140 lines
5.6 KiB
JSON
140 lines
5.6 KiB
JSON
{
|
|
"date": "2026-10-12",
|
|
"gap": "G08",
|
|
"owner_workplan": "NK-WP-0049",
|
|
"manifest": {
|
|
"repo": "net-kingdom",
|
|
"base_head": "d552bf253c398548f2eae8f4101981c1329dcdc1",
|
|
"files": [
|
|
{
|
|
"path": "sso-mfa/bootstrap/creds-bootstrap-agent.sh",
|
|
"before": "ec7d97e78499ed32e4416cc9ca4c11422e86f3a4c8b5ffe21554fb485aff14f1",
|
|
"after": "14169a740e236a93e69fccb3acc2b9740cfc74dfebe261e0a7b3d805b8b39aba"
|
|
},
|
|
{
|
|
"path": "sso-mfa/bootstrap/emergency-bundle.sh",
|
|
"before": "02ec5e9fc5e141e0c9792771a919bef5b88f759fa564a0e42dfabf003eb3e059",
|
|
"after": "c1a0e9853dae6b71537ecb708b05ce967eacf797334192156485ca943dc8c71e"
|
|
},
|
|
{
|
|
"path": "sso-mfa/bootstrap/gen-secrets.sh",
|
|
"before": "df313453d59b007cccce9b2835f9bd6451fda4a7cbd8581fa83c636cf7bc61f3",
|
|
"after": "22a98e0246b5377d999b04ad855774dc085904683602061e53ed8f5508d693ee"
|
|
},
|
|
{
|
|
"path": "sso-mfa/bootstrap/creds-status.sh",
|
|
"before": "5586743042687480377db1357a4bb7c1999025f5ffba846408ac423b94174478",
|
|
"after": "5761a22d9a0f03b8786603a75d9ba9fabac6ec6ee0178f744d8a1d75238684d1"
|
|
},
|
|
{
|
|
"path": "tests/test_bootstrap_secret_output.py",
|
|
"before": null,
|
|
"after": "afb1c9a12a47e37644f851d2939e93a70fa3def727239691d947bddd2725e3e5"
|
|
},
|
|
{
|
|
"path": "Makefile",
|
|
"before": "b9da3d5b3c01fe7f15848c379c9282827dfde8284fa3136bad020eab262ccd96",
|
|
"after": "571adaae4e2b4a7ce902c72e96815ce30aed1b0833f5774b0b2615fdcfe73eb6"
|
|
},
|
|
{
|
|
"path": "canon/standards/credential-management_v0.2.md",
|
|
"before": "7c4454a9a015d809ffdcd0ca5231352bb729376c08e7e9e43a1fec0f608d238d",
|
|
"after": "72d035ce19926098225061c74bc2e7baa65d38dffb7db2e513160eee1eacdc37"
|
|
},
|
|
{
|
|
"path": "docs/security-bootstrap-age-custody.md",
|
|
"before": "9fc8e1fa84c24c311bd50a0050d08784a0a4119b20cd3782cbfe0f3736a30dc6",
|
|
"after": "f50f7995563060e85886c7f0465e320cb3351d5648659e1caced0147028e3fc0"
|
|
},
|
|
{
|
|
"path": "sso-mfa/bootstrap/README.md",
|
|
"before": "4d9c2aafb9ed0a8ef5010d3e7d81b89ce130956dc3beb770b9559d64c7ce6994",
|
|
"after": "5a14118fb8e4a04a34b1252528f244ff660f4e173b99c85163d88cad652b9db7"
|
|
},
|
|
{
|
|
"path": "tools/security-bootstrap-console/security_bootstrap_console.py",
|
|
"before": "2f2254647f0f82bcde7ba3beb871f8d069d0bdae213e4d8e5458190e528a1e78",
|
|
"after": "e5bf6431e3bb1ff6283357f94a14c84f236729255be3602edce666016a2e031b"
|
|
},
|
|
{
|
|
"path": "workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md",
|
|
"before": null,
|
|
"after": "48284284e5846cc15f8b004844af34f5a606f0d10b6753155e06c36db6eb2ce3"
|
|
}
|
|
]
|
|
},
|
|
"scope": "Local source repair; no live root, credential or cluster mutation",
|
|
"knowledge_orientation": {
|
|
"version": "0.2.6",
|
|
"digest": "8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02",
|
|
"status": "withheld for changed sources; owner source reviewed directly"
|
|
},
|
|
"verification": {
|
|
"original_regressions": {
|
|
"failed": 7,
|
|
"passed": 0
|
|
},
|
|
"focused_with_console": {
|
|
"passed": 27,
|
|
"failed": 0
|
|
},
|
|
"shell_syntax": "pass",
|
|
"installed_source_hashes": "all 11 match candidate",
|
|
"archived_full_suite": {
|
|
"passed": 185,
|
|
"skipped": 6,
|
|
"failed": 1,
|
|
"reason": "Posture source identifier expects directory basename net-kingdom; archive basename differs."
|
|
},
|
|
"actual_checkout_full_suite": {
|
|
"command": "PYTHONDONTWRITEBYTECODE=1 python3 -m pytest -p no:cacheprovider tests tools -q --tb=short",
|
|
"passed": 192,
|
|
"failed": 0,
|
|
"skipped": 0,
|
|
"seconds": 67.56
|
|
}
|
|
},
|
|
"proof_scope": [
|
|
"synthetic HOME root marker is not exported by emergency/reprint",
|
|
"secret generation prefixes absent, including bash -x invocation",
|
|
"private generated file modes",
|
|
"dry-run makes no tool calls or state changes",
|
|
"unattended live call refused",
|
|
"real age encryption/decryption of disposable service files with simulated cluster and git",
|
|
"explicit matching-key resume; wrong/missing key refused before cluster access",
|
|
"declined handoff stops cleanup/completion",
|
|
"fresh bundle preserves prior ciphertext; new acknowledgment bound to digest",
|
|
"historical state distinguished from current acknowledgment"
|
|
],
|
|
"limits": [
|
|
"No production bootstrap or native apply/init helper acceptance",
|
|
"Terminal presence is not identity/authority or runtime isolation",
|
|
"Operator acknowledgment is not independent recovery verification",
|
|
"Other permanent-key setup and direct custody callers remain NK-WP-0049-T02",
|
|
"Historical exposed credentials are not revoked; existing founder deferral remains effective"
|
|
],
|
|
"remaining": [
|
|
"legacy custody caller reconciliation",
|
|
"owner procedure review",
|
|
"exact authorized isolated off-host recovery and cleanup receipt"
|
|
],
|
|
"source_commit": "b97f9f616f2f0aea41fbb6716269767aa691b023",
|
|
"source_pushed": true,
|
|
"statehub_sync": {
|
|
"owner": {
|
|
"fail": 0,
|
|
"automation_error": 0,
|
|
"warn": 33,
|
|
"info": 5
|
|
},
|
|
"owner_note": "Generated-only brief commit rejected; scoped source/workplan commit was pushed separately.",
|
|
"custodian": {
|
|
"fail": 0,
|
|
"automation_error": 0,
|
|
"warn": 7,
|
|
"info": 4
|
|
},
|
|
"custodian_note": "DB reconciliation succeeded; automatic working-memory commit was refused by sandbox. Reviewed assessment/evidence committed separately."
|
|
},
|
|
"source_implementation_decision_id": "d9429072-9138-5b77-b0c5-0eb2ea22bc10"
|
|
}
|