"content":"\"\"\"Supervised receipt bookkeeping, not an authenticated approval provider.\"\"\"\nimport datetime\nimport fcntl\nimport hashlib\nimport json\nimport os\nimport re\nfrom pathlib import Path\nimport stat\nimport uuid\n\nFOUNDER = {'kind': 'person', 'sub': 'uid=platform-root,ou=people,dc=netkingdom,dc=local'}\nMEMO_ID = 'infd-20261011-purpose-overlay-r1'\nPROPOSAL = 'INFD-WP-0009-T04/purpose-overlay-v1'\nPHASES = ('drill-copy-rescue-r1', 'offline-verify', 'cleanup-offline',\n 'cutover-backup', 'cutover-copy', 'release', 'verify', 'rollback', 'rollback-verify')\n\n\ndef require(value, reason):\n if not value:\n raise ValueError(reason)\n\n\ndef sha(path):\n digest = hashlib.sha256()\n with Path(path).open('rb') as stream:\n for block in iter(lambda: stream.read(1024**2), b''):\n digest.update(block)\n return digest.hexdigest()\n\n\ndef private(path, directory=False):\n info = Path(path).lstat()\n require((stat.S_ISDIR(info.st_mode) if directory else stat.S_ISREG(info.st_mode))\n and info.st_uid == os.getuid() and stat.S_IMODE(info.st_mode) == (0o700 if directory else 0o600)\n and (directory or info.st_nlink == 1), 'private owned custody required')\n\n\ndef authority(receipt, outcome, memo_sha, source_revision, phase, now=None):\n \"\"\"Root must freshly verify native outcome at fixed ORIGIN outside this helper.\n\n Receipt files/flags are not signed grants. This function checks the exact\n supervised receipt relation; existing harness/founder authority remains the\n actual permission boundary. It never authenticates a caller as human.\n \"\"\"\nnow=nowordatetime.datetime.now(datetime.timezone.utc)\nrequire(phaseinPHASES,'fixedphaserequired')\nrequire(receipt.get('proposal_id')==PROPOSALandreceipt.get('memo_id')==MEMO_ID\nandreceipt.get('memo_version')==2andreceipt.get('memo_sha256')==memo_sha\nandreceipt.get('source_revision')==source_revision\nandreceipt.get('activation')=='APPROVED'\nandreceipt.get('authority_mode')=='ADMINISTER'\nandreceipt.get('target')=='realm:kubernetes/railiance01/informed-decision'\nandreceipt.get('verification_method')=='root-fixed-origin-native-readback'\nandreceipt.get('runtime_authenticated_grant')isFalse\nandreceipt.get('outcome_query')=='/lifecycle/memos/infd-20261011-purpose-overlay-r1/outcomes?version=2',\n'exactexternallyverifiedsupervisedreceiptrequired')\nverified=datetime.datetime.fromisoformat(receipt['verified_at'].replace('Z','+00:00'))\nrequire(verified.tzinfoisnotNoneand0<=(now-verified).total_seconds()<=120,\n'freshrootnativereadbackrequiredbeforeeveryphase')\ndeadline=datetime.datetime.fromisoformat('2026-10-12T23:59:59+00:00')\nrequire(now<deadline,'approvedexecutionwindowexpired')\nrequire(outcome.get('memo_id')==MEMO_IDandoutcome.get('review',{}).get('stale')isFalse\nandoutcome['review'].get('intake_state')=='ready','nativereviewisnotready/current')\nreview_id=outcome['review']['memo_id']\nrequire(review_id==receipt.get('review_memo_id'),'nativereviewidentitychanged')\naccepted=[xforxinoutcome.get('dispositions',[])\nifx.get('submission_state')=='confirmed'\nandx.get