19 KiB
NetKingdom target implementation record
Coordinator: CUST-WP-0080. Target: security architecture. Started 16 October 2026 under the founder's explicit implementation and GPT-6.1-Sol medium subagent request. The full architecture remains the goal.
Work ownership and current status
| Gate | Existing implementation owner | Current evidence state | Next deliverable |
|---|---|---|---|
| TSA-01 | Secrets Engine / Access Engine; SECRETS-WP-0014, FLEX-WP-0024 | Producer signing, strict consumer verification and fixed-verifier packaging source integrated; actual local serve-to-consumer proof passed | Independently admit package/keys/policy and verify native rollout |
| TSA-02–03 | Platform / Secrets / Approval; RPF-WP-0035-T12, SECRETS-WP-0013, APPROVAL-WP-0002/0004 | Strict handoff and durable consume/confirm/effect seam integrated; actual local source servers and disposable OpenBao path passed | Exact effect baseline/readback and recovery acceptance, then governed native admission |
| TSA-04 | NetKingdom / Mason / Warden / KeyCape; NK-WP-0048 | Browser evidence checker, Warden pinned metadata validation and Mason versioned source selection published | Admitted machine descriptors, real owner receipts and consumer acceptance |
| TSA-05 | KeyCape / User / NetKingdom / Playwright; KEY-WP-0040, NK-WP-0050, CUST-WP-0080-T05 | Native human and agent journey gates open | Actual recovery and browser consumer acceptance |
| TSA-06 | Glas / Sand-boxer / rein / Platform / Forge; CUST-WP-0073, GLAS-WP-0012 | Workload-only credential delivery published; disposable bwrap proof reproduced; actual assignment and runner proof open | Admitted corrected runtime, combined rein acceptance and actual assignment migration |
| TSA-07–08 | Secrets / NetKingdom / Platform; NK-WP-0049 and existing lifecycle plans | Inventory/lifecycle incomplete; actual independent identity archive recovery verified 16 October | Complete service authentication, existing-token decryption and audit continuity; metadata denominator, elimination candidates and lifecycle receipts |
| TSA-09 | Audit / emitting owners; Approval T04 and current Audit work | Delivered custody; current source admission/reconciliation incomplete | Source/effect/outbox/receiver readback for first protected operation |
| TSA-10 | Forge / Repo Manager; FORGE-WP-0006, RMGR-WP-0021 | Broad receive coverage delivered; other paths and response incomplete | Coverage/reliability gaps and private response acceptance |
| TSA-11 | Reuse / provider owners | 70/70 discovery verified 15 October; stale descriptive fields remain | Correct source metadata and repeat drift/hosted checks |
| TSA-12 | Activity / Coordination / Custodian; CUST-WP-0079 | Schedule accepted but unassisted activation not proven; cadence source adoption underway | Actual activation and first independent observation |
| TSA-13–14 | NetKingdom / provider owners | Accepted reusable integration and second installation pending | Shared adapter conformance and minimal locked profiles |
| TSA-15 | Resource / telemetry / consumer owners; CUST-WP-0071 where applicable | Optimization baseline incomplete | Comparable latency, effort, resource and scanner measurements |
| TSA-16 | Custodian / governance and owner records | Governing records exist; target-wide evidence reconciliation open | Requirement-by-requirement closure audit under CUST-WP-0080-T04 |
Each entry summarizes an owner obligation; it does not copy or replace that owner's task list. The original requirement ledger and owner receipts retain their original scope and outcomes.
