From d68d131e32c523fcf989fa0e7ad44b60b33c6067 Mon Sep 17 00:00:00 2001 From: codex Date: Sat, 17 Oct 2026 19:25:36 +0200 Subject: [PATCH] Record independent Warden 1.3 kernel review r1 --- .../kernel-review-r1.json | 1673 +++++++++++++++++ 1 file changed, 1673 insertions(+) create mode 100644 docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review/kernel-review-r1.json diff --git a/docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review/kernel-review-r1.json b/docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review/kernel-review-r1.json new file mode 100644 index 0000000..64ca183 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review/kernel-review-r1.json @@ -0,0 +1,1673 @@ +{ + "schema": "custodian.warden-1.3-kernel-review.v1", + "review_round": "r1", + "reviewed_on": "2026-10-17", + "reviewer": { + "agent": "codex", + "role": "independent kernel reviewer", + "session": "Fresh session started in /home/worsch/ops-warden; no authoring-session context inherited; no delegation used." + }, + "request": "the-custodian/docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review/README.md", + "overall_verdict": "reject", + "summary": "Accept the 117fec9 original-intent fixes within KERNEL-1 scope. Reject the final branch for the attended pre-dispatch identity gap and the execution-admission bypass of attended lane/session validation. Catalog draft posture and final generated paths are correct. No pin, promotion, native acceptance or authority is granted.", + "frozen_targets": { + "original_interface": "a45cf475bc4dbc929e0eecbc1f806a9229d934e2", + "kernel_1": "117fec9241e7b985dfb187b992e173d0a5dc3700", + "branch": "warden-1.3-kernel", + "branch_head": "5abde817775d6304e3cf5a46948717a1606981bf", + "net_kingdom": "001a38ca2aa85155ce4840c4da22aca6e2346171", + "review_bases": { + "kernel_1": "a45cf47..117fec9", + "branch": "117fec9..5abde81" + }, + "source_hashes": { + "117fec9:src/warden/case_run.py": "sha256:77e8117a1fb4e039815b555797778f7180f11e30f64cebe51b350b3eb7e46768", + "5abde81:src/warden/case_run.py": "sha256:e071b485162b2db5c4a9da5821917b7ff81a07980270530ed91e987796591ddd", + "5abde81:registry/routing/catalog.yaml": "sha256:ba9634a92e584dac8c42e8624ab52adce06e79a285209cb64c0daa4dac9cd7d8", + "001a38c:security-case-type-revisions/1.3/oidc-browser-relying-party/type.yaml": "sha256:e75fe94110ef9fb7fb18072fe2856941b33507c99cb406d36576046481485d0a", + "001a38c:sso-mfa/k8s/keycape/descriptor-composition-1.3.candidate.json": "sha256:773daa1df72cc7cf6a6d8aa082208181ca2438cdecc9179b1bc5b1c3a09099c2" + } + }, + "commit_verdicts": [ + { + "commit": "117fec9241e7b985dfb187b992e173d0a5dc3700", + "base": "a45cf475bc4dbc929e0eecbc1f806a9229d934e2", + "verdict": "accept", + "scope": "KERNEL-1 original-intent delta only", + "reason": "All four predecessor defects independently reproduced and fixed; atomicity, restart lookup, exact-match refusal and separate reconcile context confirmed. This is not acceptance of the predecessor as a whole or native recovery authority." + }, + { + "commit": "a14376cf62945b7df619e81c8d59d0208dec7a3f", + "base": "117fec9241e7b985dfb187b992e173d0a5dc3700", + "verdict": "reject", + "reason": "KERNEL-2 resolution and most mode checks work, but KR1-F1 and KR1-F2 leave attended execution gaps. At this intermediate revision Apps hand-over risk is standard despite change effect, and generated provenance is stale. The latter two issues are corrected by later commits.", + "open_findings": [ + "KR1-F1", + "KR1-F2" + ] + }, + { + "commit": "69fdba29070fab16cfb6703caad386253587f107", + "base": "a14376cf62945b7df619e81c8d59d0208dec7a3f", + "verdict": "accept", + "scope": "Generated-artifact delta only", + "reason": "Correctly refreshes provenance for catalog a14376c; 38 high-risk lanes and 17 concrete paths. Does not resolve the underlying kernel findings." + }, + { + "commit": "207d29e8d1d613ca2bdee4ab7628ccc5ca2ec0fb", + "base": "69fdba29070fab16cfb6703caad386253587f107", + "verdict": "reject", + "reason": "Planner lane-kind rule and high hand-over grade are correct. KR1-F1 persists; KR1-F2 now includes unresolved attended-change sessions. KR1-F4 records missing focused tests. Generated paths at this intermediate commit are stale until 0a1e990.", + "open_findings": [ + "KR1-F1", + "KR1-F2", + "KR1-F4" + ] + }, + { + "commit": "0a1e9907bb114575eec941df1fbbca3c0c7d19ea", + "base": "207d29e8d1d613ca2bdee4ab7628ccc5ca2ec0fb", + "verdict": "accept", + "scope": "Generated-artifact delta only", + "reason": "Correctly refreshes catalog provenance, includes apps-consumer-handover and all four new high-risk lanes; 39 high-risk lanes and 17 concrete paths." + }, + { + "commit": "5abde817775d6304e3cf5a46948717a1606981bf", + "base": "0a1e9907bb114575eec941df1fbbca3c0c7d19ea", + "verdict": "reject", + "reason": "The six integration tests execute and pass, but their all-seven-admitted expectation exposes KR1-F2 and the docstring overstates the limited simulations (KR1-F3). They do not close KR1-F1 or provide native proof.", + "open_findings": [ + "KR1-F1", + "KR1-F2", + "KR1-F3", + "KR1-F4" + ] + } + ], + "findings": [ + { + "id": "KR1-F1", + "severity": "high", + "priority": "P1", + "blocking": true, + "title": "Recheck the attended human boundary at every dispatch", + "introduced_by": "a14376cf62945b7df619e81c8d59d0208dec7a3f", + "locations": [ + { + "path": "src/warden/case_run.py", + "lines": [ + 714, + 721 + ] + }, + { + "path": "src/warden/case_run.py", + "lines": [ + 853, + 876 + ] + } + ], + "problem": "The attended WARDEN_AGENT_ID check runs only in admit(). _admission(), shared by run/rollback/reconcile, rechecks caller evidence and the mint guard but does not retain or recheck attended mode. An admitted attended change