informed-decision/docs/evidence/2026-10-11-purpose-image-release/execution/native_program.py

"""Fixed remote source, passed only after exact supervised approval."""
PROGRAM = '\nimport copy,datetime,hashlib,json,os,re,subprocess,sys\nif sys.flags.optimize:raise RuntimeError(\'optimized interpreter refused\')\npayload=json.loads(__PAYLOAD__)\nexec(__GUARD__)\nphase=payload[\'phase\']\nif phase not in (\'drill-backup\',\'cutover-backup\',\'drill-copy\',\'cutover-copy\',\'release\',\'verify\',\'rollback\',\'rollback-verify\'):raise ValueError(\'fixed native phase required\')\ndeadline=datetime.datetime.fromisoformat(\'2026-10-12T23:59:59+00:00\')\ndef require(value,reason):\n if not value:raise ValueError(reason)\nrequire(datetime.datetime.now(datetime.timezone.utc)<deadline,\'execution window expired\')\nenv={**os.environ,\'KUBECONFIG\':\'/etc/rancher/k3s/k3s.yaml\'}\ndef run(argv,body=None,timeout=90):\n return subprocess.run(argv,input=body,text=True,capture_output=True,timeout=timeout,env=env)\ndef read(kind,name,namespace):\n result=run([\'kubectl\',\'get\',kind,name,\'-n\',namespace,\'-o\',\'json\'])\n require(result.returncode==0,\'fixed metadata read refused\')\n return json.loads(result.stdout)\nsealed=payload[\'sealed\']; dependencies=payload[\'dependencies\']\nlive=read(\'deployment\',\'informed-decision\',\'informed-decision\')\ncm=read(\'configmap\',\'informed-decision-runtime-6c221878d051\',\'informed-decision\')\npvc=read(\'pvc\',\'informed-decision-data\',\'informed-decision\')\ncheck_dependencies(cm,pvc,dependencies)\napp=read(\'application\',\'informed-decision\',\'argocd\')\nrequire(app[\'metadata\'][\'uid\']==\'499868f2-eabc-4df4-ae31-b89ce58d750d\',\'Application UID changed\')\nrequire(app[\'spec\'][\'source\'][\'repoURL\']==\'https://forgejo.coulomb.social/coulomb/informed-decision.git\'\n and app[\'spec\'][\'source\'][\'path\']==\'deploy/lifecycle\'\n and app[\'spec\'][\'destination\']=={\'namespace\':\'informed-decision\',\'server\':\'https://kubernetes.default.svc\'}\n and app[\'spec\'].get(\'syncPolicy\',{}).get(\'automated\') is None\n and set(app[\'spec\'][\'source\'])=={\'repoURL\',\'path\',\'targetRevision\'} and not app[\'spec\'].get(\'sources\'),\'Application owner/scope changed\')\nexpected=copy.deepcopy(sealed)\nif phase==\'verify\':expected[\'spec\'][\'template\'][\'spec\'][\'containers\'][0][\'image\']=CANDIDATE\nif phase==\'rollback\':\n image=live[\'spec\'][\'template\'][\'spec\'][\'containers\'][0][\'image\']\n require(image in (BASE,CANDIDATE),\'rollback image is outside same-schema pair\')\n expected[\'spec\'][\'template\'][\'spec\'][\'containers\'][0][\'image\']=image\ncheck_current(live,expected)\nif phase!=\'rollback\':\n require(live.get(\'status\',{}).get(\'readyReplicas\')==1\n  and live[\'status\'].get(\'updatedReplicas\')==1\n  and live[\'status\'].get(\'observedGeneration\')==live[\'metadata\'][\'generation\'],\'service not Ready1\')\ntarget=payload[\'source_revision\'] if phase==\'verify\' else \'7db8485ffecdebfabd77a9daec085553c74bf0bf\'\nif phase==\'rollback\':require(app[\'spec\'][\'source\'][\'targetRevision\'] in (target,payload[\'source_revision\']),\'rollback source is outside pair\')\nelse:require(app[\'spec\'][\'source\'][\'targetRevision\']==target,\'unexpected source pin\')\nresult={\'phase\':phase,\'all_checks_pass\':False,\'raw_output_withheld\':True,\n \'native_approval_verified_by_root\':payload[\'approval\'],\'native_authenticated_grant\':False}\ntry:\n if phase in (\'drill-backup\',\'cutover-backup\',\'drill-copy\',\'cutover-copy\',\'release\',\'verify\',\'rollback-verify\'):\n  podlist=run([\'kubectl\',\'get\',\'pods\',\'-n\',\'informed-decision\',\'-l\',\'app.kubernetes.io/name=informed-decision\',\'-o\',\'json\'])\n  require(podlist.returncode==0,\'pod metadata query refused\')\n  pods=[p for p in json.loads(podlist.stdout)[\'items\'] if not p[\'metadata\'].get(\'deletionTimestamp\')]\n  require(len(pods)==1,\'exact single live owner pod required\');pod=pods[0]\n  require(pod[\'status\'].get(\'phase\')==\'Running\' and len(pod[\'spec\'][\'containers\'])==1\n   and pod[\'spec\'][\'containers\'][0][\'image\']==expected[\'spec\'][\'template\'][\'spec\'][\'containers\'][0][\'image\']\n   and len(pod[\'status\'].get(\'c