coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Pin lifecycle delivery to scanned commit-built policy image
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
This commit is contained in:
tegwick 2026-10-04 21:46:32 +02:00
parent 7f96c7075e
commit 726e6e369b
4 changed files with 17 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

13
docs/evidence/2026-10-04-infd-lifecycle/policy-scan.json
View file

@ -1,17 +1,20 @@
{
"scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
"scanner_version": "0.74.0",
"scanned_at": "2026-10-04T19:35:45.454792771Z",
"artifact": "flex-auth:wp0007-candidate",
"image_id": "sha256:f6ed8af69af766d7e9498465a23c292d91185b79352065736a2132216aac1d37",
"scanned_at": "2026-10-04T19:45:06.255864835Z",
"artifact": "forgejo.coulomb.social/coulomb/flex-auth:main-d2d0b6f",
"image_id": "sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99",
"severities": [
"HIGH",
"CRITICAL"
],
"vulnerabilities": 0,
"full_report_sha256": "e41d19c961f0e0d3a4051362c6769edc3069b4286612239861818d403c16ee6a",
"full_report_sha256": "a3f2cefbef113ea150072efacfefbe9d6f0195bb7cf728776eac136fc8995466",
"warnings": [
"vendor severity selection"
],
"scope": "candidate artifact scan; not a general security attestation"
"scope": "candidate artifact scan; not a general security attestation",
"source_commit": "d2d0b6feeb",
"build_url": "https://forgejo.coulomb.social/coulomb/access-engine/actions/runs/316",
"immutable_image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99"
}

2
values/informed-decision-lifecycle-review.candidate.yaml
View file

@ -2,7 +2,7 @@
name: flex-auth-informed-decision-sitting
image:
repository: forgejo.coulomb.social/coulomb/flex-auth
digest: sha256:f6ed8af69af766d7e9498465a23c292d91185b79352065736a2132216aac1d37
digest: sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99
args:
- serve
- --addr

2
values/informed-decision-lifecycle.candidate.yaml
View file

@ -2,7 +2,7 @@
name: flex-auth-informed-decision-lifecycle
image:
repository: forgejo.coulomb.social/coulomb/flex-auth
digest: sha256:f6ed8af69af766d7e9498465a23c292d91185b79352065736a2132216aac1d37
digest: sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99
args:
- serve
- --addr

8
workplans/FLEX-WP-0033-informed-decision-lifecycle.md
View file

@ -14,7 +14,7 @@ state_hub_workstream_id: "cc97d906-68df-537c-a88f-fb2dcf7285c9"
---
Founder selected net-kingdom-admins humans and the State Hub workload for the
first release. Source work is on infd-wp0007-lifecycle; no live grants applied.
first release. Source work was prepared in an isolated checkout and pushed to main; no live grants applied.
## Define and prove the initial lifecycle authorization contract
@ -100,3 +100,9 @@ The existing chart's port-only API egress, advisory CARING dimensions and unsign
consumer assertions are explicitly retained limitations, not newly enforced
controls. T04 remains open; requester projection and State Hub production
forwarding also remain prerequisites in their owner workplans.
Forgejo run 316 built committed source d2d0b6f. Final candidate values now pin
forgejo.coulomb.social/coulomb/flex-auth@sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99
This supersedes the local candidate above for rollout. Both embedded packages
validate in the CI artifact. No deployed values or cluster objects changed.