the-custodian/docs/netkingdom-target-implementation.md

NetKingdom target implementation record

Coordinator: CUST-WP-0080. Target: security architecture. Started 16 October 2026 under the founder's explicit implementation and GPT-6.1-Sol medium subagent request. The full architecture remains the goal.

Work ownership and current status

Gate	Existing implementation owner	Current evidence state	Next deliverable
TSA-01	Secrets Engine / Access Engine; SECRETS-WP-0014, FLEX-WP-0024	Producer signing, strict consumer verification and fixed-verifier packaging source integrated; actual local serve-to-consumer proof passed	Independently admit package/keys/policy and verify native rollout
TSA-02–03	Platform / Secrets / Approval; RPF-WP-0035-T12, SECRETS-WP-0013, APPROVAL-WP-0002/0004	Strict handoff and durable consume/confirm/effect seam integrated; actual local source servers and disposable OpenBao path passed	Exact effect baseline/readback and recovery acceptance, then governed native admission
TSA-04	NetKingdom / Mason / Warden / KeyCape; NK-WP-0048	Browser evidence checker, Warden pinned metadata validation and Mason versioned source selection published	Admitted machine descriptors, real owner receipts and consumer acceptance
TSA-05	KeyCape / User / NetKingdom / Playwright; KEY-WP-0040, NK-WP-0050, CUST-WP-0080-T05	Native human and agent journey gates open	Actual recovery and browser consumer acceptance
TSA-06	Glas / Sand-boxer / rein / Platform / Forge; CUST-WP-0073, GLAS-WP-0012	Workload-only credential delivery published; disposable bwrap proof reproduced; actual assignment and runner proof open	Admitted corrected runtime, combined rein acceptance and actual assignment migration
TSA-07–08	Secrets / NetKingdom / Platform; NK-WP-0049 and existing lifecycle plans	Inventory/lifecycle incomplete; actual independent identity archive recovery verified 16 October	Complete service authentication, existing-token decryption and audit continuity; metadata denominator, elimination candidates and lifecycle receipts
TSA-09	Audit / emitting owners; Approval T04 and current Audit work	Delivered custody; current source admission/reconciliation incomplete	Source/effect/outbox/receiver readback for first protected operation
TSA-10	Forge / Repo Manager; FORGE-WP-0006, RMGR-WP-0021	Broad receive coverage delivered; other paths and response incomplete	Coverage/reliability gaps and private response acceptance
TSA-11	Reuse / provider owners	70/70 discovery verified 15 October; stale descriptive fields remain	Correct source metadata and repeat drift/hosted checks
TSA-12	Activity / Coordination / Custodian; CUST-WP-0079	Schedule accepted but unassisted activation not proven; cadence source adoption underway	Actual activation and first independent observation
TSA-13–14	NetKingdom / provider owners	Accepted reusable integration and second installation pending	Shared adapter conformance and minimal locked profiles
TSA-15	Resource / telemetry / consumer owners; CUST-WP-0071 where applicable	Optimization baseline incomplete	Comparable latency, effort, resource and scanner measurements
TSA-16	Custodian / governance and owner records	Governing records exist; target-wide evidence reconciliation open	Requirement-by-requirement closure audit under CUST-WP-0080-T04

Each entry summarizes an owner obligation; it does not copy or replace that owner's task list. The original requirement ledger and owner receipts retain their original scope and outcomes.

Delegated implementation wave

The founder requested model gpt-6.1-sol, reasoning effort medium. The coordinator dispatched these concrete child assignments using that configuration:

