200 lines
9.2 KiB
JSON
200 lines
9.2 KiB
JSON
{
|
|
"objective": "Finish what you found missing and finish CUST-WP-0080",
|
|
"status": "active",
|
|
"observed_at": "2026-10-18T01:27:45.628916+00:00",
|
|
"full_scope_baseline": {
|
|
"path": "docs/changes/netkingdom-target-2026-10-18/cust80-completion-r1/completion-audit.json",
|
|
"sha256": "sha256:9bdee9a790db598956fe35d5954137bb4582c9f3810d2392f7ef3236c369b065",
|
|
"all_requirements_retained": true
|
|
},
|
|
"normative_architecture": {
|
|
"path": "docs/netkingdom-target-security-architecture.md",
|
|
"sha256": "ec2079be18c7cdb8a1e4fdbd22131c08c83721d7a1bf18b4802bc5e229520f35"
|
|
},
|
|
"acceptance_gates": [
|
|
{
|
|
"id": "TSA-01",
|
|
"required_outcome": "Every inventoried privileged PEP authenticates its decision",
|
|
"required_evidence": "PEP denominator; admitted signer/channel; forged, altered, wrong-key/pin, unsigned/downgrade, expired and rotation refusals. Start SECRETS-WP-0014.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-02",
|
|
"required_outcome": "Exact approval produces one bounded protected operation",
|
|
"required_evidence": "SECRETS-WP-0013/RPF-WP-0035-T12 native effect; Approval T01/T05 issuer/tenant provenance; wrong actor/tenant/body, expiry, replay and unavailable refusal.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-03",
|
|
"required_outcome": "Crashes preserve uncertainty and cleanup",
|
|
"required_evidence": "Actual ledger restart/concurrency, consumed-before-effect failure, target reconciliation, scoped cleanup and revocation evidence; no blind replay.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-04",
|
|
"required_outcome": "First reusable browser case is accepted",
|
|
"required_evidence": "NK-WP-0048 and named Mason/Warden/KeyCape adapters; independent native structure, sign-in/denial, delivery, revocation and rollback.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-05",
|
|
"required_outcome": "Human and browser consumers can use the delivered identity",
|
|
"required_evidence": "KEY-WP-0040/U08 real-factor recovery; User Engine journey; NK-WP-0050 and CUST-WP-0080-T05 human/agent Playwright acceptance.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-06",
|
|
"required_outcome": "Actual agent and runner authority is bounded",
|
|
"required_evidence": "CUST-WP-0073/GLAS-WP-0012 admitted runtime read-denial/tool-effect proof; Forge/Platform per-job credential and repository-workflow abuse tests.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-07",
|
|
"required_outcome": "Credential lifecycle is inventoried and simplified",
|
|
"required_evidence": "Current owner/consumer denominator, unknown/orphan findings, native-identity elimination candidates; sampled replacement/adoption/old-refusal and deletion semantics. G04/G09/G12.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-08",
|
|
"required_outcome": "Recovery is independent and measured",
|
|
"required_evidence": "NK-WP-0049 plus platform/root owners; isolated recovery with ordinary issuer unavailable, restore/reconnect/audit continuity and measured RTO/RPO. G08/G11.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-09",
|
|
"required_outcome": "Security effects have independently reconciled evidence",
|
|
"required_evidence": "Admitted source/class inventory, atomic outbox, receiver readback, lag/duplicate/boundary accounting and missing-class findings. Approval/Audit/Tenant/Secrets owners.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-10",
|
|
"required_outcome": "Source and delivery controls cover declared entry paths",
|
|
"required_evidence": "FORGE-WP-0006/RMGR-WP-0021: denominator, SSH/HTTP/UI/new repo/import/mirror coverage, required checks/provenance, private synthetic finding through resolution.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-11",
|
|
"required_outcome": "Discovery remains accurate",
|
|
"required_evidence": "All reviewed IDs exactly once, owner/index parity, usable source links, current limits/version aliases, drift checks and package-family disposition. Reuse/Repo Manager/provider owners.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-12",
|
|
"required_outcome": "Improvement operates without repeated manual polling",
|
|
"required_evidence": "CUST-WP-0079/Activity accepted schedule, unassisted firing, checkpoint and changed-state notifications; adopted cadence runtime/receiver receipts; owner change and native remeasurement.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-13",
