From 58a12d258fd9923fca186dbec58e7f4a5605ddf8 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 1 Nov 2026 11:26:26 +0100 Subject: [PATCH 1/3] FLEX-WP-0040-T07: compact-sitting v14 release candidate and founder runbook Values (direct edit; not applied): sitting release -> CI image main-2de0f86 sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776 and the v14 policy path; access-engine twin regenerated for this pin only. The image's policy directory is byte-identical to 2de0f86 and its package digest is sha256:8911458f...0fde. Image in force per FLEX-WP-0034 rev 13 is 6c6dc263 (v13); rollback values are values/informed-decision-lifecycle-review.candidate.yaml. Scan: the same four Go 1.26.7 stdlib HIGH CVEs as the image in force (founder gate in the runbook). Runbook: docs/compact-sitting-v14-release-runbook.md, coordinated with informed-decision's v14 pin. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196 --- docs/compact-sitting-v14-release-runbook.md | 209 ++++++++++++++++++ .../release-candidate-checks.json | 155 +++++++++++++ .../verify-missing-action.request.json | 43 ++++ .../verify-self-approval.request.json | 44 ++++ .../informed-decision-sitting.yaml | 6 +- values/informed-decision-sitting.yaml | 10 +- 6 files changed, 461 insertions(+), 6 deletions(-) create mode 100644 docs/compact-sitting-v14-release-runbook.md create mode 100644 docs/evidence/2026-11-01-compact-sitting-v14/release-candidate-checks.json create mode 100644 docs/evidence/2026-11-01-compact-sitting-v14/verify-missing-action.request.json create mode 100644 docs/evidence/2026-11-01-compact-sitting-v14/verify-self-approval.request.json diff --git a/docs/compact-sitting-v14-release-runbook.md b/docs/compact-sitting-v14-release-runbook.md new file mode 100644 index 0000000..9cee755 --- /dev/null +++ b/docs/compact-sitting-v14-release-runbook.md @@ -0,0 +1,209 @@ +# Runbook: release compact-sitting v14 to `flex-auth-informed-decision-sitting` + +**Date prepared:** 2026-11-01 (owner: access-engine / flex-auth; nothing below has been run) +**Workplan:** `workplans/FLEX-WP-0040-bounded-execution-pdp-gate.md`, FLEX-WP-0040-T07 +**Owner note:** `docs/compact-sitting-v14-present-existing.md` ("Live steps") +**Approval:** founder, 2026-11-01, relayed by the net-kingdom coordinator +**Runs:** the founder, from an access-engine checkout at the commit carrying this file +**Evidence:** `docs/evidence/2026-11-01-compact-sitting-v14/release-candidate-checks.json` + +## Coordinated with informed-decision (same window) + +This release is one half of a pair. informed-decision pins the policy package it +expects (`policy` object of its review runtime: `deploy/lifecycle/service.candidate.json` +`runtime.json` and `deploy/lifecycle/admission.candidate.json`) and compares the +`policy_package` / `policy_version` / `policy_package_digest` of every decision with +that pin. **A version or digest mismatch fails closed**: from the moment this upgrade +completes until the consumer pins v14, every review request is refused, and the reverse +holds if the consumer moves first. Run both in one window, this release first, the +consumer pin immediately after; roll both back together. + +| | before (in force) | after | +| --- | --- | --- | +| package | `informed-decision.compact-sitting` | same | +| version | `v13` | `v14` | +| package_digest | `sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873` | `sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde` | + +The consumer's `approval_action` context change (owner note, "Consumer change required") +is needed only for `service:nk-bind-executor` present-existing requests. Without it those +are refused with `approval_action_not_admitted`; requests for requester +`informed-decision` are unaffected by v14. + +## Release