Prepare owner-reviewed zlib-only native release decision
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
parent
8d093c57c2
commit
312ab97e87
597 changed files with 119341 additions and 2 deletions
|
|
@ -1,5 +1,5 @@
|
|||
{
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"policy": {
|
||||
"origin": "http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080",
|
||||
"package": "informed-decision.compact-sitting",
|
||||
|
|
|
|||
|
|
@ -96,7 +96,7 @@
|
|||
"containers": [
|
||||
{
|
||||
"name": "informed-decision",
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"securityContext": {
|
||||
"allowPrivilegeEscalation": false,
|
||||
"readOnlyRootFilesystem": true,
|
||||
|
|
|
|||
|
|
@ -0,0 +1,73 @@
|
|||
{
|
||||
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
|
||||
"candidate_local_image_config_id": "sha256:622becc3ebd97cb66b6e7c36f35bf931a7decd9464b65851123c1cc8c998d75b",
|
||||
"candidate_registry_digest": null,
|
||||
"base_layers_preserved": 9,
|
||||
"new_layers": 2,
|
||||
"effective_runtime_config_identical": true,
|
||||
"raw_config_bytes_identical": false,
|
||||
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
|
||||
"labels_before": {
|
||||
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
|
||||
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"labels_after": {
|
||||
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"org.opencontainers.image.revision": "9b4bb25d325698ae543e7e8a8a3c3592db1f58fc",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
|
||||
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"final_changed_files": {
|
||||
"lib/apk/db/installed": {
|
||||
"before": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
|
||||
]
|
||||
},
|
||||
"usr/lib/libz.so.1.3.2": {
|
||||
"before": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
|
||||
]
|
||||
}
|
||||
},
|
||||
"directory_metadata_compared": true,
|
||||
"directory_count_base": 313,
|
||||
"directory_count_candidate": 313,
|
||||
"directory_metadata_delta": {},
|
||||
"sbom_package_count_base": 44,
|
||||
"sbom_package_count_candidate": 44,
|
||||
"sbom_only_delta": {
|
||||
"zlib": [
|
||||
"1.3.2-r0",
|
||||
"1.3.2-r1"
|
||||
]
|
||||
},
|
||||
"full_scan_baseline_findings": 1,
|
||||
"full_scan_candidate_allseverity_findings": 0,
|
||||
"db_snapshot_same": true,
|
||||
"native_workload_changed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,286 @@
|
|||
{
|
||||
"apiVersion": "apps/v1",
|
||||
"kind": "Deployment",
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"argocd.argoproj.io/tracking-id": "informed-decision:apps/Deployment:informed-decision/informed-decision",
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision",
|
||||
"uid": "a588e10a-90d2-4883-975e-6dd8b8feca92"
|
||||
},
|
||||
"spec": {
|
||||
"progressDeadlineSeconds": 600,
|
||||
"replicas": 1,
|
||||
"revisionHistoryLimit": 10,
|
||||
"selector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"strategy": {
|
||||
"type": "Recreate"
|
||||
},
|
||||
"template": {
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"labels": {
|
||||
"app.kubernetes.io/component": "review",
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"automountServiceAccountToken": false,
|
||||
"containers": [
|
||||
{
|
||||
"env": [
|
||||
{
|
||||
"name": "INFD_KEYCAPE_ISSUER",
|
||||
"value": "https://kc.coulomb.social"
|
||||
},
|
||||
{
|
||||
"name": "INFD_CONTAINER_CONFIG",
|
||||
"value": "/configuration/runtime.json"
|
||||
}
|
||||
],
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"imagePullPolicy": "IfNotPresent",
|
||||
"livenessProbe": {
|
||||
"failureThreshold": 3,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"name": "informed-decision",
|
||||
"ports": [
|
||||
{
|
||||
"containerPort": 8080,
|
||||
"name": "http",
|
||||
"protocol": "TCP"
|
||||
},
|
||||
{
|
||||
"containerPort": 8081,
|
||||
"name": "workload",
|
||||
"protocol": "TCP"
|
||||
}
|
||||
],
|
||||
"readinessProbe": {
|
||||
"failureThreshold": 3,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"resources": {
|
||||
"limits": {
|
||||
"cpu": "500m",
|
||||
"memory": "256Mi"
|
||||
},
|
||||
"requests": {
|
||||
"cpu": "5m",
|
||||
"memory": "64Mi"
|
||||
}
|
||||
},
|
||||
"securityContext": {
|
||||
"allowPrivilegeEscalation": false,
|
||||
"capabilities": {
|
||||
"drop": [
|
||||
"ALL"
|
||||
]
|
||||
},
|
||||
"readOnlyRootFilesystem": true
|
||||
},
|
||||
"startupProbe": {
|
||||
"failureThreshold": 12,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"terminationMessagePath": "/dev/termination-log",
|
||||
"terminationMessagePolicy": "File",
|
||||
"volumeMounts": [
|
||||
{
|
||||
"mountPath": "/data",
|
||||
"name": "data"
|
||||
},
|
||||
{
|
||||
"mountPath": "/run/informed-decision",
|
||||
"name": "runtime"
|
||||
},
|
||||
{
|
||||
"mountPath": "/tmp",
|
||||
"name": "tmp"
|
||||
},
|
||||
{
|
||||
"mountPath": "/configuration",
|
||||
"name": "configuration",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/policy",
|
||||
"name": "caller",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/audit",
|
||||
"name": "audit",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/kubernetes",
|
||||
"name": "kubernetes-api",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/workload-registry",
|
||||
"name": "workload-registry",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/requester",
|
||||
"name": "sitting-requester",
|
||||
"readOnly": true
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"dnsPolicy": "ClusterFirst",
|
||||
"restartPolicy": "Always",
|
||||
"schedulerName": "default-scheduler",
|
||||
"securityContext": {
|
||||
"fsGroup": 10001,
|
||||
"fsGroupChangePolicy": "OnRootMismatch",
|
||||
"runAsGroup": 10001,
|
||||
"runAsNonRoot": true,
|
||||
"runAsUser": 10001,
|
||||
"seccompProfile": {
|
||||
"type": "RuntimeDefault"
|
||||
}
|
||||
},
|
||||
"serviceAccount": "review",
|
||||
"serviceAccountName": "review",
|
||||
"terminationGracePeriodSeconds": 45,
|
||||
"volumes": [
|
||||
{
|
||||
"name": "data",
|
||||
"persistentVolumeClaim": {
|
||||
"claimName": "informed-decision-data"
|
||||
}
|
||||
},
|
||||
{
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
},
|
||||
"name": "runtime"
|
||||
},
|
||||
{
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
},
|
||||
"name": "tmp"
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"defaultMode": 292,
|
||||
"name": "informed-decision-runtime-6c221878d051"
|
||||
},
|
||||
"name": "configuration"
|
||||
},
|
||||
{
|
||||
"name": "caller",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"audience": "flex-auth",
|
||||
"expirationSeconds": 3600,
|
||||
"path": "token"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "audit",
|
||||
"secret": {
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "token",
|
||||
"path": "token"
|
||||
}
|
||||
],
|
||||
"secretName": "informed-decision-audit"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "kubernetes-api",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"expirationSeconds": 600,
|
||||
"path": "token"
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"items": [
|
||||
{
|
||||
"key": "ca.crt",
|
||||
"path": "ca.crt"
|
||||
}
|
||||
],
|
||||
"name": "kube-root-ca.crt"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"defaultMode": 292,
|
||||
"name": "informed-decision-workload-registry"
|
||||
},
|
||||
"name": "workload-registry"
|
||||
},
|
||||
{
|
||||
"name": "sitting-requester",
|
||||
"secret": {
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "client-secret",
|
||||
"path": "client-secret"
|
||||
}
|
||||
],
|
||||
"optional": false,
|
||||
"secretName": "informed-decision-sitting-requester"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
File diff suppressed because one or more lines are too long
68
docs/evidence/2026-10-11-zlib-image-release/change_guard.py
Normal file
68
docs/evidence/2026-10-11-zlib-image-release/change_guard.py
Normal file
|
|
@ -0,0 +1,68 @@
|
|||
"""Read-only exact Deployment and admission boundaries; no mutation authority."""
|
||||
import copy
|
||||
import hashlib
|
||||
import json
|
||||
|
||||
BASE = 'forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a'
|
||||
CANDIDATE = 'forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23'
|
||||
|
||||
|
||||
def dependency_projection(configmap, pvc):
|
||||
if (configmap.get('kind') != 'ConfigMap' or configmap.get('immutable') is not True
|
||||
or configmap['metadata']['namespace'] != 'informed-decision'
|
||||
or configmap['metadata']['name'] != 'informed-decision-runtime-6c221878d051'
|
||||
or set(configmap.get('data', {})) != {'runtime.json'}
|
||||
or configmap.get('binaryData')):
|
||||
raise ValueError('unexpected immutable runtime config identity')
|
||||
if (pvc.get('kind') != 'PersistentVolumeClaim'
|
||||
or pvc['metadata']['namespace'] != 'informed-decision'
|
||||
or pvc['metadata']['name'] != 'informed-decision-data'
|
||||
or pvc.get('status', {}).get('phase') != 'Bound'
|
||||
or not pvc.get('spec', {}).get('volumeName')):
|
||||
raise ValueError('unexpected bound PVC custody')
|
||||
config = projection(configmap)
|
||||
config.pop('data')
|
||||
config['canonical_data_sha256'] = hashlib.sha256(json.dumps(
|
||||
configmap['data'], sort_keys=True, separators=(',', ':')).encode()).hexdigest()
|
||||
return {'configmap': config, 'pvc': projection(pvc), 'pvc_phase': 'Bound'}
|
||||
|
||||
|
||||
def check_dependencies(configmap, pvc, sealed):
|
||||
if dependency_projection(configmap, pvc) != sealed:
|
||||
raise ValueError('runtime config or PVC identity/custody changed')
|
||||
|
||||
|
||||
def projection(value):
|
||||
value = copy.deepcopy(value)
|
||||
value.pop('status', None)
|
||||
for key in ('resourceVersion', 'generation', 'creationTimestamp', 'managedFields'):
|
||||
value['metadata'].pop(key, None)
|
||||
for key in ('kubectl.kubernetes.io/last-applied-configuration', 'deployment.kubernetes.io/revision'):
|
||||
value['metadata'].get('annotations', {}).pop(key, None)
|
||||
return value
|
||||
|
||||
|
||||
def check_current(current, sealed):
|
||||
if projection(current) != sealed:
|
||||
raise ValueError('sealed live UID or configuration changed')
|
||||
|
||||
|
||||
def check_admitted(admitted, sealed):
|
||||
expected = copy.deepcopy(sealed)
|
||||
containers = expected['spec']['template']['spec']['containers']
|
||||
if len(containers) != 1 or containers[0]['name'] != 'informed-decision' or containers[0]['image'] != BASE:
|
||||
raise ValueError('unexpected baseline container identity')
|
||||
containers[0]['image'] = CANDIDATE
|
||||
if projection(admitted) != expected:
|
||||
raise ValueError('admission changed configuration beyond the sole image pin')
|
||||
|
||||
|
||||
def transport_result(exit_code, output):
|
||||
import json
|
||||
try:
|
||||
value = json.loads(output)
|
||||
except (ValueError, TypeError):
|
||||
return {'all_checks_pass': False, 'reason': 'invalid transport result'}
|
||||
if exit_code != 0 or not isinstance(value, dict) or value.get('all_checks_pass') is not True:
|
||||
return {'all_checks_pass': False, 'reason': 'read-only preflight refused'}
|
||||
return value
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
import copy,json,time
|
||||
from datetime import datetime,timezone
|
||||
from informed_decision.policy import PolicyClient,CONTRACT,submitted_digest
|
||||
pin='sha256:'+'b'*64
|
||||
req={'id':'image-purpose-fixture','tenant':'tenant:platform','subject':{'id':'synthetic','type':'service','tenant':'tenant:platform'},'resource':{'id':'memo:fixture','type':'memo','system':'informed-decision','tenant':'tenant:platform'},'action':'register','context':{}}
|
||||
class Transport:
|
||||
def request(self,*args,**kwargs):
|
||||
now=time.time(); stamp=lambda t:datetime.fromtimestamp(t,timezone.utc).isoformat()
|
||||
b={**copy.deepcopy({k:req[k] for k in ('tenant','subject','action','resource','context')}),'request_digest':'sha256:'+'e'*64,'submitted_request_digest':submitted_digest(req)}
|
||||
if self.purpose!='ABSENT':b['purpose']=self.purpose
|
||||
d={'id':'synthetic-decision','contract_version':CONTRACT,'request_id':req['id'],'effect':'allow','matched_policy_version':'v1','subject':req['subject'],'resource':req['resource'],'binding':b,'lifetime':{'kind':'ttl','not_before':stamp(now-1),'expires_at':stamp(now+60)},'provenance':{'policy_package':'fixture','policy_version':'v1','policy_package_digest':pin,'registry_snapshot_digest':'sha256:'+'c'*64,'evaluator':'flex-auth/fixture','decision_time':stamp(now)}}
|
||||
return 200,d
|
||||
checks=[]
|
||||
for purpose in ('ABSENT','','readback','enforcement','unknown',None,False,0,[],{}):
|
||||
t=Transport();t.purpose=purpose
|
||||
c=PolicyClient('https://fixture.invalid',lambda:'synthetic-only',package='fixture',version='v1',package_digest=pin,transport=t)
|
||||
o=c.check(req)
|
||||
if purpose in ('ABSENT',''):assert o.outcome=='allow';o.require_current(time.time())
|
||||
else:assert o.outcome=='invalid_decision' and o.decision_json is None
|
||||
checks.append(str(purpose))
|
||||
print(json.dumps({'installed_image_purpose_variants':len(checks),'binding_forms_allowed':2,'advisory_or_malformed_refused':8,'synthetic_only':True,'native_provider':False}))
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
# Requested decision
|
||||
|
||||
Approve the exact new T05 zlib-only image release and protected same-schema compatibility drill, after final independent Product and Platform acknowledgments. This packet is prepared and unapproved; fresh rollback server dry-run passed with exactly the baseline image and empty diff. Root retains exact final owner source revision and independent acknowledgments before asking for native founder disposition. The prior T04 approval is excluded.
|
||||
|
||||
The admitted owner CI published immutable image f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23 from source9b4bb25d325698ae543e7e8a8a3c3592db1f58fc. Its actual full scan reports zero findings across44packages. The same scan DB finds oneMEDIUM on currentimage763c. Signed official Alpine zlib1.3.2-r1 is the sole package change; actual published filesystem proof shows onlylibz andAPKinstalleddatabase changes, zero313directorymetadata changes, retainedninebaselayers and unchanged36applicationfiles/purposepolicy/config/credentials/audience/resources. Registry-to-daemon config serialization differs under closed verified normalization, without runtime change.
|
||||
|
||||
The exact ordered protected drill and release are specified in native-backup-restore-protocol.md and hash-bound execution bundle. New backup paths, isolated clone and journal are distinct from old evidence. Real private data will enter only approved private custody and the isolated no-network clone; content never enters public evidence. Failed/uncertain phase states remain durable and cannot be retried. Prior T04 failed copy/verify are preserved.
|
||||
|
||||
After schema5/integrity/exactclonecounts pass and clone cleanup succeeds, fresh cutover backup/copy precedes the exact manual image-only Deployment sync. Current baseline is healthygeneration25/image763c/Applicationc96. ImmutableCM6c/PVC/Podconfiguration/PDP origins remain sealed. FreshnodeCPU3460of4000m supports unchangedRecreate, with another check before effect. Brief availability interruption expected.
|
||||
|
||||
Rollback restores Deploymentimage763c andApplicationc96 while retaining latestschema5database; no old snapshot restoration. Separate installed/native health/custody/PDP-gated readback and actual native image rescan precede T05 closure. Allphase starts expireOct12 23:59:59Z; release reserves30minutesforverificationandrecovery. Afterexpiry a newfounderdecision is required. EUR0newrecurringinfrastructure, boundedprivate storage andunpricedattendedtime. No newdoctrine/autopilot/credentialgrant is authorized.
|
||||
|
||||
|
||||
## Explicit recovery decision
|
||||
|
||||
Also approve the proposed item19 manual service-outage recovery term above: exact historical rootconfirmed acceptance captured before release may authorize only same763/c96 one-Deployment/latestDB-preserving rollback after failedf558 service outage, within30minutes AND the existingdeadline. Root must retain freshunavailable/failedcandidate witnesses and exactcache/journal/custody pins. Duringserviceoutage subsequentrevocation cannot bechecked; this bounded uncertainty is expressly disclosed and consented to in this new decision. No401/403/revoked/conflict/mismatch/healthyservice fallback, no backup/release fallback or future/customer-production reuse. Ordinaryfreshreadback remains preferred. Recovered placement is verified separately; rollback grants no claim of currentPDPsuccess or T05closure. See fullprotocol andclose-downchecklistitem19(PROPOSEDuntilactualacceptance).
|
||||
|
||||
|
||||
Post-Ready provider preservation proof records only fixed canonical sourceT05@1 request identity (derived from the authenticated route), HTTP200/timestamp and review-presence/disposition count. Actual native outcomes need not contain top-level memo identity. No review/disposition/state/actor body is exported or interpreted, and no currentapproval/acceptance is inferred from this provider proof. Actual founder go remains separate. Exact prior481 bytes and both completed contract reviews are retained by digest maps; unchanged history is not recopied.
|
||||
File diff suppressed because one or more lines are too long
|
|
@ -0,0 +1,399 @@
|
|||
"""One fixed supervised phase; never run this during source preparation."""
|
||||
import argparse
|
||||
import hashlib
|
||||
import json
|
||||
import os
|
||||
from pathlib import Path
|
||||
import re
|
||||
import selectors
|
||||
import stat
|
||||
import subprocess
|
||||
import sys
|
||||
import time
|
||||
|
||||
if sys.flags.optimize:
|
||||
raise SystemExit('optimized interpreter refused')
|
||||
|
||||
PHASES = ('drill-backup', 'drill-copy', 'offline-verify', 'cleanup-offline',
|
||||
'cutover-backup', 'cutover-copy', 'release', 'verify', 'rollback', 'rollback-verify')
|
||||
|
||||
|
||||
def require(value, reason):
|
||||
if not value:
|
||||
raise ValueError(reason)
|
||||
|
||||
|
||||
def sha(path):
|
||||
digest = hashlib.sha256()
|
||||
with Path(path).open('rb') as stream:
|
||||
for block in iter(lambda: stream.read(1024**2), b''):
|
||||
digest.update(block)
|
||||
return digest.hexdigest()
|
||||
|
||||
|
||||
def private(path, directory=False):
|
||||
info = Path(path).lstat()
|
||||
require((stat.S_ISDIR(info.st_mode) if directory else stat.S_ISREG(info.st_mode))
|
||||
and info.st_uid == os.getuid() and stat.S_IMODE(info.st_mode) == (0o700 if directory else 0o600)
|
||||
and (directory or info.st_nlink == 1), 'private owned custody required')
|
||||
|
||||
ROOT = Path(__file__).resolve().parent
|
||||
CASE = ROOT.parent
|
||||
OWNER = Path('/home/worsch/informed-decision')
|
||||
CUSTODIAN = Path('/home/worsch/the-custodian')
|
||||
CUSTODY = CUSTODIAN / '.private-backups/20261011-infd-zlib-r1'
|
||||
SOCKET = 'unix:///var/run/docker.sock'
|
||||
IMAGE = 'forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23'
|
||||
VOLUME = 'infd-zlib-r1-restore-20261011'
|
||||
MAX_BYTES = 512 * 1024**2
|
||||
|
||||
|
||||
def run(argv, body=None, timeout=90):
|
||||
return subprocess.run(argv, input=body, text=True, capture_output=True, timeout=timeout)
|
||||
|
||||
|
||||
def json_result(result):
|
||||
try:
|
||||
value = json.loads(result.stdout)
|
||||
except (ValueError, TypeError):
|
||||
raise ValueError('safe phase receipt unavailable; outcome uncertain') from None
|
||||
require(result.returncode == 0 and isinstance(value, dict) and value.get('all_checks_pass') is True,
|
||||
'phase did not verify complete; raw output withheld; no retry')
|
||||
permitted = {'phase', 'all_checks_pass', 'raw_output_withheld', 'native_approval_verified_by_root',
|
||||
'native_authenticated_grant', 'source_readonly_baseline', 'snapshot_readonly',
|
||||
'snapshot_sha256', 'snapshot_bytes', 'snapshot_file', 'native_parent_private',
|
||||
'native_uid', 'pod_name', 'pod_uid', 'live_readonly_schema_integrity_counts',
|
||||
'live_counts_may_include_concurrent_commits', 'operation_requested', 'source_revision',
|
||||
'resources', 'prune', 'rollout_verified', 'latest_live_database_retained',
|
||||
'client_diff_sha256', 'native_rollout_verified', 'current_schema5_database_retained',
|
||||
'private_copy_verified', 'installed_purpose_checks', 'policy_sha256',
|
||||
'policy_mode', 'policy_uid', 'installed_zlib_files', 'zlib_package', 'health_statuses', 'native_provider_probe', 'recovery_verification'}
|
||||
require(set(value) <= permitted, 'unexpected output fields withheld')
|
||||
from receipt_safety import counts
|
||||
for name in ('source_readonly_baseline', 'snapshot_readonly', 'live_readonly_schema_integrity_counts'):
|
||||
if name in value:
|
||||
counts(value[name])
|
||||
for name in ('snapshot_sha256', 'client_diff_sha256'):
|
||||
if name in value:
|
||||
require(re.fullmatch(r'[a-f0-9]{64}', value[name]) is not None, 'invalid output digest withheld')
|
||||
if 'snapshot_bytes' in value:
|
||||
require(type(value['snapshot_bytes']) is int and 0 < value['snapshot_bytes'] <= MAX_BYTES,
|
||||
'invalid output size withheld')
|
||||
if 'snapshot_file' in value:
|
||||
require(value['snapshot_file'] in ('drill.sqlite', 'cutover.sqlite'), 'invalid output file withheld')
|
||||
return value
|
||||
|
||||
|
||||
def docker(argv, body=None, timeout=120):
|
||||
return run(['docker', '--config', str(CUSTODY / 'empty-docker-config'), '--host', SOCKET] + argv,
|
||||
body=body, timeout=timeout)
|
||||
|
||||
|
||||
def remote(phase, revision, approved, snapshot_identity=None, operation_intent=None, outage_recovery=False, recovery_release_started_at=None):
|
||||
# Fixed module imported only after main verifies every executor source hash.
|
||||
from native_program import PROGRAM
|
||||
payload = {'snapshot_identity': snapshot_identity, 'operation_intent': operation_intent, 'outage_recovery': outage_recovery, 'recovery_release_started_at': recovery_release_started_at, 'phase': phase, 'source_revision': revision, 'approval': approved,
|
||||
'sealed': json.loads((CASE / 'sealed-live-deployment.json').read_text()),
|
||||
'dependencies': json.loads((CASE / 'sealed-native-dependencies.json').read_text()),
|
||||
'candidate': json.loads((CASE / 'candidate-deployment.json').read_text()),
|
||||
'rollback': json.loads((CASE / 'rollback-deployment.json').read_text()),
|
||||
'receipt_safety': (ROOT / 'receipt_safety.py').read_text(),
|
||||
'purpose_checks': (CASE / 'check_installed.py').read_text(),
|
||||
'installed_zlib': json.loads((CASE / 'installed-zlib-proof.json').read_text()), 'readonly': (CASE / 'sqlite_readonly.py').read_text()}
|
||||
script = PROGRAM.replace('__PAYLOAD__', repr(json.dumps(payload))).replace(
|
||||
'__GUARD__', repr((CASE / 'change_guard.py').read_text()))
|
||||
return json_result(run(['ssh', 'railiance01', 'python3 -'], script, timeout=200))
|
||||
|
||||
|
||||
def copy_snapshot(phase, revision, approved, journal):
|
||||
backup_phase = 'drill-backup' if phase == 'drill-copy' else 'cutover-backup'
|
||||
prior = journal.data['phases'][backup_phase]['result']
|
||||
metadata = remote(phase, revision, approved, snapshot_identity=prior)
|
||||
for key in ('snapshot_sha256', 'snapshot_bytes', 'snapshot_file', 'snapshot_readonly'):
|
||||
require(metadata[key] == prior[key], 'closed frozen snapshot changed')
|
||||
name = metadata['snapshot_file']
|
||||
require(name in ('drill.sqlite', 'cutover.sqlite') and 0 < metadata['snapshot_bytes'] <= MAX_BYTES,
|
||||
'fixed bounded snapshot required')
|
||||
pod = metadata['pod_name']
|
||||
require(re.fullmatch(r'[a-z0-9]([-a-z0-9]*[a-z0-9])?', pod) is not None, 'fixed owner pod name required')
|
||||
local = CUSTODY / name
|
||||
fd = os.open(local, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600)
|
||||
# Binary snapshot stdout goes only to a private file, never tool/chat/log output.
|
||||
# Snapshot schema/count metadata was validated before opening this destination.
|
||||
with os.fdopen(fd, 'wb') as destination:
|
||||
command = ('kubectl exec -n informed-decision ' + pod +
|
||||
' -c informed-decision -- cat /data/private/zlib85091-r1/' + name)
|
||||
transfer = subprocess.Popen(['ssh', 'railiance01', command], stdout=subprocess.PIPE,
|
||||
stderr=subprocess.DEVNULL)
|
||||
selector = selectors.DefaultSelector()
|
||||
selector.register(transfer.stdout, selectors.EVENT_READ)
|
||||
deadline = time.monotonic() + 150
|
||||
received = 0
|
||||
try:
|
||||
while True:
|
||||
remaining = deadline - time.monotonic()
|
||||
require(remaining > 0 and selector.select(remaining), 'private transfer timed out')
|
||||
block = os.read(transfer.stdout.fileno(), 1024**2)
|
||||
if not block:
|
||||
break
|
||||
received += len(block)
|
||||
require(received <= metadata['snapshot_bytes'] and received <= MAX_BYTES,
|
||||
'private copy exceeds frozen snapshot size')
|
||||
destination.write(block)
|
||||
transfer.wait(timeout=max(1, deadline - time.monotonic()))
|
||||
finally:
|
||||
selector.close()
|
||||
transfer.stdout.close()
|
||||
if transfer.poll() is None:
|
||||
transfer.kill()
|
||||
transfer.wait()
|
||||
destination.flush()
|
||||
os.fsync(destination.fileno())
|
||||
private(local)
|
||||
require(transfer.returncode == 0 and local.stat().st_size == metadata['snapshot_bytes']
|
||||
and sha(local) == metadata['snapshot_sha256'], 'private copy incomplete/uncertain; retain, no retry')
|
||||
# Re-read identity/hash after transfer. This is verification, not a write retry.
|
||||
after = remote(phase, revision, approved, snapshot_identity=prior)
|
||||
require(after['pod_uid'] == metadata['pod_uid'] and after['snapshot_sha256'] == metadata['snapshot_sha256'],
|
||||
'source identity/snapshot changed during transfer')
|
||||
return {**metadata, 'off_cluster_private_copy_verified': True, 'snapshot_contents_output': False}
|
||||
|
||||
|
||||
def offline_verify(journal):
|
||||
from receipt_safety import counts
|
||||
snapshot = CUSTODY / 'drill.sqlite'
|
||||
private(snapshot)
|
||||
previous = journal.data['phases']['drill-copy']['result']
|
||||
require(sha(snapshot) == previous['snapshot_sha256'], 'protected snapshot bytes changed')
|
||||
identity = docker(['info', '--format', '{{json .Name}}'])
|
||||
require(identity.returncode == 0 and json.loads(identity.stdout) == 'bnt-lap001',
|
||||
'local offline Docker engine identity changed')
|
||||
listed = docker(['volume', 'ls', '--format', '{{.Name}}'])
|
||||
require(listed.returncode == 0 and VOLUME not in listed.stdout.splitlines(),
|
||||
'disposable volume absence not verified')
|
||||
nonce = journal.data['phases']['offline-verify']['attempt_id']
|
||||
labels = {'informed-decision.case': 'infd-zlib-20261011-r1',
|
||||
'informed-decision.use': 'offline-restore-only', 'informed-decision.attempt': nonce}
|
||||
created = docker(['volume', 'create', '--driver', 'local', '--label', 'informed-decision.case=infd-zlib-20261011-r1',
|
||||
'--label', 'informed-decision.attempt=' + nonce,
|
||||
'--label', 'informed-decision.use=offline-restore-only', VOLUME])
|
||||
require(created.returncode == 0 and created.stdout.strip() == VOLUME, 'volume creation uncertain; no retry')
|
||||
inspected = docker(['volume', 'inspect', VOLUME])
|
||||
require(inspected.returncode == 0, 'new volume identity unavailable')
|
||||
volume = json.loads(inspected.stdout)
|
||||
require(len(volume) == 1 and volume[0]['Name'] == VOLUME and volume[0].get('Labels') == labels
|
||||
and volume[0].get('Driver') == 'local' and not volume[0].get('Options')
|
||||
and volume[0].get('Scope') == 'local', 'new isolated volume identity changed')
|
||||
identity = {key: volume[0][key] for key in ('Name', 'Labels', 'Driver', 'Scope', 'CreatedAt')}
|
||||
journal.note('offline-verify', 'created_volume_identity', identity)
|
||||
# One-time UID0/CAP_CHOWN initialization is isolated to the NEW named volume.
|
||||
# No host/live PVC/config/token mount exists; this detail needs packet review.
|
||||
initializer = """import hashlib,os,stat,sys
|
||||
if sys.flags.optimize:raise RuntimeError('optimized interpreter refused')
|
||||
folder='/restore';expected=EXPECTED
|
||||
if os.listdir(folder):raise ValueError('new empty private volume required')
|
||||
os.chmod(folder,0o700)
|
||||
fd=os.open(folder+'/review.sqlite',os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW|os.O_WRONLY,0o600)
|
||||
digest=hashlib.sha256();size=0
|
||||
with os.fdopen(fd,'wb') as target:
|
||||
while True:
|
||||
block=sys.stdin.buffer.read(1024**2)
|
||||
if not block:break
|
||||
size+=len(block)
|
||||
if size>512*1024**2:raise ValueError('private restore size exceeds bound')
|
||||
target.write(block);digest.update(block)
|
||||
target.flush();os.fsync(target.fileno())
|
||||
if digest.hexdigest()!=expected:raise ValueError('private copied snapshot differs')
|
||||
os.chown(folder+'/review.sqlite',10001,10001);os.chown(folder,10001,10001)
|
||||
print('{"all_checks_pass":true,"private_copy_verified":true}')
|
||||
""".replace('EXPECTED', repr(previous['snapshot_sha256']))
|
||||
with snapshot.open('rb') as source:
|
||||
argv = ['docker', '--config', str(CUSTODY / 'empty-docker-config'), '--host', SOCKET,
|
||||
'run', '--rm', '-i', '--network', 'none', '--read-only', '--cpus', '1', '--memory', '128m',
|
||||
'--user', '0:0', '--cap-drop', 'ALL', '--cap-add', 'CHOWN',
|
||||
'--security-opt', 'no-new-privileges', '--mount', 'type=volume,src=' + VOLUME + ',dst=/restore',
|
||||
'--entrypoint', 'python', IMAGE, '-c', initializer]
|
||||
copied = subprocess.run(argv, stdin=source, text=True, capture_output=True, timeout=150)
|
||||
json_result(copied)
|
||||
options = ['run', '--rm', '-i', '--network', 'none', '--read-only', '--cpus', '1', '--memory', '128m',
|
||||
'--user', '10001:10001', '--cap-drop', 'ALL', '--security-opt', 'no-new-privileges',
|
||||
'--mount', 'type=volume,src=' + VOLUME + ',dst=/restore']
|
||||
readonly = docker(options + ['--entrypoint', 'python', IMAGE, '-', '--db', '/restore/review.sqlite'],
|
||||
(CASE / 'sqlite_readonly.py').read_text())
|
||||
require(readonly.returncode == 0, 'offline pre-open schema/integrity gate refused; never open Store')
|
||||
checked = counts(json.loads(readonly.stdout))
|
||||
require(checked == previous['snapshot_readonly'], 'frozen snapshot/clone readonly counts differ')
|
||||
admin = docker(options + ['--entrypoint', 'informed-decision-admin', IMAGE,
|
||||
'inspect', '--db', '/restore/review.sqlite'])
|
||||
require(admin.returncode == 0, 'offline admin result uncertain')
|
||||
admin_counts = json.loads(admin.stdout)
|
||||
require(admin_counts == {key: checked[key] for key in ('schema_version', 'lifecycle', 'outbox', 'submissions')},
|
||||
'offline admin changed frozen snapshot counters')
|
||||
# Admin Store construction must not silently alter schema/integrity/counters.
|
||||
post = docker(options + ['--entrypoint', 'python', IMAGE, '-', '--db', '/restore/review.sqlite'],
|
||||
(CASE / 'sqlite_readonly.py').read_text())
|
||||
require(post.returncode == 0, 'offline post-admin readonly integrity gate refused')
|
||||
post_checked = counts(json.loads(post.stdout))
|
||||
require(post_checked == checked == previous['snapshot_readonly'],
|
||||
'offline admin altered frozen snapshot proof')
|
||||
private(snapshot)
|
||||
require(sha(snapshot) == previous['snapshot_sha256'], 'original protected snapshot changed during drill')
|
||||
return {'all_checks_pass': True, 'offline_volume': VOLUME, 'offline_readonly': checked,
|
||||
'offline_post_admin_readonly': post_checked, 'original_snapshot_hash_unchanged': True,
|
||||
'created_volume_identity': identity,
|
||||
'admin_counts': admin_counts, 'network': 'none', 'runtime_tokens_or_config_mounted': False,
|
||||
'service_entrypoint_started': False, 'original_snapshot_retained': True}
|
||||
|
||||
|
||||
def cleanup_offline(journal):
|
||||
inspected = docker(['volume', 'inspect', VOLUME])
|
||||
require(inspected.returncode == 0, 'owned disposable volume identity unverified')
|
||||
value = json.loads(inspected.stdout)
|
||||
expected = journal.data['phases']['offline-verify']['result']['created_volume_identity']
|
||||
require(len(value) == 1 and {key: value[0].get(key) for key in expected} == expected
|
||||
and not value[0].get('Options'), 'volume ownership/recreation changed')
|
||||
removed = docker(['volume', 'rm', VOLUME])
|
||||
require(removed.returncode == 0 and removed.stdout.strip() == VOLUME
|
||||
and docker(['volume', 'inspect', VOLUME]).returncode != 0,
|
||||
'cleanup outcome ambiguous; do not retry')
|
||||
return {'all_checks_pass': True, 'only_disposable_offline_volume_removed': VOLUME,
|
||||
'native_and_offcluster_original_snapshots_retained': True}
|
||||
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser(description=__doc__)
|
||||
parser.add_argument('--phase', choices=PHASES, required=True)
|
||||
parser.add_argument('--root-authority-receipt', type=Path, required=True)
|
||||
parser.add_argument('--root-native-outcome', type=Path, required=True)
|
||||
parser.add_argument('--source-revision', required=True)
|
||||
parser.add_argument('--root-fresh-scan-receipt', type=Path, required=True)
|
||||
parser.add_argument('--root-recovery-receipt', type=Path)
|
||||
args = parser.parse_args()
|
||||
require(args.root_authority_receipt == Path('/tmp/security-infd-zlib-root-authority.json')
|
||||
and args.root_native_outcome == Path('/tmp/security-infd-zlib-native-outcome-latest.json'),
|
||||
'fixed supervised receipt paths required')
|
||||
require(re.fullmatch(r'[0-9a-f]{40}', args.source_revision) is not None, 'exact source commit required')
|
||||
# Verify all prepared executor/input bytes before reading authority or dispatching.
|
||||
plan = json.loads((ROOT / 'execution-plan.json').read_text())
|
||||
require(plan.get('state') == 'prepared-unapproved' and plan.get('published_artifact_verified') is True, 'unfrozen proposal cannot execute')
|
||||
require(set(plan['executor_files']) == {'actuator.py', 'authority_journal.py', 'native_program.py', 'receipt_safety.py'},
|
||||
'fixed executor sources required')
|
||||
require(set(plan['owner_source_files']) == {'deploy/lifecycle/admission.candidate.json',
|
||||
'deploy/lifecycle/service.candidate.json',
|
||||
'deploy/lifecycle/kustomization.yaml',
|
||||
'deploy/lifecycle/registries.candidate.json'},
|
||||
'fixed owner image sources required')
|
||||
for relative, digest in plan['executor_files'].items():
|
||||
target = ROOT / relative
|
||||
require(not target.is_symlink() and sha(target) == digest, 'executor source bytes changed')
|
||||
for relative, digest in plan['case_files'].items():
|
||||
require(not Path(relative).is_absolute() and '..' not in Path(relative).parts,
|
||||
'case source path escaped')
|
||||
target = CASE / relative
|
||||
require(not target.is_symlink() and sha(target) == digest, 'case source bytes changed')
|
||||
for relative, digest in plan['owner_source_files'].items():
|
||||
target = OWNER / relative
|
||||
require(not target.is_symlink() and sha(target) == digest, 'owner image-only source changed')
|
||||
committed = subprocess.run(['git', '-C', str(OWNER), 'show', args.source_revision + ':' + relative],
|
||||
capture_output=True)
|
||||
require(committed.returncode == 0 and hashlib.sha256(committed.stdout).hexdigest() == digest,
|
||||
'committed owner render source differs from approved inputs')
|
||||
head = run(['git', '-C', str(OWNER), 'rev-parse', 'HEAD'])
|
||||
require(head.returncode == 0 and head.stdout.strip() == args.source_revision, 'owner source HEAD differs')
|
||||
from authority_journal import Journal, authority, fresh_scan, recovery_authority
|
||||
private(args.root_authority_receipt)
|
||||
private(args.root_native_outcome)
|
||||
receipt = json.loads(args.root_authority_receipt.read_text())
|
||||
require(receipt.get('native_outcome_sha256') == sha(args.root_native_outcome), 'native outcome bytes changed')
|
||||
require(receipt.get('executor_plan_sha256') == sha(ROOT / 'execution-plan.json'),
|
||||
'root verified executor plan differs')
|
||||
outage_recovery=False;recovery_receipt=None;release_cache=None
|
||||
try:
|
||||
if args.root_recovery_receipt is not None:
|
||||
require(args.phase in ('rollback','rollback-verify') and args.root_recovery_receipt==Path('/tmp/security-infd-zlib-root-recovery-receipt.json'),'outage receipt is recovery-only at fixed path')
|
||||
private(args.root_recovery_receipt)
|
||||
supplied_outage=json.loads(args.root_recovery_receipt.read_text())
|
||||
import datetime
|
||||
root_verified=datetime.datetime.fromisoformat(receipt['verified_at'].replace('Z','+00:00'))
|
||||
outage_observed=datetime.datetime.fromisoformat(supplied_outage['observed_at'].replace('Z','+00:00'))
|
||||
require(root_verified.tzinfo is not None and outage_observed.tzinfo is not None,'typed outage observation required')
|
||||
require(root_verified>=outage_observed,'pre-outage historical acceptance is not current native readback')
|
||||
approved = authority(receipt, json.loads(args.root_native_outcome.read_text()), sha(CASE / 'memo.json'),args.source_revision,args.phase)
|
||||
except ValueError:
|
||||
current_outcome=json.loads(args.root_native_outcome.read_text())
|
||||
require(current_outcome.get('http_status') not in (401,403) and current_outcome.get('explicit_revoked') is not True and current_outcome.get('current_conflict') is not True and current_outcome.get('identity_or_scope_mismatch') is not True and current_outcome.get('review',{}).get('stale') is not True,'current denial revocation conflict or mismatch forbids recovery fallback')
|
||||
require(args.phase in ('rollback','rollback-verify') and args.root_recovery_receipt==Path('/tmp/security-infd-zlib-root-recovery-receipt.json'),'fresh authority required; no general fallback')
|
||||
private(args.root_recovery_receipt);private(CUSTODY,directory=True)
|
||||
cache_path=CUSTODY/'release-authority-cache.json';journal_path=CUSTODY/'execution-journal.json';private(cache_path);private(journal_path)
|
||||
release_cache=json.loads(cache_path.read_text());prior_journal=json.loads(journal_path.read_text());recovery_receipt=json.loads(args.root_recovery_receipt.read_text())
|
||||
require(sha(cache_path)==recovery_receipt.get('cache_sha256'),'retained pre-release authority cache bytes changed')
|
||||
require(prior_journal['identity']=={'proposal':plan['proposal_id'],'source_revision':args.source_revision,'memo_sha256':sha(CASE/'memo.json'),'plan_sha256':sha(ROOT/'execution-plan.json')},'recovery journal exact trial identity required')
|
||||
approved=recovery_authority(recovery_receipt,release_cache,prior_journal,sha(CASE/'memo.json'),args.source_revision,json.loads((CASE/'sealed-live-deployment.json').read_text()),json.loads((CASE/'sealed-native-dependencies.json').read_text()),args.phase)
|
||||
outage_recovery=True
|
||||
if args.phase in ('release', 'verify'):
|
||||
require(args.root_fresh_scan_receipt == Path('/tmp/security-infd-zlib-fresh-scan-receipt.json'), 'fixed fresh scan receipt path required')
|
||||
private(args.root_fresh_scan_receipt)
|
||||
scan_receipt=json.loads(args.root_fresh_scan_receipt.read_text())
|
||||
report_path=Path('/tmp/security-infd-zlib-fresh-scan-full.json');private(report_path)
|
||||
require(sha(report_path)==scan_receipt.get('full_report_sha256'), 'fresh scan report bytes changed')
|
||||
fresh_scan(scan_receipt,json.loads(report_path.read_text()),json.loads((CASE/'fresh-scan-contract.json').read_text()))
|
||||
parent = CUSTODY.parent
|
||||
private(parent, directory=True)
|
||||
ignored = run(['git', '-C', str(CUSTODIAN), 'check-ignore', '--no-index', str(CUSTODY / 'drill.sqlite')])
|
||||
require(ignored.returncode == 0, 'offcluster custody is not ignored')
|
||||
if not CUSTODY.exists():
|
||||
require(args.phase == 'drill-backup', 'first approved phase must create unique private custody')
|
||||
os.mkdir(CUSTODY, 0o700)
|
||||
private(CUSTODY, directory=True)
|
||||
capacity = os.statvfs(CUSTODY)
|
||||
require(capacity.f_bavail * capacity.f_frsize >= 2 * MAX_BYTES + 16 * 1024**2,
|
||||
'independent protected custody headroom insufficient')
|
||||
os.makedirs(CUSTODY / 'empty-docker-config', mode=0o700, exist_ok=True)
|
||||
private(CUSTODY / 'empty-docker-config', directory=True)
|
||||
require(not list((CUSTODY / 'empty-docker-config').iterdir()), 'public Docker read config must stay empty')
|
||||
journal = Journal(CUSTODY, {'proposal': plan['proposal_id'], 'source_revision': args.source_revision,
|
||||
'memo_sha256': sha(CASE / 'memo.json'), 'plan_sha256': sha(ROOT / 'execution-plan.json')})
|
||||
try:
|
||||
if args.phase=='release':
|
||||
cache={'root_authority':receipt,'native_outcome':json.loads(args.root_native_outcome.read_text()),'memo_sha256':sha(CASE/'memo.json'),'source_revision':args.source_revision,'plan_sha256':sha(ROOT/'execution-plan.json')}
|
||||
cache_path=CUSTODY/'release-authority-cache.json'
|
||||
fd=os.open(cache_path,os.O_WRONLY|os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW,0o600)
|
||||
with os.fdopen(fd,'w') as stream:
|
||||
json.dump(cache,stream,indent=2);stream.write('\n');stream.flush();os.fsync(stream.fileno())
|
||||
private(cache_path);directory=os.open(CUSTODY,os.O_DIRECTORY|os.O_RDONLY)
|
||||
try:os.fsync(directory)
|
||||
finally:os.close(directory)
|
||||
journal.start(args.phase, approved) # fsynced RUNNING before any phase effect.
|
||||
if args.phase=='release':journal.note(args.phase,'release_authority_cache_sha256',sha(cache_path))
|
||||
if outage_recovery:
|
||||
require(sha(CUSTODY/'release-authority-cache.json')==recovery_receipt['cache_sha256'],'release authority cache changed')
|
||||
journal.note(args.phase,'outage_recovery_receipt_sha256',sha(args.root_recovery_receipt))
|
||||
journal.note(args.phase,'outage_recovery_anchor',recovery_receipt)
|
||||
|
||||
if args.phase in ('drill-copy', 'cutover-copy'):
|
||||
result = copy_snapshot(args.phase, args.source_revision, approved, journal)
|
||||
elif args.phase == 'offline-verify':
|
||||
result = offline_verify(journal)
|
||||
elif args.phase == 'cleanup-offline':
|
||||
result = cleanup_offline(journal)
|
||||
else:
|
||||
result = remote(args.phase, args.source_revision, approved, operation_intent=journal.data['phases'].get('rollback' if args.phase == 'rollback-verify' else 'release') if args.phase in ('verify', 'rollback-verify') else None, outage_recovery=outage_recovery, recovery_release_started_at=journal.data['phases']['release']['started_at'] if outage_recovery else None)
|
||||
journal.finish(args.phase, result)
|
||||
print(json.dumps(result)) # Only count/hash/identity receipts, never snapshot bytes.
|
||||
except BaseException as error:
|
||||
safe = {'all_checks_pass': False, 'phase': args.phase, 'failure_class': type(error).__name__,
|
||||
'failure': 'fixed phase outcome uncertain; original evidence retained; no retry',
|
||||
'raw_output_withheld': True}
|
||||
if journal.data['phases'].get(args.phase, {}).get('state') == 'RUNNING':
|
||||
journal.finish(args.phase, safe)
|
||||
print(json.dumps(safe))
|
||||
raise SystemExit(1) from None
|
||||
finally:
|
||||
journal.close()
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
try:
|
||||
main()
|
||||
except Exception:
|
||||
raise SystemExit('supervised execution refused before phase; raw output withheld') from None
|
||||
|
|
@ -0,0 +1,233 @@
|
|||
"""Supervised receipt bookkeeping, not an authenticated approval provider."""
|
||||
import datetime
|
||||
import fcntl
|
||||
import hashlib
|
||||
import json
|
||||
import os
|
||||
import re
|
||||
from pathlib import Path
|
||||
import stat
|
||||
import uuid
|
||||
|
||||
FOUNDER = {'kind': 'person', 'sub': 'uid=platform-root,ou=people,dc=netkingdom,dc=local'}
|
||||
MEMO_ID = 'infd-20261011-zlib-remediation-r1'
|
||||
PROPOSAL = 'INFD-WP-0009-T05/zlib85091-r1'
|
||||
PHASES = ('drill-backup', 'drill-copy', 'offline-verify', 'cleanup-offline',
|
||||
'cutover-backup', 'cutover-copy', 'release', 'verify', 'rollback', 'rollback-verify')
|
||||
|
||||
|
||||
def require(value, reason):
|
||||
if not value:
|
||||
raise ValueError(reason)
|
||||
|
||||
|
||||
def sha(path):
|
||||
digest = hashlib.sha256()
|
||||
with Path(path).open('rb') as stream:
|
||||
for block in iter(lambda: stream.read(1024**2), b''):
|
||||
digest.update(block)
|
||||
return digest.hexdigest()
|
||||
|
||||
|
||||
def private(path, directory=False):
|
||||
info = Path(path).lstat()
|
||||
require((stat.S_ISDIR(info.st_mode) if directory else stat.S_ISREG(info.st_mode))
|
||||
and info.st_uid == os.getuid() and stat.S_IMODE(info.st_mode) == (0o700 if directory else 0o600)
|
||||
and (directory or info.st_nlink == 1), 'private owned custody required')
|
||||
|
||||
|
||||
def authority(receipt, outcome, memo_sha, source_revision, phase, now=None):
|
||||
"""Root must freshly verify native outcome at fixed ORIGIN outside this helper.
|
||||
|
||||
Receipt files/flags are not signed grants. This function checks the exact
|
||||
supervised receipt relation; existing harness/founder authority remains the
|
||||
actual permission boundary. It never authenticates a caller as human.
|
||||
"""
|
||||
now = now or datetime.datetime.now(datetime.timezone.utc)
|
||||
require(phase in PHASES, 'fixed phase required')
|
||||
require(receipt.get('proposal_id') == PROPOSAL and receipt.get('memo_id') == MEMO_ID
|
||||
and receipt.get('memo_version') == 1 and receipt.get('memo_sha256') == memo_sha
|
||||
and receipt.get('source_revision') == source_revision
|
||||
and receipt.get('activation') == 'APPROVED'
|
||||
and receipt.get('authority_mode') == 'ADMINISTER'
|
||||
and receipt.get('target') == 'realm:kubernetes/railiance01/informed-decision'
|
||||
and receipt.get('verification_method') == 'root-fixed-origin-native-readback'
|
||||
and receipt.get('runtime_authenticated_grant') is False
|
||||
and receipt.get('outcome_query') == '/lifecycle/memos/' + MEMO_ID + '/outcomes?version=1',
|
||||
'exact externally verified supervised receipt required')
|
||||
verified = datetime.datetime.fromisoformat(receipt['verified_at'].replace('Z', '+00:00'))
|
||||
require(verified.tzinfo is not None and 0 <= (now - verified).total_seconds() <= 120,
|
||||
'fresh root native readback required before every phase')
|
||||
deadline = datetime.datetime.fromisoformat('2026-10-12T23:59:59+00:00')
|
||||
require(now < deadline, 'approved execution window expired')
|
||||
if phase == 'release':
|
||||
require((deadline-now).total_seconds() >= 1800, 'reserve thirty minutes for verification and recovery')
|
||||
require(outcome.get('memo_id') == MEMO_ID and outcome.get('review', {}).get('stale') is False
|
||||
and outcome['review'].get('intake_state') == 'ready', 'native review is not ready/current')
|
||||
review_id = outcome['review']['memo_id']
|
||||
require(review_id == receipt.get('review_memo_id'), 'native review identity changed')
|
||||
accepted = [x for x in outcome.get('dispositions', [])
|
||||
if x.get('submission_state') == 'confirmed'
|
||||
and x.get('disposition', {}).get('verb') == 'accept'
|
||||
and x['disposition'].get('memo_version') == 1]
|
||||
require(len(accepted) == 1, 'one confirmed founder acceptance required')
|
||||
accepted = accepted[0]['disposition']
|
||||
require(accepted.get('actor') == FOUNDER and accepted.get('memo_id') == review_id
|
||||
and accepted.get('approval_id') == receipt.get('approval_id')
|
||||
and accepted.get('id') == receipt.get('disposition_id')
|
||||
and accepted.get('at') == receipt.get('accepted_at'), 'exact founder disposition mismatch')
|
||||
require(re.fullmatch(r'[a-f0-9-]{36}', accepted['approval_id']) is not None
|
||||
and re.fullmatch(r'disp-[a-f0-9-]{36}', accepted['id']) is not None
|
||||
and re.fullmatch(r'review-[a-f0-9-]{36}', review_id) is not None,
|
||||
'native disposition identifiers are malformed')
|
||||
accepted_at = datetime.datetime.fromisoformat(accepted['at'].replace('Z', '+00:00'))
|
||||
require(accepted_at.tzinfo is not None and accepted_at <= verified, 'acceptance time not bounded')
|
||||
return {key: receipt[key] for key in ('approval_id', 'disposition_id', 'accepted_at', 'verified_at')}
|
||||
|
||||
|
||||
def fresh_scan(receipt, report, contract, now=None):
|
||||
"""Root supervised scan bookkeeping; actual scanner proof stays retained."""
