From c7bd0a17dd14f06c9984ecbb400ad63e672c6a67 Mon Sep 17 00:00:00 2001 From: codex Date: Sun, 1 Nov 2026 23:28:44 +0100 Subject: [PATCH] docs: preserve reviewed NetKingdom session artifacts --- .../build-transfer.py | 71 ++ .../cleanup-upload-staging.py | 31 + .../cpu-readonly-observation.json | 1 + .../executable-readonly-observation.json | 1 + .../execute-install.py | 155 +++ .../final-readonly-dry-run.json | 71 ++ .../install-verified.py | 213 ++++ .../local-transfer-check.py | 28 + .../local-transfer-verification.json | 12 + .../pre-absolute-path-dry-run.json | 71 ++ .../retained-headroom-refusal.json | 20 + .../native-runtime-install-r1/runtime.py | 52 + .../target-readonly-addendum.json | 1 + .../target-readonly-observation.json | 125 ++ .../transfer-archive.json | 7 + .../approved-preflight-summary.json | 14 + .../pending-decision.json | 7 + .../root-review.json | 23 + .../verify-installed.py | 29 + .../headroom-refusal-progress.json | 14 + .../native-completion-progress.json | 14 + .../supervision-before-outcome-update.json | 1004 +++++++++++++++ .../supervision-before-r3-controller.json | 1079 +++++++++++++++++ .../supervision-report.json | 22 + .../custodian-batch-0.json | 31 + .../custodian-batch-1.json | 31 + .../custodian-batch-2.json | 31 + .../custodian-batch-3.json | 31 + .../custodian-batch-4.json | 31 + .../custodian-batch-5.json | 31 + .../custodian-batch-6.json | 20 + .../custodian-consistency.json | 130 ++ .../custodian-consistency.stderr.txt | 1 + .../custodian-projection.json | 292 +++++ .../custodian-projection.stderr.txt | 0 .../.custodian-brief.md.worktree | 85 ++ .../unrelated-backup/WORK-RECORDS.md.worktree | 272 +++++ .../unrelated-backup/originals.json | 1 + .../publish_owner.py | 73 ++ .../batch-0-consistency.json | 131 ++ .../batch-0-consistency.stderr.txt | 1 + .../batch-0-projection.json | 8 + .../batch-0-projection.stderr.txt | 0 .../native-source-publication-r3/batch-0.json | 25 + .../batch-1-consistency.json | 120 ++ .../batch-1-consistency.stderr.txt | 1 + .../native-source-publication-r3/batch-1.json | 25 + .../batch-2-before-concurrent-source.json | 9 + .../batch-2-consistency.json | 120 ++ .../batch-2-consistency.stderr.txt | 1 + 50 files changed, 4566 insertions(+) create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/build-transfer.py create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/cleanup-upload-staging.py create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/cpu-readonly-observation.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/executable-readonly-observation.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/execute-install.py create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/final-readonly-dry-run.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/install-verified.py create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/local-transfer-check.py create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/local-transfer-verification.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/pre-absolute-path-dry-run.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/retained-headroom-refusal.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/runtime.py create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/target-readonly-addendum.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/target-readonly-observation.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/transfer-archive.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/approved-preflight-summary.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/pending-decision.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/root-review.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/verify-installed.py create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/headroom-refusal-progress.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/native-completion-progress.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/supervision-before-outcome-update.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/supervision-before-r3-controller.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/supervision-report.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-batch-0.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-batch-1.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-batch-2.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-batch-3.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-batch-4.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-batch-5.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-batch-6.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-consistency.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-consistency.stderr.txt create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-projection.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-projection.stderr.txt create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/unrelated-backup/.custodian-brief.md.worktree create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/unrelated-backup/WORK-RECORDS.md.worktree create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/unrelated-backup/originals.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r2/publish_owner.py create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-0-consistency.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-0-consistency.stderr.txt create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-0-projection.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-0-projection.stderr.txt create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-0.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-1-consistency.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-1-consistency.stderr.txt create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-1.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-2-before-concurrent-source.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-2-consistency.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-2-consistency.stderr.txt diff --git a/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/build-transfer.py b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/build-transfer.py new file mode 100644 index 00000000..3b645971 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/build-transfer.py @@ -0,0 +1,71 @@ +#!/usr/bin/env python3 +"""Deterministic public-runtime transfer; no runtime launch or network access.""" +import argparse +import gzip +import hashlib +import importlib.util +import io +import json +import os +from pathlib import Path +import stat +import tarfile + +ROOT = Path('/tmp/netkingdom-runtime-canonical-20261016/runtime') +EXPECTED = 'f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d' +HERE = Path(__file__).resolve().parent + + +class CountingHash: + def __init__(self, target=None): + self.target, self.hash, self.size = target, hashlib.sha256(), 0 + def write(self, value): + self.hash.update(value); self.size += len(value) + if self.target: self.target.write(value) + return len(value) + def flush(self): + if self.target: self.target.flush() + + +def runtime_module(): + p = HERE/'runtime.py' + spec = importlib.util.spec_from_file_location('reviewed_runtime_digest', p) + module = importlib.util.module_from_spec(spec); spec.loader.exec_module(module) + return module + + +def build(target=None): + if runtime_module().runtime_digest(ROOT) != EXPECTED: + raise ValueError('source_runtime_changed') + result = CountingHash(target); logical = 0; members = 0 + with gzip.GzipFile(filename='', mode='wb', compresslevel=6, mtime=0, fileobj=result) as stream: + with tarfile.open(fileobj=stream, mode='w|', format=tarfile.PAX_FORMAT) as archive: + for p in [ROOT, *sorted(ROOT.rglob('*'))]: + s=p.lstat(); name='runtime' + ('/'+p.relative_to(ROOT).as_posix() if p!=ROOT else '') + info=tarfile.TarInfo(name);info.uid=1000;info.gid=1000;info.mtime=0;info.mode=stat.S_IMODE(s.st_mode) + if stat.S_ISDIR(s.st_mode):info.type=tarfile.DIRTYPE + elif stat.S_ISLNK(s.st_mode): + info.type=tarfile.SYMTYPE; info.linkname=os.readlink(p) + if Path(info.linkname).is_absolute() or not p.resolve(strict=True).is_relative_to(ROOT): + raise ValueError('unsafe_runtime_symlink') + elif stat.S_ISREG(s.st_mode):info.type=tarfile.REGTYPE; info.size=s.st_size; logical += s.st_size + else:raise ValueError('runtime_special_file') + with p.open('rb') if stat.S_ISREG(s.st_mode) else io.BytesIO() as data: + archive.addfile(info,data if stat.S_ISREG(s.st_mode) else None) + members+=1 + if runtime_module().runtime_digest(ROOT) != EXPECTED: + raise ValueError('source_runtime_changed_during_archive') + return {'sha256':'sha256:'+result.hash.hexdigest(),'bytes':result.size,'logical_file_bytes':logical,'members':members, + 'format':'gzip mtime0; PAX tar; sorted tree; root runtime; UID/GID1000; modes and relative symlinks retained'} + + +def main(): + parser=argparse.ArgumentParser(description=__doc__);parser.add_argument('--output',type=Path) + args=parser.parse_args() + if args.output: + with args.output.open('xb') as stream:result=build(stream) + else:result=build() + print(json.dumps(result,sort_keys=True)) + + +if __name__=='__main__':main() diff --git a/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/cleanup-upload-staging.py b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/cleanup-upload-staging.py new file mode 100644 index 00000000..bf627876 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/cleanup-upload-staging.py @@ -0,0 +1,31 @@ +#!/usr/bin/env python3 +"""Conditional cleanup only when the durable receipt proves exec never started.""" +import argparse,json,shlex,subprocess +from pathlib import Path +HERE=Path(__file__).resolve().parent + +def main(): + p=argparse.ArgumentParser(description=__doc__);p.add_argument('--apply',action='store_true');args=p.parse_args() + receipt=json.loads((HERE/'execution-receipt.json').read_text()) + if not (receipt.get('status')=='staging_created' and receipt.get('phase')=='before_transfer' + and receipt.get('proposal_id')=='REINAH-WP-0008-T07-install-f599-r1'): + raise ValueError('not_a_preexecution_upload_failure') + inode=receipt['staging_identity']['inode'] + if not args.apply: + print(json.dumps({'status':'conditional_cleanup_review','inode':inode,'native_mutations':0}));return 0 + code=r'''import json,os,shutil,stat,sys +from pathlib import Path +p=Path('/home/tegwick/.helixforge-factory/runtime-install-f599-r1-20261017');s=p.lstat() +assert os.getuid()==1000 and os.getgid()==1000 and stat.S_ISDIR(s.st_mode) and s.st_uid==1000 and s.st_gid==1000 and stat.S_IMODE(s.st_mode)==0o700 and s.st_dev==2049 and s.st_ino==int(sys.argv[1]) +assert {f.name for f in p.iterdir()} <= {'runtime.tar.gz','runtime.py','install-verified.py'} +for f in p.iterdir(): + s=f.lstat();assert stat.S_ISREG(s.st_mode) and s.st_uid==1000 and not stat.S_ISLNK(s.st_mode) +shutil.rmtree(p);print(json.dumps({'status':'owned_upload_staging_removed','absent':not p.exists()}))''' + cp=subprocess.run(['ssh','-o','BatchMode=yes','-o','ConnectTimeout=15','railiance01','/usr/bin/python3 -I -B -c '+shlex.quote(code)+' '+shlex.quote(str(inode))],capture_output=True,text=True,timeout=30) + if cp.returncode:raise RuntimeError('conditional_cleanup_refused_or_uncertain') + result=json.loads(cp.stdout);(HERE/'upload-cleanup-receipt.json').write_text(json.dumps(result,indent=2)+'\n');print(json.dumps(result));return 0 + +if __name__=='__main__': + try:raise SystemExit(main()) + except Exception as exc: + print(json.dumps({'status':'cleanup_refused_or_uncertain','failure_type':type(exc).__name__}));raise SystemExit(1) from None diff --git a/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/cpu-readonly-observation.json b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/cpu-readonly-observation.json new file mode 100644 index 00000000..7ff59ca7 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/cpu-readonly-observation.json @@ -0,0 +1 @@ +{"sample_seconds": 0.5, "cpu_busy_fraction": 0.9949748743718593} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/executable-readonly-observation.json b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/executable-readonly-observation.json new file mode 100644 index 00000000..61ef674f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/executable-readonly-observation.json @@ -0,0 +1 @@ +{"python_executable": "/usr/bin/python3", "kubectl": "/usr/local/bin/kubectl", "bwrap": "/usr/bin/bwrap", "system_python_resolved": "/usr/bin/python3.12"} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/execute-install.py b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/execute-install.py new file mode 100644 index 00000000..eea881a3 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/execute-install.py @@ -0,0 +1,155 @@ +#!/usr/bin/env python3 +"""Install-only orchestration. Default is read-only; --apply requires founder go.""" +import argparse +from datetime import datetime, timezone +import hashlib +import importlib.util +import json +import os +from pathlib import Path +import shlex +import subprocess +import sys +import tempfile + +HERE=Path(__file__).resolve().parent +DIGEST='f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d' +STAGE='/home/tegwick/.helixforge-factory/runtime-install-f599-r1-20261017' +STORE='/home/tegwick/.helixforge-factory/runtimes' +SOURCE=Path('/tmp/netkingdom-runtime-canonical-20261016/runtime') + +READ_TARGET=r'''import json,os,pwd,stat,subprocess,shutil,time +from pathlib import Path +store=Path('/home/tegwick/.helixforge-factory/runtimes'); stage=Path('/home/tegwick/.helixforge-factory/runtime-install-f599-r1-20261017');digest='f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d' +def meta(p): + try: + s=p.lstat();return {'uid':s.st_uid,'gid':s.st_gid,'mode':oct(stat.S_IMODE(s.st_mode)),'device':s.st_dev,'inode':s.st_ino,'directory':stat.S_ISDIR(s.st_mode),'symlink':stat.S_ISLNK(s.st_mode)} + except FileNotFoundError:return None +cp=subprocess.run(['/usr/local/bin/kubectl','get','nodes','-o','json'],capture_output=True,timeout=20) +assert cp.returncode==0 +nodes=json.loads(cp.stdout)['items'];assert len(nodes)==1 +mem=dict(x.split(':',1) for x in Path('/proc/meminfo').read_text().splitlines()) +read_cpu=lambda:[int(x) for x in Path('/proc/stat').read_text().splitlines()[0].split()[1:9]] +a=read_cpu();time.sleep(1);b=read_cpu();d=[y-x for x,y in zip(a,b)];busy=1-(d[3]+d[4])/sum(d) +print(json.dumps({'account':pwd.getpwuid(os.getuid()).pw_name,'uid':os.getuid(),'gid':os.getgid(),'store':meta(store),'destination':meta(store/digest),'stage':meta(stage),'memory_available_bytes':int(mem['MemAvailable'].split()[0])*1024,'disk_free_bytes':shutil.disk_usage(store).free,'load_average':list(os.getloadavg()),'cpu_count':os.cpu_count(),'cpu_busy_fraction':busy,'cpu_sample_seconds':1,'node_addresses':nodes[0]['status']['addresses'],'node_ready':any(c['type']=='Ready' and c['status']=='True' for c in nodes[0]['status']['conditions'])}))''' + + +def sha(path): + with path.open('rb') as stream:return 'sha256:'+hashlib.file_digest(stream,'sha256').hexdigest() + + +def command(argv,timeout=60): + cp=subprocess.run(argv,stdout=subprocess.PIPE,stderr=subprocess.DEVNULL,timeout=timeout) + if cp.returncode:raise RuntimeError('command_failed') + return cp.stdout + + +def ssh(code,args=(),timeout=60): + remote='/usr/bin/python3 -I -B -c '+shlex.quote(code) + if args:remote+=' '+' '.join(shlex.quote(str(x)) for x in args) + return json.loads(command(['ssh','-o','BatchMode=yes','-o','ConnectTimeout=15','railiance01',remote],timeout)) + + +def module(name,path): + spec=importlib.util.spec_from_file_location(name,path) + result=importlib.util.module_from_spec(spec);spec.loader.exec_module(result);return result + + +def preflight(): + inputs=json.loads((HERE/'action-inputs.json').read_text()) + for name,expected in inputs['helper_hashes'].items(): + if sha(HERE/name)!=expected:raise ValueError('helper_changed') + if module('reviewed_runtime_reader',HERE/'runtime.py').runtime_digest(SOURCE)!=DIGEST: + raise ValueError('source_changed') + observation=ssh(READ_TARGET) + store=observation['store'] + expected=json.loads((HERE/'target-readonly-observation.json').read_text())['paths'][STORE] + checks={ + 'account':observation['account']=='tegwick' and observation['uid']==1000 and observation['gid']==1000, + 'protected_store':store['uid']==1000 and store['gid']==1000 and store['mode']=='0o700' and store['directory'] and not store['symlink'] and store['device']==expected['device'] and store['inode']==expected['inode'], + 'destination_absent':observation['destination'] is None, + 'staging_absent':observation['stage'] is None, + 'exact_ready_node':observation['node_ready'] and any(x['address']=='92.205.62.239' for x in observation['node_addresses']), + 'disk_headroom':observation['disk_free_bytes']>=2*1024**3, + 'memory_headroom':observation['memory_available_bytes']>=1024**3, + 'load_headroom':observation['load_average'][0]<=2*observation['cpu_count'], + 'cpu_headroom':observation['cpu_busy_fraction']<=0.85, + } + observation['checks']=checks + return inputs,observation + + +def save(path,value): + fd=os.open(path,os.O_WRONLY|os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW,0o600) + with os.fdopen(fd,'w') as stream:json.dump(value,stream,indent=2);stream.write('\n') + + +def main(): + parser=argparse.ArgumentParser(description=__doc__) + parser.add_argument('--apply',action='store_true');parser.add_argument('--dry-run',action='store_true') + args=parser.parse_args() + if args.apply and args.dry_run:raise ValueError('conflicting_modes') + inputs,observation=preflight() + if not args.apply: + report={'status':'read_only_dry_run_passed' if all(observation['checks'].values()) else 'read_only_dry_run_blocked','proposal_id':inputs['proposal_id'],'revision':1, + 'observed_at':datetime.now(timezone.utc).isoformat(),'target':observation, + 'source_runtime_complete_digest_verified':True,'archive':inputs['archive'], + 'remote_mutations':0,'provider_calls':0,'private_configuration_reads':False, + 'next_exact_command':'python3 -I -B '+str(HERE/'execute-install.py')+' --apply'} + print(json.dumps(report,sort_keys=True));return 0 if all(observation['checks'].values()) else 2 + if not all(observation['checks'].values()):raise ValueError('target_headroom_or_identity_refused') + receipt=HERE/'execution-receipt.json' + if receipt.exists():raise ValueError('prior_attempt_requires_reconciliation') + save(receipt,{'status':'intent_recorded','proposal_id':inputs['proposal_id'],'revision':1, + 'automatic_retry':False,'observed_at':datetime.now(timezone.utc).isoformat()}) + # No native attempt is retried by this helper. Intent survives an SSH loss. + with tempfile.TemporaryDirectory(prefix='nk-runtime-install-r1-') as temporary: + archive=Path(temporary)/'runtime.tar.gz' + with archive.open('xb') as stream:built=module('reviewed_transfer',HERE/'build-transfer.py').build(stream) + if built!=inputs['archive']:raise ValueError('archive_changed') + archive.chmod(0o600) + create=r'''import json,os,stat,time +from pathlib import Path +assert os.getuid()==1000 and os.getgid()==1000 +store=Path('/home/tegwick/.helixforge-factory/runtimes');s=store.lstat() +assert stat.S_ISDIR(s.st_mode) and s.st_uid==1000 and stat.S_IMODE(s.st_mode)==0o700 and s.st_ino==4751222 and s.st_dev==2049 +assert not (store/'f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d').exists() +read_cpu=lambda:[int(x) for x in Path('/proc/stat').read_text().splitlines()[0].split()[1:9]] +a=read_cpu();time.sleep(1);b=read_cpu();d=[y-x for x,y in zip(a,b)];assert 1-(d[3]+d[4])/sum(d)<=0.85 +stage=Path('/home/tegwick/.helixforge-factory/runtime-install-f599-r1-20261017');stage.mkdir(mode=0o700) +s=stage.lstat();print(json.dumps({'inode':s.st_ino,'device':s.st_dev}))''' + created=ssh(create) + receipt.write_text(json.dumps({'status':'staging_created','phase':'before_transfer','proposal_id':inputs['proposal_id'],'revision':1,'automatic_retry':False,'staging_identity':created,'staging_path':STAGE},indent=2)+'\n') + command(['scp','-q',str(archive),str(HERE/'runtime.py'),str(HERE/'install-verified.py'),'railiance01:'+STAGE+'/'],120) + execute=r'''import hashlib,json,os,stat,sys +from pathlib import Path +stage=Path('/home/tegwick/.helixforge-factory/runtime-install-f599-r1-20261017');s=stage.lstat() +assert stat.S_ISDIR(s.st_mode) and s.st_uid==1000 and stat.S_IMODE(s.st_mode)==0o700 and s.st_ino==int(sys.argv[1]) and s.st_dev==2049 +expected=json.loads(sys.argv[2]);assert {p.name for p in stage.iterdir()}==set(expected) +for name,want in expected.items(): + p=stage/name;s=p.lstat();assert stat.S_ISREG(s.st_mode) and s.st_uid==1000 and not stat.S_ISLNK(s.st_mode) + with p.open('rb') as stream:assert hashlib.file_digest(stream,'sha256').hexdigest()==want + p.chmod(0o600) +os.execve('/usr/bin/python3',['python3','-I','-B',str(stage/'install-verified.py'),'--stage-inode',sys.argv[1]],{'HOME':'/home/tegwick','PATH':'/usr/bin:/bin','LANG':'C.UTF-8','PYTHONDONTWRITEBYTECODE':'1'})''' + hashes={'runtime.tar.gz':inputs['archive']['sha256'].removeprefix('sha256:'), + 'runtime.py':inputs['helper_hashes']['runtime.py'].removeprefix('sha256:'), + 'install-verified.py':inputs['helper_hashes']['install-verified.py'].removeprefix('sha256:')} + # Parse the structured final helper return even when its action failed. + remote='/usr/bin/python3 -I -B -c '+shlex.quote(execute)+' '+shlex.quote(str(created['inode']))+' '+shlex.quote(json.dumps(hashes,separators=(',',':'))) + receipt.write_text(json.dumps({'status':'remote_execution_started','proposal_id':inputs['proposal_id'],'revision':1,'automatic_retry':False,'staging_identity':created,'staging_path':STAGE},indent=2)+'\n') + cp=subprocess.run(['ssh','-o','BatchMode=yes','-o','ConnectTimeout=15','railiance01',remote],stdout=subprocess.PIPE,stderr=subprocess.DEVNULL,timeout=600) + try:result=json.loads(cp.stdout) + except Exception:raise RuntimeError('remote_outcome_uncertain') from None + result['ssh_exit_code']=cp.returncode;result['staging_identity']=created + # Replace only our exact local intent receipt, never a previous attempt. + receipt.write_text(json.dumps(result,indent=2)+'\n');receipt.chmod(0o600) + print(json.dumps(result,sort_keys=True)) + return 0 if cp.returncode==0 and result.get('status')=='installed_and_offline_rehearsal_verified' else 1 + + +if __name__=='__main__': + try:raise SystemExit(main()) + except Exception as exc: + print(json.dumps({'status':'failed_or_uncertain','failure_type':type(exc).__name__, + 'automatic_retry':False,'private_diagnostics_suppressed':True})) + raise SystemExit(1) from None diff --git a/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/final-readonly-dry-run.json b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/final-readonly-dry-run.json new file mode 100644 index 00000000..a488ee91 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/final-readonly-dry-run.json @@ -0,0 +1,71 @@ +{ + "archive": { + "bytes": 109931109, + "format": "gzip mtime0; PAX tar; sorted tree; root runtime; UID/GID1000; modes and relative symlinks retained", + "logical_file_bytes": 260668241, + "members": 1448, + "sha256": "sha256:4c55b2740e759175d645705518fc33db30b26b4611f68e052a4ca909173084c7" + }, + "next_exact_command": "python3 -I -B /home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/execute-install.py --apply", + "observed_at": "2026-10-17T02:35:19.659916+00:00", + "private_configuration_reads": false, + "process_exit_code": 0, + "proposal_id": "REINAH-WP-0008-T07-install-f599-r1", + "provider_calls": 0, + "remote_mutations": 0, + "revision": 1, + "source_runtime_complete_digest_verified": true, + "status": "read_only_dry_run_passed", + "target": { + "account": "tegwick", + "checks": { + "account": true, + "cpu_headroom": true, + "destination_absent": true, + "disk_headroom": true, + "exact_ready_node": true, + "load_headroom": true, + "memory_headroom": true, + "protected_store": true, + "staging_absent": true + }, + "cpu_busy_fraction": 0.5852417302798982, + "cpu_count": 4, + "cpu_sample_seconds": 1, + "destination": null, + "disk_free_bytes": 124211384320, + "gid": 1000, + "load_average": [ + 5.0595703125, + 6.404296875, + 5.111328125 + ], + "memory_available_bytes": 7645528064, + "node_addresses": [ + { + "address": "92.205.62.239", + "type": "InternalIP" + }, + { + "address": "2a00:1169:111:6d70::", + "type": "InternalIP" + }, + { + "address": "239.62.205.92.host.secureserver.net", + "type": "Hostname" + } + ], + "node_ready": true, + "stage": null, + "store": { + "device": 2049, + "directory": true, + "gid": 1000, + "inode": 4751222, + "mode": "0o700", + "symlink": false, + "uid": 1000 + }, + "uid": 1000 + } +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/install-verified.py b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/install-verified.py new file mode 100644 index 00000000..fb26b143 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/install-verified.py @@ -0,0 +1,213 @@ +#!/usr/bin/env python3 +"""Exact install-only action; execute remotely only after founder approval.""" +import argparse +import hashlib +import importlib.util +import json +import os +from pathlib import Path, PurePosixPath +import pwd +import shutil +import signal +import stat +import subprocess +import sys +import tarfile +import time + +DIGEST = 'f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d' +ARCHIVE = '4c55b2740e759175d645705518fc33db30b26b4611f68e052a4ca909173084c7' +RUNTIME_MODULE = '19b5fb687288bbc836978b0251599dc1e4d1593e8b5efee85a6abb6a7f388412' +STORE_MODULE = 'c3d6ec09d08881611d3d02b8f55d68deed6ecfedaa1a809b6b11c57cc4ca97cf' +REHEARSAL_MODULE = '192f654cad4a5f065c7faa5e35b03493297a472e8d7fe641be2c42c5fb00dcc3' +STAGE = Path('/home/tegwick/.helixforge-factory/runtime-install-f599-r1-20261017') +STORE = Path('/home/tegwick/.helixforge-factory/runtimes') +DESTINATION = STORE/DIGEST +LOGICAL_BYTES = 260668241 +ARCHIVE_BYTES = 109931109 +MEMBERS = 1448 +ENV = {'HOME':'/home/tegwick','PATH':'/usr/bin:/bin','LANG':'C.UTF-8','PYTHONDONTWRITEBYTECODE':'1'} + + +def require(value, code): + if not value: raise ValueError(code) + + +def file_digest(path): + with path.open('rb') as source:return hashlib.file_digest(source,'sha256').hexdigest() + + +def protected(path, *, directory=False, mode=None): + s=path.lstat() + require(not stat.S_ISLNK(s.st_mode) and s.st_uid==1000 and s.st_gid==1000,'path_ownership') + require(stat.S_ISDIR(s.st_mode) if directory else stat.S_ISREG(s.st_mode),'path_type') + require(not stat.S_IMODE(s.st_mode)&0o022,'path_write_mode') + if mode is not None:require(stat.S_IMODE(s.st_mode)==mode,'path_exact_mode') + return s + + +def identify(): + require(os.getuid()==1000 and os.getgid()==1000 and pwd.getpwuid(1000).pw_name=='tegwick','account_identity') + for p in (Path('/home/tegwick'),Path('/home/tegwick/.helixforge-factory'),STORE): + protected(p,directory=True,mode=0o700 if p!=Path('/home/tegwick') else 0o750) + protected(STORE/'.install.lock',mode=0o600) + cp=subprocess.run(['/usr/local/bin/kubectl','get','nodes','-o','json'],stdout=subprocess.PIPE,stderr=subprocess.DEVNULL,timeout=20,env=ENV) + require(cp.returncode==0,'node_readback') + nodes=json.loads(cp.stdout)['items'] + require(len(nodes)==1 and any(a['address']=='92.205.62.239' for a in nodes[0]['status']['addresses']) + and any(c['type']=='Ready' and c['status']=='True' for c in nodes[0]['status']['conditions']),'node_identity') + require(shutil.disk_usage(STORE).free >= 2*1024**3,'disk_headroom') + mem=dict(x.split(':',1) for x in Path('/proc/meminfo').read_text().splitlines()) + require(int(mem['MemAvailable'].split()[0])*1024>=1024**3,'memory_headroom') + require(os.getloadavg()[0]<=2*(os.cpu_count() or 1),'load_headroom') + read_cpu=lambda:[int(x) for x in Path('/proc/stat').read_text().splitlines()[0].split()[1:9]] + a=read_cpu();time.sleep(1);b=read_cpu();d=[y-x for x,y in zip(a,b)] + require(1-(d[3]+d[4])/sum(d)<=0.85,'cpu_headroom') + + +def runtime_reader(): + p=STAGE/'runtime.py';protected(p,mode=0o600) + require(file_digest(p)==RUNTIME_MODULE,'runtime_reader_pin') + spec=importlib.util.spec_from_file_location('approved_runtime_reader',p) + module=importlib.util.module_from_spec(spec);spec.loader.exec_module(module) + return module + + +def extract(): + archive=STAGE/'runtime.tar.gz';protected(archive,mode=0o600) + require(archive.stat().st_size==ARCHIVE_BYTES and file_digest(archive)==ARCHIVE,'archive_pin') + root=STAGE/'runtime';require(not root.exists() and not root.is_symlink(),'extraction_already_present') + with tarfile.open(archive,mode='r:gz') as tf: + members=tf.getmembers();require(len(members)==MEMBERS,'archive_member_count') + seen=set(); logical=0 + for info in members: + name=PurePosixPath(info.name) + require(not name.is_absolute() and name.parts and name.parts[0]=='runtime' + and all(x not in ('','..','.') for x in name.parts),'archive_name') + require(info.name not in seen,'archive_duplicate');seen.add(info.name) + require(info.uid==1000 and info.gid==1000 and (info.issym() or not info.mode&0o7022),'archive_modes') + require(info.isdir() or info.isfile() or info.issym(),'archive_special_member') + if info.isfile():logical+=info.size + if info.issym():require(not PurePosixPath(info.linkname).is_absolute(),'archive_absolute_symlink') + require(logical==LOGICAL_BYTES,'archive_size') + # Populate directories and files before any symlink; never traverse an + # archive-created symlink while extracting a later member. + dirs=[] + for info in members: + if not info.isdir():continue + p=STAGE/info.name;p.mkdir(mode=0o700);dirs.append((p,info.mode)) + for info in members: + if not info.isfile():continue + p=STAGE/info.name + require(all(not x.is_symlink() for x in (p.parent,*p.parent.parents)),'archive_parent_alias') + fd=os.open(p,os.O_WRONLY|os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW,0o600) + with os.fdopen(fd,'wb') as target, tf.extractfile(info) as source: + shutil.copyfileobj(source,target,1024*1024) + p.chmod(info.mode) + for info in members: + if info.issym(): + p=STAGE/info.name;p.symlink_to(info.linkname) + require(p.resolve(strict=True).is_relative_to(root),'archive_symlink_escape') + for p,mode in reversed(dirs):p.chmod(mode) + require(runtime_reader().runtime_digest(root)==DIGEST,'extracted_complete_digest') + return root + + +def expired(signum, frame): + raise TimeoutError('bounded_stage_deadline') + + +def install_phase(): + from sandboxer.extensions import runtime_store, runtime + source=STAGE/'runtime' + require(Path(runtime_store.__file__).resolve().is_relative_to(source) + and file_digest(Path(runtime_store.__file__))==STORE_MODULE,'installer_source_pin') + require(Path(runtime.__file__).resolve().is_relative_to(source) + and file_digest(Path(runtime.__file__))==RUNTIME_MODULE,'installed_digest_source_pin') + require(not DESTINATION.exists() and not DESTINATION.is_symlink(),'destination_not_absent') + signal.signal(signal.SIGALRM,expired);signal.alarm(180) + try:result=runtime_store.install_runtime(source,STORE,DIGEST) + finally:signal.alarm(0) + require(result['runtime']['path']==str(DESTINATION) and not result['reused'] + and result['profile_activated'] is False and result['credential_delivery_configured'] is False,'installer_result') + print(json.dumps({'status':'installed','result':result},sort_keys=True)) + + +def rehearse_phase(): + from rein_aharness import owner_rehearsal + require(Path(owner_rehearsal.__file__).resolve().is_relative_to(DESTINATION) + and file_digest(Path(owner_rehearsal.__file__))==REHEARSAL_MODULE,'rehearsal_source_pin') + signal.signal(signal.SIGALRM,expired);signal.alarm(240) + try:steps=owner_rehearsal.rehearse(DESTINATION) + finally:signal.alarm(0) + require([x.name for x in steps]==['rein-aharness','glas-harness','claude'],'rehearsal_steps') + report={x.name:x.exit_code for x in steps} + print(json.dumps({'status':'rehearsed' if all(x.ok for x in steps) else 'rehearsal_failed','steps':report, + 'model_calls':0,'credential_reads':False,'owner_configuration_read':False},sort_keys=True)) + return 0 if all(x.ok for x in steps) else 1 + + +def phase(argv, timeout): + p=subprocess.run(argv,env=ENV,stdin=subprocess.DEVNULL,stdout=subprocess.PIPE, + stderr=subprocess.DEVNULL,timeout=timeout) + require(len(p.stdout)<=65536,'phase_output_bound') + try:result=json.loads(p.stdout) + except Exception:raise ValueError('phase_receipt_unavailable') from None + return p.returncode,result + + +def main(): + parser=argparse.ArgumentParser(description=__doc__) + parser.add_argument('--stage-inode',type=int) + parser.add_argument('--phase',choices=('install','rehearse')) + args=parser.parse_args() + if args.phase=='install':install_phase();return 0 + if args.phase=='rehearse':return rehearse_phase() + receipt={'proposal_id':'REINAH-WP-0008-T07-install-f599-r1','revision':1,'status':'failed', + 'model_calls':0,'credential_reads':False,'owner_configuration_read':False, + 'renewal_or_catalog_or_queue_mutation':False,'destination':str(DESTINATION)} + identity=None + try: + observed=protected(STAGE,directory=True,mode=0o700) + require(observed.st_ino==args.stage_inode and observed.st_dev==2049,'stage_identity') + identity=observed + identify() + require(not DESTINATION.exists() and not DESTINATION.is_symlink(),'destination_not_absent') + require({p.name for p in STAGE.iterdir()}=={'runtime.tar.gz','runtime.py','install-verified.py'},'stage_inventory') + os.nice(19) + receipt['phase']='extract_and_verify';source=extract() + receipt['extracted_complete_digest_verified']=True + receipt['phase']='install' + code,result=phase([str(source/'bin/python3'),'-I','-B',str(STAGE/'install-verified.py'),'--phase','install'],200) + receipt['installation']=result;require(code==0 and result['status']=='installed','installation_failed') + require(runtime_reader().runtime_digest(DESTINATION)==DIGEST,'installed_complete_digest') + receipt['installed_complete_digest_verified']=True + receipt['phase']='offline_rehearsal' + code,result=phase([str(DESTINATION/'bin/python3'),'-I','-B',str(STAGE/'install-verified.py'),'--phase','rehearse'],260) + receipt['rehearsal']=result;require(code==0 and result['status']=='rehearsed','rehearsal_failed') + require(runtime_reader().runtime_digest(DESTINATION)==DIGEST,'post_rehearsal_complete_digest') + receipt['post_rehearsal_complete_digest_verified']=True + receipt['status']='installed_and_offline_rehearsal_verified' + except Exception as exc: + receipt['failure_type']=type(exc).__name__ + if isinstance(exc,ValueError) and str(exc).replace('_','').isalnum():receipt['failure_code']=str(exc) + finally: + receipt['destination_exists']=DESTINATION.exists() or DESTINATION.is_symlink() + if identity is not None: + try: + current=protected(STAGE,directory=True,mode=0o700) + require((current.st_dev,current.st_ino)==(identity.st_dev,identity.st_ino),'cleanup_stage_identity') + require({p.name for p in STAGE.iterdir()} <= {'runtime.tar.gz','runtime.py','install-verified.py','runtime'},'cleanup_unexpected_stage_member') + shutil.rmtree(STAGE) + receipt['owned_staging_removed']=not STAGE.exists() and not STAGE.is_symlink() + except Exception:receipt['owned_staging_removed']=False;receipt['status']='failed' + else:receipt['owned_staging_removed']=False + print(json.dumps(receipt,sort_keys=True)) + return 0 if receipt['status']=='installed_and_offline_rehearsal_verified' else 1 + + +if __name__=='__main__': + try:raise SystemExit(main()) + except Exception as exc: + print(json.dumps({'status':'failed','failure_type':type(exc).__name__,'private_diagnostics_suppressed':True})) + raise SystemExit(1) from None diff --git a/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/local-transfer-check.py b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/local-transfer-check.py new file mode 100644 index 00000000..f8cdc810 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/local-transfer-check.py @@ -0,0 +1,28 @@ +#!