user-engine/docs/evidence/2026-10-11-one-app-catalogue-human-packet/intake.json

{
  "kind": "informed-decision.memo-intake",
  "version": 1,
  "idempotency_key": "infd-20261011-user-catalogue-bootstrap-r1-v1",
  "memo_class": "decision-record",
  "review_group": "net-kingdom-admins",
  "drafted_by": "custodian-codex",
  "approval_intent": {
    "action": "administer",
    "principal": "user-engine",
    "purpose": "Approve one supervised catalogue metadata exception with exact source/transport, expiry, verification and guarded recovery; ordinary management admission remains unmet.",
    "target": {
      "id": "USER-CATALOGUE-INFDEC-20261011-R1",
      "type": "catalogue-maintenance-exception",
      "system": "railiance01"
    }
  },
  "memo": {
    "id": "infd-20261011-user-catalogue-bootstrap-r1",
    "version": 1,
    "question": "Approve the exact one-time User Engine catalogue registration for Informed Decision, with genuine PDP denial retained, explicit supervised maintenance attribution, native dry-run and guarded recovery by October 12 at 23:59 UTC, plus restoration of ordinary authenticated management before customer production?",
    "requested_act": "approve",
    "binding_level": "organizational",
    "brief": "One fixed Application/browser-client/protected-system binding; ordinary application.register admission remains unmet. Exact reviewed executor and transport, 21 isolated PostgreSQL checks and 6 offline transport guards. Separate founder exception required before native dry-run/apply; private JSON/hash is not authentication. No image/config/IAM/human claims; created-only recovery may stop on delivery/expiry. Conditional restoration owner and criterion attached.",
    "binding": {
      "principal": {
        "id": "pending-human-session",
        "kind": "person",
        "display_name": "Founder review"
      },
      "target": {
        "kind": "resource",
        "id": "realm:kubernetes/railiance01/user-engine/catalogue/informed-decision",
        "label": "Fixed Informed Decision Application and binding in User Engine",
        "environment": "build"
      },
      "terms": "Only USER-CATALOGUE-INFDEC-20261011-R1 and attached executor b0dbbb9786e927055030acf849a72e9a44e9d3d55c84efdf245e419d381684f3 AND supervisor transport 3e594e0e8561100ae1eeb34d7208cd5b5e387ae56c29689f155aed94219770f3 with attached fixed records; execute by 2026-10-12T23:59:59Z after independent native founder-receipt confirmation and fresh frozen pod/image/package/provider/absence checks. Approve native dry-run with external PDP telemetry, one atomic mutation/no-change, read-only verification, private-input cleanup and original-grant created-only recovery before expiry. No targeted replay or future registrations; conditional ordinary management restoration before customer production."
    },
    "step_kind": "approve",
    "packet": [
      {
        "item_id": "decision-packet-md",
        "label": "decision-packet.md",
        "hash": "sha256:f49244e7dfe4c0aa30fbc1d6ec06ba8ea050968294daf6ec6543d605c55cbb3c"
      },
      {
        "item_id": "execution-and-verification-md",
        "label": "execution-and-verification.md",
        "hash": "sha256:b465319b82106a71e3ff73d01a713aef0e8957fdb3111d46b8c25923a89faf62"
      },
      {
        "item_id": "proposal-json",
        "label": "proposal.json",
        "hash": "sha256:c9bba99e39ed4119adaa5af81a6a3b03e2959eda340a377c4ee638b840639399"
      },
      {
        "item_id": "private-grant-schema-json",
        "label": "private-grant.schema.json",
        "hash": "sha256:b7c17e13fa73e9f2e5328e067befa75f681ee356f0d1587849929d498dd025f8"
      },
      {
        "item_id": "conditional-close-down-entry-md",
        "label": "conditional-close-down-entry.md",
        "hash": "sha256:6f14735aae84e82c7b3e582b5851fa6e266097ea97a931017fee6bc91d2e7cc2"
      },
      {
        "item_id": "executor-py",
        "label": "executor.py",
        "hash": "sha256:b0dbbb9786e927055030acf849a72e9a44e9d3d55c84efdf245e419d381684f3"
      },
      {
        "item_id": "supervisor-transport-py",
        "label": "supervisor-transport.py",
        "hash": "sha256:3e594e0e8561100ae1eeb34d7208cd5b5e387ae56c29689f155aed94219770f3"
      },
      {
        "item_id": "canonical-records-json",
        "label": "canonical-records.json",
        "hash": "sha256:ae6fde5f2c879e75fabb53e132261899dae0f4d864e18dd425bc272be713426b"
      },
      {
        "item_id": "executor-proposal-json",
        "label": "executor-proposal.json",
        "hash": "sha256:69ad999d70c014472d70e7ba394390e039f295ad0d35ab2d322e2a32ca00877c"
      },
      {
        "item_id": "executor-source-boundary-json",
        "label": "executor-source-boundary.json",
        "hash": "sha256:3592168805539ab87133ed88a9c095b81609314dd56968f3a26d8cb23d7e148f"
      },
      {
        "item_id": "original-postgres-receipt-json",
        "label": "original-postgres-receipt.json",
        "hash": "sha256:964cc3755e96330bf6d1ada63410f8adfdb3c45602e0446369d6dddace412405"
      },
      {
        "item_id": "final-owner-postgres-receipt-json",
        "label": "final-owner-postgres-receipt.json",
        "hash": "sha256:659d29e85da00aaece0da933ca2b25b9e60feae18072745095a66370854a7ee4"
      },
      {
        "item_id": "user-owner-agreement-md",
        "label": "user-owner-agreement.md",
        "hash": "sha256:cb9fdadb3a8f432f100e9340e5b94af932c4d11a5705af6a80d336a5026d867b"
      },
      {
        "item_id": "netkingdom-owner-agreement-md",
        "label": "netkingdom-owner-agreement.md",
        "hash": "sha256:12d11938eeed8864c5fcec1638b9045d1c96eafbaa7c02a62d17ba599666bd07"
      },
      {
        "item_id": "application-owner-facts-ack-md",
        "label": "application-owner-facts-ack.md",
        "hash": "sha256:b2da26b74cb2bb74d26312941673e95f1653f6154a7ef90155562e316f5837c7"
      },
      {
        "item_id": "retained-native-preflight-json",
        "label": "retained-native-preflight.json",
        "hash": "sha256:8bc7f73e0a89493ee376383132c47d8e0b6f0723395373153421eb3e058101eb"
      },
      {
        "item_id": "retained-native-entry-metadata-json",
        "label": "retained-native-entry-metadata.json",
        "hash": "sha256:9314410240a9997679768e54b2487c0e76c924f8ea8ab8cfff0f623d39e07060"
      },
      {
        "item_id": "retained-keycape-client-presence-json",
        "label": "retained-keycape-client-presence.json",
        "hash": "sha256:54657adf2c53ea220d93db5ab2e865fcea2106aaee517a9932d071b842a58912"
      },
      {
        "item_id": "transport-guard-receipt-json",
        "label": "transport-guard-receipt.json",
        "hash": "sha256:2919c155c0c0be0a5ac6e054798d9ec89a7b4c254ed6037a69dfaafc50ed4546"
      },
      {
        "item_id": "transport-guard-tests-py",
        "label": "transport-guard-tests.py",
        "hash": "sha256:a6362e23e5608c36ed84855c90c3f4593aebca6593844e9caf179ca9192a1f3b"
      }
    ],
    "highlights": [
      {
        "id": "explicit-maintenance-exception",
        "item_id": "decision-packet-md",
        "note": "This overrides genuine ordinary application.register denial for exactly two metadata facts; it does not satisfy normal PDP admission or authenticate a human. Recovery stops on changed dependencies,expiry or claimed/delivered/missing event. Targeted replay/delivery is excluded. Preserve one conditional restoration obligation before customer production.",
        "required_ack": true,
        "severity": "warning",
        "locator": {
          "kind": "section",
          "heading": "Requested decision"
        }
      }
    ],
    "sealed": false,
    "approval_id": null,
    "approval_binding_digest": null
  },
  "packet": [
    {
      "item_id": "decision-packet-md",
      "media_type": "text/markdown",
      "content": "# One-app catalogue registration — R1\n\n## Requested decision\n\nApprove USER-CATALOGUE-INFDEC-20261011-R1, the exact attached executor and supervisor transport, as one explicitly labelled maintenance exception to ordinary application.register PDP admission. Execution ends by 2026-10-12T23:59:59Z. Approve its native database dry-run, one atomic exact two-record apply, stated verification/cleanup and bounded created-only recovery; record the single conditional close-down obligation. This is a separate approval from the already accepted readback runtime R2.\n\nThe exception creates only Application informed-decision (display Informed Decision, owner informed-decision, scopes [global], projections [application_runtime]) and binding to browser client informed-decision-approver/protected system informed-decision, empty namespaces and null event/deployment references. URL https://decisions.coulomb.social is context only: the DTO has no URL field. No users, memberships, entitlements, IAM grants, human identity, runtime image/config/token/namespace changes or service endpoint are created.\n\n## Exact source and current evidence\n\nExecutor commit c89614ec816886e9a773da3047e35cb099c6c9ca, executor SHA256 b0dbbb9786e927055030acf849a72e9a44e9d3d55c84efdf245e419d381684f3, transport SHA256 3e594e0e8561100ae1eeb34d7208cd5b5e387ae56c29689f155aed94219770f3; canonical codec-record SHA256 23577cc4f3ea6c0ca43eb21ca0e3280eb53fb64e29b030dcd31251593f0f3f2f. Exact refined nine-file manifest 0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7 is reviewed by dedicated User Engine and NetKingdom owner workers. Informed Decision independently acknowledges only its application facts. Their original signed-role prose is attached unchanged; this requesting packet writes no formal owner approval.\n\nFinal dedicated User Engine proof ran 21 actual isolated PostgreSQL checks with installed immutable f239 package/current executor. Six additional offline transport tests prove private-file/hash/UID/image/Ready/stdin guards without SSH or estate invocation. Retain original 16 tests and the earlier five constructor assertions as preparation history. Historical native metadata demonstrates an absent catalogue, actual Access readback registry/client and KeyCape wrong-redirect refusal; it is dated supporting evidence, not a new observation or human MFA proof. All fresh native preconditions remain mandatory.\n\n## Honest admission and one-use authority\n\nOrdinary registration calls the genuine provider and must receive an identified denial. Preserve its denial audit, then invoke unchanged register_application through a one-request, fixed-subject/app/tenant/action/correlation maintenance adapter. The maintenance actor is SERVICE, issuer urn:supervised-maintenance, separate explicit operator attribution and empty roles/assurance/audience. The exception has no PDP allow ID and does not satisfy normal admission. Unexpected ordinary ALLOW stops for the normal owner path; unavailable/transport/uncertain denial refuses.