033ab4eb2ec7adfbd109778e787c7fe1b0e185a3bc0"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/key-cape/docs/evidence/2026-10-07-secrets-engine-openbao-issuance.json",
|
||||
"sha256": "sha256:a405ef5289159c525695352ba71da7eca8e897b6f2dc7e5795f9b239361d8068"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/key-cape/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md",
|
||||
"sha256": "sha256:7b4b97f9a9e6b8291078e187b967a5356702dd7817880f92c12649d764e5e0ae"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/key-cape/workplans/KEY-WP-0038-forgejo-oidc-client.md",
|
||||
"sha256": "sha256:dc8d88d462799e7e6e44da759a973d52e44102a271969a5daaa9d30ec015b064"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/the-custodian/docs/evidence/2026-10-10-security-consolidation/key39-source-design-publication/founder-source-disposition-readback-r1.json",
|
||||
"sha256": "sha256:453213194d605336e9c424976f1ac27691def39e225026f0a99628d1cfc97d1d"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,125 @@
|
|||
{
|
||||
"observed_at": "2026-10-17T11:01:03.999381+00:00",
|
||||
"pairs": [
|
||||
{
|
||||
"reviewed_manifest_sha256": "84542ddcff00932fc7ce22dcb2626be8942a3c006c5098a62fdd6b2478d0cd14",
|
||||
"files": [
|
||||
{
|
||||
"path": "net-kingdom/sso-mfa/k8s/keycape/openbao-negative-node-route.md",
|
||||
"reviewed_sha256": "cad3e3dc481d45295cc014e48285e81614911dfb4a10523883f3044f6085f363",
|
||||
"current_sha256": "cad3e3dc481d45295cc014e48285e81614911dfb4a10523883f3044f6085f363",
|
||||
"matches": true
|
||||
},
|
||||
{
|
||||
"path": "net-kingdom/sso-mfa/k8s/keycape/openbao-negative-node-wrapper.py",
|
||||
"reviewed_sha256": "76ac013d1a676a0dfa58aea1ce87b0c3e72483ccd21f586a22c5475e9132f6c1",
|
||||
"current_sha256": "76ac013d1a676a0dfa58aea1ce87b0c3e72483ccd21f586a22c5475e9132f6c1",
|
||||
"matches": true
|
||||
},
|
||||
{
|
||||
"path": "net-kingdom/sso-mfa/k8s/keycape/openbao-negative-session.py",
|
||||
"reviewed_sha256": "24b7b803e4eb7e6e7c0700a069dad0ec315ee7eb5538a88b9e56147f8fab5cdd",
|
||||
"current_sha256": "24b7b803e4eb7e6e7c0700a069dad0ec315ee7eb5538a88b9e56147f8fab5cdd",
|
||||
"matches": true
|
||||
},
|
||||
{
|
||||
"path": "net-kingdom/sso-mfa/k8s/keycape/test_openbao_negative_session.py",
|
||||
"reviewed_sha256": "01e23f2b4fc77824a161a57acb3a52d19aad846b3b6c0fd3abd81afa1dc2985c",
|
||||
"current_sha256": "01e23f2b4fc77824a161a57acb3a52d19aad846b3b6c0fd3abd81afa1dc2985c",
|
||||
"matches": true
|
||||
},
|
||||
{
|
||||
"path": "net-kingdom/sso-mfa/k8s/keycape/test_openbao_node_route.py",
|
||||
"reviewed_sha256": "1c57053be6e8472174e4034fdfbf34b3e1729f5e239b3a9af89d9e59a08d6cb6",
|
||||
"current_sha256": "1c57053be6e8472174e4034fdfbf34b3e1729f5e239b3a9af89d9e59a08d6cb6",
|
||||
"matches": true
|
||||
},
|
||||
{
|
||||
"path": "net-kingdom/sso-mfa/k8s/keycape/test_openbao_private_input.py",
|
||||
"reviewed_sha256": "84277edb5bd7858885173dea802b6bdc4f0f0c7785d6e200ee9a98d8553891a1",
|
||||
"current_sha256": "84277edb5bd7858885173dea802b6bdc4f0f0c7785d6e200ee9a98d8553891a1",
|
||||
"matches": true
|
||||
},
|
||||
{
|
||||
"path": "net-kingdom/sso-mfa/k8s/keycape/test_openbao_private_ready.py",
|
||||
"reviewed_sha256": "8a7a033b1c509ba21397d1d74580c44f24592045b2b9de50fe87638607224277",
|
||||
"current_sha256": "8a7a033b1c509ba21397d1d74580c44f24592045b2b9de50fe87638607224277",
|
||||
"matches": true
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"reviewed_manifest_sha256": "d6f641dc1e4aae7d36658d4199d89af14d2fd7a4bd4e526856eb340234f2d33e",
|
||||
"files": [
|
||||
{
|
||||
"path": "key-cape/docs/openbao-negative-token-producer-decision.json",
|
||||
"reviewed_sha256": "7b3e4a53ac4af33c780f16c3f1aa9cde0154040ad2747a8d361dd79bbb7f435c",
|
||||
"current_sha256": "7b3e4a53ac4af33c780f16c3f1aa9cde0154040ad2747a8d361dd79bbb7f435c",
|
||||
"matches": true
|
||||
},
|
||||
{
|
||||
"path": "key-cape/docs/openbao-negative-token-producer-decision.md",
|
||||
"reviewed_sha256": "38e4c9660ca57a1fb6e5ff04f214af61dd1a58abf564a5ed22216d909e27fc73",
|
||||
"current_sha256": "38e4c9660ca57a1fb6e5ff04f214af61dd1a58abf564a5ed22216d909e27fc73",
|
||||
"matches": true
|
||||
},
|
||||
{
|
||||
"path": "key-cape/scripts/openbao_negative_private_handoff.py",
|
||||
"reviewed_sha256": "faf63a3e9504dcbb46847a114275f83d508521e095410a47f92f02b86ba82b1b",
|
||||
"current_sha256": "faf63a3e9504dcbb46847a114275f83d508521e095410a47f92f02b86ba82b1b",
|
||||
"matches": true
|
||||
},
|
||||
{
|
||||
"path": "key-cape/scripts/openbao_negative_private_launcher.py",
|
||||
"reviewed_sha256": "46e57504b3185cc13f1656901a0ca02cc3887527cb09566e270f57b76099ab9c",
|
||||
"current_sha256": "46e57504b3185cc13f1656901a0ca02cc3887527cb09566e270f57b76099ab9c",
|
||||
"matches": true
|
||||
},
|
||||
{
|
||||
"path": "key-cape/scripts/test_openbao_negative_private_handoff.py",
|
||||
"reviewed_sha256": "e4eb600718e7d93b0e801ac3ab1427af9895a6e5d877c1134369e049e0849797",
|
||||
"current_sha256": "e4eb600718e7d93b0e801ac3ab1427af9895a6e5d877c1134369e049e0849797",
|
||||
"matches": true
|
||||
},
|
||||
{
|
||||
"path": "key-cape/scripts/test_openbao_negative_private_launcher.py",
|
||||
"reviewed_sha256": "243426a85075b3447adeb2ca320a13711409744f71837a06699de6ad5b04ee9d",
|
||||
"current_sha256": "243426a85075b3447adeb2ca320a13711409744f71837a06699de6ad5b04ee9d",
|
||||
"matches": true
|
||||
},
|
||||
{
|
||||
"path": "key-cape/scripts/test_openbao_negative_private_preparation.py",
|
||||
"reviewed_sha256": "8e4dd327c4a339a0151ecba57db5987965b5d536ca18123fb7c74a047a241548",
|
||||
"current_sha256": "8e4dd327c4a339a0151ecba57db5987965b5d536ca18123fb7c74a047a241548",
|
||||
"matches": true
|
||||
},
|
||||
{
|
||||
"path": "key-cape/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md",
|
||||
"reviewed_sha256": "f6113d269f127976518acb48eca818fd5d6f12421f4e4c742e8a84f49a14360b",
|
||||
"current_sha256": "7b4b97f9a9e6b8291078e187b967a5356702dd7817880f92c12649d764e5e0ae",
|
||||
"matches": false
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"current_platform_source_pins": [
|
||||
{
|
||||
"path": "helm/openbao-ui-overlay-k8s.yaml",
|
||||
"sha256": "7b345359906bf1ecc4cb8e61de7a9f1a121068a66bd919e606190a9217a82daf",
|
||||
"matches": true
|
||||
},
|
||||
{
|
||||
"path": "helm/openbao-ui-overlay/nginx.conf",
|
||||
"sha256": "464f7f5cecc69ea343c1e2acc5932e832b2a9c0e6a5099113634a12abc80ccb3",
|
||||
"matches": true
|
||||
},
|
||||
{
|
||||