('disposition',{}).get('verb')=='accept'\nandx['disposition'].get('memo_version')==1]\nrequire(len(accepted)==1,'oneconfirmedfounderacceptancerequired')\naccepted=accepted[0]['disposition']\nrequire(accepted.get('actor')==FOUNDERandaccepted.get('memo_id')==review_id\nandaccepted.get('approval_id')==receipt.get('approval_id')\nandaccepted.get('id')==receipt.get('disposition_id')\nandaccepted.get('at')==receipt.get('accepted_at'),'exactfounderdispositionmismatch')\nrequire(re.fullmatch(r'[a-f0-9-]
"content":"\"\"\"Fixedversion2recoveryremotesource;requiresfreshexactacceptance.\"\"\"\nPROGRAM='\\nimportcopy,datetime,hashlib,json,os,re,subprocess,sys\\nifsys.flags.optimize:raiseRuntimeError(\\'optimizedinterpreterrefused\\')\\npayload=json.loads(__PAYLOAD__)\\nexec(__GUARD__)\\nphase=payload[\\'phase\\']\\nifphasenotin(\\'cutover-backup\\',\\'drill-copy-rescue-r1\\',\\'cutover-copy\\',\\'release\\',\\'verify\\',\\'rollback\\',\\'rollback-verify\\'):raiseValueError(\\'fixednativephaserequired\\')\\ndeadline=datetime.datetime.fromisoformat(\\'2026-10-12T23:59:59+00:00\\')\\ndefrequire(value,reason):\\nifnotvalue:raiseValueError(reason)\\nrequire(datetime.datetime.now(datetime.timezone.utc)<deadline,\\'executionwindowexpired\\')\\nenv={**os.environ,\\'KUBECONFIG\\':\\'/etc/rancher/k3s/k3s.yaml\\'}\\ndefrun(argv,body=None,timeout=90):\\nreturnsubprocess.run(argv,input=body,text=True,capture_output=True,timeout=timeout,env=env)\\ndefread(kind,name,namespace):\\nresult=run([\\'kubectl\\',\\'get\\',kind,name,\\'-n\\',namespace,\\'-o\\',\\'json\\'])\\nrequire(result.returncode==0,\\'fixedmetadatareadrefused\\')\\nreturnjson.loads(result.stdout)\\nsealed=payload[\\'sealed\\'];dependencies=payload[\\'dependencies\\']\\nlive=read(\\'deployment\\',\\'informed-decision\\',\\'informed-decision\\')\\ncm=read(\\'configmap\\',\\'informed-decision-runtime-6c221878d051\\',\\'informed-decision\\')\\npvc=read(\\'pvc\\',\\'informed-decision-data\\',\\'informed-decision\\')\\ncheck_dependencies(cm,pvc,dependencies)\\napp=read(\\'application\\',\\'informed-decision\\',\\'argocd\\')\\nrequire(app[\\'metadata\\'][\\'uid\\']==\\'499868f2-eabc-4df4-ae31-b89ce58d750d\\',\\'ApplicationUIDchanged\\')\\nrequire(app[\\'spec\\'][\\'source\\'][\\'repoURL\\']==\\'https://forgejo.coulomb.social/coulomb/informed-decision.git\\'\\n and app[\\'spec\\'][\\'source\\'][\\'path\\']==\\'deploy/lifecycle\\'\\n and app[\\'spec\\'][\\'destination\\']=={\\'namespace\\':\\'informed-decision\\',\\'server\\':\\'https://kubernetes.default.svc\\'}\\n and app[\\'spec\\'].get(\\'syncPolicy\\',{}).get(\\'automated\\') is None\\n and set(app[\\'spec\\'][\\'source\\'])=={\\'repoURL\\',\\'path\\',\\'targetRevision\\'} and not app[\\'spec\\'].get(\\'sources\\'),\\'Application owner/scope changed\\')\\nexpected=copy.deepcopy(sealed)\\nif phase==\\'verify\\':expected[\\'spec\\'][\\'template\\'][\\'spec\\'][\\'containers\\'][0][\\'image\\']=CANDIDATE\\nif phase==\\'rollback\\':\\n image=live[\\'spec\\'][\\'template\\'][\\'spec\\'][\\'containers\\'][0][\\'image\\']\\n require(image in (BASE,CANDIDATE),\\'rollback image is outside same-schema pair\\')\\n expected[\\'spec\\'][\\'template\\'][\\'spec\\'][\\'containers\\'][0][\\'image\\']=image\\ncheck_current(live,expected)\\nif phase!