the-custodian/docs/netkingdom-target-implementation.md

# NetKingdom target implementation record

Coordinator: CUST-WP-0080. Target: [security architecture](netkingdom-target-security-architecture.md).
Started 16 October 2026 under the founder's explicit implementation and
GPT-6.1-Sol medium subagent request. The full architecture remains the goal.

## Work ownership and current status

| Gate | Existing implementation owner | Current evidence state | Next deliverable |
| --- | --- | --- | --- |
| TSA-01 | Secrets Engine / Access Engine; SECRETS-WP-0014, FLEX-WP-0024 | Producer signing, strict consumer verification and fixed-verifier packaging source integrated; actual local serve-to-consumer proof passed | Independently admit package/keys/policy and verify native rollout |
| TSA-02–03 | Platform / Secrets / Approval; RPF-WP-0035-T12, SECRETS-WP-0013, APPROVAL-WP-0002/0004 | Strict handoff and durable consume/confirm/effect seam integrated; actual local source servers and disposable OpenBao path passed | Exact effect baseline/readback and recovery acceptance, then governed native admission |
| TSA-04 | NetKingdom / Mason / Warden / KeyCape; NK-WP-0048 | Registration adapter and Warden producer compatibility published; exact offline checker reproduced, owner-reviewed and caller containment published | Admit complete descriptors/receipts and executable custody, then native consumer acceptance |
| TSA-05 | KeyCape / User / NetKingdom / Playwright; KEY-WP-0040, NK-WP-0050, CUST-WP-0080-T05 | Native human and agent journey gates open | Actual recovery and browser consumer acceptance |
| TSA-06 | Glas / Sand-boxer / rein / Platform / Forge; CUST-WP-0073, GLAS-WP-0012 | Workload-only credential delivery and combined rein runtime published; actual isolated manager proof reproduced; assignment and runner proof open | Bounded real-model acceptance, admitted runtime and actual assignment migration |
| TSA-07–08 | Secrets / NetKingdom / Platform; NK-WP-0049 and existing lifecycle plans | Inventory/lifecycle incomplete; independent identity archive recovery, retained token-material decryption and historical audit signature continuity verified 16 October | Existing-token MFA and service authentication; metadata denominator, elimination candidates and lifecycle receipts |
| TSA-09 | Audit / emitting owners; Approval T04 and current Audit work | Delivered custody; current source admission/reconciliation incomplete | Source/effect/outbox/receiver readback for first protected operation |
| TSA-10 | Forge / Repo Manager; FORGE-WP-0006, RMGR-WP-0021 | Broad receive coverage delivered; bounded actual-hook scanner refusal and cleanup accepted under T05 | Remaining coverage and private response acceptance |
| TSA-11 | Reuse / provider owners | 70/70 discovery freshly verified 16 October; two drifted owner descriptions corrected and native parity validation strengthened | Full source-link/version/package-family disposition and recurring drift acceptance |
| TSA-12 | Activity / Coordination / Custodian; CUST-WP-0079 | Schedule accepted but unassisted activation not proven; cadence source adoption underway | Actual activation and first independent observation |
| TSA-13–14 | NetKingdom / provider owners | Accepted reusable integration and second installation pending | Shared adapter conformance and minimal locked profiles |
| TSA-15 | Resource / telemetry / consumer owners; CUST-WP-0071 where applicable | Local staged-scanner baseline and bounded batching measured; other optimization evidence incomplete | Admit workload-representative performance and remaining resource/effort baselines |
| TSA-16 | Custodian / governance and owner records | Governing records exist; target-wide evidence reconciliation open | Requirement-by-requirement closure audit under CUST-WP-0080-T04 |

Each entry summarizes an owner obligation; it does not copy or replace that
owner's task list. The original [requirement ledger](evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json)
and owner receipts retain their original scope and outcomes.

## Delegated implementation wave

The founder requested model `gpt-6.1-sol`, reasoning effort `medium`. The
coordinator dispatched these concrete child assignments using that configuration:

| Handle | Owner role | Source scope | Artifact directory |
| --- | --- | --- | --- |
| `/root/decision_auth` | secrets-engine | Signed decision enforcement, existing SECRETS-WP-0014 | `docs/changes/netkingdom-target-2026-10-16/decision-auth/` |
| `/root/protected_execution` | railiance-platform | Task execution journal/cleanup, RPF-WP-0035-T12 | `docs/changes/netkingdom-target-2026-10-16/protected-execution/` |
| `/root/browser_case` | net-kingdom | First browser case verification/integration, NK-WP-0048-T06 | `docs/changes/netkingdom-target-2026-10-16/browser-case/` |
| `/root/warden_browser` | ops-warden | Exact producer validation on browser admission, WARDEN-WP-0044-T03 | `docs/changes/netkingdom-target-2026-10-16/warden-browser/` |
| `/root/agent_isolation` | glas-harness | Scope credential delivery to actual workloads, GLAS-WP-0012 | `docs/changes/netkingdom-target-2026-10-16/agent-isolation/` |
| `/root/approval_reference` | approval-engine | Atomic authenticated consuming identity and act/PDP evidence, APPROVAL-WP-0004 | `docs/changes/netkingdom-target-2026-10-16/approval-reference/` |
| `/root/access_verifier_review` | access-engine | Producer compatibility review and actual signing path, FLEX-WP-0024 | `docs/changes/netkingdom-target-2026-10-16/access-verifier-review/` |
| `/root/mason_browser` | ops-mason | Correct versioned browser type source resolution | `docs/changes/netkingdom-target-2026-10-16/mason-browser/` |

Each child reads the assigned owner's instructions and intent. Prepared changes
use isolated temporary checkouts based on current owner source, with relevant
pre-existing tracked changes retained. Exact patches, source hashes and tests
support coordinator review before integration. A child reviews only its own
owner role; independent cross-owner reviews require separate assignments.