"path": "helm/openbao-values.yaml",
|
||||
"sha256": "a10239851277889dd69dacb8636109dddd095551d85b46ca4ed2c141944e8d1e",
|
||||
"matches": true
|
||||
}
|
||||
],
|
||||
"scope": "source bytes checked only; no runtime/native/credential/test action",
|
||||
"critical_runtime_test_and_decision_entries_matching": 14,
|
||||
"workplan_only_nonmatch": "later progress text; not an executable source regression or automatic requirement to redo source review"
|
||||
}
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
{
|
||||
"files": {
|
||||
"ASSESSMENT.md": "sha256:6fa24e6dab7a26356caaba07bb539538e22a0b9af2dd19c765b6007978ae8bcd",
|
||||
"assessment.json": "sha256:af2538f41aa761c281cce555ffbda69a195ed06d5f87f1e63ad88acff35d6be4",
|
||||
"current-pins.json": "sha256:9befcb455d1f2e350a36fc1160eb3fa917deca4da2dde15cc2cb76d5d528c0d0"
|
||||
},
|
||||
"scope": "read-only source assessment; metadata-only evidence; no native action"
|
||||
}
|
||||
|
|
@ -0,0 +1,200 @@
|
|||
# Install and verify the immutable Glas/rein runtime on railiance01
|
||||
|
||||
Proposal ID: **REINAH-WP-0008-T07-install-f599-r1**, revision **1**.
|
||||
Status: **pending root review and exact founder approval; no native mutation**.
|
||||
This is a separately reviewable installation step under existing T07. It does
|
||||
not require completing the paid-attempt envelope because it uses no provider,
|
||||
worker credential, owner/spend configuration, catalog change or queue action.
|
||||
It does not activate the artifact or complete T07, GLAS-WP-0012-T03/T04, the
|
||||
current Custodian assignment migration or TSA-06.
|
||||
|
||||
## Exact action and target
|
||||
|
||||
After root retains this exact revision and the supervisor's disposition, run:
|
||||
|
||||
```bash
|
||||
python3 -I -B /home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/execute-install.py --apply
|
||||
```
|
||||
|
||||
The same file's default/`--dry-run` is read-only. `--apply` refuses any existing
|
||||
local execution receipt, so a failed/uncertain attempt cannot be rerun blindly.
|
||||
There is no scheduling, continuous claim loop, profile readiness override,
|
||||
credential acquisition, provider request, owner renewal or service restart.
|
||||
|
||||
| Input | Exact value |
|
||||
|---|---|
|
||||
| Host | existing SSH alias railiance01; Kubernetes node must be Ready at 92.205.62.239 |
|
||||
| Account | tegwick, UID/GID 1000, home /home/tegwick |
|
||||
| Existing protected store | /home/tegwick/.helixforge-factory/runtimes, mode 0700, device 2049, inode 4751222 |
|
||||
| New destination | /home/tegwick/.helixforge-factory/runtimes/f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d |
|
||||
| Complete runtime digest | sha256:f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d |
|
||||
| Retained source artifact | /tmp/netkingdom-runtime-canonical-20261016/runtime |
|
||||
| Exact new owned staging | /home/tegwick/.helixforge-factory/runtime-install-f599-r1-20261017 |
|
||||
| Transfer archive | deterministic gzip/PAX tar, 109,931,109 bytes, 1,448 members |
|
||||
| Transfer SHA-256 | sha256:4c55b2740e759175d645705518fc33db30b26b4611f68e052a4ca909173084c7 |
|
||||
| Logical regular-file bytes | 260,668,241; one retained internal relative symlink, lib64 → lib |
|
||||
|
||||
`action-inputs.json` freezes every executable/helper hash and archive input.
|
||||
`artifact-manifest.json` binds this proposal and all retained review evidence.
|
||||
Only the three named payload files go into remote staging: runtime.tar.gz,
|
||||
runtime.py and install-verified.py. The workstation archive is regenerated
|
||||
privately from the exact source only at execution, checked against the frozen
|
||||
archive hash, transferred, and removed from its local temporary directory.
|
||||
No large runtime archive or new source build is committed to this repository.
|
||||
|
||||
## Existing owner contract and actual observations
|
||||
|
||||
Sand-boxer `docs/bwrap-runtime.md` explicitly separates protected artifact
|
||||
installation from profile selection, credentials, network activation and schedules.
|
||||
The existing `runtime_store.install_runtime` verifies source, checks the owned
|
||||
store and lock, copies symlinks/modes into its own private staging, verifies the
|
||||
copy and atomically publishes under its digest. It never replaces an existing
|
||||
artifact. This proposal uses that exact implementation already in f599; it does
|
||||
not introduce another store or installer service. Remote owner source checkouts
|
||||
are absent, so the pinned public digest reader/driver travel with the artifact.
|
||||
|
||||
Exact installed component hashes:
|
||||
|
||||
- sandboxer runtime.py: sha256:19b5fb687288bbc836978b0251599dc1e4d1593e8b5efee85a6abb6a7f388412
|
||||
- sandboxer runtime_store.py: sha256:c3d6ec09d08881611d3d02b8f55d68deed6ecfedaa1a809b6b11c57cc4ca97cf
|
||||
- rein owner_rehearsal.py: sha256:192f654cad4a5f065c7faa5e35b03493297a472e8d7fe641be2c42c5fb00dcc3
|
||||
|
||||
Runtime/store components match both the artifact's sandboxer `221126cb` and
|
||||
current owner source `53f800c4`; the rehearsal matches artifact rein `9b88cadaa8`.
|
||||
The complete build includes Glas `7357115c` and llm-connect `37436bb5` from the
|
||||
previously reviewed immutable build. Reuse its actual manager/gateway proof for
|
||||
isolation/workload-delivery mechanics; no deterministic proof is relabelled a
|
||||
real model call. The new action proves native installation and free launch only.
|
||||
|
||||
Read-only target evidence verifies the expected account/node, safe home/factory/
|
||||
store/lock modes and absent destination/staging. Four older digest directories
|
||||
remain in the store, including b6e4e8a4; this action does not select, overwrite,
|
||||
remove or execute them. Pinned native executables are /usr/bin/python3 (3.12.3),
|
||||
/usr/local/bin/kubectl for the node read and /usr/bin/bwrap. No private owner/config/auth files were opened by these observations.
|
||||
|
||||
The final read-only dry-run at **2026-10-17 02:35:19 UTC** passed all guards:
|
||||
about 124.21GB free disk, 7.65GB available memory, one-second CPU busy fraction
|
||||
0.5852 and one-minute load 5.06 across four CPUs. Earlier observations found
|
||||
99.5% busy CPU and a dry-run refusal at load 12.60; those remain retained. A
|
||||
passing snapshot is not a reservation or a promise of future headroom.
