aaronrene / knowtation public
patch feat/retail-helper-finish-b-kn1 #1 / 1
aaronrene · 9 days ago · Aug 27, 2026 · Diff

RHF-b-KN1: DelegationAuthorityStore retail renew/validate/helper-access.

CAS envelope with post-CAS audit materializer, strong blob reads, session-first routes, candidate cutover with dual-gated marker (no production activation). Seven-tier 23/23; BV round 3 pass. No Scooling edits.

sha256:354ec7b79252c3626684f23b54874b685672741f851fe43a5f668b626ef4690b sha
sha256:5ff21f62530e13e99fd6ad906fb0ff54c9c3519adde5b3fd294e3360fb73a517 parent
+82 ~57 −8 symbols
sha256:f4ee4549c7295c250442be3297704d59805c9ece53988cb06ed626e408717a3b snapshot
+82
symbols added
~57
symbols modified
−8
symbols removed
0
dead code introduced
Semantic Changes 147 symbols
~ docs/reviews/2026-08-27-rhf-b-kn1-bv-round3-pass.md .md 8 symbols added
+ Build verification — RHF-b-KN1 round 3 section Build verification — RHF-b-KN1 round 3 L1–37
+ Verdict: pass section Verdict: pass L8–37
+ Deliverables verified section Deliverables verified L24–32
+ Evidence section Evidence L10–16
+ table section table L12–15
+ Explicitly not done (Tier 3) section Explicitly not done (Tier 3) L32–37
+ Round history section Round history L16–24
+ table section table L18–23
~ lib/agent/delegation-authority-store.mjs .mjs 51 symbols added
+ FileCasBlobStore class class FileCasBlobStore L334–418
+ _etagPathFor method method _etagPathFor L356–358
+ _pathFor method method _pathFor L347–350
+ constructor method method constructor L338–341
+ get method async_method get L386–389
+ getWithMetadata method async_method getWithMetadata L364–380
+ set method async_method set L396–417
+ MemoryCasBlobStore class class MemoryCasBlobStore L283–329
+ constructor method method constructor L284–288
+ get method async_method get L307–311
+ getWithMetadata method async_method getWithMetadata L294–301
+ set method async_method set L318–328
+ activateMarker function async_function activateMarker L1605–1711
+ buildAuthoritySubjects function function buildAuthoritySubjects L228–244
+ bumpRecordAudit function function bumpRecordAudit L621–641
+ constantTimeEqualHexOrString function function constantTimeEqualHexOrString L180–186
+ createDelegationAuthorityStore function function createDelegationAuthorityStore L783–1728
+ createOrVerifyCandidate function async_function createOrVerifyCandidate L1424–1598
+ delegationAuthorityCandidateBlobKey function function delegationAuthorityCandidateBlobKey L100–102
+ delegationAuthorityCandidateFileName function function delegationAuthorityCandidateFileName L116–118
+ delegationAuthorityEnvelopeBlobKey function function delegationAuthorityEnvelopeBlobKey L92–94
+ delegationAuthorityEnvelopeFileName function function delegationAuthorityEnvelopeFileName L108–110
+ derivePrincipalSubjectKey function function derivePrincipalSubjectKey L201–203
+ fail function function fail L270–278
+ hashAuditEvent function function hashAuditEvent L517–526
+ isConsentActiveStrict function function isConsentActiveStrict L149–157
+ isGrantActiveStrict function function isGrantActiveStrict L164–173
+ isRetailCodexIdentity function function isRetailCodexIdentity L761–770
+ isStrictUtcTimestamp function function isStrictUtcTimestamp L124–128
+ lengthPrefixedUtf8 function function lengthPrefixedUtf8 L209–214
+ make function function make L230–238
+ materializeAuditOutbox function async_function materializeAuditOutbox L536–613
+ mutateEnvelope function async_function mutateEnvelope L888–995
+ parseOptionalStrictUtc function function parseOptionalStrictUtc L136–140
