# NetKingdom target implementation record

Coordinator: CUST-WP-0080. Target: [security architecture](netkingdom-target-security-architecture.md).
Started 16 October 2026 under the founder's explicit implementation and
GPT-6.1-Sol medium subagent request. The full architecture remains the goal.

## Work ownership and current status

| Gate | Existing implementation owner | Current evidence state | Next deliverable |
| --- | --- | --- | --- |
| TSA-01 | Secrets Engine / Access Engine; SECRETS-WP-0014, FLEX-WP-0024 | Producer signing, strict consumer verification and fixed-verifier packaging source integrated; actual local serve-to-consumer proof passed | Independently admit package/keys/policy and verify native rollout |
| TSA-02–03 | Platform / Secrets / Approval; RPF-WP-0035-T12, SECRETS-WP-0013, APPROVAL-WP-0002/0004 | Strict handoff and durable consume/confirm/effect seam integrated; actual local source servers and disposable OpenBao path passed | Exact effect baseline/readback and recovery acceptance, then governed native admission |
| TSA-04 | NetKingdom / Mason / Warden / KeyCape; NK-WP-0048 | Browser evidence checker, Warden pinned metadata validation and Mason versioned source selection published | Admitted machine descriptors, real owner receipts and consumer acceptance |
| TSA-05 | KeyCape / User / NetKingdom / Playwright; KEY-WP-0040, NK-WP-0050, CUST-WP-0080-T05 | Native human and agent journey gates open | Actual recovery and browser consumer acceptance |
| TSA-06 | Glas / Sand-boxer / rein / Platform / Forge; CUST-WP-0073, GLAS-WP-0012 | Workload-only credential delivery published; disposable bwrap proof reproduced; actual assignment and runner proof open | Admitted corrected runtime, combined rein acceptance and actual assignment migration |
| TSA-07–08 | Secrets / NetKingdom / Platform; NK-WP-0049 and existing lifecycle plans | Inventory/lifecycle incomplete; actual independent identity archive recovery verified 16 October | Complete service authentication, existing-token decryption and audit continuity; metadata denominator, elimination candidates and lifecycle receipts |
| TSA-09 | Audit / emitting owners; Approval T04 and current Audit work | Delivered custody; current source admission/reconciliation incomplete | Source/effect/outbox/receiver readback for first protected operation |
| TSA-10 | Forge / Repo Manager; FORGE-WP-0006, RMGR-WP-0021 | Broad receive coverage delivered; other paths and response incomplete | Coverage/reliability gaps and private response acceptance |
| TSA-11 | Reuse / provider owners | 70/70 discovery verified 15 October; stale descriptive fields remain | Correct source metadata and repeat drift/hosted checks |
| TSA-12 | Activity / Coordination / Custodian; CUST-WP-0079 | Schedule accepted but unassisted activation not proven; cadence source adoption underway | Actual activation and first independent observation |
| TSA-13–14 | NetKingdom / provider owners | Accepted reusable integration and second installation pending | Shared adapter conformance and minimal locked profiles |
| TSA-15 | Resource / telemetry / consumer owners; CUST-WP-0071 where applicable | Optimization baseline incomplete | Comparable latency, effort, resource and scanner measurements |
| TSA-16 | Custodian / governance and owner records | Governing records exist; target-wide evidence reconciliation open | Requirement-by-requirement closure audit under CUST-WP-0080-T04 |

Each entry summarizes an owner obligation; it does not copy or replace that
owner's task list. The original [requirement ledger](evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json)
and owner receipts retain their original scope and outcomes.