can be dispatched after the process becomes agent-marked.", + "independent_reconstruction": { + "probe": "attended-agent-marker-after-admission", + "setup": "Generated acknowledged synthetic type, one attended human change step, active high-risk login lane, fixed synthetic adapter, fixture-only evidence verifier. Admit with WARDEN_AGENT_ID absent, then set it to synthetic-agent and call run() with the exact admitted tuple.", + "expected": "Refused before a journal row or owner callback.", + "observed": { + "dispatch": "accepted", + "owner_callbacks": 1, + "intent_rows": 1, + "receipt_rows": 2 + }, + "native_effects": false + }, + "requested_change": "Carry the admitted dispatch mode in the executor admission record and enforce the attended human/agent condition again in the common pre-dispatch admission guard. Cover cached admission followed by a changed runtime identity for run, rollback and reconcile.", + "scope_limit": "No installed native adapter or production exploitation is established by this synthetic callback test." + }, + { + "id": "KR1-F2", + "severity": "high", + "priority": "P1", + "blocking": true, + "title": "Enforce attended lane kinds and their establishing login in execution admission", + "introduced_by": "a14376cf62945b7df619e81c8d59d0208dec7a3f", + "extended_by": "207d29e8d1d613ca2bdee4ab7628ccc5ca2ec0fb", + "locations": [ + { + "path": "src/warden/case_run.py", + "lines": [ + 556, + 590 + ] + }, + { + "path": "src/warden/case_run.py", + "lines": [ + 714, + 728 + ] + }, + { + "path": "src/warden/case_type.py", + "lines": [ + 133, + 148 + ] + } + ], + "problem": "Executor.admit() never invokes check_follow_through and has no equivalent lane-kind/session_lane validation. Its attended path accepts any active, graded, delegated lane fitting the owner. The login/attended-change rule exists only in planning, and run() requires no successful plan.", + "independent_reconstruction": { + "probes": [ + "attended-secret-lane", + "attended-ceremony-lane", + "attended-unresolved-session" + ], + "setup": "Use the generated attended human change descriptor and active high-risk lane, varying lane kind between secret, ceremony, and attended-change with session_lane pending-owner-confirmation.", + "observed": "All three admit successfully while check_follow_through reports LANE-KIND for the same documents.", + "real_candidate_correspondence": "The branch integration test promotes the four draft entries and admits all seven descriptors although the two Apps establishing sessions remain unresolved. Its own separate type-check test reports those two LANE-KIND findings.", + "expected": "An attended execution admission must refuse a secret/ceremony lane and an attended-change lane without its active, reviewed login lane, before mutation dispatch." + }, + "requested_change": "Apply the attended lane-kind and establishing-session checks in the kernel admission path, using the same parsed catalog whose whole digest was authenticated. Keep the two pending-owner-confirmation Apps steps refused until an owner-confirmed login exists; align the integration expectations with that boundary.", + "scope_limit": "Planning is correctly refused today. Existing draft statuses and the missing 1.3 parameter pin remain independent blockers; this finding concerns bypassing planning through the executor API after hypothetical promotion/pinning." + }, + { + "id": "KR1-F3", + "severity": "medium", + "priority": "P2", + "blocking": false, + "title": "Describe the integration test as conditional fixture admission with all its simulations", + "introduced_by": "5abde817775d6304e3cf5a46948717a1606981bf", + "locations": [ + { + "path": "tests/test_case_1_3_integration.py", + "lines": [ + 1, + 7 + ] + }, + { + "path": "tests/test_case_1_3_integration.py", + "lines": [ + 42, + 45 + ] + }, + { + "path": "tests/test_case_1_3_integration.py", + "lines": [ + 78, + 93 + ] + } + ], + "problem": "The docstring says only promotion and the pin are simulated. Positive tests also change the committed proposed type to acknowledged, change the example case to materialized, replace its acceptance record, install stub Adapter objects and accept every evidence purpose/digest unconditionally. Fixture-only trust is disclosed, but the literal two-simulations claim is false.", + "verified": "The real 001a38c type and composition JSON are read, and the seven descriptor encodings match the type map. No dispatch occurs. The test is useful conditional admission coverage, not byte-exact acknowledged-source admission, real-adapter execution, authenticated catalog acceptance, or owner assent.", + "requested_change": "Enumerate the acknowledgment, case/materialization/acceptance and trust/adapter fixtures in the docstring and resulting review claims. State precisely that the map and metadata are real, but authority and adapter behavior are simulated. Retain the proposed-type and missing-pin negatives." + }, + { + "id": "KR1-F4", + "severity": "low", + "priority": "P3", + "blocking": false, + "title": "Add focused attended-change/session_lane unit coverage", + "introduced_by": "207d29e8d1d613ca2bdee4ab7628ccc5ca2ec0fb", + "locations": [ + { + "path": "src/warden/case_type.py", + "lines": [ + 141, + 148 + ] + }, + { + "path": "tests/test_case_1_3_integration.py", + "lines": [ + 129, + 143 + ] + } + ], + "problem": "There is no dedicated unit test for the new attended-change branch. The optional sibling integration exercises a valid login and missing Apps login references, but not a draft, unreviewed or wrong-kind establishing lane. It skips entirely when the sibling candidate is unavailable.", + "independent_reconstruction": "Seven reviewer-generated controls confirm the current planner/parser behavior for