diff --git a/docs/changes/netkingdom-target-2026-10-16/access-native-admission/image-0a05383/publisher-fix/canonical-integration.json b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/image-0a05383/publisher-fix/canonical-integration.json new file mode 100644 index 0000000..76f23ba --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/image-0a05383/publisher-fix/canonical-integration.json @@ -0,0 +1,39 @@ +{ + "repo": "access-engine", + "commit": "84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0", + "checked_at": "2026-10-16T17:54:13.797579+00:00", + "manifests": [ + "access-native-admission/image-0a05383/publisher-fix/manifest.json", + "access-package-identity/extraction/r3/manifest.json" + ], + "files_sha256": { + "tools/publish-runtime-images.sh": "sha256:1e95ed70e55b04943613f89e241ad4c25094a26cabefbed6c1bdedb8deedf630", + "tests/test_image_publisher.py": "sha256:d5a95cfd0923f9b899ef795d9cd34dee698b0846c831bd3124cb7707c5bfaa91", + "docs/native-signer-workload.json": "sha256:3246ede928d4adc3b540aa4e5e5e5472deb5f15084ea83ebde19071b26212533", + "workplans/FLEX-WP-0024-decision-envelope-authenticity.md": "sha256:def6f73745d02ea88aa334db3239d2ef22984ebefa8853a5573496a08ed1592c" + }, + "committed": true, + "published": true, + "committed_file_hashes_verified": true, + "native_accepted": false, + "scope": "Published reviewed source; no native admission", + "ancestor_of_origin_main": true, + "publication_verified_at": "2026-10-16T17:55:15.923336+00:00", + "sync": { + "session_id": 52971, + "exit_code": 0, + "source_revision": "84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0", + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 10, + "info": 0 + }, + "fixes_applied": [ + "bindings: synced 38/38", + "C-17 cleared: pushed 1 backlogged commit(s)", + "C-22 fixed: task 7f785b52\u2026 description updated", + "push: pushed" + ] + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/access-native-admission/outbox-hardening/canonical-integration.json b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/outbox-hardening/canonical-integration.json new file mode 100644 index 0000000..97448e3 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/outbox-hardening/canonical-integration.json @@ -0,0 +1,66 @@ +{ + "repo": "access-engine", + "base": "2b064eee510640224274ccdc7cefceb1ae13162e", + "patches": [ + { + "path": "access-native-admission/outbox-hardening/implementation.patch", + "sha256": "sha256:52c0ff3f62056bafe141d74baf2c79f7cfab8f5d5c674ac85cedd24bb07d5ee4" + } + ], + "files_sha256": { + "charts/access-engine/templates/deployment.yaml": "sha256:155310e75e3883fc25d9c9dcf79650a8216cf6fd09902421b856cdfeab5e4cc3", + "charts/access-engine/values.yaml": "sha256:01dafea0b6f4752081ff9dcc10a1bd315c28ac7111fbd7802b2b8e76f1a91b0f", + "charts/flex-auth/templates/deployment.yaml": "sha256:b347614283e65d9e8006a93dfbdfec15360632f6c318761e245213460e158666", + "charts/flex-auth/values.yaml": "sha256:0d5c3fa0c52d87ff6350d8f92527814b74bb8b7adadc92ded71856d9c83b1b03", + "cmd/access-engine/main.go": "sha256:da6d185ac971aaa652a6b242f5c46007f8b0089e71e6d6b499bd7925b1377758", + "cmd/access-engine/outbox_capacity_test.go": "sha256:b50bc34c9b759f32744237f7f029e34c6c5c2611c0377b86569fa123dafa7c6e", + "docs/decision-emission-operations.md": "sha256:b78d54bef54f1a93868a3ced9427297092448d19d26c57148ec56b64f4ff7d2f", + "internal/emission/delivery.go": "sha256:9bd2147108fafade36850ec2e00f0fe602471748af7d94c7b2f54e69658f95f1", + "internal/emission/hardening_linux_test.go": "sha256:1b9389db04080e413a62ead05370ff0281bca35c54e091d2d4dc855fd3d82662", + "internal/emission/lock_linux.go": "sha256:604743d6d2427ae8cc8f64cc5fae4934a4c1cf0ed24fbae171bea270ed668f6f", + "internal/emission/lock_other.go": "sha256:271a879de3d43036ce69a5db0f8c2ad401d7cce5ceab1fa721959516a1576493", + "internal/emission/outbox.go": "sha256:10b7ffa6899d2e89c4c36150f063a348eaf15cfce7a95e814af71b6ffd511ba0", + "tests/test_outbox_chart.py": "sha256:9c839f485e463ad2e84f6d948c81bdd912871efd8fdf54b6dfdf95bd22ef0f6e", + "workplans/FLEX-WP-0024-decision-envelope-authenticity.md": "sha256:23911caf0fe743b24680ccfc8223a5894c2f8bf382eb61426100310488b42e28" + }, + "receipt": "access-native-admission/outbox-hardening/canonical-integration.json", + "before_sha256": { + "charts/access-engine/templates/deployment.yaml": "sha256:8b537f42c076c0235bf120106fd649189ddee436497ba700b542a1c17e163755", + "charts/access-engine/values.yaml": "sha256:e762114881e0e3e2c71795588352d0a87880ee08309ac390c65b0e3c4f6421be", + "charts/flex-auth/templates/deployment.yaml": "sha256:8d08371c1b944e5a4ab494e42874346a29d2ffdcc5331a65f417f2f8a04bbaf0", + "charts/flex-auth/values.yaml": "sha256:05a11ad50d64299e1dbc8b0950528e7e40885f98f9157691b40a53b92aba3643", + "cmd/access-engine/main.go": "sha256