68 lines
3.2 KiB
JSON
68 lines
3.2 KiB
JSON
{
|
|
"schema": "netkingdom.source-integration.v1",
|
|
"owner": "secrets-engine",
|
|
"checkout": "/tmp/netkingdom-secrets-decision-auth",
|
|
"source_base": "6bd7129eac94131b4cf689e47cbdc9899418beb3",
|
|
"patch": "implementation-r2.patch",
|
|
"patch_sha256": "98c4300c42fe93759a55297fe6629f1d4aeed249c3625f7fd37c8ab523a08ca9",
|
|
"paths": [
|
|
"SCOPE.md",
|
|
"docs/pdp-access-path.md",
|
|
"scripts/check_pdp_producer_source.py",
|
|
"src/secrets_engine/approval_consume.py",
|
|
"src/secrets_engine/config.py",
|
|
"src/secrets_engine/decision_check.py",
|
|
"src/secrets_engine/decision_signature.py",
|
|
"tests/fixtures/pdp-signature/decision_rotate_signed.json",
|
|
"tests/fixtures/pdp-signature/decision_rotate_signed_tampered.json",
|
|
"tests/signature_support.py",
|
|
"tests/test_approval_auth.py",
|
|
"tests/test_consume_binding_join.py",
|
|
"tests/test_decision_replay.py",
|
|
"tests/test_decision_signature.py",
|
|
"tests/test_decision_transport.py",
|
|
"tests/test_execution_context.py",
|
|
"tests/test_human_control.py",
|
|
"tests/test_integration_authorization.py",
|
|
"verifier/LICENSE.access-engine",
|
|
"verifier/README.md",
|
|
"verifier/go.mod",
|
|
"verifier/internal/sign/sign.go",
|
|
"verifier/main.go",
|
|
"verifier/pkg/api/canonical.go",
|
|
"verifier/pkg/api/caring.go",
|
|
"verifier/pkg/api/doc.go",
|
|
"verifier/pkg/api/resource_manifest.go",
|
|
"verifier/producer-source.json",
|
|
"verifier/testsupport/signer/main.go",
|
|
"workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md"
|
|
],
|
|
"workplan": "SECRETS-WP-0014",
|
|
"task_status": {
|
|
"T02": "progress: implementation prepared; independent review/key admission pending",
|
|
"T03": "wait: no native rollout/trust admission"
|
|
},
|
|
"verification": [
|
|
"158 focused tests passed in 12.42s",
|
|
"Full candidate: 685 passed, 16 failed, 1 skipped in 51.58s",
|
|
"All 16 candidate failures exactly match unchanged canonical baseline failed-file run (120 passed/16 failed); zero new failure ids",
|
|
"Expanded execution/human/disposable OpenBao: 71 passed, 1 matching baseline failure",
|
|
"Real Access producer go test ./internal/sign ./pkg/api passed",
|
|
"Exact producer/fixture hashes and git diff --check pass"
|
|
],
|
|
"native_acceptance": false,
|
|
"canonical_owner_modified": false,
|
|
"secrets_read": false,
|
|
"integration_instructions": "Review/apply implementation.patch to current source after base/dirty provenance check; do not apply original dirty provenance patches. Install reviewed verifier separately; do not deploy/admit keys automatically. Root handles canonical integration/fix-consistency.",
|
|
"limitations": [
|
|
"Python wheel alone lacks installed Go helper; deployment package must install it",
|
|
"Signer plus signed evaluator/mode and policy artifact digest binds issuer/pin; producer has no distinct instance issuer field",
|
|
"Trust file must be independently admitted; no production keys/config changed",
|
|
"Sixteen pre-existing sandbox tmp ancestry ownership failures prevent claiming full green; exact baseline/candidate ids retained in verification-r2.json. No new failure ids remain."
|
|
],
|
|
"revision": "r2",
|
|
"supersedes": {
|
|
"patch": "implementation.patch",
|
|
"sha256": "1cd7adab482c1e359786ed403e1bb209e76956c62ee045d85bb8a59a13fe55b7"
|
|
}
|
|
}
|