=\\'rollback\\':\\n require(live.get(\\'status\\',{}).get(\\'readyReplicas\\')==1\\n and live[\\'status\\'].get(\\'updatedReplicas\\')==1\\n and live[\\'status\\'].get(\\'observedGeneration\\')==live[\\'metadata\\'][\\'generation\\'],\\'service not Ready1\\')\\ntarget=payload[\\'source_revision\\'] if phase==\\'verify\\' else \\'7db8485ffecdebfabd77a9daec085553c74bf0bf\\'\\nif phase==\\'rollback\\':require(app[\\'spec\\'][\\'source\\'][\\'targetRevision\\'] in (target,payload[\\'source_revision\\']),\\'rollback source is outside pair\\')\\nelse:require(app[\\'spec\\'][\\'source\\'][\\'targetRevision\\']==target,\\'unexpected source pin\\')\\nresult={\\'phase\\':phase,\\'all_checks_pass\\':False,\\'raw_output_withheld\\':True,\\n \\'native_approval_verified_by_root\\':payload[\\'approval\\'],\\'native_authenticated_grant\\':False}\\ntry:\\n if phase in (\\'cutover-backup\\',\\'drill-copy-rescue-r1\\',\\'cutover-copy\\',\\'release\\',\\'verify\\',\\'rollback-verify\\'):\\n podlist=run([\\'kubectl\\',\\'get\\',\\'pods\\',\\'-n\\',\\'informed-decision\\',\\'-l\\',\\'app.kubernetes.io/name=informed-decision\\',\\'-o\\',\\'json\\'])\\n require(podlist.returncode==0,\\'pod metadata query refused\\')\\n pods=[p for p in json.loads(podlist.stdout)[\\'item
"content":"\"\"\"Only structural count/hash receipts can leave the private execution phase.\"\"\"\ndef counts(value):\n if (set(value) != {'schema_version', 'lifecycle', 'outbox', 'submissions', 'integrity',\n 'read_only_pre_open', 'store_constructed'}\n or value['schema_version'] != 5 or value['integrity'] != 'ok'\n or value['read_only_pre_open'] is not True or value['store_constructed'] is not False\n or set(value['lifecycle']) != {'records', 'events', 'pending'}\n or not set(value['outbox']) <= {'pending', 'delivered', 'blocked'}\n or not set(value['submissions']) <= {'prepared', 'in_flight', 'confirmed', 'unresolved'}):\n raise ValueError('count-only receipt shape/state refused; values withheld')\n for group in ('lifecycle', 'outbox', 'submissions'):\n if any(type(number) is not int or number < 0 or number > 10**12\n for number in value[group].values()):\n raise ValueError('count-only receipt values refused')\n return value\n"
"content":"\"\"\"Synthetic custody/transport tests. No native data, Docker or cluster action.\"\"\"\nimportcopy\nimportdatetime\nimportio\nimportjson\nimportos\nfrompathlibimportPath\nimportsubprocess\nimportsys\nimporttempfile\nimportunittest\nfromunittest.mockimportpatch\nfromcontextlibimportredirect_stdout\n\nimportactuator\nfromauthority_journalimportJournal,authority\nfromnative_programimportPROGRAM\nfromreceipt_safetyimportcounts\n\nCASE=Path('/home/worsch/informed-decision/docs/evidence/2026-10-11-purpose-image-release')\nNOW=datetime.datetime(2026,10,11,2,0,tzinfo=datetime.timezone.utc)\nREVISION='e'*40\nCOUNT={'schema_version':5,'integrity':'ok','read