valid, missing, draft, unreviewed and wrong-kind login targets, a draft change lane, and a missing session_lane field.", + "requested_change": "Add a small fixture-only unit matrix for those branches, independent of a sibling checkout, and distinguish parser rejection from LANE-KIND/LANE-UNREVIEWED findings.", + "coverage_judgment": "Yes, this is a low-priority coverage finding. The absence of a dedicated unit test is not itself a reproduced implementation failure and is not an independent merge blocker." + } + ], + "kernel_1": { + "four_reported_defects": [ + { + "defect": "Original actor mismatch was accepted", + "probe": "fix-actor" + }, + { + "defect": "Payload attempt ID could differ from the SQL attempt_id column", + "probe": "fix-sql-attempt" + }, + { + "defect": "An orphan original intent without its original running receipt was accepted", + "probe": "fix-orphan" + }, + { + "defect": "OriginalIntent serialization accepted arbitrary nonmetadata values", + "probe": "fix-serializer" + } + ], + "independent_comparison": [ + { + "probe": "fix-actor", + "a45cf47": { + "lookup": "accepted", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 4 + ], + "callbacks": 1 + }, + "117fec9": { + "lookup": "refused: original intent actor mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + }, + "5abde81": { + "lookup": "refused: original intent actor mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "probe": "fix-sql-attempt", + "a45cf47": { + "lookup": "accepted", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 4 + ], + "callbacks": 1 + }, + "117fec9": { + "lookup": "refused: original intent attempt identity differs", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + }, + "5abde81": { + "lookup": "refused: original intent attempt identity differs", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "probe": "fix-orphan", + "a45cf47": { + "lookup": "accepted", + "rows_before": [ + 1, + 1 + ], + "rows_after": [ + 1, + 3 + ], + "callbacks": 1 + }, + "117fec9": { + "lookup": "refused: original running receipt missing; no backfill", + "rows_before": [ + 1, + 1 + ], + "rows_after": [ + 1, + 1 + ], + "callbacks": 0 + }, + "5abde81": { + "lookup": "refused: original running receipt missing; no backfill", + "rows_before": [ + 1, + 1 + ], + "rows_after": [ + 1, + 1 + ], + "callbacks": 0 + } + }, + { + "probe": "fix-serializer", + "a45cf47": "accepted", + "117fec9": "refused: invalid original intent metadata", + "5abde81": "refused: invalid original intent metadata" + } + ], + "atomicity": "The intent and pre-dispatch receipt are inserted under BEGIN IMMEDIATE, committed before invoke; a reviewer-injected receipt INSERT failure leaves zero intent/receipt rows and zero callbacks.", + "restart": "A separate Python interpreter reopens the journal and finds the original run ID. Reconcile uses that original Invocation and a distinct fresh attempt ID with operation reconcile.", + "mismatch_coverage": "Reviewer mutations of step, owner, target, actor, principal, lane, tenant, realm, source and pins all refuse before reconcile writes or callbacks. Rows are unchanged. Principal/tenant/realm also have existing checked-in consistency coverage.", + "serializer_review": "Exact Invocation/Pins objects, closed identifier/digest fields, fixed operation/actor values, bounded duplicate-free JSON decoding and save-time invocation/pin/running-state correspondence were read and exercised.", + "limits": [ + "The journal is local dispatch correspondence, not independent created-only owner provenance.", + "Current admit leaves tenant and realm empty.", + "Changed run-sheet/session pins, missing legacy intent, or missing original receipt do not acquire recovery authority." + ], + "real_registration_adapter_reconstruction": { + "method": "Reviewer-authored lost-reply/restart/reconcile scenarios using the real 001a38c registration adapter and real kernel. Reused its synthetic Kubernetes/checker fixture; owner publish, authenticate, holder, observe and revocation are synthetic. Generated descriptor/type machine map and catalog promotion are in memory; no native action.", + "117fec9": [ + { + "scenario": "success", + "result": "verified-success", + "created": [ + "keycape-client" + ], + "holder_used_original_id": true, + "synthetic_kube_mutations": 1 + }, + { + "scenario": "missing-holder-record", + "result": "refused: owner callback failed", + "created": [], + "holder_used_original_id": true, + "synthetic_kube_mutations": 1 + }, + { + "scenario": "unauthenticated-original", + "result": "refused: owner callback failed", + "created": [], + "holder_used_original_id": true, + "synthetic_kube_mutations": 1 + }, + { + "scenario": "native-revision-drift", + "result": "refused: owner callback failed", + "created": [], + "holder_used_original_id": true, + "synthetic_kube_mutations": 1 + }, + { + "scenario": "source-drift", + "result": "verified-success", + "created": [ + "keycape-client" + ], + "holder_used_original_id": true, + "synthetic_kube_mutations": 1 + } + ], + "5abde81": [ + { + "scenario": "success", + "result": "verified-success", + "created": [ + "keycape-client" + ], + "holder_used_original_id": true, + "synthetic_kube_mutations": 1 + }, + { + "scenario": "missing-holder-record", + "result": "refused: owner callback failed", + "created": [], + "holder_used_original_id": true, + "synthetic_kube_mutations": 1 + }, + { + "scenario": "unauthenticated-original", + "result": "refused: owner callback failed", + "created": [], + "holder_used_original_id": true, + "synthetic_kube_mutations": 1 + }, + { + "scenario": "native-revision-drift", + "result": "refused: owner callback failed", + "created": [], + "holder_used_original_id": true, + "synthetic_kube_mutations": 1 + }, + { + "scenario": "source-drift", + "result": "verified-success", + "created": [ + "keycape-client" + ], + "holder_used_original_id": true, + "synthetic_kube_mutations": 1 + } + ], + "scenario_label_correction": "The scenario labeled source-drift changes only the synthetic checker binary, not adapter/helper source. Its success is a read-only binary-drift observation, not a successful adapter-source-drift negative test. The reconcile path does not execute that binary; checked-in adapter tests cover source/binary drift for mutation." + } + }, + "kernel_2": { + "verdict": "scoped checks pass, subject to KR1-F2", + "verified": [ + "The catalog bytes are parsed through the real catalog entry parser and duplicate lane IDs refuse.", + "Missing, draft, undelegated, ungraded, wrong-owner and undergraded change lanes refuse.", + "A warden/attended descriptor owner must be a slash-delimited owner_repo member; owner mode additionally requires exact equality.", + "Both mint and change require literal risk high.", + "catalog-routing-acceptance still authenticates digest(catalog_source), not a single-entry digest. An unrelated-byte catalog change invalidates a verifier fixed to the original whole digest." + ], + "whole_catalog_digest_probe": { + "verified_digest": "sha256:c0353dd72899f4bacb1b51c4fc3699102ef12ef110785847932b48f60b761ce5", + "full_catalog_digest": "sha256:c0353dd72899f4bacb1b51c4fc3699102ef12ef110785847932b48f60b761ce5", + "changed_catalog": "refused: independent owner evidence not verified" + } + }, + "kernel_3": { + "verdict": "needs change (KR1-F1 and KR1-F2)", + "verified": [ + "Warden mode preserves actor/lane equality and the existing human mint restrictions, alongside the requested new catalog/type checks.", + "Attended admission requires actor human, no nonempty WARDEN_AGENT_ID, parent-session scope, and caller lane equal to descriptor lane equal to the type step lane.", + "Owner admission requires explicit native delegation, exact owner_repo equality, warden_executes false in the lane, and effect other than mint.", + "Type step must occur exactly once, declare both dispatch booleans, forbid both true, and agree with descriptor owner and lane.", + "A matching {selected_owner} case parameter is accepted only when it equals the already pinned descriptor owner; selecting another owner refuses. Later parameter validation still runs before journaling.", + "Parent-session and broker-grant revocation evidence remain separate, attempt/operation-bound requirements." + ], + "ordering_observation": "Mode checks run before target-parameter validation, but neither path writes a journal row. The duplicate-step and mismatched parameter-owner probes refuse; no authority-widening parameter-owner bypass was reproduced." + }, + "catalog_and_lane_kind": { + "draft_entries": [ + { + "id": "keycape-attended-case-change", + "status": "draft", + "risk": "high", + "owner_repo": "key-cape/net-kingdom", + "delegation": "interim", + "lane": "attended-change", + "session_lane": "key-cape-oidc-login" + }, + { + "id": "platform-secret-delivery", + "status": "draft", + "risk": "high", + "owner_repo": "railiance-platform", + "delegation": "native", + "lane": "secret" + }, + { + "id": "consumer-owner-deployment", + "status": "draft", + "risk": "high", + "owner_repo": "railiance-apps", + "delegation": "native", + "lane": "attended-change", + "session_lane": "pending-owner-confirmation" + }, + { + "id": "apps-consumer-handover", + "status": "draft", + "risk": "high", + "owner_repo": "railiance-apps", + "delegation": "native", + "lane": "attended-change", + "session_lane": "pending-owner-confirmation" + } + ], + "pointer_only": true, + "promoted": false, + "planner": "Against the committed catalog the real candidate has six LANE-UNREVIEWED findings. After in-memory draft promotion it has exactly two LANE-KIND findings, for the Apps lanes; planning stays refused. The KeyCape establishing login is active, reviewed, and kind login.", + "independent_planner_controls": [ + { + "scenario": "valid", + "result": [] + }, + { + "scenario": "missing-session", + "result": [ + "LANE-KIND" + ] + }, + { + "scenario": "draft-session", + "result": [ + "LANE-KIND" + ] + }, + { + "scenario": "unreviewed-session", + "result": [ + "LANE-KIND" + ] + }, + { + "scenario": "wrong-kind-session", + "result": [ + "LANE-KIND" + ] + }, + { + "scenario": "draft-change", + "result": [ + "LANE-UNREVIEWED" + ] + }, + { + "scenario": "missing-session-field", + "result": "catalog-refused: entry 'keycape-attended-case-change' is an attended-change lane and must name session_lane" + } + ], + "generated_artifact_checks": [ + { + "commit": "a14376c", + "artifact_fresh": false, + "different_fields": [ + "catalog_revision", + "catalog_revision_date", + "catalog_dirty" + ], + "high_risk_lane_count": 38, + "concrete_path_count": 17 + }, + { + "commit": "69fdba2", + "artifact_fresh": true, + "different_fields": [], + "high_risk_lane_count": 38, + "concrete_path_count": 17 + }, + { + "commit": "207d29e", + "artifact_fresh": false, + "different_fields": [ + "catalog_revision", + "catalog_revision_date", + "high_risk_lane_count", + "no_concrete_path" + ], + "high_risk_lane_count": 38, + "concrete_path_count": 17 + }, + { + "commit": "0a1e990", + "artifact_fresh": true, + "different_fields": [], + "high_risk_lane_count": 39, + "concrete_path_count": 17 + }, + { + "commit": "5abde81", + "artifact_fresh": true, + "different_fields": [], + "high_risk_lane_count": 39, + "concrete_path_count": 17 + } + ], + "parameter_pins": { + "unchanged_from_117fec9": true, + "versions": [ + "1.1", + "1.2" + ], + "version_1_3_present": false, + "disposition": "PIN-1 remains a founder-acknowledgment gate." + }, + "nonblocking_stale_comment": "consumer-owner-deployment