coulomb/the-custodian
5
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

docs: preserve reviewed NetKingdom session artifacts
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Reject generated-only commits / generated-commit-guard (push) Successful in 14s
Details

Browse source
This commit is contained in:
codex 2026-11-01 22:35:53 +01:00
parent 89c08e7504
commit cec1f5be1c
50 changed files with 12696 additions and 301 deletions
Download patch file Download diff file Expand all files Collapse all files

30
docs/assessments/netkingdom-2026-10-14/attended-custody-login-failure-r1.json Normal file
View file

@ -0,0 +1,30 @@
{
"id": "CUST81-ATTENDED-CUSTODY-LOGIN-FAILURE-R1",
"observed_at": "2026-10-15T02:11:21.901965+00:00",
"source": "founder user_shell_command result",
"command": "run_attended_reader_custody_r1.sh",
"exit_code": 10,
"duration_seconds": 121.2892,
"outcome": "login_failed_closed_before_command_handoff",
"reason": "login client produced non-allowlisted output",
"possible_session_contained": true,
"revocation_confirmed": false,
"provisioning_handoff_executed": false,
"raw_login_output_requested": false,
"approval_remains_valid": "9833715e-a22a-45c0-ab6c-881f0f4f1a0e",
"resumed_blocked_audit": "fresh; transport diagnosis now active",
"cust81-policy-custody-r1.jsonl": {
"exists": false,
"bytes": 0
},
"cust81-forge-reader-r1.jsonl": {
"exists": false,
"bytes": 0
},
"browser_evidence": "Two freshprofiles initialized; founder allseemedfine",
"source_correction": "Globalformatpre-scan honors trailingformat; ordering isdefensive, notprovenfunctionalbug",
"confirmed_dependency_gap": "Fallbackrecoveryregex omittedestate s. tokens; narrowownerfixunder84focusedtests",
"failure_cause": "unproven; existingcapturedloginbytesdiscarded",
"server_correlation": "owner-assembly/oidc-owner-correlation-summary-r1.json",
"correction_receipt": "oidc-diagnostic-finding-correction-r1.json"
}

49
docs/assessments/netkingdom-2026-10-14/attended-custody-login-failure-r2.json Normal file
View file

@ -0,0 +1,49 @@
{
"id": "CUST81-ATTENDED-CUSTODY-LOGIN-FAILURE-R2",
"observed_at": "2026-10-15T02:47:57.569767+00:00",
"source": "founder user_shell_command result",
"command": "run_attended_reader_custody_r1.sh",
"exit_code": 10,
"duration_seconds": 121.1726,
"category": "callback_timeout",
"client_exit": 2,
"helper_present": false,
"stdout_allowed": true,
"stderr_allowed": false,
"outcome": "login_failed_closed_before_command_handoff",
"provisioning_handoff_executed": false,
"revocation_confirmed": false,
"failure_scope": "Callback timeout before handoff; founder confirms actual login did not launch Firefox. Direct adapter.launch connectivity is proven; Bao-to-adapter entrypoint/parser/environment remains under diagnosis.",
"approval_remains_valid": "9833715e-a22a-45c0-ab6c-881f0f4f1a0e",
"raw_login_output_requested": false,
"fresh_resumed_audit": true,
"owner_diagnosis": [
"warden_browser_owner",
"platform_reader_owner"
],
"credential_free_probe": {
"sandbox_powershell": "WSL interop socket denied; not network evidence",
"elevated_windows_http": "Exact Go listener localhost binds127.0.0.1; Windows no-proxy requests to localhost and127.0.0.1 both204/fixedheader verified; IPv6 connection fails as expected for IPv4-only listener. Default callback path generally reachable; no listen-host repair justified.",
"matrix_receipt": "owner-assembly/cust81-windows-go-loopback-matrix-r1.json",
"firefox_r1": "Probe unavailable before GUI; concurrent port use observed. Retained failure, not browser reachability evidence.",
"firefox_r2": {
"status": "browser_reached_listener",
"expected_request_count": 1,
"firefox_launch_returned": true,
"receipt": "owner-assembly/cust81-firefox-loopback-probe-r2-receipt.json"
}
},
"next_action": "Determine whether founder command ran through Codex ! sandbox or separate WSL terminal; actual URL passes parser and elevated Firefox-to-WSL works, while sandbox Windowsinterop fails. Convenience wrapper now fixedPowerShell exit0 preflight before anyOIDC, exit78 if unavailable.",
"founder_clarification": {
"observed_at": "2026-10-15T02:59:15.427688+00:00",
"latest_actual_failed_login": "No new Firefox window opened",
"harmless_diagnostic": "Firefox opened blank http://localhost:8250/cust81-loopback-probe-r1 and exactly1 request verified"
},
"authorization_url_shape": {
"receipt": "owner-assembly/cust81-auth-url-shape-observation-r1.json",
"parser_accepted": true,
"raw_url_retained": false,
"oidc_login_executed": false
},
"shell_isolation_hypothesis": "Strong lead, not confirmed for founder execution yet"
}

35
docs/assessments/netkingdom-2026-10-14/attended-private-registration-before-oci-membership/attended-private-registration-owner-review-r1.json Normal file
View file

@ -0,0 +1,35 @@
{
"id": "CUST81-WARDEN-PRIVATE-WRITER-TRANSPORT-REVIEW-R1",
"revision": 1,
"status": "approved_preparation_integration_only",
"reviewer": "ops-warden-owner (codex worker)",
"authority_basis": "Explicit user worker delegation; CUST-WP-0081-T02 sanctioned writer route preparation. No autonomous grant or credential/live approval.",
"reviewed_at": "2026-10-14T23:57:51.993236+00:00",
"files": {
"attended_private_registration.py": "279cc07bc5a89dccf21b5ae1f89683319560a692f99119a7a6320776f0a87cf9",
"test_attended_private_registration.py": "496319822fe3621b47f8077af67f54b91b405fbdbaf99da3999248a8b5ae7e14",
"register_private_hub_r1.py": "31058fdc9257ce7f15f7cd273dfab1a0c856bb37e1f90bc6ef3a112eb1de163d",
"hub-private-registration-plan-r1.json": "ec0964addcc95a2f0509d70bb58c10006a3d00e1d2479d8678d3b7c6a15602b7"
},
"mason_contract_sha256": "43f80ce86dbc32fcdb9f67d479f43077094ace66a618bde68ed858aa2f3e6e12",
"browser_adapter_sha256": "4b91a4dc635e464143bfe1f484eccb2456ccd992326ac7a126b53d0a9a3c7f96",
"tests_passed": 11,
"no_gui_login_or_credentials": true,
"live_approval_required": true,
"founder_identity_act": "Dedicated member OIDC/MFA after actual hardened rollout and native proofs; writer privileges verified in-memory before Warden route.",
"containment": [
"Token-only and explicit no-store; existing ambient BAO/VAULT/writer credentials removed",
"Exact policy/entity TTL scope; no admin-role fallback",
"Original helper/plan plus exact approval/current rollout/native proof gates before login and after OIDC",
"Fresh isolated Windows Firefox private profile; output-silent browser adapter",
"Warden output/error bytes captured and discarded; no raw error strings in receipts",
"Self-revoke on successful/failed sole-token login, wrong caller, proof rejection, child failure; failed revocation overrides success",
"Caller-owned regular no-follow0600 fsynced append journal"
],
"limits": [
"Offline tests only; actual GUI/callback connectivity unverified",
"Ambiguous multiple login-token output refuses writer and cannot identify a sole token for self-revocation; outcome fails closed and requires owner investigation",
"Close dedicated Firefox after attended operation; task-specific profile remains in Windows temp",
"Fresh rollout/native proofs have a 600-second gate; obtain them immediately before attended writer login"
]
}

245
docs/assessments/netkingdom-2026-10-14/attended-private-registration-before-oci-membership/attended_private_registration.py Normal file
View file

@ -0,0 +1,245 @@
"""Attend the dedicated writer role, register seven approved sources, self-revoke.
No token persistence, raw child/error output, admin authority or browser reuse.
Preapproval and fresh actual-runtime proofs must pass before any login attempt.
"""
from pathlib import Path
import argparse
import hashlib
import importlib.util
import json
import os
import stat
import subprocess
import sys
import tempfile
import threading
import uuid
from datetime import datetime, timezone
import yaml
OUT = Path(__file__).resolve().parent
ROLE = 'reuse-surface-hub-writer-workload-kv-read'
POLICY = 'workload-kv-read-reuse-surface-runtime'
ENTITY = 'c204099b-cb94-363f-e207-5ff4d4aa6e94'
HASHES = {
'register_private_hub_r1.py': '31058fdc9257ce7f15f7cd273dfab1a0c856bb37e1f90bc6ef3a112eb1de163d',
'hub-private-registration-plan-r1.json': 'ec0964addcc95a2f0509d70bb58c10006a3d00e1d2479d8678d3b7c6a15602b7',
}
MASON = Path('/home/worsch/ops-mason/src/ops_mason/attended_login.py')
MASON_SHA = '43f80ce86dbc32fcdb9f67d479f43077094ace66a618bde68ed858aa2f3e6e12'
BROWSER = OUT / 'warden-browser-opener-r1' / 'cmd.exe'
BROWSER_SHA = '4b91a4dc635e464143bfe1f484eccb2456ccd992326ac7a126b53d0a9a3c7f96'
MAX_BYTES = 65536
def module(path, name, expected):
if hashlib.sha256(path.read_bytes()).hexdigest() != expected:
raise ValueError('reviewed_input_changed')
spec = importlib.util.spec_from_file_location(name, path)
if spec is None:
from importlib.machinery import SourceFileLoader
spec = importlib.util.spec_from_loader(name, SourceFileLoader(name, str(path)))
result = importlib.util.module_from_spec(spec)
spec.loader.exec_module(result)
return result
def prepare(args):
for name, expected in HASHES.items():
if hashlib.sha256((OUT / name).read_bytes()).hexdigest() != expected:
raise ValueError('reviewed_input_changed')
helper = module(OUT / 'register_private_hub_r1.py', 'cust81_private_helper', HASHES['register_private_hub_r1.py'])
paths = [OUT / 'register_private_hub_r1.py', helper.PLAN, helper.PUBLIC,
helper.DISCLOSURE, helper.CONSENT, args.rollout_proof, args.native_proof]
helper.public_tools()
helper.gates(helper.load(helper.PLAN), helper.load(args.approval),
helper.load(args.rollout_proof), helper.load(args.native_proof), paths)
if not args.kubeconfig.is_file():
raise ValueError('kubeconfig_unavailable')
mason = module(MASON, 'cust81_mason_attended_contract', MASON_SHA)
browser = module(BROWSER, 'cust81_private_browser_adapter', BROWSER_SHA)
return helper, mason, browser
def append(path, event):
fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_APPEND | os.O_NOFOLLOW, 0o600)
try:
info = os.fstat(fd)
if (not stat.S_ISREG(info.st_mode) or info.st_uid != os.getuid()
or stat.S_IMODE(info.st_mode) != 0o600):
raise ValueError('journal_custody')
data = memoryview((json.dumps(event, sort_keys=True) + '\n').encode())
while data:
count = os.write(fd, data)
if not count:
raise OSError('journal_write')
data = data[count:]
os.fsync(fd)
finally:
os.close(fd)
def verify_caller(raw):
if len(raw) > MAX_BYTES:
raise ValueError('lookup_size')
data = json.loads(raw)['data']
ttl = data.get('ttl')
if (data.get('policies') != [POLICY] or data.get('identity_policies') not in (None, [])
or data.get('entity_id') != ENTITY or type(ttl) is not int
or not 0 < ttl <= 1800):
raise ValueError('scoped_caller_mismatch')
def extract_token(raw, matcher):
# Extract for self-revocation even if surrounding login output is invalid.
if len(raw) > MAX_BYTES:
return ''
found = matcher.findall(raw)
return found[0] if len(found) == 1 else ''
def child_args(args):
return ['warden', 'access', 'reuse-surface-hub-write-token', '--exec', '--field',
'REUSE_SURFACE_TOKEN', '--', 'python3', str(OUT / 'register_private_hub_r1.py'),
'--apply', '--approval', str(args.approval), '--rollout-proof', str(args.rollout_proof),
'--native-proof', str(args.native_proof), '--kubeconfig', str(args.kubeconfig)]
def execute(args, helper, mason, browser, record):
env = os.environ.copy()
for key in ('BAO_TOKEN', 'VAULT_TOKEN', 'BAO_LOG_LEVEL', 'VAULT_LOG_LEVEL',
'BAO_LOG_FORMAT', 'VAULT_LOG_FORMAT', 'REUSE_SURFACE_TOKEN'):
env.pop(key, None)
env['BAO_ADDR'] = env['VAULT_ADDR'] = 'http://127.0.0.1:18200'
attempt = {'attempt_id': str(uuid.uuid4()), 'at': datetime.now(timezone.utc).isoformat(),
'proposal_id': 'CUST81-PRIVATE-REGISTRATION-EXECUTION-R1', 'revision': 1,
'approval_sha256': hashlib.sha256(args.approval.read_bytes()).hexdigest(),
'login': False, 'warden_exit': None, 'revoked': None, 'outcome': 'started'}
record(attempt.copy()) # Establish durable audit before any login.
token = ''
result_code = 1
proc = None
timer = None
with tempfile.TemporaryDirectory(prefix='cust81-private-warden-state-') as state:
config = yaml.safe_load(Path('/home/worsch/.config/warden/warden.yaml').read_text())
if not isinstance(config, dict):
raise ValueError('warden_config_shape')
config['state_dir'] = state
config_path = Path(state) / 'warden.yaml'
fd = os.open(config_path, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600)
with os.fdopen(fd, 'w') as stream:
stream.write(yaml.safe_dump(config, sort_keys=False))
stream.flush()
os.fsync(stream.fileno())
env['WARDEN_CONFIG'] = str(config_path)
try:
# token-only does not store; explicit no-store guards helper persistence.
proc = subprocess.Popen(['bao', *mason.login_args('netkingdom', ROLE), '-no-store'],
env=env, stdin=subprocess.DEVNULL, stdout=subprocess.PIPE,
stderr=subprocess.PIPE, text=True)
timer = threading.Timer(150, proc.kill)
timer.start()
failures = []
browser_opened = []
def pump():
while True:
line = proc.stderr.readline(MAX_BYTES + 1)
if not line:
break
if len(line) > MAX_BYTES:
failures.append('login_stream_size')
proc.kill()
break
kind = mason.classify_login_line(line)
if kind == 'url':
try:
if browser_opened:
raise ValueError('duplicate_browser_request')
browser_opened.append(True)
url = browser.parse_args('xdg-open', [line.strip()])
browser.launch(url)
print('Firefox opened in a fresh private profile; complete member login and MFA.', flush=True)
except Exception:
failures.append('browser_unavailable')
proc.kill()
break
elif kind == 'error':
# Raw error text never reaches receipts, stdout or exceptions.
if not failures:
failures.append('login_error')
reader = threading.Thread(target=pump, daemon=True)
reader.start()
raw = proc.stdout.read(MAX_BYTES + 1).strip()
token = extract_token(raw, mason.TOKEN_RE)
if len(raw) > MAX_BYTES:
proc.kill()
proc.wait(timeout=155)
timer.cancel()
reader.join(timeout=5)
if proc.returncode or mason.TOKEN_RE.fullmatch(raw) is None or failures or reader.is_alive():
attempt['outcome'] = 'login_refused'
else:
attempt['login'] = True
env['BAO_TOKEN'] = token
lookup = subprocess.run(['bao', 'token', 'lookup', '-format=json'], env=env,
capture_output=True, text=True, timeout=30)
if lookup.returncode:
raise ValueError('lookup_failed')
verify_caller(lookup.stdout)
attempt['entity_id'] = ENTITY
# Recheck proof freshness and exact artifact approval after OIDC.
paths = [OUT / 'register_private_hub_r1.py', helper.PLAN, helper.PUBLIC,
helper.DISCLOSURE, helper.CONSENT, args.rollout_proof, args.native_proof]
helper.gates(helper.load(helper.PLAN), helper.load(args.approval),
helper.load(args.rollout_proof), helper.load(args.native_proof), paths)
print('Dedicated caller verified; registering the seven approved sources.', flush=True)
result = subprocess.run(child_args(args), env=env, capture_output=True, timeout=600)
attempt['warden_exit'] = result.returncode
result_code = result.returncode
attempt['outcome'] = 'writer_returned'
except Exception:
attempt['outcome'] = 'stopped_inspect_receipts_before_retry'
result_code = 1
finally:
if timer:
timer.cancel()
if proc and proc.poll() is None:
proc.kill()
proc.wait(timeout=10)
if token:
env['BAO_TOKEN'] = token
try:
revoked = subprocess.run(['bao', 'token', 'revoke', '-self'], env=env,
capture_output=True, timeout=30)
attempt['revoked'] = revoked.returncode == 0
except Exception:
attempt['revoked'] = False
env.pop('BAO_TOKEN', None)
token = ''
if attempt['revoked'] is not True:
result_code = 1
print('Scoped session revocation confirmed: ' + str(attempt['revoked']), flush=True)
attempt['finished_at'] = datetime.now(timezone.utc).isoformat()
record(attempt)
return result_code
def main():
parser = argparse.ArgumentParser(description=__doc__)
parser.add_argument('--apply', action='store_true', required=True)
for name in ('approval', 'rollout-proof', 'native-proof', 'kubeconfig'):
parser.add_argument('--' + name, type=Path, required=True)
args = parser.parse_args()
helper, mason, browser = prepare(args)
return execute(args, helper, mason, browser,
lambda event: append(OUT / 'attended-private-registration-receipts.jsonl', event))
if __name__ == '__main__':
try:
sys.exit(main())
except Exception:
print('Attended private registration refused; inspect bounded receipts.', file=sys.stderr)
sys.exit(1)

29
docs/assessments/netkingdom-2026-10-14/attended-private-registration-order-owner-review-r2.json Normal file
View file

@ -0,0 +1,29 @@
{
"id": "CUST81-WARDEN-PRIVATE-WRITER-TRANSPORT-ORDER-REVIEW-R2",
"reviewer": "ops-warden-owner (codex worker)",
"status": "approved_preparation_integration_only",
"reviewed_at": "2026-10-15T03:21:13.798940+00:00",
"amendment_sha256": "c8fa74ad6648af1c884a4c607e100097f917761af5d3a6e0c5e8ce9a53b809dc",
"original_approved_sha256": "56806b127b6a926361ef82c2b53732ef71fb385bcc0b918ae4e4d815015e6966",
"candidate_sha256": "1ec34b8cded859845dc29cedf55ff02fa4881bd4d6a3a264879efd5b3e706c88",
"exact_one_line_replacement_verified": true,
"retained": [
"Explicit no-store now precedes all auth data",
"Existing token-only contract also implies no-store",
"Exact dedicated role/path and skip_browser=true",
"Exact policy/entity/TTL and no-identity-policies checks",
"External approval, pinned helper/plan and fresh runtime/native proof gates before and after OIDC",
"Captured-output suppression, no-follow0600 fsynced journal, in-memory token and finally self-revocation",
"No provisioning replay, credential/repo scope expansion or alternate writer route"
],
"independent_checks": {
"transport_tests_passed": 11,
"registration_helper_tests_passed": 14,
"constructed_current_contract_all_flags_before_auth_data": true,
"amendment_hash_verified": true
},
"proof_review": "Reviewed private-writer-cli-order-failure-r1.json: original trailing flag becomes malformed K=V before network; corrected closed-loopback probe reaches connection-refused. This worker did not rerun Bao/login.",
"prior_test_gap": "Original transport tests asserted flag presence but did not enforce flag order; they missed the pre-auth CLI parsing failure. The original approval and failed live outcome remain preserved.",
"live_execution_or_login_performed": false,
"founder_approval_still_required": true
}

42
docs/assessments/netkingdom-2026-10-14/attended-private-registration-owner-review-r1.json Normal file
View file

@ -0,0 +1,42 @@
{
"id": "CUST81-WARDEN-PRIVATE-WRITER-TRANSPORT-REVIEW-R1",
"revision": 2,
"status": "approved_preparation_integration_only",
"reviewer": "ops-warden-owner (codex worker)",
"authority_basis": "Explicit user worker delegation; CUST-WP-0081-T02 sanctioned writer route preparation. No autonomous grant or credential/live approval.",
"reviewed_at": "2026-10-14T23:59:41.682862+00:00",
"files": {
"attended_private_registration.py": "56806b127b6a926361ef82c2b53732ef71fb385bcc0b918ae4e4d815015e6966",
"test_attended_private_registration.py": "fd3cc6f564e2e81f0a514233a20c4add45cbd580e4e624d52bda9eb40c6bb642",
"register_private_hub_r1.py": "de431eb2942d469eaad0e7e167ebfb98a717c6fa2a92b7cd987333d764792113",
"hub-private-registration-plan-r1.json": "ec0964addcc95a2f0509d70bb58c10006a3d00e1d2479d8678d3b7c6a15602b7",
"hardened-reader-image-publication-r1.json": "f4ba7eff3d34dd732876b6dbba619f8c901ce9c2519b6d660101330f935a6c14"
},
"mason_contract_sha256": "43f80ce86dbc32fcdb9f67d479f43077094ace66a618bde68ed858aa2f3e6e12",
"browser_adapter_sha256": "4b91a4dc635e464143bfe1f484eccb2456ccd992326ac7a126b53d0a9a3c7f96",
"tests_passed": 11,
"no_gui_login_or_credentials": true,
"live_approval_required": true,
"founder_identity_act": "Dedicated member OIDC/MFA after actual hardened rollout and native proofs; writer privileges verified in-memory before Warden route.",
"containment": [
"Token-only and explicit no-store; existing ambient BAO/VAULT/writer credentials removed",
"Exact policy/entity TTL scope; no admin-role fallback",
"Original helper/plan plus exact approval/current rollout/native proof gates before login and after OIDC",
"Fresh isolated Windows Firefox private profile; output-silent browser adapter",
"Warden output/error bytes captured and discarded; no raw error strings in receipts",
"Self-revoke on successful/failed sole-token login, wrong caller, proof rejection, child failure; failed revocation overrides success",
"Caller-owned regular no-follow0600 fsynced append journal"
],
"limits": [
"Offline tests only; actual GUI/callback connectivity unverified",
"Ambiguous multiple login-token output refuses writer and cannot identify a sole token for self-revocation; outcome fails closed and requires owner investigation",
"Close dedicated Firefox after attended operation; task-specific profile remains in Windows temp",
"Fresh rollout/native proofs have a 600-second gate; obtain them immediately before attended writer login"
],
"refinement": {
"same_trial": true,
"previous_review_sha256": "fc147c1fdf782a11a9277412eae7e87e01c7a633e8149885d8685eeb2f452352",
"preserved_under": "attended-private-registration-before-oci-membership/",
"reason": "Successor private helper verifies Deployment/Pod pinned index plus exact registry repository and OCI index/approved linuxamd64 child membership. Both transport pre-login and post-OIDC gates now include immutable image-publication evidence required by helper."
}
}

2
docs/assessments/netkingdom-2026-10-14/attended-public-registration-receipts.jsonl Normal file
View file

@ -0,0 +1,2 @@
{"at": "2026-10-14T22:13:41.969079+00:00", "attempt_id": "8c160098-587b-426c-9f9f-33f57de30c92", "finished_at": "2026-10-14T22:15:54.561630+00:00", "login": false, "login_error": "Error authenticating: timed out waiting for response from provider", "proposal_id": "CUST81-REUSE-PUBLIC-REGISTRATION-R1", "revision": 1, "revoked": null, "warden_exit": null, "warden_state": "/tmp/custodian-warden-state-0x5_fd96"}
{"at": "2026-10-14T22:18:17.520607+00:00", "attempt_id": "23c02e30-1a4c-4bc1-a3dc-45c9bf7ce962", "entity_id": "c204099b-cb94-363f-e207-5ff4d4aa6e94", "finished_at": "2026-10-14T22:19:26.523659+00:00", "login": true, "proposal_id": "CUST81-REUSE-PUBLIC-REGISTRATION-R1", "revision": 1, "revoked": true, "warden_exit": 0, "warden_state": "/tmp/custodian-warden-state-bpn99gi5"}

30
docs/assessments/netkingdom-2026-10-14/attended-reader-custody-wait-audit-r1.json Normal file
View file

@ -0,0 +1,30 @@
{
"checked_at": "2026-10-15T03:21:25.946727+00:00",
"previous_goal_turn": "no progress: second consecutive verified impasse awaiting attended execution",
"current_goal_turn": "progress: actualcustody/phaseBnative14 verified; writerCLIdefect reproducedandone-line revision2 prepared with25tests; exactamendmentpendingfounderdisposition",
"consistency": {
"session": 44500,
"terminal": true,
"exit_code": 0,
"automation_errors": 0,
"assessment_failures": 0,
"warnings": 8,
"task_description_and_waitqualifiers_synced": true,
"generated_commit_guard": "rejected; no bypass"
},
"attendance_block": {
"condition": "Await exact revision2 founder disposition before corrected writer execution",
"consecutive_impasse_turns": 0,
"approval_remains_valid": true,
"custody_receipts_present": true,
"live_process_confirmed": false,
"human_command": "docs/assessments/netkingdom-2026-10-14/run_attended_reader_custody_r1.sh",
"next_action": "After actual approval, record disposition and amendedexecutabledigest; refresh actualsamepodproofs, derive8artifactapproval, scopedwriterregistration/final70audit"
},
"reader_delivery_executed": true,
"private_registrations_executed": false,
"goal_complete": false,
"blocked_threshold_satisfied": false,
"no_available_independent_required_work": "Corrected exactprivileged executable revision2 requires supervisorreview; allpreparation/tests complete, no correctedliveexecution permitted yet.",
"resumed_blocked_audit": "fresh after explicit userresume and actualattempt"
}

158
docs/assessments/netkingdom-2026-10-14/attended_public_registration.py Normal file
View file

