1467 lines
97 KiB
Text
1467 lines
97 KiB
Text
---
|
||
id: CUST-WP-0080
|
||
type: workplan
|
||
title: "NetKingdom target security architecture and SEC-DSM implementation"
|
||
domain: infotech
|
||
repo: the-custodian
|
||
status: active
|
||
owner: codex
|
||
topic_slug: custodian
|
||
created: "2026-10-12"
|
||
updated: "2026-10-18"
|
||
flavor: implementation
|
||
depends_on: []
|
||
state_hub_workstream_id: "dfadb19b-445e-59c6-bcd6-48e87b912c52"
|
||
---
|
||
|
||
User-requested estate assessment and gap closure. Existing owner plans retain
|
||
implementation and native acceptance ownership. This plan adds the cross-cutting
|
||
SEC-DSM assessment and tracks uncovered findings without duplicating their tasks.
|
||
Explicitly deferred or residual work is not silently promoted.
|
||
|
||
2026-10-16 founder continuation: document the optimized target architecture and
|
||
drive implementation using GPT-6.1-Sol medium subagents. The normative target for
|
||
this implementation effort is `docs/netkingdom-target-security-architecture.md`;
|
||
`docs/netkingdom-target-implementation.md` links all sixteen acceptance gates to
|
||
existing owner work. This extends the existing coordinator rather than creating
|
||
a parallel security backlog. T03 retains source/lifecycle implementation, T05
|
||
the browser consumer, and T04 native requirement closure. Existing scoped live
|
||
authorizations and deferrals remain applicable. Necessary residual dependencies
|
||
receive explicit owner-scoped promotion before implementation, never a blanket
|
||
activation. The full target remains incomplete until every acceptance gate is
|
||
proved at its stated scope.
|
||
|
||
## Review canon and map actual architecture
|
||
|
||
```task
|
||
id: CUST-WP-0080-T01
|
||
status: done
|
||
priority: high
|
||
state_hub_task_id: "c770f7e1-25eb-53ec-9a37-1f7794077ff8"
|
||
```
|
||
|
||
Read SecurityCanon SEC-DSM 1.0, accepted NetKingdom layer model and case contracts,
|
||
owner declarations, source implementation boundaries and open workplans.
|
||
Delivered `docs/netkingdom-security-blueprint.md`. The source inventory includes
|
||
the named repos, identity, policy, approval, lifecycle, audit and supporting engines.
|
||
Role-engine is a documentation catalog; zone-engine is an offline reference.
|
||
Neither is described as live enforcement. Emergent knowledge package 0.2.6,
|
||
digest 8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02,
|
||
was withheld for changed sources; current owner sources were reviewed directly.
|
||
|
||
## Inspect and optimize the blueprint before planning closure
|
||
|
||
```task
|
||
id: CUST-WP-0080-T02
|
||
status: done
|
||
priority: high
|
||
state_hub_task_id: "5973026f-8ca9-5882-99fe-65a54bc250ac"
|
||
```
|
||
|
||
Blueprint inspection table records trust boundaries, circular dependency removal,
|
||
identity-first credential selection, exact operation bindings, source/native
|
||
evidence separation and lifecycle closure. Gap analysis and sequence are in
|
||
`docs/netkingdom-security-gaps.md`. No new broker/PDP or blanket conformance claim.
|
||
|
||
## Close source defects and reconcile uncovered lifecycle gaps
|
||
|
||
```task
|
||
id: CUST-WP-0080-T03
|
||
status: progress
|
||
priority: high
|
||
state_hub_task_id: "87637402-02f1-57c1-8fbc-4141598af8e3"
|
||
```
|
||
|
||
Start with the reproduced DN-subject validation defect in existing KEY-WP-0040.
|
||
Reconcile G04/G07/G08/G10/G12/G13 against current owner inventory, scanner wiring,
|
||
bootstrap callers and approved exception evidence. Reuse owner work where it
|
||
already covers the finding. Record new concrete uncovered implementation work
|
||
before closing this task. Never populate secret values or invent owner approval.
|
||
|
||
2026-10-18 receive-budget correction: the unchanged owner source reproduces the
|
||
normal publication refusal at 90.06 seconds after 94 of 141 introduced objects.
|
||
Forge `ea65606c` publishes a six-file correction reusing Repo Manager's bounded
|
||
small-input profile, private tmpfs and independent cleanup. All scanner rules,
|
||
coverage and limits remain unchanged. The complete original delta now scans all
|
||
141 objects/one ref in 52.53 seconds. The full source suite and additional boundary
|
||
checks cover 54 distinct leaf cases without skips; initial fixture/setup failures
|
||
are retained. New FORGE-WP-0010-T01 is done, T02 progress and T03 wait; the finished
|
||
baseline and unpromoted residual plan are not reopened.
|
||
|
||
Read-only native inventory verifies the old pinned binaries, tmpfs, kernel and
|
||
166 identical installed hook fragments. Two proposed Apps source files and a
|
||
conditional two-field Deployment patch pass forward/inverse simulation and exact
|
||
server dry runs. The old Helm release must not overwrite later live changes.
|
||
Sealed activation/recovery, final drift/resource preflight, independent package/
|
||
owner admission and founder go remain open. No native change or gate closure;
|
||
the latest root evidence remains locally committed but remotely unpublished.
|
||
Source/proof: `docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/`.
|
||
|
||
2026-10-18 actual callback/current-grant continuation: two signed access-purpose
|
||
counterexamples fail against the prior ID-token verifier. The consumer now
|
||
requires independently admitted application tenant/current-token bindings,
|
||
separates ID/access purposes, checks the exact signed RS256 at_hash, joins
|
||
issuer/client/subject/tenant/type/issuance/assurance/auth-time/provenance and
|
||
rechecks current status before and after the PDP. KeyCape `e2c5a947` signs the
|
||
exact online human access-grant binding without changing disabled legacy issuance.
|
||
Its complete race suite passes 726 test/subtest results with the same six existing
|
||
native/external skips. The identical current consumer fails against the old issuer.
|
||
|
||
The actual HTTPS PKCE/discovery/UserInfo/status/revocation handlers, real Forgejo
|
||
provider/callback and unchanged generated client pass five separate consumer
|
||
processes: two current grants accepted; mixed pair, revoked original and suspended
|
||
human refused. MFA session seeds and PDP admissions are synthetic. The latest
|
||
focused suite passes 91 results without skips; the final four selected composed
|
||
packages pass 116 without skips. The initial reused-file fixture skip and its
|
||
subsequent correction are retained. No native database/issuer proof is inferred.
|
||
|
||
Apps `ab3cf5cd` retains the initial source commit and its validation-scope
|
||
correction. The 49-path source package and six issuer source postimages replay
|
||
exactly; production code and generated adapter match the tested runtime.
|
||
Complete release/static-assets/OCI rebuild, independent owner assent and native
|
||
package/type/custody acceptance remain open. Exact source/proof is in
|
||
`docs/changes/netkingdom-target-2026-10-18/forgejo-current-token-r1/`.
|
||
|
||
The user explicitly selected current KeyCape checks on every ongoing API/Git/SSH
|
||
operation for linked accounts, retaining the separate local break-glass path.
|
||
The target architecture and decision b96ef564-c713-4a48-9ab2-849958cec681 record
|
||
that profile; it grants no live change. Those route/resource/action/group checks
|
||
remain actual implementation work under existing RAPPS16-T09/NK48-T43, alongside
|
||
current protected operation/inverse, exact effect/approval, journal custody and
|
||
all-writer exclusion. Callback proof closes no native gate or coordinator task.
|
||
Audit r6 retains all sixteen gates, G01–G13 and all 116 ledger requirements.
|
||
|
||
2026-10-18 shared-client/inverse continuation: KeyCape `08c083ba` publishes
|
||
one producer current-token implementation, its generated Go adapter and private
|
||
current/revoke/independent-inactive CLI commands. Explicit trust/identity/status
|
||
joining, per-check trust/credential rereads, post-response lifetime/key checks
|
||
and exact token-digest output binding pass 724 full race test/subtest results
|
||
with six existing native/external skips. A deliberate generated-consumer-only
|
||
change fails the ordinary parity checker. KEY42-T04 records source completion;
|
||
independent issuer/profile review and native admission remain open.
|
||
|
||
Warden `08c098e6` separates immutable original session provenance from the fresh
|
||
current session needed for an exact existing inverse. It verifies original
|
||
journal/intent/pins and current identity without granting replay or clearing
|
||
uncertainty. Its actual canonical guarded suite passes 796 tests, four deselected.
|
||
The cross-owner fixture uses the actual HTTPS issuer, built CLI, generated Go
|
||
consumer and Warden kernel: 45 assertions across fresh owner processes pass,
|
||
including current/revoked checks, original business replay refusal, exact synthetic
|
||
effect restoration and independent inactive cleanup readback. Case/catalog/owner
|
||
attestations and target are synthetic; no real Forgejo/native acceptance is claimed.
|
||
|
||
All 19 KeyCape and four Warden source delta postimages replay exactly from their
|
||
published bases; compiled integration runtime/export bytes match. Original API,
|
||
fixture-mode and archive-only metadata failures are retained. Source and evidence:
|
||
`docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/`.
|
||
NK48/Apps retain current authenticated operation/inverse effect/approval bindings,
|
||
ongoing HTTP/API/Git/SSH, private journal custody/retention and all release-writer
|
||
exclusion. All sixteen gates, G01–G13 and 116 ledger entries remain in scope;
|
||
no coordinator task or native gate closes. Completion audit advances to r5.
|
||
|
||
2026-10-18 current-token producer continuation: actual owner contracts confirm
|
||
that legacy KeyCape JWT validity is expiry-only and Warden's injected session
|
||
verifier does not supply a current revocation source. Prepared an explicit,
|
||
proposed issuer scope extension in the existing KeyCape service rather than
|
||
an application-local token registry. One opt-in bounded hash-only store serves
|
||
actual human/service issuance, UserInfo, RFC 7662 introspection and RFC 7009
|
||
revocation. Unique access-token identifiers prevent same-second remint/revival;
|
||
ID-token and disabled-profile behavior remain unchanged. Online checks bind
|
||
current registration and human disposition and recheck after directory lookup.
|
||
|
||
All 659 complete source race test/subtest results pass, with six existing
|
||
native/external skips; all 43 new status results pass without skips. The built
|
||
standalone server passes 26 actual-process checks, including revocation, real
|
||
restart/predecessor refusal, fresh issuance, capacity and disabled routes. A
|
||
separate actual-handler HTTPS PKCE flow passes. Omitting the revoked-state
|
||
predicate in a controlled source copy fails seven intended checks. All 18 source/publication
|
||
postimages replay exactly from the published owner archive; production is
|
||
untouched. Process-local status loss deliberately requires reauthentication;
|
||
offline consumers retain their existing token lifetime. These limits are part
|
||
of the explicit proposed KEY-WP-0042 contract, not an implicit scope promotion.
|
||
|
||
Ordinary owner identifier preview exposed a preexisting closed historical task
|
||
without its file UUID. The Hub has an exact matching existing binding; normal
|
||
consistency audit skips creation in closed workstreams. Its existing helper
|
||
restores only that exact already-recorded reference after parent/record/title/
|
||
status/body comparison. Normal Repo Manager assigns the four new canonical
|
||
proposal records. KeyCape `67a0869c` publishes the 17-path feature and historical
|
||
reference restoration, without changing historical status or any existing UUID. Exact source, refusals and process receipts:
|
||
`docs/changes/netkingdom-target-2026-10-18/keycape-token-status-r1/`. Independent
|
||
issuer/profile assent, native issuer admission and existing NK48/Apps operation,
|
||
inverse, ongoing-resource and cleanup bindings remain open. All sixteen target
|
||
gates, thirteen gaps and 116 ledger entries remain in scope; none closes here.
|
||
|
||
2026-10-18 PostgreSQL continuation: the actual Forgejo engine/model schemas and
|
||
OAuth configuration types now pass 37 test/subtest results on disposable
|
||
PostgreSQL 16.14 across default, explicit-public and named schemas. Separate
|
||
client processes verify rollback after death immediately following INSERT,
|
||
committed apply survival through an actual database-server restart, and fresh
|
||
reconciliation/inverse. Exact restoration, drift/link refusals, trigger rollback,
|
||
uncooperative writer exclusion and concurrent preparation pass. Controlled
|
||
copies without the table lock or private-query marker fail in all three profiles.
|
||
|
||
The diagnostics test exposed a real XORM tracing-context composition panic.
|
||
Publishing the task context into the shared query hook fixes the actual path
|
||
without changing the incoming private marker. Six SQLite diagnostic checks and
|
||
all 94 selected composed package results pass without skips. Earlier container,
|
||
fixture and compilation failures, the original panic and both counterexamples
|
||
remain retained. All owned test containers and volumes were removed.