/usr/bin/env python3 +"""Local archive roundtrip only; no native execution or runtime launch.""" +import importlib.util,json,shutil,tempfile +from pathlib import Path +HERE=Path(__file__).resolve().parent + +def load(name,path): + s=importlib.util.spec_from_file_location(name,path);m=importlib.util.module_from_spec(s);s.loader.exec_module(m);return m + +def main(): + builder=load('transfer_builder',HERE/'build-transfer.py') + verifier=load('remote_install_code_review',HERE/'install-verified.py') + with tempfile.TemporaryDirectory(prefix='nk-runtime-transfer-check-') as directory: + p=Path(directory); archive=p/'runtime.tar.gz' + with archive.open('xb') as target:built=builder.build(target) + assert built==json.loads((HERE/'transfer-archive.json').read_text()) + archive.chmod(0o600);shutil.copyfile(HERE/'runtime.py',p/'runtime.py');(p/'runtime.py').chmod(0o600) + verifier.STAGE=p + extracted=verifier.extract() + result={'scope':'local temporary archive roundtrip only','archive_sha256':built['sha256'], + 'archive_bytes':built['bytes'],'member_count':built['members'], + 'complete_extracted_digest':verifier.runtime_reader().runtime_digest(extracted), + 'modes_and_internal_symlinks_preserved':True,'native_actions':0,'runtime_launches':0} + assert not p.exists();result['local_temporary_tree_removed']=True + (HERE/'local-transfer-verification.json').write_text(json.dumps(result,indent=2)+'\n') + print(json.dumps(result)) + +if __name__=='__main__':main() diff --git a/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/local-transfer-verification.json b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/local-transfer-verification.json new file mode 100644 index 00000000..f2f8332e --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/local-transfer-verification.json @@ -0,0 +1,12 @@ +{ + "scope": "local archive extraction function roundtrip; no remote installer or runtime launch", + "archive_sha256": "sha256:4c55b2740e759175d645705518fc33db30b26b4611f68e052a4ca909173084c7", + "archive_bytes": 109931109, + "member_count": 1448, + "complete_extracted_digest": "f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d", + "modes_and_internal_symlinks_preserved": true, + "native_actions": 0, + "runtime_launches": 0, + "local_temporary_tree_removed": true, + "tested_extract_function_sha256": "sha256:6671d4a0d03860e4ed4dd860c5f9405aefdb342f51eb39b6bce7c59bf18c6321" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/pre-absolute-path-dry-run.json b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/pre-absolute-path-dry-run.json new file mode 100644 index 00000000..6db3c55f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/pre-absolute-path-dry-run.json @@ -0,0 +1,71 @@ +{ + "archive": { + "bytes": 109931109, + "format": "gzip mtime0; PAX tar; sorted tree; root runtime; UID/GID1000; modes and relative symlinks retained", + "logical_file_bytes": 260668241, + "members": 1448, + "sha256": "sha256:4c55b2740e759175d645705518fc33db30b26b4611f68e052a4ca909173084c7" + }, + "next_exact_command": "python3 -I -B /home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/execute-install.py --apply", + "observed_at": "2026-10-17T02:33:46.370722+00:00", + "private_configuration_reads": false, + "process_exit_code": 0, + "proposal_id": "REINAH-WP-0008-T07-install-f599-r1", + "provider_calls": 0, + "remote_mutations": 0, + "revision": 1, + "source_runtime_complete_digest_verified": true, + "status": "read_only_dry_run_passed", + "target": { + "account": "tegwick", + "checks": { + "account": true, + "cpu_headroom": true, + "destination_absent": true, + "disk_headroom": true, + "exact_ready_node": true, + "load_headroom": true, + "memory_headroom": true, + "protected_store": true, + "staging_absent": true + }, + "cpu_busy_fraction": 0.3913043478260869, + "cpu_count": 4, + "cpu_sample_seconds": 1, + "destination": null, + "disk_free_bytes": 124223250432, + "gid": 1000, + "load_average": [ + 7.2421875, + 6.92138671875, + 5.1103515625 + ], + "memory_available_bytes": 7817695232, + "node_addresses": [ + { + "address": "92.205.62.239", + "type": "InternalIP" + }, + { + "address": "2a00:1169:111:6d70::", + "type": "InternalIP" + }, + { + "address": "239.62.205.92.host.secureserver.net", + "type": "Hostname" + } + ], + "node_ready": true, + "stage": null, + "store": { + "device": 2049, + "directory": true, + "gid": 1000, + "inode": 4751222, + "mode": "0o700", + "symlink": false, + "uid": 1000 + }, + "uid": 1000 + } +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/retained-headroom-refusal.json b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/retained-headroom-refusal.json new file mode 100644 index 00000000..cd83bf5c --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/retained-headroom-refusal.json @@ -0,0 +1,20 @@ +{ + "source": "actual pre-freeze read-only dry-run tool return retained from session", + "observed_at": "2026-10-17T02:32:39.125837+00:00", + "status": "read_only_dry_run_blocked", + "one_second_cpu_busy_fraction": 0.850632911392405, + "load_average": [ + 12.60107421875, + 7.4990234375, + 5.14306640625 + ], + "cpu_count": 4, + "refused_guards": [ + "cpu_headroom", + "load_headroom" + ], + "all_identity_store_absence_disk_memory_guards": true, + "remote_mutations": 0, + "provider_calls": 0, + "later_return": "final-readonly-dry-run.json; does not erase this refusal" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/runtime.py b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/runtime.py new file mode 100644 index 00000000..231fb72c --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/runtime.py @@ -0,0 +1,52 @@ +"""Digest-pinned, owner-configured Python runtimes for bwrap.""" + +from __future__ import annotations + +import hashlib +import json +import os +import stat +from pathlib import Path + +RUNTIME_MOUNT = "/opt/sandboxer/runtime" + + +def runtime_digest(root: Path) -> str: + """Hash the complete artifact, including modes and internal symlink targets.""" + if not root.is_absolute() or root.resolve(strict=True) != root or not root.is_dir(): + raise ValueError("runtime path must be a canonical absolute directory") + records = [] + for path in sorted(root.rglob("*")): + mode = path.lstat().st_mode + if stat.S_ISLNK(mode): + target = os.readlink(path) + if Path(target).is_absolute() or not path.resolve(strict=True).is_relative_to(root): + raise ValueError("runtime symlink escapes the artifact") + value = ["symlink", target] + elif stat.S_ISREG(mode): + with path.open("rb") as stream: + value = ["file", hashlib.file_digest(stream, "sha256").hexdigest()] + elif stat.S_ISDIR(mode): + value = ["directory"] + else: + raise ValueError("runtime contains an unsupported special file") + records.append([path.relative_to(root).as_posix(), stat.S_IMODE(mode), *value]) + return hashlib.sha256(json.dumps(records, separators=(",", ":")).encode()).hexdigest() + + +def verified_runtime(config: dict) -> Path | None: + """Only owner extension configuration can select a runtime artifact.""" + runtime = config.get("runtime") + if runtime is None: + return None + if not isinstance(runtime, dict) or set(runtime) != {"path", "sha256"}: + raise ValueError("runtime requires exactly path and sha256") + if not isinstance(runtime["path"], str) or not isinstance(runtime["sha256"], str): + raise ValueError("runtime path and sha256 must be strings") + root = Path(runtime["path"]) + if (not (root / "pyvenv.cfg").is_file() or not (root / "bin/python3").is_file() + or (root / ".git").exists()): + raise ValueError("runtime must be a standalone Python environment, not a checkout") + if runtime_digest(root) != runtime["sha256"]: + raise ValueError("runtime artifact digest does not match owner configuration") + return root diff --git a/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/target-readonly-addendum.json b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/target-readonly-addendum.json new file mode 100644 index 00000000..d7e189ea --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/target-readonly-addendum.json @@ -0,0 +1 @@ +{"python": "3.12.3", "stage_path": "/home/tegwick/.helixforge-factory/runtime-install-f599-r1-20261017", "stage_exists": false} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/target-readonly-observation.json b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/target-readonly-observation.json new file mode 100644 index 00000000..9360f85f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/target-readonly-observation.json @@ -0,0 +1,125 @@ +{ + "account": "tegwick", + "bwrap": "/usr/bin/bwrap", + "cpu_count": 4, + "disk_bytes": { + "free": 124361916416, + "total": 206900281344, + "used": 82521587712 + }, + "gid": 1000, + "home": "/home/tegwick", + "hostname": "239.62.205.92.host.secureserver.net", + "load_average": [ + 3.326171875, + 3.8720703125, + 3.53125 + ], + "memory_bytes": { + "MemAvailable": 7864901632, + "MemTotal": 16770080768, + "SwapFree": 3914285056, + "SwapTotal": 4294963200 + }, + "nodes": [ + { + "addresses": [ + { + "address": "92.205.62.239", + "type": "InternalIP" + }, + { + "address": "2a00:1169:111:6d70::", + "type": "InternalIP" + }, + { + "address": "239.62.205.92.host.secureserver.net", + "type": "Hostname" + } + ], + "name": "239.62.205.92.host.secureserver.net", + "ready": "True" + } + ], + "paths": { + "/home/tegwick": { + "device": 2049, + "directory": true, + "exists": true, + "gid": 1000, + "inode": 529950, + "mode": "0o750", + "regular": false, + "symlink": false, + "uid": 1000 + }, + "/home/tegwick/.helixforge-factory": { + "device": 2049, + "directory": true, + "exists": true, + "gid": 1000, + "inode": 4751221, + "mode": "0o700", + "regular": false, + "symlink": false, + "uid": 1000 + }, + "/home/tegwick/.helixforge-factory/runtimes": { + "device": 2049, + "directory": true, + "exists": true, + "gid": 1000, + "inode": 4751222, + "mode": "0o700", + "regular": false, + "symlink": false, + "uid": 1000 + }, + "/home/tegwick/.helixforge-factory/runtimes/.install.lock": { + "device": 2049, + "directory": false, + "exists": true, + "gid": 1000, + "inode": 4751223, + "mode": "0o600", + "regular": true, + "symlink": false, + "uid": 1000 + }, + "/home/tegwick/.helixforge-factory/runtimes/f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d": { + "exists": false + }, + "/run/user/1000": { + "device": 47, + "directory": true, + "exists": true, + "gid": 1000, + "inode": 1, + "mode": "0o700", + "regular": false, + "symlink": false, + "uid": 1000 + } + }, + "public_sources": { + "/home/tegwick/rein-aharness/rein_aharness/owner_rehearsal.py": { + "exists": false + }, + "/home/tegwick/sand-boxer/scripts/install-bwrap-runtime.py": { + "exists": false + }, + "/home/tegwick/sand-boxer/src/sandboxer/extensions/runtime.py": { + "exists": false + }, + "/home/tegwick/sand-boxer/src/sandboxer/extensions/runtime_store.py": { + "exists": false + } + }, + "store_digest_directories": [ + "2cfc7b5f5c03318820ed279ab8269a741067ded66a768dcf83565986dd9dfa80", + "5371156d2027dde6e8f140cc0a1833c4e90b8c75b3bec862e05f06a957f5fd34", + "95c9edb1241788dacdb8471c0bd0f34170ce565e097a455befb57f61ff1272ea", + "b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969" + ], + "uid": 1000 +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/transfer-archive.json b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/transfer-archive.json new file mode 100644 index 00000000..c6988f09 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r1/transfer-archive.json @@ -0,0 +1,7 @@ +{ + "sha256": "sha256:4c55b2740e759175d645705518fc33db30b26b4611f68e052a4ca909173084c7", + "bytes": 109931109, + "logical_file_bytes": 260668241, + "members": 1448, + "format": "gzip mtime0; PAX tar; sorted tree; root runtime; UID/GID1000; modes and relative symlinks retained" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/approved-preflight-summary.json b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/approved-preflight-summary.json new file mode 100644 index 00000000..d1fde043 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/approved-preflight-summary.json @@ -0,0 +1,14 @@ +{ + "status": "read_only_dry_run_passed", + "observed_at": "2026-10-17T08:34:38.132187+00:00", + "source": "actual root --dry-run tool return", + "revision": 2, + "source_runtime_complete_digest_verified": true, + "all_identity_absence_resource_and_supervision_checks_passed": true, + "cpu_busy_fraction": 0.7473958333333333, + "load_average_1m": 2.46337890625, + "disk_free_bytes": 123358224384, + "memory_available_bytes": 7780913152, + "remote_mutations": 0, + "provider_calls": 0 +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/pending-decision.json b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/pending-decision.json new file mode 100644 index 00000000..488deecd --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/pending-decision.json @@ -0,0 +1,7 @@ +{ + "id": "b6abb6ab-b182-4b4f-9f84-79ddc5ad91f3", + "status": "open", + "decision_type": "pending", + "title": "Approve exact install-only runtime f599 proposal revision 2", + "proposal_sha256": "44b17589c323e1a966caf6c1b1def123092ee289b929c8ea014bc84109103b1d" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/root-review.json b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/root-review.json new file mode 100644 index 00000000..5a720610 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/root-review.json @@ -0,0 +1,23 @@ +{ + "schema": "custodian.runtime-install-root-review.v1", + "observed_at": "2026-10-17T06:52:15.521924+00:00", + "proposal_id": "REINAH-WP-0008-T07-install-f599-r1", + "revision": 2, + "status": "accepted_for_submission_not_approved", + "proposal_sha256": "44b17589c323e1a966caf6c1b1def123092ee289b929c8ea014bc84109103b1d", + "manifest_sha256": "aea5dbfe0742fe0bb6c36a41ca7b0d70473683b2731f92cc279d43929e5c35c9", + "r1_frozen_and_verified": true, + "all_r1_r2_manifest_files_verified": true, + "independent_checks": { + "command": "python3 -B test_process_supervision.py ProcessSupervisionTests.test_timeout_reaps_session_escaped_descendant_and_retains_sibling ProcessSupervisionTests.test_hard_controller_loss_reaps_descendant_and_retains_stage", + "tests": 2, + "exit_code": 0, + "scope": "actual disposable process trees, no runtime/SSH/bwrap/provider launches" + }, + "source_review": "Existing owner installer and rehearsal callback retained; exact runtime unchanged. Runner bounds descendant ownership through private subreaper/pidfds and parent-death behavior; positive quiescence is required before staging deletion, uncertainty retains staging. Exact proposed helper/argv/archive and existing store guards reviewed.", + "runtime_enforcement_or_autopilot_granted": false, + "supervision_before_sha256": "4a4b0e61df23f1499916c04d85e61c558df810f43f485abf84792acfbbb66016", + "supervision_after_sha256": "d144ae59f67f91639d5c9c9f1b0247af7250abcef2e54fa2b563779924e3f5bf", + "fresh_founder_approval_required": true, + "native_executed": false +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/verify-installed.py b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/verify-installed.py new file mode 100644 index 00000000..25006a47 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/verify-installed.py @@ -0,0 +1,29 @@ +"""Read-only verification of the approved R2 partial install; never launches it.""" +from pathlib import Path +import hashlib +import json +import shlex +import subprocess + +HERE = Path(__file__).resolve().parent +R2 = HERE.parent / 'native-runtime-install-r2' +reader = (R2 / 'runtime.py').read_text() +assert hashlib.sha256(reader.encode()).hexdigest() == '19b5fb687288bbc836978b0251599dc1e4d1593e8b5efee85a6abb6a7f388412' +code = reader + ''' +import pwd +digest='f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d' +store=Path('/home/tegwick/.helixforge-factory/runtimes');s=store.lstat() +assert os.getuid()==1000 and os.getgid()==1000 and pwd.getpwuid(1000).pw_name=='tegwick' +assert stat.S_ISDIR(s.st_mode) and s.st_uid==1000 and s.st_gid==1000 and stat.S_IMODE(s.st_mode)==0o700 and s.st_dev==2049 and s.st_ino==4751222 +destination=store/digest +actual=runtime_digest(destination) +stage=Path('/home/tegwick/.helixforge-factory/runtime-install-f599-r2-20261017') +assert actual==digest and not stage.exists() and not stage.is_symlink() +print(json.dumps({'status':'partial_install_verified_read_only','runtime_sha256':actual,'installed_complete_digest_verified':True,'owned_stage_absent':True,'store_uid':s.st_uid,'store_gid':s.st_gid,'store_mode':oct(stat.S_IMODE(s.st_mode)),'runtime_launched':False,'private_configuration_read':False,'profile_or_queue_or_owner_state_changed':False,'native_launcher_acceptance':'unverified_after_failed_R2','model_calls':0})) +''' +result = subprocess.run(['ssh', '-o', 'BatchMode=yes', '-o', 'ConnectTimeout=15', 'railiance01', + '/usr/bin/python3 -I -B -c ' + shlex.quote(code)], capture_output=True, timeout=120) +assert result.returncode == 0, 'read-only verification failed; raw diagnostics suppressed' +value = json.loads(result.stdout) +(HERE / 'installed-partial-verification.json').write_text(json.dumps(value, indent=2) + '\n') +print(json.dumps(value)) diff --git a/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/headroom-refusal-progress.json b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/headroom-refusal-progress.json new file mode 100644 index 00000000..f1e167cc --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/headroom-refusal-progress.json @@ -0,0 +1,14 @@ +{ + "workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52", + "id": "34d6ec9e-6b78-407b-9053-38dabe3288ef", + "topic_id": null, + "task_id": null, + "decision_id": "bec667cc-15ea-4f87-ae16-111f08562e48", + "event_type": "note", + "summary": "Founder approved exact verification-only R3 SHA2567d5741ab...5d6b2d30. Fresh read-only preflight verified installed f599 and all other checks but refused CPU headroom: busy0.992481 vs0.85 limit. Zero R3 remote mutations/launcher calls, no execution receipt and no automatic polling/retry. Same-trial completed R2 outcome remains failed/partial; independent readback proves full installed digest and owned staging absence, while the R2 watchdog receipt reports process quiescence (no independent retrospective process classification). User steered active goal to inspect KEY-WP0039 and infrastructure reviews for possible finalization; source approvals/old registration go preserved, actual negative/cleanup acceptance still under review.", + "detail": null, + "author": "codex", + "session_id": null, + "created_at": "2026-10-17T11:02:21.658442Z", + "workstream_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/native-completion-progress.json b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/native-completion-progress.json new file mode 100644 index 00000000..5025dfa2 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/native-completion-progress.json @@ -0,0 +1,14 @@ +{ + "workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52", + "id": "80f70ad2-f202-4f42-aede-b0a6a4f7ad4a", + "topic_id": null, + "task_id": null, + "decision_id": "bec667cc-15ea-4f87-ae16-111f08562e48", + "event_type": "note", + "summary": "Completed exact founder-approved R3 offline verification once after major source publication checks finished and one fresh preflight passedCPU0.6633; originalCPU0.9925read-onlyrefusal retained. All3original empty-egress launchers rein-aharness/glas-harness/claude exit0; f599before/postcompletehashverified. Actualpublicjournal records3deadadoptedzombies reaped and positivequiescence, durable0600nativeprecleanupcheckpoint preserved beforeownedstageremoval. Independentread-onlynativeverification matches checkpointSHA8e6468c2cbb89f1a6feb038d2f53e888d14b1bf4c64f93386e39802cf7916282 to exactlocalprecleanupreconstruction, recheckscompletef599 andstageabsence. Same supervisedtrial succeedsafterrefinement; failedR2receipt/history/nativecauseuncertainty preserved, no unchangedsuccesscredit/autopilot. Zero reinstall/model/provider calls, credential/profile/catalog/queue changes or native16gateclosure. KEY39source tasksdone but T02stillwait: actualdenials/cleanupabsent, KEY38andcodingcustodyprerequisitesopen. Exactcaafe4beHubreadback covers originalKEY37secretsclientonly, not newprobe/codingcustody; standingattendedrule separate. Finalownerbindingauditpendingfinalsourceclarificationsync.", + "detail": null, + "author": "codex", + "session_id": null, + "created_at": "2026-10-17T11:41:11.826896Z", + "workstream_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/supervision-before-outcome-update.json b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/supervision-before-outcome-update.json new file mode 100644 index 00000000..586e04ea --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/supervision-before-outcome-update.json @@ -0,0 +1,1004 @@ +{ + "schema": "custodian.agent-supervision.v1", + "agent_id": "custodian-codex", + "identity_binding": "logical supervised coding-agent record; interactive runtime isolation not yet enforced", + "scope": "CUST-WP-0071 and CUST-WP-0073 preparation and founder-authorized Railiance changes", + "mode": "supervised", + "supervisor": "Bernd Worsch", + "policy_ref": "docs/agent-autonomy-decision.md", + "runtime_enforcement": "not_yet_migrated", + "autopilot_grant": null, + "cost_budget_eur": null, + "risk_limit_eur": null, + "proposals": [ + { + "proposal_id": "CUST-WP-0073-T03-annotation-guard", + "disposition": "unscored", + "outcome": "failed", + "reason": "Conversation authorization predates exact-revision scoring. Native admission tests passed, but ESO refresh failed under the guard. Binding rolled back and 39/39 ExternalSecrets recovered. Retain this adverse outcome; it is not promotion evidence.", + "proposal_ref": "docs/changes/CUST-WP-0073/README.md", + "execution_ref": "railiance-platform@54885ac1589074a68d9607d1be250c84c5c2307a", + "refinement_or_rescue": true, + "verification_ref": "docs/evidence/2026-09-28-secret-annotation-rollout.md", + "remediation": { + "authorization_ref": "Founder continuation: Good, go on, after the 31-declaration fix was described", + "source_changes_ref": "docs/evidence/2026-09-28-eso-metadata-publication.json", + "verification_ref": "docs/evidence/2026-09-28-secret-annotation-enforced.json", + "integration_ref": "docs/evidence/2026-09-28-eso-refresh-after-binding.json", + "outcome": "39/39 fresh successful refreshes under Deny; nine native admission checks pass", + "refinement_or_rescue": true, + "new_scored_trial": false + } + }, + { + "proposal_id": "STATE-WP-0094-T05-receiving-rollout-2026-10-04", + "disposition": "unscored", + "outcome": "succeeded", + "reason": "Founder explicitly authorized rollout before exact-revision proposal capture. Retain actual execution evidence without backfilling unchanged acceptance.", + "proposal_ref": "docs/changes/state-hub-qualifier-rollout-2026-10-04.json", + "original_revision": 1, + "original_digest_sha256": "32834917c4c6f80277abcf543a278f0b9eaa52ebdf28cd05a0e66f2047d3053a", + "approved_revision": null, + "authorization_ref": "User instruction: Do the rollout", + "executed_revision": 1, + "refinement_or_rescue": false, + "executed_digest_sha256": "32834917c4c6f80277abcf543a278f0b9eaa52ebdf28cd05a0e66f2047d3053a", + "execution_started_at": "2026-10-04T00:45:00Z", + "verification_ref": "state-hub/docs/evidence/2026-10-04-receiving-rollout.json", + "execution_ref": "railiance01 Helm state-hub revision 71; image main-3791e60", + "verified_outcome": "API/MCP Ready; schema/current receiving digest verified; fresh state-hub and ops-warden Forge derivation applied then independently noop", + "failed_checks": [ + "Custodian full reconciliation rolled back: historical ADHOC tasks_pkey UUID collision d8af3e6b-26ae-580c-bbeb-caa8ad419bec" + ], + "recovery": "No rollout rollback required; failed Custodian transaction rolled back", + "promotion_evidence": false, + "closing_verification_ref": "docs/evidence/2026-10-04-state-hub-rollout-close.json" + }, + { + "proposal_id": "STATE-WP-0095-T03-historical-receiving", + "disposition": "accepted_unchanged", + "outcome": "succeeded", + "proposal_ref": "docs/changes/state-hub-historical-receiving-2026-10-04.json", + "original_revision": 1, + "original_digest_sha256": "d6789359b3fe7988a6201fff6f367cb46948aa197e1cc0ca66c31f45e1ea9981", + "refinement_or_rescue": false, + "approval_ref": "Founder reply: Approve rollout and registrar verification; request_user_input_async call_o87uEfFs3AtXfxO5YqUnSpcg item0", + "approved_revision": 1, + "approved_digest_sha256": "d6789359b3fe7988a6201fff6f367cb46948aa197e1cc0ca66c31f45e1ea9981", + "approved_at": "2026-10-04T09:21:00.486372+00:00", + "executed_revision": 1, + "executed_digest_sha256": "d6789359b3fe7988a6201fff6f367cb46948aa197e1cc0ca66c31f45e1ea9981", + "execution_started_at": "2026-10-04T09:21:05.271010+00:00", + "original_digest": "d6789359b3fe7988a6201fff6f367cb46948aa197e1cc0ca66c31f45e1ea9981", + "approved_digest": "d6789359b3fe7988a6201fff6f367cb46948aa197e1cc0ca66c31f45e1ea9981", + "executed_digest": "d6789359b3fe7988a6201fff6f367cb46948aa197e1cc0ca66c31f45e1ea9981", + "verification_ref": "docs/evidence/2026-10-04-dependency-root-wave/verified-deployment.json", + "execution_ref": "railiance01 Helm state-hub revision72 image main-5dd3df9; exact approved revision1", + "verified_outcome": "Exact approved revision1 deployed main-5dd3df9 Helm72. API/MCP Ready, schema/source match, five frozen parents/65tasks entire rows unchanged; global retired-holder collision refused in rolled-back native transaction. Gated registrar actual38 tests passed; normal Repo Manager/Custodian receiving applied. Activity correctly refused three unrelated retirements, as expected scope requires; no acknowledgement issued.", + "registrar_verification_ref": "docs/evidence/2026-10-04-dependency-root-wave/normal-owner-sync.json", + "recovery": "No rollout rollback or rescue required; unrelated Activity receiving refused before changes. Initial supervision receipt used digest_sha256 keys; added exact matching canonical aliases for the descriptive utility without changing authority or evidence." + }, + { + "proposal_id": "INFD-WP-0009-T02/config-repin-v1", + "disposition": "accepted_unchanged", + "outcome": "succeeded", + "proposal_ref": "docs/evidence/2026-10-10-security-consolidation/infd-pin-repair-preflight.json", + "original_revision": "7db8485ffecdebfabd77a9daec085553c74bf0bf", + "original_digest_sha256": "1dcc1f01d7b6469aee7a6504d38b81cd6ef8a5c5358493ad17d8825c3aec16e7", + "approved_revision": "7db8485ffecdebfabd77a9daec085553c74bf0bf", + "approval_ref": "Founder: Approve the scoped repair; call_57c1f1615d7d459bbe3bd0f125a50bee", + "executed_revision": "7db8485ffecdebfabd77a9daec085553c74bf0bf", + "verified_outcome": "Only immutable ConfigMap/Deployment synced; Healthy, Ready1, unchanged image, readyz200, v2 pin and native registration/publication succeeded.", + "execution_adaptation": "argocd CLI absent; same approved two-resource manual sync through Application operation API with atomic baseline checks and prune false.", + "refinement_or_rescue": false, + "promotion_evidence": false, + "original_digest": "1dcc1f01d7b6469aee7a6504d38b81cd6ef8a5c5358493ad17d8825c3aec16e7", + "approved_digest": "1dcc1f01d7b6469aee7a6504d38b81cd6ef8a5c5358493ad17d8825c3aec16e7", + "executed_digest": "1dcc1f01d7b6469aee7a6504d38b81cd6ef8a5c5358493ad17d8825c3aec16e7", + "approved_digest_sha256": "1dcc1f01d7b6469aee7a6504d38b81cd6ef8a5c5358493ad17d8825c3aec16e7", + "executed_digest_sha256": "1dcc1f01d7b6469aee7a6504d38b81cd6ef8a5c5358493ad17d8825c3aec16e7", + "verification_ref": "docs/evidence/2026-10-10-security-consolidation/infd-pin-repair-preflight.json; informed-decision/docs/evidence/2026-10-10-lifecycle-consumer-pin-repair.md", + "reporting_correction": "Canonical digest aliases and verification reference copied from existing exact approved revision evidence; no new approval or authority inferred." + }, + { + "proposal_id": "CUST-SECURITY-DECISION-POSING-2026-10-10-R1", + "disposition": "unscored", + "outcome": "succeeded", + "proposal_ref": "docs/evidence/2026-10-10-security-consolidation/decision-posing-proposal.json", + "reason": "Existing founder instruction authorizes informed decisions; no backfilled exact-revision acceptance. Retain initial503 policy pin failure and subsequent review400 packet validation failure.", + "refinement_or_rescue": true, + "promotion_evidence": false, + "verified_outcome": "Both native intake records delivered; revision-specific human ACCEPT dispositions confirmed, submission_state confirmed and stale=false for each. Initial503 and packet400 failures retained in same unscored trial.", + "verification_ref": "docs/evidence/2026-10-10-security-consolidation/decision-submission-receipts.json", + "human_disposition_verification_ref": "docs/evidence/2026-10-10-security-consolidation/human-acceptance-receipts.json" + }, + { + "proposal_id": "RAPP-USER-ENGINE-READBACK-2026-10-11-R2", + "disposition": "accepted_unchanged", + "outcome": "succeeded", + "proposal_ref": "rapp-user-engine/docs/evidence/2026-10-11-published-readback-proposal/decision-packet.md", + "original_revision": "R2-amended-b4d45051", + "original_digest": "76814d47e33d652c39c78b11ee5a0498c3f10ff89a41c4219048d7d0eab0f5f2", + "target": "realm:kubernetes/railiance01/user-engine", + "expected_result": "Exact User Engine image and advisory readback integration Ready; native catalogue acceptance remains separately verified; conditional44HIGHrisk trial only.", + "verification_ref": "rapp-user-engine/docs/evidence/2026-10-11-native-readback/receipt.json; docs/evidence/2026-10-10-security-consolidation/user-readback-enforcement-check.json", + "rollback_ref": "rapp-user-engine/docs/evidence/2026-10-11-published-readback-proposal/rollback.yaml", + "cost_estimate_eur": 0, + "risk_estimate": "BriefRecreate interruption/pullfailure;44unfixedHIGH occurrences/8CVEs. Incidentlossunpriced; noautopilotgrant. Exacthumanconditionalriskdisposition required.", + "internal_pre_submission_refinements": "Original22file3faf packet retained; independentreview requiredsameSAaudiencedisclosure andstrictpreflight. Both refinedbeforefirsthuman submission; notapprovedorreclassified success.", + "memo_id": "infd-20261011-user-engine-readback-r2", + "memo_version": 1, + "promotion_evidence": false, + "approved_revision": "R2-amended-b4d45051", + "approved_digest": "76814d47e33d652c39c78b11ee5a0498c3f10ff89a41c4219048d7d0eab0f5f2", + "approval_ref": "informed-decision:infd-20261011-user-engine-readback-r2@1; approval:0dd18a5a-5555-461e-8470-931d530435cf", + "approved_at": "2026-10-11T00:48:11+00:00", + "human_disposition_id": "disp-9ab2caba-6d3d-4fac-bc64-618f9c82aa9a", + "executed_revision": "R2-amended-b4d45051", + "executed_digest": "76814d47e33d652c39c78b11ee5a0498c3f10ff89a41c4219048d7d0eab0f5f2", + "executed_candidate_sha256": "3c0700c9d6505bf3c48b3e01e3b3537855cf0dd09486d4deb4812443d6509d99", + "execution_started_at": "2026-10-11T00:52:05.905810+00:00", + "execution_ref": "docs/evidence/2026-10-10-security-consolidation/user-readback-approved-execution.json", + "verified_outcome": "Exact approved two-object rollout Ready1 gen73/observed73, readyz200; actual admitted readback registry/allow-deny/TTL/unavailable checks passed. Existing enforcement health200/unknown-action200deny; oldnativepurpose200deny is preexisting protocolgap, no allow claimed. Canonical full28objectrender changes exactly2objects. Native catalogue empty: USER26/28 consumer acceptance stillopen, no realhumanlogin/MFA or token-isolation proof. Scope execution succeeded; overall consolidation remains active.", + "refinement_or_rescue": false + }, + { + "proposal_id": "POLICY-PUB-20261011-SECURITY-LAYER-V08-R1", + "disposition": "accepted_unchanged", + "outcome": "succeeded", + "proposal_ref": "rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/decision-packet.md", + "original_revision": "R1-refined-a70fb22f", + "original_digest": "076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e", + "packet_manifest_sha256": "a70fb22f75871a08358f1cdee2410797cb0a2f01c2001f0012d16866b20e28a8", + "target": "realm:kubernetes/railiance01/policy-nexus", + "expected_result": "Ready1 exact published Policy Nexus image and paired provenance; accepted v0.8 served,73 current documents and72 existing immutable paths independently match.", + "verification_ref": "rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-native-hosting", + "rollback_ref": "rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/rollback-binding.json; Helm revision8", + "cost_estimate_eur": 0, + "risk_estimate": "Stateless public availability/pull/scheduling/runtime incompatibility. Rollback restores72 existing paths but temporarily removes newly introduced v0.8/current revision URLs. Loss bound unpriced, supervised exact human approval required.", + "execution_deadline": "2026-10-12T23:59:59Z", + "memo_id": "infd-20261011-policy-nexus-hosting-r1", + "memo_version": 1, + "internal_pre_submission_refinements": "Original27pathd402 packet retained; independent owner review required UID/full defaulted configuration and ServiceAccount reference drift refusal, HTTPS origin/redirect refusal and bounded reads. Refined30patha70 packet prepared before first human submission; one trial, no earlier approval or success.", + "promotion_evidence": false, + "approved_revision": "R1-refined-a70fb22f", + "approved_digest": "076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e", + "approval_ref": "informed-decision:infd-20261011-policy-nexus-hosting-r1@1; approval:52a3c479-2cb1-4074-abec-6a88117ad596", + "approved_at": "2026-10-11T01:14:23+00:00", + "human_disposition_id": "disp-b8bfa6c0-e879-4de2-8243-f4abb9bcd011", + "pre_actuation_attempts": [ + { + "at": "2026-10-11T01:19:18Z", + "actuator_sha256": "41837e66e8d775f0ecfab42e2d3d3f5063489a3d2f14ae8e86f595ade25e5643", + "result": "failed render comparison before Helm upgrade; node,capacity,sealed baseline and server dryrun/diff passed", + "attempted_helm_upgrade": false, + "receipt_ref": "docs/evidence/2026-10-10-security-consolidation/policy-hosting-pre-actuation-failed.json" + }, + { + "result": "local premature read of pending outcome writer failed JSON parsing before any remote execution", + "attempted_helm_upgrade": false, + "effect": "none", + "refinement": "wait for receipt-producing command completion before dependent actuator" + } + ], + "operational_actuator_refinement": "Readonly diagnosis proved existing Helm chart omits metadata.namespace; fixed command namespace policy-nexus supplies it. Refined comparison adds only missing namespace, refuses explicit wrong namespace, preserving full9object exact comparison. Approved packet/source/image/effect scope unchanged. Initialfailed pre-actuation preserved.", + "refinement_or_rescue": true, + "executed_revision": "R1-refined-a70fb22f", + "executed_digest": "076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e", + "executed_actuator_sha256": "e23fb931f253c8df79fffb922f23a1f476c2167014b06e245a22148fce25dccf", + "execution_started_at": "2026-10-11T01:23:27.564865+00:00", + "execution_completed_at": "2026-10-11T01:23:42.112194+00:00", + "execution_ref": "docs/evidence/2026-10-10-security-consolidation/policy-hosting-approved-execution.json", + "verified_outcome": "Helm9 deployed/Ready1 generation9 observed9; exact approved image/paired provenance/all9 UID-defaulted configurations pass.158publicHTTPS byte checks match73currentdocuments+72oldimmutablepaths; CertificateReady,health/index200/legacy308/404. NoArgo adoption/data/credential writes; sourcebindingreconciled. Initialpre-actuation namespace comparison failure retained and refined; no rollback used, no unchanged-success promotion credit. Wholeconsolidation remains active." + }, + { + "proposal_id": "USER-CATALOGUE-INFDEC-20261011-R1", + "disposition": "accepted_unchanged", + "outcome": "succeeded", + "proposal_ref": "user-engine/docs/evidence/2026-10-11-one-app-catalogue-human-packet/decision-packet.md", + "original_revision": "human-packet-1-after-independent-owner-reviews", + "original_digest": "026b7daa970920f468bb1cfd9e2df1eaaa99d1d5ce1945ea5db0bb33ee9e6f82", + "packet_manifest_sha256": "307c4fc5c3c352a99a1b04c1ea886faf84f2aa3b679694aa6a1d828a44501f7c", + "source_revision": "5d80644", + "target": "railiance01/user-engine exact informed-decision Application and binding through admitted f239 workload", + "expected_result": "Exact two catalogue facts, genuine ordinary denial retained, truthful maintenance audit/event and one-use consumed ledger; native three-owner readback verified without fabricated human claims.", + "verification_ref": "docs/evidence/2026-10-10-security-consolidation/user-catalogue-independent-postapply-verification.json", + "rollback_ref": "same packet; original consumed grant before expiry, unchanged created rows/no dependencies, unsent-unclaimed event only; preserve audit/outbox and forbid targeted replay", + "cost_estimate_eur": 0.1, + "risk_estimate_eur": 100, + "risk_estimate": "Build-mode two metadata facts; one owner-hour straightforward repair assumption, uncontrolled downstream effects require stop/new disposition. No IAM/runtime changes; direct supervisor external authority verification required.", + "execution_deadline": "2026-10-12T23:59:59Z", + "memo_id": "infd-20261011-user-catalogue-bootstrap-r1", + "memo_version": 1, + "executor_sha256": "b0dbbb9786e927055030acf849a72e9a44e9d3d55c84efdf245e419d381684f3", + "transport_sha256": "3e594e0e8561100ae1eeb34d7208cd5b5e387ae56c29689f155aed94219770f3", + "promotion_evidence": false, + "native_execution": false, + "approved_revision": "human-packet-1-after-independent-owner-reviews", + "approved_digest": "026b7daa970920f468bb1cfd9e2df1eaaa99d1d5ce1945ea5db0bb33ee9e6f82", + "approval_ref": "informed-decision:infd-20261011-user-catalogue-bootstrap-r1@1;approval:b859698b-5d08-4da5-9599-4760c6a799f1", + "approved_at": "2026-10-11T02:07:09+00:00", + "human_disposition_id": "disp-7683bfbb-3743-4c9f-8ae3-962b6514c92e", + "executed_revision": "human-packet-1-after-independent-owner-reviews", + "executed_digest": "026b7daa970920f468bb1cfd9e2df1eaaa99d1d5ce1945ea5db0bb33ee9e6f82", + "executed_executor_sha256": "b0dbbb9786e927055030acf849a72e9a44e9d3d55c84efdf245e419d381684f3", + "executed_transport_sha256": "3e594e0e8561100ae1eeb34d7208cd5b5e387ae56c29689f155aed94219770f3", + "execution_ref": "docs/evidence/2026-10-10-security-consolidation/user-catalogue-approved-apply.json", + "verified_outcome": "Exact2cataloguefacts/1consumedledger/3truthfulaudits/1unsentunclaimedevent; ordinaryidentifieddenialretained, noPDPallowclaim; native3waycatalogue1 andSERVICEaccountrowdenied. Nativefixturechecksnotrealhumanlogin/MFA/grantrevocation; broaderUsertasksremainopen. No rollback/replay/delivery used.", + "refinement_or_rescue": false + }, + { + "proposal_id": "INFD-WP-0009-T04/purpose-overlay-v1", + "trial_id": "infd-purpose-20261011-r1", + "disposition": "accepted_unchanged", + "outcome": "failed", + "proposal_ref": "informed-decision/docs/evidence/2026-10-11-purpose-image-release/decision-packet.md", + "original_revision": "combined-ffa2679a", + "original_digest": "fd78d486174670e12efb2f812bac02e68f294e7791b9302d0d458c053240f5a9", + "packet_manifest_sha256": "ffa2679a94a24e69a75d1248a808825498a80e711ceda98f3639a4143c40ec1b", + "memo_sha256": "506d3956beb7c62ab2bbdfda783c05905d183452a1f67a1817f3fb8c2e522937", + "source_revision": "bc6494cd1b290783ef3aef0763bf28d1deabf4b0", + "approved_source_blob_sha256": { + "deploy/lifecycle/admission.candidate.json": "92382a56b349c3b895e5806e975082527bb99d1a001140e69d857e5b0391fa55", + "deploy/lifecycle/service.candidate.json": "38b78b9cbee5ade7750a58d5156ca4c5773352e947acb304ee714b59e749ceb4", + "deploy/lifecycle/kustomization.yaml": "1bbce81bc6758434354157f8601534320c5d0290587908fd15a6d25e3fa57f47", + "deploy/lifecycle/registries.candidate.json": "9bad6db5fbc2178d31b04120016a41830c3552fbb9e2517b718f9bbe87cf649e" + }, + "target": "realm:kubernetes/railiance01/informed-decision", + "expected_result": "Protected native schema5 backup/off-cluster drill independently matches snapshot integrity/counts; exact image763c Deployment-only manual Argo release Ready1; installed purpose refusal and separate actual-provider acceptance evidence, retained current database.", + "verification_ref": "docs/evidence/2026-10-10-security-consolidation/infd-purpose-approved-drill-copy-failure.json; docs/evidence/2026-10-10-security-consolidation/infd-independent-readonly-verification-receipt.json", + "rollback_ref": "same packet: failedcandidate-independent Deployment-only7db/7f5 source/image recovery plus separateReady/schema5/currentDB verification; no old snapshot overwrite", + "cost_estimate_eur": 0, + "risk_estimate": "Brief Recreate disruption, protected evidence snapshot custody/restore and operator recovery time unpriced; inherited1fixableMEDIUM remains INFD9T05. Allphases including recovery begin beforeOct12deadline; freshdecision if windowexhausted. No autopilot cost/risk grant.", + "execution_deadline": "2026-10-12T23:59:59Z", + "memo_id": "infd-20261011-purpose-overlay-r1", + "memo_version": 1, + "execution_bundle_sha256": "27d6d6d3133c963da1dde92d498d636617387c16e850a17c598148abc35c775d", + "execution_plan_sha256": "f5e5fa906ff19d3a45d10dcdb2810373ae21f9cf44c0472ff2bd47d3bc3328d6", + "internal_pre_submission_refinements": "Initial36manifest7c6738b3 