coulomb/audit-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare compatible audit receiver with verified container lifecycle
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-11 06:46:15 +02:00
parent f1b0577095
commit cb23dc82fd
8 changed files with 426 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

33
docs/operator-runbook.md
View file

@ -10,8 +10,8 @@ In-cluster URL:
http://audit-core.audit-core.svc.cluster.local:8080
```
Reachability is part of the threat model. Ingress is allowed only from the
`user-engine` namespace (write) and from namespaces labelled
Reachability is part of the threat model. Ingress is allowed from the declared producer peers in
`deploy/networkpolicies.yaml` (write) and from namespaces labelled
`railiance.io/audit-core-reader=true` (operator read). From a workstation,
`kubectl -n audit-core port-forward svc/audit-core 8080:8080` is the usual
path and does not require that label.
@ -261,3 +261,32 @@ narrows a column must replace that note before release.
5. Deployment. `/readyz` must report `custody_class=operational` and
`recoverable_days=30`.
6. In-pod `MODE=remote DISRUPT=0` failure matrix. Evidence goes to NK-WP-0024.
## Factory sender receiver release (2026-09-11)
Build from a committed source with `make image-build`. `requirements.lock` pins
the five runtime packages with hashes; refresh intentionally with
`uv pip compile pyproject.toml --extra serve --extra postgres --generate-hashes --output-file requirements.lock`.
The image uses the factory Python 3.12 Alpine baseline, non-root UID 10001 and
no runtime package installer. Scan every candidate; a clean vulnerability result
is time-bound and not a claim that all future defects are absent.
The release check script uses only a labelled disposable local PostgreSQL
container, synthetic sender identities, and a fresh schema. It proves exact
source/tenant refusal, all seven evidence read routes denied to writers,
independent readback/redaction, duplicate handling, and a database write in
flight during SIGTERM. Waitress has a bounded five-second worker drain. Requests
without an acknowledgement still require idempotent retry; do not promise that
every queued or long-running request finishes inside a shutdown window.
The original c2fe39a image and this release have identical migrations 0001-0006.
This receiver upgrade requires no schema migration job. Rollback to c2fe39a is
structurally compatible, but loses evidence classification support: stop the two
new factory producers first and retain the custody records, then re-admit their
sender contract before resuming. Do not claim load-bearing admission while the
legacy receiver is running.
The historical SQLite importer has five PostgreSQL test failures tracked by
AUDIT-IN-0004. It is outside the live receiver path; do not use it as a recovery
procedure until that record closes. The release test result must state this
exclusion explicitly, never describe the entire suite as green.