|
||
|
||
Apps `308e83fc` publishes the 40-path source/build correction at the primary hub
|
||
with all nine task UUIDs/statuses preserved. The complete fresh frontend/static
|
||
release, all 2,234 embedded assets and 48 release CLI/SQLite checks pass. Two
|
||
fresh local no-cache OCI exports reproduce the same archive/manifest/config/index;
|
||
no second source build, registry publication or deployed acceptance is claimed.
|
||
Evidence: `docs/changes/netkingdom-target-2026-10-18/forgejo-postgres-source-r1/`.
|
||
Current operation/inverse identities, every release writer, private journal
|
||
custody/retention, ongoing resource paths and independent/native acceptance remain
|
||
under existing T34/T42/T43 and RAPPS16-T07/T08/T09. This source proof closes no
|
||
native target gate; the complete goal and ledger scope remain active.
|
||
|
||
2026-10-18 goal continuation: implemented the missing producer-owned Go client,
|
||
generated export parity check, validated Forgejo policy fixtures/Rego tests and
|
||
actual consumer callback coverage. Access Engine source `ca0cb757` is committed
|
||
and projected at primary/railiance01 with its original task bindings preserved.
|
||
The complete root race suite passes 494 test/subtest results with three existing
|
||
optional/fixture skips; the layer check and strict group-shape regressions pass.
|
||
The original malformed-group counterexamples, incomplete source files and failed
|
||
preparations remain retained.
|
||
|
||
Composed the actual Forgejo backend with private input and the source-state
|
||
transaction. Recovered the interrupted empty DB-context snapshot from its exact
|
||
frozen patch and verified both declared hashes. Actual CLI replay exposed the
|
||
Engine/Session logging-guard incompatibility; a shared underlying-logger check
|
||
corrects it while retaining raw SQL refusal and real hook redaction. Final actual
|
||
package checks pass 76 test/subtest results without skips, and the complete backend
|
||
passes 48 isolated CLI/SQLite subprocess checks. All 35 composed patch postimages
|
||
reconstruct exactly from the pinned official archive. Source and proof inventory:
|
||
`docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/`.
|
||
|
||
Actual issuer-source inspection found a further mandatory interoperability gap:
|
||
KeyCape emits a structured `assurance` object; the preceding candidate expected a
|
||
string. The actual TokenHandler fixture reproduced the rejection. The corrected
|
||
consumer preserves the signed object and tenant provenance, validates its actual
|
||
authentication time, and bounds identity validity by authentication age, token
|
||
age and expiry. All 77 actual-issuer/provider/callback test and subtest results
|
||
pass, including real discovery/FetchUser/UserInfo joining, signed ALLOW/DENY and
|
||
UserInfo spoof refusal; all 93 selected composed
|
||
package results pass without skips. The new 37-path patch replays exactly against
|
||
the official source archive. The fresh complete frontend/static release build
|
||
passes; all 2,234 embedded assets match and all 48 actual release CLI/SQLite
|
||
checks pass. Evidence is in `forgejo-keycape-claims-r1`; these are synthetic
|
||
authentication/source and local artifact proofs.
|
||
Two fresh no-cache local OCI exports from that verified binary have identical
|
||
manifest/config/index/archive digests, preserving all base layers and rootless
|
||
runtime configuration. No second source build or operational admission is claimed.
|
||
Apps `3fb031a4` publishes the five-file build-source integration at the primary
|
||
hub, preserves all nine task UUIDs and starts existing RAPPS16-T09. Independent
|
||
owner review and operational admission of that revision remain open.
|
||
Existing T43 /
|
||
RAPPS16-T09 also retain ongoing HTTP/API/Git/SSH and operation/inverse coverage;
|
||
T41/T42 retain full release integration, exclusion and private journal custody.
|
||
The full completion audit now enumerates all sixteen gates, thirteen named gaps
|
||
and 116 SEC-DSM ledger entries under `cust80-completion-r1`. No native gate or
|
||
coordinator task is closed by these source results; the full user goal is active.
|
||
`cust80-completion-r2` retains that full scope and records this source progress.
|
||
|
||
2026-10-18 resumed application review: completed the interrupted seventeen-file
|
||
release-build evidence checkpoint as `8951d324`, preserving the staged brief and
|
||
other work. Reconstructed the exact retained Access Engine adapter and producer
|
||
candidate against producer source `d328a260` in network-disabled, private-PID
|
||
sandboxes. Both full commands fail: the adapter includes an empty Go source file;
|
||
the actual producer rejects the Forgejo policy for undeclared attributes and
|
||
missing embedded/referenced fixtures and Rego tests. Adapter verifier tests and
|
||
two existing producer control functions pass, but do not establish package or
|
||
policy acceptance. The consumer callback test file is also empty, and ongoing
|
||
HTTP/API/Git/SSH coverage is absent from the candidate. Original interrupted runs
|
||
remain unverified; no previous success is overwritten. Evidence and exact source
|
||
pins: `docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/`.
|
||
NK48-T43 / RAPPS-WP-0016-T09 retain these corrections and full profile acceptance;
|
||
T41/T42 retain independent private-input/transaction review and owner integration.
|
||
No task or native target gate is closed by this review.
|
||
|
||
2026-10-12: KEY-WP-0040 source defect repaired and committed as key-cape `1344fc8`.
|
||
Twenty recovery tests and the full Go suite pass. Blue-lane code-volume-only
|
||
deployment reached generation 11 Ready; health 200 and anonymous recovery 403
|
||
verified. Exact original proposal, dry-run, initial rollout observation and
|
||
final receipt are in `docs/evidence/2026-10-12-netkingdom-security/` and the
|
||
existing supervision record. No factor or account was changed. G01 still needs
|
||
the founder's authenticated preview/U08. The prepared OTP help link remains
|
||
local source only. G13 now explicitly tracks PDP response authentication; the
|
||
finished signature producer workplan is not treated as proof of consumer rollout.
|
||
|
||
2026-10-12 continuation: reproduced and repaired G13 Check-client credential
|
||
forwarding through HTTP redirects and environment proxies, including the approval
|
||
flow's unsafe opener override. Strict literal loopback origins and response
|
||
bounds are enforced before credential access/decision use. New native owner
|
||
SECRETS-WP-0014 records completed transport work and separate open independently
|
||
anchored signature enforcement/native acceptance tasks. Focused regressions:
|
||
18 failed/5 passed before, 23 passed after; broader focused suite 71 passed.
|
||
Real repository full suite 675 passed/1 skipped. Archived sandbox full-suite
|
||
ownership/repository-detection failures are retained in the receipt rather than
|
||
misrepresented as source regressions. No live credential, policy, entitlement,
|
||
PDP deployment or protected backend was touched. G13 stays open.
|
||
|
||
2026-10-12 continuation: G08 source repair implemented in NetKingdom. Removed
|
||
emergency/reprint root export and generator prefix disclosure; private service
|
||
file creation, public-recipient bootstrap, explicit matching custody resume,
|
||
non-mutating dry-run and digest-bound encrypted handoff now have disposable
|
||
workflow tests. Historic delivery flags are preserved. NK-WP-0049 owns remaining
|
||
legacy caller reconciliation and native recovery acceptance; NK-WP-0045's
|
||
finished non-secret root-grant recovery does not cover this secret custody path.
|
||
No real root/credential was read, generated or rotated and no live bootstrap was
|
||
run. Existing CUST-WP-0073-T05 exposure deferral remains effective. Exact source
|
||
and validation receipt: `bootstrap-handoff.json` in the evidence directory.
|
||
|
||
2026-10-12 additional G08 progress: direct custody/encrypt/decrypt fixes pushed
|
||
as NetKingdom `4cf26a9`; 206 tests pass. NK-WP-0049-T02 is progress with specific
|
||
remaining Make/rotation/admin output callers. Six SEC-DSM requirements now have
|
||
substantive incomplete assessments and scoped proof/missing-evidence fields;
|
||
none is marked conformant. `custody-entrypoints.json` preserves the baseline,
|
||
source manifest, test coverage and cleanup/isolation limits. No live credentials
|
||
or founder-deferred rotation were used.
|
||
|
||
2026-10-12 G08 Make follow-through: NetKingdom `681c5b0` pushed; 227 actual checkout
|
||
tests pass (21 real-SOPS tests, no skips). Public-only setup, explicit matching-key
|
||
private SOPS output, ambient identity isolation, no-overwrite/Git-output guards
|
||
and sanitized parser/tool failure handling replace the legacy Make paths. Six
|
||
incomplete requirement assessments now cite `sops-make-entrypoints.json` and
|
||
state remaining direct/delegated callers, existing copies and native recovery
|
||
proof. This neither executes deferred rotation nor admits a production SOPS
|
||
version; the disposable binary's official checksum verification is scoped in the
|
||
receipt. NK-WP-0049-T02/T03 and G08 remain open.
|
||
|
||
2026-10-12 G08/G09 rotation output repair: NetKingdom `6ae4708` pushed.
|
||
20 regressions failed against the old
|
||
NetKingdom source; 25 focused regressions and all 252 repository tests pass after
|
||
repair. Private file validation/atomic handoff, sanitized diagnostics, SQL stdin,
|
||
fail-closed database discovery and unattended LDAP refusal remove reproduced
|
||
source defects without executing founder-deferred rotations. DSM-ROT-003 now has
|
||
an explicit incomplete assessment (seven incomplete, 89 unverified, 20 anti-pattern
|
||
references). Native adoption/old-value refusal and admin-bootstrap/RSA/delegated
|
||
source gaps remain in NK-WP-0049. Receipt: `rotation-output.json`.
|
||
|
||
|
||
2026-10-12 current-profile admin bootstrap repair pushed as NetKingdom `19a1c75`.
|
||
It removes automatic obsolete
|
||
trigger-admin creation, replaces output/argv/shell-source handling with private
|
||
input and stdin delivery, and prevents password/policy overwrite on rerun.
|
||
Fourteen baseline tests failed, two passed; 36 focused tests pass including seven
|
||
actual privacyIDEA 3.12.2 model tests on disposable SQLite. Full suite: 288 tests
|
||
and 29 subtests passed, no skips. No live credential,
|
||
account or policy changed. Evidence: `admin-bootstrap.json`. DSM-TRANS-002 now
|
||
records the remaining privileged KeyCape token path explicitly (eight incomplete,
|
||
88 unverified, 20 reference entries). Native PostgreSQL/image/MFA acceptance,
|
||
legacy-object revocation and other delegated helper lifecycle remain open.
|
||
|
||
2026-10-12 G07 broadened audit: all 21 review repositories inherit a generated-only
|
||
guard; a disposable private-key commit succeeds through it. Repo Manager's new
|
||
`secret-scan` adapter (`77fc4c9`, pushed) pins Gitleaks, scans exact staged blobs without content
|
||
output and passes 17 focused tests including an actual refused selective commit.
|
||
All 249 Repo Manager tests pass, no skips.
|
||
RMGR-WP-0021 owns source integration, exact local activation, independent forge/CI
|
||
coverage and private detection-to-response acceptance. No global hook/routing
|
||
changed and no real credential finding was exposed. Four DSM-DETECT assessments
|
||
are now explicitly incomplete (12 incomplete, 84 unverified, 20 references).
|
||
Evidence: `secret-detection.json`; G07 stays open pending native enforcement.
|
||
|
||
2026-10-12 G07 native workstation activation: RMGR-WP-0021-T02 completed.
|
||
Exact proposal CUST80-G07-local-hooks-001 installed the pinned scanner at a
|
||
durable local path and composed the two known hooks, preserving routing and
|
||
other hooks. All 22 scoped checkouts passed actual configured-hook clean,
|
||
disposable-secret, generated-only and non-executable-scanner probes. Temporary
|
||
indexes/object stores preserved user source/staging/branches; executable mode was
|
||
restored, and an unreviewed checkout kept its prior behavior. Eleven targeted
|
||
activation/rollback/guard tests pass. Receipt: `secret-hook-activation.json`;
|
||
exact proposal, backups and rollback: `docs/changes/CUST-WP-0080/`. Independent
|
||
forge/CI enforcement, other clones/history and detection-to-response remain open.
|
||
No DSM requirement or whole G07 closure is inferred from this local acceptance.
|
||
|
||
2026-10-12 G07 forge baseline: read-only observation confirmed railiance01 and
|
||
Forgejo 11.0.3. Its repository storage has 165 repository directories (not yet an
|
||
admitted production denominator). All 22 reviewed repositories exist and their
|
||
receive-hook files exactly match the seven distinct hashes generated by upstream
|
||
v11.0.3 templates, with no extra hook files/symlinks at the inspected depth.