and amended78b1e3 preserved; Platform found old-schema migration/optimizedassertion/dependencyseal/livecount gaps. Initial11helper653b68c3 preserved; independent rollbackReadyfailure/postadminintegrity/deadline findings corrected23f2fad with16synthetic+5recovery negatives. Final112/20document packet distinctProduct/PlatformACK; no previous human approval or native action.", + "promotion_evidence": false, + "native_execution": true, + "approved_revision": "combined-ffa2679a", + "approved_digest": "fd78d486174670e12efb2f812bac02e68f294e7791b9302d0d458c053240f5a9", + "approved_source_revision": "bc6494cd1b290783ef3aef0763bf28d1deabf4b0", + "approved_at": "2026-10-11T02:34:20+00:00", + "approval_ref": "informed-decision:infd-20261011-purpose-overlay-r1@1;approval:ec92806a-9aa6-494f-a76b-0385f39ba609", + "human_disposition_id": "disp-0968373d-294d-42bf-8979-36a7c5dd38cf", + "pre_actuation_attempts": [ + { + "result": "pre-phase refusal: Git custody ignore rule absent", + "native_phase_started": false, + "native_backup_or_image_change": false, + "journal_or_case_custody_created": false, + "source_hashes_and_fresh_authority_relation": "independently passed", + "recovery": "Add scoped Custodian .gitignore exclusion for exact approved private custody parent; unchanged approved helper/source/effect scope" + } + ], + "refinement_or_rescue": true, + "execution_results": { + "source_revision": "bc6494cd1b290783ef3aef0763bf28d1deabf4b0", + "drill_backup": "verified complete", + "drill_copy": "UNCERTAIN; stopped before local snapshot destination creation", + "offline_restore": "not executed", + "image_rollout": "not executed", + "database_preserved": true, + "failure_ref": "docs/evidence/2026-10-10-security-consolidation/infd-purpose-approved-drill-copy-failure.json", + "diagnosis_ref": "docs/evidence/2026-10-10-security-consolidation/infd-purpose-drill-copy-diagnosis.json", + "backup_ref": "docs/evidence/2026-10-10-security-consolidation/infd-purpose-approved-drill-backup.json", + "original_journal_retained": true, + "retry_executed": false + }, + "revisions": [ + { + "revision": "rescue-r2-d05d6e3b", + "status": "actual_target_verified_with_refinement", + "manifest_sha256": "d05d6e3b15df9acf1d7aef0ba2ec82a5a00d979ab1f324e981025cffe2cc753d", + "memo_version": 2, + "memo_sha256": "391330d062ede170a546415886d18b4895ba24d313a0dd50dcc1591c1aa3c2fa", + "revision_request_sha256": "feb946218e9611e1b686c1672fd9142896c55fd88aa2e59fabc6cfadbe22e327", + "revision_command_digest": "ccbeca292dd4ffcd0ed8a4669c82a93f9b773a30186966d3f146d5db8e5e6b8a", + "source_revision": "c96b0c6d881e855d1d158003c6de90ef390262e2", + "execution_bundle_sha256": "49c9cb70f36f6ceb7b0d22400b2ec9232a5e1a8a00d17e92b92fe367c98effb5", + "execution_plan_sha256": "9ce5728a561e6d38f8497201baa2b840d11444a0af8ad6234dfc37428113f258", + "delta": "Explicitly close WAL-aware readers; frozen zero-WAL hash-bound snapshot inspection uses immutable mode; distinct drill-copy-rescue-r1 and new linked journal preserve original uncertain attempt and SHM. Conditional remaining same-image phases only after new approval. Historical helper manifest label corrected.", + "verification": "26 synthetic executor/reader tests plus independent scope, custody and replay counterexamples; actual live drill/rollout remains pending.", + "rollback": "Deployment-only previous image/source recovery preserves latest database; old uncertain journal never rewritten.", + "cost_estimate": "EUR0 recurring infrastructure; existing temporary private-copy storage and attended time unpriced.", + "risk_estimate": "Existing approved snapshot contains private live data; metadata-only logging/private custody, no native sidecar deletion, no rollback over current database. Scoped Recreate restart and reversible Deployment-only image change conditional on actual compatibility drill.", + "approval_id": "7a34e7cc-5bad-40ea-a2f5-d6d269dc56f1", + "disposition_id": "disp-c6529331-e9d7-4466-9528-2e839739e751", + "approved_at": "2026-10-11T06:53:43Z", + "approved_source_revision": "c96b0c6d881e855d1d158003c6de90ef390262e2", + "approval_version": 2, + "review_version": 1, + "review_memo_id": "review-cda20761-f6ff-4d02-9c34-5097fc27539f", + "pre_actuation_attempts": [ + { + "outcome": "refused_before_phase", + "reason": "Root invocation supplied alternate receipt filenames instead of approved fixed interface", + "rescue_journal_created": false, + "native_operation_executed": false, + "correction": "Invoke unchanged approved helper using its original fixed receipt paths; fresh native source2 authority refresh" + } + ], + "native_execution": true, + "original_verify_phase_state": "UNCERTAIN", + "original_failed_copy_state": "UNCERTAIN", + "phase_replay_executed": false, + "independent_verification_ref": "docs/evidence/2026-10-10-security-consolidation/infd-independent-readonly-verification-receipt.json", + "actual_source_revision": "c96b0c6d881e855d1d158003c6de90ef390262e2", + "actual_image": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "actual_pod_uid": "c4cb1550-feda-4097-9de4-d891a657b662", + "ready_replicas": 1, + "rollback_executed": false, + "actual_native_provider_allow": true, + "synthetic_installed_refusal_variants": 8, + "medium_finding_due": "2026-10-18T23:59:59Z", + "product_acceptance_commit": "0693c40", + "platform_actual_acceptance_commit": "d47cbd0", + "task_closed": "INFD-WP-0009-T04", + "workplan_status": "active", + "risk_task": "INFD-WP-0009-T05", + "live_unpromoted_verifier_residual": "INFD-IN-0010" + } + ], + "current_revision_status": "owner_scoped_task_acceptance_recorded", + "outcome_detail": "verified_with_rescue_and_independent_readonly_reconciliation", + "executed_digest": "fd78d486174670e12efb2f812bac02e68f294e7791b9302d0d458c053240f5a9", + "scoring_semantics": "Original approved trial failed during copy; separately approved same-trial recovery target independently verified. Original failed/uncertain outcomes remain; no unchanged execution success scored." + }, + { + "proposal_id": "NK-FORGEJO-TYPE12-SOURCE-20261011-R1", + "trial_id": "forgejo-type12-source-20261011-r1", + "disposition": "accepted_unchanged", + "outcome": "not_executed", + "proposal_ref": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/proposal.json", + "original_revision": "final34-0b377d647ca748cd03c92f9792396412048055d4bde9f7bb06ff6d413f7acd68", + "original_digest": "585cee731de30d2b37883a57abfd9eb32f023ee694e8d911989109d5caf80569", + "packet_manifest_sha256": "0b377d647ca748cd03c92f9792396412048055d4bde9f7bb06ff6d413f7acd68", + "memo_id": "infd-20261011-forgejo-type12-source-r1", + "memo_version": 1, + "target": "NetKingdom proposed oidc-browser-relying-party type1.2 and separate Forgejo reference-migration design receipt", + "expected_result": "Source-only human acknowledgment of complete reviewed type package; canonical case remains proposed, type unimplemented, execution forbidden. No native credential or rollout action.", + "verification_ref": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/recording-gates.md", + "rollback_ref": "Immutable previous type/case1.1 retained; proposed1.2 not admitted for execution.", + "cost_estimate_eur": 0.1, + "risk_estimate": "Source-only decision. No credential exposure or live runtime change authorized.", + "promotion_evidence": false, + "native_execution": false, + "approved_digest": "585cee731de30d2b37883a57abfd9eb32f023ee694e8d911989109d5caf80569", + "approved_revision": "final34-0b377d647ca748cd03c92f9792396412048055d4bde9f7bb06ff6d413f7acd68", + "approved_at": "2026-10-11T06:47:39Z", + "approval_ref": "8e9332c8-754a-420c-b8b7-445cb4fe6765", + "human_disposition_id": "disp-315d54ad-20f1-40e6-862c-6c7d2e8f0ea8", + "approved_source_revision": "584a964684a28e759edc19862a91938bda161cb3", + "source_recording_commit": "f6856cd", + "application_design_receipt_commit": "d349815", + "followthrough_version_selection_commit": "bb9b9b5", + "source_recording_outcome": "verified_source_acknowledgment_recorded", + "scoring_semantics": "Source-only acknowledgment independently recorded; no privileged native execution authorized or performed. Source acknowledgment is retained separately from the supervision native-execution outcome axis." + }, + { + "proposal_id": "INFD-WP-0009-T05/zlib85091-r1", + "trial_id": "infd-zlib-20261011-r1", + "disposition": "accepted_unchanged", + "outcome": "succeeded", + "original_revision": "312ab97e876e17341bf16f9e95397e14c2ac2720", + "original_digest": "5dea0d404e4d13683fbf71d56273c06db7a6a916ab68759a90d7394005eee206", + "commands_sha256": "4cf81acb7d42f52d81f8ba624a6b2349a0b8948477a14c09bd069d2a4acab7cf", + "packet_manifest_sha256": "acb1262b56f10d117c702e62908db008c323a0acb5df4ed108d7868aa371bce9", + "proposal_ref": "/home/worsch/informed-decision/docs/evidence/2026-10-11-zlib-image-release/proposal.json", + "memo_id": "infd-20261011-zlib-remediation-r1", + "memo_version": 1, + "target": "realm:kubernetes/railiance01/informed-decision", + "authority_mode": "ADMINISTER", + "expected_result": "New guarded protected same-schema drill and one-Deployment zlib-only release to exact published f558; installed r1, fresh full zero scan, Ready and canonical authenticated provider proof. Human acceptance required first.", + "verification_ref": "/home/worsch/the-custodian/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/canonical-provider-verification.json", + "rollback_ref": "/home/worsch/informed-decision/docs/evidence/2026-10-11-zlib-image-release/rollback-deployment.json", + "rollback": "Exact image763/sourcec96; preserve latest database. Proposed manual outage recovery limited to same trial,30 minutes and deadline; later revocation uncertainty requires express new human consent.", + "cost_estimate_eur": 0, + "risk_estimate": "Private same-schema backup copies and brief Recreate availability gap. Failed or ambiguous phases retained; no replay. Rollback changes Deployment image/source only, retains latest database.", + "risk_limits": { + "execute_by": "2026-10-12T23:59:59Z", + "release_must_start_by": "2026-10-12T23:29:59Z", + "max_snapshot_bytes": 536870912, + "maximum_new_snapshot_payload_bytes_each_site": 1073741824, + "local_extra_disposable_clone_max_bytes": 536870912, + "private_metadata_and_sqlite_sidecars_additional_headroom_bytes": 16777216 + }, + "owner_acknowledgments": { + "Product": { + "work_item": "INFD-WP-ADHOC-2026-10-11-T09", + "status": "done", + "review_sha256": "fe7b2153e525a23980aee63e62efcd7fd3dad18145633f8f57d8d2b4640c99d4", + "binding_sha256": "d06beb1da58cced482dc6cb246ce47a6977bcf2d18109c55707d62d403b86640" + }, + "Platform": { + "work_item": "RPF-IN-0009", + "status": "done", + "review_sha256": "30c200b98f8692a8456e786d0c7a3acb5ff3634973911b088f56aa178d393fee", + "binding_sha256": "e3e1d8399e45bda48c8b9b29076e76a4be3df3b880c491ce1f103404538130bf" + } + }, + "executor_plan_sha256": "d871081999215bd3850ab1173064ed6cb6d7c23b26d9c3d5b3c5940e698d4c61", + "execution_bundle_sha256": "2ad65818444a72df7e6543575ba04a998e92b42d557409726a54fba116b5249d", + "preparation_history_ref": "/home/worsch/informed-decision/docs/evidence/2026-10-11-zlib-image-release/preparation-failure-history.json", + "history_limit": "Original67 full snapshot unavailable; retained digest and observations are not reconstructed full bytes. Earlier changes-requested reviews and failed T04 evidence preserved.", + "promotion_evidence": false, + "native_execution": true, + "bounded_outage_exception": "approved_scoped_manual_same_trial_only", + "checklist_item": 19, + "checklist_display_label": "INFD-WP-0009-T05/zlib-85091-r1", + "scoring_semantics": "New distinct T05 trial; preparation refinements are not executed trials or scored successes. No old T04 approval inherited.", + "review_memo_id": "review-2cf690a6-8c46-4faa-826c-a24a88d53dea", + "native_authoring_receipt_ref": "/home/worsch/the-custodian/docs/evidence/2026-10-10-security-consolidation/zlib-native-authoring-receipt.json", + "review_ready_at": "2026-10-11T10:40:24.369238+00:00", + "user_review_preference": "Review in informed-decision; not founder acceptance", + "approved_digest": "5dea0d404e4d13683fbf71d56273c06db7a6a916ab68759a90d7394005eee206", + "approved_revision": "312ab97e876e17341bf16f9e95397e14c2ac2720", + "approved_at": "2026-10-11T10:40:55Z", + "approval_ref": "b5ce337c-5d7d-44fa-864d-706b54039f7c", + "human_disposition_id": "disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f", + "approved_source_revision": "312ab97e876e17341bf16f9e95397e14c2ac2720", + "executed_digest": "5dea0d404e4d13683fbf71d56273c06db7a6a916ab68759a90d7394005eee206", + "executed_revision": "312ab97e876e17341bf16f9e95397e14c2ac2720", + "executed_source_revision": "312ab97e876e17341bf16f9e95397e14c2ac2720", + "refinement_or_rescue": true, + "preexecution_refinement": "Root receipt incorrectly reused native clock1.1806s ahead; three invocations refused before custody/journal. Root-only local verified_at correction; approved actuator/render/plan unchanged; failed prephase receipts retained.", + "completed_phases": [ + "drill-backup", + "drill-copy", + "offline-verify", + "cleanup-offline", + "cutover-backup", + "cutover-copy", + "release", + "verify" + ], + "verified_at": "2026-10-11T11:20:27.541827+00:00", + "outage_recovery_used": false, + "latest_database_preserved": true, + "scan_completed_at": "2026-10-11T10:48:46.790940Z", + "installed_zlib": "1.3.2-r1", + "allseverity_findings": 0, + "owner_postacceptance": "verified and recorded separately: Product T10 and Platform RPF-IN-0010", + "product_closure_commit": "47881fc1ff262bb705e75e4b59b8ef4731780d87", + "platform_acceptance_commit": "8647587ca292b67857c79f4561d3264e7f8132ef", + "actual_hub_decision_id": "2b81326f-4c09-5c66-88d1-84af4e5895fd", + "residuals_retained": [ + "INFD-IN-0010", + "INFD-IN-0009" + ] + }, + { + "proposal_id": "RPF-WP-0044-T04/public-transport-v1", + "disposition": "unscored", + "outcome": "succeeded", + "original_revision": 1, + "original_digest_sha256": "2e3094f4970f600b13b145386eab323f41e344e379a9e8b83282178e387a5920", + "proposal_ref": "railiance-platform/docs/evidence/2026-10-11-issue-core-transport/transport-plan.json", + "authorization_ref": "D2 89f1058f-33bc-47a8-8a49-0b44d426c67e; accepted build-mode blue-lane canon", + "target": "railiance01 argocd public host ConfigMap and railiance-tenants AppProject", + "expected_result": "Preserve prior public host pins and repository admissions, append only provider-verified Forgejo SSH key and exact private wrapper URL", + "verification_ref": "docs/evidence/2026-10-11-issue-core-public-transport/verification.json", + "rollback": "UID/preimage-tested inverse fields via same bounded helper; restore owner source", + "abort_owner": "railiance-platform with railiance-enablement", + "cost_estimate_eur": 0, + "risk_estimate": "Public transport admission only; no Secret, credential, network permission or workload change. Partial failures retained; no implicit replay.", + "promotion_evidence": false, + "reason": "Standing founder authorization; no backfilled exact-revision scoring or autopilot authority.", + "executed_revision": 1, + "executed_digest_sha256": "2e3094f4970f600b13b145386eab323f41e344e379a9e8b83282178e387a5920", + "executed_source_revision": "railiance-platform@1dc1d2f3a11ed74be4a4701167ee60782d616544; railiance-enablement@51a7c4cee68b48ed7a236e661b39c1d3cca92063", + "execution_ref": "docs/evidence/2026-10-11-issue-core-public-transport/execution.json", + "verified_outcome": "Both exact public fields changed and independently read back; no credential/Secret/network/workload changes. Issuance and adoption remain unexecuted.", + "refinement_or_rescue": false + }, + { + "proposal_id": "KEY-WP-0040-recovery-code-20261012-r1", + "disposition": "unscored", + "outcome": "succeeded", + "original_revision": 1, + "original_digest_sha256": "a89c59c713893cc4d779646f6a09a91d08396013a562ccf7df12e54d686db955", + "proposal_ref": "docs/evidence/2026-10-12-netkingdom-security/recovery-rollout-proposal.json", + "authorization_ref": "canon/standards/build-mode-change-authorization_v0.1.md; KEY-WP-0040 explicit blue-lane repair", + "target": "railiance01 mfa/privacyidea factor-recovery-code volume", + "expected_result": "Ready privacyIDEA deployment running DN-compatible recovery validation and value-free diagnostics", + "verification_ref": "docs/evidence/2026-10-12-netkingdom-security/recovery-rollout-receipt.json", + "rollback": "rollout_recovery.py rollback with the same payload and digest, CAS restores factor-recovery-79e2964c112f3688; retain both immutable ConfigMaps", + "abort_owner": "key-cape; executing custodian-codex", + "cost_estimate_eur": 0, + "risk_estimate": "Existing Recreate strategy causes a brief MFA-provider interruption; no account or factor change. Rollback restores prior immutable source. No new spend or authority scope.", + "promotion_evidence": false, + "reason": "Existing standing founder authorization, not an exact-revision approval or promotion grant.", + "executed_revision": 1, + "executed_digest_sha256": "a89c59c713893cc4d779646f6a09a91d08396013a562ccf7df12e54d686db955", + "verified_at": "2026-10-11T23:23:28.882335+00:00", + "verified_outcome": "Exact source ConfigMap, generation 11 ready; health 200 and unauthenticated 403. Attended positive preview remains open.", + "refinement_or_rescue": false + }, + { + "proposal_id": "FORGE6-NATIVE-PROBE-001", + "disposition": "unscored", + "outcome": "succeeded", + "original_revision": 1, + "original_digest_sha256": "b6fe6f55354f7f09837b94f4d75e79f39ac0a4b868f7ac377e2ca6590e340b42", + "proposal_ref": "docs/changes/CUST-WP-0080/receive-native-proposal.json", + "authorization_ref": "canon/standards/build-mode-change-authorization_v0.1.md", + "target": "railiance01 forgejo/forgejo-gitea-7d94988c79-8k76l new disposable /tmp probe only", + "expected_result": "Exact candidate binary on deployed image/Git accepts clean temporary pushes, rejects intermediate synthetic private key, discards quarantine, refuses unavailable scanner, recovers clean acceptance, retains dispatcher/additional-hook behavior; health remains passing and temporary area removed.", + "verification_ref": "docs/evidence/2026-10-12-netkingdom-security/receive-native-probe.json", + "rollback": "Remove only the new /tmp/custodian-receive-native-20261012-001 directory after matching .probe-owner. No existing repository/hook/config changes. Executor finally performs cleanup on success/failure.", + "abort_owner": "railiance-forge; executing custodian-codex", + "cost_estimate_eur": 0, + "risk_estimate": "Temporary approximately 27 MiB artifact storage plus small disposable Git fixtures and brief CPU use on the existing container; no new resource allocation/spend, no real credentials or production repository/config writes. Preflight requires 256 MiB free temporary space and passing health; execution has timeout and owned-path cleanup.", + "promotion_evidence": false, + "reason": "Existing standing founder authorization; not an exact-revision human approval, autopilot grant or credential-isolation proof.", + "executed_revision": 1, + "executed_digest_sha256": "b6fe6f55354f7f09837b94f4d75e79f39ac0a4b868f7ac377e2ca6590e340b42", + "verified_at": "2026-10-12T17:13:10.480151+00:00", + "verified_outcome": "Exact binaries passed disposable native push/detection/quarantine/failure/recovery/dispatcher checks in live image; existing service health passed, temporary directory removed. Production auth stubbed and hooks unchanged.", + "refinement_or_rescue": false + }, + { + "proposal_id": "FORGE6-RECEIVE-ACTIVATION-001", + "authorization_ref": "canon/standards/build-mode-change-authorization_v0.1.md", + "expected_result": "22 existing upstream dispatchers gain independent pinned secret scanner; SSH clean/blocked results observed under independently tested temporary veto, rejected probe refs and quarantines absent, veto removed, existing hooks preserved and health passing. Subsequent authorized ordinary source push separately proves clean acceptance.", + "rollback": "Run the same executor with this proposal and --rollback. Removes only the two additive files after exact hash verification; verifies original eight-file inventory on all 22 repositories. Durable admitted binaries remain inert. Automatic rollback on failed activation verification.", + "abort_owner": "railiance-forge; executing custodian-codex", + "cost_estimate_eur": 0, + "risk_estimate": "Existing infrastructure, approximately 27 MiB durable storage and transient transfer copy, sequential small probes. Possible false refusals or bounded push latency on 22 repositories until rollback. No new spend/resources or credential scope; no restart. Temporary exact-ref veto prevents synthetic fixture publication. Scanner bounds: 90 seconds, 2000 objects, 8 MiB each, 64 MiB aggregate; larger pushes require reviewed remediation rather than bypass.", + "promotion_evidence": false, + "disposition": "unscored", + "outcome": "succeeded", + "original_revision": 1, + "original_digest_sha256": "9c8ea3b7fbe16a997359432af7bcf09f429881fd23cc567188c21129e80ccf8d", + "proposal_ref": "docs/changes/CUST-WP-0080/receive-hook-proposal.json", + "target": "railiance01 existing forgejo pod; additive pre-receive.d hooks on exactly 22 listed repositories", + "verification_ref": "docs/evidence/2026-10-12-netkingdom-security/receive-hook-activation.json", + "reason": "Existing standing founder blue-lane authorization; not an exact-revision human approval or autopilot grant.", + "prepared_at": "2026-10-12T17:28:10.890040+00:00", + "refinement_or_rescue": false, + "executed_revision": 1, + "executed_digest_sha256": "9c8ea3b7fbe16a997359432af7bcf09f429881fd23cc567188c21129e80ccf8d", + "verified_at": "2026-10-12T17:32:28.543884+00:00", + "verified_outcome": "Additive independent scanner installed on 22 exact repositories. Each actual SSH clean and synthetic-secret probe produced the expected scanner result under the temporary veto; probe refs and quarantined commits absent. Veto and staging removed, original hook inventory preserved, health passes. Normal clean acceptance remains separate." + }, + { + "proposal_id": "FORGE6-TEMPLATE-LIFECYCLE-001", + "disposition": "unscored", + "outcome": "failed", + "original_revision": 1, + "original_digest_sha256": "7eddea55359b25c5ad307ed8ccd392dfadfe167d65cbe34b02f1955350bbcb36", + "proposal_ref": "docs/changes/CUST-WP-0080/forge-template-proposal.json", + "authorization_ref": "canon/standards/build-mode-change-authorization_v0.1.md", + "reason": "Standing founder blue-lane authorization after exact source/isolation/server-dry-run proof; not an exact-revision human approval, owner assent, autopilot grant or credential-isolation proof.", + "target": "railiance01 namespace forgejo: Deployment forgejo-gitea and immutable ConfigMap forgejo-secret-template-b1d7cf8cd13f", + "expected_result": "Same image and artifact hashes, Recreate replacement Ready, template selected in actual Forgejo global Git configuration, regular/executable inherited hook in temporary native Git repository, existing 22 hook inventories unchanged, health passing. No new production repository, identity, credential or publication.", + "verification_ref": "docs/evidence/2026-10-13-netkingdom-security/forge-template-activation.json", + "dry_run_ref": "docs/evidence/2026-10-13-netkingdom-security/forge-template-dry-run.json", + "rollback": "Same executor --rollback with original proposal. Removes only exact added mounts and volume, replaces added init setting with /usr/share/git-core/templates, waits for healthy replacement and verifies original 22 hooks/binaries. Keeps immutable ConfigMap inert and any already inherited repository hooks. If rollback used, reconcile owner source to explicit default selection before another Helm deploy. Automatic recovery only when current deployment template exactly matches the attempted change; unknown concurrent changes require abort-owner review.", + "abort_owner": "railiance-forge; executing custodian-codex; release source railiance-apps", + "cost_estimate_eur": 0, + "risk_estimate": "No new resource requests, spend commitments, RBAC or credential scope. Existing Recreate deployment incurs a brief forge interruption; abort after 240-second readiness budget, restore default template under conditional rollback with its own 240-second verification budget. Unknown state stops automatic recovery. New repository writes can refuse if scanner missing, overloaded or input unsupported; existing 22 profiles unchanged. Recorded node CPU requests 3460m/4000m and memory 9472Mi (59%).", + "prepared_at": "2026-10-13T11:56:51.534869+00:00", + "promotion_evidence": false, + "refinement_or_rescue": true, + "executed_revision": 1, + "executed_digest_sha256": "7eddea55359b25c5ad307ed8ccd392dfadfe167d65cbe34b02f1955350bbcb36", + "verified_at": "2026-10-13T12:02:44.468580+00:00", + "verified_outcome": "Subsequent ordinary railiance-forge push refused with scanner-file-refused after the restart. Initial hash/executable/malformed-input verification was insufficient. Custody-mode diagnosis and recovery in progress.", + "initial_verification": { + "at": "2026-10-13T12:02:44.468580+00:00", + "outcome": "Exact additive patch reached generation 12 Ready on unchanged image; configured native Git init inherits a regular executable scanner hook and malformed input refuses. Original 22 hooks/binaries preserved, health passing, temporary repository removed. No production API repository creation or global existing-repository coverage inferred.", + "limit": "Did not exercise ordinary source acceptance after the actual Kubernetes restart." + }, + "adverse_outcome_observed_at": "2026-10-13T12:11:00.052645+00:00", + "recovery_revisions": [ + { + "revision": 2, + "digest_sha256": "7530423d7528b63434d896dfe28e5288d4e332167db817efa58c2255defe28d3", + "proposal_ref": "docs/changes/CUST-WP-0080/forge-custody-repair-proposal.json", + "disposition": "unscored-standing-blue-authorization", + "outcome": "modes-restored; ordinary queued source push accepted via statehub sync", + "preflight_ref": "docs/evidence/2026-10-13-netkingdom-security/forge-custody-preflight.json", + "receipt_ref": "docs/evidence/2026-10-13-netkingdom-security/forge-custody-repair.json" + }, + { + "revision": 3, + "digest_sha256": "b9e8d82331ac2a7fc4b12b5524d486809d03b82f52dc96b31e8ae5e73b93c37f", + "proposal_ref": "docs/changes/CUST-WP-0080/forge-custody-rollout-proposal.json", + "disposition": "unscored-standing-blue-authorization", + "outcome": "first rollout verified; second restart preparation refused JSON-pointer local/server mismatch without mutation", + "source_commit": "railiance-apps 50b66c4", + "preflight_ref": "docs/evidence/2026-10-13-netkingdom-security/forge-custody-rollout-dry-run.json", + "receipt_ref": "docs/evidence/2026-10-13-netkingdom-security/forge-custody-rollout.json" + }, + { + "revision": 4, + "digest_sha256": "f6060bf7a5a604781a04b853775f72ba7ada5cc05c89a1da0df4fd480779004b", + "proposal_ref": "docs/changes/CUST-WP-0080/forge-custody-restart-proposal.json", + "disposition": "unscored-standing-blue-authorization", + "outcome": "verified second replacement generation14; guard completed; modes755 and clean/secret/quarantine/recovery checks pass", + "receipt_ref": "docs/evidence/2026-10-13-netkingdom-security/forge-custody-restart.json" + } + ], + "recovery_outcome": "Recovered with refinement: revisions2-4 restore755 and persist startup custody; two replacement pods passed native receive probes. Original trial remains failed, not an unchanged success. Authenticated SSH source push2c11c36 accepted after final restart and remote head verified.", + "recovery_summary_ref": "docs/evidence/2026-10-13-netkingdom-security/forge-custody-recovery-summary.json", + "proposal_storage": { + "format": "json-checksum-map-entries-v1", + "restore_helper": "docs/changes/CUST-WP-0080/restore_forge_proposal.py", + "original_digest_semantics": "SHA256 of exactly reconstructed executed JSON bytes; not the archive envelope", + "triage_ref": "docs/evidence/2026-10-13-netkingdom-security/forge-custody-metadata-triage.json" + } + }, + { + "proposal_id": "FORGE6-EXPAND-001", + "disposition": "unscored", + "outcome": "succeeded", + "original_revision": 1, + "original_digest_sha256": "508d540e578b8cb93a187de644f15d5ef404e2c0a90fdb96ef22cdbb2bb94c78", + "proposal_ref": "docs/changes/CUST-WP-0080/forge-expansion-proposal.json", + "authorization_ref": "canon/standards/build-mode-change-authorization_v0.1.md", + "reason": "Standing founder blue-lane authorization after exact metadata/hook preflight and atomic-ownership regression checks; no exact-revision human approval or autopilot claim.", + "target": "143 numeric repository IDs bound to private inventory digest on existing Forgejo pod", + "expected_result": "All143native targets have exact original generated hooks plus admitted profile. Each actual SSH clean and synthetic secret probe emits correct scanner result under a ref-specific veto; no probe refs/quarantined commits remain; vetoes and inert ownership links removed. Existing23profiles untouched. One incompatible gitlink repository remains explicit work, not an exemption.", + "verification_ref": "docs/evidence/2026-10-13-netkingdom-security/forge-expansion-activation.json", + "rollback": "Same executor --rollback with exact proposal, private inventory and apply receipt. Removes only exact installed hook/veto hashes on attempted IDs; automatic recovery additionally requires original ownership hard-links. Preserve all preexisting generated hooks. Unknown concurrent changes abort removal, retain unverified outcome for abort owner.", + "abort_owner": "railiance-forge; executor custodian-codex", + "cost_estimate_eur": 0, + "risk_estimate": "Additive reversible hook configuration, no rollout/new resources or identity/policy scope expansion. Probe traffic is serialized and scoped to a temporary ref; veto leaves normal refs unaffected. Unsupported or secret-bearing writes may refuse by design. Limits and initial-history/import coverage remain explicit. Abort on precondition or acceptance failure and roll back attempted cohort; no actual credential content used.", + "prepared_at": "2026-10-13T14:48:05.689089+00:00", + "promotion_evidence": false, + "refinement_or_rescue": false, + "executed_revision": 1, + "executed_digest_sha256": "508d540e578b8cb93a187de644f15d5ef404e2c0a90fdb96ef22cdbb2bb94c78", + "execution_note": "Exact revision 1 completed with process exit 0. All 143 targets verified; final read-only audit preserves 23 baseline profiles and confirms 166 of 167 current repositories admitted, zero unknown profiles, and no probe refs, vetoes or ownership markers. Repository 55 remains explicit compatibility work. No refinement or rescue; standing authorization remains unscored.", + "final_verification_ref": "docs/evidence/2026-10-13-netkingdom-security/forge-expansion-final.json", + "verified_at": "2026-10-13T15:25:26.589770+00:00" + }, + { + "proposal_id": "FORGE6-ROUTES-001", + "disposition": "unscored", + "outcome": "not_executed", + "original_revision": 1, + "original_digest_sha256": "a253fce3a565a2af94133da019bdc434dc57b21a8c61b06b4c27e036cf5a01d3", + "original_proposal_ref": "docs/changes/CUST-WP-0080/forge-routes-proposal-pre-rehearsal.json", + "prepared_revision": 2, + "prepared_digest_sha256": "d12c12857e9ed5f4afa3c1c231fd142adad580a458cc175e74f0ea0e3118d792", + "proposal_ref": "docs/changes/CUST-WP-0080/forge-routes-proposal.json", + "authorization_ref": "canon/standards/build-mode-change-authorization_v0.1.md", + "reason": "Reversible build-mode acceptance preparation; live operation needs the founder identity act in the existing attended window. No exact-revision approval, completed login or autopilot grant inferred.", + "target": "One newly created private disposable repository; pinned deployed Forgejo and admitted hook. Existing repository content, hooks, accounts and policies remain untouched.", + "expected_result": "Authenticated native HTTPS clean acceptance and synthetic-secret refusal with detector evidence; API private creation inherits exact hook; clean/content-secret and clean/merge-message refusal with unchanged refs; quarantine commit absent; anonymous private access refused; owned test repository deleted and absent.", + "verification_ref": "docs/evidence/2026-10-13-netkingdom-security/forge-routes-preparation.json", + "rollback": "Automatic cleanup checks numeric repository ID, owner, private flag, name and ownership description before deleting only the newly created test repository. On interrupted known creation, rerun run_forge_routes.py with the same proposal and receipt plus --cleanup-only. Ambiguous POST before numeric ID receipt requires reconciliation, never replay or delete by name.", + "abort_owner": "railiance-forge; custodian-codex prepares and verifies receipts", + "cost_estimate_eur": 0, + "risk_estimate": "Bounded synthetic test writes to a unique private disposable repository. No real secret fixtures, account creation, access-policy change or external publication. Unexpected acceptance may retain an unbound synthetic private-key fixture until cleanup. API/network failure stops the trial; ambiguous creation and cleanup remain explicitly unverified.", + "promotion_evidence": false, + "refinement_or_rescue": true, + "prepared_at": "2026-10-13T16:26:09.780197+00:00" + }, + { + "proposal_id": "FORGE6-RUNNER-LOOPBACK-001", + "disposition": "unscored", + "outcome": "succeeded", + "original_revision": 1, + "original_digest_sha256": "a2d29132c639f76bed0465a30119148d207f9242c29a2229a2e90cfc5a6aecac", + "original_proposal_ref": "docs/changes/CUST-WP-0080/forge-runner-loopback-proposal-revision-1.json", + "prepared_revision": 2, + "prepared_digest_sha256": "9bd1e9f98a99298c810a47e9dffa0316fe235eff53bcd6cfa0dd6391e094f853", + "proposal_ref": "docs/changes/CUST-WP-0080/forge-runner-loopback-proposal.json", + "authorization_ref": "canon/standards/build-mode-change-authorization_v0.1.md", + "reason": "Standing founder blue-lane rule: reversible reduction of exposed Docker access, reviewed source commit and server dry-run, no credential/policy-scope expansion, exact rollback and named abort owner. No exact-revision human approval or autopilot claim.", + "target": "forgejo/Deployment forgejo-runner only; existing Docker and runner binaries pinned by digest", + "expected_result": "Runner remains Ready with same image bytes and loopback Docker ping; actual Docker listener is 127.0.0.1 only and a separate Forgejo pod cannot reach it. No running or queued tasks at apply. No replica, resource-request, credential or policy expansion.", + "verification_ref": "docs/evidence/2026-10-13-netkingdom-security/forge-runner-loopback-activation.json", + "rollback": "Run same executor --rollback with this proposal, ignored original-template.json baseline and a new receipt, only against exact candidate template/UID. Restores original listener and image references; records restored exposure. No automatic rollback on a security-probe failure; abort owner reviews live state.", + "abort_owner": "railiance-forge, source owner railiance-apps; custodian-codex executes", + "cost_estimate_eur": 0, + "risk_estimate": "Brief runner unavailability during existing Recreate rollout and cold ephemeral Docker cache. Abort if running/queued work appears before apply. An external Docker consumer using the pod IP loses access; the declared runner uses loopback. A concurrent newly scheduled job remains a race; preserve any nonterminal outcome. Original private template retained for exact guarded rollback. No new resources/spend or data deletion requested.", + "refinement_or_rescue": true, + "refinement_note": "Read-only preflight showed Docker wildcard binding in /proc/net/tcp6, so rollback verification binds the observed original listener instead of assuming an IPv4-only socket. No live mutation in revision 1.", + "promotion_evidence": false, + "prepared_at": "2026-10-13T16:42:18.349596+00:00", + "executed_revision": 2, + "executed_digest_sha256": "9bd1e9f98a99298c810a47e9dffa0316fe235eff53bcd6cfa0dd6391e094f853", + "verified_at": "2026-10-13T16:46:23.659255+00:00", + "execution_note": "Process exited 0. Generation 4 Ready, exact prior image bytes retained, local Docker ping succeeds, other-pod ping refuses, actual listener is IPv4 loopback only. Zero queued/running jobs before and after. Revision 1 was preparation only; unscored standing grant, no promotion credit." + }, + { + "proposal_id": "CUST81-REUSE-PUBLIC-REGISTRATION-R1", + "disposition": "unscored", + "outcome": "succeeded", + "proposal_ref": "docs/assessments/netkingdom-2026-10-14/hub-public-registration-proposal-r1.json", + "original_revision": 1, + "original_digest_sha256": "84811121ae8d00970927b97bd6125b6a91989cce46dbe6b75a24592e15c16ca1", + "original_digest": "84811121ae8d00970927b97bd6125b6a91989cce46dbe6b75a24592e15c16ca1", + "target": "https://reuse.coulomb.social/v1/repos; 31 public-only repository registrations", + "expected_result": "All 31 reviewed public repository registrations match the approved plan and the public capabilities become discoverable from fresh hosted federation readback.", + "verification_ref": "docs/assessments/netkingdom-2026-10-14/hub-public-registration-proposal-r1.json; docs/assessments/netkingdom-2026-10-14/hub-public-resume-receipts.jsonl; fresh hosted federation GET", + "rollback": "For only rows created by this attempt, PATCH enabled=false, then verify each row and confirm its capabilities disappear from a fresh federation. Reconcile any ambiguous POST before changing it; never delete or disable pre-existing matching registrations.", + "cost_estimate_eur": 0, + "risk_estimate": "High-risk credential route uses the 15-minute dedicated role on exact KV data and metadata paths. The helper requests only REUSE_SURFACE_TOKEN and does not expose or persist its value; because the policy is path-level, another field at that secret path may also be readable by the principal. 