246 lines
11 KiB
JSON
246 lines
11 KiB
JSON
{
|
|
"objective": "Finish what you found missing and finish CUST-WP-0080",
|
|
"status": "active",
|
|
"observed_at": "2026-10-18T09:38:12.862654+00:00",
|
|
"full_scope_baseline": {
|
|
"path": "docs/changes/netkingdom-target-2026-10-18/cust80-completion-r1/completion-audit.json",
|
|
"sha256": "sha256:9bdee9a790db598956fe35d5954137bb4582c9f3810d2392f7ef3236c369b065",
|
|
"all_requirements_retained": true
|
|
},
|
|
"normative_architecture": {
|
|
"path": "docs/netkingdom-target-security-architecture.md",
|
|
"sha256": "ec2079be18c7cdb8a1e4fdbd22131c08c83721d7a1bf18b4802bc5e229520f35"
|
|
},
|
|
"acceptance_gates": [
|
|
{
|
|
"id": "TSA-01",
|
|
"required_outcome": "Every inventoried privileged PEP authenticates its decision",
|
|
"required_evidence": "PEP denominator; admitted signer/channel; forged, altered, wrong-key/pin, unsigned/downgrade, expired and rotation refusals. Start SECRETS-WP-0014.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-02",
|
|
"required_outcome": "Exact approval produces one bounded protected operation",
|
|
"required_evidence": "SECRETS-WP-0013/RPF-WP-0035-T12 native effect; Approval T01/T05 issuer/tenant provenance; wrong actor/tenant/body, expiry, replay and unavailable refusal.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-03",
|
|
"required_outcome": "Crashes preserve uncertainty and cleanup",
|
|
"required_evidence": "Actual ledger restart/concurrency, consumed-before-effect failure, target reconciliation, scoped cleanup and revocation evidence; no blind replay.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-04",
|
|
"required_outcome": "First reusable browser case is accepted",
|
|
"required_evidence": "NK-WP-0048 and named Mason/Warden/KeyCape adapters; independent native structure, sign-in/denial, delivery, revocation and rollback.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-05",
|
|
"required_outcome": "Human and browser consumers can use the delivered identity",
|
|
"required_evidence": "KEY-WP-0040/U08 real-factor recovery; User Engine journey; NK-WP-0050 and CUST-WP-0080-T05 human/agent Playwright acceptance.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-06",
|
|
"required_outcome": "Actual agent and runner authority is bounded",
|
|
"required_evidence": "CUST-WP-0073/GLAS-WP-0012 admitted runtime read-denial/tool-effect proof; Forge/Platform per-job credential and repository-workflow abuse tests.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-07",
|
|
"required_outcome": "Credential lifecycle is inventoried and simplified",
|
|
"required_evidence": "Current owner/consumer denominator, unknown/orphan findings, native-identity elimination candidates; sampled replacement/adoption/old-refusal and deletion semantics. G04/G09/G12.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-08",
|
|
"required_outcome": "Recovery is independent and measured",
|
|
"required_evidence": "NK-WP-0049 plus platform/root owners; isolated recovery with ordinary issuer unavailable, restore/reconnect/audit continuity and measured RTO/RPO. G08/G11.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-09",
|
|
"required_outcome": "Security effects have independently reconciled evidence",
|
|
"required_evidence": "Admitted source/class inventory, atomic outbox, receiver readback, lag/duplicate/boundary accounting and missing-class findings. Approval/Audit/Tenant/Secrets owners.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-10",
|
|
"required_outcome": "Source and delivery controls cover declared entry paths",
|
|