:3f799c39843967e7b087e439f73f8ff8718f3153ef418356244379e9b6a997cb", + "cmd/access-engine/outbox_capacity_test.go": null, + "docs/decision-emission-operations.md": "sha256:24724b89f2cef7a193fe2b42a31a4d6817cfdeaf9da34e99599383cc0b5affa6", + "internal/emission/delivery.go": "sha256:ac90171af3c2957b6877b7334d3dbaed671f63b8335c36034c7a1bde9a0d8265", + "internal/emission/hardening_linux_test.go": null, + "internal/emission/lock_linux.go": null, + "internal/emission/lock_other.go": null, + "internal/emission/outbox.go": "sha256:e347dd5b2e8cc1f64d4d231ecf30fe931f1524b6689338ee208c1c15281b09dc", + "tests/test_outbox_chart.py": "sha256:f6c68dfc6f8a1a8dbf2afcab18b428111765b965a419890f52fb19eb51d3ceea", + "workplans/FLEX-WP-0024-decision-envelope-authenticity.md": "sha256:cc1479ce3a986b8d2a2027aee0343f883ba972418193fc64911ab49e9f868e9b" + }, + "integrated_at": "2026-10-16T16:43:37.944580+00:00", + "source_integrated": true, + "committed": true, + "published": true, + "native_accepted": false, + "scope": "Reviewed source only; native custody and admission remain open", + "commit": "0a05383195213e7eaacd08388ce1d7892ce756df", + "publication_verified_at": "2026-10-16T16:54:23.811310+00:00", + "committed_file_hashes_verified": true, + "ancestor_of_origin_main": true, + "sync": { + "session_id": 8699, + "exit_code": 0, + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 10, + "info": 0 + }, + "bindings": "38/38", + "exact_source_revision": "0a05383195213e7eaacd08388ce1d7892ce756df", + "terminal_observed_at": "2026-10-16T16:54:23.811310+00:00" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/access-package-identity/admission/canonical-creation.json b/docs/changes/netkingdom-target-2026-10-16/access-package-identity/admission/canonical-creation.json new file mode 100644 index 0000000..33f3e72 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-package-identity/admission/canonical-creation.json @@ -0,0 +1,73 @@ +{ + "schema": "custodian.local-canonical-package.v1", + "destination": "/home/worsch/rapp-flex-auth-secrets-engine", + "commit": "d52f811ed5ec0be27c9c367e71d476125b3228be", + "tree": "d4fbad71bdc8ef870603526ccd1f53195d0322af", + "archive_sha256": "sha256:766279e86749bde4e25aafcb3989134e9879564667dd46a55be29bc995f66d8d", + "files_sha256": { + ".repo-classification.yaml": "sha256:99a5c80dda99a732563dbb64b8ce8b8663d9d619b919f9fed96cb7a63598fbb4", + "AGENTS.md": "sha256:a02928b531ce61765bfb09bb1abea548ddcb589ecef7c762a1851d8e7745c7c7", + "CLAUDE.md": "sha256:70f13f7bdd8c420fe2820ac879e464e7333c4547a5b0adf1b5e5a7a14113fa00", + "INTENT.md": "sha256:a40ff791a4070bcdc59b7f889412d2558c5cd943308890bc0bf0690ea78c3f67", + "README.md": "sha256:d8f096b22d4e67ce6eb2a2e201720fbbf3bc54059fec98ddf3f6ec4229087361", + "SCOPE.md": "sha256:6167744e2b3f4b82a38f4950463068966fe595c7d62d3674813a0e8ed66789de", + "declarations/rapp.yaml": "sha256:0b722431bc5162dd86f72b15f12424e149aca8f2a8790adf2c57e8511ea73b4c", + "docs/operations.md": "sha256:690c2140d86c68edcc09d9c9acda10f0a4f14723c4236d02dd9f832e74651d6e", + "source-pin.json": "sha256:d28e8ce2f83ebb8dd8bfd2cd03d8308405d189a77d05f7294439ba1da31e1818", + "tests/test_render.py": "sha256:5e7cfe42249eda989813275b5cd307e7a2b0be9696443e566d30578b720c8c6a", + "tools/render.py": "sha256:93ca85ddd8036952ae98e31ac1f36ebfb1ac9ad0a2f73b1e90dcf067f4ae544c", + "workplans/README.md": "sha256:29f2194b1cf0981172cd28928f74224c72778c1771413006a92e4b4ed8214511", + "workplans/archived/.gitkeep": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + }, + "clean": true, + "remote_configured": false, + "published": false, + "native_accepted": false, + "scope": "Reviewed source package locally committed; resolver validation recorded separately. No placement, custody, trust or runtime admission.", + "resolution": { + "ok": true, + "contract": "helixforge.workload-reference/v1", + "status": "resolved", + "reference": { + "rapp_id": "rapp-flex-auth-secrets-engine", + "name": "flex-auth-secrets-engine", + "deployable": "flex-auth-secrets-engine" + }, + "workload": { + "rapp_id": "rapp-flex-auth-secrets-engine", + "name": "flex-auth-secrets-engine", + "declaration_repo": "rapp-flex-auth-secrets-engine", + "declaration_path": "rapp-flex-auth-secrets-engine/declarations/rapp.yaml", + "ownership_repo": "access-engine", + "readiness_state": "draft", + "data_classification": "restricted", + "criticality": "high", + "deployables": [ + "flex-auth-secrets-engine" + ], + "reference": { + "rapp_id": "rapp-flex-auth-secrets-engine", + "name": "flex-auth-secrets-engine" + } + }, + "index_errors": [ + { + "code": "declaration_missing", + "path": "/home/worsch/rapp-forgejo/declarations/rapp.yaml", + "message": "rapp repository has no authoritative