\n\nBefore any native dry-run the supervisor independently confirms actual founder disposition for memo infd-20261011-user-catalogue-bootstrap-r1@1 and this exact packet/executor AND transport. Only then create the mode0600 private closed grant with actual approval ID and native-receipt SHA; that native receipt carries the actual founder identity. Do not invent a founder grant field, human actor or authenticated JSON author. Pin canonical grant SHA and fresh Ready pod UID with immutable f239 image/package; preserve exact approval/target/source binding. No template fixture is a grant.\n\nSERIALIZABLE transaction, fixed application lock, native database clock checks and persistent consumed audit key enforce closed exact metadata admission/replay. Final clock check is before commit, not a measurement of commit completing before expiry. Exact preexisting match consumes with no creation/event/undo. Partial/conflicting state stops. Native dry-run rolls back all local records/audits/events/ledger but genuine provider telemetry may remain; it is not globally side-effect free.\n\n## Verification and recovery\n\nApply produces the two exact payloads plus genuine denial/registration/maintenance audits, attributable application.registered event and durable consumed ledger. Read back only fixed metadata/booleans/hashes inside the admitted workload; keep credentials internal and suppress raw errors. Verify Access registered system/issuer/client, independent KeyCape client/callback facts and actual User Engine binding/catalogue/account-facing projection. Recheck actual advisory provider allow/deny/expiry/unavailable/cache behavior using clearly labelled nonpersisted policy-test fixtures, not verified human claims or a manufactured IAM identity; ordinary enforcement stays separate. A native transport allow fixture is not a human login/MFA or entitlement proof. Do not mark USER26/28 done unless their actual native acceptance conditions are met.\n\nRecovery is authorized only before expiry using the original consumed grant hash, exact unchanged created rows, no later dependencies, preserved event IDs and delivery-worker lock. Claimed/delivered/missing events stop. Retain all audits/events; only an unsent unclaimed event becomes dead-lettered. This excludes automatic drain, not separately privileged targeted delivery/replay. This exception authorizes neither; later replay or consumer reconciliation is a separate owner decision. No downstream reversal or complete consumer inventory is claimed. If recovery fails or scope drifts, stop and record the unverified outcome; do not mint another grant/operator identity to defeat one-use closure.\n\n## Alternatives, costs and close-down\n\nPreferred durable alternative: implement/use a genuine authenticated owner management path with ordinary PDP admission before creating these facts; slower but requires no exception. Another choice is to decline/expire this R1 and leave catalogue acceptance open. The proposed build-mode alternative unblocks these exact facts sooner, with independently reviewed exception/audit/transaction boundaries. No permanent service bypass is installed.\n\nEstimated direct incremental cost EUR 0.10, supervisor time 5–15 minutes, no downtime expected. Proposed recovery risk allowance EUR 100 assumes no customer estate and one owner-hour of straightforward metadata repair at EUR 100/h. Unknown or uncontrolled downstream effects are not priced away: stop/new disposition if those assumptions fail. These are supervisor-reviewed estimates, not monetary enforcement or autopilot authority.\n\nOne conditional checklist entry records ordinary authenticated application.register admission as unmet and this exact exception only. Restoration owners User Engine/Access Engine must provide a supported authenticated management path with ordinary allow/deny/attribution before customer production, retire bootstrap use and retain/reconcile evidence. This approval expires for new execution and cleanup removes private local inputs; existing factual records do not silently expire. No active waiver, native grant, trial success or approval exists from this draft.\n"
    },
    {
      "item_id": "execution-and-verification-md",
      "media_type": "text/markdown",
      "content": "# Exact supervised sequence — prepared only\n\n1. Validate unchanged packet/executor/transport/records and current package source boundaries. Confirm native founder accept, exact memo/version/packet binding, stale=false, actual resolver identity and native approval receipt. Refusal, stale packet, expiry or missing provenance stops. Record exact original/approved revision under the same R1 trial; no autonomy promotion or inherited R2 authority.\n2. Refresh read-only target Ready pod UID/image f239 and installed owner package hashes, provider ownership/health and exact absent-or-matched catalogue preflight. Do not read Secret objects/values or export database/token configuration. Freeze current metadata and target refs. A changed package or binding requires review before mutation.\n3. Create a private mode0600 grant only after independent actual founder-receipt confirmation. Grant schema is attached and authenticates nothing. The independently verified receipt holds founder ID, approved memo/version/executor/transport/records/target/deadline/packet. Grant contains only the executor's closed fields; actual approval ID/receipt hash are unknown until that disposition. Pin canonical sorted compact JSON SHA256 independently; never reuse fixture values.\n4. Invoke the exact reviewed supervisor transport with mode dry-run, approved executor SHA, private grant SHA and freshly frozen expected pod UID. Source/grant travel on stdin; existing token and DB URL are read inside the workload with raw output suppressed. Stop on unavailable/uncertain deny, unexpected ordinary allow, transport failure, drift or changed source. Dry-run rolls back User Engine state but may leave genuine provider telemetry. Do not interpret exit2 as successful recovery or assert global absence of effects.\n5. Recheck frozen preconditions, then invoke the same exact grant/source/UID with mode apply. Require result created or exact no-change and record actual transaction/evidence; no second mutation if response is uncertain. Independently read consumed ledger, exact two rows, genuine denial/maintenance audits and original event status/attribution before deciding reconciliation. A transport failure after commit can be ambiguous; first inspect exact native ledger/rows rather than retry blindly.\n6. Verify actual three-way catalogue and account-facing native projection; labelled advisory policy-fixture allow/deny/TTL/expired/unavailable/cache checks use the existing admitted readback path only and persist no subjects/fixtures. Keep actual registered facts separate from fixture claims and real human browser/MFA acceptance. Verify unchanged ordinary enforcement deny/health. Do not target outbox delivery or replay under this grant; observe already-authorized ordinary delivery metadata/receipt if available and report gaps honestly.\n7. If independently proved recovery is needed, use only the same original grant mode rollback before expiry; exact rows, no dependencies and locked unclaimed/undelivered original events are mandatory. Stop on missing/claimed/delivered event, changed fact or expired authority. Record retained dead-letter event and audit history; subsequent targeted delivery/replay requires separate owner reconciliation. Recovery failure/unknown outcome does not score success.\n8. Remove private grant/local transient inputs after success, no-change, refusal or recovery; retain only hashes and actual native receipt/outcome refs. Preserve original failures and supplementary21/6 test proofs. Activate the conditional single-control checklist row only if exact founder accept/native exception occurred, and track restoration before customer production. This sequence itself executes nothing.\n\nPrepared command shape (values in angle brackets are unresolved evidence slots, never fake authority):\n\n`python3 tools/run_approved_catalogue_bootstrap.py --executor tools/catalogue_bootstrap.py --executor-sha256 b0dbbb9786e927055030acf849a72e9a44e9d3d55c84efdf245e419d381684f3 --grant-file <private-0600-file> --grant-sha256 <actual-canonical-grant-sha256> --expected-pod-uid <fresh-ready-f239-pod-uuid> --mode dry-run`\n\nAfter successful admitted dry-run/fresh checks use mode apply. Conditional recovery uses mode rollback with the unchanged original grant. Both source and transport SHA3e594e0e8561100ae1eeb34d7208cd5b5e387ae56c29689f155aed94219770f3 must independently match the approved packet before running this command. No native command is run by packet preparation.\n"
    },
    {
      "item_id": "proposal-json",
      "media_type": "application/json",
      "content": "{\n  \"proposal_id\": \"USER-CATALOGUE-INFDEC-20261011-R1\",\n  \"memo_id\": \"infd-20261011-user-catalogue-bootstrap-r1\",\n  \"memo_version\": 1,\n  \"revision\": \"human-packet-1-after-independent-owner-reviews\",\n  \"status\": \"draft-no-native-execution\",\n  \"executor_source_commit\": \"c89614ec816886e9a773da3047e35cb099c6c9ca\",\n  \"reviewed_executor_manifest_sha256\": \"0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7\",\n  \"executor_sha256\": \"b0dbbb9786e927055030acf849a72e9a44e9d3d55c84efdf245e419d381684f3\",\n  \"transport_sha256\": \"3e594e0e8561100ae1eeb34d7208cd5b5e387ae56c29689f155aed94219770f3\",\n  \"records_sha256\": \"23577cc4f3ea6c0ca43eb21ca0e3280eb53fb64e29b030dcd31251593f0f3f2f\",\n  \"runtime_image\": \"forgejo.coulomb.social/coulomb/user-engine@sha256:f239bbf332b8eb87320c86390fddca1dcb4f7c628a7af75e79dee8058d446a7b\",\n  \"target\": \"railiance01 user-engine catalogue database through the frozen Ready portal workload\",\n  \"deadline\": \"2026-10-12T23:59:59Z\",\n  \"scope\": [\n    \"fresh read-only exact pod/image/package/provider/absence-conflict checks\",\n    \"approved native PostgreSQL dry-run with genuine external PDP telemetry retained\",\n    \"one atomic apply or exact-match no-change consumption of fixed two metadata DTOs\",\n    \"truthful ordinary denial and SERVICE maintenance registration audit, attributed registered event and native consumed-grant ledger\",\n    \"read-only native exact payload/ledger/audit/event/three-way catalogue/readback verification\",\n    \"conditional created-only recovery under unchanged original grant before expiry\",\n    \"private local grant/input cleanup and retained outcome evidence\"\n  ],\n  \"ordinary_application_register_exception\": true,\n  \"changes_runtime_configuration_or_image\": false,\n  \"grants_iam_or_human_claims\": false,\n  \"authorizes_targeted_delivery_or_replay\": false,\n  \"global_dry_run_side_effect_free\": false,\n  \"actual_approval_id\": null,\n  \"actual_founder_id\": null,\n  \"grant_created\": false,\n  \"approval_authenticity\": \"Supervisor independently verifies native founder disposition and exact packet; privateJSON/hash does not authenticate its author. Founder ID remains only in independently verified native receipt, not an invented extra grant field.