Handle	Owner role	Source scope	Artifact directory
/root/decision_auth	secrets-engine	Signed decision enforcement, existing SECRETS-WP-0014	docs/changes/netkingdom-target-2026-10-16/decision-auth/
/root/protected_execution	railiance-platform	Task execution journal/cleanup, RPF-WP-0035-T12	docs/changes/netkingdom-target-2026-10-16/protected-execution/
/root/browser_case	net-kingdom	First browser case verification/integration, NK-WP-0048-T06	docs/changes/netkingdom-target-2026-10-16/browser-case/
/root/warden_browser	ops-warden	Exact producer validation on browser admission, WARDEN-WP-0044-T03	docs/changes/netkingdom-target-2026-10-16/warden-browser/
/root/agent_isolation	glas-harness	Scope credential delivery to actual workloads, GLAS-WP-0012	docs/changes/netkingdom-target-2026-10-16/agent-isolation/
/root/approval_reference	approval-engine	Atomic authenticated consuming identity and act/PDP evidence, APPROVAL-WP-0004	docs/changes/netkingdom-target-2026-10-16/approval-reference/
/root/access_verifier_review	access-engine	Producer compatibility review and actual signing path, FLEX-WP-0024	docs/changes/netkingdom-target-2026-10-16/access-verifier-review/
/root/mason_browser	ops-mason	Correct versioned browser type source resolution	docs/changes/netkingdom-target-2026-10-16/mason-browser/

Each child reads the assigned owner's instructions and intent. Prepared changes use isolated temporary checkouts based on current owner source, with relevant pre-existing tracked changes retained. Exact patches, source hashes and tests support coordinator review before integration. A child reviews only its own owner role; independent cross-owner reviews require separate assignments.

The table records assignment history, not perpetual liveness. All eight owners delivered initial source packages. Secrets and Access are implementing the trusted service task path and preparing native package/trust/caller admission. Platform delivered exact effect readback and process-loss cleanup recovery in disposable OpenBao; the trusted successor adds absolute execution budgets. Approval delivered the shared claim adapter and is reviewing its authenticated consumer integration. Exact revisions and publication caveats are in the source wave receipt; independent tests and retained failures are in the coordinator review. Raw patches and temporary reconstructions are workspace-local review artifacts; the published owner commits are the durable source.

Published owner source	Change	Independent verification
NetKingdom c31d21ba	Browser evidence checking without native acceptance inference	103 tests
Warden 95835208	Exact pinned producer and parameter-schema validation	102 tests
Glas 7357115c	Credentials delivered only to explicit workloads	141 tests and actual disposable bwrap denial/redaction/teardown
Platform 59d1441c, 99fd21ee, d042d468	Durable cleanup, disposable native adapter and immutable grant projection	Successive suites: 73, 83 and 122 tests; counts overlap
Secrets c80a9441	Strict producer-type signature verification with independent trust configuration	125 focused tests and producer provenance check
Access ec21518e	Actual serving path signs before recording; inert chart configuration	Real local serve-to-Secrets verification; unsigned, tampered and unsafe key-file cases refused
Approval 477c6839	Atomic consuming-service identity and bound act/PDP audit fields	44 tests
Mason 57411f25	Explicit versioned type-source selection in all CLI commands	50 tests

The subsequent published revisions are Secrets ebca4f5 (fixed-verifier release bundle) and ff1a13d (strict task handoff), Platform e2b832b (journaled consume/confirm seam), and Approval eece796 (canonical consumed-act comparison). Normal owner publication and reconciliation succeeded; exact receipts retain remaining historical warnings. Independent combined Secrets verification passed 133 focused tests and seven packaging tests. Platform passed all 130 tests, then eight affected tests passed with the final Approval client; that client separately passed 36 tests.

Normal owner publication succeeded for every listed revision. Platform's scanner ref race and Access's first State Hub timeout were retried successfully. Mason's unrelated pre-existing workplan edits prevent an exact whole-repository hub revision claim. Generated-only writeback refusals were retained without bypass. Secrets' normal scanner initially flagged two public UUID identifiers; clearer constant names preserved their values and passed the unchanged scanner.