still comments that the descriptor actor is agent; the frozen 1.3 artifact has human for all seven descriptors. This comment is not evidence of an agent grant." + }, + "integration_test": { + "six_tests_ran_in_final_suite": true, + "real_files": "Exact archived 001a38c type.yaml, forgejo example, composition artifact, and 5abde81 catalog were used. Environment override selected that frozen archive.", + "descriptor_map": "All seven artifact descriptor encodings match the committed type execution_descriptors map.", + "simulations": [ + "Type status proposed -> acknowledged for positive paths.", + "Case -> materialized and acceptance record -> synthetic fixture acceptance.", + "Four draft catalog statuses -> active in memory.", + "1.3 parameter fingerprint pin patched in memory.", + "Stub Adapter callbacks and unconditional fixture evidence verifier; no real adapter dispatch." + ], + "negative_results": [ + "Six descriptor steps on draft lanes refuse; the existing mint lane remains admitted under the other fixtures.", + "Unpinned acknowledged 1.3 refuses exact-version validation.", + "Proposed 1.3 refuses as not acknowledged.", + "Promoted catalog still has the two Apps planner LANE-KIND refusals." + ], + "docstring_verdict": "Not literally proved: there are more than two simulations (KR1-F3). No native acceptance follows." + }, + "independent_reconstruction_count": { + "predecessor_defects_reconstructed": 4, + "predecessor_fixes_confirmed": 4, + "new_security_gaps_reproduced": 2, + "unique_generic_probe_scenarios": 34, + "generic_target_scenario_evaluations": { + "a45cf47": 16, + "117fec9": 16, + "5abde81": 34 + }, + "real_adapter_target_scenario_evaluations": { + "117fec9": 5, + "5abde81": 5 + }, + "planner_control_scenarios": 7, + "generated_artifact_revision_checks": 5, + "total_custom_target_scenario_evaluations": 88, + "counting_rule": "Counts primary reviewer-authored scenario evaluations, including positive controls; it is not a count of independent trust roots, native successes, or distinct defects. Repeated suite checks and inherited tests are excluded." + }, + "independent_probe_results": { + "a45cf47": [ + { + "id": "fix-actor", + "result": "observed", + "detail": { + "lookup": "accepted", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 4 + ], + "callbacks": 1 + } + }, + { + "id": "fix-sql-attempt", + "result": "observed", + "detail": { + "lookup": "accepted", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 4 + ], + "callbacks": 1 + } + }, + { + "id": "fix-orphan", + "result": "observed", + "detail": { + "lookup": "accepted", + "rows_before": [ + 1, + 1 + ], + "rows_after": [ + 1, + 3 + ], + "callbacks": 1 + } + }, + { + "id": "fix-serializer", + "result": "observed", + "detail": "accepted" + }, + { + "id": "original-mismatch-step", + "result": "observed", + "detail": { + "lookup": "refused: original intent binding mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "original-mismatch-owner", + "result": "observed", + "detail": { + "lookup": "refused: original intent owner mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "original-mismatch-target", + "result": "observed", + "detail": { + "lookup": "refused: original intent binding mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "original-mismatch-actor", + "result": "observed", + "detail": { + "lookup": "accepted", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 4 + ], + "callbacks": 1 + } + }, + { + "id": "original-mismatch-principal", + "result": "observed", + "detail": { + "lookup": "refused: original intent principal mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "original-mismatch-lane", + "result": "observed", + "detail": { + "lookup": "refused: original intent lane mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "original-mismatch-tenant", + "result": "observed", + "detail": { + "lookup": "refused: original intent tenant mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "original-mismatch-realm", + "result": "observed", + "detail": { + "lookup": "refused: original intent realm mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "original-mismatch-source", + "result": "observed", + "detail": { + "lookup": "refused: original intent source mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "original-mismatch-pins", + "result": "observed", + "detail": { + "lookup": "refused: original intent pins mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "atomic-save-failure", + "result": "observed", + "detail": { + "rows": [ + 0, + 0 + ], + "callbacks": 0 + } + }, + { + "id": "restart-context-separation", + "result": "observed", + "detail": { + "child_found_original": true, + "original_matches_dispatch": true, + "reconcile_operation": "reconcile", + "new_attempt_separate": true + } + } + ], + "117fec9": [ + { + "id": "fix-actor", + "result": "observed", + "detail": { + "lookup": "refused: original intent actor mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "fix-sql-attempt", + "result": "observed", + "detail": { + "lookup": "refused: original intent attempt identity differs", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "fix-orphan", + "result": "observed", + "detail": { + "lookup": "refused: original running receipt missing; no backfill", + "rows_before": [ + 1, + 1 + ], + "rows_after": [ + 1, + 1 + ], + "callbacks": 0 + } + }, + { + "id": "fix-serializer", + "result": "observed", + "detail": "refused: invalid original intent metadata" + }, + { + "id": "original-mismatch-step", + "result": "observed", + "detail": { + "lookup": "refused: original intent binding mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "original-mismatch-owner", + "result": "observed", + "detail": { + "lookup": "refused: original intent owner mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "original-mismatch-target", + "result": "observed", + "detail": { + "lookup": "refused: original intent binding mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "original-mismatch-actor", + "result": "observed", + "detail": { + "lookup": "refused: original intent actor mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "original-mismatch-principal", + "result": "observed", + "detail": { + "lookup": "refused: original intent principal mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "original-mismatch-lane", + "result": "observed", + "detail": { + "lookup": "refused: original intent lane mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "original-mismatch-tenant", + "result": "observed", + "detail": { + "lookup": "refused: original intent tenant mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "original-mismatch-realm", + "result": "observed", + "detail": { + "lookup": "refused: original intent realm mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "original-mismatch-source", + "result": "observed", + "detail": { + "lookup": "refused: original intent source mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "original-mismatch-pins", + "result": "observed", + "detail": { + "lookup": "refused: original intent pins mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "atomic-save-failure", + "result": "observed", + "detail": { + "rows": [ + 0, + 0 + ], + "callbacks": 0 + } + }, + { + "id": "restart-context-separation", + "result": "observed", + "detail": { + "child_found_original": true, + "original_matches_dispatch": true, + "reconcile_operation": "reconcile", + "new_attempt_separate": true + } + } + ], + "5abde81": [ + { + "id": "fix-actor", + "result": "observed", + "detail": { + "lookup": "refused: original intent actor mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "fix-sql-attempt", + "result": "observed", + "detail": { + "lookup": "refused: original intent attempt identity differs", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "fix-orphan", + "result": "observed", + "detail": { + "lookup": "refused: original running receipt missing; no backfill", + "rows_before": [ + 1, + 1 + ], + "rows_after": [ + 1, + 1 + ], + "callbacks": 0 + } + }, + { + "id": "fix-serializer", + "result": "observed", + "detail": "refused: invalid original intent metadata" + }, + { + "id": "original-mismatch-step", + "result": "observed", + "detail": { + "lookup": "refused: original intent binding mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "original-mismatch-owner", + "result": "observed", + "detail": { + "lookup": "refused: original intent owner mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "original-mismatch-target", + "result": "observed", + "detail": { + "lookup": "refused: original intent binding mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "original-mismatch-actor", + "result": "observed", + "detail": { + "lookup": "refused: original intent actor mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "original-mismatch-principal", + "result": "observed", + "detail": { + "lookup": "refused: original intent principal mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "original-mismatch-lane", + "result": "observed", + "detail": { + "lookup": "refused: original intent lane mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "original-mismatch-tenant", + "result": "observed", + "detail": { + "lookup": "refused: original intent tenant mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "original-mismatch-realm", + "result": "observed", + "detail": { + "lookup": "refused: original intent realm mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "original-mismatch-source", + "result": "observed", + "detail": { + "lookup": "refused: original intent source mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "original-mismatch-pins", + "result": "observed", + "detail": { + "lookup": "refused: original intent pins mismatch", + "rows_before": [ + 1, + 2 + ], + "rows_after": [ + 1, + 2 + ], + "callbacks": 0 + } + }, + { + "id": "atomic-save-failure", + "result": "observed", + "detail": { + "rows": [ + 0, + 0 + ], + "callbacks": 0 + } + }, + { + "id": "restart-context-separation", + "result": "observed", + "detail": { + "child_found_original": true, + "original_matches_dispatch": true, + "reconcile_operation": "reconcile", + "new_attempt_separate": true + } + }, + { + "id": "catalog-{'status': 'draft'}", + "result": "observed", + "detail": "refused: descriptor lane is not active in the catalog" + }, + { + "id": "catalog-{'risk': 'standard'}", + "result": "observed", + "detail": "refused: catalog lane risk does not cover the descriptor effect" + }, + { + "id": "catalog-{'risk': 'ungraded'}", + "result": "observed", + "detail": "refused: descriptor lane carries no risk grade" + }, + { + "id": "catalog-{'owner_repo': 'another-owner'}", + "result": "observed", + "detail": "refused: descriptor owner does not fit catalog lane owner_repo" + }, + { + "id": "catalog-{'delegation': None}", + "result": "observed", + "detail": "refused: descriptor lane has no catalog delegation record" + }, + { + "id": "catalog-missing", + "result": "observed", + "detail": "refused: descriptor lane is not in the catalog" + }, + { + "id": "mode-duplicate-step", + "result": "observed", + "detail": "refused: type step does not declare how the kernel dispatches it" + }, + { + "id": "mode-parameter-owner-matches", + "result": "observed", + "detail": "accepted" + }, + { + "id": "mode-parameter-owner-mismatches", + "result": "observed", + "detail": "refused: type step lane or owner disagrees with descriptor" + }, + { + "id": "owner-{'delegation': {'mode': 