|
||
No custom scanner hook is installed there. Branch-protection/Actions coverage,
|
||
internal policies and actual push rejection remain unverified. Metadata and
|
||
upstream comparison: `forge-secret-detection-baseline.json`. No server mutation,
|
||
credential read, repository-content scan or synthetic push was performed.
|
||
|
||
2026-10-12 G07 independent boundary source: FORGE-WP-0006 now owns the native
|
||
forge implementation under RMGR-WP-0021-T03. A standalone Linux adapter scans
|
||
introduced reachable Git objects and updated ref names, preserving quarantine
|
||
and refusing incomplete/oversized input. Thirty-three leaf cases pass, including
|
||
actual disposable pushes for intermediate/deleted secrets, second-parent merges,
|
||
messages/tags, initial/SHA-256 repositories, replacement/graft bypasses and
|
||
scanner failures. Existing owner Python test passes; the new owner Make target
|
||
passes with admitted Gitleaks and Go 1.26.9. Receipt: `receive-secret-detection.json`.
|
||
No production hook changed. Exact-binary admission, repository denominator,
|
||
SSH/HTTP/frontend/restart/new-repository coverage and response acceptance remain
|
||
open in FORGE-WP-0006-T02/T03 and RMGR-WP-0021-T03/T04. G07 stays open.
|
||
|
||
2026-10-12 G07 native admission: the exact adapter/scanner binaries passed
|
||
clean/detection/quarantine/tool-failure/recovery checks in disposable repositories
|
||
inside the running Forgejo image. Builtin authorization was stubbed only in this
|
||
isolated probe; no production hook changed during that probe. Receipt:
|
||
`receive-native-probe.json`. Metadata reconciliation now matches 165 database
|
||
repositories to 165 directories; none has a protected-branch rule. The initial
|
||
22 reviewed repositories pass shallow/partial/gitlink compatibility checks; the
|
||
remaining 143 are uncovered, not exempt. `forge-repository-inventory.json`
|
||
retains aggregates and reviewed identities only. An exact additive-hook activation
|
||
proposal and tested rollback are prepared as FORGE6-RECEIVE-ACTIVATION-001 under
|
||
the existing standing blue-lane authorization; outcome is recorded separately.
|
||
|
||
2026-10-13 interruption recovery: retained activation receipt proves that
|
||
FORGE6-RECEIVE-ACTIVATION-001 completed on October 12 at 17:32 UTC, after the
|
||
last progress note. All 22 exact Forgejo repositories gained the additive hook;
|
||
actual SSH probes produced clean/blocked scanner results under a temporary veto,
|
||
with probe refs/quarantined commits absent and the veto removed. A fresh read-only
|
||
inspection confirms the same pod/image, exact original and added hook hashes,
|
||
executable pinned binaries and healthy service. Evidence:
|
||
`receive-hook-activation.json` in the October 12 directory and
|
||
`docs/evidence/2026-10-13-netkingdom-security/receive-profile-recheck.json`.
|
||
Ordinary clean-push acceptance, HTTP/frontend/lifecycle coverage, the other 143
|
||
repositories and private response acceptance still need proof. G07 remains open.
|
||
|
||
2026-10-13 G07 acceptance follow-through: committed recovered activation as
|
||
Custodian `eb93eee` and owner record as railiance-forge `d2d87ca`; both ordinary
|
||
SSH source pushes passed through the installed profile via fix-consistency and
|
||
remote heads were verified. Owner T02 is progress in both file and hub. Four
|
||
installer/rollback tests pass again. An isolated local instance of the exact
|
||
Forgejo image with no network or host mounts passes 23 boolean lifecycle checks:
|
||
HTTP clean/secret/quarantine behavior, native content API and merge-message
|
||
refusal with actual detector evidence, clean merge, hook regeneration, exact
|
||
Git-template inheritance on new repository creation, restart and subsequent
|
||
refusal. Seven incomplete preparation/assertion attempts are retained; none is
|
||
counted as acceptance. The successful receipt and upstream source hashes are in
|
||
`docs/evidence/2026-10-13-netkingdom-security/forge-lifecycle-summary.json`.
|
||
The test reproduces the absent default new-repository hook and proves a candidate
|
||
Git-template repair, not a deployed repair. Import/mirror clone/fetch bypass the
|
||
receive boundary; those and the other 143 repositories, deployed HTTP/SSO/UI and
|
||
k3s lifecycle acceptance, CI authority and private response remain open in
|
||
FORGE-WP-0006/RMGR-WP-0021. Close-down checklist row 21 now records these unarmed
|
||
controls. No gap or requirement is marked closed from isolated acceptance.
|
||
A real pre-commit finding on the authored harness was privately classified as a
|
||
public binary-checksum false positive. The harness now reuses the immutable
|
||
admitted artifact manifest rather than duplicating that metadata. The unchanged
|
||
scanner passes the revised staged source; no suppression or exception was added.
|
||
`scanner-triage.json` retains value-free classification and resolution evidence;
|
||
this does not close RMGR-WP-0021-T04's credential-response requirement.
|
||
|
||
2026-10-13 G07 template deployment: source railiance-apps `390a30a` adds the
|
||
immutable non-secret ConfigMap, read-only file subPath mounts, encoded Git
|
||
configuration and deployment prerequisite. Thirty isolated file-mount/config/
|
||
rollback checks and six conditional-patch regressions pass. Exact proposal
|
||
FORGE6-TEMPLATE-LIFECYCLE-001 passed the server dry-run and its additive live patch
|
||
reached generation 12 Ready on the unchanged image. Actual Forgejo Git config
|
||
selects the template; a native temporary Git repository inherited the regular,
|
||
executable exact hook and refused malformed input. All 22 original hook inventories
|
||
and both binaries remain unchanged; health passes and probe data was removed.
|
||
Existing admin identity and initial-only password mode were checked before restart.
|
||
No credential, identity, resource request or policy scope was changed. The first
|
||
owner-source sync hit the restart window; retry pushed `390a30a` successfully.
|
||
Receipt: `docs/evidence/2026-10-13-netkingdom-security/forge-template-activation.json`;
|
||
proposal, guarded rollback and source reconciliation instructions are in
|
||
`docs/changes/CUST-WP-0080/forge-template-operations.md`.
|
||
|
||
Fresh metadata now reconciles 166 database repositories and directories (one more
|
||
than October 12): all hook inventories are known; 22 have the admitted profile,
|
||
144 are builtin-only. No mirrors, forks or wikis are present; no protected-branch
|
||
rules are configured. Full identity inventories remain in mode-0600 local files;
|
||
committed receipts contain aggregates only. Production API/SSO/frontend creation,
|
||
existing-repository expansion, import/mirror content paths, CI and response
|
||
acceptance remain open; T03/T04 and the owner plan are not closed by this rollout.
|
||
|
||
2026-10-13 adverse acceptance and recovery: the initial generation-12 health,
|
||
hash and malformed-input checks missed a real restart failure. The next ordinary
|
||
Forge owner push refused with `scanner-file-refused`; both installed artifacts
|
||
had become group-writable 0775, consistent with Kubernetes fsGroup volume
|
||
processing. The original trial remains failed in supervision; its original
|
||
proposal and receipt are retained, not rewritten as an unchanged success.
|
||
Revision 2 verified exact hashes/ownership and restored only 0755. The queued
|
||
Forge owner source push `ec1d7c5` then succeeded through the enforced hook.
|
||
Revision 3 adds an exact-image unprivileged startup guard, mounted only to the
|
||
existing security subtree, persisted in railiance-apps `50b66c4`. Six isolated
|
||
checks cover remount permissions, idempotence, wrong hashes, unsafe modes,
|
||
symlinks and recovery. Server dry-run and rendered source match; rollback removes
|
||
only that init container and explicitly repairs modes after remount.
|
||
Generation 13 completed the guard and passed real inherited native receive
|
||
checks: clean acceptance, intermediate-secret refusal, quarantine removal and
|
||
clean recovery. Builtin authorization is excluded in the temporary native probe;
|
||
the ordinary source push separately exercises authenticated SSH. A second
|
||
Kubernetes replacement reached generation 14 and repeated all those checks with
|
||
a different pod UID; both startup guards exited zero and both binaries remained
|
||
0755. Authenticated SSH source acceptance after that replacement is recorded
|
||
separately in the recovery summary.
|
||
Evidence: `forge-custody-repair.json`, `forge-custody-rollout.json` and
|
||
`forge-custody-restart.json` in the October 13 evidence directory. This resolves
|
||
an availability regression without weakening scanner refusal or widening access.
|
||
|
||
2026-10-13 push compatibility closed: STATE-WP-ADHOC-2026-10-13-T01 is
|
||
finished/done in file and hub. State Hub `7183f59` (identifier projection commit
|
||
`f6839b5`) and Repo Manager `5a7e838` extend client push deadlines to 120 seconds
|
||
for the admitted server scanner's 90-second budget. Timeouts report unverified
|
||
remote outcome without retry or child diagnostic disclosure. Seventy targeted
|
||
tests and two real 65-second receive-hook acceptance/refusal sequences pass;
|
||
the installed State Hub packaged module matches source. Both owner projections
|
||
applied against exact pushed commits. Receipt: `push-deadline.json`.
|
||
|
||
2026-10-13 expansion completed: FORGE6-EXPAND-001 revision 1 exited 0 after
|
||
all 143 targets passed actual SSH clean/scanner-refusal probes under an exact-ref
|
||
veto. The independent final read-only audit reconciles 167 repositories: 166
|
||
admitted profiles, one builtin-only (numeric ID 55), zero unknown profiles. All
|
||
23 baseline profiles remain exact; no probe refs, temporary vetoes or ownership
|
||
markers remain. Each rejected synthetic commit was absent after its probe.
|
||
Repository 55 has four external submodules and remains required compatibility
|
||
work. Ordinary source acceptance is distinct from vetoed scanner checks.
|
||
Production HTTP/API/frontend acceptance remains unverified: the protected API
|
||
credential route failed before child handoff and the metadata-only capability
|
||
check denied access. Prepare one complete acceptance command for the existing
|
||
attended login window. CI, import/mirror, historical/LFS/log/artifact detection
|
||
and private response gates remain open; this is no whole-estate closure.
|
||
Evidence: Custodian `docs/evidence/2026-10-13-netkingdom-security/forge-expansion-final.json`
|
||
and `forge-api-route-readiness.json`.
|
||
|
||
|
||
2026-10-13 authenticated-route preparation: FORGE6-ROUTES-001 revision 2
|
||
binds a silent contained operation to one newly created private disposable
|
||
repository. The exact shared suite passes 27 isolated pinned-image checks:
|
||
creation/inherited hook, anonymous denial, HTTPS clean/secret pushes, API content
|
||
acceptance/refusal, merge-message refusal/clean merge, unchanged refs, quarantine
|
||
and owned cleanup. Five boundary tests cover changed ownership, ambiguous-create
|
||
cleanup refusal, generic-error non-acceptance, redirect credential protection,
|
||
and silent digest-bound credential handoff. Read-only live preflight passes
|
||
under a private HOME. The failed first rehearsal and source-binding limitation
|
||
remain recorded. No production API mutation or credential fetch was performed.
|
||
The existing attended-window command is ready for caller OIDC/MFA; live route
|
||
and session-revocation receipts remain required. Packet: Custodian
|
||
`docs/attended-window/2026-10-13-forge-route-acceptance.md`; evidence:
|
||
`docs/evidence/2026-10-13-netkingdom-security/forge-routes-preparation.json`.
|
||
|
||
2026-10-13 G12 runner boundary repaired: actual unauthenticated Docker ping
|
||
from another pod reproduced the wildcard listener defect. Exact revision 2 of
|
||
FORGE6-RUNNER-LOOPBACK-001 deployed source railiance-apps `706461b`, pinning the
|
||
same running images and restricting Docker to loopback with local exec readiness.
|
||
The conditional server dry-run and three patch tests pass. Generation 4 is Ready;
|
||
loopback ping succeeds, other-pod ping refuses and the socket table contains only
|
||
127.0.0.1:2375. Zero running/queued jobs were observed before/at apply and after;
|
||
resource requests and Recreate strategy are unchanged (node CPU requests 86%).
|
||
Fresh runner heartbeat is one second old. Normal source push `706461b` triggered
|
||
workflow 7251; host-smoke and container-smoke both succeeded. Receipt:
|
||
`docs/evidence/2026-10-13-netkingdom-security/forge-runner-post-change-ci.json`. The original revision-1 preflight is
|
||
retained; revision 2 corrects rollback verification for the observed dual-stack
|
||
wildcard. Receipt: `docs/evidence/2026-10-13-netkingdom-security/forge-runner-loopback-activation.json`.
|
||
This closes the reproduced listener exposure only. Host jobs still share the
|
||
privileged runner boundary; workflow authority, required detection checks and
|
||
job-scoped credentials remain open in FORGE-WP-0006-T03 / RMGR-WP-0021-T03/T04.