The table records assignment history, not perpetual liveness. All eight owners
delivered initial source packages. Secrets and Access are implementing the trusted
service task path and preparing native package/trust/caller admission. Platform
delivered exact effect readback and process-loss cleanup recovery in disposable
OpenBao; the trusted successor adds absolute execution budgets. Approval delivered the shared claim adapter and is reviewing
its authenticated consumer integration.
Exact revisions and publication caveats are in the
[source wave receipt](changes/netkingdom-target-2026-10-16/source-wave-status.json);
independent tests and retained failures are in the
[coordinator review](changes/netkingdom-target-2026-10-16/coordinator-source-review.json).
Raw patches and temporary reconstructions are workspace-local review artifacts;
the published owner commits are the durable source.

| Published owner source | Change | Independent verification |
| --- | --- | --- |
| NetKingdom `c31d21ba` | Browser evidence checking without native acceptance inference | 103 tests |
| Warden `95835208` | Exact pinned producer and parameter-schema validation | 102 tests |
| Glas `7357115c` | Credentials delivered only to explicit workloads | 141 tests and actual disposable bwrap denial/redaction/teardown |
| Platform `59d1441c`, `99fd21ee`, `d042d468` | Durable cleanup, disposable native adapter and immutable grant projection | Successive suites: 73, 83 and 122 tests; counts overlap |
| Secrets `c80a9441` | Strict producer-type signature verification with independent trust configuration | 125 focused tests and producer provenance check |
| Access `ec21518e` | Actual serving path signs before recording; inert chart configuration | Real local serve-to-Secrets verification; unsigned, tampered and unsafe key-file cases refused |
| Approval `477c6839` | Atomic consuming-service identity and bound act/PDP audit fields | 44 tests |
| Mason `57411f25` | Explicit versioned type-source selection in all CLI commands | 50 tests |

The subsequent published revisions are Secrets `ebca4f5` (fixed-verifier release
bundle) and `ff1a13d` (strict task handoff), Platform `e2b832b` (journaled
consume/confirm seam), and Approval `eece796` (canonical consumed-act comparison).
Normal owner publication and reconciliation succeeded; exact receipts retain
remaining historical warnings.
Independent combined Secrets verification passed 133 focused tests and seven
packaging tests. Platform passed all 130 tests, then eight affected tests passed
with the final Approval client; that client separately passed 36 tests.

Normal owner publication succeeded for every listed revision. Platform's scanner
ref race and Access's first State Hub timeout were retried successfully. Mason's
unrelated pre-existing workplan edits prevent an exact whole-repository hub
revision claim. Generated-only writeback refusals were retained without bypass.
Secrets' normal scanner initially flagged two public UUID identifiers; clearer
constant names preserved their values and passed the unchanged scanner.

These are bounded source/backend proofs. Synthetic approvals and grants do not
establish production consumption or isolation of this interactive assignment.
The actual service-pilot policy still denies runtime admission. The missing strict
Secrets handoff now binds the signed decision, approval, exact grant and caller;
Platform reserves durably, journals consumption and independently confirms it
before effects. Actual Access and Approval servers passed this path with explicit
synthetic identity/key/policy admission. Denied confirmation leaves uncertainty
and permits no native effect. Six successful native calls alone do not establish
complete expected-state readback; the following source slice adds that proof.
Both Secrets and Approval now compare the existing canonical native digest,
refusing Python's boolean/integer equality ambiguity. The original counterexample
and intermediate test failures remain recorded.

This wave authorizes source implementation and preparation under the user goal.
It grants no runtime credential scope or automatic native acceptance. Required
owner checkout filesystem approval is distinct from authority to change live
trust or credentials. No agent inherits another assignment's autopilot grant.

## Subsequent source integration, 16 October

Platform `d870596` binds canonical before/after metadata snapshots through the
existing descriptor commitments, checks each baseline before its target write,
and verifies complete readback before recording success. Independent native
fixture/mediator/readback suites passed 32 tests. This is sequential observation:
there is no atomic native CAS or concurrent-writer exclusion. Partial application
remains unknown, and cleanup confirmation stays separate. Its whole-stack
positive proof is pinned to Access `ec21518e`; later Access source deliberately
removes the generic task path used by that old synthetic fixture.

Access `919ce25` fixes explicit caller-audience rendering and source revision
pinning, records the existing workload identity, and adds an offline native
receipt verifier using the installed Secrets verifier. Root review reproduced
boolean/integer and integer/float source-record equality mistakes; R2 checks exact
JSON types and hashes the same bounded bytes it verified. Nine receipt tests and
two runtime-twin tests passed independently. Missing managed package declaration,
signer custody and native image/trust admission remain explicit.

Secrets `5a2099f` records the exact native CLI preparation, verified canonical
release bundle, configuration and trust inputs. The initial serving denominator
is 11 authorization sites across 10 handlers; native effect acceptance is zero.
Root verified unchanged runtime AST except documentation. The empty-key template
is intentionally unusable until independently admitted owner inputs exist.

Approval `3485415` supplies a producer-owned Go fact adapter and authoritative
claim vectors. Root passed its Go suite, two producer-vector tests and 14,114
actual Python canonical-byte/digest comparisons. This is shared validation code,
not another evaluator or credential transport. Access B1 R2 `4f6946b` connects the
actual HTTP caller join, preserves the submitted context and withholds accidental
ALLOW until the trusted source path exists. All three affected Go packages passed
independently; a malformed nested-duplicate test was corrected and rerun. These
two commits' publication/reconciliation state is recorded in the source receipt.

The trusted Access v2 successor, refreshed strict Secrets handoff and signer-custody
proposal remain separate review packages. Access's actual Approval API fixture and signed ALLOW/refusal evidence
are source proofs; the complete new consumer-to-Platform path and native issuer,
key, workload, grant, recovery and independent audit acceptance remain necessary.
Recovery review rejected broad 404 absence and unauthenticated stored accessor
claims. Revised Platform `b9eaa20` passed 53 independent tests and adds authenticated
private accessor custody and separately admitted cleanup after executor loss,
without restoring business or consumption authority. Lost issuance before accessor
persistence remains unresolved. Actual custody/key isolation and recovery grants
remain unadmitted.