|
||||
now=now or datetime.datetime.now(datetime.timezone.utc)
|
||||
require(receipt.get('image')=='forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23'
|
||||
and receipt.get('artifact_source_revision')=='9b4bb25d325698ae543e7e8a8a3c3592db1f58fc'
|
||||
and receipt.get('scanner')=='aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969'
|
||||
and receipt.get('no_suppression') is True and receipt.get('full_allseverity_scan') is True
|
||||
and receipt.get('exit_code')==0,'exact full immutable artifact scan required')
|
||||
scanned=datetime.datetime.fromisoformat(receipt['completed_at'].replace('Z','+00:00'))
|
||||
metadata=receipt['db_metadata'];updated=datetime.datetime.fromisoformat(metadata['UpdatedAt'].replace('Z','+00:00'));next_update=datetime.datetime.fromisoformat(metadata['NextUpdate'].replace('Z','+00:00'))
|
||||
require(all(t.tzinfo is not None for t in (scanned,updated,next_update))
|
||||
and updated<=scanned<=now<next_update and (now-scanned).total_seconds()<=14400
|
||||
and metadata.get('Version')==2 and re.fullmatch(r'[a-f0-9]{64}',receipt.get('db_sha256','')) is not None,'scan or vulnerability database expired')
|
||||
require(isinstance(report,dict) and isinstance(report.get('Results'),list) and report['Results'],'retained full scan results required')
|
||||
require(report.get('SchemaVersion')==2 and report.get('ArtifactType')=='container_image','full immutable container scan schema required')
|
||||
metadata_report=report.get('Metadata',{});config=metadata_report.get('ImageConfig',{})
|
||||
require(metadata_report.get('ImageID')==contract['image_config_id'] and metadata_report.get('DiffIDs')==contract['diff_ids']
|
||||
and config.get('rootfs')==contract['image_config_rootfs'] and config.get('config',{}).get('Labels')==contract['image_source_labels']
|
||||
and metadata_report.get('OS')==contract['os'],'scan image config layers or source labels differ')
|
||||
classes=[(x.get('Class'),x.get('Type')) for x in report['Results']]
|
||||
require(sorted(classes)==[('lang-pkgs','python-pkg'),('os-pkgs','alpine')],'exact OS and Python scan coverage required')
|
||||
inventory=[]
|
||||
for result in report['Results']:
|
||||
packages=result.get('Packages');expected_count=38 if result['Class']=='os-pkgs' else 6
|
||||
require(isinstance(packages,list) and len(packages)==expected_count,'full package inventory coverage required')
|
||||
for package in packages:
|
||||
require(isinstance(package,dict) and isinstance(package.get('Name'),str) and isinstance(package.get('Version'),str)
|
||||
and isinstance(package.get('Identifier',{}).get('PURL'),str),'package identity absent')
|
||||
inventory.append([result['Class'],result['Type'],package['Name'],package['Version'],package['Identifier']['PURL']])
|
||||
inventory.sort();require(len({tuple(p) for p in inventory})==44 and inventory==contract['inventory']
|
||||
and hashlib.sha256(json.dumps(inventory,sort_keys=True,separators=(',',':')).encode()).hexdigest()==contract['inventory_canonical_sha256'],'immutable inventory differs from published 38 OS and 6 Python packages')
|
||||
require(any(p[0]=='os-pkgs' and p[2]=='zlib' and p[3]=='1.3.2-r1' for p in inventory),'fixed zlib package missing')
|
||||
for result in report['Results']:
|
||||
require(isinstance(result,dict) and isinstance(result.get('Vulnerabilities',[]),(list,type(None))),'full scan result invalid')
|
||||
require(not result.get('Vulnerabilities'),'new finding refuses release and closure')
|
||||
return {'full_report_sha256':receipt['full_report_sha256'],'db_sha256':receipt['db_sha256'],'completed_at':receipt['completed_at'],'next_update':metadata['NextUpdate'],'allseverity_findings':0}
|
||||
|
||||
|
||||
def recovery_authority(receipt, cache, journal, memo_sha, revision, sealed, dependencies, phase, now=None):
|
||||
"""Explicit new human term: supervised bounded service-outage recovery.
|
||||
|
||||
Cached acceptance is historical evidence, not a current revocation read or
|
||||
autonomous/signed grant. Root's fresh outage evidence never fabricates
|
||||
current outcomes. Only this trial's disclosed image/source recovery applies.
|
||||
"""
|
||||
now=now or datetime.datetime.now(datetime.timezone.utc)
|
||||
require(phase in ('rollback','rollback-verify'),'outage fallback is recovery-only')
|
||||
release=journal.get('phases',{}).get('release');require(isinstance(release,dict) and release.get('state') in ('RUNNING','UNCERTAIN','COMPLETE'),'recorded actual release attempt required')
|
||||
started=datetime.datetime.fromisoformat(release['started_at']);deadline=datetime.datetime.fromisoformat('2026-10-12T23:59:59+00:00')
|
||||
require(started.tzinfo is not None and 0<=(now-started).total_seconds()<=1800 and now<deadline,'bounded recovery window expired')
|
||||
require(receipt.get('kind')=='informed-decision.root-supervised-outage-recovery'
|
||||
and receipt.get('proposal_id')==PROPOSAL and receipt.get('source_revision')==revision and receipt.get('memo_sha256')==memo_sha
|
||||
and receipt.get('phase')==phase and receipt.get('release_attempt_id')==release['attempt_id']
|
||||
and receipt.get('cache_sha256')==release.get('release_authority_cache_sha256')
|
||||
and receipt.get('root_verified') is True and receipt.get('manual_supervised_recovery') is True
|
||||
and receipt.get('current_native_outcomes_claimed') is False,'exact supervised bounded recovery receipt required')
|
||||
observed=datetime.datetime.fromisoformat(receipt['observed_at'].replace('Z','+00:00'))
|
||||
require(observed.tzinfo is not None and 0<=(now-observed).total_seconds()<=120,'fresh outage observation required')
|
||||
require((receipt.get('native_probe_status')=='transport-unavailable' or type(receipt.get('native_probe_status')) is int and receipt['native_probe_status'] in (502,503,504))
|
||||
and receipt.get('explicit_revoked') is False and receipt.get('current_conflict') is False
|
||||
and receipt.get('identity_or_scope_mismatch') is False and receipt.get('service_healthy') is False,'outage recovery refuses denial/revocation/conflict/healthy service')
|
||||
require(receipt.get('deployment_uid')==sealed['metadata']['uid'] and receipt.get('configmap_uid')==dependencies['configmap']['metadata']['uid']
|
||||
and receipt.get('pvc_uid')==dependencies['pvc']['metadata']['uid']
|
||||
and receipt.get('rollback_image')=='forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a'
|
||||
and receipt.get('rollback_source')=='c96b0c6d881e855d1d158003c6de90ef390262e2','exact same-trial recovery custody required')
|
||||
previous=cache['root_authority'];require(previous.get('bounded_outage_rollback_pre_authorized') is True,'new human packet must expressly preauthorize outage recovery')
|
||||
verified=datetime.datetime.fromisoformat(previous['verified_at'].replace('Z','+00:00'))
|
||||
require(verified.tzinfo is not None and 0<=(started-verified).total_seconds()<=120,'cached root acceptance must precede actual release freshly')
|
||||
require(cache.get('memo_sha256')==memo_sha and cache.get('source_revision')==revision
|
||||
and cache.get('plan_sha256')==journal['identity']['plan_sha256'],'cache trial/source/plan differs')
|
||||
historical=authority(previous,cache['native_outcome'],memo_sha,revision,'release',verified)
|
||||
if phase=='rollback':
|
||||
placement=receipt.get('failed_candidate');require(isinstance(placement,dict) and placement.get('image')=='forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23'
|
||||
and placement.get('application_source')==revision and type(placement.get('ready_replicas')) is int and placement['ready_replicas']==0,'failed candidate placement required before recovery')
|
||||
else:
|
||||
rollback=journal['phases'].get('rollback');require(isinstance(rollback,dict) and rollback.get('state')=='COMPLETE'
|
||||
and rollback.get('outage_recovery_receipt_sha256')==receipt.get('original_outage_receipt_sha256')
|
||||
and isinstance(rollback.get('outage_recovery_anchor'),dict),'same-journal completed rollback and prior outage witness required')
|
||||
require(receipt.get('recovered_image')==receipt['rollback_image'] and receipt.get('recovered_application_source')==receipt['rollback_source']
|
||||
and type(receipt.get('ready_replicas')) is int and receipt['ready_replicas']==1,'separate exact recovered placement required')
|
||||
return {**historical,'bounded_outage_recovery':True,'current_revocation_verified':False}
|
||||
|
||||
|
||||
class Journal:
|
||||
def __init__(self, parent, identity):
|
||||
self.parent = Path(parent)
|
||||
private(self.parent, directory=True)
|
||||
self.path = self.parent / 'execution-journal.json'
|
||||
self.lock = os.open(self.parent / 'execution.lock', os.O_CREAT | os.O_NOFOLLOW | os.O_RDWR, 0o600)
|
||||
fcntl.flock(self.lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
|
||||
private(self.parent / 'execution.lock')
|
||||
if self.path.exists():
|
||||
private(self.path)
|
||||
self.data = json.loads(self.path.read_text())
|
||||
require(self.data['identity'] == identity, 'journal case/source identity changed')
|
||||
else:
|
||||
self.data = {'identity': identity, 'phases': {}}
|
||||
self.save()
|
||||
|
||||
def save(self):
|
||||
temporary = self.parent / 'execution-journal.new'
|
||||
fd = os.open(temporary, os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW | os.O_WRONLY, 0o600)
|
||||
try:
|
||||
with os.fdopen(fd, 'w') as stream:
|
||||
json.dump(self.data, stream, indent=2)
|
||||
stream.write('\n')
|
||||
stream.flush()
|
||||
os.fsync(stream.fileno())
|
||||
os.replace(temporary, self.path)
|
||||
directory = os.open(self.parent, os.O_DIRECTORY | os.O_RDONLY)
|
||||
try:
|
||||
os.fsync(directory)
|
||||
finally:
|
||||
os.close(directory)
|
||||
except BaseException:
|
||||
# Retain evidence rather than overwriting an uncertain durable intent.
|
||||
raise
|
||||
|
||||
def start(self, phase, approval):
|
||||
require(phase not in self.data['phases'], 'already attempted phase; no retry')
|
||||
predecessors = dict(zip(PHASES[1:8], PHASES[:7]))
|
||||
predecessors['rollback-verify'] = 'rollback'
|
||||
if phase in predecessors:
|
||||
require(self.data['phases'].get(predecessors[phase], {}).get('state') == 'COMPLETE',
|
||||
'preceding phase is not verified complete')
|
||||
if phase == 'rollback':
|
||||
require('release' in self.data['phases'], 'rollback requires a recorded release attempt')
|
||||
self.data['phases'][phase] = {'state': 'RUNNING', 'approval': approval,
|
||||
'attempt_id': str(uuid.uuid4()),
|
||||
'started_at': datetime.datetime.now(datetime.timezone.utc).isoformat()}
|
||||
self.save()
|
||||
|
||||
def note(self, phase, key, value):
|
||||
require(self.data['phases'][phase]['state'] == 'RUNNING', 'phase intent missing')
|
||||
self.data['phases'][phase][key] = value
|
||||
self.save()
|
||||
|
||||
def finish(self, phase, result):
|
||||
entry = self.data['phases'][phase]
|
||||
require(entry['state'] == 'RUNNING', 'phase intent missing')
|
||||
entry['result'] = result
|
||||
entry['state'] = 'COMPLETE' if result.get('all_checks_pass') is True else 'UNCERTAIN'
|
||||
self.save()
|
||||
|
||||
def close(self):
|
||||
os.close(self.lock)
|
||||
|
|
@ -0,0 +1,69 @@
|
|||
{
|
||||
"kind": "informed-decision.supervised-mechanical-release-plan",
|
||||
"version": 1,
|
||||
"proposal_id": "INFD-WP-0009-T05/zlib85091-r1",
|
||||
"trial_id": "infd-zlib-20261011-r1",
|
||||
"state": "prepared-unapproved",
|
||||
"executor_files": {
|
||||
"actuator.py": "43839e7c698dcc29472e14959c1c71970de6a305118414516245194a2399d6a1",
|
||||
"authority_journal.py": "db38ac605b48ce5c83b4fc5eb323ad34f06fa60a445f9ef276b302d358aa45fb",
|
||||
"native_program.py": "b064f14abdb14598a5d5c6fef0bad2f77b0a5854388f033c25003f210a2836da",
|
||||
"receipt_safety.py": "5c54373f2dc4b064008225c186efb1d5afdeec36d15350bda0a12ded97602d1b"
|
||||
},
|
||||
"case_files": {
|
||||
"post-ready-native-outcomes-command.py": "ddfe2619f4847238fe79ec779a15b0d8df5d178cbed989ac2d73c1480b57a706",
|
||||
"scan-receipt.json": "aaaa91061bb036e6d228b1c1bd4333578dc948cb2bb5ac8ba269429121e7321a",
|
||||
"source-commit-proof.json": "b0811da2d3bd5938733f0078e5fec8e19a6d9752c4277b80bfe9837ed72c6a3b",
|
||||
"candidate-deployment.json": "487f834cc86dcbc7a04c2392bde072ecaf87dc116b4baa16c35eb9c599ad5c95",
|
||||
"preparation-failure-history.json": "51b9983d2a806240f562dcb951955fc8360c181e6d08a8dfdcba95361c6dd596",
|
||||
"root-authority-receipt-template.json": "2a39b7dc5bf723c3596b6ffa071936705798e1a6ec674ac1f95fb3f3945949c0",
|
||||
"artifact-comparison.json": "a1c5d9e249dc00600449998360faf6e8da0206b568c76d155602c4645fa5fce4",
|
||||
"rollback-preflight-full.json": "0188799d352e4d49d5ca29d6e197742d02e96a4b0b399df1f478e41b25292eb5",
|
||||
"rollback-deployment.json": "f8a9a07abc2eb52cdf6bcdba2d9f79dec073145c31d0444a9e0fe1147e42cc4e",
|
||||
"fresh-scan-report-fixture.json": "30607043a4ca44e42024b63659ae10993c14c7a04e7c5685255ccafe4d3fb55c",
|
||||
"native-preflight-full.json": "56637994dfdae46a6f9ab442c2ff9b259212650b35eb98d896c5e837f01ce2f9",
|
||||
"sqlite_readonly.py": "9093c64f7f0e39b249da9fefdf5aaf4e4258bc31e7a27fd888479ce329a20509",
|
||||
"published-verification.json": "dd4eecf0c103dca7922094a8beeb99b77ae96fd1d5fe532e37bd833daa02614e",
|
||||
"sealed-native-dependencies.json": "042327a036ed254cf95dbeb0c056ac25b03a6a844b95a332c992df2943691369",
|
||||
"sealed-live-deployment.json": "f8a9a07abc2eb52cdf6bcdba2d9f79dec073145c31d0444a9e0fe1147e42cc4e",
|
||||
"native-preflight.json": "3b6b67a0b4d51ef791e775b528b64aa5a6f14eff629737e67baee7e2f6f60762",
|
||||
"fresh-scan-receipt-template.json": "92bbf8a891c7ef78df48430901219d8d07073cba74112a307a6d8bdec509e8dd",
|
||||
"root-recovery-receipt-template.json": "67b030c727377c0cc7edb9a1b66385044e7284c29d7a27dccaeaa5042ac7f297",
|
||||
"rollback-preflight.json": "4c3c3166205808e81326ccdae1b56afef757b0ceb4e6c96a17bf384317aeee4a",
|
||||
"installed-zlib-proof.json": "6af62f86f50ac185fab94163c24ac8150ead69e62f8d825b0dce1e75a5a57b68",
|
||||
"runtime-receipt.json": "6442676dcfd941f0a05a4cb79a02dea839fcd332d82b2154c15cf6db68de5889",
|
||||
"change_guard.py": "b3ee2b89de14e204efedd016d3900b6e31fcc9f0ea0f3125d3a4794d938ca201",
|
||||
"check_installed.py": "a34a51be9c9f2b16a06a88173b5c6c492c9957fe021cf412a86a1737730640ad",
|
||||
"candidate-runtime.json": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124",
|
||||
"fresh-scan-contract.json": "b13806a7e1464454e3817e1e62b56b0fa07fe2fddbd94d7fdc530e2c3dd9e3d2"
|
||||
},
|
||||
"owner_source_files": {
|
||||
"deploy/lifecycle/admission.candidate.json": "6c76cedd0abc4a4261cfcb69c6597611c282bd4fed8b6aaf77aff04fdf942529",
|
||||
"deploy/lifecycle/service.candidate.json": "383332cd4fd27a8b36e63a4d79addc43eb68615f742328d4577bfc2b467e2278",
|
||||
"deploy/lifecycle/kustomization.yaml": "1bbce81bc6758434354157f8601534320c5d0290587908fd15a6d25e3fa57f47",
|
||||
"deploy/lifecycle/registries.candidate.json": "9bad6db5fbc2178d31b04120016a41830c3552fbb9e2517b718f9bbe87cf649e"
|
||||
},
|
||||
"candidate_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"prior_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"source_revision": "must-be-exact-final-owner-HEAD-with-approved-four-Git-blobs",
|
||||
"phases": [
|
||||
"drill-backup",
|
||||
"drill-copy",
|
||||
"offline-verify",
|
||||
"cleanup-offline",
|
||||
"cutover-backup",
|
||||
"cutover-copy",
|
||||
"release",
|
||||
"verify",
|
||||
"rollback",
|
||||
"rollback-verify"
|
||||
],
|
||||
"authorization": "fresh externally authenticated root fixed-origin native readback before each phase; exact confirmed platform-root disposition and current packet SHA/source commit; receipt bookkeeping is not an autonomous signed grant",
|
||||
"execute_by": "2026-10-12T23:59:59Z",
|
||||
"raw_output_withheld": true,
|
||||
"native_data_or_workload_action_executed": false,
|
||||
"deadline_semantics": "All phases including verification/recovery must begin before execute_by. No extension or automatic emergency grant; beyond deadline stop and obtain a fresh founder decision. Complete the bounded drill and rollout early enough to allow recovery within the window.",
|
||||
"source_memo_version": 1,
|
||||
"native_review_memo_version": 1,
|
||||
"published_artifact_verified": true
|
||||
}
|
||||
File diff suppressed because one or more lines are too long
|
|
@ -0,0 +1,15 @@
|
|||
"""Only structural count/hash receipts can leave the private execution phase."""
|
||||
def counts(value):
|
||||
if (set(value) != {'schema_version', 'lifecycle', 'outbox', 'submissions', 'integrity',
|
||||
'read_only_pre_open', 'store_constructed'}
|
||||
or value['schema_version'] != 5 or value['integrity'] != 'ok'
|
||||
or value['read_only_pre_open'] is not True or value['store_constructed'] is not False
|
||||
or set(value['lifecycle']) != {'records', 'events', 'pending'}
|
||||
or not set(value['outbox']) <= {'pending', 'delivered', 'blocked'}
|
||||
or not set(value['submissions']) <= {'prepared', 'in_flight', 'confirmed', 'unresolved'}):
|
||||
raise ValueError('count-only receipt shape/state refused; values withheld')
|
||||
for group in ('lifecycle', 'outbox', 'submissions'):
|
||||
if any(type(number) is not int or number < 0 or number > 10**12
|
||||
for number in value[group].values()):
|
||||
raise ValueError('count-only receipt values refused')
|
||||
return value
|
||||
|
|
@ -0,0 +1,723 @@
|
|||
"""Synthetic custody/transport tests. No native data, Docker or cluster action."""
|
||||
import copy
|
||||
import datetime
|
||||
import io
|
||||
import json
|
||||
import os
|
||||
from pathlib import Path
|
||||
import subprocess
|
||||
import sys
|
||||
import tempfile
|
||||
import unittest
|
||||
from unittest.mock import patch
|
||||
from contextlib import redirect_stdout
|
||||
|
||||
import actuator
|
||||
from authority_journal import Journal, authority, fresh_scan, recovery_authority
|
||||
from native_program import PROGRAM
|
||||
from receipt_safety import counts
|
||||
|
||||
CASE = Path(__file__).resolve().parent.parent
|
||||
NOW = datetime.datetime(2026, 10, 11, 2, 0, tzinfo=datetime.timezone.utc)
|
||||
REVISION = 'e' * 40
|
||||
COUNT = {'schema_version': 5, 'integrity': 'ok', 'read_only_pre_open': True, 'store_constructed': False,
|
||||
'lifecycle': {'records': 3, 'events': 8, 'pending': 1},
|
||||
'outbox': {'pending': 2, 'delivered': 10}, 'submissions': {'confirmed': 1, 'unresolved': 1}}
|
||||
|
||||
|
||||
def accepted():
|
||||
approval = '11111111-1111-4111-8111-111111111111'
|
||||
review = 'review-22222222-2222-4222-8222-222222222222'
|
||||
disposition = 'disp-33333333-3333-4333-8333-333333333333'
|
||||
receipt = {'proposal_id': 'INFD-WP-0009-T05/zlib85091-r1',
|
||||
'memo_id': 'infd-20261011-zlib-remediation-r1', 'memo_version': 1,
|
||||
'memo_sha256': 'a' * 64, 'source_revision': REVISION, 'activation': 'APPROVED',
|
||||
'authority_mode': 'ADMINISTER', 'target': 'realm:kubernetes/railiance01/informed-decision',
|
||||
'verification_method': 'root-fixed-origin-native-readback', 'runtime_authenticated_grant': False, 'outcome_query': '/lifecycle/memos/infd-20261011-zlib-remediation-r1/outcomes?version=1',
|
||||
'verified_at': '2026-10-11T02:00:00Z', 'accepted_at': '2026-10-11T01:59:00Z',
|
||||
'review_memo_id': review, 'approval_id': approval, 'disposition_id': disposition}
|
||||
outcome = {'memo_id': receipt['memo_id'], 'review': {'memo_id': review, 'stale': False, 'intake_state': 'ready'},
|
||||
'dispositions': [{'approval_id': None, 'submission_state': 'confirmed',
|
||||
'disposition': {'verb': 'accept', 'memo_version': 1, 'memo_id': review,
|
||||
'approval_id': approval, 'id': disposition,
|
||||
'actor': {'kind': 'person', 'sub': 'uid=platform-root,ou=people,dc=netkingdom,dc=local'},
|
||||
'at': receipt['accepted_at']}}]}
|
||||
return receipt, outcome
|
||||
|
||||
|
||||
class AuthorityAndCustody(unittest.TestCase):
|
||||
def test_exact_nested_founder_receipt_not_top_level_approval(self):
|
||||
receipt, outcome = accepted()
|
||||
result = authority(receipt, outcome, 'a' * 64, REVISION, 'drill-copy', NOW)
|
||||
self.assertEqual(result['approval_id'], receipt['approval_id'])
|
||||
|
||||
def test_pending_stale_wrong_actor_version_and_binding_refuse(self):
|
||||
mutations = [lambda r, o: r.update(activation='PENDING'),
|
||||
lambda r, o: r.update(memo_sha256='changed'),
|
||||
lambda r, o: r.update(source_revision='changed'),
|
||||
lambda r, o: r.update(target='other'),
|
||||
lambda r, o: r.update(verified_at='2026-10-11T01:00:00Z'),
|
||||
lambda r, o: r.update(verification_method='caller-asserted'),
|
||||
lambda r, o: r.update(runtime_authenticated_grant=True),
|
||||
lambda r, o: o['review'].update(stale=True),
|
||||
lambda r, o: o['review'].update(intake_state='pending'),
|
||||
lambda r, o: o['dispositions'][0].update(submission_state='unresolved'),
|
||||
lambda r, o: o['dispositions'][0]['disposition'].update(memo_version=3),
|
||||
lambda r, o: o['dispositions'][0]['disposition'].update(actor={'kind': 'agent', 'sub': 'platform-root'}),
|
||||
lambda r, o: o['dispositions'].append(copy.deepcopy(o['dispositions'][0]))]
|
||||
for mutate in mutations:
|
||||
with self.subTest(mutate=mutate):
|
||||
r, o = accepted()
|
||||
mutate(r, o)
|
||||
with self.assertRaises(ValueError):
|
||||
authority(r, o, 'a' * 64, REVISION, 'release', NOW)
|
||||
|
||||
def test_expired_window_and_unknown_phase_refuse(self):
|
||||
r, o = accepted()
|
||||
with self.assertRaises(ValueError):
|
||||
authority(r, o, 'a' * 64, REVISION, 'arbitrary', NOW)
|
||||
late = datetime.datetime(2026, 10, 13, tzinfo=datetime.timezone.utc)
|
||||
r['verified_at'] = late.isoformat()
|
||||
with self.assertRaises(ValueError):
|
||||
authority(r, o, 'a' * 64, REVISION, 'rollback', late)
|
||||
|
||||
def test_durable_intent_precedes_dispatch_and_never_retries(self):
|
||||
with tempfile.TemporaryDirectory() as directory:
|
||||
parent = Path(directory)
|
||||
os.chmod(parent, 0o700)
|
||||
journal = Journal(parent, {'case': 'fixture'})
|
||||
journal.start('drill-backup', {'approval_id': 'fixture'})
|
||||
self.assertEqual(json.loads(journal.path.read_text())['phases']['drill-backup']['state'], 'RUNNING')
|
||||
journal.close() # simulated crash before result
|
||||
recovered = Journal(parent, {'case': 'fixture'})
|
||||
with self.assertRaises(ValueError):
|
||||
recovered.start('drill-backup', {})
|
||||
with self.assertRaises(ValueError):
|
||||
recovered.start('drill-backup', {})
|
||||
recovered.close()
|
||||
|
||||
def test_phase_order_and_uncertain_release_allows_only_distinct_recovery(self):
|
||||
with tempfile.TemporaryDirectory() as directory:
|
||||
os.chmod(directory, 0o700)
|
||||
j = Journal(directory, {'case': 'fixture'})
|
||||
with self.assertRaises(ValueError):
|
||||
j.start('release', {})
|
||||
for phase in actuator.PHASES[:6]:
|
||||
j.start(phase, {})
|
||||
j.finish(phase, {'all_checks_pass': True})
|
||||
j.start('release', {})
|
||||
j.finish('release', {'all_checks_pass': False})
|
||||
with self.assertRaises(ValueError):
|
||||
j.start('release', {})
|
||||
with self.assertRaises(ValueError):
|
||||
j.start('verify', {})
|
||||
j.start('rollback', {})
|
||||
j.finish('rollback', {'all_checks_pass': True})
|
||||
j.close()
|
||||
|
||||
def test_secret_or_unknown_child_output_is_withheld(self):
|
||||
for body in ('not-json', '{"all_checks_pass":true,"token":"private-value"}',
|
||||
'{"all_checks_pass":true,"snapshot_readonly":{"schema_version":5}}'):
|
||||
with self.assertRaises(ValueError):
|
||||
actuator.json_result(subprocess.CompletedProcess([], 0, body, ''))
|
||||
wrong = copy.deepcopy(COUNT)
|
||||
wrong['outbox'] = {'private-row-value': 1}
|
||||
with self.assertRaises(ValueError):
|
||||
counts(wrong)
|
||||
counts(COUNT) # blocked/unresolved counts are not required to be zero.
|
||||
|
||||
def test_binary_copy_is_bounded_private_and_never_echoed(self):
|
||||
blob = b'synthetic private fixture bytes'
|
||||
digest = __import__('hashlib').sha256(blob).hexdigest()
|
||||
metadata = {'all_checks_pass': True, 'snapshot_file': 'drill.sqlite', 'snapshot_bytes': len(blob),
|
||||
'snapshot_sha256': digest, 'snapshot_readonly': COUNT,
|
||||
'pod_name': 'fixture-pod', 'pod_uid': 'fixture-uid'}
|
||||
journal = type('FixtureJournal', (), {'data': {'phases': {'drill-backup': {'result': metadata}}}})()
|
||||
real_popen = subprocess.Popen
|
||||
for extra in (b'', b'oversized'):
|
||||
with self.subTest(extra=extra), tempfile.TemporaryDirectory() as folder:
|
||||
os.chmod(folder, 0o700)
|
||||
output = io.StringIO()
|
||||
|
||||
def child(*args, **kwargs):
|
||||
return real_popen([sys.executable, '-c', 'import sys;sys.stdout.buffer.write(' + repr(blob + extra) + ')'],
|
||||
stdout=subprocess.PIPE, stderr=subprocess.DEVNULL)
|
||||
|
||||
with patch.object(actuator, 'CUSTODY', Path(folder)), patch.object(actuator, 'remote', return_value=metadata), \
|
||||
patch('subprocess.Popen', side_effect=child), redirect_stdout(output):
|
||||
if extra:
|
||||
with self.assertRaises(ValueError):
|
||||
actuator.copy_snapshot('drill-copy', REVISION, {}, journal)
|
||||
else:
|
||||
result = actuator.copy_snapshot('drill-copy', REVISION, {}, journal)
|
||||
self.assertTrue(result['off_cluster_private_copy_verified'])
|
||||
self.assertEqual((Path(folder) / 'drill.sqlite').read_bytes(), blob)
|
||||
self.assertEqual(output.getvalue(), '')
|
||||
self.assertEqual((Path(folder) / 'drill.sqlite').stat().st_mode & 0o777, 0o600)
|
||||
|
||||
def test_recreated_offline_volume_cannot_be_deleted(self):
|
||||
identity = {'Name': actuator.VOLUME, 'Labels': {'nonce': 'old'}, 'CreatedAt': 'old'}
|
||||
journal = type('FixtureJournal', (), {'data': {'phases': {
|
||||
'offline-verify': {'result': {'created_volume_identity': identity}}}}})()
|
||||
inspected = [{**identity, 'CreatedAt': 'recreated'}]
|
||||
with patch.object(actuator, 'docker', return_value=subprocess.CompletedProcess([], 0, json.dumps(inspected), '')) as mocked:
|
||||
with self.assertRaises(ValueError):
|
||||
actuator.cleanup_offline(journal)
|
||||
self.assertEqual(mocked.call_count, 1)
|
||||
|
||||
def test_offline_post_admin_integrity_and_original_hash_are_rechecked(self):
|
||||
for defect in ('none', 'post-integrity', 'original-hash'):
|
||||
with self.subTest(defect=defect), tempfile.TemporaryDirectory() as directory:
|
||||
folder=Path(directory);os.chmod(folder,0o700)
|
||||
snapshot=folder/'drill.sqlite';snapshot.write_bytes(b'private synthetic snapshot');os.chmod(snapshot,0o600)
|
||||
digest=actuator.sha(snapshot)
|
||||
prior={'snapshot_sha256':digest,'snapshot_readonly':COUNT}
|
||||
journal=type('FixtureJournal',(),{'data':{'phases':{'drill-copy':{'result':prior},'offline-verify':{'attempt_id':'nonce'}}},'note':lambda *args:None})()
|
||||
reads=[]
|
||||
volume={'Name':actuator.VOLUME,'Labels':{'informed-decision.case':'infd-zlib-20261011-r1','informed-decision.use':'offline-restore-only','informed-decision.attempt':'nonce'},'Driver':'local','Scope':'local','CreatedAt':'fixture','Options':None}
|
||||
def docker(argv, body=None, **kwargs):
|
||||
if argv[0]=='info':body=json.dumps('bnt-lap001')
|
||||
elif argv[:2]==['volume','ls']:body=''
|
||||
elif argv[:2]==['volume','create']:body=actuator.VOLUME
|
||||
elif argv[:2]==['volume','inspect']:body=json.dumps([volume])
|
||||
elif 'informed-decision-admin' in argv:
|
||||
body=json.dumps({key:COUNT[key] for key in ('schema_version','lifecycle','outbox','submissions')})
|
||||
if defect=='original-hash':snapshot.write_bytes(b'changed synthetic original')
|
||||
elif '--entrypoint' in argv and 'python' in argv:
|
||||
reads.append(argv);proof=copy.deepcopy(COUNT)
|
||||
if len(reads)==2 and defect=='post-integrity':proof['integrity']='corrupt'
|
||||
body=json.dumps(proof)
|
||||
else:raise AssertionError('unexpected offline command')
|
||||
return subprocess.CompletedProcess(argv,0,body,'')
|
||||
with patch.object(actuator,'CUSTODY',folder),patch.object(actuator,'CASE',CASE),patch.object(actuator,'docker',side_effect=docker),patch('subprocess.run',return_value=subprocess.CompletedProcess([],0,'{"all_checks_pass":true,"private_copy_verified":true}','')):
|
||||
if defect=='none':
|
||||
result=actuator.offline_verify(journal)
|
||||
self.assertEqual(result['offline_post_admin_readonly'],COUNT)
|
||||
self.assertTrue(result['original_snapshot_hash_unchanged'])
|
||||
else:
|
||||
with self.assertRaises(ValueError):actuator.offline_verify(journal)
|
||||
self.assertEqual(len(reads),2)
|
||||
|
||||
def test_fresh_full_scan_db_expiry_and_new_findings_refuse(self):
|
||||
receipt={'image':actuator.IMAGE,'artifact_source_revision':'9b4bb25d325698ae543e7e8a8a3c3592db1f58fc','scanner':'aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969','no_suppression':True,'full_allseverity_scan':True,'exit_code':0,'completed_at':'2026-10-11T01:59:00Z','db_metadata':{'UpdatedAt':'2026-10-10T19:00:00Z','NextUpdate':'2026-10-11T19:00:00Z','Version':2},'db_sha256':'a'*64,'full_report_sha256':'b'*64}
|
||||
contract=json.loads((CASE/'fresh-scan-contract.json').read_text())
|
||||
report=json.loads((CASE/'fresh-scan-report-fixture.json').read_text())
|
||||
self.assertEqual(fresh_scan(receipt,report,contract,NOW)['allseverity_findings'],0)
|
||||
mutations=[lambda r,p:r.update(no_suppression=False),lambda r,p:r.update(image='foreign'),lambda r,p:r.update(scanner='other'),lambda r,p:r.update(completed_at='2026-10-10T21:00:00Z'),lambda r,p:r['db_metadata'].update(NextUpdate='2026-10-11T01:59:00Z'),lambda r,p:p['Results'][0].update(Vulnerabilities=[{'Severity':'LOW'}]),lambda r,p:p.update(Results=[]),lambda r,p:p.update(Results=[{}]),lambda r,p:p['Results'].pop(),lambda r,p:p['Results'][0]['Packages'].pop(),lambda r,p:p['Results'][0]['Packages'][0].update(Version='old'),lambda r,p:p['Metadata'].update(ImageID='other'),lambda r,p:p['Metadata']['DiffIDs'].pop(),lambda r,p:p['Metadata']['ImageConfig']['config']['Labels'].update(**{'org.opencontainers.image.revision':'other'}),lambda r,p:p.update(SchemaVersion=1),lambda r,p:p.update(ArtifactType='filesystem')]
|
||||
for mutate in mutations:
|
||||
r,p=copy.deepcopy(receipt),copy.deepcopy(report);mutate(r,p)
|
||||
with self.assertRaises(ValueError):fresh_scan(r,p,contract,NOW)
|
||||
|
||||
|
||||
class FixedNativeProgram(unittest.TestCase):
|
||||
def fixture(self):
|
||||
sealed = json.loads((CASE / 'sealed-live-deployment.json').read_text())
|
||||
live = copy.deepcopy(sealed)
|
||||
live['metadata'].update(generation=42)
|
||||
live['status'] = {'readyReplicas': 1, 'updatedReplicas': 1, 'observedGeneration': 42}
|
||||
dependencies = json.loads((CASE / 'sealed-native-dependencies.json').read_text())
|
||||
cm = copy.deepcopy(dependencies['configmap'])
|
||||
cm.pop('canonical_data_sha256')
|
||||
service = json.loads((CASE / 'candidate-deployment.json').read_text())
|
||||
source_service = json.loads((Path('/home/worsch/informed-decision/deploy/lifecycle/service.candidate.json')).read_text())
|
||||
cm['data'] = next(x for x in source_service['items'] if x['kind'] == 'ConfigMap')['data']
|
||||
pvc = copy.deepcopy(dependencies['pvc'])
|
||||
pvc['status'] = {'phase': 'Bound'}
|
||||
app = {'metadata': {'uid': '499868f2-eabc-4df4-ae31-b89ce58d750d', 'resourceVersion': '17'},
|
||||
'spec': {'source': {'repoURL': 'https://forgejo.coulomb.social/coulomb/informed-decision.git',
|
||||
'path': 'deploy/lifecycle', 'targetRevision': 'c96b0c6d881e855d1d158003c6de90ef390262e2'},
|
||||
'destination': {'namespace': 'informed-decision', 'server': 'https://kubernetes.default.svc'}}}
|
||||
objects = {'deployment': live, 'configmap': cm, 'pvc': pvc, 'application': app}
|
||||
payload = {'phase': 'release', 'source_revision': REVISION, 'approval': {}, 'sealed': sealed,
|
||||
'dependencies': dependencies, 'candidate': service,
|
||||
'rollback': json.loads((CASE / 'rollback-deployment.json').read_text()),
|
||||
'readonly': (CASE / 'sqlite_readonly.py').read_text(),'purpose_checks':(CASE/'check_installed.py').read_text(),
|
||||
'installed_zlib': json.loads((CASE / 'installed-zlib-proof.json').read_text()), 'receipt_safety': (Path(__file__).parent / 'receipt_safety.py').read_text()}
|
||||
return objects, payload
|
||||
|
||||
def execute_fake(self, objects, payload, ambiguous=False, schema_refused=False, ephemeral=False, expire_recovery_before_effect=False):
|
||||
writes = []
|
||||
calls = []
|
||||
elapsed=[0];real_datetime=datetime.datetime
|
||||
class Clock(real_datetime):
|
||||
@classmethod
|
||||
def now(cls,tz=None):return real_datetime.now(tz)+datetime.timedelta(seconds=elapsed[0])
|
||||
|
||||
def fake(argv, input=None, **kwargs):
|
||||
calls.append(argv)
|
||||
if argv[:2] == ['kubectl', 'get']:
|
||||
kind = argv[2]
|
||||
if kind in objects:
|
||||
body = objects[kind]
|
||||
elif kind == 'pods':
|
||||
body = {'items': [{'metadata': {'name': 'fixture-pod', 'uid': 'c4cb1550-feda-4097-9de4-d891a657b662',
|
||||
'ownerReferences': [{'kind': 'ReplicaSet', 'name': 'fixture-rs', 'uid': 'rs-uid'}]},
|
||||
'spec': {**objects['deployment']['spec']['template']['spec'],**({'ephemeralContainers':[{'name':'debug','image':'unexpected'}]} if ephemeral else {})},
|
||||
'status': {'phase': 'Running', 'containerStatuses': [{'name':'informed-decision','ready': True,'imageID':objects['deployment']['spec']['template']['spec']['containers'][0]['image']}] }}]}
|
||||
elif kind == 'replicaset':
|
||||
body = {'metadata': {'uid': 'rs-uid', 'ownerReferences': [
|
||||
{'kind': 'Deployment', 'uid': payload['sealed']['metadata']['uid']}]}}
|
||||
elif kind == 'nodes':
|
||||
body = {'items': [{'metadata': {'name': 'fixture-node'}, 'status': {
|
||||
'addresses': [{'address': '92.205.62.239'}], 'allocatable': {'cpu': '4'},
|
||||
'conditions': [{'type': key, 'status': 'True' if key == 'Ready' else 'False'}
|
||||
for key in ('Ready', 'MemoryPressure', 'DiskPressure', 'PIDPressure')]}}]}
|
||||
else:
|
||||
raise AssertionError('unexpected fixed metadata route')
|
||||
return subprocess.CompletedProcess(argv, 0, json.dumps(body), '')
|
||||
if argv[:2] == ['kubectl', 'exec']:
|
||||
if schema_refused:
|
||||
return subprocess.CompletedProcess(argv, 1, '', 'withheld')
|
||||
return subprocess.CompletedProcess(argv, 0, json.dumps({
|
||||
'all_checks_pass': True, 'live_readonly_schema_integrity_counts': COUNT}), '')
|
||||
if argv[:2] == ['kubectl', 'apply']:
|
||||
admitted = copy.deepcopy(payload['sealed'])
|
||||
admitted['spec']['template']['spec']['containers'][0]['image'] = (actuator.IMAGE if payload['phase']=='release' else payload['sealed']['spec']['template']['spec']['containers'][0]['image'])
|
||||
return subprocess.CompletedProcess(argv, 0, json.dumps(admitted), '')
|
||||
if argv[:2] == ['kubectl', 'describe']:
|
||||
return subprocess.CompletedProcess(argv, 0, 'Allocated resources:\n cpu 3460m (86%)\n', '')
|
||||
if argv[:2] == ['kubectl', 'diff']:
|
||||
return subprocess.CompletedProcess(argv, 1, '-image: base\n+image: candidate\n', '')
|
||||
if argv[:2] == ['kubectl', 'patch']:
|
||||
if expire_recovery_before_effect and '--dry-run=server' in argv:elapsed[0]=200
|
||||
if '--dry-run=server' not in argv:
|
||||
writes.append(json.loads(input))
|
||||
if ambiguous:
|
||||
return subprocess.CompletedProcess(argv, 1, '', 'withheld')
|
||||
return subprocess.CompletedProcess(argv, 0, 'application.argoproj.io/informed-decision\n', '')
|
||||
raise AssertionError('unexpected command')
|
||||
|
||||
source = PROGRAM.replace('__PAYLOAD__', repr(json.dumps(payload))).replace(
|
||||
'__GUARD__', repr((CASE / 'change_guard.py').read_text()))
|
||||
output = io.StringIO()
|
||||
with patch('subprocess.run', side_effect=fake), patch('datetime.datetime',Clock), redirect_stdout(output):
|
||||
try:
|
||||
exec(compile(source, 'fixed-native-fixture', 'exec'), {'__name__': '__fixture__'})
|
||||
except (ValueError, SystemExit):
|
||||
pass
|
||||
receipt = json.loads(output.getvalue()) if output.getvalue() else {'all_checks_pass': False}
|
||||
return receipt, writes, calls
|
||||
|
||||
def test_only_existing_application_operation_and_deployment_are_requested(self):
|
||||
objects, payload = self.fixture()
|
||||
receipt, writes, calls = self.execute_fake(objects, payload)
|
||||
self.assertTrue(receipt['all_checks_pass'])
|
||||
self.assertFalse(receipt['rollout_verified'])
|
||||
self.assertEqual(len(writes), 1)
|
||||
operation = writes[0][-1]['value']
|
||||
self.assertFalse(operation['sync']['prune'])
|
||||
self.assertEqual(operation['sync']['resources'], [
|
||||
{'group': 'apps', 'kind': 'Deployment', 'name': 'informed-decision', 'namespace': 'informed-decision'}])
|
||||
self.assertTrue(any('--dry-run=server' in argv and argv[:2] == ['kubectl', 'patch'] for argv in calls))
|
||||
self.assertEqual(writes[0][0]['path'], '/metadata/uid')
|
||||
|
||||
def test_source_overrides_automation_and_custody_drift_stop_before_write(self):
|
||||
mutations = [lambda o: o['application']['metadata'].update(uid='recreated'),
|
||||
lambda o: o['application']['spec'].update(syncPolicy={'automated': {}}),
|
||||
lambda o: o['application']['spec']['source'].update(kustomize={'images': ['other']}),
|
||||
lambda o: o['application']['spec'].update(sources=[{}]),
|
||||
lambda o: o['configmap']['metadata'].update(uid='recreated'),
|
||||
lambda o: o['pvc']['spec'].update(volumeName='replaced'),
|
||||
lambda o: o['deployment']['status'].update(readyReplicas=0)]
|
||||
for mutate in mutations:
|
||||
with self.subTest(mutate=mutate):
|
||||
objects, payload = self.fixture()
|
||||
mutate(objects)
|
||||
receipt, writes, calls = self.execute_fake(objects, payload)
|
||||
self.assertFalse(receipt['all_checks_pass'])
|
||||
self.assertEqual(writes, [])
|
||||
|
||||
def test_preopen_schema_refusal_prevents_image_operation(self):
|
||||
objects, payload = self.fixture()
|
||||
receipt, writes, calls = self.execute_fake(objects, payload, schema_refused=True)
|
||||
self.assertFalse(receipt['all_checks_pass'])
|
||||
self.assertEqual(writes, [])
|
||||
|
||||
|
||||
def test_rollback_unready_candidate_never_reads_pod_or_database(self):
|
||||
objects, payload = self.fixture()
|
||||
payload['phase'] = 'rollback'
|
||||
objects['deployment']['status'].update(readyReplicas=0, updatedReplicas=0)
|
||||
objects['deployment']['spec']['template']['spec']['containers'][0]['image'] = actuator.IMAGE
|
||||
objects['application']['spec']['source']['targetRevision'] = REVISION
|
||||
receipt, writes, calls = self.execute_fake(objects, payload, schema_refused=True)
|
||||
self.assertTrue(receipt['all_checks_pass'])
|
||||
self.assertFalse(receipt['rollout_verified'])
|
||||
self.assertEqual(len(writes), 1)
|
||||
self.assertFalse(any(argv[:2] == ['kubectl', 'exec'] or argv[:3] == ['kubectl', 'get', 'pods'] for argv in calls))
|
||||
self.assertEqual(writes[0][-1]['value']['sync']['revision'], 'c96b0c6d881e855d1d158003c6de90ef390262e2')
|
||||
|
||||
def test_rollback_still_refuses_custody_or_nonpair_image_drift(self):
|
||||
for defect in ('cm', 'pvc', 'image'):
|
||||
with self.subTest(defect=defect):
|
||||
objects, payload = self.fixture();payload['phase'] = 'rollback'
|
||||
objects['deployment']['status']['readyReplicas'] = 0
|
||||
if defect == 'cm':objects['configmap']['metadata']['uid'] = 'recreated'
|
||||
elif defect == 'pvc':objects['pvc']['spec']['volumeName'] = 'replaced'
|
||||
else:objects['deployment']['spec']['template']['spec']['containers'][0]['image'] = 'foreign-image'
|
||||
receipt, writes, calls = self.execute_fake(objects, payload)
|
||||
self.assertFalse(receipt['all_checks_pass']);self.assertEqual(writes, [])
|
||||
|
||||
def test_recovery_verification_is_separate_ready_old_image_schema_proof(self):
|
||||
objects, payload = self.fixture();payload['phase'] = 'rollback-verify'
|
||||
resource={'group':'apps','kind':'Deployment','name':'informed-decision','namespace':'informed-decision'}
|
||||
target='c96b0c6d881e855d1d158003c6de90ef390262e2'
|
||||
payload['operation_intent']={'state':'COMPLETE','started_at':'2026-10-11T01:00:00Z','result':{'operation_requested':True,'source_revision':target,'prune':False,'resources':[resource]}}
|
||||
objects['application']['status']={'operationState':{'phase':'Succeeded','startedAt':'2026-10-11T01:00:01Z','finishedAt':'2026-10-11T01:01:00Z','operation':{'initiatedBy':{'username':'custodian-codex'},'sync':{'revision':target,'resources':[resource]}},'syncResult':{'revision':target,'resources':[{**resource,'status':'Synced'}]}}}
|
||||
receipt, writes, calls = self.execute_fake(objects, payload)
|
||||
self.assertTrue(receipt['all_checks_pass']);self.assertTrue(receipt['recovery_verification'])
|
||||
self.assertEqual(writes, [])
|
||||
self.assertTrue(any(argv[:2]==['kubectl','exec'] for argv in calls))
|
||||
objects['deployment']['status']['readyReplicas'] = 0
|
||||
receipt, writes, calls = self.execute_fake(objects,payload)
|
||||