These are bounded source/backend proofs. Synthetic approvals and grants do not establish production consumption or isolation of this interactive assignment. The actual service-pilot policy still denies runtime admission. The missing strict Secrets handoff now binds the signed decision, approval, exact grant and caller; Platform reserves durably, journals consumption and independently confirms it before effects. Actual Access and Approval servers passed this path with explicit synthetic identity/key/policy admission. Denied confirmation leaves uncertainty and permits no native effect. Six successful native calls alone do not establish complete expected-state readback; the following source slice adds that proof. Both Secrets and Approval now compare the existing canonical native digest, refusing Python's boolean/integer equality ambiguity. The original counterexample and intermediate test failures remain recorded.

This wave authorizes source implementation and preparation under the user goal. It grants no runtime credential scope or automatic native acceptance. Required owner checkout filesystem approval is distinct from authority to change live trust or credentials. No agent inherits another assignment's autopilot grant.

Subsequent source integration, 16 October

Platform d870596 binds canonical before/after metadata snapshots through the existing descriptor commitments, checks each baseline before its target write, and verifies complete readback before recording success. Independent native fixture/mediator/readback suites passed 32 tests. This is sequential observation: there is no atomic native CAS or concurrent-writer exclusion. Partial application remains unknown, and cleanup confirmation stays separate. Its whole-stack positive proof is pinned to Access ec21518e; later Access source deliberately removes the generic task path used by that old synthetic fixture.

Access 919ce25 fixes explicit caller-audience rendering and source revision pinning, records the existing workload identity, and adds an offline native receipt verifier using the installed Secrets verifier. Root review reproduced boolean/integer and integer/float source-record equality mistakes; R2 checks exact JSON types and hashes the same bounded bytes it verified. Nine receipt tests and two runtime-twin tests passed independently. Missing managed package declaration, signer custody and native image/trust admission remain explicit.

Secrets 5a2099f records the exact native CLI preparation, verified canonical release bundle, configuration and trust inputs. The initial serving denominator is 11 authorization sites across 10 handlers; native effect acceptance is zero. Root verified unchanged runtime AST except documentation. The empty-key template is intentionally unusable until independently admitted owner inputs exist.

Approval 3485415 supplies a producer-owned Go fact adapter and authoritative claim vectors. Root passed its Go suite, two producer-vector tests and 14,114 actual Python canonical-byte/digest comparisons. This is shared validation code, not another evaluator or credential transport. Access B1 R2 4f6946b connects the actual HTTP caller join, preserves the submitted context and withholds accidental ALLOW until the trusted source path exists. All three affected Go packages passed independently; a malformed nested-duplicate test was corrected and rerun. These two commits' publication/reconciliation state is recorded in the source receipt.

The trusted Access v2 successor, refreshed strict Secrets handoff and signer-custody proposal remain separate review packages. Access's actual Approval API fixture and signed ALLOW/refusal evidence are source proofs; the complete new consumer-to-Platform path and native issuer, key, workload, grant, recovery and independent audit acceptance remain necessary. Recovery review rejected broad 404 absence and unauthenticated stored accessor claims. Revised Platform b9eaa20 passed 53 independent tests and adds authenticated private accessor custody and separately admitted cleanup after executor loss, without restoring business or consumption authority. Lost issuance before accessor persistence remains unresolved. Actual custody/key isolation and recovery grants remain unadmitted.

Whole-stack successor work exposed a temporal contradiction: the first v2 source allowed 15 seconds while native token lifetime requires at least 30 seconds plus cleanup reserve. Integrated Access 2b064ee now binds expiry to the exact operation deadline within declared hard limits and all original/fresh/caller authority. Its signed, claim-free DENY supplies producer-evaluated approval facts under the existing enrichment contract; Secrets 4dd004a verifies them before approval preparation. This receipt grants no execution authority. Final evaluation refuses registry drift instead of silently changing an approved request. Exact producer numeric types survive verification and recording without a copied normalizer.

