coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

FLEX-WP-0040-T07: compact-sitting v14 release candidate and founder runbook

Browse source 
Values (direct edit; not applied): sitting release -> CI image main-2de0f86
sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776 and the
v14 policy path; access-engine twin regenerated for this pin only. The image's
policy directory is byte-identical to 2de0f86 and its package digest is
sha256:8911458f...0fde. Image in force per FLEX-WP-0034 rev 13 is 6c6dc263
(v13); rollback values are values/informed-decision-lifecycle-review.candidate.yaml.
Scan: the same four Go 1.26.7 stdlib HIGH CVEs as the image in force (founder
gate in the runbook). Runbook: docs/compact-sitting-v14-release-runbook.md,
coordinated with informed-decision's v14 pin.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
This commit is contained in:
tegwick 2026-11-01 11:26:26 +01:00
parent 2cdce7eb8a
commit 58a12d258f
6 changed files with 461 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

155
docs/evidence/2026-11-01-compact-sitting-v14/release-candidate-checks.json Normal file
View file

@ -0,0 +1,155 @@
{
"scope": "release-candidate artifact checks for compact-sitting v14; read-only, offline (docker create/cp, docker run --network none); not a general security attestation; nothing applied",
"checked_at": "2026-11-01",
"candidate": {
"repository": "forgejo.coulomb.social/coulomb/flex-auth",
"tag": "main-2de0f86",
"immutable_image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776",
"revision_label": "2de0f862f9875f344f090b633813239a33d63426",
"platform": "linux/amd64",
"built_by": ".forgejo/workflows/image.yaml (push to main, examples/** path trigger), tools/publish-runtime-images.sh legacy mode"
},
"policy_file": {
"path": "/opt/flex-auth/examples/informed-decision-present-existing-review/policy.md",
"file_sha256": "dcfae73726a824795fbb19962116366461cc22813031939f4d8bcc6803f40141",
"equals_source_at": "2de0f86",
"package": "informed-decision.compact-sitting",
"version": "v14",
"package_digest": "sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde",
"package_digest_method": "internal/policy Package.Digest() over the directory copied out of the image (whole directory byte-identical to examples/ at 2de0f86)",
"image_validate": "access-engine validate --kind policy: valid, 46 Rego tests and 4 fixtures pass"
},
"rollback_policy_in_same_image": {
"path": "/opt/flex-auth/examples/informed-decision-lifecycle-review/policy.md",
"version": "v13",
"package_digest": "sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873"
},
"registry_file_sha256": "58c308f8abf2e1804b82d7d6247e8f547b1b58ae7050bbd69ba87650a3df2283 (lifecycle-review and present-existing-review copies identical)",
"offline_verify_requests": {
"verify-self-approval.request.json": {
"v14": "deny self_approval_refused",
"v13": "deny unknown_class"
},
"verify-missing-action.request.json": {
"v14": "deny approval_action_not_admitted",
"v13": "deny unknown_class"
},
"note": "subject.attributes.assurance.at must be set to the current epoch at run time (jq), otherwise both answer identity_refused"
},
"scan": {
"scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
"severities": [
"HIGH",
"CRITICAL"
],
"candidate": {
"image_id": "sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776",
"vulnerabilities": 8,
"findings": [
{
"target": "usr/local/bin/access-engine",
"id": "CVE-2026-111943",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.10, 1.27.3",
"severity": "HIGH"
},
{
"target": "usr/local/bin/access-engine",
"id": "CVE-2026-78667",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.9, 1.27.2",
"severity": "HIGH"
},
{
"target": "usr/local/bin/access-engine",
"id": "CVE-2026-78669",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.9, 1.27.2",
"severity": "HIGH"
},
{
"target": "usr/local/bin/access-engine",
"id": "CVE-2026-97031",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.9, 1.27.2",
"severity": "HIGH"
},
{
"target": "usr/local/bin/flex-auth",
"id": "CVE-2026-111943",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.10, 1.27.3",
"severity": "HIGH"
},
{
"target": "usr/local/bin/flex-auth",
"id": "CVE-2026-78667",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.9, 1.27.2",
"severity": "HIGH"
},
{
"target": "usr/local/bin/flex-auth",
"id": "CVE-2026-78669",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.9, 1.27.2",
"severity": "HIGH"
},
{
"target": "usr/local/bin/flex-auth",
"id": "CVE-2026-97031",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.9, 1.27.2",
"severity": "HIGH"
}
]
},
"in_force_6c6dc263": {
"image_id": "sha256:6c6dc263f4a7f6461e109e133c004c080e8e373acfead8611856c5fb3e44168e",
"vulnerabilities": 4,
"findings": [
{
"target": "usr/local/bin/flex-auth",
"id": "CVE-2026-111943",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.10, 1.27.3",
"severity": "HIGH"
},
{
"target": "usr/local/bin/flex-auth",
"id": "CVE-2026-78667",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.9, 1.27.2",
"severity": "HIGH"
},
{
"target": "usr/local/bin/flex-auth",
"id": "CVE-2026-78669",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.9, 1.27.2",
"severity": "HIGH"
},
{
"target": "usr/local/bin/flex-auth",
"id": "CVE-2026-97031",
"pkg": "stdlib",
"installed": "v1.26.7",
"fixed": "1.26.9, 1.27.2",
"severity": "HIGH"
}
]
},
"assessment": "Same four Go stdlib 1.26.7 CVEs (HIGH) in candidate and in the image in force; OS layer clean. The candidate does not regress, but the previous release gate (zero HIGH/CRITICAL) is not met. Fix = Go >= 1.26.10 toolchain bump and a rebuild (new digest). Founder decides."
}
}