_only_pre_open':True,'store_constructed':False,\n'lifecycle':{'records':3,'events':8,'pending':1},\n'outbox':{'pending':2,'delivered':10},'submissions':{'confirmed':1,'unresolved':1}}\n\n\ndefaccepted():\napproval='11111111-1111-4111-8111-111111111111'\nreview='review-22222222-2222-4222-8222-222222222222'\ndisposition='disp-33333333-3333-4333-8333-333333333333'\nreceipt={'proposal_id':'INFD-WP-0009-T04/purpose-overlay-v1',\n'memo_id':'infd-20261011-purpose-overlay-r1','memo_version':2,\n'memo_sha256':'a'*64,'source_revision':REVISION,'activation':'APPROVED',\n'authority_mode':'ADMINISTER','target':'realm:kubernetes/railiance01/informed-decision',\n'verification_method':'root-fixed-origin-native-readback','runtime_authenticated_grant':False,'outcome_query':'/lifecycle/memos/infd-20261011-purpose-overlay-r1/outcomes?version=2',\n'verified_at':'2026-10-11T02:00:00Z','accepted_at':'2026-10-11T01:59:00Z',\n'review_memo_id':review,'approval_id':approval,'disposition_id':disposition}\noutcome={'memo_id':receipt['memo_id'],'review':{'memo_id':review,'stale':False,'intake_state':'ready'},\n'dispositions':[{'approval_id':None,'submission_state':'confirmed',\n'disposition':{'verb':'accept','memo_version':1,'memo_id':review,\n'approval_id':approval,'id':disposition,\n'actor':{'kind':'person','sub':'uid=platform-root,ou=people,dc=netkingdom,dc=local'},\n'at':receipt['accepted_at']}}]}\nreturnreceipt,outcome\n\n\nclassAuthorityAndCustody(unittest.TestCase):\ndeftest_exact_nested_founder_receipt_not_top_level_approval(self):\nreceipt,outcome=accepted()\nresult=authority(receipt,outcome,'a'*64,REVISION,'drill-copy-rescue-r1',NOW)\nself.assertEqual(result['approval_id'],receipt['approval_id'])\n\ndeftest_pending_stale_wrong_actor_version_and_binding_refuse(self):\nmutations=[lambdar,o:r.update(activation='PENDING'),\nlambdar,o:r.update(memo_sha256='changed'),\nlambdar,o:r.update(source_revision='changed'),\nlambdar,o:r.update(target='other'),\nlambdar,o:r.update(verified_at='2026-10-11T01:00:00Z'),\nlambdar,o:r.update(verification_method='caller-asserted'),\nlambdar,o:r.update(runtime_authenticated_grant=True),\nlambdar,o:o['review'].update(stale=True),\nlambdar,o:o['review'].update(intake_state='pending'),\nlambdar,o:o['dispositions'][0].update(submission_state='unresolved'),\nlambdar,o:o['dispositions'][0]['disposition'].update(memo_version=3),\nlambdar,o:o['dispositions'][0]['disposition'].update(actor={'kind':'agent','sub':'platform-root'}),\nlambdar,o:o['dispositions'].append(copy.deepcopy(o['dispositions'][0]))]\nformutateinmutations:\nwithself.subTe
"content":"\"\"\"Synthetic recovery guards; no actual private journal/DB/native command.