Approval d40e842 preserves fractional time and uses one post-lock timestamp for validity, consumption and its outbox event. The immediate path needs no sleep, backdating or consumer tolerance. Independent verification passed all seven affected Access Go packages, 193 focused Secrets tests and 98 Approval tests. Platform 76fdc0b adds absolute call/operation/credential deadlines and exact source-byte checks; 28 independent tests passed. Platform 7be8b6e adds the complete successor proof: all eight independent tests passed using real local Access and Approval services, retained registry, strict Secrets verification and disposable OpenBao. The positive case verifies six native calls, complete readback, cleanup and signed source-record parity; refusal cases preserve zero effect. These use synthetic admission and do not establish production acceptance. All sixteen target acceptance gates remain open.

The independent identity archive recovery receipt now proves artifact integrity, original key pairs, SQLite integrity, native PostgreSQL restore and cleanup. It explicitly does not prove full service authentication, existing-token decryption or audit signature continuity. Reuse that completed archive proof and drive the remaining native service recovery; TSA-08 remains open.

Coordinator review independently reproduced a second timestamp failure in the canonical Approval Engine: a fractional expiry at .500 was consumed at actual clock .750, while consumed_at reported the whole second. The isolated counterexample is retained alongside the verified repair in d40e842; expiry remains exclusive, including when the database lock is acquired after the deadline. The original publication scanner refusal is also retained: the Approval owner labeled seven public SHA-256 references explicitly, preserving digest bytes and review meaning. The unchanged scanner then passed all six committed files.

The same Platform revision includes a bounded signer custody primitive and an explicitly proposed custody design. Twelve independent tests passed against disposable OpenBao. Exact KV CAS/readback, a private durable receipt before effect and retained uncertainty are source properties. Production execution deliberately remains unavailable pending an admitted adapter, independent owner reviews and the exact custody decision. No key, credential grant or live deployment was made.

Next native admission work

Use existing owner paths and retain the deployed lifecycle policy while preparing the first native acceptance package. The task-execution pilot remains unadmitted.

The next four source slices are published and their committed file hashes match the reviewed receipts: Access 0a05383 (bounded durable outbox and process locking), Warden d79f065 (attended administration routing), Secrets 3718e60 (reproducible CLI release and admission requirements), and Platform a3e8eb6 (phase-aware attended signer adapter). Independent checks passed the Access race/chart suites, 135 Warden tests and 56 Platform tests. Secrets' two release builds were identical; a clean offline installation and pre-credential trust refusal passed. These are source and isolated-runtime proofs, not production admission.

The installed Warden CLI now matches the reviewed routing module and preserves phase-memory. Its actual plan selects openbao-platform-admin-login, with founder_required and oidc_login. The previous routing defect is resolved; the attended identity act and exact custody proposal remain required.

Access's new canonical local thin package is committed at d52f811 with the reviewed thirteen-file tree. The exact local resolver identifies rapp-flex-auth-secrets-engine / flex-auth-secrets-engine / flex-auth-secrets-engine, owned by Access and still draft. Family review passed; the global check retains the pre-existing Forgejo declaration error and reef warning. Remote publication, central onboarding, placement and runtime admission remain separate. Its frozen extraction source/image do not activate the signer.

The normal Access image run400 published source 0a05383, then failed during receipt parsing because the runner lacks Python. Public package metadata and the run's push/pull evidence identify the published digest and exact revision; the failed run remains failed. Access 84c78e0 replaces that parser with existing Bash/Docker facilities, verifies the pulled revision label, and records the local package reference. Three independent publisher tests pass. Normal source publication and synchronization passed. Ordinary publisher run402 and both smoke jobs in run401 succeeded for exact 84c78e0; independent public package metadata confirms image sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f and its revision label. The independent image review retains this evidence separately from failed run400. No deployment follows automatically.

Audit 64509d2 defines the first pin's admission and complete-ledger reconciliation using existing receiver APIs. Independent root checks passed 17 tests plus the canonical cross-owner fixture; one isolated-checkout skip is retained. Bounded reconciliation requires independently retained complete producer ledger bytes, every-ID readback and all-class acceptance-time counts, with concurrent boundary arrivals settled. Selected successful IDs are insufficient. The initial signer slice keeps audit delivery disabled; periodic independent custody, final per-pin cadence, receiver admission and runtime observation remain required.