|
||||
|
||||
## Exact execution and refusal behavior
|
||||
|
||||
1. Verify every local helper hash and the complete source artifact digest.
|
||||
Read target metadata only; require the exact existing store device/inode,
|
||||
expected UID/GID/modes and Ready node/IP. Require both new paths absent,
|
||||
at least 2GiB free disk and 1GiB available memory, one-minute load ≤8 on four
|
||||
CPUs, and CPU busy ≤85% in one bounded one-second sample. Refuse on drift;
|
||||
no polling or mutation follows a failed gate.
|
||||
2. Write the local attempt intent before native staging. Recreate and verify
|
||||
the exact deterministic archive locally. Recheck CPU and exact store metadata
|
||||
before exclusive creation of the named 0700 remote staging directory. Record
|
||||
its actual device/inode in the local receipt before uploading anything.
|
||||
3. SCP only the archive and two public helpers. The fixed SSH bootstrap verifies
|
||||
the exact directory identity, complete three-file inventory, regular-file
|
||||
owner and all three payload hashes; it sets those owned public payload files
|
||||
to 0600. Then it execs the hashed install helper with a cleared application
|
||||
environment. Existing SSH authentication is transport only; no key is fetched,
|
||||
copied into the workload or exposed in evidence.
|
||||
4. The helper rechecks identity/headroom, lowers its scheduling priority to nice
|
||||
19, verifies archive hash/size and every member name/type/mode/count/size,
|
||||
rejects hardlinks/special/escaping members, extracts directories/files before
|
||||
internal relative symlinks and checks the complete extracted digest. It does
|
||||
not restore archive owners or execute a tar-supplied command. All created
|
||||
files belong to tegwick. A local temporary roundtrip independently passed
|
||||
that extraction and the exact final runtime digest, with modes/symlink intact.
|
||||
5. The staged candidate interpreter with `-I -B` imports and hash-checks its
|
||||
existing owner runtime/store modules, then calls existing install_runtime
|
||||
under a 180-second alarm. No new package resolution/download occurs. The
|
||||
existing helper holds its normal lock and cleans its own temporary copy on
|
||||
ordinary exception, then atomically appends the verified new digest. Refuse
|
||||
if the destination appeared, even if somebody installed identical bytes;
|
||||
no existing install is silently adopted as this action's success.
|
||||
6. Rehash the complete native destination. Execute only the installed artifact's
|
||||
existing owner_rehearsal.rehearse directly, independent of owner.json,
|
||||
SpendPolicy or ledger state. It launches rein-aharness --help,
|
||||
glas-harness --help and Claude --version inside empty-egress bwrap, each with
|
||||
a 60-second timeout and discarded command output; the phase has a 240-second
|
||||
alarm. Require exactly those three zero exits. No model/task command or
|
||||
credential route is constructed. Child environment is cleared; host HOME
|
||||
and credentials are not mounted. These ephemeral namespaces create no
|
||||
SandboxManager record, persistent worker, model session or provider lease.
|
||||
7. Rehash the entire installed tree after rehearsal and remove only the exact
|
||||
owned staging directory after device/inode/owner/mode and known-inventory
|
||||
checks. Capture the final structured result in this packet's
|
||||
execution-receipt.json. SSH closes when the foreground helper exits.
|
||||
|
||||
The rehearsal is the existing credential-free source API, not metered-once
|
||||
--rehearse against a private old owner configuration. This avoids changing pins
|
||||
or reading a ledger merely to validate an inactive artifact. It neither changes
|
||||
nor bypasses the normal future runtime/profile/spend/credential admission path.
|
||||
|
||||
## Expected result, cost and risk
|
||||
|
||||
Success is `installed_and_offline_rehearsal_verified`, with actual install result,
|
||||
owner UID/store mode, extracted/installed/post-rehearsal full digest equality,
|
||||
three explicit launcher exit codes and staging absence. Destination remains a
|
||||
dormant append. Profile and credential flags stay false; provider calls are zero.
|
||||
No current owner/catalog/queue/definition/profile bytes are read or changed by the
|
||||
installation action. T07's spend acceptance, owner renewal and real-model/native
|
||||
approvals remain separate.
|
||||
|
||||
Persistent addition is about 261MB of logical file data plus filesystem metadata.
|
||||
Transfer is about 110MB. Extraction/copy temporarily add two artifact-sized trees
|
||||
plus the archive; the 2GiB free-disk requirement includes operating margin. Hashing
|
||||
and copy are sequential and lower priority, but a snapshot gate cannot guarantee
|
||||
that shared-host CPU/IO remains idle throughout execution.
|
||||
|
||||
Requested provider spend is USD 0: no provider API exists in this action. No new
|
||||
paid resource or recurring service is committed. Incremental infrastructure,
|
||||
energy and human recovery time in EUR are **unknown**, not zero. Credible EUR
|
||||
loss from unexpected shared single-node IO/resource interruption is also unknown.
|
||||
Approval must explicitly cover this small supervised append/rehearsal exposure;
|
||||
this proposal grants no autonomous budget or autopilot authority. Root may defer
|
||||
execution until the fresh headroom gate passes without weakening its thresholds.
|
||||
|
||||
## Cleanup, rollback and uncertainty
|
||||
|
||||
Normal success/failure after verified stage identity removes only the owned
|
||||
staging tree. Unexpected directory identity or top-level objects stop cleanup;
|
||||
they are not swept. The local attempt intent retains remote staging device/inode
|
||||
before transfer. A transfer/bootstrap failure before remote helper execution may
|
||||
leave that exact staging: root can review the recorded identity and remove only
|
||||
its known upload files after confirming no execution started. The exact
|
||||
conditional command is `python3 -I -B /home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/cleanup-upload-staging.py --apply`; it requires the local receipt
|
||||
phase before_transfer, matching remote inode/device/owner/mode, only named
|
||||
regular upload files and no extracted runtime. It refuses every later phase. An SSH timeout or
|
||||
lost final reply after `remote_execution_started` is an uncertain outcome; do not
|
||||
replay --apply or delete staging while the helper may still be running. First
|
||||
confirm exact process quiescence, then inspect destination digest/stage identity
|
||||
read-only and reconcile under the same proposal. The 600-second outer SSH timeout
|
||||
is not proof that a disconnected remote process stopped.
|
||||
|
||||
The existing installer cleans its private `.install-*` copy on ordinary Python
|
||||
failure. Hard host/process loss may leave it; do not glob-delete store staging
|
||||
or infer ownership from the prefix. Preserve exact baseline/new-object metadata
|
||||
and request attended owner recovery for anything not tied to this attempt.
|
||||
|
||||
Rollback does not restore owner/catalog configuration because this action never
|
||||
changes it. Keep every older artifact and the newly installed immutable artifact
|
||||
as dormant evidence; removal of a published digest is not part of existing
|
||||
installer rollback and is not authorized here. If installation succeeds but
|
||||
rehearsal fails, record that partial outcome, retain the inactive artifact and
|
||||
staging cleanup facts, and stop. No automatic profile selection, in-place repair,
|
||||
artifact deletion, credential/provider retry or follow-up service action follows.
|
||||
|
||||
## Review evidence
|
||||
|
||||
- action-inputs.json: fixed argv/paths/helper hashes/archive/components/guards.
|
||||
- target-readonly-observation.json and target-readonly-addendum.json: actual
|
||||
target/account/store/node/absence and Python/bwrap observations.
|
||||
- cpu-readonly-observation.json and retained-headroom-refusal.json: earlier
|
||||
saturation/refusal, retained separately from the later passing snapshot.
|
||||
- final-readonly-dry-run.json: actual final helper's read-only result, zero writes.
|
||||
- local-transfer-verification.json: deterministic archive and complete local
|
||||
extraction digest/mode/symlink roundtrip, removed local temporary tree.
|
||||
|
||||
Root must review/freeze the proposal/manifest digest, retain it in the existing
|
||||
supervision trial, obtain the exact founder disposition and only then invoke the
|
||||
--apply command. No native staging, install, launcher execution, owner change or
|
||||
paid call has happened during this preparation.