\",\n  \"cost_estimate_eur\": 0.1,\n  \"risk_estimate_eur\": 100,\n  \"risk_estimate_assumptions\": [\n    \"build mode without customers\",\n    \"exactly two catalogue facts, no permissions or identity memberships\",\n    \"one hour owner recovery atEUR100/h bounds straightforward local metadata repair; uncontrolled consumer effects are not included and require stop/new disposition\",\n    \"no downtime expected and no runtime resource change\"\n  ],\n  \"risk_estimate_is_authority\": false,\n  \"owner_reviews\": [\n    {\n      \"repo\": \"user-engine\",\n      \"path\": \"/home/worsch/user-engine/docs/reviews/2026-10-11-catalogue-maintenance-owner-agreement.md\",\n      \"sha256\": \"cb9fdadb3a8f432f100e9340e5b94af932c4d11a5705af6a80d336a5026d867b\"\n    },\n    {\n      \"repo\": \"net-kingdom\",\n      \"path\": \"/home/worsch/net-kingdom/docs/reviews/2026-10-11-catalogue-maintenance-security-owner-review.md\",\n      \"sha256\": \"12d11938eeed8864c5fcec1638b9045d1c96eafbaa7c02a62d17ba599666bd07\"\n    },\n    {\n      \"repo\": \"informed-decision\",\n      \"path\": \"/home/worsch/informed-decision/docs/reviews/2026-10-11-one-app-catalogue-facts-review.md\",\n      \"sha256\": \"b2da26b74cb2bb74d26312941673e95f1653f6154a7ef90155562e316f5837c7\"\n    }\n  ],\n  \"test_evidence\": {\n    \"current_owner_isolated_postgres\": 21,\n    \"offline_transport_guards\": 6,\n    \"original_failed_preparation_preserved\": true\n  },\n  \"restoration_owner\": [\n    \"user-engine\",\n    \"access-engine\"\n  ],\n  \"restoration_criterion\": \"Before customer production, provide a supported authenticated operator management path using genuine actor authentication and ordinary access-engine PDP admission; verify allow/deny/attribution, then retire this bootstrap exception while preserving its history.\",\n  \"normal_management_admission_satisfied\": false,\n  \"conditional_checklist_entry_active\": false,\n  \"native_catalogue_complete\": false\n}\n"
    },
    {
      "item_id": "private-grant-schema-json",
      "media_type": "application/json",
      "content": "{\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\n  \"title\": \"Closed post-disposition supervisor catalogue grant; this schema authenticates nothing\",\n  \"type\": \"object\",\n  \"additionalProperties\": false,\n  \"required\": [\n    \"schema\",\n    \"proposal_id\",\n    \"approval_id\",\n    \"memo_id\",\n    \"memo_version\",\n    \"approval_receipt_sha256\",\n    \"executor_sha256\",\n    \"records_sha256\",\n    \"expires_at\",\n    \"operator_id\",\n    \"authority\"\n  ],\n  \"properties\": {\n    \"schema\": {\n      \"const\": \"user-engine.supervised-catalogue-maintenance.v1\"\n    },\n    \"proposal_id\": {\n      \"const\": \"USER-CATALOGUE-INFDEC-20261011-R1\"\n    },\n    \"approval_id\": {\n      \"type\": \"string\",\n      \"pattern\": \"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\"\n    },\n    \"memo_id\": {\n      \"const\": \"infd-20261011-user-catalogue-bootstrap-r1\"\n    },\n    \"memo_version\": {\n      \"type\": \"integer\",\n      \"const\": 1\n    },\n    \"approval_receipt_sha256\": {\n      \"type\": \"string\",\n      \"pattern\": \"^[0-9a-f]{64}$\"\n    },\n    \"executor_sha256\": {\n      \"const\": \"b0dbbb9786e927055030acf849a72e9a44e9d3d55c84efdf245e419d381684f3\"\n    },\n    \"records_sha256\": {\n      \"const\": \"23577cc4f3ea6c0ca43eb21ca0e3280eb53fb64e29b030dcd31251593f0f3f2f\"\n    },\n    \"expires_at\": {\n      \"type\": \"string\",\n      \"format\": \"date-time\",\n      \"description\": \"Future, timezone-aware, no later than2026-10-12T23:59:59Z; executor checks local and native DB clocks\"\n    },\n    \"operator_id\": {\n      \"type\": \"string\",\n      \"pattern\": \"^[a-zA-Z0-9:._-]{3,80}$\",\n      \"description\": \"Truthful separate SERVICE maintenance attribution, not native founder identity\"\n    },\n    \"authority\": {\n      \"const\": \"founder-approved-one-time-administrative-exception\"\n    }\n  }\n}\n"
    },
    {
      "item_id": "conditional-close-down-entry-md",
      "media_type": "text/markdown",
      "content": "# Conditional single-control close-down entry — not active\n\nStable reference USER-CATALOGUE-INFDEC-20261011-R1; proposed only. If the founder accepts this exact memo, append one entry to Custodian's existing security-close-down checklist without removing or relabelling prior controls. Record the actual founder disposition, packet/executor/transport/grant hashes and native outcome before marking an executed relaxation.\n\nControl: ordinary authenticated operator/PDP admission for User Engine application.register. Conditional exception: exactly one supervised registration of informed-decision Application and its exact browser-client/protected-system binding; genuine denial remains unmet and audited, followed by explicit maintenance attribution. No human/JWT roles, IAM grant, runtime endpoint, token/config change, future registrations or targeted event replay are authorized.\n\nAuthority deadline: 2026-10-12T23:59:59Z, with native precommit clock checks and durable consumed-grant closure. Existing catalogue facts are not automatically erased at expiry. Recovery may be blocked by expiry, changed rows/dependencies or claimed/delivered/missing events; owner reconciliation then needs separate disposition. Removing the private artifact is cleanup, not authentication/revocation proof.\n\nRestoration owners: User Engine for the authenticated management surface/lifecycle, Access Engine for ordinary PDP admission; Custodian tracks the checklist and founder closes it. Criterion: before customer production, a supported management path authenticates genuine operators and performs ordinary authorization, demonstrated allow/deny/attribution and fail-closed unavailable behavior; retire the one-time tool from operational use, retain consumed ledger/audits/events and reconcile any retained registration/rollback event. This draft does not claim that restoration already exists, create another workplan, or promote agent autonomy.\n"
    },
    {
      "item_id": "executor-py",
      "media_type": "text/plain",
      "content": "\"\"\"One-time supervised catalogue maintenance; no installed runtime endpoint.\n\nA private, exact-hash supervisor artifact is an out-of-band maintenance grant,\nnot authentication of its JSON author. The operator must independently confirm\nthe founder's native disposition before supplying it. No JWT role is invented.\n\"\"\"\nfrom __future__ import annotations\nimport argparse\nfrom dataclasses import replace\nfrom datetime import datetime, timedelta, timezone\nimport hashlib\nimport json\nimport os\nfrom pathlib import Path\nimport re\nimport stat\n\nfrom user_engine.adapters.postgres import PostgresUserEngineStore\nfrom user_engine.domain import (Actor, Application, ApplicationBinding, AuditRecord,\n    AuthorizationDecision, AuthorizationEffect, PrincipalType)\nfrom user_engine.service import UserEngineService, AuthorizationDenied\nfrom user_engine.store_records import store_record_for\n\nAPP = Application('informed-decision', 'Informed Decision', 'informed-decision')\nBINDING = ApplicationBinding('informed-decision', oidc_client_id='informed-decision-approver', protected_system_id='informed-decision')\nPROPOSAL = 'USER-CATALOGUE-INFDEC-20261011-R1'\nSCHEMA = 'user-engine.supervised-catalogue-maintenance.v1'\nKEYS = {'schema','proposal_id','approval_id','memo_id','memo_version','approval_receipt_sha256','executor_sha256','records_sha256','expires_at','operator_id','authority'}\n\ndef digest(value):\n    return hashlib.sha256(json.dumps(value, sort_keys=True, separators=(',', ':')).encode()).hexdigest()\n\ndef records():\n    return [store_record_for(x).__dict__ for x in (APP, BINDING)]\n\nclass Refused(ValueError):\n    pass\n\ndef validate_grant(grant, *, expected_grant_sha256, actual_executor_sha256, now):\n    if (type(grant) is not dict or set(grant) != KEYS\n            or grant['schema'] != SCHEMA or grant['proposal_id'] != PROPOSAL\n            or grant['authority'] != 'founder-approved-one-time-administrative-exception'\n            or grant['memo_id'] != 'infd-20261011-user-catalogue-bootstrap-r1'\n            or type(grant['memo_version']) is not int or grant['memo_version'] != 1\n            or not re.fullmatch(r'[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}', grant['approval_id'])\n            or not re.fullmatch(r'[a-zA-Z0-9:._-]{3,80}', grant['operator_id'])):\n        raise Refused('closed grant required')\n    for key in ('approval_receipt_sha256', 'executor_sha256', 'records_sha256'):\n        if not re.fullmatch(r'[0-9a-f]{64}', grant[key]):\n            raise Refused('exact evidence digests required')\n    expires = datetime.fromisoformat(grant['expires_at'].replace('Z', '+00:00'))\n    if (expires.tzinfo is None or now.tzinfo is None or now >= expires\n            or expires > datetime(2026, 10, 12, 23, 59, 59, tzinfo=timezone.utc)):\n        raise Refused('expired grant')\n    if (digest(grant) != expected_grant_sha256 or grant['executor_sha256'] != actual_executor_sha256\n            or grant['records_sha256'] != digest(records())):\n        raise Refused('approved source differs')\n    return expires\n\ndef _summary(cursor, audit_id):\n    cursor.execute('SELECT summary FROM user_engine_audit_records WHERE audit_id = %s', (audit_id,))\n    row = cursor.fetchone()\n    return None if row is None else json.loads(row[0])\n\ndef _event_ids(cursor, correlation):\n    cursor.execute('SELECT event_id FROM user_engine_outbox_events WHERE correlation_id = %s ORDER BY event_id', (correlation,))\n    return [r[0] for r in cursor.fetchall()]\n\ndef _actor(grant):\n    return Actor(issuer='urn:supervised-maintenance', subject=grant['operator_id'], tenant='tenant:platform',\n                 principal_type=PrincipalType.SERVICE, audience=(), claims={'maintenance_proposal': PROPOSAL})\n\nclass _Capture:\n    def __init__(self, ordinary):\n        self.ordinary = ordinary\n        self.result = None\n    def check(self, request):\n        self.result = self.ordinary.check(request)\n        return self.result\n\nclass _ExceptionAuthorization:\n    def __init__(self, actor, correlation, expires):\n        self.actor, self.correlation, self.expires = actor, correlation, expires\n        self.used = False\n    def check(self, request):\n        now = datetime.now(timezone.utc)\n        if (self.used or now >= self.expires or request.actor != self.actor\n                or request.action != 'application.register' or request.tenant != 'tenant:platform'\n                or request.resource_type != 'user-engine:application'\n                or request.resource_id != APP.application_id or request.application_id != APP.application_id\n                or request.correlation_id != self.correlation):\n            raise Refused('exception outside fixed registration')\n        self.used = True\n        return AuthorizationDecision(effect=AuthorizationEffect.ALLOW, reason='explicit supervised maintenance exception; not a PDP allow',\n            decision_id=None, binding='supervised-maintenance', issued_at=now,\n            lifetime=min(timedelta(seconds=30), self.expires-now))\n\ndef execute(connection, ordinary_authorization, grant, *, expected_grant_sha256,\n            actual_executor_sha256, mode='dry-run', now=None):\n    now = now or datetime.now(timezone.utc)\n    expires = validate_grant(grant, expected_grant_sha256=expected_grant_sha256,\n                            actual_executor_sha256=actual_executor_sha256, now=now)\n    if mode not in ('dry-run', 'apply', 'rollback'):\n        raise Refused('unknown operation')\n    store = PostgresUserEngineStore(connection)\n    if not store.ready:\n        raise Refused('existing schema required; no migration')\n    capture = _Capture(ordinary_authorization)\n    service = UserEngineService(store=store, identity_adapter=object(), authorization=capture)\n    actor = _actor(grant)\n    ledger = 'aud_catalogue_bootstrap_' + grant['approval_id']\n    correlation = 'maintenance:' + grant['approval_id']\n    # Construct both services before BEGIN: the owner readiness probe rolls back\n    # its connection. Constructing a service in the transaction would discard\n    # the genuine denial audit and release the native serialization lock.