the-custodian/docs/changes/netkingdom-target-2026-10-16/warden-browser

Warden browser input source implementation

Prepared from ops-warden HEAD in isolated /tmp/warden-browser-target-20261016. Canonical owner checkout is untouched. Only tracked baseline diffs for generated .custodian-brief.md and WORK-RECORDS.md were retained separately; no untracked owner files, private credentials or live resources were copied.

implementation.patch adds a real Executor browser path backed by the actual NetKingdom validator. Exact reviewed 1.1/1.2 parameter definition digests prevent widening accepted fields/sensitivity/constraints. The complete case is validated using verified producer validator/composer/contract/evidence bytes in an isolated temporary Python tree with empty environment and a timeout. Unknown/fixed/secret inputs, credential-shaped values and changed producer code refuse. Only the descriptor's public/operational target is projected to the owner adapter; the journal retains fingerprints, without browser parameter payloads. Every previous independent case/type/descriptor/catalog/session/materialization gate remains mandatory.

Validation: 102 passed, covering actual producer validation, real Executor/SQLite/owner callback path, existing execution/reducer suites, planning and type checks. Ruff format/check passed. The test-only owner adapter and fake provenance verifier do not establish native completion. Actual source types without reviewed execution descriptors continue to refuse before dispatch.

Source preparation advances WARDEN-WP-0044-T03. It does not install native owner adapters/provenance, contained login sessions, full ordered run orchestration or a dispatch CLI. First Forgejo acceptance still needs actual Mason structure, accepted machine descriptor/type revision, source/installed broker reconciliation, separate authorized mint/deliveries, consumer sign-in/group denial, authenticated owner receipts, both revocation scopes and created-only native rollback. No acknowledged type or case source was changed or promoted. A journal digest does not authenticate its owner. T03 stays progress and T04 stays wait.

Knowledge orientation: emergent-security 0.2.6, digest 8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02, withheld/orientation-only. Warden INTENT/SCOPE, workplan and actual producer source were read directly. No live credentials or changes, authority promotion, owner assent or public push was performed. Canonical integration and State Hub reconciliation remain with the parent session.

Revision r2 pins the exact accepted NetKingdom browser-case patch d32a7f51cbf3012bee3e4bb329f4259dea867eff1c59a2b01a65d72774488d05. The lazy evidence module is imported only by its check-evidence CLI branch, but Warden includes it in the reviewed pinned source set. Every one of the four producer modules has explicit missing/modified-source refusal coverage. The original artifacts and manifest are preserved in r1/; this directory's manifest and patch are the final r2 deliverables.