31 bounded metadata writes are individually receipted; conflicts halt the batch. Hub-write effects are reversible by disabling only rows attributable to this attempt. No private source, visibility change, deployment or resource commitment.", + "refinement_or_rescue": true, + "promotion_evidence": false, + "executed_revision": 1, + "execution_ref": "docs/assessments/netkingdom-2026-10-14/hub-public-resume-receipts.jsonl", + "verified_outcome": "31 public registrations applied and read back; all 63 public reviewed IDs appear exactly once after refresh. Scoped OpenBao session revoked. Seven private sources remain outside this proposal.", + "authorization_ref": "Founder active user objective: perform the NetKingdom security architecture review and establish all capabilities with reuse-surface; exact proposal R1 is limited to its 31 public repositories and excludes all seven private repositories.", + "reason": "Existing broad user authorization covers establishment; no exact-revision supervisor disposition was recorded. Earlier accepted_unchanged scoring inferred approval from the task objective and is corrected here; no promotion credit is claimed.", + "transport_ref": "docs/assessments/netkingdom-2026-10-14/attended_public_registration.py", + "transport_sha256": "be838f5da85d9aec4afed779d295548c739d6d1da670e13808bd804476663785", + "transport_note": "Fresh Windows Firefox private profile; scoped OpenBao token in memory only. Enforce recorded member entity, exact policies and max30m TTL before invoking unchanged Warden/helper. Revoke in finally; retain Warden audit and sanitized attempt receipt.", + "authentication_attempts": [ + { + "at": "2026-10-14T22:13:41.969079+00:00", + "attempt_id": "8c160098-587b-426c-9f9f-33f57de30c92", + "finished_at": "2026-10-14T22:15:54.561630+00:00", + "login": false, + "login_error": "Error authenticating: timed out waiting for response from provider", + "proposal_id": "CUST81-REUSE-PUBLIC-REGISTRATION-R1", + "revision": 1, + "revoked": null, + "warden_exit": null, + "warden_state": "/tmp/custodian-warden-state-0x5_fd96" + }, + { + "at": "2026-10-14T22:18:17.520607+00:00", + "attempt_id": "23c02e30-1a4c-4bc1-a3dc-45c9bf7ce962", + "entity_id": "c204099b-cb94-363f-e207-5ff4d4aa6e94", + "finished_at": "2026-10-14T22:19:26.523659+00:00", + "login": true, + "proposal_id": "CUST81-REUSE-PUBLIC-REGISTRATION-R1", + "revision": 1, + "revoked": true, + "warden_exit": 0, + "warden_state": "/tmp/custodian-warden-state-bpn99gi5" + } + ], + "executed_digest_sha256": "84811121ae8d00970927b97bd6125b6a91989cce46dbe6b75a24592e15c16ca1", + "executed_digest": "84811121ae8d00970927b97bd6125b6a91989cce46dbe6b75a24592e15c16ca1", + "final_verification_ref": "docs/assessments/netkingdom-2026-10-14/hosted-public-registration-verification.json", + "verified_at": "2026-10-14T22:19:51.870244+00:00", + "refinement_note": "Freshened stale ops-mason publication proof and added a fresh-profile in-memory authentication transport. First login timed out during Firefox update; user-requested retry succeeded. Preserve both authentication attempts; no unchanged-success scoring." + }, + { + "proposal_id": "STATE-WP-0095-T06-cluster-frozen-receiving-r1", + "disposition": "accepted_revised", + "outcome": "succeeded", + "proposal_ref": "docs/changes/netkingdom-target-2026-10-16/cluster-historical-publication-r1/revisions/r4-rollout-review/proposal-metadata.json", + "original_revision": 1, + "original_digest_sha256": "5bef9e7818ce1ebc64b81e300b6b40dcfc710a8625d6e0595534f8284dc2052d", + "original_digest": "5bef9e7818ce1ebc64b81e300b6b40dcfc710a8625d6e0595534f8284dc2052d", + "current_revision": 4, + "current_digest_sha256": "63a02e8296d126c0158b7eb2c4ce79c7eeb6f8d6f61298d473c1065c7557ba32", + "target": "railiance01 state-hub release/API/MCP and exact-new-trial migration Job only", + "expected_result": "Normal owner image promotion makes exact frozen cluster receiving available; API/MCP ready, expected c4 schema and exact three historical parents/15 tasks preserved; only then is later registrar admission eligible. No original TLS/identity native acceptance is inferred.", + "verification_ref": "docs/changes/netkingdom-target-2026-10-17/receiver-rollout-r4/verified-receiving-return.json", + "rollback_ref": "docs/changes/netkingdom-target-2026-10-16/cluster-historical-publication-r1/revisions/r4-rollout-review/MIGRATION-JOB-RECOVERY.md", + "cost_estimate_eur": null, + "risk_estimate_eur": null, + "cost_estimate": "Unknown attributable execution/network/operator recovery cost on existing infrastructure; no zero-cost claim or budget reservation inferred.", + "risk_estimate": "Unpriced production coordination outage, message migration locks/data compatibility, retained active migration Job, uncertain connection/lock mapping and recovery time; three-minute Helm wait is not a bound on outage or DB effects. Explicit supervised risk disposition required.", + "supervisor": "Bernd Worsch", + "approval_ref": "e3798419-8aa9-5425-8c08-20df6bd82a19", + "approved_revision": 4, + "approved_digest_sha256": "63a02e8296d126c0158b7eb2c4ce79c7eeb6f8d6f61298d473c1065c7557ba32", + "executed_revision": 4, + "executed_digest_sha256": "63a02e8296d126c0158b7eb2c4ce79c7eeb6f8d6f61298d473c1065c7557ba32", + "refinement_or_rescue": true, + "promotion_evidence": false, + "reason": "Founder-approved revision4 executed successfully. Helm76, exact image/module, expected schema, 18 unchanged historical full rows and five rollback-only native cases verified. Original proposal refinements retained; no unchanged-success credit.", + "revisions": [ + { + "revision": 1, + "proposal_ref": "docs/changes/netkingdom-target-2026-10-16/cluster-historical-publication-r1/REVIEW.md", + "digest_sha256": "5bef9e7818ce1ebc64b81e300b6b40dcfc710a8625d6e0595534f8284dc2052d", + "disposition": "not_submitted_or_unadjudicated", + "executed": false + }, + { + "revision": 2, + "proposal_ref": "docs/changes/netkingdom-target-2026-10-16/cluster-historical-publication-r1/revisions/r2/REVIEW.md", + "digest_sha256": "c8f13ed5d67d4743ea8e81bf720367022c820a060d7b225e84338eab2907493f", + "disposition": "not_submitted_or_unadjudicated", + "executed": false + }, + { + "revision": 3, + "proposal_ref": "docs/changes/netkingdom-target-2026-10-16/cluster-historical-publication-r1/revisions/r3-readiness/ROLLOUT-SUPPLEMENT.md", + "digest_sha256": "df2962fd1588784a987e37932bd67f03f6248ea6384cf4bbb74ad1fe2e26be2b", + "disposition": "not_submitted_or_unadjudicated", + "executed": false + } + ], + "approved_digest": "63a02e8296d126c0158b7eb2c4ce79c7eeb6f8d6f61298d473c1065c7557ba32", + "approved_at": "2026-10-16T23:55:32.549865+00:00", + "supervisor_disposition": "Founder approved exact presented revision4 unchanged; original r1 was refined before submission, so this remains accepted_revised for original-trial scoring.", + "approval_scope": "Exact pinned receiver rollout including inbox migration and documented conditional recovery; no authority promotion.", + "executed_digest": "63a02e8296d126c0158b7eb2c4ce79c7eeb6f8d6f61298d473c1065c7557ba32", + "execution_started_at": "2026-10-16T23:57:03.186884+00:00", + "execution_ref": "docs/changes/netkingdom-target-2026-10-17/receiver-rollout-r4/execution.json", + "verified_at": "2026-10-17T00:07:47.015454+00:00", + "recovery_required": false, + "post_execution_findings_ref": "docs/changes/netkingdom-target-2026-10-17/receiver-rollout-r4/ordinary-pipeline-preservation-finding.json", + "post_execution_finding": "Later ordinary Cluster deep-consistency binding refresh changed three historical parent hashes; original delivered-rollout preservation and five rollback probes passed before that separate pipeline. Further acceptance stays open." + }, + { + "proposal_id": "STATE-WP-0095-T10-frozen-bindings-guard-r1", + "disposition": "accepted_revised", + "outcome": "succeeded", + "proposal_ref": "docs/changes/netkingdom-target-2026-10-17/guard-successor-review-r2/proposal-metadata.json", + "original_revision": 1, + "original_digest_sha256": "81d365926fc585a186955d8c98ee83501fd3cec12135b2256d71b46a75097932", + "original_digest": "81d365926fc585a186955d8c98ee83501fd3cec12135b2256d71b46a75097932", + "current_revision": 2, + "current_digest_sha256": "5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e", + "target": "railiance01/92.205.62.239 state-hub release API/MCP and exact-new-trial migration Job", + "expected_result": "New API binding guard delivered and current-baseline native/whole-pipeline preservation verified, with earlier parent mismatch retained as explicit exception.", + "verification_ref": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-receiving-return.json", + "rollback_ref": "docs/changes/netkingdom-target-2026-10-17/guard-successor-review-r2/RECOVERY.md", + "cost_estimate_eur": null, + "risk_estimate_eur": null, + "cost_estimate": "Unpriced incremental execution and recovery costs on existing infrastructure.", + "risk_estimate": "Unpriced coordination outage, hook lifetime, lock mapping and recovery; reviewed conditional limits stop for attended owner on unknown state.", + "supervisor": "Bernd Worsch", + "approval_ref": "df703266-6719-4c04-ae1b-ba9afd3bca1c", + "approved_revision": 2, + "approved_digest_sha256": "5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e", + "executed_revision": 2, + "executed_digest_sha256": "5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e", + "refinement_or_rescue": true, + "promotion_evidence": false, + "related_proposal_id": "STATE-WP-0095-T06-cluster-frozen-receiving-r1", + "reason": "Separate new-code runtime request follows retained ordinary-pipeline and stale-installed-client failures. Six source refinements and real writeback regression remain visible; no extra success or authority is inferred.", + "revision_history": [ + { + "revision": 1, + "digest_sha256": "81d365926fc585a186955d8c98ee83501fd3cec12135b2256d71b46a75097932", + "outcome": "not_executed", + "refinement": "Normal secret scan flagged probe source-hash metadata; original retained locally and by digest." + }, + { + "revision": 2, + "digest_sha256": "5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e", + "outcome": "not_executed", + "refinement": "Typed module/SHA256 records; unchanged runtime and probe logic." + } + ], + "approved_digest": "5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e", + "approved_at": "2026-10-17T01:51:27.526327+00:00", + "approval_record_ref": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/approval-decision.json", + "approval_scope": "Exact revision2 new API image rollout, eight rollback/intercepted probes, corrected normal pipeline and current-baseline exception, plus scoped conditional recovery; no authority promotion.", + "executed_digest": "5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e", + "execution_started_at": "2026-10-17T01:52:59.649596+00:00", + "execution_ref": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/execution.json", + "verified_at": "2026-10-17T01:55:19.742775+00:00", + "verified_outcome": "Exactapprovedrevision2 deliveredHelm77; eightactualrollback/interceptedcasespass, all18CURRENTfullrows equalafterrolloutandnormalpipeline; archives/stagedworkpreserved. Originalthreeparentfailure retainedasfounder-approvedhistoricalexception, notrestored/backfilled.", + "recovery_required": false + }, + { + "proposal_id": "REINAH-WP-0008-T07-install-f599-r1", + "disposition": "accepted_revised", + "outcome": "unverified", + "proposal_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/FINAL-PROPOSAL.md", + "original_revision": 1, + "original_digest_sha256": "408d779a19e0e83b3be9a80ad624c1f7b7be906d22c0a8efe6e629185cc0cd0a", + "original_digest": "408d779a19e0e83b3be9a80ad624c1f7b7be906d22c0a8efe6e629185cc0cd0a", + "current_revision": 2, + "current_digest_sha256": "44b17589c323e1a966caf6c1b1def123092ee289b929c8ea014bc84109103b1d", + "target": "railiance01/92.205.62.239 account tegwick UID/GID1000; exact protected runtimes store and new f599 immutable digest directory", + "expected_result": "Exact dormant artifact append with full extracted/installed/post-rehearsal f599 digest equality; three credential-free empty-egress launcher checks pass; positively quiesced owned processes and staging gone. No provider, owner/catalog/profile/queue changes or native security-gate closure.", + "verification_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/PROCESS-CONTRACT.md", + "planned_execution_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/execution-receipt.json", + "rollback_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/FINAL-PROPOSAL.md", + "cost_estimate_eur": null, + "risk_estimate_eur": null, + "cost_estimate": "Zero provider requests and no new paid resource; infrastructure/energy/operator EUR cost unknown, explicitly supervised.", + "risk_estimate": "Shared single-node CPU/IO interruption and recovery EUR loss unknown; exact fresh headroom, private process supervision and conditional staging cleanup required. Installed digest retained inactive on partial failure.", + "supervisor": "Bernd Worsch", + "approval_ref": "b6abb6ab-b182-4b4f-9f84-79ddc5ad91f3", + "approved_revision": 2, + "approved_digest_sha256": "44b17589c323e1a966caf6c1b1def123092ee289b929c8ea014bc84109103b1d", + "executed_revision": 2, + "executed_digest_sha256": "44b17589c323e1a966caf6c1b1def123092ee289b929c8ea014bc84109103b1d", + "refinement_or_rescue": true, + "promotion_evidence": false, + "reason": "R1 held before submission after root found descendant timeout/cleanup gap. R2 adds one-action supervised runner with unchanged immutable runtime. All original failures and local bytecode/source-change refusal retained. No approval or execution inferred.", + "revision_history": [ + { + "revision": 1, + "digest_sha256": "408d779a19e0e83b3be9a80ad624c1f7b7be906d22c0a8efe6e629185cc0cd0a", + "outcome": "not_executed", + "disposition": "not_submitted_or_unadjudicated", + "root_review": "needs_refinement_descendant_cleanup" + }, + { + "revision": 2, + "digest_sha256": "44b17589c323e1a966caf6c1b1def123092ee289b929c8ea014bc84109103b1d", + "manifest_sha256": "aea5dbfe0742fe0bb6c36a41ca7b0d70473683b2731f92cc279d43929e5c35c9", + "outcome": "not_executed", + "disposition": "pending", + "root_review": "accepted_for_founder_submission_after_independent_source_review_and_two_process_oracles" + } + ], + "pending_decision_ref": "b6abb6ab-b182-4b4f-9f84-79ddc5ad91f3", + "approved_at": "2026-10-17T08:34:32.549418+00:00", + "approval_record_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/approval-decision.json", + "supervisor_disposition": "Founder approved exact presented revision2; originalR1 required root refinement and was not submitted/executed. No unchanged original-success credit or authority promotion.", + "execution_started_at": "2026-10-17T08:35:10.440830+00:00", + "execution_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/execution-receipt.json", + "execution_phase": "approved_controller_invocation_pending_verification" + } + ], + "trials": [ + { + "proposal_id": "CUST81-PRIVATE-READER-EXECUTION-R1", + "proposal_ref": "docs/assessments/netkingdom-2026-10-14/private-reader-execution-proposal-r1.json", + "original_revision": 1, + "original_digest_sha256": "704a9c932202fc14456652ea4dfdb3acb8b1db0ab3bbf5fff50e92b2c517c380", + "original_digest": "704a9c932202fc14456652ea4dfdb3acb8b1db0ab3bbf5fff50e92b2c517c380", + "disposition": "accepted_unchanged", + "outcome": "succeeded", + "trial_scope": "CUST-WP-0081 supervised exact private-reader rollout/provisioning/registration proposal; no scope grant inferred", + "target": "railiance01 reuse/reuse-surface; exact seven Forgejo private repositories; OpenBao exact newreader data path; hosted sevenregistrations", + "expected_result": "Verified hardened rollout before readeravailability, native14consentedfileproofs, hosted all70reviewedcapabilities exactlyonce", + "verification_ref": "docs/assessments/netkingdom-2026-10-14/private-reader-execution-proposal-r1.json verification/ordered_execution/prepared_artifacts", + "rollback_ref": "docs/assessments/netkingdom-2026-10-14/private-reader-execution-proposal-r1.json rollback/conditional_receipt_authority", + "cost_estimate_eur": null, + "incremental_infrastructure_cost_eur": 0, + "risk_estimate_eur": null, + "risk_estimate": "Qualitative supervised interruption/recovery and dedicated static seven-repository code-read exposure; exact guards, backup and recovery specified in packet; unpriced credible loss, no autopilot grant.", + "supervisor": "Bernd Worsch", + "approval_ref": "9833715e-a22a-45c0-ab6c-881f0f4f1a0e", + "approved_revision": 1, + "approved_digest": "704a9c932202fc14456652ea4dfdb3acb8b1db0ab3bbf5fff50e92b2c517c380", + "executed_revision": 1, + "executed_digest": "704a9c932202fc14456652ea4dfdb3acb8b1db0ab3bbf5fff50e92b2c517c380", + "refinement_or_rescue": true, + "verified_outcome": "All70reviewedcapabilities freshlyhosted exactlyonce/correctsource/no warnings; actual14privatefiles hashverified,7POST201/fullSQLreadback, admin/writerrevocationconfirmed. Executedapprovedrevision2 withcorrection/retries; not an unchanged execution success.", + "promotion_evidence": false, + "submitted_at": "2026-10-15T00:04:50.637439+00:00", + "approval_record_ref": "docs/assessments/netkingdom-2026-10-14/private-reader-execution-approval-r1.json", + "approved_at": "2026-10-15T00:07:05.087085+00:00", + "execution_preflight_refinement": "Freshrootdiff initiallyuseddefaultnamespace; stoppedbeforelivechange. Owneroriginaldryrun/diff correctlytargetedreuse. Correctedrootexplicitnamespace andrecordedproof; approvedliveeffect unchanged.", + "execution_ref": "docs/assessments/netkingdom-2026-10-14/phase-a-authorized-execution-r1.jsonl", + "partial_verified_outcome": "Hardenedrollout,custody,revocation,maintenance,readerESOdelivery,actualnative14fetch verified. Originalattendedwriter failed beforelogin dueconfirmedCLIflagorder; noregistrations. Correctedrevision2 pending exactsupervisorapproval.", + "partial_verification_ref": "docs/assessments/netkingdom-2026-10-14/phase-a-runtime-verification-r1.json", + "source_declaration_ref": "docs/assessments/netkingdom-2026-10-14/owner-assembly/active-phase-a-source-declaration-r1.json", + "attended_login_failure_ref": "docs/assessments/netkingdom-2026-10-14/attended-custody-login-failure-r1.json", + "dependency_repair_review_ref": "docs/assessments/netkingdom-2026-10-14/warden-dependency-repair-requester-review-r1.json", + "latest_attended_login_failure_ref": "docs/assessments/netkingdom-2026-10-14/attended-custody-login-failure-r2.json", + "custody_verification_refs": [ + "docs/assessments/netkingdom-2026-10-14/cust81-policy-custody-r1.jsonl", + "docs/assessments/netkingdom-2026-10-14/cust81-forge-reader-r1.jsonl", + "docs/assessments/netkingdom-2026-10-14/warden-attended-custody-terminal-r1.json" + ], + "revisions": [ + { + "revision": 2, + "digest": "c8fa74ad6648af1c884a4c607e100097f917761af5d3a6e0c5e8ce9a53b809dc", + "proposal_ref": "docs/assessments/netkingdom-2026-10-14/private-reader-execution-proposal-r2.json", + "disposition": "accepted_unchanged", + "reason": "Actual writertransport refused beforebrowser: trailing-no-store treatedas malformedauthdata; one-lineordercorrection prepared", + "executed": true, + "approval_ref": "9f496e68-655e-4e08-aa57-c822cf731124", + "approved_digest": "c8fa74ad6648af1c884a4c607e100097f917761af5d3a6e0c5e8ce9a53b809dc", + "approved_at": "2026-10-15T03:23:56.611534+00:00", + "executed_digest": "c8fa74ad6648af1c884a4c607e100097f917761af5d3a6e0c5e8ce9a53b809dc", + "execution_started_at": "2026-10-15T03:24:57.316551+00:00", + "outcome": "verified_success_after_claim_and_OTP_retries" + } + ], + "latest_writer_failure_ref": "docs/assessments/netkingdom-2026-10-14/private-writer-cli-order-failure-r1.json", + "latest_approved_revision": 2, + "latest_approval_ref": "9f496e68-655e-4e08-aa57-c822cf731124", + "latest_executed_revision": 2, + "latest_executed_digest": "c8fa74ad6648af1c884a4c607e100097f917761af5d3a6e0c5e8ce9a53b809dc", + "final_verification_ref": "docs/assessments/netkingdom-2026-10-14/hosted-private-registration-verification-r1.json", + "completed_at": "2026-10-15T03:33:16.165793+00:00" + } + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/supervision-before-r3-controller.json b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/supervision-before-r3-controller.json new file mode 100644 index 00000000..1973200b --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/supervision-before-r3-controller.json @@ -0,0 +1,1079 @@ +{ + "schema": "custodian.agent-supervision.v1", + "agent_id": "custodian-codex", + "identity_binding": "logical supervised coding-agent record; interactive runtime isolation not yet enforced", + "scope": "CUST-WP-0071 and CUST-WP-0073 preparation and founder-authorized Railiance changes", + "mode": "supervised", + "supervisor": "Bernd Worsch", + "policy_ref": "docs/agent-autonomy-decision.md", + "runtime_enforcement": "not_yet_migrated", + "autopilot_grant": null, + "cost_budget_eur": null, + "risk_limit_eur": null, + "proposals": [ + { + "proposal_id": "CUST-WP-0073-T03-annotation-guard", + "disposition": "unscored", + "outcome": "failed", + "reason": "Conversation authorization predates exact-revision scoring. Native admission tests passed, but ESO refresh failed under the guard. Binding rolled back and 39/39 ExternalSecrets recovered. Retain this adverse outcome; it is not promotion evidence.", + "proposal_ref": "docs/changes/CUST-WP-0073/README.md", + "execution_ref": "railiance-platform@54885ac1589074a68d9607d1be250c84c5c2307a", + "refinement_or_rescue": true, + "verification_ref": "docs/evidence/2026-09-28-secret-annotation-rollout.md", + "remediation": { + "authorization_ref": "Founder continuation: Good, go on, after the 31-declaration fix was described", + "source_changes_ref": "docs/evidence/2026-09-28-eso-metadata-publication.json", + "verification_ref": "docs/evidence/2026-09-28-secret-annotation-enforced.json", + "integration_ref": "docs/evidence/2026-09-28-eso-refresh-after-binding.json", + "outcome": "39/39 fresh successful refreshes under Deny; nine native admission checks pass", + "refinement_or_rescue": true, + "new_scored_trial": false + } + }, + { + "proposal_id": "STATE-WP-0094-T05-receiving-rollout-2026-10-04", + "disposition": "unscored", + "outcome": "succeeded", + "reason": "Founder explicitly authorized rollout before exact-revision proposal capture. Retain actual execution evidence without backfilling unchanged acceptance.", + "proposal_ref": "docs/changes/state-hub-qualifier-rollout-2026-10-04.json", + "original_revision": 1, + "original_digest_sha256": "32834917c4c6f80277abcf543a278f0b9eaa52ebdf28cd05a0e66f2047d3053a", + "approved_revision": null, + "authorization_ref": "User instruction: Do the rollout", + "executed_revision": 1, + "refinement_or_rescue": false, + "executed_digest_sha256": "32834917c4c6f80277abcf543a278f0b9eaa52ebdf28cd05a0e66f2047d3053a", + "execution_started_at": "2026-10-04T00:45:00Z", + "verification_ref": "state-hub/docs/evidence/2026-10-04-receiving-rollout.json", + "execution_ref": "railiance01 Helm state-hub revision 71; image main-3791e60", + "verified_outcome": "API/MCP Ready; schema/current receiving digest verified; fresh state-hub and ops-warden Forge derivation applied then independently noop", + "failed_checks": [ + "Custodian full reconciliation rolled back: historical ADHOC tasks_pkey UUID collision d8af3e6b-26ae-580c-bbeb-caa8ad419bec" + ], + "recovery": "No rollout rollback required; failed Custodian transaction rolled back", + "promotion_evidence": false, + "closing_verification_ref": "docs/evidence/2026-10-04-state-hub-rollout-close.json" + }, + { + "proposal_id": "STATE-WP-0095-T03-historical-receiving", + "disposition": "accepted_unchanged", + "outcome": "succeeded", + "proposal_ref": "docs/changes/state-hub-historical-receiving-2026-10-04.json", + "original_revision": 1, + "original_digest_sha256": "d6789359b3fe7988a6201fff6f367cb46948aa197e1cc0ca66c31f45e1ea9981", + "refinement_or_rescue": false, + "approval_ref": "Founder reply: Approve rollout and registrar verification; request_user_input_async call_o87uEfFs3AtXfxO5YqUnSpcg item0", + "approved_revision": 1, + "approved_digest_sha256": "d6789359b3fe7988a6201fff6f367cb46948aa197e1cc0ca66c31f45e1ea9981", + "approved_at": "2026-10-04T09:21:00.486372+00:00", + "executed_revision": 1, + "executed_digest_sha256": "d6789359b3fe7988a6201fff6f367cb46948aa197e1cc0ca66c31f45e1ea9981", + "execution_started_at": "2026-10-04T09:21:05.271010+00:00", + "original_digest": "d6789359b3fe7988a6201fff6f367cb46948aa197e1cc0ca66c31f45e1ea9981", + "approved_digest": "d6789359b3fe7988a6201fff6f367cb46948aa197e1cc0ca66c31f45e1ea9981", + "executed_digest": "d6789359b3fe7988a6201fff6f367cb46948aa197e1cc0ca66c31f45e1ea9981", + "verification_ref": "docs/evidence/2026-10-04-dependency-root-wave/verified-deployment.json", + "execution_ref": "railiance01 Helm state-hub revision72 image main-5dd3df9; exact approved revision1", + "verified_outcome": "Exact approved revision1 deployed main-5dd3df9 Helm72. API/MCP Ready, schema/source match, five frozen parents/65tasks entire rows unchanged; global retired-holder collision refused in rolled-back native transaction. Gated registrar actual38 tests passed; normal Repo Manager/Custodian receiving applied. Activity correctly refused three unrelated retirements, as expected scope requires; no acknowledgement issued.", + "registrar_verification_ref": "docs/evidence/2026-10-04-dependency-root-wave/normal-owner-sync.json", + "recovery": "No rollout rollback or rescue required; unrelated Activity receiving refused before changes. Initial supervision receipt used digest_sha256 keys; added exact matching canonical aliases for the descriptive utility without changing authority or evidence." + }, + { + "proposal_id": "INFD-WP-0009-T02/config-repin-v1", + "disposition": "accepted_unchanged", + "outcome": "succeeded", + "proposal_ref": "docs/evidence/2026-10-10-security-consolidation/infd-pin-repair-preflight.json", + "original_revision": "7db8485ffecdebfabd77a9daec085553c74bf0bf", + "original_digest_sha256": "1dcc1f01d7b6469aee7a6504d38b81cd6ef8a5c5358493ad17d8825c3aec16e7", + "approved_revision": "7db8485ffecdebfabd77a9daec085553c74bf0bf", + "approval_ref": "Founder: Approve the scoped repair; call_57c1f1615d7d459bbe3bd0f125a50bee", + "executed_revision": "7db8485ffecdebfabd77a9daec085553c74bf0bf", + "verified_outcome": "Only immutable ConfigMap/Deployment synced; Healthy, Ready1, unchanged image, readyz200, v2 pin and native registration/publication succeeded.", + "execution_adaptation": "argocd CLI absent; same approved two-resource manual sync through Application operation API with atomic baseline checks and prune false.", + "refinement_or_rescue": false, + "promotion_evidence": false, + "original_digest": "1dcc1f01d7b6469aee7a6504d38b81cd6ef8a5c5358493ad17d8825c3aec16e7", + "approved_digest": "1dcc1f01d7b6469aee7a6504d38b81cd6ef8a5c5358493ad17d8825c3aec16e7", + "executed_digest": "1dcc1f01d7b6469aee7a6504d38b81cd6ef8a5c5358493ad17d8825c3aec16e7", + "approved_digest_sha256": "1dcc1f01d7b6469aee7a6504d38b81cd6ef8a5c5358493ad17d8825c3aec16e7", + "executed_digest_sha256": "1dcc1f01d7b6469aee7a6504d38b81cd6ef8a5c5358493ad17d8825c3aec16e7", + "verification_ref": "docs/evidence/2026-10-10-security-consolidation/infd-pin-repair-preflight.json; informed-decision/docs/evidence/2026-10-10-lifecycle-consumer-pin-repair.md", + "reporting_correction": "Canonical digest aliases and verification reference copied from existing exact approved revision evidence; no new approval or authority inferred." + }, + { + "proposal_id": "CUST-SECURITY-DECISION-POSING-2026-10-10-R1", + "disposition": "unscored", + "outcome": "succeeded", + "proposal_ref": "docs/evidence/2026-10-10-security-consolidation/decision-posing-proposal.json", + "reason": "Existing founder instruction authorizes informed decisions; no backfilled exact-revision acceptance. Retain initial503 policy pin failure and subsequent review400 packet validation failure.", + "refinement_or_rescue": true, + "promotion_evidence": false, + "verified_outcome": "Both native intake records delivered; revision-specific human ACCEPT dispositions confirmed, submission_state confirmed and stale=false for each. Initial503 and packet400 failures retained in same unscored trial.", + "verification_ref": "docs/evidence/2026-10-10-security-consolidation/decision-submission-receipts.json", + "human_disposition_verification_ref": "docs/evidence/2026-10-10-security-consolidation/human-acceptance-receipts.json" + }, + { + "proposal_id": "RAPP-USER-ENGINE-READBACK-2026-10-11-R2", + "disposition": "accepted_unchanged", + "outcome": "succeeded", + "proposal_ref": "rapp-user-engine/docs/evidence/2026-10-11-published-readback-proposal/decision-packet.md", + "original_revision": "R2-amended-b4d45051", + "original_digest": "76814d47e33d652c39c78b11ee5a0498c3f10ff89a41c4219048d7d0eab0f5f2", + "target": "realm:kubernetes/railiance01/user-engine", + "expected_result": "Exact User Engine image and advisory readback integration Ready; native catalogue acceptance remains separately verified; conditional44HIGHrisk trial only.", + "verification_ref": "rapp-user-engine/docs/evidence/2026-10-11-native-readback/receipt.json; docs/evidence/2026-10-10-security-consolidation/user-readback-enforcement-check.json", + "rollback_ref": "rapp-user-engine/docs/evidence/2026-10-11-published-readback-proposal/rollback.yaml", + "cost_estimate_eur": 0, + "risk_estimate": "BriefRecreate interruption/pullfailure;44unfixedHIGH occurrences/8CVEs. Incidentlossunpriced; noautopilotgrant. Exacthumanconditionalriskdisposition required.", + "internal_pre_submission_refinements": "Original22file3faf packet retained; independentreview requiredsameSAaudiencedisclosure andstrictpreflight. Both refinedbeforefirsthuman submission; notapprovedorreclassified success.", + "memo_id": "infd-20261011-user-engine-readback-r2", + "memo_version": 1, + "promotion_evidence": false, + "approved_revision": "R2-amended-b4d45051", + "approved_digest": "76814d47e33d652c39c78b11ee5a0498c3f10ff89a41c4219048d7d0eab0f5f2", + "approval_ref": "informed-decision:infd-20261011-user-engine-readback-r2@1; approval:0dd18a5a-5555-461e-8470-931d530435cf", + "approved_at": "2026-10-11T00:48:11+00:00", + "human_disposition_id": "disp-9ab2caba-6d3d-4fac-bc64-618f9c82aa9a", + "executed_revision": "R2-amended-b4d45051", + "executed_digest": "76814d47e33d652c39c78b11ee5a0498c3f10ff89a41c4219048d7d0eab0f5f2", + "executed_candidate_sha256": "3c0700c9d6505bf3c48b3e01e3b3537855cf0dd09486d4deb4812443d6509d99", + "execution_started_at": "2026-10-11T00:52:05.905810+00:00", + "execution_ref": "docs/evidence/2026-10-10-security-consolidation/user-readback-approved-execution.json", + "verified_outcome": "Exact approved two-object rollout Ready1 gen73/observed73, readyz200; actual admitted readback registry/allow-deny/TTL/unavailable checks passed. Existing enforcement health200/unknown-action200deny; oldnativepurpose200deny is preexisting protocolgap, no allow claimed. Canonical full28objectrender changes exactly2objects. Native catalogue empty: USER26/28 consumer acceptance stillopen, no realhumanlogin/MFA or token-isolation proof. Scope execution succeeded; overall consolidation remains active.", + "refinement_or_rescue": false + }, + { + "proposal_id": "POLICY-PUB-20261011-SECURITY-LAYER-V08-R1", + "disposition": "accepted_unchanged", + "outcome": "succeeded", + "proposal_ref": "rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/decision-packet.md", + "original_revision": "R1-refined-a70fb22f", + "original_digest": "076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e", + "packet_manifest_sha256": "a70fb22f75871a08358f1cdee2410797cb0a2f01c2001f0012d16866b20e28a8", + "target": "realm:kubernetes/railiance01/policy-nexus", + "expected_result": "Ready1 exact published Policy Nexus image and paired provenance; accepted v0.8 served,73 current documents and72 existing immutable paths independently match.", + "verification_ref": "rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-native-hosting", + "rollback_ref": "rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/rollback-binding.json; Helm revision8", + "cost_estimate_eur": 0, + "risk_estimate": "Stateless public availability/pull/scheduling/runtime incompatibility. Rollback restores72 existing paths but temporarily removes newly introduced v0.8/current revision URLs. Loss bound unpriced, supervised exact human approval required.", + "execution_deadline": "2026-10-12T23:59:59Z", + "memo_id": "infd-20261011-policy-nexus-hosting-r1", + "memo_version": 1, + "internal_pre_submission_refinements": "Original27pathd402 packet retained; independent owner review required UID/full defaulted configuration and ServiceAccount reference drift refusal, HTTPS origin/redirect refusal and bounded reads. Refined30patha70 packet prepared before first human submission; one trial, no earlier approval or success.", + "promotion_evidence": false, + "approved_revision": "R1-refined-a70fb22f", + "approved_digest": "076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e", + "approval_ref": "informed-decision:infd-20261011-policy-nexus-hosting-r1@1; approval:52a3c479-2cb1-4074-abec-6a88117ad596", + "approved_at": "2026-10-11T01:14:23+00:00", + "human_disposition_id": "disp-b8bfa6c0-e879-4de2-8243-f4abb9bcd011", + "pre_actuation_attempts": [ + { + "at": "2026-10-11T01:19:18Z", + "actuator_sha256": "41837e66e8d775f0ecfab42e2d3d3f5063489a3d2f14ae8e86f595ade25e5643", + "result": "failed render comparison before Helm upgrade; node,capacity,sealed baseline and server dryrun/diff passed", + "attempted_helm_upgrade": false, + "receipt_ref": "docs/evidence/2026-10-10-security-consolidation/policy-hosting-pre-actuation-failed.json" + }, + { + "result": "local premature read of pending outcome writer failed JSON parsing before any remote execution", + "attempted_helm_upgrade": false, + "effect": "none", + "refinement": "wait for receipt-producing command completion before dependent actuator" + } + ], + "operational_actuator_refinement": "Readonly diagnosis proved existing Helm chart omits metadata.namespace; fixed command namespace policy-nexus supplies it. Refined comparison adds only missing namespace, refuses explicit wrong namespace, preserving full9object exact comparison. Approved packet/source/image/effect scope unchanged. Initialfailed pre-actuation preserved.", + "refinement_or_rescue": true, + "executed_revision": "R1-refined-a70fb22f", + "executed_digest": "076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e", + "executed_actuator_sha256": "e23fb931f253c8df79fffb922f23a1f476c2167014b06e245a22148fce25dccf", + "execution_started_at": "2026-10-11T01:23:27.564865+00:00", + "execution_completed_at": "2026-10-11T01:23:42.112194+00:00", + "execution_ref": "docs/evidence/2026-10-10-security-consolidation/policy-hosting-approved-execution.json", + "verified_outcome": "Helm9 deployed/Ready1 generation9 observed9; exact approved image/paired provenance/all9 UID-defaulted configurations pass.158publicHTTPS byte checks match73currentdocuments+72oldimmutablepaths; CertificateReady,health/index200/legacy308/404. NoArgo adoption/data/credential writes; sourcebindingreconciled. Initialpre-actuation namespace comparison failure retained and refined; no rollback used, no unchanged-success promotion credit. Wholeconsolidation remains active." + }, + { + "proposal_id": "USER-CATALOGUE-INFDEC-20261011-R1", + "disposition": "accepted_unchanged", + "outcome": "succeeded", + "proposal_ref": "user-engine/docs/evidence/2026-10-11-one-app-catalogue-human-packet/decision-packet.md", + "original_revision": "human-packet-1-after-independent-owner-reviews", + "original_digest": "026b7daa970920f468bb1cfd9e2df1eaaa99d1d5ce1945ea5db0bb33ee9e6f82", + "packet_manifest_sha256": "307c4fc5c3c352a99a1b04c1ea886faf84f2aa3b679694aa6a1d828a44501f7c", + "source_revision": "5d80644", + "target": "railiance01/user-engine exact informed-decision Application and binding through admitted f239 workload", + "expected_result": "Exact two catalogue facts, genuine ordinary denial retained, truthful maintenance audit/event and one-use consumed ledger; native three-owner readback verified without fabricated human claims.", + "verification_ref": "docs/evidence/2026-10-10-security-consolidation/user-catalogue-independent-postapply-verification.json", + "rollback_ref": "same packet; original consumed grant before expiry, unchanged created rows/no dependencies, unsent-unclaimed event only; preserve audit/outbox and forbid targeted replay", + "cost_estimate_eur": 0.1, + "risk_estimate_eur": 100, + "risk_estimate": "Build-mode two metadata facts; one owner-hour straightforward repair assumption, uncontrolled downstream effects require stop/new disposition. No IAM/runtime changes; direct supervisor external authority verification required.", + "execution_deadline": "2026-10-12T23:59:59Z", + "memo_id": "infd-20261011-user-catalogue-bootstrap-r1", + "memo_version": 1, + "executor_sha256": "b0dbbb9786e927055030acf849a72e9a44e9d3d55c84efdf245e419d381684f3", + "transport_sha256": "3e594e0e8561100ae1eeb34d7208cd5b5e387ae56c29689f155aed94219770f3", + "promotion_evidence": false, + "native_execution": false, + "approved_revision": "human-packet-1-after-independent-owner-reviews", + "approved_digest": "026b7daa970920f468bb1cfd9e2df1eaaa99d1d5ce1945ea5db0bb33ee9e6f82", + "approval_ref": "informed-decision:infd-20261011-user-catalogue-bootstrap-r1@1;approval:b859698b-5d08-4da5-9599-4760c6a799f1", + "approved_at": "2026-10-11T02:07:09+00:00", + "human_disposition_id": "disp-7683bfbb-3743-4c9f-8ae3-962b6514c92e", + "executed_revision": "human-packet-1-after-independent-owner-reviews", + "executed_digest": "026b7daa970920f468bb1cfd9e2df1eaaa99d1d5ce1945ea5db0bb33ee9e6f82", + "executed_executor_sha256": "b0dbbb9786e927055030acf849a72e9a44e9d3d55c84efdf245e419d381684f3", + "executed_transport_sha256": "3e594e0e8561100ae1eeb34d7208cd5b5e387ae56c29689f155aed94219770f3", + "execution_ref": "docs/evidence/2026-10-10-security-consolidation/user-catalogue-approved-apply.json", + "verified_outcome": "Exact2cataloguefacts/1consumedledger/3truthfulaudits/1unsentunclaimedevent; ordinaryidentifieddenialretained, noPDPallowclaim; native3waycatalogue1 andSERVICEaccountrowdenied. Nativefixturechecksnotrealhumanlogin/MFA/grantrevocation; broaderUsertasksremainopen. No rollback/replay/delivery used.", + "refinement_or_rescue": false + }, + { + "proposal_id": "INFD-WP-0009-T04/purpose-overlay-v1", + "trial_id": "infd-purpose-20261011-r1", + "disposition": "accepted_unchanged", + "outcome": "failed", + "proposal_ref": "informed-decision/docs/evidence/2026-10-11-purpose-image-release/decision-packet.md", + "original_revision": "combined-ffa2679a", + "original_digest": "fd78d486174670e12efb2f812bac02e68f294e7791b9302d0d458c053240f5a9", + "packet_manifest_sha256": "ffa2679a94a24e69a75d1248a808825498a80e711ceda98f3639a4143c40ec1b", + "memo_sha256": "506d3956beb7c62ab2bbdfda783c05905d183452a1f67a1817f3fb8c2e522937", + "source_revision": "bc6494cd1b290783ef3aef0763bf28d1deabf4b0", + "approved_source_blob_sha256": { + "deploy/lifecycle/admission.candidate.json": "92382a56b349c3b895e5806e975082527bb99d1a001140e69d857e5b0391fa55", + "deploy/lifecycle/service.candidate.json": "38b78b9cbee5ade7750a58d5156ca4c5773352e947acb304ee714b59e749ceb4", + "deploy/lifecycle/kustomization.yaml": "1bbce81bc6758434354157f8601534320c5d0290587908fd15a6d25e3fa57f47", + "deploy/lifecycle/registries.candidate.json": "9bad6db5fbc2178d31b04120016a41830c3552fbb9e2517b718f9bbe87cf649e" + }, + "target": "realm:kubernetes/railiance01/informed-decision", + "expected_result": "Protected native schema5 backup/off-cluster drill independently matches snapshot integrity/counts; exact image763c Deployment-only manual Argo release Ready1; installed purpose refusal and separate actual-provider acceptance evidence, retained current database.", + "verification_ref": "docs/evidence/2026-10-10-security-consolidation/infd-purpose-approved-drill-copy-failure.json; docs/evidence/2026-10-10-security-consolidation/infd-independent-readonly-verification-receipt.json", + "rollback_ref": "same packet: failedcandidate-independent Deployment-only7db/7f5 source/image recovery plus separateReady/schema5/currentDB verification; no old snapshot overwrite", + "cost_estimate_eur": 0, + "risk_estimate": "Brief Recreate disruption, protected evidence snapshot custody/restore and operator recovery time unpriced; inherited1fixableMEDIUM remains INFD9T05. Allphases including recovery begin beforeOct12deadline; freshdecision if windowexhausted. No autopilot cost/risk grant.", + "execution_deadline": "2026-10-12T23:59:59Z", + "memo_id": "infd-20261011-purpose-overlay-r1", + "memo_version": 1, + "execution_bundle_sha256": "27d6d6d3133c963da1dde92d498d636617387c16e850a17c598148abc35c775d", + "execution_plan_sha256": "f5e5fa906ff19d3a45d10dcdb2810373ae21f9cf44c0472ff2bd47d3bc3328d6", + "internal_pre_submission_refinements": "Initial36manifest7c6738b3 and amended78b1e3 preserved; Platform found old-schema migration/optimizedassertion/dependencyseal/livecount gaps. Initial11helper653b68c3 preserved; independent rollbackReadyfailure/postadminintegrity/deadline findings corrected23f2fad with16synthetic+5recovery negatives. Final112/20document packet distinctProduct/PlatformACK; no previous human approval or native action.", + "promotion_evidence": false, + "native_execution": true, + "approved_revision": "combined-ffa2679a", + "approved_digest": "fd78d486174670e12efb2f812bac02e68f294e7791b9302d0d458c053240f5a9", + "approved_source_revision": "bc6494cd1b290783ef3aef0763bf28d1deabf4b0", + "approved_at": "2026-10-11T02:34:20+00:00", + "approval_ref": "informed-decision:infd-20261011-purpose-overlay-r1@1;approval:ec92806a-9aa6-494f-a76b-0385f39ba609", + "human_disposition_id": "disp-0968373d-294d-42bf-8979-36a7c5dd38cf", + "pre_actuation_attempts": [ + { + "result": "pre-phase refusal: Git custody ignore rule absent", + "native_phase_started": false, + "native_backup_or_image_change": false, + "journal_or_case_custody_created": false, + "source_hashes_and_fresh_authority_relation": "independently passed", + "recovery": "Add scoped Custodian .gitignore exclusion for exact approved private custody parent; unchanged approved helper/source/effect scope" + } + ], + "refinement_or_rescue": true, + "execution_results": { + "source_revision": "bc6494cd1b290783ef3aef0763bf28d1deabf4b0", + "drill_backup": "verified complete", + "drill_copy": "UNCERTAIN; stopped before local snapshot destination creation", + "offline_restore": "not executed", + "image_rollout": "not executed", + "database_preserved": true, + "failure_ref": "docs/evidence/2026-10-10-security-consolidation/infd-purpose-approved-drill-copy-failure.json", + "diagnosis_ref": "docs/evidence/2026-10-10-security-consolidation/infd-purpose-drill-copy-diagnosis.json", + "backup_ref": "docs/evidence/2026-10-10-security-consolidation/infd-purpose-approved-drill-backup.json", + "original_journal_retained": true, + "retry_executed": false + }, + "revisions": [ + { + "revision": "rescue-r2-d05d6e3b", + "status": "actual_target_verified_with_refinement", + "manifest_sha256": "d05d6e3b15df9acf1d7aef0ba2ec82a5a00d979ab1f324e981025cffe2cc753d", + "memo_version": 2, + "memo_sha256": "391330d062ede170a546415886d18b4895ba24d313a0dd50dcc1591c1aa3c2fa", + "revision_request_sha256": "feb946218e9611e1b686c1672fd9142896c55fd88aa2e59fabc6cfadbe22e327", + "revision_command_digest": "ccbeca292dd4ffcd0ed8a4669c82a93f9b773a30186966d3f146d5db8e5e6b8a", + "source_revision": "c96b0c6d881e855d1d158003c6de90ef390262e2", + "execution_bundle_sha256": "49c9cb70f36f6ceb7b0d22400b2ec9232a5e1a8a00d17e92b92fe367c98effb5", + "execution_plan_sha256": "9ce5728a561e6d38f8497201baa2b840d11444a0af8ad6234dfc37428113f258", + "delta": "Explicitly close WAL-aware readers; frozen zero-WAL hash-bound snapshot inspection uses immutable mode; distinct drill-copy-rescue-r1 and new linked journal preserve original uncertain attempt and SHM. Conditional remaining same-image phases only after new approval. Historical helper manifest label corrected.", + "verification": "26 synthetic executor/reader tests plus independent scope, custody and replay counterexamples; actual live drill/rollout remains pending.", + "rollback": "Deployment-only previous image/source recovery preserves latest database; old uncertain journal never rewritten.", + "cost_estimate": "EUR0 recurring infrastructure; existing temporary private-copy storage and attended time unpriced.", + "risk_estimate": "Existing approved snapshot contains private live data; metadata-only logging/private custody, no native sidecar deletion, no rollback over current database. Scoped Recreate restart and reversible Deployment-only image change conditional on actual compatibility drill.", + "approval_id": "7a34e7cc-5bad-40ea-a2f5-d6d269dc56f1", + "disposition_id": "disp-c6529331-e9d7-4466-9528-2e839739e751", + "approved_at": "2026-10-11T06:53:43Z", + "approved_source_revision": "c96b0c6d881e855d1d158003c6de90ef390262e2", + "approval_version": 2, + "review_version": 1, + "review_memo_id": "review-cda20761-f6ff-4d02-9c34-5097fc27539f", + "pre_actuation_attempts": [ + { + "outcome": "refused_before_phase", + "reason": "Root invocation supplied alternate receipt filenames instead of approved fixed interface", + "rescue_journal_created": false, + "native_operation_executed": false, + "correction": "Invoke unchanged approved helper using its original fixed receipt paths; fresh native source2 authority refresh" + } + ], + "native_execution": true, + "original_verify_phase_state": "UNCERTAIN", + "original_failed_copy_state": "UNCERTAIN", + "phase_replay_executed": false, + "independent_verification_ref": "docs/evidence/2026-10-10-security-consolidation/infd-independent-readonly-verification-receipt.json", + "actual_source_revision": "c96b0c6d881e855d1d158003c6de90ef390262e2", + "actual_image": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "actual_pod_uid": "c4cb1550-feda-4097-9de4-d891a657b662", + "ready_replicas": 1, + "rollback_executed": false, + "actual_native_provider_allow": true, + "synthetic_installed_refusal_variants": 8, + "medium_finding_due": "2026-10-18T23:59:59Z", + "product_acceptance_commit": "0693c40", + "platform_actual_acceptance_commit": "d47cbd0", + "task_closed": "INFD-WP-0009-T04", + "workplan_status": "active", + "risk_task": "INFD-WP-0009-T05", + "live_unpromoted_verifier_residual": "INFD-IN-0010" + } + ], + "current_revision_status": "owner_scoped_task_acceptance_recorded", + "outcome_detail": "verified_with_rescue_and_independent_readonly_reconciliation", + "executed_digest": "fd78d486174670e12efb2f812bac02e68f294e7791b9302d0d458c053240f5a9", + "scoring_semantics": "Original approved trial failed during copy; separately approved same-trial recovery target independently verified. Original failed/uncertain outcomes remain; no unchanged execution success scored." + }, + { + "proposal_id": "NK-FORGEJO-TYPE12-SOURCE-20261011-R1", + "trial_id": "forgejo-type12-source-20261011-r1", + "disposition": "accepted_unchanged", + "outcome": "not_executed", + "proposal_ref": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/proposal.json", + "original_revision": "final34-0b377d647ca748cd03c92f9792396412048055d4bde9f7bb06ff6d413f7acd68", + "original_digest": "585cee731de30d2b37883a57abfd9eb32f023ee694e8d911989109d5caf80569", + "packet_manifest_sha256": "0b377d647ca748cd03c92f9792396412048055d4bde9f7bb06ff6d413f7acd68", + "memo_id": "infd-20261011-forgejo-type12-source-r1", + "memo_version": 1, + "target": "NetKingdom proposed oidc-browser-relying-party type1.2 and separate Forgejo reference-migration design receipt", + "expected_result": "Source-only human acknowledgment of complete reviewed type package; canonical case remains proposed, type unimplemented, execution forbidden. No native credential or rollout action.", + "verification_ref": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/recording-gates.md", + "rollback_ref": "Immutable previous type/case1.1 retained; proposed1.2 not admitted for execution.", + "cost_estimate_eur": 0.1, + "risk_estimate": "Source-only decision. No credential exposure or live runtime change authorized.", + "promotion_evidence": false, + "native_execution": false, + "approved_digest": "585cee731de30d2b37883a57abfd9eb32f023ee694e8d911989109d5caf80569", + "approved_revision": "final34-0b377d647ca748cd03c92f9792396412048055d4bde9f7bb06ff6d413f7acd68", + "approved_at": "2026-10-11T06:47:39Z", + "approval_ref": "8e9332c8-754a-420c-b8b7-445cb4fe6765", + "human_disposition_id": "disp-315d54ad-20f1-40e6-862c-6c7d2e8f0ea8", + "approved_source_revision": "584a964684a28e759edc19862a91938bda161cb3", + "source_recording_commit": "f6856cd", + "application_design_receipt_commit": "d349815", + "followthrough_version_selection_commit": "bb9b9b5", + "source_recording_outcome": "verified_source_acknowledgment_recorded", + "scoring_semantics": "Source-only acknowledgment independently recorded; no privileged native execution authorized or performed. Source acknowledgment is retained separately from the supervision native-execution outcome axis." + }, + { + "proposal_id": "INFD-WP-0009-T05/zlib85091-r1", + "trial_id": "infd-zlib-20261011-r1", + "disposition": "accepted_unchanged", + "outcome": "succeeded", + "original_revision": "312ab97e876e17341bf16f9e95397e14c2ac2720", + "original_digest": "5dea0d404e4d13683fbf71d56273c06db7a6a916ab68759a90d7394005eee206", + "commands_sha256": "4cf81acb7d42f52d81f8ba624a6b2349a0b8948477a14c09bd069d2a4acab7cf", + "packet_manifest_sha256": "acb1262b56f10d117c702e62908db008c323a0acb5df4ed108d7868aa371bce9", + "proposal_ref": "/home/worsch/informed-decision/docs/evidence/2026-10-11-zlib-image-release/proposal.json", + "memo_id": "infd-20261011-zlib-remediation-r1", + "memo_version": 1, + "target": "realm:kubernetes/railiance01/informed-decision", + "authority_mode": "ADMINISTER", + "expected_result": "New guarded protected same-schema drill and one-Deployment zlib-only release to exact published f558; installed r1, fresh full zero scan, Ready and canonical authenticated provider proof. Human acceptance required first.", + "verification_ref": "/home/worsch/the-custodian/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/canonical-provider-verification.json", + "rollback_ref": "/home/worsch/informed-decision/docs/evidence/2026-10-11-zlib-image-release/rollback-deployment.json", + "rollback": "Exact image763/sourcec96; preserve latest database. Proposed manual outage recovery limited to same trial,30 minutes and deadline; later revocation uncertainty requires express new human consent.", + "cost_estimate_eur": 0, + "risk_estimate": "Private same-schema backup copies and brief Recreate availability gap. Failed or ambiguous phases retained; no replay. Rollback changes Deployment image/source only, retains latest database.", + "risk_limits": { + "execute_by": "2026-10-12T23:59:59Z", + "release_must_start_by": "2026-10-12T23:29:59Z", + "max_snapshot_bytes": 536870912, + "maximum_new_snapshot_payload_bytes_each_site": 1073741824, + "local_extra_disposable_clone_max_bytes": 536870912, + "private_metadata_and_sqlite_sidecars_additional_headroom_bytes": 16777216 + }, + "owner_acknowledgments": { + "Product": { + "work_item": "INFD-WP-ADHOC-2026-10-11-T09", + "status": "done", + "review_sha256": "fe7b2153e525a23980aee63e62efcd7fd3dad18145633f8f57d8d2b4640c99d4", + "binding_sha256": "d06beb1da58cced482dc6cb246ce47a6977bcf2d18109c55707d62d403b86640" + }, + "Platform": { + "work_item": "RPF-IN-0009", + "status": "done", + "review_sha256": "30c200b98f8692a8456e786d0c7a3acb5ff3634973911b088f56aa178d393fee", + "binding_sha256": "e3e1d8399e45bda48c8b9b29076e76a4be3df3b880c491ce1f103404538130bf" + } + }, + "executor_plan_sha256": "d871081999215bd3850ab1173064ed6cb6d7c23b26d9c3d5b3c5940e698d4c61", + "execution_bundle_sha256": "2ad65818444a72df7e6543575ba04a998e92b42d557409726a54fba116b5249d", + "preparation_history_ref": "/home/worsch/informed-decision/docs/evidence/2026-10-11-zlib-image-release/preparation-failure-history.json", + "history_limit": "Original67 full snapshot unavailable; retained digest and observations are not reconstructed full bytes. Earlier changes-requested reviews and failed T04 evidence preserved.", + "promotion_evidence": false, + "native_execution": true, + "bounded_outage_exception": "approved_scoped_manual_same_trial_only", + "checklist_item": 19, + "checklist_display_label": "INFD-WP-0009-T05/zlib-85091-r1", + "scoring_semantics": "New distinct T05 trial; preparation refinements are not executed trials or scored successes. No old T04 approval inherited.", + "review_memo_id": "review-2cf690a6-8c46-4faa-826c-a24a88d53dea", + "native_authoring_receipt_ref": "/home/worsch/the-custodian/docs/evidence/2026-10-10-security-consolidation/zlib-native-authoring-receipt.json", + "review_ready_at": "2026-10-11T10:40:24.369238+00:00", + "user_review_preference": "Review in informed-decision; not founder acceptance", + "approved_digest": "5dea0d404e4d13683fbf71d56273c06db7a6a916ab68759a90d7394005eee206", + "approved_revision": "312ab97e876e17341bf16f9e95397e14c2ac2720", + "approved_at": "2026-10-11T10:40:55Z", + "approval_ref": "b5ce337c-5d7d-44fa-864d-706b54039f7c", + "human_disposition_id": "disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f", + "approved_source_revision": "312ab97e876e17341bf16f9e95397e14c2ac2720", + "executed_digest": "5dea0d404e4d13683fbf71d56273c06db7a6a916ab68759a90d7394005eee206", + "executed_revision": "312ab97e876e17341bf16f9e95397e14c2ac2720", + "executed_source_revision": "312ab97e876e17341bf16f9e95397e14c2ac2720", + "refinement_or_rescue": true, + "preexecution_refinement": "Root receipt incorrectly reused native clock1.1806s ahead; three invocations refused before custody/journal. Root-only local verified_at correction; approved actuator/render/plan unchanged; failed prephase receipts retained.", + "completed_phases": [ + "drill-backup", + "drill-copy", + "offline-verify", + "cleanup-offline", + "cutover-backup", + "cutover-copy", + "release", + "verify" + ], + "verified_at": "2026-10-11T11:20:27.541827+00:00", + "outage_recovery_used": false, + "latest_database_preserved": true, + "scan_completed_at": "2026-10-11T10:48:46.790940Z", + "installed_zlib": "1.3.2-r1", + "allseverity_findings": 0, + "owner_postacceptance": "verified and recorded separately: Product T10 and Platform RPF-IN-0010", + "product_closure_commit": "47881fc1ff262bb705e75e4b59b8ef4731780d87", + "platform_acceptance_commit": "8647587ca292b67857c79f4561d3264e7f8132ef", + "actual_hub_decision_id": "2b81326f-4c09-5c66-88d1-84af4e5895fd", + "residuals_retained": [ + "INFD-IN-0010", + "INFD-IN-0009" + ] + }, + { + "proposal_id": "RPF-WP-0044-T04/public-transport-v1", + "disposition": "unscored", + "outcome": "succeeded", + "original_revision": 1, + "original_digest_sha256": "2e3094f4970f600b13b145386eab323f41e344e379a9e8b83282178e387a5920", + "proposal_ref": "railiance-platform/docs/evidence/2026-10-11-issue-core-transport/transport-plan.json", + "authorization_ref": "D2 89f1058f-33bc-47a8-8a49-0b44d426c67e; accepted build-mode blue-lane canon", + "target": "railiance01 argocd public host ConfigMap and railiance-tenants AppProject", + "expected_result": "Preserve prior public host pins and repository admissions, append only provider-verified Forgejo SSH key and exact private wrapper URL", + "verification_ref": "docs/evidence/2026-10-11-issue-core-public-transport/verification.json", + "rollback": "UID/preimage-tested inverse fields via same bounded helper; restore owner source", + "abort_owner": "railiance-platform with railiance-enablement", + "cost_estimate_eur": 0, + "risk_estimate": "Public transport admission only; no Secret, credential, network permission or workload change. Partial failures retained; no implicit replay.", + "promotion_evidence": false, + "reason": "Standing founder authorization; no backfilled exact-revision scoring or autopilot authority.", + "executed_revision": 1, + "executed_digest_sha256": "2e3094f4970f600b13b145386eab323f41e344e379a9e8b83282178e387a5920", + "executed_source_revision": "railiance-platform@1dc1d2f3a11ed74be4a4701167ee60782d616544; railiance-enablement@51a7c4cee68b48ed7a236e661b39c1d3cca92063", + "execution_ref": "docs/evidence/2026-10-11-issue-core-public-transport/execution.json", + "verified_outcome": "Both exact public fields changed and independently read back; no credential/Secret/network/workload changes. Issuance and adoption remain unexecuted.", + "refinement_or_rescue": false + }, + { + "proposal_id": "KEY-WP-0040-recovery-code-20261012-r1", + "disposition": "unscored", + "outcome": "succeeded", + "original_revision": 1, + "original_digest_sha256": "a89c59c713893cc4d779646f6a09a91d08396013a562ccf7df12e54d686db955", + "proposal_ref": "docs/evidence/2026-10-12-netkingdom-security/recovery-rollout-proposal.json", + "authorization_ref": "canon/standards/build-mode-change-authorization_v0.1.md; KEY-WP-0040 explicit blue-lane repair", + "target": "railiance01 mfa/privacyidea factor-recovery-code volume", + "expected_result": "Ready privacyIDEA deployment running DN-compatible recovery validation and value-free diagnostics", + "verification_ref": "docs/evidence/2026-10-12-netkingdom-security/recovery-rollout-receipt.json", + "rollback": "rollout_recovery.py rollback with the same payload and digest, CAS restores factor-recovery-79e2964c112f3688; retain both immutable ConfigMaps", + "abort_owner": "key-cape; executing custodian-codex", + "cost_estimate_eur": 0, + "risk_estimate": "Existing Recreate strategy causes a brief MFA-provider interruption; no account or factor change. Rollback restores prior immutable source. No new spend or authority scope.", + "promotion_evidence": false, + "reason": "Existing standing founder authorization, not an exact-revision approval or promotion grant.", + "executed_revision": 1, + "executed_digest_sha256": "a89c59c713893cc4d779646f6a09a91d08396013a562ccf7df12e54d686db955", + "verified_at": "2026-10-11T23:23:28.882335+00:00", + "verified_outcome": "Exact source ConfigMap, generation 11 ready; health 200 and unauthenticated 403. Attended positive preview remains open.", + "refinement_or_rescue": false + }, + { + "proposal_id": "FORGE6-NATIVE-PROBE-001", + "disposition": "unscored", + "outcome": "succeeded", + "original_revision": 1, + "original_digest_sha256": "b6fe6f55354f7f09837b94f4d75e79f39ac0a4b868f7ac377e2ca6590e340b42", + "proposal_ref": "docs/changes/CUST-WP-0080/receive-native-proposal.json", + "authorization_ref": "canon/standards/build-mode-change-authorization_v0.1.md", + "target": "railiance01 forgejo/forgejo-gitea-7d94988c79-8k76l new disposable /tmp probe only", + "expected_result": "Exact candidate binary on deployed image/Git accepts clean temporary pushes, rejects intermediate synthetic private key, discards quarantine, refuses unavailable scanner, recovers clean acceptance, retains dispatcher/additional-hook behavior; health remains passing and temporary area removed.", + "verification_ref": "docs/evidence/2026-10-12-netkingdom-security/receive-native-probe.json", + "rollback": "Remove only the new /tmp/custodian-receive-native-20261012-001 directory after matching .probe-owner. No existing repository/hook/config changes. Executor finally performs cleanup on success/failure.", + "abort_owner": "railiance-forge; executing custodian-codex", + "cost_estimate_eur": 0, + "risk_estimate": "Temporary approximately 27 MiB artifact storage plus small disposable Git fixtures and brief CPU use on the existing container; no new resource allocation/spend, no real credentials or production repository/config writes. Preflight requires 256 MiB free temporary space and passing health; execution has timeout and owned-path cleanup.", + "promotion_evidence": false, + "reason": "Existing standing founder authorization; not an exact-revision human approval, autopilot grant or credential-isolation proof.", + "executed_revision": 1, + "executed_digest_sha256": "b6fe6f55354f7f09837b94f4d75e79f39ac0a4b868f7ac377e2ca6590e340b42", + "verified_at": "2026-10-12T17:13:10.480151+00:00", + "verified_outcome": "Exact binaries passed disposable native push/detection/quarantine/failure/recovery/dispatcher checks in live image; existing service health passed, temporary directory removed. Production auth stubbed and hooks unchanged.", + "refinement_or_rescue": false + }, + { + "proposal_id": "FORGE6-RECEIVE-ACTIVATION-001", + "authorization_ref": "canon/standards/build-mode-change-authorization_v0.1.md", + "expected_result": "22 existing upstream dispatchers gain independent pinned secret scanner; SSH clean/blocked results observed under independently tested temporary veto, rejected probe refs and quarantines absent, veto removed, existing hooks preserved and health passing. Subsequent authorized ordinary source push separately proves clean acceptance.", + "rollback": "Run the same executor with this proposal and --rollback. Removes only the two additive files after exact hash verification; verifies original eight-file inventory on all 22 repositories. Durable admitted binaries remain inert. Automatic rollback on failed activation verification.", + "abort_owner": "railiance-forge; executing custodian-codex", + "cost_estimate_eur": 0, + "risk_estimate": "Existing infrastructure, approximately 27 MiB durable storage and transient transfer copy, sequential small probes. Possible false refusals or bounded push latency on 22 repositories until rollback. No new spend/resources or credential scope; no restart. Temporary exact-ref veto prevents synthetic fixture publication. Scanner bounds: 90 seconds, 2000 objects, 8 MiB each, 64 MiB aggregate; larger pushes require reviewed remediation rather than bypass.", + "promotion_evidence": false, + "disposition": "unscored", + "outcome": "succeeded", + "original_revision": 1, + "original_digest_sha256": "9c8ea3b7fbe16a997359432af7bcf09f429881fd23cc567188c21129e80ccf8d", + "proposal_ref": "docs/changes/CUST-WP-0080/receive-hook-proposal.json", + "target": "railiance01 existing forgejo pod; additive pre-receive.d hooks on exactly 22 listed repositories", + "verification_ref": "docs/evidence/2026-10-12-netkingdom-security/receive-hook-activation.json", + "reason": "Existing standing founder blue-lane authorization; not an exact-revision human approval or autopilot grant.", + "prepared_at": "2026-10-12T17:28:10.890040+00:00", + "refinement_or_rescue": false, + "executed_revision": 1, + "executed_digest_sha256": "9c8ea3b7fbe16a997359432af7bcf09f429881fd23cc567188c21129e80ccf8d", + "verified_at": "2026-10-12T17:32:28.543884+00:00", + "verified_outcome": "Additive independent scanner installed on 22 exact repositories. Each actual SSH clean and synthetic-secret probe produced the expected scanner result under the temporary veto; probe refs and quarantined commits absent. Veto and staging removed, original hook inventory preserved, health passes. Normal clean acceptance remains separate." + }, + { + "proposal_id": "FORGE6-TEMPLATE-LIFECYCLE-001", + "disposition": "unscored", + "outcome": "failed", + "original_revision": 1, + "original_digest_sha256": "7eddea55359b25c5ad307ed8ccd392dfadfe167d65cbe34b02f1955350bbcb36", + "proposal_ref": "docs/changes/CUST-WP-0080/forge-template-proposal.json", + "authorization_ref": "canon/standards/build-mode-change-authorization_v0.1.md", + "reason": "Standing founder blue-lane authorization after exact source/isolation/server-dry-run proof; not an exact-revision human approval, owner assent, autopilot grant or credential-isolation proof.", + "target": "railiance01 namespace forgejo: Deployment forgejo-gitea and immutable ConfigMap forgejo-secret-template-b1d7cf8cd13f", + "expected_result": "Same image and artifact hashes, Recreate replacement Ready, template selected in actual Forgejo global Git configuration, regular/executable inherited hook in temporary native Git repository, existing 22 hook inventories unchanged, health passing. No new production repository, identity, credential or publication.", + "verification_ref": "docs/evidence/2026-10-13-netkingdom-security/forge-template-activation.json", + "dry_run_ref": "docs/evidence/2026-10-13-netkingdom-security/forge-template-dry-run.json", + "rollback": "Same executor --rollback with original proposal. Removes only exact added mounts and volume, replaces added init setting with /usr/share/git-core/templates, waits for healthy replacement and verifies original 22 hooks/binaries. Keeps immutable ConfigMap inert and any already inherited repository hooks. If rollback used, reconcile owner source to explicit default selection before another Helm deploy. Automatic recovery only when current deployment template exactly matches the attempted change; unknown concurrent changes require abort-owner review.", + "abort_owner": "railiance-forge; executing custodian-codex; release source railiance-apps", + "cost_estimate_eur": 0, + "risk_estimate": "No new resource requests, spend commitments, RBAC or credential scope. Existing Recreate deployment incurs a brief forge interruption; abort after 240-second readiness budget, restore default template under conditional rollback with its own 240-second verification budget. Unknown state stops automatic recovery. New repository writes can refuse if scanner missing, overloaded or input unsupported; existing 22 profiles unchanged. Recorded node CPU requests 3460m/4000m and memory 9472Mi (59%).", + "prepared_at": "2026-10-13T11:56:51.534869+00:00", + "promotion_evidence": false, + "refinement_or_rescue": true, + "executed_revision": 1, + "executed_digest_sha256": "7eddea55359b25c5ad307ed8ccd392dfadfe167d65cbe34b02f1955350bbcb36", + "verified_at": "2026-10-13T12:02:44.468580+00:00", + "verified_outcome": "Subsequent ordinary railiance-forge push refused with scanner-file-refused after the restart. Initial hash/executable/malformed-input verification was insufficient. Custody-mode diagnosis and recovery in progress.", + "initial_verification": { + "at": "2026-10-13T12:02:44.468580+00:00", + "outcome": "Exact additive patch reached generation 12 Ready on unchanged image; configured native Git init inherits a regular executable scanner hook and malformed input refuses. Original 22 hooks/binaries preserved, health passing, temporary repository removed. No production API repository creation or global existing-repository coverage inferred.", + "limit": "Did not exercise ordinary source acceptance after the actual Kubernetes restart." + }, + "adverse_outcome_observed_at": "2026-10-13T12:11:00.052645+00:00", + "recovery_revisions": [ + { + "revision": 2, + "digest_sha256": "7530423d7528b63434d896dfe28e5288d4e332167db817efa58c2255defe28d3", + "proposal_ref": "docs/changes/CUST-WP-0080/forge-custody-repair-proposal.json", + "disposition": "unscored-standing-blue-authorization", + "outcome": "modes-restored; ordinary queued source push accepted via statehub sync", + "preflight_ref": "docs/evidence/2026-10-13-netkingdom-security/forge-custody-preflight.json", + "receipt_ref": "docs/evidence/2026-10-13-netkingdom-security/forge-custody-repair.json" + }, + { + "revision": 3, + "digest_sha256": "b9e8d82331ac2a7fc4b12b5524d486809d03b82f52dc96b31e8ae5e73b93c37f", + "proposal_ref": "docs/changes/CUST-WP-0080/forge-custody-rollout-proposal.json", + "disposition": "unscored-standing-blue-authorization", + "outcome": "first rollout verified; second restart preparation refused JSON-pointer local/server mismatch without mutation", + "source_commit": "railiance-apps 50b66c4", + "preflight_ref": "docs/evidence/2026-10-13-netkingdom-security/forge-custody-rollout-dry-run.json", + "receipt_ref": "docs/evidence/2026-10-13-netkingdom-security/forge-custody-rollout.json" + }, + { + "revision": 4, + "digest_sha256": "f6060bf7a5a604781a04b853775f72ba7ada5cc05c89a1da0df4fd480779004b", + "proposal_ref": "docs/changes/CUST-WP-0080/forge-custody-restart-proposal.json", + "disposition": "unscored-standing-blue-authorization", + "outcome": "verified second replacement generation14; guard completed; modes755 and clean/secret/quarantine/recovery checks pass", + "receipt_ref": "docs/evidence/2026-10-13-netkingdom-security/forge-custody-restart.json" + } + ], + "recovery_outcome": "Recovered with refinement: revisions2-4 restore755 and persist startup custody; two replacement pods passed native receive probes. Original trial remains failed, not an unchanged success. Authenticated SSH source push2c11c36 accepted after final restart and remote head verified.", + "recovery_summary_ref": "docs/evidence/2026-10-13-netkingdom-security/forge-custody-recovery-summary.json", + "proposal_storage": { + "format": "json-checksum-map-entries-v1", + "restore_helper": "docs/changes/CUST-WP-0080/restore_forge_proposal.py", + "original_digest_semantics": "SHA256 of exactly reconstructed executed JSON bytes; not the archive envelope", + "triage_ref": "docs/evidence/2026-10-13-netkingdom-security/forge-custody-metadata-triage.json" + } + }, + { + "proposal_id": "FORGE6-EXPAND-001", + "disposition": "unscored", + "outcome": "succeeded", + "original_revision": 1, + "original_digest_sha256": "508d540e578b8cb93a187de644f15d5ef404e2c0a90fdb96ef22cdbb2bb94c78", + "proposal_ref": "docs/changes/CUST-WP-0080/forge-expansion-proposal.json", + "authorization_ref": "canon/standards/build-mode-change-authorization_v0.1.md", + "reason": "Standing founder blue-lane authorization after exact metadata/hook preflight and atomic-ownership regression checks; no exact-revision human approval or autopilot claim.", + "target": "143 numeric repository IDs bound to private inventory digest on existing Forgejo pod", + "expected_result": "All143native targets have exact original generated hooks plus admitted profile. Each actual SSH clean and synthetic secret probe emits correct scanner result under a ref-specific veto; no probe refs/quarantined commits remain; vetoes and inert ownership links removed. Existing23profiles untouched. One incompatible gitlink repository remains explicit work, not an exemption.", + "verification_ref": "docs/evidence/2026-10-13-netkingdom-security/forge-expansion-activation.json", + "rollback": "Same executor --rollback with exact proposal, private inventory and apply receipt. Removes only exact installed hook/veto hashes on attempted IDs; automatic recovery additionally requires original ownership hard-links. Preserve all preexisting generated hooks. Unknown concurrent changes abort removal, retain unverified outcome for abort owner.", + "abort_owner": "railiance-forge; executor custodian-codex", + "cost_estimate_eur": 0, + "risk_estimate": "Additive reversible hook configuration, no rollout/new resources or identity/policy scope expansion. Probe traffic is serialized and scoped to a temporary ref; veto leaves normal refs unaffected. Unsupported or secret-bearing writes may refuse by design. Limits and initial-history/import coverage remain explicit. Abort on precondition or acceptance failure and roll back attempted cohort; no actual credential content used.", + "prepared_at": "2026-10-13T14:48:05.689089+00:00", + "promotion_evidence": false, + "refinement_or_rescue": false, + "executed_revision": 1, + "executed_digest_sha256": "508d540e578b8cb93a187de644f15d5ef404e2c0a90fdb96ef22cdbb2bb94c78", + "execution_note": "Exact revision 1 completed with process exit 0. All 143 targets verified; final read-only audit preserves 23 baseline profiles and confirms 166 of 167 current repositories admitted, zero unknown profiles, and no probe refs, vetoes or ownership markers. Repository 55 remains explicit compatibility work. No refinement or rescue; standing authorization remains unscored.", + "final_verification_ref": "docs/evidence/2026-10-13-netkingdom-security/forge-expansion-final.json", + "verified_at": "2026-10-13T15:25:26.589770+00:00" + }, + { + "proposal_id": "FORGE6-ROUTES-001", + "disposition": "unscored", + "outcome": "not_executed", + "original_revision": 1, + "original_digest_sha256": "a253fce3a565a2af94133da019bdc434dc57b21a8c61b06b4c27e036cf5a01d3", + "original_proposal_ref": "docs/changes/CUST-WP-0080/forge-routes-proposal-pre-rehearsal.json", + "prepared_revision": 2, + "prepared_digest_sha256": "d12c12857e9ed5f4afa3c1c231fd142adad580a458cc175e74f0ea0e3118d792", + "proposal_ref": "docs/changes/CUST-WP-0080/forge-routes-proposal.json", + "authorization_ref": "canon/standards/build-mode-change-authorization_v0.1.md", + "reason": "Reversible build-mode acceptance preparation; live operation needs the founder identity act in the existing attended window. No exact-revision approval, completed login or autopilot grant inferred.", + "target": "One newly created private disposable repository; pinned deployed Forgejo and admitted hook. Existing repository content, hooks, accounts and policies remain untouched.", + "expected_result": "Authenticated native HTTPS clean acceptance and synthetic-secret refusal with detector evidence; API private creation inherits exact hook; clean/content-secret and clean/merge-message refusal with unchanged refs; quarantine commit absent; anonymous private access refused; owned test repository deleted and absent.", + "verification_ref": "docs/evidence/2026-10-13-netkingdom-security/forge-routes-preparation.json", + "rollback": "Automatic cleanup checks numeric repository ID, owner, private flag, name and ownership description before deleting only the newly created test repository. On interrupted known creation, rerun run_forge_routes.py with the same proposal and receipt plus --cleanup-only. Ambiguous POST before numeric ID receipt requires reconciliation, never replay or delete by name.", + "abort_owner": "railiance-forge; custodian-codex prepares and verifies receipts", + "cost_estimate_eur": 0, + "risk_estimate": "Bounded synthetic test writes to a unique private disposable repository. No real secret fixtures, account creation, access-policy change or external publication. Unexpected acceptance may retain an unbound synthetic private-key fixture until cleanup. API/network failure stops the trial; ambiguous creation and cleanup remain explicitly unverified.", + "promotion_evidence": false, + "refinement_or_rescue": true, + "prepared_at": "2026-10-13T16:26:09.780197+00:00" + }, + { + "proposal_id": "FORGE6-RUNNER-LOOPBACK-001", + "disposition": "unscored", + "outcome": "succeeded", + "original_revision": 1, + "original_digest_sha256": "a2d29132c639f76bed0465a30119148d207f9242c29a2229a2e90cfc5a6aecac", + "original_proposal_ref": "docs/changes/CUST-WP-0080/forge-runner-loopback-proposal-revision-1.json", + "prepared_revision": 2, + "prepared_digest_sha256": "9bd1e9f98a99298c810a47e9dffa0316fe235eff53bcd6cfa0dd6391e094f853", + "proposal_ref": "docs/changes/CUST-WP-0080/forge-runner-loopback-proposal.json", + "authorization_ref": "canon/standards/build-mode-change-authorization_v0.1.md", + "reason": "Standing founder blue-lane rule: reversible reduction of exposed Docker access, reviewed source commit and server dry-run, no credential/policy-scope expansion, exact rollback and named abort owner. No exact-revision human approval or autopilot claim.", + "target": "forgejo/Deployment forgejo-runner only; existing Docker and runner binaries pinned by digest", + "expected_result": "Runner remains Ready with same image bytes and loopback Docker ping; actual Docker listener is 127.0.0.1 only and a separate Forgejo pod cannot reach it. No running or queued tasks at apply. No replica, resource-request, credential or policy expansion.", + "verification_ref": "docs/evidence/2026-10-13-netkingdom-security/forge-runner-loopback-activation.json", + "rollback": "Run same executor --rollback with this proposal, ignored original-template.json baseline and a new receipt, only against exact candidate template/UID. Restores original listener and image references; records restored exposure. No automatic rollback on a security-probe failure; abort owner reviews live state.", + "abort_owner": "railiance-forge, source owner railiance-apps; custodian-codex executes", + "cost_estimate_eur": 0, + "risk_estimate": "Brief runner unavailability during existing Recreate rollout and cold ephemeral Docker cache. Abort if running/queued work appears before apply. An external Docker consumer using the pod IP loses access; the declared runner uses loopback. A concurrent newly scheduled job remains a race; preserve any nonterminal outcome. Original private template retained for exact guarded rollback. No new resources/spend or data deletion requested.", + "refinement_or_rescue": true, + "refinement_note": "Read-only preflight showed Docker wildcard binding in /proc/net/tcp6, so rollback verification binds the observed original listener instead of assuming an IPv4-only socket. No live mutation in revision 1.", + "promotion_evidence": false, + "prepared_at": "2026-10-13T16:42:18.349596+00:00", + "executed_revision": 2, + "executed_digest_sha256": "9bd1e9f98a99298c810a47e9dffa0316fe235eff53bcd6cfa0dd6391e094f853", + "verified_at": "2026-10-13T16:46:23.659255+00:00", + "execution_note": "Process exited 0. Generation 4 Ready, exact prior image bytes retained, local Docker ping succeeds, other-pod ping refuses, actual listener is IPv4 loopback only. Zero queued/running jobs before and after. Revision 1 was preparation only; unscored standing grant, no promotion credit." + }, + { + "proposal_id": "CUST81-REUSE-PUBLIC-REGISTRATION-R1", + "disposition": "unscored", + "outcome": "succeeded", + "proposal_ref": "docs/assessments/netkingdom-2026-10-14/hub-public-registration-proposal-r1.json", + "original_revision": 1, + "original_digest_sha256": "84811121ae8d00970927b97bd6125b6a91989cce46dbe6b75a24592e15c16ca1", + "original_digest": "84811121ae8d00970927b97bd6125b6a91989cce46dbe6b75a24592e15c16ca1", + "target": "https://reuse.coulomb.social/v1/repos; 31 public-only repository registrations", + "expected_result": "All 31 reviewed public repository registrations match the approved plan and the public capabilities become discoverable from fresh hosted federation readback.", + "verification_ref": "docs/assessments/netkingdom-2026-10-14/hub-public-registration-proposal-r1.json; docs/assessments/netkingdom-2026-10-14/hub-public-resume-receipts.jsonl; fresh hosted federation GET", + "rollback": "For only rows created by this attempt, PATCH enabled=false, then verify each row and confirm its capabilities disappear from a fresh federation. Reconcile any ambiguous POST before changing it; never delete or disable pre-existing matching registrations.", + "cost_estimate_eur": 0, + "risk_estimate": "High-risk credential route uses the 15-minute dedicated role on exact KV data and metadata paths. The helper requests only REUSE_SURFACE_TOKEN and does not expose or persist its value; because the policy is path-level, another field at that secret path may also be readable by the principal. 