182 lines
8.4 KiB
JSON
182 lines
8.4 KiB
JSON
{
|
|
"objective": "Finish what you found missing and finish CUST-WP-0080",
|
|
"status": "active",
|
|
"observed_at": "2026-10-18T00:28:21.910794+00:00",
|
|
"full_scope_baseline": {
|
|
"path": "docs/changes/netkingdom-target-2026-10-18/cust80-completion-r1/completion-audit.json",
|
|
"sha256": "sha256:9bdee9a790db598956fe35d5954137bb4582c9f3810d2392f7ef3236c369b065",
|
|
"all_requirements_retained": true
|
|
},
|
|
"normative_architecture": {
|
|
"path": "docs/netkingdom-target-security-architecture.md",
|
|
"sha256": "ec2079be18c7cdb8a1e4fdbd22131c08c83721d7a1bf18b4802bc5e229520f35"
|
|
},
|
|
"acceptance_gates": [
|
|
{
|
|
"id": "TSA-01",
|
|
"required_outcome": "Every inventoried privileged PEP authenticates its decision",
|
|
"required_evidence": "PEP denominator; admitted signer/channel; forged, altered, wrong-key/pin, unsigned/downgrade, expired and rotation refusals. Start SECRETS-WP-0014.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-02",
|
|
"required_outcome": "Exact approval produces one bounded protected operation",
|
|
"required_evidence": "SECRETS-WP-0013/RPF-WP-0035-T12 native effect; Approval T01/T05 issuer/tenant provenance; wrong actor/tenant/body, expiry, replay and unavailable refusal.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-03",
|
|
"required_outcome": "Crashes preserve uncertainty and cleanup",
|
|
"required_evidence": "Actual ledger restart/concurrency, consumed-before-effect failure, target reconciliation, scoped cleanup and revocation evidence; no blind replay.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-04",
|
|
"required_outcome": "First reusable browser case is accepted",
|
|
"required_evidence": "NK-WP-0048 and named Mason/Warden/KeyCape adapters; independent native structure, sign-in/denial, delivery, revocation and rollback.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-05",
|
|
"required_outcome": "Human and browser consumers can use the delivered identity",
|
|
"required_evidence": "KEY-WP-0040/U08 real-factor recovery; User Engine journey; NK-WP-0050 and CUST-WP-0080-T05 human/agent Playwright acceptance.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-06",
|
|
"required_outcome": "Actual agent and runner authority is bounded",
|
|
"required_evidence": "CUST-WP-0073/GLAS-WP-0012 admitted runtime read-denial/tool-effect proof; Forge/Platform per-job credential and repository-workflow abuse tests.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-07",
|
|
"required_outcome": "Credential lifecycle is inventoried and simplified",
|
|
"required_evidence": "Current owner/consumer denominator, unknown/orphan findings, native-identity elimination candidates; sampled replacement/adoption/old-refusal and deletion semantics. G04/G09/G12.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-08",
|
|
"required_outcome": "Recovery is independent and measured",
|
|
"required_evidence": "NK-WP-0049 plus platform/root owners; isolated recovery with ordinary issuer unavailable, restore/reconnect/audit continuity and measured RTO/RPO. G08/G11.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-09",
|
|
"required_outcome": "Security effects have independently reconciled evidence",
|
|
"required_evidence": "Admitted source/class inventory, atomic outbox, receiver readback, lag/duplicate/boundary accounting and missing-class findings. Approval/Audit/Tenant/Secrets owners.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-10",
|
|
"required_outcome": "Source and delivery controls cover declared entry paths",
|
|
"required_evidence": "FORGE-WP-0006/RMGR-WP-0021: denominator, SSH/HTTP/UI/new repo/import/mirror coverage, required checks/provenance, private synthetic finding through resolution.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-11",
|
|
"required_outcome": "Discovery remains accurate",
|
|