candidate + +| Field | Value | +| --- | --- | +| release / namespace | `flex-auth-informed-decision-sitting` / `flex-auth` | +| chart | `charts/flex-auth` (this checkout) | +| values | `values/informed-decision-sitting.yaml` (edited directly; twin `values/access-engine/informed-decision-sitting.yaml` regenerated, not deployed) | +| image | `forgejo.coulomb.social/coulomb/flex-auth@sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776` | +| image tag / source | `main-2de0f86`, OCI revision label `2de0f862f9875f344f090b633813239a33d63426` (CI `.forgejo/workflows/image.yaml`, push to main) | +| policy | `/opt/flex-auth/examples/informed-decision-present-existing-review/policy.md` (file sha256 `dcfae737…40141`, package digest verified from the image) | +| registry | unchanged path `/opt/flex-auth/examples/informed-decision-lifecycle-review/registry.json` (byte-identical to the present-existing copy) | + +### Gate: image scan (founder decision) + +Trivy (HIGH/CRITICAL) finds four Go stdlib 1.26.7 CVEs in both binaries of the candidate +(CVE-2026-111943, CVE-2026-78667, CVE-2026-78669, CVE-2026-97031; fixed in Go 1.26.9 / +1.26.10). The image in force (`6c6dc263`) has **the same four**, so the candidate does not +regress, but the earlier release bar (zero HIGH/CRITICAL, FLEX-WP-0034) is not met. Either +accept for this release (no regression) or ask the owner for a Go toolchain bump and +rebuild first, which yields a new digest and requires re-running the checks in the evidence +file. Do not proceed without choosing. + +## Image in force (source evidence) + +`values/informed-decision-sitting.yaml` recorded `bdac62bc…` (FLEX-WP-0033 cutover, +2026-10-04) but was never promoted after FLEX-WP-0034. Source evidence says the release +runs `6c6dc263`: + +- FLEX-WP-0034-T02 (2026-10-05): Helm revision 13 deployed with `--atomic` from owner CI + image `6c6dc263` (source f234d01), values `values/informed-decision-lifecycle-review.candidate.yaml` + (commit 941ffa6), consumer pinned v13 `31be5985`. +- `registry/release-units/flex-auth-informed-decision-sitting.yaml` pins the live OCI image + `6c6dc263…168e`. +- FLEX-WP-0038 (2026-10-22): a diff of the values file against live showed the sitting + release "also changes image", i.e. live is not `bdac62bc`; that release was not upgraded. + +So the pre-release state is expected to be: revision 13, image `6c6dc263`, v13 policy at +`…/informed-decision-lifecycle-review/policy.md`, memory request 32Mi. Step 0 confirms it +read-only; if it differs, stop and report. + +## Steps + +```bash +export KUBECONFIG=$HOME/.kube/config-railiance01 +cd ~/access-engine # the commit carrying this runbook +REL=flex-auth-informed-decision-sitting +NS=flex-auth +``` + +### 0. Record the state in force (read-only) + +```bash +helm -n $NS history $REL --max 5 +helm -n $NS get values $REL -o yaml > /tmp/$REL.values-before.yaml +kubectl -n $NS get deploy $REL -o jsonpath='{.spec.template.spec.containers[0].image}{"\n"}{.spec.template.spec.containers[0].args}{"\n"}' +``` + +Expect: last revision `deployed` (13 unless something has run since), image +`…@sha256:6c6dc263f4a7f6461e109e133c004c080e8e373acfead8611856c5fb3e44168e`, `--policy` +`/opt/flex-auth/examples/informed-decision-lifecycle-review/policy.md`. Write down the +revision number as `PREV`; it is the rollback target. If the image differs, stop. + +### 1. Server dry-run and diff (read-only) + +```bash +helm -n $NS upgrade $REL charts/flex-auth -f values/informed-decision-sitting.yaml \ + --dry-run=server > /tmp/$REL.dry-run.txt && echo dry-run-ok +helm template $REL charts/flex-auth -n $NS -f values/informed-decision-sitting.yaml \ + | kubectl -n $NS diff -f - +``` + +Expected diff, Deployment `flex-auth-informed-decision-sitting` only: + +- image `@sha256:6c6dc263…168e` → `@sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776` +- `--policy` `…/informed-decision-lifecycle-review/policy.md` → `…/informed-decision-present-existing-review/policy.md` +- memory request `32Mi` → `40Mi` (FLEX-WP-0038 right-sizing, already in the values file) +- possibly two added args `--caller-audience` `flex-auth` (FLEX-WP-0038 saw this chart + drift). `flex-auth` is the binary's default, so behaviour is unchanged; the consumer's + token audience is untouched. +- possibly Helm-managed labels/annotations (chart version, revision). + +Anything else (NetworkPolicy, RBAC, Service, caller binding, registry path, replicas) means +stop and report to the owner. + +### 2. Upgrade + +```bash +helm -n $NS upgrade $REL charts/flex-auth -f values/informed-decision-sitting.yaml \ + --atomic --wait --timeout 3m +kubectl -n $NS rollout status deploy/$REL --timeout=2m +``` + +`--atomic` reverts to `PREV` by itself if the pod does not become ready. + +### 3. Pin the consumer (informed-decision, same window) + +Per informed-decision's own runbook: set the review runtime's `policy` object to +`informed-decision.compact-sitting` / `v14` / +`sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde` and release it. +Until then review requests fail closed. + +### 4. Verify (read-only decision checks with synthetic claims) + +The service admits only the informed-decision pod and the +`system:serviceaccount:informed-decision:review` caller, so check through a port-forward +with a short-lived token for that ServiceAccount (the documented pattern of +`docs/operator-caller-access-path.md`). Both requests are synthetic and must be **denied**; +no approval or memo is touched. + +```bash +kubectl -n $NS get deploy $REL -o jsonpath='{.spec.template.spec.containers[0].image}{"\n"}' +kubectl -n $NS logs deploy/$REL --tail=20 + +kubectl -n $NS port-forward svc/$REL 18080:8080 >/dev/null 2>&1 & PF=$! +sleep 2 +TOKEN=$(kubectl -n informed-decision create token review --audience=flex-auth --duration=10m) +E=docs/evidence/2026-11-01-compact-sitting-v14 +for f in verify-self-approval verify-missing-action; do + jq --argjson now "$(date +%s)" '.subject.attributes.assurance.at = $now' $E/$f.request.json \ + | curl -s -X POST localhost:18080/v1/check -H "Authorization: Bearer $TOKEN" \ + -H 'Content-Type: application/json' -d @- \ + | jq -c --arg f $f '[$f,.effect,.reason,.provenance.policy_version,.provenance.policy_package_digest]' +done +curl -s -o /dev/null -w 'no-token http %{http_code}\n' -X POST localhost:18080/v1/check \ + -H 'Content-Type: application/json' -d @$E/verify-self-approval.request.json +unset TOKEN; kill $PF +``` + +Expected: + +```text +["verify-self-approval","deny","self_approval_refused","v14","sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde"] +["verify-missing-action","deny","approval_action_not_admitted","v14","sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde"] +no-token http 401 +``` + +(The same two requests against v13 answer `unknown_class`, so these reasons prove v14 is +serving. They were checked offline against the image's own `check` command.) Then confirm +in informed-decision that an ordinary review read for requester `informed-decision` +still succeeds with the v14 pin (its own check). Any other result: roll back. + +### 5. Rollback (both halves) + +```bash +helm -n $NS rollback $REL $PREV --wait --timeout 3m +kubectl -n $NS get deploy $REL -o jsonpath='{.spec.template.spec.containers[0].image}{"\n"}' +``` + +Expect image `@sha256:6c6dc263f4a7f6461e109e133c004c080e8e373acfead8611856c5fb3e44168e` +and the lifecycle-review policy path. Then restore informed-decision's v13 pin +(`v13`, `sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873`). + +Rollback values, if `helm