self.assertFalse(receipt['all_checks_pass'])
|
||||
|
||||
def test_ambiguous_patch_is_never_retried(self):
|
||||
objects, payload = self.fixture()
|
||||
receipt, writes, calls = self.execute_fake(objects, payload, ambiguous=True)
|
||||
self.assertFalse(receipt['all_checks_pass'])
|
||||
self.assertEqual(len(writes), 1)
|
||||
|
||||
def test_false_omitempty_needs_bound_current_request_and_exact_completion(self):
|
||||
objects,payload=self.fixture();payload['phase']='rollback-verify'
|
||||
resource={'group':'apps','kind':'Deployment','name':'informed-decision','namespace':'informed-decision'}
|
||||
target='c96b0c6d881e855d1d158003c6de90ef390262e2'
|
||||
payload['operation_intent']={'state':'COMPLETE','started_at':'2026-10-11T01:00:00Z','result':{'operation_requested':True,'source_revision':target,'prune':False,'resources':[resource]}}
|
||||
objects['application']['status']={'operationState':{'phase':'Succeeded','startedAt':'2026-10-11T01:00:01Z','finishedAt':'2026-10-11T01:01:00Z','operation':{'initiatedBy':{'username':'custodian-codex'},'sync':{'revision':target,'resources':[resource]}},'syncResult':{'revision':target,'resources':[{**resource,'status':'Synced'}]}}}
|
||||
self.assertTrue(self.execute_fake(objects,payload)[0]['all_checks_pass'])
|
||||
mutations=[lambda o,p:o['application']['status']['operationState']['operation']['sync'].update(prune=True),
|
||||
lambda o,p:o['application']['status']['operationState']['operation']['sync'].update(prune=None),
|
||||
lambda o,p:o['application']['status']['operationState'].update(startedAt='2026-10-11T00:59:00Z'),
|
||||
lambda o,p:o['application']['status']['operationState']['operation'].update(initiatedBy={'username':'other'}),
|
||||
lambda o,p:o['application']['status']['operationState']['syncResult'].update(revision='foreign'),
|
||||
lambda o,p:o['application']['status']['operationState']['syncResult']['resources'][0].update(status='Pruned'),
|
||||
lambda o,p:p['operation_intent']['result'].update(prune=True),
|
||||
lambda o,p:p.update(operation_intent=None)]
|
||||
for mutate in mutations:
|
||||
o,p=copy.deepcopy(objects),copy.deepcopy(payload);mutate(o,p)
|
||||
receipt,writes,calls=self.execute_fake(o,p)
|
||||
self.assertFalse(receipt['all_checks_pass']);self.assertEqual(writes,[])
|
||||
|
||||
def test_optimized_executor_refuses_before_any_input(self):
|
||||
result=subprocess.run([sys.executable,'-O',str(Path(__file__).parent/'actuator.py'),'--phase','release','--root-authority-receipt','/missing','--root-native-outcome','/missing','--source-revision',REVISION],capture_output=True,text=True)
|
||||
self.assertNotEqual(result.returncode,0)
|
||||
self.assertIn('optimized interpreter refused',result.stderr)
|
||||
|
||||
def test_actual_pod_ephemeral_container_refuses_before_native_effect(self):
|
||||
objects,payload=self.fixture();receipt,writes,calls=self.execute_fake(objects,payload,ephemeral=True)
|
||||
self.assertFalse(receipt['all_checks_pass']);self.assertEqual(writes,[])
|
||||
self.assertFalse(any(argv[:2]==['kubectl','exec'] for argv in calls))
|
||||
|
||||
def test_outage_native_rollback_requires_failed_candidate_and_same_source(self):
|
||||
objects,payload=self.fixture();payload.update(phase='rollback',outage_recovery=True,recovery_release_started_at=datetime.datetime.now(datetime.timezone.utc).isoformat())
|
||||
objects['deployment']['spec']['template']['spec']['containers'][0]['image']=actuator.IMAGE
|
||||
objects['deployment']['status'].update(readyReplicas=0,updatedReplicas=0)
|
||||
objects['application']['spec']['source']['targetRevision']=REVISION
|
||||
self.assertTrue(self.execute_fake(objects,payload)[0]['all_checks_pass'])
|
||||
for defect in ('healthy','baseline','wrongsource'):
|
||||
o,p=copy.deepcopy(objects),copy.deepcopy(payload)
|
||||
if defect=='healthy':o['deployment']['status']['readyReplicas']=1
|
||||
elif defect=='baseline':o['deployment']['spec']['template']['spec']['containers'][0]['image']=p['sealed']['spec']['template']['spec']['containers'][0]['image']
|
||||
else:o['application']['spec']['source']['targetRevision']='other'
|
||||
receipt,writes,calls=self.execute_fake(o,p);self.assertFalse(receipt['all_checks_pass']);self.assertEqual(writes,[])
|
||||
|
||||
def test_native_recovery_window_rechecked_immediately_before_effect(self):
|
||||
objects,payload=self.fixture();payload.update(phase='rollback',outage_recovery=True,recovery_release_started_at=(datetime.datetime.now(datetime.timezone.utc)-datetime.timedelta(seconds=1700)).isoformat())
|
||||
objects['deployment']['spec']['template']['spec']['containers'][0]['image']=actuator.IMAGE
|
||||
objects['deployment']['status'].update(readyReplicas=0,updatedReplicas=0)
|
||||
objects['application']['spec']['source']['targetRevision']=REVISION
|
||||
receipt,writes,calls=self.execute_fake(objects,payload,expire_recovery_before_effect=True)
|
||||
self.assertFalse(receipt['all_checks_pass']);self.assertEqual(writes,[])
|
||||
self.assertTrue(any('--dry-run=server' in argv and argv[:2]==['kubectl','patch'] for argv in calls))
|
||||
|
||||
|
||||
class FullCliDispatch(unittest.TestCase):
|
||||
def invoke(self,phase,corrupt_source=False,outage=False,denial=False):
|
||||
import hashlib,shutil
|
||||
import authority_journal
|
||||
realpath=Path;called=[];output=io.StringIO()
|
||||
with tempfile.TemporaryDirectory() as folder:
|
||||
base=Path(folder);custody=base/'private';custody.mkdir(mode=0o700)
|
||||
empty=custody/'empty-docker-config';empty.mkdir(mode=0o700)
|
||||
owner=base/'owner';owner.mkdir();case=owner/'case';case.mkdir();execution=case/'execution';execution.mkdir()
|
||||
for name in ('actuator.py','authority_journal.py','native_program.py','receipt_safety.py'):
|
||||
shutil.copyfile(Path(__file__).parent/name,execution/name)
|
||||
(case/'memo.json').write_text('{}')
|
||||
for name in ('sealed-live-deployment.json','sealed-native-dependencies.json','candidate-deployment.json','rollback-deployment.json','check_installed.py','sqlite_readonly.py','change_guard.py','installed-zlib-proof.json','fresh-scan-contract.json'):
|
||||
shutil.copyfile(CASE/name,case/name)
|
||||
names=('deploy/lifecycle/admission.candidate.json','deploy/lifecycle/service.candidate.json','deploy/lifecycle/kustomization.yaml','deploy/lifecycle/registries.candidate.json')
|
||||
for name in names:
|
||||
target=owner/name;target.parent.mkdir(parents=True,exist_ok=True);target.write_text('sourcefixture')
|
||||
plan={'state':'prepared-unapproved','published_artifact_verified':True,'proposal_id':'INFD-WP-0009-T05/zlib85091-r1','executor_files':{n:actuator.sha(execution/n) for n in ('actuator.py','authority_journal.py','native_program.py','receipt_safety.py')},'case_files':{p.name:actuator.sha(p) for p in case.iterdir() if p.is_file() and p.name!='memo.json'},'owner_source_files':{n:actuator.sha(owner/n) for n in names}}
|
||||
(execution/'execution-plan.json').write_text(json.dumps(plan))
|
||||
receipt,outcome=accepted();receipt.update(native_outcome_sha256=hashlib.sha256(json.dumps(outcome).encode()).hexdigest(),executor_plan_sha256=actuator.sha(execution/'execution-plan.json'))
|
||||
mapping={}
|
||||
for fixed,data in [('/tmp/security-infd-zlib-root-authority.json',receipt),('/tmp/security-infd-zlib-native-outcome-latest.json',outcome),('/tmp/security-infd-zlib-fresh-scan-receipt.json',{'fixture':True}),('/tmp/security-infd-zlib-fresh-scan-full.json',{'fixture':True})]:
|
||||
target=base/Path(fixed).name;target.write_text(json.dumps(data));target.chmod(0o600);mapping[fixed]=target
|
||||
scanreceipt=mapping['/tmp/security-infd-zlib-fresh-scan-receipt.json'];scanreceipt.write_text(json.dumps({'full_report_sha256':actuator.sha(mapping['/tmp/security-infd-zlib-fresh-scan-full.json'])}))
|
||||
identity={'proposal':plan['proposal_id'],'source_revision':REVISION,'memo_sha256':actuator.sha(case/'memo.json'),'plan_sha256':actuator.sha(execution/'execution-plan.json')}
|
||||
blob=b'private synthetic full-cli snapshot';metadata={'all_checks_pass':True,'snapshot_file':'drill.sqlite','snapshot_bytes':len(blob),'snapshot_sha256':hashlib.sha256(blob).hexdigest(),'snapshot_readonly':COUNT,'pod_name':'fixture-pod','pod_uid':'fixture-poduid'}
|
||||
j=Journal(custody,identity)
|
||||
predecessors=list(actuator.PHASES[:actuator.PHASES.index(phase)])
|
||||
for predecessor in predecessors:
|
||||
j.start(predecessor,{})
|
||||
result=metadata if predecessor=='drill-backup' else {'all_checks_pass':True}
|
||||
if predecessor in ('release','rollback'):result={'all_checks_pass':True,'operation_requested':True,'prune':False,'source_revision':REVISION,'resources':[{'group':'apps','kind':'Deployment','name':'informed-decision','namespace':'informed-decision'}]}
|
||||
j.finish(predecessor,result)
|
||||
j.close()
|
||||
if outage:
|
||||
receipt.update(memo_sha256=identity['memo_sha256'],bounded_outage_rollback_pre_authorized=True,verified_at='2026-10-11T01:59:00Z',accepted_at='2026-10-11T01:58:00Z')
|
||||
outcome['dispositions'][0]['disposition']['at']=receipt['accepted_at']
|
||||
cache={'root_authority':receipt,'native_outcome':copy.deepcopy(outcome),'memo_sha256':identity['memo_sha256'],'source_revision':REVISION,'plan_sha256':identity['plan_sha256']}
|
||||
cp=custody/'release-authority-cache.json';cp.write_text(json.dumps(cache));cp.chmod(0o600)
|
||||
data=json.loads(j.path.read_text());data['phases']['release'].update(started_at='2026-10-11T01:59:30Z',release_authority_cache_sha256=actuator.sha(cp));j.path.write_text(json.dumps(data))
|
||||
sealed=json.loads((case/'sealed-live-deployment.json').read_text());deps=json.loads((case/'sealed-native-dependencies.json').read_text())
|
||||
probe={'kind':'informed-decision.root-supervised-outage-recovery','proposal_id':plan['proposal_id'],'source_revision':REVISION,'memo_sha256':identity['memo_sha256'],'phase':phase,'release_attempt_id':data['phases']['release']['attempt_id'],'cache_sha256':actuator.sha(cp),'root_verified':True,'manual_supervised_recovery':True,'current_native_outcomes_claimed':False,'observed_at':NOW.isoformat(),'native_probe_status':503,'explicit_revoked':False,'current_conflict':False,'identity_or_scope_mismatch':False,'service_healthy':False,'deployment_uid':sealed['metadata']['uid'],'configmap_uid':deps['configmap']['metadata']['uid'],'pvc_uid':deps['pvc']['metadata']['uid'],'rollback_image':sealed['spec']['template']['spec']['containers'][0]['image'],'rollback_source':'c96b0c6d881e855d1d158003c6de90ef390262e2','failed_candidate':{'image':actuator.IMAGE,'application_source':REVISION,'ready_replicas':0}}
|
||||
if phase=='rollback-verify':
|
||||
witness=copy.deepcopy(probe);witness['phase']='rollback'
|
||||
probe.update(original_outage_receipt_sha256='d'*64,recovered_image=probe['rollback_image'],recovered_application_source=probe['rollback_source'],ready_replicas=1)
|
||||
probe.pop('failed_candidate')
|
||||
data['phases']['rollback'].update(outage_recovery_receipt_sha256='d'*64,outage_recovery_anchor=witness)
|
||||
data['phases']['rollback']['result']['source_revision']=probe['rollback_source']
|
||||
j.path.write_text(json.dumps(data))
|
||||
rp=base/'root-recovery.json';rp.write_text(json.dumps(probe));rp.chmod(0o600);mapping['/tmp/security-infd-zlib-root-recovery-receipt.json']=rp
|
||||
if denial:outcome['http_status']=403
|
||||
native=mapping['/tmp/security-infd-zlib-native-outcome-latest.json'];native.write_text(json.dumps(outcome));receipt['native_outcome_sha256']=actuator.sha(native);mapping['/tmp/security-infd-zlib-root-authority.json'].write_text(json.dumps(receipt))
|
||||
if corrupt_source:(owner/names[0]).write_text('changed')
|
||||
def mapped(value):return mapping.get(str(value),realpath(value))
|
||||
def run(argv,body=None,**kwargs):
|
||||
if argv[:4]==['git','-C',str(owner),'rev-parse']:return subprocess.CompletedProcess(argv,0,REVISION+'\n','')
|
||||
if argv[:4]==['git','-C',str(base),'check-ignore']:return subprocess.CompletedProcess(argv,0,'ignored','')
|
||||
if argv[:2]==['ssh','railiance01']:
|
||||
import ast
|
||||
parsed=ast.parse(body);node=next(x for x in parsed.body if isinstance(x,ast.Assign) and any(isinstance(t,ast.Name) and t.id=='payload' for t in x.targets));payload=json.loads(ast.literal_eval(node.value.args[0]));called.append(payload)
|
||||
self.assertEqual(json.loads(j.path.read_text())['phases'][phase]['state'],'RUNNING')
|
||||
if phase=='drill-copy':self.assertEqual(payload['snapshot_identity'],metadata)
|
||||
if phase in ('verify','rollback-verify'):self.assertEqual(payload['operation_intent']['state'],'COMPLETE');self.assertFalse(payload['operation_intent']['result']['prune'])
|
||||
result=metadata if phase=='drill-copy' else {'all_checks_pass':True,'phase':phase}
|
||||
return subprocess.CompletedProcess(argv,0,json.dumps(result),'')
|
||||
raise AssertionError('unexpected CLI transport')
|
||||
def git_show(argv,**kwargs):
|
||||
self.assertEqual(argv[:4],['git','-C',str(owner),'show']);data=(owner/argv[4].split(':',1)[1]).read_bytes();return subprocess.CompletedProcess(argv,0,data,b'')
|
||||
real_popen=subprocess.Popen
|
||||
def binary(*args,**kwargs):return real_popen([sys.executable,'-c','import sys;sys.stdout.buffer.write('+repr(blob)+')'],stdout=subprocess.PIPE,stderr=subprocess.DEVNULL)
|
||||
argv=['actuator.py','--phase',phase,'--root-authority-receipt','/tmp/security-infd-zlib-root-authority.json','--root-native-outcome','/tmp/security-infd-zlib-native-outcome-latest.json','--root-fresh-scan-receipt','/tmp/security-infd-zlib-fresh-scan-receipt.json','--source-revision',REVISION]
|
||||
if outage:argv+=['--root-recovery-receipt','/tmp/security-infd-zlib-root-recovery-receipt.json']
|
||||
real_recovery=authority_journal.recovery_authority;real_authority=authority_journal.authority
|
||||
def authority_dispatch(*args,**kwargs):
|
||||
if outage and len(args)<6:raise ValueError('service unavailable')
|
||||
return real_authority(*args,**kwargs) if outage else {'fixture':True}
|
||||
with patch.object(actuator,'ROOT',execution),patch.object(actuator,'CASE',case),patch.object(actuator,'OWNER',owner),patch.object(actuator,'CUSTODIAN',base),patch.object(actuator,'CUSTODY',custody),patch.object(actuator,'Path',side_effect=mapped),patch.object(actuator,'run',side_effect=run),patch('subprocess.run',side_effect=git_show),patch('subprocess.Popen',side_effect=binary),patch.object(authority_journal,'authority',side_effect=authority_dispatch),patch.object(authority_journal,'recovery_authority',side_effect=lambda *args: real_recovery(*args,now=NOW)),patch.object(authority_journal,'fresh_scan',return_value={'fixture':True}),patch('sys.argv',argv),redirect_stdout(output):
|
||||
if corrupt_source or denial:
|
||||
with self.assertRaises(ValueError):actuator.main()
|
||||
else:actuator.main()
|
||||
state=json.loads(j.path.read_text())['phases'].get(phase)
|
||||
return called,state,output.getvalue()
|
||||
|
||||
def test_main_cli_copy_binds_snapshot_and_retains_private_bytes(self):
|
||||
calls,state,output=self.invoke('drill-copy');self.assertEqual(len(calls),2);self.assertEqual(state['state'],'COMPLETE');self.assertNotIn('private synthetic',output)
|
||||
|
||||
def test_main_cli_verify_binds_completed_release_intent(self):
|
||||
calls,state,output=self.invoke('verify');self.assertEqual(len(calls),1);self.assertEqual(state['state'],'COMPLETE')
|
||||
|
||||
def test_main_cli_release_dispatches_only_after_durable_phase(self):
|
||||
calls,state,output=self.invoke('release');self.assertEqual(len(calls),1);self.assertEqual(state['state'],'COMPLETE')
|
||||
|
||||
def test_main_cli_source_hash_refuses_before_journal_or_transport(self):
|
||||
calls,state,output=self.invoke('release',corrupt_source=True);self.assertEqual(calls,[]);self.assertIsNone(state);self.assertEqual(output,'')
|
||||
|
||||
def test_main_cli_bounded_outage_rollback_uses_retained_cache_and_witness(self):
|
||||
calls,state,output=self.invoke('rollback',outage=True)
|
||||
self.assertEqual(len(calls),1);self.assertTrue(calls[0]['outage_recovery'])
|
||||
self.assertEqual(state['state'],'COMPLETE');self.assertIn('outage_recovery_receipt_sha256',state)
|
||||
self.assertFalse(state['approval']['current_revocation_verified'])
|
||||
|
||||
def test_main_cli_current403_prevents_cached_fallback_before_phase(self):
|
||||
calls,state,output=self.invoke('rollback',outage=True,denial=True)
|
||||
self.assertEqual(calls,[]);self.assertIsNone(state);self.assertEqual(output,'')
|
||||
|
||||
def test_main_cli_outage_recovery_verify_binds_prior_completed_rollback(self):
|
||||
calls,state,output=self.invoke('rollback-verify',outage=True)
|
||||
self.assertEqual(len(calls),1);self.assertTrue(calls[0]['outage_recovery'])
|
||||
self.assertEqual(calls[0]['operation_intent']['state'],'COMPLETE')
|
||||
self.assertEqual(state['state'],'COMPLETE');self.assertFalse(state['approval']['current_revocation_verified'])
|
||||
|
||||
|
||||
class PacketBindingAndBodyLimit(unittest.TestCase):
|
||||
def test_lossless_gzip_bundle_retains_exact_source_hashes(self):
|
||||
import gzip,base64,hashlib
|
||||
bundle=json.loads((CASE/'execution-bundle.json').read_text())
|
||||
for group in ('files','case_evidence'):
|
||||
for relative,item in bundle[group].items():
|
||||
data=gzip.decompress(base64.b64decode(item['content_base64'],validate=True))
|
||||
self.assertEqual(len(data),item['uncompressed_bytes']);self.assertEqual(hashlib.sha256(data).hexdigest(),item['sha256'])
|
||||
self.assertEqual(data,(CASE/relative).read_bytes())
|
||||
item=next(iter(bundle['files'].values()));changed=bytearray(base64.b64decode(item['content_base64']));changed[-1]^=1
|
||||
with self.assertRaises((OSError,EOFError)):gzip.decompress(changed)
|
||||
|
||||
def test_actual_source_http_256kib_limit_before_register_side_effect(self):
|
||||
import os
|
||||
script="""import io,json,sys
|
||||
sys.dont_write_bytecode=True
|
||||
sys.path.insert(0,'/home/worsch/informed-decision')
|
||||
from informed_decision.lifecycle_http import LifecycleAPI,MAX_BODY
|
||||
from informed_decision.lifecycle_service import Caller
|
||||
from informed_decision.lifecycle_service import LifecycleError
|
||||
from informed_decision.intake import validate_submission,SubmitterGrant
|
||||
from informed_decision.lifecycle_commands import decode_memo,decode_documents
|
||||
from pathlib import Path
|
||||
root=Path(sys.argv[1]);commands=json.loads((root/'lifecycle-commands.json').read_text());envelope=json.loads((root/'intake.json').read_text())
|
||||
validate_submission(envelope,submitter_id='state-hub',grant=SubmitterGrant('state-hub',frozenset({'decision-record'}),frozenset({'net-kingdom-admins'})))
|
||||
class Service:
|
||||
calls=0
|
||||
def _caller(self,caller):pass
|
||||
def register(self,*args,**kwargs):self.calls+=1;return 'fixture-event'
|
||||
service=Service();api=LifecycleAPI(service,lambda token:object.__new__(Caller))
|
||||
typedmemo=decode_memo(commands[0]['register']['memo']);decode_documents(commands[0]['register']['documents'],typedmemo)
|
||||
try:decode_documents(commands[0]['register']['documents']+[commands[0]['register']['documents'][0]],typedmemo)
|
||||
except ValueError:pass
|
||||
else:raise AssertionError('duplicate digest accepted')
|
||||
body=json.dumps(commands[0]['register']).encode();assert len(body)<240*1024
|
||||
base={'REQUEST_METHOD':'POST','PATH_INFO':'/v1/decisions','QUERY_STRING':'','CONTENT_TYPE':'application/json','HTTP_AUTHORIZATION':'Bearer synthetic-fixture','HTTP_IDEMPOTENCY_KEY':'fixture'}
|
||||
status,result=api.dispatch({**base,'CONTENT_LENGTH':str(len(body)),'wsgi.input':io.BytesIO(body)});assert status==200 and service.calls==1
|
||||
oversize=b' '+body+b' '*(MAX_BODY+1-len(body)-1)
|
||||
try:api.dispatch({**base,'CONTENT_LENGTH':str(len(oversize)),'wsgi.input':io.BytesIO(oversize)})
|
||||
except LifecycleError as e:assert e.status==413
|
||||
else:raise AssertionError('oversize accepted')
|
||||
assert service.calls==1
|
||||
print(json.dumps({'synthetic_body_limit_verified':True,'intake_validated':True,'register_bytes':len(body)}))
|
||||
"""
|
||||
result=subprocess.run([sys.executable,'-c',script,str(CASE)],capture_output=True,text=True,env={**os.environ,'PYTHONDONTWRITEBYTECODE':'1'})
|
||||
self.assertEqual(result.returncode,0,result.stderr);self.assertTrue(json.loads(result.stdout)['synthetic_body_limit_verified'])
|
||||
|
||||
|
||||
class OutcomeMetadataAndOutage(unittest.TestCase):
|
||||
def load_probe(self):
|
||||
import runpy
|
||||
return runpy.run_path(str(CASE/'post-ready-native-outcomes-command.py'))
|
||||
|
||||
|
||||
def outcome(self):
|
||||
# Actual native shape: ONLYreview/dispositions; top identity absent.
|
||||
return {'review':{'memo_id':'review-22222222-2222-4222-8222-222222222222','intake_state':'not_submitted','stale':False,'unknown':'PRIVATE_SENTINEL'},'dispositions':[{'disposition':{'verb':'comment','actor':{'kind':'system','sub':'system:fixture'},'note':'PRIVATE_SENTINEL','reasons':['PRIVATE_SENTINEL']},'submission_state':None,'approved_at':None}]+[{'disposition':{'verb':'accept','actor':{'kind':'person','sub':'uid=fixture'},'note':'PRIVATE_SENTINEL'},'submission_state':state,'approved_at':None} for state in ('prepared','in_flight','confirmed','unresolved')],'unknown':'PRIVATE_SENTINEL'}
|
||||
|
||||
def test_counts_only_omit_entire_private_native_body_and_never_infer_go(self):
|
||||
probe=self.load_probe();body=self.outcome();self.assertNotIn('memo_id',body)
|
||||
safe=probe['safe_outcome_metadata'](body);raw=json.dumps(safe)
|
||||
self.assertNotIn('PRIVATE_SENTINEL',raw);self.assertNotIn('note',raw);self.assertNotIn('reasons',raw);self.assertNotIn('actor',raw);self.assertNotIn('submission_state',raw)
|
||||
self.assertEqual(safe['disposition_count'],5);self.assertFalse(safe['approval_inferred']);self.assertFalse(safe['current_approval_claimed']);self.assertFalse(safe['dispositions_interpreted'])
|
||||
self.assertEqual(safe['request_identity_source'],'fixed-authenticated-route')
|
||||
self.assertFalse(probe['safe_outcome_metadata']({'review':None,'dispositions':[]})['has_review'])
|
||||
|
||||
def test_five_native_shape_counterexamples_refuse_without_echo(self):
|
||||
probe=self.load_probe()
|
||||
mutations=[lambda o:o.update(review=['PRIVATE_SENTINEL']),lambda o:o.update(dispositions='PRIVATE_SENTINEL'),lambda o:o.update(dispositions=[None]),lambda o:o.update(memo_id='PRIVATE_SENTINEL'),lambda o:o.update(version=True),lambda o:o.update(dispositions=[{}]*1025)]
|
||||
for mutate in mutations:
|
||||
o=self.outcome();mutate(o)
|
||||
with self.assertRaises(ValueError) as error:probe['safe_outcome_metadata'](o)
|
||||
self.assertNotIn('PRIVATE_SENTINEL',str(error.exception))
|
||||
|
||||
def test_actual_source_lifecycle_outcomes_native_shape_without_real_database(self):
|
||||
import contextlib,types,os
|
||||
script="""import contextlib,json,sys,types,runpy
|
||||
sys.dont_write_bytecode=True
|
||||
sys.path.insert(0,'/home/worsch/informed-decision')
|
||||
from informed_decision.lifecycle_service import LifecycleService
|
||||
from pathlib import Path
|
||||
probe=runpy.run_path(str(Path(sys.argv[1])/'post-ready-native-outcomes-command.py'))
|
||||
class Rows(list):
|
||||
def fetchone(self):return self[0] if self else None
|
||||
class DB:
|
||||
def __init__(self,reviewed,ledger):self.reviewed,self.ledger=reviewed,ledger
|
||||
def execute(self,sql,params):
|
||||
if 'FROM lifecycle_events' in sql:return Rows([{'body':json.dumps({'review_memo_id':'review-22222222-2222-4222-8222-222222222222'})}] if self.reviewed else [])
|
||||
if 'FROM intake_ledger' in sql:return Rows([{'state':self.ledger}] if self.ledger is not None else [])
|
||||
if 'FROM dispositions' in sql:return Rows([{'body':json.dumps({'id':'fixture-comment','verb':'comment','actor':{'kind':'system','sub':'system:fixture'},'note':'PRIVATE_SENTINEL','reasons':['PRIVATE_SENTINEL']}),'state':None,'approved_at':None}]+[{'body':json.dumps({'id':'fixture-accept','verb':'accept','note':'PRIVATE_SENTINEL'}),'state':state,'approved_at':None} for state in ('prepared','in_flight','confirmed','unresolved')])
|
||||
raise AssertionError('unexpected native outcomes query')
|
||||
for reviewed,ledger in [(False,None),(True,None),(True,'intake_created'),(True,'ready')]:
|
||||
db=DB(reviewed,ledger)
|
||||
@contextlib.contextmanager
|
||||
def connection():yield db
|
||||
store=types.SimpleNamespace(_connection=connection,_memo=lambda *args:types.SimpleNamespace(version=1))
|
||||
repository=types.SimpleNamespace(store=store,_record=lambda *args:None)
|
||||
service=object.__new__(LifecycleService);service.repository=repository;calls=[]
|
||||
service._authorize=lambda caller,memo,action,attrs:(lambda:calls.append('current'),None)
|
||||
body=service.outcomes(types.SimpleNamespace(attribution=types.SimpleNamespace(tenant='synthetic')),probe['MEMO_ID'],1)
|
||||
assert set(body)=={'review','dispositions'} and 'memo_id' not in body and calls==['current']
|
||||
result=probe['safe_outcome_metadata'](body)
|
||||
assert result['has_review']==reviewed and result['disposition_count']==(5 if reviewed else 0)
|
||||
assert result['approval_inferred'] is False and result['current_approval_claimed'] is False and 'PRIVATE_SENTINEL' not in json.dumps(result)
|
||||
print(json.dumps({'actual_source_outcomes_shape_verified':True,'real_database_opened':False,'provider_called':False}))
|
||||
"""
|
||||
result=subprocess.run([sys.executable,'-c',script,str(CASE)],capture_output=True,text=True,env={**os.environ,'PYTHONDONTWRITEBYTECODE':'1'})
|
||||
self.assertEqual(result.returncode,0,result.stderr);self.assertTrue(json.loads(result.stdout)['actual_source_outcomes_shape_verified'])
|
||||
|
||||
def test_actual_command_mocked_opener_never_prints_private_fields(self):
|
||||
import types,runpy,urllib.request
|
||||
module=types.ModuleType('api.services.memo_dispatch');module.ORIGIN='http://synthetic.invalid';module.NoRedirect=urllib.request.HTTPRedirectHandler;module.token_file=lambda path:'synthetic-fixture'
|
||||
class Response:
|
||||
status=200
|
||||
def __enter__(self):return self
|
||||
def __exit__(self,*args):pass
|
||||
def read(self,bound):return json.dumps(OutcomeMetadataAndOutage.outcome(self_test)).encode()
|
||||
self_test=self
|
||||
class Opener:
|
||||
def open(self,request,timeout):return Response()
|
||||
output=io.StringIO()
|
||||
with patch.dict('sys.modules',{'api.services.memo_dispatch':module}),patch('urllib.request.build_opener',return_value=Opener()),redirect_stdout(output):
|
||||
runpy.run_path(str(CASE/'post-ready-native-outcomes-command.py'),run_name='__main__')
|
||||
self.assertNotIn('PRIVATE_SENTINEL',output.getvalue());self.assertNotIn('synthetic-fixture',output.getvalue())
|
||||
self.assertTrue(json.loads(output.getvalue())['native_provider_path_returned'])
|
||||
|
||||
|
||||
def test_actual_command_private_token_error_and_http403_never_echo_body(self):
|
||||
import types,runpy,urllib.request,urllib.error
|
||||
module=types.ModuleType('api.services.memo_dispatch');module.ORIGIN='http://synthetic.invalid';module.NoRedirect=urllib.request.HTTPRedirectHandler
|
||||
def token_failure(path):raise ValueError('PRIVATE_SENTINEL')
|
||||
for failure in ('token','http403'):
|
||||
output=io.StringIO();module.token_file=token_failure if failure=='token' else lambda path:'synthetic-fixture'
|
||||
class Opener:
|
||||
def open(self,*args,**kwargs):raise urllib.error.HTTPError('http://synthetic.invalid',403,'PRIVATE_SENTINEL',{},io.BytesIO(b'PRIVATE_SENTINEL'))
|
||||
with patch.dict('sys.modules',{'api.services.memo_dispatch':module}),patch('urllib.request.build_opener',return_value=Opener()),redirect_stdout(output):
|
||||
with self.assertRaises(SystemExit):runpy.run_path(str(CASE/'post-ready-native-outcomes-command.py'),run_name='__main__')
|
||||
raw=output.getvalue();self.assertNotIn('PRIVATE_SENTINEL',raw);self.assertNotIn('synthetic-fixture',raw)
|
||||
receipt=json.loads(raw);self.assertEqual(receipt['status'],'unverified');self.assertNotIn('native_provider_path_returned',receipt)
|
||||
if failure=='http403':self.assertEqual(receipt['http_status'],403)
|
||||
|
||||
def recovery_fixture(self):
|
||||
receipt,outcome=accepted();receipt.update(bounded_outage_rollback_pre_authorized=True,verified_at='2026-10-11T01:59:00Z',accepted_at='2026-10-11T01:58:00Z')
|
||||
outcome['dispositions'][0]['disposition']['at']=receipt['accepted_at']
|
||||
sealed=json.loads((CASE/'sealed-live-deployment.json').read_text());deps=json.loads((CASE/'sealed-native-dependencies.json').read_text())
|
||||
cache={'root_authority':receipt,'native_outcome':outcome,'memo_sha256':'a'*64,'source_revision':REVISION,'plan_sha256':'b'*64}
|
||||
journal={'identity':{'plan_sha256':'b'*64},'phases':{'release':{'state':'COMPLETE','started_at':'2026-10-11T01:59:30Z','attempt_id':'release-fixture','release_authority_cache_sha256':'c'*64}}}
|
||||
probe={'kind':'informed-decision.root-supervised-outage-recovery','proposal_id':'INFD-WP-0009-T05/zlib85091-r1','source_revision':REVISION,'memo_sha256':'a'*64,'phase':'rollback','release_attempt_id':'release-fixture','cache_sha256':'c'*64,'root_verified':True,'manual_supervised_recovery':True,'current_native_outcomes_claimed':False,'observed_at':NOW.isoformat(),'native_probe_status':503,'explicit_revoked':False,'current_conflict':False,'identity_or_scope_mismatch':False,'service_healthy':False,'deployment_uid':sealed['metadata']['uid'],'configmap_uid':deps['configmap']['metadata']['uid'],'pvc_uid':deps['pvc']['metadata']['uid'],'rollback_image':sealed['spec']['template']['spec']['containers'][0]['image'],'rollback_source':'c96b0c6d881e855d1d158003c6de90ef390262e2','failed_candidate':{'image':actuator.IMAGE,'application_source':REVISION,'ready_replicas':0}}
|
||||
return probe,cache,journal,sealed,deps
|
||||
|
||||
def test_explicit_manual_cached_acceptance_only_outage_recovery(self):
|
||||
probe,cache,journal,sealed,deps=self.recovery_fixture()
|
||||
result=recovery_authority(probe,cache,journal,'a'*64,REVISION,sealed,deps,'rollback',NOW)
|
||||
self.assertTrue(result['bounded_outage_recovery']);self.assertFalse(result['current_revocation_verified'])
|
||||
mutations=[lambda p,c,j:p.update(native_probe_status=401),lambda p,c,j:p.update(native_probe_status=403),lambda p,c,j:p.update(explicit_revoked=True),lambda p,c,j:p.update(current_conflict=True),lambda p,c,j:p.update(identity_or_scope_mismatch=True),lambda p,c,j:p.update(service_healthy=True),lambda p,c,j:p.update(deployment_uid='recreated'),lambda p,c,j:p.update(source_revision='other'),lambda p,c,j:p.update(configmap_uid='recreated'),lambda p,c,j:p.update(pvc_uid='recreated'),lambda p,c,j:p['failed_candidate'].update(ready_replicas=1),lambda p,c,j:j['phases'].pop('release'),lambda p,c,j:c['root_authority'].update(bounded_outage_rollback_pre_authorized=False),lambda p,c,j:j['phases']['release'].update(started_at='2026-10-11T01:00:00Z')]
|
||||
for mutate in mutations:
|
||||
p,c,j=copy.deepcopy(probe),copy.deepcopy(cache),copy.deepcopy(journal);mutate(p,c,j)
|
||||
with self.assertRaises(ValueError):recovery_authority(p,c,j,'a'*64,REVISION,sealed,deps,'rollback',NOW)
|
||||
with self.assertRaises(ValueError):recovery_authority(probe,cache,journal,'a'*64,REVISION,sealed,deps,'release',NOW)
|
||||
late=datetime.datetime(2026,10,13,tzinfo=datetime.timezone.utc)
|
||||
with self.assertRaises(ValueError):recovery_authority(probe,cache,journal,'a'*64,REVISION,sealed,deps,'rollback',late)
|
||||
|
||||
def test_recovery_verify_requires_completed_prior_rollback_and_recovered_baseline(self):
|
||||
probe,cache,journal,sealed,deps=self.recovery_fixture();probe.update(phase='rollback-verify',original_outage_receipt_sha256='d'*64,recovered_image=probe['rollback_image'],recovered_application_source=probe['rollback_source'],ready_replicas=1)
|
||||
journal['phases']['rollback']={'state':'COMPLETE','outage_recovery_receipt_sha256':'d'*64,'outage_recovery_anchor':{'failed_candidate':probe.pop('failed_candidate')}}
|
||||
self.assertTrue(recovery_authority(probe,cache,journal,'a'*64,REVISION,sealed,deps,'rollback-verify',NOW)['bounded_outage_recovery'])
|
||||
for defect in ('state','link','image','source','ready'):
|
||||
p,j=copy.deepcopy(probe),copy.deepcopy(journal)
|
||||
if defect=='state':j['phases']['rollback']['state']='UNCERTAIN'
|
||||
elif defect=='link':p['original_outage_receipt_sha256']='other'
|
||||
elif defect=='image':p['recovered_image']=actuator.IMAGE
|
||||
elif defect=='source':p['recovered_application_source']=REVISION
|
||||
else:p['ready_replicas']=0
|
||||
with self.assertRaises(ValueError):recovery_authority(p,cache,j,'a'*64,REVISION,sealed,deps,'rollback-verify',NOW)
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
unittest.main()
|
||||
|
|
@ -0,0 +1,358 @@
|
|||
{
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"image_config_id": "sha256:622becc3ebd97cb66b6e7c36f35bf931a7decd9464b65851123c1cc8c998d75b",
|
||||
"diff_ids": [
|
||||
"sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c",
|
||||
"sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd",
|
||||
"sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366",
|
||||
"sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe",
|
||||
"sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1",
|
||||
"sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c",
|
||||
"sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59",
|
||||
"sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02",
|
||||
"sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3",
|
||||
"sha256:115811e30e0bde3e5a482191a32028a4323bacde928f17e808760ad2899407d6",
|
||||
"sha256:08f4420173dc9f73d520ab9f1a08adeb802ab64d1e1a2f419af11ba2302b05ea"
|
||||
],
|
||||
"image_config_rootfs": {
|
||||
"type": "layers",
|
||||
"diff_ids": [
|
||||
"sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c",
|
||||
"sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd",
|
||||
"sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366",
|
||||
"sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe",
|
||||
"sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1",
|
||||
"sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c",
|
||||
"sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59",
|
||||
"sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02",
|
||||
"sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3",
|
||||
"sha256:115811e30e0bde3e5a482191a32028a4323bacde928f17e808760ad2899407d6",
|
||||
"sha256:08f4420173dc9f73d520ab9f1a08adeb802ab64d1e1a2f419af11ba2302b05ea"
|
||||
]
|
||||
},
|
||||
"image_source_labels": {
|
||||
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"org.opencontainers.image.revision": "9b4bb25d325698ae543e7e8a8a3c3592db1f58fc",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
|
||||
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"os": {
|
||||
"Family": "alpine",
|
||||
"Name": "3.24.1"
|
||||
},
|
||||
"inventory": [
|
||||
[
|
||||
"lang-pkgs",
|
||||
"python-pkg",
|
||||
"PyJWT",
|
||||
"2.15.1",
|
||||
"pkg:pypi/pyjwt@2.15.1"
|
||||
],
|
||||
[
|
||||
"lang-pkgs",
|
||||
"python-pkg",
|
||||
"cffi",
|
||||
"2.1.1",
|
||||
"pkg:pypi/cffi@2.1.1"
|
||||
],
|
||||
[
|
||||
"lang-pkgs",
|
||||
"python-pkg",
|
||||
"cryptography",
|
||||
"50.0.1",
|
||||
"pkg:pypi/cryptography@50.0.1"
|
||||
],
|
||||
[
|
||||
"lang-pkgs",
|
||||
"python-pkg",
|
||||
"informed-decision",
|
||||
"0.2.0",
|
||||
"pkg:pypi/informed-decision@0.2.0"
|
||||
],
|
||||
[
|
||||
"lang-pkgs",
|
||||
"python-pkg",
|
||||
"pycparser",
|
||||
"3.0",
|
||||
"pkg:pypi/pycparser@3.0"
|
||||
],
|
||||
[
|
||||
"lang-pkgs",
|
||||
"python-pkg",
|
||||
"waitress",
|
||||
"3.0.2",
|
||||
"pkg:pypi/waitress@3.0.2"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
".python-rundeps",
|
||||
"20260901.001029",
|
||||
"pkg:apk/alpine/.python-rundeps@20260901.001029?arch=noarch&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"alpine-baselayout",
|
||||
"3.7.2-r1",
|
||||
"pkg:apk/alpine/alpine-baselayout@3.7.2-r1?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"alpine-baselayout-data",
|
||||
"3.7.2-r1",
|
||||
"pkg:apk/alpine/alpine-baselayout-data@3.7.2-r1?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"alpine-keys",
|
||||
"2.6-r0",
|
||||
"pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"alpine-release",
|
||||
"3.24.1-r0",
|
||||
"pkg:apk/alpine/alpine-release@3.24.1-r0?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"apk-tools",
|
||||
"3.0.6-r0",
|
||||
"pkg:apk/alpine/apk-tools@3.0.6-r0?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"busybox",
|
||||
"1.37.0-r31",
|
||||
"pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"busybox-binsh",
|
||||
"1.37.0-r31",
|
||||
"pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"ca-certificates",
|
||||
"20260611-r0",
|
||||
"pkg:apk/alpine/ca-certificates@20260611-r0?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"ca-certificates-bundle",
|
||||
"20260611-r0",
|
||||
"pkg:apk/alpine/ca-certificates-bundle@20260611-r0?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"gdbm",
|
||||
"1.26-r0",
|
||||
"pkg:apk/alpine/gdbm@1.26-r0?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"keyutils-libs",
|
||||
"1.6.3-r4",
|
||||
"pkg:apk/alpine/keyutils-libs@1.6.3-r4?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"krb5-conf",
|
||||
"1.0-r2",
|
||||
"pkg:apk/alpine/krb5-conf@1.0-r2?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"krb5-libs",
|
||||
"1.22.2-r1",
|
||||
"pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"libapk",
|
||||
"3.0.6-r0",
|
||||
"pkg:apk/alpine/libapk@3.0.6-r0?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"libbz2",
|
||||
"1.0.8-r6",
|
||||
"pkg:apk/alpine/libbz2@1.0.8-r6?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"libcom_err",
|
||||
"1.47.4-r0",
|
||||
"pkg:apk/alpine/libcom_err@1.47.4-r0?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"libcrypto3",
|
||||
"3.5.8-r0",
|
||||
"pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"libffi",
|
||||
"3.5.2-r1",
|
||||
"pkg:apk/alpine/libffi@3.5.2-r1?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"libintl",
|
||||
"1.0-r0",
|
||||
"pkg:apk/alpine/libintl@1.0-r0?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"libncursesw",
|
||||
"6.6_p20260516-r0",
|
||||
"pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"libnsl",
|
||||
"2.0.1-r2",
|
||||
"pkg:apk/alpine/libnsl@2.0.1-r2?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"libpanelw",
|
||||
"6.6_p20260516-r0",
|
||||
"pkg:apk/alpine/libpanelw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"libssl3",
|
||||
"3.5.8-r0",
|
||||
"pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"libtirpc",
|
||||
"1.3.5-r1",
|
||||
"pkg:apk/alpine/libtirpc@1.3.5-r1?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"libtirpc-conf",
|
||||
"1.3.5-r1",
|
||||
"pkg:apk/alpine/libtirpc-conf@1.3.5-r1?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"libuuid",
|
||||
"2.42.3-r1",
|
||||
"pkg:apk/alpine/libuuid@2.42.3-r1?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"libverto",
|
||||
"0.3.2-r2",
|
||||
"pkg:apk/alpine/libverto@0.3.2-r2?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"musl",
|
||||
"1.2.6-r2",
|
||||
"pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"musl-utils",
|
||||
"1.2.6-r2",
|
||||
"pkg:apk/alpine/musl-utils@1.2.6-r2?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"ncurses-terminfo-base",
|
||||
"6.6_p20260516-r0",
|
||||
"pkg:apk/alpine/ncurses-terminfo-base@6.6_p20260516-r0?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"readline",
|
||||
"8.3.3-r1",
|
||||
"pkg:apk/alpine/readline@8.3.3-r1?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"scanelf",
|
||||
"1.3.9-r1",
|
||||
"pkg:apk/alpine/scanelf@1.3.9-r1?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"sqlite-libs",
|
||||
"3.53.4-r0",
|
||||
"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"ssl_client",
|
||||
"1.37.0-r31",
|
||||
"pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"tzdata",
|
||||
"2026c-r0",
|
||||
"pkg:apk/alpine/tzdata@2026c-r0?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"xz-libs",
|
||||
"5.8.3-r0",
|
||||
"pkg:apk/alpine/xz-libs@5.8.3-r0?arch=x86_64&distro=3.24.1"
|
||||
],
|
||||
[
|
||||
"os-pkgs",
|
||||
"alpine",
|
||||
"zlib",
|
||||
"1.3.2-r1",
|
||||
"pkg:apk/alpine/zlib@1.3.2-r1?arch=x86_64&distro=3.24.1"
|
||||
]
|
||||
],
|
||||
"inventory_canonical_sha256": "1fd5bfb2d7c04a7316a283adbea0f54f04f0c5acbb218b11e0c5677bfe87c464",
|
||||
"published_fullreport_sha256": "2ff68e765b9c65292611d5a969202a7654637168edefcedac5d2c7634009edae",
|
||||
"publication_manifest_sha256": "6ba2c341b496ab7f79f9c5fd33a92831c2f8db25d018a4b4e67d41e0af9c5bc9",
|
||||
"scope": "Exact immutable published archive identity and inventory; findings must be checked anew on fresh DB."