+ principalActorKey function function principalActorKey L193–195
+ pruneAuthorityEnvelope function function pruneAuthorityEnvelope L650–690
+ randomIdToken function function randomIdToken L250–252
+ randomPrefixedId function function randomPrefixedId L259–262
+ readActiveEnvelope function async_function readActiveEnvelope L798–880
+ readHelperAccess function async_function readHelperAccess L1001–1039
+ rebuildNewestActiveConsentIndex function function rebuildNewestActiveConsentIndex L699–721
+ renewPersonal function async_function renewPersonal L1045–1192
+ resolveAuthorityCasStore function function resolveAuthorityCasStore L425–434
+ revokeConsent function async_function revokeConsent L1318–1361
+ revokeGrant function async_function revokeGrant L1369–1416
+ sealEnvelopeStateHash function function sealEnvelopeStateHash L440–445
+ seedActiveAuthorityEnvelope function async_function seedActiveAuthorityEnvelope L1740–1785
+ selectActivePersonalConsent function function selectActivePersonalConsent L732–755
+ underCapacity function function underCapacity L499–511
+ validateAndConsume function async_function validateAndConsume L1202–1312
+ validateEnvelopeInternalIntegrity function function validateEnvelopeInternalIntegrity L451–493
~ test/rhf-b-kn1-delegation-retail.test.mjs .mjs 3 symbols added
+ mkDataDir function function mkDataDir L59–61
+ personalConsent function function personalConsent L63–79
+ seededStore function async_function seededStore L81–105
~ docs/OVERSEER-HANDOVER.md .md 14 symbols added, 8 symbols removed, 50 symbols modified
~ Archived — AIP-b Operator T2 live smoke (parallel residual)
~ Archived — CODEX-HUB-ACTOR (was PRIMARY after #331 — superseded)
~ code[text]
~ Archived — RHF-b-KN0 paste block (completed)
~ code[text]
~ Paste-ready prompt — AIP-b Operator T2 live smoke
~ code[text]
~ Paste-ready prompt — RHF-b-KN1 (fresh chat)
~ code[text]
~ code[text]
~ Paste-ready prompt — trend-agent propose re-smoke (after deploy; Operator, not AIP-b)
~ code[text]
~ This session — AIP-b Auto DONE (2026-08-24)
~ This session — SD-21 land AIP-b DONE (2026-08-24)
− NEXT SESSION — RHF-b-KN1 DELEGATION-RETAIL section NEXT SESSION — RHF-b-KN1 DELEGATION-RETAIL L36–190
− Paste-ready prompt — Scooling F28b land + F26 smoke (product order — paste in Scooling chat) section Paste-ready prompt — Scooling F28b land + F26 smoke (product order — paste in Scooling chat) L176–190
− Prior — RHF-b-KN0 deploy proof Operator FINDINGS (2026-08-27) section Prior — RHF-b-KN0 deploy proof Operator FINDINGS (2026-08-27) L85–89
− THE ONE NEXT STEP — Model: Operator + Auto section THE ONE NEXT STEP — Model: Operator + Auto L44–62
− code[text] variable variable code[text] L46–61
− This session — RHF-b-KN0 Auto DONE (2026-08-27) section This session — RHF-b-KN0 Auto DONE (2026-08-27) L89–97
− This session — RHF-b-KN0 deploy proof Operator PASS (2026-08-27) section This session — RHF-b-KN0 deploy proof Operator PASS (2026-08-27) L79–85
− Product-order relay (2026-08-27, KN0 deploy proof PASS) section Product-order relay (2026-08-27, KN0 deploy proof PASS) L18–36
+ NEXT SESSION — KN0 deploy proof re-run (ARCHIVED — PASS) section NEXT SESSION — KN0 deploy proof re-run (ARCHIVED — PASS) L74–230
+ Paste-ready prompt — Scooling F28b land + F26 smoke (product order — paste in Scooling chat) section Paste-ready prompt — Scooling F28b land + F26 smoke (product order — paste in Scooling chat) L215–230
+ THE ONE NEXT STEP — Model: Operator (archived) section THE ONE NEXT STEP — Model: Operator (archived) L82–104
+ code[text] variable variable code[text] L88–103
