202 lines
13 KiB
Diff
202 lines
13 KiB
Diff
--- a/workplans/NK-WP-0048-security-case-types.md
|
|
+++ b/workplans/NK-WP-0048-security-case-types.md
|
|
@@ -708,6 +708,34 @@
|
|
without the trusted integration. SQLite remains local/disposable only; any
|
|
production exception requires explicit scoped governance under ADR-0015.
|
|
|
|
+2026-10-17 owner-integration refinement: T23 records the completed source/package
|
|
+placement review, distinct from T21's source/disposable-SQL proof. Its dedicated
|
|
+`rapp-identity-provisioner` recommendation is draft and unbound, not an accepted
|
|
+package or existing repository. The full six-consumer rapp-postgres renderer
|
|
+accepts the inert candidate on platform-pg-2 as its third of four declared
|
|
+consumers; first-cell placement is refused as a fifth. Neither the estimated
|
|
+four-consumer ceiling nor source requests establish native headroom or backup.
|
|
+
|
|
+Next independent owner contracts: NetKingdom/package/substrate owners accept
|
|
+exact deployment/rollback fate; rapp-postgres admits the dedicated consumer,
|
|
+roles, five-connection budget and actual backup/restore; Platform admits exact
|
|
+renewable runtime/migration delivery and TLS/CA/SAN; network owners scope SQL,
|
|
+broker and checkpoint paths without assuming a narrow policy subtracts additive
|
|
+same-namespace access. Protected caller owners must provide authoritative
|
|
+GroupJournalBinding construction and current authorization; an independent
|
|
+existing holder must authenticate and atomically advance the exact content
|
|
+checkpoint, not a counter or ordinary Audit receipt. Directory/runtime owners
|
|
+must select and prove either an exclusive all-writer maintenance barrier or
|
|
+provider-supported CAS/generation, including established sessions, lifecycle
|
|
+cascades and remove/readd ABA. No source review establishes those owner facts.
|
|
+
|
|
+The default PostgreSQL activation and destructive native rollback remain refused.
|
|
+Storage/lease acceptance can be proposed separately from LDAP mutation only after
|
|
+exact owner source/target/custody/verification/recovery and cost/risk review;
|
|
+State Hub guard approval grants none of it. Source-only integration review and
|
|
+native acceptance matrix: Custodian native-storage-r1/OWNER-REVIEW.md. T14's
|
|
+existing status, UUID, dependencies and native completion gate are retained.
|
|
+
|
|
2026-10-17 refinement: T20 retains the historical durable SQLite source and
|
|
actual disposable LLDAP proof. T21 extracts the completed PostgreSQL source and
|
|
bounded real disposable SQL compatibility proof. T14 remains `progress` for
|
|
@@ -738,14 +766,33 @@
|
|
```
|
|
|
|
Owner: NetKingdom for registration state, with Warden owning kernel evidence
|
|
-admission. Next action: select the exact existing owner evidence holder/readback
|
|
-contract and define authenticated lookup for the original creation attempt.
|
|
-Completion requires restart/lost-receipt fixtures that bind case/source/principal,
|
|
-original created-only provenance and current native revision before any undo;
|
|
-uncertain outcomes remain non-replayable. The T13 adapter deliberately refuses
|
|
-post-restart rollback and installs no reconciliation callback. A new broker or
|
|
-unverified JSON receipt is not a recovery contract. Actual evidence-holder
|
|
-acceptance and attended recovery remain separately authorized native work.
|
|
+admission. T22 records the completed source review and exact existing-seam gaps;
|
|
+T15 retains implementation and authenticated restart/lost-receipt acceptance.
|
|
+Next action: identify the actual owner publisher/authenticator and bounded
|
|
+original-attempt readback contract, and obtain Warden's reviewed original-intent
|
|
+lookup/context interface through existing WARDEN-WP-0044-T03. The current Journal
|
|
+retains attempt identity in historical rows but only hashes evidence references;
|
|
+load drops that context and reconcile passes a fresh attempt to the callback.
|
|
+The adapter's original payload and creation record remain process-local. Neither
|
|
+that journal nor a current matching registry entry reconstructs creation authority.
|
|
+
|
|
+The owner contract must bind the original Invocation, case/type/descriptor/catalog/
|
|
+acceptance pins, source, principal and admitted tenant/realm provenance, separately
|
|
+from the new reconciliation attempt and its independently revoked parent session.