## Delegated implementation wave

The founder requested model `gpt-6.1-sol`, reasoning effort `medium`. The
coordinator dispatched these concrete child assignments using that configuration:

| Handle | Owner role | Source scope | Artifact directory |
| --- | --- | --- | --- |
| `/root/decision_auth` | secrets-engine | Signed decision enforcement, existing SECRETS-WP-0014 | `docs/changes/netkingdom-target-2026-10-16/decision-auth/` |
| `/root/protected_execution` | railiance-platform | Task execution journal/cleanup, RPF-WP-0035-T12 | `docs/changes/netkingdom-target-2026-10-16/protected-execution/` |
| `/root/browser_case` | net-kingdom | First browser case verification/integration, NK-WP-0048-T06 | `docs/changes/netkingdom-target-2026-10-16/browser-case/` |
| `/root/warden_browser` | ops-warden | Exact producer validation on browser admission, WARDEN-WP-0044-T03 | `docs/changes/netkingdom-target-2026-10-16/warden-browser/` |
| `/root/agent_isolation` | glas-harness | Scope credential delivery to actual workloads, GLAS-WP-0012 | `docs/changes/netkingdom-target-2026-10-16/agent-isolation/` |
| `/root/approval_reference` | approval-engine | Atomic authenticated consuming identity and act/PDP evidence, APPROVAL-WP-0004 | `docs/changes/netkingdom-target-2026-10-16/approval-reference/` |
| `/root/access_verifier_review` | access-engine | Producer compatibility review and actual signing path, FLEX-WP-0024 | `docs/changes/netkingdom-target-2026-10-16/access-verifier-review/` |
| `/root/mason_browser` | ops-mason | Correct versioned browser type source resolution | `docs/changes/netkingdom-target-2026-10-16/mason-browser/` |

Each child reads the assigned owner's instructions and intent. Prepared changes
use isolated temporary checkouts based on current owner source, with relevant
pre-existing tracked changes retained. Exact patches, source hashes and tests
support coordinator review before integration. A child reviews only its own
owner role; independent cross-owner reviews require separate assignments.

The table records assignment history, not perpetual liveness. All eight owners
delivered initial source packages. Secrets and Access are implementing the trusted
service task path and preparing native package/trust/caller admission. Platform
delivered exact effect readback and process-loss cleanup recovery in disposable
OpenBao; the trusted successor adds absolute execution budgets. Approval delivered the shared claim adapter and is reviewing
its authenticated consumer integration.
Exact revisions and publication caveats are in the
[source wave receipt](changes/netkingdom-target-2026-10-16/source-wave-status.json);
independent tests and retained failures are in the
[coordinator review](changes/netkingdom-target-2026-10-16/coordinator-source-review.json).
Raw patches and temporary reconstructions are workspace-local review artifacts;
the published owner commits are the durable source.

| Published owner source | Change | Independent verification |
| --- | --- | --- |
| NetKingdom `c31d21ba` | Browser evidence checking without native acceptance inference | 103 tests |
| Warden `95835208` | Exact pinned producer and parameter-schema validation | 102 tests |
| Glas `7357115c` | Credentials delivered only to explicit workloads | 141 tests and actual disposable bwrap denial/redaction/teardown |
| Platform `59d1441c`, `99fd21ee`, `d042d468` | Durable cleanup, disposable native adapter and immutable grant projection | Successive suites: 73, 83 and 122 tests; counts overlap |
| Secrets `c80a9441` | Strict producer-type signature verification with independent trust configuration | 125 focused tests and producer provenance check |
| Access `ec21518e` | Actual serving path signs before recording; inert chart configuration | Real local serve-to-Secrets verification; unsigned, tampered and unsafe key-file cases refused |
| Approval `477c6839` | Atomic consuming-service identity and bound act/PDP audit fields | 44 tests |
| Mason `57411f25` | Explicit versioned type-source selection in all CLI commands | 50 tests |

The subsequent published revisions are Secrets `ebca4f5` (fixed-verifier release
bundle) and `ff1a13d` (strict task handoff), Platform `e2b832b` (journaled
consume/confirm seam), and Approval `eece796` (canonical consumed-act comparison).
Normal owner publication and reconciliation succeeded; exact receipts retain
remaining historical warnings.
Independent combined Secrets verification passed 133 focused tests and seven
packaging tests. Platform passed all 130 tests, then eight affected tests passed
with the final Approval client; that client separately passed 36 tests.