• Access owns an immutable image, signer projection, retained caller binding and durable outbox. Metadata inspection found no existing namespace PVC. A proposed 1 GiB local-path claim is new storage; its requested capacity is not a filesystem quota. OS-enforced single-writer locking, bounded append/startup and fail-closed storage failure behavior are published in the existing outbox. Recreate with one pod alone does not establish those properties.
• Platform owns proposed CCR-2026-0050 for the exact read lane, separate attended signer writing, fencing and private recovery receipts. Native role naming must satisfy the real delegated-applier policy. The installed Warden plan now selects the required admin-login route. The phase-aware writer preserves metadata-only and seed-write uncertainty; recovery is read-only and cannot authorize replay.
• Secrets owns the release bundle, fixed verifier, independently admitted public trust and actual caller delivery. Clean installation and lifecycle ALLOW/DENY capture are preparatory evidence; they do not establish effects at the inventoried eleven privileged call sites across ten handlers. Those effects remain unaccepted.
• The retained Access tuple now resolves against its committed local declaration. Resolve availability for each actual admission consumer separately; a local checkout does not establish central registration, placement or runtime trust. Native audit receiver reconciliation also remains required.

The source wave receipt records exact publication and synchronization results. Temporary review checkouts and agent handles remain preparation artifacts, not runtime deployments.

Two preparation dependencies are now simplified in published source. Access dc04202 permits exactly zero or one outbox writer through the ordinary Helm chart, removing the separate hand-derived stopped manifest. Both charts reject unsafe replica values; 86 actual Helm render cases and the existing outbox suite pass. The chart successor explicitly retains the independently verified 84c78e0 image; chart and binary revisions remain distinct.

Platform 84c529f replaces the conflated cluster/GitOps reviewer with the exact runtime/storage owner. Access owns workload and Helm release changes; Platform owns existing GitOps Applications and their sync/freeze integration; cluster owns runtime, headroom and storage review. Enablement participates if an actual controller installation change is proposed. Independent checks passed 45 native preparation tests and 54 overlapping cluster custody tests. The focused CCR validates but remains proposed with unconfirmed claims. A normal scanner refusal on ambiguous public image references was corrected with complete typed OCI references; the unchanged scanner then accepted all six files. The full CCR validator retains unrelated baseline CCR0035 errors.

Both commits have verified publication and normal synchronization receipts. Cluster's own review record was published as RCLUSTER-WP-0017. Its source-only review accepts the exact Platform role correction. The sync prefix warning is a reporting defect: ADR-007 explicitly assigns RCLUSTER-WP, while the checker infers the retired prefix from the historical file majority. Existing identifiers and UUIDs remain correct and unchanged. This review grants no native action. Frozen rollout R1 and custody P2 remain historical preparation; their successors must bind the new source revisions and distinct owner scopes. The coordinator checks retain the source proofs separately from deployment acceptance.

Dependency and residual handling

The current implementation demand selects necessary target dependencies for owner review and scoped promotion. APPROVAL-WP-0002's exact issuer/provenance, audit and served-PEP obligations are required; its residual label must be reconciled by its owner before implementation dispatch. This does not activate every residual security plan or the deferred exposure rotation.

Cross-owner waits attach to the existing project driver where one exists, or a derived cross_owner_wait case benefiting CUST-WP-0080. The dispatched child handles establish current execution, not a separate fleet wake service. If a child is terminal, record its deliverables and dispatch the next reachable owner task; never report a stale handle as running.

Evidence and completion rules

For each change record the original owner revision, pre-existing dirty-state digest, exact patch, focused tests, independent review, integrated revision, publication and native acceptance separately. Bind each native receipt to target, identity, scope, source/image/config revision, expected result, negative cases, cleanup and rollback. Preserve failures and unverified outcomes.

The coordinator reviews evidence against every TSA gate and the named owner requirements. It may record partial source delivery without closing a native gate. Work continues until the target's complete exit condition holds. The first wave is implementation progress, not the completion boundary.