the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-execution-backend-r1

Apps T05 source preparation, r1

This packet adds real offline source mechanics on frozen Apps main 944b30ad63ab054cc24617e374e177d34cd572da, without claiming an operational configuration backend. The isolated source is /tmp/apps-execution-backend-r1/source. apps-source.patch contains one module, ten synthetic tests and an existing RAPPS-WP-0016-T05 continuation. No canonical Apps source or status was edited, no commit was made and no owner assent was produced. NK-WP-0048-T34 remains open.

The module compares explicitly supplied public JSON projections against exact proposed acceptance digests. It permits differences only in the named netkingdom OAuth entry and ENABLE_AUTO_REGISTRATION/ACCOUNT_LINKING policy keys. It preserves other OAuth sources and all unrelated public settings, requires disabled registration and retained local sign-in, and rejects value-bearing key shapes. It pins the actual Makefile, public values, registry values and helper bytes. Output contains only metadata, hashes and command templates, never OAuth/group contents or helper output. The group reference bytes are exact acceptance-bound data; this does not establish chart key compatibility or the runtime any-of group behavior.

The upgrade template uses the actual Forgejo chart/version/namespace/release and private helper stream seam, excluding unrelated Make prerequisites and --install/namespace creation. The module imports no command/runtime API, opens no files, and has no dispatch runner or capability callbacks. The private helper is named but cannot execute. activate() always raises Refused, even when caller-supplied session, journal or exclusion flags are supplied. A source input is not an authenticated acceptance, observation or authority record.

Inverse preparation binds the exact transaction scope, immutable original before, confirmed post, current post equality and later restored revision with the original configuration hash. Pending, unknown and already-restored records require owner reconciliation rather than unguarded replay. Preexisting matched configuration yields no rollback command. All inverse templates remain non-dispatchable and require a fresh current inverse operation session; the revoked hand-over parent and stored provenance confer no permission. The separate control-flow candidate's inverse_session placement is unchanged.

The original receipt-only rollback seam and preexisting NOCHANGE behavior are untouched: this patch does not edit or replace any adapter or kernel step. It does not introduce an eighth step or switch configuration ownership to a Forgejo API mutation.

Actual facilities selected for owner continuation

These are source implementation proposals within T05, not authority grants or an assertion that the missing implementations exist.

Need	Selected existing owner surface	Exact remaining implementation
Accepted case configuration	Apps helm/forgejo-values.yaml, registry values and existing tools/forgejo-helm-secrets.sh; chart 12.5.0	Owner must publish the exact accepted public OAuth/group-reference projection and chart-compatible secret reference. A confidential projection must prove DB/admin/helper values unchanged without disclosing or emitting them. The preparer never consumes helm get values output.
Authenticated durable configuration history	Existing owner choice of committed docs/evidence/<date>-forgejo-netkingdom-handover.json identified by path@commit, extended within the same repository evidence surface	Retain original intent before mutation; bind separate confirmed post, inverse attempt and verified outcome records to that immutable intent and transaction. Authenticate owner custody and main publication/readback. Stop on pending/publication ambiguity. A local file or git commit alone is not authenticated execution permission. No remote publication or new service is selected here.
Current operation/inverse session	Existing attended Apps owner option C (apps-consumer-handover), using Warden's actual Invocation/exact-source evidence-verification seam where applicable	Implement the actual owner provenance verifier, current disposition and revocation source. Bind principal/owner/case/acceptance/source/cluster/namespace/release/client/descriptor/transaction and distinct inverse operation. Revoke each operation attempt on success/refusal/failure. The same operator may perform the fresh inverse; no new standing agent identity is proposed.
Release-wide serialization	Existing Apps owner-operated release tooling capability, with attended release-freeze/reconciliation as the proposed mechanism	Owner must bind effective exclusion of manual Helm, Make and every external automation/reconciler across current-check, command and readback. No implemented enforcement was found. Helm has no CAS. Local locks, Warden journal locks and revision equality are insufficient; dispatch must stay disabled.

Warden case_run.Executor explicitly injects an evidence verifier and fixed adapters; none ship by default. Its _admission rechecks current session evidence, but that does not implement a separate Apps configuration inverse session. Journal provides private SQLite, synchronous FULL and a process lock for its own case receipts/intents; it is neither this configuration journal nor exclusion of other Helm writers. Its code is inspected, not instantiated. The Apps private-reader runtime-proof wrapper authenticates a different read operation and is not reused as release-write or inverse permission.

Bounded writer inventory

The archive's Makefile, all tools/ source and all three workflow source files were searched, together with the Forgejo/operator runbooks. Paths/hashes are in source-inventory.json. No credentials/config from HOME were inspected.

The direct Forgejo Helm writer is Makefile:483 (forgejo-deploy), with Makefile:465 its server dry-run variant. The former depends on mailer ESO, OpenBao store/operator installation and hook-template deployment; those are outside this OAuth-only transaction. Runbook deployment commands invoke this Make target. No independent Forgejo release writer was found in the archived tools or workflows. Other release writers exist for inter-hub/core-hub/vergabe/ coulomb/reuse; their configurable Make release variables and arbitrary manual Helm access cannot be assumed excluded from Forgejo. External writers and cluster reconciler permissions are not enumerable or enforceable from this bounded source inventory. There is no claim of exhaustive estate writer discovery or production writer freeze.

Validation and limits

Ten tests pass under an empty HOME and allowlisted environment. The test code blocks subprocess creation and sockets before exercising preparation. Checks cover exact scope/source mismatch, unrelated release and OAuth policy changes, duplicate sources, unsafe registration, value-bearing keys, case-only templates, original-before/post/current/inverse guards, ambiguous states and preexisting NOCHANGE. No native tool, credential read, external network, browser/MFA or owner session was exercised. This proves offline validation mechanics only.

Synthetic public projections intentionally do not assert the chart's actual OAuth schema. No production accepted projection was available in the bounded owner source. Actual chart rendering, authoritative private/public readback, durable publication failure/recovery and all four consumer login/group probes remain real T02/T03/T05 work. The existing T05 workplan's needs-change history and task status remain retained in the source draft.