@ -0,0 +1,158 @@
"""Attend scoped OIDC, run the unchanged public registration helper, revoke.
No login token is printed or saved. Windows Firefox uses a new temporary
profile and a private window, so existing Authelia sessions are not reused.
"""
from pathlib import Path
import argparse
import hashlib
import json
import os
import subprocess
import sys
import tempfile
import threading
import uuid
from datetime import datetime, timezone
from contextlib import nullcontext
from urllib.parse import urlsplit
import yaml
OUT = Path(__file__).resolve().parent
sys.path.insert(0, '/home/worsch/ops-mason/src')
from ops_mason.attended_login import TOKEN_RE, classify_login_line, login_args, openbao_error_text
ROLE = 'reuse-surface-hub-writer-workload-kv-read'
POLICY = 'workload-kv-read-reuse-surface-runtime'
HASHES = {
'hub-public-registration-proposal-r1.json': '84811121ae8d00970927b97bd6125b6a91989cce46dbe6b75a24592e15c16ca1',
'hub-public-resume-plan.json': '768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b',
'register_public_hub.py': 'c6a5f08e01af3a5c4b1d6557859f4400eaba0d7eb0bb1976f45bba6bc5a05fda',
'test_register_public_hub.py': '519cd624eef4ad3c0ed97ab686368b4ffb26985066c8baa2d804e1c6c1af8e02',
}
def main():
parser = argparse.ArgumentParser(description=__doc__)
parser.add_argument('--apply', action='store_true', required=True)
parser.parse_args()
for filename, expected in HASHES.items():
if hashlib.sha256((OUT / filename).read_bytes()).hexdigest() != expected:
raise RuntimeError('prepared public proposal inputs changed')
env = os.environ.copy()
for name in ('BAO_TOKEN', 'VAULT_TOKEN', 'BAO_LOG_LEVEL', 'VAULT_LOG_LEVEL'):
env.pop(name, None)
env['BAO_ADDR'] = env['VAULT_ADDR'] = 'http://127.0.0.1:18200'
attempt = {'attempt_id': str(uuid.uuid4()), 'at': datetime.now(timezone.utc).isoformat(),
'proposal_id': 'CUST81-REUSE-PUBLIC-REGISTRATION-R1', 'revision': 1,
'login': False, 'warden_exit': None, 'revoked': None}
token = ''
profile_id = 'custodian-oidc-' + attempt['attempt_id']
windows_temp = subprocess.run(
['powershell.exe', '-NoProfile', '-NonInteractive', '-Command',
'[System.IO.Path]::GetTempPath()'], capture_output=True, text=True, check=True,
timeout=20).stdout.strip()
if not windows_temp or '\n' in windows_temp or not windows_temp[1:3] == ':\\':
raise RuntimeError('Windows temporary profile location unavailable')
windows_profile = windows_temp.rstrip('\\') + '\\' + profile_id
linux_profile = subprocess.run(['wslpath', '-u', windows_profile], capture_output=True,
text=True, check=True, timeout=10).stdout.strip()
Path(linux_profile).mkdir(mode=0o700)
with nullcontext(tempfile.mkdtemp(prefix='custodian-warden-state-')) as state:
attempt['warden_state'] = state
config = yaml.safe_load(Path('/home/worsch/.config/warden/warden.yaml').read_text())
config['state_dir'] = state
config_path = Path(state) / 'warden.yaml'
config_path.write_text(yaml.safe_dump(config, sort_keys=False))
config_path.chmod(0o600)
env['WARDEN_CONFIG'] = str(config_path)
try:
proc = subprocess.Popen(['bao', *login_args('netkingdom', ROLE)], env=env,
stdin=subprocess.DEVNULL, stdout=subprocess.PIPE,
stderr=subprocess.PIPE, text=True)
errors = []
browser_errors = []
def pump():
for line in proc.stderr:
kind = classify_login_line(line)
if kind == 'url':
url = line.strip()
parsed = urlsplit(url)
if parsed.scheme != 'https' or not parsed.hostname or parsed.username:
browser_errors.append('unexpected OIDC URL')
proc.terminate()
continue
try:
subprocess.Popen(
['/mnt/c/Program Files/Mozilla Firefox/firefox.exe',
'-no-remote', '-profile', windows_profile, '-new-instance',
'-private-window', url], stdout=subprocess.DEVNULL,
stderr=subprocess.DEVNULL, start_new_session=True)
print('Firefox opened in a fresh private profile; complete member login and MFA.', flush=True)
except OSError:
browser_errors.append('Firefox launch failed')
proc.terminate()
elif kind == 'error':
errors.append(line)
reader = threading.Thread(target=pump, daemon=True)
reader.start()
login_output = proc.stdout.read().strip()
token_match = TOKEN_RE.search(login_output)
token = token_match.group(0) if token_match else ''
proc.wait()
reader.join(timeout=5)
if proc.returncode or TOKEN_RE.fullmatch(login_output) is None or browser_errors:
attempt['login_error'] = openbao_error_text(errors)[:1200] or '; '.join(browser_errors) or 'login failed'
print(attempt['login_error'], flush=True)
return 1
attempt['login'] = True
env['BAO_TOKEN'] = token
lookup = subprocess.run(['bao', 'token', 'lookup', '-format=json'], env=env,
capture_output=True, text=True, timeout=30)
if lookup.returncode:
raise RuntimeError('scoped token lookup failed')
data = json.loads(lookup.stdout)['data']
if (set(data.get('policies', [])) != {POLICY} or data.get('identity_policies')
or data.get('entity_id') != 'c204099b-cb94-363f-e207-5ff4d4aa6e94'
or not 0 < int(data.get('ttl', 0)) <= 1800):
raise RuntimeError('caller does not match the dedicated role boundary')
attempt['entity_id'] = data.get('entity_id')
print('Dedicated caller verified; applying the unchanged 31-public-repository plan.', flush=True)
result = subprocess.run(
['warden', 'access', 'reuse-surface-hub-write-token', '--exec', '--field',
'REUSE_SURFACE_TOKEN', '--', 'python3', str(OUT / 'register_public_hub.py'), '--apply'],
env=env, capture_output=True, timeout=600)
attempt['warden_exit'] = result.returncode
print('Warden returned status ' + str(result.returncode) + '; durable hub receipts require readback.', flush=True)
return result.returncode
finally:
if token:
env['BAO_TOKEN'] = token
try:
revocation = subprocess.run(['bao', 'token', 'revoke', '-self'], env=env,
capture_output=True, timeout=30)
attempt['revoked'] = revocation.returncode == 0
except Exception:
attempt['revoked'] = False
env.pop('BAO_TOKEN', None)
token = ''
print('Scoped session revocation confirmed: ' + str(attempt['revoked']), flush=True)
attempt['finished_at'] = datetime.now(timezone.utc).isoformat()
receipt = OUT / 'attended-public-registration-receipts.jsonl'
fd = os.open(receipt, os.O_WRONLY | os.O_CREAT | os.O_APPEND, 0o600)
try:
os.write(fd, (json.dumps(attempt, sort_keys=True) + '\n').encode())
os.fsync(fd)
finally:
os.close(fd)
if __name__ == '__main__':
try:
sys.exit(main())
except Exception as exc:
print('Attended run stopped: ' + type(exc).__name__, file=sys.stderr)
sys.exit(1)

61
docs/assessments/netkingdom-2026-10-14/hardened-reader-local-image-r1.json Normal file
View file

@ -0,0 +1,61 @@
{
"created_at": "2026-10-14T22:55:37.628846+00:00",
"status": "local_hardened_image_built_and_smoke_verified",
"tag": "cust81-reuse-surface:reader-r1",
"local_image_manifest_digest": "sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0",
"platform": "linux/amd64",
"base_image_digest": "sha256:78387bc3881b8273120a12ebe6c1ab22b018ccc2c9adf565ae1ac9b536e184ea",
"published": false,
"deployed": false,
"credentials_provisioned": false,
"context_file_hashes": {
"Dockerfile": "004ccbd1aafccada16635993e6634cfeadcc5f4aa332ff84395f3888744ca769",
"README.md": "6e4dc8d382612320cc2c8558ad583b0564ff594a7032b33137cb7a61887621cc",
"pyproject.toml": "c208dda78bc490a03310cae2cc4d1b774973caddd8cecbcdf9efc35efa8acf49",
"reuse_surface/__init__.py": "c0c598dada3cd7dfcf87c3bf0562a2b4454f6c569e4fd248f2105a0404367277",
"reuse_surface/catalog.py": "df4ae59123f900cf396c857853b9c3e88f0fad9ad18b3a26c295cc2067119dcb",
"reuse_surface/cli.py": "da968735cb45dc9944c3a722234641e17cd49a6bef9aa91f40e78ddde3fb9c0e",
"reuse_surface/establish.py": "58e05d8572506c03cdd83598e823df63872cbc9a6f0d0c94897dd5d5829c3fc9",
"reuse_surface/federation.py": "dbaa40f25cc0f090143578cd1c7068cb2cb00960fafd17d5239bf8a5bac514dd",
"reuse_surface/forge_host.py": "9900ce52d478250d39609fb6fadf2aae17acc8cbb3b66bd8117a58e9b3571fe4",
"reuse_surface/graph.py": "6ccca1ab09d13caf8aae4490ec86e8431784aeb96414550e90e181a418599406",
"reuse_surface/hub/__init__.py": "19266d0b695aa6ba7e5efda5ce8b3c2baa1925d92cec3c129a01ca436be64440",
"reuse_surface/hub/app.py": "19bdc8331d62df69b1df65958e107639d13a2d0c3e3202786c9127f1f4cc68f3",
"reuse_surface/hub/compose.py": "ded3838e664d8c680171b9ffefeeaa5189aeba056f572d0c33778d35c760937d",
"reuse_surface/hub/hub-registration.schema.yaml": "8b1d838a13f505b27abcae018db098f2abb14882f95bc5095fd967a0997bad09",
"reuse_surface/hub/store.py": "806fb8b70e55f80c819c6fff8d45956f324c74ea41897f32d3a115bc17c0d8b5",
"reuse_surface/hub/webhooks.py": "88c0706d9884e8cc3b3149985ab59228e32ac73c568b1f9285094876dd372cbd",
"reuse_surface/hub_client.py": "12d626992963fb60abdcd4d7a6c1df7eb9b29f0ea1a33616ff3a82846e9497df",
"reuse_surface/hub_sync.py": "ba6390c563507e86e8ed45d887bc925b96ecfbeabc4a9e03f60f8871b147fb60",
"reuse_surface/interactive.py": "572fccd3933947d0ad9a747971d157d57ecd6cb9031401e780c1e014dd6fd0e8",
"reuse_surface/llm_bridge.py": "b0511ce17400f896bc7e0ebdad4b17fe1ef16129dd1558705c277d32cf158cb5",
"reuse_surface/maintain.py": "7a52fa965102df4837ab6d238ddba2dc9cc3608e0c04d9705311ff2333ce648c",
"reuse_surface/maintain_llm.py": "b8a085a4d015368d94dece921a2a143b11c229ddb412dfd630168a4cf4a3751f",
"reuse_surface/overlaps.py": "815ea57f3e0d438c22a9df5d04893e99efc8172f93c3cbea77e65acb2b270ef3",
"reuse_surface/patches.py": "7de8fe12e6b91ec0ac897cd9baa0efabe436b0b6885f6429d9cceb6ed8ca03af",
"reuse_surface/plan_check.py": "17cfac48ec1cd5baafd4466991a8f8fc146d0107c80d8dae3c8a0514281a863d",
"reuse_surface/plan_snapshot.py": "1c020e77786d179cc2f20cb554b63051b3cb77ed31dfa06b2de76ef0bec07ae0",
"reuse_surface/private_source_verify.py": "c67a284091cc4dd62dca56658a14b8ea1357e2b3df1518120da4c51e0ee8d85c",
"reuse_surface/registry.py": "14b910a9088ef8bc9b8b68256dcf3201e2f8dad418c7b405ca67da503f1561aa",
"reuse_surface/registry_update.py": "b44cdec110d1b3070c9939969288e10aa3bf1ebb01aed9fe7bf17c47a2db474b",
"reuse_surface/reports.py": "20f15564500d0686dea540b7ba18e53d38f672867e47ce9f12978d8effbf7c81",
"reuse_surface/statehub_bridge.py": "769becb3c064203c468cc5d22aec2ef34c2220d08531cbfaa2b00e00cd24d03f",
"reuse_surface/stats.py": "1760e313bd99f47a7b005e857ab81e9f8e4462de74dae79a5a8c0f3f83f45f7b",
"schemas/capability.schema.yaml": "3b0172baa4e6d54f400e911af6adb0d86b4576b86d7aea6d8f18c3fce3b8ae3f",
"schemas/federation.schema.yaml": "82670dfe8585c37f9e38cafa6de951eecf705a3324657b1c1ba7bea662b8dc59",
"schemas/hub-registration.schema.yaml": "8b1d838a13f505b27abcae018db098f2abb14882f95bc5095fd967a0997bad09",
"schemas/plan-check-rerank.schema.json": "33f2cbf9bc92cf9a9f41a2f31dd21c280ccc2dfc5bcae783be39aa28b66904d5",
"schemas/plan-check-result.schema.json": "8e7cb33547c647be9322b39e8bee64a24b6807391214da707a2fde4835e9b5d0",
"schemas/registry-draft.schema.json": "200b17cf6c3e1ea523887f4e51650dffd6d919f64824d4c9dfc28ace28272d91",
"schemas/registry-patch.schema.json": "a11e2385946edaffc772568103bcc4769274ad78456ae6b62e59103ede898de7",
"schemas/reuse-event.schema.json": "67b7d7436effdfd6c389eefc76de76c57bd1bc577388c60c4a2f0839dc36b6be"
},
"smoke": {
"network": "none",
"filesystem": "read-only with task-owned data/tmp tmpfs",
"health": "ok",
"empty_registry": true,
"native_source_sha256": "dbaa40f25cc0f090143578cd1c7068cb2cb00960fafd17d5239bf8a5bac514dd"
},
"registry_pin_gate": "Owner must publish this exact artifact and independently verify registry digest before rendering actual approved release values."
}

3023
docs/assessments/netkingdom-2026-10-14/hosted-after-hardened-phase-a.json Normal file
View file

File diff suppressed because it is too large Load diff

3023
docs/assessments/netkingdom-2026-10-14/hosted-after-owner-consent.json Normal file
View file

File diff suppressed because it is too large Load diff

3023
docs/assessments/netkingdom-2026-10-14/hosted-after-public-registration.json Normal file
View file

File diff suppressed because it is too large Load diff

608
docs/assessments/netkingdom-2026-10-14/hosted-before-federated.json
View file