'interim', 'intended_owner': 'review-owner', 'blocked_on': 'synthetic', 'reviewed': '2026-10-17'}}", + "result": "observed", + "detail": "refused: owner step lane is not the owner's native path" + }, + { + "id": "owner-{'owner_repo': 'review-owner/another-owner'}", + "result": "observed", + "detail": "refused: owner step lane is not the owner's native path" + }, + { + "id": "owner-{'warden_executes': True}", + "result": "observed", + "detail": "refused: owner step lane is not the owner's native path" + }, + { + "id": "attended-secret-lane", + "result": "observed", + "detail": { + "planning_findings": [ + "LANE-KIND" + ], + "admission": "accepted" + } + }, + { + "id": "attended-ceremony-lane", + "result": "observed", + "detail": { + "planning_findings": [ + "LANE-KIND" + ], + "admission": "accepted" + } + }, + { + "id": "attended-unresolved-session", + "result": "observed", + "detail": { + "planning_findings": [ + "LANE-KIND" + ], + "admission": "accepted" + } + }, + { + "id": "attended-agent-marker-after-admission", + "result": "observed", + "detail": { + "dispatch": "accepted", + "callbacks": 1, + "rows": [ + 1, + 2 + ] + } + }, + { + "id": "whole-catalog-digest", + "result": "observed", + "detail": { + "verified_digest": "sha256:c0353dd72899f4bacb1b51c4fc3699102ef12ef110785847932b48f60b761ce5", + "full_catalog_digest": "sha256:c0353dd72899f4bacb1b51c4fc3699102ef12ef110785847932b48f60b761ce5", + "changed_catalog": "refused: independent owner evidence not verified" + } + }, + { + "id": "condition-false", + "result": "observed", + "detail": "accepted" + } + ] + }, + "test_execution": { + "isolation": "Frozen git archives under /tmp/warden-kernel-review-r1. Later test subprocesses use an allowlisted environment, empty isolated home, frozen sibling NetKingdom, no ambient credentials and a socket audit guard. The only allowed socket connection is to a loopback server bound by that same test process (desk dry-run).", + "initial_aborted_attempts": { + "commands": [ + "make test at 117fec9", + "make test at 5abde81" + ], + "exit_codes": [ + 130, + 130 + ], + "reason": "Stopped after identifying the general access advisory tests perform unmocked ambient OpenBao identity lookup. See boundary_deviation; these aborted launches are not passing evidence." + }, + "first_isolated_full_suites": [ + { + "revision": "117fec9", + "command": "python -m pytest (repository pytest configuration)", + "passed": 705, + "failed": 10, + "skipped": 2, + "deselected": 4, + "seconds": 79.52 + }, + { + "revision": "5abde81", + "command": "python -m pytest (repository pytest configuration, WARDEN_TEST_NETKINGDOM_ROOT points to 001a38c archive)", + "passed": 734, + "failed": 10, + "skipped": 2, + "deselected": 4, + "seconds": 96.23 + } + ], + "all_ten_failure_causes": [ + { + "tests": [ + "TestGeneratedArtifact::test_artifact_is_current" + ], + "cause": "Git archives have no .git provenance: generator reports unknown revision/date. Corrected only scratch Git metadata, fetched the exact frozen commit and populated the index; source bytes unchanged." + }, + { + "tests": [ + "test_approve_flow_http_dry" + ], + "cause": "The initial network guard also denied the synthetic loopback desk server. Refined it to allow only an endpoint bound by that test process." + }, + { + "tests": [ + "test_published_coverage_equals_measured_coverage", + "test_repo_catalog_uses_only_explicit_workload_references" + ], + "cause": "Isolated home lacked three public rapp declarations. Copied only rapp-core-hub, rapp-issue-core and rapp-qonto declarations into the test home; no credential files were copied." + }, + { + "tests": [ + "test_memory_status_and_activate_round_trip", + "test_worker_uses_stabilized_memory_without_llm", + "test_cross_runtime_continuity_agent_to_worker", + "test_route_find_records_memory_episode", + "test_build_plans_records_worker_outcomes", + "test_route_find_implicitly_activates_memory_without_explicit_command" + ], + "cause": "Review runner set WARDEN_MEMORY=0 globally, conflicting with tests of recording. Removed that override inside the isolated home; writes remain scratch-only." + } + ], + "skipped_tests": "Two canonical-type/case tests locate NetKingdom under Path.home(). Supplied a link from the isolated home to the frozen archive and reran both.", + "focused_environment_rechecks": { + "117fec9": "15 passed in 3.87s", + "5abde81": "15 passed in 4.08s", + "composition": "All ten initially failing cases, the two skipped cases, and three previously passing memory tests. No repository source was changed." + }, + "combined_unique_repository_test_outcome": { + "117fec9": "717 selected tests have passing observations; 4 integration-marked tests remain deselected.", + "5abde81": "746 selected tests have passing observations; 4 integration-marked tests remain deselected.", + "qualification": "Combined full-suite and focused recheck evidence, not a claim that an uninterrupted full-suite run passed." + }, + "lint": "make lint at 5abde81: All checks passed.", + "net_kingdom_requested_rechecks": [ + { + "kernel": "117fec9", + "tests": [ + "test_admit_1_3_type.py", + "test_keycape_registration_adapter.py" + ], + "result": "27 passed, 54 subtests passed in 6.81s" + }, + { + "kernel": "5abde81", + "tests": [ + "test_admit_1_3_type.py", + "test_keycape_registration_adapter.py" + ], + "result": "17 failures (14 failing subtests plus 3 failing top-level tests), 24 passed, 40 subtests passed in 5.14s", + "cause": "These older fixtures pass b'fixture-only-catalog', which the new parsed-catalog admission correctly refuses. Seven positive admission subtests and seven expected missing-pin subtests stop earlier with invalid catalog source shape; three registration kernel fixtures also stop