120 lines
7.4 KiB
JSON
120 lines
7.4 KiB
JSON
{
|
|
"owner_repository": "/home/worsch/railiance-platform",
|
|
"isolated_checkout": "/tmp/netkingdom-platform-wave4-20261016",
|
|
"base_commit": "d042d468df6d4085bb93a73ec26f4c4103554575",
|
|
"patch_sha256": "f26a5e1f63f68c487930d3f076502f1bae73d16107d3be2537aeeda56e73628e",
|
|
"files_sha256": {
|
|
"docs/task-execution-mediator-seam.md": "bedef06305956d1db7887fb9b86b5b5311f34ee3a6106df573c4a93de4e3d577",
|
|
"scripts/task_execution_journal.py": "507b41a790e678dfd16af747bd851f5abc2fed5a8fb70bca05449d9e5ac674e8",
|
|
"scripts/task_execution_mediator.py": "312b0b0fd246484d4537485db8db7b0e9b67e7c2cc10a5b2b68ac264ede4c180",
|
|
"scripts/task_execution_native_fixture.py": "60abb78634038ca9422a35265c7a21b6653fed8ef5b85c4d50e846f4e3da4edf",
|
|
"tests/task_execution_source_servers.py": "271e78fbfa3bf23f1c852297151d0ad38ab6bb5394851875a565f43453e1c57c",
|
|
"tests/test_task_execution_mediation_journal.py": "ced684dbb4b2454b50bc100649d9cee3a0882ac8aef04639ce399a69f54b00db",
|
|
"tests/test_task_execution_mediator.py": "a196a18038567275dfc10fb51ecc4ead99f58637959b9395ae4986ade47b7829",
|
|
"workplans/RPF-WP-0035-credential-lane-implementation.md": "f70c0011cb5d2ef310d6e2bf392a0b6bb6f78b407b9182a1e38bed2f80472f23"
|
|
},
|
|
"work_item": "RPF-WP-0035-T12",
|
|
"contract_work_item": "SECRETS-WP-0013",
|
|
"test_status": "130 distinct owner checks passed across full R1 and final focused R2 runs; all final mediator/ordinal cases pass with R2",
|
|
"secrets_dependency": {
|
|
"canonical_base": "c80a944",
|
|
"staged_checkout": "/tmp/netkingdom-secrets-task-handoff",
|
|
"module": "secrets_engine.task_execution_handoff",
|
|
"files_sha256": {
|
|
"src/secrets_engine/task_execution_handoff.py": "b82695b88c201fdcbd8854a0d3c37ee2d2d3feee2c0663d784180fa070ac6677",
|
|
"src/secrets_engine/approval_consume.py": "bea80a503944b1b9796819cfea5f514c3184a724115130d16c3bc0c675f09a6b"
|
|
},
|
|
"source_owner": "secrets-engine; no Platform edits",
|
|
"r1_module_sha256": "671a393aa2b9355e1c81c502a74f9ce8adad75fe7eb03492d11843a94b24d758",
|
|
"r1_boundary": "Full129 test proof before owner independent native bool/int digest counterexample; R2 must be used for final integration."
|
|
},
|
|
"provider_sources": {
|
|
"approval-engine": {
|
|
"base": "477c683991fda3c01e2af98a18f5a8719ee9dbc9",
|
|
"tracked_dirty": [
|
|
"M .custodian-brief.md",
|
|
" M WORK-RECORDS.md",
|
|
" M workplans/APPROVAL-WP-0004-exact-consume-source-provenance.md"
|
|
],
|
|
"written_by_worker": false
|
|
},
|
|
"access-engine": {
|
|
"base": "ec21518e25df2a58444f19ff3413ce0b83383d3c",
|
|
"tracked_dirty": [
|
|
"M .custodian-brief.md",
|
|
" M WORK-RECORDS.md"
|
|
],
|
|
"written_by_worker": false
|
|
},
|
|
"secrets-engine": {
|
|
"base": "c80a944105a00220cd3c1a007709e72d830dd08d",
|
|
"tracked_dirty": [
|
|
"M .custodian-brief.md",
|
|
" M WORK-RECORDS.md"
|
|
],
|
|
"written_by_worker": false
|
|
}
|
|
},
|
|
"fixture_binaries": {
|
|
"access": {
|
|
"path": "/tmp/netkingdom-platform-wave4-access",
|
|
"sha256": "b689b678aa90b746c674813eae8fea945e2d1ba24f10dfb44f475ea020c6b0a3",
|
|
"build_command": "GOCACHE=/tmp/netkingdom-platform-wave4-buildcache GOFLAGS=-mod=readonly go build -o /tmp/netkingdom-platform-wave4-access ./cmd/access-engine",
|
|
"build_cwd": "/home/worsch/access-engine",
|
|
"build_result": "exit0; Go emitted a read-only module stat-cache write warning, binary built and native tests verified"
|
|
},
|
|
"verify": {
|
|
"path": "/tmp/netkingdom-platform-wave4-verify",
|
|
"sha256": "f389e81dee7176c1e40b88169bbe328010207e671e587259e6dfae01b646e9b9",
|
|
"build_command": "GOCACHE=/tmp/netkingdom-platform-wave4-buildcache GOFLAGS=-mod=readonly go build -o /tmp/netkingdom-platform-wave4-verify .",
|
|