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
{
|
||||
"decision_id": "b6abb6ab-b182-4b4f-9f84-79ddc5ad91f3",
|
||||
"approved_at": "2026-10-17T08:34:32.549418+00:00",
|
||||
"approved_revision": 2,
|
||||
"approved_digest_sha256": "44b17589c323e1a966caf6c1b1def123092ee289b929c8ea014bc84109103b1d",
|
||||
"approval_source": "Actual user response: Approve exact revision 2",
|
||||
"status": "resolved",
|
||||
"decided_by": "Bernd Worsch",
|
||||
"scope": "Founder selected Approve exact revision 2 in the active conversation. Exact proposal REINAH-WP-0008-T07-install-f599-r1 revision2 SHA25644b17589c323e1a966caf6c1b1def123092ee289b929c8ea014bc84109103b1d: dormant f599 append and supervised credential-free three-launcher rehearsal, fresh headroom/identity/source/absence guards and frozen conditional cleanup. Infrastructure/operator cost and interruption/recovery EUR risk explicitly unknown and accepted only for this supervised action. No model/provider, owner/spend/credential/catalog/profile/queue changes or autonomy grant."
|
||||
}
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
{
|
||||
"status": "partial_install_verified_read_only",
|
||||
"runtime_sha256": "f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d",
|
||||
"installed_complete_digest_verified": true,
|
||||
"owned_stage_absent": true,
|
||||
"store_uid": 1000,
|
||||
"store_gid": 1000,
|
||||
"store_mode": "0o700",
|
||||
"runtime_launched": false,
|
||||
"private_configuration_read": false,
|
||||
"profile_or_queue_or_owner_state_changed": false,
|
||||
"native_launcher_acceptance": "unverified_after_failed_R2",
|
||||
"model_calls": 0
|
||||
}
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
{
|
||||
"decision_id": "bec667cc-15ea-4f87-ae16-111f08562e48",
|
||||
"approved_at": "2026-10-17T10:57:39.975862+00:00",
|
||||
"approved_revision": 3,
|
||||
"approved_digest_sha256": "7d5741abc7da042d4de6cd36437801309b844760f606b3145d615fd75d6b2d30",
|
||||
"approval_source": "Actual user response: Approve exact revision 3",
|
||||
"status": "resolved",
|
||||
"decided_by": "Bernd Worsch",
|
||||
"scope": "Founder actual conversation reply: Approve exact revision 3. Approval is bound only to stable proposal REINAH-WP-0008-T07-install-f599-r1 revision3 SHA256 7d5741abc7da042d4de6cd36437801309b844760f606b3145d615fd75d6b2d30, verification-only of installed inactive f599, unchanged three empty-egress launcher commands, repaired dead-zombie handling, exclusive durable public precleanup receipt, fresh exact guards and reviewed conditional cleanup. Unknown infrastructure/operator EUR cost and interruption/recovery loss EUR explicitly accepted only for this supervised action. No reinstall/model/credential/profile/catalog/queue changes or autopilot grant. R2 failed partial outcome retained in the same trial."
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"installed_runtime_complete_digest_verified": true, "next_exact_command": "python3 -I -B /home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/execute-verify.py --apply", "observed_at": "2026-10-17T10:57:48.591714+00:00", "private_configuration_reads": false, "proposal_id": "REINAH-WP-0008-T07-install-f599-r1", "provider_calls": 0, "remote_mutations": 0, "revision": 3, "status": "read_only_dry_run_blocked", "target": {"account": "tegwick", "bwrap_die_with_parent_supported": true, "bwrap_version": "bubblewrap 0.9.0", "checks": {"account": true, "bwrap_parent_death_contract": true, "cpu_headroom": false, "disk_headroom": true, "durable_receipt_absent": true, "exact_installed_runtime": true, "exact_ready_node": true, "load_headroom": true, "memory_headroom": true, "protected_store": true, "staging_absent": true, "supervision_primitives": true}, "cpu_busy_fraction": 0.9924812030075187, "cpu_count": 4, "cpu_sample_seconds": 1, "destination": {"device": 2049, "directory": true, "gid": 1000, "inode": 4743998, "mode": "0o755", "symlink": false, "uid": 1000}, "disk_free_bytes": 122694397952, "durable_receipt": null, "gid": 1000, "installed_complete_digest": "f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d", "load_average": [4.4833984375, 3.09765625, 2.39306640625], "memory_available_bytes": 7532904448, "node_addresses": [{"address": "92.205.62.239", "type": "InternalIP"}, {"address": "2a00:1169:111:6d70::", "type": "InternalIP"}, {"address": "239.62.205.92.host.secureserver.net", "type": "Hostname"}], "node_ready": true, "pidfd_available": true, "primary_manual_contract_excerpt": ")\\&.\n.RE\n.PP\n\\fB\\-\\-die\\-with\\-parent\\fR\n.RS 4\nEnsures child process (COMMAND) dies when bwrap\\*(Aqs parent dies\\&. Kills (SIGKILL) all bwrap sandbox processes in sequence from parent to child including COMMAND process when bwrap or bwrap\\*(Aqs parent dies\\&. See prctl, PR_SET_PDEATHSIG\\&.\n.RE\n.PP\n\\fB\\-\\-as\\-pid\\-1\\fR\n.RS 4\nDo not create a process with PID=1 in the sandbox to reap child processes\\&.\n.RE\n.PP\n\\fB\\-\\-cap\\-add \\fR\\fBCAP\\fR\n.RS 4\nAdd ", "stage": null, "store": {"device": 2049, "directory": true, "gid": 1000, "inode": 4751222, "mode": "0o700", "symlink": false, "uid": 1000}, "subreaper_get_supported": true, "uid": 1000}}
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
{
|
||||
"workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52",
|
||||
"id": "ae3bd654-98d0-40bb-b1a7-25c9ca3a7f95",
|
||||
"topic_id": null,
|
||||
"task_id": null,
|
||||
"decision_id": null,
|
||||
"event_type": "note",
|
||||
"summary": "Executed founder-approved exact runtime installation R2 once; inactive f599 full native digest verified, but three-launcher rehearsal failed (phase_receipt_unavailable / leader_left_descendants). Positive owned-process quiescence and staging removal independently verified. Recorded failed/partial outcome in same supervised trial; no gate closure or promotion. Prepared verification-only R3 with dead-zombie classification repair and durable public receipt-before-cleanup; root18R3/29R2hash checks and5focusedlocalchecks pass. Fresh exact R3 approval pending decision bec667cc-15ea-4f87-ae16-111f08562e48; no R3 native mutation. Ops-warden source validation publication and rein original-issued HARNESS identity repair continue independently.",
|
||||
"detail": {
|
||||
"r2_approval_ref": "b6abb6ab-b182-4b4f-9f84-79ddc5ad91f3",
|
||||
"r3_proposal_sha256": "sha256:7d5741abc7da042d4de6cd36437801309b844760f606b3145d615fd75d6b2d30",
|
||||
"native_failure_cause": "unproven; source zombie counterexample is not native causal evidence",
|
||||
"r2_execution_receipt": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/execution-receipt.json",
|
||||
"independent_verification": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/installed-partial-verification.json",
|
||||
"all_16_native_target_gates": "open"
|
||||
},
|
||||
"author": "codex",
|
||||
"session_id": null,
|
||||
"created_at": "2026-10-17T10:40:30.575417Z",
|
||||
"workstream_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52"
|
||||
}
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
{
|
||||
"workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52",
|
||||
"id": "bec667cc-15ea-4f87-ae16-111f08562e48",
|
||||
"topic_id": null,
|
||||
"title": "Review exact R3 verification of inactive installed f599 runtime after failed R2",
|
||||