@ -18,7 +18,7 @@
},
{
"repo": "agentic-resources",
"count": 0,
"count": 1,
"url": "https://forgejo.coulomb.social/coulomb/agentic-resources/raw/branch/main/registry/indexes/capabilities.yaml",
"cache": "/data/cache/agentic-resources.yaml"
},
@ -72,7 +72,7 @@
},
{
"repo": "coordination-engine",
"count": 0,
"count": 1,
"url": "https://forgejo.coulomb.social/coulomb/coordination-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"cache": "/data/cache/coordination-engine.yaml"
},
@ -216,7 +216,7 @@
},
{
"repo": "net-kingdom",
"count": 1,
"count": 6,
"url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml",
"cache": "/data/cache/net-kingdom.yaml"
},
@ -246,7 +246,7 @@
},
{
"repo": "ops-warden",
"count": 1,
"count": 3,
"url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml",
"cache": "/data/cache/ops-warden.yaml"
},
@ -282,7 +282,7 @@
},
{
"repo": "railiance-forge",
"count": 1,
"count": 2,
"url": "https://forgejo.coulomb.social/coulomb/railiance-forge/raw/branch/main/registry/indexes/capabilities.yaml",
"cache": "/data/cache/railiance-forge.yaml"
},
@ -374,20 +374,24 @@
"capabilities": [
{
"id": "capability.activity.event-coordinate",
"name": "Organizational Event Coordination",
"summary": "Coordinate structured responses to cross-domain events through activity workflows and automation.",
"vector": "D3 / A1 / C1 / R0",
"name": "Durable automation and bounded operations",
"summary": "Temporal/NATS/webhook/manual trigger, validated definitions and evidence/runtime sinks.",
"domain": "helix_forge",
"status": "draft",
"owner": "activity-core",
"path": "registry/capabilities/capability.activity.event-coordinate.md",
"tags": [
"activity",
"coordination",
"automation"
"automation",
"security",
"netkingdom",
"framework-reuse"
],
"vector": "D3 / A4 / C1 / R0",
"path": "registry/capabilities/capability.activity.event-coordinate.md",
"consumption_modes": [
"informational"
"HTTP API",
"source"
],
"source_repo": "activity-core",
"source_url": "https://forgejo.coulomb.social/coulomb/activity-core/raw/branch/main/registry/indexes/capabilities.yaml",
@ -417,21 +421,24 @@
},
{
"id": "capability.agents.custodian-runtime-tooling",
"name": "Custodian Runtime And Repo-Classification Tooling",
"summary": "Generic tooling from The Custodian's runtime and ecosystem-management surface: an agent runtime framework (context, actions, tool adapters, policies) and repo-classification batch tooling used across the workstation's 61 repos.",
"vector": "D2 / A1 / C1 / R0",
"name": "Generic agent runtime and repository tooling",
"summary": "Agent runtime modules and repository classification tooling.",
"domain": "custodian",
"status": "draft",
"owner": "the-custodian",
"path": "registry/capabilities/capability.agents.custodian-runtime-tooling.md",
"tags": [
"agents",
"runtime",
"classification"
"classification",
"security",
"netkingdom",
"framework-reuse"
],
"vector": "D2 / A2 / C1 / R0",
"path": "registry/capabilities/capability.agents.custodian-runtime-tooling.md",
"consumption_modes": [
"library import (runtime/)",
"cli (tools/ scripts)"
"CLI",
"source"
],
"source_repo": "the-custodian",
"source_url": "https://forgejo.coulomb.social/coulomb/the-custodian/raw/branch/main/registry/indexes/capabilities.yaml",
@ -485,6 +492,28 @@
"source_url": "https://forgejo.coulomb.social/coulomb/llm-connect/raw/branch/main/registry/indexes/capabilities.yaml",
"source_index": "/data/cache/llm-connect.yaml"
},
{
"id": "capability.agents.performance-learning",
"name": "Agent performance learning",
"summary": "Capture sessions, curate patterns, distribute lessons and measure outcomes.",
"domain": "infotech",
"status": "draft",
"owner": "agentic-resources",
"tags": [
"security",
"netkingdom",
"framework-reuse"
],
"vector": "D3 / A2 / C1 / R0",
"path": "registry/capabilities/capability.agents.performance-learning.md",
"consumption_modes": [
"CLI",
"source"
],
"source_repo": "agentic-resources",
"source_url": "https://forgejo.coulomb.social/coulomb/agentic-resources/raw/branch/main/registry/indexes/capabilities.yaml",
"source_index": "/data/cache/agentic-resources.yaml"
},
{
"id": "capability.agents.repo-scoping-service",
"name": "Repository Scoping Service",
@ -510,23 +539,21 @@
},
{
"id": "capability.audit.event-retain",
"name": "Audit Event Retention",
"summary": "Collect, normalize, retain, and search audit events with integrity evidence across tenants.",
"joins": "operations.audit",
"provision": "data/capability/audit-core-operational.json",
"vector": "D4 provision / A4 / C3 / R2",
"name": "Independent audit custody",
"summary": "Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation.",
"domain": "infotech",
"status": "production",
"status": "draft",
"owner": "audit-core",
"path": "registry/capabilities/capability.audit.event-retain.md",
"tags": [
"audit",
"retention",
"compliance"
"security",
"netkingdom",
"framework-reuse"
],
"vector": "D3 / A4 / C3 / R2",
"path": "registry/capabilities/capability.audit.event-retain.md",
"consumption_modes": [
"http ingest",
"source module"
"HTTP API",
"source"
],
"source_repo": "audit-core",
"source_url": "https://forgejo.coulomb.social/coulomb/audit-core/raw/branch/main/registry/indexes/capabilities.yaml",
@ -534,20 +561,24 @@
},
{
"id": "capability.authorization.policy-evaluate",
"name": "Authorization Policy Evaluation",
"summary": "Evaluate access decisions from policy-as-code rules for subjects, resources, and actions.",
"vector": "D4 / A2 / C2 / R1",
"name": "Policy evaluation and decision evidence",
"summary": "Check, batch, list-allowed, explain, binding, lifetime and decision records.",
"domain": "helix_forge",
"status": "draft",
"owner": "flex-auth",
"path": "registry/capabilities/capability.authorization.policy-evaluate.md",
"owner": "access-engine",
"tags": [
"authorization",
"policy",
"flex-auth"
"flex-auth",
"security",
"netkingdom",
"framework-reuse"
],
"vector": "D4 / A4 / C2 / R1",
"path": "registry/capabilities/capability.authorization.policy-evaluate.md",
"consumption_modes": [
"source module"
"HTTP API",
"source"
],
"source_repo": "access-engine",
"source_url": "https://forgejo.coulomb.social/coulomb/access-engine/raw/branch/main/registry/indexes/capabilities.yaml",
@ -725,6 +756,28 @@
"source_url": "https://forgejo.coulomb.social/coulomb/markitect-tool/raw/branch/main/registry/indexes/capabilities.yaml",
"source_index": "/data/cache/markitect-tool.yaml"
},
{
"id": "capability.coordination.cross-owner-work",
"name": "Cross-owner coordination lifecycle",
"summary": "Observation, lease, wake-up, checkpoint and receipt contracts/runtime.",
"domain": "infotech",
"status": "draft",
"owner": "coordination-engine",
"tags": [
"security",
"netkingdom",
"framework-reuse"
],
"vector": "D3 / A2 / C1 / R0",
"path": "registry/capabilities/capability.coordination.cross-owner-work.md",
"consumption_modes": [
"CLI",
"source"
],
"source_repo": "coordination-engine",
"source_url": "https://forgejo.coulomb.social/coulomb/coordination-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"source_index": "/data/cache/coordination-engine.yaml"
},
{
"id": "capability.design.whynot-system",
"name": "Whynot Design System",
@ -905,21 +958,23 @@
},
{
"id": "capability.iam.key-cape",
"name": "KeyCape Lightweight IAM (NetKingdom Profile)",
"summary": "Lightweight-mode implementation of the NetKingdom IAM Profile (versioned OIDC/PKCE contract), orchestrating Authelia, LLDAP, and privacyIDEA so applications integrate against the profile, not against implementation internals.",
"vector": "D4 / A2 / C2 / R1",
"name": "OIDC identity and assurance",
"summary": "OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI.",
"domain": "infotech",
"status": "draft",
"owner": "key-cape",
"path": "registry/capabilities/capability.iam.key-cape.md",
"tags": [
"iam",
"oidc",
"netkingdom",
"security"
"security",
"framework-reuse"
],
"vector": "D4 / A4 / C2 / R1",
"path": "registry/capabilities/capability.iam.key-cape.md",
"consumption_modes": [
"service (self-hosted deployment)"
"HTTP API",
"source"
],
"source_repo": "key-cape",
"source_url": "https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml",
@ -948,20 +1003,24 @@
},
{
"id": "capability.identity.user-engine",
"name": "Headless Multi-Tenant User Engine",
"summary": "Headless, multi-application, multi-tenant user management engine covering registration, identity/factor models, entitlement claims, hats/realms/services/assets access profiles, and onboarding journeys.",
"vector": "D4 / A1 / C2 / R0",
"name": "User lifecycle and account journeys",
"summary": "Accounts, identity links, membership, MFA and recovery portal, advisory catalog.",
"domain": "communication",
"status": "draft",
"owner": "user-engine",
"path": "registry/capabilities/capability.identity.user-engine.md",
"tags": [
"identity",
"user-management",
"multi-tenant"
"multi-tenant",
"security",
"netkingdom",
"framework-reuse"
],
"vector": "D4 / A4 / C2 / R0",
"path": "registry/capabilities/capability.identity.user-engine.md",
"consumption_modes": [
"library import"
"HTTP API",
"source"
],
"source_repo": "user-engine",
"source_url": "https://forgejo.coulomb.social/coulomb/user-engine/raw/branch/main/registry/indexes/capabilities.yaml",
@ -1013,22 +1072,24 @@
},
{
"id": "capability.infotech.canon-service",
"name": "InfoTechCanon Service Surface",
"summary": "Concrete service surface (CLI, importable functions, read-only local HTTP API) over the InfoTechCanon information-processing infospace, backed by infospace-bench.",
"vector": "D2 / A2 / C1 / R0",
"name": "Shared semantic contracts and validation",
"summary": "Markdown canon with library, CLI and read-only API.",
"domain": "infotech",
"status": "draft",
"owner": "info-tech-canon",
"path": "registry/capabilities/capability.infotech.canon-service.md",
"tags": [
"canon",
"infospace",
"service"
"service",
"security",
"netkingdom",
"framework-reuse"
],
"vector": "D2 / A4 / C1 / R0",
"path": "registry/capabilities/capability.infotech.canon-service.md",
"consumption_modes": [
"cli",
"library import",
"http api (read-only, local)"
"HTTP API",
"source"
],
"source_repo": "info-tech-canon",
"source_url": "https://forgejo.coulomb.social/coulomb/info-tech-canon/raw/branch/main/registry/indexes/capabilities.yaml",
@ -1207,21 +1268,24 @@
},
{
"id": "capability.infotech.issue-tracking",
"name": "Universal Issue Tracking Coordination",
"summary": "Unified Python/CLI interface for issue tracking across Forgejo, GitHub, and GitLab, preventing direct platform API usage and credential sprawl for coordinating agents.",
"vector": "D4 / A2 / C2 / R1",
"name": "External issue tracker connector",
"summary": "CLI and Python adapters for external issue systems.",
"domain": "infotech",
"status": "draft",
"owner": "issue-core",
"path": "registry/capabilities/capability.infotech.issue-tracking.md",
"tags": [
"issue-tracking",
"coordination",
"multi-platform"
"connector",
"work-record",
"security",
"netkingdom",
"framework-reuse"
],
"vector": "D4 / A2 / C2 / R1",
"path": "registry/capabilities/capability.infotech.issue-tracking.md",
"consumption_modes": [
"cli",
"library import"
"CLI",
"source"
],
"source_repo": "issue-core",
"source_url": "https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml",
@ -1340,21 +1404,25 @@
},
{
"id": "capability.ops.tunnel-bridge",
"name": "SSH Reverse Tunnel Lifecycle Manager (ops-bridge)",
"summary": "CLI that manages named SSH reverse tunnels keeping remote execution environments connected to the local Custodian State Hub, with auto-reconnect, health checks, and structured audit events.",
"vector": "D3 / A2 / C2 / R1",
"name": "SSH tunnel lifecycle",
"summary": "Named tunnels, reconnect, health and TTL-aware cert_command.",
"domain": "infotech",
"status": "draft",
"owner": "ops-bridge",
"path": "registry/capabilities/capability.ops.tunnel-bridge.md",
"tags": [
"ssh",
"tunnel",
"ops",
"connectivity"
"connectivity",
"security",
"netkingdom",
"framework-reuse"
],
"vector": "D3 / A2 / C2 / R1",
"path": "registry/capabilities/capability.ops.tunnel-bridge.md",
"consumption_modes": [
"cli"
"CLI",
"source"
],
"source_repo": "ops-bridge",
"source_url": "https://forgejo.coulomb.social/coulomb/ops-bridge/raw/branch/main/registry/indexes/capabilities.yaml",
@ -1383,22 +1451,25 @@
},
{
"id": "capability.railiance.ci-enablement",
"name": "Railiance Developer Enablement And CI/CD Templates",
"summary": "S4 Developer Enablement layer of the Railiance OAS Stack \u2014 reusable CI/CD workflow templates, developer portal paths, platform templates, SDKs, and buildpacks, using forge capabilities without owning forge runtime.",
"vector": "D3 / A2 / C2 / R1",
"name": "Developer delivery and CI templates",
"summary": "Reusable CI workflows, build and deployment patterns.",
"domain": "financials",
"status": "draft",
"owner": "railiance-enablement",
"path": "registry/capabilities/capability.railiance.ci-enablement.md",
"tags": [
"railiance",
"ci-cd",
"developer-enablement",
"forgejo"
"forgejo",
"security",
"netkingdom",
"framework-reuse"
],
"vector": "D3 / A2 / C2 / R1",
"path": "registry/capabilities/capability.railiance.ci-enablement.md",
"consumption_modes": [
"ci workflow template (copy/reference)",
"cli (promote-repo-to-forgejo.sh)"
"CLI",
"source"
],
"source_repo": "railiance-enablement",
"source_url": "https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml",
@ -1406,22 +1477,25 @@
},
{
"id": "capability.railiance.cluster-bootstrap",
"name": "Railiance Cluster Runtime Bootstrap",
"summary": "Cluster runtime entry point of the Railiance Infrastructure-as-Code framework: from two bare Linux servers, a Git repo, and credentials, rebuilds a fully automated Kubernetes-based environment.",
"vector": "D3 / A2 / C1 / R0",
"name": "Kubernetes runtime and cluster controls",
"summary": "k3s, ingress, CNI, operators and kubeconfig/runtime checks.",
"domain": "financials",
"status": "draft",
"owner": "railiance-cluster",
"path": "registry/capabilities/capability.railiance.cluster-bootstrap.md",
"tags": [
"railiance",
"kubernetes",
"iac",
"bootstrap"
"bootstrap",
"security",
"netkingdom",
"framework-reuse"
],
"vector": "D3 / A2 / C1 / R0",
"path": "registry/capabilities/capability.railiance.cluster-bootstrap.md",
"consumption_modes": [
"cli",
"ansible playbook"
"CLI",
"source"
],
"source_repo": "railiance-cluster",
"source_url": "https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml",
@ -1429,22 +1503,25 @@
},
{
"id": "capability.railiance.fabric-graph",
"name": "Railiance Fabric Ecosystem Graph",
"summary": "Models the durable infrastructure-responsibility graph of the Railiance netkingdom: schemas, discovery tools, registry services, graph queries, and State Hub export contracts for services, machines, repos, deployables, endpoints, ownership, dependencies, and bindings.",
"vector": "D3 / A1 / C1 / R0",
"name": "Infrastructure ownership and dependency graph",
"summary": "Schemas, validation, graph queries and State Hub exports.",
"domain": "financials",
"status": "draft",
"owner": "railiance-fabric",
"path": "registry/capabilities/capability.railiance.fabric-graph.md",
"tags": [
"railiance",
"graph",
"ownership",
"discovery"
"discovery",
"security",
"netkingdom",
"framework-reuse"
],
"vector": "D3 / A2 / C1 / R0",
"path": "registry/capabilities/capability.railiance.fabric-graph.md",
"consumption_modes": [
"library import",
"cli (validation)"
"CLI",
"source"
],
"source_repo": "railiance-fabric",
"source_url": "https://forgejo.coulomb.social/coulomb/railiance-fabric/raw/branch/main/registry/indexes/capabilities.yaml",
@ -1452,22 +1529,25 @@
},
{
"id": "capability.railiance.forge-infrastructure",
"name": "Railiance Forge And Artifact Infrastructure",
"summary": "Source forge, registry, and automation-runner infrastructure for Railiance, separated out from railiance-apps/railiance-enablement; covers current Gitea operation, the Forgejo migration, container/package registries, and Actions runner substrate.",
"vector": "D3 / A1 / C1 / R0",
"name": "Source forge, registries and runner substrate",
"summary": "Forgejo operation, package registries and runner lifecycle.",
"domain": "financials",
"status": "draft",
"owner": "railiance-forge",
"path": "registry/capabilities/capability.railiance.forge-infrastructure.md",
"tags": [
"railiance",
"forgejo",
"forge",
"ci-runner"
"ci-runner",
"security",
"netkingdom",
"framework-reuse"
],
"vector": "D3 / A2 / C1 / R0",
"path": "registry/capabilities/capability.railiance.forge-infrastructure.md",
"consumption_modes": [
"cli (operator tooling)",
"documentation/runbooks"
"CLI",
"source"
],
"source_repo": "railiance-forge",
"source_url": "https://forgejo.coulomb.social/coulomb/railiance-forge/raw/branch/main/registry/indexes/capabilities.yaml",
@ -1475,22 +1555,25 @@
},
{
"id": "capability.railiance.infra-provisioning",
"name": "RailianceHosts Infrastructure Provisioning",
"summary": "Git-driven server provisioning and convergence for Hosteurope/Hetzner Cloud using Terraform, cloud-init, and Ansible, with SOPS+age encrypted in-repo secrets and a servers.yaml inventory as source of truth.",
"vector": "D4 / A2 / C2 / R1",
"name": "Host convergence and security baseline",
"summary": "Ansible inventory, firewall, SSH bootstrap and baseline verification.",
"domain": "financials",
"status": "draft",
"owner": "railiance-infra",
"path": "registry/capabilities/capability.railiance.infra-provisioning.md",
"tags": [
"railiance",
"terraform",
"ansible",
"infrastructure"
"infrastructure",
"security",
"netkingdom",
"framework-reuse"
],
"vector": "D4 / A2 / C2 / R1",
"path": "registry/capabilities/capability.railiance.infra-provisioning.md",
"consumption_modes": [
"cli (terraform/ansible)",
"gitops"
"CLI",
"source"
],
"source_repo": "railiance-infra",
"source_url": "https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml",
@ -1498,21 +1581,25 @@
},
{
"id": "capability.railiance.platform-services",
"name": "Railiance Platform Services",
"summary": "S3 Platform Services layer of the Railiance OAS Stack \u2014 shared cluster services: PostgreSQL HA, Valkey cache, secret management, identity integration, and object storage.",
"vector": "D3 / A2 / C1 / R0",
"name": "Secret custody and platform data services",
"summary": "OpenBao policy/custody, consumer grants, secret delivery and database/backup contracts.",
"domain": "financials",
"status": "draft",
"owner": "railiance-platform",
"path": "registry/capabilities/capability.railiance.platform-services.md",
"tags": [
"railiance",
"platform",
"secrets",
"postgres"
"postgres",
"security",
"netkingdom",
"framework-reuse"
],
"vector": "D3 / A2 / C1 / R0",
"path": "registry/capabilities/capability.railiance.platform-services.md",
"consumption_modes": [
"cli (shell/python scripts)"
"CLI",
"source"
],
"source_repo": "railiance-platform",
"source_url": "https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml",
@ -1520,22 +1607,25 @@
},
{
"id": "capability.railiance.workload-deployment-tooling",
"name": "Railiance Application Workload Deployment Tooling",
"summary": "S5 Workloads and Experience Endpoints layer of the Railiance OAS Stack \u2014 application Helm releases, Kubernetes workload manifests, deployment guardrails, and smoke-test/check tooling for user-facing services.",
"vector": "D3 / A2 / C1 / R1",
"name": "Workload release configuration and guards",
"summary": "Helm/manifests, exact image pins, application runbooks and rollout/rollback.",
"domain": "financials",
"status": "draft",
"owner": "railiance-apps",
"path": "registry/capabilities/capability.railiance.workload-deployment-tooling.md",
"tags": [
"railiance",
"kubernetes",
"helm",
"deployment"
"deployment",
"security",
"netkingdom",
"framework-reuse"
],
"vector": "D3 / A2 / C1 / R1",
"path": "registry/capabilities/capability.railiance.workload-deployment-tooling.md",
"consumption_modes": [
"cli (shell scripts)",
"helm/kubernetes deployment"
"CLI",
"source"
],
"source_repo": "railiance-apps",
"source_url": "https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml",
@ -1543,23 +1633,24 @@
},
{
"id": "capability.registry.register",
"name": "Capability Registration",
"summary": "Register a new capability so it becomes visible for planning and implementation reuse.",
"vector": "D3 / A4 / C2 / R3",
"name": "Capability registry and federation",
"summary": "Owner Markdown entries, indexes, federation hub and planning queries.",
"domain": "helix_forge",
"status": "draft",
"owner": "reuse-surface",
"path": "registry/capabilities/capability.registry.register.md",
"tags": [
"registry",
"governance",
"meta"
"meta",
"security",
"netkingdom",
"framework-reuse"
],
"vector": "D3 / A3 / C2 / R3",
"path": "registry/capabilities/capability.registry.register.md",
"consumption_modes": [
"informational",
"markdown authoring",
"cli",
"service API"
"library",
"CLI"
],
"source_repo": "reuse-surface",
"source_url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml",
@ -1567,43 +1658,225 @@
},
{
"id": "capability.registry.validate",
"name": "Registry Entry Validation",
"summary": "Validate capability registry entries against schema, index consistency, and relation integrity.",
"vector": "D4 / A3 / C3 / R3",
"name": "Capability registry validation",
"summary": "Schema, index consistency and relation checks.",
"domain": "helix_forge",
"status": "draft",
"owner": "reuse-surface",
"path": "registry/capabilities/capability.registry.validate.md",
"tags": [
"registry",
"validation",
"cli"
"cli",
"security",
"netkingdom",
"framework-reuse"
],
"vector": "D4 / A3 / C3 / R3",
"path": "registry/capabilities/capability.registry.validate.md",
"consumption_modes": [
"cli"
"library",
"CLI"
],
"source_repo": "reuse-surface",
"source_url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml",
"source_index": "/data/cache/reuse-surface.yaml"
},
{
"id": "capability.security.iam-tooling-suite",
"name": "NetKingdom Security/IAM Tooling Suite",
"summary": "Canonical security architecture and executable reference tooling for IAM, bootstrap, posture validation, deterministic plan-only security scenario composition, and proposal-only posture feedback.",
"vector": "D3 / A2 / C1 / R1",
"id": "capability.security.access-routing",
"name": "Credential routing and contained access",
"summary": "warden route and access catalog; exact lane conduit and secret-exec routing.",
"domain": "infotech",
"status": "draft",
"owner": "ops-warden",
"tags": [
"security",
"netkingdom",
"framework-reuse"
],
"vector": "D3 / A3 / C1 / R0",
"path": "registry/capabilities/capability.security.access-routing.md",
"consumption_modes": [
"library",
"CLI"
],
"source_repo": "ops-warden",
"source_url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml",
"source_index": "/data/cache/ops-warden.yaml"
},
{
"id": "capability.security.bootstrap-recovery",
"name": "Guarded bootstrap and recovery preparation",
"summary": "Local identity, bootstrap console, encrypted custody handoff and caller tools.",
"domain": "infotech",
"status": "draft",
"owner": "net-kingdom",
"tags": [
"security",
"netkingdom",
"framework-reuse"
],
"vector": "D3 / A2 / C1 / R0",
"path": "registry/capabilities/capability.security.bootstrap-recovery.md",
"consumption_modes": [
"CLI",
"source"
],
"source_repo": "net-kingdom",
"source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml",
"source_index": "/data/cache/net-kingdom.yaml"
},
{
"id": "capability.security.case-contracts",
"name": "Security case types and instance validation",
"summary": "Versioned types, cases and schema validation.",
"domain": "infotech",
"status": "draft",
"owner": "net-kingdom",
"tags": [
"security",
"netkingdom",
"framework-reuse"
],
"vector": "D3 / A2 / C1 / R0",
"path": "registry/capabilities/capability.security.case-contracts.md",
"consumption_modes": [
"CLI",
"source"
],
"source_repo": "net-kingdom",
"source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml",
"source_index": "/data/cache/net-kingdom.yaml"
},
{
"id": "capability.security.case-follow-through",
"name": "Security case operational follow-through",
"summary": "KnownSecurityCase route, plan and operational receipts.",
"domain": "infotech",
"status": "draft",
"owner": "ops-warden",
"tags": [
"security",
"netkingdom",
"framework-reuse"
],
"vector": "D3 / A2 / C1 / R0",
"path": "registry/capabilities/capability.security.case-follow-through.md",
"consumption_modes": [
"CLI",
"source"
],
"source_repo": "ops-warden",
"source_url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml",
"source_index": "/data/cache/ops-warden.yaml"
},
{
"id": "capability.security.emission-profile",
"name": "Security emission cadence validation",
"summary": "Security profile over generic emission contracts and validator.",
"domain": "infotech",
"status": "draft",
"owner": "net-kingdom",
"tags": [
"security",
"netkingdom",
"framework-reuse"
],
"vector": "D3 / A2 / C1 / R0",
"path": "registry/capabilities/capability.security.emission-profile.md",
"consumption_modes": [
"CLI",
"source"
],
"source_repo": "net-kingdom",
"source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml",
"source_index": "/data/cache/net-kingdom.yaml"
},
{
"id": "capability.security.forge-secret-prevention",
"name": "Independent introduced-history secret prevention",
"summary": "Pinned receive adapter, lifecycle template and fail-closed scan.",
"domain": "infotech",
"status": "draft",
"owner": "railiance-forge",
"tags": [
"security",
"netkingdom",
"framework-reuse"
],
"vector": "D3 / A2 / C1 / R0",
"path": "registry/capabilities/capability.security.forge-secret-prevention.md",
"consumption_modes": [
"CLI",
"source"
],
"source_repo": "railiance-forge",
"source_url": "https://forgejo.coulomb.social/coulomb/railiance-forge/raw/branch/main/registry/indexes/capabilities.yaml",
"source_index": "/data/cache/railiance-forge.yaml"
},
{
"id": "capability.security.iam-tooling-suite",
"name": "NetKingdom security architecture and conformance tooling",
"summary": "Versioned IAM, layer, tenancy and credential contracts plus validators.",
"domain": "infotech",
"status": "draft",
"owner": "net-kingdom",
"path": "registry/capabilities/capability.security.iam-tooling-suite.md",
"tags": [
"security",
"iam",
"kubernetes",
"conformance"
"conformance",
"netkingdom",
"framework-reuse"
],
"vector": "D3 / A2 / C1 / R1",
"path": "registry/capabilities/capability.security.iam-tooling-suite.md",
"consumption_modes": [
"cli",
"local web ui"
"CLI",
"source"
],
"source_repo": "net-kingdom",
"source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml",
"source_index": "/data/cache/net-kingdom.yaml"
},
{
"id": "capability.security.posture-feedback",
"name": "Deterministic posture feedback",
"summary": "CLI evaluates evidence age and posture into owner-routed findings.",
"domain": "infotech",
"status": "draft",
"owner": "net-kingdom",
"tags": [
"security",
"netkingdom",
"framework-reuse"
],
"vector": "D3 / A2 / C1 / R0",
"path": "registry/capabilities/capability.security.posture-feedback.md",
"consumption_modes": [
"CLI",
"source"
],
"source_repo": "net-kingdom",
"source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml",
"source_index": "/data/cache/net-kingdom.yaml"
},
{
"id": "capability.security.scenario-compose",
"name": "Deterministic security scenario composition",
"summary": "CLI selects pinned providers and orders trust transitions.",
"domain": "infotech",
"status": "draft",
"owner": "net-kingdom",
"tags": [
"security",
"netkingdom",
"framework-reuse"
],
"vector": "D3 / A2 / C1 / R0",
"path": "registry/capabilities/capability.security.scenario-compose.md",
"consumption_modes": [
"CLI",
"source"
],
"source_repo": "net-kingdom",
"source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml",
@ -1611,24 +1884,26 @@
},
{
"id": "capability.security.ssh-certificate-issuance",
"name": "SSH Certificate Issuance",
"summary": "Issue short-lived CA-signed SSH certificates for adm, agt, and atm actors through a stable cert_command CLI interface; steward NetKingdom operational access routing.",
"vector": "D4 / A3 / C3 / R2",
"name": "Decision-bound SSH certificates",
"summary": "warden sign with local and OpenBao backends and adm/agt/atm actors.",
"domain": "helix_forge",
"status": "draft",
"owner": "ops-warden",
"path": "registry/capabilities/capability.security.ssh-certificate-issuance.md",
"tags": [
"ssh",
"certificate",
"ca",
"ops-warden",
"openbao",
"security"
"security",
"netkingdom",
"framework-reuse"
],
"vector": "D4 / A3 / C3 / R2",
"path": "registry/capabilities/capability.security.ssh-certificate-issuance.md",
"consumption_modes": [
"CLI",
"cert_command subprocess"
"library",
"CLI"
],
"source_repo": "ops-warden",
"source_url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml",
@ -1636,20 +1911,24 @@
},
{
"id": "capability.statehub.progress-log",
"name": "Work Progress Logging",
"summary": "Record progress events, decisions, and session notes against workstreams and tasks in State Hub.",
"vector": "D4 / A4 / C3 / R3",
"name": "Progress and work evidence indexing",
"summary": "REST progress and task evidence references.",
"domain": "helix_forge",
"status": "draft",
"owner": "state-hub",
"path": "registry/capabilities/capability.statehub.progress-log.md",
"tags": [
"state-hub",
"progress",
"coordination"
"coordination",
"security",
"netkingdom",
"framework-reuse"
],
"vector": "D4 / A4 / C3 / R3",
"path": "registry/capabilities/capability.statehub.progress-log.md",
"consumption_modes": [
"service API"
"HTTP API",
"source"
],
"source_repo": "state-hub",
"source_url": "https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml",
@ -1657,21 +1936,24 @@
},
{
"id": "capability.statehub.workstream-coordinate",
"name": "Workstream And Task Coordination",
"summary": "Track active workstreams, tasks, progress, and consistency across domain repositories.",
"vector": "D4 / A4 / C3 / R2",
"name": "Cross-repository work tracking",
"summary": "File-derived workplans, tasks, dependencies, decisions and coordination views.",
"domain": "helix_forge",
"status": "draft",
"owner": "state-hub",
"path": "registry/capabilities/capability.statehub.workstream-coordinate.md",
"tags": [
"state-hub",
"coordination",
"workplans"
"workplans",
"security",
"netkingdom",
"framework-reuse"
],
"vector": "D4 / A4 / C3 / R2",
"path": "registry/capabilities/capability.statehub.workstream-coordinate.md",
"consumption_modes": [
"service API",
"HTTP REST"
"HTTP API",
"source"
],
"source_repo": "state-hub",
"source_url": "https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml",
@ -1867,6 +2149,6 @@
"source_index": "/data/cache/shard-wiki.yaml"
}
],
"composed_at": "2026-10-14T00:17:44+00:00",
"composed_at": "2026-10-14T18:17:44+00:00",
"stale": false
}

17
docs/assessments/netkingdom-2026-10-14/hosted-owner-consent-verification.json Normal file
View file

@ -0,0 +1,17 @@
{
"checked_at": "2026-10-14T22:34:23.499101+00:00",
"expected": 70,
"present": 63,
"missing": [
"capability.railiance.openbao-package",
"capability.railiance.policy-publication-package",
"capability.railiance.postgres-isolation-recovery",
"capability.railiance.sbom-runtime-package",
"capability.railiance.telemetry-package",
"capability.railiance.tenant-engine-package",
"capability.railiance.user-engine-package"
],
"duplicates": [],
"composed_at": "2026-10-14T22:34:30+00:00",
"stale": false
}

108
docs/assessments/netkingdom-2026-10-14/hosted-post-all-clear-check.json Normal file
View file

@ -0,0 +1,108 @@
{
"all_clear_message_id": "e6cbec92-af64-456b-8ee6-9b69913c03c3",
"checked_at": "2026-10-14T21:38:16.627522+00:00",
"hub": {
"composed_at": "2026-10-14T18:17:44+00:00",
"federated_capability_records": 76,
"registrations": 64,
"sources": 61,
"stale": false
},
"public_plan": {
"absent": [
"approval-engine",
"emergent-security",
"fin-hub",
"gate-house",
"glas-harness",
"informed-decision",
"kings-guard",
"maturity-engine",
"ops-mason",
"policy-nexus",
"rail-knative",
"rail-kubernetes",
"railiance-bootstrap",
"railiance-master",
"railiance-telemetry",
"rapp-playwright",
"reef-railiance",
"rein-aharness",
"rein-openweights",
"repo-manager",
"resource-control",
"risk-nexus",
"role-engine",
"runbook-tutorials",
"sand-boxer",
"sbom-nexus",
"secrets-engine",
"security-canon",
"tenant-engine",
"whitehat-security",
"zone-engine"
],
"already_matching": [],
"conflicting": [],
"count": 31,
"plan_sha256": "768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b",
"proposal_id": "CUST81-REUSE-PUBLIC-REGISTRATION-R1",
"proposal_sha256": "84811121ae8d00970927b97bd6125b6a91989cce46dbe6b75a24592e15c16ca1",
"revision": 1
},
"registration_attempt": "OIDC login timed out waiting for provider; Warden and helper were not invoked; no hub writes occurred.",
"reviewed_inventory": {
"duplicate_ids": [],
"expected_ids": 70,
"missing_ids": [
"capability.execution.openweight-rein",
"capability.execution.profile-harness",
"capability.execution.sandbox-provision",
"capability.execution.scheduled-agent-rein",
"capability.finance.security-budget-evidence",
"capability.identity.tenant-facts",
"capability.infotech.runbook-tutorials",
"capability.infotech.sbom-management",
"capability.observability.security-signals",
"capability.organization.role-catalog",
"capability.railiance.bootstrap-sequencing",
"capability.railiance.browser-verification",
"capability.railiance.knative-rail",
"capability.railiance.kubernetes-rail",
"capability.railiance.openbao-package",
"capability.railiance.policy-publication-package",
"capability.railiance.postgres-isolation-recovery",
"capability.railiance.sbom-runtime-package",
"capability.railiance.security-consumption-contracts",
"capability.railiance.substrate-bindings",
"capability.railiance.telemetry-package",
"capability.railiance.tenant-engine-package",
"capability.railiance.user-engine-package",
"capability.resources.security-capacity",
"capability.security.adversarial-evidence",
"capability.security.agent-knowledge",
"capability.security.approval-lifecycle",
"capability.security.credential-lifecycle",
"capability.security.doctrine-review",
"capability.security.human-decision-workspace",
"capability.security.maturity-claims",
"capability.security.policy-publication",
"capability.security.posture-assessment",
"capability.security.practice-canon",
"capability.security.repository-secret-prevention",
"capability.security.risk-register",
"capability.security.structure-construction",
"capability.security.zone-reference"
],
"present_ids": 32
},
"schema": "custodian.netkingdom-hosted-registration-check.v1",
"write_attempted": false,
"writer_access": {
"CCR": "CCR-2026-0044",
"member_receipt": "/home/worsch/ops-mason/docs/evidence/2026-10-14-reuse-surface-hub-writer-member.txt",
"non_member_receipt": "/home/worsch/ops-mason/docs/evidence/2026-10-14-reuse-surface-hub-writer-non-member.txt",
"result": "both passed; member token revoked",
"status": "applied"
}
}

155
docs/assessments/netkingdom-2026-10-14/hub-private-registration-preparation-r1.json Normal file
View file

@ -0,0 +1,155 @@
{
"id": "CUST81-PRIVATE-REGISTRATION-PREPARATION-R1",
"revision": 1,
"created_at": "2026-10-14T22:34:23.499101+00:00",
"status": "prepared; not executable until platform auth_env and native fetch receipts are bound",
"disclosure_consent_receipt": "private-source-owner-consent-r1.json",
"disclosure_proposal_sha256": "46ac4fe49a08054cc215aade2fbaf3b36ee334520997857ed84f530b52da9d35",
"actions": [
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-openbao",
"url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/indexes/capabilities.yaml?ref=35672be138036c8433a5ac5de91e068c03c2b124",
"domain": "infotech",
"enabled": true,
"required": false,
"auth_env": null,
"auth_header": "Authorization"
},
"capability_ids": [
"capability.railiance.openbao-package"
],
"consented_commit": "35672be138036c8433a5ac5de91e068c03c2b124",
"native_fetch_receipt": null,
"proposed_auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-policy-nexus",
"url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/indexes/capabilities.yaml?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3",
"domain": "infotech",
"enabled": true,
"required": false,
"auth_env": null,
"auth_header": "Authorization"
},
"capability_ids": [
"capability.railiance.policy-publication-package"
],
"consented_commit": "088b78ac03b0cebeec34a69aae3569eb7ec2f9c3",
"native_fetch_receipt": null,
"proposed_auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-postgres",
"url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/indexes/capabilities.yaml?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5",
"domain": "infotech",
"enabled": true,
"required": false,
"auth_env": null,
"auth_header": "Authorization"
},
"capability_ids": [
"capability.railiance.postgres-isolation-recovery"
],
"consented_commit": "a9f569c96d74aa384ac8d3ac4aa960e4061550b5",
"native_fetch_receipt": null,
"proposed_auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-sbom-nexus",
"url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/indexes/capabilities.yaml?ref=adbedd349e8df97be43a1f57db7095af45ff29d1",
"domain": "infotech",
"enabled": true,
"required": false,
"auth_env": null,
"auth_header": "Authorization"
},
"capability_ids": [
"capability.railiance.sbom-runtime-package"
],
"consented_commit": "adbedd349e8df97be43a1f57db7095af45ff29d1",
"native_fetch_receipt": null,
"proposed_auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-telemetry",
"url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/indexes/capabilities.yaml?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5",
"domain": "infotech",
"enabled": true,
"required": false,
"auth_env": null,
"auth_header": "Authorization"
},
"capability_ids": [
"capability.railiance.telemetry-package"
],
"consented_commit": "f158307e24b86bab88a1af4830ff6b4f85afdeb5",
"native_fetch_receipt": null,
"proposed_auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-tenant-engine",
"url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/indexes/capabilities.yaml?ref=9bdc86572728783a5ed94266f04f7b12d414c557",
"domain": "infotech",
"enabled": true,
"required": false,
"auth_env": null,
"auth_header": "Authorization"
},
"capability_ids": [
"capability.railiance.tenant-engine-package"
],
"consented_commit": "9bdc86572728783a5ed94266f04f7b12d414c557",
"native_fetch_receipt": null,
"proposed_auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-user-engine",
"url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/indexes/capabilities.yaml?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738",
"domain": "infotech",
"enabled": true,
"required": false,
"auth_env": null,
"auth_header": "Authorization"
},
"capability_ids": [
"capability.railiance.user-engine-package"
],
"consented_commit": "f35108f9e1b8702fb6c526fe42b2fec5ca032738",
"native_fetch_receipt": null,
"proposed_auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
}
],
"gates": [
"Exact consented index and entry hashes must match native hub-side fetched bytes",
"Independent technical reviews and reviewed platform credential delivery must be recorded",
"Replace null auth_env only with the platform-confirmed environment variable name; retain a new executable proposal digest",
"Read existing registrations; reject conflicts without overwrite",
"After registration force native hosted refresh and prove all 70 reviewed IDs exactly once",
"Use consented-commit pinned raw API URLs; mutable main must not automatically publish unreviewed future metadata."
],
"reader_proposal": {
"path": "private-reader-provisioning-preparation-r1.json",
"sha256": "7819eb51d249f5c7aff4df9fb520afcfb76603b05a4104439499102b6c20af99"
}
}

0
docs/assessments/netkingdom-2026-10-14/hub-private-registration-r1.lock Normal file
View file

9
docs/assessments/netkingdom-2026-10-14/hub-private-source-pending.json
View file

@ -1,5 +1,5 @@
{
"reason": "Anonymous source fetch returns 404; hub-side read credential or separately approved metadata publication is needed. Do not change repository visibility.",
"reason": "Owner disclosure consent recorded for all seven exact source revisions; restricted hub-side reader, independent technical reviews and native authenticated index/entry fetch verification remain pending. Repositories stay private.",
"repos": [
"rapp-openbao",
"rapp-policy-nexus",
@ -98,7 +98,8 @@
"needed_fields": [
"auth_env name for an already admitted hub-side source-read credential",
"proof that the credential is limited to the intended repository read scope",
"successful hub-side index fetch without value disclosure",
"owner consent to metadata appearing in public federation"
]
"successful hub-side index fetch without value disclosure"
],
"consent_receipt": "private-source-owner-consent-r1.json",
"registration_preparation": "hub-private-registration-preparation-r1.json"
}

125
docs/assessments/netkingdom-2026-10-14/hub-public-resume-receipts.jsonl Normal file
View file