"required_evidence": "FORGE-WP-0006/RMGR-WP-0021: denominator, SSH/HTTP/UI/new repo/import/mirror coverage, required checks/provenance, private synthetic finding through resolution.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-11",
|
|
"required_outcome": "Discovery remains accurate",
|
|
"required_evidence": "All reviewed IDs exactly once, owner/index parity, usable source links, current limits/version aliases, drift checks and package-family disposition. Reuse/Repo Manager/provider owners.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-12",
|
|
"required_outcome": "Improvement operates without repeated manual polling",
|
|
"required_evidence": "CUST-WP-0079/Activity accepted schedule, unassisted firing, checkpoint and changed-state notifications; adopted cadence runtime/receiver receipts; owner change and native remeasurement.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-13",
|
|
"required_outcome": "Shared adapters reduce per-consumer implementation",
|
|
"required_evidence": "Producer-format cross-language fixtures, two real consumers, version compatibility, denied-path parity, upgrades and rollback; no second PDP.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-14",
|
|
"required_outcome": "Minimal profiles are independently reusable",
|
|
"required_evidence": "Version/provider lock, dependency and optional-provider declaration, provider adapters, second clean installation, complete positive/negative journeys and upgrade/recovery instructions.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-15",
|
|
"required_outcome": "Optimization improves measured operations",
|
|
"required_evidence": "Baseline and repeat measurements of onboarding time/touches, p50/p95 decision/effect latency, scanner throughput/failure, resources/headroom and owner effort with unchanged control coverage.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-16",
|
|
"required_outcome": "Governance and exceptions remain truthful",
|
|
"required_evidence": "Existing SEC-DSM ledger and close-down controls reconciled to exact evidence; real authority for changes, explicit residual promotions, preserved deferrals and no invented owner assent.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
}
|
|
],
|
|
"sec_dsm_requirements": {
|
|
"path": "docs/evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json",
|
|
"sha256": "sha256:ad81f7186ada04aa1cc410932fc8669d69dc2232f3c0be00657b17f3aa3a8184",
|
|
"count": 116,
|
|
"status_counts": {
|
|
"unverified": 84,
|
|
"incomplete": 12,
|
|
"reference": 20
|
|
},
|
|
"closure_status_unchanged": true
|
|
},
|
|
"gap_ids": [
|
|
"G01",
|
|
"G02",
|
|
"G03",
|
|
"G04",
|
|
"G05",
|
|
"G06",
|
|
"G07",
|
|
"G08",
|
|
"G09",
|
|
"G10",
|
|
"G11",
|
|
"G12",
|
|
"G13"
|
|
],
|
|
"separate_required_deliverables": [
|
|
"G01-G13 current closure evidence or already applicable approved exceptions",
|
|
"SEC-DSM requirement ledger reconciled with exact evidence",
|
|
"T05 real human and agent Playwright acceptance and supported discovery",
|
|
"Second real consumer and clean installation proves reuse",
|
|
"Residual handoffs before workplan finish; no required work left only in prose"
|
|
],
|
|
"source_progress": {
|
|
"packet": "docs/changes/netkingdom-target-2026-10-18/forgejo-postgres-source-r1",
|
|
"producer_source_commit": "git:ca0cb75729a63c9288b7333382d0fa3eb1e8c9a3",
|
|
"consumer_owner_commit": "git:308e83fcfbf9ec98dbe6b0286cbe8ec7be8899b3",
|
|
"consumer_paths": 40,
|
|
"patch_sha256": "sha256:feb1079399a43989742ae0a946c1ada50113d1821e6541f97f0b5592ee1fc20c",
|
|
"postgreSQL_test_subtest_passes": 37,
|
|
"database_schema_profiles": [
|
|
"default",
|
|
"explicit-public",
|
|
"named"
|
|
],
|
|
