From 0b30bfb08cb59b09fc6c6e5cf6da9bd0c126b24e Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 11 Sep 2026 14:23:07 +0200 Subject: [PATCH] Record native sender acceptance and retained audit readback gate Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc --- .../2026-09-11-factory-native-producers.json | 488 ++++++++++++++++++ ...AUDIT-WP-0009-evidence-role-conformance.md | 49 ++ 2 files changed, 537 insertions(+) create mode 100644 docs/evidence/2026-09-11-factory-native-producers.json diff --git a/docs/evidence/2026-09-11-factory-native-producers.json b/docs/evidence/2026-09-11-factory-native-producers.json new file mode 100644 index 0000000..5625cd7 --- /dev/null +++ b/docs/evidence/2026-09-11-factory-native-producers.json @@ -0,0 +1,488 @@ +{ + "schema": "helixforge.native-audit-producer-return.v1", + "observed_at": "2026-09-11T12:19:49.844051+00:00", + "status": "native_sender_checks_passed_pending_independent_readback", + "platform_execution_commit": "9654f9e8cf039e267f66c61869a073b20a947610", + "native_success": { + "schema": "platform.factory-native-acceptance-receipt.v1", + "status": "native_sender_checks_passed_pending_independent_readback", + "credential_values_emitted": false, + "started_at": "2026-09-11T10:42:09.254002+00:00", + "run_id": "factory-audit-20260911104152-94aced", + "packet_sha256": "5e8a20e29fb309924005a061939c94d8a40815126c44654b6daeb8adf18424c7", + "source_commits": { + "approval-engine": [ + "a0a602976eef818f36dde35f76f7f2e589bd051b", + "approval_engine" + ], + "informed-decision": [ + "1a122235741d61b649e39ab86ddfbd317e54ad2f", + "informed_decision" + ] + }, + "receiver_before": { + "image": "forgejo.coulomb.social/coulomb/audit-core@sha256:c82e0442de0fd181342916ae9cd5d6de41d859e1efda637bd93936c67873afa5", + "deployment_uid": "b85fe3d0-75c9-4e0d-8c34-c6f1df0881bb", + "deployment_resource_version": "59845369", + "pod_uid": "4d0ee4e5-5427-43f1-94ca-88e5470c4831", + "capabilities": { + "load_bearing": true, + "redact": true, + "write_only": true, + "source_exact": true, + "tenant_exact": true + }, + "synthetic_probe_only": true, + "credential_reads": 0 + }, + "phase": "sender_checks_complete", + "operator_registry_reads": 0, + "created_objects": [ + { + "kind": "ConfigMap", + "name": "factory-audit-20260911104152-94aced", + "namespace": "approval-engine", + "uid": "e847feeb-f847-480a-b4d0-cfc63ddeda94" + }, + { + "kind": "NetworkPolicy", + "name": "factory-audit-20260911104152-94aced", + "namespace": "approval-engine", + "uid": "3cfeab0f-9495-4ac3-916e-4f8ffa7a5b10" + }, + { + "kind": "Job", + "name": "factory-audit-20260911104152-94aced", + "namespace": "approval-engine", + "uid": "42a23f42-657b-4077-8935-6b8315711416" + }, + { + "kind": "ConfigMap", + "name": "factory-audit-20260911104152-94aced", + "namespace": "informed-decision", + "uid": "ed443945-66aa-48db-88c6-f176b5c66c70" + }, + { + "kind": "NetworkPolicy", + "name": "factory-audit-20260911104152-94aced", + "namespace": "informed-decision", + "uid": "21bc3c88-5515-4923-b675-f3648f621e4c" + }, + { + "kind": "Job", + "name": "factory-audit-20260911104152-94aced", + "namespace": "informed-decision", + "uid": "8da3c95a-b194-4acd-aad4-2b0ac1004dbd" + } + ], + "producers": [ + { + "credential_values_emitted": false, + "domain_transaction_atomicity_tested": false, + "event_id": "factory-audit-20260911104152-94aced-approval-engine", + "http_statuses": [ + 202, + 200 + ], + "human_binding_tested": false, + "negatives": { + "audit_bearer_revocation_tested": false, + "invalid_bearer_denied": 401, + "own_reconciliation": true, + "probe_count": 1, + "read_routes_denied": 7, + "sibling_reconciliation_denied": true, + "source_denied": 400, + "tenant_denied": 400 + }, + "phase": "restart-retry", + "process_restart_retry": true, + "producer_service_deployed": false, + "run_id": "factory-audit-20260911104152-94aced", + "sender": "approval-engine", + "source_zip_sha256": "114215406400f6f5728520bf3d7dc2b7a4ff410784b80201b7a5ae24259f64c0", + "status": "passed", + "synthetic_outbox_only": true, + "pod_uid": "27517b95-091f-405c-9185-2fad1678097f", + "image": "forgejo.coulomb.social/coulomb/approval-engine@sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49", + "runtime_image_id": "forgejo.coulomb.social/coulomb/approval-engine@sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49" + }, + { + "credential_values_emitted": false, + "domain_transaction_atomicity_tested": false, + "event_id": "factory-audit-20260911104152-94aced-informed-decision", + "http_statuses": [ + 202, + 200 + ], + "human_binding_tested": false, + "negatives": { + "audit_bearer_revocation_tested": false, + "invalid_bearer_denied": 401, + "own_reconciliation": true, + "probe_count": 1, + "read_routes_denied": 7, + "sibling_reconciliation_denied": true, + "source_denied": 400, + "tenant_denied": 400 + }, + "phase": "restart-retry", + "process_restart_retry": true, + "producer_service_deployed": false, + "run_id": "factory-audit-20260911104152-94aced", + "sender": "informed-decision", + "source_zip_sha256": "114215406400f6f5728520bf3d7dc2b7a4ff410784b80201b7a5ae24259f64c0", + "status": "passed", + "synthetic_outbox_only": true, + "pod_uid": "dd2c4175-553a-40af-a656-5cb3db8e45fd", + "image": "forgejo.coulomb.social/coulomb/approval-engine@sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49", + "runtime_image_id": "forgejo.coulomb.social/coulomb/approval-engine@sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49" + } + ], + "cleanup_requested": true, + "completed_at": "2026-09-11T10:42:29.225372+00:00" + }, + "prior_native_attempts": [ + { + "schema": "platform.factory-native-acceptance-receipt.v1", + "status": "refused", + "credential_values_emitted": false, + "started_at": "2026-09-11T10:33:22.819971+00:00", + "run_id": "factory-audit-20260911092835-933db8", + "packet_sha256": "f8c3292ae181df016e658499b2b6719fe9cbe9843532e0f3c8af6e36e844827d", + "source_commits": { + "approval-engine": [ + "a0a602976eef818f36dde35f76f7f2e589bd051b", + "approval_engine" + ], + "informed-decision": [ + "bda9381f070859ae997474cf44b86bf4eea9bb52", + "informed_decision" + ] + }, + "error": "command_failed" + }, + { + "schema": "platform.factory-native-acceptance-receipt.v1", + "status": "refused", + "credential_values_emitted": false, + "started_at": "2026-09-11T10:35:10.524203+00:00", + "run_id": "factory-audit-20260911092835-933db8", + "packet_sha256": "f8c3292ae181df016e658499b2b6719fe9cbe9843532e0f3c8af6e36e844827d", + "source_commits": { + "approval-engine": [ + "a0a602976eef818f36dde35f76f7f2e589bd051b", + "approval_engine" + ], + "informed-decision": [ + "bda9381f070859ae997474cf44b86bf4eea9bb52", + "informed_decision" + ] + }, + "receiver_before": { + "image": "forgejo.coulomb.social/coulomb/audit-core@sha256:c82e0442de0fd181342916ae9cd5d6de41d859e1efda637bd93936c67873afa5", + "deployment_uid": "b85fe3d0-75c9-4e0d-8c34-c6f1df0881bb", + "deployment_resource_version": "59845369", + "pod_uid": "4d0ee4e5-5427-43f1-94ca-88e5470c4831", + "capabilities": { + "load_bearing": true, + "redact": true, + "write_only": true, + "source_exact": true, + "tenant_exact": true + }, + "synthetic_probe_only": true, + "credential_reads": 0 + }, + "phase": "native_jobs", + "operator_registry_reads": 0, + "created_objects": [ + { + "kind": "ConfigMap", + "name": "factory-audit-20260911092835-933db8", + "namespace": "approval-engine", + "uid": "6f377d22-f3a1-48f2-be88-ad38d99512cc" + }, + { + "kind": "NetworkPolicy", + "name": "factory-audit-20260911092835-933db8", + "namespace": "approval-engine", + "uid": "ada01a82-3123-4d38-9da9-c1e2b36832ad" + }, + { + "kind": "Job", + "name": "factory-audit-20260911092835-933db8", + "namespace": "approval-engine", + "uid": "9006f388-1f12-4cd5-a622-41d3ebed7a91" + }, + { + "kind": "ConfigMap", + "name": "factory-audit-20260911092835-933db8", + "namespace": "informed-decision", + "uid": "83801283-ca24-40d4-a11e-346d886229c4" + }, + { + "kind": "NetworkPolicy", + "name": "factory-audit-20260911092835-933db8", + "namespace": "informed-decision", + "uid": "fdcdaecc-f497-455e-9082-cdf4ea3554e2" + }, + { + "kind": "Job", + "name": "factory-audit-20260911092835-933db8", + "namespace": "informed-decision", + "uid": "f485ae88-5022-446e-b968-04842afd25fa" + } + ], + "producers": [ + { + "credential_values_emitted": false, + "domain_transaction_atomicity_tested": false, + "event_id": "factory-audit-20260911092835-933db8-approval-engine", + "http_statuses": [ + 202, + 200 + ], + "human_binding_tested": false, + "negatives": { + "audit_bearer_revocation_tested": false, + "invalid_bearer_denied": 401, + "own_reconciliation": true, + "probe_count": 1, + "read_routes_denied": 7, + "sibling_reconciliation_denied": true, + "source_denied": 400, + "tenant_denied": 400 + }, + "process_restart_retry": true, + "producer_service_deployed": false, + "run_id": "factory-audit-20260911092835-933db8", + "sender": "approval-engine", + "source_zip_sha256": "2c6f8768a11cd5af042ae13ad339f424ec04c0865cb5dda21e40e8c2c16bce8f", + "status": "passed", + "synthetic_outbox_only": true, + "pod_uid": "3ffa8a47-efbc-4e22-9098-09b54a233b59", + "image": "forgejo.coulomb.social/coulomb/approval-engine@sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49", + "runtime_image_id": "forgejo.coulomb.social/coulomb/approval-engine@sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49" + } + ], + "cleanup_requested": true, + "error": "native_probe_job_failed_informed-decision" + }, + { + "schema": "platform.factory-native-acceptance-receipt.v1", + "status": "refused", + "credential_values_emitted": false, + "started_at": "2026-09-11T10:37:54.801484+00:00", + "run_id": "factory-audit-20260911103731-dec2cb", + "packet_sha256": "61c7fd0c4640633be1a2917b8f6e2cceff2fa65516796c4c6b74eb2009435fe3", + "source_commits": { + "approval-engine": [ + "a0a602976eef818f36dde35f76f7f2e589bd051b", + "approval_engine" + ], + "informed-decision": [ + "bda9381f070859ae997474cf44b86bf4eea9bb52", + "informed_decision" + ] + }, + "receiver_before": { + "image": "forgejo.coulomb.social/coulomb/audit-core@sha256:c82e0442de0fd181342916ae9cd5d6de41d859e1efda637bd93936c67873afa5", + "deployment_uid": "b85fe3d0-75c9-4e0d-8c34-c6f1df0881bb", + "deployment_resource_version": "59845369", + "pod_uid": "4d0ee4e5-5427-43f1-94ca-88e5470c4831", + "capabilities": { + "load_bearing": true, + "redact": true, + "write_only": true, + "source_exact": true, + "tenant_exact": true + }, + "synthetic_probe_only": true, + "credential_reads": 0 + }, + "phase": "native_jobs", + "operator_registry_reads": 0, + "created_objects": [ + { + "kind": "ConfigMap", + "name": "factory-audit-20260911103731-dec2cb", + "namespace": "approval-engine", + "uid": "23370eeb-d048-44d1-a6c2-3d04377598ef" + }, + { + "kind": "NetworkPolicy", + "name": "factory-audit-20260911103731-dec2cb", + "namespace": "approval-engine", + "uid": "c3a9926e-0d8a-47e8-98b7-a0164fdf6135" + }, + { + "kind": "Job", + "name": "factory-audit-20260911103731-dec2cb", + "namespace": "approval-engine", + "uid": "3142e57f-58a2-4ad6-8397-71846793830b" + }, + { + "kind": "ConfigMap", + "name": "factory-audit-20260911103731-dec2cb", + "namespace": "informed-decision", + "uid": "b6979ed9-9dfe-47de-ad94-04cd024e698f" + }, + { + "kind": "NetworkPolicy", + "name": "factory-audit-20260911103731-dec2cb", + "namespace": "informed-decision", + "uid": "02c06383-c207-497a-be4c-3e786c9120dd" + }, + { + "kind": "Job", + "name": "factory-audit-20260911103731-dec2cb", + "namespace": "informed-decision", + "uid": "7f6b970c-282f-4b29-b78d-13889e792063" + } + ], + "producers": [ + { + "credential_values_emitted": false, + "domain_transaction_atomicity_tested": false, + "event_id": "factory-audit-20260911103731-dec2cb-approval-engine", + "http_statuses": [ + 202, + 200 + ], + "human_binding_tested": false, + "negatives": { + "audit_bearer_revocation_tested": false, + "invalid_bearer_denied": 401, + "own_reconciliation": true, + "probe_count": 1, + "read_routes_denied": 7, + "sibling_reconciliation_denied": true, + "source_denied": 400, + "tenant_denied": 400 + }, + "phase": "restart-retry", + "process_restart_retry": true, + "producer_service_deployed": false, + "run_id": "factory-audit-20260911103731-dec2cb", + "sender": "approval-engine", + "source_zip_sha256": "2c6f8768a11cd5af042ae13ad339f424ec04c0865cb5dda21e40e8c2c16bce8f", + "status": "passed", + "synthetic_outbox_only": true, + "pod_uid": "c6554313-7e7f-41af-99bd-a4cd0eb30d7f", + "image": "forgejo.coulomb.social/coulomb/approval-engine@sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49", + "runtime_image_id": "forgejo.coulomb.social/coulomb/approval-engine@sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49" + } + ], + "failed_producer": { + "sender": "informed-decision", + "diagnostics": [ + { + "error": "contained_probe_failed", + "phase": "bootstrap", + "observed_http_statuses": [] + } + ] + }, + "cleanup_requested": true, + "error": "native_probe_job_failed_informed-decision" + } + ], + "cleanup": [ + { + "run_id": "factory-audit-20260911092835-933db8", + "all_probe_objects_absent": true + }, + { + "run_id": "factory-audit-20260911103731-dec2cb", + "all_probe_objects_absent": true + }, + { + "run_id": "factory-audit-20260911104152-94aced", + "all_probe_objects_absent": true + } + ], + "receiver_readiness": { + "status": "ok", + "custody_class": "operational", + "durable": true, + "tamper_evidence": false, + "recoverable_days": 30, + "recoverable_source": "resource-control/data/capability/platform-audit-storage.json#provisions[capability=data.backup]", + "recoverable_basis": "measured" + }, + "operator_readback": { + "status": "pending", + "attended_attempts_this_session": 2, + "last_exit_code": 5, + "command_handoff": false, + "receipt_created": false, + "remote_session_revocation": "unconfirmed", + "credential_values_emitted": false + }, + "informed_decision_correction": { + "source_commit": "1a122235741d61b649e39ab86ddfbd317e54ad2f", + "cause": "new private directory inherits setgid on fsGroup volume; exact mode check refused startup", + "before_regression": "1 failed, 15 passed", + "after_suite": { + "passed": 335, + "skipped": 39 + }, + "native_helper_verified": true + }, + "probe_tests": { + "passed": 6, + "real_adapters": true, + "local_receiver": "actual Audit Core SQLite backend", + "volume_setgid_inheritance_tested": true + }, + "informed_decision_container": { + "status": "passed", + "image_id": "sha256:92cde609fca63141740d53594a80a513e250a4d68cdde98b973a9de66403d8c8", + "repo_digests": [ + "informed-decision@sha256:92cde609fca63141740d53594a80a513e250a4d68cdde98b973a9de66403d8c8" + ], + "checks_passed": 11, + "checks": [ + "installed container entrypoint serves with projected configuration", + "non-root read-only runtime has no external network or published port", + "private config/database modes enforced; package installer absent", + "configured review refuses anonymous access and reports audit-unready status", + "a second writer cannot acquire the active evidence volume", + "synthetic uncertain intent and undelivered evidence remain explicit", + "consistent backup created while serving; overwrite refused", + "SIGTERM closes the serving writer without forced kill", + "restart preserves immutable content and unresolved submission without retry", + "separate restored volume preserves exact content and unresolved state", + "incomplete owner configuration exits before serving" + ], + "fixture_only": true, + "external_network": "none", + "content_snapshot_sha256": "33a5e2399ef7602b9137f1a381411b045857a153e18abc65a325137bc1959c05", + "native_identity_policy_audit_proven": false, + "published": false, + "deployed": false, + "factory_attempts": 0, + "paid_model_calls": 0, + "cleanup_complete": true + }, + "claims": { + "synthetic_outbox_recovery": true, + "real_sender_credential_used_inside_own_job": true, + "operator_credentials_read_by_jobs": false, + "independent_readback": false, + "audit_bearer_revocation": false, + "domain_transaction_atomicity": false, + "human_binding": false, + "producer_service_deployment": false, + "factory_attempts": 0, + "paid_model_calls": 0 + }, + "remaining_owner_records": [ + "AUDIT-WP-0009-T09", + "AUDIT-WP-0009-T11", + "RPF-WP-0035-T08", + "INFD-WP-0001-T08", + "HFACT-WP-0001-T03" + ] +} diff --git a/workplans/AUDIT-WP-0009-evidence-role-conformance.md b/workplans/AUDIT-WP-0009-evidence-role-conformance.md