History

tegwick 5fd04e2095 Implement AUDIT-WP-0007 hash-chain integrity. Accept now extends a single-schema chain. Verify walks it; a rewritten payload_hash is a break. Tamper evidence is that detector plus an external chain-head attestation, not WORM.		2026-08-16 01:18:30 +02:00
..
audit-core.yaml	Implement AUDIT-WP-0007 hash-chain integrity.	2026-08-16 01:18:30 +02:00
clustersecretstore.yaml	Read mounted DB credentials from a Kubernetes snapshot	2026-08-13 12:25:32 +02:00
externalsecret-senders.yaml	Stand up railiance01 receiver without founder bao kv put	2026-08-13 10:27:13 +02:00
externalsecrets.yaml	Stand up railiance01 receiver without founder bao kv put	2026-08-13 10:27:13 +02:00
migrate-job.yaml	Cut over AUDIT-WP-0006 image and add AUDIT-WP-0007.	2026-08-16 00:57:59 +02:00
networkpolicies.yaml	Add deployment manifests, custody-class guard and request counters	2026-08-10 17:42:43 +02:00
README.md	Cut over AUDIT-WP-0006 image and add AUDIT-WP-0007.	2026-08-16 00:57:59 +02:00
senders-scope.json	Implement AUDIT-WP-0006 honest operational custody.	2026-08-16 00:24:33 +02:00
senders-scope.yaml	Implement AUDIT-WP-0006 honest operational custody.	2026-08-16 00:24:33 +02:00

README.md

railiance01 package

Target: railiance01 only. The workstation kubeconfig that talks to that API is the k3s-api-railiance01 tunnel (local port 16444). ~/.kube/config-hosteurope currently points at 16443 (coulombcore); rewrite the server port or export a copy before applying.

Apply order is documented in docs/operator-runbook.md. Do not apply the Deployment until:

The image digest is pinned (currently sha256:05fe1c06… from commit 40dcadd).
Secrets audit-core-database, audit-core-database-migrate, and audit-core-senders exist. ConfigMap audit-core-senders-scope is applied (deploy/senders-scope.yaml) before the Deployment mounts it.
Job audit-core-migrate has completed.

make image-build
make deploy-dry-run