rollback` is unavailable (exact revision-13 values, kept in the +repo): `values/informed-decision-lifecycle-review.candidate.yaml` + +```yaml +image: forgejo.coulomb.social/coulomb/flex-auth@sha256:6c6dc263f4a7f6461e109e133c004c080e8e373acfead8611856c5fb3e44168e +--registry /opt/flex-auth/examples/informed-decision-lifecycle-review/registry.json +--policy /opt/flex-auth/examples/informed-decision-lifecycle-review/policy.md # v13, 31be5985… +resources.requests: cpu 5m, memory 32Mi +``` + +```bash +helm -n $NS upgrade $REL charts/flex-auth -f values/informed-decision-lifecycle-review.candidate.yaml --atomic --wait --timeout 3m +``` + +The candidate image also carries the v13 package unchanged (same path, same digest), so +reverting only `--policy` on the new image is a valid partial rollback if the image itself +is not the problem. + +## After a successful release (owner follow-up) + +- Record the Helm revision and the step-4 output under + `docs/evidence/2026-11-01-compact-sitting-v14/` and mark FLEX-WP-0040-T07 accordingly. +- Update `registry/release-units/flex-auth-informed-decision-sitting.yaml` to the new image + digest and source. +- Keep `values/informed-decision-lifecycle-review.candidate.yaml` as the v13 rollback + reference until the v14 pair has run cleanly. diff --git a/docs/evidence/2026-11-01-compact-sitting-v14/release-candidate-checks.json b/docs/evidence/2026-11-01-compact-sitting-v14/release-candidate-checks.json new file mode 100644 index 0000000..002c189 --- /dev/null +++ b/docs/evidence/2026-11-01-compact-sitting-v14/release-candidate-checks.json @@ -0,0 +1,155 @@ +{ + "scope": "release-candidate artifact checks for compact-sitting v14; read-only, offline (docker create/cp, docker run --network none); not a general security attestation; nothing applied", + "checked_at": "2026-11-01", + "candidate": { + "repository": "forgejo.coulomb.social/coulomb/flex-auth", + "tag": "main-2de0f86", + "immutable_image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776", + "revision_label": "2de0f862f9875f344f090b633813239a33d63426", + "platform": "linux/amd64", + "built_by": ".forgejo/workflows/image.yaml (push to main, examples/** path trigger), tools/publish-runtime-images.sh legacy mode" + }, + "policy_file": { + "path": "/opt/flex-auth/examples/informed-decision-present-existing-review/policy.md", + "file_sha256": "dcfae73726a824795fbb19962116366461cc22813031939f4d8bcc6803f40141", + "equals_source_at": "2de0f86", + "package": "informed-decision.compact-sitting", + "version": "v14", + "package_digest": "sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde", + "package_digest_method": "internal/policy Package.Digest() over the directory copied out of the image (whole directory byte-identical to examples/ at 2de0f86)", + "image_validate": "access-engine validate --kind policy: valid, 46 Rego tests and 4 fixtures pass" + }, + "rollback_policy_in_same_image": { + "path": "/opt/flex-auth/examples/informed-decision-lifecycle-review/policy.md", + "version": "v13", + "package_digest": "sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873" + }, + "registry_file_sha256": "58c308f8abf2e1804b82d7d6247e8f547b1b58ae7050bbd69ba87650a3df2283 (lifecycle-review and present-existing-review copies identical)", + "offline_verify_requests": { + "verify-self-approval.request.json": { + "v14": "deny self_approval_refused", + "v13": "deny unknown_class" + }, + "verify-missing-action.request.json": { + "v14": "deny approval_action_not_admitted", + "v13": "deny unknown_class" + }, + "note": "subject.attributes.assurance.at must be set to the current epoch at run time (jq), otherwise both answer identity_refused" + }, + "scan": { + "scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969", + "severities": [ + "HIGH", + "CRITICAL" + ], + "candidate": { + "image_id": "sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776", + "vulnerabilities": 8, + "findings": [ + { + "target": "usr/local/bin/access-engine", + "id": "CVE-2026-111943", + "pkg": "stdlib", + "installed": "v1.26.7", + "fixed": "1.26.10, 1.27.3", + "severity": "HIGH" + }, + { + "target": "usr/local/bin/access-engine", + "id": "CVE-2026-78667", + "pkg": "stdlib", + "installed": "v1.26.7", + "fixed": "1.26.9, 1.27.2", + "severity": "HIGH" + }, + { + "target": "usr/local/bin/access-engine", + "id": "CVE-2026-78669", + "pkg": "stdlib", + "installed": "v1.26.7", + "fixed": "1.26.9, 1.27.2", + "severity": "HIGH" + }, + { + "target": "usr/local/bin/access-engine", + "id": "CVE-2026-97031", + "pkg": "stdlib", + "installed": "v1.26.7", + "fixed": "1.26.9, 1.27.2", + "severity": "HIGH" + }, + { + "target": "usr/local/bin/flex-auth", + "id": "CVE-2026-111943", + "pkg": "stdlib", + "installed": "v1.26.7", + "fixed": "1.26.10, 1.27.3", + "severity": "HIGH" + }, + { + "target": "usr/local/bin/flex-auth", + "id": "CVE-2026-78667", + "pkg": "stdlib", + "installed": "v1.26.7", + "fixed": "1.26.9, 1.27.2", + "severity": "HIGH" + }, + { + "target": "usr/local/bin/flex-auth", + "id": "CVE-2026-78669", + "pkg": "stdlib", + "installed": "v1.26.7", + "fixed": "1.26.9, 1.27.2", + "severity": "HIGH" + }, + { + "target": "usr/local/bin/flex-auth", + "id": "CVE-2026-97031", + "pkg": "stdlib", + "installed": "v1.26.7", + "fixed": "1.26.9, 1.27.2", + "severity": "HIGH" + } + ] + }, + "in_force_6c6dc263": { + "image_id": "sha256:6c6dc263f4a7f6461e109e133c004c080e8e373acfead8611856c5fb3e44168e", + "vulnerabilities": 4, + "findings": [ + { + "target": "usr/local/bin/flex-auth", + "id": "CVE-2026-111943", + "pkg": "stdlib", + "installed": "v1.26.7", + "fixed": "1.26.10, 1.27.3", + "severity": "HIGH" + }, + { + "target": "usr/local/bin/flex-auth", + "id": "CVE-2026-78667", + "pkg": "stdlib", + "installed": "v1.26.7", + "fixed": "1.26.9, 1.27.2", + "severity": "HIGH" + }, + { + "target": "usr/local/bin/flex-auth", + "id": "CVE-2026-78669", + "pkg": "stdlib", + "installed": "v1.26.7", + "fixed": "1.26.9, 1.27.2", + "severity": "HIGH" + }, + { + "target": "usr/local/bin/flex-auth", + "id": "CVE-2026-97031", + "pkg": "stdlib", + "installed": "v1.26.7", + "fixed": "1.26.9, 1.27.2", + "severity": "HIGH" + } + ] + }, + "assessment": "Same four Go stdlib 1.26.7 CVEs (HIGH) in candidate and in the image in force; OS layer clean. The candidate does not regress, but the previous release gate (zero HIGH/CRITICAL) is not met. Fix = Go >= 1.26.10 toolchain bump and a rebuild (new digest). Founder decides." + } +} diff --git a/docs/evidence/2026-11-01-compact-sitting-v14/verify-missing-action.request.json b/docs/evidence/2026-11-01-compact-sitting-v14/verify-missing-action.request.json new file mode 100644 index 0000000..78883de --- /dev/null +++ b/docs/evidence/2026-11-01-compact-sitting-v14/verify-missing-action.request.json @@ -0,0 +1,43 @@ +{ + "id": "v14-verify-missing-action", + "tenant": "tenant:platform", + "subject": { + "id": "founder-human", + "type": "human", + "tenant": "tenant:platform", + "attributes": { + "principal_type_source": "authentication-derived", + "tenant_source": "registration-supplied", + "groups": [ + "net-kingdom-admins" + ], + "assurance": { + "level": "aal2", + "mfa": true, + "source": "key-cape", + "methods": [ + "pwd", + "otp" + ], + "at": 0 + } + } + }, + "resource": { + "id": "memo:v14-release-verify", + "type": "decision-memo", + "system": "informed-decision", + "tenant": "tenant:platform" + }, + "action": "read", + "context": { + "review_group": "net-kingdom-admins", + "memo_class": "bounded-execution", + "intake_submitter": "nk-bind-executor", + "approval_requester": "service:nk-bind-executor", + "approval_human_control": true, + "memo_version": 