Normal owner publication succeeded for every listed revision. Platform's scanner
ref race and Access's first State Hub timeout were retried successfully. Mason's
unrelated pre-existing workplan edits prevent an exact whole-repository hub
revision claim. Generated-only writeback refusals were retained without bypass.
Secrets' normal scanner initially flagged two public UUID identifiers; clearer
constant names preserved their values and passed the unchanged scanner.

These are bounded source/backend proofs. Synthetic approvals and grants do not
establish production consumption or isolation of this interactive assignment.
The actual service-pilot policy still denies runtime admission. The missing strict
Secrets handoff now binds the signed decision, approval, exact grant and caller;
Platform reserves durably, journals consumption and independently confirms it
before effects. Actual Access and Approval servers passed this path with explicit
synthetic identity/key/policy admission. Denied confirmation leaves uncertainty
and permits no native effect. Six successful native calls alone do not establish
complete expected-state readback; the following source slice adds that proof.
Both Secrets and Approval now compare the existing canonical native digest,
refusing Python's boolean/integer equality ambiguity. The original counterexample
and intermediate test failures remain recorded.

This wave authorizes source implementation and preparation under the user goal.
It grants no runtime credential scope or automatic native acceptance. Required
owner checkout filesystem approval is distinct from authority to change live
trust or credentials. No agent inherits another assignment's autopilot grant.

## Subsequent source integration, 16 October

Platform `d870596` binds canonical before/after metadata snapshots through the
existing descriptor commitments, checks each baseline before its target write,
and verifies complete readback before recording success. Independent native
fixture/mediator/readback suites passed 32 tests. This is sequential observation:
there is no atomic native CAS or concurrent-writer exclusion. Partial application
remains unknown, and cleanup confirmation stays separate. Its whole-stack
positive proof is pinned to Access `ec21518e`; later Access source deliberately
removes the generic task path used by that old synthetic fixture.

Access `919ce25` fixes explicit caller-audience rendering and source revision
pinning, records the existing workload identity, and adds an offline native
receipt verifier using the installed Secrets verifier. Root review reproduced
boolean/integer and integer/float source-record equality mistakes; R2 checks exact
JSON types and hashes the same bounded bytes it verified. Nine receipt tests and
two runtime-twin tests passed independently. Missing managed package declaration,
signer custody and native image/trust admission remain explicit.

Secrets `5a2099f` records the exact native CLI preparation, verified canonical
release bundle, configuration and trust inputs. The initial serving denominator
is 11 authorization sites across 10 handlers; native effect acceptance is zero.
Root verified unchanged runtime AST except documentation. The empty-key template
is intentionally unusable until independently admitted owner inputs exist.

Approval `3485415` supplies a producer-owned Go fact adapter and authoritative
claim vectors. Root passed its Go suite, two producer-vector tests and 14,114
actual Python canonical-byte/digest comparisons. This is shared validation code,
not another evaluator or credential transport. Access B1 R2 `4f6946b` connects the
actual HTTP caller join, preserves the submitted context and withholds accidental
ALLOW until the trusted source path exists. All three affected Go packages passed
independently; a malformed nested-duplicate test was corrected and rerun. These
two commits' publication/reconciliation state is recorded in the source receipt.

The trusted Access v2 successor, refreshed strict Secrets handoff and signer-custody
proposal remain separate review packages. Access's actual Approval API fixture and signed ALLOW/refusal evidence
are source proofs; the complete new consumer-to-Platform path and native issuer,
key, workload, grant, recovery and independent audit acceptance remain necessary.
Recovery review rejected broad 404 absence and unauthenticated stored accessor
claims. Revised Platform `b9eaa20` passed 53 independent tests and adds authenticated
private accessor custody and separately admitted cleanup after executor loss,
without restoring business or consumption authority. Lost issuance before accessor
persistence remains unresolved. Actual custody/key isolation and recovery grants
remain unadmitted.