Delegated implementation wave
The founder requested model gpt-6.1-sol, reasoning effort medium. The
coordinator dispatched these concrete child assignments using that configuration:
| Handle | Owner role | Source scope | Artifact directory |
|---|---|---|---|
/root/decision_auth |
secrets-engine | Signed decision enforcement, existing SECRETS-WP-0014 | docs/changes/netkingdom-target-2026-10-16/decision-auth/ |
/root/protected_execution |
railiance-platform | Task execution journal/cleanup, RPF-WP-0035-T12 | docs/changes/netkingdom-target-2026-10-16/protected-execution/ |
/root/browser_case |
net-kingdom | First browser case verification/integration, NK-WP-0048-T06 | docs/changes/netkingdom-target-2026-10-16/browser-case/ |
/root/warden_browser |
ops-warden | Exact producer validation on browser admission, WARDEN-WP-0044-T03 | docs/changes/netkingdom-target-2026-10-16/warden-browser/ |
/root/agent_isolation |
glas-harness | Scope credential delivery to actual workloads, GLAS-WP-0012 | docs/changes/netkingdom-target-2026-10-16/agent-isolation/ |
/root/approval_reference |
approval-engine | Atomic authenticated consuming identity and act/PDP evidence, APPROVAL-WP-0004 | docs/changes/netkingdom-target-2026-10-16/approval-reference/ |
/root/access_verifier_review |
access-engine | Producer compatibility review and actual signing path, FLEX-WP-0024 | docs/changes/netkingdom-target-2026-10-16/access-verifier-review/ |
/root/mason_browser |
ops-mason | Correct versioned browser type source resolution | docs/changes/netkingdom-target-2026-10-16/mason-browser/ |
Each child reads the assigned owner's instructions and intent. Prepared changes use isolated temporary checkouts based on current owner source, with relevant pre-existing tracked changes retained. Exact patches, source hashes and tests support coordinator review before integration. A child reviews only its own owner role; independent cross-owner reviews require separate assignments.
The table records assignment history, not perpetual liveness. All eight owners delivered initial source packages. Secrets and Access are implementing the trusted service task path and preparing native package/trust/caller admission. Platform delivered exact effect readback and process-loss cleanup recovery in disposable OpenBao; the trusted successor adds absolute execution budgets. Approval delivered the shared claim adapter and is reviewing its authenticated consumer integration. Exact revisions and publication caveats are in the source wave receipt; independent tests and retained failures are in the coordinator review. Raw patches and temporary reconstructions are workspace-local review artifacts; the published owner commits are the durable source.
| Published owner source | Change | Independent verification |
|---|---|---|
NetKingdom c31d21ba |
Browser evidence checking without native acceptance inference | 103 tests |
Warden 95835208 |
Exact pinned producer and parameter-schema validation | 102 tests |
Glas 7357115c |
Credentials delivered only to explicit workloads | 141 tests and actual disposable bwrap denial/redaction/teardown |
Platform 59d1441c, 99fd21ee, d042d468 |
Durable cleanup, disposable native adapter and immutable grant projection | Successive suites: 73, 83 and 122 tests; counts overlap |
Secrets c80a9441 |
Strict producer-type signature verification with independent trust configuration | 125 focused tests and producer provenance check |
Access ec21518e |
Actual serving path signs before recording; inert chart configuration | Real local serve-to-Secrets verification; unsigned, tampered and unsafe key-file cases refused |
Approval 477c6839 |
Atomic consuming-service identity and bound act/PDP audit fields | 44 tests |
Mason 57411f25 |
Explicit versioned type-source selection in all CLI commands | 50 tests |
The subsequent published revisions are Secrets ebca4f5 (fixed-verifier release
bundle) and ff1a13d (strict task handoff), Platform e2b832b (journaled
consume/confirm seam), and Approval eece796 (canonical consumed-act comparison).
Normal owner publication and reconciliation succeeded; exact receipts retain
remaining historical warnings.
Independent combined Secrets verification passed 133 focused tests and seven
packaging tests. Platform passed all 130 tests, then eight affected tests passed
with the final Approval client; that client separately passed 36 tests.
Normal owner publication succeeded for every listed revision. Platform's scanner ref race and Access's first State Hub timeout were retried successfully. Mason's unrelated pre-existing workplan edits prevent an exact whole-repository hub revision claim. Generated-only writeback refusals were retained without bypass. Secrets' normal scanner initially flagged two public UUID identifiers; clearer constant names preserved their values and passed the unchanged scanner.