there. This is fixture incompatibility, not evidence to weaken KERNEL-2. The branch real-catalog integration and reviewer real-adapter reconstruction cover the newer seam." + } + ], + "other_failed_preparations": [ + { + "attempt": "First focused environment recheck used two guessed pytest selector names", + "result": "Exit 4, no tests ran", + "resolution": "Read the names and reran the correct selectors, preserving this failed attempt." + }, + { + "attempt": "git rev-parse 001a38c from ops-warden", + "result": "Wrong-repository ref lookup failed", + "resolution": "Resolved and archived from net-kingdom; frozen full SHA is recorded above." + } + ], + "scratch_evidence_location": "/tmp/warden-kernel-review-r1 (supplemental and ephemeral; this JSON embeds the material outcomes)", + "reviewer_probe_sources_sha256": { + "independent_probes.py": "sha256:aa916adc766af8891e216764b91cf635bb087af042095301bb58b8c4e3af4819", + "registration_reconstruct.py": "sha256:867a6355c44ab5c8d8cb59682a1d14138b4d1191674cb08f5b7410d45af7fded", + "lane_kind_controls.py": "sha256:5c20cb73519330c984b1e953571384d9fbe7b762c27936aefcf1e5918e18992e", + "branch_artifacts.py": "sha256:c777f37b0b30b3b9a5432e7ca9de4738aa65e8a1cf298826e7d68a0ec05619cd" + } + }, + "boundary_deviation": { + "status": "initial test-isolation failure; retained adverse outcome", + "description": "The first two general-suite launches inherited the workstation environment/home. Access advisory tests call describe_ambient_openbao_caller without a mock; that helper invokes bao token lookup -format=json when an ambient token file exists. A later metadata-only check confirmed bao exists and ~/.vault-token exists (neither token environment variable was set). Therefore these launches must be treated as unapproved ambient credential-use/native lookup attempts, contrary to the review hard limit, not as evidence of a wholly offline review.", + "unknowns": "The initial output contains no lookup response or native success evidence; whether a request reached OpenBao or succeeded was not verified. The CLI may have read the ambient token file. No follow-up credential or native query was made to investigate.", + "containment": "Both sessions were interrupted with exit 130; all subsequent execution used the credential-free isolated home and socket guard. No secret value was displayed in review outputs or written into this JSON. No intentional secret retrieval, signing, route mutation, production mutation or native adapter invocation was performed.", + "effect_on_verdict": "Do not count the aborted attempts as compliant reconstruction or native acceptance. Source verdicts rely on later isolated observations. Full adherence to the requested no-secret/no-native execution boundary cannot be claimed for this session." + }, + "additional_bounded_observations": [ + { + "probe": "condition-false", + "observation": "A generated step whose when condition is false is admitted; Executor does not call the planner condition evaluator. The omission predates the reviewed delta and was not counted as a newly introduced KERNEL-1/2/3 defect. The probe is retained for a broader execution/planning-contract review." + }, + { + "observation": "Planning refusal is real, but the executor API is callable without a plan. Independent evidence verification is a required injected trust root, not a substitute for the kernel checks explicitly required in this review." + } + ], + "knowledge_orientation": { + "package_version": "0.2.6", + "package_digest": "8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02", + "audience": "generic", + "cards": [ + "start", + "evidence", + "access (source text)" + ], + "validated_card_status": { + "start": "withheld / orientation-only", + "evidence": "withheld / orientation-only" + }, + "source_status": "Multiple source checkouts changed relative to package pins. Withheld text was not treated as action authority. Reviewed task README, owner-review-ops-warden.json, frozen kernel/type/catalog contracts and current ops-warden INTENT.md / net-kingdom SECURITY-COMPANION.md directly." + }, + "changes_made": { + "ops_warden_source_edits": false, + "net_kingdom_source_edits": false, + "fixes_applied": false, + "requested_output_only": "the-custodian/docs/changes/netkingdom-target-2026-10-17/warden-1.3-kernel-review/kernel-review-r1.json", + "scratch_only": "Archives, Python environments, synthetic journals, test-home public declarations, scratch Git metadata and reviewer probes.", + "workplan_edits": false, + "statehub_fix_consistency_required": false, + "preexisting_ops_warden_worktree_change": "WORK-RECORDS.md was already modified at session start and remains untouched." + }, + "what_remains": [ + "Owner changes and independent follow-up review for KR1-F1 and KR1-F2 before accepting the kernel branch.", + "Correct the integration claim (KR1-F3) and add dedicated attended-change unit tests (KR1-F4).", + "Retain and resolve the initial test-isolation boundary deviation; it is not a compliant no-native test success.", + "Owner confirmation of all four draft pointers and real establishing login lanes for the two Apps attended-change paths before promotion.", + "Founder acknowledgment of the exact re-frozen type, then owner recomputation and addition of the 1.3 parameter pin under PIN-1; no preauthorization.", + "Authenticated real owner evidence, original created-only provenance, exact native readback and per-attempt parent-session/grant revocation under WARDEN-WP-0044-T03.", + "Update older NetKingdom fixture catalogs for the new admission contract; do not remove parsed-catalog checks to make them pass.", + "Native run and downstream catalog integration acceptance remain outside this source review." + ], + "grants": "none" +}