|
||||
}
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
{
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"artifact_source_revision": "9b4bb25d325698ae543e7e8a8a3c3592db1f58fc",
|
||||
"scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
|
||||
"full_allseverity_scan": true,
|
||||
"no_suppression": true,
|
||||
"exit_code": null,
|
||||
"completed_at": null,
|
||||
"db_metadata": null,
|
||||
"db_sha256": null,
|
||||
"full_report_sha256": null,
|
||||
"note": "Template is not actual evidence or approval"
|
||||
}
|
||||
|
|
@ -0,0 +1,373 @@
|
|||
{
|
||||
"SchemaVersion": 2,
|
||||
"ArtifactType": "container_image",
|
||||
"Metadata": {
|
||||
"ImageID": "sha256:622becc3ebd97cb66b6e7c36f35bf931a7decd9464b65851123c1cc8c998d75b",
|
||||
"DiffIDs": [
|
||||
"sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c",
|
||||
"sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd",
|
||||
"sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366",
|
||||
"sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe",
|
||||
"sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1",
|
||||
"sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c",
|
||||
"sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59",
|
||||
"sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02",
|
||||
"sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3",
|
||||
"sha256:115811e30e0bde3e5a482191a32028a4323bacde928f17e808760ad2899407d6",
|
||||
"sha256:08f4420173dc9f73d520ab9f1a08adeb802ab64d1e1a2f419af11ba2302b05ea"
|
||||
],
|
||||
"OS": {
|
||||
"Family": "alpine",
|
||||
"Name": "3.24.1"
|
||||
},
|
||||
"ImageConfig": {
|
||||
"rootfs": {
|
||||
"type": "layers",
|
||||
"diff_ids": [
|
||||
"sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c",
|
||||
"sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd",
|
||||
"sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366",
|
||||
"sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe",
|
||||
"sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1",
|
||||
"sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c",
|
||||
"sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59",
|
||||
"sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02",
|
||||
"sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3",
|
||||
"sha256:115811e30e0bde3e5a482191a32028a4323bacde928f17e808760ad2899407d6",
|
||||
"sha256:08f4420173dc9f73d520ab9f1a08adeb802ab64d1e1a2f419af11ba2302b05ea"
|
||||
]
|
||||
},
|
||||
"config": {
|
||||
"Labels": {
|
||||
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"org.opencontainers.image.revision": "9b4bb25d325698ae543e7e8a8a3c3592db1f58fc",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
|
||||
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"Results": [
|
||||
{
|
||||
"Class": "os-pkgs",
|
||||
"Type": "alpine",
|
||||
"Packages": [
|
||||
{
|
||||
"Name": ".python-rundeps",
|
||||
"Version": "20260901.001029",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/.python-rundeps@20260901.001029?arch=noarch&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "alpine-baselayout",
|
||||
"Version": "3.7.2-r1",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/alpine-baselayout@3.7.2-r1?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "alpine-baselayout-data",
|
||||
"Version": "3.7.2-r1",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/alpine-baselayout-data@3.7.2-r1?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "alpine-keys",
|
||||
"Version": "2.6-r0",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "alpine-release",
|
||||
"Version": "3.24.1-r0",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/alpine-release@3.24.1-r0?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "apk-tools",
|
||||
"Version": "3.0.6-r0",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/apk-tools@3.0.6-r0?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "busybox",
|
||||
"Version": "1.37.0-r31",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "busybox-binsh",
|
||||
"Version": "1.37.0-r31",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "ca-certificates",
|
||||
"Version": "20260611-r0",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/ca-certificates@20260611-r0?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "ca-certificates-bundle",
|
||||
"Version": "20260611-r0",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/ca-certificates-bundle@20260611-r0?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "gdbm",
|
||||
"Version": "1.26-r0",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/gdbm@1.26-r0?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "keyutils-libs",
|
||||
"Version": "1.6.3-r4",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/keyutils-libs@1.6.3-r4?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "krb5-conf",
|
||||
"Version": "1.0-r2",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/krb5-conf@1.0-r2?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "krb5-libs",
|
||||
"Version": "1.22.2-r1",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "libapk",
|
||||
"Version": "3.0.6-r0",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/libapk@3.0.6-r0?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "libbz2",
|
||||
"Version": "1.0.8-r6",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/libbz2@1.0.8-r6?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "libcom_err",
|
||||
"Version": "1.47.4-r0",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/libcom_err@1.47.4-r0?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "libcrypto3",
|
||||
"Version": "3.5.8-r0",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "libffi",
|
||||
"Version": "3.5.2-r1",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/libffi@3.5.2-r1?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "libintl",
|
||||
"Version": "1.0-r0",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/libintl@1.0-r0?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "libncursesw",
|
||||
"Version": "6.6_p20260516-r0",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "libnsl",
|
||||
"Version": "2.0.1-r2",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/libnsl@2.0.1-r2?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "libpanelw",
|
||||
"Version": "6.6_p20260516-r0",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/libpanelw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "libssl3",
|
||||
"Version": "3.5.8-r0",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "libtirpc",
|
||||
"Version": "1.3.5-r1",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/libtirpc@1.3.5-r1?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "libtirpc-conf",
|
||||
"Version": "1.3.5-r1",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/libtirpc-conf@1.3.5-r1?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "libuuid",
|
||||
"Version": "2.42.3-r1",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/libuuid@2.42.3-r1?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "libverto",
|
||||
"Version": "0.3.2-r2",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/libverto@0.3.2-r2?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "musl",
|
||||
"Version": "1.2.6-r2",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "musl-utils",
|
||||
"Version": "1.2.6-r2",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/musl-utils@1.2.6-r2?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "ncurses-terminfo-base",
|
||||
"Version": "6.6_p20260516-r0",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/ncurses-terminfo-base@6.6_p20260516-r0?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "readline",
|
||||
"Version": "8.3.3-r1",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/readline@8.3.3-r1?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "scanelf",
|
||||
"Version": "1.3.9-r1",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/scanelf@1.3.9-r1?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "sqlite-libs",
|
||||
"Version": "3.53.4-r0",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "ssl_client",
|
||||
"Version": "1.37.0-r31",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "tzdata",
|
||||
"Version": "2026c-r0",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/tzdata@2026c-r0?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "xz-libs",
|
||||
"Version": "5.8.3-r0",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/xz-libs@5.8.3-r0?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "zlib",
|
||||
"Version": "1.3.2-r1",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:apk/alpine/zlib@1.3.2-r1?arch=x86_64&distro=3.24.1"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"Class": "lang-pkgs",
|
||||
"Type": "python-pkg",
|
||||
"Packages": [
|
||||
{
|
||||
"Name": "PyJWT",
|
||||
"Version": "2.15.1",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:pypi/pyjwt@2.15.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "cffi",
|
||||
"Version": "2.1.1",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:pypi/cffi@2.1.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "cryptography",
|
||||
"Version": "50.0.1",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:pypi/cryptography@50.0.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "informed-decision",
|
||||
"Version": "0.2.0",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:pypi/informed-decision@0.2.0"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "pycparser",
|
||||
"Version": "3.0",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:pypi/pycparser@3.0"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "waitress",
|
||||
"Version": "3.0.2",
|
||||
"Identifier": {
|
||||
"PURL": "pkg:pypi/waitress@3.0.2"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,147 @@
|
|||
[
|
||||
{
|
||||
"original_path": "deploy/lifecycle/admission.candidate.json",
|
||||
"original_sha256": "6c76cedd0abc4a4261cfcb69c6597611c282bd4fed8b6aaf77aff04fdf942529",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/deploy/lifecycle/admission.candidate.json"
|
||||
},
|
||||
{
|
||||
"original_path": "deploy/lifecycle/kustomization.yaml",
|
||||
"original_sha256": "1bbce81bc6758434354157f8601534320c5d0290587908fd15a6d25e3fa57f47",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/deploy/lifecycle/kustomization.yaml"
|
||||
},
|
||||
{
|
||||
"original_path": "deploy/lifecycle/registries.candidate.json",
|
||||
"original_sha256": "9bad6db5fbc2178d31b04120016a41830c3552fbb9e2517b718f9bbe87cf649e",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/deploy/lifecycle/registries.candidate.json"
|
||||
},
|
||||
{
|
||||
"original_path": "deploy/lifecycle/service.candidate.json",
|
||||
"original_sha256": "383332cd4fd27a8b36e63a4d79addc43eb68615f742328d4577bfc2b467e2278",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/deploy/lifecycle/service.candidate.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/artifact-comparison.json",
|
||||
"original_sha256": "a1c5d9e249dc00600449998360faf6e8da0206b568c76d155602c4645fa5fce4",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/artifact-comparison.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/candidate-deployment.json",
|
||||
"original_sha256": "487f834cc86dcbc7a04c2392bde072ecaf87dc116b4baa16c35eb9c599ad5c95",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/candidate-deployment.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/candidate-runtime.json",
|
||||
"original_sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/candidate-runtime.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/change_guard.py",
|
||||
"original_sha256": "b3ee2b89de14e204efedd016d3900b6e31fcc9f0ea0f3125d3a4794d938ca201",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/change_guard.py"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/check_installed.py",
|
||||
"original_sha256": "a34a51be9c9f2b16a06a88173b5c6c492c9957fe021cf412a86a1737730640ad",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/check_installed.py"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/decision-packet.md",
|
||||
"original_sha256": "763f30c1433d1ca872b029519ec46ad1b97c47d60b7ea0eea0275a2c6b647dc3",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/decision-packet.md"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/execution/actuator.py",
|
||||
"original_sha256": "741b490bdb315896f05f2e91404c02765517dc1beea81fa590017fccafd299b4",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/actuator.py"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/execution/authority_journal.py",
|
||||
"original_sha256": "040144321c69622c223a8437832a3c5a4a9595fc37774fde5ff0ad676828ebf0",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/authority_journal.py"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/execution/execution-plan.json",
|
||||
"original_sha256": "9b458e2b4d418525987b6cb1b9a160c4b1a2c621625c1b5c571ea5c77e9d4361",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/execution-plan.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/execution/native_program.py",
|
||||
"original_sha256": "fcf8fc3593910b2e99dd51d159a30aa9b853c40ff00c566a620d20eaadc8af20",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/native_program.py"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/execution/receipt_safety.py",
|
||||
"original_sha256": "5c54373f2dc4b064008225c186efb1d5afdeec36d15350bda0a12ded97602d1b",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/receipt_safety.py"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/execution/test_execution.py",
|
||||
"original_sha256": "aa86921fe37fcff382676490f937af2e62bd6472a6b4700c862aaf3ce4ab8225",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/test_execution.py"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/installed-zlib-proof.json",
|
||||
"original_sha256": "6af62f86f50ac185fab94163c24ac8150ead69e62f8d825b0dce1e75a5a57b68",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/installed-zlib-proof.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/memo.json",
|
||||
"original_sha256": "3c76c6a8f95dcb55183583a937a4428b745a5c918643de8f2a2bc11dee846d98",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/memo.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/native-backup-restore-protocol.md",
|
||||
"original_sha256": "f586a511c1921490185bab95334f27de6d3cca20b348df20d18bcb9257d7ae35",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/native-backup-restore-protocol.md"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/native-preflight.json",
|
||||
"original_sha256": "56637994dfdae46a6f9ab442c2ff9b259212650b35eb98d896c5e837f01ce2f9",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/native-preflight.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/proposal.json",
|
||||
"original_sha256": "48b0f0baf4efc239111411ad7d1c291f8eceaa0ddf1414dac73d49ccdb3bbe70",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/proposal.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/published-verification.json",
|
||||
"original_sha256": "dd4eecf0c103dca7922094a8beeb99b77ae96fd1d5fe532e37bd833daa02614e",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/published-verification.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/rollback-deployment.json",
|
||||
"original_sha256": "f8a9a07abc2eb52cdf6bcdba2d9f79dec073145c31d0444a9e0fe1147e42cc4e",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/rollback-deployment.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/runtime-receipt.json",
|
||||
"original_sha256": "6442676dcfd941f0a05a4cb79a02dea839fcd332d82b2154c15cf6db68de5889",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/runtime-receipt.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/scan-receipt.json",
|
||||
"original_sha256": "aaaa91061bb036e6d228b1c1bd4333578dc948cb2bb5ac8ba269429121e7321a",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/scan-receipt.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/sealed-live-deployment.json",
|
||||
"original_sha256": "f8a9a07abc2eb52cdf6bcdba2d9f79dec073145c31d0444a9e0fe1147e42cc4e",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/sealed-live-deployment.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/sealed-native-dependencies.json",
|
||||
"original_sha256": "042327a036ed254cf95dbeb0c056ac25b03a6a844b95a332c992df2943691369",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/sealed-native-dependencies.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/source-commit-proof.json",
|
||||
"original_sha256": "b0811da2d3bd5938733f0078e5fec8e19a6d9752c4277b80bfe9837ed72c6a3b",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/source-commit-proof.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/sqlite_readonly.py",
|
||||
"original_sha256": "9093c64f7f0e39b249da9fefdf5aaf4e4258bc31e7a27fd888479ce329a20509",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/sqlite_readonly.py"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,205 @@
|
|||
[
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/lifecycle/admission.candidate.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/deploy/lifecycle/admission.candidate.json",
|
||||
"original_sha256": "92382a56b349c3b895e5806e975082527bb99d1a001140e69d857e5b0391fa55",
|
||||
"staged_sha256": "6c76cedd0abc4a4261cfcb69c6597611c282bd4fed8b6aaf77aff04fdf942529"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/lifecycle/kustomization.yaml",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/deploy/lifecycle/kustomization.yaml",
|
||||
"original_sha256": "1bbce81bc6758434354157f8601534320c5d0290587908fd15a6d25e3fa57f47",
|
||||
"staged_sha256": "1bbce81bc6758434354157f8601534320c5d0290587908fd15a6d25e3fa57f47"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/lifecycle/registries.candidate.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/deploy/lifecycle/registries.candidate.json",
|
||||
"original_sha256": "9bad6db5fbc2178d31b04120016a41830c3552fbb9e2517b718f9bbe87cf649e",
|
||||
"staged_sha256": "9bad6db5fbc2178d31b04120016a41830c3552fbb9e2517b718f9bbe87cf649e"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/lifecycle/service.candidate.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/deploy/lifecycle/service.candidate.json",
|
||||
"original_sha256": "38b78b9cbee5ade7750a58d5156ca4c5773352e947acb304ee714b59e749ceb4",
|
||||
"staged_sha256": "383332cd4fd27a8b36e63a4d79addc43eb68615f742328d4577bfc2b467e2278"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/artifact-comparison.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/artifact-comparison.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "a1c5d9e249dc00600449998360faf6e8da0206b568c76d155602c4645fa5fce4"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/candidate-deployment.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/candidate-deployment.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "487f834cc86dcbc7a04c2392bde072ecaf87dc116b4baa16c35eb9c599ad5c95"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/candidate-runtime.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/candidate-runtime.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/change_guard.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/change_guard.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "b3ee2b89de14e204efedd016d3900b6e31fcc9f0ea0f3125d3a4794d938ca201"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/check_installed.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/check_installed.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "a34a51be9c9f2b16a06a88173b5c6c492c9957fe021cf412a86a1737730640ad"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/decision-packet.md",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/decision-packet.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "763f30c1433d1ca872b029519ec46ad1b97c47d60b7ea0eea0275a2c6b647dc3"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/execution/actuator.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/execution/actuator.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "741b490bdb315896f05f2e91404c02765517dc1beea81fa590017fccafd299b4"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/execution/authority_journal.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/execution/authority_journal.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "040144321c69622c223a8437832a3c5a4a9595fc37774fde5ff0ad676828ebf0"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/execution/execution-plan.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/execution/execution-plan.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "9b458e2b4d418525987b6cb1b9a160c4b1a2c621625c1b5c571ea5c77e9d4361"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/execution/native_program.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/execution/native_program.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "fcf8fc3593910b2e99dd51d159a30aa9b853c40ff00c566a620d20eaadc8af20"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/execution/receipt_safety.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/execution/receipt_safety.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "5c54373f2dc4b064008225c186efb1d5afdeec36d15350bda0a12ded97602d1b"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/execution/test_execution.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/execution/test_execution.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "aa86921fe37fcff382676490f937af2e62bd6472a6b4700c862aaf3ce4ab8225"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/installed-zlib-proof.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/installed-zlib-proof.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "6af62f86f50ac185fab94163c24ac8150ead69e62f8d825b0dce1e75a5a57b68"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/memo.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/memo.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "3c76c6a8f95dcb55183583a937a4428b745a5c918643de8f2a2bc11dee846d98"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/native-backup-restore-protocol.md",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/native-backup-restore-protocol.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f586a511c1921490185bab95334f27de6d3cca20b348df20d18bcb9257d7ae35"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/native-preflight.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/native-preflight.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "56637994dfdae46a6f9ab442c2ff9b259212650b35eb98d896c5e837f01ce2f9"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/proposal.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/proposal.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "48b0f0baf4efc239111411ad7d1c291f8eceaa0ddf1414dac73d49ccdb3bbe70"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/published-verification.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/published-verification.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "dd4eecf0c103dca7922094a8beeb99b77ae96fd1d5fe532e37bd833daa02614e"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/rollback-deployment.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/rollback-deployment.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f8a9a07abc2eb52cdf6bcdba2d9f79dec073145c31d0444a9e0fe1147e42cc4e"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/runtime-receipt.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/runtime-receipt.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "6442676dcfd941f0a05a4cb79a02dea839fcd332d82b2154c15cf6db68de5889"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/scan-receipt.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/scan-receipt.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "aaaa91061bb036e6d228b1c1bd4333578dc948cb2bb5ac8ba269429121e7321a"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/sealed-live-deployment.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/sealed-live-deployment.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f8a9a07abc2eb52cdf6bcdba2d9f79dec073145c31d0444a9e0fe1147e42cc4e"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/sealed-native-dependencies.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/sealed-native-dependencies.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "042327a036ed254cf95dbeb0c056ac25b03a6a844b95a332c992df2943691369"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/source-commit-proof.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/source-commit-proof.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "b0811da2d3bd5938733f0078e5fec8e19a6d9752c4277b80bfe9837ed72c6a3b"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/sqlite_readonly.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/sqlite_readonly.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "9093c64f7f0e39b249da9fefdf5aaf4e4258bc31e7a27fd888479ce329a20509"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,52 @@
|
|||
{
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"policy": {
|
||||
"origin": "http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080",
|
||||
"package": "informed-decision.compact-sitting",
|
||||
"version": "v13",
|
||||
"package_digest": "sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873",
|
||||
"pod_name": "flex-auth-informed-decision-sitting"
|
||||
},
|
||||
"keycape_egress_ips": [
|
||||
"92.205.62.239"
|
||||
],
|
||||
"storage_class": "local-path",
|
||||
"ordinary_approval_ids": [
|
||||
"2ce76d7f-01c3-4b63-8476-8d1230679769",
|
||||
"c2af4bcf-15b4-4305-aac1-acc7e4dcb099",
|
||||
"dc22666a-d5d7-46bc-9490-ebe9fe09dc38"
|
||||
],
|
||||
"lifecycle_policy": {
|
||||
"package": "informed-decision.lifecycle",
|
||||
"version": "v2",
|
||||
"package_digest": "sha256:da01e045fc108adec6b489e5d51f7e57366793016c5a64776963780a6aae457c",
|
||||
"origin": "http://flex-auth-informed-decision-lifecycle.flex-auth.svc.cluster.local:8080",
|
||||
"pod_name": "flex-auth-informed-decision-lifecycle"
|
||||
},
|
||||
"lifecycle_delivery": true,
|
||||
"intake_attributes": true,
|
||||
"intake_delivery": {
|
||||
"hub_origin": "http://state-hub.state-hub.svc.cluster.local:8000"
|
||||
},
|
||||
"workload_api": {
|
||||
"registries_configmap": "informed-decision-workload-registry",
|
||||
"peers": [
|
||||
{
|
||||
"namespace": "state-hub",
|
||||
"app": "state-hub"
|
||||
}
|
||||
],
|
||||
"api_egress": [
|
||||
{
|
||||
"ip": "10.43.0.1",
|
||||
"port": 443
|
||||
},
|
||||
{
|
||||
"ip": "92.205.62.239",
|
||||
"port": 6443
|
||||
}
|
||||
],
|
||||
"intake": true,
|
||||
"lifecycle": true
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- service.candidate.json
|
||||
- registries.candidate.json
|
||||
commonAnnotations:
|
||||
informed-decision.coulomb.social/admission: approved; INFD-WP-0007 cutover
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "ConfigMap",
|
||||
"metadata": {
|
||||
"name": "informed-decision-workload-registry",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "proposal; INFD-WP-0007 concrete rollout approval required"
|
||||
}
|
||||
},
|
||||
"data": {
|
||||
"lifecycle-callers.json": "{\n \"system:serviceaccount:state-hub:state-hub\": {\n \"tenant\": \"tenant:platform\"\n }\n}\n",
|
||||
"intake-submitters.json": "{\n \"system:serviceaccount:state-hub:state-hub\": {\n \"submitter_id\": \"state-hub\",\n \"memo_classes\": [\n \"decision-record\"\n ],\n \"review_groups\": [\n \"net-kingdom-admins\"\n ],\n \"daily_limit\": 50\n }\n}\n",
|
||||
"review-groups.json": "{\n \"net-kingdom-admins\": {\n \"subject\": \"uid=platform-root,ou=people,dc=netkingdom,dc=local\",\n \"display_name\": \"Platform reviewer\"\n }\n}\n"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,800 @@
|
|||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "List",
|
||||
"items": [
|
||||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "ServiceAccount",
|
||||
"metadata": {
|
||||
"name": "review",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
||||
}
|
||||
},
|
||||
"automountServiceAccountToken": false
|
||||
},
|
||||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "PersistentVolumeClaim",
|
||||
"metadata": {
|
||||
"name": "informed-decision-data",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"accessModes": [
|
||||
"ReadWriteOnce"
|
||||
],
|
||||
"storageClassName": "local-path",
|
||||
"resources": {
|
||||
"requests": {
|
||||
"storage": "1Gi"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "ConfigMap",
|
||||
"metadata": {
|
||||
"name": "informed-decision-runtime-6c221878d051",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
||||
}
|
||||
},
|
||||
"immutable": true,
|
||||
"data": {
|
||||
"runtime.json": "{\"approval_origin\":\"http://approval-engine.approval-engine.svc.cluster.local:8080\",\"audit\":{\"origin\":\"http://audit-core.audit-core.svc.cluster.local:8080\",\"sender_token_file\":\"/var/run/secrets/informed-decision/audit/token\"},\"evidence_db\":\"/data/private/review.sqlite\",\"intake_attributes\":true,\"intake_delivery\":{\"hub_origin\":\"http://state-hub.state-hub.svc.cluster.local:8000\"},\"lifecycle_delivery\":true,\"lifecycle_policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-lifecycle.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.lifecycle\",\"package_digest\":\"sha256:da01e045fc108adec6b489e5d51f7e57366793016c5a64776963780a6aae457c\",\"version\":\"v2\"},\"ordinary_approval_ids\":[\"2ce76d7f-01c3-4b63-8476-8d1230679769\",\"c2af4bcf-15b4-4305-aac1-acc7e4dcb099\",\"dc22666a-d5d7-46bc-9490-ebe9fe09dc38\"],\"policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.compact-sitting\",\"package_digest\":\"sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873\",\"version\":\"v13\"},\"schema\":\"informed-decision.review-runtime.v1\",\"workload_api\":{\"intake\":{\"groups_file\":\"/workload-registry/review-groups.json\",\"secret_file\":\"/var/run/secrets/informed-decision/requester/client-secret\",\"submitters_file\":\"/workload-registry/intake-submitters.json\"},\"lifecycle_callers_file\":\"/workload-registry/lifecycle-callers.json\",\"token_review\":{\"ca_file\":\"/var/run/secrets/informed-decision/kubernetes/ca.crt\",\"origin\":\"https://kubernetes.default.svc:443\",\"token_file\":\"/var/run/secrets/informed-decision/kubernetes/token\"}}}"
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "apps/v1",
|
||||
"kind": "Deployment",
|
||||
"metadata": {
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"replicas": 1,
|
||||
"strategy": {
|
||||
"type": "Recreate"
|
||||
},
|
||||
"progressDeadlineSeconds": 600,
|
||||
"selector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"template": {
|
||||
"metadata": {
|
||||
"labels": {
|
||||
"app.kubernetes.io/name": "informed-decision",
|
||||
"app.kubernetes.io/component": "review"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"automountServiceAccountToken": false,
|
||||
"serviceAccountName": "review",
|
||||
"terminationGracePeriodSeconds": 45,
|
||||
"securityContext": {
|
||||
"runAsNonRoot": true,
|
||||
"runAsUser": 10001,
|
||||
"runAsGroup": 10001,
|
||||
"fsGroup": 10001,
|
||||
"fsGroupChangePolicy": "OnRootMismatch",
|
||||
"seccompProfile": {
|
||||
"type": "RuntimeDefault"
|
||||
}
|
||||
},
|
||||
"containers": [
|
||||
{
|
||||
"name": "informed-decision",
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"securityContext": {
|
||||
"allowPrivilegeEscalation": false,
|
||||
"readOnlyRootFilesystem": true,
|
||||
"capabilities": {
|
||||
"drop": [
|
||||
"ALL"
|
||||
]
|
||||
}
|
||||
},
|
||||
"env": [
|
||||
{
|
||||
"name": "INFD_KEYCAPE_ISSUER",
|
||||
"value": "https://kc.coulomb.social"
|
||||
},
|
||||
{
|
||||
"name": "INFD_CONTAINER_CONFIG",
|
||||
"value": "/configuration/runtime.json"
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"name": "http",
|
||||
"containerPort": 8080
|
||||
},
|
||||
{
|
||||
"name": "workload",
|
||||
"containerPort": 8081
|
||||
}
|
||||
],
|
||||
"startupProbe": {
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"timeoutSeconds": 2,
|
||||
"failureThreshold": 12
|
||||
},
|
||||
"readinessProbe": {
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"livenessProbe": {
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"resources": {
|
||||
"requests": {
|
||||
"cpu": "5m",
|
||||
"memory": "64Mi"
|
||||
},
|
||||
"limits": {
|
||||
"cpu": "500m",
|
||||
"memory": "256Mi"
|
||||
}
|
||||
},
|
||||
"volumeMounts": [
|
||||
{
|
||||
"name": "data",
|
||||
"mountPath": "/data"
|
||||
},
|
||||
{
|
||||
"name": "runtime",
|
||||
"mountPath": "/run/informed-decision"
|
||||
},
|
||||
{
|
||||
"name": "tmp",
|
||||
"mountPath": "/tmp"
|
||||
},
|
||||
{
|
||||
"name": "configuration",
|
||||
"mountPath": "/configuration",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"name": "caller",
|
||||
"mountPath": "/var/run/secrets/informed-decision/policy",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"name": "audit",
|
||||
"mountPath": "/var/run/secrets/informed-decision/audit",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"name": "kubernetes-api",
|
||||
"mountPath": "/var/run/secrets/informed-decision/kubernetes",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"name": "workload-registry",
|
||||
"mountPath": "/workload-registry",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"name": "sitting-requester",
|
||||
"mountPath": "/var/run/secrets/informed-decision/requester",
|
||||
"readOnly": true
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"volumes": [
|
||||
{
|
||||
"name": "data",
|
||||
"persistentVolumeClaim": {
|
||||
"claimName": "informed-decision-data"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "runtime",
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "tmp",
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "configuration",
|
||||
"configMap": {
|
||||
"name": "informed-decision-runtime-6c221878d051",
|
||||
"defaultMode": 292
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "caller",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"path": "token",
|
||||
"audience": "flex-auth",
|
||||
"expirationSeconds": 3600
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "audit",
|
||||
"secret": {
|
||||
"secretName": "informed-decision-audit",
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "token",
|
||||
"path": "token"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "kubernetes-api",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"path": "token",
|
||||
"expirationSeconds": 600
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"name": "kube-root-ca.crt",
|
||||
"items": [
|
||||
{
|
||||
"key": "ca.crt",
|
||||
"path": "ca.crt"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "workload-registry",
|
||||
"configMap": {
|
||||
"name": "informed-decision-workload-registry",
|
||||
"defaultMode": 292
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "sitting-requester",
|
||||
"secret": {
|
||||
"secretName": "informed-decision-sitting-requester",
|
||||
"defaultMode": 288,
|
||||
"optional": false,
|
||||
"items": [
|
||||
{
|
||||
"key": "client-secret",
|
||||
"path": "client-secret"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "Service",
|
||||
"metadata": {
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"type": "ClusterIP",
|
||||
"selector": {
|
||||
"app.kubernetes.io/name": "informed-decision",
|
||||
"app.kubernetes.io/component": "review"
|
||||
},
|
||||
"ports": [
|
||||
{
|
||||
"name": "http",
|
||||
"port": 80,
|
||||
"targetPort": "http",
|
||||
"protocol": "TCP"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "networking.k8s.io/v1",
|
||||
"kind": "NetworkPolicy",
|
||||
"metadata": {
|
||||
"name": "informed-decision-review",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision",
|
||||
"app.kubernetes.io/component": "review"
|
||||
}
|
||||
},
|
||||
"policyTypes": [
|
||||
"Ingress",
|
||||
"Egress"
|
||||
],
|
||||
"ingress": [
|
||||
{
|
||||
"from": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "kube-system"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "traefik"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 8080
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"from": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "state-hub"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "state-hub"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 8081
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"egress": [
|
||||
{
|
||||
"to": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "kube-system"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"k8s-app": "kube-dns"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "UDP",
|
||||
"port": 53
|
||||
},
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 53
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"to": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "approval-engine"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "approval-engine"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "audit-core"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "audit-core"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "flex-auth"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "flex-auth-informed-decision-sitting"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "flex-auth"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "flex-auth-informed-decision-lifecycle"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 8080
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"to": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "kube-system"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "traefik"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 8443
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"to": [
|
||||
{
|
||||
"ipBlock": {
|
||||
"cidr": "92.205.62.239/32"
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 443
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"to": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "state-hub"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "state-hub"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 8000
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"to": [
|
||||
{
|
||||
"ipBlock": {
|
||||
"cidr": "10.43.0.1/32"
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 443
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"to": [
|
||||
{
|
||||
"ipBlock": {
|
||||
"cidr": "92.205.62.239/32"
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 6443
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "Service",
|
||||
"metadata": {
|
||||
"name": "informed-decision-workload",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"type": "ClusterIP",
|
||||
"selector": {
|
||||
"app.kubernetes.io/name": "informed-decision",
|
||||
"app.kubernetes.io/component": "review"
|
||||
},
|
||||
"ports": [
|
||||
{
|
||||
"name": "workload",
|
||||
"port": 8081,
|
||||
"targetPort": "workload",
|
||||
"protocol": "TCP"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "rbac.authorization.k8s.io/v1",
|
||||
"kind": "ClusterRole",
|
||||
"metadata": {
|
||||
"name": "informed-decision-tokenreview",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "proposal; INFD-WP-0007/INFD-WP-0005 owner review required"
|
||||
}
|
||||
},
|
||||
"rules": [
|
||||
{
|
||||
"apiGroups": [
|
||||
"authentication.k8s.io"
|
||||
],
|
||||
"resources": [
|
||||
"tokenreviews"
|
||||
],
|
||||
"verbs": [
|
||||
"create"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"apiVersion": "rbac.authorization.k8s.io/v1",
|
||||
"kind": "ClusterRoleBinding",
|
||||
"metadata": {
|
||||
"name": "informed-decision-tokenreview",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "proposal; INFD-WP-0007/INFD-WP-0005 owner review required"
|
||||
}
|
||||
},
|
||||
"roleRef": {
|
||||
"apiGroup": "rbac.authorization.k8s.io",
|
||||
"kind": "ClusterRole",
|
||||
"name": "informed-decision-tokenreview"
|
||||
},
|
||||
"subjects": [
|
||||
{
|
||||
"kind": "ServiceAccount",
|
||||
"name": "review",
|
||||
"namespace": "informed-decision"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"apiVersion": "networking.k8s.io/v1",
|
||||
"kind": "NetworkPolicy",
|
||||
"metadata": {
|
||||
"name": "informed-decision-review-ingress",
|
||||
"namespace": "approval-engine",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08",
|
||||
"informed-decision.coulomb.social/owner-review": "APPROVAL-WP-0002-T01"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "approval-engine"
|
||||
}
|
||||
},
|
||||
"policyTypes": [
|
||||
"Ingress"
|
||||
],
|
||||
"ingress": [
|
||||
{
|
||||
"from": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision",
|
||||
"app.kubernetes.io/component": "review"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 8080
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "networking.k8s.io/v1",
|
||||
"kind": "NetworkPolicy",
|
||||
"metadata": {
|
||||
"name": "informed-decision-review-ingress",
|
||||
"namespace": "flex-auth",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08",
|
||||
"informed-decision.coulomb.social/owner-review": "INFD-WP-0001-T08 policy-owner return"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "flex-auth-informed-decision-sitting"
|
||||
}
|
||||
},
|
||||
"policyTypes": [
|
||||
"Ingress"
|
||||
],
|
||||
"ingress": [
|
||||
{
|
||||
"from": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision",
|
||||
"app.kubernetes.io/component": "review"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 8080
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "networking.k8s.io/v1",
|
||||
"kind": "NetworkPolicy",
|
||||
"metadata": {
|
||||
"name": "informed-decision-lifecycle-ingress",
|
||||
"namespace": "flex-auth",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08",
|
||||
"informed-decision.coulomb.social/owner-review": "INFD-WP-0007 lifecycle policy-owner return"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "flex-auth-informed-decision-lifecycle"
|
||||
}
|
||||
},
|
||||
"policyTypes": [
|
||||
"Ingress"
|
||||
],
|
||||
"ingress": [
|
||||
{
|
||||
"from": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision",
|
||||
"app.kubernetes.io/component": "review"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 8080
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,73 @@
|
|||
{
|
||||
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
|
||||
"candidate_local_image_config_id": "sha256:622becc3ebd97cb66b6e7c36f35bf931a7decd9464b65851123c1cc8c998d75b",
|
||||
"candidate_registry_digest": null,
|
||||
"base_layers_preserved": 9,
|
||||
"new_layers": 2,
|
||||
"effective_runtime_config_identical": true,
|
||||
"raw_config_bytes_identical": false,
|
||||
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
|
||||
"labels_before": {
|
||||
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
|
||||
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"labels_after": {
|
||||
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"org.opencontainers.image.revision": "9b4bb25d325698ae543e7e8a8a3c3592db1f58fc",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
|
||||
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"final_changed_files": {
|
||||
"lib/apk/db/installed": {
|
||||
"before": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
|
||||
]
|
||||
},
|
||||
"usr/lib/libz.so.1.3.2": {
|
||||
"before": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
|
||||
]
|
||||
}
|
||||
},
|
||||
"directory_metadata_compared": true,
|
||||
"directory_count_base": 313,
|
||||
"directory_count_candidate": 313,
|
||||
"directory_metadata_delta": {},
|
||||
"sbom_package_count_base": 44,
|
||||
"sbom_package_count_candidate": 44,
|
||||
"sbom_only_delta": {
|
||||
"zlib": [
|
||||
"1.3.2-r0",
|
||||
"1.3.2-r1"
|
||||
]
|
||||
},
|
||||
"full_scan_baseline_findings": 1,
|
||||
"full_scan_candidate_allseverity_findings": 0,
|
||||
"db_snapshot_same": true,
|
||||
"native_workload_changed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,286 @@
|
|||
{
|
||||
"apiVersion": "apps/v1",
|
||||
"kind": "Deployment",
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"argocd.argoproj.io/tracking-id": "informed-decision:apps/Deployment:informed-decision/informed-decision",
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision",
|
||||
"uid": "a588e10a-90d2-4883-975e-6dd8b8feca92"
|
||||
},
|
||||
"spec": {
|
||||
"progressDeadlineSeconds": 600,
|
||||
"replicas": 1,
|
||||
"revisionHistoryLimit": 10,
|
||||
"selector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"strategy": {
|
||||
"type": "Recreate"
|
||||
},
|
||||
"template": {
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"labels": {
|
||||
"app.kubernetes.io/component": "review",
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"automountServiceAccountToken": false,
|
||||
"containers": [
|
||||
{
|
||||
"env": [
|
||||
{
|
||||
"name": "INFD_KEYCAPE_ISSUER",
|
||||
"value": "https://kc.coulomb.social"
|
||||
},
|
||||
{
|
||||
"name": "INFD_CONTAINER_CONFIG",
|
||||
"value": "/configuration/runtime.json"
|
||||
}
|
||||
],
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"imagePullPolicy": "IfNotPresent",
|
||||
"livenessProbe": {
|
||||
"failureThreshold": 3,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"name": "informed-decision",
|
||||
"ports": [
|
||||
{
|
||||
"containerPort": 8080,
|
||||
"name": "http",
|
||||
"protocol": "TCP"
|
||||
},
|
||||
{
|
||||
"containerPort": 8081,
|
||||
"name": "workload",
|
||||
"protocol": "TCP"
|
||||
}
|
||||
],
|
||||
"readinessProbe": {
|
||||
"failureThreshold": 3,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"resources": {
|
||||
"limits": {
|
||||
"cpu": "500m",
|
||||
"memory": "256Mi"
|
||||
},
|
||||
"requests": {
|
||||
"cpu": "5m",
|
||||
"memory": "64Mi"
|
||||
}
|
||||
},
|
||||
"securityContext": {
|
||||
"allowPrivilegeEscalation": false,
|
||||
"capabilities": {
|
||||
"drop": [
|
||||
"ALL"
|
||||
]
|
||||
},
|
||||
"readOnlyRootFilesystem": true
|
||||
},
|
||||
"startupProbe": {
|
||||
"failureThreshold": 12,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"terminationMessagePath": "/dev/termination-log",
|
||||
"terminationMessagePolicy": "File",
|
||||
"volumeMounts": [
|
||||
{
|
||||
"mountPath": "/data",
|
||||
"name": "data"
|
||||
},
|
||||
{
|
||||
"mountPath": "/run/informed-decision",
|
||||
"name": "runtime"
|
||||
},
|
||||
{
|
||||
"mountPath": "/tmp",
|
||||
"name": "tmp"
|
||||
},
|
||||
{
|
||||
"mountPath": "/configuration",
|
||||
"name": "configuration",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/policy",
|
||||
"name": "caller",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/audit",
|
||||
"name": "audit",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/kubernetes",
|
||||
"name": "kubernetes-api",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/workload-registry",
|
||||
"name": "workload-registry",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/requester",
|
||||
"name": "sitting-requester",
|
||||
"readOnly": true
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"dnsPolicy": "ClusterFirst",
|
||||
"restartPolicy": "Always",
|
||||
"schedulerName": "default-scheduler",
|
||||
"securityContext": {
|
||||
"fsGroup": 10001,
|
||||
"fsGroupChangePolicy": "OnRootMismatch",
|
||||
"runAsGroup": 10001,
|
||||
"runAsNonRoot": true,
|
||||
"runAsUser": 10001,
|
||||
"seccompProfile": {
|
||||
"type": "RuntimeDefault"
|
||||
}
|
||||
},
|
||||
"serviceAccount": "review",
|
||||
"serviceAccountName": "review",
|
||||
"terminationGracePeriodSeconds": 45,
|
||||
"volumes": [
|
||||
{
|
||||
"name": "data",
|
||||
"persistentVolumeClaim": {
|
||||
"claimName": "informed-decision-data"
|
||||
}
|
||||
},
|
||||
{
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
},
|
||||
"name": "runtime"
|
||||
},
|
||||
{
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
},
|
||||
"name": "tmp"
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"defaultMode": 292,
|
||||
"name": "informed-decision-runtime-6c221878d051"
|
||||
},
|
||||
"name": "configuration"
|
||||
},
|
||||
{
|
||||
"name": "caller",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"audience": "flex-auth",
|
||||
"expirationSeconds": 3600,
|
||||
"path": "token"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "audit",
|
||||
"secret": {
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "token",
|
||||
"path": "token"
|
||||
}
|
||||
],
|
||||
"secretName": "informed-decision-audit"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "kubernetes-api",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"expirationSeconds": 600,
|
||||
"path": "token"
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"items": [
|
||||
{
|
||||
"key": "ca.crt",
|
||||
"path": "ca.crt"
|
||||
}
|
||||
],
|
||||
"name": "kube-root-ca.crt"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"defaultMode": 292,
|
||||
"name": "informed-decision-workload-registry"
|
||||
},
|
||||
"name": "workload-registry"
|
||||
},
|
||||
{
|
||||
"name": "sitting-requester",
|
||||
"secret": {
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "client-secret",
|
||||
"path": "client-secret"
|
||||
}
|
||||
],
|
||||
"optional": false,
|
||||
"secretName": "informed-decision-sitting-requester"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
File diff suppressed because one or more lines are too long
|
|
@ -0,0 +1,68 @@
|
|||
"""Read-only exact Deployment and admission boundaries; no mutation authority."""
|
||||
import copy
|
||||
import hashlib
|
||||
import json
|
||||
|
||||
BASE = 'forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a'
|
||||
CANDIDATE = 'forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23'
|
||||
|
||||
|
||||
def dependency_projection(configmap, pvc):
|
||||
if (configmap.get('kind') != 'ConfigMap' or configmap.get('immutable') is not True
|
||||
or configmap['metadata']['namespace'] != 'informed-decision'
|
||||
or configmap['metadata']['name'] != 'informed-decision-runtime-6c221878d051'
|
||||
or set(configmap.get('data', {})) != {'runtime.json'}
|
||||
or configmap.get('binaryData')):
|
||||
raise ValueError('unexpected immutable runtime config identity')
|
||||
if (pvc.get('kind') != 'PersistentVolumeClaim'
|
||||
or pvc['metadata']['namespace'] != 'informed-decision'
|
||||
or pvc['metadata']['name'] != 'informed-decision-data'
|
||||
or pvc.get('status', {}).get('phase') != 'Bound'
|
||||
or not pvc.get('spec', {}).get('volumeName')):
|
||||
raise ValueError('unexpected bound PVC custody')
|
||||
config = projection(configmap)
|
||||
config.pop('data')
|
||||
config['canonical_data_sha256'] = hashlib.sha256(json.dumps(
|
||||
configmap['data'], sort_keys=True, separators=(',', ':')).encode()).hexdigest()
|
||||
return {'configmap': config, 'pvc': projection(pvc), 'pvc_phase': 'Bound'}
|
||||
|
||||
|
||||
def check_dependencies(configmap, pvc, sealed):
|
||||
if dependency_projection(configmap, pvc) != sealed:
|
||||
raise ValueError('runtime config or PVC identity/custody changed')
|
||||
|
||||
|
||||
def projection(value):
|
||||
value = copy.deepcopy(value)
|
||||
value.pop('status', None)
|
||||
for key in ('resourceVersion', 'generation', 'creationTimestamp', 'managedFields'):
|
||||
value['metadata'].pop(key, None)
|
||||
for key in ('kubectl.kubernetes.io/last-applied-configuration', 'deployment.kubernetes.io/revision'):
|
||||
value['metadata'].get('annotations', {}).pop(key, None)
|
||||
return value
|
||||
|
||||
|
||||
def check_current(current, sealed):
|
||||
if projection(current) != sealed:
|
||||
raise ValueError('sealed live UID or configuration changed')
|
||||
|
||||
|
||||
def check_admitted(admitted, sealed):
|
||||
expected = copy.deepcopy(sealed)
|
||||
containers = expected['spec']['template']['spec']['containers']
|
||||
if len(containers) != 1 or containers[0]['name'] != 'informed-decision' or containers[0]['image'] != BASE:
|
||||
raise ValueError('unexpected baseline container identity')
|
||||
containers[0]['image'] = CANDIDATE
|
||||
if projection(admitted) != expected:
|
||||
raise ValueError('admission changed configuration beyond the sole image pin')
|
||||
|
||||
|
||||
def transport_result(exit_code, output):
|
||||
import json
|
||||
try:
|
||||
value = json.loads(output)
|
||||
except (ValueError, TypeError):
|
||||
return {'all_checks_pass': False, 'reason': 'invalid transport result'}
|
||||
if exit_code != 0 or not isinstance(value, dict) or value.get('all_checks_pass') is not True:
|
||||
return {'all_checks_pass': False, 'reason': 'read-only preflight refused'}
|
||||
return value
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
import copy,json,time
|
||||
from datetime import datetime,timezone
|
||||
from informed_decision.policy import PolicyClient,CONTRACT,submitted_digest
|
||||
pin='sha256:'+'b'*64
|
||||
req={'id':'image-purpose-fixture','tenant':'tenant:platform','subject':{'id':'synthetic','type':'service','tenant':'tenant:platform'},'resource':{'id':'memo:fixture','type':'memo','system':'informed-decision','tenant':'tenant:platform'},'action':'register','context':{}}
|
||||
class Transport:
|
||||
def request(self,*args,**kwargs):
|
||||
now=time.time(); stamp=lambda t:datetime.fromtimestamp(t,timezone.utc).isoformat()
|
||||
b={**copy.deepcopy({k:req[k] for k in ('tenant','subject','action','resource','context')}),'request_digest':'sha256:'+'e'*64,'submitted_request_digest':submitted_digest(req)}
|
||||
if self.purpose!='ABSENT':b['purpose']=self.purpose
|
||||
d={'id':'synthetic-decision','contract_version':CONTRACT,'request_id':req['id'],'effect':'allow','matched_policy_version':'v1','subject':req['subject'],'resource':req['resource'],'binding':b,'lifetime':{'kind':'ttl','not_before':stamp(now-1),'expires_at':stamp(now+60)},'provenance':{'policy_package':'fixture','policy_version':'v1','policy_package_digest':pin,'registry_snapshot_digest':'sha256:'+'c'*64,'evaluator':'flex-auth/fixture','decision_time':stamp(now)}}
|
||||
return 200,d
|
||||
checks=[]
|
||||
for purpose in ('ABSENT','','readback','enforcement','unknown',None,False,0,[],{}):
|
||||
t=Transport();t.purpose=purpose
|
||||
c=PolicyClient('https://fixture.invalid',lambda:'synthetic-only',package='fixture',version='v1',package_digest=pin,transport=t)
|
||||
o=c.check(req)
|
||||
if purpose in ('ABSENT',''):assert o.outcome=='allow';o.require_current(time.time())
|
||||
else:assert o.outcome=='invalid_decision' and o.decision_json is None
|
||||
checks.append(str(purpose))
|
||||
print(json.dumps({'installed_image_purpose_variants':len(checks),'binding_forms_allowed':2,'advisory_or_malformed_refused':8,'synthetic_only':True,'native_provider':False}))
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
# Requested decision
|
||||
|
||||
Approve the exact new T05 zlib-only image release and protected same-schema compatibility drill, after final independent Product and Platform acknowledgments. This packet is prepared and unapproved; its final committed source and rollback dry-run are still pending. The prior T04 approval is excluded.
|
||||
|
||||
The admitted owner CI published immutable image f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23 from source9b4bb25d325698ae543e7e8a8a3c3592db1f58fc. Its actual full scan reports zero findings across44packages. The same scan DB finds oneMEDIUM on currentimage763c. Signed official Alpine zlib1.3.2-r1 is the sole package change; actual published filesystem proof shows onlylibz andAPKinstalleddatabase changes, zero313directorymetadata changes, retainedninebaselayers and unchanged36applicationfiles/purposepolicy/config/credentials/audience/resources. Registry-to-daemon config serialization differs under closed verified normalization, without runtime change.
|
||||
|
||||
The exact ordered protected drill and release are specified in native-backup-restore-protocol.md and hash-bound execution bundle. New backup paths, isolated clone and journal are distinct from old evidence. Real private data will enter only approved private custody and the isolated no-network clone; content never enters public evidence. Failed/uncertain phase states remain durable and cannot be retried. Prior T04 failed copy/verify are preserved.
|
||||
|
||||
After schema5/integrity/exactclonecounts pass and clone cleanup succeeds, fresh cutover backup/copy precedes the exact manual image-only Deployment sync. Current baseline is healthygeneration25/image763c/Applicationc96. ImmutableCM6c/PVC/Podconfiguration/PDP origins remain sealed. FreshnodeCPU3460of4000m supports unchangedRecreate, with another check before effect. Brief availability interruption expected.
|
||||
|
||||
Rollback restores Deploymentimage763c andApplicationc96 while retaining latestschema5database; no old snapshot restoration. Separate installed/native health/custody/PDP-gated readback and actual native image rescan precede T05 closure. Allphase starts expireOct12 23:59:59Z; release reserves30minutesforverificationandrecovery. Afterexpiry a newfounderdecision is required. EUR0newrecurringinfrastructure, boundedprivate storage andunpricedattendedtime. No newdoctrine/autopilot/credentialgrant is authorized.
|
||||
|
|
@ -0,0 +1,354 @@
|
|||
"""One fixed supervised phase; never run this during source preparation."""
|
||||
import argparse
|
||||
import hashlib
|
||||
import json
|
||||
import os
|
||||
from pathlib import Path
|
||||
import re
|
||||
import selectors
|
||||
import stat
|
||||
import subprocess
|
||||
import sys
|
||||
import time
|
||||
|
||||
if sys.flags.optimize:
|
||||
raise SystemExit('optimized interpreter refused')
|
||||
|
||||
PHASES = ('drill-backup', 'drill-copy', 'offline-verify', 'cleanup-offline',
|
||||
'cutover-backup', 'cutover-copy', 'release', 'verify', 'rollback', 'rollback-verify')
|
||||
|
||||
|
||||
def require(value, reason):
|
||||
if not value:
|
||||
raise ValueError(reason)
|
||||
|
||||
|
||||
def sha(path):
|
||||
digest = hashlib.sha256()
|
||||
with Path(path).open('rb') as stream:
|
||||
for block in iter(lambda: stream.read(1024**2), b''):
|
||||
digest.update(block)
|
||||
return digest.hexdigest()
|
||||
|
||||
|
||||
def private(path, directory=False):
|
||||
info = Path(path).lstat()
|
||||
require((stat.S_ISDIR(info.st_mode) if directory else stat.S_ISREG(info.st_mode))
|
||||
and info.st_uid == os.getuid() and stat.S_IMODE(info.st_mode) == (0o700 if directory else 0o600)
|
||||
and (directory or info.st_nlink == 1), 'private owned custody required')
|
||||
|
||||
ROOT = Path(__file__).resolve().parent
|
||||
CASE = ROOT.parent
|
||||
OWNER = Path('/home/worsch/informed-decision')
|
||||
CUSTODIAN = Path('/home/worsch/the-custodian')
|
||||
CUSTODY = CUSTODIAN / '.private-backups/20261011-infd-zlib-r1'
|
||||
SOCKET = 'unix:///var/run/docker.sock'
|
||||
IMAGE = 'forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23'
|
||||
VOLUME = 'infd-zlib-r1-restore-20261011'
|
||||
MAX_BYTES = 512 * 1024**2
|
||||
|
||||
|
||||
def run(argv, body=None, timeout=90):
|
||||
return subprocess.run(argv, input=body, text=True, capture_output=True, timeout=timeout)
|
||||
|
||||
|
||||
def json_result(result):
|
||||
try:
|
||||
value = json.loads(result.stdout)
|
||||
except (ValueError, TypeError):
|
||||
raise ValueError('safe phase receipt unavailable; outcome uncertain') from None
|
||||
require(result.returncode == 0 and isinstance(value, dict) and value.get('all_checks_pass') is True,
|
||||
'phase did not verify complete; raw output withheld; no retry')
|
||||
permitted = {'phase', 'all_checks_pass', 'raw_output_withheld', 'native_approval_verified_by_root',
|
||||
'native_authenticated_grant', 'source_readonly_baseline', 'snapshot_readonly',
|
||||
'snapshot_sha256', 'snapshot_bytes', 'snapshot_file', 'native_parent_private',
|
||||
'native_uid', 'pod_name', 'pod_uid', 'live_readonly_schema_integrity_counts',
|
||||
'live_counts_may_include_concurrent_commits', 'operation_requested', 'source_revision',
|
||||
'resources', 'prune', 'rollout_verified', 'latest_live_database_retained',
|
||||
'client_diff_sha256', 'native_rollout_verified', 'current_schema5_database_retained',
|
||||
'private_copy_verified', 'installed_purpose_checks', 'policy_sha256',
|
||||
'policy_mode', 'policy_uid', 'installed_zlib_files', 'zlib_package', 'health_statuses', 'native_provider_probe', 'recovery_verification'}
|
||||
require(set(value) <= permitted, 'unexpected output fields withheld')
|
||||
from receipt_safety import counts
|
||||
for name in ('source_readonly_baseline', 'snapshot_readonly', 'live_readonly_schema_integrity_counts'):
|
||||
if name in value:
|
||||
counts(value[name])
|
||||
for name in ('snapshot_sha256', 'client_diff_sha256'):
|
||||
if name in value:
|
||||
require(re.fullmatch(r'[a-f0-9]{64}', value[name]) is not None, 'invalid output digest withheld')
|
||||
if 'snapshot_bytes' in value:
|
||||
require(type(value['snapshot_bytes']) is int and 0 < value['snapshot_bytes'] <= MAX_BYTES,
|
||||
'invalid output size withheld')
|
||||
if 'snapshot_file' in value:
|
||||
require(value['snapshot_file'] in ('drill.sqlite', 'cutover.sqlite'), 'invalid output file withheld')
|
||||
return value
|
||||
|
||||
|
||||
def docker(argv, body=None, timeout=120):
|
||||
return run(['docker', '--config', str(CUSTODY / 'empty-docker-config'), '--host', SOCKET] + argv,
|
||||
body=body, timeout=timeout)
|
||||
|
||||
|
||||
def remote(phase, revision, approved):
|
||||
# Fixed module imported only after main verifies every executor source hash.
|
||||
from native_program import PROGRAM
|
||||
payload = {'phase': phase, 'source_revision': revision, 'approval': approved,
|
||||
'sealed': json.loads((CASE / 'sealed-live-deployment.json').read_text()),
|
||||
'dependencies': json.loads((CASE / 'sealed-native-dependencies.json').read_text()),
|
||||
'candidate': json.loads((CASE / 'candidate-deployment.json').read_text()),
|
||||
'rollback': json.loads((CASE / 'rollback-deployment.json').read_text()),
|
||||
'receipt_safety': (ROOT / 'receipt_safety.py').read_text(),
|
||||
'purpose_checks': (CASE / 'check_installed.py').read_text(),
|
||||
'installed_zlib': json.loads((CASE / 'installed-zlib-proof.json').read_text()), 'readonly': (CASE / 'sqlite_readonly.py').read_text()}
|
||||
script = PROGRAM.replace('__PAYLOAD__', repr(json.dumps(payload))).replace(
|
||||
'__GUARD__', repr((CASE / 'change_guard.py').read_text()))
|
||||
return json_result(run(['ssh', 'railiance01', 'python3 -'], script, timeout=200))
|
||||
|
||||
|
||||
def copy_snapshot(phase, revision, approved, journal):
|
||||
metadata = remote(phase, revision, approved)
|
||||
backup_phase = 'drill-backup' if phase == 'drill-copy' else 'cutover-backup'
|
||||
prior = journal.data['phases'][backup_phase]['result']
|
||||
for key in ('snapshot_sha256', 'snapshot_bytes', 'snapshot_file', 'snapshot_readonly'):
|
||||
require(metadata[key] == prior[key], 'closed frozen snapshot changed')
|
||||
name = metadata['snapshot_file']
|
||||
require(name in ('drill.sqlite', 'cutover.sqlite') and 0 < metadata['snapshot_bytes'] <= MAX_BYTES,
|
||||
'fixed bounded snapshot required')
|
||||
pod = metadata['pod_name']
|
||||
require(re.fullmatch(r'[a-z0-9]([-a-z0-9]*[a-z0-9])?', pod) is not None, 'fixed owner pod name required')
|
||||
local = CUSTODY / name
|
||||
fd = os.open(local, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600)
|
||||
# Binary snapshot stdout goes only to a private file, never tool/chat/log output.
|
||||
# Snapshot schema/count metadata was validated before opening this destination.
|
||||
with os.fdopen(fd, 'wb') as destination:
|
||||
command = ('kubectl exec -n informed-decision ' + pod +
|
||||
' -c informed-decision -- cat /data/private/zlib85091-r1/' + name)
|
||||
transfer = subprocess.Popen(['ssh', 'railiance01', command], stdout=subprocess.PIPE,
|
||||
stderr=subprocess.DEVNULL)
|
||||
selector = selectors.DefaultSelector()
|
||||
selector.register(transfer.stdout, selectors.EVENT_READ)
|
||||
deadline = time.monotonic() + 150
|
||||
received = 0
|
||||
try:
|
||||
while True:
|
||||
remaining = deadline - time.monotonic()
|
||||
require(remaining > 0 and selector.select(remaining), 'private transfer timed out')
|
||||
block = os.read(transfer.stdout.fileno(), 1024**2)
|
||||
if not block:
|
||||
break
|
||||
received += len(block)
|
||||
require(received <= metadata['snapshot_bytes'] and received <= MAX_BYTES,
|
||||
'private copy exceeds frozen snapshot size')
|
||||
destination.write(block)
|
||||
transfer.wait(timeout=max(1, deadline - time.monotonic()))
|
||||
finally:
|
||||
selector.close()
|
||||
transfer.stdout.close()
|
||||
if transfer.poll() is None:
|
||||
transfer.kill()
|
||||
transfer.wait()
|
||||
destination.flush()
|
||||
os.fsync(destination.fileno())
|
||||
private(local)
|
||||
require(transfer.returncode == 0 and local.stat().st_size == metadata['snapshot_bytes']
|
||||
and sha(local) == metadata['snapshot_sha256'], 'private copy incomplete/uncertain; retain, no retry')
|
||||
# Re-read identity/hash after transfer. This is verification, not a write retry.
|
||||
after = remote(phase, revision, approved)
|
||||
require(after['pod_uid'] == metadata['pod_uid'] and after['snapshot_sha256'] == metadata['snapshot_sha256'],
|
||||
'source identity/snapshot changed during transfer')
|
||||
return {**metadata, 'off_cluster_private_copy_verified': True, 'snapshot_contents_output': False}
|
||||
|
||||
|
||||
def offline_verify(journal):
|
||||
from receipt_safety import counts
|
||||
snapshot = CUSTODY / 'drill.sqlite'
|
||||
private(snapshot)
|
||||
previous = journal.data['phases']['drill-copy']['result']
|
||||
require(sha(snapshot) == previous['snapshot_sha256'], 'protected snapshot bytes changed')
|
||||
identity = docker(['info', '--format', '{{json .Name}}'])
|
||||
require(identity.returncode == 0 and json.loads(identity.stdout) == 'bnt-lap001',
|
||||
'local offline Docker engine identity changed')
|
||||
listed = docker(['volume', 'ls', '--format', '{{.Name}}'])
|
||||
require(listed.returncode == 0 and VOLUME not in listed.stdout.splitlines(),
|
||||
'disposable volume absence not verified')
|
||||
nonce = journal.data['phases']['offline-verify']['attempt_id']
|
||||
labels = {'informed-decision.case': 'infd-zlib-20261011-r1',
|
||||
'informed-decision.use': 'offline-restore-only', 'informed-decision.attempt': nonce}
|
||||
created = docker(['volume', 'create', '--driver', 'local', '--label', 'informed-decision.case=infd-zlib-20261011-r1',
|
||||
'--label', 'informed-decision.attempt=' + nonce,
|
||||
'--label', 'informed-decision.use=offline-restore-only', VOLUME])
|
||||
require(created.returncode == 0 and created.stdout.strip() == VOLUME, 'volume creation uncertain; no retry')
|
||||
inspected = docker(['volume', 'inspect', VOLUME])
|
||||
require(inspected.returncode == 0, 'new volume identity unavailable')
|
||||
volume = json.loads(inspected.stdout)
|
||||
require(len(volume) == 1 and volume[0]['Name'] == VOLUME and volume[0].get('Labels') == labels
|
||||
and volume[0].get('Driver') == 'local' and not volume[0].get('Options')
|
||||
and volume[0].get('Scope') == 'local', 'new isolated volume identity changed')
|
||||
identity = {key: volume[0][key] for key in ('Name', 'Labels', 'Driver', 'Scope', 'CreatedAt')}
|
||||
journal.note('offline-verify', 'created_volume_identity', identity)
|
||||
# One-time UID0/CAP_CHOWN initialization is isolated to the NEW named volume.
|
||||
# No host/live PVC/config/token mount exists; this detail needs packet review.
|
||||
initializer = """import hashlib,os,stat,sys
|
||||
if sys.flags.optimize:raise RuntimeError('optimized interpreter refused')
|
||||
folder='/restore';expected=EXPECTED
|
||||
if os.listdir(folder):raise ValueError('new empty private volume required')
|
||||
os.chmod(folder,0o700)
|
||||
fd=os.open(folder+'/review.sqlite',os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW|os.O_WRONLY,0o600)
|
||||
digest=hashlib.sha256();size=0
|
||||
with os.fdopen(fd,'wb') as target:
|
||||
while True:
|
||||
block=sys.stdin.buffer.read(1024**2)
|
||||
if not block:break
|
||||
size+=len(block)
|
||||
if size>512*1024**2:raise ValueError('private restore size exceeds bound')
|
||||
target.write(block);digest.update(block)
|
||||
target.flush();os.fsync(target.fileno())
|
||||
if digest.hexdigest()!=expected:raise ValueError('private copied snapshot differs')
|
||||
os.chown(folder+'/review.sqlite',10001,10001);os.chown(folder,10001,10001)
|
||||
print('{"all_checks_pass":true,"private_copy_verified":true}')
|
||||
""".replace('EXPECTED', repr(previous['snapshot_sha256']))
|
||||
with snapshot.open('rb') as source:
|
||||
argv = ['docker', '--config', str(CUSTODY / 'empty-docker-config'), '--host', SOCKET,
|
||||
'run', '--rm', '-i', '--network', 'none', '--read-only', '--cpus', '1', '--memory', '128m',
|
||||
'--user', '0:0', '--cap-drop', 'ALL', '--cap-add', 'CHOWN',
|
||||
'--security-opt', 'no-new-privileges', '--mount', 'type=volume,src=' + VOLUME + ',dst=/restore',
|
||||
'--entrypoint', 'python', IMAGE, '-c', initializer]
|
||||
copied = subprocess.run(argv, stdin=source, text=True, capture_output=True, timeout=150)
|
||||
json_result(copied)
|
||||
options = ['run', '--rm', '-i', '--network', 'none', '--read-only', '--cpus', '1', '--memory', '128m',
|
||||
'--user', '10001:10001', '--cap-drop', 'ALL', '--security-opt', 'no-new-privileges',
|
||||
'--mount', 'type=volume,src=' + VOLUME + ',dst=/restore']
|
||||
readonly = docker(options + ['--entrypoint', 'python', IMAGE, '-', '--db', '/restore/review.sqlite'],
|
||||
(CASE / 'sqlite_readonly.py').read_text())
|
||||
require(readonly.returncode == 0, 'offline pre-open schema/integrity gate refused; never open Store')
|
||||
checked = counts(json.loads(readonly.stdout))
|
||||
require(checked == previous['snapshot_readonly'], 'frozen snapshot/clone readonly counts differ')
|
||||
admin = docker(options + ['--entrypoint', 'informed-decision-admin', IMAGE,
|
||||
'inspect', '--db', '/restore/review.sqlite'])
|
||||
require(admin.returncode == 0, 'offline admin result uncertain')
|
||||
admin_counts = json.loads(admin.stdout)
|
||||
require(admin_counts == {key: checked[key] for key in ('schema_version', 'lifecycle', 'outbox', 'submissions')},
|
||||
'offline admin changed frozen snapshot counters')
|
||||
# Admin Store construction must not silently alter schema/integrity/counters.
|
||||
post = docker(options + ['--entrypoint', 'python', IMAGE, '-', '--db', '/restore/review.sqlite'],
|
||||
(CASE / 'sqlite_readonly.py').read_text())
|
||||
require(post.returncode == 0, 'offline post-admin readonly integrity gate refused')
|
||||
post_checked = counts(json.loads(post.stdout))
|
||||
require(post_checked == checked == previous['snapshot_readonly'],
|
||||
'offline admin altered frozen snapshot proof')
|
||||
private(snapshot)
|
||||
require(sha(snapshot) == previous['snapshot_sha256'], 'original protected snapshot changed during drill')
|
||||
return {'all_checks_pass': True, 'offline_volume': VOLUME, 'offline_readonly': checked,
|
||||
'offline_post_admin_readonly': post_checked, 'original_snapshot_hash_unchanged': True,
|
||||
'created_volume_identity': identity,
|
||||
'admin_counts': admin_counts, 'network': 'none', 'runtime_tokens_or_config_mounted': False,
|
||||
'service_entrypoint_started': False, 'original_snapshot_retained': True}
|
||||
|
||||
|
||||
def cleanup_offline(journal):
|
||||
inspected = docker(['volume', 'inspect', VOLUME])
|
||||
require(inspected.returncode == 0, 'owned disposable volume identity unverified')
|
||||
value = json.loads(inspected.stdout)
|
||||
expected = journal.data['phases']['offline-verify']['result']['created_volume_identity']
|
||||
require(len(value) == 1 and {key: value[0].get(key) for key in expected} == expected
|
||||
and not value[0].get('Options'), 'volume ownership/recreation changed')
|
||||
removed = docker(['volume', 'rm', VOLUME])
|
||||
require(removed.returncode == 0 and removed.stdout.strip() == VOLUME
|
||||
and docker(['volume', 'inspect', VOLUME]).returncode != 0,
|
||||
'cleanup outcome ambiguous; do not retry')
|
||||
return {'all_checks_pass': True, 'only_disposable_offline_volume_removed': VOLUME,
|
||||
'native_and_offcluster_original_snapshots_retained': True}
|
||||
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser(description=__doc__)
|
||||
parser.add_argument('--phase', choices=PHASES, required=True)
|
||||
parser.add_argument('--root-authority-receipt', type=Path, required=True)
|
||||
parser.add_argument('--root-native-outcome', type=Path, required=True)
|
||||
parser.add_argument('--source-revision', required=True)
|
||||
args = parser.parse_args()
|
||||
require(args.root_authority_receipt == Path('/tmp/security-infd-zlib-root-authority.json')
|
||||
and args.root_native_outcome == Path('/tmp/security-infd-zlib-native-outcome-latest.json'),
|
||||
'fixed supervised receipt paths required')
|
||||
require(re.fullmatch(r'[0-9a-f]{40}', args.source_revision) is not None, 'exact source commit required')
|
||||
# Verify all prepared executor/input bytes before reading authority or dispatching.
|
||||
plan = json.loads((ROOT / 'execution-plan.json').read_text())
|
||||
require(plan.get('state') == 'prepared-reviewed' and plan.get('published_artifact_verified') is True, 'unfrozen proposal cannot execute')
|
||||
require(set(plan['executor_files']) == {'actuator.py', 'authority_journal.py', 'native_program.py', 'receipt_safety.py'},
|
||||
'fixed executor sources required')
|
||||
require(set(plan['owner_source_files']) == {'deploy/lifecycle/admission.candidate.json',
|
||||
'deploy/lifecycle/service.candidate.json',
|
||||
'deploy/lifecycle/kustomization.yaml',
|
||||
'deploy/lifecycle/registries.candidate.json'},
|
||||
'fixed owner image sources required')
|
||||
for relative, digest in plan['executor_files'].items():
|
||||
target = ROOT / relative
|
||||
require(not target.is_symlink() and sha(target) == digest, 'executor source bytes changed')
|
||||
for relative, digest in plan['case_files'].items():
|
||||
require(not Path(relative).is_absolute() and '..' not in Path(relative).parts,
|
||||
'case source path escaped')
|
||||
target = CASE / relative
|
||||
require(not target.is_symlink() and sha(target) == digest, 'case source bytes changed')
|
||||
for relative, digest in plan['owner_source_files'].items():
|
||||
target = OWNER / relative
|
||||
require(not target.is_symlink() and sha(target) == digest, 'owner image-only source changed')
|
||||
committed = subprocess.run(['git', '-C', str(OWNER), 'show', args.source_revision + ':' + relative],
|
||||
capture_output=True)
|
||||
require(committed.returncode == 0 and hashlib.sha256(committed.stdout).hexdigest() == digest,
|
||||
'committed owner render source differs from approved inputs')
|
||||
head = run(['git', '-C', str(OWNER), 'rev-parse', 'HEAD'])
|
||||
require(head.returncode == 0 and head.stdout.strip() == args.source_revision, 'owner source HEAD differs')
|
||||
from authority_journal import Journal, authority
|
||||
private(args.root_authority_receipt)
|
||||
private(args.root_native_outcome)
|
||||
receipt = json.loads(args.root_authority_receipt.read_text())
|
||||
require(receipt.get('native_outcome_sha256') == sha(args.root_native_outcome), 'native outcome bytes changed')
|
||||
require(receipt.get('executor_plan_sha256') == sha(ROOT / 'execution-plan.json'),
|
||||
'root verified executor plan differs')
|
||||
approved = authority(receipt, json.loads(args.root_native_outcome.read_text()), sha(CASE / 'memo.json'),
|
||||
args.source_revision, args.phase)
|
||||
parent = CUSTODY.parent
|
||||
private(parent, directory=True)
|
||||
ignored = run(['git', '-C', str(CUSTODIAN), 'check-ignore', '--no-index', str(CUSTODY / 'drill.sqlite')])
|
||||
require(ignored.returncode == 0, 'offcluster custody is not ignored')
|
||||
if not CUSTODY.exists():
|
||||
require(args.phase == 'drill-backup', 'first approved phase must create unique private custody')
|
||||
os.mkdir(CUSTODY, 0o700)
|
||||
private(CUSTODY, directory=True)
|
||||
capacity = os.statvfs(CUSTODY)
|
||||
require(capacity.f_bavail * capacity.f_frsize >= 2 * MAX_BYTES + 16 * 1024**2,
|
||||
'independent protected custody headroom insufficient')
|
||||
os.makedirs(CUSTODY / 'empty-docker-config', mode=0o700, exist_ok=True)
|
||||
private(CUSTODY / 'empty-docker-config', directory=True)
|
||||
require(not list((CUSTODY / 'empty-docker-config').iterdir()), 'public Docker read config must stay empty')
|
||||
journal = Journal(CUSTODY, {'proposal': plan['proposal_id'], 'source_revision': args.source_revision,
|
||||
'memo_sha256': sha(CASE / 'memo.json'), 'plan_sha256': sha(ROOT / 'execution-plan.json')})
|
||||
try:
|
||||
journal.start(args.phase, approved) # fsynced RUNNING before any phase effect.