|
|
+Use an existing authenticated holder/readback; Audit Core's custody API is a
|
|
+candidate only until its actual registration source/class, load-bearing emission
|
|
+contract and separate scoped reader are admitted. No new broker or receipt trust
|
|
+root is proposed. A missing original record, ambiguous publication, NO_CHANGE,
|
|
+changed native revision or lost readback stays uncertain; no add replay or undo.
|
|
+
|
|
+Completion requires restart/lost-receipt fixtures against the selected actual owner
|
|
+contract: independently authenticated original created-only provenance, original
|
|
+exact client entry and unchanged current postcreation UID/resourceVersion before
|
|
+any undo, with wrong attempt/case/source/principal and unavailable-holder refusals.
|
|
+The T13 adapter deliberately refuses post-restart rollback and installs no
|
|
+reconciliation callback. Existing source review, JSON receipts and synthetic
|
|
+trust do not satisfy native holder acceptance or authorize attended recovery.
|
|
+Exact remaining owner facts: Custodian native-registration-r1/original-attempt-review.json.
|
|
|
|
## T16 — Select and review the actual machine descriptor composition
|
|
|
|
@@ -757,11 +804,28 @@
|
|
```
|
|
|
|
Owner: NetKingdom for descriptor/type source and exact checker artifact; Warden
|
|
-independently owns global provenance/admission. Next action: obtain review of the
|
|
-exact checker source/artifact proposed by T17 and identify native owner evidence/
|
|
-session callback contracts, then assemble the complete step descriptor set and
|
|
-a proposed explicit type version selection. T13's historical descriptor retains
|
|
-its synthetic checker; T17 supplies an artifact-bound proposal, not admission.
|
|
+independently owns global provenance/admission. T22 records the completed seven-step
|
|
+source1.2 inventory and regenerated register-client descriptor using the delivered
|
|
+checker and current sealed-snapshot source; T16 retains exact owner review,
|
|
+complete descriptor composition and admission. Next action: bind actual native
|
|
+publisher/authenticator, original/current session verification and revocation,
|
|
+executable storage/custody and config pins, then obtain the six missing fixed
|
|
+owner descriptors/adapters for ensure-groups, mint-secret, deliver-secret,
|
|
+bind-env, deliver-consumer-secret and hand-over. The inventory identifies each
|
|
+existing owner seam, exact missing contract and created-only rollback requirement;
|
|
+it is not an executable bundle. T14 and T15 remain independent prerequisites.
|
|
+
|
|
+Review the dedicated consumer source1.2 composition only through the existing
|
|
+explicit version-root selection. Keep canonical1.1/default and its accepted case
|
|
+unchanged, and the source-only acknowledged1.2 reference case proposed without
|
|
+acceptance fields. New descriptor bytes require a reviewed exact successor
|
|
+revision/version under canon section6; they do not inherit historical source
|
|
+acknowledgment. Changed authentication/materialization/trust needs the prescribed
|
|
+informed-decision acknowledgment. Do not insert a partial descriptor map or use
|
|
+--allow-unimplemented preparation as ordinary case/native admission. The registry
|
|
+helper reports restart_required; separately review quiet-window restart/readiness
|
|
+and actual consumer verification rather than infer activation from registry CAS.
|
|
+Exact composition: Custodian native-registration-r1/descriptor-composition.json.
|
|
Completion requires separate owner source review of exact machine descriptors,
|
|
artifact/source/config pins, normal type/version admission and independent
|
|
evidence-verification boundaries. Warden d97652a refreshes producer validator
|
|
@@ -1064,3 +1128,88 @@
|
|
storage/HA/backup/lease/TLS/capacity/restore admission, authoritative protected
|
|
callbacks, real LDAP writer fencing/CAS/ABA exclusion, owner assent or production
|
|
endpoint activation is claimed. Those remain live T14 work.
|
|
+
|
|
+
|
|
+## T22 — Establish registration recovery source gaps and complete descriptor review inventory
|
|
+
|
|
+```task
|
|
+id: NK-WP-0048-T22
|
|
+status: done
|
|
+priority: high
|
|
+```
|
|
+
|
|
+Completed 2026-10-17: source-only owner-contract review and complete review
|
|
+inventory. Inspected the actual registration adapter, Warden Journal/Executor,
|
|
+NetKingdom evidence compatibility checker and Audit Core custody/read surfaces.