31 bounded metadata writes are individually receipted; conflicts halt the batch. Hub-write effects are reversible by disabling only rows attributable to this attempt. No private source, visibility change, deployment or resource commitment.", + "refinement_or_rescue": true, + "promotion_evidence": false, + "executed_revision": 1, + "execution_ref": "docs/assessments/netkingdom-2026-10-14/hub-public-resume-receipts.jsonl", + "verified_outcome": "31 public registrations applied and read back; all 63 public reviewed IDs appear exactly once after refresh. Scoped OpenBao session revoked. Seven private sources remain outside this proposal.", + "authorization_ref": "Founder active user objective: perform the NetKingdom security architecture review and establish all capabilities with reuse-surface; exact proposal R1 is limited to its 31 public repositories and excludes all seven private repositories.", + "reason": "Existing broad user authorization covers establishment; no exact-revision supervisor disposition was recorded. Earlier accepted_unchanged scoring inferred approval from the task objective and is corrected here; no promotion credit is claimed.", + "transport_ref": "docs/assessments/netkingdom-2026-10-14/attended_public_registration.py", + "transport_sha256": "be838f5da85d9aec4afed779d295548c739d6d1da670e13808bd804476663785", + "transport_note": "Fresh Windows Firefox private profile; scoped OpenBao token in memory only. Enforce recorded member entity, exact policies and max30m TTL before invoking unchanged Warden/helper. Revoke in finally; retain Warden audit and sanitized attempt receipt.", + "authentication_attempts": [ + { + "at": "2026-10-14T22:13:41.969079+00:00", + "attempt_id": "8c160098-587b-426c-9f9f-33f57de30c92", + "finished_at": "2026-10-14T22:15:54.561630+00:00", + "login": false, + "login_error": "Error authenticating: timed out waiting for response from provider", + "proposal_id": "CUST81-REUSE-PUBLIC-REGISTRATION-R1", + "revision": 1, + "revoked": null, + "warden_exit": null, + "warden_state": "/tmp/custodian-warden-state-0x5_fd96" + }, + { + "at": "2026-10-14T22:18:17.520607+00:00", + "attempt_id": "23c02e30-1a4c-4bc1-a3dc-45c9bf7ce962", + "entity_id": "c204099b-cb94-363f-e207-5ff4d4aa6e94", + "finished_at": "2026-10-14T22:19:26.523659+00:00", + "login": true, + "proposal_id": "CUST81-REUSE-PUBLIC-REGISTRATION-R1", + "revision": 1, + "revoked": true, + "warden_exit": 0, + "warden_state": "/tmp/custodian-warden-state-bpn99gi5" + } + ], + "executed_digest_sha256": "84811121ae8d00970927b97bd6125b6a91989cce46dbe6b75a24592e15c16ca1", + "executed_digest": "84811121ae8d00970927b97bd6125b6a91989cce46dbe6b75a24592e15c16ca1", + "final_verification_ref": "docs/assessments/netkingdom-2026-10-14/hosted-public-registration-verification.json", + "verified_at": "2026-10-14T22:19:51.870244+00:00", + "refinement_note": "Freshened stale ops-mason publication proof and added a fresh-profile in-memory authentication transport. First login timed out during Firefox update; user-requested retry succeeded. Preserve both authentication attempts; no unchanged-success scoring." + }, + { + "proposal_id": "STATE-WP-0095-T06-cluster-frozen-receiving-r1", + "disposition": "accepted_revised", + "outcome": "succeeded", + "proposal_ref": "docs/changes/netkingdom-target-2026-10-16/cluster-historical-publication-r1/revisions/r4-rollout-review/proposal-metadata.json", + "original_revision": 1, + "original_digest_sha256": "5bef9e7818ce1ebc64b81e300b6b40dcfc710a8625d6e0595534f8284dc2052d", + "original_digest": "5bef9e7818ce1ebc64b81e300b6b40dcfc710a8625d6e0595534f8284dc2052d", + "current_revision": 4, + "current_digest_sha256": "63a02e8296d126c0158b7eb2c4ce79c7eeb6f8d6f61298d473c1065c7557ba32", + "target": "railiance01 state-hub release/API/MCP and exact-new-trial migration Job only", + "expected_result": "Normal owner image promotion makes exact frozen cluster receiving available; API/MCP ready, expected c4 schema and exact three historical parents/15 tasks preserved; only then is later registrar admission eligible. No original TLS/identity native acceptance is inferred.", + "verification_ref": "docs/changes/netkingdom-target-2026-10-17/receiver-rollout-r4/verified-receiving-return.json", + "rollback_ref": "docs/changes/netkingdom-target-2026-10-16/cluster-historical-publication-r1/revisions/r4-rollout-review/MIGRATION-JOB-RECOVERY.md", + "cost_estimate_eur": null, + "risk_estimate_eur": null, + "cost_estimate": "Unknown attributable execution/network/operator recovery cost on existing infrastructure; no zero-cost claim or budget reservation inferred.", + "risk_estimate": "Unpriced production coordination outage, message migration locks/data compatibility, retained active migration Job, uncertain connection/lock mapping and recovery time; three-minute Helm wait is not a bound on outage or DB effects. Explicit supervised risk disposition required.", + "supervisor": "Bernd Worsch", + "approval_ref": "e3798419-8aa9-5425-8c08-20df6bd82a19", + "approved_revision": 4, + "approved_digest_sha256": "63a02e8296d126c0158b7eb2c4ce79c7eeb6f8d6f61298d473c1065c7557ba32", + "executed_revision": 4, + "executed_digest_sha256": "63a02e8296d126c0158b7eb2c4ce79c7eeb6f8d6f61298d473c1065c7557ba32", + "refinement_or_rescue": true, + "promotion_evidence": false, + "reason": "Founder-approved revision4 executed successfully. Helm76, exact image/module, expected schema, 18 unchanged historical full rows and five rollback-only native cases verified. Original proposal refinements retained; no unchanged-success credit.", + "revisions": [ + { + "revision": 1, + "proposal_ref": "docs/changes/netkingdom-target-2026-10-16/cluster-historical-publication-r1/REVIEW.md", + "digest_sha256": "5bef9e7818ce1ebc64b81e300b6b40dcfc710a8625d6e0595534f8284dc2052d", + "disposition": "not_submitted_or_unadjudicated", + "executed": false + }, + { + "revision": 2, + "proposal_ref": "docs/changes/netkingdom-target-2026-10-16/cluster-historical-publication-r1/revisions/r2/REVIEW.md", + "digest_sha256": "c8f13ed5d67d4743ea8e81bf720367022c820a060d7b225e84338eab2907493f", + "disposition": "not_submitted_or_unadjudicated", + "executed": false + }, + { + "revision": 3, + "proposal_ref": "docs/changes/netkingdom-target-2026-10-16/cluster-historical-publication-r1/revisions/r3-readiness/ROLLOUT-SUPPLEMENT.md", + "digest_sha256": "df2962fd1588784a987e37932bd67f03f6248ea6384cf4bbb74ad1fe2e26be2b", + "disposition": "not_submitted_or_unadjudicated", + "executed": false + } + ], + "approved_digest": "63a02e8296d126c0158b7eb2c4ce79c7eeb6f8d6f61298d473c1065c7557ba32", + "approved_at": "2026-10-16T23:55:32.549865+00:00", + "supervisor_disposition": "Founder approved exact presented revision4 unchanged; original r1 was refined before submission, so this remains accepted_revised for original-trial scoring.", + "approval_scope": "Exact pinned receiver rollout including inbox migration and documented conditional recovery; no authority promotion.", + "executed_digest": "63a02e8296d126c0158b7eb2c4ce79c7eeb6f8d6f61298d473c1065c7557ba32", + "execution_started_at": "2026-10-16T23:57:03.186884+00:00", + "execution_ref": "docs/changes/netkingdom-target-2026-10-17/receiver-rollout-r4/execution.json", + "verified_at": "2026-10-17T00:07:47.015454+00:00", + "recovery_required": false, + "post_execution_findings_ref": "docs/changes/netkingdom-target-2026-10-17/receiver-rollout-r4/ordinary-pipeline-preservation-finding.json", + "post_execution_finding": "Later ordinary Cluster deep-consistency binding refresh changed three historical parent hashes; original delivered-rollout preservation and five rollback probes passed before that separate pipeline. Further acceptance stays open." + }, + { + "proposal_id": "STATE-WP-0095-T10-frozen-bindings-guard-r1", + "disposition": "accepted_revised", + "outcome": "succeeded", + "proposal_ref": "docs/changes/netkingdom-target-2026-10-17/guard-successor-review-r2/proposal-metadata.json", + "original_revision": 1, + "original_digest_sha256": "81d365926fc585a186955d8c98ee83501fd3cec12135b2256d71b46a75097932", + "original_digest": "81d365926fc585a186955d8c98ee83501fd3cec12135b2256d71b46a75097932", + "current_revision": 2, + "current_digest_sha256": "5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e", + "target": "railiance01/92.205.62.239 state-hub release API/MCP and exact-new-trial migration Job", + "expected_result": "New API binding guard delivered and current-baseline native/whole-pipeline preservation verified, with earlier parent mismatch retained as explicit exception.", + "verification_ref": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-receiving-return.json", + "rollback_ref": "docs/changes/netkingdom-target-2026-10-17/guard-successor-review-r2/RECOVERY.md", + "cost_estimate_eur": null, + "risk_estimate_eur": null, + "cost_estimate": "Unpriced incremental execution and recovery costs on existing infrastructure.", + "risk_estimate": "Unpriced coordination outage, hook lifetime, lock mapping and recovery; reviewed conditional limits stop for attended owner on unknown state.", + "supervisor": "Bernd Worsch", + "approval_ref": "df703266-6719-4c04-ae1b-ba9afd3bca1c", + "approved_revision": 2, + "approved_digest_sha256": "5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e", + "executed_revision": 2, + "executed_digest_sha256": "5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e", + "refinement_or_rescue": true, + "promotion_evidence": false, + "related_proposal_id": "STATE-WP-0095-T06-cluster-frozen-receiving-r1", + "reason": "Separate new-code runtime request follows retained ordinary-pipeline and stale-installed-client failures. Six source refinements and real writeback regression remain visible; no extra success or authority is inferred.", + "revision_history": [ + { + "revision": 1, + "digest_sha256": "81d365926fc585a186955d8c98ee83501fd3cec12135b2256d71b46a75097932", + "outcome": "not_executed", + "refinement": "Normal secret scan flagged probe source-hash metadata; original retained locally and by digest." + }, + { + "revision": 2, + "digest_sha256": "5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e", + "outcome": "not_executed", + "refinement": "Typed module/SHA256 records; unchanged runtime and probe logic." + } + ], + "approved_digest": "5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e", + "approved_at": "2026-10-17T01:51:27.526327+00:00", + "approval_record_ref": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/approval-decision.json", + "approval_scope": "Exact revision2 new API image rollout, eight rollback/intercepted probes, corrected normal pipeline and current-baseline exception, plus scoped conditional recovery; no authority promotion.", + "executed_digest": "5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e", + "execution_started_at": "2026-10-17T01:52:59.649596+00:00", + "execution_ref": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/execution.json", + "verified_at": "2026-10-17T01:55:19.742775+00:00", + "verified_outcome": "Exactapprovedrevision2 deliveredHelm77; eightactualrollback/interceptedcasespass, all18CURRENTfullrows equalafterrolloutandnormalpipeline; archives/stagedworkpreserved. Originalthreeparentfailure retainedasfounder-approvedhistoricalexception, notrestored/backfilled.", + "recovery_required": false + }, + { + "proposal_id": "REINAH-WP-0008-T07-install-f599-r1", + "disposition": "accepted_revised", + "outcome": "failed", + "proposal_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/FINAL-PROPOSAL.md", + "original_revision": 1, + "original_digest_sha256": "408d779a19e0e83b3be9a80ad624c1f7b7be906d22c0a8efe6e629185cc0cd0a", + "original_digest": "408d779a19e0e83b3be9a80ad624c1f7b7be906d22c0a8efe6e629185cc0cd0a", + "current_revision": 3, + "current_digest_sha256": "7d5741abc7da042d4de6cd36437801309b844760f606b3145d615fd75d6b2d30", + "target": "railiance01/92.205.62.239 account tegwick UID/GID1000; exact protected runtimes store and new f599 immutable digest directory", + "expected_result": "Exact dormant artifact append with full extracted/installed/post-rehearsal f599 digest equality; three credential-free empty-egress launcher checks pass; positively quiesced owned processes and staging gone. No provider, owner/catalog/profile/queue changes or native security-gate closure.", + "verification_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/installed-partial-verification.json", + "planned_execution_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/execution-receipt.json", + "rollback_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/FINAL-PROPOSAL.md", + "cost_estimate_eur": null, + "risk_estimate_eur": null, + "cost_estimate": "Zero provider requests and no new paid resource; infrastructure/energy/operator EUR cost unknown, explicitly supervised.", + "risk_estimate": "Shared single-node CPU/IO interruption and recovery EUR loss unknown; exact fresh headroom, private process supervision and conditional staging cleanup required. Installed digest retained inactive on partial failure.", + "supervisor": "Bernd Worsch", + "approval_ref": "b6abb6ab-b182-4b4f-9f84-79ddc5ad91f3", + "approved_revision": 2, + "approved_digest_sha256": "44b17589c323e1a966caf6c1b1def123092ee289b929c8ea014bc84109103b1d", + "executed_revision": 2, + "executed_digest_sha256": "44b17589c323e1a966caf6c1b1def123092ee289b929c8ea014bc84109103b1d", + "refinement_or_rescue": true, + "promotion_evidence": false, + "reason": "R1 held after root found descendant cleanup gap; founder approved exact R2 and it was executed once. R2 was partial/failed and requires review of separately prepared R3. No approval or success inferred for R3.", + "revision_history": [ + { + "revision": 1, + "digest_sha256": "408d779a19e0e83b3be9a80ad624c1f7b7be906d22c0a8efe6e629185cc0cd0a", + "outcome": "not_executed", + "disposition": "not_submitted_or_unadjudicated", + "root_review": "needs_refinement_descendant_cleanup" + }, + { + "revision": 2, + "digest_sha256": "44b17589c323e1a966caf6c1b1def123092ee289b929c8ea014bc84109103b1d", + "manifest_sha256": "aea5dbfe0742fe0bb6c36a41ca7b0d70473683b2731f92cc279d43929e5c35c9", + "outcome": "failed", + "disposition": "accepted_revised", + "root_review": "accepted_for_founder_submission_after_independent_source_review_and_two_process_oracles", + "approval_ref": "b6abb6ab-b182-4b4f-9f84-79ddc5ad91f3", + "executed_digest_sha256": "44b17589c323e1a966caf6c1b1def123092ee289b929c8ea014bc84109103b1d", + "execution_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/execution-receipt.json", + "verification_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/installed-partial-verification.json" + }, + { + "revision": 3, + "digest_sha256": "7d5741abc7da042d4de6cd36437801309b844760f606b3145d615fd75d6b2d30", + "manifest_sha256": "19d3a74b124a9a7236bd4b8f6fe45656b4651d875017486f0dfa515f3f81d806", + "outcome": "not_executed", + "disposition": "accepted_revised", + "root_review": "source_review_and_five_focused_root_checks_passed", + "approval_ref": "bec667cc-15ea-4f87-ae16-111f08562e48", + "approved_at": "2026-10-17T10:57:39.975862+00:00", + "preflight": "refused_cpu_headroom_0.99248; zero native mutation" + } + ], + "pending_decision_ref": null, + "approved_at": "2026-10-17T08:34:32.549418+00:00", + "approval_record_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/approval-decision.json", + "supervisor_disposition": "Founder approved exact R3; fresh read-only preflight refused CPU headroom before any remote write/launch. Completed R2 failed outcome and its approval/execution remain the scored trial state; latest R3 approval is retained separately. No authority promotion or automatic retry.", + "execution_started_at": "2026-10-17T08:35:10.440830+00:00", + "execution_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/execution-receipt.json", + "execution_phase": "completed_failed_partial_install_independently_verified", + "approved_digest": "44b17589c323e1a966caf6c1b1def123092ee289b929c8ea014bc84109103b1d", + "executed_digest": "44b17589c323e1a966caf6c1b1def123092ee289b929c8ea014bc84109103b1d", + "verified_outcome": "R2 installed exact inactive f599; independent readback verified full digest and owned staging absence. Three-launcher proof failed with phase_receipt_unavailable/leader_left_descendants. R2 watchdog receipt reports positive process quiescence; erased process trace prevents independent retrospective process classification. Native launcher acceptance remains unverified. No automatic retry.", + "failure_receipt_sha256": "sha256:59969ad9992ac289a553e1076209ba0d04b6fa7cd171bfad83dcc1f96d80a1c6", + "failure_cause_limit": "R2 source zombie-classification bug reproduced locally; native trace removed, so causal attribution of this native failure remains unproven.", + "pending_revision": { + "revision": 3, + "digest_sha256": "7d5741abc7da042d4de6cd36437801309b844760f606b3145d615fd75d6b2d30", + "manifest_sha256": "19d3a74b124a9a7236bd4b8f6fe45656b4651d875017486f0dfa515f3f81d806", + "proposal_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/FINAL-PROPOSAL.md", + "disposition": "accepted_revised", + "outcome": "not_executed", + "target": "railiance01/tegwick existing inactive f599; new exact verification staging and durable public precleanup receipt", + "expected_result": "All three unchanged empty-egress offline launcher commands exit zero, full f599 digest before/after, durable public receipt before positive-quiescence conditional cleanup. No installation, model call, credential/profile/queue change or gate closure.", + "verification_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/FINAL-PROPOSAL.md", + "rollback_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/FINAL-PROPOSAL.md", + "cost_estimate_eur": null, + "risk_estimate_eur": null, + "cost_risk_note": "Zero provider calls/new paid resources; infrastructure/operator cost and interruption loss EUR UNKNOWN. Fresh exact supervised exposure approval required.", + "root_review_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/root-review.json", + "decision_ref": "bec667cc-15ea-4f87-ae16-111f08562e48", + "approval_ref": "bec667cc-15ea-4f87-ae16-111f08562e48", + "approved_at": "2026-10-17T10:57:39.975862+00:00" + }, + "execution_attempts": [ + { + "revision": 2, + "approved_revision": 2, + "approved_digest_sha256": "44b17589c323e1a966caf6c1b1def123092ee289b929c8ea014bc84109103b1d", + "approval_ref": "b6abb6ab-b182-4b4f-9f84-79ddc5ad91f3", + "executed_digest_sha256": "44b17589c323e1a966caf6c1b1def123092ee289b929c8ea014bc84109103b1d", + "outcome": "failed", + "execution_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/execution-receipt.json", + "verification_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/installed-partial-verification.json", + "verified_outcome": "R2 installed exact inactive f599; independent readback verified full digest and owned staging absence. Three-launcher proof failed with phase_receipt_unavailable/leader_left_descendants. R2 watchdog receipt reports positive process quiescence; erased process trace prevents independent retrospective process classification. Native launcher acceptance remains unverified. No automatic retry.", + "failure_receipt_sha256": "sha256:59969ad9992ac289a553e1076209ba0d04b6fa7cd171bfad83dcc1f96d80a1c6" + } + ], + "next_execution": { + "revision": 3, + "digest_sha256": "7d5741abc7da042d4de6cd36437801309b844760f606b3145d615fd75d6b2d30", + "status": "approved_read_only_preflight_refused_cpu_headroom", + "execution_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/execution-receipt.json", + "approval_ref": "bec667cc-15ea-4f87-ae16-111f08562e48", + "approval_record_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/approval-decision.json", + "preflight_ref": "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/approved-preflight.json", + "native_mutations": 0, + "launcher_calls": 0, + "automatic_polling_or_retry": false + }, + "latest_approval": { + "decision_id": "bec667cc-15ea-4f87-ae16-111f08562e48", + "approved_at": "2026-10-17T10:57:39.975862+00:00", + "approved_revision": 3, + "approved_digest_sha256": "7d5741abc7da042d4de6cd36437801309b844760f606b3145d615fd75d6b2d30", + "approval_source": "Actual user response: Approve exact revision 3", + "status": "resolved", + "decided_by": "Bernd Worsch", + "scope": "Founder actual conversation reply: Approve exact revision 3. Approval is bound only to stable proposal REINAH-WP-0008-T07-install-f599-r1 revision3 SHA256 7d5741abc7da042d4de6cd36437801309b844760f606b3145d615fd75d6b2d30, verification-only of installed inactive f599, unchanged three empty-egress launcher commands, repaired dead-zombie handling, exclusive durable public precleanup receipt, fresh exact guards and reviewed conditional cleanup. Unknown infrastructure/operator EUR cost and interruption/recovery loss EUR explicitly accepted only for this supervised action. No reinstall/model/credential/profile/catalog/queue changes or autopilot grant. R2 failed partial outcome retained in the same trial." + } + } + ], + "trials": [ + { + "proposal_id": "CUST81-PRIVATE-READER-EXECUTION-R1", + "proposal_ref": "docs/assessments/netkingdom-2026-10-14/private-reader-execution-proposal-r1.json", + "original_revision": 1, + "original_digest_sha256": "704a9c932202fc14456652ea4dfdb3acb8b1db0ab3bbf5fff50e92b2c517c380", + "original_digest": "704a9c932202fc14456652ea4dfdb3acb8b1db0ab3bbf5fff50e92b2c517c380", + "disposition": "accepted_unchanged", + "outcome": "succeeded", + "trial_scope": "CUST-WP-0081 supervised exact private-reader rollout/provisioning/registration proposal; no scope grant inferred", + "target": "railiance01 reuse/reuse-surface; exact seven Forgejo private repositories; OpenBao exact newreader data path; hosted sevenregistrations", + "expected_result": "Verified hardened rollout before readeravailability, native14consentedfileproofs, hosted all70reviewedcapabilities exactlyonce", + "verification_ref": "docs/assessments/netkingdom-2026-10-14/private-reader-execution-proposal-r1.json verification/ordered_execution/prepared_artifacts", + "rollback_ref": "docs/assessments/netkingdom-2026-10-14/private-reader-execution-proposal-r1.json rollback/conditional_receipt_authority", + "cost_estimate_eur": null, + "incremental_infrastructure_cost_eur": 0, + "risk_estimate_eur": null, + "risk_estimate": "Qualitative supervised interruption/recovery and dedicated static seven-repository code-read exposure; exact guards, backup and recovery specified in packet; unpriced credible loss, no autopilot grant.", + "supervisor": "Bernd Worsch", + "approval_ref": "9833715e-a22a-45c0-ab6c-881f0f4f1a0e", + "approved_revision": 1, + "approved_digest": "704a9c932202fc14456652ea4dfdb3acb8b1db0ab3bbf5fff50e92b2c517c380", + "executed_revision": 1, + "executed_digest": "704a9c932202fc14456652ea4dfdb3acb8b1db0ab3bbf5fff50e92b2c517c380", + "refinement_or_rescue": true, + "verified_outcome": "All70reviewedcapabilities freshlyhosted exactlyonce/correctsource/no warnings; actual14privatefiles hashverified,7POST201/fullSQLreadback, admin/writerrevocationconfirmed. Executedapprovedrevision2 withcorrection/retries; not an unchanged execution success.", + "promotion_evidence": false, + "submitted_at": "2026-10-15T00:04:50.637439+00:00", + "approval_record_ref": "docs/assessments/netkingdom-2026-10-14/private-reader-execution-approval-r1.json", + "approved_at": "2026-10-15T00:07:05.087085+00:00", + "execution_preflight_refinement": "Freshrootdiff initiallyuseddefaultnamespace; stoppedbeforelivechange. Owneroriginaldryrun/diff correctlytargetedreuse. Correctedrootexplicitnamespace andrecordedproof; approvedliveeffect unchanged.", + "execution_ref": "docs/assessments/netkingdom-2026-10-14/phase-a-authorized-execution-r1.jsonl", + "partial_verified_outcome": "Hardenedrollout,custody,revocation,maintenance,readerESOdelivery,actualnative14fetch verified. Originalattendedwriter failed beforelogin dueconfirmedCLIflagorder; noregistrations. Correctedrevision2 pending exactsupervisorapproval.", + "partial_verification_ref": "docs/assessments/netkingdom-2026-10-14/phase-a-runtime-verification-r1.json", + "source_declaration_ref": "docs/assessments/netkingdom-2026-10-14/owner-assembly/active-phase-a-source-declaration-r1.json", + "attended_login_failure_ref": "docs/assessments/netkingdom-2026-10-14/attended-custody-login-failure-r1.json", + "dependency_repair_review_ref": "docs/assessments/netkingdom-2026-10-14/warden-dependency-repair-requester-review-r1.json", + "latest_attended_login_failure_ref": "docs/assessments/netkingdom-2026-10-14/attended-custody-login-failure-r2.json", + "custody_verification_refs": [ + "docs/assessments/netkingdom-2026-10-14/cust81-policy-custody-r1.jsonl", + "docs/assessments/netkingdom-2026-10-14/cust81-forge-reader-r1.jsonl", + "docs/assessments/netkingdom-2026-10-14/warden-attended-custody-terminal-r1.json" + ], + "revisions": [ + { + "revision": 2, + "digest": "c8fa74ad6648af1c884a4c607e100097f917761af5d3a6e0c5e8ce9a53b809dc", + "proposal_ref": "docs/assessments/netkingdom-2026-10-14/private-reader-execution-proposal-r2.json", + "disposition": "accepted_unchanged", + "reason": "Actual writertransport refused beforebrowser: trailing-no-store treatedas malformedauthdata; one-lineordercorrection prepared", + "executed": true, + "approval_ref": "9f496e68-655e-4e08-aa57-c822cf731124", + "approved_digest": "c8fa74ad6648af1c884a4c607e100097f917761af5d3a6e0c5e8ce9a53b809dc", + "approved_at": "2026-10-15T03:23:56.611534+00:00", + "executed_digest": "c8fa74ad6648af1c884a4c607e100097f917761af5d3a6e0c5e8ce9a53b809dc", + "execution_started_at": "2026-10-15T03:24:57.316551+00:00", + "outcome": "verified_success_after_claim_and_OTP_retries" + } + ], + "latest_writer_failure_ref": "docs/assessments/netkingdom-2026-10-14/private-writer-cli-order-failure-r1.json", + "latest_approved_revision": 2, + "latest_approval_ref": "9f496e68-655e-4e08-aa57-c822cf731124", + "latest_executed_revision": 2, + "latest_executed_digest": "c8fa74ad6648af1c884a4c607e100097f917761af5d3a6e0c5e8ce9a53b809dc", + "final_verification_ref": "docs/assessments/netkingdom-2026-10-14/hosted-private-registration-verification-r1.json", + "completed_at": "2026-10-15T03:33:16.165793+00:00" + } + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/supervision-report.json b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/supervision-report.json new file mode 100644 index 00000000..34f29b9c --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r3/supervision-report.json @@ -0,0 +1,22 @@ +{ + "agent_id": "custodian-codex", + "scope": "CUST-WP-0071 and CUST-WP-0073 preparation and founder-authorized Railiance changes", + "mode": "supervised", + "counts": { + "unscored": 12, + "total": 23, + "outcome_failed": 4, + "refinement_or_rescue": 12, + "outcome_succeeded": 17, + "accepted_unchanged": 8, + "adjudicated": 11, + "verified_executions": 10, + "unchanged_successes": 4, + "outcome_not_executed": 2, + "accepted_revised": 3 + }, + "unchanged_acceptance_rate": 0.7272727272727273, + "unchanged_execution_success_rate": 0.4, + "authority_granted": false, + "note": "Descriptive evidence only; null rates mean no eligible sample. Never promotes an agent." +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-batch-0.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-batch-0.json new file mode 100644 index 00000000..3f9296f8 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-batch-0.json @@ -0,0 +1,31 @@ +{ + "exit_code": 0, + "commit": "275e034883882199dca585e4cd3dc34d173270da", + "parent": "ceaeef1ee79eeba37e7cacf73ba8aed3357a5e7c", + "paths": [ + "docs/changes/netkingdom-target-2026-10-17/native-gates-r1/native-gate-audit.json", + "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/README.md", + "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/consumer-proof-plan.md", + "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/focused-regressions.stderr.txt", + "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/focused-regressions.stdout.txt", + "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/hub-readback.json", + "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/manifest.json", + "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/next-attempt-proposal.json", + "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/original-behavior-regression.txt", + "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/owner-declaration.template.json", + "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/owner-source.patch", + "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/postimages/tests/isolated-keycape-native-fixture-manifest.json", + "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/postimages/tests/test_isolated_keycape_recovery.py", + "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/postimages/tools/bootstrap-recovery/isolated-keycape.py", + "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/postimages/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md", + "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/preimages/tests/isolated-keycape-native-fixture-manifest.json", + "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/preimages/tests/test_isolated_keycape_recovery.py", + "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/preimages/tools/bootstrap-recovery/isolated-keycape.py" + ], + "stdout": "[main 275e034] Record native security preparation and owner checkpoints (1/7)\n 18 files changed, 7262 insertions(+)\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-gates-r1/native-gate-audit.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/README.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/consumer-proof-plan.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/focused-regressions.stderr.txt\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/focused-regressions.stdout.txt\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/hub-readback.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/next-attempt-proposal.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/original-behavior-regression.txt\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/owner-declaration.template.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/owner-source.patch\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/postimages/tests/isolated-keycape-native-fixture-manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/postimages/tests/test_isolated_keycape_recovery.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/postimages/tools/bootstrap-recovery/isolated-keycape.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/postimages/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/preimages/tests/isolated-keycape-native-fixture-manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/preimages/tests/test_isolated_keycape_recovery.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/preimages/tools/bootstrap-recovery/isolated-keycape.py\n", + "stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 18, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n", + "push_exit_code": 0, + "push_stdout": "", + "push_stderr": "remote: {\"status\":\"clean\",\"scope\":\"introduced-reachable-git-objects-and-updated-ref-names\",\"scanned_objects\":33,\"scanned_refs\":1,\"scanner_version\":\"8.30.1\"} \nTo forgejo-remote:coulomb/the-custodian.git\n ceaeef1..275e034 main -> main\n", + "remote_exact": true +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-batch-1.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-batch-1.json new file mode 100644 index 00000000..da9a89e1 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-batch-1.json @@ -0,0 +1,31 @@ +{ + "exit_code": 0, + "commit": "a6eee04d420eb993660c914594f3ceab83b3f567", + "parent": "275e034883882199dca585e4cd3dc34d173270da", + "paths": [ + "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/preimages/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md", + "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/refinement-r2/NK-WP-0049.postimage.md", + "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/refinement-r2/NK-WP-0049.preimage.md", + "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/refinement-r2/manifest.json", + "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/refinement-r2/task-refinement.patch", + "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/refinement-r2/updated-owner-source.patch", + "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/routing-discovery.json", + "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/selector-preflight.json", + "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/selector-uniqueness.patch", + "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/source-references.json", + "docs/changes/netkingdom-target-2026-10-17/native-identity-r1/verification.json", + "docs/changes/netkingdom-target-2026-10-17/native-registration-r1/assemble_review.py", + "docs/changes/netkingdom-target-2026-10-17/native-registration-r1/descriptor-composition.json", + "docs/changes/netkingdom-target-2026-10-17/native-registration-r1/manifest.json", + "docs/changes/netkingdom-target-2026-10-17/native-registration-r1/original-attempt-review.json", + "docs/changes/netkingdom-target-2026-10-17/native-registration-r1/register-client.proposed-descriptor.json", + "docs/changes/netkingdom-target-2026-10-17/native-registration-r1/source-manifest.json", + "docs/changes/netkingdom-target-2026-10-17/native-registration-r1/source-verification.json" + ], + "stdout": "[main a6eee04] Record native security preparation and owner checkpoints (2/7)\n 18 files changed, 5770 insertions(+)\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/preimages/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/refinement-r2/NK-WP-0049.postimage.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/refinement-r2/NK-WP-0049.preimage.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/refinement-r2/manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/refinement-r2/task-refinement.patch\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/refinement-r2/updated-owner-source.patch\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/routing-discovery.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/selector-preflight.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/selector-uniqueness.patch\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/source-references.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-identity-r1/verification.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-registration-r1/assemble_review.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-registration-r1/descriptor-composition.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-registration-r1/manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-registration-r1/original-attempt-review.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-registration-r1/register-client.proposed-descriptor.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-registration-r1/source-manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-registration-r1/source-verification.json\n", + "stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 18, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n", + "push_exit_code": 0, + "push_stdout": "", + "push_stderr": "remote: {\"status\":\"clean\",\"scope\":\"introduced-reachable-git-objects-and-updated-ref-names\",\"scanned_objects\":27,\"scanned_refs\":1,\"scanner_version\":\"8.30.1\"} \nTo forgejo-remote:coulomb/the-custodian.git\n 275e034..a6eee04 main -> main\n", + "remote_exact": true +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-batch-2.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-batch-2.json new file mode 100644 index 00000000..bf99ed7a --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-batch-2.json @@ -0,0 +1,31 @@ +{ + "exit_code": 0, + "commit": "b5c80ce59565d2107c4f8eeca8171ce325f53e47", + "parent": "a6eee04d420eb993660c914594f3ceab83b3f567", + "paths": [ + "docs/changes/netkingdom-target-2026-10-17/native-registration-r1/summary.json", + "docs/changes/netkingdom-target-2026-10-17/native-registration-r1/work-record-proposal.json", + "docs/changes/netkingdom-target-2026-10-17/native-registration-refinement-r2/manifest.json", + "docs/changes/netkingdom-target-2026-10-17/native-registration-refinement-r2/postimage.md", + "docs/changes/netkingdom-target-2026-10-17/native-registration-refinement-r2/preimage.md", + "docs/changes/netkingdom-target-2026-10-17/native-registration-refinement-r2/t22-applied-intermediate.md", + "docs/changes/netkingdom-target-2026-10-17/native-registration-refinement-r2/workplan.patch", + "docs/changes/netkingdom-target-2026-10-17/native-storage-r1/OWNER-REVIEW.md", + "docs/changes/netkingdom-target-2026-10-17/native-storage-r1/artifact-manifest.json", + "docs/changes/netkingdom-target-2026-10-17/native-storage-r1/identity-provisioner.consumer.PROPOSED.yaml", + "docs/changes/netkingdom-target-2026-10-17/native-storage-r1/rapp-identity-provisioner.PROPOSED.yaml", + "docs/changes/netkingdom-target-2026-10-17/native-storage-r1/rendered/identity-provisioner.sql", + "docs/changes/netkingdom-target-2026-10-17/native-storage-r1/rendered/identity-provisioner.yaml", + "docs/changes/netkingdom-target-2026-10-17/native-storage-r1/source-references.json", + "docs/changes/netkingdom-target-2026-10-17/native-storage-r1/source-validation.