declarations/rapp.yaml" + } + ] + }, + "canonical_source_hashes_verified": true, + "verified_at": "2026-10-16T17:54:13.797579+00:00", + "family_validation": { + "declarations": 18, + "errors": 1, + "warnings": 1, + "baseline_findings_unchanged": [ + "rapp-forgejo missing declaration", + "reef derived bound_rapps warning" + ], + "bounded_owner_source_review": "../family-review/review.json" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/audit-native-admission/canonical-integration.json b/docs/changes/netkingdom-target-2026-10-16/audit-native-admission/canonical-integration.json new file mode 100644 index 0000000..dac965d --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/audit-native-admission/canonical-integration.json @@ -0,0 +1,37 @@ +{ + "repo": "audit-core", + "commit": "64509d2c4039ca1249f9e8aabf2bae030e3640cf", + "checked_at": "2026-10-16T17:54:13.797579+00:00", + "manifests": [ + "audit-native-admission/manifest-r2.json" + ], + "files_sha256": { + "docs/flex-auth-secrets-engine-admission.md": "sha256:0825d33b4ed33a0c10eda778a2a7d23764f34086756607a4f5d8a12018ec9a38", + "tests/test_flex_auth_native_contract.py": "sha256:9101f5158c698b53e8171e8e7397356f8c94c67c5168fc0f51f9dd3e460cd010", + "workplans/AUDIT-WP-0013-cross-repo-sender-admission.md": "sha256:3f956165ba24dc15cb1a7a44261f2b223b10c4858977c0a9e5690214961c42cf" + }, + "committed": true, + "published": true, + "committed_file_hashes_verified": true, + "native_accepted": false, + "scope": "Published reviewed source; no native admission", + "ancestor_of_origin_main": true, + "publication_verified_at": "2026-10-16T17:55:15.923336+00:00", + "sync": { + "session_id": 2244, + "exit_code": 0, + "source_revision": "64509d2c4039ca1249f9e8aabf2bae030e3640cf", + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 10, + "info": 0 + }, + "fixes_applied": [ + "bindings: synced 18/18", + "C-17 cleared: pushed 1 backlogged commit(s)", + "C-22 fixed: task 76b59808\u2026 description updated", + "push: pushed" + ] + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/coordinator-source-review.json b/docs/changes/netkingdom-target-2026-10-16/coordinator-source-review.json index 520d5c9..7387a7f 100644 --- a/docs/changes/netkingdom-target-2026-10-16/coordinator-source-review.json +++ b/docs/changes/netkingdom-target-2026-10-16/coordinator-source-review.json @@ -1,5 +1,5 @@ { - "checked_at": "2026-10-16T15:29:47.365221+00:00", + "checked_at": "2026-10-16T17:54:13.797579+00:00", "review_scope": "independent source reconstruction, focused regression tests and canonical integrated hash verification; not foreign owner approval or native acceptance", "checks": { "platform": { @@ -272,6 +272,51 @@ "native_accepted": false, "approval_limit": "Whole-repository projection revision unavailable due to retained unrelated dirty workplans; generated-only writeback refused without bypass", "platform_sync": "Exact7be8b6e applied at primary/railiance01;64records,12historical unresolvededges" + }, + "wave8_publication": { + "result": "All four commits published; exact committed bytes and origin/main ancestry verified", + "native_accepted": false + }, + "access_outbox_hardening": { + "result": "Root go test -race ./internal/emission ./internal/decision ./cmd/access-engine -count=1 and chart tests passed", + "source_commit": "0a05383195213e7eaacd08388ce1d7892ce756df", + "scope": "Process exclusion, bounded storage/startup and refusal paths; native PVC/disk/receiver acceptance remains open" + }, + "warden_installed_routing": { + "result": "135 root tests passed; normal make install-memory and installed plan verified", + "receipt": "warden-admin-routing/installed-verification.json", + "scope": "Installed metadata routing; no login or native custody" + }, + "platform_native_adapter_r2": { + "result": "56 root tests passed in40.02s", + "retained_r1_failure": "Metadata-only crash could not recover; R2 distinguishes absent/metadata-only/version1 read-only outcomes", + "consumer_review": "decision-native-preparation/platform-public-trust-review-r2.json", + "native_accepted": false + }, + "secrets_clean_release": { + "result": "Independent artifact/source hashes, two builds equal; fresh offline install and pre-credential trust refusal passed", + "receipt": "decision-native-preparation/r3/coordinator-bundle-review.json", + "native_effects_accepted": "0/11 call sites" + }, + "access_package_local": { + "result": "Exact thirteen-file canonical tree committed; actual local resolver succeeds; global baseline findings retained", + "receipt": "access-package-identity/admission/canonical-creation.json", + "scope": "Local source ownership only; no remote/placement/native acceptance" + }, + "access_publisher_fix": { + "result": "3 root tests and Bash syntax passed", + "commit": "84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0", + "retained_failure": "CI400 