@ -0,0 +1,125 @@
{"at":"2026-10-14T21:55:44.707164+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"approval-engine"}
{"at":"2026-10-14T21:55:44.709724+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"emergent-security"}
{"at":"2026-10-14T21:55:44.712173+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"fin-hub"}
{"at":"2026-10-14T21:55:44.714415+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"gate-house"}
{"at":"2026-10-14T21:55:44.716362+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"glas-harness"}
{"at":"2026-10-14T21:55:44.718351+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"informed-decision"}
{"at":"2026-10-14T21:55:44.720385+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"kings-guard"}
{"at":"2026-10-14T21:55:44.722486+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"maturity-engine"}
{"at":"2026-10-14T21:55:44.724716+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"ops-mason"}
{"at":"2026-10-14T21:55:44.727047+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"policy-nexus"}
{"at":"2026-10-14T21:55:44.729015+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rail-kubernetes"}
{"at":"2026-10-14T21:55:44.730901+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"railiance-bootstrap"}
{"at":"2026-10-14T21:55:44.732745+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"railiance-master"}
{"at":"2026-10-14T21:55:44.735376+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"railiance-telemetry"}
{"at":"2026-10-14T21:55:44.737359+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rapp-playwright"}
{"at":"2026-10-14T21:55:44.739539+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"reef-railiance"}
{"at":"2026-10-14T21:55:44.741686+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rein-aharness"}
{"at":"2026-10-14T21:55:44.743806+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rein-openweights"}
{"at":"2026-10-14T21:55:44.746032+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"repo-manager"}
{"at":"2026-10-14T21:55:44.748361+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"resource-control"}
{"at":"2026-10-14T21:55:44.750542+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"risk-nexus"}
{"at":"2026-10-14T21:55:44.752378+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"role-engine"}
{"at":"2026-10-14T21:55:44.754465+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"runbook-tutorials"}
{"at":"2026-10-14T21:55:44.756568+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"sand-boxer"}
{"at":"2026-10-14T21:55:44.758526+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"sbom-nexus"}
{"at":"2026-10-14T21:55:44.760477+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"secrets-engine"}
{"at":"2026-10-14T21:55:44.762377+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"security-canon"}
{"at":"2026-10-14T21:55:44.764325+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"tenant-engine"}
{"at":"2026-10-14T21:55:44.766244+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"whitehat-security"}
{"at":"2026-10-14T21:55:44.768233+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"zone-engine"}
{"at":"2026-10-14T21:55:44.770217+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rail-knative"}
{"at":"2026-10-14T22:11:13.307878+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"approval-engine"}
{"at":"2026-10-14T22:11:13.311161+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"emergent-security"}
{"at":"2026-10-14T22:11:13.313775+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"fin-hub"}
{"at":"2026-10-14T22:11:13.317225+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"gate-house"}
{"at":"2026-10-14T22:11:13.320078+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"glas-harness"}
{"at":"2026-10-14T22:11:13.322597+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"informed-decision"}
{"at":"2026-10-14T22:11:13.325032+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"kings-guard"}
{"at":"2026-10-14T22:11:13.327383+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"maturity-engine"}
{"at":"2026-10-14T22:11:13.329639+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"ops-mason"}
{"at":"2026-10-14T22:11:13.332961+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"policy-nexus"}
{"at":"2026-10-14T22:11:13.335882+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rail-kubernetes"}
{"at":"2026-10-14T22:11:13.338252+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"railiance-bootstrap"}
{"at":"2026-10-14T22:11:13.340768+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"railiance-master"}
{"at":"2026-10-14T22:11:13.342993+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"railiance-telemetry"}
{"at":"2026-10-14T22:11:13.344988+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rapp-playwright"}
{"at":"2026-10-14T22:11:13.347525+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"reef-railiance"}
{"at":"2026-10-14T22:11:13.349658+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rein-aharness"}
{"at":"2026-10-14T22:11:13.351939+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rein-openweights"}
{"at":"2026-10-14T22:11:13.354038+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"repo-manager"}
{"at":"2026-10-14T22:11:13.356052+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"resource-control"}
{"at":"2026-10-14T22:11:13.358055+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"risk-nexus"}
{"at":"2026-10-14T22:11:13.360086+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"role-engine"}
{"at":"2026-10-14T22:11:13.362568+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"runbook-tutorials"}
{"at":"2026-10-14T22:11:13.365022+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"sand-boxer"}
{"at":"2026-10-14T22:11:13.367367+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"sbom-nexus"}
{"at":"2026-10-14T22:11:13.369443+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"secrets-engine"}
{"at":"2026-10-14T22:11:13.371507+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"security-canon"}
{"at":"2026-10-14T22:11:13.373667+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"tenant-engine"}
{"at":"2026-10-14T22:11:13.376203+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"whitehat-security"}
{"at":"2026-10-14T22:11:13.378859+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"zone-engine"}
{"at":"2026-10-14T22:11:13.380873+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rail-knative"}
{"at":"2026-10-14T22:19:19.969383+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"approval-engine"}
{"at":"2026-10-14T22:19:19.969383+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"approval-engine"}
{"at":"2026-10-14T22:19:20.096237+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"emergent-security"}
{"at":"2026-10-14T22:19:20.096237+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"emergent-security"}
{"at":"2026-10-14T22:19:20.201945+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"fin-hub"}
{"at":"2026-10-14T22:19:20.201945+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"fin-hub"}
{"at":"2026-10-14T22:19:20.311948+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"gate-house"}
{"at":"2026-10-14T22:19:20.311948+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"gate-house"}
{"at":"2026-10-14T22:19:20.417470+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"glas-harness"}
{"at":"2026-10-14T22:19:20.417470+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"glas-harness"}
{"at":"2026-10-14T22:19:20.516965+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"informed-decision"}
{"at":"2026-10-14T22:19:20.516965+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"informed-decision"}
{"at":"2026-10-14T22:19:20.627189+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"kings-guard"}
{"at":"2026-10-14T22:19:20.627189+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"kings-guard"}
{"at":"2026-10-14T22:19:20.738432+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"maturity-engine"}
{"at":"2026-10-14T22:19:20.738432+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"maturity-engine"}
{"at":"2026-10-14T22:19:20.852933+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"ops-mason"}
{"at":"2026-10-14T22:19:20.852933+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"ops-mason"}
{"at":"2026-10-14T22:19:20.955682+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"policy-nexus"}
{"at":"2026-10-14T22:19:20.955682+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"policy-nexus"}
{"at":"2026-10-14T22:19:21.063571+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rail-kubernetes"}
{"at":"2026-10-14T22:19:21.063571+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rail-kubernetes"}
{"at":"2026-10-14T22:19:21.172865+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"railiance-bootstrap"}
{"at":"2026-10-14T22:19:21.172865+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"railiance-bootstrap"}
{"at":"2026-10-14T22:19:24.202084+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"railiance-master"}
{"at":"2026-10-14T22:19:24.202084+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"railiance-master"}
{"at":"2026-10-14T22:19:24.304744+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"railiance-telemetry"}
{"at":"2026-10-14T22:19:24.304744+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"railiance-telemetry"}
{"at":"2026-10-14T22:19:24.404162+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rapp-playwright"}
{"at":"2026-10-14T22:19:24.404162+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rapp-playwright"}
{"at":"2026-10-14T22:19:24.501978+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"reef-railiance"}
{"at":"2026-10-14T22:19:24.501978+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"reef-railiance"}
{"at":"2026-10-14T22:19:24.598482+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rein-aharness"}
{"at":"2026-10-14T22:19:24.598482+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rein-aharness"}
{"at":"2026-10-14T22:19:24.716900+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rein-openweights"}
{"at":"2026-10-14T22:19:24.716900+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rein-openweights"}
{"at":"2026-10-14T22:19:24.815553+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"repo-manager"}
{"at":"2026-10-14T22:19:24.815553+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"repo-manager"}
{"at":"2026-10-14T22:19:24.921586+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"resource-control"}
{"at":"2026-10-14T22:19:24.921586+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"resource-control"}
{"at":"2026-10-14T22:19:25.034921+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"risk-nexus"}
{"at":"2026-10-14T22:19:25.034921+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"risk-nexus"}
{"at":"2026-10-14T22:19:25.143690+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"role-engine"}
{"at":"2026-10-14T22:19:25.143690+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"role-engine"}
{"at":"2026-10-14T22:19:25.247740+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"runbook-tutorials"}
{"at":"2026-10-14T22:19:25.247740+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"runbook-tutorials"}
{"at":"2026-10-14T22:19:25.351093+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"sand-boxer"}
{"at":"2026-10-14T22:19:25.351093+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"sand-boxer"}
{"at":"2026-10-14T22:19:25.454641+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"sbom-nexus"}
{"at":"2026-10-14T22:19:25.454641+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"sbom-nexus"}
{"at":"2026-10-14T22:19:25.558997+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"secrets-engine"}
{"at":"2026-10-14T22:19:25.558997+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"secrets-engine"}
{"at":"2026-10-14T22:19:25.659662+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"security-canon"}
{"at":"2026-10-14T22:19:25.659662+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"security-canon"}
{"at":"2026-10-14T22:19:25.769760+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"tenant-engine"}
{"at":"2026-10-14T22:19:25.769760+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"tenant-engine"}
{"at":"2026-10-14T22:19:25.879033+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"whitehat-security"}
{"at":"2026-10-14T22:19:25.879033+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"whitehat-security"}
{"at":"2026-10-14T22:19:25.974741+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"zone-engine"}
{"at":"2026-10-14T22:19:25.974741+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"zone-engine"}
{"at":"2026-10-14T22:19:26.069099+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rail-knative"}
{"at":"2026-10-14T22:19:26.069099+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rail-knative"}
{"at":"2026-10-14T22:19:26.261887+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"readback_verified","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo_count":31}

14
docs/assessments/netkingdom-2026-10-14/live-authenticated-source-inventory-r1.json Normal file
View file

@ -0,0 +1,14 @@
{
"checked_at": "2026-10-14T23:01:13.254261+00:00",
"target_node_ip": "92.205.62.239",
"pod": "reuse-surface-54fb694b9-tv59j",
"helper_sha256": "42eed5513db090d338daec39258b89a4ce2e9369d175c3c8312904ed68867ee1",
"read_only": true,
"raw_output_discarded": true,
"credentials_read": false,
"secrets_or_environment_dumped": false,
"previous_deployment_target_attempt": "refused_or_unavailable; preserved; direct verified pod probe succeeded",
"status": "verified",
"authenticated_source_count": 0,
"sources": []
}

8
docs/assessments/netkingdom-2026-10-14/live-native-federation-source-r1.json Normal file
View file

@ -0,0 +1,8 @@
{
"checked_at": "2026-10-14T23:18:45.427267+00:00",
"pod": "reuse-surface-54fb694b9-tv59j",
"read_only": true,
"raw_output_discarded": true,
"status": "verified",
"native_source_sha256": "b6bde1e0942189e422f0c87f226ae28027f0dff1a29887a55eb88c8eaafe58ce"
}

11
docs/assessments/netkingdom-2026-10-14/oidc-diagnostic-finding-correction-r1.json Normal file
View file

@ -0,0 +1,11 @@
{
"id": "CUST81-OIDC-DIAGNOSTIC-FINDING-CORRECTION-R1",
"checked_at": "2026-10-15T02:18:32.162341+00:00",
"earlier_finding": "Appending -format=json after role= was characterized as functional format parsing bug.",
"corrected_evidence": "Bao command/main.go setupEnv scans all argv for global format before commandparser. The trailingflag selectsJSONoutput even though flag.FlagSet leaves it in authdata; OIDC ignoresunknownkey.",
"disposition": "Defensive argumentordering improvement, not proven functional bug or121secondcause.",
"still_confirmed_gap": "Warden fallback tokenrecoveryregex omits estate s. token shape.",
"server_correlation": "Sparse whitelisted events insufficient to prove authsuccess/failure/issuance/revocation.",
"actual_timeout_cause": "unproven",
"next_evidence": "Fixed value outputdiagnostic category on next attendedattempt or founderfinalpage clarification; noallowlist relaxation."
}

6
docs/assessments/netkingdom-2026-10-14/owner-access-gate.json
View file

@ -3,16 +3,16 @@
"id": "5cd22087-e5d8-5d5e-a252-610a6ac13653",
"topic_id": "cee7bedf-2b48-46ef-8601-006474f2ad7a",
"title": "Complete scoped owner provisioning for reuse-surface discovery",
"description": "Execution/evidence gate for CUST-WP-0081-T02. The user selected Arrange scoped owner access; that direction is already recorded and is not being requested again. railiance-platform must confirm caller admission through reuse-surface-hub-write-token (the actual attempt was denied by OpenBao 403), and provide the non-secret hub auth_env reference plus scoped-read and metadata-publication admission evidence for rapp-openbao, rapp-policy-nexus, rapp-postgres, rapp-sbom-nexus, rapp-telemetry, rapp-tenant-engine and rapp-user-engine. Exact requirements: docs/assessments/netkingdom-2026-10-14/scoped-access-handoff.json. No secret values in this record. Resolve on verified provisioning receipts; resolution alone is not a runtime credential grant. Do not attach to the already-resolved general October 11 provisioning decision or mark completed based on user intent.",
"description": "Execution/evidence gate for CUST-WP-0081-T02. Public batch applied and verified (63/70 hosted). Founder metadata disclosure consent for all seven private source revisions recorded separately as decision d8f8f216-ac94-4295-97f3-825fd21254ea; do not request it again. Remaining: independent technical reviews, restricted hub-only repository reader through railiance-platform reviewed custody/ESO delivery, sanitized auth_env and native fetch receipts, seven registrations and final all-70 audit. This gate stays open until verified provisioning; metadata consent is not a credential or rollout grant. See docs/assessments/netkingdom-2026-10-14/private-source-owner-consent-r1.json and scoped-access-handoff.json.",
"decision_type": "pending",
"status": "open",
"rationale": "All 70 owner capability records are established locally and published; hosted discovery remains 32/70. The remaining 38 registrations need this owner setup.",
"rationale": "All 70 owner records published; 63/70 verified hosted. Owner disclosure consent satisfied; seven-source reader and native fetch evidence pending.",
"decided_by": null,
"decided_at": null,
"deadline": null,
"escalation_note": null,
"superseded_by": null,
"created_at": "2026-10-14T07:51:34.426143Z",
"updated_at": "2026-10-14T07:51:34.426143Z",
"updated_at": "2026-10-14T22:31:45.188478Z",
"workstream_id": "e8992815-389a-5c40-8569-a2b0ee3945f0"
}

23
docs/assessments/netkingdom-2026-10-14/owner-assembly/active-phase-a-source-declaration-r1.json Normal file
View file

@ -0,0 +1,23 @@
{
"id": "CUST81-APPS-ACTIVE-PHASE-A-SOURCE-DECLARATION-R1",
"decision_id": "9833715e-a22a-45c0-ab6c-881f0f4f1a0e",
"approved_combined_proposal_digest_prefix": "704a9c",
"effect": "existing founder-approved phase A exact effect declared in normal production values, preventing later make reapply from restoring vulnerable image",
"path": "helm/reuse-surface-values.yaml",
"predecessor_sha256": "sha256:1b69c76629c8a938ca372f64d20513bbb9a59dcf12bb84f69b29228bc2bd2f60",
"new_sha256": "sha256:56c776b6f9c371c252f788058c16c678c47c5d1ef9e8666601897a22a91b272f",
"old_prod_plus_approved_overlay_semantics_equal": true,
"entire_normal_chart_render_equals_approved_phase_a_objects": true,
"image_digest": "sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0",
"allowlist_url_count": 14,
"other_value_semantics_unchanged": true,
"live_apply_performed": false,
"credential_or_eso_change": false,
"bound_preparation_artifacts_changed": false,
"status": "published_primary_reconciled",
"commit": "91f828b3c167c72ab9a0cec1263467345a7ab63c",
"remote_main": "91f828b3c167c72ab9a0cec1263467345a7ab63c",
"primary_derived_commit": "91f828b3c167c72ab9a0cec1263467345a7ab63c",
"normal_rmgr_status": "applied",
"primary_instance": "railiance01"
}

53
docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-a-current/exact-execution-proposal-r1.json Normal file
View file

@ -0,0 +1,53 @@
{
"id": "CUST81-APPS-PHASE-A-EXECUTION-PROPOSAL-R1",
"status": "prepared_not_executed",
"requires_founder_live_change_approval": true,
"release": "reuse",
"namespace": "reuse",
"source_commit": "05f654e20f7ea68471e586d7892e25441c65875d",
"source_archive_command": [
"git",
"-C",
"/home/worsch/railiance-apps",
"archive",
"--format=tar.gz",
"-o",
"/tmp/cust81-apps-05f654e.tar.gz",
"05f654e20f7ea68471e586d7892e25441c65875d",
"charts/reuse-surface",
"helm/reuse-surface-values.yaml",
"docs/assessments/cust81-private-reader/phase-a-local-image-r1/phase-a-values.proposed.yaml"
],
"node_preparation_commands": [
"ssh railiance01 'mkdir -p /tmp/cust81-phase-a-05f654e'",
"scp /tmp/cust81-apps-05f654e.tar.gz railiance01:/tmp/cust81-phase-a-05f654e/source.tar.gz",
"ssh railiance01 'tar -xzf /tmp/cust81-phase-a-05f654e/source.tar.gz -C /tmp/cust81-phase-a-05f654e'"
],
"exact_deploy_command": "ssh railiance01 'KUBECONFIG=/etc/rancher/k3s/k3s.yaml helm upgrade reuse /tmp/cust81-phase-a-05f654e/charts/reuse-surface --namespace reuse -f /tmp/cust81-phase-a-05f654e/helm/reuse-surface-values.yaml -f /tmp/cust81-phase-a-05f654e/docs/assessments/cust81-private-reader/phase-a-local-image-r1/phase-a-values.proposed.yaml --atomic --wait --timeout 5m'",
"phase_a_rollback_command": "ssh railiance01 'KUBECONFIG=/etc/rancher/k3s/k3s.yaml helm rollback reuse 10 --namespace reuse --wait --timeout 5m'",
"rollback_gate": "valid only before reader delivery; after phase B revoke/remove reader and verify absence before old image restore",
"last_deployed_revision": 10,
"pre_execution_recheck": [
"node92.205.62.239 and100m/256Mi surge capacity",
"authenticated registrations remain0",
"current Helm revision10/deployed and no pending operation",
"no reader ESO delivery performed",
"published manifest digest2364b7e... matches approval",
"database backup recovery receipt fresh enough for planned change and abort owner identified"
],
"safe_output_contract": "Executor captures/discards raw Helm/kubectl stdout/stderr and emits only whitelisted status/target/digest/readiness fields; never prints Secrets/env/annotations/rawerrors",
"database_recovery_receipt": {
"path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/reuse-database-recovery-preflight-r2.json",
"sha256": "c27c99cae46e7f1f0fb26fca91fdaec860d241966177432b3d55d391d10de84e"
},
"incremental_infrastructure_cost_eur": 0,
"credible_loss_bound_eur": null,
"risk": "supervised qualitative service/SQLite recovery risk; no autopilot grant",
"post_deploy_checks": [
"running imageID matches publisheddigest",
"Ready API/landing andhealth",
"native credential-routing refusals remain effective",
"fresh federation contains all63 public reviewed IDs exactlyonce",
"phaseBnotstarted until phaseAverificationreceipt"
]
}

49
docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-a-current/helm-recovery-revision-r1.json Normal file
View file

@ -0,0 +1,49 @@
{
"release": "reuse",
"namespace": "reuse",
"last_deployed_revision": 10,
"revisions": [
{
"revision": 1,
"status": "superseded"
},
{
"revision": 2,
"status": "superseded"
},
{
"revision": 3,
"status": "superseded"
},
{
"revision": 4,
"status": "superseded"
},
{
"revision": 5,
"status": "superseded"
},
{
"revision": 6,
"status": "superseded"
},
{
"revision": 7,
"status": "superseded"
},
{
"revision": 8,
"status": "superseded"
},
{
"revision": 9,
"status": "superseded"
},
{
"revision": 10,
"status": "deployed"
}
],
"raw_descriptions_values_stdout_stderr_discarded": true,
"live_change": false
}

53
docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-a-current/semantic-diff-r1.json Normal file
View file

@ -0,0 +1,53 @@
{
"status": "verified_intended_changes_only",
"kubectl_diff_exit": 1,
"changes": [
{
"object_name": "reuse-surface",
"direction": "removed",
"field": "generation",
"classification": "server_managed_generation_increment",
"expected_value_verified": true
},
{
"object_name": "reuse-surface",
"direction": "added",
"field": "generation",
"classification": "server_managed_generation_increment",
"expected_value_verified": true
},
{
"object_name": "reuse-surface",
"direction": "added",
"field": "- name",
"classification": "intended_allowlist_env_name",
"expected_value_verified": true
},
{
"object_name": "reuse-surface",
"direction": "added",
"field": "value",
"classification": "intended_exact14_allowlist_env_value",
"expected_value_verified": true
},
{
"object_name": "reuse-surface",
"direction": "removed",
"field": "image",
"classification": "prior_image",
"expected_value_verified": true
},
{
"object_name": "reuse-surface",
"direction": "added",
"field": "image",
"classification": "intended_image",
"expected_value_verified": true
}
],
"raw_values_annotations_stderr_discarded": true,
"live_changes": false,
"custom_external_parser_attempt": "did not yield receipt, no semantic claim inferred",
"generation_before": 6,
"generation_after_dry_run": 7
}

110
docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-a-current/server-preflight-r1.json Normal file
View file

@ -0,0 +1,110 @@
{
"checked_at": "2026-10-14T23:45:06.197843+00:00",
"target_node_ip": "92.205.62.239",
"release": "reuse",
"namespace": "reuse",
"render_sha256": "36c20c3e16757d3e888a3db02853032b33e791aa04a6055fe001121254345b81",
"reviewed_objects": [
{
"kind": "ConfigMap",
"name": "reuse-surface-landing"
},
{
"kind": "PersistentVolumeClaim",
"name": "reuse-surface-data"
},
{
"kind": "Service",
"name": "reuse-surface-landing"
},
{
"kind": "Service",
"name": "reuse-surface"
},
{
"kind": "Deployment",
"name": "reuse-surface"
},
{
"kind": "Deployment",
"name": "reuse-surface-landing"
},
{
"kind": "Ingress",
"name": "reuse-surface"
},
{
"kind": "Ingress",
"name": "reuse-surface-landing"
},
{
"kind": "Ingress",
"name": "reuse-surface-http-redirect"
},
{
"kind": "Middleware",
"name": "reuse-surface-redirect-https"
}
],
"results": [
{
"operation": "server_dry_run",
"exit_code": 0,
"known_failure_categories": [],
"whitelisted_actions": [
{
"name": "reuse-surface-landing",
"action": "configured"
},
{
"name": "reuse-surface-data",
"action": "configured"
},
{
"name": "reuse-surface-landing",
"action": "configured"
},
{
"name": "reuse-surface",
"action": "configured"
},
{
"name": "reuse-surface",
"action": "configured"
},
{
"name": "reuse-surface-landing",
"action": "configured"
},
{
"name": "reuse-surface",
"action": "configured"
},
{
"name": "reuse-surface-landing",
"action": "configured"
},
{
"name": "reuse-surface-http-redirect",
"action": "configured"
},
{
"name": "reuse-surface-redirect-https",
"action": "configured"
}
],
"raw_stdout_stderr_discarded": true
},
{
"operation": "client_diff",
"exit_code": 1,
"known_failure_categories": [],
"whitelisted_actions": [],
"raw_stdout_stderr_discarded": true
}
],
"live_changes_performed": false,
"secrets_or_env_read": false,
"prior_target_check": "ExternalIP-only expectation failed though kubectl exit0; corrected to documented InternalIP/ExternalIP address matching without restarting any live process",
"status": "server_accepted_diff_review_pending"
}

25
docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-a-current/source-publication-r3.json Normal file
View file

@ -0,0 +1,25 @@
{
"id": "CUST81-APPS-SOURCE-PUBLICATION-R3",
"status": "published_and_primary_reconciled",
"commit": "05f654e20f7ea68471e586d7892e25441c65875d",
"source_commit": "fb7d56d",
"uuid_commit": "05f654e",
"remote_main_verified": "05f654e20f7ea68471e586d7892e25441c65875d",
"primary_instance": "railiance01",
"primary_derived_commit": "05f654e20f7ea68471e586d7892e25441c65875d",
"normal_route": "uv run --project /home/worsch/repo-manager rmgr sync --path /home/worsch/railiance-apps --push --no-commit-identifiers",
"scanner_gate": "unchanged accepted normal push",
"original_backup_ref": "custody/cust81-apps-unpublished-r2",
"original_commits": [
"4e8e0f5",
"6a8a54d"
],
"unrelated_staged_preserved": [
".custodian-brief.md"
],
"unrelated_dirty_preserved": [
"WORK-RECORDS.md"
],
"production_values_eso_unchanged": true,
"live_change": false
}

53
docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/apps-owner-phase-b-review.md Normal file
View file

@ -0,0 +1,53 @@
# Apps phase B delivery preparation review
Disposition: `approved` for exact bounded preparation only. No founder credential,
source-activation or production rollout authorization is inferred. Own workitem
RAPPS-WP-0017-T03; INTENT basis is release contracts, explicit S3 handoffs,
repeatable recovery and evidence before confidence.
Full ExternalSecret server dry-run accepted and client diff verified only the
single new reader item plus native remoteRef defaults. Both old fields, existing
store, target and all other source spec/metadata are unchanged. The first strict
live equality check correctly refused on native ESO defaults, with no apply;
subsequent projection explicitly verified those defaults. The approved source
replacement is distinct from the current active file and must replace it only
after consent, then pass normal owner source publication before live apply.
Server acceptance does not prove the dedicated KV field or ESO read policy exists.
Phase B must follow verified phase A *and* terminal verified platform provisioning
under the exact approved CCR. Verify current API pod ready, spec image index and
imageID against published OCI index or its linux/amd64 child (exclude attestation
manifest), source federation/private verification module hashes and exact14 URL
allowlist. Confirm ESO Ready and selected reader-key presence only, then controlled
restart with fresh headroom/PVC readiness and capture-only output. No token or env
value enters argv, source, receipts or logs.
The native proof wrapper consumes only three exact-byte non-secret packets via
stdin, verifies their compiled hashes and module/source hashes, verifies the
complete14 URL allowlist, and invokes the application's native fetch path without
cache. Temporary packet files are0600 and removed. Four local refusal fixtures
passed; no real credentials or network requests were used. Its output must be
combined with separately verified API pod UID/readiness/image metadata; a
process receipt alone does not prove the target pod identity. Any missing,
mis-hashed, non-exact scope or native fetch outcome refuses success. Native
proof requires all7 sources and14 metadata fetches before registrations/final70.
Rollback ordering is explicit: revoke dedicated Forgejo PAT and verify; restore
source-controlled two-field ESO mapping to stop rematerialization; remove only
the materialized reader key through a captured exact JSON patch; restart the
current hardened deployment and verify reader absence in new pod/materialized
Secret plus issuer revocation. Only then may an independently approved rollback
to vulnerable Helm revision10 occur. No old-token fallback, default DB restore,
credential re-mint or Secret/env dump is proposed.
All exact predecessor/replacement digests, SSH delivery/restart/removal commands,
proof hashes/packet paths and gate schema are in phase-b-execution-proposal-r1.json.
No credential creation, ESO apply, Secret mutation, restart or deploy was executed.
Revision2 of the same proposal corrects malformed shell quoting in the original
reader-removal command. Original proposal/review/manifest remain archived.
The replacement is structured SSH argv with `shlex.join` over exact remote
kubectl argv and compact JSON patch. Offline shell parsing roundtrips exactly
one removal operation at `/data/REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN`; no
other key is touched. This refinement is not another successful trial.
Disposition remains approved preparation only, never founder live authority.

