coulomb/audit-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Operate scheduled chain-head attestation (AUDIT-WP-0009-T12)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Apply the separate attestor identity, named-ConfigMap RBAC, attest
egress and daily CronJob. Bootstrap an empty chain-head ConfigMap
only because it was absent; drop the placeholder from the apply path
so a later apply cannot overwrite a live head. One-shot job published
a 59-event attestation; mounted readback and receiver write-denial
passed. Offsite copy stays the operator path.

Assistant: grok
Assistant-Session: 01a0a182-bab7-7f11-b32b-d06f3af52082
This commit is contained in:
tegwick 2026-09-15 21:18:17 +02:00
parent 805bacbc14
commit 4c940d49ae
5 changed files with 58 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

24
workplans/AUDIT-WP-0009-evidence-role-conformance.md
View file

@ -9,7 +9,7 @@ flavor: implementation
owner: claude
topic_slug: railiance
created: "2026-08-29"
updated: "2026-09-14"
updated: "2026-09-15"
depends_on:
- AUDIT-WP-0007
state_hub_workstream_id: "46a96b03-bc08-53b5-9c93-4071adabf734"
@ -608,14 +608,28 @@ runtime/spend gates remain separate. Factory attempts and paid calls remain 0.
```task
id: AUDIT-WP-0009-T12
status: todo
status: done
priority: high
state_hub_task_id: "712ba035-edad-5528-8293-56375553d85a"
```
Residual from the source-complete T02: the 2026-09-11 receiver rollout found
no native attest CronJob or audit-core-chain-head ConfigMap. The new receiver
correctly reports tamper_evidence=false while its 32-event chain is intact.
Done 2026-09-15. Native attestor is live: ServiceAccount/Role/RoleBinding
`audit-core-attest` (named ConfigMap get/update/patch only, no create),
CronJob `audit-core-attest-chain` at 17:03 UTC, NetworkPolicy
`audit-core-attest-egress` (Postgres, DNS, API 443/6443). Empty ConfigMap
`audit-core-chain-head` was bootstrapped because it was absent; the
placeholder is no longer in the apply path so a later apply cannot clobber
a live head. One-shot Job `audit-core-attest-t12` published
`audit-core.chain-head.v1` for 59 events at 2026-09-15T19:15:40Z. Receiver
mount caught up; default SA cannot patch; attest SA cannot create ConfigMaps;
receiver API PATCH is a URLError (no API egress). CPU request is 10m so the
job schedules on the packed node.
Offsite copy is still RESOURCE-WP-0002-T06 / operator — this job does not
write Nextcloud. In-cluster attestation is a database-owner boundary only.
`/readyz` still reports last-known `tamper_evidence: false` on the live
image; the mounted file is the live claim. Receipt:
`docs/evidence/2026-09-15-t12-attest-run.json`.
Apply the reviewed separate attestor identity, exact-ConfigMap RBAC, component
egress and scheduled job; bootstrap an empty ConfigMap only if absent, never
overwrite a live attestation with the manifest placeholder. Prove one successful