the-custodian/docs/changes/netkingdom-target-2026-10-16/browser-checker-environment-r2

Config-checker environment and executable selection correction

Source-only candidate for independent root review; no canonical owner writes. The historical registration R3 and checker-artifact proposal remain unchanged.

KeyCape's existing config.Load reads two non-secret environment overrides, KEYCAPE_ACCOUNT_PORTAL_URL and KEYCAPE_BROWSER_LOGOUT_URL. The old helper passed its ambient environment to the checker, so supplied invalid URL configuration could be replaced by valid ambient URLs, and supplied valid configuration could be rejected by invalid ambient URLs. A selected bare relative filename could also be hashed locally by the adapter but resolved differently through PATH by the subprocess. pre-fix-counterexample.txt retains all three failures against the actual historical helper and exact real checker artifact.

The existing helper now resolves the selected file to an absolute executable path and supplies env={}. No separate wrapper or service is introduced. Three new opt-in owner regression tests use the actual supplied checker artifact; helper-only test runs explicitly skip them without an artifact. All 39 affected checks pass with the exact artifact supplied, and 11 actual artifact/helper/ kernel scenarios pass with synthetic Kubernetes and owner evidence/session trust. No checker stub or producer-pin override is used. The non-checker PATH decoy exits 27 and supplies no forged checker report; the selected real artifact must produce the successful config verdict.

Path resolution does not establish immutable executable custody or eliminate replacement races. Those remain native host-storage/execution admission requirements. The helper change alters successor source-composition pins; proposed-descriptor.json is a new source proposal, and historical descriptors are not rewritten. Native checker storage, callbacks, complete type/step selection, identity and browser acceptance remain open.

The improved build_checker.py accepts a required full commit, expected src tree, fresh output directory and expected artifact digest. It never substitutes HEAD or requires the working tree to match the archived historical revision. The revision must be reachable from the existing published origin/main ref. An actual fresh build reproduced the exact binary and byte-identical full source/toolchain/module closure. The original build script and receipts remain in browser-checker-artifact-next/. Mutable-ref refusal is retained separately.

python3 docs/changes/netkingdom-target-2026-10-16/browser-checker-environment-r2/verify_candidate.py
python3 docs/changes/netkingdom-target-2026-10-16/browser-checker-environment-r2/build_checker.py \
  --source-revision 3c71226a1a7b8a2bdb710e9c497e1a1f7f8a3987 \
  --source-tree f0010b9cab17dbc3a787628a29657d98b900320f \
  --output-dir /tmp/fresh-keycape-checker-review \
  --expected-artifact-sha256 sha256:be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5

The four-file patch proposes the helper fix, three real-artifact regressions, updated source contract notes and work-record refinement. The prior reviewed T17 offline-artifact task proposal is preserved, T18 records the source boundary correction and counterexamples, and T16 retains exact owner review/native composition scope. All existing task UUIDs and native gates remain unchanged. The preimage/postimage hashes are in manifest.json; independent source review and integration/publication are separate from fixture completion.