History

codex a192d24c9a Some checks are pending CI Smoke / host-smoke (push) Waiting to run Details CI Smoke / container-smoke (push) Waiting to run Details Reject generated-only commits / generated-commit-guard (push) Waiting to run Details docs: preserve reviewed NetKingdom session artifacts		2026-11-01 23:14:27 +01:00
..
preimages	docs: preserve reviewed NetKingdom session artifacts	2026-11-01 23:14:27 +01:00
canonical-integration.json	Record verified security source integrations and remaining contract seams	2026-10-16 16:52:23 +02:00
coordinator-files-r2.json	docs: preserve reviewed NetKingdom session artifacts	2026-11-01 23:14:27 +01:00
implementation-r1-to-r2.patch	docs: preserve reviewed NetKingdom session artifacts	2026-11-01 23:14:27 +01:00
implementation-r1.patch	docs: preserve reviewed NetKingdom session artifacts	2026-11-01 23:14:27 +01:00
implementation-r2.patch	docs: preserve reviewed NetKingdom session artifacts	2026-11-01 23:14:27 +01:00
manifest-r1.json	docs: preserve reviewed NetKingdom session artifacts	2026-11-01 23:14:27 +01:00
manifest-r2.json	docs: preserve reviewed NetKingdom session artifacts	2026-11-01 23:14:27 +01:00
owner-source-review-r1.json	docs: preserve reviewed NetKingdom session artifacts	2026-11-01 23:14:27 +01:00
owner-source-review-r2.json	docs: preserve reviewed NetKingdom session artifacts	2026-11-01 23:14:27 +01:00
r1-refusal-counterexamples.json	docs: preserve reviewed NetKingdom session artifacts	2026-11-01 23:14:27 +01:00
README.md	docs: preserve reviewed NetKingdom session artifacts	2026-11-01 23:14:27 +01:00
validation-r1.json	docs: preserve reviewed NetKingdom session artifacts	2026-11-01 23:14:27 +01:00
validation-r2.json	docs: preserve reviewed NetKingdom session artifacts	2026-11-01 23:14:27 +01:00

README.md

Protected cleanup recovery source successor

implementation-r1.patch adds operation-bound private fixture custody and a separately admitted cleanup-only executor. Actual forked executor death can be reconciled through fixed accessor revocation/absence and exact grant-policy retirement. The runner never restores business or consume admission, mints a session, or retries an effect. Its durable native intent and receipt records preserve unknown outcomes; a fresh owner permit is required after failure.

Custody is a separate owner-only directory and persists accessors, not bearer credentials. This proves process-independent fixture recovery. Same-UID hostile code isolation, production storage/encryption/retention, exact recovery-role scope and native actor/audit admission remain unselected/unadmitted. No estate backend, credential read, new live grant or generic broker is introduced. Lost token-create response before accessor commit remains explicit unresolved token cleanup debt.

Exact source hashes and preimages are retained in manifest-r1.json and preimages/. Parent owns integration, work-record sync and progress log. The separate Platform signer-custody proposal remains frozen.

Validation: 48 regression tests passed; final frozen recovery/journal suite24 tests passed. Counts overlap. Exact run chronology and retained initial failures are in validation-r1.json. owner-source-review-r1.json approves source only. Canonical apply-check and source/preimage hashes passed.

R2 supersedes the R1 source proposal after root refusal review. R1 files remain unchanged. Use implementation-r2.patch (full) or implementation-r1-to-r2.patch (delta over R1). Exact hashes are in manifest-r2.json; owner source review and validation are owner-source-review-r2.json / validation-r2.json. R2 fixes arbitrary404 absence, broad rstrip equivalence and unauthenticated/corrupt capsule acceptance.53successor tests and29final frozen cases passed; counts overlap. r1-refusal-counterexamples.json retains reproduced original failures.