amadan
Bind activation evidence to actual platform configuration and domain APIs
1 file changed,
+23
−8
implementation/home-provisioner.md+23 −8
CI passed — run details
diff --git a/implementation/home-provisioner.md b/implementation/home-provisioner.md| index b738128..e4c6860 100644 |
| --- a/implementation/home-provisioner.md |
| +++ b/implementation/home-provisioner.md |
| @@ -173,7 +173,7 @@ it. Tests must prove direct app requests cannot invoke it. |
| private request. It identifies existing credential/directory primary hosts, |
| canonical origins, account, existing data-key fingerprints, operator public pins, |
| exact release/artifact/config revisions and registry identity. Use supported |
| -`carlos instances list/show`, route/version checks and maintenance preflight; |
| +`carlos instances list`, route/version checks and maintenance preflight; |
| restart's asleep output is not exec eligibility proof. The operator's fresh approval |
| is required on the console's exact request. Existing Home databases and identities |
| are retained. No credential sign-in is fabricated for the owner. |
| @@ -202,8 +202,10 @@ are retained. No credential sign-in is fabricated for the owner. |
| the returned current domain binding, primary route and environment. |
| 6. Register the exact consumer with credential Home by updating its bounded immutable |
| HOME_CONSUMERS manifest through protected environment configuration. Preserve every |
| - existing registration and all current assertion keys. Read back the configured |
| - revision/digest and verify the actual restarted credential host version. Its normal |
| + existing registration and all current assertion keys. Read back the public manifest and protected configuration delivery result, |
| + then use the fixed credential compatibility checker under the maintenance |
| + environment binding to verify the active manifest digest and public key |
| + fingerprints. Verify the actual restarted credential host version. Its normal |
| GET /authorize validation can confirm that this consumer/audience pair reaches the |
| expected sign-in flow without sending mail; it cannot alone prove key custody. |
| Current source allows16 entries/8192bytes and requires directory registration; |
| @@ -211,8 +213,8 @@ are retained. No credential sign-in is fabricated for the owner. |
| 7. Provision the pending directory consumer. Verify its returned signed record using |
| the independent pinned directory operator public key. Install the exact record and |
| private bearer into the isolated Docs config using supported protected delivery. |
| - The local journal records ciphertext digests and platform config revisions, never |
| - secret values in public receipts. |
| + The local journal records ciphertext digests and the checked maintenance |
| + environment binding, never secret values in public receipts. |
| 8. Collect activation evidence and publish only through the approved activation rule |
| below. Verify completed two-team browser acceptance using real synthetic identities |
| and actual Home credential authentication; no pre-minted session is live evidence. |
| @@ -222,7 +224,20 @@ console/domain/instance/version response structs or add a reviewed JSON CLI outp |
| for a currently text-only command. Source platform dcf0cad `instances_cli.go`, |
| `domains_cli.go`, `cli.go:routeVersionCheck`, `internal/console/apicli.go`; Home171 |
| `internal/home/runtime.go` HOME_CONSUMERS validation and `exchange.go` authorization |
| -validation. Domain claim alone does not prove materialized TLS. Dial only configured |
| +validation. Current domain responses distinguish derived State from legacy Status: require |
| +State=live (not merely Status=live), then verify actual TLS/version. Domain claim |
| +alone does not prove materialized TLS. Current configGet has no revision field and |
| +never returns secret values; absence is not a successful secret/config comparison. |
| +Use maintenance's immutable protected environment binding and a fixed non-serving |
| +application compatibility checker against that snapshot. The Home checker reports |
| +only exact origins, active public operator/assertion/roster key fingerprints and |
| +consumer-manifest digest. The Docs checker reports exact TeamMode bindings, verified |
| +provisioning record digest, generation and SHA256 of the canonical bearer already |
| +present in protected config. These are bounded private results, never public logs. |
| +Checkers make no network calls, mint no sessions and change no DB/key/authority. |
| +They require separate small implementation/review slices; no current API is claimed |
| +to supply these application-specific facts. Existing secret fingerprints are compared |
| +privately to enrolled fingerprints, without copying existing private keys out. Dial only configured |
| canonical HTTPS hosts with normal certificate validation, no redirects unless the |
| specific sign-in probe validates every expected hop. Compare full expected version |
| in body/header and current platform route/alias mapping. Store bounded response |
| @@ -232,8 +247,8 @@ email, assertion and unrelated response content are never retained in evidence. |
| ## Activation gate and pending roster integration |
| An activation authorization signs exact consumer/team/app/audience, generation, |
| -record sequence/digest, deployed release/artifact digest, protected config revision, |
| -credential registration revision/digest, materialized alias binding, verification |
| +record sequence/digest, deployed release/artifact digest, checked maintenance environment binding, |
| +credential registration digest, materialized alias binding, verification |
| start/end time and the versioned acceptance policy. The local provisioner only emits |
| it after its typed collectors pass. It is bounded to16KiB, expires within300 seconds, |
| and is approved in the fresh console maintenance request. The Home command verifies |