\"\"\"\nimportcopy\nimportdatetime\nimporthashlib\nimportjson\nimportos\nfrompathlibimportPath\nimporttempfile\nimportunittest\nfromauthority_journalimportJournal,authority,original_anchor\nfromtest_executionimportaccepted,NOW,REVISION\n\nROOT=Path(__file__).parent\nPLAN=json.loads((ROOT/'execution-plan.json').read_text())\nCASE=ROOT.parent\nBACKUP=json.loads((CASE/'original-approved-drill-backup.json').read_text())\n\nclassRescueGuards(unittest.TestCase):\ndeforiginal(self,parent):\noriginal={'identity':PLAN['recovery']['original_identity'],'phases':{}}\nforname,metadatainPLAN['recovery']['original_anchor']['phase_metadata'].items():\noriginal['phases'][name]={**metadata,'result':BACKUPifname=='drill-backup'else{'all_checks_pass':False}}\np=parent/'execution-journal.json';p.write_text(json.dumps(original));os.chmod(p,0o600)\nanchor=copy.deepcopy(PLAN['recovery']['original_anchor']);anchor['original_journal_sha256']=hashlib.sha256(p.read_bytes()).hexdigest()\nreturnp,original,anchor\n\ndeftest_exact_original_failed_journal_is_linked_without_mutation(self):\nwithtempfile.TemporaryDirectory()asdirectory:\nparent=Path(directory);os.chmod(parent,0o700);p,original,expected=self.original(parent);before=p.read_bytes()\nanchor=original_anchor(parent,expected,BACKUP,original['identity'])\nj=Journal(parent,{'fixture':True,'recovery_anchor':anchor});j.start('drill-copy-rescue-r1',{})\nself.assertEqual(p.read_bytes(),before);self.assertEqual(j.path.name,'rescue-execution-journal-r1.json')\nj.finish('drill-copy-rescue-r1',{'all_checks_pass':True});j.start('offline-verify',{})\nself.assertEqual(p.read_bytes(),before);j.close()\n\ndeftest_original_missing_uncertain_recreated_attempt_or_rollout_refuse(self):\nfordefectin('missing','complete','attempt','rollout','hash'):\nwithself.subTest(defect=defect),tempfile.TemporaryDirectory()asdirectory:\nparent=Path(directory);os.chmod(parent,0o700);p,o,e=self.original(parent)\nifdefect=='missing':o['phases'].pop('drill-copy')\nelifdefect=='complete':o['phases']['drill-copy']['state']='COMPLETE'\nelifdefect=='attempt':o['phases']['drill-copy']['attempt_id']='different'\nelifdefect=='rollout':o['phases']['release']={'state':'RUNNING'}\nifdefect!='hash':\np.write_text(json.dumps(o));e['original_journal_sha256']=hashlib.sha256(p.read_bytes()).hexdigest()\nelse:e['original_journal_sha256']='0'*64\nwithself.assertRaises((ValueError,KeyError)):original_anchor(parent,e,BACKUP,PLAN['recovery']['original_identity'])\n\ndeftest_rescue_replay_refused_and_old_phase_never_admitted(self):\nwithtempfile.TemporaryDirectory()asdirectory:\nos.chmod(directory,0o700);j=Journal(directory,{'fixture':True})\nwithself.assertRaises(ValueError):j.start('drill-copy',{})\nwithself.assertRaises(ValueError):j.start('drill-backup',{})\nwithself.assertRaises(ValueError):j.start('offline-verify',{})\nj.start('drill-copy-rescue-r1',{});j.finish('drill-copy-rescue-r1',{'all_checks_pass':False})\nwithself.assertRaises(ValueError):j.start('drill-copy-rescue-r1',{})\nwithself.assertRaises(ValueError):j.start('offline-verify',{})\nj.close()\n\ndeftest_new_authority_requires_version2_old_approval_refuses(self):\nreceipt,outcome=accepted();receipt['memo_version']=2;outcome['dispositions'][0]['disposition']['memo_version']=1\nauthority(receipt,outcome,'a'*64,REVISION,'drill-copy-rescue-r1',NOW)\nreceipt['memo_version']=1\nwithself.assertRaises(ValueError):authority(receipt,outcome,'a'*64,REVISION,'drill-copy-rescue-r1',NOW)\nwiths
