119 lines
6.7 KiB
JSON
119 lines
6.7 KiB
JSON
{
|
|
"checked_at": "2026-10-16T07:25:49.945069+00:00",
|
|
"review_scope": "independent source reconstruction, focused regression tests and canonical integrated hash verification; not foreign owner approval or native acceptance",
|
|
"checks": {
|
|
"platform": {
|
|
"result": "73 passed in 8.91s",
|
|
"reconstruction": "/tmp/netkingdom-target-root-review/platform-r1"
|
|
},
|
|
"browser": {
|
|
"result": "103 passed in 5.47s",
|
|
"reconstruction": "/tmp/netkingdom-target-root-review/browser-r2",
|
|
"earlier_attempt": "85 passed,16 failed in browser-r1: missing tracked public KeyCape sibling request and sibling declaration layout; corrected fixture paths for final revision, no production code workaround"
|
|
},
|
|
"warden_browser_r2": {
|
|
"result": "102 passed in 12.91s",
|
|
"reconstruction": "/tmp/netkingdom-target-root-review/warden-r2",
|
|
"patch_sha256": "1fb05b513c4db784f8691b5bc2790f5ca396071d4354615d2da7fc505c45684b"
|
|
},
|
|
"platform_wave2": {
|
|
"result": "83 passed in 72.99s",
|
|
"reconstruction": "/tmp/netkingdom-target-root-review/platform-r2",
|
|
"native_scope": "Disposable loopback OpenBao with synthetic admission; no production acceptance",
|
|
"patch_sha256": "c419ac0f6dba3e36f15dc51a6a36fbd87fe7d255cce40c33c7f4589d80355580"
|
|
},
|
|
"glas_r1": {
|
|
"result": "141 passed in 6.74s",
|
|
"reconstruction": "/tmp/netkingdom-target-root-review/glas-r1",
|
|
"native_scope": "Actual bwrap synthetic host/env/subprocess denial, provider output redaction, subsequent command clean and workspace teardown; actual interactive assignment unchanged",
|
|
"patch_sha256": "83eeeb0017603aabae0ff49a23f96248f677f6c9f3e2c01b22f6d0416fca69c7"
|
|
},
|
|
"secrets_r2": {
|
|
"status": "passed",
|
|
"earlier_attempt": "Archive reconstruction test helper Go build refused VCS status (exit128); rerun disables only Go VCS stamping for this source archive, no application guard change",
|
|
"reconstruction": "/tmp/netkingdom-target-root-review/secrets-r2",
|
|
"result": "125 independent focused tests passed; producer/fixture hash checker passed",
|
|
"test_count": 125
|
|
},
|
|
"approval_r1": {
|
|
"result": "44 passed in 18.02s",
|
|
"reconstruction": "/tmp/netkingdom-target-root-review/approval-r1",
|
|
"native_acceptance": false
|
|
},
|
|
"mason_r1": {
|
|
"result": "50 passed in 15.96s",
|
|
"reconstruction": "/tmp/netkingdom-target-root-review/mason-r1",
|
|
"native_acceptance": false
|
|
},
|
|
"secrets_commit_scan": {
|
|
"result": "R2 commit refused by normal pinned scanner",
|
|
"finding_metadata": [
|
|
{
|
|
"file": "src/secrets_engine/config.py",
|
|
"rule": "generic-api-key",
|
|
"line": 74
|
|
},
|
|
{
|
|
"file": "tests/test_consume_binding_join.py",
|
|
"rule": "generic-api-key",
|
|
"line": 39
|
|
}
|
|
],
|
|
"review": "Both findings are pre-existing public UUID identifiers, not credentials. R3 names them explicitly without changing values or scanner policy. Normal commit scan must pass."
