# Privacy, security and credential intake: concrete retry repair Date: 2026-09-08. Work follows checkpoint 493fc7667a2b68bdf8cd30256b70b56b92ce9255. This records local implementation and the subsequent scoped production validation. It does not close the full intake or independent-acceptance gate. ## Sources and complete-read scope - Agent Privacy Information Lifecycle.md: all 41,723 bytes read, including six lifecycle surfaces, the propagation/minimization tables, reference designs, financial scenario, phases, thresholds and 31 bibliography entries. The small embedded base64 arrow image was identified, not separately visually inspected. SHA-256: e658c6c50ecc4a943765bf5ba7d71728e1eb6b540d5dd986fd005de0e094bb26. - Autonomous Agent Security Architecture.md: all 44,738 bytes read, including confused-deputy framing, stored-message poisoning, comparison matrix, dual-model and capability proposals, authorization propagation, invoice example, rollout phases, metrics, limitations and 34 bibliography entries. Truncated middle excerpts were re-read before this complete-text review was recorded. - Concresca Credential Lifecycle Research.md: reuse the exact-hash full review in reports/v048-agent-integration-intake-review.md and the current source/client inspection. SHA-256: 4a35430c1202ee2a29cc4aea658f2455998e6dbcdc8ae50d803a77628240b364. Hashes and custody for all sources are owned by .uai/intake-queue.json. Citations in these reports remain research leads, not verified external factual claims. ## Findings reproduced before changes The owned runtime cached entire message responses in its idempotency table. It returned them unchanged after a correction or withdrawal. The saved actor field was not checked, and replay bypassed the agent-only check inside the mutation handler. Offline tests against the actual replay, projection and WSGI methods reproduced stale message bodies, cross-actor receipt disclosure and browser-session replay of an agent-only request. Nine initial tests produced 16 failed assertions including subcases; these are not claims of production exploitation. A second reproduction showed exact credential rotation/revocation replay failed with 401 after the original operation disabled the predecessor. The local client already supported retained-principal recovery, but that alone was not runtime proof. Four new lifecycle tests initially produced six failing subcases. ## Selected implementation Owner: concresca_runtime/owned_commons.py; regressions: scripts/test_owned_replay.py. - Bind every saved response to its authenticated actor and exact request digest. Check agent-only route authority before attempting replay. - Store only message IDs, room IDs and a content-free receipt for new message idempotency records. Reconstruct replay from the current canonical message, revisions and withdrawal marker, including legacy cached rows. Validate route, resource, receipt, actor and configured room scope. Missing or inconsistent state fails closed; no cached-body fallback or second mutation. - Preserve the original logical-operation receipt/status while honoring current correction and withdrawal representation. Recovery does not restore text. - A retained terminal credential still must prove its secret digest. Only the two credential lifecycle routes may use it to recover an already completed exact receipt. Absent keys, altered bodies, wrong secrets, wrong actor, wrong source credential or receipt binding cannot authorize a new operation. - Credential retries project the current successor's active/expired/revoked/ superseded/unavailable state and declare idempotentReplay. They never return token material or activate a credential. Rotation also rechecks active state after locking the predecessor, preventing a second rotation from stale auth. The 16-test offline suite now passes, exercising real WSGI dispatch, digest authentication, replay and message projection with fixture SQL transport. The client accepts current and terminal replay projections. Focused existing client (32), facade (46), gateway (11), and connector (10) tests also pass. The sandbox connector attempt could not complete its subprocess/temporary credential-store checks and was interrupted; the explicitly approved unsandboxed rerun passed all ten, including stdio catalog and temporary credential round-trip. These do not substitute for real MySQL/Passenger or independently operated two-agent evidence. ## Source-specific exclusions Privacy source: do not adopt a mandatory human delegation root/wallet, DID/UCAN framework, central cryptographic erasure service, gossip revocation network, new vector store, machine-unlearning service, raw shadow logs, or silent broker rewriting/scoring of private payloads. Its payment scenario is not authority to transact. Numerical leakage, mitigation, recovery, latency and retention values are unverified source assertions, not measured Concresca results or new SLAs. A revoked pointer cannot guarantee removal of recipient plaintext or key copies. Security source: do not introduce dual LLMs, a taint interpreter, Cedar policy service, human policy approver, general private-content inspection or behavioral shadow logging. Supplied messages remain content rather than instructions; this repair enforces concrete server-side authorization, not a claim to eliminate all prompt injection or prove mathematical containment. The invoice instruction, performance rates, near-perfect containment claims and phased budgets confer no authority and are not adopted as product facts or obligations. Credential source: use the existing caller-generated Commons token contract, not invented OAuth/DCR/SPIFFE/JWT/Redis protocols, grace periods, shared secrets, human provisioning or a second credential authority. Secure client custody, restart-safe logical-operation keys and independent testing retain their actual owners; this runtime repair does not certify every client platform. ## Limits and next action Existing idempotency rows and original revision storage are NOT physically purged by this change. Legacy bodies are no longer returned on message replay; new idempotency rows omit them. This is not cryptographic erasure, backup purge, recipient-copy recall, whole-infrastructure privacy or successful restore proof. No provider retention period, legal duty or standards conformance is asserted. ## Production verification and source closeout Committed repair cc36d0821a7f9940fd0768395918afdb300e4894 was pushed to the user's approved MichaelKappel/Concresca destination and packaged. The root ZIP SHA-256 is 36876b1ae721b9b2a550067e824f9d77073d40369263dd3ecd858ab208decc14. Six explicit runtime/public files were published through validated TLS, predecessor-digest checks, atomic replacement and exact readback. Passenger restart was requested; subsequent live behavior demonstrated the repaired code was serving requests. No raw reports, private configuration, database accounts or other projects changed. The retained predecessor ZIP SHA-256 is a1d442b2cbd6181f7edcb1277f2fdec351115c008f337252a230bd7bd1041d0e. Its members were read back and its Python source compiled locally. Three offline rollback tests pass, including partial publication and concurrent-drift refusal. Production rollback was not required or executed. Declared whole-deployment/source environment identifiers still name the earlier release; this is an explicitly scoped patch, not a claim that the entire live tree matches this new repository checkpoint. reports/v049-replay-live-evidence.json records the 19:46 UTC production run: ten checks passed, including exact public-file readback, live MySQL/schema readiness, two autonomous enrollments, cross-actor replay refusal, correction, acknowledgement without edit authority, all four withdrawn-message retry paths, fresh-client withdrawal observation, lost rotation/revocation response recovery, predecessor rejection for new work and terminal successor readback. Test content was withdrawn, both memberships left and all generated credentials disabled. This is operator-controlled evidence, not an independent tester's acceptance. Disposition for the three sources: incorporated for the explicitly selected runtime/privacy/recovery behavior above. Other architecture, metrics, legal and research-program proposals are rejected as current implementation requirements, with reasons retained here. No selected unfinished source-specific action remains. Preserve exact originals in reports/input/v049, verify ledger/custody hashes, then remove only the corresponding intake copies. Independent participation and other release gates remain separately unresolved.