\n    exception_service = UserEngineService(store=store, identity_adapter=object(),\n        authorization=_ExceptionAuthorization(actor, correlation, expires))\n    outcome = None\n    try:\n        with store.transaction():\n            with connection.cursor() as cursor:\n                cursor.execute('SET TRANSACTION ISOLATION LEVEL SERIALIZABLE')\n                cursor.execute('SELECT pg_advisory_xact_lock(hashtextextended(%s, 0))', ('user-engine:one-app-catalogue:informed-decision',))\n                cursor.execute('SELECT clock_timestamp()')\n                if cursor.fetchone()[0] >= expires:\n                    raise Refused('native transaction grant expired')\n                previous = _summary(cursor, ledger)\n                rollback_done = _summary(cursor, ledger + '_rollback')\n                if mode == 'rollback':\n                    if previous is None or rollback_done is not None or not previous['created']:\n                        raise Refused('no unused created-only recovery authority')\n                    if previous['grant_sha256'] != expected_grant_sha256:\n                        raise Refused('recovery grant differs from consumed authority')\n                    if store.application(APP.application_id) != APP or store.binding(APP.application_id) != BINDING:\n                        raise Refused('created metadata changed')\n                    cursor.execute(\"SELECT COUNT(*) FROM user_engine_records WHERE application_id = %s AND record_type NOT IN ('applications', 'application_bindings')\", (APP.application_id,))\n                    if cursor.fetchone()[0]:\n                        raise Refused('later dependent records exist')\n                    # Match the existing delivery worker's session advisory lock namespace.\n                    for event_id in previous['event_ids']:\n                        cursor.execute('SELECT pg_advisory_xact_lock(hashtextextended(%s, 0))', ('user-engine:tenant-lifecycle:outbox-event:' + event_id,))\n                    for event_id in previous['event_ids']:\n                        cursor.execute('SELECT event_id FROM user_engine_outbox_events WHERE event_id = %s FOR UPDATE', (event_id,))\n                        if cursor.fetchone() is None:\n                            raise Refused('created event missing')\n                        event = store.outbox_event(event_id)\n                        if (event is None or event.correlation_id != correlation or event.claimed_by is not None\n                                or event.claimed_at is not None or event.delivered_at is not None):\n                            raise Refused('claimed/delivered event needs owner reconciliation')\n                        store.save_outbox(replace(event, dead_lettered_at=now,\n                            failure_reason='supervised bootstrap rolled back before delivery'))\n                    for row in records():\n                        cursor.execute('DELETE FROM user_engine_records WHERE record_type = %s AND record_key = %s AND payload = %s::jsonb',\n                                       (row['record_type'], row['record_key'], json.dumps(row['payload'])))\n                        if cursor.rowcount != 1:\n                            raise Refused('created-only compare-and-delete failed')\n                    store.append_audit(AuditRecord(ledger + '_rollback', actor, 'application.metadata.bootstrap.rollback', APP.application_id,\n                        actor.tenant, correlation, summary=json.dumps({'maintenance_authority': grant['approval_id'], 'grant_sha256': expected_grant_sha256,\n                        'removed': ['applications', 'application_bindings'], 'events_retained_dead_lettered': previous['event_ids']})))\n                    outcome = {'result': 'rolled-back', 'ordinary_pdp_allow_claimed': False, 'created_entities_removed': 2, 'audit_and_event_history_retained': True}\n                else:\n                    if previous is not None:\n                        raise Refused('native single-use grant already consumed')\n                    a, b = store.application(APP.application_id), store.binding(APP.application_id)\n                    if (a is None) != (b is None) or (a is not None and (a != APP or b != BINDING)):\n                        raise Refused('partial or conflicting metadata')\n                    created = a is None\n                    if created:\n                        try:\n                            service.register_application(actor, APP, binding=BINDING, correlation_id=correlation)\n                        except AuthorizationDenied:\n                            refusal = capture.result\n                            if (refusal is None or refusal.allowed or refusal.decision_id is None\n                                    or refusal.reason == 'authorization service unavailable'):\n                                raise Refused('real ordinary PDP refusal required')\n                        else:\n                            raise Refused('ordinary authorization unexpectedly allowed; use normal owner path')\n                        exception_service.register_application(actor, APP, binding=BINDING, correlation_id=correlation)\n                    if store.application(APP.application_id) != APP or store.binding(APP.application_id) != BINDING:\n                        raise Refused('post-write readback differs')\n                    event_ids = _event_ids(cursor, correlation)\n                    for event_id in event_ids:\n                        event = store.outbox_event(event_id)\n                        store.save_outbox(replace(event, payload={**event.payload, 'maintenance_exception': True,\n                            'proposal_id': PROPOSAL, 'approval_id': grant['approval_id'], 'operator_id': actor.subject}))\n                    summary = {'created': created, 'grant_sha256': expected_grant_sha256, 'records_sha256': grant['records_sha256'],\n                        'executor_sha256': actual_executor_sha256, 'approval_receipt_sha256': grant['approval_receipt_sha256'],\n                        'ordinary_pdp_denial_id': capture.result.decision_id if created else None, 'event_ids': event_ids,\n                        'authority': grant['authority'], 'not_human_authentication': True}\n                    store.append_audit(AuditRecord(ledger, actor, 'application.metadata.bootstrap', APP.application_id,\n                        actor.tenant, correlation, summary=json.dumps(summary)))\n                    outcome = {'result': 'created' if created else 'no-change', 'ordinary_pdp_refusal_retained': created,\n                        'ordinary_pdp_allow_claimed': False, 'created_entities': 2 if created else 0,\n                        'created_event_ids': event_ids, 'grant_native_single_use': True}\n                cursor.execute('SELECT clock_timestamp()')\n                if cursor.fetchone()[0] >= expires:\n                    raise Refused('grant expired before transaction commit')\n                if mode == 'dry-run':\n                    raise _DryRun(outcome)\n    except _DryRun as dry:\n        return {**dry.outcome, 'transaction_committed': False, 'dry_run_rolled_back': True}\n    return {**outcome, 'transaction_committed': True}\n\nclass _DryRun(Exception):\n    def __init__(self, outcome):\n        self.outcome = outcome\n\n\ndef main():\n    parser = argparse.ArgumentParser(description=__doc__)\n    parser.add_argument('--grant-file', required=True, type=Path)\n    parser.add_argument('--expected-grant-sha256', required=True)\n    parser.add_argument('--mode', choices=['dry-run','apply','rollback'], default='dry-run')\n    args = parser.parse_args()\n    # Whole stdout/stderr, including dependency/driver errors, stays contained.\n    saved = os.dup(1)\n    null = os.open(os.devnull, os.O_WRONLY)\n    os.dup2(null, 1); os.dup2(null, 2)\n    try:\n        info = args.grant_file.lstat()\n        if (not stat.S_ISREG(info.st_mode) or info.st_uid != os.getuid()\n                or stat.S_IMODE(info.st_mode) != 0o600 or info.st_size > 8192):\n            raise Refused('private reviewed grant artifact required')\n        grant = json.loads(args.grant_file.read_text())\n        source_hash = hashlib.sha256(Path(__file__).read_bytes()).hexdigest()\n        import psycopg\n        from user_engine.adapters.flex_auth import FlexAuthHTTPAdapter\n        ordinary = FlexAuthHTTPAdapter(base_url=os.environ['USER_ENGINE_FLEX_AUTH_URL'],\n            bearer_token_file=os.environ['USER_ENGINE_FLEX_AUTH_TOKEN_FILE'], timeout_seconds=3)\n        with psycopg.connect(os.environ['USER_ENGINE_DATABASE_URL']) as connection:\n            result = execute(connection, ordinary, grant, expected_grant_sha256=args.expected_grant_sha256,\n                             actual_executor_sha256=source_hash, mode=args.mode)\n        status = 0\n    except Exception:\n        result, status = {'result': 'refused-or-rolled-back', 'raw_output_suppressed': True}, 2\n    os.dup2(saved, 1); os.close(saved); os.close(null)\n    print(json.dumps(result, sort_keys=True))\n    return status\n\nif __name__ == '__main__':\n    raise SystemExit(main())\n"
    },
    {
      "item_id": "supervisor-transport-py",
      "media_type": "text/plain",