Whole-stack successor work exposed a temporal contradiction: the first v2 source
allowed 15 seconds while native token lifetime requires at least 30 seconds plus
cleanup reserve. Integrated Access `2b064ee` now binds expiry to the exact operation
deadline within declared hard limits and all original/fresh/caller authority.
Its signed, claim-free DENY supplies producer-evaluated approval facts under the
existing enrichment contract; Secrets `4dd004a` verifies them before approval
preparation. This receipt grants no execution authority. Final evaluation refuses
registry drift instead of silently changing an approved request. Exact producer
numeric types survive verification and recording without a copied normalizer.

Approval `d40e842` preserves fractional time and uses one post-lock timestamp for
validity, consumption and its outbox event. The immediate path needs no sleep,
backdating or consumer tolerance. Independent verification passed all seven
affected Access Go packages, 193 focused Secrets tests and 98 Approval tests.
Platform `76fdc0b` adds absolute call/operation/credential deadlines and exact
source-byte checks; 28 independent tests passed. Platform `7be8b6e` adds the
complete successor proof: all eight independent tests passed using real local
Access and Approval services, retained registry, strict Secrets verification and
disposable OpenBao. The positive case verifies six native calls, complete readback,
cleanup and signed source-record parity; refusal cases preserve zero effect.
These use synthetic admission and do not establish production acceptance.
All sixteen target acceptance gates remain open.

The independent [identity archive recovery receipt](../../net-kingdom/docs/evidence/2026-10-16-identity-backup-live/actual-full-recovery-review.json)
now proves artifact integrity, original key pairs, SQLite integrity, native
PostgreSQL restore and cleanup. It explicitly does not prove full service
authentication, existing-token decryption or audit signature continuity. Reuse
that completed archive proof and drive the remaining native service recovery;
TSA-08 remains open.

The subsequent [isolated privacyIDEA review](../../net-kingdom/docs/evidence/2026-10-16-identity-outage-recovery/actual-isolated-privacyidea-review.json)
at 19:10 UTC accepts NK-WP-0049-T20/T31: five retained token materials were read
internally, all five wrong-key cases refused, and all 279209 historical audit
signatures verified with zero invalid/unsigned rows. New-signature negative
checks and container/plaintext cleanup also passed. This supersedes the earlier
token-material and stored-row continuity gaps only. Existing-token MFA, service
authentication and event completeness remain unproven; no private credential
was delivered to this agent.

Coordinator review independently reproduced a second timestamp failure in the
canonical Approval Engine: a fractional expiry at `.500` was consumed at actual
clock `.750`, while `consumed_at` reported the whole second. The isolated
[counterexample](changes/netkingdom-target-2026-10-16/approval-timestamp-precision/coordinator-counterexample.json)
is retained alongside the verified repair in `d40e842`; expiry remains exclusive,
including when the database lock is acquired after the deadline. The original
publication scanner refusal is also retained: the Approval owner labeled seven
public SHA-256 references explicitly, preserving digest bytes and review meaning.
The unchanged scanner then passed all six committed files.

The same Platform revision includes a bounded signer custody primitive and an
explicitly proposed custody design. Twelve independent tests passed against
disposable OpenBao. Exact KV CAS/readback, a private durable receipt before effect
and retained uncertainty are source properties. Production execution deliberately
remains unavailable pending an admitted adapter, independent owner reviews and
the exact custody decision. No key, credential grant or live deployment was made.

## Next native admission work

Use existing owner paths and retain the deployed lifecycle policy while preparing
the first native acceptance package. The task-execution pilot remains unadmitted.

The next four source slices are published and their committed file hashes match
the reviewed receipts: Access `0a05383` (bounded durable outbox and process locking),
Warden `d79f065` (attended administration routing), Secrets `3718e60` (reproducible
CLI release and admission requirements), and Platform `a3e8eb6` (phase-aware
attended signer adapter). Independent checks passed the Access race/chart suites,
135 Warden tests and 56 Platform tests. Secrets' two release builds were identical;
a clean offline installation and pre-credential trust refusal passed. These are
source and isolated-runtime proofs, not production admission.

The installed Warden CLI now matches the reviewed routing module and preserves
phase-memory. Its actual plan selects `openbao-platform-admin-login`, with
`founder_required` and `oidc_login`. The previous routing defect is resolved;
the attended identity act and exact custody proposal remain required.

Access's new canonical local thin package is committed at `d52f811` with the
reviewed thirteen-file tree. The exact local resolver identifies
`rapp-flex-auth-secrets-engine` / `flex-auth-secrets-engine` /
`flex-auth-secrets-engine`, owned by Access and still draft. Family review passed;
the global check retains the pre-existing Forgejo declaration error and reef
warning. Remote publication, central onboarding, placement and runtime admission
remain separate. Its frozen extraction source/image do not activate the signer.

The normal Access image run400 published source `0a05383`, then failed during
receipt parsing because the runner lacks Python. Public package metadata and the
run's push/pull evidence identify the published digest and exact revision; the
failed run remains failed. Access `84c78e0` replaces that parser with existing
Bash/Docker facilities, verifies the pulled revision label, and records the local
package reference. Three independent publisher tests pass. Normal source publication
and synchronization passed. Ordinary publisher run402 and both smoke jobs in run401
succeeded for exact `84c78e0`; independent public package metadata confirms image
`sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f`
and its revision label. The [independent image review](changes/netkingdom-target-2026-10-16/access-native-admission/image-84c78e0/coordinator-review.json)
retains this evidence separately from failed run400. No deployment follows automatically.

Audit `64509d2` defines the first pin's admission and complete-ledger reconciliation
using existing receiver APIs. Independent root checks passed 17 tests plus the
canonical cross-owner fixture; one isolated-checkout skip is retained. Bounded
reconciliation requires independently retained complete producer ledger bytes,
every-ID readback and all-class acceptance-time counts, with concurrent boundary
arrivals settled. Selected successful IDs are insufficient. The initial signer
slice keeps audit delivery disabled; periodic independent custody, final per-pin
cadence, receiver admission and runtime observation remain required.

