From d834d0c4b71ea7ddf81317d5c2746ca514a810c8 Mon Sep 17 00:00:00 2001 From: codex Date: Sat, 17 Oct 2026 00:46:32 +0200 Subject: [PATCH] docs(security): record verified owner source delivery and native gates --- .../resume-integration-r1/README.md | 23 ++ .../native-next-steps.md | 82 +++++ .../publication-verification.json | 83 +++++ .../source-references.json | 326 ++++++++++++++++++ .../verified-results.json | 207 +++++++++++ docs/netkingdom-target-implementation.md | 60 +++- ...gdom-security-blueprint-and-gap-closure.md | 25 +- 7 files changed, 804 insertions(+), 2 deletions(-) create mode 100644 docs/changes/netkingdom-target-2026-10-16/resume-integration-r1/README.md create mode 100644 docs/changes/netkingdom-target-2026-10-16/resume-integration-r1/native-next-steps.md create mode 100644 docs/changes/netkingdom-target-2026-10-16/resume-integration-r1/publication-verification.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/resume-integration-r1/source-references.json create mode 100644 docs/changes/netkingdom-target-2026-10-16/resume-integration-r1/verified-results.json diff --git a/docs/changes/netkingdom-target-2026-10-16/resume-integration-r1/README.md b/docs/changes/netkingdom-target-2026-10-16/resume-integration-r1/README.md new file mode 100644 index 0000000..e82bc2e --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/resume-integration-r1/README.md @@ -0,0 +1,23 @@ +# Verified owner source delivery, 17 October 2026 + +NetKingdom source `4f65e41` delivers local group provenance and sealed-custody +recovery preparation. Repo Manager source `83c521b` delivers bounded staged-object +batching. Normal hooks accepted source and follow-through records. Exact remote +heads, unchanged source files, source ancestry and all 61 owner task ID/UUID/status +bindings are checked in [publication verification](publication-verification.json). +The legacy consistency projection's missing task IDs were detected and repaired +through the existing forge-derived reconciliation; the failed audit remains noted. + +[Verified results](verified-results.json) retain the 65/111/42 canonical test +outcomes, 14 actual disposable LLDAP oracles, four actual configured-hook cases, +13 scanner parity cases, performance samples, independent cleanup and limitations. +Checksums in this published receipt use explicit `sha256:` prefixes. Original +receipts and full frozen fixture/candidate packets remain workspace-local, with +their original digests retained; these are source/disposable results. + +Review corrected production SQLite-on-PVC guidance before publication. The local +journal is not production storage admission. No actual key, restored consumer, +live deployment, rotation or owner assent was introduced. All sixteen target +acceptance gates remain open. [Next steps](native-next-steps.md) use the existing +owner/package/custody boundaries, supported by [40 independently verified public +source references](source-references.json). diff --git a/docs/changes/netkingdom-target-2026-10-16/resume-integration-r1/native-next-steps.md b/docs/changes/netkingdom-target-2026-10-16/resume-integration-r1/native-next-steps.md new file mode 100644 index 0000000..14b6d27 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/resume-integration-r1/native-next-steps.md @@ -0,0 +1,82 @@ +# Native preparation after verified source delivery + +These are owner-bound preparation steps. Source evidence establishes neither +current native assent nor production acceptance. [Source references](source-references.json) +bind 23 group/storage and 17 recovery references to exact reviewed Git bytes. + +## Group journal and protected rollback — NK-WP-0048-T14 + +NetKingdom owns implementation and attended directory reconciliation. Platform +owns shared database/custody governance; rapp-postgres supplies the existing +database-per-consumer surface. The inspected runtime package bindings do not +assign identity-provisioner a managed package. Settle that assignment first. +Accepted ADR-0015 excludes SQLite-on-PVC from production. Keep the delivered +SQLite backend local/disposable; build the same journal semantics behind the +existing injection seam using CNPG, or obtain an explicit scoped policy exception. + +The proposed consumer is identity-provisioner in namespace sso, with a separate +database/schema and runtime/migration/owner roles. Placement, connections, +statement/idle timeouts, retention, backup and dynamic credential lease delivery +need existing package/Platform acceptance. Source declarations suggest the second +cell as an overflow candidate; they prove no live headroom or granted capacity. +EUR cost and credible loss bounds remain unknown. No consumer or database was +created and no lease was requested. + +Tenant/case scope must come from an authoritative protected caller binding. +Caller JSON and a default platform scope are insufficient. Warden's old group +caller route was dropped; User Engine's runtime token/pod access is not new +protected-case authority. Bind current case/source/principal/native identities, +independent evidence and per-attempt session revocation through existing owners. + +SQL row versions/active-slot exclusion can serialize cooperating journal calls. +They cannot fence LLDAP's admin WebUI, helper or user-deletion writers. Prove an +all-writer maintenance barrier