      "content": "\"\"\"Prepared supervisor-only transport. NEVER run before founder exception approval.\nNo credentials leave the workload. Source/grant are delivered only on stdin.\n\"\"\"\nimport argparse,base64,hashlib,json,os,stat,subprocess,sys\nfrom pathlib import Path\n\ndef main():\n p=argparse.ArgumentParser(description=__doc__)\n p.add_argument('--executor',type=Path,required=True)\n p.add_argument('--executor-sha256',required=True)\n p.add_argument('--grant-file',type=Path,required=True)\n p.add_argument('--grant-sha256',required=True)\n p.add_argument('--expected-pod-uid',required=True)\n p.add_argument('--mode',choices=['dry-run','apply','rollback'],default='dry-run')\n a=p.parse_args()\n try:\n  st=a.grant_file.lstat()\n  if not stat.S_ISREG(st.st_mode) or st.st_uid!=os.getuid() or stat.S_IMODE(st.st_mode)!=0o600 or st.st_size>8192:raise ValueError('private grant required')\n  source=a.executor.read_bytes();grant=json.loads(a.grant_file.read_text())\n  sha=lambda b:hashlib.sha256(b).hexdigest()\n  canonical=lambda x:json.dumps(x,sort_keys=True,separators=(',',':')).encode()\n  if sha(source)!=a.executor_sha256 or sha(canonical(grant))!=a.grant_sha256:raise ValueError('source/grant mismatch')\n  packet={'source':base64.b64encode(source).decode(),'executor_sha256':a.executor_sha256,'grant':grant,'grant_sha256':a.grant_sha256,'mode':a.mode}\n  native=\"\"\"\nimport base64,hashlib,json,os,sys\npayload=json.loads(base64.b64decode('__PACKET__'))\nsaved=os.dup(1);null=os.open(os.devnull,os.O_WRONLY);os.dup2(null,1);os.dup2(null,2)\ntry:\n source=base64.b64decode(payload['source'])\n if hashlib.sha256(source).hexdigest()!=payload['executor_sha256']:raise ValueError('source differs')\n ns={'__name__':'supervised_catalogue_maintenance'};exec(compile(source,'<reviewed-maintenance-executor>','exec'),ns)\n import psycopg\n from user_engine.adapters.flex_auth import FlexAuthHTTPAdapter\n ordinary=FlexAuthHTTPAdapter(base_url=os.environ['USER_ENGINE_FLEX_AUTH_URL'],bearer_token_file=os.environ['USER_ENGINE_FLEX_AUTH_TOKEN_FILE'],timeout_seconds=3)\n with psycopg.connect(os.environ['USER_ENGINE_DATABASE_URL']) as conn:\n  result=ns['execute'](conn,ordinary,payload['grant'],expected_grant_sha256=payload['grant_sha256'],actual_executor_sha256=payload['executor_sha256'],mode=payload['mode'])\nexcept Exception:result={'result':'refused-or-rolled-back','raw_output_suppressed':True}\nos.dup2(saved,1);os.close(saved);os.close(null);print(json.dumps(result,sort_keys=True))\n\"\"\".replace('__PACKET__',base64.b64encode(canonical(packet)).decode())\n  remote=\"\"\"\nimport base64,json,subprocess,sys\nr=subprocess.run(['kubectl','get','pods','-n','user-engine','-l','app.kubernetes.io/name=user-engine','-o','json'],capture_output=True,text=True)\ntry:\n pods=[p for p in json.loads(r.stdout)['items'] if p['metadata']['uid']=='__UID__' and p.get('status',{}).get('phase')=='Running' and any(c['type']=='Ready' and c['status']=='True' for c in p.get('status',{}).get('conditions',[]))]\n if r.returncode or len(pods)!=1:raise ValueError('fixed pod not ready')\n pod=pods[0];portal=[c for c in pod['spec']['containers'] if c['name']=='portal']\n if len(portal)!=1 or portal[0]['image']!='forgejo.coulomb.social/coulomb/user-engine@sha256:f239bbf332b8eb87320c86390fddca1dcb4f7c628a7af75e79dee8058d446a7b':raise ValueError('source runtime differs')\n r=subprocess.run(['kubectl','exec','-i','-n','user-engine',pod['metadata']['name'],'-c','portal','--','python3','-'],input=base64.b64decode('__NATIVE__'),capture_output=True)\n out=json.loads(r.stdout)\n if r.returncode:raise ValueError('exec failure')\nexcept Exception:out={'result':'refused-or-rolled-back','raw_output_suppressed':True}\nprint(json.dumps(out,sort_keys=True))\n\"\"\".replace('__UID__',a.expected_pod_uid).replace('__NATIVE__',base64.b64encode(native.encode()).decode())\n  import uuid\n  uuid.UUID(a.expected_pod_uid) # only UUID reaches the fixed remote literal\n  r=subprocess.run(['ssh','railiance01','python3 -'],input=remote,text=True,capture_output=True)\n  out=json.loads(r.stdout)\n  if r.returncode:raise ValueError('transport failure')\n except Exception:out={'result':'refused-or-rolled-back','raw_output_suppressed':True}\n print(json.dumps(out,sort_keys=True))\n return 0 if out.get('result') in ('created','no-change','rolled-back') else 2\nif __name__=='__main__':raise SystemExit(main())\n"
    },
    {
      "item_id": "canonical-records-json",
      "media_type": "application/json",
      "content": "{\n  \"application\": {\n    \"application_id\": \"informed-decision\",\n    \"display_name\": \"Informed Decision\",\n    \"owner\": \"informed-decision\",\n    \"allowed_profile_scopes\": [\n      \"global\"\n    ],\n    \"allowed_projection_types\": [\n      \"application_runtime\"\n    ]\n  },\n  \"binding\": {\n    \"application_id\": \"informed-decision\",\n    \"oidc_client_id\": \"informed-decision-approver\",\n    \"protected_system_id\": \"informed-decision\",\n    \"catalog_namespaces\": [],\n    \"event_source\": null,\n    \"deployment_ref\": null\n  },\n  \"canonical_store_rows\": [\n    {\n      \"record_type\": \"applications\",\n      \"record_key\": \"informed-decision\",\n      \"payload\": {\n        \"application_id\": \"informed-decision\",\n        \"display_name\": \"Informed Decision\",\n        \"owner\": \"informed-decision\",\n        \"allowed_profile_scopes\": [\n          \"global\"\n        ],\n        \"allowed_projection_types\": [\n          \"application_runtime\"\n        ]\n      },\n      \"tenant\": null,\n      \"user_id\": null,\n      \"application_id\": \"informed-decision\",\n      \"scope_type\": null,\n      \"scope_id\": null\n    },\n    {\n      \"record_type\": \"application_bindings\",\n      \"record_key\": \"informed-decision\",\n      \"payload\": {\n        \"application_id\": \"informed-decision\",\n        \"oidc_client_id\": \"informed-decision-approver\",\n        \"protected_system_id\": \"informed-decision\",\n        \"catalog_namespaces\": [],\n        \"event_source\": null,\n        \"deployment_ref\": null\n      },\n      \"tenant\": null,\n      \"user_id\": null,\n      \"application_id\": \"informed-decision\",\n      \"scope_type\": null,\n      \"scope_id\": null\n    }\n  ],\n  \"application_owner\": \"informed-decision\",\n  \"local_registry_owner\": \"user-engine\",\n  \"protected_system_owner\": \"access-engine\",\n  \"oidc_client_owner\": \"key-cape\",\n  \"entry_url_evidence\": \"https://decisions.coulomb.social/\",\n  \"entry_url_persisted\": false,\n  \"entry_url_reason\": \"Canonical Application/ApplicationBinding model has no entry URL field. URL is separate verified Ingress context, never an invented persisted field.\",\n  \"creates_user_permissions\": false,\n  \"scope\": \"One application record and one exact binding; no memberships, roles, grants or user creation.\"\n}\n"
    },
    {
      "item_id": "executor-proposal-json",
      "media_type": "application/json",
      "content": "{\n  \"proposal_id\": \"USER-CATALOGUE-INFDEC-20261011-R1\",\n  \"revision\": \"executor-preparation-2-owner-findings\",\n  \"status\": \"prepared-not-approved-not-executed\",\n  \"historical_proposal_manifest_sha256\": \"60b185aabbf6a8448c0c3aef57279b6741db1cd1361b8dab48be29df9f14f78e\",\n  \"executor_sha256\": \"b0dbbb9786e927055030acf849a72e9a44e9d3d55c84efdf245e419d381684f3\",\n  \"supervisor_transport_sha256\": \"3e594e0e8561100ae1eeb34d7208cd5b5e387ae56c29689f155aed94219770f3\",\n  \"records_sha256\": \"23577cc4f3ea6c0ca43eb21ca0e3280eb53fb64e29b030dcd31251593f0f3f2f\",\n  \"expected_runtime_image\": \"forgejo.coulomb.social/coulomb/user-engine@sha256:f239bbf332b8eb87320c86390fddca1dcb4f7c628a7af75e79dee8058d446a7b\",\n  \"fresh_pod_uid_required\": true,\n  \"deadline\": \"2026-10-12T23:59:59Z\",\n  \"authority\": \"separate founder-approved supervised administrative exception; out-of-band supervisor validates native receipt\",\n  \"existing_r2_does_not_approve_catalogue_mutation\": true,\n  \"normal_pdp_refusal_required\": true,\n  \"catalogue_entities\": [\n    \"applications/informed-decision\",\n    \"application_bindings/informed-decision\"\n  ],\n  \"target_tenant\": \"tenant:platform\",\n  \"retained_events\": [\n    \"application.registered\"\n  ],\n  \"new_endpoint\": false,\n  \"runtime_image_change\": false,\n  \"iam_grants\": false,\n  \"credentials_exported\": false,\n  \"budget_estimate\": {\n    \"cost_eur_upper_bound\": 0.1,\n    \"supervised_seconds_estimate\": 300,\n    \"application_downtime_expected_seconds\": 0\n  },\n  \"risk\": \"Exactly one administrative catalogue mutation bypasses ordinary application.register PDP admission under an explicit maintenance exception, retaining genuine denial and truthful service attribution. Public browser login/MFA remains unverified; downstream events may prevent automatic rollback.\",\n  \"rollback\": \"Only exact originally created rows; original consumed grant digest; before expiry; no dependencies; delivery lock; refuse any claimed/delivered/missing event; retain audits and dead-letter unsent registered event. No full downstream reversal claim. Dead-lettering stops automatic drain only; existing privileged targeted delivery/replay can revive the retained event. This maintenance grant authorizes neither; any later replay requires separate owner reconciliation/disposition.\",\n  \"owner_review_required\": [\n    \"User Engine audit/service attribution and transaction semantics\",\n    \"NetKingdom exception scope, catalogue facts, event consumers/dead-letter semantics\",\n    \"Custodian precise founder disposition and conditional close-down obligation\"\n  ]\n}\n"
    },
    {
      "item_id": "executor-source-boundary-json",
      "media_type": "application/json",
      "content": "{\n  \"reviewed_current_owner_inputs\": [\n    {\n      \"path\": \"src/user_engine/service.py\",\n      \"sha256\": \"1c60b69e08c36eb3f678893a4a945eeeb9c73d5246c6566857cd8c134f75446d\"\n    },\n    {\n      \"path\": \"src/user_engine/adapters/postgres.py\",\n      \"sha256\": \"528d75431d1f3a7e55423ffa55d34722ac343582e513985db74ba3add36e6da6\"\n    },\n    {\n      \"path\": \"src/user_engine/adapters/flex_auth.py\",\n      \"sha256\": \"73d645b7b37904ebfe0df6f7ed397b74b4c47f505cd64a30c39e60717ce71455\"\n    },\n    {\n      \"path\": \"src/user_engine/domain/models.py\",\n      \"sha256\": \"8c9cb8051a930fa05a1657c8b539510588f1788812d68510df55712d2f4df050\"\n    },\n    {\n      \"path\": \"src/user_engine/store_records.py\",\n      \"sha256\": \"3cec4575434e82e29932a3e9cc7659f3dd8fa7e5be81d5690487033796bbfc16\"\n    }\n  ],\n  \"runtime_sources_modified\": false,\n  \"transport_native_execution_tested\": false,\n  \"note\": \"Executor tested with actual published runtime dependencies and current owner source mounted read-only; not a native service execution approval.\"\n}\n"
    },
    {
      "item_id": "original-postgres-receipt-json",
      "media_type": "application/json",