- Access owns an immutable image, signer projection, retained caller binding and
  durable outbox. Metadata inspection found no existing namespace PVC. A proposed
  1 GiB local-path claim is new storage; its requested capacity is not a filesystem
  quota. OS-enforced single-writer locking, bounded append/startup and fail-closed
  storage failure behavior are published in the existing outbox. Recreate
  with one pod alone does not establish those properties.
- Platform owns proposed CCR-2026-0050 for the exact read lane, separate attended
  signer writing, fencing and private recovery receipts. Native role naming must
  satisfy the real delegated-applier policy. The installed Warden plan now selects
  the required admin-login route. The phase-aware writer preserves metadata-only
  and seed-write uncertainty; recovery is read-only and cannot authorize replay.
- Secrets owns the release bundle, fixed verifier, independently admitted public
  trust and actual caller delivery. Clean installation and lifecycle ALLOW/DENY
  capture are preparatory evidence; they do not establish effects at the inventoried
  eleven privileged call sites across ten handlers. Those effects remain unaccepted.
- The retained Access tuple now resolves against its committed local declaration.
  Resolve availability for each actual admission consumer separately; a local
  checkout does not establish central registration, placement or runtime trust.
  Native audit receiver reconciliation also remains required.

The [source wave receipt](changes/netkingdom-target-2026-10-16/source-wave-status.json)
records exact publication and synchronization results. Temporary review checkouts
and agent handles remain preparation artifacts, not runtime deployments.

Two preparation dependencies are now simplified in published source. Access
`dc04202` permits exactly zero or one outbox writer through the ordinary Helm
chart, removing the separate hand-derived stopped manifest. Both charts reject
unsafe replica values; 86 actual Helm render cases and the existing outbox suite
pass. The chart successor explicitly retains the independently verified `84c78e0`
image; chart and binary revisions remain distinct.

Platform `84c529f` replaces the conflated cluster/GitOps reviewer with the exact
runtime/storage owner. Access owns workload and Helm release changes; Platform
owns existing GitOps Applications and their sync/freeze integration; cluster
owns runtime, headroom and storage review. Enablement participates if an actual
controller installation change is proposed. Independent checks passed 45 native
preparation tests and 54 overlapping cluster custody tests. The focused CCR
validates but remains proposed with unconfirmed claims. A normal scanner refusal
on ambiguous public image references was corrected with complete typed OCI
references; the unchanged scanner then accepted all six files. The full CCR
validator retains unrelated baseline CCR0035 errors.

Both commits have verified publication and normal synchronization receipts.
Cluster's own review record was published as `RCLUSTER-WP-0017`. Its source-only
review accepts the exact Platform role correction. The sync prefix warning is a
reporting defect: ADR-007 explicitly assigns `RCLUSTER-WP`, while the checker
infers the retired prefix from the historical file majority. Existing identifiers
and UUIDs remain correct and unchanged. This review grants no native action.
Frozen rollout R1 and custody P2 remain historical preparation. The
[rollout R2](changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/README.md)
and [custody P4](changes/netkingdom-target-2026-10-16/platform-signer-custody/native-adapter-r2/native-packet-p4/README.md)
now bind the new source revisions and distinct owner scopes. Independent fresh
Helm renders match the frozen outputs; eight assembler checks passed. The stopped
Helm phase disables waiting and automatic rollback because an unbound
WaitForFirstConsumer claim cannot bind with zero pods, and a rollback to the
running predecessor would defeat the intended stop. The running phase can use
automatic rollback only after authenticating its new stopped predecessor.
Cluster's exact source reviews are complete under T01; fresh native preflight
and approved storage verification remain T02/T03. Actual founder entity, expiry,
approved credential request, held window and native dispositions remain unset.
The [coordinator checks](changes/netkingdom-target-2026-10-16/source-wave10-coordinator-review.json)
retain the source proofs separately from deployment acceptance.

The coordinator then executed the reviewed public-metadata collector and exact
seven-resource server dry-run on railiance01 at 18:53 UTC. Target node and cluster
identity and the actual kubectl JSONPath formatter passed first. All seven
resources were accepted; the API-returned stopped Deployment retained replicas
zero and exactly matched the frozen projection. Its live predecessor remains
generation four, Helm revision four, one ready pod with the old image. No PVC,
namespace quota, LimitRange or HPA was observed. No persistent mutation, writer
freeze, credential access or custody action occurred. The
[native preflight receipt](changes/netkingdom-target-2026-10-16/native-preflight-r1/coordinator-review.json)
binds the collector, payload, actual observations and independent checks.
Server admission does not establish Helm upgrade equivalence or a held window.
A second narrowly selected observation and tested resource-stream parser confirm
91 nonterminal bound pods, 3580m CPU requested of 4000m allocatable, and 9760Mi
memory requested. No node taints, cordon, pod-level resource requests or restartable
init containers were observed. The proposed replacement retains 25m/32Mi requests;
the dated 420m unrequested CPU is not a reservation. Cluster has reviewed the
bounded runtime/storage plan under its own T02, while actual held-window and
PVC/PV retention gates remain open. Access and Platform review their own workload
and GitOps/custody scopes separately.

Secrets has now selected the exact public bundle and empty-key configuration in
owner commit `a4f1802`, followed by actual local installation recorded in
`5356810`. The existing offline installer created the fresh selected immutable
release prefix; seventeen public configuration files were copied with mode0600
into the selected private revision directory. Installed CLI help, all ten catalog
rows and the actual installed authorization boundary passed the empty-key refusal
before caller-file or socket access. The
[installation receipt](changes/netkingdom-target-2026-10-16/secrets-native-admission-next/actual-prekey-install.json)
records exact artifact/configuration hashes. This completes inert local package
preparation, not key/caller admission or any of the eleven protected effect sites.
The sandbox-mapped ownership preflight refusal and subsequent successful host
check are retained; neither custody nor approval/backend access was configured.

Rein source `9b88cad` advances the existing combined-runtime lock to published
Glas `7357115c`, retaining the selected llm-connect and Sand-boxer revisions.
Normal publication and owner synchronization passed. Its canonical rebuild has
complete artifact digest
`sha256:f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d`.
The coordinator independently ran the actual installed manager/gateway proof and
rehashed all1447 artifact records afterwards. Startup, synthetic host/environment
denial, exact task identity, workload-only synthetic credential delivery,
redaction, cancellation/expiry and cleanup passed with profile1.1.1 still
unverified. Seven rein tests pass; the unchanged Glas revision retains its141-test
proof. The [canonical runtime proof](changes/netkingdom-target-2026-10-16/agent-isolation-next/coordinator-canonical-manager-proof.json)
explicitly excludes model calls, native installation/admission and migration of
this interactive assignment. REINAH-WP-0008-T07 and TSA-06 remain open.

