Prepare verified v7 policy and review rollout for p01

Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029c-c003-7283-acc9-930b434e6cae
2026-10-03 19:53:36 +02:00 · 2026-10-03 19:53:36 +02:00 · 027423610c
commit 027423610c
parent 7996a8e23b
6 changed files with 491 additions and 0 deletions
--- a/docs/batches/2026-10-03-provisioning-window/DEPLOY-v7.md
+++ b/docs/batches/2026-10-03-provisioning-window/DEPLOY-v7.md
@ -0,0 +1,49 @@
+# p01 admission rollout candidate — awaiting founder approval
+
+Authority required: ADMINISTER @ realm:kubernetes/railiance01,
+activation=APPROVED, for the two changes below. No live rollout has run.
+
+1. Helm release `flex-auth-informed-decision-sitting`, namespace `flex-auth`:
+   update only its image to the CI build of access-engine commit `f946c7b`:
+   `sha256:f6fa2062f7095e66c7a91f20cd130914b5481d46d9d909339e028f7ecdf0065d`.
+   The v7 package admits p01's exact native approval pin and preserves existing
+   records. Actual published-image evaluation confirms the package digest
+   `sha256:2490955f175c52574543e210be06f468a01e56c778d38d4fdcad731875e37cc7`.
+2. Create immutable ConfigMap `informed-decision-runtime-b800648bd80b` and
+   update Deployment `informed-decision` to reference it. Only the policy
+   version/digest change; its current application image, storage and resource
+   requests are retained. Recreate causes a brief review-service interruption.
+
+Preparation evidence: CI image and smoke checks succeeded; published-image
+synthetic p01 read allowed; 795 candidate policy checks passed; both server
+preflights passed in their explicit namespaces. Client diff for the policy
+shows only the image change beyond apply bookkeeping; review diff shows only
+its configuration reference and the new ConfigMap. Node requests: 3445m of
+4000m CPU, enough for the policy's 5m surge. Recheck before live execution.
+No ArgoCD application targeting these two namespaces was observed.
+
+Deploy through Helm on railiance01, with the access-engine chart and pinned
+`values/informed-decision-sitting.yaml` copied to a temporary directory:
+
+```bash
+export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
+helm upgrade --install flex-auth-informed-decision-sitting \
+  /tmp/infd-p01-rollout/charts/flex-auth \
+  -f /tmp/infd-p01-rollout/values/informed-decision-sitting.yaml \
+  --namespace flex-auth --atomic --timeout 5m
+kubectl -n flex-auth rollout status deployment/flex-auth-informed-decision-sitting --timeout=120s
+```
+
+Verify the served package before the review-service update. Then apply only
+`review-rollout-v7.json` on the node, and wait for review health/readiness.
+Update `deploy/sitting-admission.json` to the reviewed
+`review-admission-v7.json` in the same session as the actual rollout.
+
+Recovery: Helm rollback to the pre-rollout revision if needed; restore the
+review Deployment's old config reference
+`informed-decision-runtime-5c11925287fa` if the config update fails. Retain the
+old ConfigMap and private evidence volume.
+
+A5 (attach/load the memo) and A6 (fresh-MFA human answer) follow verified
+rollout. These operations are not performed by publishing the CI image. The
+approval expires 2026-10-04 17:08 UTC; no automatic approval recreation.