1, + "approval_id": "00000000-0000-4000-8000-000000000014", + "approval_binding_digest": "sha256:0000000000000000000000000000000000000000000000000000000000000000" + } +} diff --git a/docs/evidence/2026-11-01-compact-sitting-v14/verify-self-approval.request.json b/docs/evidence/2026-11-01-compact-sitting-v14/verify-self-approval.request.json new file mode 100644 index 0000000..c6c4031 --- /dev/null +++ b/docs/evidence/2026-11-01-compact-sitting-v14/verify-self-approval.request.json @@ -0,0 +1,44 @@ +{ + "id": "v14-verify-self-approval", + "tenant": "tenant:platform", + "subject": { + "id": "service:nk-bind-executor", + "type": "human", + "tenant": "tenant:platform", + "attributes": { + "principal_type_source": "authentication-derived", + "tenant_source": "registration-supplied", + "groups": [ + "net-kingdom-admins" + ], + "assurance": { + "level": "aal2", + "mfa": true, + "source": "key-cape", + "methods": [ + "pwd", + "otp" + ], + "at": 0 + } + } + }, + "resource": { + "id": "memo:v14-release-verify", + "type": "decision-memo", + "system": "informed-decision", + "tenant": "tenant:platform" + }, + "action": "read", + "context": { + "review_group": "net-kingdom-admins", + "memo_class": "bounded-execution", + "intake_submitter": "nk-bind-executor", + "approval_requester": "service:nk-bind-executor", + "approval_human_control": true, + "approval_action": "bounded-execution", + "memo_version": 1, + "approval_id": "00000000-0000-4000-8000-000000000014", + "approval_binding_digest": "sha256:0000000000000000000000000000000000000000000000000000000000000000" + } +} diff --git a/values/access-engine/informed-decision-sitting.yaml b/values/access-engine/informed-decision-sitting.yaml index 7a3a9e9..ba4a340 100644 --- a/values/access-engine/informed-decision-sitting.yaml +++ b/values/access-engine/informed-decision-sitting.yaml @@ -2,7 +2,7 @@ name: access-engine-informed-decision-sitting image: repository: forgejo.coulomb.social/coulomb/flex-auth - digest: sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99 + digest: sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776 args: - serve - --addr @@ -10,7 +10,7 @@ args: - --registry - /opt/flex-auth/examples/informed-decision-lifecycle-review/registry.json - --policy -- /opt/flex-auth/examples/informed-decision-lifecycle-review/policy.md +- /opt/flex-auth/examples/informed-decision-present-existing-review/policy.md callerAuth: mode: enforce kubernetesURL: https://10.43.0.1 @@ -23,7 +23,7 @@ consumer: resources: requests: cpu: 5m - memory: 32Mi + memory: 40Mi limits: cpu: 300m memory: 192Mi diff --git a/values/informed-decision-sitting.yaml b/values/informed-decision-sitting.yaml index 3a8ee66..6cf60ae 100644 --- a/values/informed-decision-sitting.yaml +++ b/values/informed-decision-sitting.yaml @@ -1,8 +1,12 @@ -# Founder-approved INFD-WP-0007 / FLEX-WP-0033 cutover, 2026-10-04. +# FLEX-WP-0040-T07 release candidate (founder-approved 2026-11-01; NOT yet applied): +# compact-sitting v14 sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde, +# CI image main-2de0f86. Runbook: docs/compact-sitting-v14-release-runbook.md. +# In force before this release (Helm rev 13, FLEX-WP-0034, v13): image 6c6dc263...168e, +# exact values values/informed-decision-lifecycle-review.candidate.yaml (rollback). name: flex-auth-informed-decision-sitting image: repository: forgejo.coulomb.social/coulomb/flex-auth - digest: sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99 + digest: sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776 args: - serve - --addr @@ -10,7 +14,7 @@ args: - --registry - /opt/flex-auth/examples/informed-decision-lifecycle-review/registry.json - --policy -- /opt/flex-auth/examples/informed-decision-lifecycle-review/policy.md +- /opt/flex-auth/examples/informed-decision-present-existing-review/policy.md callerAuth: mode: enforce kubernetesURL: https://10.43.0.1 From ff5d0643fa6cfad8857d0df97d6c434e1694c632 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 1 Nov 2026 11:45:36 +0100 Subject: [PATCH 2/3] FLEX-WP-0040-T07: sitting pin test follows the v14 release candidate values 58a12d2 moved values/informed-decision-sitting.yaml to the v14 candidate image and policy path; TestSittingImagePinMatchesRecordedBuild still asserted the 2026-10-04 bdac62bc cutover pin. It now asserts the recorded candidate. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196 --- internal/policy/informed_decision_attribute_test.go | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/internal/policy/informed_decision_attribute_test.go b/internal/policy/informed_decision_attribute_test.go index 9346f6c..321e35b 100644 --- a/internal/policy/informed_decision_attribute_test.go +++ b/internal/policy/informed_decision_attribute_test.go @@ -102,12 +102,14 @@ func TestSittingImagePinMatchesRecordedBuild(t *testing.T) { } text := string(raw) // values/informed-decision-sitting.yaml records the founder-approved - // INFD-WP-0007 / FLEX-WP-0033 cutover image of 2026-10-04 (64a22ab), which - // serves the lifecycle-review package. The v11 pin (1aae59f) is superseded. - if !strings.Contains(text, "sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99") { - t.Fatal("sitting image digest differs from the recorded cutover build") + // FLEX-WP-0040-T07 compact-sitting v14 release candidate (CI image of + // 2de0f86, docs/compact-sitting-v14-release-runbook.md). The FLEX-WP-0034 + // v13 image (6c6dc263) is the rollback, kept in + // values/informed-decision-lifecycle-review.candidate.yaml. + if !strings.Contains(text, "sha256:154726d25ba2ce88ef41551dcb3bb395557095eff19e767a29d0331fafec4776") { + t.Fatal("sitting image digest differs from the recorded release candidate build") } - if !strings.Contains(text, "/opt/flex-auth/examples/informed-decision-lifecycle-review/policy.md") { + if !strings.Contains(text, "/opt/flex-auth/examples/informed-decision-present-existing-review/policy.md") { t.Fatal("sitting policy path changed") } } From f4c9f2beeb92d1639eebce7d6fbef60ea3f4db81 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 1 Nov 2026 11:45:39 +0100 Subject: [PATCH 3/3] FLEX-WP-0040-T07: build with Go 1.26.10 (stdlib HIGH CVEs) Founder decision 2026-11-01: the v14 release must meet the zero HIGH/CRITICAL bar. Trivy found CVE-2026-111943, -78667, -78669 and -97031 in Go stdlib 1.26.7 (fixed in 1.26.9/1.26.10). Builder image golang:1.26.10-alpine (index sha256:a2012b4a1d1f9f7e9f44e0d39b805a901e856b1dd80b4e6ee4338db547050308) and go.mod go 1.26.10; runtime base unchanged. make test (race), go vet and both compact-sitting policy packages (v14 46 tests, v13 32 tests) pass on go1.26.10. Containerfile and go.mod trigger .forgejo/workflows/image.yaml. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196 --- Containerfile | 2 +- go.mod | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Containerfile b/Containerfile index 56ba921..38696b3 100644 --- a/Containerfile +++ b/Containerfile @@ -1,4 +1,4 @@ -FROM golang:1.26.7-alpine@sha256:28d89ee9cc0ff9fec75c82ca201e6bf7fdf9a679d4b7b24dfa04f2bb766bb468 AS build +FROM golang:1.26.10-alpine@sha256:a2012b4a1d1f9f7e9f44e0d39b805a901e856b1dd80b4e6ee4338db547050308 AS build WORKDIR /src COPY go.mod go.sum ./ # Portable, unchanged Approval-owner pure data helper; available before download. diff --git a/go.mod b/go.mod index 86a6104..1974efc 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/netkingdom/access-engine -go 1.26.7 +go 1.26.10 require ( github.com/netkingdom/approval-engine/adapters/go/approvalfact v0.0.0