coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
access-engine/values/informed-decision-sitting.yaml

33 lines
1.1 KiB
YAML
Raw Normal View History

FLEX-WP-0040-T07: compact-sitting v14 release candidate and founder runbook Values (direct edit; not applied): sitting release -> CI image main-2de0f86 sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776 and the v14 policy path; access-engine twin regenerated for this pin only. The image's policy directory is byte-identical to 2de0f86 and its package digest is sha256:8911458f...0fde. Image in force per FLEX-WP-0034 rev 13 is 6c6dc263 (v13); rollback values are values/informed-decision-lifecycle-review.candidate.yaml. Scan: the same four Go 1.26.7 stdlib HIGH CVEs as the image in force (founder gate in the runbook). Runbook: docs/compact-sitting-v14-release-runbook.md, coordinated with informed-decision's v14 pin. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
2026-11-01 11:26:26 +01:00
# FLEX-WP-0040-T07 release candidate (founder-approved 2026-11-01; NOT yet applied):
# compact-sitting v14 sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde,
FLEX-WP-0040-T07: v14 release candidate is the Go 1.26.10 image (main-f4c9f2b) Candidate image forgejo.coulomb.social/coulomb/flex-auth@sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c (revision label f4c9f2b). Read-only checks: v14 and v13 policy directories byte-identical to source, package digests 8911458f (v14) and 31be5985 (v13), in-image validate 46/46 and 32/32, offline verify requests answer self_approval_refused / approval_action_not_admitted on v14, Trivy HIGH/CRITICAL = 0 (same pinned scanner). Values, twin, pin test, runbook (scan gate passed; informed-decision side ready at RELEASE_SHA 005709a3, image ca75f0be, carrying 80ef840) and evidence move to this digest; the 154726d2 image is superseded. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
2026-11-01 11:55:27 +01:00
# CI image main-f4c9f2b (Go 1.26.10). Runbook: docs/compact-sitting-v14-release-runbook.md.
FLEX-WP-0040-T07: compact-sitting v14 release candidate and founder runbook Values (direct edit; not applied): sitting release -> CI image main-2de0f86 sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776 and the v14 policy path; access-engine twin regenerated for this pin only. The image's policy directory is byte-identical to 2de0f86 and its package digest is sha256:8911458f...0fde. Image in force per FLEX-WP-0034 rev 13 is 6c6dc263 (v13); rollback values are values/informed-decision-lifecycle-review.candidate.yaml. Scan: the same four Go 1.26.7 stdlib HIGH CVEs as the image in force (founder gate in the runbook). Runbook: docs/compact-sitting-v14-release-runbook.md, coordinated with informed-decision's v14 pin. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
2026-11-01 11:26:26 +01:00
# In force before this release (Helm rev 13, FLEX-WP-0034, v13): image 6c6dc263...168e,
# exact values values/informed-decision-lifecycle-review.candidate.yaml (rollback).
Compile compact sitting review package without widening T03. Seven exact-record pins from the 2026-09-15 sitting-create receipt. c01 is omitted. Identity bar matches T03. 147 local evaluator checks pass. Deploy waits on a CI image that contains the new package. Assistant: grok Assistant-Session: 01a0a6cb-0334-72c0-83b0-2df57474a0f6
2026-09-15 22:45:46 +02:00
name: flex-auth-informed-decision-sitting
image:
repository: forgejo.coulomb.social/coulomb/flex-auth
FLEX-WP-0040-T07: v14 release candidate is the Go 1.26.10 image (main-f4c9f2b) Candidate image forgejo.coulomb.social/coulomb/flex-auth@sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c (revision label f4c9f2b). Read-only checks: v14 and v13 policy directories byte-identical to source, package digests 8911458f (v14) and 31be5985 (v13), in-image validate 46/46 and 32/32, offline verify requests answer self_approval_refused / approval_action_not_admitted on v14, Trivy HIGH/CRITICAL = 0 (same pinned scanner). Values, twin, pin test, runbook (scan gate passed; informed-decision side ready at RELEASE_SHA 005709a3, image ca75f0be, carrying 80ef840) and evidence move to this digest; the 154726d2 image is superseded. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
2026-11-01 11:55:27 +01:00
digest: sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c
Compile compact sitting review package without widening T03. Seven exact-record pins from the 2026-09-15 sitting-create receipt. c01 is omitted. Identity bar matches T03. 147 local evaluator checks pass. Deploy waits on a CI image that contains the new package. Assistant: grok Assistant-Session: 01a0a6cb-0334-72c0-83b0-2df57474a0f6
2026-09-15 22:45:46 +02:00
args:
Promote approved lifecycle and review policy values Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
2026-10-04 23:54:27 +02:00
- serve
- --addr
- 0.0.0.0:8080
- --registry
- /opt/flex-auth/examples/informed-decision-lifecycle-review/registry.json
- --policy
FLEX-WP-0040-T07: compact-sitting v14 release candidate and founder runbook Values (direct edit; not applied): sitting release -> CI image main-2de0f86 sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776 and the v14 policy path; access-engine twin regenerated for this pin only. The image's policy directory is byte-identical to 2de0f86 and its package digest is sha256:8911458f...0fde. Image in force per FLEX-WP-0034 rev 13 is 6c6dc263 (v13); rollback values are values/informed-decision-lifecycle-review.candidate.yaml. Scan: the same four Go 1.26.7 stdlib HIGH CVEs as the image in force (founder gate in the runbook). Runbook: docs/compact-sitting-v14-release-runbook.md, coordinated with informed-decision's v14 pin. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
2026-11-01 11:26:26 +01:00
- /opt/flex-auth/examples/informed-decision-present-existing-review/policy.md
Compile compact sitting review package without widening T03. Seven exact-record pins from the 2026-09-15 sitting-create receipt. c01 is omitted. Identity bar matches T03. 147 local evaluator checks pass. Deploy waits on a CI image that contains the new package. Assistant: grok Assistant-Session: 01a0a6cb-0334-72c0-83b0-2df57474a0f6
2026-09-15 22:45:46 +02:00
callerAuth:
mode: enforce
kubernetesURL: https://10.43.0.1
binding: informed-decision=system:serviceaccount:informed-decision:review
consumer:
isolated: false
namespace: informed-decision
podName: informed-decision
resources:
Promote approved lifecycle and review policy values Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
2026-10-04 23:54:27 +02:00
requests:
cpu: 5m
Wave-2 right-sizing: flex-auth requests 145m/288Mi -> 45m/204Mi across 9 releases (FLEX-WP-0038) Chart default request 25m/32Mi -> 5m/20Mi (user-engine, tenant-engine, ops-warden, ops-warden-fetch, secrets-engine); overrides keep 5m CPU with memory by 7d p95 x1.15: application-readback 24Mi, informed-decision-lifecycle 24Mi, informed-decision-sitting 40Mi (p95 35Mi, up from 32Mi), informed-decision-t03 16Mi. Limits unchanged. Evidence: resource-control 2026-10-21 node budget (3d9b1bd). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 276069@bnt-lap001 Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
2026-10-22 00:08:03 +02:00
memory: 40Mi
Promote approved lifecycle and review policy values Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
2026-10-04 23:54:27 +02:00
limits:
cpu: 300m
memory: 192Mi
Reference in a new issue Copy permalink