that survives process loss, or provider CAS and +generation semantics, before native destructive rollback. Two reads and one +replica do not prevent races or remove/re-add ABA. A database restored behind an +LDAP effect must remain quarantined pending independent reconciliation. Preserve +intents/evidence; never clear uncertainty by dropping or reinitializing storage. + +## Original TLS and selected consumer — NK-WP-0049-T35/T36 + +railiance-cluster owns the ingress/cert-manager/cluster-backup substrate; +NetKingdom owns namespace ingress intent. The declared TLS identity is +kc.coulomb.social using sso/kc-tls and letsencrypt-prod, terminated by Traefik. +The identity archive profile excludes this TLS Secret. The inspected encrypted +cluster-backup source writes same-host state/Helm/kubeconfig copies and establishes +no independently recoverable original TLS/trust snapshot. Its named plaintext +staging and whole-cluster restore are not admitted isolated recovery steps. + +Obtain the existing source owner's metadata and independent private custody path, +or an explicitly accepted reissue disposition for the outage claim. Draft owner +questions have not been sent. No key retrieval or self-signed substitute is ready. +Once public-only original certificate/chain/trust provenance is established, +bind its public hashes/SANs/validity to the exact isolated attempt. Keep private +inputs in the owner's terminal and run complete preflight before any key prompt. + +The historically deployed secrets-engine-openbao client is a defensible selector +candidate: issuer proof from 7 October and consumer proof from 10 October predate +the 16 October archive. The public selector is: + +| Field | Candidate value | +| --- | --- | +| Client / audience | secrets-engine-openbao | +| Secret environment name | KEYCAPE_SECRETS_ENGINE_OPENBAO_CLIENT_SECRET | +| Scope / denied scope | openbao:login / openbao:admin | +| Subject / tenant | service:secrets-engine / tenant:platform | +| Required role | secrets-engine | + +Historical deployment does not prove current owner assent, archived uniqueness, +environment binding or restored consumer continuity. Have the existing service +owner validate the selector; later private archive/native checks must establish +the original registration without retrieving a client secret into work records. +No token exchange, OpenBao login, new grant, rotation or consumer redirect occurred. +T33 still waits for complete reviewed readiness; T18 owns actual owner-held +execution/consumer acceptance and T19 retained-factor MFA. + +## Configured-hook acceptance — RMGR-WP-0021-T05 + +Source publication, canonical import routing, 42 tests, 13 parity cases and four +actual configured clean/private-key cases are established separately. Keep the +actual unavailable-scanner hook case pending until a reviewed fixture can shadow +the exact scanner path without changing the real scanner or user state. Remote +receive/CI/private-response coverage and whole TSA-15 acceptance remain open. diff --git a/docs/changes/netkingdom-target-2026-10-16/resume-integration-r1/publication-verification.json b/docs/changes/netkingdom-target-2026-10-16/resume-integration-r1/publication-verification.json new file mode 100644 index 0000000..a5c9c34 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/resume-integration-r1/publication-verification.json @@ -0,0 +1,83 @@ +{ + "schema": "custodian.owner-publication-verification.v1", + "observed_at": "2026-10-16T22:45:50.633309+00:00", + "native_target_acceptance": false, + "all_sixteen_target_gates_remain_open": true, + "owners": [ + { + "repo": "net-kingdom", + "source_commit": "4f65e41ac55d2bc652122b76312048efdaf6b698", + "published_head": "6cb43c0cc55212363a5406b02db046e2384a7c40", + "remote_main_exact": true, + "source_ancestor_verified": true, + "source_files_unchanged": 20, + "normal_source_and_record_hooks_passed": true, + "preexisting_other_work_preserved": true, + "sync": { + "legacy_consistency": { + "fail": 0, + "automation_error": 0, + "warn": 36, + "info": 5 + }, + "central_projection": "applied", + "retained_audit_finding": "Legacy sync matched UUID/status but omitted task record IDs after T09; forge-derived reconciliation repaired projection." + }, + "workplans": [ + { + "id": "NK-WP-0048", + "tasks": 20, + "source_counts": { + "done": 14, + "wait": 2, + "todo": 3, + "progress": 1 + }, + "all_ids_uuids_statuses_match": true + }, + { + "id": "NK-WP-0049", + "tasks": 36, + "source_counts": { + "done": 24, + "progress": 4, + "wait": 7, + "todo": 1 + }, + "all_ids_uuids_statuses_match": true + } + ] + }, + { + "repo": "repo-manager", + "source_commit": "83c521bf2fa351d730a90bf7f7e13dfd4b0cff2a", + "published_head": "b02e1cefb0e07fe246dc9fe9c5a989fe06116587", + "remote_main_exact": true, + "source_ancestor_verified": true, + "source_files_unchanged": 2, + "normal_source_and_record_hooks_passed": true, + "preexisting_other_work_preserved": true, + "sync": { + "status": "applied", + "commit": "b02e1cefb0e07fe246dc9fe9c5a989fe06116587", + "refused": 0 + }, + "workplans": [ + { + "id": "RMGR-WP-0021", + "tasks": 5, + "source_counts": { + "done": 2, + "progress": 2, + "todo": 1 + }, + "all_ids_uuids_statuses_match": true + } + ] + } + ], + "projection_instance": { + "instance_role": "primary", + "instance_label": "railiance01" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/resume-integration-r1/source-references.json