      "content": "{\n  \"recorded_at\": \"2026-10-11T01:18:48.808601+00:00\",\n  \"scope\": \"isolated disposable PostgreSQL only; no native DB/credentials\",\n  \"postgres_image\": \"postgres@sha256:b0f9560a2de083e2cc7382e75f808c7381a32852a7ec49117deedb300e552b24\",\n  \"python_dependency_image\": \"forgejo.coulomb.social/coulomb/user-engine@sha256:f239bbf332b8eb87320c86390fddca1dcb4f7c628a7af75e79dee8058d446a7b\",\n  \"resources\": {\n    \"postgres_memory_bytes\": 536870912,\n    \"postgres_cpu_limit\": 1,\n    \"test_worker_memory_bytes\": 536870912,\n    \"test_worker_cpu_limit\": 1,\n    \"postgres_network\": \"none\",\n    \"worker_network\": \"isolated PostgreSQL container namespace only\",\n    \"read_only_source_mounts\": true\n  },\n  \"final_test_count\": 16,\n  \"final_test_exit_code\": 0,\n  \"final_test_seconds\": 1.73,\n  \"final_test_output\": \"Ran 16 tests in 1.730s; OK\",\n  \"test_opt_in\": \"USER_ENGINE_ISOLATED_CATALOGUE_PG_TEST=network-none-fixture\",\n  \"preparation_history\": [\n    {\n      \"tests\": 11,\n      \"failed_assertions\": 5,\n      \"cause\": \"Second service constructor ran readiness rollback inside transaction, discarded ordinary-denial audit and serialization lock.\",\n      \"corrected\": true\n    },\n    {\n      \"tests\": 11,\n      \"passed\": 11\n    },\n    {\n      \"tests\": 15,\n      \"passed\": 15\n    },\n    {\n      \"tests\": 16,\n      \"passed\": 16\n    },\n    {\n      \"tests\": 16,\n      \"passed\": 16,\n      \"note\": \"Final portable test path and explicit isolated-fixture opt-in verified.\"\n    }\n  ],\n  \"meaningful_gates\": [\n    \"genuine denial and explicit maintenance audit/event attribution\",\n    \"full transaction rollback after first-row failure\",\n    \"dry-run no durable entities/audits/events/grant\",\n    \"native clock expiration despite stale caller time\",\n    \"fresh connection native single-use replay refusal\",\n    \"partial/conflicting record refusal\",\n    \"exact existing no-change consumes without recovery\",\n    \"unavailable or unexpected ordinary allow refusal\",\n    \"source/closed/expired grant refusal\",\n    \"exact consumed grant digest recovery\",\n    \"created-only rollback retains history/deadletters unsent event\",\n    \"claimed/delivered event stops\",\n    \"changed metadata and later dependency stop\",\n    \"existing delivery lock blocks recovery without deletion\"\n  ],\n  \"resources_removed\": {\n    \"test_worker_auto_removed\": true,\n    \"postgres_container_removed\": true,\n    \"private_volume_removed\": true\n  },\n  \"native_invocation\": false,\n  \"founder_approval\": null\n}\n"
    },
    {
      "item_id": "final-owner-postgres-receipt-json",
      "media_type": "application/json",
      "content": "{\n  \"reviewed_manifest_sha256\": \"0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7\",\n  \"executor_sha256\": \"b0dbbb9786e927055030acf849a72e9a44e9d3d55c84efdf245e419d381684f3\",\n  \"scope\": \"isolated disposable PostgreSQL only; no estate credentials or native invocation\",\n  \"attempts\": [\n    {\n      \"command\": \"unittest discover current 21 catalogue tests using installed image package\",\n      \"exit_code\": 0,\n      \"output\": \"test_absent_registration_preserves_real_denial_and_explicit_maintenance_attribution (test_catalogue_bootstrap.Tests.test_absent_registration_preserves_real_denial_and_explicit_maintenance_attribution) ... ok\\ntest_changed_created_record_stops_rollback (test_catalogue_bootstrap.Tests.test_changed_created_record_stops_rollback) ... ok\\ntest_claimed_event_stops_rollback_without_deleting_entities (test_catalogue_bootstrap.Tests.test_claimed_event_stops_rollback_without_deleting_entities) ... ok\\ntest_conflicting_or_partial_metadata_refuses_without_mutation (test_catalogue_bootstrap.Tests.test_conflicting_or_partial_metadata_refuses_without_mutation) ... ok\\ntest_created_only_rollback_preserves_history_and_deadletters_unsent_event (test_catalogue_bootstrap.Tests.test_created_only_rollback_preserves_history_and_deadletters_unsent_event) ... ok\\ntest_delivered_event_stops_recovery_and_retains_entities (test_catalogue_bootstrap.Tests.test_delivered_event_stops_recovery_and_retains_entities) ... ok\\ntest_delivery_worker_lock_blocks_recovery_without_partial_delete (test_catalogue_bootstrap.Tests.test_delivery_worker_lock_blocks_recovery_without_partial_delete) ... ok\\ntest_dry_run_rolls_back_application_binding_all_audit_and_outbox (test_catalogue_bootstrap.Tests.test_dry_run_rolls_back_application_binding_all_audit_and_outbox) ... ok\\ntest_exact_preexisting_match_is_nochange_and_has_no_undo (test_catalogue_bootstrap.Tests.test_exact_preexisting_match_is_nochange_and_has_no_undo) ... ok\\ntest_expired_or_extra_or_wrong_source_grant_refuses (test_catalogue_bootstrap.Tests.test_expired_or_extra_or_wrong_source_grant_refuses) ... ok\\ntest_grant_is_closed_after_one_use_across_fresh_connection (test_catalogue_bootstrap.Tests.test_grant_is_closed_after_one_use_across_fresh_connection) ... ok\\ntest_later_dependent_record_stops_created_only_recovery (test_catalogue_bootstrap.Tests.test_later_dependent_record_stops_created_only_recovery) ... ok\\ntest_native_clock_refuses_expired_grant_even_with_stale_caller_clock (test_catalogue_bootstrap.Tests.test_native_clock_refuses_expired_grant_even_with_stale_caller_clock) ... ok\\ntest_recovery_requires_original_consumed_grant (test_catalogue_bootstrap.Tests.test_recovery_requires_original_consumed_grant) ... ok\\ntest_transaction_failure_after_first_row_leaves_no_partial_data_or_grant (test_catalogue_bootstrap.Tests.test_transaction_failure_after_first_row_leaves_no_partial_data_or_grant) ... ok\\ntest_unavailable_or_unexpected_ordinary_allow_cannot_trigger_exception (test_catalogue_bootstrap.Tests.test_unavailable_or_unexpected_ordinary_allow_cannot_trigger_exception) ... ok\\ntest_deadline_hard_cap_and_no_timezone_are_refused (test_catalogue_bootstrap_owner_negatives.OwnerNegatives.test_deadline_hard_cap_and_no_timezone_are_refused) ... ok\\ntest_exact_request_adapter_cannot_switch_app_tenant_or_identity (test_catalogue_bootstrap_owner_negatives.OwnerNegatives.test_exact_request_adapter_cannot_switch_app_tenant_or_identity) ... ok\\ntest_exception_is_single_request_with_no_pdp_decision_id (test_catalogue_bootstrap_owner_negatives.OwnerNegatives.test_exception_is_single_request_with_no_pdp_decision_id) ... ok\\ntest_json_boolean_is_not_an_authenticated_memo_revision (test_catalogue_bootstrap_owner_negatives.OwnerNegatives.test_json_boolean_is_not_an_authenticated_memo_revision) ... ok\\ntest_other_memo_or_added_scope_cannot_expand_fixed_exception (test_catalogue_bootstrap_owner_negatives.OwnerNegatives.test_other_memo_or_added_scope_cannot_expand_fixed_exception) ... ok\\n\\n----------------------------------------------------------------------\\nRan 21 tests in 1.561s\\n\\nOK\\n\"\n    }\n  ],\n  \"limits\": {\n    \"memory\": \"512m\",\n    \"cpus\": \"1\",\n    \"postgres_network\": \"none\",\n    \"worker_network\": \"container:fixture\"\n  },\n  \"images\": {\n    \"postgres\": \"postgres@sha256:b0f9560a2de083e2cc7382e75f808c7381a32852a7ec49117deedb300e552b24\",\n    \"worker\": \"forgejo.coulomb.social/coulomb/user-engine@sha256:f239bbf332b8eb87320c86390fddca1dcb4f7c628a7af75e79dee8058d446a7b\"\n  },\n  \"cleanup\": {\n    \"stop_exit_code\": 0,\n    \"container_absent\": false,\n    \"private_data_tmpfs\": true,\n    \"worker_auto_removed\": true,\n    \"final_confirmation\": {\n      \"container_absent\": true,\n      \"verified_command\": \"docker ps -a --filter name=user-owner-review --format names/status returned empty after auto-removal\"\n    }\n  },\n  \"current_test_count\": 21,\n  \"current_test_seconds\": 1.561,\n  \"prior_failed_preparation_retained\": {\n    \"original_receipt_sha256\": \"964cc3755e96330bf6d1ada63410f8adfdb3c45602e0446369d6dddace412405\",\n    \"prior_tests\": 11,\n    \"prior_failed_assertions\": 5,\n    \"cause\": \"readiness probe rolled back transaction inside second service constructor\",\n    \"old_receipt_unmodified\": true\n  },\n  \"independently_confirmed_installed_and_checkout_source_hashes\": [\n    {\n      \"path\": \"src/user_engine/service.py\",\n      \"sha256\": \"1c60b69e08c36eb3f678893a4a945eeeb9c73d5246c6566857cd8c134f75446d\"\n    },\n    {\n      \"path\": \"src/user_engine/adapters/postgres.py\",\n      \"sha256\": \"528d75431d1f3a7e55423ffa55d34722ac343582e513985db74ba3add36e6da6\"\n    },\n    {\n      \"path\": \"src/user_engine/adapters/flex_auth.py\",\n      \"sha256\": \"73d645b7b37904ebfe0df6f7ed397b74b4c47f505cd64a30c39e60717ce71455\"\n    },\n    {\n      \"path\": \"src/user_engine/domain/models.py\",\n      \"sha256\": \"8c9cb8051a930fa05a1657c8b539510588f1788812d68510df55712d2f4df050\"\n    },\n    {\n      \"path\": \"src/user_engine/store_records.py\",\n      \"sha256\": \"3cec4575434e82e29932a3e9cc7659f3dd8fa7e5be81d5690487033796bbfc16\"\n    }\n  ]\n}\n"
    },
    {
      "item_id": "user-owner-agreement-md",
      "media_type": "text/markdown",
      "content": "# User Engine owner agreement — exact catalogue maintenance source\n\n- reviewer: user-engine-owner (agent user-engine, codex)\n- decision: approved\n- comment: INTENT §Layer Engine/PIP, Binding rules 1/3/5/6 and Product Boundaries; exact nine-file preparation manifest SHA256 0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7, executor SHA256 b0dbbb9786e927055030acf849a72e9a44e9d3d55c84efdf245e419d381684f3 and transport SHA256 3e594e0e8561100ae1eeb34d7208cd5b5e387ae56c29689f155aed94219770f3. Work item USER-WP-ADHOC-2026-10-11-T03.\n\nThis dedicated worker loaded User Engine AGENTS/INTENT and worked from its\ncheckout, independently inspecting registration, authorization, domain codecs,\nPostgreSQL persistence/transactions, audit and outbox consumers. This entry\nreviews User Engine only. Approval is source agreement for the precisely\nlabelled maintenance alternative; it is no founder decision, native execution\npermission, runtime admission, human authentication proof or active relaxation.\n\nCatalogue application/binding facts belong to this Engine. Ordinary protected\nregistration still requires access-engine authorization. The standalone tool\ntruthfully overrides an identified genuine ordinary denial for exactly\ninformed-decision / OIDC informed-decision-approver / system informed-decision,\nwith a separate one-use service maintenance actor, empty roles/assurance and no\nPDP allow ID. This is an exception to normal admission, requiring a separate\nexact founder disposition and independently verified native receipt covering\nexecutor AND transport, frozen Ready pod/image, records, deadline and recovery.\nThe private hash-pinned artifact asserts this external authority; it does not\nauthenticate its author. Prior R2 readback authority does not authorize it.\n\nStrict integer memo revision rejects JSON true. Fixed request/action/actor/tenant\nbindings, native database clock checks, serializable transaction and advisory\nlock protect exact admission; durable audit key prevents reuse after restart.\nBoth services are constructed before the transaction because owner readiness\nrolls back the connection. The prior constructor defect and five failed\nassertions remain in original preparation history. Exact preexisting match\nconsumes with no undo. Partial/conflicting rows, provider unavailable, uncertain\ndenial and unexpected ordinary allow refuse. Native dry-run rolls back local\nrecords/audit/outbox/ledger while external provider telemetry may remain. Final\nclock check precedes commit; it is not a measured commit-completion deadline.