These are bounded source/backend proofs. Synthetic approvals and grants do not establish production consumption or isolation of this interactive assignment. The actual service-pilot policy still denies runtime admission. The missing strict Secrets handoff now binds the signed decision, approval, exact grant and caller; Platform reserves durably, journals consumption and independently confirms it before effects. Actual Access and Approval servers passed this path with explicit synthetic identity/key/policy admission. Denied confirmation leaves uncertainty and permits no native effect. Six successful native calls alone do not establish complete expected-state readback; the following source slice adds that proof. Both Secrets and Approval now compare the existing canonical native digest, refusing Python's boolean/integer equality ambiguity. The original counterexample and intermediate test failures remain recorded.
This wave authorizes source implementation and preparation under the user goal. It grants no runtime credential scope or automatic native acceptance. Required owner checkout filesystem approval is distinct from authority to change live trust or credentials. No agent inherits another assignment's autopilot grant.
Subsequent source integration, 16 October
Platform d870596 binds canonical before/after metadata snapshots through the
existing descriptor commitments, checks each baseline before its target write,
and verifies complete readback before recording success. Independent native
fixture/mediator/readback suites passed 32 tests. This is sequential observation:
there is no atomic native CAS or concurrent-writer exclusion. Partial application
remains unknown, and cleanup confirmation stays separate. Its whole-stack
positive proof is pinned to Access ec21518e; later Access source deliberately
removes the generic task path used by that old synthetic fixture.
Access 919ce25 fixes explicit caller-audience rendering and source revision
pinning, records the existing workload identity, and adds an offline native
receipt verifier using the installed Secrets verifier. Root review reproduced
boolean/integer and integer/float source-record equality mistakes; R2 checks exact
JSON types and hashes the same bounded bytes it verified. Nine receipt tests and
two runtime-twin tests passed independently. Missing managed package declaration,
signer custody and native image/trust admission remain explicit.
Secrets 5a2099f records the exact native CLI preparation, verified canonical
release bundle, configuration and trust inputs. The initial serving denominator
is 11 authorization sites across 10 handlers; native effect acceptance is zero.
Root verified unchanged runtime AST except documentation. The empty-key template
is intentionally unusable until independently admitted owner inputs exist.
Approval 3485415 supplies a producer-owned Go fact adapter and authoritative
claim vectors. Root passed its Go suite, two producer-vector tests and 14,114
actual Python canonical-byte/digest comparisons. This is shared validation code,
not another evaluator or credential transport. Access B1 R2 4f6946b connects the
actual HTTP caller join, preserves the submitted context and withholds accidental
ALLOW until the trusted source path exists. All three affected Go packages passed
independently; a malformed nested-duplicate test was corrected and rerun. These
two commits' publication/reconciliation state is recorded in the source receipt.
The trusted Access v2 successor, refreshed strict Secrets handoff and signer-custody
proposal remain separate review packages. Access's actual Approval API fixture and signed ALLOW/refusal evidence
are source proofs; the complete new consumer-to-Platform path and native issuer,
key, workload, grant, recovery and independent audit acceptance remain necessary.
Recovery review rejected broad 404 absence and unauthenticated stored accessor
claims. Revised Platform b9eaa20 passed 53 independent tests and adds authenticated
private accessor custody and separately admitted cleanup after executor loss,
without restoring business or consumption authority. Lost issuance before accessor
persistence remains unresolved. Actual custody/key isolation and recovery grants
remain unadmitted.
Whole-stack successor work exposed a temporal contradiction: the first v2 source
allowed 15 seconds while native token lifetime requires at least 30 seconds plus
cleanup reserve. Integrated Access 2b064ee now binds expiry to the exact operation
deadline within declared hard limits and all original/fresh/caller authority.
Its signed, claim-free DENY supplies producer-evaluated approval facts under the
existing enrichment contract; Secrets 4dd004a verifies them before approval
preparation. This receipt grants no execution authority. Final evaluation refuses
registry drift instead of silently changing an approved request. Exact producer
numeric types survive verification and recording without a copied normalizer.
Approval d40e842 preserves fractional time and uses one post-lock timestamp for
validity, consumption and its outbox event. The immediate path needs no sleep,
backdating or consumer tolerance. Independent verification passed all seven
affected Access Go packages, 193 focused Secrets tests and 98 Approval tests.