"description": "Same stable proposal REINAH-WP-0008-T07-install-f599-r1 revision3, canonical owner HARNESS-WP-0008-T07. Proposal docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/FINAL-PROPOSAL.md SHA256 7d5741abc7da042d4de6cd36437801309b844760f606b3145d615fd75d6b2d30; artifact manifest SHA256 19d3a74b124a9a7236bd4b8f6fe45656b4651d875017486f0dfa515f3f81d806. R2 approval b6abb6ab-b182-4b4f-9f84-79ddc5ad91f3 executed once, failed/partial: exact f599 installed inactive; launcher proof failed; owned processes quiesced and stage removed. R3 is verification-only with unchanged three empty-egress launcher commands; repairs demonstrated source zombie-classification bug and retains exclusive durable public precleanup receipt. No reinstall, model/provider calls, credentials/profile/catalog/queue changes. Infrastructure/operator EUR cost and credible interruption/recovery loss EUR UNKNOWN, requiring explicit supervised exposure approval. Fresh headroom and reviewed conditional cleanup apply. Exact revision approval required by docs/agent-environment-orientation.md section4 and docs/agent-autonomy-decision.md; no R3 native writes/launches until actual founder approval. Independent root source review,18R3pins/29R2pins and5localprocess/cleanupchecks passed. R2 native causal attribution remains unproven.",
|
||||
"decision_type": "pending",
|
||||
"status": "open",
|
||||
"rationale": null,
|
||||
"decided_by": null,
|
||||
"decided_at": null,
|
||||
"deadline": null,
|
||||
"escalation_note": null,
|
||||
"superseded_by": null,
|
||||
"created_at": "2026-10-17T10:40:04.792578Z",
|
||||
"updated_at": "2026-10-17T10:40:04.792578Z",
|
||||
"workstream_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52"
|
||||
}
|
||||
|
|
@ -0,0 +1,38 @@
|
|||
{
|
||||
"status": "accepted_for_fresh_exact_founder_review_only",
|
||||
"observed_at": "2026-10-17T10:39:45.041285+00:00",
|
||||
"proposal_id": "REINAH-WP-0008-T07-install-f599-r1",
|
||||
"revision": 3,
|
||||
"proposal_sha256": "sha256:7d5741abc7da042d4de6cd36437801309b844760f606b3145d615fd75d6b2d30",
|
||||
"manifest_sha256": "sha256:19d3a74b124a9a7236bd4b8f6fe45656b4651d875017486f0dfa515f3f81d806",
|
||||
"r3_manifest_files_checked": 18,
|
||||
"frozen_r2_files_checked": 29,
|
||||
"hash_mismatches": 0,
|
||||
"source_review": [
|
||||
"verification-only; no installer/archive transfer path",
|
||||
"same full three-launcher proof",
|
||||
"reaps only already-dead adopted direct-child zombies and preserves Popen leader status",
|
||||
"genuine live descendants still refuse and must quiesce",
|
||||
"exclusive durable receipt plus fsync before conditional staging removal",
|
||||
"no private argv/env/stderr emitted",
|
||||
"no automatic replay"
|
||||
],
|
||||
"independent_local_checks": {
|
||||
"count": 5,
|
||||
"passed": 5,
|
||||
"cases": [
|
||||
"dead adopted zombie reaped without false failure",
|
||||
"live orphan refusal retains actual public state",
|
||||
"three nested launcher receipts preserved",
|
||||
"durable public receipt precedes cleanup",
|
||||
"receipt persistence failure retains staging"
|
||||
],
|
||||
"native_or_bwrap_execution": false
|
||||
},
|
||||
"r2_actual_outcome": "failed_partial_install_verified",
|
||||
"r2_native_cause": "unproven; local zombie counterexample is not native causal proof",
|
||||
"authority_granted": false,
|
||||
"r3_native_executed": false,
|
||||
"supervision_before_sha256": "sha256:0a98712f8cad262081d9a32742773a3b50dd26ce126f641f171343f2eed38f2b",
|
||||
"supervision_report_valid": true
|
||||
}
|
||||
|
|
@ -0,0 +1,266 @@
|
|||
{
|
||||
"base_commit": "4097a0bfbc42b937f23a06d19d3aa4587c51927f",
|
||||
"purpose": "Preserve actual failed R2 and exact approved R3/read-only headroom refusal; no R3 native execution inferred",
|
||||
"batches": [
|
||||
[
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/FINAL-PROPOSAL.md",
|
||||
"sha256": "sha256:44b17589c323e1a966caf6c1b1def123092ee289b929c8ea014bc84109103b1d"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/PROCESS-CONTRACT.md",
|
||||
"sha256": "sha256:ed79d14bde467e8893c341419c37fa2992184597fc9015c2e7d81fb4ece63fd0"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/action-inputs.json",
|
||||
"sha256": "sha256:ce7f5a25be440561f5179ae9980d85eb693a11b58d2012c8aea24b8bae04ab6f"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/artifact-manifest.json",
|
||||
"sha256": "sha256:aea5dbfe0742fe0bb6c36a41ca7b0d70473683b2731f92cc279d43929e5c35c9"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/build-transfer.py",
|
||||
"sha256": "sha256:99914629f354d4b6d5a4750850b32ec2cb64ac5ce18e86702d9157ea6f6b0124"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/cleanup-upload-staging.py",
|
||||
"sha256": "sha256:cec7eab2b25e4a0077ec45c055d7ba9542bc8e8724b53f2117be61c913269188"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/cpu-readonly-observation.json",
|
||||
"sha256": "sha256:c424ecb281baf128d6c79f1e6c6f678093f9b5e9c84a3454f9891fe6197b2e95"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/executable-readonly-observation.json",
|
||||
"sha256": "sha256:3ee73cdeeb4f82a55b31d19c6a24aacc4199e2e8647335d65b4e8f2e7d079c18"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/execute-install.py",
|
||||
"sha256": "sha256:44d93406ce62cc1f08ca9c7deb3eed6f45c74d61efd978f7b0acec31ba04cdc5"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/execution-receipt.json",
|
||||
"sha256": "sha256:59969ad9992ac289a553e1076209ba0d04b6fa7cd171bfad83dcc1f96d80a1c6"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/final-readonly-dry-run.json",
|
||||
"sha256": "sha256:17144cdb22f975212ea02a5109c94740c430d79272ef9d919ce57dec68c2d880"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/frozen-native-argv.json",
|
||||
"sha256": "sha256:0efb13aa725111cc227453bc7fc40eaf039c83cbd291ca7cb0409daf6b1e6c55"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/install-verified.py",
|
||||
"sha256": "sha256:c6895881b83b3f5d5408c646040368cc5c59a99e1495fa0914b9183e087a6831"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/local-bytecode-refinement.json",
|
||||
"sha256": "sha256:08c92506d6abefe15aff4a9b7908ab8bee425e7792abc6095e1dd04101a2a540"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/local-transfer-check.py",
|
||||
"sha256": "sha256:97fbec826d517b1746a2ec5ef67e5aab053777690977abdddc8b33ec5804e22e"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/local-transfer-verification.json",
|
||||
"sha256": "sha256:2331b854389b4c15f5adce1f62aa0846e9f47dfda351a7ef166c90b5e9b2737c"
|
||||
}
|
||||
],
|
||||
[
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/pre-absolute-path-dry-run.json",
|
||||
"sha256": "sha256:9ea47b71b8636e4beb7dadf595f1d08bde261c9986986a1335d0c00d581a6d0c"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/process-fixture-results.json",
|
||||
"sha256": "sha256:fc72ce36758ea40010aeb7c4ce97c167d09784fde63eeb9b2ccaa3428dc9a831"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/process_supervision.py",
|
||||
"sha256": "sha256:4d990ee05003040e74bfdac7b2e49a3ef1512d4a054b3ff2317647b3670dd1bf"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/r1-preservation.json",
|
||||
"sha256": "sha256:50848ad45fda68f43e11710bb04b0793717a5d0659e3fbcf8003708ee5ccb542"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/r1-to-r2.patch",
|
||||
"sha256": "sha256:63f35421b67576188ff92d920319a23aa0a6606b9a2137d1061687c77126b541"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/r2-initial-readonly-dry-run.json",