|
||
|
||
2026-10-13 submodule reconciliation: the four declared URLs use the retired
|
||
forge NodePort. Two pins are reachable under their current canonical repository
|
||
names. The wiki and issue-facade names are absent; a read-only object search
|
||
across all 167 admitted-inventory directories found the issue-facade pin in
|
||
repository ID 13, but no copy of the wiki pin. Neither pin is present in the two
|
||
expected workstation submodule locations. This identifies further mapping and
|
||
recovery work; no repository content was fetched, changed or uploaded, and no
|
||
scanner exception was introduced. Receipts: `forge-gitlink-reconciliation.json`,
|
||
`forge-missing-gitlink-object-search.json`, `forge-gitlink-local-copies.json`.
|
||
|
||
2026-10-13 KeyCape custody callers reconciled with existing RPF-WP-0040:
|
||
retired personal-admin token mint/refresh entry points and updated bootstrap
|
||
configuration to the scoped renewable factor credential mount. First creation
|
||
uses private literal inputs, captured diagnostics, stdin-only Secret data and
|
||
API create without last-applied annotations or replacement of existing config.
|
||
Signing keys are published privately without overwrite and retained on failure.
|
||
Legacy RSA/client-secret replacement rotations now refuse before mutation;
|
||
configuration-preserving rotation and retained rollback custody remain required.
|
||
|
||
The old source failed 21 of 22 new regressions. Final bootstrap/KeyCape suite:
|
||
277 passed, 22 dependency-related skips; actual KeyCape Go loader/config and
|
||
credential-file adapter suites pass against generated synthetic configuration.
|
||
Failed verification preparations are retained in the receipt. No live credential
|
||
or deployment changed. NK-WP-0049-T02 remains progress: other callers, historical
|
||
object revocation, coordinated rotation and owner-scoped native recovery remain.
|
||
Evidence: `docs/evidence/2026-10-13-netkingdom-security/keycape-caller-reconciliation.json`.
|
||
|
||
2026-10-13 remaining service generator repair: NetKingdom `b01a30b` replaces
|
||
PostgreSQL/privacyIDEA/LLDAP/Authelia shell sourcing, credential argv and raw
|
||
apply output with private literal parsing and captured stdin-only Secret writes.
|
||
Default apply creates or verifies exact matching fields; named rotation changes
|
||
only its allowed field. Patches bind UID/resource version/data, preserve unrelated
|
||
fields and remove last-applied copies, then verify returned API state. Authelia
|
||
retains its private first-bootstrap key and preserves existing issuer/hash state.
|
||
Batch apply suppresses child output; DB rotation includes the previously omitted
|
||
CNPG application Secret. The stale attended LDAP/KeyCape replacement path refuses
|
||
before mutation. Coordinated/native lifecycle acceptance remains open.
|
||
|
||
Final unchanged-source suite: 366 passed, 22 dependency-related skips; native
|
||
local OpenSSL/bcrypt and kubectl stdin patch/stale-version checks passed without
|
||
a cluster. No live credentials or deployments changed. NK-WP-0049-T02 remains
|
||
progress for other diagnostics/bootstrap/SOPS callers and lifecycle requirements;
|
||
T03 remains its owner-scoped recovery gate. Evidence:
|
||
`docs/evidence/2026-10-13-netkingdom-security/service-secret-callers.json`.
|
||
|
||
2026-10-13 SOPS write caller repair: NetKingdom `8f80857` removes Make/shell
|
||
argument execution before custody handoff, uses public-only encryption of private
|
||
untracked JSON/YAML, and replaces editor-based updates with explicit private
|
||
replacement input outside Git. Edit/rotate require the matching temporary key
|
||
and exactly the registered recipient; extra recipient metadata is refused.
|
||
Original MAC and replacement ciphertext are verified, encryption policy is
|
||
preserved, and child diagnostics/plaintext are suppressed. Source checks and
|
||
atomic ciphertext replacement do not provide isolation from hostile same-UID
|
||
writers. Data-key rotation is explicitly distinct from recipient migration.
|
||
|
||
Final unchanged-source suite: 585 passed, one unavailable privacyIDEA module
|
||
skip; all real-SOPS cases ran. The initial expanded run's checkout-name failure
|
||
and missing sibling-schema skips are retained, then resolved by correcting the
|
||
test workspace without changing source. A pre-commit generic-key match on the
|
||
redundant public-recipient comment was resolved by removing that comment; parsed
|
||
configuration is unchanged, and the normal eight-blob scan passed. Executable
|
||
source matches the final test binding. NK-WP-0049-T02 now names the remaining
|
||
key-export, MFA diagnostic, LDAP and realm-repair callers plus the complete
|
||
inventory reconciliation; T03 still requires exact owner-approved native recovery.
|
||
No production custody key was retrieved and no live decryption, Secret write or
|
||
deployment change was performed. Evidence:
|
||
`docs/evidence/2026-10-13-netkingdom-security/sops-write-callers.json`.
|
||
|
||
2026-10-13 continuation: privacyIDEA key export/recovery source repaired in
|
||
NetKingdom commit 1cbe00fd78e60ac70f2ea7957a0e1d7477388dcf. Export preserves the existing encryption/audit
|
||
keys, validates private custody and exact pod/PVC ownership, and conditionally
|
||
creates or verifies DR Secrets. Recovery now restores the actual stopped
|
||
application PVC; old Secret-only and unmounted-helper instructions are withdrawn.
|
||
The unchanged tested source passed 631 tests, zero skips; actual privacyIDEA
|
||
3.12.2 decryption and audit-signature continuity passed in a disposable local
|
||
environment. All 15 applied paths match the test binding. This is not live cluster
|
||
or off-host recovery acceptance. NK-WP-0049-T02 remains progress for remaining
|
||
callers/inventory; T03 remains wait for owner-approved native recovery. Receipt:
|
||
`docs/evidence/2026-10-13-netkingdom-security/privacyidea-key-custody.json`.
|
||
|
||
2026-10-13 continuation: bounded MFA-state diagnostic published in NetKingdom
|
||
`96feef46ab22811e3736231f04818655ca7b834e`. Removed retired Secret reads, insecure TLS, token argv
|
||
and raw provider errors. Explicit protected input, scoped token listing, inert
|
||
realm visibility proof before/after and complete counts distinguish confirmed,
|
||
pending and inactive factors. Real privacyIDEA 3.12.2 reproduces HTTP-200 empty
|
||
results after permission withdrawal; the diagnostic refuses them and accepts
|
||
permission recovery. Real self-service, tampered and expired tokens are refused.
|
||
Focused55 pass; full suite 1 failed, 685 passed, 4 warnings in 540.61s (0:09:00). One unchanged 50ms abort timing
|
||
assertion missed by 0.49ms; all46 tests in that module pass on unchanged rerun.
|
||
The original failure remains in the receipt. All nine applied paths match
|
||
the frozen test binding. KeyCape's workload delivery is not shared or expanded;
|
||
a live diagnostic needs separate owner admission. Native estate acceptance and
|
||
remaining LDAP/realm/inventory work stay open. Receipt:
|
||
`docs/evidence/2026-10-13-netkingdom-security/mfa-state-diagnostic.json`.
|
||
|
||
2026-10-13 continuation: realm/bootstrap source repaired in NetKingdom
|
||
`30f0d2784018daa98e36e7c1042d4e2138a05a7c`. Reproduced old credential-file command execution
|
||
using a disposable marker; the replacement parses the same bytes literally.
|
||
Attended passwords stay in memory. Preview/explicit apply repairs missing core
|
||
configuration while preserving bind credentials, custom tuning, realm bindings,
|
||
defaults and owner-managed MFA policies; broad legacy policy replay is removed.
|
||
The console and guides use the supported flow, including fresh functional MFA
|
||
proof. Shared transport blocks unapproved origins, redirects/proxies and raw
|
||
error propagation. Actual privacyIDEA 3.12.2 proves minimal resolver updates
|
||
preserve omitted fields, correcting the old general replacement claim.
|
||
Frozen source passed all 723 tests with zero skips; four upstream deprecation
|
||
warnings. All 16 committed blobs match the test binding. Native/PTY/regression
|
||
receipts and limits: `docs/evidence/2026-10-13-netkingdom-security/realm-bootstrap-repair.json`.
|
||
No live provider or credential change. Remaining LDAP/incident-cutover callers,
|
||
full inventory and owner-approved native recovery keep NK-WP-0049 and G08 open.
|
||
|
||
2026-10-14 legacy LLDAP lifecycle callers retired in NetKingdom `84c5dbe`.
|
||
Three shell helpers refuse before argument/credential processing or external calls;
|
||
Make targets no longer expand user input and console commands refuse before
|
||
metadata loading/delegation. Blank lifecycle worksheets no longer prefill successful
|
||
checks; existing validators reject unfilled templates. Ordinary onboarding now
|
||
points to existing User Engine/identity-provisioner contracts, while platform-root
|
||
and recovery remain separate owner procedures. Historical receipts are preserved
|
||
and older assessment snapshots explicitly superseded for this tooling.
|
||
|
||
Eleven corrected-baseline regressions fail on old source; 28 focused and 76 total
|
||
affected tests pass with no skips. All 21 applied source files match the tested
|
||
manifest; five changed shell files pass syntax checks and the normal secret scan
|
||
is clean. Receipt: `docs/evidence/2026-10-14-netkingdom-security/legacy-lldap-retirement.json`.
|
||
No runtime/account/credential changed. Group bootstrap, membership management,
|
||
verify-t07, incident-cutover callers, complete inventory and native independent
|
||
recovery remain open under NK-WP-0049; G08 and this task remain progress.
|
||
|
||
2026-10-14 provider boundary follow-up: NetKingdom `e861f63` reserves
|
||
`net-kingdom-` platform groups in the existing service-group request validator.
|
||
Prior source rejected `netkingdom-` suspension names but accepted the actual
|
||
platform users/admins namespace. Six regressions reproduce reaching directory
|
||
login from both ensure/revoke before repair; all 45 provider tests pass afterward.
|
||
Mixed requests and delete-if-empty also refuse before login. Receipt:
|
||
`docs/evidence/2026-10-14-netkingdom-security/platform-group-boundary.json`.
|
||
No rollout or live directory mutation; exact owner deployment and native checks
|
||
remain necessary before claiming live enforcement. NK-WP-0049 stays active.
|
||
|
||
2026-10-14 LDAP group caller reconciliation delivered in NetKingdom `ab25dde`.
|
||
Bootstrap, membership and T07 wrappers now reuse provider operations and literal
|
||
private custody through one adapter. No executable credential sourcing, ambient
|
||
password fallback, credential argv, curl/kubectl or KeyCape config Secret read.
|
||
Bootstrap only creates missing empty fixed baseline groups; service membership
|
||
requires exact existing identities/groups and refuses reserved namespaces.
|
||
Preview/apply binds origin, operation, target and observed state; fresh prewrite
|
||
and final exact readback preserve unrelated data. Owner-controlled exclusive
|
||
maintenance remains necessary because LLDAP has no cross-query CAS; partial
|
||
failures require reconciliation, not blind rollback.
|
||
|
||
Three old-source regressions failed; all 200 affected tests pass without skips.
|
||
An actual isolated local immutable LLDAP image passed preview, preservation,
|
||
idempotence, add/remove, reserved/stale refusal and T07 incomplete-exit checks.
|
||
The synthetic fixture/container/private files were removed. T07 is explicitly
|
||
structural-only (exit 2), not lifecycle/login/recovery acceptance. Receipt:
|
||
`docs/evidence/2026-10-14-netkingdom-security/lldap-group-maintenance.json`.
|
||
No live estate change. Incident-cutover/full inventory and owner-approved native
|
||
recovery/estate acceptance keep NK-WP-0049 and G08 open.
|
||
|
||
2026-10-14 bounded incident resolver source repair completed in NetKingdom
|
||
`4dffe2f`. Both helpers now use attended memory-only input, scoped shared
|
||
transport, configuration/target-bound preview, one minimal password update and
|
||
native candidate/stored LDAP bind verification. Full reconcile pins cluster
|
||
identity/readiness, validates discovery, exact user and token-backed MFA, and
|
||
records missing predecessor evidence as incomplete. Raw notes, temporary secret
|
||
files, ambient endpoint overrides and default-overwriting writes are removed.
|
||
|
||
Validation: 171 affected tests pass, plus disposable real privacyIDEA 3.12.2 and
|
||
LLDAP demonstrate bind refusal/replacement, preservation and actual HOTP. The
|
||
initial one-test fixture failure is retained; cluster/KeyCape gates are substituted
|
||
only in the native fixture, with production acceptance explicitly unverified.