pushed image then failed because python3 absent; no scanner/workflow bypass" + }, + "audit_bounded_reconciliation": { + "result": "17 root tests passed,1 isolated skip; actual canonical sibling fixture separately passed1", + "commit": "64509d2c4039ca1249f9e8aabf2bae030e3640cf", + "scope": "Complete independently retained ledger protocol and receiver fixtures; no sender/observer admission" + }, + "platform_packet_assembler_r2": { + "result": "5 root tests passed", + "retained_r1_failure": "Initial assembler did not enforce promised0600; repaired with exclusive no-follow open,fchmod,fsync", + "scope": "Offline preparation only; external approvals unauthenticated by assembler" } } } diff --git a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/canonical-integration.json b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/canonical-integration.json new file mode 100644 index 0000000..0b06a5a --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/canonical-integration.json @@ -0,0 +1,53 @@ +{ + "repo": "secrets-engine", + "base": "4dd004a2250104ba56293b2d7b0d96f4e076ea99", + "patches": [ + { + "path": "decision-native-preparation/r3/native-cli-admission-r3-full.patch", + "sha256": "sha256:87dbdf5498a4d2950a83db0cfd13e03cadfb4b9450271cc1aa4f24e14a7613f6" + }, + { + "path": "decision-native-preparation/r4/native-cli-admission-r4-over-r3.patch", + "sha256": "sha256:4deb45d649221b2f303ba12e634d1213845410848af0f2919bee47a365b856c0" + } + ], + "files_sha256": { + "docs/proposals/native-cli-admission/README.md": "sha256:13c84e6cb5a925166856f587b6bfaee3dda3536d2ad441bf8d6a03461f05091b", + "docs/proposals/native-cli-admission/proposal.json": "sha256:6a76c1156a5f142e247a42abe435b092eebbc09391948d78fcb6367f7fc34b9a", + "workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md": "sha256:2951cb7876801eff74af121c5d948c03f82ef53f25812e656342333e7561acb6" + }, + "receipt": "decision-native-preparation/r4/canonical-integration.json", + "before_sha256": { + "docs/proposals/native-cli-admission/README.md": "sha256:13c84e6cb5a925166856f587b6bfaee3dda3536d2ad441bf8d6a03461f05091b", + "docs/proposals/native-cli-admission/proposal.json": "sha256:fcf38c5923c9932ae8c75d039afc895c0295efe7bc61fcaa9211ae5f56dd4d5d", + "workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md": "sha256:2951cb7876801eff74af121c5d948c03f82ef53f25812e656342333e7561acb6" + }, + "integrated_at": "2026-10-16T16:43:37.993814+00:00", + "source_integrated": true, + "committed": true, + "published": true, + "native_accepted": false, + "scope": "Reviewed source only; native custody and admission remain open", + "commit": "3718e60d7385db091d3423352f44e922863087de", + "publication_verified_at": "2026-10-16T16:54:23.811310+00:00", + "committed_file_hashes_verified": true, + "ancestor_of_origin_main": true, + "sync": { + "session_id": 39953, + "exit_code": 0, + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 4, + "info": 1 + }, + "bindings": "16/16", + "exact_source_revision": "3718e60d7385db091d3423352f44e922863087de", + "terminal_observed_at": "2026-10-16T16:54:23.811310+00:00" + }, + "patch_chain_note": "R3 full patch was applied before the recorded R4 delta; final complete patch listed separately.", + "equivalent_complete_patch": { + "path": "decision-native-preparation/r4/native-cli-admission-r4-full.patch", + "sha256": "sha256:18867bfa44bd8e59f5a4b77cf5a243c0640f9d68b06d0fc512f7400795de2d18" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/platform-signer-custody/native-adapter-r2/canonical-integration.json b/docs/changes/netkingdom-target-2026-10-16/platform-signer-custody/native-adapter-r2/canonical-integration.json new file mode 100644 index 0000000..e228a27 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/platform-signer-custody/native-adapter-r2/canonical-integration.json @@ -0,0 +1,59 @@ +{ + "repo": "railiance-platform", + "base": "7be8b6e76d602a5306052f9e42881fbea250ede8", + "patches": [ + { + "path": "platform-signer-custody/native-preparation-r1/implementation.patch", + "sha256": "sha256:a9d4631d3320ac3fa56f5a61965005c546eae241d2004cc1e6385e04668b7f7f" + }, + { + "path": "platform-signer-custody/native-adapter-r2/implementation-r2.patch", + "sha256": "sha256:c5b8f0d10650f13eb5939874bda1fb457b3dc5835e63e043af9824e43edb9f80" + } + ], + "files_sha256": { + "credential-change-requests/CCR-2026-0050-flex-auth-envelope-signing.yaml": "sha256:72fd6e84e866a72f4768dabd66326aebe1fdd00013b2314de961ca72a632679f", + "openbao/policies/workload-kv-read-flex-auth-envelope-signing.hcl": "sha256:b9f816da25c7770863a5fc7b3b873e9da90b087e71a9052e766bf0a187ff85ef", + "docs/credential-lane-designs/flex-auth-envelope-signing-native-plan.json": "sha256:5f8c37a7d9781884bf06050be80ca192a3b92eab2d20e28f9b304e57e7456844", + "docs/credential-lane-designs/flex-auth-envelope-signing-native-plan.md": "sha256:241e3e46d7823c1fb0dd62ce2d61dadf659d109286acea872e0aaad9cac26760", + "docs/credential-lane-designs/flex-auth-envelope-signing-native-projection.yaml.proposed": "sha256:4972402b6d6490eb4dd540525b5ce475443d6b99373c28eda197c932438d745f", + "tests/test_flex_auth_signer_native_preparation.py": "sha256:8b05c5f519e69f66be9dc1ac942f5a7a8fe60edda63d4c38daaba7e15a166314", + "workplans/RPF-WP-0035-credential-lane-implementation.md": "sha256:180731a9ac1a2b4ccb4458c6cee54151f43e63008e2c35a33db7f01ea9e9d768", + "scripts/flex_auth_signer_custody.py": "sha256:f169ad12f90d729b647085c3bed2c0d8d005db23a2341b6d3d5f1793bcfd110c", + "scripts/flex_auth_signer_native.py": "sha256:5a3b3b33bcad45ef2939413bfd3db76e5ee70e3b815d0d64af53147851aa3a0d", + "tests/test_flex_auth_signer_native.py": "sha256:8a99d1819c54fc20660cd6d16e8b429e2fc9f30cf4cefc90704201a588c825a6", + "docs/credential-lane-designs/flex-auth-envelope-signing-native-adapter.md": "sha256:0e185a651fbbef96996c38ff18ce338f4d6c0117c3fb069a43e766816e56d5db" + }, + "receipt": "platform-signer-custody/native-adapter-r2/canonical-integration.json", + "before_sha256": { + "credential-change-requests/CCR-2026-0050-flex-auth-envelope-signing.yaml": null, + "openbao/policies/workload-kv-read-flex-auth-envelope-signing.hcl": null, + "docs/credential-lane-designs/flex-auth-envelope-signing-native-plan.json": null, + "docs/credential-lane-designs/flex-auth-envelope-signing-native-plan.md": null, + "docs/credential-lane-designs/flex-auth-envelope-signing-native-projection.yaml.proposed": null, + "tests/test_flex_auth_signer_native_preparation.py": null, + "workplans/RPF-WP-0035-credential-lane-implementation.md": "sha256:d3cbe2ba5e344c1e8fc7e9f422d89030616b98abd53df4b9327f44fcaca865d3", + "scripts/flex_auth_signer_custody.py": "sha256:8ed281a49c1f1cdb23772efe3593e75c62572a12b8d7a6a4c574f27b38722e75", + "scripts/flex_auth_signer_native.py": null, + "tests/test_flex_auth_signer_native.py": null, + "docs/credential-lane-designs/flex-auth-envelope-signing-native-adapter.md": null + }, + "integrated_at": "2026-10-16T16:43:38.030422+00:00", + "source_integrated": true, + "committed": true, + "published": true, + "native_accepted": false, + "scope": "Reviewed source only; native custody and admission remain open", + "commit": "a3e8eb64bae110393ba0aeab043de03a92b8421a", + "publication_verified_at": "2026-10-16T16:54:23.811310+00:00", + "committed_file_hashes_verified": true, + "ancestor_of_origin_main": true, + "sync": { + "session_id": 81690, + "exit_code": 0, + "summary": {}, + "bindings": "64 records;12 historical unresolved edges", + "exact_source_revision": "a3e8eb64bae110393ba0aeab043de03a92b8421a", + "terminal_observed_at": "2026-10-16T16:54:23.811310+00:00" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/source-wave-status.json b/docs/changes/netkingdom-target-2026-10-16/source-wave-status.json index 43203ef..f1c5ace 100644 --- a/docs/changes/netkingdom-target-2026-10-16/source-wave-status.json +++ b/docs/changes/netkingdom-target-2026-10-16/source-wave-status.json @@ -1,6 +1,6 @@ { "schema": "custodian.netkingdom-source-wave.v1", - "observed_at": "2026-10-16T15:38:05.312185+00:00", + "observed_at": "2026-10-16T17:55:15.923336+00:00", "coordinator": "CUST-WP-0080-T06", "source_slices": [ { @@ -243,6 +243,86 @@ "sha256": "sha256:a29cdbd2ac92fd09bc6c79144e9aeb84bb6abcd303df997c0f01c0223cf1a508" } ] + }, + { + "repo": "access-engine", + "slice": "access-native-admission/outbox-hardening", + "commit": "0a05383195213e7eaacd08388ce1d7892ce756df", + "published": true, + "native_accepted": false, + "receipt": "access-native-admission/outbox-hardening/canonical-integration.json", + "patches": [ + { + "path": "access-native-admission/outbox-hardening/implementation.patch", + "sha256": "sha256:52c0ff3f62056bafe141d74baf2c79f7cfab8f5d5c674ac85cedd24bb07d5ee4" + } + ] + }, + { + "repo": "ops-warden", + "slice": "warden-admin-routing", + "commit": "d79f06595545f2b66631ffbcee14a382e96bc293", + "published": true, + "native_accepted": false, + "receipt": "warden-admin-routing/canonical-integration.json", + "patches": [ + { + "path": "warden-admin-routing/ops-warden.patch", + "sha256": "sha256:362996a03c0e260e68744de7d041aa4d296c16c6d166341ad61ab3057a454c24" + } + ] + }, + { + "repo": "secrets-engine", + "slice": "decision-native-preparation/r4", + "commit": "3718e60d7385db091d3423352f44e922863087de", + "published": true, + "native_accepted": false, + "receipt": "decision-native-preparation/r4/canonical-integration.json", + "patches": [ + { + "path": "decision-native-preparation/r3/native-cli-admission-r3-full.patch", + "sha256": "sha256:87dbdf5498a4d2950a83db0cfd13e03cadfb4b9450271cc1aa4f24e14a7613f6" + }, + { + "path": "decision-native-preparation/r4/native-cli-admission-r4-over-r3.patch", + "sha256": "sha256:4deb45d649221b2f303ba12e634d1213845410848af0f2919bee47a365b856c0" + } + ] + }, + { + "repo": "railiance-platform", + "slice": "platform-signer-custody/native-adapter-r2", + "commit": "a3e8eb64bae110393ba0aeab043de03a92b8421a", + "published": true, + "native_accepted": false, + "receipt": "platform-signer-custody/native-adapter-r2/canonical-integration.json", + "patches": [ + { + "path": "platform-signer-custody/native-preparation-r1/implementation.patch", + "sha256": "sha256:a9d4631d3320ac3fa56f5a61965005c546eae241d2004cc1e6385e04668b7f7f" + }, + { + "path": "platform-signer-custody/native-adapter-r2/implementation-r2.patch", + "sha256": "sha256:c5b8f0d10650f13eb5939874bda1fb457b3dc5835e63e043af9824e43edb9f80" + } + ] + }, + { + "repo": "audit-core", + "slice": "audit-native-admission", + "commit": "64509d2c4039ca1249f9e8aabf2bae030e3640cf", + "published": true, + "native_accepted": false, + "receipt": "audit-native-admission/canonical-integration.json" + }, + { + "repo": "access-engine", + "slice": "access-native-admission/image-0a05383/publisher-fix", + "commit": "84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0", + "published": true, + "native_accepted": false, + "receipt": "access-native-admission/image-0a05383/publisher-fix/canonical-integration.json" } ], "integrity_note": "Canonical owner commits are the durable source. Raw patches and temporary reconstructions are workspace-local review artifacts; their hashes retain revision identity. No runtime admission follows from these commits.", @@ -255,14 +335,14 @@ "Historical (resolved by Access B1 reconciliation): Access follow-up task-index repair timed out again; producer source remains published. Owner admission preparation also tracks qualified wait metadata." ], "remaining_critical_path": [ - "Independently integrate trusted Access v2, strict Secrets successor and new Platform whole-stack proof; old positive fixture stays pinned to Access ec21518e", - "Admit actual recovery custody/actor/audit and resolve lost issuance without accessor; authenticated process-loss cleanup source b9eaa20 is integrated and published", - "Exact native producer image, signer custody/public trust, consumer bundle/config and caller admission", - "Actual browser identity/case, agent isolation, runner isolation, source audit completeness, independent recovery and remaining sixteen TSA gates" + "Exact native producer image, committed managed package declaration, independently approved signer custody/public trust, consumer bundle/config and caller admission", + "Admit actual recovery custody/actor/audit and resolve lost issuance without accessor; source tests do not establish runtime authority", + "Native audit source/class admission, durable storage and independent receiver reconciliation", + "Actual browser identity/case, agent isolation, runner isolation, independent service recovery and all sixteen TSA gates" ], "canonical_receipt_verification": { - "checked_at": "2026-10-16T14:52:11.590806+00:00", - "scope": "six subsequent source slices", + "checked_at": "2026-10-16T16:54:23.811310+00:00", + "scope": "four wave8 source slices", "all_commit_file_hashes_match": true, "all_commits_ancestor_of_origin_main": true, "native_acceptance": false diff --git a/docs/changes/netkingdom-target-2026-10-16/warden-admin-routing/canonical-integration.json b/docs/changes/netkingdom-target-2026-10-16/warden-admin-routing/canonical-integration.json new file mode 100644 index 0000000..32253ba --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/warden-admin-routing/canonical-integration.json @@ -0,0 +1,44 @@ +{ + "repo": "ops-warden", + "base": "958352089b443459a6368efc0e591c8a0a8b8604", + "patches": [ + { + "path": "warden-admin-routing/ops-warden.patch", + "sha256": "sha256:362996a03c0e260e68744de7d041aa4d296c16c6d166341ad61ab3057a454c24" + } + ], + "files_sha256": { + "src/warden/routing/catalog.py": "sha256:34baa0f709c00a02412380e17481bf08654f6e0a86c4df094f822dad3b50a60a", + "tests/test_openbao_configuration_routing.py": "sha256:597c3092827b684cb86986a12e489d6fd609b62dc739a33b7dd42e59c9879721", + "workplans/WARDEN-WP-0038-plan-mutation-intent.md": "sha256:09b0ed8c6315255796a2da0d64dfd001b1f6de2e903ac2ea79bc5667b499fb83" + }, + "receipt": "warden-admin-routing/canonical-integration.json", + "before_sha256": { + "src/warden/routing/catalog.py": "sha256:bca219450bb7eb92dfac2273e85a93edccba04575f01d1ef74762453df805ccb", + "tests/test_openbao_configuration_routing.py": "sha256:efbb1c0be1e8cba7f1ca8ebd860abad9da90cfd9bd9e77206bc0b9a6c65e0c02", + "workplans/WARDEN-WP-0038-plan-mutation-intent.md": "sha256:73e5a2d20731abbce3e719fc655767dc93b385bfa932e53fb200df0e2235d8d5" + }, + "integrated_at": "2026-10-16T16:43:37.973837+00:00", + "source_integrated": true, + "committed": true, + "published": true, + "native_accepted": false, + "scope": "Reviewed