Whole-stack successor work exposed a temporal contradiction: the first v2 source
allowed 15 seconds while native token lifetime requires at least 30 seconds plus
cleanup reserve. Integrated Access `2b064ee` now binds expiry to the exact operation
deadline within declared hard limits and all original/fresh/caller authority.
Its signed, claim-free DENY supplies producer-evaluated approval facts under the
existing enrichment contract; Secrets `4dd004a` verifies them before approval
preparation. This receipt grants no execution authority. Final evaluation refuses
registry drift instead of silently changing an approved request. Exact producer
numeric types survive verification and recording without a copied normalizer.

Approval `d40e842` preserves fractional time and uses one post-lock timestamp for
validity, consumption and its outbox event. The immediate path needs no sleep,
backdating or consumer tolerance. Independent verification passed all seven
affected Access Go packages, 193 focused Secrets tests and 98 Approval tests.
Platform `76fdc0b` adds absolute call/operation/credential deadlines and exact
source-byte checks; 28 independent tests passed. Platform `7be8b6e` adds the
complete successor proof: all eight independent tests passed using real local
Access and Approval services, retained registry, strict Secrets verification and
disposable OpenBao. The positive case verifies six native calls, complete readback,
cleanup and signed source-record parity; refusal cases preserve zero effect.
These use synthetic admission and do not establish production acceptance.
All sixteen target acceptance gates remain open.

The independent [identity archive recovery receipt](../../net-kingdom/docs/evidence/2026-10-16-identity-backup-live/actual-full-recovery-review.json)
now proves artifact integrity, original key pairs, SQLite integrity, native
PostgreSQL restore and cleanup. It explicitly does not prove full service
authentication, existing-token decryption or audit signature continuity. Reuse
that completed archive proof and drive the remaining native service recovery;
TSA-08 remains open.

Coordinator review independently reproduced a second timestamp failure in the
canonical Approval Engine: a fractional expiry at `.500` was consumed at actual
clock `.750`, while `consumed_at` reported the whole second. The isolated
[counterexample](changes/netkingdom-target-2026-10-16/approval-timestamp-precision/coordinator-counterexample.json)
is retained alongside the verified repair in `d40e842`; expiry remains exclusive,
including when the database lock is acquired after the deadline. The original
publication scanner refusal is also retained: the Approval owner labeled seven
public SHA-256 references explicitly, preserving digest bytes and review meaning.
The unchanged scanner then passed all six committed files.

The same Platform revision includes a bounded signer custody primitive and an
explicitly proposed custody design. Twelve independent tests passed against
disposable OpenBao. Exact KV CAS/readback, a private durable receipt before effect
and retained uncertainty are source properties. Production execution deliberately
remains unavailable pending an admitted adapter, independent owner reviews and
the exact custody decision. No key, credential grant or live deployment was made.

## Next native admission work

Use existing owner paths and retain the deployed lifecycle policy while preparing
the first native acceptance package. The task-execution pilot remains unadmitted.

The next four source slices are published and their committed file hashes match
the reviewed receipts: Access `0a05383` (bounded durable outbox and process locking),
Warden `d79f065` (attended administration routing), Secrets `3718e60` (reproducible
CLI release and admission requirements), and Platform `a3e8eb6` (phase-aware
attended signer adapter). Independent checks passed the Access race/chart suites,
135 Warden tests and 56 Platform tests. Secrets' two release builds were identical;
a clean offline installation and pre-credential trust refusal passed. These are
source and isolated-runtime proofs, not production admission.

The installed Warden CLI now matches the reviewed routing module and preserves
phase-memory. Its actual plan selects `openbao-platform-admin-login`, with
`founder_required` and `oidc_login`. The previous routing defect is resolved;
the attended identity act and exact custody proposal remain required.