Access `d328a260` and Platform `08c1f036` published their independent bounded
rollout-plan reviews. Access names the actual Helm writers and the stopped-only
rollback target; Platform binds the observed manual-sync Applications and exact
namespaced signing-key delivery lane. No queued Application operation or
Argo-owned signer Deployment was observed. Initial rollout/CCR authorization
precedes installation and its resulting storage/fence evidence; final one-use
custody assent binds those actual facts. This ordering does not authorize either
stage. The founder entity, maintenance window, approved CCR and final dispositions
remain unresolved. The [checkpoint review](changes/netkingdom-target-2026-10-16/source-wave11-coordinator-review.json)
independently verifies five new owner commits against published history and binds
the public preflight, installed-package and canonical-runtime evidence.

NetKingdom `015694ee` repairs the existing optional execution-descriptor pin
contract. JSON schema and semantic validation now agree on bounded, correctly
shaped pins; semantic checks require declared step identifiers, and the evidence
API refuses malformed maps without crashing. The coordinator independently passed
21 new tests and verified all six committed file hashes; the owner passed 127
affected tests. Current browser type/case bytes remain unchanged. NK-WP-0048-T12
now tracks the existing NetKingdom entry points' attended adapter preparation;
machine descriptors and native browser acceptance remain outstanding. The
[source review](changes/netkingdom-target-2026-10-16/browser-acceptance-next/coordinator-review.json)
does not admit a type, adapter, identity or protected operation.

Reuse's existing validator now checks descriptive index/entry parity and refuses
duplicate identifiers/paths and malformed metadata. Both corrected owner indexes
are published. A forced hosted composition at 19:25 UTC returned every reviewed
capability exactly once with its correct source owner, no federation warning,
and matching NetKingdom bootstrap-recovery and Railiance Bootstrap descriptions
and tags. All 60 local provider indexes passed the strengthened validator with
zero errors/warnings. The [hosted readback](changes/netkingdom-target-2026-10-16/improvement-loop-next/coordinator-hosted-refresh.json)
establishes current discovery parity; it does not prove package-family closure,
an operating schedule, consumer reliability or runtime acceptance.

Warden `d97652a3` independently reviews and adopts the exact NetKingdom producer
validator/evidence hashes from `015694ee`. The prior pins correctly refused the
changed modules; the source update preserves that drift refusal and adds malformed
descriptor integration cases. The coordinator passed all 87 actual producer,
Executor and reducer checks with the canonical pins and no overrides. The
[verification](changes/netkingdom-target-2026-10-16/warden-browser-pin-refresh/coordinator-review.json)
establishes producer compatibility, not admission of the proposed registration
adapter or native browser execution.

NetKingdom `0775c2bf` publishes the reviewed registration adapter around the
existing client-registration helper. Its execution descriptor binds the exact
checker executable and helper sources before kernel admission. Rollback requires
authenticated creation in the same process and unchanged object identity/version;
pre-existing registrations, lost readback and interrupted recovery confer no
rollback authority. The coordinator independently passed 36 checks and verified
that all three published source files match the reviewed candidate. The
[publication review](changes/netkingdom-target-2026-10-16/browser-adapter-next/coordinator-publication-review.json)
retains the rejected first revision's missing checker binding. Actual checker
selection, owner evidence/revocation callbacks, group provenance, durable restart
reconciliation and native browser acceptance remain tracked in NK-WP-0048.
Owner `0394484` records publication and normal task UUID writeback. All 16 tasks
are projected; normal synchronization retains zero failures/automation errors,
25 final warnings and the generated-only brief commit refusals.

The isolated KeyCape restore adapter remains under source review. Its wrapper
reuses the existing archive/custody pipeline and original native verifier, with
private state in verified temporary memory mounts. Review has required correction
of optimized-away checks, signer ambiguity and launch/environment binding. The
third revision binds one daemon and registers plaintext cleanup before decryption;
the coordinator passed 52 checks and verified all 14 dependency hashes. A remaining
race requires stopping the exact parent execution before timed cleanup can begin.
Synthetic tests do not establish pinned-image runtime
compatibility, actual credential recovery or downstream consumer continuity;
NK-WP-0049-T18 and the identity recovery target remain open.

The next browser checker artifact is independently reproducible from published
KeyCape `3c71226a`: the coordinator verified all 108 source files, 9876 cached
toolchain files and ten used module trees, rebuilt offline and obtained the same
13633409-byte executable (`sha256:be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5`).
Eight actual-checker/helper/kernel fixtures passed. This proves bounded build
and fixture behavior, not upstream compiler provenance or native executable
custody. KeyCape's own source review identifies two public environment overrides;
the NetKingdom caller must isolate its checker environment before integration.
The [independent build receipt](changes/netkingdom-target-2026-10-16/browser-checker-artifact-next/coordinator-build-review.json)
retains the exact scope and the corrected module-cache path lookup failure.

Recovery revision four independently passed 61 checks, including real disposable
processes for deadline shutdown and hard parent loss. Exact parent-process
quiescence now precedes cleanup. A further counterexample showed that a nonzero
Docker CLI result lost its uncertainty marker; a minimal successor must retain
that ambiguity. Pinned-image compatibility remains unproven, including shared
memory mounts, policy-lock startup and issuer hostname resolution. No recovery
credential, production configuration or native acceptance was used by these checks.

## Dependency and residual handling

The current implementation demand selects necessary target dependencies for
owner review and scoped promotion. APPROVAL-WP-0002's exact issuer/provenance,
audit and served-PEP obligations are required; its residual label must be
reconciled by its owner before implementation dispatch. This does not activate
every residual security plan or the deferred exposure rotation.