|
||||
if args.phase in ('drill-copy', 'cutover-copy'):
|
||||
result = copy_snapshot(args.phase, args.source_revision, approved, journal)
|
||||
elif args.phase == 'offline-verify':
|
||||
result = offline_verify(journal)
|
||||
elif args.phase == 'cleanup-offline':
|
||||
result = cleanup_offline(journal)
|
||||
else:
|
||||
result = remote(args.phase, args.source_revision, approved, operation_intent=journal.data['phases'].get('rollback' if args.phase == 'rollback-verify' else 'release') if args.phase in ('verify', 'rollback-verify') else None)
|
||||
journal.finish(args.phase, result)
|
||||
print(json.dumps(result)) # Only count/hash/identity receipts, never snapshot bytes.
|
||||
except BaseException as error:
|
||||
safe = {'all_checks_pass': False, 'phase': args.phase, 'failure_class': type(error).__name__,
|
||||
'failure': 'fixed phase outcome uncertain; original evidence retained; no retry',
|
||||
'raw_output_withheld': True}
|
||||
if journal.data['phases'].get(args.phase, {}).get('state') == 'RUNNING':
|
||||
journal.finish(args.phase, safe)
|
||||
print(json.dumps(safe))
|
||||
raise SystemExit(1) from None
|
||||
finally:
|
||||
journal.close()
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
try:
|
||||
main()
|
||||
except Exception:
|
||||
raise SystemExit('supervised execution refused before phase; raw output withheld') from None
|
||||
|
|
@ -0,0 +1,150 @@
|
|||
"""Supervised receipt bookkeeping, not an authenticated approval provider."""
|
||||
import datetime
|
||||
import fcntl
|
||||
import hashlib
|
||||
import json
|
||||
import os
|
||||
import re
|
||||
from pathlib import Path
|
||||
import stat
|
||||
import uuid
|
||||
|
||||
FOUNDER = {'kind': 'person', 'sub': 'uid=platform-root,ou=people,dc=netkingdom,dc=local'}
|
||||
MEMO_ID = 'infd-20261011-zlib-remediation-r1'
|
||||
PROPOSAL = 'INFD-WP-0009-T05/zlib85091-r1'
|
||||
PHASES = ('drill-backup', 'drill-copy', 'offline-verify', 'cleanup-offline',
|
||||
'cutover-backup', 'cutover-copy', 'release', 'verify', 'rollback', 'rollback-verify')
|
||||
|
||||
|
||||
def require(value, reason):
|
||||
if not value:
|
||||
raise ValueError(reason)
|
||||
|
||||
|
||||
def sha(path):
|
||||
digest = hashlib.sha256()
|
||||
with Path(path).open('rb') as stream:
|
||||
for block in iter(lambda: stream.read(1024**2), b''):
|
||||
digest.update(block)
|
||||
return digest.hexdigest()
|
||||
|
||||
|
||||
def private(path, directory=False):
|
||||
info = Path(path).lstat()
|
||||
require((stat.S_ISDIR(info.st_mode) if directory else stat.S_ISREG(info.st_mode))
|
||||
and info.st_uid == os.getuid() and stat.S_IMODE(info.st_mode) == (0o700 if directory else 0o600)
|
||||
and (directory or info.st_nlink == 1), 'private owned custody required')
|
||||
|
||||
|
||||
def authority(receipt, outcome, memo_sha, source_revision, phase, now=None):
|
||||
"""Root must freshly verify native outcome at fixed ORIGIN outside this helper.
|
||||
|
||||
Receipt files/flags are not signed grants. This function checks the exact
|
||||
supervised receipt relation; existing harness/founder authority remains the
|
||||
actual permission boundary. It never authenticates a caller as human.
|
||||
"""
|
||||
now = now or datetime.datetime.now(datetime.timezone.utc)
|
||||
require(phase in PHASES, 'fixed phase required')
|
||||
require(receipt.get('proposal_id') == PROPOSAL and receipt.get('memo_id') == MEMO_ID
|
||||
and receipt.get('memo_version') == 1 and receipt.get('memo_sha256') == memo_sha
|
||||
and receipt.get('source_revision') == source_revision
|
||||
and receipt.get('activation') == 'APPROVED'
|
||||
and receipt.get('authority_mode') == 'ADMINISTER'
|
||||
and receipt.get('target') == 'realm:kubernetes/railiance01/informed-decision'
|
||||
and receipt.get('verification_method') == 'root-fixed-origin-native-readback'
|
||||
and receipt.get('runtime_authenticated_grant') is False
|
||||
and receipt.get('outcome_query') == '/lifecycle/memos/' + MEMO_ID + '/outcomes?version=1',
|
||||
'exact externally verified supervised receipt required')
|
||||
verified = datetime.datetime.fromisoformat(receipt['verified_at'].replace('Z', '+00:00'))
|
||||
require(verified.tzinfo is not None and 0 <= (now - verified).total_seconds() <= 120,
|
||||
'fresh root native readback required before every phase')
|
||||
deadline = datetime.datetime.fromisoformat('2026-10-12T23:59:59+00:00')
|
||||
require(now < deadline, 'approved execution window expired')
|
||||
if phase == 'release':
|
||||
require((deadline-now).total_seconds() >= 1800, 'reserve thirty minutes for verification and recovery')
|
||||
require(outcome.get('memo_id') == MEMO_ID and outcome.get('review', {}).get('stale') is False
|
||||
and outcome['review'].get('intake_state') == 'ready', 'native review is not ready/current')
|
||||
review_id = outcome['review']['memo_id']
|
||||
require(review_id == receipt.get('review_memo_id'), 'native review identity changed')
|
||||
accepted = [x for x in outcome.get('dispositions', [])
|
||||
if x.get('submission_state') == 'confirmed'
|
||||
and x.get('disposition', {}).get('verb') == 'accept'
|
||||
and x['disposition'].get('memo_version') == 1]
|
||||
require(len(accepted) == 1, 'one confirmed founder acceptance required')
|
||||
accepted = accepted[0]['disposition']
|
||||
require(accepted.get('actor') == FOUNDER and accepted.get('memo_id') == review_id
|
||||
and accepted.get('approval_id') == receipt.get('approval_id')
|
||||
and accepted.get('id') == receipt.get('disposition_id')
|
||||
and accepted.get('at') == receipt.get('accepted_at'), 'exact founder disposition mismatch')
|
||||
require(re.fullmatch(r'[a-f0-9-]{36}', accepted['approval_id']) is not None
|
||||
and re.fullmatch(r'disp-[a-f0-9-]{36}', accepted['id']) is not None
|
||||
and re.fullmatch(r'review-[a-f0-9-]{36}', review_id) is not None,
|
||||
'native disposition identifiers are malformed')
|
||||
accepted_at = datetime.datetime.fromisoformat(accepted['at'].replace('Z', '+00:00'))
|
||||
require(accepted_at.tzinfo is not None and accepted_at <= verified, 'acceptance time not bounded')
|
||||
return {key: receipt[key] for key in ('approval_id', 'disposition_id', 'accepted_at', 'verified_at')}
|
||||
|
||||
|
||||
class Journal:
|
||||
def __init__(self, parent, identity):
|
||||
self.parent = Path(parent)
|
||||
private(self.parent, directory=True)
|
||||
self.path = self.parent / 'execution-journal.json'
|
||||
self.lock = os.open(self.parent / 'execution.lock', os.O_CREAT | os.O_NOFOLLOW | os.O_RDWR, 0o600)
|
||||
fcntl.flock(self.lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
|
||||
private(self.parent / 'execution.lock')
|
||||
if self.path.exists():
|
||||
private(self.path)
|
||||
self.data = json.loads(self.path.read_text())
|
||||
require(self.data['identity'] == identity, 'journal case/source identity changed')
|
||||
else:
|
||||
self.data = {'identity': identity, 'phases': {}}
|
||||
self.save()
|
||||
|
||||
def save(self):
|
||||
temporary = self.parent / 'execution-journal.new'
|
||||
fd = os.open(temporary, os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW | os.O_WRONLY, 0o600)
|
||||
try:
|
||||
with os.fdopen(fd, 'w') as stream:
|
||||
json.dump(self.data, stream, indent=2)
|
||||
stream.write('\n')
|
||||
stream.flush()
|
||||
os.fsync(stream.fileno())
|
||||
os.replace(temporary, self.path)
|
||||
directory = os.open(self.parent, os.O_DIRECTORY | os.O_RDONLY)
|
||||
try:
|
||||
os.fsync(directory)
|
||||
finally:
|
||||
os.close(directory)
|
||||
except BaseException:
|
||||
# Retain evidence rather than overwriting an uncertain durable intent.
|
||||
raise
|
||||
|
||||
def start(self, phase, approval):
|
||||
require(phase not in self.data['phases'], 'already attempted phase; no retry')
|
||||
predecessors = dict(zip(PHASES[1:8], PHASES[:7]))
|
||||
predecessors['rollback-verify'] = 'rollback'
|
||||
if phase in predecessors:
|
||||
require(self.data['phases'].get(predecessors[phase], {}).get('state') == 'COMPLETE',
|
||||
'preceding phase is not verified complete')
|
||||
if phase == 'rollback':
|
||||
require('release' in self.data['phases'], 'rollback requires a recorded release attempt')
|
||||
self.data['phases'][phase] = {'state': 'RUNNING', 'approval': approval,
|
||||
'attempt_id': str(uuid.uuid4()),
|
||||
'started_at': datetime.datetime.now(datetime.timezone.utc).isoformat()}
|
||||
self.save()
|
||||
|
||||
def note(self, phase, key, value):
|
||||
require(self.data['phases'][phase]['state'] == 'RUNNING', 'phase intent missing')
|
||||
self.data['phases'][phase][key] = value
|
||||
self.save()
|
||||
|
||||
def finish(self, phase, result):
|
||||
entry = self.data['phases'][phase]
|
||||
require(entry['state'] == 'RUNNING', 'phase intent missing')
|
||||
entry['result'] = result
|
||||
entry['state'] = 'COMPLETE' if result.get('all_checks_pass') is True else 'UNCERTAIN'
|
||||
self.save()
|
||||
|
||||
def close(self):
|
||||
os.close(self.lock)
|
||||
|
|
@ -0,0 +1,59 @@
|
|||
{
|
||||
"kind": "informed-decision.supervised-mechanical-release-plan",
|
||||
"version": 1,
|
||||
"proposal_id": "INFD-WP-0009-T05/zlib85091-r1",
|
||||
"trial_id": "infd-zlib-20261011-r1",
|
||||
"state": "prepared-awaiting-independent-owner-acknowledgments",
|
||||
"executor_files": {
|
||||
"actuator.py": "741b490bdb315896f05f2e91404c02765517dc1beea81fa590017fccafd299b4",
|
||||
"authority_journal.py": "040144321c69622c223a8437832a3c5a4a9595fc37774fde5ff0ad676828ebf0",
|
||||
"native_program.py": "fcf8fc3593910b2e99dd51d159a30aa9b853c40ff00c566a620d20eaadc8af20",
|
||||
"receipt_safety.py": "5c54373f2dc4b064008225c186efb1d5afdeec36d15350bda0a12ded97602d1b"
|
||||
},
|
||||
"case_files": {
|
||||
"scan-receipt.json": "aaaa91061bb036e6d228b1c1bd4333578dc948cb2bb5ac8ba269429121e7321a",
|
||||
"source-commit-proof.json": "b0811da2d3bd5938733f0078e5fec8e19a6d9752c4277b80bfe9837ed72c6a3b",
|
||||
"candidate-deployment.json": "487f834cc86dcbc7a04c2392bde072ecaf87dc116b4baa16c35eb9c599ad5c95",
|
||||
"artifact-comparison.json": "a1c5d9e249dc00600449998360faf6e8da0206b568c76d155602c4645fa5fce4",
|
||||
"rollback-deployment.json": "f8a9a07abc2eb52cdf6bcdba2d9f79dec073145c31d0444a9e0fe1147e42cc4e",
|
||||
"sqlite_readonly.py": "9093c64f7f0e39b249da9fefdf5aaf4e4258bc31e7a27fd888479ce329a20509",
|
||||
"published-verification.json": "dd4eecf0c103dca7922094a8beeb99b77ae96fd1d5fe532e37bd833daa02614e",
|
||||
"sealed-native-dependencies.json": "042327a036ed254cf95dbeb0c056ac25b03a6a844b95a332c992df2943691369",
|
||||
"sealed-live-deployment.json": "f8a9a07abc2eb52cdf6bcdba2d9f79dec073145c31d0444a9e0fe1147e42cc4e",
|
||||
"native-preflight.json": "56637994dfdae46a6f9ab442c2ff9b259212650b35eb98d896c5e837f01ce2f9",
|
||||
"installed-zlib-proof.json": "6af62f86f50ac185fab94163c24ac8150ead69e62f8d825b0dce1e75a5a57b68",
|
||||
"runtime-receipt.json": "6442676dcfd941f0a05a4cb79a02dea839fcd332d82b2154c15cf6db68de5889",
|
||||
"change_guard.py": "b3ee2b89de14e204efedd016d3900b6e31fcc9f0ea0f3125d3a4794d938ca201",
|
||||
"check_installed.py": "a34a51be9c9f2b16a06a88173b5c6c492c9957fe021cf412a86a1737730640ad",
|
||||
"candidate-runtime.json": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124"
|
||||
},
|
||||
"owner_source_files": {
|
||||
"deploy/lifecycle/admission.candidate.json": "6c76cedd0abc4a4261cfcb69c6597611c282bd4fed8b6aaf77aff04fdf942529",
|
||||
"deploy/lifecycle/service.candidate.json": "383332cd4fd27a8b36e63a4d79addc43eb68615f742328d4577bfc2b467e2278",
|
||||
"deploy/lifecycle/kustomization.yaml": "1bbce81bc6758434354157f8601534320c5d0290587908fd15a6d25e3fa57f47",
|
||||
"deploy/lifecycle/registries.candidate.json": "9bad6db5fbc2178d31b04120016a41830c3552fbb9e2517b718f9bbe87cf649e"
|
||||
},
|
||||
"candidate_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"prior_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"source_revision": "must-be-exact-final-owner-HEAD-with-approved-four-Git-blobs",
|
||||
"phases": [
|
||||
"drill-backup",
|
||||
"drill-copy",
|
||||
"offline-verify",
|
||||
"cleanup-offline",
|
||||
"cutover-backup",
|
||||
"cutover-copy",
|
||||
"release",
|
||||
"verify",
|
||||
"rollback",
|
||||
"rollback-verify"
|
||||
],
|
||||
"authorization": "fresh externally authenticated root fixed-origin native readback before each phase; exact confirmed platform-root disposition and current packet SHA/source commit; receipt bookkeeping is not an autonomous signed grant",
|
||||
"execute_by": "2026-10-12T23:59:59Z",
|
||||
"raw_output_withheld": true,
|
||||
"native_data_or_workload_action_executed": false,
|
||||
"deadline_semantics": "All phases including verification/recovery must begin before execute_by. No extension or automatic emergency grant; beyond deadline stop and obtain a fresh founder decision. Complete the bounded drill and rollout early enough to allow recovery within the window.",
|
||||
"source_memo_version": 1,
|
||||
"native_review_memo_version": 1,
|
||||
"published_artifact_verified": true
|
||||
}
|
||||
File diff suppressed because one or more lines are too long
|
|
@ -0,0 +1,15 @@
|
|||
"""Only structural count/hash receipts can leave the private execution phase."""
|
||||
def counts(value):
|
||||
if (set(value) != {'schema_version', 'lifecycle', 'outbox', 'submissions', 'integrity',
|
||||
'read_only_pre_open', 'store_constructed'}
|
||||
or value['schema_version'] != 5 or value['integrity'] != 'ok'
|
||||
or value['read_only_pre_open'] is not True or value['store_constructed'] is not False
|
||||
or set(value['lifecycle']) != {'records', 'events', 'pending'}
|
||||
or not set(value['outbox']) <= {'pending', 'delivered', 'blocked'}
|
||||
or not set(value['submissions']) <= {'prepared', 'in_flight', 'confirmed', 'unresolved'}):
|
||||
raise ValueError('count-only receipt shape/state refused; values withheld')
|
||||
for group in ('lifecycle', 'outbox', 'submissions'):
|
||||
if any(type(number) is not int or number < 0 or number > 10**12
|
||||
for number in value[group].values()):
|
||||
raise ValueError('count-only receipt values refused')
|
||||
return value
|
||||
|
|
@ -0,0 +1,393 @@
|
|||
"""Synthetic custody/transport tests. No native data, Docker or cluster action."""
|
||||
import copy
|
||||
import datetime
|
||||
import io
|
||||
import json
|
||||
import os
|
||||
from pathlib import Path
|
||||
import subprocess
|
||||
import sys
|
||||
import tempfile
|
||||
import unittest
|
||||
from unittest.mock import patch
|
||||
from contextlib import redirect_stdout
|
||||
|
||||
import actuator
|
||||
from authority_journal import Journal, authority
|
||||
from native_program import PROGRAM
|
||||
from receipt_safety import counts
|
||||
|
||||
CASE = Path(__file__).resolve().parent.parent
|
||||
NOW = datetime.datetime(2026, 10, 11, 2, 0, tzinfo=datetime.timezone.utc)
|
||||
REVISION = 'e' * 40
|
||||
COUNT = {'schema_version': 5, 'integrity': 'ok', 'read_only_pre_open': True, 'store_constructed': False,
|
||||
'lifecycle': {'records': 3, 'events': 8, 'pending': 1},
|
||||
'outbox': {'pending': 2, 'delivered': 10}, 'submissions': {'confirmed': 1, 'unresolved': 1}}
|
||||
|
||||
|
||||
def accepted():
|
||||
approval = '11111111-1111-4111-8111-111111111111'
|
||||
review = 'review-22222222-2222-4222-8222-222222222222'
|
||||
disposition = 'disp-33333333-3333-4333-8333-333333333333'
|
||||
receipt = {'proposal_id': 'INFD-WP-0009-T05/zlib85091-r1',
|
||||
'memo_id': 'infd-20261011-zlib-remediation-r1', 'memo_version': 1,
|
||||
'memo_sha256': 'a' * 64, 'source_revision': REVISION, 'activation': 'APPROVED',
|
||||
'authority_mode': 'ADMINISTER', 'target': 'realm:kubernetes/railiance01/informed-decision',
|
||||
'verification_method': 'root-fixed-origin-native-readback', 'runtime_authenticated_grant': False, 'outcome_query': '/lifecycle/memos/infd-20261011-zlib-remediation-r1/outcomes?version=1',
|
||||
'verified_at': '2026-10-11T02:00:00Z', 'accepted_at': '2026-10-11T01:59:00Z',
|
||||
'review_memo_id': review, 'approval_id': approval, 'disposition_id': disposition}
|
||||
outcome = {'memo_id': receipt['memo_id'], 'review': {'memo_id': review, 'stale': False, 'intake_state': 'ready'},
|
||||
'dispositions': [{'approval_id': None, 'submission_state': 'confirmed',
|
||||
'disposition': {'verb': 'accept', 'memo_version': 1, 'memo_id': review,
|
||||
'approval_id': approval, 'id': disposition,
|
||||
'actor': {'kind': 'person', 'sub': 'uid=platform-root,ou=people,dc=netkingdom,dc=local'},
|
||||
'at': receipt['accepted_at']}}]}
|
||||
return receipt, outcome
|
||||
|
||||
|
||||
class AuthorityAndCustody(unittest.TestCase):
|
||||
def test_exact_nested_founder_receipt_not_top_level_approval(self):
|
||||
receipt, outcome = accepted()
|
||||
result = authority(receipt, outcome, 'a' * 64, REVISION, 'drill-copy', NOW)
|
||||
self.assertEqual(result['approval_id'], receipt['approval_id'])
|
||||
|
||||
def test_pending_stale_wrong_actor_version_and_binding_refuse(self):
|
||||
mutations = [lambda r, o: r.update(activation='PENDING'),
|
||||
lambda r, o: r.update(memo_sha256='changed'),
|
||||
lambda r, o: r.update(source_revision='changed'),
|
||||
lambda r, o: r.update(target='other'),
|
||||
lambda r, o: r.update(verified_at='2026-10-11T01:00:00Z'),
|
||||
lambda r, o: r.update(verification_method='caller-asserted'),
|
||||
lambda r, o: r.update(runtime_authenticated_grant=True),
|
||||
lambda r, o: o['review'].update(stale=True),
|
||||
lambda r, o: o['review'].update(intake_state='pending'),
|
||||
lambda r, o: o['dispositions'][0].update(submission_state='unresolved'),
|
||||
lambda r, o: o['dispositions'][0]['disposition'].update(memo_version=3),
|
||||
lambda r, o: o['dispositions'][0]['disposition'].update(actor={'kind': 'agent', 'sub': 'platform-root'}),
|
||||
lambda r, o: o['dispositions'].append(copy.deepcopy(o['dispositions'][0]))]
|
||||
for mutate in mutations:
|
||||
with self.subTest(mutate=mutate):
|
||||
r, o = accepted()
|
||||
mutate(r, o)
|
||||
with self.assertRaises(ValueError):
|
||||
authority(r, o, 'a' * 64, REVISION, 'release', NOW)
|
||||
|
||||
def test_expired_window_and_unknown_phase_refuse(self):
|
||||
r, o = accepted()
|
||||
with self.assertRaises(ValueError):
|
||||
authority(r, o, 'a' * 64, REVISION, 'arbitrary', NOW)
|
||||
late = datetime.datetime(2026, 10, 13, tzinfo=datetime.timezone.utc)
|
||||
r['verified_at'] = late.isoformat()
|
||||
with self.assertRaises(ValueError):
|
||||
authority(r, o, 'a' * 64, REVISION, 'rollback', late)
|
||||
|
||||
def test_durable_intent_precedes_dispatch_and_never_retries(self):
|
||||
with tempfile.TemporaryDirectory() as directory:
|
||||
parent = Path(directory)
|
||||
os.chmod(parent, 0o700)
|
||||
journal = Journal(parent, {'case': 'fixture'})
|
||||
journal.start('drill-backup', {'approval_id': 'fixture'})
|
||||
self.assertEqual(json.loads(journal.path.read_text())['phases']['drill-backup']['state'], 'RUNNING')
|
||||
journal.close() # simulated crash before result
|
||||
recovered = Journal(parent, {'case': 'fixture'})
|
||||
with self.assertRaises(ValueError):
|
||||
recovered.start('drill-backup', {})
|
||||
with self.assertRaises(ValueError):
|
||||
recovered.start('drill-backup', {})
|
||||
recovered.close()
|
||||
|
||||
def test_phase_order_and_uncertain_release_allows_only_distinct_recovery(self):
|
||||
with tempfile.TemporaryDirectory() as directory:
|
||||
os.chmod(directory, 0o700)
|
||||
j = Journal(directory, {'case': 'fixture'})
|
||||
with self.assertRaises(ValueError):
|
||||
j.start('release', {})
|
||||
for phase in actuator.PHASES[:6]:
|
||||
j.start(phase, {})
|
||||
j.finish(phase, {'all_checks_pass': True})
|
||||
j.start('release', {})
|
||||
j.finish('release', {'all_checks_pass': False})
|
||||
with self.assertRaises(ValueError):
|
||||
j.start('release', {})
|
||||
with self.assertRaises(ValueError):
|
||||
j.start('verify', {})
|
||||
j.start('rollback', {})
|
||||
j.finish('rollback', {'all_checks_pass': True})
|
||||
j.close()
|
||||
|
||||
def test_secret_or_unknown_child_output_is_withheld(self):
|
||||
for body in ('not-json', '{"all_checks_pass":true,"token":"private-value"}',
|
||||
'{"all_checks_pass":true,"snapshot_readonly":{"schema_version":5}}'):
|
||||
with self.assertRaises(ValueError):
|
||||
actuator.json_result(subprocess.CompletedProcess([], 0, body, ''))
|
||||
wrong = copy.deepcopy(COUNT)
|
||||
wrong['outbox'] = {'private-row-value': 1}
|
||||
with self.assertRaises(ValueError):
|
||||
counts(wrong)
|
||||
counts(COUNT) # blocked/unresolved counts are not required to be zero.
|
||||
|
||||
def test_binary_copy_is_bounded_private_and_never_echoed(self):
|
||||
blob = b'synthetic private fixture bytes'
|
||||
digest = __import__('hashlib').sha256(blob).hexdigest()
|
||||
metadata = {'all_checks_pass': True, 'snapshot_file': 'drill.sqlite', 'snapshot_bytes': len(blob),
|
||||
'snapshot_sha256': digest, 'snapshot_readonly': COUNT,
|
||||
'pod_name': 'fixture-pod', 'pod_uid': 'fixture-uid'}
|
||||
journal = type('FixtureJournal', (), {'data': {'phases': {'drill-backup': {'result': metadata}}}})()
|
||||
real_popen = subprocess.Popen
|
||||
for extra in (b'', b'oversized'):
|
||||
with self.subTest(extra=extra), tempfile.TemporaryDirectory() as folder:
|
||||
os.chmod(folder, 0o700)
|
||||
output = io.StringIO()
|
||||
|
||||
def child(*args, **kwargs):
|
||||
return real_popen([sys.executable, '-c', 'import sys;sys.stdout.buffer.write(' + repr(blob + extra) + ')'],
|
||||
stdout=subprocess.PIPE, stderr=subprocess.DEVNULL)
|
||||
|
||||
with patch.object(actuator, 'CUSTODY', Path(folder)), patch.object(actuator, 'remote', return_value=metadata), \
|
||||
patch('subprocess.Popen', side_effect=child), redirect_stdout(output):
|
||||
if extra:
|
||||
with self.assertRaises(ValueError):
|
||||
actuator.copy_snapshot('drill-copy', REVISION, {}, journal)
|
||||
else:
|
||||
result = actuator.copy_snapshot('drill-copy', REVISION, {}, journal)
|
||||
self.assertTrue(result['off_cluster_private_copy_verified'])
|
||||
self.assertEqual((Path(folder) / 'drill.sqlite').read_bytes(), blob)
|
||||
self.assertEqual(output.getvalue(), '')
|
||||
self.assertEqual((Path(folder) / 'drill.sqlite').stat().st_mode & 0o777, 0o600)
|
||||
|
||||
def test_recreated_offline_volume_cannot_be_deleted(self):
|
||||
identity = {'Name': actuator.VOLUME, 'Labels': {'nonce': 'old'}, 'CreatedAt': 'old'}
|
||||
journal = type('FixtureJournal', (), {'data': {'phases': {
|
||||
'offline-verify': {'result': {'created_volume_identity': identity}}}}})()
|
||||
inspected = [{**identity, 'CreatedAt': 'recreated'}]
|
||||
with patch.object(actuator, 'docker', return_value=subprocess.CompletedProcess([], 0, json.dumps(inspected), '')) as mocked:
|
||||
with self.assertRaises(ValueError):
|
||||
actuator.cleanup_offline(journal)
|
||||
self.assertEqual(mocked.call_count, 1)
|
||||
|
||||
def test_offline_post_admin_integrity_and_original_hash_are_rechecked(self):
|
||||
for defect in ('none', 'post-integrity', 'original-hash'):
|
||||
with self.subTest(defect=defect), tempfile.TemporaryDirectory() as directory:
|
||||
folder=Path(directory);os.chmod(folder,0o700)
|
||||
snapshot=folder/'drill.sqlite';snapshot.write_bytes(b'private synthetic snapshot');os.chmod(snapshot,0o600)
|
||||
digest=actuator.sha(snapshot)
|
||||
prior={'snapshot_sha256':digest,'snapshot_readonly':COUNT}
|
||||
journal=type('FixtureJournal',(),{'data':{'phases':{'drill-copy':{'result':prior},'offline-verify':{'attempt_id':'nonce'}}},'note':lambda *args:None})()
|
||||
reads=[]
|
||||
volume={'Name':actuator.VOLUME,'Labels':{'informed-decision.case':'infd-zlib-20261011-r1','informed-decision.use':'offline-restore-only','informed-decision.attempt':'nonce'},'Driver':'local','Scope':'local','CreatedAt':'fixture','Options':None}
|
||||
def docker(argv, body=None, **kwargs):
|
||||
if argv[0]=='info':body=json.dumps('bnt-lap001')
|
||||
elif argv[:2]==['volume','ls']:body=''
|
||||
elif argv[:2]==['volume','create']:body=actuator.VOLUME
|
||||
elif argv[:2]==['volume','inspect']:body=json.dumps([volume])
|
||||
elif 'informed-decision-admin' in argv:
|
||||
body=json.dumps({key:COUNT[key] for key in ('schema_version','lifecycle','outbox','submissions')})
|
||||
if defect=='original-hash':snapshot.write_bytes(b'changed synthetic original')
|
||||
elif '--entrypoint' in argv and 'python' in argv:
|
||||
reads.append(argv);proof=copy.deepcopy(COUNT)
|
||||
if len(reads)==2 and defect=='post-integrity':proof['integrity']='corrupt'
|
||||
body=json.dumps(proof)
|
||||
else:raise AssertionError('unexpected offline command')
|
||||
return subprocess.CompletedProcess(argv,0,body,'')
|
||||
with patch.object(actuator,'CUSTODY',folder),patch.object(actuator,'CASE',CASE),patch.object(actuator,'docker',side_effect=docker),patch('subprocess.run',return_value=subprocess.CompletedProcess([],0,'{"all_checks_pass":true,"private_copy_verified":true}','')):
|
||||
if defect=='none':
|
||||
result=actuator.offline_verify(journal)
|
||||
self.assertEqual(result['offline_post_admin_readonly'],COUNT)
|
||||
self.assertTrue(result['original_snapshot_hash_unchanged'])
|
||||
else:
|
||||
with self.assertRaises(ValueError):actuator.offline_verify(journal)
|
||||
self.assertEqual(len(reads),2)
|
||||
|
||||
|
||||
class FixedNativeProgram(unittest.TestCase):
|
||||
def fixture(self):
|
||||
sealed = json.loads((CASE / 'sealed-live-deployment.json').read_text())
|
||||
live = copy.deepcopy(sealed)
|
||||
live['metadata'].update(generation=42)
|
||||
live['status'] = {'readyReplicas': 1, 'updatedReplicas': 1, 'observedGeneration': 42}
|
||||
dependencies = json.loads((CASE / 'sealed-native-dependencies.json').read_text())
|
||||
cm = copy.deepcopy(dependencies['configmap'])
|
||||
cm.pop('canonical_data_sha256')
|
||||
service = json.loads((CASE / 'candidate-deployment.json').read_text())
|
||||
source_service = json.loads((Path('/home/worsch/informed-decision/deploy/lifecycle/service.candidate.json')).read_text())
|
||||
cm['data'] = next(x for x in source_service['items'] if x['kind'] == 'ConfigMap')['data']
|
||||
pvc = copy.deepcopy(dependencies['pvc'])
|
||||
pvc['status'] = {'phase': 'Bound'}
|
||||
app = {'metadata': {'uid': '499868f2-eabc-4df4-ae31-b89ce58d750d', 'resourceVersion': '17'},
|
||||
'spec': {'source': {'repoURL': 'https://forgejo.coulomb.social/coulomb/informed-decision.git',
|
||||
'path': 'deploy/lifecycle', 'targetRevision': 'c96b0c6d881e855d1d158003c6de90ef390262e2'},
|
||||
'destination': {'namespace': 'informed-decision', 'server': 'https://kubernetes.default.svc'}}}
|
||||
objects = {'deployment': live, 'configmap': cm, 'pvc': pvc, 'application': app}
|
||||
payload = {'phase': 'release', 'source_revision': REVISION, 'approval': {}, 'sealed': sealed,
|
||||
'dependencies': dependencies, 'candidate': service,
|
||||
'rollback': json.loads((CASE / 'rollback-deployment.json').read_text()),
|
||||
'readonly': (CASE / 'sqlite_readonly.py').read_text(),'purpose_checks':(CASE/'check_installed.py').read_text(),
|
||||
'installed_zlib': json.loads((CASE / 'installed-zlib-proof.json').read_text()), 'receipt_safety': (Path(__file__).parent / 'receipt_safety.py').read_text()}
|
||||
return objects, payload
|
||||
|
||||
def execute_fake(self, objects, payload, ambiguous=False, schema_refused=False):
|
||||
writes = []
|
||||
calls = []
|
||||
|
||||
def fake(argv, input=None, **kwargs):
|
||||
calls.append(argv)
|
||||
if argv[:2] == ['kubectl', 'get']:
|
||||
kind = argv[2]
|
||||
if kind in objects:
|
||||
body = objects[kind]
|
||||
elif kind == 'pods':
|
||||
body = {'items': [{'metadata': {'name': 'fixture-pod', 'uid': 'c4cb1550-feda-4097-9de4-d891a657b662',
|
||||
'ownerReferences': [{'kind': 'ReplicaSet', 'name': 'fixture-rs', 'uid': 'rs-uid'}]},
|
||||
'spec': objects['deployment']['spec']['template']['spec'],
|
||||
'status': {'phase': 'Running', 'containerStatuses': [{'name':'informed-decision','ready': True,'imageID':objects['deployment']['spec']['template']['spec']['containers'][0]['image']}] }}]}
|
||||
elif kind == 'replicaset':
|
||||
body = {'metadata': {'uid': 'rs-uid', 'ownerReferences': [
|
||||
{'kind': 'Deployment', 'uid': payload['sealed']['metadata']['uid']}]}}
|
||||
elif kind == 'nodes':
|
||||
body = {'items': [{'metadata': {'name': 'fixture-node'}, 'status': {
|
||||
'addresses': [{'address': '92.205.62.239'}], 'allocatable': {'cpu': '4'},
|
||||
'conditions': [{'type': key, 'status': 'True' if key == 'Ready' else 'False'}
|
||||
for key in ('Ready', 'MemoryPressure', 'DiskPressure', 'PIDPressure')]}}]}
|
||||
else:
|
||||
raise AssertionError('unexpected fixed metadata route')
|
||||
return subprocess.CompletedProcess(argv, 0, json.dumps(body), '')
|
||||
if argv[:2] == ['kubectl', 'exec']:
|
||||
if schema_refused:
|
||||
return subprocess.CompletedProcess(argv, 1, '', 'withheld')
|
||||
return subprocess.CompletedProcess(argv, 0, json.dumps({
|
||||
'all_checks_pass': True, 'live_readonly_schema_integrity_counts': COUNT}), '')
|
||||
if argv[:2] == ['kubectl', 'apply']:
|
||||
admitted = copy.deepcopy(payload['sealed'])
|
||||
admitted['spec']['template']['spec']['containers'][0]['image'] = (actuator.IMAGE if payload['phase']=='release' else payload['sealed']['spec']['template']['spec']['containers'][0]['image'])
|
||||
return subprocess.CompletedProcess(argv, 0, json.dumps(admitted), '')
|
||||
if argv[:2] == ['kubectl', 'describe']:
|
||||
return subprocess.CompletedProcess(argv, 0, 'Allocated resources:\n cpu 3460m (86%)\n', '')
|
||||
if argv[:2] == ['kubectl', 'diff']:
|
||||
return subprocess.CompletedProcess(argv, 1, '-image: base\n+image: candidate\n', '')
|
||||
if argv[:2] == ['kubectl', 'patch']:
|
||||
if '--dry-run=server' not in argv:
|
||||
writes.append(json.loads(input))
|
||||
if ambiguous:
|
||||
return subprocess.CompletedProcess(argv, 1, '', 'withheld')
|
||||
return subprocess.CompletedProcess(argv, 0, 'application.argoproj.io/informed-decision\n', '')
|
||||
raise AssertionError('unexpected command')
|
||||
|
||||
source = PROGRAM.replace('__PAYLOAD__', repr(json.dumps(payload))).replace(
|
||||
'__GUARD__', repr((CASE / 'change_guard.py').read_text()))
|
||||
output = io.StringIO()
|
||||
with patch('subprocess.run', side_effect=fake), redirect_stdout(output):
|
||||
try:
|
||||
exec(compile(source, 'fixed-native-fixture', 'exec'), {'__name__': '__fixture__'})
|
||||
except (ValueError, SystemExit):
|
||||
pass
|
||||
receipt = json.loads(output.getvalue()) if output.getvalue() else {'all_checks_pass': False}
|
||||
return receipt, writes, calls
|
||||
|
||||
def test_only_existing_application_operation_and_deployment_are_requested(self):
|
||||
objects, payload = self.fixture()
|
||||
receipt, writes, calls = self.execute_fake(objects, payload)
|
||||
self.assertTrue(receipt['all_checks_pass'])
|
||||
self.assertFalse(receipt['rollout_verified'])
|
||||
self.assertEqual(len(writes), 1)
|
||||
operation = writes[0][-1]['value']
|
||||
self.assertFalse(operation['sync']['prune'])
|
||||
self.assertEqual(operation['sync']['resources'], [
|
||||
{'group': 'apps', 'kind': 'Deployment', 'name': 'informed-decision', 'namespace': 'informed-decision'}])
|
||||
self.assertTrue(any('--dry-run=server' in argv and argv[:2] == ['kubectl', 'patch'] for argv in calls))
|
||||
self.assertEqual(writes[0][0]['path'], '/metadata/uid')
|
||||
|
||||
def test_source_overrides_automation_and_custody_drift_stop_before_write(self):
|
||||
mutations = [lambda o: o['application']['metadata'].update(uid='recreated'),
|
||||
lambda o: o['application']['spec'].update(syncPolicy={'automated': {}}),
|
||||
lambda o: o['application']['spec']['source'].update(kustomize={'images': ['other']}),
|
||||
lambda o: o['application']['spec'].update(sources=[{}]),
|
||||
lambda o: o['configmap']['metadata'].update(uid='recreated'),
|
||||
lambda o: o['pvc']['spec'].update(volumeName='replaced'),
|
||||
lambda o: o['deployment']['status'].update(readyReplicas=0)]
|
||||
for mutate in mutations:
|
||||
with self.subTest(mutate=mutate):
|
||||
objects, payload = self.fixture()
|
||||
mutate(objects)
|
||||
receipt, writes, calls = self.execute_fake(objects, payload)
|
||||
self.assertFalse(receipt['all_checks_pass'])
|
||||
self.assertEqual(writes, [])
|
||||
|
||||
def test_preopen_schema_refusal_prevents_image_operation(self):
|
||||
objects, payload = self.fixture()
|
||||
receipt, writes, calls = self.execute_fake(objects, payload, schema_refused=True)
|
||||
self.assertFalse(receipt['all_checks_pass'])
|
||||
self.assertEqual(writes, [])
|
||||
|
||||
|
||||
def test_rollback_unready_candidate_never_reads_pod_or_database(self):
|
||||
objects, payload = self.fixture()
|
||||
payload['phase'] = 'rollback'
|
||||
objects['deployment']['status'].update(readyReplicas=0, updatedReplicas=0)
|
||||
objects['deployment']['spec']['template']['spec']['containers'][0]['image'] = actuator.IMAGE
|
||||
objects['application']['spec']['source']['targetRevision'] = REVISION
|
||||
receipt, writes, calls = self.execute_fake(objects, payload, schema_refused=True)
|
||||
self.assertTrue(receipt['all_checks_pass'])
|
||||
self.assertFalse(receipt['rollout_verified'])
|
||||
self.assertEqual(len(writes), 1)
|
||||
self.assertFalse(any(argv[:2] == ['kubectl', 'exec'] or argv[:3] == ['kubectl', 'get', 'pods'] for argv in calls))
|
||||
self.assertEqual(writes[0][-1]['value']['sync']['revision'], 'c96b0c6d881e855d1d158003c6de90ef390262e2')
|
||||
|
||||
def test_rollback_still_refuses_custody_or_nonpair_image_drift(self):
|
||||
for defect in ('cm', 'pvc', 'image'):
|
||||
with self.subTest(defect=defect):
|
||||
objects, payload = self.fixture();payload['phase'] = 'rollback'
|
||||
objects['deployment']['status']['readyReplicas'] = 0
|
||||
if defect == 'cm':objects['configmap']['metadata']['uid'] = 'recreated'
|
||||
elif defect == 'pvc':objects['pvc']['spec']['volumeName'] = 'replaced'
|
||||
else:objects['deployment']['spec']['template']['spec']['containers'][0]['image'] = 'foreign-image'
|
||||
receipt, writes, calls = self.execute_fake(objects, payload)
|
||||
self.assertFalse(receipt['all_checks_pass']);self.assertEqual(writes, [])
|
||||
|
||||
def test_recovery_verification_is_separate_ready_old_image_schema_proof(self):
|
||||
objects, payload = self.fixture();payload['phase'] = 'rollback-verify'
|
||||
resource={'group':'apps','kind':'Deployment','name':'informed-decision','namespace':'informed-decision'}
|
||||
target='c96b0c6d881e855d1d158003c6de90ef390262e2'
|
||||
payload['operation_intent']={'state':'COMPLETE','started_at':'2026-10-11T01:00:00Z','result':{'operation_requested':True,'source_revision':target,'prune':False,'resources':[resource]}}
|
||||
objects['application']['status']={'operationState':{'phase':'Succeeded','startedAt':'2026-10-11T01:00:01Z','finishedAt':'2026-10-11T01:01:00Z','operation':{'initiatedBy':{'username':'custodian-codex'},'sync':{'revision':target,'resources':[resource]}},'syncResult':{'revision':target,'resources':[{**resource,'status':'Synced'}]}}}
|
||||
receipt, writes, calls = self.execute_fake(objects, payload)
|
||||
self.assertTrue(receipt['all_checks_pass']);self.assertTrue(receipt['recovery_verification'])
|
||||
self.assertEqual(writes, [])
|
||||
self.assertTrue(any(argv[:2]==['kubectl','exec'] for argv in calls))
|
||||
objects['deployment']['status']['readyReplicas'] = 0
|
||||
receipt, writes, calls = self.execute_fake(objects,payload)
|
||||
self.assertFalse(receipt['all_checks_pass'])
|
||||
|
||||
def test_ambiguous_patch_is_never_retried(self):
|
||||
objects, payload = self.fixture()
|
||||
receipt, writes, calls = self.execute_fake(objects, payload, ambiguous=True)
|
||||
self.assertFalse(receipt['all_checks_pass'])
|
||||
self.assertEqual(len(writes), 1)
|
||||
|
||||
def test_false_omitempty_needs_bound_current_request_and_exact_completion(self):
|
||||
objects,payload=self.fixture();payload['phase']='rollback-verify'
|
||||
resource={'group':'apps','kind':'Deployment','name':'informed-decision','namespace':'informed-decision'}
|
||||
target='c96b0c6d881e855d1d158003c6de90ef390262e2'
|
||||
payload['operation_intent']={'state':'COMPLETE','started_at':'2026-10-11T01:00:00Z','result':{'operation_requested':True,'source_revision':target,'prune':False,'resources':[resource]}}
|
||||
objects['application']['status']={'operationState':{'phase':'Succeeded','startedAt':'2026-10-11T01:00:01Z','finishedAt':'2026-10-11T01:01:00Z','operation':{'initiatedBy':{'username':'custodian-codex'},'sync':{'revision':target,'resources':[resource]}},'syncResult':{'revision':target,'resources':[{**resource,'status':'Synced'}]}}}
|
||||
self.assertTrue(self.execute_fake(objects,payload)[0]['all_checks_pass'])
|
||||
mutations=[lambda o,p:o['application']['status']['operationState']['operation']['sync'].update(prune=True),
|
||||
lambda o,p:o['application']['status']['operationState']['operation']['sync'].update(prune=None),
|
||||
lambda o,p:o['application']['status']['operationState'].update(startedAt='2026-10-11T00:59:00Z'),
|
||||
lambda o,p:o['application']['status']['operationState']['operation'].update(initiatedBy={'username':'other'}),
|
||||
lambda o,p:o['application']['status']['operationState']['syncResult'].update(revision='foreign'),
|
||||
lambda o,p:o['application']['status']['operationState']['syncResult']['resources'][0].update(status='Pruned'),
|
||||
lambda o,p:p['operation_intent']['result'].update(prune=True),
|
||||
lambda o,p:p.update(operation_intent=None)]
|
||||
for mutate in mutations:
|
||||
o,p=copy.deepcopy(objects),copy.deepcopy(payload);mutate(o,p)
|
||||
receipt,writes,calls=self.execute_fake(o,p)
|
||||
self.assertFalse(receipt['all_checks_pass']);self.assertEqual(writes,[])
|
||||
|
||||
def test_optimized_executor_refuses_before_any_input(self):
|
||||
result=subprocess.run([sys.executable,'-O',str(Path(__file__).parent/'actuator.py'),'--phase','release','--root-authority-receipt','/missing','--root-native-outcome','/missing','--source-revision',REVISION],capture_output=True,text=True)
|
||||
self.assertNotEqual(result.returncode,0)
|
||||
self.assertIn('optimized interpreter refused',result.stderr)
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
unittest.main()
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
{
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"zlib_package": "1.3.2-r1",
|
||||
"files": {
|
||||
"lib/apk/db/installed": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
|
||||
],
|
||||
"usr/lib/libz.so.1.3.2": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,101 @@
|
|||
{
|
||||
"id": "infd-20261011-zlib-remediation-r1",
|
||||
"version": 1,
|
||||
"question": "Approve the exact zlib85091 fixed image-only release, new protected backup/restore compatibility drill and database-preserving rollback?",
|
||||
"requested_act": "approve",
|
||||
"binding_level": "organizational",
|
||||
"brief": "Published owner CI image f558 has zero full-scan findings across44packages; only zlib1.3.2-r0 to r1 changes. Fresh schema5 private backup/isolated clone drill and cutover snapshot precede one Deployment manual prune=false Recreate sync. Separate founder go required; old T04 acceptance/history unchanged. Rollback image763c/Applicationc96 retains latestDB. Release reserves30minutes before Oct12 deadline.",
|
||||
"binding": {
|
||||
"principal": {
|
||||
"id": "pending-human-session",
|
||||
"kind": "person",
|
||||
"display_name": "Founder review"
|
||||
},
|
||||
"target": {
|
||||
"kind": "environment",
|
||||
"id": "realm:kubernetes/railiance01/informed-decision",
|
||||
"label": "Informed Decision zlib85091 image-only remediation on railiance01",
|
||||
"environment": "production"
|
||||
},
|
||||
"terms": "Approve only INFD-WP-0009-T05/zlib85091-r1 trialinfd-zlib-20261011-r1 and exact attached digests: new private drillbackup/copy, isolatedschema5pre/admin/postintegrityandcounts, exactcreatedclonecleanup, freshcutoverbackup/copy, manualfinalsourceDeployment-onlyimagef558/prune=false. ImmutableCM/PVC/config/credentials/audience/resources sealed. Freshrootnativeauthenticated confirmed founderACCEPTsource1 beforeeveryphase; receiptsarebookkeeping/noautonomousgrant. Rollbackonlyimage763c/Applicationc96 preserveslatestDB, separateverification. AllphasesbeginbeforeOct12 23:59:59Z; releasereserves30minutes; newdecisionbeyond. ExistingT04UNCERTAINEvidenceunaltered, nooldhelperamendment/phase retry, noresidualpromotion ordoctrinechange."