13
docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/command-parser-check-r2.json Normal file
View file

@ -0,0 +1,13 @@
{
"id": "CUST81-PHASE-B-COMMAND-PARSER-CHECK-R2",
"status": "passed",
"proposal_revision": 2,
"original_proposal_sha256": "sha256:572af68fcf56072c1fd846101a76611885acd6efedfe5dba10d96d9f77f701e0",
"ssh_argv_count": 3,
"remote_argv_roundtrip": true,
"patch_operation_count": 1,
"patch_op": "remove",
"patch_path": "/data/REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN",
"other_field_changes": false,
"live_command_executed": false
}

31
docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/eso-preflight-r1.json Normal file
View file

@ -0,0 +1,31 @@
{
"id": "CUST81-APPS-PHASE-B-ESO-PREFLIGHT-R1",
"checked_at": "2026-10-14T23:55:29.993576+00:00",
"target_node_ip": "92.205.62.239",
"status": "verified_preparation",
"active_predecessor_path": "/home/worsch/railiance-apps/manifests/reuse-surface-runtime-externalsecret.yaml",
"active_predecessor_sha256": "e036084aec9fad3bea63cc0d591c3b40a392ab9f54d9226a2d2b3fd7194d8a47",
"proposed_replacement_path": "/home/worsch/railiance-apps/docs/assessments/cust81-private-reader/reuse-surface-runtime-externalsecret.r1.yaml",
"proposed_replacement_sha256": "adfb34c0ee4d01bc602f57cd2320f1658465fb8f8660978828fffa05a5b604b5",
"old_two_fields_retained": true,
"existing_store_unchanged": true,
"live_spec_projected_matches_predecessor": true,
"native_remoteRef_defaults_verified": true,
"previous_attempt": "full live data equality assertion refused on native ESO defaults; no command apply executed, original refusal retained",
"results": [
{
"operation": "server_dry_run",
"exit_code": 0,
"raw_stdout_stderr_discarded": true
},
{
"operation": "client_diff",
"exit_code": 1,
"exact_new_reader_item_plus_native_defaults_only": true,
"raw_values_annotations_stderr_discarded": true
}
],
"credentials_provisioned": false,
"live_apply_performed": false,
"limitation": "server acceptance does not prove dedicated KV field exists or ESO consumer policy reader path granted"
}

18
docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/manifest.json Normal file
View file

@ -0,0 +1,18 @@
{
"proposal_id": "CUST81-APPS-PHASE-B-EXECUTION-PROPOSAL-R1",
"revision": 2,
"owner": "railiance-apps",
"disposition": "approved",
"approved_scope": "bounded source preparation only; no active ESO or live action",
"founder_live_approval": false,
"refinement_or_rescue": true,
"files": {
"apps-owner-phase-b-review.md": "sha256:496c842f4a284d6b2904c027dfd1e8aab85567f19fa74a228f27c4cc578ce026",
"command-parser-check-r2.json": "sha256:5080bdd2ece186200aec1a37b4450c99a50d435444f0f850277b82252516d6e1",
"eso-preflight-r1.json": "sha256:e39f07427af80fd036e6eec21202efe194fff2db67b8523bb07052e1388d8fab",
"native-proof-wrapper-local-checks-r1.json": "sha256:c5fcee128f7b4653ecfc0c455aab57a7efa8f6a9de382af69d447d8065091bab",
"native_runtime_proof_stdin.py": "sha256:1edc317e8563a120b62a6830eebb2875c144b45c57a491eb7da849095c5d1933",
"phase-b-execution-proposal-r1.json": "sha256:13f19158e09b0693a64ff400ecbc3e5ec09d28673731e87733d1e2fad9bd3222",
"run_eso_preflight.py": "sha256:fd42789518e9a6c1305fc3828bf1afb8c9a4e8238b4eeed30f7e7ec05656f09b"
}
}

15
docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/native-proof-wrapper-local-checks-r1.json Normal file
View file

@ -0,0 +1,15 @@
{
"id": "CUST81-NATIVE-RUNTIME-PROOF-PREPARATION-CHECKS-R1",
"status": "passed",
"wrapper_sha256": "1edc317e8563a120b62a6830eebb2875c144b45c57a491eb7da849095c5d1933",
"fixture_cases": [
"missing_reader",
"malformed_allowlist",
"tampered_packet",
"native_refusal"
],
"native_network_requests": 0,
"real_credentials_used": false,
"failure_output_sentinel_excluded": true,
"scope_refusal_before_any_fetch": true
}

38
docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/native_runtime_proof_stdin.py Normal file
View file

@ -0,0 +1,38 @@
"""Approved preparation only: execute in verified hardened API pod after phase B.
stdin envelope contains only three base64-encoded hash-bound non-secret packets.
No token accepted; native module consumes its reviewed runtime source credential.
"""
import base64,hashlib,json,os,tempfile
from pathlib import Path
import sys
from reuse_surface import federation, private_source_verify as native
EXPECTED={'proposal':'7819eb51d249f5c7aff4df9fb520afcfb76603b05a4104439499102b6c20af99','disclosure':'46ac4fe49a08054cc215aade2fbaf3b36ee334520997857ed84f530b52da9d35','consent':'4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52'}
FEDI='dbaa40f25cc0f090143578cd1c7068cb2cb00960fafd17d5239bf8a5bac514dd'
NATIVE='c67a284091cc4dd62dca56658a14b8ea1357e2b3df1518120da4c51e0ee8d85c'
receipt={'id':'CUST81-NATIVE-RUNTIME-PROOF-R1','status':'unverified','raw_errors_or_values_emitted':False}
try:
source_sha=hashlib.sha256(Path(federation.__file__).read_bytes()).hexdigest()
helper_sha=hashlib.sha256(Path(native.__file__).read_bytes()).hexdigest()
assert source_sha==FEDI and helper_sha==NATIVE
envelope=json.loads(sys.stdin.buffer.read(1048576))
assert set(envelope)==set(EXPECTED)
with tempfile.TemporaryDirectory(prefix='cust81-native-packets-') as temporary:
paths={}
for name,digest in EXPECTED.items():
content=base64.b64decode(envelope[name],validate=True)
assert hashlib.sha256(content).hexdigest()==digest
p=Path(temporary)/(name+'.json');p.write_bytes(content);p.chmod(0o600);paths[name]=p
sources=list(native._prepared_sources(paths['proposal'],paths['disclosure'],paths['consent']))
expected_urls={native._raw_url(source['repo'],source['consented_commit'],path) for source,files in sources for path in files}
allow=json.loads(os.environ.get('REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST','{}'))
assert set(allow)=={native.AUTH_ENV} and len(allow[native.AUTH_ENV])==14 and set(allow[native.AUTH_ENV])==expected_urls
# Presence only: never print/read the secret value here. Native acquisition
# is subsequently performed only at its reviewed exact URL routing boundary.
key_present=native.AUTH_ENV in os.environ
assert key_present
result=native.verify(paths['proposal'],paths['disclosure'],paths['consent'])
receipt.update(source_sha256=source_sha,helper_sha256=helper_sha,packet_sha256=EXPECTED,runtime_allowlist_exact14=True,reader_key_present=True,native_fetch=result,status='verified' if result['all_verified'] else 'native_fetch_failed')
except Exception:
receipt.update(status='runtime_or_native_proof_refused',error='hash_scope_or_native_validation_failed')
print(json.dumps(receipt,sort_keys=True))
raise SystemExit(0 if receipt['status']=='verified' else 1)

88
docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/phase-b-execution-proposal-r1.json Normal file
View file

@ -0,0 +1,88 @@
{
"id": "CUST81-APPS-PHASE-B-EXECUTION-PROPOSAL-R1",
"disposition": "approved",
"approved_scope": "bounded preparation only; founder live go still required",
"status": "prepared_not_executed",
"workitem": "RAPPS-WP-0017-T03",
"active_predecessor_sha256": "e036084aec9fad3bea63cc0d591c3b40a392ab9f54d9226a2d2b3fd7194d8a47",
"replacement_sha256": "adfb34c0ee4d01bc602f57cd2320f1658465fb8f8660978828fffa05a5b604b5",
"preconditions": [
"verified phase A current API pod ready pinned hardened image/source hashes",
"platform provisioner terminal verified and approved CCR revision executed",
"Forgejo exact7 readonly grants and PAT receipt verified",
"native ESO path-read policy/store issuer receipt verified",
"founder consent to exact phase B source update and delivery"
],
"source_update_after_consent": {
"command": "cp docs/assessments/cust81-private-reader/reuse-surface-runtime-externalsecret.r1.yaml manifests/reuse-surface-runtime-externalsecret.yaml",
"publication": "owner commits only exact replacement and normal rmgr sync --push; verify primary exact source commit before liveapply",
"not_executed": true
},
"apply_command": "ssh railiance01 'KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl apply -f /tmp/cust81-phase-b/reuse-surface-runtime-externalsecret.yaml'",
"sync_verify_before_restart": "wait for ESO Ready and selected reader-key-presence boolean via reviewed captured-output wrapper; never raw Secret/annotation/env output",
"restart_command": "ssh railiance01 'KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl rollout restart deployment/reuse-surface --namespace reuse'",
"restart_wait_command": "ssh railiance01 'KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl rollout status deployment/reuse-surface --namespace reuse --timeout=300s'",
"headroom_gate": "recheck100m/256Mi surge headroom/PVC and actual hardened deployment before restart",
"cleanup_order": [
"credential owner revokes exact dedicated Forgejo PAT and verifies revocation; no oldtoken fallback",
"restore reviewed two-field ESO manifest through source-controlled owner lane and apply, stops rematerialization",
"remove only REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN from reuse/reuse-surface-env with captured-output exact JSON patch",
"restart/wait current hardened deployment, verify reader-key absence boolean in new pod and materialized Secret plus exact token revocation",
"only then may separately approved Helm rollback reuse10 restore vulnerable priorimage; do not restore DB by default"
],
"raw_output_contract": "all mutating/proof child stdout/stderr captured/discarded; only whitelisted outcome/proof JSON may reach receipts",
"runtime_proof": {
"pod_metadata_schema": [
"verified API pod name and UID",
"Ready true",
"expected spec image OCI indexsha2364b7e...",
"actual imageID equals index or linux/amd64childsha1a69354af2bc87d4baaecc4b02e13fda468efd3746024f440cc6d138beeee2ab",
"node92.205.62.239",
"source/header-routing/native helper hashes verified",
"exact14 allowlist boolean",
"reader-key presence boolean",
"native14fetch/7consentedhashall_verified"
],
"wrapper_path": "/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/native_runtime_proof_stdin.py",
"wrapper_sha256": "1edc317e8563a120b62a6830eebb2875c144b45c57a491eb7da849095c5d1933",
"packets": {
"proposal": {
"path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/private-reader-provisioning-preparation-r1.json",
"sha256": "7819eb51d249f5c7aff4df9fb520afcfb76603b05a4104439499102b6c20af99"
},
"disclosure": {
"path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/private-source-disclosure-proposal-r1.json",
"sha256": "46ac4fe49a08054cc215aade2fbaf3b36ee334520997857ed84f530b52da9d35"
},
"consent": {
"path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/private-source-owner-consent-r1.json",
"sha256": "4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52"
}
},
"invocation": "capture kubectl --kubeconfig <verifiedconfig> -n reuse exec -i <metadata-verified current API pod> -c reuse-surface -- python3 -c <exact hash-bound wrapper source>; stdin JSON envelope {proposal:base64(exactbytes),disclosure:base64(exactbytes),consent:base64(exactbytes)}; no token/credential in argv or stdin; wrapper writes/removes only temporary nonsecret packet files",
"exit_success_required": true
},
"no_live_credential_or_apply_action": true,
"revision": 2,
"refinement_or_rescue": true,
"original_revision_sha256": "sha256:572af68fcf56072c1fd846101a76611885acd6efedfe5dba10d96d9f77f701e0",
"reader_key_removal_ssh_argv": [
"ssh",
"railiance01",
"env KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl patch secret reuse-surface-env --namespace reuse --type=json -p '[{\"op\":\"remove\",\"path\":\"/data/REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN\"}]'"
],
"reader_key_removal_remote_argv": [
"env",
"KUBECONFIG=/etc/rancher/k3s/k3s.yaml",
"kubectl",
"patch",
"secret",
"reuse-surface-env",
"--namespace",
"reuse",
"--type=json",
"-p",
"[{\"op\":\"remove\",\"path\":\"/data/REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN\"}]"
],
"reader_key_removal_offline_check": "passed shell roundtrip exact single remove op on only selected reader key; no other data field/annotation/spec touched"
}

283
docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/phase-b-preparation.patch Normal file
View file

@ -0,0 +1,283 @@
diff --git a/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/apps-owner-phase-b-review.md b/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/apps-owner-phase-b-review.md
new file mode 100644
index 0000000..57e022a
--- /dev/null
+++ b/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/apps-owner-phase-b-review.md
@@ -0,0 +1,45 @@
+# Apps phase B delivery preparation review
+
+Disposition: `approved` for exact bounded preparation only. No founder credential,
+source-activation or production rollout authorization is inferred. Own workitem
+RAPPS-WP-0017-T03; INTENT basis is release contracts, explicit S3 handoffs,
+repeatable recovery and evidence before confidence.
+
+Full ExternalSecret server dry-run accepted and client diff verified only the
+single new reader item plus native remoteRef defaults. Both old fields, existing
+store, target and all other source spec/metadata are unchanged. The first strict
+live equality check correctly refused on native ESO defaults, with no apply;
+subsequent projection explicitly verified those defaults. The approved source
+replacement is distinct from the current active file and must replace it only
+after consent, then pass normal owner source publication before live apply.
+Server acceptance does not prove the dedicated KV field or ESO read policy exists.
+
+Phase B must follow verified phase A *and* terminal verified platform provisioning
+under the exact approved CCR. Verify current API pod ready, spec image index and
+imageID against published OCI index or its linux/amd64 child (exclude attestation
+manifest), source federation/private verification module hashes and exact14 URL
+allowlist. Confirm ESO Ready and selected reader-key presence only, then controlled
+restart with fresh headroom/PVC readiness and capture-only output. No token or env
+value enters argv, source, receipts or logs.
+
+The native proof wrapper consumes only three exact-byte non-secret packets via
+stdin, verifies their compiled hashes and module/source hashes, verifies the
+complete14 URL allowlist, and invokes the application's native fetch path without
+cache. Temporary packet files are0600 and removed. Four local refusal fixtures
+passed; no real credentials or network requests were used. Its output must be
+combined with separately verified API pod UID/readiness/image metadata; a
+process receipt alone does not prove the target pod identity. Any missing,
+mis-hashed, non-exact scope or native fetch outcome refuses success. Native
+proof requires all7 sources and14 metadata fetches before registrations/final70.
+
+Rollback ordering is explicit: revoke dedicated Forgejo PAT and verify; restore
+source-controlled two-field ESO mapping to stop rematerialization; remove only
+the materialized reader key through a captured exact JSON patch; restart the
+current hardened deployment and verify reader absence in new pod/materialized
+Secret plus issuer revocation. Only then may an independently approved rollback
+to vulnerable Helm revision10 occur. No old-token fallback, default DB restore,
+credential re-mint or Secret/env dump is proposed.
+
+All exact predecessor/replacement digests, SSH delivery/restart/removal commands,
+proof hashes/packet paths and gate schema are in phase-b-execution-proposal-r1.json.
+No credential creation, ESO apply, Secret mutation, restart or deploy was executed.
diff --git a/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/eso-preflight-r1.json b/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/eso-preflight-r1.json
new file mode 100644
index 0000000..db58a9d
--- /dev/null
+++ b/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/eso-preflight-r1.json
@@ -0,0 +1,31 @@
+{
+ "id": "CUST81-APPS-PHASE-B-ESO-PREFLIGHT-R1",
+ "checked_at": "2026-10-14T23:55:29.993576+00:00",
+ "target_node_ip": "92.205.62.239",
+ "status": "verified_preparation",
+ "active_predecessor_path": "/home/worsch/railiance-apps/manifests/reuse-surface-runtime-externalsecret.yaml",
+ "active_predecessor_sha256": "e036084aec9fad3bea63cc0d591c3b40a392ab9f54d9226a2d2b3fd7194d8a47",
+ "proposed_replacement_path": "/home/worsch/railiance-apps/docs/assessments/cust81-private-reader/reuse-surface-runtime-externalsecret.r1.yaml",
+ "proposed_replacement_sha256": "adfb34c0ee4d01bc602f57cd2320f1658465fb8f8660978828fffa05a5b604b5",
+ "old_two_fields_retained": true,
+ "existing_store_unchanged": true,
+ "live_spec_projected_matches_predecessor": true,
+ "native_remoteRef_defaults_verified": true,
+ "previous_attempt": "full live data equality assertion refused on native ESO defaults; no command apply executed, original refusal retained",
+ "results": [
+ {
+ "operation": "server_dry_run",
+ "exit_code": 0,
+ "raw_stdout_stderr_discarded": true
+ },
+ {
+ "operation": "client_diff",
+ "exit_code": 1,
+ "exact_new_reader_item_plus_native_defaults_only": true,
+ "raw_values_annotations_stderr_discarded": true
+ }
+ ],
+ "credentials_provisioned": false,
+ "live_apply_performed": false,
+ "limitation": "server acceptance does not prove dedicated KV field exists or ESO consumer policy reader path granted"
+}
diff --git a/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/native-proof-wrapper-local-checks-r1.json b/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/native-proof-wrapper-local-checks-r1.json
new file mode 100644
index 0000000..43cd703
--- /dev/null
+++ b/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/native-proof-wrapper-local-checks-r1.json
@@ -0,0 +1,15 @@
+{
+ "id": "CUST81-NATIVE-RUNTIME-PROOF-PREPARATION-CHECKS-R1",
+ "status": "passed",
+ "wrapper_sha256": "1edc317e8563a120b62a6830eebb2875c144b45c57a491eb7da849095c5d1933",
+ "fixture_cases": [
+ "missing_reader",
+ "malformed_allowlist",
+ "tampered_packet",
+ "native_refusal"
+ ],
+ "native_network_requests": 0,
+ "real_credentials_used": false,
+ "failure_output_sentinel_excluded": true,
+ "scope_refusal_before_any_fetch": true
+}
diff --git a/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/native_runtime_proof_stdin.py b/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/native_runtime_proof_stdin.py
new file mode 100644
index 0000000..8b76d09
--- /dev/null
+++ b/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/native_runtime_proof_stdin.py
@@ -0,0 +1,38 @@
+"""Approved preparation only: execute in verified hardened API pod after phase B.
+stdin envelope contains only three base64-encoded hash-bound non-secret packets.
+No token accepted; native module consumes its reviewed runtime source credential.
+"""
+import base64,hashlib,json,os,tempfile
+from pathlib import Path
+import sys
+from reuse_surface import federation, private_source_verify as native
+EXPECTED={'proposal':'7819eb51d249f5c7aff4df9fb520afcfb76603b05a4104439499102b6c20af99','disclosure':'46ac4fe49a08054cc215aade2fbaf3b36ee334520997857ed84f530b52da9d35','consent':'4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52'}
+FEDI='dbaa40f25cc0f090143578cd1c7068cb2cb00960fafd17d5239bf8a5bac514dd'
+NATIVE='c67a284091cc4dd62dca56658a14b8ea1357e2b3df1518120da4c51e0ee8d85c'
+receipt={'id':'CUST81-NATIVE-RUNTIME-PROOF-R1','status':'unverified','raw_errors_or_values_emitted':False}
+try:
+ source_sha=hashlib.sha256(Path(federation.__file__).read_bytes()).hexdigest()
+ helper_sha=hashlib.sha256(Path(native.__file__).read_bytes()).hexdigest()
+ assert source_sha==FEDI and helper_sha==NATIVE
+ envelope=json.loads(sys.stdin.buffer.read(1048576))
+ assert set(envelope)==set(EXPECTED)
+ with tempfile.TemporaryDirectory(prefix='cust81-native-packets-') as temporary:
+ paths={}
+ for name,digest in EXPECTED.items():
+ content=base64.b64decode(envelope[name],validate=True)
+ assert hashlib.sha256(content).hexdigest()==digest
+ p=Path(temporary)/(name+'.json');p.write_bytes(content);p.chmod(0o600);paths[name]=p
+ sources=list(native._prepared_sources(paths['proposal'],paths['disclosure'],paths['consent']))
+ expected_urls={native._raw_url(source['repo'],source['consented_commit'],path) for source,files in sources for path in files}
+ allow=json.loads(os.environ.get('REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST','{}'))
+ assert set(allow)=={native.AUTH_ENV} and len(allow[native.AUTH_ENV])==14 and set(allow[native.AUTH_ENV])==expected_urls
+ # Presence only: never print/read the secret value here. Native acquisition
+ # is subsequently performed only at its reviewed exact URL routing boundary.
+ key_present=native.AUTH_ENV in os.environ
+ assert key_present
+ result=native.verify(paths['proposal'],paths['disclosure'],paths['consent'])
+ receipt.update(source_sha256=source_sha,helper_sha256=helper_sha,packet_sha256=EXPECTED,runtime_allowlist_exact14=True,reader_key_present=True,native_fetch=result,status='verified' if result['all_verified'] else 'native_fetch_failed')
+except Exception:
+ receipt.update(status='runtime_or_native_proof_refused',error='hash_scope_or_native_validation_failed')
+print(json.dumps(receipt,sort_keys=True))
+raise SystemExit(0 if receipt['status']=='verified' else 1)
diff --git a/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/phase-b-execution-proposal-r1.json b/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/phase-b-execution-proposal-r1.json
new file mode 100644
index 0000000..980719d
--- /dev/null
+++ b/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/phase-b-execution-proposal-r1.json
@@ -0,0 +1,67 @@
+{
+ "id": "CUST81-APPS-PHASE-B-EXECUTION-PROPOSAL-R1",
+ "disposition": "approved",
+ "approved_scope": "bounded preparation only; founder live go still required",
+ "status": "prepared_not_executed",
+ "workitem": "RAPPS-WP-0017-T03",
+ "active_predecessor_sha256": "e036084aec9fad3bea63cc0d591c3b40a392ab9f54d9226a2d2b3fd7194d8a47",
+ "replacement_sha256": "adfb34c0ee4d01bc602f57cd2320f1658465fb8f8660978828fffa05a5b604b5",
+ "preconditions": [
+ "verified phase A current API pod ready pinned hardened image/source hashes",
+ "platform provisioner terminal verified and approved CCR revision executed",
+ "Forgejo exact7 readonly grants and PAT receipt verified",
+ "native ESO path-read policy/store issuer receipt verified",
+ "founder consent to exact phase B source update and delivery"
+ ],
+ "source_update_after_consent": {
+ "command": "cp docs/assessments/cust81-private-reader/reuse-surface-runtime-externalsecret.r1.yaml manifests/reuse-surface-runtime-externalsecret.yaml",
+ "publication": "owner commits only exact replacement and normal rmgr sync --push; verify primary exact source commit before liveapply",
+ "not_executed": true
+ },
+ "apply_command": "ssh railiance01 'KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl apply -f /tmp/cust81-phase-b/reuse-surface-runtime-externalsecret.yaml'",
+ "sync_verify_before_restart": "wait for ESO Ready and selected reader-key-presence boolean via reviewed captured-output wrapper; never raw Secret/annotation/env output",
+ "restart_command": "ssh railiance01 'KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl rollout restart deployment/reuse-surface --namespace reuse'",
+ "restart_wait_command": "ssh railiance01 'KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl rollout status deployment/reuse-surface --namespace reuse --timeout=300s'",
+ "headroom_gate": "recheck100m/256Mi surge headroom/PVC and actual hardened deployment before restart",
+ "cleanup_order": [
+ "credential owner revokes exact dedicated Forgejo PAT and verifies revocation; no oldtoken fallback",
+ "restore reviewed two-field ESO manifest through source-controlled owner lane and apply, stops rematerialization",
+ "remove only REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN from reuse/reuse-surface-env with captured-output exact JSON patch",
+ "restart/wait current hardened deployment, verify reader-key absence boolean in new pod and materialized Secret plus exact token revocation",
+ "only then may separately approved Helm rollback reuse10 restore vulnerable priorimage; do not restore DB by default"
+ ],
+ "exact_reader_key_removal_command": "ssh railiance01 'KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl patch secret reuse-surface-env --namespace reuse --type=json -p '''[{\"op\":\"remove\",\"path\":\"/data/REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN\"}]''''",
+ "raw_output_contract": "all mutating/proof child stdout/stderr captured/discarded; only whitelisted outcome/proof JSON may reach receipts",
+ "runtime_proof": {
+ "pod_metadata_schema": [
+ "verified API pod name and UID",
+ "Ready true",
+ "expected spec image OCI indexsha2364b7e...",
+ "actual imageID equals index or linux/amd64childsha1a69354af2bc87d4baaecc4b02e13fda468efd3746024f440cc6d138beeee2ab",
+ "node92.205.62.239",
+ "source/header-routing/native helper hashes verified",
+ "exact14 allowlist boolean",
+ "reader-key presence boolean",
+ "native14fetch/7consentedhashall_verified"
+ ],
+ "wrapper_path": "/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/native_runtime_proof_stdin.py",
+ "wrapper_sha256": "1edc317e8563a120b62a6830eebb2875c144b45c57a491eb7da849095c5d1933",
+ "packets": {
+ "proposal": {
+ "path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/private-reader-provisioning-preparation-r1.json",
+ "sha256": "7819eb51d249f5c7aff4df9fb520afcfb76603b05a4104439499102b6c20af99"
+ },
+ "disclosure": {
+ "path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/private-source-disclosure-proposal-r1.json",
+ "sha256": "46ac4fe49a08054cc215aade2fbaf3b36ee334520997857ed84f530b52da9d35"
+ },
+ "consent": {
+ "path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/private-source-owner-consent-r1.json",
+ "sha256": "4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52"
+ }
+ },
+ "invocation": "capture kubectl --kubeconfig <verifiedconfig> -n reuse exec -i <metadata-verified current API pod> -c reuse-surface -- python3 -c <exact hash-bound wrapper source>; stdin JSON envelope {proposal:base64(exactbytes),disclosure:base64(exactbytes),consent:base64(exactbytes)}; no token/credential in argv or stdin; wrapper writes/removes only temporary nonsecret packet files",
+ "exit_success_required": true
+ },
+ "no_live_credential_or_apply_action": true
+}
diff --git a/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/run_eso_preflight.py b/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/run_eso_preflight.py
new file mode 100644
index 0000000..a1640b6
--- /dev/null
+++ b/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/run_eso_preflight.py
@@ -0,0 +1,30 @@
+from pathlib import Path
+import subprocess,json,yaml,hashlib,datetime
+art=Path(__file__).resolve().parent
+canonical=Path('/home/worsch/railiance-apps')
+old=canonical/'manifests/reuse-surface-runtime-externalsecret.yaml';new=canonical/'docs/assessments/cust81-private-reader/reuse-surface-runtime-externalsecret.r1.yaml'
+base=yaml.safe_load(old.read_text());proposal=yaml.safe_load(new.read_text())
+assert proposal['spec']['data'][:-1]==base['spec']['data']
+item=proposal['spec']['data'][-1]
+assert item=={'secretKey':'REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN','remoteRef':{'key':'workloads/reuse/reuse-surface/forgejo-source-read','property':'FORGEJO_SOURCE_TOKEN'}}
+assert {k:v for k,v in proposal.items() if k!='spec'}=={k:v for k,v in base.items() if k!='spec'}
+assert {k:v for k,v in proposal['spec'].items() if k!='data'}=={k:v for k,v in base['spec'].items() if k!='data'}
+kube=['kubectl','--kubeconfig','/home/worsch/.kube/config-railiance01']
+p=subprocess.run(kube+['get','nodes','-o','json'],capture_output=True,timeout=20);nodes=json.loads(p.stdout);assert p.returncode==0 and len(nodes['items'])==1 and any(a['address']=='92.205.62.239' for a in nodes['items'][0]['status']['addresses'])
+p=subprocess.run(kube+['-n','reuse','get','externalsecret','reuse-surface-runtime','-o','json'],capture_output=True,timeout=20);assert p.returncode==0;live=json.loads(p.stdout)
+rows=[{'secretKey':r['secretKey'],'remoteRef':{k:r['remoteRef'][k] for k in ('key','property')}} for r in live['spec']['data']]
+assert rows==base['spec']['data'] and live['spec']['secretStoreRef']==base['spec']['secretStoreRef']
+assert all({k:v for k,v in r['remoteRef'].items() if k not in ('key','property')}=={'conversionStrategy':'Default','decodingStrategy':'None','metadataPolicy':'None'} for r in live['spec']['data'])
+results=[]
+for args in [['apply','--dry-run=server','-f',str(new)],['diff','-f',str(new)]]:
+ p=subprocess.run(kube+['-n','reuse']+args,capture_output=True,timeout=60)
+ if args[0]=='diff':
+ changed=[line[1:].strip() for line in p.stdout.decode(errors='replace').splitlines() if line.startswith(('+','-')) and not line.startswith(('+++','---'))]
+ intended={'- remoteRef:', 'key: workloads/reuse/reuse-surface/forgejo-source-read','property: FORGEJO_SOURCE_TOKEN','secretKey: REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN','conversionStrategy: Default','decodingStrategy: None','metadataPolicy: None'}
+ other=[line for line in changed if line not in intended and not line.startswith('generation:')]
+ assert not other
+ results.append({'operation':'client_diff','exit_code':p.returncode,'exact_new_reader_item_plus_native_defaults_only':True,'raw_values_annotations_stderr_discarded':True})
+ else:results.append({'operation':'server_dry_run','exit_code':p.returncode,'raw_stdout_stderr_discarded':True})
+assert results[0]['exit_code']==0 and results[1]['exit_code'] in (0,1)
+r={'id':'CUST81-APPS-PHASE-B-ESO-PREFLIGHT-R1','checked_at':datetime.datetime.now(datetime.timezone.utc).isoformat(),'target_node_ip':'92.205.62.239','status':'verified_preparation','active_predecessor_path':str(old),'active_predecessor_sha256':hashlib.sha256(old.read_bytes()).hexdigest(),'proposed_replacement_path':str(new),'proposed_replacement_sha256':hashlib.sha256(new.read_bytes()).hexdigest(),'old_two_fields_retained':True,'existing_store_unchanged':True,'live_spec_projected_matches_predecessor':True,'native_remoteRef_defaults_verified':True,'previous_attempt':'full live data equality assertion refused on native ESO defaults; no command apply executed, original refusal retained','results':results,'credentials_provisioned':False,'live_apply_performed':False,'limitation':'server acceptance does not prove dedicated KV field exists or ESO consumer policy reader path granted'}
+(art/'eso-preflight-r1.json').write_text(json.dumps(r,indent=2)+'\n');print(json.dumps(r,indent=2))
diff --git a/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/manifest.json b/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/manifest.json
new file mode 100644
index 0000000..c96bfbc
--- /dev/null
+++ b/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/manifest.json
@@ -0,0 +1,15 @@
+{
+ "proposal_id": "CUST81-APPS-PHASE-B-EXECUTION-PROPOSAL-R1",
+ "owner": "railiance-apps",
+ "disposition": "approved",
+ "approved_scope": "bounded preparation only",
+ "founder_live_approval": false,
+ "files": {
+ "apps-owner-phase-b-review.md": "sha256:2ed614f22f64abbba497ca116220bd33a9985b7aa2a5608bf01cbdd18c30f863",
+ "eso-preflight-r1.json": "sha256:e39f07427af80fd036e6eec21202efe194fff2db67b8523bb07052e1388d8fab",
+ "native-proof-wrapper-local-checks-r1.json": "sha256:c5fcee128f7b4653ecfc0c455aab57a7efa8f6a9de382af69d447d8065091bab",
+ "native_runtime_proof_stdin.py": "sha256:1edc317e8563a120b62a6830eebb2875c144b45c57a491eb7da849095c5d1933",
+ "phase-b-execution-proposal-r1.json": "sha256:572af68fcf56072c1fd846101a76611885acd6efedfe5dba10d96d9f77f701e0",
+ "run_eso_preflight.py": "sha256:fd42789518e9a6c1305fc3828bf1afb8c9a4e8238b4eeed30f7e7ec05656f09b"
+ }
+}