+ This session — RHF-b-KN0 Auto DONE (2026-08-27) section This session — RHF-b-KN0 Auto DONE (2026-08-27) L128–136
+ This session — RHF-b-KN0 deploy proof Operator FINDINGS (2026-08-27) section This session — RHF-b-KN0 deploy proof Operator FINDINGS (2026-08-27) L121–128
+ NEXT SESSION — Land RHF-b-KN1 (then Scooling RHF-b-SC) section NEXT SESSION — Land RHF-b-KN1 (then Scooling RHF-b-SC) L29–74
+ Archived — KN0 deploy proof (PASS 2026-08-27) section Archived — KN0 deploy proof (PASS 2026-08-27) L70–74
+ Archived — RHF-b-KN1 paste block (completed) section Archived — RHF-b-KN1 paste block (completed) L63–70
+ code[text] variable variable code[text] L65–69
+ THE ONE NEXT STEP — Model: Operator + Auto section THE ONE NEXT STEP — Model: Operator + Auto L37–54
+ code[text] variable variable code[text] L39–53
+ This session — RHF-b-KN1 Auto DONE (2026-08-27) section This session — RHF-b-KN1 Auto DONE (2026-08-27) L54–63
+ Product-order relay (2026-08-27, RHF-b-KN1 BV pass) section Product-order relay (2026-08-27, RHF-b-KN1 BV pass) L18–29
~ Overseer Handover — Knowtation
~ ARCHIVED SESSION — SEC-KN-3a build prompt
~ Prior session — SEC-KN-4b BV round 2 = pass
~ ARCHIVED SESSION — SEC-KN-4b build prompt
~ Knowtation-owned findings (from Pass 2)
~ table
~ ARCHIVED SESSION — SEC-KN-5 build prompt
~ Prior session — SEC-KN-3a BV round 1 = pass
~ ARCHIVED SESSION — SEC-KN-6 build prompt
~ Prior session — SEC-KN-5 BV round 1 = pass
~ Change log
~ table
~ LANE TIP — Knowtation authorization/security lane
~ Earlier this session — SEC-KN-4c-b Auto land code DONE, BV round 1 pass (2026-08-01)
~ PARKED — SEC-KN-P6-ROTATE-b R4–R5 (operator 2026-08-01)
~ table
~ PARKED — after APPLE-4-live (do not skip ahead)
~ table
~ Prior session — CAPTURE-HOSTED-APPLY-KN-b DONE (2026-07-31, BV round 1 pass)
~ Prior session — FLOW-WRITE-LIVE-GATEWAY-PROXY DONE (2026-07-29)
~ Prior session — SEC-KN-6 BV round 1 = pass
~ Prior session — SEC-SEAM-1a round 3: D1–D4 ratified, N1 closed, loop blocked at round 3
~ Prior session — SEC-SEAM-1a rounds 4–7: D5 = A, freeze CLEARED
~ Prior session — SEC-SEAM-1b Auto build + BV pass
~ Prior this session — KN-APPLE-a Thinking CLEARED (2026-08-09)
~ Prior this session — SEC-KN-P6-ROTATE-b R1–R3 + P0 deploy; R4–R5 PARKED (2026-08-01)
~ Prior — KN-APPLE-b Auto DONE + BV pass (2026-08-09)
~ Prior — SITE-FINISH-FLOW-RUN-KN-b DONE (BV, 2026-08-06)
~ PRODUCT RELAY — sequencing (Scooling board)
~ This session — KN-DOCS-SYNC-DRIVE-GATE DONE (2026-08-17)
~ table
~ Shared context (prepend to any phase prompt)
~ Status (Knowtation product)
~ table
~ Verified snapshot (what exists now)
~ table
~ docs/ROADMAP.md .md 5 symbols modified
~ Roadmap — knowtation
~ Build queue
~ table
~ Current status (2026-08-27)
~ table
~ hub/bridge/delegation-routes.mjs .mjs 6 symbols added, 1 symbol modified
+ authorityStoreFor function function authorityStoreFor L122–131
+ mapVaultDenial function function mapVaultDenial L461–477
+ requireRetailSession function function requireRetailSession L486–499
+ requireStrictSessionToken function function requireStrictSessionToken L92–104
+ sendAuthorityUnavailable function function sendAuthorityUnavailable L505–515
+ sendDelegationError function function sendDelegationError L110–116
~ registerBridgeDelegationRoutes
~ hub/gateway/server.mjs .mjs 1 symbol modified
~ proxyTo
← Older Oldest on feat/retail-helper-finish-b-kn1
All commits
Newer → Latest on feat/retail-helper-finish-b-kn1

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:354ec7b79252c3626684f23b54874b685672741f851fe43a5f668b626ef4690b --body "your comment"