|
||||
},
|
||||
"step_kind": "approve",
|
||||
"packet": [
|
||||
{
|
||||
"item_id": "decision-packet-md",
|
||||
"label": "decision-packet.md",
|
||||
"hash": "sha256:763f30c1433d1ca872b029519ec46ad1b97c47d60b7ea0eea0275a2c6b647dc3"
|
||||
},
|
||||
{
|
||||
"item_id": "proposal-json",
|
||||
"label": "proposal.json",
|
||||
"hash": "sha256:48b0f0baf4efc239111411ad7d1c291f8eceaa0ddf1414dac73d49ccdb3bbe70"
|
||||
},
|
||||
{
|
||||
"item_id": "native-backup-restore-protocol-md",
|
||||
"label": "native-backup-restore-protocol.md",
|
||||
"hash": "sha256:f586a511c1921490185bab95334f27de6d3cca20b348df20d18bcb9257d7ae35"
|
||||
},
|
||||
{
|
||||
"item_id": "native-preflight-json",
|
||||
"label": "native-preflight.json",
|
||||
"hash": "sha256:56637994dfdae46a6f9ab442c2ff9b259212650b35eb98d896c5e837f01ce2f9"
|
||||
},
|
||||
{
|
||||
"item_id": "published-verification-json",
|
||||
"label": "published-verification.json",
|
||||
"hash": "sha256:dd4eecf0c103dca7922094a8beeb99b77ae96fd1d5fe532e37bd833daa02614e"
|
||||
},
|
||||
{
|
||||
"item_id": "artifact-comparison-json",
|
||||
"label": "artifact-comparison.json",
|
||||
"hash": "sha256:a1c5d9e249dc00600449998360faf6e8da0206b568c76d155602c4645fa5fce4"
|
||||
},
|
||||
{
|
||||
"item_id": "installed-zlib-proof-json",
|
||||
"label": "installed-zlib-proof.json",
|
||||
"hash": "sha256:6af62f86f50ac185fab94163c24ac8150ead69e62f8d825b0dce1e75a5a57b68"
|
||||
},
|
||||
{
|
||||
"item_id": "sealed-live-deployment-json",
|
||||
"label": "sealed-live-deployment.json",
|
||||
"hash": "sha256:f8a9a07abc2eb52cdf6bcdba2d9f79dec073145c31d0444a9e0fe1147e42cc4e"
|
||||
},
|
||||
{
|
||||
"item_id": "sealed-native-dependencies-json",
|
||||
"label": "sealed-native-dependencies.json",
|
||||
"hash": "sha256:042327a036ed254cf95dbeb0c056ac25b03a6a844b95a332c992df2943691369"
|
||||
},
|
||||
{
|
||||
"item_id": "candidate-deployment-json",
|
||||
"label": "candidate-deployment.json",
|
||||
"hash": "sha256:487f834cc86dcbc7a04c2392bde072ecaf87dc116b4baa16c35eb9c599ad5c95"
|
||||
},
|
||||
{
|
||||
"item_id": "rollback-deployment-json",
|
||||
"label": "rollback-deployment.json",
|
||||
"hash": "sha256:f8a9a07abc2eb52cdf6bcdba2d9f79dec073145c31d0444a9e0fe1147e42cc4e"
|
||||
},
|
||||
{
|
||||
"item_id": "execution-plan-json",
|
||||
"label": "execution-plan.json",
|
||||
"hash": "sha256:9b458e2b4d418525987b6cb1b9a160c4b1a2c621625c1b5c571ea5c77e9d4361"
|
||||
}
|
||||
],
|
||||
"highlights": [
|
||||
{
|
||||
"id": "protected-drill-and-recreate",
|
||||
"item_id": "decision-packet-md",
|
||||
"note": "This new T05 decision authorizes protected real-data backup/copy and no-network same-schema restore drill plus brief Recreate image release. Scan0 is actual published44package result, not installed acceptance. Rollback preserves latestDB; priorfailedT04evidence retained. No oldapprovalreuse. Allphase starts expireOct12; release reserves30minutesforrecovery; noautomaticextension.",
|
||||
"required_ack": true,
|
||||
"severity": "warning",
|
||||
"locator": {
|
||||
"kind": "section",
|
||||
"heading": "Requested decision"
|
||||
}
|
||||
}
|
||||
],
|
||||
"sealed": false,
|
||||
"approval_id": null,
|
||||
"approval_binding_digest": null
|
||||
}
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
# T05 zlib85091 release — preliminary, unapproved
|
||||
|
||||
This is a distinct proposal/trial for existing INFD-WP-0009-T05. The actual T04 source2 acceptance does not authorize it. Previous R1 copy and R2 verify UNCERTAIN journal states remain untouched. INFD-IN-0010 remains an unpromoted general verifier residual; this new task-specific verifier is a prerequisite of active T05, not an amendment of the old approved helper.
|
||||
|
||||
Exact intended image f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23 was built by admitted owner CI11534/run4 from 9b4bb25d325698ae543e7e8a8a3c3592db1f58fc. Publication is not installed acceptance. Final packet requires independent published-image scan/runtime/filesystem/source proof and fresh read-only native projection/one-object dry-run evidence. Until all final inputs and independent owner acknowledgments are frozen, execution-plan state remains preliminary and the actuator refuses before any authority, journal or native action.
|
||||
|
||||
After a NEW exact confirmed founder acceptance, root freshly authenticates fixed-origin native source-version1 outcomes before each phase. Receipt files are supervised bookkeeping, not signed grants or autonomy. Wrong task, source, memo/version, stale/pending/agent disposition, old T04 acceptance or changed inputs refuse. Root retains exact approved source revision/digests and action results in supervision. Approval does not promote any agent.
|
||||
|
||||
Fixed phase order: drill-backup → drill-copy → offline-verify → cleanup-offline → cutover-backup → cutover-copy → release → verify. New private native /data/private/zlib85091-r1, root .private-backups/20261011-infd-zlib-r1 and local volume infd-zlib-r1-restore-20261011 are distinct from all T04 custody. New private journal intent is fsynced RUNNING before dispatch; no attempted phase replay. Fixed output schema contains only counts, hashes, object identity and boolean results; raw errors and private content are withheld. Existing native snapshots/database/sidecars are never removed or restored over current data.
|
||||
|
||||
Fresh backup inspection uses copied explicit-close SQLite helpers: live and offline clone readers are mode=ro/query_only and WAL-aware, before any Store/admin open. Immutable reader is used only for freshly closed hash-bound private snapshot with absent/zero WAL frames and stable identity/metadata/digest before/after read/copy. Main and sidecars remain retained. Schema must equal5, integrity ok, and exact snapshot/isolated clone counts match before/admin/after. The detached local clone has network none, readonly root, no service/runtime config/credential mounts; only narrowly scoped UID0 CAP_CHOWN initializer precedes UID10001 reads/admin. Original private copy is hash-stable. Cleanup removes only the disposable volume whose nonce/labels/creation metadata match this trial, before cutover.
|
||||
|
||||
Each snapshot is bounded512MiB. At most two new snapshots occupy each native/offcluster custody (1GiB payload each); the disposable offcluster clone adds512MiB while present, plus16MiB sidecar/metadata reserve. New native drill phase checks free space for both; local custody checks two snapshot bounds plus reserve. Existing T04 retention consumes additional pre-existing space. EUR0 recurring infrastructure estimate; human/compute time unpriced.
|
||||
|
||||
Cutover takes a fresh native backup and exact offcluster copy. Release then requires latest schema5 readonly proof, sealed Pod/Deployment/config/PVC custody and same baseline image763c/current Application sourcec96, a healthy single target92.205.62.239 node and fresh requested CPU ≤ allocatable capacity. Recreate and resources remain unchanged. Server dry-run/client diff must show only the image. Application UID/resourceVersion/source CAS dispatches manual exact final revision, initiatedBy custodian-codex, explicit prune=false and only apps/Deployment informed-decision in its namespace. No whole-Application sync, namespace/config/credential/resource change or pruning.
|
||||
|
||||
Verification reads imageID/readiness/owner chain/exact configured Pod fields, schema5/integrity/metadata counts, installed policy hash and synthetic purpose refusals, health200, installed fixed zlib and exact image proof. Real PDP-gated lifecycle readback is a separate root authenticated observation and not replaced by synthetic checks. Argo3.5.3 omits false prune in operation status: missing or exactfalse is accepted only together with this journal's COMPLETE explicitfalse request, exact source/resources/initiation, operation start after our durable attempt, bounded finish and one Synced Deployment result. True/null/string/prior/foreign/extra-resource results refuse.
|
||||
|
||||
Rollback → rollback-verify is separate and permitted only after a recorded release attempt. It switches only Application source back to c96 and Deployment image763c; it never restores an old snapshot over the latest database. Recovery dispatch works even if candidate Pod is absent/unready and never depends on candidate DB inspection. Recovery verification separately requires Ready1/old image/current schema5/data-custody and exact recorded scoped completion. All phases must begin before2026-10-12T23:59:59Z; release must begin at least30minutes earlier. Beyond expiry stop and obtain a new founder decision; no automatic extension or emergency grant. A failed/uncertain attempt requires informed recovery rather than retry.
|
||||
|
||||
T05 remains progress until actual installed acceptance and native rescan prove the finding absent. No Risk Engine grade is assigned. Only then may owner close T05/risk and consider finishing WP9, with existing residuals live first.
|
||||
|
|
@ -0,0 +1,672 @@
|
|||
{
|
||||
"all_checks_pass": true,
|
||||
"observed_at": "2026-10-11T09:40:15.540874+00:00",
|
||||
"native_changed": false,
|
||||
"protected_database_read": false,
|
||||
"secret_read": false,
|
||||
"deployment_generation": 25,
|
||||
"ready_replicas": 1,
|
||||
"sealed_live_deployment": {
|
||||
"apiVersion": "apps/v1",
|
||||
"kind": "Deployment",
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"argocd.argoproj.io/tracking-id": "informed-decision:apps/Deployment:informed-decision/informed-decision",
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision",
|
||||
"uid": "a588e10a-90d2-4883-975e-6dd8b8feca92"
|
||||
},
|
||||
"spec": {
|
||||
"progressDeadlineSeconds": 600,
|
||||
"replicas": 1,
|
||||
"revisionHistoryLimit": 10,
|
||||
"selector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"strategy": {
|
||||
"type": "Recreate"
|
||||
},
|
||||
"template": {
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"labels": {
|
||||
"app.kubernetes.io/component": "review",
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"automountServiceAccountToken": false,
|
||||
"containers": [
|
||||
{
|
||||
"env": [
|
||||
{
|
||||
"name": "INFD_KEYCAPE_ISSUER",
|
||||
"value": "https://kc.coulomb.social"
|
||||
},
|
||||
{
|
||||
"name": "INFD_CONTAINER_CONFIG",
|
||||
"value": "/configuration/runtime.json"
|
||||
}
|
||||
],
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"imagePullPolicy": "IfNotPresent",
|
||||
"livenessProbe": {
|
||||
"failureThreshold": 3,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"name": "informed-decision",
|
||||
"ports": [
|
||||
{
|
||||
"containerPort": 8080,
|
||||
"name": "http",
|
||||
"protocol": "TCP"
|
||||
},
|
||||
{
|
||||
"containerPort": 8081,
|
||||
"name": "workload",
|
||||
"protocol": "TCP"
|
||||
}
|
||||
],
|
||||
"readinessProbe": {
|
||||
"failureThreshold": 3,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"resources": {
|
||||
"limits": {
|
||||
"cpu": "500m",
|
||||
"memory": "256Mi"
|
||||
},
|
||||
"requests": {
|
||||
"cpu": "5m",
|
||||
"memory": "64Mi"
|
||||
}
|
||||
},
|
||||
"securityContext": {
|
||||
"allowPrivilegeEscalation": false,
|
||||
"capabilities": {
|
||||
"drop": [
|
||||
"ALL"
|
||||
]
|
||||
},
|
||||
"readOnlyRootFilesystem": true
|
||||
},
|
||||
"startupProbe": {
|
||||
"failureThreshold": 12,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"terminationMessagePath": "/dev/termination-log",
|
||||
"terminationMessagePolicy": "File",
|
||||
"volumeMounts": [
|
||||
{
|
||||
"mountPath": "/data",
|
||||
"name": "data"
|
||||
},
|
||||
{
|
||||
"mountPath": "/run/informed-decision",
|
||||
"name": "runtime"
|
||||
},
|
||||
{
|
||||
"mountPath": "/tmp",
|
||||
"name": "tmp"
|
||||
},
|
||||
{
|
||||
"mountPath": "/configuration",
|
||||
"name": "configuration",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/policy",
|
||||
"name": "caller",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/audit",
|
||||
"name": "audit",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/kubernetes",
|
||||
"name": "kubernetes-api",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/workload-registry",
|
||||
"name": "workload-registry",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/requester",
|
||||
"name": "sitting-requester",
|
||||
"readOnly": true
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"dnsPolicy": "ClusterFirst",
|
||||
"restartPolicy": "Always",
|
||||
"schedulerName": "default-scheduler",
|
||||
"securityContext": {
|
||||
"fsGroup": 10001,
|
||||
"fsGroupChangePolicy": "OnRootMismatch",
|
||||
"runAsGroup": 10001,
|
||||
"runAsNonRoot": true,
|
||||
"runAsUser": 10001,
|
||||
"seccompProfile": {
|
||||
"type": "RuntimeDefault"
|
||||
}
|
||||
},
|
||||
"serviceAccount": "review",
|
||||
"serviceAccountName": "review",
|
||||
"terminationGracePeriodSeconds": 45,
|
||||
"volumes": [
|
||||
{
|
||||
"name": "data",
|
||||
"persistentVolumeClaim": {
|
||||
"claimName": "informed-decision-data"
|
||||
}
|
||||
},
|
||||
{
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
},
|
||||
"name": "runtime"
|
||||
},
|
||||
{
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
},
|
||||
"name": "tmp"
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"defaultMode": 292,
|
||||
"name": "informed-decision-runtime-6c221878d051"
|
||||
},
|
||||
"name": "configuration"
|
||||
},
|
||||
{
|
||||
"name": "caller",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"audience": "flex-auth",
|
||||
"expirationSeconds": 3600,
|
||||
"path": "token"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "audit",
|
||||
"secret": {
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "token",
|
||||
"path": "token"
|
||||
}
|
||||
],
|
||||
"secretName": "informed-decision-audit"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "kubernetes-api",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"expirationSeconds": 600,
|
||||
"path": "token"
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"items": [
|
||||
{
|
||||
"key": "ca.crt",
|
||||
"path": "ca.crt"
|
||||
}
|
||||
],
|
||||
"name": "kube-root-ca.crt"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"defaultMode": 292,
|
||||
"name": "informed-decision-workload-registry"
|
||||
},
|
||||
"name": "workload-registry"
|
||||
},
|
||||
{
|
||||
"name": "sitting-requester",
|
||||
"secret": {
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "client-secret",
|
||||
"path": "client-secret"
|
||||
}
|
||||
],
|
||||
"optional": false,
|
||||
"secretName": "informed-decision-sitting-requester"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"candidate_deployment": {
|
||||
"apiVersion": "apps/v1",
|
||||
"kind": "Deployment",
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"argocd.argoproj.io/tracking-id": "informed-decision:apps/Deployment:informed-decision/informed-decision",
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision",
|
||||
"uid": "a588e10a-90d2-4883-975e-6dd8b8feca92"
|
||||
},
|
||||
"spec": {
|
||||
"progressDeadlineSeconds": 600,
|
||||
"replicas": 1,
|
||||
"revisionHistoryLimit": 10,
|
||||
"selector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"strategy": {
|
||||
"type": "Recreate"
|
||||
},
|
||||
"template": {
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"labels": {
|
||||
"app.kubernetes.io/component": "review",
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"automountServiceAccountToken": false,
|
||||
"containers": [
|
||||
{
|
||||
"env": [
|
||||
{
|
||||
"name": "INFD_KEYCAPE_ISSUER",
|
||||
"value": "https://kc.coulomb.social"
|
||||
},
|
||||
{
|
||||
"name": "INFD_CONTAINER_CONFIG",
|
||||
"value": "/configuration/runtime.json"
|
||||
}
|
||||
],
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"imagePullPolicy": "IfNotPresent",
|
||||
"livenessProbe": {
|
||||
"failureThreshold": 3,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"name": "informed-decision",
|
||||
"ports": [
|
||||
{
|
||||
"containerPort": 8080,
|
||||
"name": "http",
|
||||
"protocol": "TCP"
|
||||
},
|
||||
{
|
||||
"containerPort": 8081,
|
||||
"name": "workload",
|
||||
"protocol": "TCP"
|
||||
}
|
||||
],
|
||||
"readinessProbe": {
|
||||
"failureThreshold": 3,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"resources": {
|
||||
"limits": {
|
||||
"cpu": "500m",
|
||||
"memory": "256Mi"
|
||||
},
|
||||
"requests": {
|
||||
"cpu": "5m",
|
||||
"memory": "64Mi"
|
||||
}
|
||||
},
|
||||
"securityContext": {
|
||||
"allowPrivilegeEscalation": false,
|
||||
"capabilities": {
|
||||
"drop": [
|
||||
"ALL"
|
||||
]
|
||||
},
|
||||
"readOnlyRootFilesystem": true
|
||||
},
|
||||
"startupProbe": {
|
||||
"failureThreshold": 12,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"terminationMessagePath": "/dev/termination-log",
|
||||
"terminationMessagePolicy": "File",
|
||||
"volumeMounts": [
|
||||
{
|
||||
"mountPath": "/data",
|
||||
"name": "data"
|
||||
},
|
||||
{
|
||||
"mountPath": "/run/informed-decision",
|
||||
"name": "runtime"
|
||||
},
|
||||
{
|
||||
"mountPath": "/tmp",
|
||||
"name": "tmp"
|
||||
},
|
||||
{
|
||||
"mountPath": "/configuration",
|
||||
"name": "configuration",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/policy",
|
||||
"name": "caller",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/audit",
|
||||
"name": "audit",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/kubernetes",
|
||||
"name": "kubernetes-api",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/workload-registry",
|
||||
"name": "workload-registry",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/requester",
|
||||
"name": "sitting-requester",
|
||||
"readOnly": true
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"dnsPolicy": "ClusterFirst",
|
||||
"restartPolicy": "Always",
|
||||
"schedulerName": "default-scheduler",
|
||||
"securityContext": {
|
||||
"fsGroup": 10001,
|
||||
"fsGroupChangePolicy": "OnRootMismatch",
|
||||
"runAsGroup": 10001,
|
||||
"runAsNonRoot": true,
|
||||
"runAsUser": 10001,
|
||||
"seccompProfile": {
|
||||
"type": "RuntimeDefault"
|
||||
}
|
||||
},
|
||||
"serviceAccount": "review",
|
||||
"serviceAccountName": "review",
|
||||
"terminationGracePeriodSeconds": 45,
|
||||
"volumes": [
|
||||
{
|
||||
"name": "data",
|
||||
"persistentVolumeClaim": {
|
||||
"claimName": "informed-decision-data"
|
||||
}
|
||||
},
|
||||
{
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
},
|
||||
"name": "runtime"
|
||||
},
|
||||
{
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
},
|
||||
"name": "tmp"
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"defaultMode": 292,
|
||||
"name": "informed-decision-runtime-6c221878d051"
|
||||
},
|
||||
"name": "configuration"
|
||||
},
|
||||
{
|
||||
"name": "caller",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"audience": "flex-auth",
|
||||
"expirationSeconds": 3600,
|
||||
"path": "token"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "audit",
|
||||
"secret": {
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "token",
|
||||
"path": "token"
|
||||
}
|
||||
],
|
||||
"secretName": "informed-decision-audit"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "kubernetes-api",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"expirationSeconds": 600,
|
||||
"path": "token"
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"items": [
|
||||
{
|
||||
"key": "ca.crt",
|
||||
"path": "ca.crt"
|
||||
}
|
||||
],
|
||||
"name": "kube-root-ca.crt"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"defaultMode": 292,
|
||||
"name": "informed-decision-workload-registry"
|
||||
},
|
||||
"name": "workload-registry"
|
||||
},
|
||||
{
|
||||
"name": "sitting-requester",
|
||||
"secret": {
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "client-secret",
|
||||
"path": "client-secret"
|
||||
}
|
||||
],
|
||||
"optional": false,
|
||||
"secretName": "informed-decision-sitting-requester"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"sealed_dependencies": {
|
||||
"configmap": {
|
||||
"apiVersion": "v1",
|
||||
"immutable": true,
|
||||
"kind": "ConfigMap",
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"argocd.argoproj.io/tracking-id": "informed-decision:/ConfigMap:informed-decision/informed-decision-runtime-6c221878d051",
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"name": "informed-decision-runtime-6c221878d051",
|
||||
"namespace": "informed-decision",
|
||||
"uid": "90113d2d-54d9-4e82-b1d3-90b49ebed2b5"
|
||||
},
|
||||
"canonical_data_sha256": "8ec462d12347548f506eeebf1e3c7cc47648019c8a783804d09bcc79b0f22af6"
|
||||
},
|
||||
"pvc": {
|
||||
"apiVersion": "v1",
|
||||
"kind": "PersistentVolumeClaim",
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"argocd.argoproj.io/tracking-id": "informed-decision:/PersistentVolumeClaim:informed-decision/informed-decision-data",
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover",
|
||||
"pv.kubernetes.io/bind-completed": "yes",
|
||||
"pv.kubernetes.io/bound-by-controller": "yes",
|
||||
"volume.beta.kubernetes.io/storage-provisioner": "rancher.io/local-path",
|
||||
"volume.kubernetes.io/selected-node": "239.62.205.92.host.secureserver.net",
|
||||
"volume.kubernetes.io/storage-provisioner": "rancher.io/local-path"
|
||||
},
|
||||
"finalizers": [
|
||||
"kubernetes.io/pvc-protection"
|
||||
],
|
||||
"name": "informed-decision-data",
|
||||
"namespace": "informed-decision",
|
||||
"uid": "d80b25b1-141a-441b-b205-98fa2fd98b7c"
|
||||
},
|
||||
"spec": {
|
||||
"accessModes": [
|
||||
"ReadWriteOnce"
|
||||
],
|
||||
"resources": {
|
||||
"requests": {
|
||||
"storage": "1Gi"
|
||||
}
|
||||
},
|
||||
"storageClassName": "local-path",
|
||||
"volumeMode": "Filesystem",
|
||||
"volumeName": "pvc-d80b25b1-141a-441b-b205-98fa2fd98b7c"
|
||||
}
|
||||
},
|
||||
"pvc_phase": "Bound"
|
||||
},
|
||||
"argo": {
|
||||
"uid": "499868f2-eabc-4df4-ae31-b89ce58d750d",
|
||||
"source": {
|
||||
"path": "deploy/lifecycle",
|
||||
"repoURL": "https://forgejo.coulomb.social/coulomb/informed-decision.git",
|
||||
"targetRevision": "c96b0c6d881e855d1d158003c6de90ef390262e2"
|
||||
},
|
||||
"destination": {
|
||||
"namespace": "informed-decision",
|
||||
"server": "https://kubernetes.default.svc"
|
||||
},
|
||||
"automated": false,
|
||||
"health": {
|
||||
"lastTransitionTime": "2026-10-11T07:00:42Z",
|
||||
"status": "Healthy"
|
||||
},
|
||||
"sync": {
|
||||
"comparedTo": {
|
||||
"destination": {
|
||||
"namespace": "informed-decision",
|
||||
"server": "https://kubernetes.default.svc"
|
||||
},
|
||||
"source": {
|
||||
"path": "deploy/lifecycle",
|
||||
"repoURL": "https://forgejo.coulomb.social/coulomb/informed-decision.git",
|
||||
"targetRevision": "c96b0c6d881e855d1d158003c6de90ef390262e2"
|
||||
}
|
||||
},
|
||||
"revision": "c96b0c6d881e855d1d158003c6de90ef390262e2",
|
||||
"status": "OutOfSync"
|
||||
}
|
||||
},
|
||||
"server_dry_run_passed": true,
|
||||
"admission_only_image_delta": true,
|
||||
"client_diff_exit": 1,
|
||||
"client_diff_sha256": "ccff7c1ecfd9eb59fc0ce566c1013a2af5df514af048c68474a272997024ef7b",
|
||||
"allocatable_cpu_m": 4000,
|
||||
"requested_cpu_m": 3460,
|
||||
"strategy": "Recreate"
|
||||
}
|
||||
|
|
@ -0,0 +1,37 @@
|
|||
{
|
||||
"kind": "informed-decision.supervised-release-proposal",
|
||||
"version": 1,
|
||||
"proposal_id": "INFD-WP-0009-T05/zlib85091-r1",
|
||||
"trial_id": "infd-zlib-20261011-r1",
|
||||
"state": "prepared-awaiting-independent-owner-acknowledgments",
|
||||
"memo_id": "infd-20261011-zlib-remediation-r1",
|
||||
"memo_version": 1,
|
||||
"task": "INFD-WP-0009-T05",
|
||||
"candidate_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"artifact_source_revision": "9b4bb25d325698ae543e7e8a8a3c3592db1f58fc",
|
||||
"prior_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"prior_application_revision": "c96b0c6d881e855d1d158003c6de90ef390262e2",
|
||||
"source_revision": null,
|
||||
"published_artifact_verified": true,
|
||||
"native_actions_executed": false,
|
||||
"approval_id": null,
|
||||
"authority_mode": "ADMINISTER",
|
||||
"target": "realm:kubernetes/railiance01/informed-decision",
|
||||
"cost_estimate_eur": 0,
|
||||
"risk": "Private same-schema backup copies and brief Recreate availability gap. Failed or ambiguous phases retained; no replay. Rollback changes Deployment image/source only, retains latest database.",
|
||||
"execute_by": "2026-10-12T23:59:59Z",
|
||||
"release_must_start_by": "2026-10-12T23:29:59Z",
|
||||
"max_snapshot_bytes": 536870912,
|
||||
"maximum_new_snapshot_payload_bytes_each_site": 1073741824,
|
||||
"local_extra_disposable_clone_max_bytes": 536870912,
|
||||
"private_metadata_and_sqlite_sidecars_additional_headroom_bytes": 16777216,
|
||||
"unbound_inputs": [
|
||||
"fresh rollback server admission",
|
||||
"exact committed owner rendering revision",
|
||||
"Product and Platform final acknowledgments",
|
||||
"confirmed founder exact new disposition"
|
||||
],
|
||||
"published_verification_sha256": "dd4eecf0c103dca7922094a8beeb99b77ae96fd1d5fe532e37bd833daa02614e",
|
||||
"native_readonly_preflight_sha256": "56637994dfdae46a6f9ab442c2ff9b259212650b35eb98d896c5e837f01ce2f9",
|
||||
"executor_plan_sha256": "9b458e2b4d418525987b6cb1b9a160c4b1a2c621625c1b5c571ea5c77e9d4361"
|
||||
}
|
||||
|
|
@ -0,0 +1,96 @@
|
|||
{
|
||||
"proposal_id": "INFD-WP-0009-T05/zlib-85091-r1",
|
||||
"task_id": "INFD-WP-0009-T05",
|
||||
"risk_record": "INFD-RISK-20261011-ZLIB-85091",
|
||||
"state": "actual-owner-CI-published-independent-verification-passed-native-unapproved",
|
||||
"verified_utc": "2026-10-11T09:40:24.469646+00:00",
|
||||
"source_revision": "9b4bb25d325698ae543e7e8a8a3c3592db1f58fc",
|
||||
"ci_task": 11534,
|
||||
"ci_run": 4,
|
||||
"ci_status": "success",
|
||||
"reviewed_source_manifest_sha256": "724aa4777eb1c8976d868e5f504473f4b6d58f13d750d87aefa5c8d5ca0747ec",
|
||||
"all74_source_hashes_match_actual_commit": true,
|
||||
"published_image_digest": "sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"base_image_digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"registry_config_digest": "sha256:622becc3ebd97cb66b6e7c36f35bf931a7decd9464b65851123c1cc8c998d75b",
|
||||
"executed_local_daemon_image_id": "sha256:f2e07e3dd839b55afd5d517243a765a26965325e4e6750f508771ad556bd6d01",
|
||||
"serialization_caveat": "Daemon load reserializes config; all diffIDs/platform/effective config+labels independently equal to registry; neither config nor daemon ID substitutes for registry image digest",
|
||||
"actual_registry_descriptors_and_layers_verified": true,
|
||||
"base9layers_unchanged": true,
|
||||
"overlay_layers": 2,
|
||||
"fullscan_baseline": {
|
||||
"MEDIUM": 1,
|
||||
"id": "CVE-2026-85091"
|
||||
},
|
||||
"fullscan_candidate_allseverity_findings": 0,
|
||||
"fullscan_no_suppressions": true,
|
||||
"same_fresh_DB_both_images": true,
|
||||
"scanner_db_sha256": "03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917",
|
||||
"scanner_db_metadata": {
|
||||
"Version": 2,
|
||||
"NextUpdate": "2026-10-11T18:59:50.889010572Z",
|
||||
"UpdatedAt": "2026-10-10T18:59:50.889010923Z",
|
||||
"DownloadedAt": "2026-10-10T23:32:32.380033131Z"
|
||||
},
|
||||
"scanner_caveat": "Alpine3.24 absent EOL list warning; actual38OS+6Python detectors ran. Zero means this verified DB snapshot, not unknown-future assurance or estate risk grade.",
|
||||
"sbom_count": 44,
|
||||
"sbom_only_delta": {
|
||||
"zlib": [
|
||||
"1.3.2-r0",
|
||||
"1.3.2-r1"
|
||||
]
|
||||
},
|
||||
"final_changed_files": [
|
||||
"lib/apk/db/installed",
|
||||
"usr/lib/libz.so.1.3.2"
|
||||
],
|
||||
"directory_count": 313,
|
||||
"directory_metadata_delta": {},
|
||||
"app_files_identical": 36,
|
||||
"installed_UID": 10001,
|
||||
"installed_GID": 10001,
|
||||
"policy_sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62",
|
||||
"policy_mode": "0o644",
|
||||
"policy_UID": 0,
|
||||
"candidate_image_executed": true,
|
||||
"public_registry_layer_readback": true,
|
||||
"native_provider_test": false,
|
||||
"installed_purpose_variants": 10,
|
||||
"purpose_forms_allow": 2,
|
||||
"purpose_forms_refuse": 8,
|
||||
"runtime_readonly_networknone": true,
|
||||
"native_workload_or_database_or_snapshot_or_credentials_accessed": false,
|
||||
"native_rollout": false,
|
||||
"founder_release_approval": false,
|
||||
"risk_followthrough": "T05 remains active; manual review due2026-10-18, no controller or estate risk grade. Actual native installation/fresh scoped founder decision still required before closure.",
|
||||
"verification_refinement": "First run used registry config as daemon handle and refused before candidate execution125. Corrected by independently proving loaded daemon ID semantics+diffIDs exact, then executed. Not actual image failure.",
|
||||
"evidence_sha256": {
|
||||
"artifact-comparison.json": "a1c5d9e249dc00600449998360faf6e8da0206b568c76d155602c4645fa5fce4",
|
||||
"base-image-config.json": "4ad7249c75fd9fc039ceb186772419e1cba5fd9759c404556459c80a2d285d10",
|
||||
"base-image-manifest.json": "978c575d3c7bf0de39dbe4e9567c39cd36f70b7e55bc17357bdb03fb3b96b0fb",
|
||||
"base-runtime.json": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24",
|
||||
"base-sbom.cdx.json": "dd7d64c9571391acd4d1f86c6026a1b094abab4ee56e5a9f799ec2fd3c7d915a",
|
||||
"base-sbom.cdx.json.log": "8ab4473a5f74b36e82a4095e9c8d6e66d80aec64bd1cebd6c9f6734531869fca",
|
||||
"base-trivy-full.json": "3e91a3001adb008cec37d9ae3c08342f5d43c8ba0111eee75c63a6a7918808a9",
|
||||
"base-trivy-full.json.log": "96a48dc39f7d674b4954d5fa98a76645528ec0fe705782fe114e3b4b9d776862",
|
||||
"candidate-runtime.json": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124",
|
||||
"ci-publication-observation.json": "ffe6f2508bc9bebbdc85ac63eae5765562efbb8e920cc85b8da30a12ee1e4b17",
|
||||
"image-config.json": "253ab359013aeb3457d2abe0852bacd33697f973dd32c1b5738800e5dc633f43",
|
||||
"image-manifest.json": "9ca2abec6a26d9a9f802dfe75efa8bffdc28485e6bcaf525cc9b075df3700194",
|
||||
"installed-purpose.json": "312312c6f0bd2751401b3bc5bcd30ee6af01ed7cb380f85b863d03b0c7e9d1ad",
|
||||
"loaded-daemon-image-proof.json": "2e5c043a101d75e4c569adb6bc2f09020679b28ed2ad836c954f7d27101ce719",
|
||||
"publication-digest.json": "ca2a1dec38db8c5fbbc00ef4f27aa865edbbd4a7ca9dc21b2ba023664c507f38",
|
||||
"read_public_artifact.py": "eaa31da1ebb2095ea5e1bc7c570311cc4747f0d7f718034dad934351d1920daf",
|
||||
"registry-proof.json": "3ef52d9e4800fc9bd238072241dc15f13a0260ee3df1e82e6f63e72902749d92",
|
||||
"run_published_runtime.py": "d9bd33fecd2a98c2381b4ba2dce12b5c3d9a69faa5e350291924fc885f5e775f",
|
||||
"run_published_scan.py": "2583ab96350412fb3f20b5b05ded0949eb3ee8e5c0e8923a9c2c42d419d36639",
|
||||
"runtime-comparison.json": "993b80b9285e227a0bdfde4927cd2f053bcc4a58dd9bd1b633ac7a4637d6713c",
|
||||
"runtime-receipt.json": "6442676dcfd941f0a05a4cb79a02dea839fcd332d82b2154c15cf6db68de5889",
|
||||
"sbom.cdx.json": "4202263059780eae0448328044c1cf68b59758f329ae6bc981d916610527eae3",
|
||||
"sbom.cdx.json.log": "51873b37a0846ee1a618ea7591d79809dc0f8624f77a03fae7af953bcbd7282f",
|
||||
"scan-receipt.json": "aaaa91061bb036e6d228b1c1bd4333578dc948cb2bb5ac8ba269429121e7321a",
|
||||
"source-commit-proof.json": "b0811da2d3bd5938733f0078e5fec8e19a6d9752c4277b80bfe9837ed72c6a3b",
|
||||
"trivy-full.json": "2ff68e765b9c65292611d5a969202a7654637168edefcedac5d2c7634009edae",
|
||||
"trivy-full.json.log": "b3419af860d264449f61986f562491edaead27dfd3638ceabe94b4fe177f4bf1"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,286 @@
|
|||
{
|
||||
"apiVersion": "apps/v1",
|
||||
"kind": "Deployment",
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"argocd.argoproj.io/tracking-id": "informed-decision:apps/Deployment:informed-decision/informed-decision",
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision",
|
||||
"uid": "a588e10a-90d2-4883-975e-6dd8b8feca92"
|
||||
},
|
||||
"spec": {
|
||||
"progressDeadlineSeconds": 600,
|
||||
"replicas": 1,
|
||||
"revisionHistoryLimit": 10,
|
||||
"selector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"strategy": {
|
||||
"type": "Recreate"
|
||||
},
|
||||
"template": {
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"labels": {
|
||||
"app.kubernetes.io/component": "review",
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"automountServiceAccountToken": false,
|
||||
"containers": [
|
||||
{
|
||||
"env": [
|
||||
{
|
||||
"name": "INFD_KEYCAPE_ISSUER",
|
||||
"value": "https://kc.coulomb.social"
|
||||
},
|
||||
{
|
||||
"name": "INFD_CONTAINER_CONFIG",
|
||||
"value": "/configuration/runtime.json"
|
||||
}
|
||||
],
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"imagePullPolicy": "IfNotPresent",
|
||||
"livenessProbe": {
|
||||
"failureThreshold": 3,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"name": "informed-decision",
|
||||
"ports": [
|
||||
{
|
||||
"containerPort": 8080,
|
||||
"name": "http",
|
||||
"protocol": "TCP"
|
||||
},
|
||||
{
|
||||
"containerPort": 8081,
|
||||
"name": "workload",
|
||||
"protocol": "TCP"
|
||||
}
|
||||
],
|
||||
"readinessProbe": {
|
||||
"failureThreshold": 3,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"resources": {
|
||||
"limits": {
|
||||
"cpu": "500m",
|
||||
"memory": "256Mi"
|
||||
},
|
||||
"requests": {
|
||||
"cpu": "5m",
|
||||
"memory": "64Mi"
|
||||
}
|
||||
},
|
||||
"securityContext": {
|
||||
"allowPrivilegeEscalation": false,
|
||||
"capabilities": {
|
||||
"drop": [
|
||||
"ALL"
|
||||
]
|
||||
},
|
||||
"readOnlyRootFilesystem": true
|
||||
},
|
||||
"startupProbe": {
|
||||
"failureThreshold": 12,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"terminationMessagePath": "/dev/termination-log",
|
||||
"terminationMessagePolicy": "File",
|
||||
"volumeMounts": [
|
||||
{
|
||||
"mountPath": "/data",
|
||||
"name": "data"
|
||||
},
|
||||
{
|
||||
"mountPath": "/run/informed-decision",
|
||||
"name": "runtime"
|
||||
},
|
||||
{
|
||||
"mountPath": "/tmp",
|
||||
"name": "tmp"
|
||||
},
|
||||
{
|
||||
"mountPath": "/configuration",
|
||||
"name": "configuration",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/policy",
|
||||
"name": "caller",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/audit",
|
||||
"name": "audit",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/kubernetes",
|
||||
"name": "kubernetes-api",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/workload-registry",
|
||||
"name": "workload-registry",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/requester",
|
||||
"name": "sitting-requester",
|
||||
"readOnly": true
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"dnsPolicy": "ClusterFirst",
|
||||
"restartPolicy": "Always",
|
||||
"schedulerName": "default-scheduler",
|
||||
"securityContext": {
|
||||
"fsGroup": 10001,
|
||||
"fsGroupChangePolicy": "OnRootMismatch",
|
||||
"runAsGroup": 10001,
|
||||
"runAsNonRoot": true,
|
||||
"runAsUser": 10001,
|
||||
"seccompProfile": {
|
||||
"type": "RuntimeDefault"
|
||||
}
|
||||
},
|
||||
"serviceAccount": "review",
|
||||
"serviceAccountName": "review",
|
||||
"terminationGracePeriodSeconds": 45,
|
||||
"volumes": [
|
||||
{
|
||||
"name": "data",
|
||||
"persistentVolumeClaim": {
|
||||
"claimName": "informed-decision-data"
|
||||
}
|
||||
},
|
||||
{
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
},
|
||||
"name": "runtime"
|
||||
},
|
||||
{
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
},
|
||||
"name": "tmp"
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"defaultMode": 292,
|
||||
"name": "informed-decision-runtime-6c221878d051"
|
||||
},
|
||||
"name": "configuration"
|
||||
},
|
||||
{
|
||||
"name": "caller",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"audience": "flex-auth",
|
||||
"expirationSeconds": 3600,
|
||||
"path": "token"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "audit",
|
||||
"secret": {
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "token",
|
||||
"path": "token"
|
||||
}
|
||||
],
|
||||
"secretName": "informed-decision-audit"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "kubernetes-api",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"expirationSeconds": 600,
|
||||
"path": "token"
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"items": [
|
||||
{
|
||||
"key": "ca.crt",
|
||||
"path": "ca.crt"
|
||||
}
|
||||
],
|
||||
"name": "kube-root-ca.crt"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"defaultMode": 292,
|
||||
"name": "informed-decision-workload-registry"
|
||||
},
|
||||
"name": "workload-registry"
|
||||
},
|
||||
{
|
||||
"name": "sitting-requester",
|
||||
"secret": {
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "client-secret",
|
||||
"path": "client-secret"
|
||||
}
|
||||
],
|
||||
"optional": false,
|
||||
"secretName": "informed-decision-sitting-requester"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
{
|
||||
"revision": "9b4bb25d325698ae543e7e8a8a3c3592db1f58fc",
|
||||
"published_digest": "sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"verified_registry_config_digest": "sha256:622becc3ebd97cb66b6e7c36f35bf931a7decd9464b65851123c1cc8c998d75b",
|
||||
"executed_loaded_daemon_id": "sha256:f2e07e3dd839b55afd5d517243a765a26965325e4e6750f508771ad556bd6d01",
|
||||
"image_source": "actual anonymous verified descriptor/layer archive loaded locally",
|
||||
"candidate_image_executed": true,
|
||||
"network": "none",
|
||||
"read_only_root": true,
|
||||
"memory": "128MiB",
|
||||
"cpus": 1,
|
||||
"checker_source": "exact gitshow pinnedcommit",
|
||||
"native_provider_test": false,
|
||||
"native_workload_changed": false,
|
||||
"database_or_admin_or_provider_credentials": false,
|
||||
"verified_utc": "2026-10-11T09:39:37.502275+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,170 @@
|
|||
{
|
||||
"scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
|
||||
"db_sha256": "03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917",
|
||||
"db_metadata": {
|
||||
"Version": 2,
|
||||
"NextUpdate": "2026-10-11T18:59:50.889010572Z",
|
||||
"UpdatedAt": "2026-10-10T18:59:50.889010923Z",
|
||||
"DownloadedAt": "2026-10-10T23:32:32.380033131Z"
|
||||
},
|
||||
"same_fresh_db_both_images": true,
|
||||
"no_suppression": true,
|
||||
"records": [
|
||||
{
|
||||
"archive": "base-image.tar",
|
||||
"format": "json",
|
||||
"started_utc": "2026-10-11T09:38:34.774672+00:00",
|
||||
"exit_code": 0,
|
||||
"command": [
|
||||
"docker",
|
||||
"--config",
|
||||
"/tmp/infd-purpose-published-verification/empty-docker-config",
|
||||
"--host",
|
||||
"unix:///var/run/docker.sock",
|
||||
"run",
|
||||
"--rm",
|
||||
"--network",
|
||||
"none",
|
||||
"--cpus",
|
||||
"1",
|
||||
"--memory",
|
||||
"1g",
|
||||
"-v",
|
||||
"/tmp/infd-zlib-published-9b4bb25d:/artifact",
|
||||
"-v",
|
||||
"/tmp/infd-zlib-published-scan-cache:/cache",
|
||||
"aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
|
||||
"image",
|
||||
"--input",
|
||||
"/artifact/base-image.tar",
|
||||
"--cache-dir",
|
||||
"/cache",
|
||||
"--skip-db-update",
|
||||
"--skip-java-db-update",
|
||||
"--scanners",
|
||||
"vuln",
|
||||
"--format",
|
||||
"json",
|
||||
"--output",
|
||||
"/artifact/base-trivy-full.json"
|
||||
]
|
||||
},
|
||||
{
|
||||
"archive": "base-image.tar",
|
||||
"format": "cyclonedx",
|
||||
"started_utc": "2026-10-11T09:38:38.856254+00:00",
|
||||
"exit_code": 0,
|
||||
"command": [
|
||||
"docker",
|
||||
"--config",
|
||||
"/tmp/infd-purpose-published-verification/empty-docker-config",
|
||||
"--host",
|
||||
"unix:///var/run/docker.sock",
|
||||
"run",
|
||||
"--rm",
|
||||
"--network",
|
||||
"none",
|
||||
"--cpus",
|
||||
"1",
|
||||
"--memory",
|
||||
"1g",
|
||||
"-v",
|
||||
"/tmp/infd-zlib-published-9b4bb25d:/artifact",
|
||||
"-v",
|
||||
"/tmp/infd-zlib-published-scan-cache:/cache",
|
||||
"aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
|
||||
"image",
|
||||
"--input",
|
||||
"/artifact/base-image.tar",
|
||||
"--cache-dir",
|
||||
"/cache",
|
||||
"--skip-db-update",
|
||||
"--skip-java-db-update",
|
||||
"--scanners",
|
||||
"vuln",
|
||||
"--format",
|
||||
"cyclonedx",
|
||||
"--output",
|
||||
"/artifact/base-sbom.cdx.json"
|
||||
]
|
||||
},
|
||||
{
|
||||
"archive": "image.tar",
|
||||
"format": "json",
|
||||
"started_utc": "2026-10-11T09:38:39.729798+00:00",
|
||||
"exit_code": 0,
|
||||
"command": [
|
||||
"docker",
|
||||
"--config",
|
||||
"/tmp/infd-purpose-published-verification/empty-docker-config",
|
||||
"--host",
|
||||
"unix:///var/run/docker.sock",
|
||||
"run",
|
||||
"--rm",
|
||||
"--network",
|
||||
"none",
|
||||
"--cpus",
|
||||
"1",
|
||||
"--memory",
|
||||
"1g",
|
||||
"-v",
|
||||
"/tmp/infd-zlib-published-9b4bb25d:/artifact",
|
||||
"-v",
|
||||
"/tmp/infd-zlib-published-scan-cache:/cache",
|
||||
"aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
|
||||
"image",
|
||||
"--input",
|
||||
"/artifact/image.tar",
|
||||
"--cache-dir",
|
||||
"/cache",
|
||||
"--skip-db-update",
|
||||
"--skip-java-db-update",
|
||||
"--scanners",
|
||||
"vuln",
|
||||
"--format",
|
||||
"json",
|
||||
"--output",
|
||||
"/artifact/trivy-full.json"
|
||||
]
|
||||
},
|
||||
{
|
||||
"archive": "image.tar",
|
||||
"format": "cyclonedx",
|
||||
"started_utc": "2026-10-11T09:38:40.675048+00:00",
|
||||
"exit_code": 0,
|
||||
"command": [
|
||||
"docker",
|
||||
"--config",
|
||||
"/tmp/infd-purpose-published-verification/empty-docker-config",
|
||||
"--host",
|
||||
"unix:///var/run/docker.sock",
|
||||
"run",
|
||||
"--rm",
|
||||
"--network",
|
||||
"none",
|
||||
"--cpus",
|
||||
"1",
|
||||
"--memory",
|
||||
"1g",
|
||||
"-v",
|
||||
"/tmp/infd-zlib-published-9b4bb25d:/artifact",
|
||||
"-v",
|
||||
"/tmp/infd-zlib-published-scan-cache:/cache",
|
||||
"aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
|
||||
"image",
|
||||
"--input",
|
||||
"/artifact/image.tar",
|
||||
"--cache-dir",
|
||||
"/cache",
|
||||
"--skip-db-update",
|
||||
"--skip-java-db-update",
|
||||
"--scanners",
|
||||
"vuln",
|
||||
"--format",
|
||||
"cyclonedx",
|
||||
"--output",
|
||||
"/artifact/sbom.cdx.json"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,286 @@
|
|||
{
|
||||
"apiVersion": "apps/v1",
|
||||
"kind": "Deployment",
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"argocd.argoproj.io/tracking-id": "informed-decision:apps/Deployment:informed-decision/informed-decision",
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision",
|
||||
"uid": "a588e10a-90d2-4883-975e-6dd8b8feca92"
|
||||
},
|
||||
"spec": {
|
||||
"progressDeadlineSeconds": 600,
|
||||
"replicas": 1,
|
||||
"revisionHistoryLimit": 10,
|
||||
"selector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"strategy": {
|
||||
"type": "Recreate"
|
||||
},
|
||||
"template": {
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"labels": {
|
||||
"app.kubernetes.io/component": "review",
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"automountServiceAccountToken": false,
|
||||
"containers": [
|
||||
{
|
||||
"env": [
|
||||
{
|
||||
"name": "INFD_KEYCAPE_ISSUER",
|
||||
"value": "https://kc.coulomb.social"
|
||||
},
|
||||
{
|
||||
"name": "INFD_CONTAINER_CONFIG",
|
||||
"value": "/configuration/runtime.json"
|
||||
}
|
||||
],
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"imagePullPolicy": "IfNotPresent",
|
||||
"livenessProbe": {
|
||||
"failureThreshold": 3,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"name": "informed-decision",
|
||||
"ports": [
|
||||
{
|
||||
"containerPort": 8080,
|
||||
"name": "http",
|
||||
"protocol": "TCP"
|
||||
},
|
||||
{
|
||||
"containerPort": 8081,
|
||||
"name": "workload",
|
||||
"protocol": "TCP"
|
||||
}
|
||||
],
|
||||
"readinessProbe": {
|
||||
"failureThreshold": 3,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"resources": {
|
||||
"limits": {
|
||||
"cpu": "500m",
|
||||
"memory": "256Mi"
|
||||
},
|
||||
"requests": {
|
||||
"cpu": "5m",
|
||||
"memory": "64Mi"
|
||||
}
|
||||
},
|
||||
"securityContext": {
|
||||
"allowPrivilegeEscalation": false,
|
||||
"capabilities": {
|
||||
"drop": [
|
||||
"ALL"
|
||||
]
|
||||
},
|
||||
"readOnlyRootFilesystem": true
|
||||
},
|
||||
"startupProbe": {
|
||||
"failureThreshold": 12,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"terminationMessagePath": "/dev/termination-log",
|
||||
"terminationMessagePolicy": "File",
|
||||
"volumeMounts": [
|
||||
{
|
||||
"mountPath": "/data",
|
||||
"name": "data"
|
||||
},
|
||||
{
|
||||
"mountPath": "/run/informed-decision",
|
||||
"name": "runtime"
|
||||
},
|
||||
{
|
||||
"mountPath": "/tmp",
|
||||
"name": "tmp"
|
||||
},
|
||||
{
|
||||
"mountPath": "/configuration",
|
||||
"name": "configuration",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/policy",
|
||||
"name": "caller",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/audit",
|
||||
"name": "audit",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/kubernetes",
|
||||
"name": "kubernetes-api",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/workload-registry",
|
||||
"name": "workload-registry",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/requester",
|
||||
"name": "sitting-requester",
|
||||
"readOnly": true
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"dnsPolicy": "ClusterFirst",
|
||||
"restartPolicy": "Always",
|
||||
"schedulerName": "default-scheduler",
|
||||
"securityContext": {
|
||||
"fsGroup": 10001,
|
||||
"fsGroupChangePolicy": "OnRootMismatch",
|
||||
"runAsGroup": 10001,
|
||||
"runAsNonRoot": true,
|
||||
"runAsUser": 10001,
|
||||
"seccompProfile": {
|
||||
"type": "RuntimeDefault"
|
||||
}
|
||||
},
|
||||
"serviceAccount": "review",
|
||||
"serviceAccountName": "review",
|
||||
"terminationGracePeriodSeconds": 45,
|
||||
"volumes": [
|
||||
{
|
||||
"name": "data",
|
||||
"persistentVolumeClaim": {
|
||||
"claimName": "informed-decision-data"
|
||||
}
|
||||
},
|
||||
{
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
},
|
||||
"name": "runtime"
|
||||
},
|
||||
{
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
},
|
||||
"name": "tmp"
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"defaultMode": 292,
|
||||
"name": "informed-decision-runtime-6c221878d051"
|
||||
},
|
||||
"name": "configuration"
|
||||
},
|
||||
{
|
||||
"name": "caller",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"audience": "flex-auth",
|
||||
"expirationSeconds": 3600,
|
||||
"path": "token"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "audit",
|
||||
"secret": {
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "token",
|
||||
"path": "token"
|
||||
}
|
||||
],
|
||||
"secretName": "informed-decision-audit"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "kubernetes-api",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"expirationSeconds": 600,
|
||||
"path": "token"
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"items": [
|
||||
{
|
||||
"key": "ca.crt",
|
||||
"path": "ca.crt"
|
||||
}
|
||||
],
|
||||
"name": "kube-root-ca.crt"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"defaultMode": 292,
|
||||
"name": "informed-decision-workload-registry"
|
||||
},
|
||||
"name": "workload-registry"
|
||||
},
|
||||
{
|
||||
"name": "sitting-requester",
|
||||
"secret": {
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "client-secret",
|
||||
"path": "client-secret"
|
||||
}
|
||||
],
|
||||
"optional": false,
|
||||
"secretName": "informed-decision-sitting-requester"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,52 @@
|
|||
{
|
||||
"configmap": {
|
||||
"apiVersion": "v1",
|
||||
"immutable": true,
|
||||
"kind": "ConfigMap",
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"argocd.argoproj.io/tracking-id": "informed-decision:/ConfigMap:informed-decision/informed-decision-runtime-6c221878d051",
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"name": "informed-decision-runtime-6c221878d051",
|
||||
"namespace": "informed-decision",
|
||||
"uid": "90113d2d-54d9-4e82-b1d3-90b49ebed2b5"
|
||||
},
|
||||
"canonical_data_sha256": "8ec462d12347548f506eeebf1e3c7cc47648019c8a783804d09bcc79b0f22af6"
|
||||
},
|
||||
"pvc": {
|
||||
"apiVersion": "v1",
|
||||
"kind": "PersistentVolumeClaim",
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"argocd.argoproj.io/tracking-id": "informed-decision:/PersistentVolumeClaim:informed-decision/informed-decision-data",
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover",
|
||||
"pv.kubernetes.io/bind-completed": "yes",
|
||||
"pv.kubernetes.io/bound-by-controller": "yes",
|
||||
"volume.beta.kubernetes.io/storage-provisioner": "rancher.io/local-path",
|
||||
"volume.kubernetes.io/selected-node": "239.62.205.92.host.secureserver.net",
|
||||
"volume.kubernetes.io/storage-provisioner": "rancher.io/local-path"
|
||||
},
|
||||
"finalizers": [
|
||||
"kubernetes.io/pvc-protection"
|
||||
],
|
||||
"name": "informed-decision-data",
|
||||
"namespace": "informed-decision",
|
||||
"uid": "d80b25b1-141a-441b-b205-98fa2fd98b7c"
|
||||
},
|
||||
"spec": {
|
||||
"accessModes": [
|
||||
"ReadWriteOnce"
|
||||
],
|
||||
"resources": {
|
||||
"requests": {
|
||||
"storage": "1Gi"
|
||||
}
|
||||
},
|
||||
"storageClassName": "local-path",
|
||||
"volumeMode": "Filesystem",
|
||||
"volumeName": "pvc-d80b25b1-141a-441b-b205-98fa2fd98b7c"
|
||||
}
|
||||
},
|
||||
"pvc_phase": "Bound"
|
||||
}
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
{
|
||||
"revision": "9b4bb25d325698ae543e7e8a8a3c3592db1f58fc",
|
||||
"reviewed_manifest_sha256": "724aa4777eb1c8976d868e5f504473f4b6d58f13d750d87aefa5c8d5ca0747ec",
|
||||
"reviewed_paths": 74,
|
||||
"mismatches": [],
|
||||
"owner_read_only_git_show": true
|
||||
}
|
||||
|
|
@ -0,0 +1,95 @@
|
|||
"""Pre-open schema/integrity/count proof; stdlib only, never constructs Store."""