|
|
+No existing admitted holder/readback supplies authenticated original-attempt
|
|
+recovery: payload/creation are process-local, persisted evidence references are
|
|
+hashed, and reconcile receives a new attempt without original context. The exact
|
|
+four-owner contract requirements and non-replayable missing/ambiguous cases are
|
|
+recorded; no recovery callback, publisher, credential grant or native trust root
|
|
+was installed. T15 retains implementation and actual acceptance.
|
|
+
|
|
+The complete source1.2 inventory maps all seven follow-through steps to their
|
|
+existing owners, missing exact contracts and created-only rollback requirements.
|
|
+The actual maintained adapter regenerated the sole existing register-client
|
|
+machine descriptor against the delivered 13,633,409-byte checker and current
|
|
+sealed-memfd snapshot source. The checker rehash and Warden Descriptor.decode
|
|
+round-trip passed; six owner descriptors remain absent. Actual source commands
|
|
+render canonical1.1 and explicitly selected1.2 with execution.permitted false;
|
|
+ordinary1.2 case admission still refuses its acknowledged/unimplemented type.
|
|
+Canonical type/case/acknowledgment bytes were hash-checked unchanged. No tests were
|
|
+added or rerun, no native configuration or effect occurred, and no owner assent
|
|
+or complete machine bundle is claimed. T16 retains native executable custody,
|
|
+complete exact descriptors, independent source review and normal version/type
|
|
+admission. This extracted outcome supplies no native gate completion credit.
|
|
+
|
|
+Evidence in the-custodian:
|
|
+`docs/changes/netkingdom-target-2026-10-17/native-registration-r1/`, especially
|
|
+original-attempt-review.json, descriptor-composition.json, source-verification.json,
|
|
+source-manifest.json and manifest.json. The prior sixteen-gate audit remains
|
|
+immutable. Publication, normal task UUID allocation and projection are separate
|
|
+coordinator follow-through; no Hub UUID is assigned by this source record.
|
|
+
|
|
+
|
|
+## T23 — Review native journal package assignment and storage integration boundaries
|
|
+
|
|
+```task
|
|
+id: NK-WP-0048-T23
|
|
+status: done
|
|
+priority: high
|
|
+```
|
|
+
|
|
+Completed 2026-10-17: source/package placement and protected integration review
|
|
+only, separate from T21's completed PostgreSQL source and disposable-SQL proof.
|
|
+The owner review recommends a dedicated independently rolled-back
|
|
+`rapp-identity-provisioner`, owned by NetKingdom on rail-kubernetes, with a
|
|
+schema-valid draft declaration and no reef binding. No repository, registry
|
|
+entry, native package assignment or owner assent was created. Existing
|
|
+rapp-user-engine ownership/token delivery does not assign it the provisioner.
|
|
+
|
|
+The complete current rapp-postgres catalog has six declared consumers: four on
|
|
+platform-pg and two on platform-pg-2. The inert renderer-valid provisioner
|
|
+candidate fits platform-pg-2 at three of four, requesting one migration plus
|
|
+four runtime connections; placing it on the first cell is refused as a fifth.
|
|
+Normative package schema and full-catalog capacity/render checks passed. The
|
|
+four-consumer ceiling is estimated, not measured native headroom, and no current
|
|
+SQL session, backup or restore acceptance is claimed.
|
|
+
|
|
+The exact review identifies remaining package/substrate, SQL role/lease/TLS,
|
|
+network and backup/recovery contracts; independently authenticated protected
|
|
+scope callbacks; an external content-bound checkpoint holder with atomic
|
|
+advance/loss handling; and all-LDAP-writer exclusion or provider CAS/generation,
|
|
+including lifecycle cascades and remove/readd ABA. Generic Audit custody is not
|
|
+that checkpoint service. A database-only fence, final reread or one replica
|
|
+cannot exclude foreign directory writers. The native acceptance/recovery matrix
|
|
+keeps storage/lease admission separate from separately approved directory
|
|
+mutation; the production activation remains disabled pending trusted integration.
|
|
+
|
|
+Evidence in the-custodian:
|
|
+`docs/changes/netkingdom-target-2026-10-17/native-storage-r1/OWNER-REVIEW.md`,
|
|
+source-validation.json and hash-bound source-references.json, plus the inert
|
|
+proposed declaration/consumer and renderer outputs. No native resource, lease,
|
|
+credential, deployment, destructive effect, independent holder or native owner
|
|
+acceptance was delivered. T14 retains these live gates with its original UUID
|
|
+and progress status. This completed review adds no duplicate T21 acceptance
|
|
+credit; publication, task UUID allocation and projection remain coordinator
|
|
+follow-through and no UUID is hand-assigned here.
|