b/docs/changes/netkingdom-target-2026-10-16/resume-integration-r1/source-references.json new file mode 100644 index 0000000..abbd284 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/resume-integration-r1/source-references.json @@ -0,0 +1,326 @@ +{ + "scope": "exact public Git sources; no live topology or owner assent", + "all_40_hashes_independently_verified": true, + "references": [ + { + "lane": "group_storage", + "repo": "net-kingdom", + "path": "INTENT.md", + "revision": "878abc93588e12b6da1bac055cfbb3abb8d7adf1", + "sha256": "sha256:fd2ba8dff9dfd5583ec6d8b0348f273bfe00c59923b5d5d47cd22b1fb4658c54", + "source": "https://forgejo.coulomb.social/coulomb/net-kingdom/src/commit/878abc93588e12b6da1bac055cfbb3abb8d7adf1/INTENT.md" + }, + { + "lane": "group_storage", + "repo": "net-kingdom", + "path": "docs/adr/ADR-0015-netkingdom-railiance-workload-packaging-and-relational-platform.md", + "revision": "878abc93588e12b6da1bac055cfbb3abb8d7adf1", + "sha256": "sha256:2000985ef211aeedd3656e15cedb289e655526c2dcc4a161a64ffc27f0289db1", + "source": "https://forgejo.coulomb.social/coulomb/net-kingdom/src/commit/878abc93588e12b6da1bac055cfbb3abb8d7adf1/docs/adr/ADR-0015-netkingdom-railiance-workload-packaging-and-relational-platform.md" + }, + { + "lane": "group_storage", + "repo": "net-kingdom", + "path": "sso-mfa/k8s/identity-provisioner/deployment.yaml", + "revision": "878abc93588e12b6da1bac055cfbb3abb8d7adf1", + "sha256": "sha256:807878e939967c8b88dafd4746c2a321b373d9f552083a82248fa917d4d9ea73", + "source": "https://forgejo.coulomb.social/coulomb/net-kingdom/src/commit/878abc93588e12b6da1bac055cfbb3abb8d7adf1/sso-mfa/k8s/identity-provisioner/deployment.yaml" + }, + { + "lane": "group_storage", + "repo": "net-kingdom", + "path": "docs/identity-provisioner-bind-repair.md", + "revision": "878abc93588e12b6da1bac055cfbb3abb8d7adf1", + "sha256": "sha256:df1e39eca8573cb06dae61386aa6ade316533947a0959f07fe4a03ea503fd148", + "source": "https://forgejo.coulomb.social/coulomb/net-kingdom/src/commit/878abc93588e12b6da1bac055cfbb3abb8d7adf1/docs/identity-provisioner-bind-repair.md" + }, + { + "lane": "group_storage", + "repo": "net-kingdom", + "path": "sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md", + "revision": "878abc93588e12b6da1bac055cfbb3abb8d7adf1", + "sha256": "sha256:03be1481f387d9fddbdeff550abbc2cbaa120db4105877c909acc7b3f00f8046", + "source": "https://forgejo.coulomb.social/coulomb/net-kingdom/src/commit/878abc93588e12b6da1bac055cfbb3abb8d7adf1/sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md" + }, + { + "lane": "group_storage", + "repo": "net-kingdom", + "path": "sso-mfa/k8s/lldap/ingress.yaml", + "revision": "878abc93588e12b6da1bac055cfbb3abb8d7adf1", + "sha256": "sha256:7cb1f0e09f22004adcdd66d617857123d08276aa685d677b0c6e81e0aabe5290", + "source": "https://forgejo.coulomb.social/coulomb/net-kingdom/src/commit/878abc93588e12b6da1bac055cfbb3abb8d7adf1/sso-mfa/k8s/lldap/ingress.yaml" + }, + { + "lane": "group_storage", + "repo": "ops-mason", + "path": "docs/directory-group-binding.md", + "revision": "57411f25b990f0d70dcfdcbd07778f6219bb9bf8", + "sha256": "sha256:b050e19ccabebf2fd27d7052cf4b6ecd2f9015874566230727674c1c75894fdf", + "source": "https://forgejo.coulomb.social/coulomb/ops-mason/src/commit/57411f25b990f0d70dcfdcbd07778f6219bb9bf8/docs/directory-group-binding.md" + }, + { + "lane": "group_storage", + "repo": "ops-mason", + "path": "registry/capabilities/capability.security.structure-construction.md", + "revision": "57411f25b990f0d70dcfdcbd07778f6219bb9bf8", + "sha256": "sha256:000ceac5b4c71569aed1c9af970980a0c72a34db13fdca40671c9ddbfe97409d", + "source": "https://forgejo.coulomb.social/coulomb/ops-mason/src/commit/57411f25b990f0d70dcfdcbd07778f6219bb9bf8/registry/capabilities/capability.security.structure-construction.md" + }, + { + "lane": "group_storage", + "repo": "ops-warden", + "path": "registry/routing/catalog.yaml", + "revision": "d97652a3bb5fa733b063d71a1b74068efcccf572", + "sha256": "sha256:c47065c0892fd0bd07c2bffab95884e7e907832eef3623c4d69d6ad3b01ebc53", + "source": "https://forgejo.coulomb.social/coulomb/ops-warden/src/commit/d97652a3bb5fa733b063d71a1b74068efcccf572/registry/routing/catalog.yaml" + }, + { + "lane": "group_storage", + "repo": "railiance-platform", + "path": "docs/rapp-postgres-boundary.md", + "revision": "08c1f036f2750097750f435efd76e8f6ee6df393", + "sha256": "sha256:6d80877d2eb7cef79a11f1d8ee40e8bb7fabdbdd122494a7aaa39b6d931e610d", + "source": "https://forgejo.coulomb.social/coulomb/railiance-platform/src/commit/08c1f036f2750097750f435efd76e8f6ee6df393/docs/rapp-postgres-boundary.md" + }, + { + "lane": "group_storage", + "repo": "railiance-platform", + "path": "INTENT.md", + "revision": "08c1f036f2750097750f435efd76e8f6ee6df393", + "sha256": "sha256:12c6540735af591f7a4a9fe85ff10d3cd00eec55b5b6b1ddf148abf2d3ac9a9c", + "source": "https://forgejo.coulomb.social/coulomb/railiance-platform/src/commit/08c1f036f2750097750f435efd76e8f6ee6df393/INTENT.md" + }, + { + "lane": "group_storage", + "repo": "rapp-postgres", + "path": "declarations/rapp.yaml", + "revision": "a9f569c96d74aa384ac8d3ac4aa960e4061550b5", + "sha256": "sha256:a5811e9fa994ae5815214e81440b3be2a32b58236c09ec1887c54d0a7f9f3dce", + "source": "https://forgejo.coulomb.social/coulomb/rapp-postgres/src/commit/a9f569c96d74aa384ac8d3ac4aa960e4061550b5/declarations/rapp.yaml" + }, + { + "lane": "group_storage", + "repo": "rapp-postgres", + "path": "scripts/render_consumers.py", + "revision": "a9f569c96d74aa384ac8d3ac4aa960e4061550b5", + "sha256": "sha256:5d83e29e5ec675b3c78c0129d9e12213b624146f5883534a7e5c99aaaa057f61", + "source": "https://forgejo.coulomb.social/coulomb/rapp-postgres/src/commit/a9f569c96d74aa384ac8d3ac4aa960e4061550b5/scripts/render_consumers.py" + }, + { + "lane": "group_storage", + "repo": "rapp-postgres", + "path": "docs/adr/ADR-0004-platform-pg-cell-ceiling.md", + "revision": "a9f569c96d74aa384ac8d3ac4aa960e4061550b5", + "sha256": "sha256:1f1eb521f8e6690bfdf650257308a6139540a65ca65d822a8def5f7a90fde82b", + "source": "https://forgejo.coulomb.social/coulomb/rapp-postgres/src/commit/a9f569c96d74aa384ac8d3ac4aa960e4061550b5/docs/adr/ADR-0004-platform-pg-cell-ceiling.md" + }, + { + "lane": "group_storage", + "repo": "rapp-postgres", + "path": "docs/adr/ADR-0001-consumer-boundary-and-tenant-isolation.md", + "revision": "a9f569c96d74aa384ac8d3ac4aa960e4061550b5", + "sha256": "sha256:3474c0e1b411ce65a4fee63288b22101662370db737ca7e41158263bf310eb06", + "source": "https://forgejo.coulomb.social/coulomb/rapp-postgres/src/commit/a9f569c96d74aa384ac8d3ac4aa960e4061550b5/docs/adr/ADR-0001-consumer-boundary-and-tenant-isolation.md" + }, + { + "lane": "group_storage", + "repo": "rapp-postgres", + "path": "consumers/tenant-engine.yaml", + "revision": "a9f569c96d74aa384ac8d3ac4aa960e4061550b5", + "sha256": "sha256:92f36d587f001c86ff401aedd25cb49fa171d49e000b0a6ab551e182e5c11448", + "source": "https://forgejo.coulomb.social/coulomb/rapp-postgres/src/commit/a9f569c96d74aa384ac8d3ac4aa960e4061550b5/consumers/tenant-engine.yaml" + }, + { + "lane": "group_storage", + "repo": "rapp-postgres", + "path": "consumers/audit-core.yaml", + "revision": "a9f569c96d74aa384ac8d3ac4aa960e4061550b5", + "sha256": "sha256:a2db53f901df056546b2c028f287f8fc50486e6e6cd81026b9e926b6b64272b3", + "source": "https://forgejo.coulomb.social/coulomb/rapp-postgres/src/commit/a9f569c96d74aa384ac8d3ac4aa960e4061550b5/consumers/audit-core.yaml" + }, + { + "lane": "group_storage", + "repo": "rapp-postgres", + "path": "consumers/core-hub.yaml", + "revision": "a9f569c96d74aa384ac8d3ac4aa960e4061550b5", + "sha256": "sha256:8fe3e8b4488548b2f5e01f1d46edd9fd5fe4f0e4f65a3821f172adbfb5ae1d84", + "source": "https://forgejo.coulomb.social/coulomb/rapp-postgres/src/commit/a9f569c96d74aa384ac8d3ac4aa960e4061550b5/consumers/core-hub.yaml" + }, + { + "lane": "group_storage", + "repo": "rapp-postgres", + "path": "consumers/isolation-probe.yaml", + "revision": "a9f569c96d74aa384ac8d3ac4aa960e4061550b5", + "sha256": "sha256:8ea24d3bd04ab683b47ceff2586932ea4fdb0d45c49896167bb5b352a67a5cfb", + "source": "https://forgejo.coulomb.social/coulomb/rapp-postgres/src/commit/a9f569c96d74aa384ac8d3ac4aa960e4061550b5/consumers/isolation-probe.yaml" + }, + { + "lane": "group_storage", + "repo": "rapp-postgres", + "path": "consumers/sbom-nexus.yaml", + "revision": "a9f569c96d74aa384ac8d3ac4aa960e4061550b5", + "sha256": "sha256:0b21d05fe7b9d21cbc9eb761f455329739ceb71f8dd3d1200971426962c11236", + "source": "https://forgejo.coulomb.social/coulomb/rapp-postgres/src/commit/a9f569c96d74aa384ac8d3ac4aa960e4061550b5/consumers/sbom-nexus.yaml" + }, + { + "lane": "group_storage", + "repo": "rapp-postgres", + "path": "consumers/canned-prompts.yaml", + "revision": "a9f569c96d74aa384ac8d3ac4aa960e4061550b5", + "sha256": "sha256:97d4b439cec7e788b7c1fa2c7181c2606ed098dcf37a38c1f73f7393e6046429", + "source": "https://forgejo.coulomb.social/coulomb/rapp-postgres/src/commit/a9f569c96d74aa384ac8d3ac4aa960e4061550b5/consumers/canned-prompts.yaml" + }, + { + "lane": "group_storage", + "repo": "reef-railiance", + "path": "bindings/rapps.yaml", + "revision": "33b840faac109f134bf1115d631d5b1242052d9a", + "sha256": "sha256:796007c68f0eda1d50cebddf9e11a2c123a8814ebaf67f739ed5d2af2d6fa3f1", + "source": "https://forgejo.coulomb.social/coulomb/reef-railiance/src/commit/33b840faac109f134bf1115d631d5b1242052d9a/bindings/rapps.yaml" + }, + { + "lane": "group_storage", + "repo": "rail-kubernetes", + "path": "docs/wave-1-contract.md", + "revision": "5fad47fdfb7d4cabc21cf10f52ac733ef59803b0", + "sha256": "sha256:2974f8bd9096fe1f096e9f557fbbc2c29fc80462c46d693462b2258abdc9fbff", + "source": "https://forgejo.coulomb.social/coulomb/rail-kubernetes/src/commit/5fad47fdfb7d4cabc21cf10f52ac733ef59803b0/docs/wave-1-contract.md" + }, + { + "lane": "tls_registration", + "repo": "net-kingdom", + "path": "sso-mfa/k8s/keycape/ingress.yaml", + "revision": "878abc93588e12b6da1bac055cfbb3abb8d7adf1", + "sha256": "sha256:bc5c7524a82de5e8b9755e7d7d408b4a66e034424cb2663c1d21352d292d5a72", + "source": "https://forgejo.coulomb.social/coulomb/net-kingdom/src/commit/878abc93588e12b6da1bac055cfbb3abb8d7adf1/sso-mfa/k8s/keycape/ingress.yaml" + }, + { + "lane": "tls_registration", + "repo": "net-kingdom", + "path": "tools/bootstrap-recovery/identity-backup-profile.json", + "revision": "878abc93588e12b6da1bac055cfbb3abb8d7adf1", + "sha256": "sha256:40f9e5b5bb957e5b23e03b31701702b850502d16a92a0fa0ebf92618cc3f18a1", + "source": "https://forgejo.coulomb.social/coulomb/net-kingdom/src/commit/878abc93588e12b6da1bac055cfbb3abb8d7adf1/tools/bootstrap-recovery/identity-backup-profile.json" + }, + { + "lane": "tls_registration", + "repo": "net-kingdom", + "path": "sso-mfa/k8s/keycape/secrets-engine-openbao-client-rollout.py", + "revision": "878abc93588e12b6da1bac055cfbb3abb8d7adf1", + "sha256": "sha256:8b834e5f0353a5e11797637420609e06e7bf7de47777c7e78b774f74d4a6afbd", + "source": "https://forgejo.coulomb.social/coulomb/net-kingdom/src/commit/878abc93588e12b6da1bac055cfbb3abb8d7adf1/sso-mfa/k8s/keycape/secrets-engine-openbao-client-rollout.py" + }, + { + "lane": "tls_registration", + "repo": "net-kingdom", + "path": "sso-mfa/k8s/keycape/deployment.yaml", + "revision": "878abc93588e12b6da1bac055cfbb3abb8d7adf1", + "sha256": "sha256:83777942bc922c7d1719b0ad0b09e873105c342dae3b013bb65eeccf6d905626", + "source": "https://forgejo.coulomb.social/coulomb/net-kingdom/src/commit/878abc93588e12b6da1bac055cfbb3abb8d7adf1/sso-mfa/k8s/keycape/deployment.yaml" + }, + { + "lane": "tls_registration", + "repo": "net-kingdom", + "path": "workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md", + "revision": "878abc93588e12b6da1bac055cfbb3abb8d7adf1", + "sha256": "sha256:ef38481d26e599802d94f8b06a4d89c7c99a83c81ca5be9bcf7422b885867479", + "source": "https://forgejo.coulomb.social/coulomb/net-kingdom/src/commit/878abc93588e12b6da1bac055cfbb3abb8d7adf1/workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md" + }, + { + "lane": "tls_registration", + "repo": "net-kingdom", + "path": "sso-mfa/k8s/keycape/README.md", + "revision": "878abc93588e12b6da1bac055cfbb3abb8d7adf1", + "sha256": "sha256:e7a002996fd57477f6bcd054264076fe04da17f8685095163c1c80dd57b753f2", + "source": "https://forgejo.coulomb.social/coulomb/net-kingdom/src/commit/878abc93588e12b6da1bac055cfbb3abb8d7adf1/sso-mfa/k8s/keycape/README.md" + }, + { + "lane": "tls_registration", + "repo": "key-cape", + "path": "workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md", + "revision": "834b0d06a13bb2ece9cc98392cb39ba0e2167ecb", + "sha256": "sha256:3a90a0c460fc439570820b96d1ddc3b7f8646c557ca3a8aa27c6d546bb1a845a", + "source": "https://forgejo.coulomb.social/coulomb/key-cape/src/commit/834b0d06a13bb2ece9cc98392cb39ba0e2167ecb/workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md" + }, + { + "lane": "tls_registration", + "repo": "key-cape", + "path": "docs/evidence/2026-10-07-secrets-engine-openbao-issuance.json", + "revision": "834b0d06a13bb2ece9cc98392cb39ba0e2167ecb", + "sha256": "sha256:a405ef5289159c525695352ba71da7eca8e897b6f2dc7e5795f9b239361d8068", + "source": "https://forgejo.coulomb.social/coulomb/key-cape/src/commit/834b0d06a13bb2ece9cc98392cb39ba0e2167ecb/docs/evidence/2026-10-07-secrets-engine-openbao-issuance.json" + }, + { + "lane": "tls_registration", + "repo": "secrets-engine", + "path": "docs/evidence/2026-10-10-keycape-openbao-probe.json", + "revision": "535681052cd55ca613706ecc60c39d299929b3c5", + "sha256": "sha256:bf0b5df9f030499d96770f1d9fb2091a8d37da71422a6d456be7200d3a1a1782", + "source": "https://forgejo.coulomb.social/coulomb/secrets-engine/src/commit/535681052cd55ca613706ecc60c39d299929b3c5/docs/evidence/2026-10-10-keycape-openbao-probe.json" + }, + { + "lane": "tls_registration", + "repo": "secrets-engine", + "path": "docs/keycape-openbao-consumer-custody.md", + "revision": "535681052cd55ca613706ecc60c39d299929b3c5", + "sha256": "sha256:73efdd549f3feaccc53eefd6f1b95c8b9eb7091648f94ad80978ba5381be9124", + "source": "https://forgejo.coulomb.social/coulomb/secrets-engine/src/commit/535681052cd55ca613706ecc60c39d299929b3c5/docs/keycape-openbao-consumer-custody.md" + }, + { + "lane": "tls_registration", + "repo": "railiance-cluster", + "path": "SCOPE.md", + "revision": "cac8eabef5a0d0990a7b0de8f5e2c762666ac7f0", + "sha256": "sha256:e4f6a8dd3d72a1f04f0d94721d57ca2a4c7e98790a8373876a5005b87ec5d8a6", + "source": "https://forgejo.coulomb.social/coulomb/railiance-cluster/src/commit/cac8eabef5a0d0990a7b0de8f5e2c762666ac7f0/SCOPE.md" + }, + { + "lane": "tls_registration", + "repo": "railiance-cluster", + "path": "docs/rail-kubernetes-substrate-profile.md", + "revision": "cac8eabef5a0d0990a7b0de8f5e2c762666ac7f0", + "sha256": "sha256:75beeca7ef9670efc0b92c1ef8a33e24b72acbcdee06ee8de3c6492cb69d4f6b", + "source": "https://forgejo.coulomb.social/coulomb/railiance-cluster/src/commit/cac8eabef5a0d0990a7b0de8f5e2c762666ac7f0/docs/rail-kubernetes-substrate-profile.md" + }, + { + "lane": "tls_registration", + "repo": "railiance-cluster", + "path": "tools/cmd/railiance-backup-s2", + "revision": "cac8eabef5a0d0990a7b0de8f5e2c762666ac7f0", + "sha256": "sha256:35c60b7ccccd7b4d5a1cf2134c1f2ca78c45040a7ffcc55f2c32c385a0a682a3", + "source": "https://forgejo.coulomb.social/coulomb/railiance-cluster/src/commit/cac8eabef5a0d0990a7b0de8f5e2c762666ac7f0/tools/cmd/railiance-backup-s2" + }, + { + "lane": "tls_registration", + "repo": "railiance-cluster", + "path": "tools/cmd/railiance-restore-s2", + "revision": "cac8eabef5a0d0990a7b0de8f5e2c762666ac7f0", + "sha256": "sha256:25be58968fee3eeb6069e5af08abe601e8f60f04241e8de4bb917a7c639882e5", + "source": "https://forgejo.coulomb.social/coulomb/railiance-cluster/src/commit/cac8eabef5a0d0990a7b0de8f5e2c762666ac7f0/tools/cmd/railiance-restore-s2" + }, + { + "lane": "tls_registration", + "repo": "railiance-cluster", + "path": "docs/backup-restore.md", + "revision": "cac8eabef5a0d0990a7b0de8f5e2c762666ac7f0", + "sha256": "sha256:4d0bbaad3d69f10179ba9590d3fa12fba2967202c756ecf1952436d1e27de902", + "source": "https://forgejo.coulomb.social/coulomb/railiance-cluster/src/commit/cac8eabef5a0d0990a7b0de8f5e2c762666ac7f0/docs/backup-restore.md" + }, + { + "lane": "tls_registration", + "repo": "railiance-master", + "path": "docs/rail-kubernetes-boundary.md", + "revision": "a0be0d3142b5392f1fb6271cf91325ce91a0f9d4", + "sha256": "sha256:b7a382622e241c174b11a8645aba1801693f22950bb132760b2170fcb828ced1", + "source": "https://forgejo.coulomb.social/coulomb/railiance-master/src/commit/a0be0d3142b5392f1fb6271cf91325ce91a0f9d4/docs/rail-kubernetes-boundary.md" + }, + { + "lane": "tls_registration", + "repo": "railiance-platform", + "path": "docs/backup-provider-coverage.md", + "revision": "08c1f036f2750097750f435efd76e8f6ee6df393", + "sha256": "sha256:f5983aac1e8cc1828e9f73340b1f66c0e67cdcddc1a1e49cbe6f5e39e90c6641", + "source": "https://forgejo.coulomb.social/coulomb/railiance-platform/src/commit/08c1f036f2750097750f435efd76e8f6ee6df393/docs/backup-provider-coverage.md" + } + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-16/resume-integration-r1/verified-results.json b/docs/changes/netkingdom-target-2026-10-16/resume-integration-r1/verified-results.json new file mode 100644 index 0000000..a58cbe9 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/resume-integration-r1/verified-results.json @@ -0,0 +1,207 @@ +{ + "schema": "custodian.target-source-results.v1", + "observed_at": "2026-10-16T22:42:25.642867+00:00", + "scope": "Reviewed owner source plus generated local/disposable compatibility fixtures; no target gate closed", + "canonical_tests": { + "group_provisioner": { + "passed": 65, + "seconds": 8.55 + }, + "recovery_preparation": { + "passed": 111, + "seconds": 14.5 + }, + "staged_scanner": { + "passed": 42, + "seconds": 31.66 + } + }, + "recovery_limitations": { + "legacy_custody_tests_passed": 94, + "legacy_real_sops_skipped": 61, + "actual_owner_held_recovery": false, + "private_admission_complete": false, + "named_file_mode_parent_loss_fixed": false, + "sealed_child_fd_lives_until_child_exit": true + }, + "group_native_fixture": { + "schema": "nk48.synthetic-groups-native-result.v1", + "status": "synthetic_native_compatibility_passed", + "manifest_sha256": "sha256:8a0514f5f14137355972400cd4852f48c892316d28e3abd3c86635d7cb81eef2", + "production_contacted": false, + "actual_credentials_used": false, + "native_acceptance_claimed": false, + "session": { + "run_id": "ee97d0d3572a4d28971d9b19c6d4de78", + "containers": [ + "nk49-kc-ee97d0d3572a4d28971d9b19c6d4de78-groups-lldap", + "nk49-kc-ee97d0d3572a4d28971d9b19c6d4de78-groups-probe" + ], + "label": "net-kingdom.recovery-run=ee97d0d3572a4d28971d9b19c6d4de78" + }, + "containment_verified_before_private_import": true, + "checks": { + "only_loopback_and_no_external_routes": true, + "actual_graphql_ensure_verified": true, + "created_inventory_exact": true, + "preexisting_membership_excluded": true, + "separate_process_sqlite_restart_verified": true, + "actual_graphql_revoke_verified": true, + "preexisting_empty_and_shared_groups_preserved": true, + "all_preexisting_users_and_memberships_preserved": true, + "rollback_replay_nonmutating": true, + "rolledback_key_cannot_recreate": true, + "shared_membership_drift_refused_before_undo": true, + "lost_actual_graphql_response_retains_intent": true, + "reopened_uncertainty_refuses_ensure_and_revoke": true, + "unknown_and_cross_case_receipts_refused": true + }, + "container_cleanup_obligations": [ + { + "container": "nk49-kc-ee97d0d3572a4d28971d9b19c6d4de78-groups-probe", + "status": "absence_verified" + }, + { + "container": "nk49-kc-ee97d0d3572a4d28971d9b19c6d4de78-groups-lldap", + "status": "absence_verified" + } + ], + "container_cleanup_verified": true + }, + "original_group_receipt_sha256": "sha256:da93ca03cec2ad1bae639cc9863bbcaada331e4433ca101372d6bbce05c33382", + "independent_group_cleanup": { + "engine": "74f93783-6cef-43a8-a3c4-f62586cd3bc1", + "exact_container_names_absent": true, + "exact_run_label_inventory_empty": true, + "hard_parent_loss_claim": false + }, + "configured_hooks": { + "status": "verified", + "scope": "actual configured shared and Custodian hooks; generated alternate-index fixtures only", + "source_sha256": "sha256:e709c658f779534fcab093207b0a78e49d54fc584c515fdf7ac535ce75f6c400", + "scanner_sha256": "sha256:88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509", + "hook_sha256": "sha256:d50cf763dc9814383c6886e30b6650bbbdcb49ddd78889082e3fda3626a2cbfd", + "provider_calls": 0, + "real_credentials_read": false, + "real_index_opened": false, + "actual_hook_unavailable_scanner": "pending; no host scanner mutation performed", + "cases": [ + { + "repo": "repo-manager", + "cases": [ + { + "case": "clean", + "status": "clean", + "exit_code": 0, + "scanned_blobs": 1 + }, + { + "case": "generated-private-key", + "status": "blocked", + "exit_code": 1, + "scanned_blobs": 1 + } + ] + }, + { + "repo": "the-custodian", + "cases": [ + { + "case": "clean", + "status": "clean", + "exit_code": 0, + "scanned_blobs": 1 + }, + { + "case": "generated-private-key", + "status": "blocked", + "exit_code": 1, + "scanned_blobs": 1 + } + ] + } + ], + "fixture_removed": true, + "new_scan_storage_absent": true, + "real_index_stat_unchanged": true, + "real_head_unchanged": true, + "routing_and_artifacts_unchanged": true, + "driver_sha256": "sha256:c91d2dc83f04ec17147c0e1410e42f4817b69e4cc5a02201682e5fa7b021b6f4" + }, + "original_hook_receipt_sha256": "sha256:c6541e459b239cf21cb87234fecf7b5c9754dfc55064e07ab87903e3761959a8", + "scanner_parity": { + "exact_old_new_cases": 13, + "fixture_removed": true + }, + "scanner_performance": { + "observations": [ + { + "case": "clean-1x1KiB", + "bytes": 1024, + "unique_blobs": 1, + "warm_samples": 7, + "warm_p50_ms": 835.286, + "warm_p95_nearest_rank_ms": 931.695, + "warm_median_MiB_per_second": 0.001 + }, + { + "case": "clean-16x1KiB", + "bytes": 16384, + "unique_blobs": 16, + "warm_samples": 7, + "warm_p50_ms": 884.239, + "warm_p95_nearest_rank_ms": 965.383, + "warm_median_MiB_per_second": 0.018 + }, + { + "case": "clean-64x1KiB", + "bytes": 65536, + "unique_blobs": 64, + "warm_samples": 7, + "warm_p50_ms": 904.024, + "warm_p95_nearest_rank_ms": 1144.16, + "warm_median_MiB_per_second": 0.069 + }, + { + "case": "clean-1x1MiB", + "bytes": 1048576, + "unique_blobs": 1, + "warm_samples": 7, + "warm_p50_ms": 1902.956, + "warm_p95_nearest_rank_ms": 2524.1, + "warm_median_MiB_per_second": 0.525 + }, + { + "case": "synthetic-private-key", + "bytes": 1675, + "unique_blobs": 1, + "warm_samples": 7, + "warm_p50_ms": 882.714, + "warm_p95_nearest_rank_ms": 949.596, + "warm_median_MiB_per_second": 0.002 + } + ], + "original_receipt_sha256": "sha256:0dae6e12f4067b95864e1d62f8760e6aece302304f2aee4ce0b90144fce64143", + "warm_repetitions": 7, + "percentiles": "nearest rank; descriptive small sample", + "baseline_p50_ms": { + "clean-1x1KiB": 702.358, + "clean-16x1KiB": 12065.334, + "clean-64x1KiB": 49171.849, + "clean-1x1MiB": 2548.887 + }, + "single_blob_slowdown_retained": true, + "receive_ci_or_workload_claim": false + }, + "review_refinements_retained": [ + "Group exactly-one intent row update and database identity checks", + "Definite before-write refusal preserves evidence and releases active fence", + "Scanner batches and reports moved to verified private tmpfs with parent-death cleanup", + "SQLite-on-PVC production guidance corrected before publication against accepted ADR-0015" + ], + "production_deployments": false, + "actual_credentials_used": false, + "native_target_acceptance": false, + "all_sixteen_target_gates_remain_open": true, + "encoding": "Published checksum strings carry explicit sha256: type prefixes; original receipt bytes remain workspace-local and separately hashed." +} diff --git a/docs/netkingdom-target-implementation.md b/docs/netkingdom-target-implementation.md index 43693c9..c5fe2af 100644 --- a/docs/netkingdom-target-implementation.md +++ b/docs/netkingdom-target-implementation.md @@ -19,7 +19,7 @@ GPT-6.1-Sol medium subagent request. The full architecture remains the goal. | TSA-11 | Reuse / provider owners | 70/70 discovery freshly verified 16 October; two drifted owner descriptions corrected and native parity validation strengthened | Full source-link/version/package-family disposition and recurring drift acceptance | | TSA-12 | Activity / Coordination / Custodian; CUST-WP-0079 | Schedule accepted but unassisted activation not proven; cadence source adoption underway | Actual activation and first independent observation | | TSA-13–14 | NetKingdom / provider owners | Accepted reusable integration and second installation pending | Shared adapter conformance and minimal locked profiles | -| TSA-15 | Resource / telemetry / consumer owners; CUST-WP-0071 where applicable | Optimization baseline incomplete | Comparable latency, effort, resource and scanner measurements | +| TSA-15 | Resource / telemetry / consumer owners; CUST-WP-0071 where applicable | Local staged-scanner baseline and bounded batching measured; other optimization evidence incomplete | Admit workload-representative performance and remaining resource/effort baselines | | TSA-16 | Custodian / governance and owner records | Governing records exist; target-wide evidence reconciliation open | Requirement-by-requirement closure audit under CUST-WP-0080-T04 | Each entry summarizes an owner obligation; it does not copy or replace that @@ -616,3 +616,61 @@ remain open. Continue with NK-WP-0049-T33's exact owner-held attempt preparation NK-WP-0048-T16's evidence/revocation/custody integration, and the other owner actions in the full target audit. No historical handle or model-limit failure establishes a running worker. The goal remains active. + +## Reviewed source delivery, 17 October 2026 + +Coordinated GPT-6.1-Sol medium owner assignments delivered NetKingdom source +`4f65e41` and Repo Manager source `83c521b` through normal hooks. Independent +canonical runs passed 65 group-provisioner, 111 recovery-preparation and 42 scanner +checks. [Publication verification](changes/netkingdom-target-2026-10-16/resume-integration-r1/publication-verification.json) +records pushed revisions, task projections and preservation of unrelated work. +All sixteen target gates remain open. + +Group ensure/revoke now retains complete prestate, write-before-call intent and +exact confirmed creations across process restart. Missing/replaced storage, +missing intent rows, unresolved writes, legacy broad rollback and detected shared +membership drift refuse. An actual disposable LLDAP trial passed 14 compatibility +oracles; independent pinned-daemon