|
||||
"sha256": "sha256:631c6f0d8c0f66f51509751094937fd909821d4f45a042fd77f9d10f237115b8"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/retained-headroom-refusal.json",
|
||||
"sha256": "sha256:89c847b4a75f138ff2464fc8291cf36939d293a777fd41ffd41d72f96ba9a2f8"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/retained-local-source-refusal.json",
|
||||
"sha256": "sha256:fdd3b584da6ebedc173ccc5f8879c42dbd821d4b98338337fbef809a403485ba"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/runtime.py",
|
||||
"sha256": "sha256:19b5fb687288bbc836978b0251599dc1e4d1593e8b5efee85a6abb6a7f388412"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/target-readonly-addendum.json",
|
||||
"sha256": "sha256:9588f51b353093d178b8c52892ca627c2317fab761591715a0765603a4182a8f"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/target-readonly-observation.json",
|
||||
"sha256": "sha256:ba4012303e5634686208a818b221113a1a670c31ed29269d8a4cc98308616275"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/test_process_supervision.py",
|
||||
"sha256": "sha256:7ea89d9dee17d6ac4b554e25c083ac43d9b94039a4bcbe411d0e2ccbfb55a180"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/transfer-archive.json",
|
||||
"sha256": "sha256:3222ccd39ea968353ea5e58ec36f0e3ca35b608020444243b053074a36abfe0b"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/FINAL-PROPOSAL.md",
|
||||
"sha256": "sha256:7d5741abc7da042d4de6cd36437801309b844760f606b3145d615fd75d6b2d30"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/action-inputs.json",
|
||||
"sha256": "sha256:f37f6263e364e0caf4903a7374203224146f9655e9fec63e04c70b96b4351dbb"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/artifact-manifest.json",
|
||||
"sha256": "sha256:19d3a74b124a9a7236bd4b8f6fe45656b4651d875017486f0dfa515f3f81d806"
|
||||
}
|
||||
],
|
||||
[
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/cleanup-upload-staging.py",
|
||||
"sha256": "sha256:d007c297d80cffad2b42040d92f8335c6bae8aa13021098256222dea0c76f3d3"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/execute-verify.py",
|
||||
"sha256": "sha256:252cf6dfb5c501bc82259f0370b2912f73b1edfeb60b2d7af9036d4b82588ed5"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/final-readonly-dry-run.json",
|
||||
"sha256": "sha256:d7d273b2df07e919d0a1b35b765d9e6722f9cb215ce91d8553e79326384c5a7d"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/frozen-native-argv.json",
|
||||
"sha256": "sha256:0efb13aa725111cc227453bc7fc40eaf039c83cbd291ca7cb0409daf6b1e6c55"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/local-fixture-results.json",
|
||||
"sha256": "sha256:339b2fcfd8d407e09874592b681830c605a463a88841351eed494a182d677219"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/process_supervision.py",
|
||||
"sha256": "sha256:ec08fe309b36e55a0013e73d35b4db3a8eed9cdf32412a923cbafa83f68788c4"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/r2-baseline.json",
|
||||
"sha256": "sha256:caaea4ca1b6bfa7fd765a3f4e5fe556d9484b77eac388af6ff20735d6962f81d"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/r2-to-r3-supervisor.patch",
|
||||
"sha256": "sha256:00f5540bed786b912d8c3ce8aaa3fc012b4cf3eb208edbbe0d15139dcc533c09"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/r2-zombie-counterexample.json",
|
||||
"sha256": "sha256:c4a81c396e02e3bf372d6cd31f69c8030574576c171c8b455e8ca641106a1f83"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/reproduce-r2.py",
|
||||
"sha256": "sha256:dce2d3cd5fa2c55a9ad84cbdd5f133d71ea483ada4ba88cc76997640e928de60"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/retained-fixture-refinement.json",
|
||||
"sha256": "sha256:2d171d188345637a4e862a76ab917a39854c94058338d7c31c8c8ce397d8da51"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/runtime.py",
|
||||
"sha256": "sha256:19b5fb687288bbc836978b0251599dc1e4d1593e8b5efee85a6abb6a7f388412"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/source-contract-pins.json",
|
||||
"sha256": "sha256:900475059e62063ea899ef42bc3de9c9edf794c7113b3f4a46491a3984090b6b"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/test_process_supervision.py",
|
||||
"sha256": "sha256:93a6c98ccf971ea18bd5e9efffcc7c5a6b0456540cae9856d1addf5e38a88239"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/test_receipt_cleanup.py",
|
||||
"sha256": "sha256:1c64e3e68cb42a539e5b63c4137f56ff3d6924840ba4eb9cbfd8bb329f0d0616"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/verify-installed.py",
|
||||
"sha256": "sha256:846369568edf016e5122e30fdd861f855e77c14713b644ddd175d1181afe6b93"
|
||||
}
|
||||
],
|
||||
[
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/FINAL-PROPOSAL.md",
|
||||
"sha256": "sha256:408d779a19e0e83b3be9a80ad624c1f7b7be906d22c0a8efe6e629185cc0cd0a"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/approval-decision.json",
|
||||
"sha256": "sha256:ac6d9534d90e8af99af250f716b953b43ca9108f9a06df9567a727ccb6e74be4"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/installed-partial-verification.json",
|
||||
"sha256": "sha256:8da5a42a68a6f21b92a925fe36fe233ac153c2762846a29d0710e368b05f6fff"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/root-review.json",
|
||||
"sha256": "sha256:bc8016d73bc435a184dbfce881a37bb63b82075a20d3e0c59c6701a2e6bfb35e"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/pending-decision.json",
|
||||
"sha256": "sha256:e0d053b431813a548c94bde0e18f92cd7edffe3764255cb8ba929e6c5113b5ba"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/checkpoint-progress.json",
|
||||
"sha256": "sha256:b62c553375b4ffd5670297db341c776be8a22b750fbcc77b06a486941c8e2843"
|
||||
},
|
||||
{
|
||||
"path": ".kaizen/agents/custodian-codex/supervision.json",
|
||||
"sha256": "sha256:e059610e44c209cc53ed93d5c4c9024d8600ab65df9e20c9ffaddb05efc6e170"
|
||||
},
|
||||
{
|
||||
"path": "docs/netkingdom-target-implementation.md",
|
||||
"sha256": "sha256:af545b07e448f5b42330d85f16b5ee9db4133ebae914f82246227bdd8ecfa8e7"
|
||||
},
|
||||
{
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md",
|
||||
"sha256": "sha256:3ef9aff203bf01116fcb5a0c20517ef7e8098155f5004b21b9cff654bc872193"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/approval-decision.json",
|
||||
"sha256": "sha256:5c70349ecbae11451a36c470af76ef0ae09ae419e7e63ae6f7bff8052f64bf83"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/approved-preflight.json",
|
||||
"sha256": "sha256:2530ba1bb93a8581d950c18c92c391ae2009089180f17b77b7e2575e2d018de0"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/key39-infra-finalization-r1/ASSESSMENT.md",
|
||||
"sha256": "sha256:6fa24e6dab7a26356caaba07bb539538e22a0b9af2dd19c765b6007978ae8bcd"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/key39-infra-finalization-r1/assessment.json",
|
||||
"sha256": "sha256:af2538f41aa761c281cce555ffbda69a195ed06d5f87f1e63ad88acff35d6be4"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/key39-infra-finalization-r1/current-pins.json",
|
||||
"sha256": "sha256:9befcb455d1f2e350a36fc1160eb3fa917deca4da2dde15cc2cb76d5d528c0d0"
|
||||
},
|
||||
{
|
||||
"path": "docs/changes/netkingdom-target-2026-10-17/key39-infra-finalization-r1/manifest.json",
|
||||
"sha256": "sha256:5dfdb59242d8f4743178b8f6cd8bba71bf86592172eb4666642b1f2ddda8cdeb"
|
||||
}
|
||||
]
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,114 @@
|
|||
"""Publish explicit public trial evidence through normal commit and sync gates."""