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/FINAL-PROPOSAL.md", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/artifact-manifest.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/exec-owner.REVIEW.json" + ], + "stdout": "[main b5c80ce] Record native security preparation and owner checkpoints (3/7)\n 18 files changed, 4823 insertions(+)\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-registration-r1/summary.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-registration-r1/work-record-proposal.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-registration-refinement-r2/manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-registration-refinement-r2/postimage.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-registration-refinement-r2/preimage.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-registration-refinement-r2/t22-applied-intermediate.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-registration-refinement-r2/workplan.patch\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/FINAL-PROPOSAL.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/artifact-manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/exec-owner.REVIEW.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-storage-r1/OWNER-REVIEW.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-storage-r1/artifact-manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-storage-r1/identity-provisioner.consumer.PROPOSED.yaml\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-storage-r1/rapp-identity-provisioner.PROPOSED.yaml\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-storage-r1/rendered/identity-provisioner.sql\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-storage-r1/rendered/identity-provisioner.yaml\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-storage-r1/source-references.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-storage-r1/source-validation.json\n", + "stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 18, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n", + "push_exit_code": 0, + "push_stdout": "", + "push_stderr": "remote: {\"status\":\"clean\",\"scope\":\"introduced-reachable-git-objects-and-updated-ref-names\",\"scanned_objects\":28,\"scanned_refs\":1,\"scanner_version\":\"8.30.1\"} \nTo forgejo-remote:coulomb/the-custodian.git\n a6eee04..b5c80ce main -> main\n", + "remote_exact": true +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-batch-3.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-batch-3.json new file mode 100644 index 00000000..aaadc722 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-batch-3.json @@ -0,0 +1,31 @@ +{ + "exit_code": 0, + "commit": "43f88d5f7329c9f8e4554efdacca43f5ca67ce98", + "parent": "b5c80ce59565d2107c4f8eeca8171ce325f53e47", + "paths": [ + "docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/one-task.REVIEW.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/pricing-observation.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/runtime-pins.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/source-references.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/source-review.json", + "docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/access-need.json", + "docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/capabilities-evidence.json", + "docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/findings.json", + "docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/manifest.json", + "docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/routing-evidence.json", + "docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/source-history-followthrough-r2.json", + "docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/source-references.json", + "docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/README.md", + "docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/hub-readback.json", + "docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/manifest.json", + "docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/metadata-handoff.template.json", + "docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/rehearsal-cases.json", + "docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/review.json" + ], + "stdout": "[main 43f88d5] Record native security preparation and owner checkpoints (4/7)\n 18 files changed, 1068 insertions(+)\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/one-task.REVIEW.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/pricing-observation.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/runtime-pins.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/source-references.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-r1/source-review.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/README.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/hub-readback.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/metadata-handoff.template.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/rehearsal-cases.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/review.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/access-need.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/capabilities-evidence.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/findings.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/routing-evidence.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/source-history-followthrough-r2.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/storage-share-tls-r1/source-references.json\n", + "stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 18, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n", + "push_exit_code": 0, + "push_stdout": "", + "push_stderr": "remote: {\"status\":\"clean\",\"scope\":\"introduced-reachable-git-objects-and-updated-ref-names\",\"scanned_objects\":26,\"scanned_refs\":1,\"scanner_version\":\"8.30.1\"} \nTo forgejo-remote:coulomb/the-custodian.git\n b5c80ce..43f88d5 main -> main\n", + "remote_exact": true +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-batch-4.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-batch-4.json new file mode 100644 index 00000000..09158d85 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-batch-4.json @@ -0,0 +1,31 @@ +{ + "exit_code": 0, + "commit": "ae055669d0e623040ce4f9ea843e834efa515e91", + "parent": "43f88d5f7329c9f8e4554efdacca43f5ca67ce98", + "paths": [ + "docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/source-references.json", + "docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/OWNER-PLAN.md", + "docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/artifact-manifest.json", + "docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/consumer-proof-interface.json", + "docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/consumer-source-manifest.json", + "docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/consumer_contract_observer.py", + "docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/existing-selector-preflight.json", + "docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/source-checks.json", + "docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/source-references.json", + "docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/test_consumer_contract_observer.py", + "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/artifact-manifest.json", + "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/integration-manifest.json", + "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/integration-result.json", + "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/owner-plan.post.md", + "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/publish_owner.py", + "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/secrets-engine-commit.json", + "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/secrets-engine-consistency.json", + "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/secrets-engine-consistency.stderr.txt" + ], + "stdout": "[main ae05566] Record native security preparation and owner checkpoints (5/7)\n 18 files changed, 1278 insertions(+)\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/artifact-manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/integration-manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/integration-result.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/owner-plan.post.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/publish_owner.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/secrets-engine-commit.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/secrets-engine-consistency.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/secrets-engine-consistency.stderr.txt\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/OWNER-PLAN.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/artifact-manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/consumer-proof-interface.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/consumer-source-manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/consumer_contract_observer.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/existing-selector-preflight.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/source-checks.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/source-references.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/test_consumer_contract_observer.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/scanner-response-r1/source-references.json\n", + "stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 18, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n", + "push_exit_code": 0, + "push_stdout": "", + "push_stderr": "remote: {\"status\":\"clean\",\"scope\":\"introduced-reachable-git-objects-and-updated-ref-names\",\"scanned_objects\":26,\"scanned_refs\":1,\"scanner_version\":\"8.30.1\"} \nTo forgejo-remote:coulomb/the-custodian.git\n 43f88d5..ae05566 main -> main\n", + "remote_exact": true +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-batch-5.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-batch-5.json new file mode 100644 index 00000000..2b241908 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-batch-5.json @@ -0,0 +1,31 @@ +{ + "exit_code": 0, + "commit": "a6d0e1ea3db297010c7cb6a2a05e90291929dcca", + "parent": "ae055669d0e623040ce4f9ea843e834efa515e91", + "paths": [ + "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/secrets-engine-projection.json", + "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/secrets-engine-projection.stderr.txt", + "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/secrets-integration.json", + "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/source.patch", + "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/verification.json", + "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/verified-bindings.json", + "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/workplan.post.md", + "docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/workplan.pre.md", + "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/checkpoint-progress.json", + "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/commit.json", + "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/commit.stderr.txt", + "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/commit.stdout.txt", + "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/consistency.json", + "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/consistency.stderr.txt", + "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/projection.json", + "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/projection.stderr.txt", + "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/publish-before-verifier-refinement.py", + "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/publish.py" + ], + "stdout": "[main a6d0e1e] Record native security preparation and owner checkpoints (6/7)\n 18 files changed, 2334 insertions(+)\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/secrets-engine-projection.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/secrets-engine-projection.stderr.txt\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/secrets-integration.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/source.patch\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/verification.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/verified-bindings.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/workplan.post.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/consumer-outage-owner-followthrough-r1/workplan.pre.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/checkpoint-progress.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/commit.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/commit.stderr.txt\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/commit.stdout.txt\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/consistency.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/consistency.stderr.txt\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/projection.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/projection.stderr.txt\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/publish-before-verifier-refinement.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/publish.py\n", + "stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 17, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n", + "push_exit_code": 0, + "push_stdout": "", + "push_stderr": "remote: {\"status\":\"clean\",\"scope\":\"introduced-reachable-git-objects-and-updated-ref-names\",\"scanned_objects\":22,\"scanned_refs\":1,\"scanner_version\":\"8.30.1\"} \nTo forgejo-remote:coulomb/the-custodian.git\n ae05566..a6d0e1e main -> main\n", + "remote_exact": true +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-batch-6.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-batch-6.json new file mode 100644 index 00000000..113c23c8 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-batch-6.json @@ -0,0 +1,20 @@ +{ + "exit_code": 0, + "commit": "6f61224f12f0be060d2686f0466c80d7274f77cb", + "parent": "a6d0e1ea3db297010c7cb6a2a05e90291929dcca", + "paths": [ + "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/publish_custodian.py", + "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/root-source-review.json", + "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/verification-refusals.json", + "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/verified-bindings.json", + "docs/netkingdom-target-implementation.md", + "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md", + "docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-publication-inputs.json" + ], + "stdout": "[main 6f61224] Record native security preparation and owner checkpoints (7/7)\n 7 files changed, 1046 insertions(+)\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-publication-inputs.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/publish_custodian.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/root-source-review.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/verification-refusals.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/verified-bindings.json\n", + "stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 7, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n", + "push_exit_code": 0, + "push_stdout": "", + "push_stderr": "remote: {\"status\":\"clean\",\"scope\":\"introduced-reachable-git-objects-and-updated-ref-names\",\"scanned_objects\":14,\"scanned_refs\":1,\"scanner_version\":\"8.30.1\"} \nTo forgejo-remote:coulomb/the-custodian.git\n a6d0e1e..6f61224 main -> main\n", + "remote_exact": true +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-consistency.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-consistency.json new file mode 100644 index 00000000..b502b1e1 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-consistency.json @@ -0,0 +1,130 @@ +{ + "repo_slug": "the-custodian", + "repo_path": "/home/worsch/the-custodian", + "source_revision": "6f61224f12f0be060d2686f0466c80d7274f77cb", + "source_revision_reason": null, + "issues": [ + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager warning: workplans/: repository uses more than one workplan prefix: ['CUST-WP', 'THE-WP']", + "file_path": "workplans/", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager contradictory: workplans/ADHOC-2026-08-25-retired.md: workplan id 'CUST-WP-ADHOC-2026-08-25-RETIRED' is not accepted by the canon kind registry", + "file_path": "workplans/ADHOC-2026-08-25-retired.md", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-05", + "message": "Title drift in 'cust-wp-0010': file='Domain and Repository Goals' db='Workplan Lifecycle Documentation' (file wins)", + "file_path": "workplans/CUST-WP-0010b-domain-and-repo-goals.md", + "db_id": "def8455a-9de4-4891-a15a-5b09ca98ab1e", + "file_value": "Domain and Repository Goals", + "db_value": "Workplan Lifecycle Documentation", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'STATE-WP-0092' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md", + "db_id": "", + "file_value": "STATE-WP-0092", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-40", + "message": "blocker satisfied, task still wait: 'CUST-WP-0073-T05' in workplan 'CUST-WP-0073' \u2014 decision 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa is resolved", + "file_path": "workplans/CUST-WP-0073-agent-credential-separation.md#CUST-WP-0073-T05", + "db_id": "", + "file_value": "1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-39", + "message": "Human wait task 'CUST-WP-0079-T06' in workplan 'CUST-WP-0079' has needs_human: true without decision_id \u2014 unrouted human gate", + "file_path": "workplans/CUST-WP-0079-deterministic-security-flow.md#CUST-WP-0079-T06", + "db_id": "", + "file_value": "needs_human: true", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'cust-wp-0010b' (id=416ff571\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "416ff571-18cf-5cb2-9c8b-836f68a301b3", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'interactive-the-custodian@retired-20260828' (id=370c2481\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "370c2481-6806-41eb-a917-f8874f03184f", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'the-custodian-adhoc-2026-07-02@retired-20260827' (id=5c53733b\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "5c53733b-c077-4a93-be66-9c3af8f9b6fd", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'adhoc-2026-05-02@retired-20260827' (id=3f54ce9c\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "3f54ce9c-1f95-42de-894f-0f81a52ba2e8", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'THE-WP-0001' uses prefix 'THE-WP' but repo canonical prefix is 'CUST-WP' \u2014 new plans must conform", + "file_path": "workplans/THE-WP-0001-federation-interface.md", + "db_id": "", + "file_value": "THE-WP-0001", + "db_value": "CUST-WP", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 89/89", + "C-05 fixed: workstream def8455a\u2026 title \u2192 'Domain and Repository Goals'", + "push: pushed" + ], + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 7, + "info": 4 + }, + "result": "warn" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-consistency.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-consistency.stderr.txt new file mode 100644 index 00000000..047afc64 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-consistency.stderr.txt @@ -0,0 +1 @@ +WARN: working-memory commit failed: Generated-only commits rejected: staged diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-projection.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-projection.json new file mode 100644 index 00000000..a663d216 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-projection.json @@ -0,0 +1,292 @@ +{ + "ok": true, + "status": "applied", + "repo_slug": "the-custodian", + "commit": "6f61224f12f0be060d2686f0466c80d7274f77cb", + "requests": 2, + "elapsed_ms": 12228.0, + "git": { + "upstream": "origin/main", + "behind": 0, + "ahead": 0 + }, + "identifiers": { + "schema": "repo-manager.identifier-assignment.v1", + "ok": true, + "executed": true, + "repo": "the-custodian", + "namespace": "helixforge", + "assignments": [], + "historical_invalid_identifiers": [ + { + "kind": "workplan", + "id": "CUST-WP-ADHOC-2026-08-25-RETIRED", + "source": "workplans/ADHOC-2026-08-25-retired.md" + } + ], + "historical_identity_collisions": [], + "files_changed": [] + }, + "receipt": { + "schema": "state-hub.repository-projection-reconcile.v1", + "instance_role": "primary", + "instance_label": "railiance01", + "expected_commit": "6f61224f12f0be060d2686f0466c80d7274f77cb", + "derived_commit": "6f61224f12f0be060d2686f0466c80d7274f77cb", + "outcome": { + "schema": "state-hub.projection-reset.v1", + "repo_slug": "the-custodian", + "commit": "6f61224f12f0be060d2686f0466c80d7274f77cb", + "status": "applied", + "counts": { + "created": 0, + "updated": 88, + "retired": 0, + "refused": 0, + "released": 0, + "created_tasks": 0, + "updated_tasks": 0, + "cancelled_tasks": 0, + "created_edges": 0, + "removed_edges": 0, + "unresolved_edges": 0, + "external_edges": 13 + }, + "created": [], + "updated": [ + "CUST-WP-0000", + "CUST-WP-0000b", + "CUST-WP-0000c", + "CUST-WP-0001", + "CUST-WP-0002", + "CUST-WP-0004", + "CUST-WP-0005", + "CUST-WP-0006", + "CUST-WP-0007", + "CUST-WP-0008", + "CUST-WP-0009", + "CUST-WP-0010", + "CUST-WP-0010b", + "CUST-WP-0013", + "CUST-WP-0014", + "CUST-WP-0015", + "CUST-WP-0016", + "CUST-WP-0017", + "CUST-WP-0017-LEGACY", + "CUST-WP-0018", + "CUST-WP-0019", + "CUST-WP-0020", + "CUST-WP-0021", + "CUST-WP-0022", + "CUST-WP-0023", + "CUST-WP-0024", + "CUST-WP-0025", + "CUST-WP-0026", + "CUST-WP-0027", + "CUST-WP-0028", + "CUST-WP-0029", + "CUST-WP-0030", + "CUST-WP-0031", + "CUST-WP-0032", + "CUST-WP-0033", + "CUST-WP-0034", + "CUST-WP-0035", + "CUST-WP-0036", + "CUST-WP-0037", + "CUST-WP-0039", + "CUST-WP-0040", + "CUST-WP-0041", + "CUST-WP-0043", + "CUST-WP-0044", + "CUST-WP-0045", + "CUST-WP-0046", + "CUST-WP-0047", + "CUST-WP-0048", + "CUST-WP-0049", + "CUST-WP-0050", + "CUST-WP-0051", + "CUST-WP-0052", + "CUST-WP-0053", + "CUST-WP-0053-LEGACY", + "CUST-WP-0054", + "CUST-WP-0055", + "CUST-WP-0056", + "CUST-WP-0057", + "CUST-WP-0058", + "CUST-WP-0059", + "CUST-WP-0060", + "CUST-WP-0061", + "CUST-WP-0062", + "CUST-WP-0063", + "CUST-WP-0064", + "CUST-WP-0065", + "CUST-WP-0066", + "CUST-WP-0067", + "CUST-WP-0068", + "CUST-WP-0069", + "CUST-WP-0070", + "CUST-WP-0071", + "CUST-WP-0072", + "CUST-WP-0073", + "CUST-WP-0074", + "CUST-WP-0075", + "CUST-WP-0076", + "CUST-WP-0077", + "CUST-WP-0078", + "CUST-WP-0079", + "CUST-WP-0080", + "CUST-WP-0081", + "CUST-WP-ADHOC-2026-03-29", + "CUST-WP-ADHOC-2026-05-02", + "CUST-WP-ADHOC-2026-07-02", + "CUST-WP-ADHOC-2026-08-25", + "CUST-WP-ADHOC-2026-09-06", + "THE-WP-0001" + ], + "retired": [], + "released": [], + "created_tasks": [], + "updated_tasks": [], + "cancelled_tasks": [], + "created_edges": [], + "removed_edges": [], + "unresolved_edges": [], + "external_edges": [ + { + "workplan": "CUST-WP-0071", + "from": "CUST-WP-0071-T05", + "target": "CUST-WP-0071-T04", + "relationship_type": "starts_after", + "from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3", + "from_task_id": "20ddd4d7-d85d-5b95-bb0a-7b0ca8af76ca", + "to_workplan_id": null, + "to_task_id": "944f98e2-7e42-5894-925b-752423f3a1cc" + }, + { + "workplan": "CUST-WP-0071", + "from": "CUST-WP-0071-T03", + "target": "CUST-WP-0071-T01", + "relationship_type": "starts_after", + "from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3", + "from_task_id": "6dc67558-eb1e-5bb6-a667-986f884dd495", + "to_workplan_id": null, + "to_task_id": "4ae8eb8d-f8c5-5256-ae50-c323cfd73d7a" + }, + { + "workplan": "CUST-WP-0071", + "from": "CUST-WP-0071-T03", + "target": "CUST-WP-0071-T02", + "relationship_type": "starts_after", + "from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3", + "from_task_id": "6dc67558-eb1e-5bb6-a667-986f884dd495", + "to_workplan_id": null, + "to_task_id": "82192370-2fd7-5363-88d2-3c67889d3d68" + }, + { + "workplan": "CUST-WP-0071", + "from": "CUST-WP-0071-T02", + "target": "CUST-WP-0071-T01", + "relationship_type": "starts_after", + "from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3", + "from_task_id": "82192370-2fd7-5363-88d2-3c67889d3d68", + "to_workplan_id": null, + "to_task_id": "4ae8eb8d-f8c5-5256-ae50-c323cfd73d7a" + }, + { + "workplan": "CUST-WP-0071", + "from": "CUST-WP-0071-T02", + "target": "RAPPS-WP-0014-T03", + "relationship_type": "starts_after", + "from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3", + "from_task_id": "82192370-2fd7-5363-88d2-3c67889d3d68", + "to_workplan_id": null, + "to_task_id": "dd069c6d-fcc1-5bac-b233-976f2f0d5cd1" + }, + { + "workplan": "CUST-WP-0071", + "from": "CUST-WP-0071-T04", + "target": "CUST-WP-0071-T03", + "relationship_type": "starts_after", + "from_workplan_id": "2249bddb-7524-5add-bd5c-c4163a6ca0f3", + "from_task_id": "944f98e2-7e42-5894-925b-752423f3a1cc", + "to_workplan_id": null, + "to_task_id": "6dc67558-eb1e-5bb6-a667-986f884dd495" + }, + { + "workplan": "CUST-WP-0073", + "from": "CUST-WP-0073-T02", + "target": "GLAS-WP-0012", + "relationship_type": "blocks", + "from_workplan_id": "a98a9f34-83b4-5c8c-8107-e05f7806d50d", + "from_task_id": "4b88b0b7-dc7e-5612-aa5d-1a08f0530c35", + "to_workplan_id": "170bf1ae-337f-5553-8d1e-03b07100e08f", + "to_task_id": null + }, + { + "workplan": "CUST-WP-0073", + "from": "CUST-WP-0073-T04", + "target": "CUST-WP-0073-T02", + "relationship_type": "starts_after", + "from_workplan_id": "a98a9f34-83b4-5c8c-8107-e05f7806d50d", + "from_task_id": "90725511-4e31-549f-b567-47feff1a9ca4", + "to_workplan_id": null, + "to_task_id": "4b88b0b7-dc7e-5612-aa5d-1a08f0530c35" + }, + { + "workplan": "CUST-WP-0079", + "from": "CUST-WP-0079-T03", + "target": "ACTIVITY-WP-0047", + "relationship_type": "blocks", + "from_workplan_id": "ab288f92-d364-5c24-9362-aee451f266c3", + "from_task_id": "1be0569c-221d-5925-a0ff-fd2af88e52b1", + "to_workplan_id": "ee97869b-dca2-54c9-aa18-0b479c244fb3", + "to_task_id": null + }, + { + "workplan": "CUST-WP-0079", + "from": "CUST-WP-0079-T04", + "target": "PNEX-WP-0006", + "relationship_type": "blocks", + "from_workplan_id": "ab288f92-d364-5c24-9362-aee451f266c3", + "from_task_id": "5dd52156-09a8-5781-b288-99ae822f59a6", + "to_workplan_id": "774c5037-a3d0-5e65-893c-d18970acd66a", + "to_task_id": null + }, + { + "workplan": "CUST-WP-0080", + "from": "CUST-WP-0080-T04", + "target": "CUST-WP-0080-T03", + "relationship_type": "starts_after", + "from_workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52", + "from_task_id": "82378b0f-7004-5c2f-9683-b356a1227576", + "to_workplan_id": null, + "to_task_id": "87637402-02f1-57c1-8fbc-4141598af8e3" + }, + { + "workplan": "CUST-WP-0080", + "from": "CUST-WP-0080-T05", + "target": "RPF-WP-0056", + "relationship_type": "blocks", + "from_workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52", + "from_task_id": "ed8b909a-23bf-5e5f-b600-e477fbae136b", + "to_workplan_id": "31933d08-c877-5fda-aff9-6220c3705c92", + "to_task_id": null + }, + { + "workplan": "CUST-WP-0080", + "from": "CUST-WP-0080-T05", + "target": "RAPP-PLAYWRIGHT-WP-0004", + "relationship_type": "blocks", + "from_workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52", + "from_task_id": "ed8b909a-23bf-5e5f-b600-e477fbae136b", + "to_workplan_id": "f9280c40-201e-59b5-a6f0-1aace8e0e2e2", + "to_task_id": null + } + ], + "refused": [], + "notes": [ + "Preserved bound historical row and task UUIDs: CUST-WP-ADHOC-2026-08-25-RETIRED" + ] + } + } +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-projection.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/custodian-projection.stderr.txt new file mode 100644 index 00000000..e69de29b diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/unrelated-backup/.custodian-brief.md.worktree b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/unrelated-backup/.custodian-brief.md.worktree new file mode 100644 index 00000000..18bd5dff --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/unrelated-backup/.custodian-brief.md.worktree @@ -0,0 +1,85 @@ + +# Custodian Brief — net-kingdom + +**Domain:** infotech +**Last synced:** 2026-10-16 19:19 UTC +**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* + +## Active Workstreams + +### Publish the NetKingdom emission-cadence security profile +Progress: 5/6 done | workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc` + +**Open tasks:** +- ► Bind and hand off the published contract `e3fbc8b8` + +### Register Playwright human and agent consumers through governed identity delivery +Progress: 1/3 done | workplan_id: `06ba98d5-609e-5aaa-9bf7-4c4f4460e377` + +**Open tasks:** +- ! Verify issuer and real consumer acceptance `5a3aaf57` + *(wait: Await owner-scoped registry/custody activation, native cluster authentication and individual transport, then real human and agent acceptance under CUST-WP-0080-T05.)* +- ► Deliver custody integration and guarded registration activation `a9dadd07` + +### Remove bootstrap secret output and verify separated recovery custody +Progress: 22/31 done | workplan_id: `17d315f0-829e-57c7-85cc-3a7914152804` + +**Open tasks:** +- ! Accept remaining recovery and caller evidence and close the G08 handoff `d68cd4d3` + *(wait: Await the separately tracked native service proofs, current/legacy caller dispositions and residual-scope decisions; archive recovery, backup activation, independent outage retrieval and guide publication are complete.)* +- ! Resolve historical credential and configuration-preserving rotation dispositions `3ea6bf00` + *(wait: Await the caller/consumer ledger, current replacement-lane acceptance and explicit credential-owner dispositions; existing exposure-rotation deferral is unchanged.)* +- ! Verify current caller and provider admission at their actual boundaries `77aa42be` + *(wait: Await the current-caller ledger and exact per-caller owner admission/test inputs; the backup credential grants do not admit unrelated callers.)* +- ! Prove retained privacyIDEA token decryption and existing-token MFA `6f8af1a7` + *(wait: LLDAP T16, token-material T31 and audit T20 passed; await the exact isolated MFA adapter and owner-selected retained-token/factor inputs.)* +- ! Prove restored KeyCape issuer, policy and consumer continuity `141dd773` + *(wait: LLDAP recovery T16 passed; await the exact isolated KeyCape adapter/procedure and retained-token MFA proof for the selected flow.)* +- ! Prove restored Authelia storage and OIDC continuity `b47f9975` + *(wait: LLDAP recovery T16 passed; await the exact isolated Authelia adapter/procedure and private authentication-flow inputs from T15.)* +- ► Map current callers, owners and native acceptance gaps `479d6970` +- … and 2 more open tasks + +### Establish SecurityCaseTypes so that known security cases are light +Progress: 7/9 done | workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb` + +**Open tasks:** +- ! T05 — Acknowledge the type through informed-decision `d9b26bcf` + *(wait: Type1.2 architecture has a confirmed source-only founder acknowledgment; canonical1.1 remains unchanged/default and the1.2 reference case stays proposed. Needs explicit version selection/reference-source integration without normal admission bypass, closed owner adapters plus global/native receipt verifier (WARDEN-WP-0044-T03), independently verified six-object structural materialization and CCR42 claims/created-only provenance, exact broker/case/source reconciliation, then separately authorized native mint/delivery and attended registry/consumer verification. Source acknowledgment, a bundle or local tests do not prove implemented/materialized/live status.)* +- ! T06 — First KnownSecurityCase: Forgejo `c3c9c3ae` + *(wait: The next types follow once the first one is proven end to end.)* + +### Define an execution-attribution receipt for Railiance runs +Progress: 1/2 done | workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487` + +**Open tasks:** +- ! Agree the evidence holder and schema with audit-core and Railiance `963120c1` + *(wait: Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance.)* + +### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker +Progress: 1/9 done | workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07` + +**Open tasks:** +- ! Admit the database consumer `2fe6f100` + *(wait: ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence.)* +- ! Package the broker deployment `32d1411b` + *(wait: ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment.)* +- ! Integrate an upstream identity provider `6697a994` + *(wait: Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence.)* +- ! Define federated assurance `d845380d` + *(wait: Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners.)* +- ! Verify IAM conformance and coexistence `9cb7fd93` + *(wait: Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent.)* +- ! Enforce tenant and platform boundaries `38998c68` + *(wait: Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission.)* +- ! Prove recovery and audit delivery `e5f44ddc` + *(wait: Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent.)