|
||||
import argparse
|
||||
from contextlib import closing
|
||||
import hashlib
|
||||
import os
|
||||
import re
|
||||
import stat
|
||||
import json
|
||||
from pathlib import Path
|
||||
import sqlite3
|
||||
|
||||
|
||||
def inspect_readonly(path, *, _closed_snapshot=False):
|
||||
path = Path(path)
|
||||
if not path.is_file() or path.is_symlink():
|
||||
raise ValueError('existing nonsymlink private database required')
|
||||
uri = path.resolve().as_uri() + '?mode=ro' + ('&immutable=1' if _closed_snapshot else '')
|
||||
# sqlite3.Connection context management ends transactions; it does not close.
|
||||
with closing(sqlite3.connect(uri, uri=True, timeout=5)) as db:
|
||||
db.execute('PRAGMA query_only=ON')
|
||||
db.execute('BEGIN')
|
||||
version = db.execute('PRAGMA user_version').fetchone()[0]
|
||||
if version != 5:
|
||||
raise ValueError('pre-open database is not schema5; refuse migration')
|
||||
if db.execute('PRAGMA integrity_check').fetchall() != [('ok',)]:
|
||||
raise ValueError('read-only integrity check refused')
|
||||
lifecycle = {name: db.execute('SELECT COUNT(*) FROM ' + table).fetchone()[0]
|
||||
for name, table in (('records', 'lifecycle_records'),
|
||||
('events', 'lifecycle_events'),
|
||||
('pending', 'lifecycle_pending'))}
|
||||
result = {'schema_version': version, 'lifecycle': lifecycle,
|
||||
'outbox': dict(db.execute('SELECT state,COUNT(*) FROM outbox GROUP BY state')),
|
||||
'submissions': dict(db.execute('SELECT state,COUNT(*) FROM submissions GROUP BY state')),
|
||||
'integrity': 'ok', 'read_only_pre_open': True, 'store_constructed': False}
|
||||
db.rollback()
|
||||
return result
|
||||
|
||||
|
||||
def inspect_closed_snapshot(path, expected_sha256):
|
||||
"""Only a privately retained, frozen main-file snapshot with no WAL frames.
|
||||
|
||||
Caller must establish exclusive snapshot creation/admin exit/no writer, and
|
||||
supply the recorded frozen main digest. Never use for the live database.
|
||||
Immutable SQLite reads ignore stale SHM and never create/change sidecars.
|
||||
Existing sidecars remain custody evidence; nothing is deleted/checkpointed.
|
||||
"""
|
||||
path = Path(path)
|
||||
if re.fullmatch(r'[0-9a-f]{64}', expected_sha256) is None:
|
||||
raise ValueError('exact frozen snapshot digest required')
|
||||
def metadata(target):
|
||||
info = target.lstat()
|
||||
if not stat.S_ISREG(info.st_mode) or stat.S_IMODE(info.st_mode) != 0o600 or info.st_nlink != 1:
|
||||
raise ValueError('private single-link snapshot custody required')
|
||||
return info
|
||||
main = metadata(path)
|
||||
if not 0 < main.st_size <= 512 * 1024**2:
|
||||
raise ValueError('bounded frozen snapshot required')
|
||||
def sidecars():
|
||||
identities = {}
|
||||
for suffix in ('-wal', '-shm'):
|
||||
target = Path(str(path) + suffix)
|
||||
if os.path.lexists(target):
|
||||
info = metadata(target)
|
||||
if info.st_uid != main.st_uid or info.st_gid != main.st_gid:
|
||||
raise ValueError('snapshot sidecar custody changed')
|
||||
if suffix == '-wal' and info.st_size != 0:
|
||||
raise ValueError('snapshot has WAL frames; immutable read refused')
|
||||
identities[suffix] = (info.st_dev, info.st_ino, info.st_size, info.st_mtime_ns)
|
||||
return identities
|
||||
before_sidecars = sidecars()
|
||||
def digest():
|
||||
value = hashlib.sha256()
|
||||
with path.open('rb') as stream:
|
||||
for block in iter(lambda: stream.read(1024**2), b''):
|
||||
value.update(block)
|
||||
return value.hexdigest()
|
||||
if digest() != expected_sha256:
|
||||
raise ValueError('frozen main-file digest changed before inspection')
|
||||
proof = inspect_readonly(path, _closed_snapshot=True)
|
||||
after = metadata(path)
|
||||
if (after.st_dev, after.st_ino, after.st_uid, after.st_gid, after.st_size) != (main.st_dev, main.st_ino, main.st_uid, main.st_gid, main.st_size):
|
||||
raise ValueError('frozen main-file identity changed')
|
||||
if digest() != expected_sha256 or sidecars() != before_sidecars:
|
||||
raise ValueError('frozen snapshot changed during inspection')
|
||||
return proof
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
parser = argparse.ArgumentParser(description=__doc__)
|
||||
parser.add_argument('--db', type=Path, required=True)
|
||||
args = parser.parse_args()
|
||||
try:
|
||||
print(json.dumps(inspect_readonly(args.db), sort_keys=True))
|
||||
except Exception:
|
||||
raise SystemExit('read-only schema5/integrity/count gate refused; no Store/admin open') from None
|
||||
|
|
@ -0,0 +1,342 @@
|
|||
[
|
||||
{
|
||||
"path": "deploy/lifecycle/admission.candidate.json",
|
||||
"sha256": "6c76cedd0abc4a4261cfcb69c6597611c282bd4fed8b6aaf77aff04fdf942529",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/deploy/lifecycle/admission.candidate.json"
|
||||
},
|
||||
{
|
||||
"path": "deploy/lifecycle/kustomization.yaml",
|
||||
"sha256": "1bbce81bc6758434354157f8601534320c5d0290587908fd15a6d25e3fa57f47",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/deploy/lifecycle/kustomization.yaml"
|
||||
},
|
||||
{
|
||||
"path": "deploy/lifecycle/registries.candidate.json",
|
||||
"sha256": "9bad6db5fbc2178d31b04120016a41830c3552fbb9e2517b718f9bbe87cf649e",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/deploy/lifecycle/registries.candidate.json"
|
||||
},
|
||||
{
|
||||
"path": "deploy/lifecycle/service.candidate.json",
|
||||
"sha256": "383332cd4fd27a8b36e63a4d79addc43eb68615f742328d4577bfc2b467e2278",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/deploy/lifecycle/service.candidate.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/artifact-comparison.json",
|
||||
"sha256": "a1c5d9e249dc00600449998360faf6e8da0206b568c76d155602c4645fa5fce4",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/artifact-comparison.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/candidate-deployment.json",
|
||||
"sha256": "487f834cc86dcbc7a04c2392bde072ecaf87dc116b4baa16c35eb9c599ad5c95",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/candidate-deployment.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/candidate-runtime.json",
|
||||
"sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/candidate-runtime.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/change_guard.py",
|
||||
"sha256": "b3ee2b89de14e204efedd016d3900b6e31fcc9f0ea0f3125d3a4794d938ca201",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/change_guard.py"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/check_installed.py",
|
||||
"sha256": "a34a51be9c9f2b16a06a88173b5c6c492c9957fe021cf412a86a1737730640ad",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/check_installed.py"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/decision-packet.md",
|
||||
"sha256": "c570bade38479af93f08f717fcebb328a0db38e5b58bd0e7983681bc5ae41b7a",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/decision-packet.md"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/execution/actuator.py",
|
||||
"sha256": "dabeda33ffe52989337e214dc6e6d3ef5f04797569145faf2ff69024b101ec80",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/actuator.py"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/execution/authority_journal.py",
|
||||
"sha256": "2aa9bae40752922264e53382d898e3083b8d229b185329266942bdd397013108",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/authority_journal.py"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/execution/execution-plan.json",
|
||||
"sha256": "750a4386277dc79c3213e6aed17ae5686332bfd587a55e5e87ebf3776a63ab0c",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/execution-plan.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/execution/native_program.py",
|
||||
"sha256": "fcf8fc3593910b2e99dd51d159a30aa9b853c40ff00c566a620d20eaadc8af20",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/native_program.py"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/execution/receipt_safety.py",
|
||||
"sha256": "5c54373f2dc4b064008225c186efb1d5afdeec36d15350bda0a12ded97602d1b",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/receipt_safety.py"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/execution/test_execution.py",
|
||||
"sha256": "7458222049d8df2f01f2ce359b5864ae41cd73054ee59659ca8cd8ac17cf73ac",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/test_execution.py"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/execution-bundle.json",
|
||||
"sha256": "09b0a8ed6c3c7d1e94f5f703a2d5834ca26fc166cfc8f4f9b4511ab70ec16ac9",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution-bundle.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/fresh-scan-receipt-template.json",
|
||||
"sha256": "92bbf8a891c7ef78df48430901219d8d07073cba74112a307a6d8bdec509e8dd",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/fresh-scan-receipt-template.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/archive-map.json",
|
||||
"sha256": "44be75acb94d8125efb9416dea91059aeeb79625d23c7959bdc099a95c26a9ca",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/archive-map.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/original-manifest.json",
|
||||
"sha256": "7ac1d698cab2dfbde6bc0a84bcadd2c3229d24f4a4a59125fe72b2856fa82e07",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/original-manifest.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/deploy/lifecycle/admission.candidate.json",
|
||||
"sha256": "6c76cedd0abc4a4261cfcb69c6597611c282bd4fed8b6aaf77aff04fdf942529",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/deploy/lifecycle/admission.candidate.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/deploy/lifecycle/kustomization.yaml",
|
||||
"sha256": "1bbce81bc6758434354157f8601534320c5d0290587908fd15a6d25e3fa57f47",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/deploy/lifecycle/kustomization.yaml"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/deploy/lifecycle/registries.candidate.json",
|
||||
"sha256": "9bad6db5fbc2178d31b04120016a41830c3552fbb9e2517b718f9bbe87cf649e",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/deploy/lifecycle/registries.candidate.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/deploy/lifecycle/service.candidate.json",
|
||||
"sha256": "383332cd4fd27a8b36e63a4d79addc43eb68615f742328d4577bfc2b467e2278",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/deploy/lifecycle/service.candidate.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/artifact-comparison.json",
|
||||
"sha256": "a1c5d9e249dc00600449998360faf6e8da0206b568c76d155602c4645fa5fce4",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/artifact-comparison.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/candidate-deployment.json",
|
||||
"sha256": "487f834cc86dcbc7a04c2392bde072ecaf87dc116b4baa16c35eb9c599ad5c95",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/candidate-deployment.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/candidate-runtime.json",
|
||||
"sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/candidate-runtime.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/change_guard.py",
|
||||
"sha256": "b3ee2b89de14e204efedd016d3900b6e31fcc9f0ea0f3125d3a4794d938ca201",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/change_guard.py"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/check_installed.py",
|
||||
"sha256": "a34a51be9c9f2b16a06a88173b5c6c492c9957fe021cf412a86a1737730640ad",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/check_installed.py"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/decision-packet.md",
|
||||
"sha256": "763f30c1433d1ca872b029519ec46ad1b97c47d60b7ea0eea0275a2c6b647dc3",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/decision-packet.md"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/actuator.py",
|
||||
"sha256": "741b490bdb315896f05f2e91404c02765517dc1beea81fa590017fccafd299b4",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/actuator.py"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/authority_journal.py",
|
||||
"sha256": "040144321c69622c223a8437832a3c5a4a9595fc37774fde5ff0ad676828ebf0",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/authority_journal.py"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/execution-plan.json",
|
||||
"sha256": "9b458e2b4d418525987b6cb1b9a160c4b1a2c621625c1b5c571ea5c77e9d4361",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/execution-plan.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/native_program.py",
|
||||
"sha256": "fcf8fc3593910b2e99dd51d159a30aa9b853c40ff00c566a620d20eaadc8af20",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/native_program.py"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/receipt_safety.py",
|
||||
"sha256": "5c54373f2dc4b064008225c186efb1d5afdeec36d15350bda0a12ded97602d1b",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/receipt_safety.py"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/test_execution.py",
|
||||
"sha256": "aa86921fe37fcff382676490f937af2e62bd6472a6b4700c862aaf3ce4ab8225",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/test_execution.py"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/installed-zlib-proof.json",
|
||||
"sha256": "6af62f86f50ac185fab94163c24ac8150ead69e62f8d825b0dce1e75a5a57b68",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/installed-zlib-proof.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/memo.json",
|
||||
"sha256": "3c76c6a8f95dcb55183583a937a4428b745a5c918643de8f2a2bc11dee846d98",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/memo.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/native-backup-restore-protocol.md",
|
||||
"sha256": "f586a511c1921490185bab95334f27de6d3cca20b348df20d18bcb9257d7ae35",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/native-backup-restore-protocol.md"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/native-preflight.json",
|
||||
"sha256": "56637994dfdae46a6f9ab442c2ff9b259212650b35eb98d896c5e837f01ce2f9",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/native-preflight.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/proposal.json",
|
||||
"sha256": "48b0f0baf4efc239111411ad7d1c291f8eceaa0ddf1414dac73d49ccdb3bbe70",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/proposal.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/published-verification.json",
|
||||
"sha256": "dd4eecf0c103dca7922094a8beeb99b77ae96fd1d5fe532e37bd833daa02614e",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/published-verification.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/rollback-deployment.json",
|
||||
"sha256": "f8a9a07abc2eb52cdf6bcdba2d9f79dec073145c31d0444a9e0fe1147e42cc4e",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/rollback-deployment.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/runtime-receipt.json",
|
||||
"sha256": "6442676dcfd941f0a05a4cb79a02dea839fcd332d82b2154c15cf6db68de5889",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/runtime-receipt.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/scan-receipt.json",
|
||||
"sha256": "aaaa91061bb036e6d228b1c1bd4333578dc948cb2bb5ac8ba269429121e7321a",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/scan-receipt.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/sealed-live-deployment.json",
|
||||
"sha256": "f8a9a07abc2eb52cdf6bcdba2d9f79dec073145c31d0444a9e0fe1147e42cc4e",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/sealed-live-deployment.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/sealed-native-dependencies.json",
|
||||
"sha256": "042327a036ed254cf95dbeb0c056ac25b03a6a844b95a332c992df2943691369",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/sealed-native-dependencies.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/source-commit-proof.json",
|
||||
"sha256": "b0811da2d3bd5938733f0078e5fec8e19a6d9752c4277b80bfe9837ed72c6a3b",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/source-commit-proof.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/sqlite_readonly.py",
|
||||
"sha256": "9093c64f7f0e39b249da9fefdf5aaf4e4258bc31e7a27fd888479ce329a20509",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/sqlite_readonly.py"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/installed-zlib-proof.json",
|
||||
"sha256": "6af62f86f50ac185fab94163c24ac8150ead69e62f8d825b0dce1e75a5a57b68",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/installed-zlib-proof.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/intake.json",
|
||||
"sha256": "8154c90745d860b2984e4616f0bb1c35889b07b7ff8b841e7430db7592a15b7a",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/intake.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/lifecycle-commands.json",
|
||||
"sha256": "196e2cef9ba38f075b458f164f05b5df594d188ee84b210744ef94c31f753294",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/lifecycle-commands.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/memo.json",
|
||||
"sha256": "15b3fc9c708593adb52d9eb240c1a6b55d5ac43b1637b8047499f15e525e368f",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/memo.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/native-backup-restore-protocol.md",
|
||||
"sha256": "0614e2118927180d18f4a3fa833990a38e27340234a952abdb1d2ca93e7602a4",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/native-backup-restore-protocol.md"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/native-preflight.json",
|
||||
"sha256": "56637994dfdae46a6f9ab442c2ff9b259212650b35eb98d896c5e837f01ce2f9",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/native-preflight.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/post-ready-native-outcomes-command.py",
|
||||
"sha256": "ce88aca5e2d6cd5ab7533898bc9b246bd159482c4acccb0afe4c451ee88f57fa",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/post-ready-native-outcomes-command.py"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/proposal.json",
|
||||
"sha256": "a992d799bc07e8fbf05b894a5b184b11092f0041ee68187e59a23c5395b263e9",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/proposal.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/published-verification.json",
|
||||
"sha256": "dd4eecf0c103dca7922094a8beeb99b77ae96fd1d5fe532e37bd833daa02614e",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/published-verification.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/rollback-deployment.json",
|
||||
"sha256": "f8a9a07abc2eb52cdf6bcdba2d9f79dec073145c31d0444a9e0fe1147e42cc4e",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/rollback-deployment.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/rollback-preflight.json",
|
||||
"sha256": "0188799d352e4d49d5ca29d6e197742d02e96a4b0b399df1f478e41b25292eb5",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/rollback-preflight.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/runtime-receipt.json",
|
||||
"sha256": "6442676dcfd941f0a05a4cb79a02dea839fcd332d82b2154c15cf6db68de5889",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/runtime-receipt.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/scan-receipt.json",
|
||||
"sha256": "aaaa91061bb036e6d228b1c1bd4333578dc948cb2bb5ac8ba269429121e7321a",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/scan-receipt.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/sealed-live-deployment.json",
|
||||
"sha256": "f8a9a07abc2eb52cdf6bcdba2d9f79dec073145c31d0444a9e0fe1147e42cc4e",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/sealed-live-deployment.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/sealed-native-dependencies.json",
|
||||
"sha256": "042327a036ed254cf95dbeb0c056ac25b03a6a844b95a332c992df2943691369",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/sealed-native-dependencies.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/source-commit-proof.json",
|
||||
"sha256": "b0811da2d3bd5938733f0078e5fec8e19a6d9752c4277b80bfe9837ed72c6a3b",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/source-commit-proof.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/sqlite_readonly.py",
|
||||
"sha256": "9093c64f7f0e39b249da9fefdf5aaf4e4258bc31e7a27fd888479ce329a20509",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/sqlite_readonly.py"
|
||||
},
|
||||
{
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/submission-proof.json",
|
||||
"sha256": "4a529f57b886260f8d1b109e06e487a936fa1eb5eeb79dbbd9e4e7a05f9ae2e9",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/submission-proof.json"
|
||||
},
|
||||
{
|
||||
"path": "workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
|
||||
"sha256": "112e0aa642a7f48edf8073eee180b62d5ab6000aa4a6197ea6ffc10d7087beb0",
|
||||
"archive": "docs/evidence/2026-10-11-zlib-image-release/initial-81adb9e1/owner-snapshot/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,478 @@
|
|||
[
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/lifecycle/admission.candidate.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/deploy/lifecycle/admission.candidate.json",
|
||||
"original_sha256": "92382a56b349c3b895e5806e975082527bb99d1a001140e69d857e5b0391fa55",
|
||||
"staged_sha256": "6c76cedd0abc4a4261cfcb69c6597611c282bd4fed8b6aaf77aff04fdf942529"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/lifecycle/kustomization.yaml",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/deploy/lifecycle/kustomization.yaml",
|
||||
"original_sha256": "1bbce81bc6758434354157f8601534320c5d0290587908fd15a6d25e3fa57f47",
|
||||
"staged_sha256": "1bbce81bc6758434354157f8601534320c5d0290587908fd15a6d25e3fa57f47"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/lifecycle/registries.candidate.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/deploy/lifecycle/registries.candidate.json",
|
||||
"original_sha256": "9bad6db5fbc2178d31b04120016a41830c3552fbb9e2517b718f9bbe87cf649e",
|
||||
"staged_sha256": "9bad6db5fbc2178d31b04120016a41830c3552fbb9e2517b718f9bbe87cf649e"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/lifecycle/service.candidate.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/deploy/lifecycle/service.candidate.json",
|
||||
"original_sha256": "38b78b9cbee5ade7750a58d5156ca4c5773352e947acb304ee714b59e749ceb4",
|
||||
"staged_sha256": "383332cd4fd27a8b36e63a4d79addc43eb68615f742328d4577bfc2b467e2278"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/artifact-comparison.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/artifact-comparison.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "a1c5d9e249dc00600449998360faf6e8da0206b568c76d155602c4645fa5fce4"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/candidate-deployment.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/candidate-deployment.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "487f834cc86dcbc7a04c2392bde072ecaf87dc116b4baa16c35eb9c599ad5c95"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/candidate-runtime.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/candidate-runtime.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/change_guard.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/change_guard.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "b3ee2b89de14e204efedd016d3900b6e31fcc9f0ea0f3125d3a4794d938ca201"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/check_installed.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/check_installed.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "a34a51be9c9f2b16a06a88173b5c6c492c9957fe021cf412a86a1737730640ad"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/decision-packet.md",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/decision-packet.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "c570bade38479af93f08f717fcebb328a0db38e5b58bd0e7983681bc5ae41b7a"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/execution/actuator.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/execution/actuator.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "dabeda33ffe52989337e214dc6e6d3ef5f04797569145faf2ff69024b101ec80"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/execution/authority_journal.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/execution/authority_journal.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "2aa9bae40752922264e53382d898e3083b8d229b185329266942bdd397013108"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/execution/execution-plan.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/execution/execution-plan.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "750a4386277dc79c3213e6aed17ae5686332bfd587a55e5e87ebf3776a63ab0c"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/execution/native_program.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/execution/native_program.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "fcf8fc3593910b2e99dd51d159a30aa9b853c40ff00c566a620d20eaadc8af20"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/execution/receipt_safety.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/execution/receipt_safety.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "5c54373f2dc4b064008225c186efb1d5afdeec36d15350bda0a12ded97602d1b"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/execution/test_execution.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/execution/test_execution.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "7458222049d8df2f01f2ce359b5864ae41cd73054ee59659ca8cd8ac17cf73ac"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/execution-bundle.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/execution-bundle.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "09b0a8ed6c3c7d1e94f5f703a2d5834ca26fc166cfc8f4f9b4511ab70ec16ac9"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/fresh-scan-receipt-template.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/fresh-scan-receipt-template.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "92bbf8a891c7ef78df48430901219d8d07073cba74112a307a6d8bdec509e8dd"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/archive-map.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/archive-map.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "44be75acb94d8125efb9416dea91059aeeb79625d23c7959bdc099a95c26a9ca"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/original-manifest.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/original-manifest.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "7ac1d698cab2dfbde6bc0a84bcadd2c3229d24f4a4a59125fe72b2856fa82e07"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/deploy/lifecycle/admission.candidate.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/deploy/lifecycle/admission.candidate.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "6c76cedd0abc4a4261cfcb69c6597611c282bd4fed8b6aaf77aff04fdf942529"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/deploy/lifecycle/kustomization.yaml",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/deploy/lifecycle/kustomization.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "1bbce81bc6758434354157f8601534320c5d0290587908fd15a6d25e3fa57f47"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/deploy/lifecycle/registries.candidate.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/deploy/lifecycle/registries.candidate.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "9bad6db5fbc2178d31b04120016a41830c3552fbb9e2517b718f9bbe87cf649e"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/deploy/lifecycle/service.candidate.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/deploy/lifecycle/service.candidate.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "383332cd4fd27a8b36e63a4d79addc43eb68615f742328d4577bfc2b467e2278"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/artifact-comparison.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/artifact-comparison.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "a1c5d9e249dc00600449998360faf6e8da0206b568c76d155602c4645fa5fce4"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/candidate-deployment.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/candidate-deployment.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "487f834cc86dcbc7a04c2392bde072ecaf87dc116b4baa16c35eb9c599ad5c95"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/candidate-runtime.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/candidate-runtime.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/change_guard.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/change_guard.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "b3ee2b89de14e204efedd016d3900b6e31fcc9f0ea0f3125d3a4794d938ca201"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/check_installed.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/check_installed.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "a34a51be9c9f2b16a06a88173b5c6c492c9957fe021cf412a86a1737730640ad"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/decision-packet.md",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/decision-packet.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "763f30c1433d1ca872b029519ec46ad1b97c47d60b7ea0eea0275a2c6b647dc3"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/actuator.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/actuator.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "741b490bdb315896f05f2e91404c02765517dc1beea81fa590017fccafd299b4"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/authority_journal.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/authority_journal.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "040144321c69622c223a8437832a3c5a4a9595fc37774fde5ff0ad676828ebf0"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/execution-plan.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/execution-plan.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "9b458e2b4d418525987b6cb1b9a160c4b1a2c621625c1b5c571ea5c77e9d4361"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/native_program.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/native_program.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "fcf8fc3593910b2e99dd51d159a30aa9b853c40ff00c566a620d20eaadc8af20"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/receipt_safety.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/receipt_safety.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "5c54373f2dc4b064008225c186efb1d5afdeec36d15350bda0a12ded97602d1b"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/test_execution.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/test_execution.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "aa86921fe37fcff382676490f937af2e62bd6472a6b4700c862aaf3ce4ab8225"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/installed-zlib-proof.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/installed-zlib-proof.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "6af62f86f50ac185fab94163c24ac8150ead69e62f8d825b0dce1e75a5a57b68"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/memo.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/memo.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "3c76c6a8f95dcb55183583a937a4428b745a5c918643de8f2a2bc11dee846d98"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/native-backup-restore-protocol.md",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/native-backup-restore-protocol.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f586a511c1921490185bab95334f27de6d3cca20b348df20d18bcb9257d7ae35"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/native-preflight.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/native-preflight.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "56637994dfdae46a6f9ab442c2ff9b259212650b35eb98d896c5e837f01ce2f9"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/proposal.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/proposal.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "48b0f0baf4efc239111411ad7d1c291f8eceaa0ddf1414dac73d49ccdb3bbe70"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/published-verification.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/published-verification.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "dd4eecf0c103dca7922094a8beeb99b77ae96fd1d5fe532e37bd833daa02614e"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/rollback-deployment.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/rollback-deployment.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f8a9a07abc2eb52cdf6bcdba2d9f79dec073145c31d0444a9e0fe1147e42cc4e"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/runtime-receipt.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/runtime-receipt.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "6442676dcfd941f0a05a4cb79a02dea839fcd332d82b2154c15cf6db68de5889"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/scan-receipt.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/scan-receipt.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "aaaa91061bb036e6d228b1c1bd4333578dc948cb2bb5ac8ba269429121e7321a"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/sealed-live-deployment.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/sealed-live-deployment.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f8a9a07abc2eb52cdf6bcdba2d9f79dec073145c31d0444a9e0fe1147e42cc4e"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/sealed-native-dependencies.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/sealed-native-dependencies.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "042327a036ed254cf95dbeb0c056ac25b03a6a844b95a332c992df2943691369"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/source-commit-proof.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/source-commit-proof.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "b0811da2d3bd5938733f0078e5fec8e19a6d9752c4277b80bfe9837ed72c6a3b"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/sqlite_readonly.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/sqlite_readonly.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "9093c64f7f0e39b249da9fefdf5aaf4e4258bc31e7a27fd888479ce329a20509"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/installed-zlib-proof.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/installed-zlib-proof.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "6af62f86f50ac185fab94163c24ac8150ead69e62f8d825b0dce1e75a5a57b68"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/intake.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/intake.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "8154c90745d860b2984e4616f0bb1c35889b07b7ff8b841e7430db7592a15b7a"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/lifecycle-commands.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/lifecycle-commands.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "196e2cef9ba38f075b458f164f05b5df594d188ee84b210744ef94c31f753294"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/memo.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/memo.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "15b3fc9c708593adb52d9eb240c1a6b55d5ac43b1637b8047499f15e525e368f"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/native-backup-restore-protocol.md",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/native-backup-restore-protocol.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "0614e2118927180d18f4a3fa833990a38e27340234a952abdb1d2ca93e7602a4"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/native-preflight.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/native-preflight.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "56637994dfdae46a6f9ab442c2ff9b259212650b35eb98d896c5e837f01ce2f9"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/post-ready-native-outcomes-command.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/post-ready-native-outcomes-command.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "ce88aca5e2d6cd5ab7533898bc9b246bd159482c4acccb0afe4c451ee88f57fa"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/proposal.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/proposal.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "a992d799bc07e8fbf05b894a5b184b11092f0041ee68187e59a23c5395b263e9"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/published-verification.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/published-verification.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "dd4eecf0c103dca7922094a8beeb99b77ae96fd1d5fe532e37bd833daa02614e"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/rollback-deployment.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/rollback-deployment.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f8a9a07abc2eb52cdf6bcdba2d9f79dec073145c31d0444a9e0fe1147e42cc4e"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/rollback-preflight.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/rollback-preflight.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "0188799d352e4d49d5ca29d6e197742d02e96a4b0b399df1f478e41b25292eb5"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/runtime-receipt.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/runtime-receipt.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "6442676dcfd941f0a05a4cb79a02dea839fcd332d82b2154c15cf6db68de5889"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/scan-receipt.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/scan-receipt.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "aaaa91061bb036e6d228b1c1bd4333578dc948cb2bb5ac8ba269429121e7321a"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/sealed-live-deployment.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/sealed-live-deployment.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f8a9a07abc2eb52cdf6bcdba2d9f79dec073145c31d0444a9e0fe1147e42cc4e"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/sealed-native-dependencies.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/sealed-native-dependencies.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "042327a036ed254cf95dbeb0c056ac25b03a6a844b95a332c992df2943691369"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/source-commit-proof.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/source-commit-proof.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "b0811da2d3bd5938733f0078e5fec8e19a6d9752c4277b80bfe9837ed72c6a3b"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/sqlite_readonly.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/sqlite_readonly.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "9093c64f7f0e39b249da9fefdf5aaf4e4258bc31e7a27fd888479ce329a20509"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/submission-proof.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/submission-proof.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "4a529f57b886260f8d1b109e06e487a936fa1eb5eeb79dbbd9e4e7a05f9ae2e9"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
|
||||
"original_sha256": "af785afbf188184b72563c10813663d44117df7cb7394ecb1b9a25cbdfea67a4",
|
||||
"staged_sha256": "112e0aa642a7f48edf8073eee180b62d5ab6000aa4a6197ea6ffc10d7087beb0"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,52 @@
|
|||
{
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"policy": {
|
||||
"origin": "http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080",
|
||||
"package": "informed-decision.compact-sitting",
|
||||
"version": "v13",
|
||||
"package_digest": "sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873",
|
||||
"pod_name": "flex-auth-informed-decision-sitting"
|
||||
},
|
||||
"keycape_egress_ips": [
|
||||
"92.205.62.239"
|
||||
],
|
||||
"storage_class": "local-path",
|
||||
"ordinary_approval_ids": [
|
||||
"2ce76d7f-01c3-4b63-8476-8d1230679769",
|
||||
"c2af4bcf-15b4-4305-aac1-acc7e4dcb099",
|
||||
"dc22666a-d5d7-46bc-9490-ebe9fe09dc38"
|
||||
],
|
||||
"lifecycle_policy": {
|
||||
"package": "informed-decision.lifecycle",
|
||||
"version": "v2",
|
||||
"package_digest": "sha256:da01e045fc108adec6b489e5d51f7e57366793016c5a64776963780a6aae457c",
|
||||
"origin": "http://flex-auth-informed-decision-lifecycle.flex-auth.svc.cluster.local:8080",
|
||||
"pod_name": "flex-auth-informed-decision-lifecycle"
|
||||
},
|
||||
"lifecycle_delivery": true,
|
||||
"intake_attributes": true,
|
||||
"intake_delivery": {
|
||||
"hub_origin": "http://state-hub.state-hub.svc.cluster.local:8000"
|
||||
},
|
||||
"workload_api": {
|
||||
"registries_configmap": "informed-decision-workload-registry",
|
||||
"peers": [
|
||||
{
|
||||
"namespace": "state-hub",
|
||||
"app": "state-hub"
|
||||
}
|
||||
],
|
||||
"api_egress": [
|
||||
{
|
||||
"ip": "10.43.0.1",
|
||||
"port": 443
|
||||
},
|
||||
{
|
||||
"ip": "92.205.62.239",
|
||||
"port": 6443
|
||||
}
|
||||
],
|
||||
"intake": true,
|
||||
"lifecycle": true
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- service.candidate.json
|
||||
- registries.candidate.json
|
||||
commonAnnotations:
|
||||
informed-decision.coulomb.social/admission: approved; INFD-WP-0007 cutover
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "ConfigMap",
|
||||
"metadata": {
|
||||
"name": "informed-decision-workload-registry",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "proposal; INFD-WP-0007 concrete rollout approval required"
|
||||
}
|
||||
},
|
||||
"data": {
|
||||
"lifecycle-callers.json": "{\n \"system:serviceaccount:state-hub:state-hub\": {\n \"tenant\": \"tenant:platform\"\n }\n}\n",
|
||||
"intake-submitters.json": "{\n \"system:serviceaccount:state-hub:state-hub\": {\n \"submitter_id\": \"state-hub\",\n \"memo_classes\": [\n \"decision-record\"\n ],\n \"review_groups\": [\n \"net-kingdom-admins\"\n ],\n \"daily_limit\": 50\n }\n}\n",
|
||||
"review-groups.json": "{\n \"net-kingdom-admins\": {\n \"subject\": \"uid=platform-root,ou=people,dc=netkingdom,dc=local\",\n \"display_name\": \"Platform reviewer\"\n }\n}\n"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,800 @@
|
|||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "List",
|
||||
"items": [
|
||||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "ServiceAccount",
|
||||
"metadata": {
|
||||
"name": "review",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
||||
}
|
||||
},
|
||||
"automountServiceAccountToken": false
|
||||
},
|
||||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "PersistentVolumeClaim",
|
||||
"metadata": {
|
||||
"name": "informed-decision-data",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"accessModes": [
|
||||
"ReadWriteOnce"
|
||||
],
|
||||
"storageClassName": "local-path",
|
||||
"resources": {
|
||||
"requests": {
|
||||
"storage": "1Gi"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "ConfigMap",
|
||||
"metadata": {
|
||||
"name": "informed-decision-runtime-6c221878d051",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
||||
}
|
||||
},
|
||||
"immutable": true,
|
||||
"data": {
|
||||
"runtime.json": "{\"approval_origin\":\"http://approval-engine.approval-engine.svc.cluster.local:8080\",\"audit\":{\"origin\":\"http://audit-core.audit-core.svc.cluster.local:8080\",\"sender_token_file\":\"/var/run/secrets/informed-decision/audit/token\"},\"evidence_db\":\"/data/private/review.sqlite\",\"intake_attributes\":true,\"intake_delivery\":{\"hub_origin\":\"http://state-hub.state-hub.svc.cluster.local:8000\"},\"lifecycle_delivery\":true,\"lifecycle_policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-lifecycle.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.lifecycle\",\"package_digest\":\"sha256:da01e045fc108adec6b489e5d51f7e57366793016c5a64776963780a6aae457c\",\"version\":\"v2\"},\"ordinary_approval_ids\":[\"2ce76d7f-01c3-4b63-8476-8d1230679769\",\"c2af4bcf-15b4-4305-aac1-acc7e4dcb099\",\"dc22666a-d5d7-46bc-9490-ebe9fe09dc38\"],\"policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.compact-sitting\",\"package_digest\":\"sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873\",\"version\":\"v13\"},\"schema\":\"informed-decision.review-runtime.v1\",\"workload_api\":{\"intake\":{\"groups_file\":\"/workload-registry/review-groups.json\",\"secret_file\":\"/var/run/secrets/informed-decision/requester/client-secret\",\"submitters_file\":\"/workload-registry/intake-submitters.json\"},\"lifecycle_callers_file\":\"/workload-registry/lifecycle-callers.json\",\"token_review\":{\"ca_file\":\"/var/run/secrets/informed-decision/kubernetes/ca.crt\",\"origin\":\"https://kubernetes.default.svc:443\",\"token_file\":\"/var/run/secrets/informed-decision/kubernetes/token\"}}}"
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "apps/v1",
|
||||
"kind": "Deployment",
|
||||
"metadata": {
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"replicas": 1,
|
||||
"strategy": {
|
||||
"type": "Recreate"
|
||||
},
|
||||
"progressDeadlineSeconds": 600,
|
||||
"selector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"template": {
|
||||
"metadata": {
|
||||
"labels": {
|
||||
"app.kubernetes.io/name": "informed-decision",
|
||||
"app.kubernetes.io/component": "review"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"automountServiceAccountToken": false,
|
||||
"serviceAccountName": "review",
|
||||
"terminationGracePeriodSeconds": 45,
|
||||
"securityContext": {
|
||||
"runAsNonRoot": true,
|
||||
"runAsUser": 10001,
|
||||
"runAsGroup": 10001,
|
||||
"fsGroup": 10001,
|
||||
"fsGroupChangePolicy": "OnRootMismatch",
|
||||
"seccompProfile": {
|
||||
"type": "RuntimeDefault"
|
||||
}
|
||||
},
|
||||
"containers": [
|
||||
{
|
||||
"name": "informed-decision",
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"securityContext": {
|
||||
"allowPrivilegeEscalation": false,
|
||||
"readOnlyRootFilesystem": true,
|
||||
"capabilities": {
|
||||
"drop": [
|
||||
"ALL"
|
||||
]
|
||||
}
|
||||
},
|
||||
"env": [
|
||||
{
|
||||
"name": "INFD_KEYCAPE_ISSUER",
|
||||
"value": "https://kc.coulomb.social"
|
||||
},
|
||||
{
|
||||
"name": "INFD_CONTAINER_CONFIG",
|
||||
"value": "/configuration/runtime.json"
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"name": "http",
|
||||
"containerPort": 8080
|
||||
},
|
||||
{
|
||||
"name": "workload",
|
||||
"containerPort": 8081
|
||||
}
|
||||
],
|
||||
"startupProbe": {
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"timeoutSeconds": 2,
|
||||
"failureThreshold": 12
|
||||
},
|
||||
"readinessProbe": {
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"livenessProbe": {
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"resources": {
|
||||
"requests": {
|
||||
"cpu": "5m",
|
||||
"memory": "64Mi"
|
||||
},
|
||||
"limits": {
|
||||
"cpu": "500m",
|
||||
"memory": "256Mi"
|
||||
}
|
||||
},
|
||||
"volumeMounts": [
|
||||
{
|
||||
"name": "data",
|
||||
"mountPath": "/data"
|
||||
},
|
||||
{
|
||||
"name": "runtime",
|
||||
"mountPath": "/run/informed-decision"
|
||||
},
|
||||
{
|
||||
"name": "tmp",
|
||||
"mountPath": "/tmp"
|
||||
},
|
||||
{
|
||||
"name": "configuration",
|
||||
"mountPath": "/configuration",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"name": "caller",
|
||||
"mountPath": "/var/run/secrets/informed-decision/policy",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"name": "audit",
|
||||
"mountPath": "/var/run/secrets/informed-decision/audit",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"name": "kubernetes-api",
|
||||
"mountPath": "/var/run/secrets/informed-decision/kubernetes",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"name": "workload-registry",
|
||||
"mountPath": "/workload-registry",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"name": "sitting-requester",
|
||||
"mountPath": "/var/run/secrets/informed-decision/requester",
|
||||
"readOnly": true
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"volumes": [
|
||||
{
|
||||
"name": "data",
|
||||
"persistentVolumeClaim": {
|
||||
"claimName": "informed-decision-data"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "runtime",
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "tmp",
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "configuration",
|
||||
"configMap": {
|
||||
"name": "informed-decision-runtime-6c221878d051",
|
||||
"defaultMode": 292
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "caller",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"path": "token",
|
||||
"audience": "flex-auth",
|
||||
"expirationSeconds": 3600
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "audit",
|
||||
"secret": {
|
||||
"secretName": "informed-decision-audit",
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "token",
|
||||
"path": "token"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "kubernetes-api",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"path": "token",
|
||||
"expirationSeconds": 600
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"name": "kube-root-ca.crt",
|
||||
"items": [
|
||||
{
|
||||
"key": "ca.crt",
|
||||
"path": "ca.crt"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "workload-registry",
|
||||
"configMap": {
|
||||
"name": "informed-decision-workload-registry",
|
||||
"defaultMode": 292
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "sitting-requester",
|
||||
"secret": {
|
||||
"secretName": "informed-decision-sitting-requester",
|
||||
"defaultMode": 288,
|
||||
"optional": false,
|
||||
"items": [
|
||||
{
|
||||
"key": "client-secret",
|
||||
"path": "client-secret"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "Service",
|
||||
"metadata": {
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"type": "ClusterIP",
|
||||
"selector": {
|
||||
"app.kubernetes.io/name": "informed-decision",
|
||||
"app.kubernetes.io/component": "review"
|
||||
},
|
||||
"ports": [
|
||||
{
|
||||
"name": "http",
|
||||
"port": 80,
|
||||
"targetPort": "http",
|
||||
"protocol": "TCP"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "networking.k8s.io/v1",
|
||||
"kind": "NetworkPolicy",
|
||||
"metadata": {
|
||||
"name": "informed-decision-review",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision",
|
||||
"app.kubernetes.io/component": "review"
|
||||
}
|
||||
},
|
||||
"policyTypes": [
|
||||
"Ingress",
|
||||
"Egress"
|
||||
],
|
||||
"ingress": [
|
||||
{
|
||||
"from": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "kube-system"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "traefik"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 8080
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"from": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "state-hub"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "state-hub"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 8081
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"egress": [
|
||||
{
|
||||
"to": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "kube-system"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"k8s-app": "kube-dns"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "UDP",
|
||||
"port": 53
|
||||
},
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 53
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"to": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "approval-engine"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "approval-engine"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "audit-core"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "audit-core"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "flex-auth"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "flex-auth-informed-decision-sitting"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "flex-auth"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "flex-auth-informed-decision-lifecycle"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 8080
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"to": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "kube-system"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "traefik"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 8443
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"to": [
|
||||
{
|
||||
"ipBlock": {
|
||||
"cidr": "92.205.62.239/32"
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 443
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"to": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "state-hub"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "state-hub"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 8000
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"to": [
|
||||
{
|
||||
"ipBlock": {
|
||||
"cidr": "10.43.0.1/32"
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 443
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"to": [
|
||||
{
|
||||
"ipBlock": {
|
||||
"cidr": "92.205.62.239/32"
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 6443
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "Service",
|
||||
"metadata": {
|
||||
"name": "informed-decision-workload",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"type": "ClusterIP",
|
||||
"selector": {
|
||||
"app.kubernetes.io/name": "informed-decision",
|
||||
"app.kubernetes.io/component": "review"
|
||||
},
|
||||
"ports": [
|
||||
{
|
||||
"name": "workload",
|
||||
"port": 8081,
|
||||
"targetPort": "workload",
|
||||
"protocol": "TCP"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "rbac.authorization.k8s.io/v1",
|
||||
"kind": "ClusterRole",
|
||||
"metadata": {
|
||||
"name": "informed-decision-tokenreview",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "proposal; INFD-WP-0007/INFD-WP-0005 owner review required"
|
||||
}
|
||||
},
|
||||
"rules": [
|
||||
{
|
||||
"apiGroups": [
|
||||
"authentication.k8s.io"
|
||||
],
|
||||
"resources": [
|
||||
"tokenreviews"
|
||||
],
|
||||
"verbs": [
|
||||
"create"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"apiVersion": "rbac.authorization.k8s.io/v1",
|
||||
"kind": "ClusterRoleBinding",
|
||||
"metadata": {
|
||||
"name": "informed-decision-tokenreview",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "proposal; INFD-WP-0007/INFD-WP-0005 owner review required"
|
||||
}
|
||||
},
|
||||
"roleRef": {
|
||||
"apiGroup": "rbac.authorization.k8s.io",
|
||||
"kind": "ClusterRole",
|
||||
"name": "informed-decision-tokenreview"
|
||||
},
|
||||
"subjects": [
|
||||
{
|
||||
"kind": "ServiceAccount",
|
||||
"name": "review",
|
||||
"namespace": "informed-decision"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"apiVersion": "networking.k8s.io/v1",
|
||||
"kind": "NetworkPolicy",
|
||||
"metadata": {
|
||||
"name": "informed-decision-review-ingress",
|
||||
"namespace": "approval-engine",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08",
|
||||
"informed-decision.coulomb.social/owner-review": "APPROVAL-WP-0002-T01"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "approval-engine"
|
||||
}
|
||||
},
|
||||
"policyTypes": [
|
||||
"Ingress"
|
||||
],
|
||||
"ingress": [
|
||||
{
|
||||
"from": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision",
|
||||
"app.kubernetes.io/component": "review"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 8080
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "networking.k8s.io/v1",
|
||||
"kind": "NetworkPolicy",
|
||||
"metadata": {
|
||||
"name": "informed-decision-review-ingress",
|
||||
"namespace": "flex-auth",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08",
|
||||
"informed-decision.coulomb.social/owner-review": "INFD-WP-0001-T08 policy-owner return"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "flex-auth-informed-decision-sitting"
|
||||
}
|
||||
},
|
||||
"policyTypes": [
|
||||
"Ingress"
|
||||
],
|
||||
"ingress": [
|
||||
{
|
||||
"from": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision",
|
||||
"app.kubernetes.io/component": "review"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 8080
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "networking.k8s.io/v1",
|
||||
"kind": "NetworkPolicy",
|
||||
"metadata": {
|
||||
"name": "informed-decision-lifecycle-ingress",
|
||||
"namespace": "flex-auth",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08",
|
||||
"informed-decision.coulomb.social/owner-review": "INFD-WP-0007 lifecycle policy-owner return"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "flex-auth-informed-decision-lifecycle"
|
||||
}
|
||||
},
|
||||
"policyTypes": [
|
||||
"Ingress"
|
||||
],
|
||||
"ingress": [
|
||||
{
|
||||
"from": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision",
|
||||
"app.kubernetes.io/component": "review"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 8080
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,73 @@
|
|||
{
|
||||
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
|
||||
"candidate_local_image_config_id": "sha256:622becc3ebd97cb66b6e7c36f35bf931a7decd9464b65851123c1cc8c998d75b",
|
||||
"candidate_registry_digest": null,
|
||||
"base_layers_preserved": 9,
|
||||
"new_layers": 2,
|
||||
"effective_runtime_config_identical": true,
|
||||
"raw_config_bytes_identical": false,
|
||||
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
|
||||
"labels_before": {
|
||||
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
|
||||
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"labels_after": {
|
||||
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"org.opencontainers.image.revision": "9b4bb25d325698ae543e7e8a8a3c3592db1f58fc",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
|
||||
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"final_changed_files": {
|
||||
"lib/apk/db/installed": {
|
||||
"before": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
|
||||
]
|
||||
},
|
||||
"usr/lib/libz.so.1.3.2": {
|
||||
"before": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
|
||||
]
|
||||
}
|
||||
},
|
||||
"directory_metadata_compared": true,
|
||||
"directory_count_base": 313,
|
||||
"directory_count_candidate": 313,
|
||||
"directory_metadata_delta": {},
|
||||
"sbom_package_count_base": 44,
|
||||
"sbom_package_count_candidate": 44,
|
||||
"sbom_only_delta": {
|
||||
"zlib": [
|
||||
"1.3.2-r0",
|
||||
"1.3.2-r1"
|
||||
]
|
||||
},
|
||||
"full_scan_baseline_findings": 1,
|
||||
"full_scan_candidate_allseverity_findings": 0,
|
||||
"db_snapshot_same": true,
|
||||
"native_workload_changed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,286 @@
|
|||
{
|
||||
"apiVersion": "apps/v1",
|
||||
"kind": "Deployment",
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"argocd.argoproj.io/tracking-id": "informed-decision:apps/Deployment:informed-decision/informed-decision",
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision",
|
||||
"uid": "a588e10a-90d2-4883-975e-6dd8b8feca92"
|
||||
},
|
||||
"spec": {
|
||||
"progressDeadlineSeconds": 600,
|
||||
"replicas": 1,
|
||||
"revisionHistoryLimit": 10,
|
||||
"selector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"strategy": {
|
||||
"type": "Recreate"
|
||||
},
|
||||
"template": {
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"labels": {
|
||||
"app.kubernetes.io/component": "review",
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"automountServiceAccountToken": false,
|
||||
"containers": [
|
||||
{
|
||||
"env": [
|
||||
{
|
||||
"name": "INFD_KEYCAPE_ISSUER",
|
||||
"value": "https://kc.coulomb.social"
|
||||
},
|
||||
{
|
||||
"name": "INFD_CONTAINER_CONFIG",
|
||||
"value": "/configuration/runtime.json"
|
||||
}
|
||||
],
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"imagePullPolicy": "IfNotPresent",
|
||||
"livenessProbe": {
|
||||
"failureThreshold": 3,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"name": "informed-decision",
|
||||
"ports": [
|
||||
{
|
||||
"containerPort": 8080,
|
||||
"name": "http",
|
||||
"protocol": "TCP"
|
||||
},
|
||||
{
|
||||
"containerPort": 8081,
|
||||
"name": "workload",
|
||||
"protocol": "TCP"
|
||||
}
|
||||
],
|
||||
"readinessProbe": {
|
||||
"failureThreshold": 3,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"resources": {
|
||||
"limits": {
|
||||
"cpu": "500m",
|
||||
"memory": "256Mi"
|
||||
},
|
||||
"requests": {
|
||||
"cpu": "5m",
|
||||
"memory": "64Mi"
|
||||
}
|
||||
},
|
||||
"securityContext": {
|
||||
"allowPrivilegeEscalation": false,
|
||||
"capabilities": {
|
||||
"drop": [
|
||||
"ALL"
|
||||
]
|
||||
},
|
||||
"readOnlyRootFilesystem": true
|
||||
},
|
||||
"startupProbe": {
|
||||
"failureThreshold": 12,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"terminationMessagePath": "/dev/termination-log",
|
||||
"terminationMessagePolicy": "File",
|
||||
"volumeMounts": [
|
||||
{
|
||||
"mountPath": "/data",
|
||||
"name": "data"
|
||||
},
|
||||
{
|
||||
"mountPath": "/run/informed-decision",
|
||||
"name": "runtime"
|
||||
},
|
||||
{
|
||||
"mountPath": "/tmp",
|
||||
"name": "tmp"
|
||||
},
|
||||
{
|
||||
"mountPath": "/configuration",
|
||||
"name": "configuration",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/policy",
|
||||
"name": "caller",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/audit",
|
||||
"name": "audit",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/kubernetes",
|
||||
"name": "kubernetes-api",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/workload-registry",
|
||||
"name": "workload-registry",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/requester",
|
||||
"name": "sitting-requester",
|
||||
"readOnly": true
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"dnsPolicy": "ClusterFirst",
|
||||
"restartPolicy": "Always",
|
||||
"schedulerName": "default-scheduler",
|
||||
"securityContext": {
|
||||
"fsGroup": 10001,
|
||||
"fsGroupChangePolicy": "OnRootMismatch",
|
||||
"runAsGroup": 10001,
|
||||
"runAsNonRoot": true,
|
||||
"runAsUser": 10001,
|
||||
"seccompProfile": {
|
||||
"type": "RuntimeDefault"
|
||||
}
|
||||
},
|
||||
"serviceAccount": "review",
|
||||
"serviceAccountName": "review",
|
||||
"terminationGracePeriodSeconds": 45,
|
||||
"volumes": [
|
||||
{
|
||||
"name": "data",
|
||||
"persistentVolumeClaim": {
|
||||
"claimName": "informed-decision-data"
|
||||
}
|
||||
},
|
||||
{
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
},
|
||||
"name": "runtime"
|
||||
},
|
||||
{
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
},
|
||||
"name": "tmp"
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"defaultMode": 292,
|
||||
"name": "informed-decision-runtime-6c221878d051"
|
||||
},
|
||||
"name": "configuration"
|
||||
},
|
||||
{
|
||||
"name": "caller",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"audience": "flex-auth",
|
||||
"expirationSeconds": 3600,
|
||||
"path": "token"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "audit",
|
||||
"secret": {
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "token",
|
||||
"path": "token"
|
||||
}
|
||||
],
|
||||
"secretName": "informed-decision-audit"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "kubernetes-api",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"expirationSeconds": 600,
|
||||
"path": "token"
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"items": [
|
||||
{
|
||||
"key": "ca.crt",
|
||||
"path": "ca.crt"
|
||||
}
|
||||
],
|
||||
"name": "kube-root-ca.crt"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"defaultMode": 292,
|
||||
"name": "informed-decision-workload-registry"
|
||||
},
|
||||
"name": "workload-registry"
|
||||
},
|
||||
{
|
||||
"name": "sitting-requester",
|
||||
"secret": {
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "client-secret",
|
||||
"path": "client-secret"
|
||||
}
|
||||
],
|
||||
"optional": false,
|
||||
"secretName": "informed-decision-sitting-requester"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
File diff suppressed because one or more lines are too long
|
|
@ -0,0 +1,68 @@
|
|||
"""Read-only exact Deployment and admission boundaries; no mutation authority."""