30
docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/run_eso_preflight.py Normal file
View file

@ -0,0 +1,30 @@
from pathlib import Path
import subprocess,json,yaml,hashlib,datetime
art=Path(__file__).resolve().parent
canonical=Path('/home/worsch/railiance-apps')
old=canonical/'manifests/reuse-surface-runtime-externalsecret.yaml';new=canonical/'docs/assessments/cust81-private-reader/reuse-surface-runtime-externalsecret.r1.yaml'
base=yaml.safe_load(old.read_text());proposal=yaml.safe_load(new.read_text())
assert proposal['spec']['data'][:-1]==base['spec']['data']
item=proposal['spec']['data'][-1]
assert item=={'secretKey':'REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN','remoteRef':{'key':'workloads/reuse/reuse-surface/forgejo-source-read','property':'FORGEJO_SOURCE_TOKEN'}}
assert {k:v for k,v in proposal.items() if k!='spec'}=={k:v for k,v in base.items() if k!='spec'}
assert {k:v for k,v in proposal['spec'].items() if k!='data'}=={k:v for k,v in base['spec'].items() if k!='data'}
kube=['kubectl','--kubeconfig','/home/worsch/.kube/config-railiance01']
p=subprocess.run(kube+['get','nodes','-o','json'],capture_output=True,timeout=20);nodes=json.loads(p.stdout);assert p.returncode==0 and len(nodes['items'])==1 and any(a['address']=='92.205.62.239' for a in nodes['items'][0]['status']['addresses'])
p=subprocess.run(kube+['-n','reuse','get','externalsecret','reuse-surface-runtime','-o','json'],capture_output=True,timeout=20);assert p.returncode==0;live=json.loads(p.stdout)
rows=[{'secretKey':r['secretKey'],'remoteRef':{k:r['remoteRef'][k] for k in ('key','property')}} for r in live['spec']['data']]
assert rows==base['spec']['data'] and live['spec']['secretStoreRef']==base['spec']['secretStoreRef']
assert all({k:v for k,v in r['remoteRef'].items() if k not in ('key','property')}=={'conversionStrategy':'Default','decodingStrategy':'None','metadataPolicy':'None'} for r in live['spec']['data'])
results=[]
for args in [['apply','--dry-run=server','-f',str(new)],['diff','-f',str(new)]]:
p=subprocess.run(kube+['-n','reuse']+args,capture_output=True,timeout=60)
if args[0]=='diff':
changed=[line[1:].strip() for line in p.stdout.decode(errors='replace').splitlines() if line.startswith(('+','-')) and not line.startswith(('+++','---'))]
intended={'- remoteRef:', 'key: workloads/reuse/reuse-surface/forgejo-source-read','property: FORGEJO_SOURCE_TOKEN','secretKey: REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN','conversionStrategy: Default','decodingStrategy: None','metadataPolicy: None'}
other=[line for line in changed if line not in intended and not line.startswith('generation:')]
assert not other
results.append({'operation':'client_diff','exit_code':p.returncode,'exact_new_reader_item_plus_native_defaults_only':True,'raw_values_annotations_stderr_discarded':True})
else:results.append({'operation':'server_dry_run','exit_code':p.returncode,'raw_stdout_stderr_discarded':True})
assert results[0]['exit_code']==0 and results[1]['exit_code'] in (0,1)
r={'id':'CUST81-APPS-PHASE-B-ESO-PREFLIGHT-R1','checked_at':datetime.datetime.now(datetime.timezone.utc).isoformat(),'target_node_ip':'92.205.62.239','status':'verified_preparation','active_predecessor_path':str(old),'active_predecessor_sha256':hashlib.sha256(old.read_bytes()).hexdigest(),'proposed_replacement_path':str(new),'proposed_replacement_sha256':hashlib.sha256(new.read_bytes()).hexdigest(),'old_two_fields_retained':True,'existing_store_unchanged':True,'live_spec_projected_matches_predecessor':True,'native_remoteRef_defaults_verified':True,'previous_attempt':'full live data equality assertion refused on native ESO defaults; no command apply executed, original refusal retained','results':results,'credentials_provisioned':False,'live_apply_performed':False,'limitation':'server acceptance does not prove dedicated KV field exists or ESO consumer policy reader path granted'}
(art/'eso-preflight-r1.json').write_text(json.dumps(r,indent=2)+'\n');print(json.dumps(r,indent=2))

18
docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-publication-r2.json Normal file
View file

@ -0,0 +1,18 @@
{
"id": "CUST81-APPS-PHASE-B-SOURCE-PUBLICATION-R2",
"status": "published_primary_reconciled",
"commit": "ea2d4632a114c348c70b01d684cc5a2d4f413b91",
"remote_main": "ea2d4632a114c348c70b01d684cc5a2d4f413b91",
"primary_derived_commit": "ea2d4632a114c348c70b01d684cc5a2d4f413b91",
"normal_rmgr_status": "applied",
"primary_instance": "railiance01",
"canonical_folder": "/home/worsch/railiance-apps/docs/assessments/cust81-private-reader/phase-b-r1",
"canonical_proposal": "/home/worsch/railiance-apps/docs/assessments/cust81-private-reader/phase-b-r1/phase-b-execution-proposal-r1.json",
"canonical_review": "/home/worsch/railiance-apps/docs/assessments/cust81-private-reader/phase-b-r1/apps-owner-phase-b-review.md",
"manifest_sha256": "sha256:52ec35f1e150c1e2aca21bc138b523bf74423dd391e62daca8182d1b8924ed34",
"proposal_sha256": "sha256:13f19158e09b0693a64ff400ecbc3e5ec09d28673731e87733d1e2fad9bd3222",
"active_eso_unchanged": true,
"all_bound_file_digests_verified": true,
"unrelated_staged_brief_preserved": true,
"live_actions_executed": false
}

56
docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/files/charts/reuse-surface/templates/_helpers.tpl Normal file
View file

@ -0,0 +1,56 @@
{{- define "reuse.fullname" -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- printf "%s" $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- define "reuse.labels" -}}
app.kubernetes.io/name: {{ include "reuse.fullname" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
app.kubernetes.io/part-of: railiance-apps
helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" }}
{{- end -}}
{{- define "reuse.selectorLabels" -}}
app.kubernetes.io/name: {{ include "reuse.fullname" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end -}}
{{- define "reuse.landingFullname" -}}
{{- printf "%s-landing" (include "reuse.fullname" .) | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- define "reuse.redirectMiddlewareName" -}}
{{- printf "%s-redirect-https" (include "reuse.fullname" .) | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- define "reuse.landingSelectorLabels" -}}
app.kubernetes.io/name: {{ include "reuse.fullname" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: landing
{{- end -}}
{{- define "reuse.image" -}}
{{- if and .Values.authSourceAllowlist (not .Values.image.digest) -}}
{{- fail "authenticated source allowlist requires reviewed hardened image.digest" -}}
{{- end -}}
{{- if .Values.image.digest -}}
{{- if not (regexMatch "^sha256:[a-f0-9]{64}$" .Values.image.digest) -}}
{{- fail "image.digest must be sha256 plus 64 lowercase hex characters" -}}
{{- end -}}
{{- printf "%s@%s" .Values.image.repository .Values.image.digest -}}
{{- else -}}
{{- if not .Values.image.tag -}}
{{- fail "image.tag is required - pin it in helm/reuse-surface-values.yaml" -}}
{{- end -}}
{{- printf "%s:%s" .Values.image.repository .Values.image.tag -}}
{{- end -}}
{{- end -}}
{{- define "reuse.landingImage" -}}
{{- if not .Values.landing.image.tag -}}
{{- fail "landing.image.tag is required when landing.enabled=true" -}}
{{- end -}}
{{- printf "%s:%s" .Values.landing.image.repository .Values.landing.image.tag -}}
{{- end -}}

87
docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/files/charts/reuse-surface/templates/deployment.yaml Normal file
View file

@ -0,0 +1,87 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "reuse.fullname" . }}
labels:
{{- include "reuse.labels" . | nindent 4 }}
app.kubernetes.io/component: api
spec:
replicas: {{ .Values.replicaCount }}
selector:
matchLabels: {{- include "reuse.selectorLabels" . | nindent 6 }}
strategy:
type: RollingUpdate
rollingUpdate:
maxSurge: 1
maxUnavailable: 0
template:
metadata:
labels:
{{- include "reuse.selectorLabels" . | nindent 8 }}
app.kubernetes.io/component: api
spec:
enableServiceLinks: false
securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }}
containers:
- name: reuse-surface
image: {{ include "reuse.image" . | quote }}
imagePullPolicy: {{ .Values.image.pullPolicy }}
command: ["reuse-surface", "serve"]
securityContext: {{- toYaml .Values.securityContext | nindent 12 }}
ports:
- name: http
containerPort: {{ .Values.service.targetPort }}
protocol: TCP
envFrom:
- secretRef:
name: {{ .Values.envSecretName | quote }}
env:
- name: REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST
value: {{ .Values.authSourceAllowlist | toJson | quote }}
- name: REUSE_SURFACE_LISTEN_HOST
value: "0.0.0.0"
- name: REUSE_SURFACE_LISTEN_PORT
value: {{ .Values.service.targetPort | quote }}
- name: REUSE_SURFACE_DB
value: {{ printf "%s/reuse.db" .Values.persistence.mountPath | quote }}
- name: REUSE_SURFACE_CACHE_DIR
value: {{ printf "%s/cache" .Values.persistence.mountPath | quote }}
{{- if .Values.persistence.enabled }}
volumeMounts:
- name: data
mountPath: {{ .Values.persistence.mountPath }}
{{- end }}
{{- if .Values.probes.enabled }}
readinessProbe:
httpGet:
path: {{ .Values.probes.path }}
port: {{ .Values.probes.port }}
initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
livenessProbe:
httpGet:
path: {{ .Values.probes.path }}
port: {{ .Values.probes.port }}
initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
{{- end }}
resources: {{- toYaml .Values.resources | nindent 12 }}
{{- if .Values.persistence.enabled }}
volumes:
- name: data
persistentVolumeClaim:
claimName: {{ include "reuse.fullname" . }}-data
{{- end }}
{{- with .Values.nodeSelector }}
nodeSelector: {{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.affinity }}
affinity: {{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.tolerations }}
tolerations: {{- toYaml . | nindent 8 }}
{{- end }}

30
docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/files/charts/reuse-surface/values.schema.json Normal file
View file

@ -0,0 +1,30 @@
{
"$schema": "https://json-schema.org/draft-07/schema#",
"type": "object",
"properties": {
"image": {
"type": "object",
"properties": {
"digest": {
"type": "string",
"pattern": "^(|sha256:[a-f0-9]{64})$"
}
}
},
"authSourceAllowlist": {
"type": "object",
"propertyNames": {
"pattern": "^[A-Z][A-Z0-9_]*$"
},
"additionalProperties": {
"type": "array",
"uniqueItems": true,
"items": {
"type": "string",
"pattern": "^https://[^\\s]+$"
},
"minItems": 1
}
}
}
}

106
docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/files/charts/reuse-surface/values.yaml Normal file
View file

@ -0,0 +1,106 @@
image:
repository: forgejo.coulomb.social/coulomb/reuse-surface
tag: ""
digest: ""
pullPolicy: IfNotPresent
replicaCount: 1
service:
type: ClusterIP
port: 8000
targetPort: 8000
persistence:
enabled: true
size: 1Gi
mountPath: /data
storageClassName: ""
resources:
requests:
cpu: 100m
memory: 256Mi
limits:
cpu: 500m
memory: 512Mi
envSecretName: reuse-surface-env
# Non-secret exact URL bindings for authenticated remote metadata fetches.
# Nonempty bindings require an immutable digest; use only a reviewed hardened image.
authSourceAllowlist: {}
landing:
enabled: false
image:
repository: nginxinc/nginx-unprivileged
tag: "1.27-alpine"
pullPolicy: IfNotPresent
service:
port: 8080
targetPort: 8080
ingress:
# Explicit Traefik router priority for the landing catch-all. Traefik
# otherwise derives priority from rule-string length, where PathPrefix(`/`)
# ties with Path(`/health`) and can win. Keep this below every API route.
priority: 1
noindex: true
title: "Railiance service endpoint"
eyebrow: "Railiance S5"
body: "This endpoint is available for automated clients and operators."
buttonLabel: "Continue"
primaryUrl: ""
redirect:
enabled: false
target: ""
delaySeconds: 5
links: []
html: ""
resources:
requests:
cpu: 10m
memory: 32Mi
limits:
cpu: 50m
memory: 64Mi
ingress:
enabled: true
className: traefik
host: reuse.coulomb.social
tls: true
redirectHttp:
enabled: false
permanent: true
apiPaths:
- path: /health
pathType: Exact
- path: /v1
pathType: Prefix
annotations:
traefik.ingress.kubernetes.io/router.entrypoints: websecure
traefik.ingress.kubernetes.io/router.tls: "true"
cert-manager.io/cluster-issuer: letsencrypt-prod
probes:
enabled: true
path: /health
port: 8000
liveness:
initialDelaySeconds: 15
periodSeconds: 30
timeoutSeconds: 5
failureThreshold: 3
readiness:
initialDelaySeconds: 10
periodSeconds: 10
timeoutSeconds: 5
failureThreshold: 3
podSecurityContext: {}
securityContext: {}
nodeSelector: {}
tolerations: []
affinity: {}

61
docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/files/scripts/reuse_authenticated_source_inventory.py Normal file
View file

@ -0,0 +1,61 @@
#!/usr/bin/env python3
"""Read-only authenticated source metadata; never read env or Kubernetes Secrets.
Caller must first confirm the kubeconfig targets railiance01. Raw command
stdout/stderr and exception text are never emitted. No credentials are needed
beyond the caller's separately approved Kubernetes observation/exec lane.
"""
import argparse
import json
import re
import subprocess
from urllib.parse import urlsplit, parse_qs
# SQL projects metadata only; the registration payload itself is never printed.
POD_CODE = '''import json, sqlite3
with sqlite3.connect("file:/data/reuse.db?mode=ro", uri=True) as db:
rows=db.execute("SELECT repo, json_extract(payload, '$.auth_env'), json_extract(payload, '$.index_url') FROM registrations WHERE json_extract(payload, '$.auth_env') IS NOT NULL AND json_extract(payload, '$.auth_env') != ''").fetchall()
print(json.dumps(rows))
'''
def sanitize(rows):
result = []
for repo, name, url in rows:
if not isinstance(repo, str) or not re.fullmatch(r'[a-zA-Z0-9_.-]{1,128}', repo):
raise ValueError('invalid metadata')
if not isinstance(name, str) or not re.fullmatch(r'[A-Z][A-Z0-9_]{0,127}', name):
raise ValueError('invalid metadata')
parts = urlsplit(url)
# URLs are untrusted stored data; refuse userinfo/fragments and arbitrary
# query fields (which could contain credentials). Never echo invalid rows.
query = parse_qs(parts.query, keep_blank_values=True)
if (parts.scheme != 'https' or parts.username or parts.password or parts.fragment
or parts.hostname != 'forgejo.coulomb.social' or parts.port not in (None, 443)
or not re.fullmatch(r'/api/v1/repos/coulomb/[a-zA-Z0-9_.-]+/raw/registry/indexes/[a-zA-Z0-9_.-]+', parts.path)
or any(k != 'ref' for k in query)
or ('ref' in query and (len(query['ref']) != 1 or not re.fullmatch(r'[a-zA-Z0-9_.-]{1,128}', query['ref'][0])))):
raise ValueError('unsafe metadata')
result.append({'repo': repo, 'auth_env': name, 'index_url': url})
return sorted(result, key=lambda row: row['repo'])
def main():
parser = argparse.ArgumentParser(description=__doc__)
parser.add_argument('--kubeconfig', required=True)
args = parser.parse_args()
try:
proc = subprocess.run(['kubectl', '--kubeconfig', args.kubeconfig, '-n', 'reuse',
'exec', 'deployment/reuse-surface', '-c', 'reuse-surface', '--', 'python3', '-c', POD_CODE],
capture_output=True, timeout=30)
if proc.returncode:
raise RuntimeError('inventory unavailable')
rows = sanitize(json.loads(proc.stdout))
except Exception:
print(json.dumps({'status': 'refused_or_unavailable', 'raw_output_discarded': True}))
return 1
print(json.dumps({'status': 'verified', 'authenticated_source_count': len(rows), 'sources': rows}, indent=2))
return 0
if __name__ == '__main__':
raise SystemExit(main())

57
docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/files/workplans/RAPPS-WP-0017-reuse-private-reader-release.md Normal file
View file

@ -0,0 +1,57 @@
---
id: RAPPS-WP-0017
type: workplan
title: "Release hardened reuse federation with seven-source metadata reader"
domain: financials
repo: railiance-apps
status: proposed
owner: codex
created: "2026-10-15"
updated: "2026-10-15"
flavor: implementation
depends_on: [RPF-WP-0058, REUSE-WP-0025]
---
Provisional id in isolated preparation checkout; root integration must confirm
availability. No hub registration, fix-consistency or push until integration.
Source owners approved metadata disclosure under CUST81 R1; that is not approval
for live credential issuance or workload rollout. Apps owns only S5 release.
## Prepare bounded release contract
```task
id: RAPPS-WP-0017-T01
status: done
priority: high
```
Prepare chart allowlist/digest support, exact14 URL override and separate phase-B
ESO manifest, own preparation review and meaningful local validation.
Evidence: docs/assessments/cust81-private-reader/apps-owner-review-r1.md.
## Verify and promote hardened runtime before reader delivery
```task
id: RAPPS-WP-0017-T02
status: wait
priority: high
```
Wait for published fully hardened image digest/source/tests plus owner reviews
and change authorization. Obtain metadata-only existing auth-source migration
inventory, live headroom/PVC evidence, exact server dry-run/diff, baseline health
and rollback receipt. Phase A deploy excludes reader ESO mapping.
## Deliver reviewed reader and prove complete hosted discovery
```task
id: RAPPS-WP-0017-T03
status: wait
priority: high
```
After verified phase A and approved/executed platform CCR, apply phase-B ESO
mapping and restart hardened runtime through reviewed owner lane. Require
sanitized ESO/key-presence proof and reuse native14 fetch/7 entry hashes before
registration. Final CUST81 owner verifies70/70 hosted; rollback revokes/removes
reader before any vulnerable image restoration.

615
docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/review/apps-chart-preparation-r1.patch Normal file
View file