Cross-owner waits attach to the existing project driver where one exists, or a
derived `cross_owner_wait` case benefiting CUST-WP-0080. The dispatched child
handles establish current execution, not a separate fleet wake service. If a
child is terminal, record its deliverables and dispatch the next reachable owner
task; never report a stale handle as running.

## Evidence and completion rules

For each change record the original owner revision, pre-existing dirty-state
digest, exact patch, focused tests, independent review, integrated revision,
publication and native acceptance separately. Bind each native receipt to target,
identity, scope, source/image/config revision, expected result, negative cases,
cleanup and rollback. Preserve failures and unverified outcomes.

The coordinator reviews evidence against every TSA gate and the named owner
requirements. It may record partial source delivery without closing a native
gate. Work continues until the target's complete exit condition holds. The first
wave is implementation progress, not the completion boundary.

## Requested pause checkpoint, 16 October 2026

The founder requested a progress report and a good pause point. Owner publication
and final consistency sync are complete; retain this checkpoint and stop implementation;
no new runtime trial is authorized by the pause. All sixteen target acceptance
gates remain open. The goal was paused at this checkpoint, not complete. The
subsequent explicit continuation resumes the full target; see the resume record
below.

Published NetKingdom `916ba4b` contains the two-line existing-helper correction
for an absolute selected executable and an empty checker environment, plus its
regressions and work records. The coordinator verified exact equality of all four
published files and passed 39 affected checks and 11 actual-checker scenarios.
The final owner record `cbabb6d` is published; final consistency sync passed, all
18 projected tasks match (12 done, 2 waiting, 4 todo), and original staged brief
content was restored. These are owner-plan tasks, not the sixteen target gates.
KeyCape `834b0d0` independently endorses the exact offline artifact behavior with
explicit input, provenance, custody and native-acceptance limits.

Recovery R5 independently passed 67 checks, then its first actual local Docker
positive fixture failed before native verification. The safe receipt reports
all three registered containers, four temporary volumes and exact temporary
plaintext removed; independent label-filtered Docker inventories confirmed
absence, and no fixture source directory remains. Only generated test material
was used. No actual recovery or production acceptance follows. The frozen R5
manifest is `sha256:6a4e3f47fc9a647d813dfbe75851d1ef62ebac7cfc7a7818b587ad56bf919c7a`;
the [failed trial](changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/actual-fixture-r5-failure.json)
is retained locally without retrying or weakening checks. The normal publication
scanner refused six raw evidence files; their originals and the complete frozen
R5 source packet remain workspace-local. See the
[publication scope](changes/netkingdom-target-2026-10-16/pause-publication-scope.json)
for exact withheld paths. Resume requires this workspace or a separately reviewed
transfer of those originals; this checkpoint does not contain the full fixture.

On resume, first diagnose the R5 containment/startup refusal using bounded public
metadata and a safe phase marker; do not infer the cause from passing mocks.
The receipt places the failure after public image readback and before the full
provision completion marker. Review any correction before another disposable
positive case; run the hard-loss/deadline/uncertain-response cases only after the
positive case passes. Canonical recovery integration and real owner-held recovery
remain separate. Continue browser descriptor/callback/executable-custody work
from NK-WP-0048-T16, with group and durable-restart obligations retained.

Signer rollout/custody remains at the reviewed source packets: founder maintenance
window, independently established entity, approved CCR and exact native owner
assents are still required. Existing rotation deferral and supervised mode remain
unchanged. Resume the full target architecture, not only these two lanes.

## Resumed implementation, 16 October 2026

The founder explicitly resumed the active goal. The previous turn qualifies as
progress: published owner source, independently checked artifacts and a retained
failed native fixture changed the next action. Historical child handles and the
pause checkpoint are not evidence of current execution.

Three new GPT-6.1-Sol medium assignments cover recovery startup diagnosis
(`/root/recovery_resume`), the remaining browser adapter source
(`/root/browser_resume`) and independent TSA-01–16 evidence review plus scanner
measurement (`/root/target_audit`). Frozen R5 and its failure remain unchanged;
successors receive independent review before another disposable fixture. Existing
supervised authority, attended custody requirements and rotation deferral remain
in force. Completion still requires the full target acceptance contract.

Independent review reproduced the browser checker's mutable-path execution race.
The successor snapshots digest-verified bytes into a sealed Linux memfd and
passes only that descriptor to both checker subprocesses. Review removed an
earlier unbounded pathname read; reachable symlink, FIFO and oversized-file
refusals now precede the helper and still attempt parent-session revocation.
All 49 source checks and 12 actual-checker/helper/kernel scenarios passed
independently. The five reviewed source files are integrated into NetKingdom with
exact postimage equality; owner publication is tracked separately in the
[source review](changes/netkingdom-target-2026-10-16/browser-resume-r1/coordinator-review.json).
Native executable custody, callbacks, group provenance and restart reconciliation
remain required.

Recovery R6 fixes a demonstrated conflict between the pinned helper image's
declared anonymous volume and the existing containment check, using an explicit
bounded tmpfs at that path. It adds public phase markers without disclosing
diagnostics or private payload. The coordinator passed 72 checks, then the exact
frozen R6 positive Docker fixture passed: original hostname/TLS/signer, native
service authentication, wrong-secret/excess-scope denial, unchanged durable bytes
and cleanup. The [independent review](changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/coordinator-r6-all-review.json)
binds generated test material only. Full original fixture receipts and frozen
preparation packets remain workspace-local; published owner source and retained
review/reaper receipts provide the source and cleanup record. It is not actual owner-held recovery, human
MFA or downstream consumer acceptance. R5's failure remains retained; its missing
phase marker prevents a retrospective claim about the first failing check.

The [independent target audit](changes/netkingdom-target-2026-10-16/resume-audit-r1/README.md)
maps all sixteen remaining acceptance obligations to current owner evidence.
The real daily report succeeds on the workstation without sending messages or
calling a provider. The selected rein startup readiness check fails; its existing
model-backed profile does not establish an admitted deterministic schedule runner.
Workstation reachability therefore does not justify enabling Activity's schedule.