|
||||
import argparse
|
||||
import hashlib
|
||||
import json
|
||||
from pathlib import Path
|
||||
import subprocess
|
||||
|
||||
ROOT = Path('/home/worsch/the-custodian')
|
||||
HERE = Path(__file__).resolve().parent
|
||||
PLAN = json.loads((HERE / 'inputs.json').read_text())
|
||||
BACKUP = HERE / 'unrelated-backup'
|
||||
ORIGINALS = json.loads((BACKUP / 'originals.json').read_text())
|
||||
|
||||
|
||||
def git(*args):
|
||||
return subprocess.check_output(['git', '-C', str(ROOT), *args],
|
||||
stderr=subprocess.PIPE, timeout=40).decode()
|
||||
|
||||
|
||||
def preserved():
|
||||
for name, row in ORIGINALS.items():
|
||||
assert hashlib.sha256((ROOT / name).read_bytes()).hexdigest() == row['sha256']
|
||||
assert git('ls-files', '--stage', '--', name) == row['index']
|
||||
|
||||
|
||||
def source_join(expected, actual, label):
|
||||
if actual == expected:
|
||||
return
|
||||
git('merge-base', '--is-ancestor', expected, actual)
|
||||
changed = set(git('diff', '--name-only', expected, actual).splitlines())
|
||||
ours = {r['path'] for rows in PLAN['batches'] for r in rows}
|
||||
ours |= {str((HERE / name).relative_to(ROOT)) for name in ('inputs.json', 'publish.py')}
|
||||
assert not changed & ours, 'concurrent source overlap requires review'
|
||||
record = HERE / (label + '-concurrent-source.json')
|
||||
assert not record.exists()
|
||||
record.write_text(json.dumps({'expected': expected, 'actual': actual,
|
||||
'intervening_paths': sorted(changed), 'overlap_with_selected_paths': False,
|
||||
'history_preserved': True}, indent=2) + '\n')
|
||||
|
||||
|
||||
def restore_generated():
|
||||
for name in ('.custodian-brief.md', 'WORK-RECORDS.md'):
|
||||
row = ORIGINALS[name]
|
||||
(ROOT / name).write_bytes((BACKUP / (name + '.worktree')).read_bytes())
|
||||
mode, oid, stage, path = row['index'].split()
|
||||
assert stage == '0'
|
||||
git('update-index', '--cacheinfo', mode, oid, path)
|
||||
preserved()
|
||||
|
||||
|
||||
def command(label, argv, timeout):
|
||||
output = HERE / (label + '.json')
|
||||
assert not output.exists(), 'prior receipt: review before any retry'
|
||||
cp = subprocess.run(argv, cwd=ROOT, capture_output=True, text=True, timeout=timeout)
|
||||
output.write_text(cp.stdout)
|
||||
(HERE / (label + '.stderr.txt')).write_text(cp.stderr)
|
||||
assert cp.returncode == 0, label + ' refused; receipt retained'
|
||||
return cp
|
||||
|
||||
|
||||
def main():
|
||||
p = argparse.ArgumentParser()
|
||||
p.add_argument('batch', type=int)
|
||||
n = p.parse_args().batch
|
||||
expected = PLAN['base_commit'] if n == 0 else json.loads(
|
||||
(HERE / f'batch-{n - 1}.json').read_text())['commit']
|
||||
current = git('rev-parse', 'HEAD').strip()
|
||||
source_join(expected, current, f'batch-{n}-before')
|
||||
expected = current
|
||||
assert not (HERE / f'batch-{n}.json').exists()
|
||||
preserved()
|
||||
rows = PLAN['batches'][n]
|
||||
for row in rows:
|
||||
assert 'sha256:' + hashlib.sha256((ROOT / row['path']).read_bytes()).hexdigest() == row['sha256']
|
||||
paths = [r['path'] for r in rows]
|
||||
if n == len(PLAN['batches']) - 1:
|
||||
paths += [str((HERE / name).relative_to(ROOT)) for name in ('inputs.json', 'publish.py')]
|
||||
git('add', '--', *paths)
|
||||
cp = subprocess.run(['git', '-C', str(ROOT), 'commit', '--only', '-m',
|
||||
f'Record failed runtime trial and reviewed verification proposal ({n+1}/{len(PLAN["batches"])})',
|
||||
'--', *paths], capture_output=True, text=True, timeout=240)
|
||||
head = git('rev-parse', 'HEAD').strip()
|
||||
receipt = {'parent': expected, 'commit': head, 'paths': paths,
|
||||
'commit_exit_code': cp.returncode, 'stdout': cp.stdout, 'stderr': cp.stderr}
|
||||
(HERE / f'batch-{n}.json').write_text(json.dumps(receipt, indent=2) + '\n')
|
||||
preserved()
|
||||
assert cp.returncode == 0, 'normal commit refused; receipt retained'
|
||||
assert set(git('diff-tree', '--no-commit-id', '--name-only', '-r', head).splitlines()) == set(paths)
|
||||
try:
|
||||
command(f'batch-{n}-consistency', ['statehub', 'fix-consistency', '--repo', 'the-custodian', '--json'], 300)
|
||||
if n == len(PLAN['batches']) - 1:
|
||||
command(f'batch-{n}-projection', ['/home/worsch/repo-manager/.venv/bin/rmgr', 'sync',
|
||||
'--path', str(ROOT), '--push'], 180)
|
||||
finally:
|
||||
restore_generated()
|
||||
if n == len(PLAN['batches']) - 1:
|
||||
projection = json.loads((HERE / f'batch-{n}-projection.json').read_text())
|
||||
assert projection['status'] == 'applied'
|
||||
receiving = projection['receipt']
|
||||
assert receiving['expected_commit'] == receiving['derived_commit'] == projection['commit']
|
||||
source_join(head, projection['commit'], f'batch-{n}-projected')
|
||||
assert (receiving['instance_role'], receiving['instance_label']) == ('primary', 'railiance01')
|
||||
remote = git('ls-remote', 'origin', 'refs/heads/main').split()[0]
|
||||
source_join(head, remote, f'batch-{n}-published')
|
||||
live = git('rev-parse', 'HEAD').strip()
|
||||
if live != remote:
|
||||
source_join(remote, live, f'batch-{n}-after')
|
||||
preserved()
|
||||
print(json.dumps({'status': 'published_and_projected' if n == len(PLAN['batches']) - 1 else 'published_evidence_projection_waits_for_committed_workplan', 'batch': n, 'commit': head,
|
||||
'paths': len(paths), 'unrelated_preserved': True}))
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
|
|
@ -982,3 +982,64 @@ Evidence: dated 17 October `native-identity-r1`, `native-registration-r1`,
|
|||
`consumer-outage-owner-followthrough-r1/verified-bindings.json`,
|
||||
`native-source-publication-r1/verified-bindings.json`, and
|
||||
`storage-share-tls-r1/source-history-followthrough-r2.json`.