Access's new canonical local thin package is committed at `d52f811` with the
reviewed thirteen-file tree. The exact local resolver identifies
`rapp-flex-auth-secrets-engine` / `flex-auth-secrets-engine` /
`flex-auth-secrets-engine`, owned by Access and still draft. Family review passed;
the global check retains the pre-existing Forgejo declaration error and reef
warning. Remote publication, central onboarding, placement and runtime admission
remain separate. Its frozen extraction source/image do not activate the signer.

The normal Access image run400 published source `0a05383`, then failed during
receipt parsing because the runner lacks Python. Public package metadata and the
run's push/pull evidence identify the published digest and exact revision; the
failed run remains failed. Access `84c78e0` replaces that parser with existing
Bash/Docker facilities, verifies the pulled revision label, and records the local
package reference. Three independent publisher tests pass. Normal source publication and synchronization passed; successor CI is being
observed. No deployment follows automatically.

Audit `64509d2` defines the first pin's admission and complete-ledger reconciliation
using existing receiver APIs. Independent root checks passed 17 tests plus the
canonical cross-owner fixture; one isolated-checkout skip is retained. Bounded
reconciliation requires independently retained complete producer ledger bytes,
every-ID readback and all-class acceptance-time counts, with concurrent boundary
arrivals settled. Selected successful IDs are insufficient. The initial signer
slice keeps audit delivery disabled; periodic independent custody, final per-pin
cadence, receiver admission and runtime observation remain required.

- Access owns an immutable image, signer projection, retained caller binding and
  durable outbox. Metadata inspection found no existing namespace PVC. A proposed
  1 GiB local-path claim is new storage; its requested capacity is not a filesystem
  quota. OS-enforced single-writer locking, bounded append/startup and fail-closed
  storage failure behavior are published in the existing outbox. Recreate
  with one pod alone does not establish those properties.
- Platform owns proposed CCR-2026-0050 for the exact read lane, separate attended
  signer writing, fencing and private recovery receipts. Native role naming must
  satisfy the real delegated-applier policy. The installed Warden plan now selects
  the required admin-login route. The phase-aware writer preserves metadata-only
  and seed-write uncertainty; recovery is read-only and cannot authorize replay.
- Secrets owns the release bundle, fixed verifier, independently admitted public
  trust and actual caller delivery. Clean installation and lifecycle ALLOW/DENY
  capture are preparatory evidence; they do not establish effects at the inventoried
  eleven privileged call sites across ten handlers. Those effects remain unaccepted.
- The retained Access tuple now resolves against its committed local declaration.
  Resolve availability for each actual admission consumer separately; a local
  checkout does not establish central registration, placement or runtime trust.
  Native audit receiver reconciliation also remains required.

The [source wave receipt](changes/netkingdom-target-2026-10-16/source-wave-status.json)
records exact publication and synchronization results. Temporary review checkouts
and agent handles remain preparation artifacts, not runtime deployments.

## Dependency and residual handling

The current implementation demand selects necessary target dependencies for
owner review and scoped promotion. APPROVAL-WP-0002's exact issuer/provenance,
audit and served-PEP obligations are required; its residual label must be
reconciled by its owner before implementation dispatch. This does not activate
every residual security plan or the deferred exposure rotation.

Cross-owner waits attach to the existing project driver where one exists, or a
derived `cross_owner_wait` case benefiting CUST-WP-0080. The dispatched child
handles establish current execution, not a separate fleet wake service. If a
child is terminal, record its deliverables and dispatch the next reachable owner
task; never report a stale handle as running.

## Evidence and completion rules

For each change record the original owner revision, pre-existing dirty-state
digest, exact patch, focused tests, independent review, integrated revision,
publication and native acceptance separately. Bind each native receipt to target,
identity, scope, source/image/config revision, expected result, negative cases,
cleanup and rollback. Preserve failures and unverified outcomes.

The coordinator reviews evidence against every TSA gate and the named owner
requirements. It may record partial source delivery without closing a native
gate. Work continues until the target's complete exit condition holds. The first
wave is implementation progress, not the completion boundary.