|
||
Source docs/inventory and NK-WP-0049 are updated. Evidence:
|
||
`docs/evidence/2026-10-14-netkingdom-security/resolver-cutover.json`.
|
||
No live cutover or privileged credential retrieval. Full caller/root-output
|
||
inventory keeps T02 progress and owner-native recovery keeps T03 wait. The broad
|
||
consolidation goal remains cleared; this finishes only the requested current
|
||
resolver-helper task. Playwright T05 retains its existing owner-return gates.
|
||
|
||
## Verify native closure against every requirement
|
||
|
||
```task
|
||
id: CUST-WP-0080-T04
|
||
status: todo
|
||
depends_on: [CUST-WP-0080-T03]
|
||
priority: high
|
||
state_hub_task_id: "82378b0f-7004-5c2f-9683-b356a1227576"
|
||
```
|
||
|
||
Verify G01–G13 against current source/runtime receipts and the individual SEC-DSM
|
||
requirement ledger. Existing owner integration, attendance, residual-promotion
|
||
and recovery gates remain effective. Mark finished only when all required gaps
|
||
are verified closed or covered by complete actually approved exceptions; plans,
|
||
source-only tests and owner handoffs are not closure evidence.
|
||
|
||
## Coordinate self-service Playwright identity delivery
|
||
|
||
```task
|
||
id: CUST-WP-0080-T05
|
||
status: progress
|
||
priority: high
|
||
depends_on: [RPF-WP-0056, RAPP-PLAYWRIGHT-WP-0004]
|
||
state_hub_task_id: "ed8b909a-23bf-5e5f-b600-e477fbae136b"
|
||
```
|
||
|
||
User-requested addition on 2026-10-13. Accountable coordinating owner:
|
||
**the-custodian / custodian-codex**. Accept incoming request
|
||
`1b279bad-a159-43da-8709-1167882e62f8`; retain Platform's RPF-WP-0056-T03
|
||
live acceptance and RAPP-PLAYWRIGHT-WP-0004-T01/T03 provider acceptance.
|
||
Delivery tracking: `infra/security-flow/playwright-delivery.json`, a cross-owner
|
||
case attached to these existing plans; no duplicate implementation plan.
|
||
|
||
The pilot and namespace RBAC are delivered. Real human/agent authentication,
|
||
per-caller API transport, one-command trial, renewal/revocation and native
|
||
acceptance remain. All identified platform humans and coding agents already
|
||
qualify; no further membership decision is requested. The coordinator owns
|
||
collecting exact owner task/revision returns, resolving dependency gaps and
|
||
checking delivery evidence, not approving another owner's implementation.
|
||
|
||
First executable milestone: review the prepared registration/authenticator
|
||
candidates with their existing owners, obtain their source task/revision and
|
||
rollback references, and document a supported transport for one real human and
|
||
one registered agent. Registration and governed custody (KeyCape/NetKingdom/
|
||
Platform), native JWT authenticator (railiance-cluster), and per-caller transport
|
||
(ops-bridge/cluster) converge before Platform's integrated consumer command and
|
||
real human/agent trials. Existing request IDs and unaccepted owner returns are
|
||
preserved in the case; missing task IDs are explicit gaps, not invented commitments.
|
||
|
||
Close only after Platform and provider accept native positive/negative identity,
|
||
permission, browser, lifecycle and recovery receipts, supported consumer docs,
|
||
and the maintained managed-availability discovery update. Message delivery alone
|
||
does not close this task. No new access gateway, shared administrator kubeconfig,
|
||
shared workstation SSH identity, or broader target/permission grant is required.
|
||
|
||
2026-10-13 provider recovery return accepted for coordination:
|
||
`a2449fe0-ba12-47b8-9ca3-d7deedc089c3`, rapp-playwright commit
|
||
`2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb`. Reviewed committed local/managed
|
||
SIGKILL, partial-artifact cleanup, completed-hash preservation and fresh browser
|
||
trial receipts, including the initial transport failure. Same-image abrupt
|
||
recovery is delivered; no crash was repeated by the coordinator. Case references
|
||
and dependency wording now retain the narrower live gap: exact registration,
|
||
custody, native JWT authenticator and per-caller transport owner revisions, then
|
||
real human/agent trials and managed acceptance/discovery. Cross-version rollback
|
||
remains explicitly unproven in provider T01. No foreign task status was changed;
|
||
this task stays progress and no membership decision is reopened.
|
||
|
||
2026-10-13 NetKingdom registration dependency advanced: `5dd74df` accepts the
|
||
actual implementation request in NK-WP-0050. T01 delivers the exact public
|
||
loopback/custom-scope and per-agent registration compiler using existing registry
|
||
merge operations. Nine new and 64 existing registration tests pass; native
|
||
KeyCape config/startup and generated token/JWKS exchange checks pass. The broader
|
||
159-test run retains two unchanged short-window failures; all seven tests in that
|
||
module pass unchanged on rerun. Receipt: `playwright-registration-preparation.json`
|
||
in the October 13 evidence directory. Case now links NK-WP-0050-T02 for governed
|
||
custody and guarded activation, with T03 awaiting actual issuer/consumer receipts.
|
||
No browser-case admission, custody grant, real identity trial or live rollout is
|
||
inferred. Other identity/authenticator/transport owner returns remain missing.
|
||
|
||
2026-10-13 registration activation preparation published in NetKingdom
|
||
`eba6e1f`: single-Recreate stop/configure/resume sequencing, native verifier pin,
|
||
private proposal digest and exact object/data/spec conditions, pod-quiescence
|
||
checks, readback and original-state rollback now have 90 passing focused tests
|
||
with no skips plus native synthetic KeyCape startup checks. Follow-up `276b95f`
|
||
refuses reproduced implicit-audience and aliased-Secret collisions; both new
|
||
regressions failed before repair and pass afterward. Pre-existing clients
|
||
and bindings survive rollback; intervening drift refuses stale replay.
|
||
NK-WP-0050-T02 is progress. The module has no live CLI or Kubernetes connection;
|
||
protected executor/recovery-state integration, admitted identity/custody, exact
|
||
current image/cluster and supervised live acceptance remain open. Receipt:
|
||
`playwright-activation-preparation.json` in the October 13 evidence directory.
|
||
No live credentials or deployments changed; this does not close consumer delivery.
|
||
|
||
|
||
## Establish the target architecture and drive the restructuring
|
||
|
||
```task
|
||
id: CUST-WP-0080-T06
|
||
status: progress
|
||
priority: high
|
||
state_hub_task_id: "6aca534c-5c7a-556f-b6b6-406433670c29"
|
||
```
|
||
|
||
Founder implementation request, 2026-10-16. Document the optimized target and
|
||
coordinate GPT-6.1-Sol medium agents against the existing owner work. Delivered
|
||
`docs/netkingdom-target-security-architecture.md` with sixteen scope-specific
|
||
acceptance gates and `docs/netkingdom-target-implementation.md` with ownership,
|
||
dependency and evidence rules. First dispatched source work: Secrets Engine
|
||
decision authentication, Platform durable cleanup, NetKingdom first-case
|
||
compatibility. Exact handles and artifact locations are in the implementation
|
||
record. Documentation link/ID checks pass. Implementation and native acceptance
|
||
remain open; this task closes only with the target's exit condition and T04
|
||
requirement audit, not with the first source wave.
|
||
|
||
2026-10-16 source wave published across eight owner repositories: NetKingdom
|
||
`c31d21ba`, Warden `95835208`, Glas `7357115c`, Platform `59d1441c` / `99fd21ee` /
|
||
`d042d468`, Secrets `c80a9441`, Access `ec21518e`, Approval `477c6839`, and Mason
|
||
`57411f25`. Independent reconstruction tests, actual disposable OpenBao/bwrap
|
||
checks and local Access serve-to-Secrets signature verification passed at their
|
||
bounded scopes. Exact revisions, failures and publication caveats are recorded in
|
||
`docs/changes/netkingdom-target-2026-10-16/source-wave-status.json` and its
|
||
coordinator review. No production trust, credential or runtime admission changed.
|
||
The subsequent source packages integrate Secrets packaging (`ebca4f5`) and strict
|
||
task authorization (`ff1a13d`), Platform journaled consume/confirm/effect
|
||
(`e2b832b`), and Approval canonical confirmation (`eece796`). Independent
|
||
verification passed 133 combined Secrets checks, seven packaging checks, all 130
|
||
Platform checks and eight final mediator checks with the repaired Approval client.
|
||
The actual local provider path uses synthetic admission; the real task policy
|
||
still denies. Exact native expected-state readback/recovery and governed
|
||
package/key/caller admission are next. All sixteen acceptance gates remain open.
|
||
|
||
2026-10-16 next source integration: Platform `d870596` adds exact committed
|
||
metadata baseline/readback and separate cleanup confirmation (32 independent
|
||
tests). Access `919ce25` adds exact native receipt checking and workload/audience
|
||
preparation (nine receipt and two runtime-twin tests); Secrets `5a2099f` records
|
||
native CLI/trust preparation and the 11-site/10-handler denominator, with zero
|
||
native effect acceptance. Approval `3485415` provides the shared owner Go claim
|
||
adapter (14,114 independent actual Python byte/digest comparisons); Access
|
||
`4f6946b` adds the real service caller HTTP join and generic task bypass refusal.
|
||
Exact commit/publication receipts retain State Hub timeouts and scanner results.
|
||
Trusted v2 source, strict consumer successor, authenticated process-loss cleanup
|
||
recovery and signer custody are the next reviewed packages. Old positive stack
|
||
proof remains pinned to Access `ec21518e`; it does not validate the new task path.
|
||
No native gate, live grant, deployment or credential admission is closed here.
|
||
|
||
Platform `b9eaa20` adds independently admitted process-loss cleanup recovery after
|
||
53 passing root tests. Root review required exact absence semantics and capsule
|
||
integrity; failures and revised proof remain retained. Lost token issuance without
|
||
persisted accessor and actual custody/isolation remain open. Trusted successor
|
||
source passed the full Access Go suite and 176 focused Secrets tests, but actual
|
||
whole-stack work found incompatible time budgets and retained-registry digest
|
||
correspondence. Owners are repairing those contracts before successor integration;
|
||
no empty-registry shortcut or timing waiver establishes acceptance.
|
||
|
||
2026-10-16 coordinator checkpoint: all six subsequent canonical receipt file hashes
|
||
match their owner commits and every commit is an ancestor of origin/main. The
|
||
actual immediate-consumption path also exposes whole-second Approval receipt
|
||
precision against fractional decision start times; owner resolution is required.
|
||
Access, Secrets and Platform continue the retained-registry end-to-end repair.
|
||
|
||
Coordinator independently reproduced expired fractional Approval consumption
|
||
against canonical `3485415`: expiry .500, actual clock .750, consumed_at .000.
|
||
Owner repair is part of the protected-operation gate. NK-WP-0049 now supplies
|
||
actual independent identity archive recovery evidence; remaining service
|
||
authentication, token decryption and audit continuity are still required.
|
||
|
||
2026-10-16 successor source integration: Access `2b064ee` and Secrets `4dd004a`
|
||
now preserve producer-evaluated approval facts and exact numeric types across the
|
||
retained-registry join. Approval `d40e842` fixes fractional expiry with a single
|
||
post-lock instant; the original counterexample and scanner refusal are retained.
|
||
Platform `76fdc0b` adds absolute budgets; `7be8b6e` supplies the complete successor
|
||
proof and bounded signer custody source. Root independently passed seven affected
|
||
Go packages, 193 Secrets tests, 98 Approval tests, 28 budget tests, eight complete
|
||
provider-to-OpenBao cases and twelve disposable signer tests (overlapping suites,
|
||
not an estate coverage score). Native issuer/key/grant/deployment/audit gates stay
|
||
open. Access outbox process locking and capacity limits, Platform exact native
|
||
writer preparation, and Secrets immutable release/install proof are active owner
|
||
follow-through. No existing PVC or managed-package identity is assumed.
|
||
|
||
2026-10-16 next checkpoint: Access `0a05383`, Warden `d79f065`, Secrets `3718e60`
|
||
and Platform `a3e8eb6` published through normal owner synchronization, with exact
|
||
committed-file hashes independently verified. Installed Warden routing now selects
|
||
the required attended admin lane and retains phase-memory. Root checks passed
|
||
Access race/chart validation, 135 routing tests, 56 phase-aware signer tests and
|
||
clean reproducible Secrets bundle installation. Original failures are retained.
|
||
|
||
Canonical local package `rapp-flex-auth-secrets-engine` now has reviewed commit
|
||
`d52f811`, exact tree and local owner/workload resolution; it remains draft with
|
||
no remote or native admission. The ordinary Access publisher failed after pushing
|
||
source `0a05383` because Python was absent on its runner. Reviewed source repair
|
||
`84c78e0` uses Bash/Docker metadata validation and records the package reference;
|
||
normal source synchronization and successor CI observation are underway. Audit
|
||
`64509d2` specifies existing-API reconciliation against a complete independently
|
||
retained producer ledger, with independent contract tests. Its sender/cadence and
|
||
operational observer gates remain open. Platform prepared exact custody source
|
||
pins and distinct missing owner inputs; no approval or native scope was invented.