"required_evidence": "All reviewed IDs exactly once, owner/index parity, usable source links, current limits/version aliases, drift checks and package-family disposition. Reuse/Repo Manager/provider owners.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-12",
|
|
"required_outcome": "Improvement operates without repeated manual polling",
|
|
"required_evidence": "CUST-WP-0079/Activity accepted schedule, unassisted firing, checkpoint and changed-state notifications; adopted cadence runtime/receiver receipts; owner change and native remeasurement.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-13",
|
|
"required_outcome": "Shared adapters reduce per-consumer implementation",
|
|
"required_evidence": "Producer-format cross-language fixtures, two real consumers, version compatibility, denied-path parity, upgrades and rollback; no second PDP.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-14",
|
|
"required_outcome": "Minimal profiles are independently reusable",
|
|
"required_evidence": "Version/provider lock, dependency and optional-provider declaration, provider adapters, second clean installation, complete positive/negative journeys and upgrade/recovery instructions.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-15",
|
|
"required_outcome": "Optimization improves measured operations",
|
|
"required_evidence": "Baseline and repeat measurements of onboarding time/touches, p50/p95 decision/effect latency, scanner throughput/failure, resources/headroom and owner effort with unchanged control coverage.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-16",
|
|
"required_outcome": "Governance and exceptions remain truthful",
|
|
"required_evidence": "Existing SEC-DSM ledger and close-down controls reconciled to exact evidence; real authority for changes, explicit residual promotions, preserved deferrals and no invented owner assent.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
}
|
|
],
|
|
"sec_dsm_requirements": {
|
|
"path": "docs/evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json",
|
|
"sha256": "sha256:ad81f7186ada04aa1cc410932fc8669d69dc2232f3c0be00657b17f3aa3a8184",
|
|
"count": 116,
|
|
"status_counts": {
|
|
"unverified": 84,
|
|
"incomplete": 12,
|
|
"reference": 20
|
|
},
|
|
"closure_status_unchanged": true
|
|
},
|
|
"gap_ids": [
|
|
"G01",
|
|
"G02",
|
|
"G03",
|
|
"G04",
|
|
"G05",
|
|
"G06",
|
|
"G07",
|
|
"G08",
|
|
"G09",
|
|
"G10",
|
|
"G11",
|
|
"G12",
|
|
"G13"
|
|
],
|
|
"separate_required_deliverables": [
|
|
"G01-G13 current closure evidence or already applicable approved exceptions",
|
|
"SEC-DSM requirement ledger reconciled with exact evidence",
|
|
"T05 real human and agent Playwright acceptance and supported discovery",
|
|
"Second real consumer and clean installation proves reuse",
|
|
"Residual handoffs before workplan finish; no required work left only in prose"
|
|
],
|
|
"source_progress": {
|
|
"packet": "docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1",
|
|
"producer_source_commit": "git:ca0cb75729a63c9288b7333382d0fa3eb1e8c9a3",
|
|
"consumer_owner_commit": "git:3fb031a47ff5379358fd8cc230b40961b3b5d3a8",
|
|
"consumer_paths": 37,
|
|
"patch_sha256": "sha256:15cb7f13b1b1d1095cc344176ca337f705333a436a70ae803fcfd3d7f802ccf4",
|
|
"actual_issuer_provider_callback_passes_including_subtests": 77,
|
|
"selected_composed_package_passes_including_subtests": 93,
|
|
"skips_in_these_suites": 0,
|
|
"complete_frontend_static_build": true,
|
|
"exact_embedded_assets": 2234,
|
|
"actual_release_cli_subprocesses": 48,
|
|
"synthetic_authentication": true,
|
|
"independent_owner_assent": false,
|
|
"native_gates_closed": 0,
|
|
"local_OCI_exports_exact": 2,
|
|
"local_OCI_manifest": "sha256:fc93a924b6e5f80a1dbf2a371dfd2e09fab10baa1cbca189bf61602009438822"
|
|
},
|
|
"current_work": "Publish source evidence and continue existing owner operation/session/exclusion/custody and ongoing protected-path implementation; native acceptance remains required.",
|
|
"workplan_finished": false,
|
|
"goal_complete": false
|
|
}
|