All four R6 Docker cases subsequently passed: positive, hard-parent-loss,
execution deadline and a nonzero response after Docker accepted a container.
The last case retains uncertainty despite cleanup. Independent verification
checks the same daemon and host tmpfs device as the trial, proves all exact
containers/volumes/plaintext absent and retains all three reaper outcomes.
An initial receipt lookup used the sandbox's different `/dev/shm`; that failed
observation is retained and superseded by the
[host-bound review](changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/coordinator-r6-all-review.json).

The recovery source is integrated into the owner checkout. Normal publication
first refused eight public source-file hashes in the fixture manifest. R7 uses
explicit SHA-256-qualified checksums and a strict type/shape verifier, passing the
unchanged scanner and 73 checks. All recovery runtime bytes remain identical to
the four-case R6 proof. The original refusal and the
[publication encoding review](changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/publication-r7/review.json)
remain evidence. NK-WP-0049-T32 records bounded source/fixture delivery;
T33 prepares the exact owner-held attempt; T18 retains real recovery and consumer
acceptance. Neither a test archive nor these source tasks closes TSA-08.

Browser source `8790dd18` is published; the coordinator completed the interrupted
worker's record at `85a54ab` and verified all 19 projected task statuses. Two
GPT-6.1-Sol workers reached their model usage limit after their substantive
commands completed. Their handles are terminal, and the coordinator inspected
actual command receipts rather than treating them as continuing execution.

The scanner baseline also completed with disposable fixtures removed and owner
source unchanged. Warm median staged-scan time was 0.702 seconds for one 1-KiB
blob, 12.065 seconds for 16 distinct blobs and 49.172 seconds for 64; one 1-MiB
blob took 2.549 seconds. Generated-private-key refusal and unavailable/wrong-digest
refusal passed. The [measurement](changes/netkingdom-target-2026-10-16/resume-audit-r1/scanner-baseline.json)
is a local baseline, not a throughput improvement or remote receive-path result.
Per-blob process startup is a concrete owner optimization candidate; control
coverage and attribution must be preserved before claiming TSA-15 improvement.

Recovery source `5fcd5952` is published through the normal owner path. The
[canonical integration check](changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/canonical-r7-integration.json)
verifies all eight added files, all 33 projected task statuses and preservation
of the pre-existing staged/working brief. Native archive/identity/consumer gates
remain open. Continue with NK-WP-0049-T33's exact owner-held attempt preparation,
NK-WP-0048-T16's evidence/revocation/custody integration, and the other owner
actions in the full target audit. No historical handle or model-limit failure
establishes a running worker. The goal remains active.

## Reviewed source delivery, 17 October 2026

Coordinated GPT-6.1-Sol medium owner assignments delivered NetKingdom source
`4f65e41` and Repo Manager source `83c521b` through normal hooks. Independent
canonical runs passed 65 group-provisioner, 111 recovery-preparation and 42 scanner
checks. [Publication verification](changes/netkingdom-target-2026-10-16/resume-integration-r1/publication-verification.json)
records pushed revisions, task projections and preservation of unrelated work.
All sixteen target gates remain open.

Group ensure/revoke now retains complete prestate, write-before-call intent and
exact confirmed creations across process restart. Missing/replaced storage,
missing intent rows, unresolved writes, legacy broad rollback and detected shared
membership drift refuse. An actual disposable LLDAP trial passed 14 compatibility
oracles; independent pinned-daemon checks found both exact names and the run label
absent. This proves neither external-writer fencing nor ABA exclusion. Review
corrected SQLite-volume deployment advice before publication: accepted ADR-0015
requires CNPG/rapp-postgres or a governed exception. SQLite remains local/disposable.
NK-WP-0048-T20 records completed preparation; T14 retains native storage, scope,
all-writer exclusion and protected callback/evidence/session acceptance.

Recovery validates bounded strict admission metadata, its exact digest, all 17
local source/config dependencies and required imports before custody. The existing
attended entry point adds sealed anonymous key descriptors and versioned private
manifest derivation after authenticated full-archive validation. Parent loss
does not revoke an admitted child's descriptor before child exit. The compatible
named-file mode retains its original hard-loss limitation. Older custody tests
passed 94 cases with 61 real-SOPS cases skipped. T34 records source delivery;
T35/T36 track original TLS and registration bindings; T33 retains readiness and
T18 actual owner-held recovery/consumer acceptance. No actual key was requested.

Scanner batching uses verified executable/object bytes, bounded small-blob batches
and private tmpfs with parent-loss cleanup; larger blobs retain stdin semantics.
Thirteen exact old/new parity cases match. Both configured shared and Custodian
hooks accepted clean content and blocked a generated private key through temporary
indexes/object stores. Real indexes were not opened, HEAD/index metadata stayed
unchanged and all fixture storage was removed. Source tests cover unavailable
scanners; actual-hook unavailability remains pending without changing scanner
permissions. The canonical source/explicit repo-local CLI route is verified;
no global installed CLI is claimed.

| Generated warm fixture | Previous median | Batched median |
| --- | ---: | ---: |
| 1 distinct 1-KiB blob | 0.702 s | 0.835 s |
| 16 distinct 1-KiB blobs | 12.065 s | 0.884 s |
| 64 distinct 1-KiB blobs | 49.172 s | 0.904 s |
| 1 1-MiB blob | 2.549 s | 1.903 s |

Seven-repeat samples are descriptive local measurements. The one-blob slowdown
remains part of the result; receive/CI coverage and workload tails are not inferred.
[Verified results](changes/netkingdom-target-2026-10-16/resume-integration-r1/verified-results.json)
retain exact test scopes, measurements, refinements and cleanup evidence.

The next [native preparation steps](changes/netkingdom-target-2026-10-16/resume-integration-r1/native-next-steps.md)
are grounded in 23 group/storage and 17 recovery public-source references. They
identify existing owner paths and a historical secrets-engine-openbao registration
without inventing current assent, independent TLS custody, production storage
admission or consumer continuity. Full frozen fixture packets remain workspace-local.

