the-custodian/docs/changes/netkingdom-target-2026-10-17/native-identity-r1/verification.json
codex a6eee04d42
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Reject generated-only commits / generated-commit-guard (push) Successful in 8s
Record native security preparation and owner checkpoints (2/7)
2026-10-17 07:51:36 +02:00

70 lines
3.1 KiB
JSON

{
"status": "source_regressions_passed_not_native_assent",
"canonical_changed_paths": [
"tools/bootstrap-recovery/isolated-keycape.py",
"tests/test_isolated_keycape_recovery.py",
"tests/isolated-keycape-native-fixture-manifest.json",
"workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md"
],
"changes": [
{
"path": "tools/bootstrap-recovery/isolated-keycape.py",
"preimage_sha256": "sha256:f67627b7d1647d75187dd899874efe22383bc91de5d97dabb9801076668ab3c2",
"postimage_sha256": "sha256:86f37add7221e4c73e3f9d878c09a3cc81061627cbf024ed6887d973d929b718"
},
{
"path": "tests/test_isolated_keycape_recovery.py",
"preimage_sha256": "sha256:247e9a87f5be2ee9f20f7edbb4a9f612ab7cb0cd940392c3caeca8b046605f55",
"postimage_sha256": "sha256:5f729e077db51dd6b17d00dc3eb71c0e652849f55fe68505a07befa663c91dea"
},
{
"path": "tests/isolated-keycape-native-fixture-manifest.json",
"preimage_sha256": "sha256:1dcefbc7ca7b0c2be33135b1b7977b89ba657223ecbb1310cc691d151b3d916e",
"postimage_sha256": "sha256:936ee435be04b27f391391e7dda02def69e153bde3adcce92d569f33f308db2e"
},
{
"path": "workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md",
"preimage_sha256": "sha256:678ec04b73b57c026001791706c05c5d4d5a508a32f17210ae8ad03ab15d53b8",
"postimage_sha256": "sha256:5830c429f58a0317b28c7b4bcf22a1b46e6d01b41378cdae95f947c6d9317e44"
}
],
"checks": [
{
"command": "PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tests -p test_isolated_keycape_recovery.py",
"tests": 39,
"exit_code": 0,
"evidence": "tool result; includes existing full unique-selector mocked flow and four new pre-further-input refusal tests"
},
{
"command": "PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tests -p test_isolated_keycape*.py",
"tests": 77,
"pass": 76,
"errors": 1,
"exit_code": 1,
"evidence": "focused-regressions.stderr.txt",
"finding": "unexecuted source manifest correctly refused changed adapter/test hashes; retained before two-hash/scope update"
},
{
"command": "PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tests -p test_isolated_keycape_fixture_plan.py",
"tests": 4,
"exit_code": 0,
"evidence": "tool result; only affected fixture-plan checks repeated after two-hash/scope refresh"
},
{
"command": "git diff --check -- four changed paths",
"exit_code": 0
},
{
"command": "new refusal regressions against retained original adapter bytes",
"tests": 4,
"errors": 4,
"expected_original_contract_failure": true,
"evidence": "original-behavior-regression.txt"
}
],
"limit": "All fixtures synthetic/mocked. Exact-one check runs on already-restored config, not before decryption or initial key prompt; no runtime action or credential source performed. Current native Go validation also rejects duplicate IDs.",
"review_status": "pending root independent review; no owner publication/sync performed",
"hub_writes": false,
"frozen_runtime_receipts_changed": false,
"task_status_changes": false
}