source only; native custody and admission remain open", + "commit": "d79f06595545f2b66631ffbcee14a382e96bc293", + "publication_verified_at": "2026-10-16T16:54:23.811310+00:00", + "committed_file_hashes_verified": true, + "ancestor_of_origin_main": true, + "sync": { + "session_id": 41513, + "exit_code": 0, + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 9, + "info": 5 + }, + "bindings": "51/51", + "exact_source_revision": "d79f06595545f2b66631ffbcee14a382e96bc293", + "terminal_observed_at": "2026-10-16T16:54:23.811310+00:00" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/warden-admin-routing/installed-verification.json b/docs/changes/netkingdom-target-2026-10-16/warden-admin-routing/installed-verification.json new file mode 100644 index 0000000..014b61b --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/warden-admin-routing/installed-verification.json @@ -0,0 +1,25 @@ +{ + "schema": "custodian.warden-installed-routing.v1", + "observed_at": "2026-10-16T16:54:23.811310+00:00", + "source_commit": "d79f06595545f2b66631ffbcee14a382e96bc293", + "install_command": "make install-memory", + "install_exit_code": 0, + "ops_warden_version": "0.1.2", + "phase_memory_version": "0.1.0", + "installed_routing_module_sha256": "sha256:34baa0f709c00a02412380e17481bf08654f6e0a86c4df094f822dad3b50a60a", + "need": "attended OpenBao platform administration for reviewed flex-auth signer custody CAS0 and fixed KV metadata", + "plan_exit_code": 0, + "verdict": "founder_required", + "lane_id": "openbao-platform-admin-login", + "founder_act": "oidc_login", + "catalog_hash": "c47065c0892f", + "catalog_source": "bundled", + "runtime_dispatch_mismatch_resolved": true, + "login_or_native_execution": false, + "orientation": { + "version": "0.2.6", + "digest": "sha256:8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02", + "status": "withheld; current owner instructions and intent reviewed directly" + }, + "remaining": "Complete exact custody packet and owner reviews before attended execution; routing does not authorize the action." +} diff --git a/docs/netkingdom-target-implementation.md b/docs/netkingdom-target-implementation.md index e969940..3dad40a 100644 --- a/docs/netkingdom-target-implementation.md +++ b/docs/netkingdom-target-implementation.md @@ -203,24 +203,64 @@ the exact custody decision. No key, credential grant or live deployment was made Use existing owner paths and retain the deployed lifecycle policy while preparing the first native acceptance package. The task-execution pilot remains unadmitted. +The next four source slices are published and their committed file hashes match +the reviewed receipts: Access `0a05383` (bounded durable outbox and process locking), +Warden `d79f065` (attended administration routing), Secrets `3718e60` (reproducible +CLI release and admission requirements), and Platform `a3e8eb6` (phase-aware +attended signer adapter). Independent checks passed the Access race/chart suites, +135 Warden tests and 56 Platform tests. Secrets' two release builds were identical; +a clean offline installation and pre-credential trust refusal passed. These are +source and isolated-runtime proofs, not production admission. + +The installed Warden CLI now matches the reviewed routing module and preserves +phase-memory. Its actual plan selects `openbao-platform-admin-login`, with +`founder_required` and `oidc_login`. The previous routing defect is resolved; +the attended identity act and exact custody proposal remain required. + +Access's new canonical local thin package is committed at `d52f811` with the +reviewed thirteen-file tree. The exact local resolver identifies +`rapp-flex-auth-secrets-engine` / `flex-auth-secrets-engine` / +`flex-auth-secrets-engine`, owned by Access and still draft. Family review passed; +the global check retains the pre-existing Forgejo declaration error and reef +warning. Remote publication, central onboarding, placement and runtime admission +remain separate. Its frozen extraction source/image do not activate the signer. + +The normal Access image run400 published source `0a05383`, then failed during +receipt parsing because the runner lacks Python. Public package metadata and the +run's push/pull evidence identify the published digest and exact revision; the +failed run remains failed. Access `84c78e0` replaces that parser with existing +Bash/Docker facilities, verifies the pulled revision label, and records the local +package reference. Three independent publisher tests pass. Normal source publication and synchronization passed; successor CI is being +observed. No deployment follows automatically. + +Audit `64509d2` defines the