@ -0,0 +1,615 @@
diff --git a/charts/reuse-surface/templates/_helpers.tpl b/charts/reuse-surface/templates/_helpers.tpl
index 1c46bdb..cdcae93 100644
--- a/charts/reuse-surface/templates/_helpers.tpl
+++ b/charts/reuse-surface/templates/_helpers.tpl
@@ -32,11 +32,21 @@ app.kubernetes.io/component: landing
{{- end -}}
{{- define "reuse.image" -}}
+{{- if and .Values.authSourceAllowlist (not .Values.image.digest) -}}
+{{- fail "authenticated source allowlist requires reviewed hardened image.digest" -}}
+{{- end -}}
+{{- if .Values.image.digest -}}
+{{- if not (regexMatch "^sha256:[a-f0-9]{64}$" .Values.image.digest) -}}
+{{- fail "image.digest must be sha256 plus 64 lowercase hex characters" -}}
+{{- end -}}
+{{- printf "%s@%s" .Values.image.repository .Values.image.digest -}}
+{{- else -}}
{{- if not .Values.image.tag -}}
{{- fail "image.tag is required - pin it in helm/reuse-surface-values.yaml" -}}
{{- end -}}
{{- printf "%s:%s" .Values.image.repository .Values.image.tag -}}
{{- end -}}
+{{- end -}}
{{- define "reuse.landingImage" -}}
{{- if not .Values.landing.image.tag -}}
diff --git a/charts/reuse-surface/templates/deployment.yaml b/charts/reuse-surface/templates/deployment.yaml
index b1c47e7..06b815d 100644
--- a/charts/reuse-surface/templates/deployment.yaml
+++ b/charts/reuse-surface/templates/deployment.yaml
@@ -36,6 +36,8 @@ spec:
- secretRef:
name: {{ .Values.envSecretName | quote }}
env:
+ - name: REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST
+ value: {{ .Values.authSourceAllowlist | toJson | quote }}
- name: REUSE_SURFACE_LISTEN_HOST
value: "0.0.0.0"
- name: REUSE_SURFACE_LISTEN_PORT
diff --git a/charts/reuse-surface/values.yaml b/charts/reuse-surface/values.yaml
index fb54e76..0e520d2 100644
--- a/charts/reuse-surface/values.yaml
+++ b/charts/reuse-surface/values.yaml
@@ -1,6 +1,7 @@
image:
repository: forgejo.coulomb.social/coulomb/reuse-surface
tag: ""
+ digest: ""
pullPolicy: IfNotPresent
replicaCount: 1
@@ -26,6 +27,10 @@ resources:
envSecretName: reuse-surface-env
+# Non-secret exact URL bindings for authenticated remote metadata fetches.
+# Nonempty bindings require an immutable digest; use only a reviewed hardened image.
+authSourceAllowlist: {}
+
landing:
enabled: false
image:
diff --git a/charts/reuse-surface/values.schema.json b/charts/reuse-surface/values.schema.json
new file mode 100644
index 0000000..7367c10
--- /dev/null
+++ b/charts/reuse-surface/values.schema.json
@@ -0,0 +1,30 @@
+{
+ "$schema": "https://json-schema.org/draft-07/schema#",
+ "type": "object",
+ "properties": {
+ "image": {
+ "type": "object",
+ "properties": {
+ "digest": {
+ "type": "string",
+ "pattern": "^(|sha256:[a-f0-9]{64})$"
+ }
+ }
+ },
+ "authSourceAllowlist": {
+ "type": "object",
+ "propertyNames": {
+ "pattern": "^[A-Z][A-Z0-9_]*$"
+ },
+ "additionalProperties": {
+ "type": "array",
+ "uniqueItems": true,
+ "items": {
+ "type": "string",
+ "pattern": "^https://[^\\s]+$"
+ },
+ "minItems": 1
+ }
+ }
+ }
+}
diff --git a/scripts/reuse_authenticated_source_inventory.py b/scripts/reuse_authenticated_source_inventory.py
new file mode 100644
index 0000000..1072c97
--- /dev/null
+++ b/scripts/reuse_authenticated_source_inventory.py
@@ -0,0 +1,61 @@
+#!/usr/bin/env python3
+"""Read-only authenticated source metadata; never read env or Kubernetes Secrets.
+
+Caller must first confirm the kubeconfig targets railiance01. Raw command
+stdout/stderr and exception text are never emitted. No credentials are needed
+beyond the caller's separately approved Kubernetes observation/exec lane.
+"""
+import argparse
+import json
+import re
+import subprocess
+from urllib.parse import urlsplit, parse_qs
+
+# SQL projects metadata only; the registration payload itself is never printed.
+POD_CODE = '''import json, sqlite3
+with sqlite3.connect("file:/data/reuse.db?mode=ro", uri=True) as db:
+ rows=db.execute("SELECT repo, json_extract(payload, '$.auth_env'), json_extract(payload, '$.index_url') FROM registrations WHERE json_extract(payload, '$.auth_env') IS NOT NULL AND json_extract(payload, '$.auth_env') != ''").fetchall()
+ print(json.dumps(rows))
+'''
+
+
+def sanitize(rows):
+ result = []
+ for repo, name, url in rows:
+ if not isinstance(repo, str) or not re.fullmatch(r'[a-zA-Z0-9_.-]{1,128}', repo):
+ raise ValueError('invalid metadata')
+ if not isinstance(name, str) or not re.fullmatch(r'[A-Z][A-Z0-9_]{0,127}', name):
+ raise ValueError('invalid metadata')
+ parts = urlsplit(url)
+ # URLs are untrusted stored data; refuse userinfo/fragments and arbitrary
+ # query fields (which could contain credentials). Never echo invalid rows.
+ query = parse_qs(parts.query, keep_blank_values=True)
+ if (parts.scheme != 'https' or parts.username or parts.password or parts.fragment
+ or parts.hostname != 'forgejo.coulomb.social' or parts.port not in (None, 443)
+ or not re.fullmatch(r'/api/v1/repos/coulomb/[a-zA-Z0-9_.-]+/raw/registry/indexes/[a-zA-Z0-9_.-]+', parts.path)
+ or any(k != 'ref' for k in query)
+ or ('ref' in query and (len(query['ref']) != 1 or not re.fullmatch(r'[a-zA-Z0-9_.-]{1,128}', query['ref'][0])))):
+ raise ValueError('unsafe metadata')
+ result.append({'repo': repo, 'auth_env': name, 'index_url': url})
+ return sorted(result, key=lambda row: row['repo'])
+
+
+def main():
+ parser = argparse.ArgumentParser(description=__doc__)
+ parser.add_argument('--kubeconfig', required=True)
+ args = parser.parse_args()
+ try:
+ proc = subprocess.run(['kubectl', '--kubeconfig', args.kubeconfig, '-n', 'reuse',
+ 'exec', 'deployment/reuse-surface', '-c', 'reuse-surface', '--', 'python3', '-c', POD_CODE],
+ capture_output=True, timeout=30)
+ if proc.returncode:
+ raise RuntimeError('inventory unavailable')
+ rows = sanitize(json.loads(proc.stdout))
+ except Exception:
+ print(json.dumps({'status': 'refused_or_unavailable', 'raw_output_discarded': True}))
+ return 1
+ print(json.dumps({'status': 'verified', 'authenticated_source_count': len(rows), 'sources': rows}, indent=2))
+ return 0
+
+if __name__ == '__main__':
+ raise SystemExit(main())
diff --git a/workplans/RAPPS-WP-0017-reuse-private-reader-release.md b/workplans/RAPPS-WP-0017-reuse-private-reader-release.md
new file mode 100644
index 0000000..0363d08
--- /dev/null
+++ b/workplans/RAPPS-WP-0017-reuse-private-reader-release.md
@@ -0,0 +1,57 @@
+---
+id: RAPPS-WP-0017
+type: workplan
+title: "Release hardened reuse federation with seven-source metadata reader"
+domain: financials
+repo: railiance-apps
+status: proposed
+owner: codex
+created: "2026-10-15"
+updated: "2026-10-15"
+flavor: implementation
+depends_on: [RPF-WP-0058, REUSE-WP-0025]
+---
+
+Provisional id in isolated preparation checkout; root integration must confirm
+availability. No hub registration, fix-consistency or push until integration.
+Source owners approved metadata disclosure under CUST81 R1; that is not approval
+for live credential issuance or workload rollout. Apps owns only S5 release.
+
+## Prepare bounded release contract
+
+```task
+id: RAPPS-WP-0017-T01
+status: done
+priority: high
+```
+
+Prepare chart allowlist/digest support, exact14 URL override and separate phase-B
+ESO manifest, own preparation review and meaningful local validation.
+Evidence: docs/assessments/cust81-private-reader/apps-owner-review-r1.md.
+
+## Verify and promote hardened runtime before reader delivery
+
+```task
+id: RAPPS-WP-0017-T02
+status: wait
+priority: high
+```
+
+Wait for published fully hardened image digest/source/tests plus owner reviews
+and change authorization. Obtain metadata-only existing auth-source migration
+inventory, live headroom/PVC evidence, exact server dry-run/diff, baseline health
+and rollback receipt. Phase A deploy excludes reader ESO mapping.
+
+## Deliver reviewed reader and prove complete hosted discovery
+
+```task
+id: RAPPS-WP-0017-T03
+status: wait
+priority: high
+```
+
+After verified phase A and approved/executed platform CCR, apply phase-B ESO
+mapping and restart hardened runtime through reviewed owner lane. Require
+sanitized ESO/key-presence proof and reuse native14 fetch/7 entry hashes before
+registration. Final CUST81 owner verifies70/70 hosted; rollback revokes/removes
+reader before any vulnerable image restoration.
diff --git a/docs/assessments/cust81-private-reader/runtime-auth-source-allowlist-r1.json b/docs/assessments/cust81-private-reader/runtime-auth-source-allowlist-r1.json
new file mode 100644
index 0000000..edb5f74
--- /dev/null
+++ b/docs/assessments/cust81-private-reader/runtime-auth-source-allowlist-r1.json
@@ -0,0 +1,18 @@
+{
+ "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN": [
+ "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/capabilities/capability.railiance.openbao-package.md?ref=35672be138036c8433a5ac5de91e068c03c2b124",
+ "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/indexes/capabilities.yaml?ref=35672be138036c8433a5ac5de91e068c03c2b124",
+ "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/capabilities/capability.railiance.policy-publication-package.md?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3",
+ "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/indexes/capabilities.yaml?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3",
+ "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/capabilities/capability.railiance.postgres-isolation-recovery.md?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5",
+ "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/indexes/capabilities.yaml?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5",
+ "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/capabilities/capability.railiance.sbom-runtime-package.md?ref=adbedd349e8df97be43a1f57db7095af45ff29d1",
+ "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/indexes/capabilities.yaml?ref=adbedd349e8df97be43a1f57db7095af45ff29d1",
+ "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/capabilities/capability.railiance.telemetry-package.md?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5",
+ "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/indexes/capabilities.yaml?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5",
+ "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/capabilities/capability.railiance.tenant-engine-package.md?ref=9bdc86572728783a5ed94266f04f7b12d414c557",
+ "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/indexes/capabilities.yaml?ref=9bdc86572728783a5ed94266f04f7b12d414c557",
+ "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/capabilities/capability.railiance.user-engine-package.md?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738",
+ "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/indexes/capabilities.yaml?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738"
+ ]
+}
diff --git a/docs/assessments/cust81-private-reader/supervision-preparation-r1.json b/docs/assessments/cust81-private-reader/supervision-preparation-r1.json
new file mode 100644
index 0000000..722694b
--- /dev/null
+++ b/docs/assessments/cust81-private-reader/supervision-preparation-r1.json
@@ -0,0 +1,10 @@
+{
+ "agent": "delegated-railiance-apps-cust81-preparation",
+ "mode": "supervised",
+ "scope": "isolated local chart/config/ESO proposal preparation, local verification only",
+ "supervisor": "root custodian coordinating founder-authorized work",
+ "promotion_evidence": null,
+ "runtime_enforcement_verified": false,
+ "authority_granted": false,
+ "live_execution_authorized": false
+}
diff --git a/docs/assessments/cust81-private-reader/reuse-surface-runtime-externalsecret.r1.yaml b/docs/assessments/cust81-private-reader/reuse-surface-runtime-externalsecret.r1.yaml
new file mode 100644
index 0000000..3822799
--- /dev/null
+++ b/docs/assessments/cust81-private-reader/reuse-surface-runtime-externalsecret.r1.yaml
@@ -0,0 +1,46 @@
+# PROPOSAL ONLY: phase B, after hardened runtime verified and CCR approved.
+# reuse-surface hub runtime secrets from OpenBao (RAILIANCE-WP-0011 / CCR-2026-0005).
+#
+# OpenBao path (platform KV v2): workloads/reuse/reuse-surface/runtime-secrets
+# Fields: REUSE_SURFACE_TOKEN, REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
+#
+# Prereqs on railiance01:
+# - External Secrets Operator (make eso-deploy)
+# - ClusterSecretStore openbao-reuse (railiance-platform openbao-secretstore)
+# - OpenBao policy workload-kv-read-reuse-surface-runtime + ESO token
+# (make reuse-openbao-eso-token-apply)
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+ name: reuse-surface-runtime
+ namespace: reuse
+ labels:
+ app.kubernetes.io/name: reuse-surface
+ app.kubernetes.io/part-of: railiance-apps
+spec:
+ refreshInterval: 1h
+ secretStoreRef:
+ kind: ClusterSecretStore
+ name: openbao-reuse
+ target:
+ # Explicit target metadata prevents ESO copying source last-applied annotations.
+ template:
+ metadata:
+ labels:
+ app.kubernetes.io/name: reuse-surface
+ app.kubernetes.io/part-of: railiance-apps
+ name: reuse-surface-env
+ creationPolicy: Owner
+ data:
+ - secretKey: REUSE_SURFACE_TOKEN
+ remoteRef:
+ key: workloads/reuse/reuse-surface/runtime-secrets
+ property: REUSE_SURFACE_TOKEN
+ - secretKey: REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
+ remoteRef:
+ key: workloads/reuse/reuse-surface/runtime-secrets
+ property: REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
+ - secretKey: REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN
+ remoteRef:
+ key: workloads/reuse/reuse-surface/forgejo-source-read
+ property: FORGEJO_SOURCE_TOKEN
diff --git a/docs/assessments/cust81-private-reader/apps-owner-review-r1.md b/docs/assessments/cust81-private-reader/apps-owner-review-r1.md
new file mode 100644
index 0000000..9a51050
--- /dev/null
+++ b/docs/assessments/cust81-private-reader/apps-owner-review-r1.md
@@ -0,0 +1,104 @@
+# Railiance apps preparation review — CUST81 private metadata reader R1
+
+Reviewer: delegated railiance-apps preparation worker, supervised local preparation
+assignment. No promotion evidence or existing own-scope supervision record was
+found; the descriptive preparation record grants no runtime authority. This is
+an S5 release-contract review grounded in INTENT principles 1–5 (workloads,
+release contracts, repeatable operations, explicit S3 handoff, verified health).
+It is not a founder decision, independent platform credential review or reuse
+application source review. No live changes, commits, pushes, hub writes, image
+publishes, login or credential retrieval occurred.
+
+Disposition: **approved for integration as local preparation only; live promotion blocked**.
+Canonical review disposition: `approved`. This accepts the bounded S5 proposal
+and its explicit runtime gates, not live execution or another owner’s review.
+
+## Proposed changes and owner boundaries
+
+The chart accepts an optional immutable image digest, adds a non-secret exact
+`REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST` environment binding, and fails rendering
+when a nonempty allowlist lacks an immutable digest. Schema checks enforce
+HTTPS allowlist entries and valid digest syntax. Production values continue
+using their existing `main-6cbc862` tag; production ExternalSecret is unchanged.
+The preparation override contains exactly 14 reviewed pinned metadata URLs and
+an empty digest deliberately preventing deployment. A synthetic all-zero digest
+in local tests is not an image and must never be promoted.
+
+The proposed phase-B ExternalSecret preserves existing two keys, target metadata
+and existing `openbao-reuse` ClusterSecretStore, adding only
+`REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN` from
+`workloads/reuse/reuse-surface/forgejo-source-read:FORGEJO_SOURCE_TOKEN`.
+Platform owns the dedicated KV path/policy/store read scope, CCR-2026-0046 and
+credential issuance; apps neither provisions nor consumes an admin credential.
+
+Digest presence cannot prove the hardened application is included. The reuse
+owner must provide published build digest, source revision, tests and review
+binding *both* authenticated redirect rejection and exact environment-name/URL
+credential routing. A reader must not reach the existing vulnerable runtime.
+
+## Ordered promotion gates — not executed
+
+1. Confirm own-scope supervision and founder change approval, reviewed CCR,
+ exact seven-source owner consent packet and scoped Forgejo read-only issuer
+ receipt. Integrate provisional RAPPS-WP-0017 through root owner coordination.
+2. Run metadata inventory helper with an explicitly verified railiance01
+ kubeconfig; compare existing authenticated registrations with newly
+ fail-closed image behavior. The helper reads only SQLite registration
+ metadata, never env/Secrets, captures command errors and refuses unsafe
+ URLs. If it refuses, resolve via the source owner without emitting raw
+ objects. Any existing authenticated source requires separately reviewed
+ exact URL bindings including capability entry URLs before promotion; do not
+ silently orphan sources or broaden the 14-URL map. Missing inventory blocks
+ phase A. Store only safe names, counts and validated metadata URLs.
+3. Read live release image/revision, replica state, PVC storage/access modes and
+ readiness. Confirm node external IP `92.205.62.239`, not retired coulombcore.
+ Record requested CPU/memory headroom and pending pods before rollout. Existing
+ API requests 100m CPU/256Mi, surge1 requires that much additional allocatable
+ capacity; landing unchanged. Confirm the existing PVC supports simultaneous
+ pod scheduling/mount on this single node; stop if RWO/RWOP or mount conflicts
+ prevent it. No rollout strategy/resource/PVC changes are proposed. Do not
+ change other workloads merely to obtain capacity.
+4. Once a real reviewed digest exists, fill the preparation values; render
+ exact chart with production values plus proposal overrides. Server dry-run
+ and client diff must cover every rendered chart object and the phase-B ESO
+ manifest. Preserve stderr in memory and emit sanitized status only; never
+ print live Secrets, Helm secret values, annotations or raw API failures.
+ Existing release owner and any Argo adoption must be verified before choosing
+ owner Helm upgrade versus GitOps sync; neither is executed here.
+5. Phase A: approved release of hardened digest plus approved allowlist, with
+ existing ESO fields only. Owner Helm path must use atomic upgrade, timeout
+ and wait; verify actual running imageID matches digest, API health/probes,
+ public federation baseline63 and credential-routing refusal/redirect tests.
+ Deployment failure blocks phase B. Database/PVC remains unchanged. Collect a
+ separately approved safe backup/recovery receipt before any risky live release.
+6. Phase B: after verified phase A, execute reviewed platform credential action
+ and ESO reader mapping. Verify only ESO condition/status and key-presence
+ booleans via approved suppressing helpers, then restart/sync the hardened
+ workload so envFrom obtains the reader. Never dump Secret or process env.
+7. Reuse owner runs native exact-byte authenticated proof for all14 URLs and
+ seven capability entries using pinned consent hashes. Only then register
+ seven sources through the scoped write route and verify hosted70/70,
+ no duplicates/conflicting IDs and public federation preserves all63.
+
+## Rollback contract
+
+Before execution capture previous approved release revision, digest/tag and
+safe configuration, public discovery baseline and database recovery receipt.
+If phase A fails before credential delivery, atomic restore of previous release
+is safe because no reader has been supplied. After phase B, **never downgrade to
+vulnerable runtime with reader still available**: revoke the dedicated reader
+at Forgejo/OpenBao via credential owner, remove phase-B ESO mapping and materialized
+reader key through reviewed silent maintenance, restart current hardened pods,
+verify absence/revocation, then restore prior approved chart/image only if needed.
+Metadata registrations may remain inaccessible until re-established; record the
+regression explicitly. Do not roll back the PVC or use stale tokens as recovery.
+
+## Local evidence and limitations
+
+`helm lint charts/reuse-surface -f helm/reuse-surface-values.yaml` passed.
+`python3 docs/assessments/cust81-private-reader/verify_preparation.py` passed eight
+checks, including exact14 roundtrip, digest/schema refusal, retention of current
+strategy/resources/PVC, correct isolated ESO mapping, metadata URL sanitization
+and subprocess error suppression. `local-verification-r1.json` contains command
+statuses without raw output. No cluster inventory, resource headroom,
+server dry-run/diff, image publish, live approval or native fetch has been proven.
diff --git a/docs/assessments/cust81-private-reader/verify_preparation.py b/docs/assessments/cust81-private-reader/verify_preparation.py
new file mode 100644
index 0000000..8523b6b
--- /dev/null
+++ b/docs/assessments/cust81-private-reader/verify_preparation.py
@@ -0,0 +1,68 @@
+"""Local chart and non-disclosure checks only; never contacts a cluster."""
+import hashlib
+import importlib.util
+import json
+from pathlib import Path
+import subprocess
+import yaml
+
+ROOT = Path(__file__).resolve().parents[3]
+ARTIFACT = Path(__file__).resolve().parent
+calls = []
+
+def render(extra, success=True):
+ command = ['helm', 'template', 'reuse', str(ROOT / 'charts/reuse-surface'), '-f', str(ROOT / 'helm/reuse-surface-values.yaml'), *extra]
+ proc = subprocess.run(command, capture_output=True, text=True)
+ calls.append({'command': command, 'exit_code': proc.returncode, 'expected_success': success})
+ assert (proc.returncode == 0) == success
+ return list(yaml.safe_load_all(proc.stdout)) if success else []
+
+def api(docs):
+ return next(d for d in docs if d and d.get('kind') == 'Deployment' and d['metadata']['name'] == 'reuse-surface')
+
+current = api(render([]))
+assert current['spec']['template']['spec']['containers'][0]['image'].endswith(':main-6cbc862')
+assert next(e['value'] for e in current['spec']['template']['spec']['containers'][0]['env'] if e['name']=='REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST') == '{}'
+proposal = ['-f', str(ARTIFACT / 'private-reader-values.r1.yaml')]
+render(proposal, False) # unknown real digest is a hard gate
+# Synthetic digest is render-only, and expressly not promotion/build evidence.
+render(proposal+['--set', 'image.digest=sha256:bad'], False)
+render(proposal+['--set-json', 'authSourceAllowlist={"BAD":["http://attacker.invalid"]}', '--set', 'image.digest=sha256:'+'0'*64], False)
+docs = render(proposal+['--set', 'image.digest=sha256:'+'0'*64])
+deployment = api(docs)
+container = deployment['spec']['template']['spec']['containers'][0]
+assert container['image'].endswith('@sha256:'+'0'*64)
+allowlist=json.loads(next(e['value'] for e in container['env'] if e['name']=='REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST'))
+expected = json.loads((ARTIFACT/'runtime-auth-source-allowlist-r1.json').read_text())
+assert allowlist==expected and len(next(iter(allowlist.values())))==14
+assert deployment['spec']['strategy'] == current['spec']['strategy']
+assert container['resources']==current['spec']['template']['spec']['containers'][0]['resources']
+assert deployment['spec']['template']['spec']['volumes']==current['spec']['template']['spec']['volumes']
+assert container['volumeMounts']==current['spec']['template']['spec']['containers'][0]['volumeMounts']
+secret=yaml.safe_load((ARTIFACT/'reuse-surface-runtime-externalsecret.r1.yaml').read_text())
+baseline=yaml.safe_load((ROOT/'manifests/reuse-surface-runtime-externalsecret.yaml').read_text())
+assert secret['spec']['data'][:-1]==baseline['spec']['data']
+assert secret['spec']['secretStoreRef']==baseline['spec']['secretStoreRef']
+assert secret['spec']['data'][-1]=={'secretKey':'REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN','remoteRef':{'key':'workloads/reuse/reuse-surface/forgejo-source-read','property':'FORGEJO_SOURCE_TOKEN'}}
+spec=importlib.util.spec_from_file_location('inventory',ROOT/'scripts/reuse_authenticated_source_inventory.py')
+mod=importlib.util.module_from_spec(spec);spec.loader.exec_module(mod)
+url=expected['REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN'][1]
+assert len(mod.sanitize([['rapp-openbao','FIXTURE_READ_TOKEN',url]]))==1
+for bad in ['https://token@forgejo.coulomb.social/x', url+'&token=fixture-secret','http://attacker.invalid',url+'#fixture-secret']:
+ try: mod.sanitize([['rapp-openbao','FIXTURE_READ_TOKEN',bad]])
+ except ValueError: pass
+ else: raise AssertionError('unsafe URL accepted')
+# Errors from kubectl are discarded before output; no subprocess invoked in test.
+original=mod.subprocess.run
+class Failure:
+ returncode=1;stdout=b'fixture-secret';stderr=b'fixture-secret'
+mod.subprocess.run=lambda *args,**kwargs: Failure()
+import sys,io,contextlib
+argv=sys.argv;sys.argv=['inventory','--kubeconfig','fixture-path']
+buf=io.StringIO()
+with contextlib.redirect_stdout(buf): assert mod.main()==1
+sys.argv=argv;mod.subprocess.run=original
+assert 'fixture-secret' not in buf.getvalue()
+result={'status':'passed','local_only':True,'real_image_digest':None,'synthetic_digest_used_only_to_check_rendering':True,'checks':['production rendering unchanged except empty fail-closed allowlist','unknown/malformed digest fails','HTTP allowlist fails schema','exact14 URLs roundtrip','strategy resources PVC retained','dedicated ESO mapping preserves current fields/store','metadata sanitizer excludes userinfo/query secrets/fragments','kubectl failure output discarded'],'helm_calls':calls}
+(ARTIFACT/'local-verification-r1.json').write_text(json.dumps(result,indent=2)+'\n')
+print(json.dumps({'status':'passed','checks':len(result['checks'])}))
diff --git a/docs/assessments/cust81-private-reader/private-reader-values.r1.yaml b/docs/assessments/cust81-private-reader/private-reader-values.r1.yaml
new file mode 100644
index 0000000..70dc932
--- /dev/null
+++ b/docs/assessments/cust81-private-reader/private-reader-values.r1.yaml
@@ -0,0 +1,5 @@
+# PREPARATION ONLY: empty digest deliberately prevents rendering/deployment.
+# Fill only after reuse-surface publishes and reviews the fully hardened image.
+image:
+ digest: ""
+authSourceAllowlist: {"REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN": ["https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/capabilities/capability.railiance.openbao-package.md?ref=35672be138036c8433a5ac5de91e068c03c2b124", "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/indexes/capabilities.yaml?ref=35672be138036c8433a5ac5de91e068c03c2b124", "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/capabilities/capability.railiance.policy-publication-package.md?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3", "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/indexes/capabilities.yaml?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3", "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/capabilities/capability.railiance.postgres-isolation-recovery.md?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5", "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/indexes/capabilities.yaml?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5", "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/capabilities/capability.railiance.sbom-runtime-package.md?ref=adbedd349e8df97be43a1f57db7095af45ff29d1", "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/indexes/capabilities.yaml?ref=adbedd349e8df97be43a1f57db7095af45ff29d1", "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/capabilities/capability.railiance.telemetry-package.md?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5", "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/indexes/capabilities.yaml?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5", "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/capabilities/capability.railiance.tenant-engine-package.md?ref=9bdc86572728783a5ed94266f04f7b12d414c557", "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/indexes/capabilities.yaml?ref=9bdc86572728783a5ed94266f04f7b12d414c557", "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/capabilities/capability.railiance.user-engine-package.md?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738", "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/indexes/capabilities.yaml?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738"]}
diff --git a/docs/assessments/cust81-private-reader/local-verification-r1.json b/docs/assessments/cust81-private-reader/local-verification-r1.json
new file mode 100644
index 0000000..531488b
--- /dev/null
+++ b/docs/assessments/cust81-private-reader/local-verification-r1.json
@@ -0,0 +1,94 @@
+{
+ "status": "passed",
+ "local_only": true,
+ "real_image_digest": null,
+ "synthetic_digest_used_only_to_check_rendering": true,
+ "checks": [
+ "production rendering unchanged except empty fail-closed allowlist",
+ "unknown/malformed digest fails",
+ "HTTP allowlist fails schema",
+ "exact14 URLs roundtrip",
+ "strategy resources PVC retained",
+ "dedicated ESO mapping preserves current fields/store",
+ "metadata sanitizer excludes userinfo/query secrets/fragments",
+ "kubectl failure output discarded"
+ ],
+ "helm_calls": [
+ {
+ "command": [
+ "helm",
+ "template",
+ "reuse",
+ "/tmp/cust81-apps-reader-owner/charts/reuse-surface",
+ "-f",
+ "/tmp/cust81-apps-reader-owner/helm/reuse-surface-values.yaml"
+ ],
+ "exit_code": 0,
+ "expected_success": true
+ },
+ {
+ "command": [
+ "helm",
+ "template",
+ "reuse",
+ "/tmp/cust81-apps-reader-owner/charts/reuse-surface",
+ "-f",
+ "/tmp/cust81-apps-reader-owner/helm/reuse-surface-values.yaml",
+ "-f",
+ "/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/private-reader-values.r1.yaml"
+ ],
+ "exit_code": 1,
+ "expected_success": false
+ },
+ {
+ "command": [
+ "helm",
+ "template",
+ "reuse",
+ "/tmp/cust81-apps-reader-owner/charts/reuse-surface",
+ "-f",
+ "/tmp/cust81-apps-reader-owner/helm/reuse-surface-values.yaml",
+ "-f",
+ "/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/private-reader-values.r1.yaml",
+ "--set",
+ "image.digest=sha256:bad"
+ ],
+ "exit_code": 1,
+ "expected_success": false
+ },
+ {
+ "command": [
+ "helm",
+ "template",
+ "reuse",
+ "/tmp/cust81-apps-reader-owner/charts/reuse-surface",
+ "-f",
+ "/tmp/cust81-apps-reader-owner/helm/reuse-surface-values.yaml",
+ "-f",
+ "/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/private-reader-values.r1.yaml",
+ "--set-json",
+ "authSourceAllowlist={\"BAD\":[\"http://attacker.invalid\"]}",
+ "--set",
+ "image.digest=sha256:0000000000000000000000000000000000000000000000000000000000000000"
+ ],
+ "exit_code": 1,
+ "expected_success": false
+ },
+ {
+ "command": [
+ "helm",
+ "template",
+ "reuse",
+ "/tmp/cust81-apps-reader-owner/charts/reuse-surface",
+ "-f",
+ "/tmp/cust81-apps-reader-owner/helm/reuse-surface-values.yaml",
+ "-f",
+ "/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/private-reader-values.r1.yaml",
+ "--set",
+ "image.digest=sha256:0000000000000000000000000000000000000000000000000000000000000000"
+ ],
+ "exit_code": 0,
+ "expected_success": true
+ }
+ ]
+}