## Continued verification, 17 October 2026

The actual shared and Custodian hooks now pass all six clean, generated-key and
unavailable-scanner cases. A private mount namespace shadows the scanner only
inside each fixture; the host executable, real index and HEAD remain unchanged.
Ten fixture checks and an actual disposable parent-loss cleanup trial passed.
Failed R1/R2 trials remain retained; the reviewed successor explicitly verifies
the writable `/dev/null` device it needs. Exact host tmpfs identity and resource
absence were checked. [Hook results](changes/netkingdom-target-2026-10-17/scanner-unavailable-r1/namespace-hook-results.json)
and [cleanup results](changes/netkingdom-target-2026-10-17/scanner-unavailable-r1/namespace-lifecycle-results.json)
support RMGR-WP-0021-T05 completion, published at `9ebde0a9`. The first projection
returned `pending_push` despite exit zero; the follow-up authoritative projection
returned `applied` at that exact revision. Other Repo Manager coverage and private
response work remain open.

The previously skipped real-SOPS coverage now passes with generated material in
an isolated network/mount/PID namespace. All 61 prior cases passed, then four new
end-to-end sealed-descriptor decrypt/edit/rotate and wrong-key refusal cases
brought the successor to [65 passed](changes/netkingdom-target-2026-10-17/sops-real-regressions.json).
The fixture uses SOPS 3.13.3 with matching official release asset and checksum
digests; its Sigstore signature was not verified. The executable is not installed
system-wide and this does not admit native tool custody or actual owner-held
recovery. The earlier skipped result remains historical evidence.

SECRETS-WP-0015 is published at `c59bbf56`: the source-bound public registration
selector and offline checker are delivered. Outage-compatible consumption and
private/native admission remain separate open tasks. RCLUSTER-WP-0018's reviewed
TLS metadata tool and plan are prepared; publication stopped before mutation on
15 bare historical labels and five collisions across three frozen archives.
The exact receiver-first successor preserves the existing three parents and 15
task UUIDs. Independent candidate suites pass 26 receiver and 47 registrar tests;
the registrar guard remains active until receiving is deployed and verified.
Original TLS custody/reissue disposition is still unknown.

The proposed State Hub rollout must cover its full difference from deployed
`main-7d99282`, including an unrelated inbox migration already on `main`.
The receiver patch adds no migration, but that fact does not establish an
unchanged deployed schema. Normal CI artifact identity, full-change review,
fresh headroom/dry-run, verification/rollback and scoped founder approval remain
required. No production rollout or historical identity rewrite has occurred.
All sixteen target acceptance gates remain open.

PostgreSQL source `70f408ca` is now published with the SOPS test successor in
NetKingdom. The canonical provisioner suite passes 82 cases. All 21 real
disposable PostgreSQL oracles pass: migration/runtime-role refusal, restart and
revoke, full visible prestate preservation, exact reservation/CAS, divergent
same-counter database forks, lost acknowledgments and real dump/restore refusal.
LDAP remains the declared test double in this SQL fixture. The earlier separate
14-oracle actual LLDAP proof retains its own scope. Independent fixed-daemon
checks confirm both exact containers and their run label absent.
[SQL result](changes/netkingdom-target-2026-10-17/postgres-r5-result.json) and
[cleanup](changes/netkingdom-target-2026-10-17/postgres-r5-cleanup.json) retain the
actual return. Failed R2/R3/R4 trials remain recorded; review fixed a real nested
receipt-reference defect, then two snapshot-fixture defects before the pass.
NK-WP-0048-T21 records completed source/SQL proof; T14 retains native CNPG,
checkpoint/custody/scope/callback integration and all LDAP writer fencing.
NK-WP-0049-T37 records the 65 real-SOPS cases; its actual recovery gates stay open.

State Hub receiver source `51bc70d1` is published, independently hash-checked and
projected. Its normal CI task 12624 succeeded. Anonymous registry protocol
verified manifest `sha256:c802690ee1811b3d77df4077936f9cdced1385514e8673fcbc9232b84d645015`;
[read-only image inspection](changes/netkingdom-target-2026-10-17/statehub-public-image-inspection.json)
verified all 22 compressed layers, selected receiver/migration/hub-core files,
the exact build ID and 86 Python package metadata records without executing or
installing the image. Floating build origins remain unknown. Source readiness
follow-up `086d79a2` changes only Make/test/workplan files and preserves this
runtime artifact. Both command-fixture branches and the actual full server
dry-run pass with the annotation policy unchanged.

The [disposable migration check](changes/netkingdom-target-2026-10-17/migration-compat-r1-result.json)
passes ten old-model DDL/new-migration/old-write-shape oracles; independent
[cleanup](changes/netkingdom-target-2026-10-17/migration-compat-r1-cleanup.json)
confirms exact resource absence. The tiny synthetic migration timing does not
predict production lock duration or establish full HTTP/ORM acceptance.
Helm rollback retains the additive schema; the existing migration Job has no
active deadline, so Helm's three-minute timeout does not guarantee job termination.
The concrete rollout review must retain that recovery limitation. No live
deployment, registrar activation or native target gate closure is inferred.

The [exact rollout proposal, revision 4](changes/netkingdom-target-2026-10-16/cluster-historical-publication-r1/revisions/r4-rollout-review/FINAL-PROPOSAL.md)
is prepared and recorded as pending under the existing supervision record. The
packaged chart and image digest are fixed; its values-preserving server dry-run
keeps eight identities and changes only three image paths. Fresh observation
finds Helm 75, the original API/MCP images Ready, schema `b3c4d5e6f7a8`, no
migration Job and passing headroom. Approval must cover the full inbox migration
and exact conditional recovery limits. EUR cost/loss exposure and production
migration timing remain unpriced; unknown recovery mapping stops for attended
owner recovery. This record grants no authority.

Four [coordination receipts](changes/netkingdom-target-2026-10-17/coordination-receipts.json)
now project the explicit foreign-owner waits, using the existing retirement
driver for receiver/registrar sequencing and derived cases elsewhere. No new
driver, external message or worker wake was created. The
[publication readback](changes/netkingdom-target-2026-10-17/completed-deliverable-publication.json)
verifies all 58 NetKingdom and eight State Hub task IDs/UUIDs/statuses against
source, plus exact remote heads. Earlier Repo Manager/Secrets readback verifies
nine more owner bindings and the two Secrets dependency edges.