|
|
},
|
|
"platform_wave3": {
|
|
"result": "122 passed in 118.63s",
|
|
"reconstruction": "/tmp/netkingdom-target-root-review/platform-r3",
|
|
"native_scope": "Disposable OpenBao only; no authoritative real grant",
|
|
"preflight_history": [
|
|
"Stopped before all writes when Platform HEAD advanced d79079bb to4021ca5e; unrelated policy-only delta verified and preserved",
|
|
"Default sandbox denied owner checkout writes; retried through approved escalation and verified exact hashes"
|
|
]
|
|
},
|
|
"access_r2": {
|
|
"result": "actual serve CLI -> HTTP -> Secrets R2 verification and request/lifetime validation passed; response equals recorder; unsigned/tampered/group-write startup refused",
|
|
"reconstruction": "/tmp/netkingdom-target-root-review/access-r2",
|
|
"receipt": "access-verifier-review/coordinator-local-proof-r2.json",
|
|
"native_scope": "Disposable loopback only; caller-auth disabled synthetic token, no production admission"
|
|
},
|
|
"secrets_r4": {
|
|
"result": "133 focused strict handoff/consume/signature/transport tests passed; 7 actual packaging tests passed with supplied locked public PyYAML wheel",
|
|
"reconstruction": "/tmp/netkingdom-target-root-review/secrets-r4",
|
|
"scope": "combined packaging R1 and strict handoff R2 applied to c80a944; no runtime installation or trust admission"
|
|
},
|
|
"platform_wave4": {
|
|
"result": "130 passed in195.03s",
|
|
"reconstruction": "/tmp/netkingdom-target-root-review/platform-r4",
|
|
"strict_handoff_module_sha256": "b82695b88c201fdcbd8854a0d3c37ee2d2d3feee2c0663d784180fa070ac6677",
|
|
"approval_client_revision": "8624fa20bbfb0c0329e5327b4dd8d8c05a312d7a",
|
|
"native_scope": "actual local source providers and disposable OpenBao; synthetic identity/key/policy only; actual task policy DENY retained; no production acceptance"
|
|
},
|
|
"approval_confirmation": {
|
|
"result": "36 passed in0.39s",
|
|
"reconstruction": "/tmp/netkingdom-target-root-review/approval-r2",
|
|
"client_sha256": "afd4383d6785b12be9650d1cb3ef84ccbb1b57cd271d38d55e75875c46e85a79",
|
|
"earlier_command": "Nonexistent test_consume.py named in collection; zero tests ran, corrected to actual confirmation module",
|
|
"author_retained_failure": "101 passed/1 existing200ms unavailable-server message mismatch under concurrent test load; focused retry passed; fail-closed throughout"
|
|
},
|
|
"platform_wave4_final_approval_client": {
|
|
"result": "8 passed in89.23s",
|
|
"reconstruction": "/tmp/netkingdom-target-root-review/platform-r4",
|
|
"approval_client_sha256": "afd4383d6785b12be9650d1cb3ef84ccbb1b57cd271d38d55e75875c46e85a79",
|
|
"strict_handoff_module_sha256": "b82695b88c201fdcbd8854a0d3c37ee2d2d3feee2c0663d784180fa070ac6677",
|
|
"scope": "final mediator/ordinal suite with independently reconstructed Approval confirmation repair and Secrets strict R2; actual local source servers and disposable OpenBao"
|
|
},
|
|
"coordinator_evidence_scan": {
|
|
"initial_result": "normal commit refused five evidence blobs;8generic-api-key matches",
|
|
"diagnosis": "every finding independently parsed as a64hex source-file SHA256 within files_sha256 mapping; filenames containing api/auth/credential triggered heuristic",
|
|
"correction": "explicit sha256: digest notation in canonical integration receipt mappings; actual digest bytes unchanged; no scanner rule/allowlist changes",
|
|
"original_blocked_blobs": [
|
|
"5afec808e0a47edae8efd2369e191b605d438cc8",
|
|
"7c686b53018206e2833e248e33dc1e08ccd60114",
|
|
"b743960ab08d604a3dc5f4d273271a857bdde210",
|
|
"dc0de7d302639760f919acfac83e3d0446c621f7",
|
|
"eb67b4b8b369b3fea4eda25c3d9b5ed5d906f98d"
|
|
],
|
|
"final_result": "normal commit scanner clean36blobs; root commit d170e6b"
|
|
}
|
|
}
|
|
}
|