--- a/docs/batches/2026-10-03-provisioning-window/policy-rollout-v7.yaml
+++ b/docs/batches/2026-10-03-provisioning-window/policy-rollout-v7.yaml
@ -0,0 +1,186 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: flex-auth-informed-decision-sitting
+  labels:
+    app.kubernetes.io/name: flex-auth-informed-decision-sitting
+    app.kubernetes.io/instance: flex-auth-informed-decision-sitting
+    app.kubernetes.io/part-of: flex-auth
+  namespace: flex-auth
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: flex-auth-informed-decision-sitting
+  policyTypes:
+  - Ingress
+  - Egress
+  egress:
+  - ports:
+    - port: 443
+      protocol: TCP
+    - port: 6443
+      protocol: TCP
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: informed-decision
+      podSelector:
+        matchLabels:
+          app.kubernetes.io/name: informed-decision
+    ports:
+    - port: 8080
+      protocol: TCP
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: flex-auth-informed-decision-sitting
+  labels:
+    app.kubernetes.io/name: flex-auth-informed-decision-sitting
+    app.kubernetes.io/instance: flex-auth-informed-decision-sitting
+    app.kubernetes.io/part-of: flex-auth
+  namespace: flex-auth
+automountServiceAccountToken: false
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: flex-auth-informed-decision-sitting-tokenreviewer
+  labels:
+    app.kubernetes.io/name: flex-auth-informed-decision-sitting
+    app.kubernetes.io/instance: flex-auth-informed-decision-sitting
+    app.kubernetes.io/part-of: flex-auth
+rules:
+- apiGroups:
+  - authentication.k8s.io
+  resources:
+  - tokenreviews
+  verbs:
+  - create
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: flex-auth-informed-decision-sitting-tokenreviewer
+  labels:
+    app.kubernetes.io/name: flex-auth-informed-decision-sitting
+    app.kubernetes.io/instance: flex-auth-informed-decision-sitting
+    app.kubernetes.io/part-of: flex-auth
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: flex-auth-informed-decision-sitting-tokenreviewer
+subjects:
+- kind: ServiceAccount
+  name: flex-auth-informed-decision-sitting
+  namespace: flex-auth
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: flex-auth-informed-decision-sitting
+  labels:
+    app.kubernetes.io/name: flex-auth-informed-decision-sitting
+    app.kubernetes.io/instance: flex-auth-informed-decision-sitting
+    app.kubernetes.io/part-of: flex-auth
+  namespace: flex-auth
+spec:
+  selector:
+    app.kubernetes.io/name: flex-auth-informed-decision-sitting
+  ports:
+  - name: http
+    port: 8080
+    targetPort: http
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: flex-auth-informed-decision-sitting
+  labels:
+    app.kubernetes.io/name: flex-auth-informed-decision-sitting
+    app.kubernetes.io/instance: flex-auth-informed-decision-sitting
+    app.kubernetes.io/part-of: flex-auth
+  namespace: flex-auth
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: flex-auth-informed-decision-sitting
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: flex-auth-informed-decision-sitting
+        app.kubernetes.io/instance: flex-auth-informed-decision-sitting
+        app.kubernetes.io/part-of: flex-auth
+    spec:
+      automountServiceAccountToken: false
+      serviceAccountName: flex-auth-informed-decision-sitting
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+      - name: flex-auth
+        image: forgejo.coulomb.social/coulomb/flex-auth@sha256:f6fa2062f7095e66c7a91f20cd130914b5481d46d9d909339e028f7ecdf0065d
+        imagePullPolicy: IfNotPresent
+        args:
+        - serve
+        - --addr
+        - 0.0.0.0:8080
+        - --registry
+        - /opt/flex-auth/examples/informed-decision-sitting/registry.json
+        - --policy
+        - /opt/flex-auth/examples/informed-decision-sitting/policy.md
+        - --caller-auth-mode
+        - enforce
+        - --caller-kubernetes-url
+        - https://10.43.0.1
+        - --caller-binding
+        - informed-decision=system:serviceaccount:informed-decision:review
+        ports:
+        - name: http
+          containerPort: 8080
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+          periodSeconds: 20
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+          periodSeconds: 5
+        resources:
+          limits:
+            cpu: 300m
+            memory: 192Mi
+          requests:
+            cpu: 5m
+            memory: 32Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+        volumeMounts:
+        - mountPath: /var/run/secrets/flex-auth-reviewer
+          name: flex-auth-reviewer
+          readOnly: true
+      volumes:
+      - name: flex-auth-reviewer
+        projected:
+          defaultMode: 288
+          sources:
+          - serviceAccountToken:
+              expirationSeconds: 3600
+              path: token
+          - configMap:
+              name: kube-root-ca.crt
+              items:
+              - key: ca.crt
+                path: ca.crt