Platform 76fdc0b adds absolute call/operation/credential deadlines and exact
source-byte checks; 28 independent tests passed. Platform 7be8b6e adds the
complete successor proof: all eight independent tests passed using real local
Access and Approval services, retained registry, strict Secrets verification and
disposable OpenBao. The positive case verifies six native calls, complete readback,
cleanup and signed source-record parity; refusal cases preserve zero effect.
These use synthetic admission and do not establish production acceptance.
All sixteen target acceptance gates remain open.
The independent identity archive recovery receipt now proves artifact integrity, original key pairs, SQLite integrity, native PostgreSQL restore and cleanup. It explicitly does not prove full service authentication, existing-token decryption or audit signature continuity. Reuse that completed archive proof and drive the remaining native service recovery; TSA-08 remains open.
Coordinator review independently reproduced a second timestamp failure in the
canonical Approval Engine: a fractional expiry at .500 was consumed at actual
clock .750, while consumed_at reported the whole second. The isolated
counterexample
is retained alongside the verified repair in d40e842; expiry remains exclusive,
including when the database lock is acquired after the deadline. The original
publication scanner refusal is also retained: the Approval owner labeled seven
public SHA-256 references explicitly, preserving digest bytes and review meaning.
The unchanged scanner then passed all six committed files.
The same Platform revision includes a bounded signer custody primitive and an explicitly proposed custody design. Twelve independent tests passed against disposable OpenBao. Exact KV CAS/readback, a private durable receipt before effect and retained uncertainty are source properties. Production execution deliberately remains unavailable pending an admitted adapter, independent owner reviews and the exact custody decision. No key, credential grant or live deployment was made.
Next native admission work
Use existing owner paths and retain the deployed lifecycle policy while preparing the first native acceptance package. The task-execution pilot remains unadmitted.
- Access owns an immutable image, signer projection, retained caller binding and durable outbox. Metadata inspection found no existing namespace PVC. A proposed 1 GiB local-path claim is new storage; its requested capacity is not a filesystem quota. OS-enforced single-writer locking, bounded append/startup and fail-closed storage failure behavior are being implemented in the existing outbox. Recreate with one pod alone does not establish those properties.
- Platform owns proposed CCR-2026-0050 for the exact read lane, separate attended signer writing, fencing and private recovery receipts. Native role naming must satisfy the real delegated-applier policy. The current free-text Warden plan selected a survey route instead of the required admin-login route; preserve that dispatch mismatch as a blocker rather than silently choosing another credential.
- Secrets owns the release bundle, fixed verifier, independently admitted public trust and actual caller delivery. Clean installation and lifecycle ALLOW/DENY capture are preparatory evidence; they do not establish effects at the inventoried eleven privileged call sites across ten handlers. Those effects remain unaccepted.
- Retained Access deployment lacks an established managed-package identity tuple. Resolve that with the package owner; another application's declaration cannot supply its authority. Native audit receiver reconciliation also remains required.
The source wave receipt records exact publication and synchronization results. Temporary review checkouts and agent handles remain preparation artifacts, not runtime deployments.
Dependency and residual handling
The current implementation demand selects necessary target dependencies for owner review and scoped promotion. APPROVAL-WP-0002's exact issuer/provenance, audit and served-PEP obligations are required; its residual label must be reconciled by its owner before implementation dispatch. This does not activate every residual security plan or the deferred exposure rotation.
Cross-owner waits attach to the existing project driver where one exists, or a
derived cross_owner_wait case benefiting CUST-WP-0080. The dispatched child
handles establish current execution, not a separate fleet wake service. If a
child is terminal, record its deliverables and dispatch the next reachable owner
task; never report a stale handle as running.
Evidence and completion rules
For each change record the original owner revision, pre-existing dirty-state digest, exact patch, focused tests, independent review, integrated revision, publication and native acceptance separately. Bind each native receipt to target, identity, scope, source/image/config revision, expected result, negative cases, cleanup and rollback. Preserve failures and unverified outcomes.
The coordinator reviews evidence against every TSA gate and the named owner requirements. It may record partial source delivery without closing a native gate. Work continues until the target's complete exit condition holds. The first wave is implementation progress, not the completion boundary.