\n\nCreated-only recovery checks the original grant digest and expiry, unchanged\nmetadata, absent dependencies, original events and the existing delivery-worker\nlock. Claimed/delivered/missing events stop recovery; history survives.\nDead-lettering excludes automatic drain only. Ordinary separately authorized\ntargeted delivery and replay can revive a retained event; this exception grants\nneither. Owner reconciliation is required before that later action. No complete\nconsumer inventory or reversal of downstream effects is asserted.\n\nThe existing HTTP delivery adapter sends the eight-field platform envelope,\nincluding maintenance labels in data. application.registered is attributive,\nnot an invitation mail class. Source attribution does not prove native consumer\nreceipt, stream completeness, MFA success or user access. Verify actual bound\nrows, consumed ledger, genuine denial/maintenance audit, registered event and\nits intended consumer under existing sender admission after any separately\napproved execution. USER-WP-0026-T03 and USER-WP-0028-T02 remain open.\n\nAll 21 current checks passed in 1.561s using real disposable PostgreSQL, installed\nimmutable f239 image package, read-only staged executor/test mount, isolated\nnetwork and 512Mi/1CPU per container. Installed service/postgres/flex-auth/codec/\ndomain hashes match current owner-source boundary. Both fixture workers and\nPostgreSQL were auto-removed; data existed only on tmpfs. Initial immediate\ncleanup query raced auto-removal and is retained as false; a later query\nconfirmed absence. No native database/workload write, login, credential read,\ntransport dispatch or human decision occurred. The original16 prior-source\nreceipt is retained unchanged and is supplemented, not relabelled as new proof.\n\nBefore execution, the requesting Custodian must obtain all required independent\nowner reviews and the exact separate founder exception, record its conditional\nclose-down obligation and preserve ordinary authentication/admission as unmet.\nRejection, expiry, recovery failure and unverified execution cannot be scored\nas successful native catalogue acceptance.\n"
    },
    {
      "item_id": "netkingdom-owner-agreement-md",
      "media_type": "text/markdown",
      "content": "# NetKingdom owner review — bounded one-app catalogue maintenance exception\n\n```yaml\nreviewer: net-kingdom-owner (agent net-kingdom, codex)\ndecision: approved\nreviewed_at: \"2026-10-11\"\nwork_item: NK-WP-ADHOC-2026-10-11-T02\nproposal: USER-CATALOGUE-INFDEC-20261011-R1\nrevision: executor-preparation-2-owner-findings\nmanifest_sha256: 0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7\nexecutor_sha256: b0dbbb9786e927055030acf849a72e9a44e9d3d55c84efdf245e419d381684f3\ntransport_sha256: 3e594e0e8561100ae1eeb34d7208cd5b5e387ae56c29689f155aed94219770f3\nrecords_sha256: 23577cc4f3ea6c0ca43eb21ca0e3280eb53fb64e29b030dcd31251593f0f3f2f\ncomment: >-\n  NetKingdom INTENT declares Taxonomy/security canon and orchestration with\n  explicit externally owned identity, PDP and user-domain facts. This exact\n  alternative is one labelled supervised maintenance exception for the two\n  fixed User Engine metadata records, not a normative permission, new login,\n  grant or case type. Technical agreement under NK-WP-ADHOC-2026-10-11-T02\n  preserves real ordinary denial, independent exact founder disposition,\n  recorded exception scope, bounded recovery and distinct owner roles.\n  It provides no founder approval, native runtime go or catalogue completion.\n```\n\n## Canonical facts and owner separation\n\nThe nine applied files all match the exact refinement manifest above. Application\ninformed-decision / display Informed Decision / owner informed-decision and\nbinding informed-decision-approver -> protected system informed-decision match\nUser Engine's actual codecs and canonical-records.json. Access Engine's readback\nregistry independently binds issuer https://kc.coulomb.social and that client;\nKeyCape source/owner registration receipt independently names the exact callback\nhttps://decisions.coulomb.social/auth/callback. Existing retained keycape-client-\npresence and native-preflight receipts support current preparation; no new live\nissuer or database read was performed in this review. A fresh frozen target/pod/\nimage and unchanged facts still must be rechecked before separately approved use.\n\nThe proposed write does not create a user, membership, group, default role,\nentitlement, grant or authorization rule. Application and binding are catalogue\nfacts, not allow-list entries or permission. No entry URL is smuggled into the\nDTO: its model has no URL field, and observed Ingress URL remains context only.\nThis source agreement does not establish a fleet-complete catalogue or supply\nany application owner's still-required acknowledgement in another owner's voice.\nUser Engine owns record lifecycle/persistence; Access owns the protected system\nand decisions; KeyCape owns authentication/client registration; InformedDecision\nowns application semantics. NetKingdom agrees only to security orchestration scope.\n\n## Explicit exception, not satisfied normal admission\n\nINTENT and accepted security-layer-model v0.8 retain the sole PDP and ordinary\nPEP obligations. The tool intentionally overrides genuine ordinary application.\nregister denial after preserving its identified decision and audit. That is a\nproposed exceptional administrative act, not normal conforming admission and not\nan outage stance or PDP allow. Maintenance actor is truthfully SERVICE with\nurn:supervised-maintenance issuer, explicit attribution and no forged human JWT,\nroles, assurance or invented login. Exception result has no PDP decision ID.\nNo standard, normal service endpoint, IAM policy or existing PDP adapter changes.\n\nThe private mode0600 canonical-hash grant is out-of-band supervised evidence,\nnot authentication of its author. Custodian must independently verify actual\nfounder disposition for this exact executor AND transport, records, Ready pod/\nimmutable image, deadline and recovery. Prior readback R2 authority is insufficient.\nBoth native dry-run and apply require that distinct scope. The dry-run may cause\nreal external PDP telemetry while rolling back local rows/audits/outbox/ledger;\nit is not globally side-effect free. Future human acceptance must preserve normal\nadmission as unmet and record the exact conditional close-down relaxation. This\nsource preparation creates no active exception or scored execution success.\n\n## Expiry, one-use and recovery\n\nClosed grant requires exact integer memo revision, fixed proposal/memo/record/\nexecutor hashes and maximum deadline2026-10-12T23:59:59Z. The fixed method/request\nbinding and <=30s lifetime are narrow. SERIALIZABLE transaction, fixed application\nadvisory lock, native DB clock checks and persisted audit-key ledger bind absent/\nexact admission and prevent replay after process restart. Both services must be\nconstructed before BEGIN because readiness rolls back its connection. Final\nclock check is precommit; it is not observation of commit completing by expiry.\n\nExact pre-existing match consumes with no creation or undo. Partial/conflicting\nfacts, unavailable/uncertain provider deny or unexpected ordinary allow refuse.\nCreated-only recovery requires the original consumed grant hash before expiry,\nunchanged exact two records, no later dependencies, preserved event IDs and the\nexisting delivery-worker lock. Missing, claimed or delivered events stop recovery.\nHistory is retained, not erased. A changed grant/operator cannot defeat one-use\nor create fresh rollback authority. Failed or expired recovery needs separate\nowner reconciliation and disposition; no reversal of downstream effects is claimed.\n\n## Retained event and replay boundary\n\nThe registered event remains attributive, with maintenance_exception/proposal/\napproval/operator labels, transported through the existing audit envelope. It\nis not an invitation mail class or a user-authorization grant. Standard pending\ndrain excludes dead-lettered rollback events. Separately authorized targeted\ndelivery/replay can revive retained events; this proposal explicitly grants\nneither. The reviewer agrees to the added caveat requiring separate owner\nreconciliation/disposition before any such later action. Preserve rollback/event\nIDs so a future consumer/reviewer can correlate the retired registration and\navoid mistaking delayed evidence for current facts. No complete consumer inventory,\nfaithful-display, native audit arrival or stream-completeness claim is made.\n\n## Verification and remaining authority\n\nFresh dedicated User Engine owner agreement is applied in its own review file;\nthis worker neither replaces it nor signs that role. Its independently recorded\n21 isolated PostgreSQL checks passed on current exact source and immutable f239\ninstalled package dependencies, with private fixtures/cleanup limits retained.\nThat is not a native database invocation or authority grant. This NetKingdom\nreview independently reran the five pure negative tests on the applied executor:\nall pass, with no network/database/credential access. Earlier sixteen-test receipt\nand constructor failures remain history, not relabelled as final proof.\n\nNo further source change is required for this narrow technical agreement. Before\nexecution the requester still needs exact human exception and all required owner\nacknowledgments; freeze concrete grant/target preconditions and supervise the\nalready prepared source transport. Afterwards verify exact two codec payloads,\none consumed ledger, genuine denial/maintenance audits, attributed event and\nnative catalogue/readback boundaries. Human MFA/allow and any complete journey\nremain separate; USER-WP-0026-T03/USER-WP-0028-T02 cannot close from this review.\nNo native write, credential read, login, new agent, runtime publication or founder\nruling occurred. This review introduces no NetKingdom standard permission.\n"
    },
    {
      "item_id": "application-owner-facts-ack-md",
      "media_type": "text/markdown",