254
docs/assessments/netkingdom-2026-10-14/publication-preflight.json
View file

@ -2,8 +2,8 @@
{
"repo": "access-engine",
"branch": "main",
"local_head": "16ca97b2776789f730cc7049a2d6533612faaccd",
"remote_head": "16ca97b2776789f730cc7049a2d6533612faaccd",
"local_head": "62ac2b4e99dec2005c7c407fe633612578a7907d",
"remote_head": "62ac2b4e99dec2005c7c407fe633612578a7907d",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -11,8 +11,8 @@
{
"repo": "activity-core",
"branch": "main",
"local_head": "83e6446807c4b36f3aa5023a5c16d4c7df8bd3df",
"remote_head": "83e6446807c4b36f3aa5023a5c16d4c7df8bd3df",
"local_head": "f9f8df039258a0d8b6fc29dc1f7c4bcc75fdc8c0",
"remote_head": "f9f8df039258a0d8b6fc29dc1f7c4bcc75fdc8c0",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -20,8 +20,8 @@
{
"repo": "agentic-resources",
"branch": "main",
"local_head": "65b3a5cb6bf3eb214b492b95a38f2eb729f89709",
"remote_head": "65b3a5cb6bf3eb214b492b95a38f2eb729f89709",
"local_head": "c4cedab945e047de068428fb943f346f093b22dc",
"remote_head": "c4cedab945e047de068428fb943f346f093b22dc",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -29,8 +29,8 @@
{
"repo": "approval-engine",
"branch": "main",
"local_head": "e1649617e8ad321f79632d5fd33e973ae5d5ae51",
"remote_head": "e1649617e8ad321f79632d5fd33e973ae5d5ae51",
"local_head": "db850aded5fc3b5d35938d26e8084e436a83943b",
"remote_head": "db850aded5fc3b5d35938d26e8084e436a83943b",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -38,8 +38,8 @@
{
"repo": "audit-core",
"branch": "main",
"local_head": "f1e715326b3ffd956623a84fa7ab0ce5ab3fbcf9",
"remote_head": "f1e715326b3ffd956623a84fa7ab0ce5ab3fbcf9",
"local_head": "8d4bde6ece39ce0df3a3cc49da38613123e8f215",
"remote_head": "8d4bde6ece39ce0df3a3cc49da38613123e8f215",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -47,8 +47,8 @@
{
"repo": "coordination-engine",
"branch": "main",
"local_head": "c401067842072b75717f76480dd6e7db1836059c",
"remote_head": "c401067842072b75717f76480dd6e7db1836059c",
"local_head": "16de8fc3f70020df646f1ebdca705a1bf88485a0",
"remote_head": "16de8fc3f70020df646f1ebdca705a1bf88485a0",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -56,8 +56,8 @@
{
"repo": "emergent-security",
"branch": "main",
"local_head": "4c6fda38298fa50665ead41526b893adf069d335",
"remote_head": "4c6fda38298fa50665ead41526b893adf069d335",
"local_head": "6eead2a922ae2eb81593213f54bf1f35e1c9970f",
"remote_head": "6eead2a922ae2eb81593213f54bf1f35e1c9970f",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -65,8 +65,8 @@
{
"repo": "fin-hub",
"branch": "main",
"local_head": "8f527c6705bbf5d7ffed43559411ca748bec8fe4",
"remote_head": "8f527c6705bbf5d7ffed43559411ca748bec8fe4",
"local_head": "cace0fda7474304cc42028287f7ba1327ab07d00",
"remote_head": "cace0fda7474304cc42028287f7ba1327ab07d00",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -74,8 +74,8 @@
{
"repo": "gate-house",
"branch": "main",
"local_head": "bc890c4d050a2e726ce8988a8260ab9caea133e3",
"remote_head": "bc890c4d050a2e726ce8988a8260ab9caea133e3",
"local_head": "ab1a299674679ccfefa8df84b877614ac44c9d38",
"remote_head": "ab1a299674679ccfefa8df84b877614ac44c9d38",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -83,8 +83,8 @@
{
"repo": "glas-harness",
"branch": "main",
"local_head": "7b1557ba14f483569b90ebfdc2d0136fa69602fe",
"remote_head": "7b1557ba14f483569b90ebfdc2d0136fa69602fe",
"local_head": "dc88f302044c7c2b41795958527e64be8a83e3ab",
"remote_head": "dc88f302044c7c2b41795958527e64be8a83e3ab",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": [
@ -94,8 +94,8 @@
{
"repo": "info-tech-canon",
"branch": "main",
"local_head": "3d206a56f4ece439f6ee87f9ee4d1800ab82166e",
"remote_head": "3d206a56f4ece439f6ee87f9ee4d1800ab82166e",
"local_head": "9b9be2ec8e846ceaa05fa644323b02d8603e39b6",
"remote_head": "9b9be2ec8e846ceaa05fa644323b02d8603e39b6",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -103,8 +103,8 @@
{
"repo": "informed-decision",
"branch": "main",
"local_head": "ee6a65b80a0fea1a914dfa31434b903669656c09",
"remote_head": "ee6a65b80a0fea1a914dfa31434b903669656c09",
"local_head": "faae9cb0dbaf4c8d23f838183f513c302ad3b9f0",
"remote_head": "faae9cb0dbaf4c8d23f838183f513c302ad3b9f0",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": [
@ -114,8 +114,8 @@
{
"repo": "issue-core",
"branch": "main",
"local_head": "de368271f6ffc06353ec409998a0d6d0ec0bf25e",
"remote_head": "de368271f6ffc06353ec409998a0d6d0ec0bf25e",
"local_head": "1427d268a09b9334a98a167230ec7dd1d4a82053",
"remote_head": "1427d268a09b9334a98a167230ec7dd1d4a82053",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -123,19 +123,17 @@
{
"repo": "key-cape",
"branch": "main",
"local_head": "1344fc80e56315c5c99f58993f9ee02ce79e8a76",
"remote_head": "1344fc80e56315c5c99f58993f9ee02ce79e8a76",
"same_head": true,
"local_head": "8c6c071ad9c73865793a075ed1b34b93e5075436",
"remote_head": "44b243410006a2df32adcd4cae2ab5e6f806da82",
"same_head": false,
"remote_read_exit": 0,
"staged_paths": [
".custodian-brief.md"
]
"staged_paths": []
},
{
"repo": "kings-guard",
"branch": "main",
"local_head": "af02e2547598d6ec0e83f482d9ea3ef943ea67b7",
"remote_head": "af02e2547598d6ec0e83f482d9ea3ef943ea67b7",
"local_head": "6aea834dc556067672f31ed762f44a39bad988e3",
"remote_head": "6aea834dc556067672f31ed762f44a39bad988e3",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -144,7 +142,7 @@
"repo": "maturity-engine",
"branch": "main",
"local_head": "2f1de542cc8f24a79452f906d99f95be39d8b6a9",
"remote_head": "2ef97c87a0f818a906aa42942c32d6c69f9ec899",
"remote_head": "363e8160a4910766e9380fabee68a8642dd45ccf",
"same_head": false,
"remote_read_exit": 0,
"staged_paths": []
@ -152,17 +150,17 @@
{
"repo": "net-kingdom",
"branch": "main",
"local_head": "1a36e857cc5aae6fe738f794417126c46dd94627",
"remote_head": "1a36e857cc5aae6fe738f794417126c46dd94627",
"same_head": true,
"local_head": "2cc09ceb05c6f2132c6fc3478901c4ee1085fa1b",
"remote_head": "8f0a5902004c47415846d818e400eb5d5e1e037d",
"same_head": false,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "ops-bridge",
"branch": "main",
"local_head": "190ef1e188e12c606f1359325fd9fdd1dbef29e2",
"remote_head": "190ef1e188e12c606f1359325fd9fdd1dbef29e2",
"local_head": "2246656f43fa5eae3ae917f63ea1dfa3f53f4a00",
"remote_head": "2246656f43fa5eae3ae917f63ea1dfa3f53f4a00",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -170,17 +168,19 @@
{
"repo": "ops-mason",
"branch": "main",
"local_head": "d86ad141befb6800468f5132d4c7c9ce2f852bb5",
"remote_head": "d86ad141befb6800468f5132d4c7c9ce2f852bb5",
"local_head": "97d1fed9496aacb1836982096b8aecb6da13cf0d",
"remote_head": "97d1fed9496aacb1836982096b8aecb6da13cf0d",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
"staged_paths": [
".custodian-brief.md"
]
},
{
"repo": "ops-warden",
"branch": "main",
"local_head": "6d2f1be9691b19e826898a2166ae4451e4802ae2",
"remote_head": "6d2f1be9691b19e826898a2166ae4451e4802ae2",
"local_head": "1baeb0821cb6304464fab78932d8c6501f8c4cc6",
"remote_head": "1baeb0821cb6304464fab78932d8c6501f8c4cc6",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -188,8 +188,8 @@
{
"repo": "policy-nexus",
"branch": "main",
"local_head": "f784f017b0822f34c785f0b34c7c55fcf39c9d99",
"remote_head": "f784f017b0822f34c785f0b34c7c55fcf39c9d99",
"local_head": "c14561b2e5318e9637ba93e4c96c06a2db92d0c4",
"remote_head": "c14561b2e5318e9637ba93e4c96c06a2db92d0c4",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -197,8 +197,8 @@
{
"repo": "rail-kubernetes",
"branch": "main",
"local_head": "35159e49c1340b7a0e30c49188975c8839d346f6",
"remote_head": "35159e49c1340b7a0e30c49188975c8839d346f6",
"local_head": "5fad47fdfb7d4cabc21cf10f52ac733ef59803b0",
"remote_head": "5fad47fdfb7d4cabc21cf10f52ac733ef59803b0",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -206,8 +206,8 @@
{
"repo": "railiance-apps",
"branch": "main",
"local_head": "706461b845086ee2df8ce9acae3dae7feebfffda",
"remote_head": "706461b845086ee2df8ce9acae3dae7feebfffda",
"local_head": "72bcad86d7531bcc27f0e465a9385be559ba0c9f",
"remote_head": "72bcad86d7531bcc27f0e465a9385be559ba0c9f",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": [
@ -217,8 +217,8 @@
{
"repo": "railiance-bootstrap",
"branch": "main",
"local_head": "ae00b2652737aaf18358431e66f59eeb7c01e16b",
"remote_head": "ae00b2652737aaf18358431e66f59eeb7c01e16b",
"local_head": "70bd14d3b941a49c78bbc51d8faab5ab1da1df76",
"remote_head": "70bd14d3b941a49c78bbc51d8faab5ab1da1df76",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -226,8 +226,8 @@
{
"repo": "railiance-cluster",
"branch": "main",
"local_head": "12d1e881ff2086566712fbc591db293b38ea2bcf",
"remote_head": "12d1e881ff2086566712fbc591db293b38ea2bcf",
"local_head": "750c3e5b9b4623c52bce2b8fbd758f423f81f6c1",
"remote_head": "750c3e5b9b4623c52bce2b8fbd758f423f81f6c1",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -235,8 +235,8 @@
{
"repo": "railiance-enablement",
"branch": "main",
"local_head": "51a7c4cee68b48ed7a236e661b39c1d3cca92063",
"remote_head": "51a7c4cee68b48ed7a236e661b39c1d3cca92063",
"local_head": "ce9f6d1be8ff73afdedd6d666a8485e6c7348069",
"remote_head": "ce9f6d1be8ff73afdedd6d666a8485e6c7348069",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -244,8 +244,8 @@
{
"repo": "railiance-fabric",
"branch": "main",
"local_head": "96d19127125e85bdab7ff0ff79fc3ecf7d19045e",
"remote_head": "96d19127125e85bdab7ff0ff79fc3ecf7d19045e",
"local_head": "095342c72ab6f02c72dd5d40e869dcba536bc5c1",
"remote_head": "095342c72ab6f02c72dd5d40e869dcba536bc5c1",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -253,8 +253,8 @@
{
"repo": "railiance-forge",
"branch": "main",
"local_head": "a15fac8e938c11b041eb39386f05b63d46ae566a",
"remote_head": "a15fac8e938c11b041eb39386f05b63d46ae566a",
"local_head": "6e8f657e55e96b4e9f3d9d74a27b420b68467e61",
"remote_head": "6e8f657e55e96b4e9f3d9d74a27b420b68467e61",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": [
@ -264,17 +264,17 @@
{
"repo": "railiance-infra",
"branch": "main",
"local_head": "ef64e324b61e9aa9b9ed03aad7dd2101915057ca",
"remote_head": "ef64e324b61e9aa9b9ed03aad7dd2101915057ca",
"same_head": true,
"local_head": "32f64b54fd94a5e6a145ef7c2c8faf051f721a71",
"remote_head": "99bc66f8c98a5404339074bf5bb11271d9f6d58d",
"same_head": false,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "railiance-master",
"branch": "main",
"local_head": "865c3bed86b3992244b29d6f1d6b8ebbe8db78c7",
"remote_head": "865c3bed86b3992244b29d6f1d6b8ebbe8db78c7",
"local_head": "a0be0d3142b5392f1fb6271cf91325ce91a0f9d4",
"remote_head": "a0be0d3142b5392f1fb6271cf91325ce91a0f9d4",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -282,17 +282,17 @@
{
"repo": "railiance-platform",
"branch": "main",
"local_head": "d303c99e3be993ffa989bc9ba3d7b471903858ce",
"remote_head": "d303c99e3be993ffa989bc9ba3d7b471903858ce",
"same_head": true,
"local_head": "0f0282a43646edbb5743318bc923749af1c0cea2",
"remote_head": "b797594a21fb0969ec987e633521245e0277267b",
"same_head": false,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "railiance-telemetry",
"branch": "main",
"local_head": "81d905971c38de9aaf11088ba605e112152d8268",
"remote_head": "81d905971c38de9aaf11088ba605e112152d8268",
"local_head": "8cdb2d11dda03bd6839750d059b37932f069e66a",
"remote_head": "8cdb2d11dda03bd6839750d059b37932f069e66a",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -300,8 +300,8 @@
{
"repo": "rapp-openbao",
"branch": "main",
"local_head": "13ab9144bbb1d88fe760362df91a83c8b34e4e66",
"remote_head": "13ab9144bbb1d88fe760362df91a83c8b34e4e66",
"local_head": "35672be138036c8433a5ac5de91e068c03c2b124",
"remote_head": "35672be138036c8433a5ac5de91e068c03c2b124",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -309,8 +309,8 @@
{
"repo": "rapp-playwright",
"branch": "main",
"local_head": "2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb",
"remote_head": "2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb",
"local_head": "4f76a87f67fdd9dab19564bb84235397e2f2470a",
"remote_head": "4f76a87f67fdd9dab19564bb84235397e2f2470a",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -318,8 +318,8 @@
{
"repo": "rapp-policy-nexus",
"branch": "main",
"local_head": "d3fee97d32ad47e3a7e3201a9c5b7209b4333fda",
"remote_head": "d3fee97d32ad47e3a7e3201a9c5b7209b4333fda",
"local_head": "088b78ac03b0cebeec34a69aae3569eb7ec2f9c3",
"remote_head": "088b78ac03b0cebeec34a69aae3569eb7ec2f9c3",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -327,8 +327,8 @@
{
"repo": "rapp-postgres",
"branch": "main",
"local_head": "03744030c9258e920f6403a9ce184a26d7b75268",
"remote_head": "03744030c9258e920f6403a9ce184a26d7b75268",
"local_head": "a9f569c96d74aa384ac8d3ac4aa960e4061550b5",
"remote_head": "a9f569c96d74aa384ac8d3ac4aa960e4061550b5",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -336,8 +336,8 @@
{
"repo": "rapp-telemetry",
"branch": "main",
"local_head": "17053dbc47f7c22efd67fd90d06d108d154835fa",
"remote_head": "17053dbc47f7c22efd67fd90d06d108d154835fa",
"local_head": "f158307e24b86bab88a1af4830ff6b4f85afdeb5",
"remote_head": "f158307e24b86bab88a1af4830ff6b4f85afdeb5",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -345,8 +345,8 @@
{
"repo": "rapp-tenant-engine",
"branch": "main",
"local_head": "c160be23577ab4d99ee2cd008deb455b07f0597d",
"remote_head": "c160be23577ab4d99ee2cd008deb455b07f0597d",
"local_head": "9bdc86572728783a5ed94266f04f7b12d414c557",
"remote_head": "9bdc86572728783a5ed94266f04f7b12d414c557",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -354,17 +354,19 @@
{
"repo": "rapp-user-engine",
"branch": "main",
"local_head": "15faf1dc063a0bfdb2c4a56e9eb5b5791ec73d4c",
"remote_head": "15faf1dc063a0bfdb2c4a56e9eb5b5791ec73d4c",
"local_head": "f35108f9e1b8702fb6c526fe42b2fec5ca032738",
"remote_head": "f35108f9e1b8702fb6c526fe42b2fec5ca032738",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
"staged_paths": [
".custodian-brief.md"
]
},
{
"repo": "reef-railiance",
"branch": "main",
"local_head": "ffb9e272ce1489cc37cc6388873558d8ba56c239",
"remote_head": "ffb9e272ce1489cc37cc6388873558d8ba56c239",
"local_head": "33b840faac109f134bf1115d631d5b1242052d9a",
"remote_head": "33b840faac109f134bf1115d631d5b1242052d9a",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -372,8 +374,8 @@
{
"repo": "rein-aharness",
"branch": "main",
"local_head": "398949a3d34b6c9faae0fa1d0ff0aa039565aa42",
"remote_head": "398949a3d34b6c9faae0fa1d0ff0aa039565aa42",
"local_head": "a58d11ce8ae9ea07baf0682c4f860caa251692b3",
"remote_head": "a58d11ce8ae9ea07baf0682c4f860caa251692b3",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": [
@ -383,8 +385,8 @@
{
"repo": "rein-openweights",
"branch": "main",
"local_head": "e1fccb39b738a5381a9de6e1d799f124797798ce",
"remote_head": "e1fccb39b738a5381a9de6e1d799f124797798ce",
"local_head": "a2e428a76592d79982ea3c4eba5f137a12fb44e4",
"remote_head": "a2e428a76592d79982ea3c4eba5f137a12fb44e4",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -392,8 +394,8 @@
{
"repo": "repo-manager",
"branch": "main",
"local_head": "7677b00f69cd6362ac16a1021dc180ec6df4ebfa",
"remote_head": "7677b00f69cd6362ac16a1021dc180ec6df4ebfa",
"local_head": "97ea2489257de08911cc5da1e1b84d8e15780dc3",
"remote_head": "97ea2489257de08911cc5da1e1b84d8e15780dc3",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -401,8 +403,8 @@
{
"repo": "resource-control",
"branch": "main",
"local_head": "3604d468f86ede7d320f4d22dd4aea775306b53f",
"remote_head": "3604d468f86ede7d320f4d22dd4aea775306b53f",
"local_head": "ac4e1c43e6d82ecd81108f3b006454ac6aa76722",
"remote_head": "ac4e1c43e6d82ecd81108f3b006454ac6aa76722",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -410,8 +412,8 @@
{
"repo": "reuse-surface",
"branch": "main",
"local_head": "a6da9f2c5c0cb8a69ddf4ea2386e79699a90c2e1",
"remote_head": "a6da9f2c5c0cb8a69ddf4ea2386e79699a90c2e1",
"local_head": "03cd049773478e9de7e38035a49deaa82772a357",
"remote_head": "03cd049773478e9de7e38035a49deaa82772a357",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -419,8 +421,8 @@
{
"repo": "risk-nexus",
"branch": "main",
"local_head": "b877231d66e1289dc32fda07ed2c61dcb3e970dc",
"remote_head": "b877231d66e1289dc32fda07ed2c61dcb3e970dc",
"local_head": "0cb565e1e498002b0fe71975e7654b641a4c24d2",
"remote_head": "0cb565e1e498002b0fe71975e7654b641a4c24d2",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -428,8 +430,8 @@
{
"repo": "role-engine",
"branch": "main",
"local_head": "d231241dbfeeb541b34243f4022883aa6417a1eb",
"remote_head": "d231241dbfeeb541b34243f4022883aa6417a1eb",
"local_head": "c9d6d0763542f632f1d9b799d63b6b85cf8eaaab",
"remote_head": "c9d6d0763542f632f1d9b799d63b6b85cf8eaaab",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -437,8 +439,8 @@
{
"repo": "runbook-tutorials",
"branch": "main",
"local_head": "df97fadf5decfcdb5c3c6ab90211226335ffdf8e",
"remote_head": "df97fadf5decfcdb5c3c6ab90211226335ffdf8e",
"local_head": "f0ea260895e8ad8e60f24bf64a89be063b7f8e13",
"remote_head": "f0ea260895e8ad8e60f24bf64a89be063b7f8e13",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -446,8 +448,8 @@
{
"repo": "sand-boxer",
"branch": "main",
"local_head": "b06d94f02b037764ff41c73c8ab43f4c8f5d309d",
"remote_head": "b06d94f02b037764ff41c73c8ab43f4c8f5d309d",
"local_head": "7ddf92070f2fa267d79f8cad0aa07d16f0cd6410",
"remote_head": "7ddf92070f2fa267d79f8cad0aa07d16f0cd6410",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": [
@ -457,8 +459,8 @@
{
"repo": "sbom-nexus",
"branch": "main",
"local_head": "07e998d9abfd4e4fcc74db9e292ed22c6f407522",
"remote_head": "07e998d9abfd4e4fcc74db9e292ed22c6f407522",
"local_head": "db76194330b9502e9a1085ae25cdd27ce264ec7b",
"remote_head": "db76194330b9502e9a1085ae25cdd27ce264ec7b",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -466,8 +468,8 @@
{
"repo": "secrets-engine",
"branch": "main",
"local_head": "d379a3dfba73c42cd97f4d9cba3a02d705155e4d",
"remote_head": "d379a3dfba73c42cd97f4d9cba3a02d705155e4d",
"local_head": "6bd7129eac94131b4cf689e47cbdc9899418beb3",
"remote_head": "6bd7129eac94131b4cf689e47cbdc9899418beb3",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": [
@ -477,8 +479,8 @@
{
"repo": "security-canon",
"branch": "main",
"local_head": "1664a6def20be2759a1e575024563efd27c9f36f",
"remote_head": "1664a6def20be2759a1e575024563efd27c9f36f",
"local_head": "c31c3008a53bcff07be09d0507d4693d27b40a5a",
"remote_head": "c31c3008a53bcff07be09d0507d4693d27b40a5a",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -486,8 +488,8 @@
{
"repo": "state-hub",
"branch": "main",
"local_head": "4ffc7236735afc6223aa613262483ea911307714",
"remote_head": "4ffc7236735afc6223aa613262483ea911307714",
"local_head": "2a2ac2eb195a073633f4db0f166b927ca1877d67",
"remote_head": "2a2ac2eb195a073633f4db0f166b927ca1877d67",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": [
@ -497,8 +499,8 @@
{
"repo": "tenant-engine",
"branch": "main",
"local_head": "1dabbcf47d87d27d118dcf3147d9e3588a807e0c",
"remote_head": "1dabbcf47d87d27d118dcf3147d9e3588a807e0c",
"local_head": "79a61905957bd78d3f4c93da42d7034ad3e3c8de",
"remote_head": "79a61905957bd78d3f4c93da42d7034ad3e3c8de",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -506,17 +508,19 @@
{
"repo": "the-custodian",
"branch": "main",
"local_head": "3f6df63a9a5ca5edfaf1c17ab59bd18b29c54c5e",
"remote_head": "3f6df63a9a5ca5edfaf1c17ab59bd18b29c54c5e",
"local_head": "0e7bcd128bb80d3630d84c2ba1bedf88578ccde1",
"remote_head": "0e7bcd128bb80d3630d84c2ba1bedf88578ccde1",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
"staged_paths": [
".custodian-brief.md"
]
},
{
"repo": "user-engine",
"branch": "main",
"local_head": "85a419d6c5d0b4434d3ca7f33bde3092f5838f79",
"remote_head": "85a419d6c5d0b4434d3ca7f33bde3092f5838f79",
"local_head": "e9534ef00f02f2b4772cd80f3b7c7aad5f9dae23",
"remote_head": "e9534ef00f02f2b4772cd80f3b7c7aad5f9dae23",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -524,8 +528,8 @@
{
"repo": "whitehat-security",
"branch": "main",
"local_head": "5587a8f6ac4b129527db819bc72832051c7fcc3b",
"remote_head": "5587a8f6ac4b129527db819bc72832051c7fcc3b",
"local_head": "42fe7a12c7d9d64142ec0e820ba4e975ffeac593",
"remote_head": "42fe7a12c7d9d64142ec0e820ba4e975ffeac593",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
@ -533,8 +537,8 @@
{
"repo": "zone-engine",
"branch": "main",
"local_head": "b5a6f88a82b125ebc82c0484bec1ea541e4f95d0",
"remote_head": "b5a6f88a82b125ebc82c0484bec1ea541e4f95d0",
"local_head": "7e7e3f307ca996c373e91009ed1b9b0cbc6fcb9e",
"remote_head": "7e7e3f307ca996c373e91009ed1b9b0cbc6fcb9e",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []

2
docs/assessments/netkingdom-2026-10-14/published-source-verification.json
View file

@ -444,7 +444,7 @@
{
"path": "registry/capabilities/capability.security.structure-construction.md",
"http": 200,
"sha256": "7d6699c19f89d1ab916e0e2da6f7a36232b4960f693b042bf4374c86b7115f13",
"sha256": "000ceac5b4c71569aed1c9af970980a0c72a34db13fdca40671c9ddbfe97409d",
"matches_local": true
}
],

18
docs/assessments/netkingdom-2026-10-14/scoped-access-handoff.json
View file

@ -1,7 +1,7 @@
{
"workplan": "CUST-WP-0081",
"user_disposition": "Arrange scoped owner access",
"status": "Awaiting owner provisioning; user preference is not evidence of provisioned access",
"status": "Public batch verified; founder metadata disclosure consent recorded for all seven sources. Restricted hub reader and native fetch verification remain pending.",
"owner_repo": "railiance-platform",
"write_access": {
"route": "reuse-surface-hub-write-token",
@ -17,7 +17,8 @@
"platform/data/workloads/reuse/reuse-surface/runtime-secrets",
"platform/metadata/workloads/reuse/reuse-surface/runtime-secrets"
],
"negative_check": "An unrelated sibling path must remain denied. Do not broaden policy contents or attach administrative/ESO-only permissions."
"negative_check": "An unrelated sibling path must remain denied. Do not broaden policy contents or attach administrative/ESO-only permissions.",
"verified_execution_receipt": "hosted-public-registration-verification.json"
},
"private_source_access": {
"repositories": [
@ -38,11 +39,18 @@
"visibility_change_authorized": false,
"credential_design": "A new dedicated Forgejo identity/PAT restricted to repository-read for exactly these seven sources; verify a denied-write/admin negative. Keep it distinct from the hub writer token and from other workload credentials.",
"delivery": "Owner-reviewed OpenBao custody and ESO delivery to the reuse-surface hub runtime, then configure the registration auth_env with the environment variable name only.",
"approval": "Platform operator and each relevant source owner must approve the limited private capability-metadata disclosure and reader scope before provisioning."
"approval": "Platform operator and each relevant source owner must approve the limited private capability-metadata disclosure and reader scope before provisioning.",
"metadata_disclosure_consent": {
"status": "approved",
"receipt": "private-source-owner-consent-r1.json",
"decision_id": "d8f8f216-ac94-4295-97f3-825fd21254ea",
"proposal_sha256": "46ac4fe49a08054cc215aade2fbaf3b36ee334520997857ed84f530b52da9d35"
},
"consumer_delivery_gate": "Reuse owner reports native authenticated redirect forwarding hazard. Require owner-reviewed native fetch fix and verified fixed hub image before introducing source-reader PAT; initial same-image assumption is superseded by private-reader-owner-assembly-receipt.json."
},
"resume": "Update and retain the exact registration proposal revision with admitted auth_env references, verify source parity, execute bounded registrations, then require all 70 reviewed IDs exactly once in a fresh hosted federation.",
"secret_values_requested_in_chat": false,
"owner_message_sent": false,
"owner_message_sent": true,
"attended_sequence": [
"Review CCR-2026-0005 and identify the actual intended caller principal. The existing OIDC identity is not named in the CCR.",
"If needed, obtain and record platform-operator plus reuse-surface-owner approval for binding that exact identity to the existing read-only policy. Verify read on the two exact paths and denial on a sibling path.",
@ -54,6 +62,6 @@
"plan": "hub-public-resume-plan.json",
"helper": "register_public_hub.py",
"repositories": 31,
"status": "prepared and tested; not executed"
"status": "31 registrations applied, readback verified, hosted public capabilities verified, login session revoked"
}
}