68 lines
4.5 KiB
Diff
68 lines
4.5 KiB
Diff
--- a/workplans/NK-WP-0048-security-case-types.md
|
|
+++ b/workplans/NK-WP-0048-security-case-types.md
|
|
@@ -323,7 +323,7 @@
|
|
```task
|
|
id: NK-WP-0048-T06
|
|
status: wait
|
|
-depends_on: [NK-WP-0048-T05, NK-WP-0048-T08, NK-WP-0048-T09, NK-WP-0048-T12, NK-WP-0048-T13, NK-WP-0048-T14, NK-WP-0048-T15, NK-WP-0048-T16, MASON-WP-0010-T03, WARDEN-WP-0044-T03]
|
|
+depends_on: [NK-WP-0048-T05, NK-WP-0048-T08, NK-WP-0048-T09, NK-WP-0048-T12, NK-WP-0048-T13, NK-WP-0048-T14, NK-WP-0048-T15, NK-WP-0048-T16, NK-WP-0048-T17, MASON-WP-0010-T03, WARDEN-WP-0044-T03]
|
|
blocking_reason: "Type1.2 architecture has a confirmed source-only founder acknowledgment; canonical1.1 remains unchanged/default and the1.2 reference case stays proposed. Needs explicit version selection/reference-source integration without normal admission bypass, closed owner adapters plus global/native receipt verifier (WARDEN-WP-0044-T03), independently verified six-object structural materialization and CCR42 claims/created-only provenance, exact broker/case/source reconciliation, then separately authorized native mint/delivery and attended registry/consumer verification. Source acknowledgment, a bundle or local tests do not prove implemented/materialized/live status."
|
|
priority: high
|
|
state_hub_task_id: "d9b26bcf-a7c6-59a2-92a0-f913d76a203c"
|
|
@@ -734,10 +734,11 @@
|
|
```
|
|
|
|
Owner: NetKingdom for descriptor/type source and exact checker artifact; Warden
|
|
-independently owns global provenance/admission. Next action: identify the exact
|
|
-reviewed checker executable artifact and native owner evidence/session callback
|
|
-contracts, then assemble the complete step descriptor set and a proposed explicit
|
|
-type version selection. T13's retained descriptor pins a synthetic checker only.
|
|
+independently owns global provenance/admission. Next action: obtain review of the
|
|
+exact checker source/artifact proposed by T17 and identify native owner evidence/
|
|
+session callback contracts, then assemble the complete step descriptor set and
|
|
+a proposed explicit type version selection. T13's historical descriptor retains
|
|
+its synthetic checker; T17 supplies an artifact-bound proposal, not admission.
|
|
Completion requires separate owner source review of exact machine descriptors,
|
|
artifact/source/config pins, normal type/version admission and independent
|
|
evidence-verification boundaries. Warden d97652a refreshes producer validator
|
|
@@ -746,3 +747,40 @@
|
|
change. Platform owns structural/mint/broker/delivery evidence; Apps owns actual
|
|
consumer login/group enforcement. Neither their assent nor native acceptance is
|
|
supplied by this task.
|
|
+
|
|
+## T17 — Build and exercise the exact offline config-checker artifact
|
|
+
|
|
+```task
|
|
+id: NK-WP-0048-T17
|
|
+status: done
|
|
+priority: high
|
|
+```
|
|
+
|
|
+Completed 2026-10-16, isolated artifact/source fixture proof only. Built the
|
|
+existing `key-cape/src/cmd/keycape` command from published clean source revision
|
|
+`3c71226a1a7b8a2bdb710e9c497e1a1f7f8a3987`, source tree
|
|
+`f0010b9cab17dbc3a787628a29657d98b900320f`, with cached Go 1.23.0,
|
|
+CGO disabled, Linux/amd64 v1, trimmed paths, disabled VCS stamping and offline
|
|
+read-only module selection. The full retained closure pins 108 source files,
|
|
+9876 toolchain files and ten used module source directories. Three isolated
|
|
+build locations produced identical 13633409-byte artifacts:
|
|
+`sha256:be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5`.
|
|
+
|
|
+Eight disposable checks use the actual executable and maintained helper/kernel,
|
|
+with complete synthetic configs and a minimal environment: add/created-only
|
|
+removal, normal pinned producer admission, rollback, lost-readback uncertainty,
|
|
+stale revisions, substituted checker refusal, invalid startup config and missing
|
|
+secret-env refusal. No checker stub or producer-pin override remains. The
|
|
+artifact-bound descriptor proposal is
|
|
+`sha256:76b1153d188062ece53fcd5e8d35290fdbfd02a69dd79d4b001fc42781afcdc3`.
|
|
+Evidence: Custodian
|
|
+`docs/changes/netkingdom-target-2026-10-16/browser-checker-artifact-next/`.
|
|
+The first two build attempts succeeded but their closure collection failed;
|
|
+both failures are retained, as is refusal of the older incomplete synthetic
|
|
+fixture. No production config, credentials or cluster mutation was used.
|
|
+
|
|
+This extracts completed build/fixture scope from T16 without claiming KeyCape
|
|
+owner endorsement, native checker selection/storage custody, acknowledged type
|
|
+integration, native evidence/session callbacks or attended browser acceptance.
|
|
+T16 retains exact owner review and composition/admission scope. The attended
|
|
+registration procedure remains unexercised.
|