| .. | ||
| postimages | ||
| preimages/workplans | ||
| publication-backup | ||
| rejected-r1 | ||
| reviewed-r2 | ||
| reviewed-r3 | ||
| canonical-integration.json | ||
| coordinator-publication-review.json | ||
| coordinator-review-r3.json | ||
| finalize_receipt_r3.py | ||
| implementation.patch | ||
| integrate_r3.py | ||
| integrated-source-hashes.json | ||
| manifest.json | ||
| normal-final.exit.json | ||
| normal-final.stderr.txt | ||
| normal-final.stdout.json | ||
| normal-sync.exit.json | ||
| normal-sync.stderr.txt | ||
| normal-sync.stdout.json | ||
| normal-writeback.exit.json | ||
| normal-writeback.stderr.txt | ||
| normal-writeback.stdout.json | ||
| owner-progress.json | ||
| projection-dependencies.json | ||
| projection-tasks.json | ||
| proposed-descriptor.json | ||
| README.md | ||
| record_publication_r3.py | ||
| sync_owner_final_r3.py | ||
| sync_owner_r3.py | ||
| sync_owner_writeback_r3.py | ||
| tests.txt | ||
| verify_candidate.py | ||
NetKingdom registration adapter source candidate R3
Source-only candidate awaiting independent root review. No canonical owner file, type/case bytes or status changed; no credential or live action was used. Exercise status: unexercised.
The patch adds a fixed attended registration adapter around actual maintained
keycape-client.run, its contract notes and 16 new fixture checks. The 20
existing helper checks also pass. Three new checks exercise actual Warden
admission/dispatch/rollback and uncertain transitions with synthetic owner trust
with unchanged published Warden d97652a producer pins. No replacement of adapter
callables after admission is used: the proposed Invocation is built first, and
normal admission independently derives the same full binding.
R1's root review found an unbound config-checker executable: the caller could
supply another binary and its matching hash under the same descriptor. That
rejected revision remains in rejected-r1/; the superseded R2 source/fixture
packet remains in reviewed-r2/. R2 corrected the custody finding; R3 retains that correction and includes the exact selected
checker hash in the adapter source-composition pin and descriptor. Substitution
under the original descriptor is now refused before tooling. The descriptor
retained here uses a synthetic checker digest only; native executable selection
and owner acknowledgment remain outstanding.
Reproduce from current pinned owner dependencies:
python3 docs/changes/netkingdom-target-2026-10-16/browser-adapter-next/verify_candidate.py
implementation.patch adds three files and proposes an exact owner workplan edit
against retained preimages/. No canonical workplan changed. postimages/ holds the exact proposed
bytes. manifest.json binds all source/fixture hashes and the observed owner
state at packaging; this is not a reconstructed session-start dirty-state
snapshot. tests.txt retains the 36 passing checks. Warden/source owner heads
and current canonical changes remain outside this patch.
The owner contract in postimages/sso-mfa/k8s/keycape/registration-adapter.md
records required native callbacks and remaining scope. In particular: published Warden d97652a now admits the exact producer source
bytes through its normal pins, without attesting this adapter; group ensure
has no created-membership provenance; group revoke can remove a pre-existing
membership; env/config/restart adapters remain; durable post-restart creation
reconciliation is absent. Platform/Apps native acceptance remains separately
owned. None of these gaps is supplied by the fixture proof.
The exact workplan proposal preserves existing T10/T11/T12 Hub UUIDs and all other prior bytes outside T06 dependencies/T12 prose. T13 records source implementation and fixture proof as done, explicitly excluding independent review/publication. T12 retains env/config/restart work, while T14 tracks group creation provenance, T15 durable registration recovery and T16 actual descriptor/ checker artifact selection and owner review. T06 retains all source dependencies and native acceptance scope. No acknowledged type/case bytes or statuses change. Root review and publication receipts must be added when integration is approved.