|
||
All sixteen target gates remain open pending scope-matched native acceptance.
|
||
|
||
The ordinary successor publisher run402 and both smoke401 jobs succeeded for
|
||
exact `84c78e0`. Root independently verified public commit statuses, the unique
|
||
registry digest `sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f`
|
||
and explicit source revision label. Exact rollout values, stopped/ready source
|
||
renders and Platform projection are prepared separately from native evidence;
|
||
consumer pre-key trust and custody P2 remain proposed. Checkpoint `fa0fc15`
|
||
published and synchronized 89/89 with no failures; generated-only writeback was
|
||
refused without bypass. Original failures and all native gates remain retained.
|
||
|
||
2026-10-16 source simplification checkpoint: Access `dc04202` adds exact zero/one
|
||
writer Helm maintenance states; Platform `84c529f` separates runtime/storage
|
||
review from GitOps ownership. Both are published with normal sync receipts and
|
||
exact committed-file hash verification. Independent checks cover 86 actual Helm
|
||
renders plus existing outbox tests, 45 Platform native/preparation tests and 54
|
||
overlapping cluster custody tests. Focused CCR0050 validation passes; unconfirmed
|
||
claims and unrelated baseline CCR0035 errors remain. The initial public-digest
|
||
scanner refusal is retained; typed OCI metadata passed the unchanged scanner.
|
||
Cluster own-review record `RCLUSTER-WP-0017` was published at `523669f`; the source
|
||
role correction received a bounded owner review. Its prefix warning conflicts
|
||
with ADR-007 because the checker infers the retired prefix from historical files;
|
||
the correct IDs and assigned UUIDs are preserved. Successor rollout/custody packets are being
|
||
prepared. No custody, deployment, trust, storage or protected effect occurred;
|
||
all sixteen target gates remain open.
|
||
|
||
2026-10-16 source preparation successors: exact rollout R2 and custody P4 now
|
||
join published chart `dc04202`, image source `84c78e0` and Platform `84c529f`.
|
||
Root reproduced frozen Helm outputs and passed eight packet assembler tests;
|
||
P4 corrects preserved P3 ownership prose without changing executor or scope.
|
||
Cluster's own T01 source review is complete; its native T02/T03 remain open.
|
||
Stopped Helm uses explicit bounded fence verification without PVC waiting or
|
||
automatic restart of the running predecessor. Founder identity, expiry, actual
|
||
held window, approved CCR and native dispositions remain unresolved. Checkpoint
|
||
`50de8be` published and synchronized 89/89 with zero failures. No target gate is
|
||
closed by these source preparations.
|
||
|
||
2026-10-16 native preparation: coordinator public-metadata observation and exact
|
||
seven-resource server dry-run passed on the verified railiance01 target at
|
||
18:53 UTC. API admission retained the frozen stopped projection and replicas zero;
|
||
the actual release remains running at Helm revision four. No persistent mutation,
|
||
held writer fence, credential/custody action or native activation occurred.
|
||
Reviewed wrapper, exact payload and actual receipts are retained under
|
||
`docs/changes/netkingdom-target-2026-10-16/native-preflight-r1/`.
|
||
Parallel owner work now integrates the workload-only combined runtime and native
|
||
registry parity checks, with independent Secrets preparatory-package selection.
|
||
All sixteen target gates remain open; this is progress toward their native
|
||
acceptance rather than a reduced completion criterion.
|
||
|
||
2026-10-16 owner checkpoint: Access `d328a260` and Platform `08c1f036`
|
||
published independent bounded rollout reviews, separating initial rollout/CCR
|
||
authorization from final one-use custody assent. Secrets `a4f1802`/`5356810`
|
||
selected and recorded the actual inert local package installation; all ten catalog
|
||
rows and empty-key refusal passed without caller/socket access. Rein `9b88cad`
|
||
published the combined runtime lock; the actual isolated manager proof passed and
|
||
the coordinator independently rehashed all 1447 artifact records unchanged.
|
||
Five owner commits and their public evidence are bound in
|
||
`docs/changes/netkingdom-target-2026-10-16/source-wave11-coordinator-review.json`.
|
||
None establishes live signer/caller admission, an accepted protected effect,
|
||
actual interactive-assignment migration or completion of a TSA gate.
|
||
|
||
2026-10-16 continued implementation: NetKingdom `015694ee` fixes disagreement
|
||
between JSON schema and Python validation of exact machine-descriptor pins;
|
||
the coordinator independently passed 21 new tests and verified committed files.
|
||
Reuse `dd00b27` strengthens the existing mandatory parity validator; corrected
|
||
NetKingdom/Bootstrap indexes are published. Forced hosted composition at 19:25
|
||
returned all 70 reviewed capabilities exactly once with correct owners and both
|
||
corrected descriptions/tags. KeyCape `3c71226` reconciles the already-deployed OTP
|
||
help link and names the actual remaining attended recovery steps. Independent
|
||
NetKingdom recovery evidence now accepts retained token-material decryption and
|
||
historical audit signature continuity (T20/T31), while real MFA and service
|
||
continuity remain open. Exact owner commits and receipt scope are recorded in
|
||
`docs/changes/netkingdom-target-2026-10-16/source-wave12-coordinator-review.json`.
|
||
Separate GPT-6.1-Sol medium owner agents are implementing the missing browser
|
||
registration and isolated KeyCape recovery adapters in temporary candidates;
|
||
neither candidate is admitted for native execution.
|
||
|
||
2026-10-16 checkpoint publication: `cf59a5f` and `5a50901` published the reviewed
|
||
native preflight, independent owner plans, inert installation, combined-runtime
|
||
proof and follow-up owner/discovery evidence. Both normal reconciliations synced
|
||
89/89 bindings with zero failures/automation errors; seven background warnings
|
||
and four informational findings remain. Original staged brief bytes/index and
|
||
unrelated work were preserved. The initial public-hash scanner refusal was
|
||
resolved by typed hash metadata without changing values or bypassing scanning.
|
||
Warden `d97652a3` subsequently refreshed its reviewed producer pins; coordinator
|
||
verification passed 87 actual integration/refusal checks without pin overrides.
|
||
The registration adapter independently passed 36 source checks after binding the
|
||
checker executable into its descriptor, and was published at `0775c2bf` with exact
|
||
source-file equality independently verified. Normal owner synchronization
|
||
reconciled all 16 task records, with four assigned UUIDs and publication evidence
|
||
retained in owner `0394484`. All three normal passes returned zero failures and
|
||
automation errors; generated-only hook refusals and 25 final warnings remain.
|
||
No native checker/callback/identity was admitted.
|
||
Recovery adapter revision three independently passed 52 synthetic checks, with
|
||
all 14 dependency hashes verified. Exact daemon routing and early plaintext
|
||
cleanup registration are corrected; the remaining cleanup-versus-parent-lifetime
|
||
race requires a successor before canonical integration or native proof.
|
||
All sixteen target gates remain open.
|
||
|
||
2026-10-16 continued artifact/runtime review: coordinator reproduced the exact
|
||
KeyCape checker executable from published source with all declared source,
|
||
toolchain and module hashes verified; eight real-checker/helper/kernel fixtures
|
||
pass. Separate KeyCape owner review is underway. The existing NetKingdom caller
|
||
needs explicit checker environment and executable-path containment. Recovery R4
|
||
passed 61 independent checks, including disposable deadline/hard-parent-loss
|
||
processes, but a reproduced nonzero-Docker uncertainty gap requires a successor.
|
||
Native pinned-image fixture preparation continues with policy-lock write access
|
||
limited to temporary policy data. No actual credentials or native acceptance
|
||
were exercised. Checkpoint `86a5b0d` published and synced 89/89 with zero failures
|
||
and seven background warnings; original staged brief and unrelated work preserved.
|
||
|
||
2026-10-16 founder-requested pause: stop after current normal publication and
|
||
checkpoint sync. NetKingdom `916ba4b` publishes deterministic checker environment/
|
||
path selection, with 39 affected and 11 real-artifact checks independently passed;
|
||
KeyCape `834b0d0` publishes its bounded owner review. Recovery R5 passed 67 source/
|
||
process checks, but the actual disposable Docker positive fixture failed before
|
||
native verification. All registered resources/plaintext were removed and absence
|
||
independently checked. Retain the failed receipt and exact frozen R5; diagnose
|
||
before another trial. No actual credential recovery or target acceptance was
|
||
claimed. Full resume points and outstanding native gates are in the implementation
|
||
record's requested-pause section. Workplan tasks stay open; pause is not completion.
|
||
|
||
|
||
2026-10-16 explicit resume: GPT-6.1-Sol medium agents resumed recovery, browser
|
||
source and independent target-audit lanes. Browser immutable checker snapshot
|
||
passed 49 source and 12 real-artifact integration checks independently, then the
|
||
exact five-file patch was applied to the NetKingdom owner checkout. Owner
|
||
publication remains a separate receipt. R6 recovery preserves the anonymous-volume
|
||
refusal while masking the pinned helper image's declared volume with bounded
|
||
tmpfs; 72 checks and the first actual synthetic Docker positive passed. Original
|
||
TLS/signer, native service allow/deny, stored bytes and cleanup passed; real
|
||
owner-held recovery and all sixteen target gates remain open. Independent
|
||
scheduling prerequisites prove host report/hub access but fail the selected rein
|
||
startup readiness check. Full evidence and next acceptance steps are linked from
|
||
the implementation record's resumed-implementation section.
|
||
|
||
|
||
Resume follow-through: all four synthetic R6 native Docker cases passed, including
|
||
exact process-loss/deadline quiescence and retained uncertain-response refusal.
|
||
Host-device-bound independent checks retained the three reaper outcomes and
|
||
confirmed every exact resource/plaintext absent. The sandbox's separate tmpfs
|
||
initially hid those receipts; that observation failure remains recorded.
|
||
Recovery source is integrated; publication encoding R7 preserves runtime bytes,
|
||
uses typed public checksums after a retained normal scanner refusal, and passes
|
||
73 checks. NK-WP-0049-T32/T33 separate delivered source proof from preparation of
|
||
the real owner-held attempt; T18 remains open. Browser source8790dd18 and record
|
||
85a54ab are committed, with19 projected owner tasks matching. Actual local scanner
|
||
baseline and refusal cases completed with temporary fixtures removed. Two model
|
||
workers hit their usage limit after completed commands; coordinator verified the
|
||
receipts and continued integration. No native target gate or rotation deferral
|
||
changed; the full goal remains active.
|
||
|
||
|
||
Recovery source publication verified at `5fcd5952`: all eight added files match,
|
||
all33 projected tasks agree (T32 source proof done, T33 preparation todo, T18
|
||
actual recovery wait), normal sync has zero failures/automation errors and30
|
||
warnings, and the original staged/working brief is preserved. Full frozen fixture
|
||
packets remain workspace-local; canonical owner source, published independent
|
||
host cleanup/reaper evidence and the canonical integration receipt retain the
|
||
bounded delivered result. The target-wide goal remains active.
|
||
|
||
|
||
2026-10-17 source implementation follow-through: coordinated GPT-6.1-Sol medium
|
||
owner agents delivered group provenance/recovery source (`4f65e41`, NetKingdom)
|
||
and bounded staged-scanner batching (`83c521b`, Repo Manager). Independent canonical
|
||
runs passed 65/111/42 checks respectively. Actual disposable LLDAP passed 14 oracles
|
||
with independent exact-resource cleanup; four generated cases passed through the
|
||
configured shared/Custodian hooks using alternate indexes. Thirteen old/new scanner
|
||
parity cases match. The 16/64 small-blob medians improved from 12.065/49.172 to
|
||
0.884/0.904 seconds; one small blob slowed. These are bounded local results.
|
||
|
||
Review corrected production SQLite-volume advice before publication: ADR-0015
|
||
requires CNPG/rapp-postgres or an explicit governed exception. SQLite remains
|
||
local/disposable. NK-WP-0048-T20 records delivered preparation; T14 retains native
|
||
storage, scope, writer fencing, callbacks, evidence and revocation. NK-WP-0049-T34
|
||
records sealed-custody/preflight source; T35/T36 track original TLS/registration
|
||
bindings, T33 readiness and T18 actual recovery. Public source identifies the
|
||
railiance-cluster ingress/backup boundary and a historical secrets-engine-openbao
|
||
selector without current assent or private reads. RMGR-WP-0021-T05 stays progress
|
||
because actual-hook unavailable-scanner acceptance remains pending. All sixteen
|
||
target requirements stay open. Publication/task-projection/preservation checks:
|
||
`docs/changes/netkingdom-target-2026-10-16/resume-integration-r1/`.