"build_cwd": "/home/worsch/secrets-engine/verifier",
|
|
"build_result": "exit0"
|
|
}
|
|
},
|
|
"estate_native_production_acceptance": false,
|
|
"estate_grants_or_custody_changed": false,
|
|
"canonical_owner_written": false,
|
|
"current_policy_runtime_admission": "Actual unchanged service task package signed DENY; separately named exact-descriptor synthetic fixture policy only for positive local proof",
|
|
"owner_dirty_observed": [
|
|
" M WORK-RECORDS.md"
|
|
],
|
|
"tests": {
|
|
"initial_full_command": "SECRETS_ENGINE_SOURCE_ROOT=/home/worsch/secrets-engine PYTHONPATH=/tmp/netkingdom-secrets-task-handoff/src:/home/worsch/approval-engine python3 -m pytest -xq tests/test_task_execution_mediator.py tests/test_task_execution_mediation_journal.py tests/test_task_execution_plan.py tests/test_task_execution_journal.py tests/test_task_execution_cleanup.py tests/test_task_execution_cleanup_calls.py tests/test_task_execution_grant.py tests/test_task_execution_native_fixture.py",
|
|
"initial_full_result": "129 passed in146.13s with strict Secrets R1; retained as intermediate only after its owner found native bool/int binding ambiguity.",
|
|
"final_focused_command": "SECRETS_ENGINE_SOURCE_ROOT=/home/worsch/secrets-engine PYTHONPATH=/tmp/netkingdom-secrets-task-handoff/src:/home/worsch/approval-engine python3 -m pytest -xq tests/test_task_execution_mediator.py tests/test_task_execution_mediation_journal.py",
|
|
"final_focused_result": "8 passed in57.14s with strict Secrets R2 and exact JSON catalogue/approval equality plus new bool/int negative.",
|
|
"unchanged_base_checks": 122,
|
|
"current_mediator_and_ordinal_checks": 8,
|
|
"single_full130_run_claimed": false,
|
|
"fixture_setup_failures": [
|
|
"Initial synthetic policy omitted required Rego test block; actual source policy validation refused. Added real deny test block.",
|
|
"Fixture HTTP helper initially shadowed http module; corrected helper import before source-server proof."
|
|
],
|
|
"mechanisms": [
|
|
"Actual Access source serve with enforced TokenReview client against explicit synthetic reviewer",
|
|
"Independent generated Ed25519 signer/key admission and owner-local source policy-digest pin",
|
|
"Actual Secrets mandatory producer-type signature verifier + strict retained-artifact task handoff",
|
|
"Actual Approval HTTP/SQLite service issue, distinct synthetic human approval, strict CAS and independent authenticated GET",
|
|
"Actual disposable OpenBao task grant/token, six fixed metadata calls and native cleanup",
|
|
"Authoritative independent read-scope denial after CAS leaves unknown/pending and zero target native effects",
|
|
"Untouched actual task package returns signed DENY before CAS; positive uses separate exact-descriptor synthetic fixture policy",
|
|
"No caller authorization result/callback accepted; missing strict dependency and source purpose/bool aliases refuse before credentials/CAS",
|
|
"Known synthetic token values absent from journal bytes"
|
|
]
|
|
},
|
|
"checks": [
|
|
"git diff --check passed",
|
|
"exact reverse-patch check passed",
|
|
"manifest matches all frozen owner source/test bytes",
|
|
"strict R2 dependency hash verified after final test"
|
|
],
|
|
"actual_policy_proof": {
|
|
"path": "/home/worsch/access-engine/examples/secrets-engine-service-task-execution/policy_package.md",
|
|
"sha256": "9c0facea87c61e0c2814538814e212d21415d77eb9f7cda8a8716bc1d37d2795",
|
|
"matches_owner_head": true,
|
|
"runtime_admission_literal_false": true
|
|
},
|
|
"strict_external_dependency_integrated_by_platform_worker": false,
|
|
"review_sha256": "14670cff7c40508b0283606dafe841f124b1e713d86c01759e2c0dd605af3513",
|
|
"native_openbao_version": "OpenBao v2.5.5 (028992583c693c4de6350b8aa52ff85e30375a99), built 2026-06-17T11:18:48Z"
|
|
}
|