      "content": "# Informed Decision application-owner catalogue facts review\n\n```yaml\nreviewer: informed-decision-owner (agent informed-decision, codex)\ndecision: approved\nwork_item: INFD-WP-ADHOC-2026-10-11-T01\nscope: application-facts source acknowledgement only\ncomment: >-\n  INTENT.md Purpose and What informed-decision Owns assign the decision surface\n  and browser client to this repository; What informed-decision Does Not Own\n  and Design Principles 9-10 reserve authorization, authentication and human\n  binding to their respective owners. Exact canonical-records.json SHA-256\n  ae6fde5f2c879e75fabb53e132261899dae0f4d864e18dd425bc272be713426b and refined\n  nine-file executor manifest SHA-256\n  0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7 were reviewed\n  under INFD-WP-ADHOC-2026-10-11-T01. Application facts agree with the native\n  identity/declaration/client/requester source and existing value-free receipts.\n```\n\nApplication is `informed-decision`, display name `Informed Decision`, owner\n`informed-decision`, allowed profile scopes exactly `[global]`, allowed\nprojection types exactly `[application_runtime]`. Binding is application\n`informed-decision`, browser OIDC client `informed-decision-approver`, protected\nsystem `informed-decision`, empty `catalog_namespaces`, null `event_source`\nand null `deployment_ref`. These are two catalogue metadata entities only;\nallowed profile/projection vocabulary is not a user permission or an IAM grant.\n\n`informed_decision/oidc.py` fixes the browser client, HTTPS origin and exact\ncallback; `informed_decision/policy.py:build_request` submits protected system\n`informed-decision`. Governing INTENT.md declares `Staff`/`pep-shaped`, matching\nits derived `layer.yaml`; no layer or role change is proposed.\n`informed_decision/requester.py` instead fixes the separate create-only\n`informed-decision-sitting-requester`, authenticates service subject\n`informed-decision` and requests `approval:create`. The proposal correctly\nbinds the browser client, without conflating it with that workload identity.\n\nThe User Engine Application/ApplicationBinding model has no URL field.\n`https://decisions.coulomb.social/` remains context only, never an invented\nfield or a substitute for event/deployment identity. Existing proposal receipts\n`native-entry-metadata.json`, `keycape-client-presence.json` and\n`native-preflight.json` retain TLS Ingress host/UID, native wrong-redirect\nrefusal and absent exact catalogue rows, respectively. These dated receipts\nare supporting evidence, not a fresh live observation or real human MFA proof.\n\nThe refined executor's APP/BINDING values agree with these facts. Its standalone\nSERVICE maintenance attribution and retained genuine ordinary PDP denial do\nnot create a browser/human identity or claim a normal PDP allow. Exact founder\nexception disposition remains separately required. Single-use/native-clock\nexpiry, created-only recovery and retained audit/outbox history are exception\nmechanisms reviewed by their owners; this application ACK neither approves\nthose mechanisms for live use nor certifies downstream reversal. Dead-lettering\nexcludes automatic drain only: privileged targeted delivery/replay can revive\nthe retained event and remains outside the proposed maintenance authority.\n\nThis entry records only the informed-decision-owner role. It changes no record\nstatus, bound claims, admission fields or authority; it approves no maintenance\nexception, credentials, login, native mutation, release or human disposition.\nReal human browser/MFA acceptance and USER-WP-0026-T03/USER-WP-0028-T02 closure\nremain independent gates. No owner-facts correction was found.\n\nReviewed owner HEAD: `3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168`.\n"
    },
    {
      "item_id": "retained-native-preflight-json",
      "media_type": "application/json",
      "content": "{\n  \"application_absent\": true,\n  \"binding_absent\": true,\n  \"exact_match\": false,\n  \"fixed_application_id\": \"informed-decision\",\n  \"native_mutation\": false,\n  \"partial_or_conflicting\": false,\n  \"read_only\": true,\n  \"pod_uid\": \"e500bcae-c911-43a2-bd40-6a30b39064ab\",\n  \"pod_image_match\": true,\n  \"native_exec_returncode\": 0\n}\n"
    },
    {
      "item_id": "retained-native-entry-metadata-json",
      "media_type": "application/json",
      "content": "{\n  \"ingress_read\": true,\n  \"secret_objects_read\": false,\n  \"entries\": [\n    {\n      \"name\": \"informed-decision\",\n      \"uid\": \"98d3885a-a62d-49c2-91ea-6616fa5a04ae\",\n      \"hosts\": [\n        \"decisions.coulomb.social\"\n      ],\n      \"tls_hosts\": [\n        \"decisions.coulomb.social\"\n      ]\n    },\n    {\n      \"name\": \"informed-decision-http-redirect\",\n      \"uid\": \"550279fb-c9a1-4585-9b21-27b1c8f90b6d\",\n      \"hosts\": [\n        \"decisions.coulomb.social\"\n      ],\n      \"tls_hosts\": []\n    }\n  ]\n}\n"
    },
    {
      "item_id": "retained-keycape-client-presence-json",
      "media_type": "application/json",
      "content": "{\n  \"read_only\": true,\n  \"secret_objects_read\": false,\n  \"real_human_login_performed\": false,\n  \"method\": \"Known client rejects unregistered redirect with native KeyCape redirect_uri error; no login/cookie/state output.\",\n  \"http_status\": 400,\n  \"registered_client_rejects_wrong_redirect\": true\n}\n"
    },
    {
      "item_id": "transport-guard-receipt-json",
      "media_type": "application/json",
      "content": "{\n  \"recorded_at\": \"2026-10-11T01:48:58.692449+00:00\",\n  \"tests\": 6,\n  \"passed\": 6,\n  \"seconds\": 0.022,\n  \"test_sha256\": \"a6362e23e5608c36ed84855c90c3f4593aebca6593844e9caf179ca9192a1f3b\",\n  \"reviewed_transport_sha256\": \"3e594e0e8561100ae1eeb34d7208cd5b5e387ae56c29689f155aed94219770f3\",\n  \"runtime_source_modified\": false,\n  \"network_calls\": 0,\n  \"native_dispatch\": false,\n  \"approval_fixture_is_authority\": false,\n  \"test_scope\": \"Mocked subprocess transport guard negatives and exact stdin binding only; not estate transport, founder authentication or native DB proof.\"\n}\n"
    },
    {
      "item_id": "transport-guard-tests-py",
      "media_type": "text/plain",
      "content": "\"\"\"Offline transport guards with explicit fixture receipts; never dispatch SSH.\nThe mocked packet is not founder authority or a native execution test.\n\"\"\"\nimport base64\nimport contextlib\nimport hashlib\nimport importlib.util\nimport io\nimport json\nfrom pathlib import Path\nimport re\nimport tempfile\nfrom types import SimpleNamespace\nimport unittest\nfrom unittest.mock import patch\n\ntransport=Path(__file__).resolve().parents[1]/'tools'/'run_approved_catalogue_bootstrap.py'\nif not transport.is_file():transport=Path('/home/worsch/user-engine/tools/run_approved_catalogue_bootstrap.py') # staged offline test fallback only\nspec=importlib.util.spec_from_file_location('catalogue_transport',transport)\nm=importlib.util.module_from_spec(spec);spec.loader.exec_module(m)\nIMAGE='forgejo.coulomb.social/coulomb/user-engine@sha256:f239bbf332b8eb87320c86390fddca1dcb4f7c628a7af75e79dee8058d446a7b'\nUID='11111111-1111-4111-8111-111111111111'\nclass Tests(unittest.TestCase):\n def setUp(self):\n  self.tmp=tempfile.TemporaryDirectory();self.root=Path(self.tmp.name)\n  self.source=self.root/'executor.py';self.source.write_text('# explicit fixture source, not a native executor\\n')\n  self.grant=self.root/'private.json';self.grant.write_text(json.dumps({'fixture':'not-authority'}));self.grant.chmod(0o600)\n  self.args=['tool','--executor',str(self.source),'--executor-sha256',hashlib.sha256(self.source.read_bytes()).hexdigest(),'--grant-file',str(self.grant),'--grant-sha256',hashlib.sha256(b'{\"fixture\":\"not-authority\"}').hexdigest(),'--expected-pod-uid',UID]\n def tearDown(self):self.tmp.cleanup()\n def call(self,args=None):\n  output=io.StringIO()\n  with patch('sys.argv',args or self.args),patch.object(m.subprocess,'run',return_value=SimpleNamespace(returncode=0,stdout='{\"result\":\"created\"}')) as dispatch,contextlib.redirect_stdout(output):\n   status=m.main()\n  return status,dispatch,json.loads(output.getvalue())\n def test_wrong_executor_or_grant_hash_refuses_before_ssh(self):\n  for field in ['--executor-sha256','--grant-sha256']:\n   args=self.args.copy();args[args.index(field)+1]='0'*64\n   status,dispatch,out=self.call(args);self.assertEqual(status,2);dispatch.assert_not_called();self.assertEqual(out['result'],'refused-or-rolled-back')\n def test_nonprivate_or_symlink_grant_refuses_before_ssh(self):\n  self.grant.chmod(0o644);status,dispatch,_=self.call();self.assertEqual(status,2);dispatch.assert_not_called()\n  self.grant.chmod(0o600);link=self.root/'link';link.symlink_to(self.grant);args=self.args.copy();args[args.index('--grant-file')+1]=str(link)\n  status,dispatch,_=self.call(args);self.assertEqual(status,2);dispatch.assert_not_called()\n def test_invalid_uid_cannot_enter_remote_python_literal(self):\n  args=self.args.copy();args[args.index('--expected-pod-uid')+1]=\"invalid'); __import__('os').system('false'); #\"\n  status,dispatch,_=self.call(args);self.assertEqual(status,2);dispatch.assert_not_called()\n def test_transport_binds_source_grant_mode_to_stdin_without_credentials(self):\n  status,dispatch,_=self.call();self.assertEqual(status,0);self.assertEqual(dispatch.call_args.args[0],['ssh','railiance01','python3 -'])\n  remote=dispatch.call_args.kwargs['input'];self.assertIn(UID,remote);self.assertIn(IMAGE,remote)\n  native=base64.b64decode(re.search(r\"base64.b64decode\\('([^']+)'\\)\",remote).group(1)).decode()\n  packet=json.loads(base64.b64decode(re.search(r\"base64.b64decode\\('([^']+)'\\)\",native).group(1)))\n  self.assertEqual(base64.b64decode(packet['source']),self.source.read_bytes());self.assertEqual(packet['mode'],'dry-run');self.assertEqual(packet['grant'],{'fixture':'not-authority'})\n  self.assertIn(\"os.environ['USER_ENGINE_DATABASE_URL']\",native);self.assertIn(\"os.environ['USER_ENGINE_FLEX_AUTH_TOKEN_FILE']\",native)\n def test_remote_rejects_wrong_uid_not_ready_and_changed_image_before_exec(self):\n  _,dispatch,_=self.call();remote=dispatch.call_args.kwargs['input']\n  for uid,ready,image in [('22222222-2222-4222-8222-222222222222',True,IMAGE),(UID,False,IMAGE),(UID,True,'fixture:changed')]:\n   pods={'items':[{'metadata':{'uid':uid,'name':'fixture-pod'},'status':{'phase':'Running','conditions':[{'type':'Ready','status':'True' if ready else 'False'}]},'spec':{'containers':[{'name':'portal','image':image}]}}]}\n   out=io.StringIO()\n   with patch('subprocess.run',return_value=SimpleNamespace(returncode=0,stdout=json.dumps(pods))) as native_dispatch,contextlib.redirect_stdout(out):exec(compile(remote,'<fixture-remote>','exec'),{'__name__':'fixture'})\n   self.assertEqual(native_dispatch.call_count,1);self.assertEqual(json.loads(out.getvalue())['result'],'refused-or-rolled-back')\n def test_remote_exact_ready_pod_executes_only_fixed_portal_stdin(self):\n  _,dispatch,_=self.call();remote=dispatch.call_args.kwargs['input'];pods={'items':[{'metadata':{'uid':UID,'name':'fixture-pod'},'status':{'phase':'Running','conditions':[{'type':'Ready','status':'True'}]},'spec':{'containers':[{'name':'portal','image':IMAGE}]}}]}\n  out=io.StringIO()\n  with patch('subprocess.run',side_effect=[SimpleNamespace(returncode=0,stdout=json.dumps(pods)),SimpleNamespace(returncode=0,stdout=b'{\"result\":\"created\"}')]) as native_dispatch,contextlib.redirect_stdout(out):exec(compile(remote,'<fixture-remote>','exec'),{'__name__':'fixture'})\n  self.assertEqual(native_dispatch.call_count,2);self.assertEqual(native_dispatch.call_args.args[0],['kubectl','exec','-i','-n','user-engine','fixture-pod','-c','portal','--','python3','-']);self.assertIsInstance(native_dispatch.call_args.kwargs['input'],bytes)\nif __name__=='__main__':unittest.main()\n"
    }
  ]
}