|
||
No rotation, live deployment, actual key recovery or authority promotion occurred.
|
||
|
||
2026-10-17 continued verification and owner refinement: NetKingdom `70f408ca`
|
||
publishes the PostgreSQL provenance backend and real-SOPS regression successor.
|
||
Canonical provisioner tests pass 82. The actual disposable PostgreSQL trial passes
|
||
21 oracles, including restart/revoke, same-counter divergent forks, lost replies
|
||
and dump/restore rollback refusal; all exact resources are independently absent.
|
||
LDAP remains synthetic in this SQL fixture. Failed R2/R3/R4 returns are retained;
|
||
review repaired a real nested receipt-reference bug and two fixture snapshot
|
||
defects. NK-WP-0048-T21 records completed source/SQL proof; T14 retains actual
|
||
CNPG, owner callbacks/checkpoints/custody, all-writer fencing and native admission.
|
||
NK-WP-0049-T37 records all 65 actual SOPS cases (61 previously skipped plus four
|
||
sealed-FD cases); historical T34's skipped result stays unchanged. Actual recovery,
|
||
TLS/trust, registration/private admission and MFA remain open.
|
||
|
||
Repo Manager `9ebde0a9` completes only RMGR-WP-0021-T05 after ten fixture checks,
|
||
six actual configured-hook cases and exact hard-loss cleanup pass. Five projected
|
||
task bindings and remote HEAD match; T03/T04 and TSA-10/15 remain open.
|
||
Secrets Engine `c59bbf56` publishes SECRETS-WP-0015 with four exact projected task
|
||
bindings and both dependency edges. RCLUSTER-WP-0018 source is prepared but remains
|
||
unpublished behind the correct immutable-history guard. Do not replace the three
|
||
historical parent or 15 task UUIDs to force publication.
|
||
|
||
State Hub receiver `51bc70d1` and source-only dry-run repair `086d79a2` are published
|
||
and authoritatively projected. The CI image digest and selected receiver/migration/
|
||
hub-core files and 86 package metadata entries are independently verified without
|
||
executing or installing the image. Ten disposable actual SQL migration/old-write
|
||
compatibility oracles pass; production migration timing/full application behavior
|
||
remain unproved. The real server dry-run now passes with server-side dry-run for
|
||
the two Secret templates and the existing annotation policy intact. The full
|
||
rollout includes the inbox migration already on main; Helm rollback retains that
|
||
schema, and its timeout does not automatically stop a running migration Job.
|
||
Final exact values-preserving review and scoped founder rollout approval remain
|
||
separate. Keep the registrar guard until receiving is delivered and verified.
|
||
The one unresolved projected STATE95 dependency deliberately points to the
|
||
not-yet-admitted RMGR19 successor; it is not permission to activate it early.
|
||
|
||
Evidence: `docs/changes/netkingdom-target-2026-10-17/`, the exact published owner
|
||
sources, retained fixture revisions and the implementation record. All sixteen
|
||
native target gates remain open; no production rollout, private recovery,
|
||
credential rotation or autonomy grant occurred.
|
||
|
||
Final checkpoint: the exact packaged-chart, digest-pinned reuse-values server
|
||
dry-run passes with eight identities and only three image changes. Revision 4 of
|
||
`STATE-WP-0095-T06-cluster-frozen-receiving-r1` is recorded as pending in the
|
||
existing supervision record, preserving the original revision/digest, adverse
|
||
preparation history and all authority fields. The final proposal explicitly
|
||
includes the inbox migration and conditional exact-Job recovery, with unpriced
|
||
EUR exposure and unknown mapping requiring attended owner recovery. No live
|
||
action is approved or executed. Four coordination receipts attach foreign waits
|
||
without messages or worker wakes. Source/remote/Hub readback verifies 66 new
|
||
checkpoint owner bindings plus the nine Repo Manager/Secrets bindings; source
|
||
counts and native acceptance remain separate.
|
||
|
||
|
||
## Approved receiver execution, 2026-10-17
|
||
|
||
This checkpoint supersedes the pending-rollout state recorded above. The founder's
|
||
“good, go ahead” approved exact revision 4 of
|
||
`STATE-WP-0095-T06-cluster-frozen-receiving-r1`, digest
|
||
`63a02e8296d126c0158b7eb2c4ce79c7eeb6f8d6f61298d473c1065c7557ba32`.
|
||
Decision `e3798419-8aa9-5425-8c08-20df6bd82a19` records
|
||
`ADMINISTER @ realm:kubernetes/railiance01`, `activation=APPROVED` for that
|
||
proposal and its exact conditional recovery, with no autonomy grant.
|
||
|
||
The owner Helm upgrade succeeded as revision 76. API and MCP are Ready on the
|
||
approved image digest `c802690ee1811b3d77df4077936f9cdced1385514e8673fcbc9232b84d645015`;
|
||
primary/railiance01 reports applied and expected schema `c4d5e6f7a8b9`.
|
||
Delivered historical projection module hash matches the reviewed image. Full-row
|
||
hashes and column sets of all three historical workplans and fifteen tasks are
|
||
identical before and after deployment. Five actual native receiving cases pass:
|
||
preserve, foreign holder, missing task, nonterminal parent and nonterminal task.
|
||
Every probe rolled back; zero commits and a fresh-transaction full-row comparison
|
||
confirm preservation. Helm succeeded and the migration Job disappeared after
|
||
its exact UID and owned Pod were observed; no Job Succeeded event is claimed.
|
||
No recovery was needed. The exact owned staging archive/directory was removed.
|
||
|
||
Only after these observations was the frozen seven-file registrar source applied.
|
||
Canonical focused checks pass 47; the actual read-only Cluster allocator preview
|
||
proposes exactly seven missing UUID fields in the new WP0018 and one existing
|
||
ADHOC task. Fifteen invalid historical labels and five collisions remain reported;
|
||
no archive rewrite, direct database UUID repair or broad syntax exception occurred.
|
||
Owner publication and receiving follow-through are recorded separately below.
|
||
|
||
Evidence: `docs/changes/netkingdom-target-2026-10-17/receiver-rollout-r4/verified-receiving-return.json`
|
||
and its hash-bound actual native receipts; registrar source/application and preview
|
||
receipts in `registrar-followthrough-r1/`. The same original supervision trial
|
||
retains all preparation revisions and failures; accepted-revised execution earns
|
||
no unchanged-success credit. All sixteen native target gates remain open.
|
||
|
||
|
||
## Ordinary Cluster publication and retained acceptance failure, 2026-10-17
|
||
|
||
Cluster owner commit `c562d7134c38679952a8ffd17a8a893a900aef0d` is published and
|
||
reconciled on primary/railiance01 at the exact expected/derived revision. WP0018's
|
||
five task ID/UUID/status bindings and three internal edges match source and the
|
||
remote. Exactly seven missing fields were assigned by the normal managed path,
|
||
including one existing ADHOC task field. All three frozen archive hashes remain
|
||
unchanged, and original staged/dirty generated files were restored exactly.
|
||
Registrar source admission `70cd7549` is published and verified, with T05 done;
|
||
source preparation and actual Cluster acceptance remain separate outcomes.
|
||
|
||
The stronger full-row guard FAILED after the required legacy deep consistency
|
||
pass: the three historical parent hashes changed, while all fifteen task full
|
||
rows remain identical. The native forge projection reports preservation, but
|
||
that does not establish preservation for the whole pipeline. Source review found
|
||
that `PUT /workplans/index/bindings` writes backing fields and a new sync timestamp
|
||
without consulting the frozen-history guard; ORM update timestamps also advance.
|
||
The checker calls this route even during checks. Only whole-row baseline hashes
|
||
were retained, so exact changed columns/values cannot be reconstructed from the
|
||
baseline. No guessed timestamp or database restoration is performed.
|
||
|
||
This later failure does not erase the earlier passing rollout and rollback-only
|
||
probe results. It prevents RMGR-WP-0019-T06 and STATE-WP-0095-T07 completion.
|
||
The existing State Hub owner record carries the source guard and regression
|
||
follow-up plus its separate reviewed runtime-delivery obligation. Source edits,
|
||
fixtures and successful publication do not stand in for that new native return.
|
||
No further production rollout is authorized by the earlier revision-4 approval.
|
||
|
||
Evidence: `docs/changes/netkingdom-target-2026-10-17/cluster-publication-readback.json`,
|
||
`railiance-cluster-projection.json`, and
|
||
`receiver-rollout-r4/ordinary-pipeline-preservation-finding.json`, including the
|
||
retained `post-publication-full-row-hashes-FAILED.json` and exact archive checks.
|
||
All sixteen native target gates remain open.
|
||
|
||
|
||
## Verified installed-client repair and exact runtime successor, 2026-10-17
|
||
|
||
State Hub source guards and real writeback regression are published through
|
||
`c103cbf3c8bed5dba87a03e320595ddded9301a3`; the later WP-only checkpoint is
|
||
`9eaa36143ea18111c522ea14d32978495b4e5030`. Canonical guard checks pass 102,
|
||
independent review passes 109, and five actual disposable Git checks verify
|
||
file-scoped commits with unrelated staged/dirty state and hook refusal preserved.
|
||
Normal chart rendering and classification checks pass. The first attempted
|
||
client rerun loaded an older installed package and failed again; its actual
|
||
receipts stay retained. The installed owner package was then refreshed and its
|
||
loaded checker hash verified against R6 source before the next run.
|
||
|
||
The corrected actual ordinary Cluster maintenance passes: 20/20 ordinary
|
||
bindings, three frozen bindings omitted, and all eighteen CURRENT full-row
|
||
hashes unchanged before/after. Original failed parent hashes are not restored
|
||
or relabeled as successes. The old writeback helper also included an unrelated
|
||
staged brief during legitimate C23 activation. Forward correction
|
||
`6ae3f847c83da3402883453ee7110457bfb2d0d6` preserves active WP18, restores the
|
||
prior committed brief, and reinstates its exact original staged/worktree bytes;
|
||
dirty WORK-RECORDS and archive hashes are preserved. No history was rewritten.
|
||
Repo Manager `1dacdd4a31c8e9b1bb1ddfb0c349dfb87e29e8cd` retains T05 done/T06 wait
|
||
and projects T06's actual dependency on STATE-WP-0095-T10. State Hub T07 also
|
||
waits on T10; all ten own task UUIDs remain exact, T09 done/T10 human wait.
|
||
|
||
The normal CI guard image at
|
||
`sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1`
|
||
is inspected read-only against runtime source `c103cbf`. Selected guard/receiver/
|
||
migration/build files match; package metadata and hub-core source hashes equal
|
||
the deployed image's observations. Exact pinned-package reuse-values server
|
||
dry-run passes eight identities and only three image changes. Fresh explicit
|
||
target/headroom/schema checks pass. The prepared eight native cases enforce
|
||
commit interception and rollback; their actual schema/interception contracts
|
||
are checked without a DB connection, but these new native cases are not executed.
|
||
|
||
Exact successor `STATE-WP-0095-T10-frozen-bindings-guard-r1` revision 1 is pending,
|
||
metadata digest `81d365926fc585a186955d8c98ee83501fd3cec12135b2256d71b46a75097932`,
|
||
decision `df703266-6719-4c04-ae1b-ba9afd3bca1c`. It requests scoped new-image
|
||
approval, current-baseline acceptance with the old failure retained as an
|
||
exception, and exact conditional recovery/rollback to Helm 76. Unknown EUR
|
||
cost/risk or Job/DB mapping is not a free or bounded exposure. The prior
|
||
revision-4 approval does not approve this successor. Current runtime remains
|
||
healthy Helm 76 on the approved `51bc70d` image; no new API guard delivery or
|
||
native security-gate closure is inferred. The original supervision record
|
||
retains successful earlier-stage execution plus later failures; its new request
|
||
is pending/not executed and grants no authority.
|
||
|
||
Evidence: `docs/changes/netkingdom-target-2026-10-17/guard-successor-review-r1/`,
|
||
`receiver-rollout-r4/before-verified-client.json`, `after-verified-client.json`,
|
||
`verified-loaded-client.json`, `verified-client-cluster-consistency.json`,
|
||
`verified-client-cluster-projection.json`, the exact owner publication packets
|
||
and `rollout-owner-bindings.json`. The original receiver/registrar case is
|
||
satisfied; the successor attaches to the existing retirement driver and stops
|
||
at the human gate. TLS metadata work remains an owner wait. No worker was woken.
|
||
All sixteen native target gates remain open.