first pin's admission and complete-ledger reconciliation +using existing receiver APIs. Independent root checks passed 17 tests plus the +canonical cross-owner fixture; one isolated-checkout skip is retained. Bounded +reconciliation requires independently retained complete producer ledger bytes, +every-ID readback and all-class acceptance-time counts, with concurrent boundary +arrivals settled. Selected successful IDs are insufficient. The initial signer +slice keeps audit delivery disabled; periodic independent custody, final per-pin +cadence, receiver admission and runtime observation remain required. + - Access owns an immutable image, signer projection, retained caller binding and durable outbox. Metadata inspection found no existing namespace PVC. A proposed 1 GiB local-path claim is new storage; its requested capacity is not a filesystem quota. OS-enforced single-writer locking, bounded append/startup and fail-closed - storage failure behavior are being implemented in the existing outbox. Recreate + storage failure behavior are published in the existing outbox. Recreate with one pod alone does not establish those properties. - Platform owns proposed CCR-2026-0050 for the exact read lane, separate attended signer writing, fencing and private recovery receipts. Native role naming must - satisfy the real delegated-applier policy. The current free-text Warden plan - selected a survey route instead of the required admin-login route; preserve that - dispatch mismatch as a blocker rather than silently choosing another credential. + satisfy the real delegated-applier policy. The installed Warden plan now selects + the required admin-login route. The phase-aware writer preserves metadata-only + and seed-write uncertainty; recovery is read-only and cannot authorize replay. - Secrets owns the release bundle, fixed verifier, independently admitted public trust and actual caller delivery. Clean installation and lifecycle ALLOW/DENY capture are preparatory evidence; they do not establish effects at the inventoried eleven privileged call sites across ten handlers. Those effects remain unaccepted. -- Retained Access deployment lacks an established managed-package identity tuple. - Resolve that with the package owner; another application's declaration cannot - supply its authority. Native audit receiver reconciliation also remains required. +- The retained Access tuple now resolves against its committed local declaration. + Resolve availability for each actual admission consumer separately; a local + checkout does not establish central registration, placement or runtime trust. + Native audit receiver reconciliation also remains required. The [source wave receipt](changes/netkingdom-target-2026-10-16/source-wave-status.json) records exact publication and synchronization results. Temporary review checkouts diff --git a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md index 3691849..e04e37e 100644 --- a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md +++ b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md @@ -708,3 +708,22 @@ not an estate coverage score). Native issuer/key/grant/deployment/audit gates st open. Access outbox process locking and capacity limits, Platform exact native writer preparation, and Secrets immutable release/install proof are active owner follow-through. No existing PVC or managed-package identity is assumed. + +2026-10-16 next checkpoint: Access `0a05383`, Warden `d79f065`, Secrets `3718e60` +and Platform `a3e8eb6` published through normal owner synchronization, with exact +committed-file hashes independently verified. Installed Warden routing now selects +the required attended admin lane and retains phase-memory. Root checks passed +Access race/chart validation, 135 routing tests, 56 phase-aware signer tests and +clean reproducible Secrets bundle installation. Original failures are retained. + +Canonical local package `rapp-flex-auth-secrets-engine` now has reviewed commit +`d52f811`, exact tree and local owner/workload resolution; it remains draft with +no remote or native admission. The ordinary Access publisher failed after pushing +source `0a05383` because Python was absent on its runner. Reviewed source repair +`84c78e0` uses Bash/Docker metadata validation and records the package reference; +normal source synchronization and successor CI observation are underway. Audit +`64509d2` specifies existing-API reconciliation against a complete independently +retained producer ledger, with independent contract tests. Its sender/cadence and +operational observer gates remain open. Platform prepared exact custody source +pins and distinct missing owner inputs; no approval or native scope was invented. +All sixteen target gates remain open pending scope-matched native acceptance.