--- a/docs/batches/2026-10-03-provisioning-window/review-admission-v7.json
+++ b/docs/batches/2026-10-03-provisioning-window/review-admission-v7.json
@ -0,0 +1,19 @@
+{
+  "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:0557edffb0efccc2e283cb878bc3f85deacd8165b45eefde830c21f6f02710c8",
+  "policy": {
+    "origin": "http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080",
+    "package": "informed-decision.compact-sitting",
+    "version": "v7",
+    "package_digest": "sha256:2490955f175c52574543e210be06f468a01e56c778d38d4fdcad731875e37cc7",
+    "pod_name": "flex-auth-informed-decision-sitting"
+  },
+  "keycape_egress_ips": [
+    "92.205.62.239"
+  ],
+  "storage_class": "local-path",
+  "ordinary_approval_ids": [
+    "2ce76d7f-01c3-4b63-8476-8d1230679769",
+    "c2af4bcf-15b4-4305-aac1-acc7e4dcb099",
+    "dc22666a-d5d7-46bc-9490-ebe9fe09dc38"
+  ]
+}
--- a/docs/batches/2026-10-03-provisioning-window/review-rollout-v7.json
+++ b/docs/batches/2026-10-03-provisioning-window/review-rollout-v7.json
@ -0,0 +1,219 @@
+{
+  "apiVersion": "v1",
+  "kind": "List",
+  "items": [
+    {
+      "apiVersion": "v1",
+      "kind": "ConfigMap",
+      "metadata": {
+        "name": "informed-decision-runtime-b800648bd80b",
+        "namespace": "informed-decision",
+        "annotations": {
+          "informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
+        }
+      },
+      "immutable": true,
+      "data": {
+        "runtime.json": "{\"approval_origin\":\"http://approval-engine.approval-engine.svc.cluster.local:8080\",\"audit\":{\"origin\":\"http://audit-core.audit-core.svc.cluster.local:8080\",\"sender_token_file\":\"/var/run/secrets/informed-decision/audit/token\"},\"evidence_db\":\"/data/private/review.sqlite\",\"ordinary_approval_ids\":[\"2ce76d7f-01c3-4b63-8476-8d1230679769\",\"c2af4bcf-15b4-4305-aac1-acc7e4dcb099\",\"dc22666a-d5d7-46bc-9490-ebe9fe09dc38\"],\"policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.compact-sitting\",\"package_digest\":\"sha256:2490955f175c52574543e210be06f468a01e56c778d38d4fdcad731875e37cc7\",\"version\":\"v7\"},\"schema\":\"informed-decision.review-runtime.v1\"}"
+      }
+    },
+    {
+      "apiVersion": "apps/v1",
+      "kind": "Deployment",
+      "metadata": {
+        "name": "informed-decision",
+        "namespace": "informed-decision",
+        "annotations": {
+          "informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
+        }
+      },
+      "spec": {
+        "replicas": 1,
+        "strategy": {
+          "type": "Recreate"
+        },
+        "progressDeadlineSeconds": 600,
+        "selector": {
+          "matchLabels": {
+            "app.kubernetes.io/name": "informed-decision"
+          }
+        },
+        "template": {
+          "metadata": {
+            "labels": {
+              "app.kubernetes.io/name": "informed-decision",
+              "app.kubernetes.io/component": "review"
+            }
+          },
+          "spec": {
+            "automountServiceAccountToken": false,
+            "serviceAccountName": "review",
+            "terminationGracePeriodSeconds": 45,
+            "securityContext": {
+              "runAsNonRoot": true,
+              "runAsUser": 10001,
+              "runAsGroup": 10001,
+              "fsGroup": 10001,
+              "fsGroupChangePolicy": "OnRootMismatch",
+              "seccompProfile": {
+                "type": "RuntimeDefault"
+              }
+            },
+            "containers": [
+              {
+                "name": "informed-decision",
+                "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:0557edffb0efccc2e283cb878bc3f85deacd8165b45eefde830c21f6f02710c8",
+                "securityContext": {
+                  "allowPrivilegeEscalation": false,
+                  "readOnlyRootFilesystem": true,
+                  "capabilities": {
+                    "drop": [
+                      "ALL"
+                    ]
+                  }
+                },
+                "env": [
+                  {
+                    "name": "INFD_KEYCAPE_ISSUER",
+                    "value": "https://kc.coulomb.social"
+                  },
+                  {
+                    "name": "INFD_CONTAINER_CONFIG",
+                    "value": "/configuration/runtime.json"
+                  }
+                ],
+                "ports": [
+                  {
+                    "name": "http",
+                    "containerPort": 8080
+                  }
+                ],
+                "startupProbe": {
+                  "httpGet": {
+                    "path": "/healthz",
+                    "port": "http"
+                  },
+                  "periodSeconds": 10,
+                  "timeoutSeconds": 2,
+                  "failureThreshold": 12
+                },
+                "readinessProbe": {
+                  "httpGet": {
+                    "path": "/healthz",
+                    "port": "http"