checks found both exact names and the run label +absent. This proves neither external-writer fencing nor ABA exclusion. Review +corrected SQLite-volume deployment advice before publication: accepted ADR-0015 +requires CNPG/rapp-postgres or a governed exception. SQLite remains local/disposable. +NK-WP-0048-T20 records completed preparation; T14 retains native storage, scope, +all-writer exclusion and protected callback/evidence/session acceptance. + +Recovery validates bounded strict admission metadata, its exact digest, all 17 +local source/config dependencies and required imports before custody. The existing +attended entry point adds sealed anonymous key descriptors and versioned private +manifest derivation after authenticated full-archive validation. Parent loss +does not revoke an admitted child's descriptor before child exit. The compatible +named-file mode retains its original hard-loss limitation. Older custody tests +passed 94 cases with 61 real-SOPS cases skipped. T34 records source delivery; +T35/T36 track original TLS and registration bindings; T33 retains readiness and +T18 actual owner-held recovery/consumer acceptance. No actual key was requested. + +Scanner batching uses verified executable/object bytes, bounded small-blob batches +and private tmpfs with parent-loss cleanup; larger blobs retain stdin semantics. +Thirteen exact old/new parity cases match. Both configured shared and Custodian +hooks accepted clean content and blocked a generated private key through temporary +indexes/object stores. Real indexes were not opened, HEAD/index metadata stayed +unchanged and all fixture storage was removed. Source tests cover unavailable +scanners; actual-hook unavailability remains pending without changing scanner +permissions. The canonical source/explicit repo-local CLI route is verified; +no global installed CLI is claimed. + +| Generated warm fixture | Previous median | Batched median | +| --- | ---: | ---: | +| 1 distinct 1-KiB blob | 0.702 s | 0.835 s | +| 16 distinct 1-KiB blobs | 12.065 s | 0.884 s | +| 64 distinct 1-KiB blobs | 49.172 s | 0.904 s | +| 1 1-MiB blob | 2.549 s | 1.903 s | + +Seven-repeat samples are descriptive local measurements. The one-blob slowdown +remains part of the result; receive/CI coverage and workload tails are not inferred. +[Verified results](changes/netkingdom-target-2026-10-16/resume-integration-r1/verified-results.json) +retain exact test scopes, measurements, refinements and cleanup evidence. + +The next [native preparation steps](changes/netkingdom-target-2026-10-16/resume-integration-r1/native-next-steps.md) +are grounded in 23 group/storage and 17 recovery public-source references. They +identify existing owner paths and a historical secrets-engine-openbao registration +without inventing current assent, independent TLS custody, production storage +admission or consumer continuity. Full frozen fixture packets remain workspace-local. diff --git a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md index d84c3a4..6881ae7 100644 --- a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md +++ b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md @@ -8,7 +8,7 @@ status: active owner: codex topic_slug: custodian created: "2026-10-12" -updated: "2026-10-16" +updated: "2026-10-17" flavor: implementation depends_on: [] state_hub_workstream_id: "dfadb19b-445e-59c6-bcd6-48e87b912c52" @@ -886,3 +886,26 @@ warnings, and the original staged/working brief is preserved. Full frozen fixtur packets remain workspace-local; canonical owner source, published independent host cleanup/reaper evidence and the canonical integration receipt retain the bounded delivered result. The target-wide goal remains active. + + +2026-10-17 source implementation follow-through: coordinated GPT-6.1-Sol medium +owner agents delivered group provenance/recovery source (`4f65e41`, NetKingdom) +and bounded staged-scanner batching (`83c521b`, Repo Manager). Independent canonical +runs passed 65/111/42 checks respectively. Actual disposable LLDAP passed 14 oracles +with independent exact-resource cleanup; four generated cases passed through the +configured shared/Custodian hooks using alternate indexes. Thirteen old/new scanner +parity cases match. The 16/64 small-blob medians improved from 12.065/49.172 to +0.884/0.904 seconds; one small blob slowed. These are bounded local results. + +Review corrected production SQLite-volume advice before publication: ADR-0015 +requires CNPG/rapp-postgres or an explicit governed exception. SQLite remains +local/disposable. NK-WP-0048-T20 records delivered preparation; T14 retains native +storage, scope, writer fencing, callbacks, evidence and revocation. NK-WP-0049-T34 +records sealed-custody/preflight source; T35/T36 track original TLS/registration +bindings, T33 readiness and T18 actual recovery. Public source identifies the +railiance-cluster ingress/backup boundary and a historical secrets-engine-openbao +selector without current assent or private reads. RMGR-WP-0021-T05 stays progress +because actual-hook unavailable-scanner acceptance remains pending. All sixteen +target requirements stay open. Publication/task-projection/preservation checks: +`docs/changes/netkingdom-target-2026-10-16/resume-integration-r1/`. +No rotation, live deployment, actual key recovery or authority promotion occurred.