* +- … and 1 more open tasks + +--- +## MCP Orientation (when available) + +If the state-hub MCP server is reachable, call: +`get_domain_summary("infotech")` +This provides richer cross-domain context. +If the MCP call fails, use this file as your orientation source. diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/unrelated-backup/WORK-RECORDS.md.worktree b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/unrelated-backup/WORK-RECORDS.md.worktree new file mode 100644 index 00000000..e6f84275 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/unrelated-backup/WORK-RECORDS.md.worktree @@ -0,0 +1,272 @@ +# Work Records — net-kingdom + +> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record +> stage 3). Do not edit by hand — edit the source file/block listed for +> each record and re-run fix-consistency to refresh this index. Archived +> workplans are omitted; closed decisions/intakes/engagements stay listed +> so recently-resolved work is still visible. [auto] + +| Kind | ID | Status | Lane | Source | +| --- | --- | --- | --- | --- | +| workplan | NK-WP-ADHOC-2026-07-02 | finished | — | workplans/ADHOC-2026-07-02.md | +| workplan | NK-WP-ADHOC-2026-08-14 | finished | — | workplans/ADHOC-2026-08-14.md | +| workplan | NK-WP-ADHOC-2026-08-23 | finished | — | workplans/ADHOC-2026-08-23.md | +| workplan | NK-WP-ADHOC-2026-10-03 | finished | — | workplans/ADHOC-2026-10-03.md | +| workplan | NK-WP-ADHOC-2026-10-10 | finished | — | workplans/ADHOC-2026-10-10.md | +| workplan | NK-WP-ADHOC-2026-10-11 | finished | — | workplans/ADHOC-2026-10-11.md | +| workplan | NK-WP-ADHOC-2026-10-16 | finished | — | workplans/ADHOC-2026-10-16.md | +| workplan | NET-WP-0020 | finished | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | +| workplan | NK-WP-0009 | finished | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | +| workplan | NK-WP-0011 | active | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| workplan | NK-WP-0021 | finished | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md | +| workplan | NK-WP-0022 | finished | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| workplan | NK-WP-0023 | finished | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| workplan | NK-WP-0024 | finished | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md | +| workplan | NK-WP-0025 | finished | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | +| workplan | NK-WP-0026 | finished | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md | +| workplan | NK-WP-0027 | backlog | — | workplans/NK-WP-0027-reef-placement-reconciliation.md | +| workplan | NK-WP-0028 | finished | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md | +| workplan | NK-WP-0029 | finished | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md | +| workplan | NK-WP-0030 | finished | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md | +| workplan | NK-WP-0031 | finished | — | workplans/NK-WP-0031-deterministic-posture-feedback.md | +| workplan | NK-WP-0032 | finished | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md | +| workplan | NK-WP-0033 | finished | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md | +| workplan | NK-WP-0034 | finished | — | workplans/NK-WP-0034-verification-that-verifies.md | +| workplan | NK-WP-0035 | active | — | workplans/NK-WP-0035-emission-cadence-security-profile.md | +| workplan | NK-WP-0036 | finished | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | +| workplan | NK-WP-0037 | finished | — | workplans/NK-WP-0037-vergabe-company-welcome.md | +| workplan | NK-WP-0038 | finished | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md | +| workplan | NK-WP-0039 | finished | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md | +| workplan | NK-WP-0040 | active | — | workplans/NK-WP-0040-execution-attribution-receipt.md | +| workplan | NK-WP-0041 | finished | — | workplans/NK-WP-0041-onboarding-journey-usability.md | +| workplan | NK-WP-0042 | finished | — | workplans/NK-WP-0042-workload-mfa-step-up.md | +| workplan | NK-WP-0043 | finished | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md | +| workplan | NK-WP-0044 | finished | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| workplan | NK-WP-0045 | finished | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| workplan | NK-WP-0046 | finished | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md | +| workplan | NK-WP-0047 | finished | — | workplans/NK-WP-0047-platform-password-reset-mail.md | +| workplan | NK-WP-0048 | active | — | workplans/NK-WP-0048-security-case-types.md | +| workplan | NK-WP-0049 | active | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| workplan | NK-WP-0050 | active | — | workplans/NK-WP-0050-playwright-consumer-registration.md | +| workplan | NK-WP-0051 | finished | — | workplans/NK-WP-0051-sign-in-diagnosis.md | +| task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md | +| task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md | +| task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md | +| task | NK-WP-ADHOC-2026-08-14-T02 | done | — | workplans/ADHOC-2026-08-14.md | +| task | NK-WP-ADHOC-2026-08-14-T03 | done | — | workplans/ADHOC-2026-08-14.md | +| task | NK-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md | +| task | NK-WP-ADHOC-2026-10-03-T01 | done | — | workplans/ADHOC-2026-10-03.md | +| task | NK-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md | +| task | NK-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-11-T03 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-11-T04 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-11-T05 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-11-T06 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-11-T07 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-16-T01 | done | — | workplans/ADHOC-2026-10-16.md | +| task | NET-WP-0020-T01 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | +| task | NET-WP-0020-T02 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | +| task | NET-WP-0020-T03 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | +| task | NET-WP-0020-T04 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | +| task | NET-WP-0020-T05 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | +| task | NK-WP-0009-T01 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | +| task | NK-WP-0009-T02 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | +| task | NK-WP-0009-T03 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | +| task | NK-WP-0009-T04 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | +| task | NK-WP-0009-T05 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | +| task | NK-WP-0009-T06 | done | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | +| task | NK-WP-0011-T01 | done | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T02 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T03 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T04 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T05 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T06 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T07 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T08 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0011-T09 | wait | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| task | NK-WP-0021-T01 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md | +| task | NK-WP-0021-T02 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md | +| task | NK-WP-0021-T03 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md | +| task | NK-WP-0021-T04 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md | +| task | NK-WP-0021-T05 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md | +| task | NK-WP-0022-T01 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0022-T02 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0022-T03 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0022-T04 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0022-T05 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0022-T06 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0022-T07 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0022-T08 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | +| task | NK-WP-0023-T01 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0023-T02 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0023-T03 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0023-T04 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0023-T05 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0023-T06 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0023-T07 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0023-T08 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | +| task | NK-WP-0024-T01 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md | +| task | NK-WP-0024-T02 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md | +| task | NK-WP-0024-T03 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md | +| task | NK-WP-0024-T04 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md | +| task | NK-WP-0025-T01 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | +| task | NK-WP-0025-T02 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | +| task | NK-WP-0025-T03 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | +| task | NK-WP-0025-T04 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | +| task | NK-WP-0025-T05 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | +| task | NK-WP-0026-T01 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md | +| task | NK-WP-0026-T02 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md | +| task | NK-WP-0027-T01 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md | +| task | NK-WP-0027-T02 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md | +| task | NK-WP-0027-T03 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md | +| task | NK-WP-0027-T04 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md | +| task | NK-WP-0027-T05 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md | +| task | NK-WP-0027-T06 | todo | — | workplans/NK-WP-0027-reef-placement-reconciliation.md | +| task | NK-WP-0028-T01 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md | +| task | NK-WP-0028-T02 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md | +| task | NK-WP-0028-T03 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md | +| task | NK-WP-0028-T04 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md | +| task | NK-WP-0029-T01 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md | +| task | NK-WP-0029-T02 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md | +| task | NK-WP-0029-T03 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md | +| task | NK-WP-0029-T04 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md | +| task | NK-WP-0030-T01 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md | +| task | NK-WP-0030-T02 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md | +| task | NK-WP-0030-T03 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md | +| task | NK-WP-0030-T04 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md | +| task | NK-WP-0030-T05 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md | +| task | NK-WP-0031-T01 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md | +| task | NK-WP-0031-T02 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md | +| task | NK-WP-0031-T03 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md | +| task | NK-WP-0031-T04 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md | +| task | NK-WP-0031-T05 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md | +| task | NK-WP-0032-T01 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md | +| task | NK-WP-0032-T02 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md | +| task | NK-WP-0032-T03 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md | +| task | NK-WP-0032-T04 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md | +| task | NK-WP-0033-T01 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md | +| task | NK-WP-0033-T02 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md | +| task | NK-WP-0033-T03 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md | +| task | NK-WP-0033-T04 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md | +| task | NK-WP-0033-T05 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md | +| task | NK-WP-0034-T01 | done | — | workplans/NK-WP-0034-verification-that-verifies.md | +| task | NK-WP-0034-T02 | done | — | workplans/NK-WP-0034-verification-that-verifies.md | +| task | NK-WP-0034-T03 | done | — | workplans/NK-WP-0034-verification-that-verifies.md | +| task | NK-WP-0034-T04 | done | — | workplans/NK-WP-0034-verification-that-verifies.md | +| task | NK-WP-0035-T01 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md | +| task | NK-WP-0035-T02 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md | +| task | NK-WP-0035-T03 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md | +| task | NK-WP-0035-T04 | progress | — | workplans/NK-WP-0035-emission-cadence-security-profile.md | +| task | NK-WP-0035-T05 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md | +| task | NK-WP-0035-T06 | done | — | workplans/NK-WP-0035-emission-cadence-security-profile.md | +| task | NK-WP-0036-T01 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | +| task | NK-WP-0036-T02 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | +| task | NK-WP-0036-T03 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | +| task | NK-WP-0036-T04 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | +| task | NK-WP-0036-T05 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | +| task | NK-WP-0036-T06 | done | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | +| task | NK-WP-0037-T01 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md | +| task | NK-WP-0037-T02 | done | — | workplans/NK-WP-0037-vergabe-company-welcome.md | +| task | NK-WP-0038-T01 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md | +| task | NK-WP-0038-T02 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md | +| task | NK-WP-0039-T01 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md | +| task | NK-WP-0039-T02 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md | +| task | NK-WP-0039-T03 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md | +| task | NK-WP-0039-T04 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md | +| task | NK-WP-0040-T01 | done | — | workplans/NK-WP-0040-execution-attribution-receipt.md | +| task | NK-WP-0040-T02 | wait | — | workplans/NK-WP-0040-execution-attribution-receipt.md | +| task | NK-WP-0041-T01 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md | +| task | NK-WP-0041-T02 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md | +| task | NK-WP-0041-T03 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md | +| task | NK-WP-0042-T01 | done | — | workplans/NK-WP-0042-workload-mfa-step-up.md | +| task | NK-WP-0042-T02 | cancel | — | workplans/NK-WP-0042-workload-mfa-step-up.md | +| task | NK-WP-0043-T01 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md | +| task | NK-WP-0043-T02 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md | +| task | NK-WP-0043-T03 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md | +| task | NK-WP-0044-T01 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| task | NK-WP-0044-T02 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| task | NK-WP-0044-T03 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| task | NK-WP-0044-T04 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| task | NK-WP-0044-T05 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| task | NK-WP-0044-T06 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| task | NK-WP-0044-T07 | done | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | +| task | NK-WP-0045-T01 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| task | NK-WP-0045-T02 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| task | NK-WP-0045-T03 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| task | NK-WP-0045-T04 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| task | NK-WP-0045-T05 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| task | NK-WP-0045-T06 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| task | NK-WP-0046-T01 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md | +| task | NK-WP-0046-T02 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md | +| task | NK-WP-0046-T03 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md | +| task | NK-WP-0047-T01 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md | +| task | NK-WP-0047-T02 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md | +| task | NK-WP-0047-T03 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md | +| task | NK-WP-0048-T01 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T02 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T03 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T04 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T05 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T06 | wait | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T07 | wait | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T08 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T09 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T10 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T11 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T12 | todo | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T13 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T14 | todo | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T15 | todo | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T16 | todo | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T17 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T18 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0048-T19 | done | — | workplans/NK-WP-0048-security-case-types.md | +| task | NK-WP-0049-T01 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T02 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T03 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T04 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T05 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T06 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T07 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T08 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T09 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T10 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T11 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T12 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T13 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T14 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T15 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T16 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T17 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T18 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T19 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T20 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T21 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T22 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T23 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T24 | todo | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T25 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T26 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T27 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T28 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T29 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T30 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T31 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T32 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T33 | todo | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0050-T01 | done | — | workplans/NK-WP-0050-playwright-consumer-registration.md | +| task | NK-WP-0050-T02 | progress | — | workplans/NK-WP-0050-playwright-consumer-registration.md | +| task | NK-WP-0050-T03 | wait | — | workplans/NK-WP-0050-playwright-consumer-registration.md | +| task | NK-WP-0051-T01 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md | +| task | NK-WP-0051-T02 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md | +| task | NK-WP-0051-T03 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md | +| task | NK-WP-0051-T04 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md | +| task | NK-WP-0051-T05 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md | +| task | NK-WP-0051-T06 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md | +| intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | +| intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | +| intake | NET-IN-0001 | open | — | intakes/intakes.md | +| intake | NET-IN-0002 | open | — | intakes/intakes.md | +| intake | NET-IN-0003 | open | — | intakes/intakes.md | +| intake | NET-IN-0004 | open | — | intakes/intakes.md | diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/unrelated-backup/originals.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/unrelated-backup/originals.json new file mode 100644 index 00000000..1be7eb91 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r1/unrelated-backup/originals.json @@ -0,0 +1 @@ +{".custodian-brief.md": "100644 ea9ccd0b2bd2cc1ec89723b35c44c53f0d79ba98 0\t.custodian-brief.md\n", "WORK-RECORDS.md": "100644 76a6b7fc304c508f1b50010cb72d892826c6a831 0\tWORK-RECORDS.md\n"} \ No newline at end of file diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r2/publish_owner.py b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r2/publish_owner.py new file mode 100644 index 00000000..59923260 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r2/publish_owner.py @@ -0,0 +1,73 @@ +"""Normal file-scoped owner publication with exact unrelated-state preservation.""" +from pathlib import Path +import argparse +import hashlib +import json +import subprocess +import sys + +parser = argparse.ArgumentParser() +parser.add_argument('manifest', type=Path) +parser.add_argument('phase', choices=['commit', 'sync']) +args = parser.parse_args() +cfg = json.loads(args.manifest.read_text()); here = args.manifest.parent +root = Path('/home/worsch') / cfg['owner']; backup = here / 'publication-backup' +paths = [f['path'] for f in cfg['files']] +def git(*argv): + return subprocess.check_output(['git', '-C', str(root), *argv], stderr=subprocess.PIPE, timeout=40).decode().strip() +def preserve(restore=False): + for row in json.loads((backup / 'originals.json').read_text()): + name = row['path']; raw = (backup / (name + '.worktree')).read_bytes() + if restore: + (root / name).write_bytes(raw) + if row['index']: + mode, oid, stage, path = row['index'].split() + assert stage == '0' + git('update-index', '--cacheinfo', mode, oid, path) + assert (root / name).read_bytes() == raw + assert git('ls-files', '--stage', '--', name) == row['index'] +if args.phase == 'commit': + assert git('rev-parse', 'HEAD') == cfg['base_revision'] + assert git('ls-remote', 'origin', 'refs/heads/main').split()[0] == cfg['base_revision'] + for row in cfg['files']: + assert hashlib.sha256((root / row['path']).read_bytes()).hexdigest() == row['sha256'] + assert not backup.exists(); backup.mkdir() + originals = [] + for name in ['.custodian-brief.md', 'WORK-RECORDS.md']: + if (root / name).exists(): + (backup / (name + '.worktree')).write_bytes((root / name).read_bytes()) + originals.append({'path': name, 'index': git('ls-files', '--stage', '--', name)}) + (backup / 'originals.json').write_text(json.dumps(originals, indent=2) + '\n') + git('add', '--', *paths) + result = subprocess.run(['git', '-C', str(root), 'commit', '--only', '-m', cfg['message'], '--', *paths], + capture_output=True, text=True, timeout=240) + head = git('rev-parse', 'HEAD') + (here / 'publication-commit.json').write_text(json.dumps({'exit_code': result.returncode, 'commit': head, + 'base': cfg['base_revision'], 'files': cfg['files'], 'stdout': result.stdout, 'stderr': result.stderr}, indent=2) + '\n') + preserve() + assert result.returncode == 0, 'normal commit refused; receipt retained' + assert set(git('diff-tree', '--no-commit-id', '--name-only', '-r', head).splitlines()) == set(paths) + print(json.dumps({'status': 'committed', 'owner': cfg['owner'], 'commit': head, 'files': len(paths)})) +else: + head = json.loads((here / 'publication-commit.json').read_text())['commit'] + assert git('rev-parse', 'HEAD') == head + sys.path.insert(0, '/home/worsch/repo-manager/src') + from repo_manager.identifiers import ensure_missing_work_record_identifiers + preview = ensure_missing_work_record_identifiers(root, execute=False) + assert preview['ok'] and not preview['files_changed'] and not preview['assignments'], 'unrelated UUID assignment requires review' + try: + for label, argv, timeout in [ + ('consistency', ['statehub', 'fix-consistency', '--repo', cfg['owner'], '--json'], 300), + ('projection', ['/home/worsch/repo-manager/.venv/bin/rmgr', 'sync', '--path', str(root), '--push'], 180)]: + result = subprocess.run(argv, cwd=root, capture_output=True, text=True, timeout=timeout) + (here / (label + '.json')).write_text(result.stdout) + (here / (label + '.stderr.txt')).write_text(result.stderr) + assert result.returncode == 0, label + ' refused; receipt retained' + finally: + preserve(restore=True) + projection = json.loads((here / 'projection.json').read_text()) + assert projection['status'] == 'applied' and projection['commit'] == head + assert projection['receipt']['expected_commit'] == projection['receipt']['derived_commit'] == head + assert (projection['receipt']['instance_role'], projection['receipt']['instance_label']) == ('primary', 'railiance01') + assert git('ls-remote', 'origin', 'refs/heads/main').split()[0] == head + print(json.dumps({'status': 'applied', 'owner': cfg['owner'], 'commit': head, 'unrelated_work_preserved': True})) diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-0-consistency.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-0-consistency.json new file mode 100644 index 00000000..df4850ab --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-0-consistency.json @@ -0,0 +1,131 @@ +{ + "repo_slug": "the-custodian", + "repo_path": "/home/worsch/the-custodian", + "source_revision": null, + "source_revision_reason": "dirty_workplans", + "issues": [ + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager warning: workplans/: repository uses more than one workplan prefix: ['CUST-WP', 'THE-WP']", + "file_path": "workplans/", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager contradictory: workplans/ADHOC-2026-08-25-retired.md: workplan id 'CUST-WP-ADHOC-2026-08-25-RETIRED' is not accepted by the canon kind registry", + "file_path": "workplans/ADHOC-2026-08-25-retired.md", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-05", + "message": "Title drift in 'cust-wp-0010': file='Domain and Repository Goals' db='Workplan Lifecycle Documentation' (file wins)", + "file_path": "workplans/CUST-WP-0010b-domain-and-repo-goals.md", + "db_id": "def8455a-9de4-4891-a15a-5b09ca98ab1e", + "file_value": "Domain and Repository Goals", + "db_value": "Workplan Lifecycle Documentation", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'STATE-WP-0092' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md", + "db_id": "", + "file_value": "STATE-WP-0092", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-40", + "message": "blocker satisfied, task still wait: 'CUST-WP-0073-T05' in workplan 'CUST-WP-0073' \u2014 decision 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa is resolved", + "file_path": "workplans/CUST-WP-0073-agent-credential-separation.md#CUST-WP-0073-T05", + "db_id": "", + "file_value": "1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-39", + "message": "Human wait task 'CUST-WP-0079-T06' in workplan 'CUST-WP-0079' has needs_human: true without decision_id \u2014 unrouted human gate", + "file_path": "workplans/CUST-WP-0079-deterministic-security-flow.md#CUST-WP-0079-T06", + "db_id": "", + "file_value": "needs_human: true", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'cust-wp-0010b' (id=416ff571\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "416ff571-18cf-5cb2-9c8b-836f68a301b3", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'interactive-the-custodian@retired-20260828' (id=370c2481\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "370c2481-6806-41eb-a917-f8874f03184f", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'adhoc-2026-05-02@retired-20260827' (id=3f54ce9c\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "3f54ce9c-1f95-42de-894f-0f81a52ba2e8", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'the-custodian-adhoc-2026-07-02@retired-20260827' (id=5c53733b\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "5c53733b-c077-4a93-be66-9c3af8f9b6fd", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'THE-WP-0001' uses prefix 'THE-WP' but repo canonical prefix is 'CUST-WP' \u2014 new plans must conform", + "file_path": "workplans/THE-WP-0001-federation-interface.md", + "db_id": "", + "file_value": "THE-WP-0001", + "db_value": "CUST-WP", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 89/89", + "C-17 cleared: pushed 2 backlogged commit(s)", + "C-05 fixed: workstream def8455a\u2026 title \u2192 'Domain and Repository Goals'", + "push: pushed" + ], + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 7, + "info": 4 + }, + "result": "warn" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-0-consistency.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-0-consistency.stderr.txt new file mode 100644 index 00000000..047afc64 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-0-consistency.stderr.txt @@ -0,0 +1 @@ +WARN: working-memory commit failed: Generated-only commits rejected: staged diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-0-projection.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-0-projection.json new file mode 100644 index 00000000..76d3c74b --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-0-projection.json @@ -0,0 +1,8 @@ +{ + "ok": false, + "status": "pending_commit", + "error": "authoritative workplan files have uncommitted changes", + "dirty_paths": [ + "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-0-projection.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-0-projection.stderr.txt new file mode 100644 index 00000000..e69de29b diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-0.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-0.json new file mode 100644 index 00000000..a8d2d2f4 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-0.json @@ -0,0 +1,25 @@ +{ + "parent": "4097a0bfbc42b937f23a06d19d3aa4587c51927f", + "commit": "ffd995213c1d980172598a0f97371e4e9a63c75e", + "paths": [ + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/FINAL-PROPOSAL.md", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/PROCESS-CONTRACT.md", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/action-inputs.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/artifact-manifest.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/build-transfer.py", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/cleanup-upload-staging.py", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/cpu-readonly-observation.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/executable-readonly-observation.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/execute-install.py", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/execution-receipt.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/final-readonly-dry-run.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/frozen-native-argv.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/install-verified.py", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/local-bytecode-refinement.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/local-transfer-check.py", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/local-transfer-verification.json" + ], + "commit_exit_code": 0, + "stdout": "[main ffd9952] Record failed runtime trial and reviewed verification proposal (1/4)\n 16 files changed, 1298 insertions(+)\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/FINAL-PROPOSAL.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/PROCESS-CONTRACT.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/action-inputs.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/artifact-manifest.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/build-transfer.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/cleanup-upload-staging.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/cpu-readonly-observation.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/executable-readonly-observation.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/execute-install.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/execution-receipt.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/final-readonly-dry-run.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/frozen-native-argv.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/install-verified.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/local-bytecode-refinement.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/local-transfer-check.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/local-transfer-verification.json\n", + "stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 16, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-1-consistency.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-1-consistency.json new file mode 100644 index 00000000..d03dd980 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-1-consistency.json @@ -0,0 +1,120 @@ +{ + "repo_slug": "the-custodian", + "repo_path": "/home/worsch/the-custodian", + "source_revision": null, + "source_revision_reason": "dirty_workplans", + "issues": [ + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager warning: workplans/: repository uses more than one workplan prefix: ['CUST-WP', 'THE-WP']", + "file_path": "workplans/", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager contradictory: workplans/ADHOC-2026-08-25-retired.md: workplan id 'CUST-WP-ADHOC-2026-08-25-RETIRED' is not accepted by the canon kind registry", + "file_path": "workplans/ADHOC-2026-08-25-retired.md", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'STATE-WP-0092' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md", + "db_id": "", + "file_value": "STATE-WP-0092", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-40", + "message": "blocker satisfied, task still wait: 'CUST-WP-0073-T05' in workplan 'CUST-WP-0073' \u2014 decision 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa is resolved", + "file_path": "workplans/CUST-WP-0073-agent-credential-separation.md#CUST-WP-0073-T05", + "db_id": "", + "file_value": "1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-39", + "message": "Human wait task 'CUST-WP-0079-T06' in workplan 'CUST-WP-0079' has needs_human: true without decision_id \u2014 unrouted human gate", + "file_path": "workplans/CUST-WP-0079-deterministic-security-flow.md#CUST-WP-0079-T06", + "db_id": "", + "file_value": "needs_human: true", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'cust-wp-0010b' (id=416ff571\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "416ff571-18cf-5cb2-9c8b-836f68a301b3", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'interactive-the-custodian@retired-20260828' (id=370c2481\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "370c2481-6806-41eb-a917-f8874f03184f", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'adhoc-2026-05-02@retired-20260827' (id=3f54ce9c\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "3f54ce9c-1f95-42de-894f-0f81a52ba2e8", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'the-custodian-adhoc-2026-07-02@retired-20260827' (id=5c53733b\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "5c53733b-c077-4a93-be66-9c3af8f9b6fd", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'THE-WP-0001' uses prefix 'THE-WP' but repo canonical prefix is 'CUST-WP' \u2014 new plans must conform", + "file_path": "workplans/THE-WP-0001-federation-interface.md", + "db_id": "", + "file_value": "THE-WP-0001", + "db_value": "CUST-WP", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 89/89", + "C-17 cleared: pushed 2 backlogged commit(s)", + "push: pushed" + ], + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 6, + "info": 4 + }, + "result": "warn" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-1-consistency.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-1-consistency.stderr.txt new file mode 100644 index 00000000..047afc64 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-1-consistency.stderr.txt @@ -0,0 +1 @@ +WARN: working-memory commit failed: Generated-only commits rejected: staged diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-1.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-1.json new file mode 100644 index 00000000..e5cedb84 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-1.json @@ -0,0 +1,25 @@ +{ + "parent": "ffd995213c1d980172598a0f97371e4e9a63c75e", + "commit": "6844177f48e15158678232d8259b87abded67b12", + "paths": [ + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/pre-absolute-path-dry-run.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/process-fixture-results.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/process_supervision.py", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/r1-preservation.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/r1-to-r2.patch", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/r2-initial-readonly-dry-run.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/retained-headroom-refusal.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/retained-local-source-refusal.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/runtime.py", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/target-readonly-addendum.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/target-readonly-observation.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/test_process_supervision.py", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/transfer-archive.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/FINAL-PROPOSAL.md", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/action-inputs.json", + "docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/artifact-manifest.json" + ], + "commit_exit_code": 0, + "stdout": "[main 6844177] Record failed runtime trial and reviewed verification proposal (2/4)\n 16 files changed, 1479 insertions(+)\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/pre-absolute-path-dry-run.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/process-fixture-results.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/process_supervision.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/r1-preservation.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/r1-to-r2.patch\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/r2-initial-readonly-dry-run.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/retained-headroom-refusal.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/retained-local-source-refusal.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/runtime.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/target-readonly-addendum.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/target-readonly-observation.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/test_process_supervision.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r2/transfer-archive.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/FINAL-PROPOSAL.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/action-inputs.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/artifact-manifest.json\n", + "stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 16, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-2-before-concurrent-source.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-2-before-concurrent-source.json new file mode 100644 index 00000000..facb6d0d --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-2-before-concurrent-source.json @@ -0,0 +1,9 @@ +{ + "expected": "6844177f48e15158678232d8259b87abded67b12", + "actual": "08870d65de615cbb8b5e1f374bf53a2229c21930", + "intervening_paths": [ + "docs/changes/netkingdom-target-2026-10-17/nk48-adapters-1.2-review/coordinator-review-r5.json" + ], + "overlap_with_selected_paths": false, + "history_preserved": true +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-2-consistency.json b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-2-consistency.json new file mode 100644 index 00000000..5d9182ff --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-2-consistency.json @@ -0,0 +1,120 @@ +{ + "repo_slug": "the-custodian", + "repo_path": "/home/worsch/the-custodian", + "source_revision": null, + "source_revision_reason": "dirty_workplans", + "issues": [ + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager warning: workplans/: repository uses more than one workplan prefix: ['CUST-WP', 'THE-WP']", + "file_path": "workplans/", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager contradictory: workplans/ADHOC-2026-08-25-retired.md: workplan id 'CUST-WP-ADHOC-2026-08-25-RETIRED' is not accepted by the canon kind registry", + "file_path": "workplans/ADHOC-2026-08-25-retired.md", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'STATE-WP-0092' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md", + "db_id": "", + "file_value": "STATE-WP-0092", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-40", + "message": "blocker satisfied, task still wait: 'CUST-WP-0073-T05' in workplan 'CUST-WP-0073' \u2014 decision 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa is resolved", + "file_path": "workplans/CUST-WP-0073-agent-credential-separation.md#CUST-WP-0073-T05", + "db_id": "", + "file_value": "1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-39", + "message": "Human wait task 'CUST-WP-0079-T06' in workplan 'CUST-WP-0079' has needs_human: true without decision_id \u2014 unrouted human gate", + "file_path": "workplans/CUST-WP-0079-deterministic-security-flow.md#CUST-WP-0079-T06", + "db_id": "", + "file_value": "needs_human: true", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'cust-wp-0010b' (id=416ff571\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "416ff571-18cf-5cb2-9c8b-836f68a301b3", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'interactive-the-custodian@retired-20260828' (id=370c2481\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "370c2481-6806-41eb-a917-f8874f03184f", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'adhoc-2026-05-02@retired-20260827' (id=3f54ce9c\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "3f54ce9c-1f95-42de-894f-0f81a52ba2e8", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'the-custodian-adhoc-2026-07-02@retired-20260827' (id=5c53733b\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "5c53733b-c077-4a93-be66-9c3af8f9b6fd", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'THE-WP-0001' uses prefix 'THE-WP' but repo canonical prefix is 'CUST-WP' \u2014 new plans must conform", + "file_path": "workplans/THE-WP-0001-federation-interface.md", + "db_id": "", + "file_value": "THE-WP-0001", + "db_value": "CUST-WP", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 89/89", + "C-17 cleared: pushed 1 backlogged commit(s)", + "push: pushed" + ], + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 6, + "info": 4 + }, + "result": "warn" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-2-consistency.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-2-consistency.stderr.txt new file mode 100644 index 00000000..047afc64 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/native-source-publication-r3/batch-2-consistency.stderr.txt @@ -0,0 +1 @@ +WARN: working-memory commit failed: Generated-only commits rejected: staged