+                  },
+                  "periodSeconds": 10,
+                  "timeoutSeconds": 2
+                },
+                "livenessProbe": {
+                  "httpGet": {
+                    "path": "/healthz",
+                    "port": "http"
+                  },
+                  "periodSeconds": 10,
+                  "timeoutSeconds": 2
+                },
+                "resources": {
+                  "requests": {
+                    "cpu": "5m",
+                    "memory": "64Mi"
+                  },
+                  "limits": {
+                    "cpu": "500m",
+                    "memory": "256Mi"
+                  }
+                },
+                "volumeMounts": [
+                  {
+                    "name": "data",
+                    "mountPath": "/data"
+                  },
+                  {
+                    "name": "runtime",
+                    "mountPath": "/run/informed-decision"
+                  },
+                  {
+                    "name": "tmp",
+                    "mountPath": "/tmp"
+                  },
+                  {
+                    "name": "configuration",
+                    "mountPath": "/configuration",
+                    "readOnly": true
+                  },
+                  {
+                    "name": "caller",
+                    "mountPath": "/var/run/secrets/informed-decision/policy",
+                    "readOnly": true
+                  },
+                  {
+                    "name": "audit",
+                    "mountPath": "/var/run/secrets/informed-decision/audit",
+                    "readOnly": true
+                  }
+                ]
+              }
+            ],
+            "volumes": [
+              {
+                "name": "data",
+                "persistentVolumeClaim": {
+                  "claimName": "informed-decision-data"
+                }
+              },
+              {
+                "name": "runtime",
+                "emptyDir": {
+                  "medium": "Memory",
+                  "sizeLimit": "16Mi"
+                }
+              },
+              {
+                "name": "tmp",
+                "emptyDir": {
+                  "medium": "Memory",
+                  "sizeLimit": "16Mi"
+                }
+              },
+              {
+                "name": "configuration",
+                "configMap": {
+                  "name": "informed-decision-runtime-b800648bd80b",
+                  "defaultMode": 292
+                }
+              },
+              {
+                "name": "caller",
+                "projected": {
+                  "defaultMode": 288,
+                  "sources": [
+                    {
+                      "serviceAccountToken": {
+                        "path": "token",
+                        "audience": "flex-auth",
+                        "expirationSeconds": 3600
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "audit",
+                "secret": {
+                  "secretName": "informed-decision-audit",
+                  "defaultMode": 288,
+                  "items": [
+                    {
+                      "key": "token",
+                      "path": "token"
+                    }
+                  ]
+                }
+              }
+            ]
+          }
+        }
+      }
+    }
+  ]
+}
--- a/docs/evidence/2026-10-03-provisioning-window-ci-image.json
+++ b/docs/evidence/2026-10-03-provisioning-window-ci-image.json
@ -0,0 +1,9 @@
+{
+  "source_commit": "f946c7b709e259e22b078b3e78b0c06fd2eea038",
+  "ci_status": "success",
+  "policy_image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:f6fa2062f7095e66c7a91f20cd130914b5481d46d9d909339e028f7ecdf0065d",
+  "policy_package_digest": "sha256:2490955f175c52574543e210be06f468a01e56c778d38d4fdcad731875e37cc7",
+  "policy_version": "v7",
+  "p01_synthetic_read": "allow",
+  "scope": "offline published-image evaluator; no live rollout or human binding"
+}
--- a/workplans/ADHOC-2026-10-03.md
+++ b/workplans/ADHOC-2026-10-03.md
@ -71,3 +71,12 @@ validation/tests also passed. Candidate package digest:
 `sha256:2490955f175c52574543e210be06f468a01e56c778d38d4fdcad731875e37cc7`.
 Evidence: `docs/evidence/2026-10-03-provisioning-window-policy-candidate-checks.json`
 and `docs/evidence/2026-10-03-provisioning-window-admission-candidate.json`.
+
+A4 publication: founder applied the tested patch. Access-engine committed and
+synced it as `f946c7b`; CI published image
+`sha256:f6fa2062f7095e66c7a91f20cd130914b5481d46d9d909339e028f7ecdf0065d`.
+Published-image evaluation confirms v7 and the expected package digest.
+Deployment values are pinned in access-engine commit `20ea612`.
+`docs/batches/2026-10-03-provisioning-window/DEPLOY-v7.md` records the concrete
+policy/review rollout candidate, namespace-scoped preflight and rollback.
+Live rollout awaits founder approval. Load and human disposition remain open.