"separate_client_crash_recovery": true,
|
|
"actual_database_server_restart_recovery": true,
|
|
"controlled_missing_lock_and_private_marker_counterexamples": true,
|
|
"following_query_hook_context_panic_corrected": true,
|
|
"selected_composed_passes_including_subtests": 94,
|
|
"source_skips": 0,
|
|
"release": {
|
|
"frontend_and_static_backend": "passed",
|
|
"release_version": "11.0.3+cust80.feb10793",
|
|
"binary_sha256": "sha256:92efb26614d3fca22c400920d92c4cd022e32ab86c1f562f60699ab5f750cd28",
|
|
"embedded_assets_exact": 2234,
|
|
"actual_release_CLI_checks": 48,
|
|
"exact_local_OCI_exports": 2,
|
|
"manifest": "sha256:9d127b0a75d3d53b1598e7f380dce29f23f42c2e69056fdfc9a42122d98c41c7",
|
|
"native_admission": false
|
|
},
|
|
"independent_owner_assent": false,
|
|
"production_database": false,
|
|
"native_gates_closed": 0
|
|
},
|
|
"current_work": "Integrate the published shared current-token client into actual NK48/Apps current operation/inverse and ongoing resource paths, preserving owner policy/approval/effect bindings. Independent issuer profile and package/custody admission, every-release-writer exclusion, private journal custody/retention and all sixteen native gates remain open. Full G01-G13 and 116-entry ledger retained.",
|
|
"workplan_finished": false,
|
|
"goal_complete": false,
|
|
"preceding_audit": {
|
|
"path": "docs/changes/netkingdom-target-2026-10-18/cust80-completion-r4/completion-audit.json",
|
|
"sha256": "sha256:8a4e3e61f3639a31d9d5df7803d3cb420eb391b191894e209d62b9e3100d5127"
|
|
},
|
|
"issuer_source_progress": {
|
|
"packet": "docs/changes/netkingdom-target-2026-10-18/keycape-token-status-r1",
|
|
"base_revision": "git:d803e9282a47b49daf930fb905312fa5104c0ace",
|
|
"scope": "proposed opt-in extension in the existing issuer",
|
|
"source_delta_paths": 18,
|
|
"complete_race_passes_including_subtests": 659,
|
|
"existing_native_external_skips": 6,
|
|
"new_token_status_passes_including_subtests": 43,
|
|
"actual_built_server_process_checks": 26,
|
|
"actual_process_restart": true,
|
|
"actual_handler_HTTPS_PKCE_status_revocation": true,
|
|
"controlled_revocation_guard_omission_failed_checks": 7,
|
|
"independent_owner_assent": false,
|
|
"native_admission": false,
|
|
"gates_closed": 0,
|
|
"owner_identifier_reconciliation": "existing exact historical reference restored using official consistency injection helper; new canonical records assigned by normal Repo Manager; no replacement existing UUID",
|
|
"consumer_owner_commit": "git:67a0869c1ee40c9e00a60cb7c1d828734d5d3d32",
|
|
"owner_primary_projection_verified": true,
|
|
"owner_workplan": "KEY-WP-0042",
|
|
"owner_workplan_status": "proposed",
|
|
"owner_tasks": {
|
|
"T01": "progress",
|
|
"T02": "done",
|
|
"T03": "todo"
|
|
},
|
|
"source_task_complete_only": true
|
|
},
|
|
"shared_client_source_progress": {
|
|
"packet": "docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1",
|
|
"issuer_commit": "git:08c083bae9ff35fbaf028c36d72a95b57d2541b7",
|
|
"warden_commit": "git:08c098e64a9afd89e43f65436782ed2bb69cdfbd",
|
|
"complete_issuer_race_passes_including_subtests": 724,
|
|
"existing_native_external_skips": 6,
|
|
"warden_canonical_unit_passes": 796,
|
|
"warden_deselected": 4,
|
|
"built_cross_owner_fixture_assertions": 45,
|
|
"owner_processes": 2,
|
|
"generated_go_consumer_processes": 4,
|
|
"exact_source_delta_replay_paths": 23,
|
|
"single_generated_producer_export_and_drift_refusal": true,
|
|
"independent_owner_assent": false,
|
|
"native_admission": false,
|
|
"second_real_consumer": false,
|
|
"native_gates_closed": 0,
|
|
"both_owner_primary_projections_verified": true
|
|
}
|
|
}
|