|
||||
|
||||
## Partial runtime installation and pending verification, 2026-10-17
|
||||
|
||||
Founder approval `b6abb6ab-b182-4b4f-9f84-79ddc5ad91f3` authorized exact
|
||||
installation proposal revision 2, SHA256
|
||||
`44b17589c323e1a966caf6c1b1def123092ee289b929c8ea014bc84109103b1d`.
|
||||
It ran once and installed the inactive runtime with complete native digest
|
||||
`f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d`.
|
||||
The offline rehearsal then failed with `phase_receipt_unavailable`; its process
|
||||
supervisor reported `leader_left_descendants`, followed by positive process
|
||||
quiescence. Independent readback verified the complete installed digest and
|
||||
absence of owned staging. This is a failed trial with
|
||||
a verified partial installation, not launcher acceptance or a closed target gate.
|
||||
|
||||
A local counterexample reproduces a zombie-classification defect in the frozen
|
||||
revision 2 source. The native failure's cause remains unproven because that run
|
||||
did not retain its process trace. Verification-only revision 3 repairs the
|
||||
demonstrated defect and retains a durable public process receipt before cleanup.
|
||||
Its original three launcher checks remain required. Root source review, all
|
||||
18 candidate file pins, 29 frozen revision 2 file pins and five focused local
|
||||
process/cleanup checks passed. These local checks establish no native acceptance.
|
||||
|
||||
The founder approved exact revision 3, SHA256
|
||||
`7d5741abc7da042d4de6cd36437801309b844760f606b3145d615fd75d6b2d30`,
|
||||
under decision `bec667cc-15ea-4f87-ae16-111f08562e48`. Its fresh read-only
|
||||
preflight refused CPU headroom (99.25% busy; limit 85%) before any remote write
|
||||
or launcher call. No revision 3 execution receipt exists and no automatic poll
|
||||
or retry follows. The approved helper has no installation or runtime archive
|
||||
transfer path. Infrastructure cost and interruption/recovery loss in EUR remain
|
||||
unknown. No model call, credential/profile/queue change, Custodian migration,
|
||||
autopilot grant or native target gate closure follows from either preparation.
|
||||
|
||||
Evidence: `native-runtime-install-r2/execution-receipt.json`,
|
||||
`native-runtime-install-review-r2/installed-partial-verification.json`,
|
||||
`native-runtime-install-r3/FINAL-PROPOSAL.md`, and
|
||||
`native-runtime-install-review-r3/{root-review,approval-decision,approved-preflight}.json`
|
||||
in the dated 17 October packet.
|
||||
|
||||
## KEY-WP-0039 finalization review, 2026-10-17
|
||||
|
||||
The user-directed review confirms its source deliverables remain complete:
|
||||
T01 and T03 are done, and all 14 reviewed executable/test/producer-decision
|
||||
pins plus three Platform source pins still match. The later workplan narrative
|
||||
is not a change to those reviewed executables. Existing source acceptance,
|
||||
registration go `caafe4be-4f68-47b4-9567-316d47b94992` and the standing attended
|
||||
rule remain valid; no new helper protocol or repeated registration approval is
|
||||
needed.
|
||||
|
||||
The parent cannot finish yet. T02 requires actual negative-claim/expiry refusals,
|
||||
a committed value-free receipt and removal of the probe clients. No such native
|
||||
receipt was found in the bounded owner-source search. KEY-WP-0038-T02/T03 remain
|
||||
open prerequisites, and Platform's 17 October return still identifies the existing
|
||||
coding-client custody proposal as unadmitted. Node route, live role/plugin/leeway
|
||||
and private custody facts remain its existing attended owner obligations.
|
||||
|
||||
The remaining sequence is the existing Forgejo registration/claims proof,
|
||||
admission of the existing coding-client proposal and owner readiness returns,
|
||||
then the attended negative/revoke/cleanup proof. KEY39 stays active with T02
|
||||
waiting. Infrastructure source-review approval supplies no missing native proof.
|
||||
Evidence: `key39-infra-finalization-r1/assessment.json` and its linked owner
|
||||
reviews in the dated 17 October packet.
|
||||
|
|
|
|||
|
|
@ -1169,3 +1169,40 @@ bindings and `storage-share-tls-r1/source-history-followthrough-r2.json`.
|
|||
All current task statuses remain appropriate: T03/T05/T06 progress, T04 todo,
|
||||
T01/T02 done. No completion percentage or native closure is inferred from the
|
||||
new completed source-review tasks. This remains the active implementation goal.
|
||||
|
||||
## Failed runtime trial with verified partial installation, 2026-10-17
|
||||
|
||||
Exact founder-approved installation revision 2 ran once under decision
|
||||
`b6abb6ab-b182-4b4f-9f84-79ddc5ad91f3`. The inactive f599 runtime is installed
|
||||
and its complete native digest independently verified. The required offline
|
||||
launcher rehearsal failed (`phase_receipt_unavailable`, supervision reason
|
||||
`leader_left_descendants`). Its watchdog reported positive process quiescence;
|
||||
independent readback verified the full installed digest and owned staging absence.
|
||||
The same supervised trial records failure; no native target
|
||||
gate or runtime acceptance is complete.
|
||||
|
||||
The frozen source has a locally reproduced zombie-classification bug, but the
|
||||
native failure's cause remains unproven. Reviewable verification-only revision 3
|
||||
repairs that source defect and preserves a durable public receipt before cleanup,
|
||||
keeping the full three-launcher acceptance requirement. Root verified 18 candidate
|
||||
and 29 frozen revision 2 file pins; five focused local process/cleanup checks pass.
|
||||
The founder approved exact revision 3 under
|
||||
`bec667cc-15ea-4f87-ae16-111f08562e48`, proposal SHA256
|
||||
`7d5741abc7da042d4de6cd36437801309b844760f606b3145d615fd75d6b2d30`.
|
||||
Its fresh read-only preflight refused CPU headroom (99.25% busy; limit 85%).
|
||||
No revision 3 remote write, launcher call or automatic retry occurred.
|
||||
No reinstall, model call, credential/profile/queue change or autonomous live
|
||||
retry is authorized by the failed revision 2 run. EUR cost/risk remain unknown.
|
||||
All six task blocks, UUIDs and statuses remain unchanged; all sixteen native
|
||||
target gates remain open. Evidence is linked from the implementation document's
|
||||
dated partial-runtime-installation checkpoint.
|
||||
|
||||
2026-10-17 user-directed KEY-WP-0039 finalization review: its accepted source
|
||||
deliverables remain done (T01/T03); all 14 reviewed executable/test/decision pins
|
||||
and three Platform pins still match. Existing registration go and standing
|
||||
attended authorization remain valid. T02's actual negative/expiry/revoke/cleanup
|
||||
receipt is absent in the bounded source search; KEY38-T02/T03 and the existing
|
||||
unadmitted coding-client custody/owner readiness returns remain prerequisites.
|
||||
The parent stays active, T02 waits, and no native gate closes. No new helper
|
||||
protocol or repeated source/registration approval is required. Evidence:
|
||||
`docs/changes/netkingdom-target-2026-10-17/key39-infra-finalization-r1/`.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue