44 lines
4 KiB
JSON
44 lines
4 KiB
JSON
{
|
|
"reviewer": "railiance-platform-owner (agent railiance-platform, codex)",
|
|
"decision": "approved",
|
|
"owner_work_item": "RPF-WP-0035-T12",
|
|
"review_scope": "Source-only deterministic cleanup Plan binding and disposable native OpenBao adapter. Native fixture proof is not production admission.",
|
|
"comment": "Platform INTENT Secure Custody, Stable Interfaces and Durable by Default support fixed owner-held ephemeral native execution and explicit uncertain outcomes. Reviewed exact modified file hashes below. The adapter admits only a live owner-spawned disposable loopback dev process, has no production caller and creates no source authority from synthetic approval/grant/state inputs. This source review does not grant human approval or native production acceptance.",
|
|
"reviewed_files_sha256": {
|
|
"docs/task-execution-native-fixture.md": "7de76b6e2d6e7ae02191cfb970c787c0e541387323d7292d32847e2e4e09e687",
|
|
"scripts/task_execution_journal.py": "e13c21a7649321ab8ba2748ae6bd704e55c0802ea2c936317d312e0479dc060d",
|
|
"scripts/task_execution_native_fixture.py": "f335a8fd7d9a156b136a3465b3aaa9144d23475fc4b1fea52b54b89880d92b29",
|
|
"scripts/task_execution_plan.py": "f799a6320e92722c0cbe452f58ac793b55da47f97938efe7f1de851231849d37",
|
|
"tests/test_task_execution_cleanup_calls.py": "b74d417827b73a73fbe93d5e11a196014d772fe3ff0e3c06c9327eef34062b17",
|
|
"tests/test_task_execution_journal.py": "b51a4f5b8122221c69ad2486d6e1751298bd4665ac37c94f363dd5a27c5a014c",
|
|
"tests/test_task_execution_native_fixture.py": "a973b4873f6313ea2a7dca56b71a31a693dbd5d2022e2e2dbf793b8c9edd46ab",
|
|
"tests/test_task_execution_plan.py": "679bfe0450e7975b8ad6747cd210afce1de33da54acdf64bc9f00b3603772b95",
|
|
"workplans/RPF-WP-0035-credential-lane-implementation.md": "24b2ef20eba123c511575ec4694b26dcc8f4c5854fe6a4a30dd24cd0ae784e60"
|
|
},
|
|
"patch_sha256": "c419ac0f6dba3e36f15dc51a6a36fbd87fe7d255cce40c33c7f4589d80355580",
|
|
"base_local_commit": "774cf8755ef429ada616d993b3df8fa1b44fe177",
|
|
"first_package_files_exactly_preserved_as_base": true,
|
|
"independent_from_implementation": false,
|
|
"production_admission": "changes_required",
|
|
"minimal_grant_work": {
|
|
"existing_type": "task-execution-grant (already proposed by Platform/Secrets contracts; not admitted in current CCR validator)",
|
|
"existing_descriptor_join": "execution_grant_ccr_id + grant_immutable_sha256; no new engine descriptor field/schema",
|
|
"immutable_projection": "Define exact CCR immutable fields and exclude only explicitly owner-defined append-only reviews/evidence; never exclude policy/token/body/target/deadline/source/cleanup bytes.",
|
|
"binding_contents": [
|
|
"operation/action/actor/catalogue/tenant and target CCR immutable identity",
|
|
"owner-admitted origin/cluster and exact source revisions",
|
|
"six generated metadata method/path/body commitments and native before/after state expectations",
|
|
"exact generated per-operation grant ACL, parent custody, nonrenewable no-default/no-identity policy TTL/use constraints and reserved cleanup use",
|
|
"Compiler cleanup_specs(operation_id), including fixed credential slots, revoke/verify and delete/verify sequence plus explicit no-issue/no-create branches",
|
|
"business deadline and separately retained cleanup obligation; no arbitrary token/accessor handles in record"
|
|
],
|
|
"validation": "Validator reconstructs every generated field from owner sources and compares; mediator checks authoritative grant immutable digest against exact admitted descriptor before reserve/consume/native requests."
|
|
},
|
|
"other_open_gates": [
|
|
"Authenticated initiating identity and independent claim/PDP/package/signed consume confirmation",
|
|
"Owner runtime origin/source/isolation and granted protected custody",
|
|
"Complete native baseline/readback normalization and concurrency/conflict handling",
|
|
"Trusted per-call served deadline/accounting plus audit outbox and protected crash recovery",
|
|
"Exact founder-scoped attended production trial and owner-native acceptance"
|
|
]
|
|
}
|