index 88066b3..7cd5be8 100644 --- a/workplans/AUDIT-WP-0009-evidence-role-conformance.md +++ b/workplans/AUDIT-WP-0009-evidence-role-conformance.md @@ -287,6 +287,13 @@ status: progress priority: high state_hub_task_id: "fd4a4ac3-e525-57c1-9179-e0fcd0226913" ``` + +**Current native return, 2026-09-11 10:42 UTC:** custody/ESO delivery, +source-adapter accepted write, duplicate-after-process-restart, exact scope/read +refusals and own reconciliation count one passed. Independent archive readback +and audit bearer revocation remain; service/domain-transaction/human operation +is separate. See the retained native producer receipt and attempt history below. + Register `approval-engine` as a distinct source under §9.4 and `AUDIT-IN-0001`: sender registration, the four event classes (issuance, use, supersession, revocation), tenancy mapping, retention profile, `secret_policy`, and @@ -391,6 +398,13 @@ status: progress priority: high state_hub_task_id: "96e0cbd5-e3ce-5807-8f64-41244671327b" ``` + +**Current native return, 2026-09-11 10:42 UTC:** custody/ESO delivery, +source-adapter accepted write, duplicate-after-process-restart, exact scope/read +refusals and own reconciliation count one passed. Independent archive readback +and audit bearer revocation remain; service/domain-transaction/human operation +is separate. See the retained native producer receipt and attempt history below. + Register `informed-decision` as a distinct load-bearing source under `AUDIT-IN-0003`, and answer the doctrine question `GH-DEC-2026-014` put to audit-core: whether the record shape can carry a source-held-content @@ -545,6 +559,41 @@ service/outbox/recovery and first-heartbeat operation remain unproved; ESO reader-session revocation is a separate control from audit bearer revocation. T12 still owns attestation/offsite operation; tamper_evidence=false is accurate. + +### Native producer return — 2026-09-11 10:42 UTC + +Both actual source adapters used their own ESO-delivered credential inside a +bounded native Job. Each synthetic event received 202, retained its durable +outbox after an injected lost receipt, and received duplicate 200 after a fresh +process reopened the outbox. Each source's reconciliation reported exactly one +record for its unique probe class. Wrong source/tenant, seven archive read +routes, sibling reconciliation and invalid-bearer requests were refused. + +The first Informed Decision probe exposed a private-store startup defect: +fsGroup volumes add inherited setgid to a newly created 0700 directory. +Informed Decision `1a12223` corrects creation without repairing unsafe existing +data. The regression failed before the fix; the available suite now passes +335 tests with 39 optional checks skipped. Native retry verifies the exact +corrected helper. Six probe tests and eleven rebuilt-container checks pass, +including actual setgid-volume startup, restart/restore and cleanup. + +All temporary probe Jobs, Pods, ConfigMaps and NetworkPolicies are verified +absent. Receiver c82e0442 remains operational/durable; tamper_evidence=false. +Producer verification requires no operator registry read or new OpenBao login. +Independent readback is a separate attended command consuming the successful +receipt; it must not rerun the producer jobs. Both attended verification-login +attempts this session ended before handoff (exit 5; remote revocation +unconfirmed), so independent archive readback remains pending. + +This proves synthetic outbox delivery/recovery with native sender credentials, +not domain-transaction atomicity, deployed producer services or human binding. +An invalid bearer is not a revoked formerly valid bearer. AUDIT T09/T11 and +RPF T08 remain progress for independent readback and audit bearer-revocation +acceptance; CCR21/22 remain applied. Service/policy/human admission and native +runtime/spend gates remain separate. Factory attempts and paid calls remain 0. + +[Native producer receipt](../docs/evidence/2026-09-11-factory-native-producers.json). + ## Operate the scheduled attestation and independent offsite return ```task