|
||
|
||
The same pending API guard proposal now has revision 2, SHA256 `5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e`, at `docs/changes/netkingdom-target-2026-10-17/guard-successor-review-r2/FINAL-PROPOSAL.md`. Only the probe source-hash metadata representation changed after the normal scanner flagged hashes as generic API keys. Revision 1 remains unapproved and unexecuted; the runtime image, probe case logic, acceptance exception and recovery scope are unchanged. Source-publication receipt hashes are exposed through reversible typed metadata companions; original bytes and the refused scan remain retained.
|
||
|
||
The owner’s WP-only revision-2 reference amendment is published at State Hub `4c03c9d2c6a47f5c7247473f74b2e2f188b787bd`. Final source/remote/primary readback verifies all 26 affected owner task bindings; runtime source remains `51bc70d` and the proposed guard image remains `c103cbf`.
|
||
|
||
|
||
## Approved API guard delivered and verified, 2026-10-17
|
||
|
||
The founder approved `STATE-WP-0095-T10-frozen-bindings-guard-r1` revision 2,
|
||
SHA256 `5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e`,
|
||
through decision `df703266-6719-4c04-ae1b-ba9afd3bca1c`. The exact pinned
|
||
`main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1`
|
||
image is delivered at Helm 77. API and MCP are Ready; applied/expected schema
|
||
remains `c4d5e6f7a8b9`. The exact observed migration Job and owned Pod are gone,
|
||
and only the verified owned chart staging was removed. No recovery was needed.
|
||
|
||
All eight deployed owner-handler cases passed with enforced commit interception,
|
||
rollback and fresh-transaction comparison. The actual ordinary Cluster pipeline
|
||
passes with the verified installed checker: 20/20 ordinary bindings, three frozen
|
||
bindings omitted, and all eighteen CURRENT historical full rows unchanged across
|
||
the rollout, native probes and maintenance. All three frozen archives and
|
||
unrelated staged/worktree state are preserved. The earlier three-parent mismatch
|
||
remains a founder-approved historical exception: unavailable old preimages were
|
||
not guessed, restored or relabeled as a passing result. Runtime acceptance is
|
||
separate from all sixteen NetKingdom native target gates, which remain open.
|
||
|
||
Frozen acceptance return:
|
||
`docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-receiving-return.json`,
|
||
SHA256 `09958bd69367cc6903e2a21a56eb81b6a8a46c2a1907afc93f787cd63732e92a`.
|
||
The supervision record retains original revision 1, the approved/executed revision
|
||
2, exact digests and successful refined outcome; it grants no autopilot authority.
|
||
|
||
Source follow-through: State Hub `200cbd0a61a805d0fe29f9d6d1c49a6cf1f1703a` finishes STATE-WP-0095 with all ten tasks done and declared image pins matching the verified deployment; Repo Manager `3bcb1e1cf3e58b263f690534f7f28024d75cdbf6` finishes RMGR-WP-0019 with all six tasks done. Task UUIDs remain unchanged. The existing binding-guard successor coordination case is satisfied; independent native-owner work remains live, and no worker was woken.
|
||
|
||
## Source-owner follow-through and native preparation, 2026-10-17
|
||
|
||
NetKingdom `c52ca7f405416d437951844c0640b86e677c3523` publishes the exact-one
|
||
original client selector guard, four early-refusal regressions and the scoped
|
||
unexecuted fixture-manifest successor. Root independently passes those four
|
||
checks; the owner's 39 adapter checks and four affected manifest checks pass.
|
||
The prior stale-hash refusal and original frozen native receipts stay retained.
|
||
This guard acts after decryption and before further runtime inputs; it supplies
|
||
no archive/TLS/consumer/native acceptance. NK49-T38 records this completed source
|
||
outcome. NK48-T22/T23 record the distinct registration and storage owner reviews.
|
||
All 58 old task blocks are preserved; 61 actual source/remote/primary task
|
||
bindings and active internal dependencies are verified after normal publication.
|
||
Initial overly broad historical-edge verification refused; the corrected check
|
||
uses the actual C20 source rule, preserving the refusal and original verifier.
|
||
|
||
Secrets Engine `691dc742362eeec45d5bd32d2b468f31a959748e` publishes its exact
|
||
original-consumer custody plan and marks SECRETS-WP-0015-T03 done for source
|
||
preparation. Four task UUIDs and T04's human-wait dependencies on T03/NK49-T33
|
||
are verified. The candidate observer remains unwired/unexecuted on real input;
|
||
five synthetic checks establish only claim parsing/source/input refusals.
|
||
Original TLS/archive/private admission, original OpenBao/custody/MFA recovery,
|
||
actual signed-token/resource-server denials and revocation remain native owner
|
||
work. Existing protected-backend scopes stay in SECRETS0008/0013.
|
||
|
||
The completed owner reviews leave NK48-T14/T15/T16 implementation/native gates
|
||
open. The proposed package/SQL candidate, original-context seam and six missing
|
||
descriptors do not create native authority. GLAS's bounded real-model proposal
|
||
retains its existing Claude profile, spend/metering/native approval requirements
|
||
and immutable runtime; it does not migrate this Custodian assignment. The private
|
||
scanner-response lane still needs an actual owner contract. APPROVAL-WP-0002
|
||
remains residual and was not promoted. All sixteen target native gates are open.
|
||
|
||
User-directed NetKingdom source/history investigation locates the requested
|
||
StorageShare recovery guide: publication commit
|
||
`31f483966cdfca4df1d326dee3ec0b6d33ea0e5e`, actual readback 16 October 18:01 UTC,
|
||
Backup account, `railiance-backups/net-kingdom-identity/`, filename
|
||
`net-kingdom-recovery-57d1940947aa25ff-START-HERE.md`, with ZIP/checksum.
|
||
The local guide matches that recorded publication. Current remote visibility,
|
||
original TLS custody and whole-estate recovery are not established by this
|
||
identity-only guide. No share, credential, backup or current remote file changed.
|
||
|
||
Evidence: dated 17 October native/source/consumer packets listed in
|
||
`docs/netkingdom-target-implementation.md`, especially each owner's verified
|
||
bindings and `storage-share-tls-r1/source-history-followthrough-r2.json`.
|
||
All current task statuses remain appropriate: T03/T05/T06 progress, T04 todo,
|
||
T01/T02 done. No completion percentage or native closure is inferred from the
|
||
new completed source-review tasks. This remains the active implementation goal.
|
||
|
||
## Runtime installation and refined offline verification, 2026-10-17
|
||
|
||
Exact founder-approved installation revision 2 ran once under decision
|
||
`b6abb6ab-b182-4b4f-9f84-79ddc5ad91f3`. The inactive f599 runtime is installed
|
||
and its complete native digest independently verified. The required offline
|
||
launcher rehearsal failed (`phase_receipt_unavailable`, supervision reason
|
||
`leader_left_descendants`). Its watchdog reported positive process quiescence;
|
||
independent readback verified the full installed digest and owned staging absence.
|
||
The same supervised trial records failure; no native target
|
||
gate or runtime acceptance is complete.
|
||
|
||
The frozen source has a locally reproduced zombie-classification bug, but the
|
||
native failure's cause remains unproven. Reviewable verification-only revision 3
|
||
repairs that source defect and preserves a durable public receipt before cleanup,
|
||
keeping the full three-launcher acceptance requirement. Root verified 18 candidate
|
||
and 29 frozen revision 2 file pins; five focused local process/cleanup checks pass.
|
||
The founder approved exact revision 3 under
|
||
`bec667cc-15ea-4f87-ae16-111f08562e48`, proposal SHA256
|
||
`7d5741abc7da042d4de6cd36437801309b844760f606b3145d615fd75d6b2d30`.
|
||
Its first read-only preflight refused CPU headroom (99.25% busy; limit 85%).
|
||
After the main publication checks finished, one fresh preflight passed at 66.33%
|
||
CPU busy. The exact approved controller ran once. All three original empty-egress
|
||
offline launcher checks exited zero with complete f599 before/post digest equality;
|
||
its journal reports three dead adopted zombies reaped and positive quiescence.
|
||
Independent native readback verified full f599 again, owned staging absence and
|
||
the retained0600 public checkpoint's exact match to the local precleanup receipt.
|
||
The same trial records refined success with the original failed revision 2
|
||
receipt/history preserved; no unchanged original-success credit is inferred.
|
||
No reinstall, model call, credential/profile/queue change or autonomous live
|
||
retry is authorized by the failed revision 2 run. Revision 3's separate exact
|
||
approval covers the completed verification only. EUR cost remains unmeasured.
|
||
All six task blocks, UUIDs and statuses remain unchanged; all sixteen native
|
||
target gates remain open. Evidence is linked from the implementation document's
|
||
dated partial-runtime-installation checkpoint.
|
||
|
||
2026-10-17 user-directed KEY-WP-0039 finalization review: its accepted source
|
||
deliverables remain done (T01/T03); all 14 reviewed executable/test/decision pins
|
||
and three Platform pins still match. Exact Hub readback confirms the existing
|
||
registration go covers KEY37-T03's original secrets-engine-openbao client; it
|
||
does not admit new probe credentials or coding-client custody. That original
|
||
approval remains valid, and the reviewed-command standing attended rule has its
|
||
separate existing scope. T02's actual negative/expiry/revoke/cleanup
|
||
receipt is absent in the bounded source search; KEY38-T02/T03 and the existing
|
||
unadmitted coding-client custody/owner readiness returns remain prerequisites.
|
||
The parent stays active, T02 waits, and no native gate closes. No new helper
|
||
protocol or repeated original-client registration approval is required. Evidence:
|
||
`docs/changes/netkingdom-target-2026-10-17/key39-infra-finalization-r1/`.
|
||
|
||
|
||
2026-10-17 T03 implementation checkpoint: independent GPT-6.1-Sol medium
|
||
reviewers checked the actual Warden kernel, fixed issuer-reference and Apps
|
||
inverse candidates. Reviewed kernel corrections plus the narrow ambient-lookup
|
||
unit-test fix are integrated and published at Warden `922c26d`; the normal
|
||
allocator's existing completed-task UUID addition is retained separately from
|
||
implementation `ae7bc73`. All four WP44 task bindings/statuses remain unchanged.
|
||
Platform `104ed90` publishes the proposed exact issuer ESO source; NetKingdom
|
||
`342a6f25` and `befb0bc6` carry independent mint regressions, valid catalog
|
||
fixtures and exact proposed issuer-template text. Source tests and limitations
|
||
are recorded in docs/netkingdom-target-implementation.md. NK48 refinement adds
|
||
completed source tasks T32/T33/T35 and keeps T34 progress for the real Apps
|
||
inverse/backend; T16 and first native case remain open. The fresh inverse-session
|
||
prototype is corrected and tested, but no real owner backend or authority is
|
||
invented. Earlier rejected reviews, the possible ambient lookup and failed
|
||
preparations remain retained. All six coordinator task blocks/statuses/UUIDs
|
||
are unchanged; all sixteen target native gates remain open.
|
||
|
||
|
||
2026-10-17 T03 safe-unit follow-through: Warden `b593c879` integrates the
|
||
ordinary test-entry guard after independent rejection and root review of the
|
||
minimal O_TRUNC/provenance corrections. The corrected full ordinary make test
|
||
passes 785 tests, four deselected, under synthetic ambient-token/HOME/Python/
|
||
pytest sentinels. Source, pins, catalog and four WP44 task blocks are unchanged.
|
||
The known ambient-lookup accident path has a supported isolated test entry;
|
||
this is not an OS sandbox or actual assignment isolation, and original adverse
|
||
unknown outcomes remain retained. Evidence: dated warden-safe-unit-integration-r1
|
||
and warden-safe-unit-runner-review-r1 packets. Coordinator task statuses and all
|
||
sixteen native acceptance gates remain unchanged.
|
||
|
||
2026-10-17 T03 concrete owner follow-through: Platform source d35c0f9d is
|
||
published/projected with reviewed exact broker source validation and the
|
||
human-only issuer catalog correction. New normal-allocator RPF-WP-0060 makes
|
||
the four existing owner review obligations live tasks; T02 done, T01 progress,
|
||
T03/T04 todo. Independent delivery review rejects the first command candidate
|
||
for freshness/defaulting/transport/race defects; no inert prototype counts as
|
||
operational delivery. Actual Apps chart/image inspection proves the existing
|
||
CLIENT_SECRET reference can work but the exact three-group any-of sign-in gate
|
||
cannot be expressed by the current literal field. Nine offline/render checks
|
||
are independently reproduced. NK48 task refinement records completed source
|
||
proof T36 and real implementation T37, preserving all prior 35 task blocks.
|
||
Existing T34 inverse/session/journal/exclusion and T16/T06 admission/native gates
|
||
stay open. Evidence is linked in the implementation record. All six coordinator
|
||
task blocks/UUIDs/statuses and all sixteen native gates remain unchanged.
|