|
|
"required_outcome": "Shared adapters reduce per-consumer implementation",
|
|
"required_evidence": "Producer-format cross-language fixtures, two real consumers, version compatibility, denied-path parity, upgrades and rollback; no second PDP.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-14",
|
|
"required_outcome": "Minimal profiles are independently reusable",
|
|
"required_evidence": "Version/provider lock, dependency and optional-provider declaration, provider adapters, second clean installation, complete positive/negative journeys and upgrade/recovery instructions.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-15",
|
|
"required_outcome": "Optimization improves measured operations",
|
|
"required_evidence": "Baseline and repeat measurements of onboarding time/touches, p50/p95 decision/effect latency, scanner throughput/failure, resources/headroom and owner effort with unchanged control coverage.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
},
|
|
{
|
|
"id": "TSA-16",
|
|
"required_outcome": "Governance and exceptions remain truthful",
|
|
"required_evidence": "Existing SEC-DSM ledger and close-down controls reconciled to exact evidence; real authority for changes, explicit residual promotions, preserved deferrals and no invented owner assent.",
|
|
"status": "incomplete",
|
|
"completion_evidence": []
|
|
}
|
|
],
|
|
"sec_dsm_requirements": {
|
|
"path": "docs/evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json",
|
|
"sha256": "sha256:ad81f7186ada04aa1cc410932fc8669d69dc2232f3c0be00657b17f3aa3a8184",
|
|
"count": 116,
|
|
"status_counts": {
|
|
"unverified": 84,
|
|
"incomplete": 12,
|
|
"reference": 20
|
|
},
|
|
"closure_status_unchanged": true
|
|
},
|
|
"gap_ids": [
|
|
"G01",
|
|
"G02",
|
|
"G03",
|
|
"G04",
|
|
"G05",
|
|
"G06",
|
|
"G07",
|
|
"G08",
|
|
"G09",
|
|
"G10",
|
|
"G11",
|
|
"G12",
|
|
"G13"
|
|
],
|
|
"separate_required_deliverables": [
|
|
"G01-G13 current closure evidence or already applicable approved exceptions",
|
|
"SEC-DSM requirement ledger reconciled with exact evidence",
|
|
"T05 real human and agent Playwright acceptance and supported discovery",
|
|
"Second real consumer and clean installation proves reuse",
|
|
"Residual handoffs before workplan finish; no required work left only in prose"
|
|
],
|
|
"source_progress": {
|
|
"packet": "docs/changes/netkingdom-target-2026-10-18/forgejo-postgres-source-r1",
|
|
"producer_source_commit": "git:ca0cb75729a63c9288b7333382d0fa3eb1e8c9a3",
|
|
"consumer_owner_commit": "git:308e83fcfbf9ec98dbe6b0286cbe8ec7be8899b3",
|
|
"consumer_paths": 40,
|
|
"patch_sha256": "sha256:feb1079399a43989742ae0a946c1ada50113d1821e6541f97f0b5592ee1fc20c",
|
|
"postgreSQL_test_subtest_passes": 37,
|
|
"database_schema_profiles": [
|
|
"default",
|
|
"explicit-public",
|
|
"named"
|
|
],
|
|
"separate_client_crash_recovery": true,
|
|
"actual_database_server_restart_recovery": true,
|
|
"controlled_missing_lock_and_private_marker_counterexamples": true,
|
|
"following_query_hook_context_panic_corrected": true,
|
|
"selected_composed_passes_including_subtests": 94,
|
|
"source_skips": 0,
|
|
"release": {
|
|
"frontend_and_static_backend": "passed",
|
|
"release_version": "11.0.3+cust80.feb10793",
|
|
"binary_sha256": "sha256:92efb26614d3fca22c400920d92c4cd022e32ab86c1f562f60699ab5f750cd28",
|
|
"embedded_assets_exact": 2234,
|
|
"actual_release_CLI_checks": 48,
|
|
"exact_local_OCI_exports": 2,
|
|
"manifest": "sha256:9d127b0a75d3d53b1598e7f380dce29f23f42c2e69056fdfc9a42122d98c41c7",
|
|
"native_admission": false
|
|
},
|
|
"independent_owner_assent": false,
|
|
"production_database": false,
|
|
"native_gates_closed": 0
|
|
},
|
|
"current_work": "Current authenticated operation/inverse sessions and evidence; exclusion of all application/Helm/release writers; private journal custody/retention; ongoing HTTP/API/Git/SSH authorization; exact owner and native admission. All sixteen gates, G01-G13 and 116 SEC-DSM entries remain in scope.",
|
|
"workplan_finished": false,
|
|
"goal_complete": false,
|
|
"preceding_audit": {
|
|
"path": "docs/changes/netkingdom-target-2026-10-18/cust80-completion-r2/completion-audit.json",
|
|
"sha256": "sha256:001ede40ad6d7cadcfc575a101828f782f65ea0c75e6a5e0f6b0afe761420b0d"
|
|
}
|
|
}
|