43
docs/evidence/2026-11-01-compact-sitting-v14/verify-missing-action.request.json Normal file
View file

@ -0,0 +1,43 @@
{
"id": "v14-verify-missing-action",
"tenant": "tenant:platform",
"subject": {
"id": "founder-human",
"type": "human",
"tenant": "tenant:platform",
"attributes": {
"principal_type_source": "authentication-derived",
"tenant_source": "registration-supplied",
"groups": [
"net-kingdom-admins"
],
"assurance": {
"level": "aal2",
"mfa": true,
"source": "key-cape",
"methods": [
"pwd",
"otp"
],
"at": 0
}
}
},
"resource": {
"id": "memo:v14-release-verify",
"type": "decision-memo",
"system": "informed-decision",
"tenant": "tenant:platform"
},
"action": "read",
"context": {
"review_group": "net-kingdom-admins",
"memo_class": "bounded-execution",
"intake_submitter": "nk-bind-executor",
"approval_requester": "service:nk-bind-executor",
"approval_human_control": true,
"memo_version": 1,
"approval_id": "00000000-0000-4000-8000-000000000014",
"approval_binding_digest": "sha256:0000000000000000000000000000000000000000000000000000000000000000"
}
}

44
docs/evidence/2026-11-01-compact-sitting-v14/verify-self-approval.request.json Normal file
View file

@ -0,0 +1,44 @@
{
"id": "v14-verify-self-approval",
"tenant": "tenant:platform",
"subject": {
"id": "service:nk-bind-executor",
"type": "human",
"tenant": "tenant:platform",
"attributes": {
"principal_type_source": "authentication-derived",
"tenant_source": "registration-supplied",
"groups": [
"net-kingdom-admins"
],
"assurance": {
"level": "aal2",
"mfa": true,
"source": "key-cape",
"methods": [
"pwd",
"otp"
],
"at": 0
}
}
},
"resource": {
"id": "memo:v14-release-verify",
"type": "decision-memo",
"system": "informed-decision",
"tenant": "tenant:platform"
},
"action": "read",
"context": {
"review_group": "net-kingdom-admins",
"memo_class": "bounded-execution",
"intake_submitter": "nk-bind-executor",
"approval_requester": "service:nk-bind-executor",
"approval_human_control": true,
"approval_action": "bounded-execution",
"memo_version": 1,
"approval_id": "00000000-0000-4000-8000-000000000014",
"approval_binding_digest": "sha256:0000000000000000000000000000000000000000000000000000000000000000"
}
}