|
||||
import copy
|
||||
import hashlib
|
||||
import json
|
||||
|
||||
BASE = 'forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a'
|
||||
CANDIDATE = 'forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23'
|
||||
|
||||
|
||||
def dependency_projection(configmap, pvc):
|
||||
if (configmap.get('kind') != 'ConfigMap' or configmap.get('immutable') is not True
|
||||
or configmap['metadata']['namespace'] != 'informed-decision'
|
||||
or configmap['metadata']['name'] != 'informed-decision-runtime-6c221878d051'
|
||||
or set(configmap.get('data', {})) != {'runtime.json'}
|
||||
or configmap.get('binaryData')):
|
||||
raise ValueError('unexpected immutable runtime config identity')
|
||||
if (pvc.get('kind') != 'PersistentVolumeClaim'
|
||||
or pvc['metadata']['namespace'] != 'informed-decision'
|
||||
or pvc['metadata']['name'] != 'informed-decision-data'
|
||||
or pvc.get('status', {}).get('phase') != 'Bound'
|
||||
or not pvc.get('spec', {}).get('volumeName')):
|
||||
raise ValueError('unexpected bound PVC custody')
|
||||
config = projection(configmap)
|
||||
config.pop('data')
|
||||
config['canonical_data_sha256'] = hashlib.sha256(json.dumps(
|
||||
configmap['data'], sort_keys=True, separators=(',', ':')).encode()).hexdigest()
|
||||
return {'configmap': config, 'pvc': projection(pvc), 'pvc_phase': 'Bound'}
|
||||
|
||||
|
||||
def check_dependencies(configmap, pvc, sealed):
|
||||
if dependency_projection(configmap, pvc) != sealed:
|
||||
raise ValueError('runtime config or PVC identity/custody changed')
|
||||
|
||||
|
||||
def projection(value):
|
||||
value = copy.deepcopy(value)
|
||||
value.pop('status', None)
|
||||
for key in ('resourceVersion', 'generation', 'creationTimestamp', 'managedFields'):
|
||||
value['metadata'].pop(key, None)
|
||||
for key in ('kubectl.kubernetes.io/last-applied-configuration', 'deployment.kubernetes.io/revision'):
|
||||
value['metadata'].get('annotations', {}).pop(key, None)
|
||||
return value
|
||||
|
||||
|
||||
def check_current(current, sealed):
|
||||
if projection(current) != sealed:
|
||||
raise ValueError('sealed live UID or configuration changed')
|
||||
|
||||
|
||||
def check_admitted(admitted, sealed):
|
||||
expected = copy.deepcopy(sealed)
|
||||
containers = expected['spec']['template']['spec']['containers']
|
||||
if len(containers) != 1 or containers[0]['name'] != 'informed-decision' or containers[0]['image'] != BASE:
|
||||
raise ValueError('unexpected baseline container identity')
|
||||
containers[0]['image'] = CANDIDATE
|
||||
if projection(admitted) != expected:
|
||||
raise ValueError('admission changed configuration beyond the sole image pin')
|
||||
|
||||
|
||||
def transport_result(exit_code, output):
|
||||
import json
|
||||
try:
|
||||
value = json.loads(output)
|
||||
except (ValueError, TypeError):
|
||||
return {'all_checks_pass': False, 'reason': 'invalid transport result'}
|
||||
if exit_code != 0 or not isinstance(value, dict) or value.get('all_checks_pass') is not True:
|
||||
return {'all_checks_pass': False, 'reason': 'read-only preflight refused'}
|
||||
return value
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
import copy,json,time
|
||||
from datetime import datetime,timezone
|
||||
from informed_decision.policy import PolicyClient,CONTRACT,submitted_digest
|
||||
pin='sha256:'+'b'*64
|
||||
req={'id':'image-purpose-fixture','tenant':'tenant:platform','subject':{'id':'synthetic','type':'service','tenant':'tenant:platform'},'resource':{'id':'memo:fixture','type':'memo','system':'informed-decision','tenant':'tenant:platform'},'action':'register','context':{}}
|
||||
class Transport:
|
||||
def request(self,*args,**kwargs):
|
||||
now=time.time(); stamp=lambda t:datetime.fromtimestamp(t,timezone.utc).isoformat()
|
||||
b={**copy.deepcopy({k:req[k] for k in ('tenant','subject','action','resource','context')}),'request_digest':'sha256:'+'e'*64,'submitted_request_digest':submitted_digest(req)}
|
||||
if self.purpose!='ABSENT':b['purpose']=self.purpose
|
||||
d={'id':'synthetic-decision','contract_version':CONTRACT,'request_id':req['id'],'effect':'allow','matched_policy_version':'v1','subject':req['subject'],'resource':req['resource'],'binding':b,'lifetime':{'kind':'ttl','not_before':stamp(now-1),'expires_at':stamp(now+60)},'provenance':{'policy_package':'fixture','policy_version':'v1','policy_package_digest':pin,'registry_snapshot_digest':'sha256:'+'c'*64,'evaluator':'flex-auth/fixture','decision_time':stamp(now)}}
|
||||
return 200,d
|
||||
checks=[]
|
||||
for purpose in ('ABSENT','','readback','enforcement','unknown',None,False,0,[],{}):
|
||||
t=Transport();t.purpose=purpose
|
||||
c=PolicyClient('https://fixture.invalid',lambda:'synthetic-only',package='fixture',version='v1',package_digest=pin,transport=t)
|
||||
o=c.check(req)
|
||||
if purpose in ('ABSENT',''):assert o.outcome=='allow';o.require_current(time.time())
|
||||
else:assert o.outcome=='invalid_decision' and o.decision_json is None
|
||||
checks.append(str(purpose))
|
||||
print(json.dumps({'installed_image_purpose_variants':len(checks),'binding_forms_allowed':2,'advisory_or_malformed_refused':8,'synthetic_only':True,'native_provider':False}))
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
# Requested decision
|
||||
|
||||
Approve the exact new T05 zlib-only image release and protected same-schema compatibility drill, after final independent Product and Platform acknowledgments. This packet is prepared and unapproved; fresh rollback server dry-run passed with exactly the baseline image and empty diff. Root retains exact final owner source revision and independent acknowledgments before asking for native founder disposition. The prior T04 approval is excluded.
|
||||
|
||||
The admitted owner CI published immutable image f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23 from source9b4bb25d325698ae543e7e8a8a3c3592db1f58fc. Its actual full scan reports zero findings across44packages. The same scan DB finds oneMEDIUM on currentimage763c. Signed official Alpine zlib1.3.2-r1 is the sole package change; actual published filesystem proof shows onlylibz andAPKinstalleddatabase changes, zero313directorymetadata changes, retainedninebaselayers and unchanged36applicationfiles/purposepolicy/config/credentials/audience/resources. Registry-to-daemon config serialization differs under closed verified normalization, without runtime change.
|
||||
|
||||
The exact ordered protected drill and release are specified in native-backup-restore-protocol.md and hash-bound execution bundle. New backup paths, isolated clone and journal are distinct from old evidence. Real private data will enter only approved private custody and the isolated no-network clone; content never enters public evidence. Failed/uncertain phase states remain durable and cannot be retried. Prior T04 failed copy/verify are preserved.
|
||||
|
||||
After schema5/integrity/exactclonecounts pass and clone cleanup succeeds, fresh cutover backup/copy precedes the exact manual image-only Deployment sync. Current baseline is healthygeneration25/image763c/Applicationc96. ImmutableCM6c/PVC/Podconfiguration/PDP origins remain sealed. FreshnodeCPU3460of4000m supports unchangedRecreate, with another check before effect. Brief availability interruption expected.
|
||||
|
||||
Rollback restores Deploymentimage763c andApplicationc96 while retaining latestschema5database; no old snapshot restoration. Separate installed/native health/custody/PDP-gated readback and actual native image rescan precede T05 closure. Allphase starts expireOct12 23:59:59Z; release reserves30minutesforverificationandrecovery. Afterexpiry a newfounderdecision is required. EUR0newrecurringinfrastructure, boundedprivate storage andunpricedattendedtime. No newdoctrine/autopilot/credentialgrant is authorized.
|
||||
File diff suppressed because one or more lines are too long
|
|
@ -0,0 +1,362 @@
|
|||
"""One fixed supervised phase; never run this during source preparation."""
|
||||
import argparse
|
||||
import hashlib
|
||||
import json
|
||||
import os
|
||||
from pathlib import Path
|
||||
import re
|
||||
import selectors
|
||||
import stat
|
||||
import subprocess
|
||||
import sys
|
||||
import time
|
||||
|
||||
if sys.flags.optimize:
|
||||
raise SystemExit('optimized interpreter refused')
|
||||
|
||||
PHASES = ('drill-backup', 'drill-copy', 'offline-verify', 'cleanup-offline',
|
||||
'cutover-backup', 'cutover-copy', 'release', 'verify', 'rollback', 'rollback-verify')
|
||||
|
||||
|
||||
def require(value, reason):
|
||||
if not value:
|
||||
raise ValueError(reason)
|
||||
|
||||
|
||||
def sha(path):
|
||||
digest = hashlib.sha256()
|
||||
with Path(path).open('rb') as stream:
|
||||
for block in iter(lambda: stream.read(1024**2), b''):
|
||||
digest.update(block)
|
||||
return digest.hexdigest()
|
||||
|
||||
|
||||
def private(path, directory=False):
|
||||
info = Path(path).lstat()
|
||||
require((stat.S_ISDIR(info.st_mode) if directory else stat.S_ISREG(info.st_mode))
|
||||
and info.st_uid == os.getuid() and stat.S_IMODE(info.st_mode) == (0o700 if directory else 0o600)
|
||||
and (directory or info.st_nlink == 1), 'private owned custody required')
|
||||
|
||||
ROOT = Path(__file__).resolve().parent
|
||||
CASE = ROOT.parent
|
||||
OWNER = Path('/home/worsch/informed-decision')
|
||||
CUSTODIAN = Path('/home/worsch/the-custodian')
|
||||
CUSTODY = CUSTODIAN / '.private-backups/20261011-infd-zlib-r1'
|
||||
SOCKET = 'unix:///var/run/docker.sock'
|
||||
IMAGE = 'forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23'
|
||||
VOLUME = 'infd-zlib-r1-restore-20261011'
|
||||
MAX_BYTES = 512 * 1024**2
|
||||
|
||||
|
||||
def run(argv, body=None, timeout=90):
|
||||
return subprocess.run(argv, input=body, text=True, capture_output=True, timeout=timeout)
|
||||
|
||||
|
||||
def json_result(result):
|
||||
try:
|
||||
value = json.loads(result.stdout)
|
||||
except (ValueError, TypeError):
|
||||
raise ValueError('safe phase receipt unavailable; outcome uncertain') from None
|
||||
require(result.returncode == 0 and isinstance(value, dict) and value.get('all_checks_pass') is True,
|
||||
'phase did not verify complete; raw output withheld; no retry')
|
||||
permitted = {'phase', 'all_checks_pass', 'raw_output_withheld', 'native_approval_verified_by_root',
|
||||
'native_authenticated_grant', 'source_readonly_baseline', 'snapshot_readonly',
|
||||
'snapshot_sha256', 'snapshot_bytes', 'snapshot_file', 'native_parent_private',
|
||||
'native_uid', 'pod_name', 'pod_uid', 'live_readonly_schema_integrity_counts',
|
||||
'live_counts_may_include_concurrent_commits', 'operation_requested', 'source_revision',
|
||||
'resources', 'prune', 'rollout_verified', 'latest_live_database_retained',
|
||||
'client_diff_sha256', 'native_rollout_verified', 'current_schema5_database_retained',
|
||||
'private_copy_verified', 'installed_purpose_checks', 'policy_sha256',
|
||||
'policy_mode', 'policy_uid', 'installed_zlib_files', 'zlib_package', 'health_statuses', 'native_provider_probe', 'recovery_verification'}
|
||||
require(set(value) <= permitted, 'unexpected output fields withheld')
|
||||
from receipt_safety import counts
|
||||
for name in ('source_readonly_baseline', 'snapshot_readonly', 'live_readonly_schema_integrity_counts'):
|
||||
if name in value:
|
||||
counts(value[name])
|
||||
for name in ('snapshot_sha256', 'client_diff_sha256'):
|
||||
if name in value:
|
||||
require(re.fullmatch(r'[a-f0-9]{64}', value[name]) is not None, 'invalid output digest withheld')
|
||||
if 'snapshot_bytes' in value:
|
||||
require(type(value['snapshot_bytes']) is int and 0 < value['snapshot_bytes'] <= MAX_BYTES,
|
||||
'invalid output size withheld')
|
||||
if 'snapshot_file' in value:
|
||||
require(value['snapshot_file'] in ('drill.sqlite', 'cutover.sqlite'), 'invalid output file withheld')
|
||||
return value
|
||||
|
||||
|
||||
def docker(argv, body=None, timeout=120):
|
||||
return run(['docker', '--config', str(CUSTODY / 'empty-docker-config'), '--host', SOCKET] + argv,
|
||||
body=body, timeout=timeout)
|
||||
|
||||
|
||||
def remote(phase, revision, approved):
|
||||
# Fixed module imported only after main verifies every executor source hash.
|
||||
from native_program import PROGRAM
|
||||
payload = {'phase': phase, 'source_revision': revision, 'approval': approved,
|
||||
'sealed': json.loads((CASE / 'sealed-live-deployment.json').read_text()),
|
||||
'dependencies': json.loads((CASE / 'sealed-native-dependencies.json').read_text()),
|
||||
'candidate': json.loads((CASE / 'candidate-deployment.json').read_text()),
|
||||
'rollback': json.loads((CASE / 'rollback-deployment.json').read_text()),
|
||||
'receipt_safety': (ROOT / 'receipt_safety.py').read_text(),
|
||||
'purpose_checks': (CASE / 'check_installed.py').read_text(),
|
||||
'installed_zlib': json.loads((CASE / 'installed-zlib-proof.json').read_text()), 'readonly': (CASE / 'sqlite_readonly.py').read_text()}
|
||||
script = PROGRAM.replace('__PAYLOAD__', repr(json.dumps(payload))).replace(
|
||||
'__GUARD__', repr((CASE / 'change_guard.py').read_text()))
|
||||
return json_result(run(['ssh', 'railiance01', 'python3 -'], script, timeout=200))
|
||||
|
||||
|
||||
def copy_snapshot(phase, revision, approved, journal):
|
||||
metadata = remote(phase, revision, approved)
|
||||
backup_phase = 'drill-backup' if phase == 'drill-copy' else 'cutover-backup'
|
||||
prior = journal.data['phases'][backup_phase]['result']
|
||||
for key in ('snapshot_sha256', 'snapshot_bytes', 'snapshot_file', 'snapshot_readonly'):
|
||||
require(metadata[key] == prior[key], 'closed frozen snapshot changed')
|
||||
name = metadata['snapshot_file']
|
||||
require(name in ('drill.sqlite', 'cutover.sqlite') and 0 < metadata['snapshot_bytes'] <= MAX_BYTES,
|
||||
'fixed bounded snapshot required')
|
||||
pod = metadata['pod_name']
|
||||
require(re.fullmatch(r'[a-z0-9]([-a-z0-9]*[a-z0-9])?', pod) is not None, 'fixed owner pod name required')
|
||||
local = CUSTODY / name
|
||||
fd = os.open(local, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600)
|
||||
# Binary snapshot stdout goes only to a private file, never tool/chat/log output.
|
||||
# Snapshot schema/count metadata was validated before opening this destination.
|
||||
with os.fdopen(fd, 'wb') as destination:
|
||||
command = ('kubectl exec -n informed-decision ' + pod +
|
||||
' -c informed-decision -- cat /data/private/zlib85091-r1/' + name)
|
||||
transfer = subprocess.Popen(['ssh', 'railiance01', command], stdout=subprocess.PIPE,
|
||||
stderr=subprocess.DEVNULL)
|
||||
selector = selectors.DefaultSelector()
|
||||
selector.register(transfer.stdout, selectors.EVENT_READ)
|
||||
deadline = time.monotonic() + 150
|
||||
received = 0
|
||||
try:
|
||||
while True:
|
||||
remaining = deadline - time.monotonic()
|
||||
require(remaining > 0 and selector.select(remaining), 'private transfer timed out')
|
||||
block = os.read(transfer.stdout.fileno(), 1024**2)
|
||||
if not block:
|
||||
break
|
||||
received += len(block)
|
||||
require(received <= metadata['snapshot_bytes'] and received <= MAX_BYTES,
|
||||
'private copy exceeds frozen snapshot size')
|
||||
destination.write(block)
|
||||
transfer.wait(timeout=max(1, deadline - time.monotonic()))
|
||||
finally:
|
||||
selector.close()
|
||||
transfer.stdout.close()
|
||||
if transfer.poll() is None:
|
||||
transfer.kill()
|
||||
transfer.wait()
|
||||
destination.flush()
|
||||
os.fsync(destination.fileno())
|
||||
private(local)
|
||||
require(transfer.returncode == 0 and local.stat().st_size == metadata['snapshot_bytes']
|
||||
and sha(local) == metadata['snapshot_sha256'], 'private copy incomplete/uncertain; retain, no retry')
|
||||
# Re-read identity/hash after transfer. This is verification, not a write retry.
|
||||
after = remote(phase, revision, approved)
|
||||
require(after['pod_uid'] == metadata['pod_uid'] and after['snapshot_sha256'] == metadata['snapshot_sha256'],
|
||||
'source identity/snapshot changed during transfer')
|
||||
return {**metadata, 'off_cluster_private_copy_verified': True, 'snapshot_contents_output': False}
|
||||
|
||||
|
||||
def offline_verify(journal):
|
||||
from receipt_safety import counts
|
||||
snapshot = CUSTODY / 'drill.sqlite'
|
||||
private(snapshot)
|
||||
previous = journal.data['phases']['drill-copy']['result']
|
||||
require(sha(snapshot) == previous['snapshot_sha256'], 'protected snapshot bytes changed')
|
||||
identity = docker(['info', '--format', '{{json .Name}}'])
|
||||
require(identity.returncode == 0 and json.loads(identity.stdout) == 'bnt-lap001',
|
||||
'local offline Docker engine identity changed')
|
||||
listed = docker(['volume', 'ls', '--format', '{{.Name}}'])
|
||||
require(listed.returncode == 0 and VOLUME not in listed.stdout.splitlines(),
|
||||
'disposable volume absence not verified')
|
||||
nonce = journal.data['phases']['offline-verify']['attempt_id']
|
||||
labels = {'informed-decision.case': 'infd-zlib-20261011-r1',
|
||||
'informed-decision.use': 'offline-restore-only', 'informed-decision.attempt': nonce}
|
||||
created = docker(['volume', 'create', '--driver', 'local', '--label', 'informed-decision.case=infd-zlib-20261011-r1',
|
||||
'--label', 'informed-decision.attempt=' + nonce,
|
||||
'--label', 'informed-decision.use=offline-restore-only', VOLUME])
|
||||
require(created.returncode == 0 and created.stdout.strip() == VOLUME, 'volume creation uncertain; no retry')
|
||||
inspected = docker(['volume', 'inspect', VOLUME])
|
||||
require(inspected.returncode == 0, 'new volume identity unavailable')
|
||||
volume = json.loads(inspected.stdout)
|
||||
require(len(volume) == 1 and volume[0]['Name'] == VOLUME and volume[0].get('Labels') == labels
|
||||
and volume[0].get('Driver') == 'local' and not volume[0].get('Options')
|
||||
and volume[0].get('Scope') == 'local', 'new isolated volume identity changed')
|
||||
identity = {key: volume[0][key] for key in ('Name', 'Labels', 'Driver', 'Scope', 'CreatedAt')}
|
||||
journal.note('offline-verify', 'created_volume_identity', identity)
|
||||
# One-time UID0/CAP_CHOWN initialization is isolated to the NEW named volume.
|
||||
# No host/live PVC/config/token mount exists; this detail needs packet review.
|
||||
initializer = """import hashlib,os,stat,sys
|
||||
if sys.flags.optimize:raise RuntimeError('optimized interpreter refused')
|
||||
folder='/restore';expected=EXPECTED
|
||||
if os.listdir(folder):raise ValueError('new empty private volume required')
|
||||
os.chmod(folder,0o700)
|
||||
fd=os.open(folder+'/review.sqlite',os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW|os.O_WRONLY,0o600)
|
||||
digest=hashlib.sha256();size=0
|
||||
with os.fdopen(fd,'wb') as target:
|
||||
while True:
|
||||
block=sys.stdin.buffer.read(1024**2)
|
||||
if not block:break
|
||||
size+=len(block)
|
||||
if size>512*1024**2:raise ValueError('private restore size exceeds bound')
|
||||
target.write(block);digest.update(block)
|
||||
target.flush();os.fsync(target.fileno())
|
||||
if digest.hexdigest()!=expected:raise ValueError('private copied snapshot differs')
|
||||
os.chown(folder+'/review.sqlite',10001,10001);os.chown(folder,10001,10001)
|
||||
print('{"all_checks_pass":true,"private_copy_verified":true}')
|
||||
""".replace('EXPECTED', repr(previous['snapshot_sha256']))
|
||||
with snapshot.open('rb') as source:
|
||||
argv = ['docker', '--config', str(CUSTODY / 'empty-docker-config'), '--host', SOCKET,
|
||||
'run', '--rm', '-i', '--network', 'none', '--read-only', '--cpus', '1', '--memory', '128m',
|
||||
'--user', '0:0', '--cap-drop', 'ALL', '--cap-add', 'CHOWN',
|
||||
'--security-opt', 'no-new-privileges', '--mount', 'type=volume,src=' + VOLUME + ',dst=/restore',
|
||||
'--entrypoint', 'python', IMAGE, '-c', initializer]
|
||||
copied = subprocess.run(argv, stdin=source, text=True, capture_output=True, timeout=150)
|
||||
json_result(copied)
|
||||
options = ['run', '--rm', '-i', '--network', 'none', '--read-only', '--cpus', '1', '--memory', '128m',
|
||||
'--user', '10001:10001', '--cap-drop', 'ALL', '--security-opt', 'no-new-privileges',
|
||||
'--mount', 'type=volume,src=' + VOLUME + ',dst=/restore']
|
||||
readonly = docker(options + ['--entrypoint', 'python', IMAGE, '-', '--db', '/restore/review.sqlite'],
|
||||
(CASE / 'sqlite_readonly.py').read_text())
|
||||
require(readonly.returncode == 0, 'offline pre-open schema/integrity gate refused; never open Store')
|
||||
checked = counts(json.loads(readonly.stdout))
|
||||
require(checked == previous['snapshot_readonly'], 'frozen snapshot/clone readonly counts differ')
|
||||
admin = docker(options + ['--entrypoint', 'informed-decision-admin', IMAGE,
|
||||
'inspect', '--db', '/restore/review.sqlite'])
|
||||
require(admin.returncode == 0, 'offline admin result uncertain')
|
||||
admin_counts = json.loads(admin.stdout)
|
||||
require(admin_counts == {key: checked[key] for key in ('schema_version', 'lifecycle', 'outbox', 'submissions')},
|
||||
'offline admin changed frozen snapshot counters')
|
||||
# Admin Store construction must not silently alter schema/integrity/counters.
|
||||
post = docker(options + ['--entrypoint', 'python', IMAGE, '-', '--db', '/restore/review.sqlite'],
|
||||
(CASE / 'sqlite_readonly.py').read_text())
|
||||
require(post.returncode == 0, 'offline post-admin readonly integrity gate refused')
|
||||
post_checked = counts(json.loads(post.stdout))
|
||||
require(post_checked == checked == previous['snapshot_readonly'],
|
||||
'offline admin altered frozen snapshot proof')
|
||||
private(snapshot)
|
||||
require(sha(snapshot) == previous['snapshot_sha256'], 'original protected snapshot changed during drill')
|
||||
return {'all_checks_pass': True, 'offline_volume': VOLUME, 'offline_readonly': checked,
|
||||
'offline_post_admin_readonly': post_checked, 'original_snapshot_hash_unchanged': True,
|
||||
'created_volume_identity': identity,
|
||||
'admin_counts': admin_counts, 'network': 'none', 'runtime_tokens_or_config_mounted': False,
|
||||
'service_entrypoint_started': False, 'original_snapshot_retained': True}
|
||||
|
||||
|
||||
def cleanup_offline(journal):
|
||||
inspected = docker(['volume', 'inspect', VOLUME])
|
||||
require(inspected.returncode == 0, 'owned disposable volume identity unverified')
|
||||
value = json.loads(inspected.stdout)
|
||||
expected = journal.data['phases']['offline-verify']['result']['created_volume_identity']
|
||||
require(len(value) == 1 and {key: value[0].get(key) for key in expected} == expected
|
||||
and not value[0].get('Options'), 'volume ownership/recreation changed')
|
||||
removed = docker(['volume', 'rm', VOLUME])
|
||||
require(removed.returncode == 0 and removed.stdout.strip() == VOLUME
|
||||
and docker(['volume', 'inspect', VOLUME]).returncode != 0,
|
||||
'cleanup outcome ambiguous; do not retry')
|
||||
return {'all_checks_pass': True, 'only_disposable_offline_volume_removed': VOLUME,
|
||||
'native_and_offcluster_original_snapshots_retained': True}
|
||||
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser(description=__doc__)
|
||||
parser.add_argument('--phase', choices=PHASES, required=True)
|
||||
parser.add_argument('--root-authority-receipt', type=Path, required=True)
|
||||
parser.add_argument('--root-native-outcome', type=Path, required=True)
|
||||
parser.add_argument('--source-revision', required=True)
|
||||
parser.add_argument('--root-fresh-scan-receipt', type=Path, required=True)
|
||||
args = parser.parse_args()
|
||||
require(args.root_authority_receipt == Path('/tmp/security-infd-zlib-root-authority.json')
|
||||
and args.root_native_outcome == Path('/tmp/security-infd-zlib-native-outcome-latest.json'),
|
||||
'fixed supervised receipt paths required')
|
||||
require(re.fullmatch(r'[0-9a-f]{40}', args.source_revision) is not None, 'exact source commit required')
|
||||
# Verify all prepared executor/input bytes before reading authority or dispatching.
|
||||
plan = json.loads((ROOT / 'execution-plan.json').read_text())
|
||||
require(plan.get('state') == 'prepared-unapproved' and plan.get('published_artifact_verified') is True, 'unfrozen proposal cannot execute')
|
||||
require(set(plan['executor_files']) == {'actuator.py', 'authority_journal.py', 'native_program.py', 'receipt_safety.py'},
|
||||
'fixed executor sources required')
|
||||
require(set(plan['owner_source_files']) == {'deploy/lifecycle/admission.candidate.json',
|
||||
'deploy/lifecycle/service.candidate.json',
|
||||
'deploy/lifecycle/kustomization.yaml',
|
||||
'deploy/lifecycle/registries.candidate.json'},
|
||||
'fixed owner image sources required')
|
||||
for relative, digest in plan['executor_files'].items():
|
||||
target = ROOT / relative
|
||||
require(not target.is_symlink() and sha(target) == digest, 'executor source bytes changed')
|
||||
for relative, digest in plan['case_files'].items():
|
||||
require(not Path(relative).is_absolute() and '..' not in Path(relative).parts,
|
||||
'case source path escaped')
|
||||
target = CASE / relative
|
||||
require(not target.is_symlink() and sha(target) == digest, 'case source bytes changed')
|
||||
for relative, digest in plan['owner_source_files'].items():
|
||||
target = OWNER / relative
|
||||
require(not target.is_symlink() and sha(target) == digest, 'owner image-only source changed')
|
||||
committed = subprocess.run(['git', '-C', str(OWNER), 'show', args.source_revision + ':' + relative],
|
||||
capture_output=True)
|
||||
require(committed.returncode == 0 and hashlib.sha256(committed.stdout).hexdigest() == digest,
|
||||
'committed owner render source differs from approved inputs')
|
||||
head = run(['git', '-C', str(OWNER), 'rev-parse', 'HEAD'])
|
||||
require(head.returncode == 0 and head.stdout.strip() == args.source_revision, 'owner source HEAD differs')
|
||||
from authority_journal import Journal, authority, fresh_scan
|
||||
private(args.root_authority_receipt)
|
||||
private(args.root_native_outcome)
|
||||
receipt = json.loads(args.root_authority_receipt.read_text())
|
||||
require(receipt.get('native_outcome_sha256') == sha(args.root_native_outcome), 'native outcome bytes changed')
|
||||
require(receipt.get('executor_plan_sha256') == sha(ROOT / 'execution-plan.json'),
|
||||
'root verified executor plan differs')
|
||||
approved = authority(receipt, json.loads(args.root_native_outcome.read_text()), sha(CASE / 'memo.json'),
|
||||
args.source_revision, args.phase)
|
||||
if args.phase in ('release', 'verify'):
|
||||
require(args.root_fresh_scan_receipt == Path('/tmp/security-infd-zlib-fresh-scan-receipt.json'), 'fixed fresh scan receipt path required')
|
||||
private(args.root_fresh_scan_receipt)
|
||||
scan_receipt=json.loads(args.root_fresh_scan_receipt.read_text())
|
||||
report_path=Path('/tmp/security-infd-zlib-fresh-scan-full.json');private(report_path)
|
||||
require(sha(report_path)==scan_receipt.get('full_report_sha256'), 'fresh scan report bytes changed')
|
||||
fresh_scan(scan_receipt,json.loads(report_path.read_text()))
|
||||
parent = CUSTODY.parent
|
||||
private(parent, directory=True)
|
||||
ignored = run(['git', '-C', str(CUSTODIAN), 'check-ignore', '--no-index', str(CUSTODY / 'drill.sqlite')])
|
||||
require(ignored.returncode == 0, 'offcluster custody is not ignored')
|
||||
if not CUSTODY.exists():
|
||||
require(args.phase == 'drill-backup', 'first approved phase must create unique private custody')
|
||||
os.mkdir(CUSTODY, 0o700)
|
||||
private(CUSTODY, directory=True)
|
||||
capacity = os.statvfs(CUSTODY)
|
||||
require(capacity.f_bavail * capacity.f_frsize >= 2 * MAX_BYTES + 16 * 1024**2,
|
||||
'independent protected custody headroom insufficient')
|
||||
os.makedirs(CUSTODY / 'empty-docker-config', mode=0o700, exist_ok=True)
|
||||
private(CUSTODY / 'empty-docker-config', directory=True)
|
||||
require(not list((CUSTODY / 'empty-docker-config').iterdir()), 'public Docker read config must stay empty')
|
||||
journal = Journal(CUSTODY, {'proposal': plan['proposal_id'], 'source_revision': args.source_revision,
|
||||
'memo_sha256': sha(CASE / 'memo.json'), 'plan_sha256': sha(ROOT / 'execution-plan.json')})
|
||||
try:
|
||||
journal.start(args.phase, approved) # fsynced RUNNING before any phase effect.
|
||||
if args.phase in ('drill-copy', 'cutover-copy'):
|
||||
result = copy_snapshot(args.phase, args.source_revision, approved, journal)
|
||||
elif args.phase == 'offline-verify':
|
||||
result = offline_verify(journal)
|
||||
elif args.phase == 'cleanup-offline':
|
||||
result = cleanup_offline(journal)
|
||||
else:
|
||||
result = remote(args.phase, args.source_revision, approved, operation_intent=journal.data['phases'].get('rollback' if args.phase == 'rollback-verify' else 'release') if args.phase in ('verify', 'rollback-verify') else None)
|
||||
journal.finish(args.phase, result)
|
||||
print(json.dumps(result)) # Only count/hash/identity receipts, never snapshot bytes.
|
||||
except BaseException as error:
|
||||
safe = {'all_checks_pass': False, 'phase': args.phase, 'failure_class': type(error).__name__,
|
||||
'failure': 'fixed phase outcome uncertain; original evidence retained; no retry',
|
||||
'raw_output_withheld': True}
|
||||
if journal.data['phases'].get(args.phase, {}).get('state') == 'RUNNING':
|
||||
journal.finish(args.phase, safe)
|
||||
print(json.dumps(safe))
|
||||
raise SystemExit(1) from None
|
||||
finally:
|
||||
journal.close()
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
try:
|
||||
main()
|
||||
except Exception:
|
||||
raise SystemExit('supervised execution refused before phase; raw output withheld') from None
|
||||
|
|
@ -0,0 +1,170 @@
|
|||
"""Supervised receipt bookkeeping, not an authenticated approval provider."""
|
||||
import datetime
|
||||
import fcntl
|
||||
import hashlib
|
||||
import json
|
||||
import os
|
||||
import re
|
||||
from pathlib import Path
|
||||
import stat
|
||||
import uuid
|
||||
|
||||
FOUNDER = {'kind': 'person', 'sub': 'uid=platform-root,ou=people,dc=netkingdom,dc=local'}
|
||||
MEMO_ID = 'infd-20261011-zlib-remediation-r1'
|
||||
PROPOSAL = 'INFD-WP-0009-T05/zlib85091-r1'
|
||||
PHASES = ('drill-backup', 'drill-copy', 'offline-verify', 'cleanup-offline',
|
||||
'cutover-backup', 'cutover-copy', 'release', 'verify', 'rollback', 'rollback-verify')
|
||||
|
||||
|
||||
def require(value, reason):
|
||||
if not value:
|
||||
raise ValueError(reason)
|
||||
|
||||
|
||||
def sha(path):
|
||||
digest = hashlib.sha256()
|
||||
with Path(path).open('rb') as stream:
|
||||
for block in iter(lambda: stream.read(1024**2), b''):
|
||||
digest.update(block)
|
||||
return digest.hexdigest()
|
||||
|
||||
|
||||
def private(path, directory=False):
|
||||
info = Path(path).lstat()
|
||||
require((stat.S_ISDIR(info.st_mode) if directory else stat.S_ISREG(info.st_mode))
|
||||
and info.st_uid == os.getuid() and stat.S_IMODE(info.st_mode) == (0o700 if directory else 0o600)
|
||||
and (directory or info.st_nlink == 1), 'private owned custody required')
|
||||
|
||||
|
||||
def authority(receipt, outcome, memo_sha, source_revision, phase, now=None):
|
||||
"""Root must freshly verify native outcome at fixed ORIGIN outside this helper.
|
||||
|
||||
Receipt files/flags are not signed grants. This function checks the exact
|
||||
supervised receipt relation; existing harness/founder authority remains the
|
||||
actual permission boundary. It never authenticates a caller as human.
|
||||
"""
|
||||
now = now or datetime.datetime.now(datetime.timezone.utc)
|
||||
require(phase in PHASES, 'fixed phase required')
|
||||
require(receipt.get('proposal_id') == PROPOSAL and receipt.get('memo_id') == MEMO_ID
|
||||
and receipt.get('memo_version') == 1 and receipt.get('memo_sha256') == memo_sha
|
||||
and receipt.get('source_revision') == source_revision
|
||||
and receipt.get('activation') == 'APPROVED'
|
||||
and receipt.get('authority_mode') == 'ADMINISTER'
|
||||
and receipt.get('target') == 'realm:kubernetes/railiance01/informed-decision'
|
||||
and receipt.get('verification_method') == 'root-fixed-origin-native-readback'
|
||||
and receipt.get('runtime_authenticated_grant') is False
|
||||
and receipt.get('outcome_query') == '/lifecycle/memos/' + MEMO_ID + '/outcomes?version=1',
|
||||
'exact externally verified supervised receipt required')
|
||||
verified = datetime.datetime.fromisoformat(receipt['verified_at'].replace('Z', '+00:00'))
|
||||
require(verified.tzinfo is not None and 0 <= (now - verified).total_seconds() <= 120,
|
||||
'fresh root native readback required before every phase')
|
||||
deadline = datetime.datetime.fromisoformat('2026-10-12T23:59:59+00:00')
|
||||
require(now < deadline, 'approved execution window expired')
|
||||
if phase == 'release':
|
||||
require((deadline-now).total_seconds() >= 1800, 'reserve thirty minutes for verification and recovery')
|
||||
require(outcome.get('memo_id') == MEMO_ID and outcome.get('review', {}).get('stale') is False
|
||||
and outcome['review'].get('intake_state') == 'ready', 'native review is not ready/current')
|
||||
review_id = outcome['review']['memo_id']
|
||||
require(review_id == receipt.get('review_memo_id'), 'native review identity changed')
|
||||
accepted = [x for x in outcome.get('dispositions', [])
|
||||
if x.get('submission_state') == 'confirmed'
|
||||
and x.get('disposition', {}).get('verb') == 'accept'
|
||||
and x['disposition'].get('memo_version') == 1]
|
||||
require(len(accepted) == 1, 'one confirmed founder acceptance required')
|
||||
accepted = accepted[0]['disposition']
|
||||
require(accepted.get('actor') == FOUNDER and accepted.get('memo_id') == review_id
|
||||
and accepted.get('approval_id') == receipt.get('approval_id')
|
||||
and accepted.get('id') == receipt.get('disposition_id')
|
||||
and accepted.get('at') == receipt.get('accepted_at'), 'exact founder disposition mismatch')
|
||||
require(re.fullmatch(r'[a-f0-9-]{36}', accepted['approval_id']) is not None
|
||||
and re.fullmatch(r'disp-[a-f0-9-]{36}', accepted['id']) is not None
|
||||
and re.fullmatch(r'review-[a-f0-9-]{36}', review_id) is not None,
|
||||
'native disposition identifiers are malformed')
|
||||
accepted_at = datetime.datetime.fromisoformat(accepted['at'].replace('Z', '+00:00'))
|
||||
require(accepted_at.tzinfo is not None and accepted_at <= verified, 'acceptance time not bounded')
|
||||
return {key: receipt[key] for key in ('approval_id', 'disposition_id', 'accepted_at', 'verified_at')}
|
||||
|
||||
|
||||
def fresh_scan(receipt, report, now=None):
|
||||
"""Root supervised scan bookkeeping; actual scanner proof stays retained."""
|
||||
now=now or datetime.datetime.now(datetime.timezone.utc)
|
||||
require(receipt.get('image')=='forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23'
|
||||
and receipt.get('artifact_source_revision')=='9b4bb25d325698ae543e7e8a8a3c3592db1f58fc'
|
||||
and receipt.get('scanner')=='aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969'
|
||||
and receipt.get('no_suppression') is True and receipt.get('full_allseverity_scan') is True
|
||||
and receipt.get('exit_code')==0,'exact full immutable artifact scan required')
|
||||
scanned=datetime.datetime.fromisoformat(receipt['completed_at'].replace('Z','+00:00'))
|
||||
metadata=receipt['db_metadata'];updated=datetime.datetime.fromisoformat(metadata['UpdatedAt'].replace('Z','+00:00'));next_update=datetime.datetime.fromisoformat(metadata['NextUpdate'].replace('Z','+00:00'))
|
||||
require(all(t.tzinfo is not None for t in (scanned,updated,next_update))
|
||||
and updated<=scanned<=now<next_update and (now-scanned).total_seconds()<=14400
|
||||
and metadata.get('Version')==2 and re.fullmatch(r'[a-f0-9]{64}',receipt.get('db_sha256','')) is not None,'scan or vulnerability database expired')
|
||||
require(isinstance(report,dict) and isinstance(report.get('Results'),list) and report['Results'],'retained full scan results required')
|
||||
for result in report['Results']:
|
||||
require(isinstance(result,dict) and isinstance(result.get('Vulnerabilities',[]),(list,type(None))),'full scan result invalid')
|
||||
require(not result.get('Vulnerabilities'),'new finding refuses release and closure')
|
||||
return {'full_report_sha256':receipt['full_report_sha256'],'db_sha256':receipt['db_sha256'],'completed_at':receipt['completed_at'],'next_update':metadata['NextUpdate'],'allseverity_findings':0}
|
||||
|
||||
|
||||
class Journal:
|
||||
def __init__(self, parent, identity):
|
||||
self.parent = Path(parent)
|
||||
private(self.parent, directory=True)
|
||||
self.path = self.parent / 'execution-journal.json'
|
||||
self.lock = os.open(self.parent / 'execution.lock', os.O_CREAT | os.O_NOFOLLOW | os.O_RDWR, 0o600)
|
||||
fcntl.flock(self.lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
|
||||
private(self.parent / 'execution.lock')
|
||||
if self.path.exists():
|
||||
private(self.path)
|
||||
self.data = json.loads(self.path.read_text())
|
||||
require(self.data['identity'] == identity, 'journal case/source identity changed')
|
||||
else:
|
||||
self.data = {'identity': identity, 'phases': {}}
|
||||
self.save()
|
||||
|
||||
def save(self):
|
||||
temporary = self.parent / 'execution-journal.new'
|
||||
fd = os.open(temporary, os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW | os.O_WRONLY, 0o600)
|
||||
try:
|
||||
with os.fdopen(fd, 'w') as stream:
|
||||
json.dump(self.data, stream, indent=2)
|
||||
stream.write('\n')
|
||||
stream.flush()
|
||||
os.fsync(stream.fileno())
|
||||
os.replace(temporary, self.path)
|
||||
directory = os.open(self.parent, os.O_DIRECTORY | os.O_RDONLY)
|
||||
try:
|
||||
os.fsync(directory)
|
||||
finally:
|
||||
os.close(directory)
|
||||
except BaseException:
|
||||
# Retain evidence rather than overwriting an uncertain durable intent.
|
||||
raise
|
||||
|
||||
def start(self, phase, approval):
|
||||
require(phase not in self.data['phases'], 'already attempted phase; no retry')
|
||||
predecessors = dict(zip(PHASES[1:8], PHASES[:7]))
|
||||
predecessors['rollback-verify'] = 'rollback'
|
||||
if phase in predecessors:
|
||||
require(self.data['phases'].get(predecessors[phase], {}).get('state') == 'COMPLETE',
|
||||
'preceding phase is not verified complete')
|
||||
if phase == 'rollback':
|
||||
require('release' in self.data['phases'], 'rollback requires a recorded release attempt')
|
||||
self.data['phases'][phase] = {'state': 'RUNNING', 'approval': approval,
|
||||
'attempt_id': str(uuid.uuid4()),
|
||||
'started_at': datetime.datetime.now(datetime.timezone.utc).isoformat()}
|
||||
self.save()
|
||||
|
||||
def note(self, phase, key, value):
|
||||
require(self.data['phases'][phase]['state'] == 'RUNNING', 'phase intent missing')
|
||||
self.data['phases'][phase][key] = value
|
||||
self.save()
|
||||
|
||||
def finish(self, phase, result):
|
||||
entry = self.data['phases'][phase]
|
||||
require(entry['state'] == 'RUNNING', 'phase intent missing')
|
||||
entry['result'] = result
|
||||
entry['state'] = 'COMPLETE' if result.get('all_checks_pass') is True else 'UNCERTAIN'
|
||||
self.save()
|
||||
|
||||
def close(self):
|
||||
os.close(self.lock)
|
||||
|
|
@ -0,0 +1,62 @@
|
|||
{
|
||||
"kind": "informed-decision.supervised-mechanical-release-plan",
|
||||
"version": 1,
|
||||
"proposal_id": "INFD-WP-0009-T05/zlib85091-r1",
|
||||
"trial_id": "infd-zlib-20261011-r1",
|
||||
"state": "prepared-unapproved",
|
||||
"executor_files": {
|
||||
"actuator.py": "dabeda33ffe52989337e214dc6e6d3ef5f04797569145faf2ff69024b101ec80",
|
||||
"authority_journal.py": "2aa9bae40752922264e53382d898e3083b8d229b185329266942bdd397013108",
|
||||
"native_program.py": "fcf8fc3593910b2e99dd51d159a30aa9b853c40ff00c566a620d20eaadc8af20",
|
||||
"receipt_safety.py": "5c54373f2dc4b064008225c186efb1d5afdeec36d15350bda0a12ded97602d1b"
|
||||
},
|
||||
"case_files": {
|
||||
"post-ready-native-outcomes-command.py": "ce88aca5e2d6cd5ab7533898bc9b246bd159482c4acccb0afe4c451ee88f57fa",
|
||||
"scan-receipt.json": "aaaa91061bb036e6d228b1c1bd4333578dc948cb2bb5ac8ba269429121e7321a",
|
||||
"source-commit-proof.json": "b0811da2d3bd5938733f0078e5fec8e19a6d9752c4277b80bfe9837ed72c6a3b",
|
||||
"candidate-deployment.json": "487f834cc86dcbc7a04c2392bde072ecaf87dc116b4baa16c35eb9c599ad5c95",
|
||||
"artifact-comparison.json": "a1c5d9e249dc00600449998360faf6e8da0206b568c76d155602c4645fa5fce4",
|
||||
"rollback-deployment.json": "f8a9a07abc2eb52cdf6bcdba2d9f79dec073145c31d0444a9e0fe1147e42cc4e",
|
||||
"sqlite_readonly.py": "9093c64f7f0e39b249da9fefdf5aaf4e4258bc31e7a27fd888479ce329a20509",
|
||||
"published-verification.json": "dd4eecf0c103dca7922094a8beeb99b77ae96fd1d5fe532e37bd833daa02614e",
|
||||
"sealed-native-dependencies.json": "042327a036ed254cf95dbeb0c056ac25b03a6a844b95a332c992df2943691369",
|
||||
"sealed-live-deployment.json": "f8a9a07abc2eb52cdf6bcdba2d9f79dec073145c31d0444a9e0fe1147e42cc4e",
|
||||
"native-preflight.json": "56637994dfdae46a6f9ab442c2ff9b259212650b35eb98d896c5e837f01ce2f9",
|
||||
"fresh-scan-receipt-template.json": "92bbf8a891c7ef78df48430901219d8d07073cba74112a307a6d8bdec509e8dd",
|
||||
"rollback-preflight.json": "0188799d352e4d49d5ca29d6e197742d02e96a4b0b399df1f478e41b25292eb5",
|
||||
"installed-zlib-proof.json": "6af62f86f50ac185fab94163c24ac8150ead69e62f8d825b0dce1e75a5a57b68",
|
||||
"runtime-receipt.json": "6442676dcfd941f0a05a4cb79a02dea839fcd332d82b2154c15cf6db68de5889",
|
||||
"change_guard.py": "b3ee2b89de14e204efedd016d3900b6e31fcc9f0ea0f3125d3a4794d938ca201",
|
||||
"check_installed.py": "a34a51be9c9f2b16a06a88173b5c6c492c9957fe021cf412a86a1737730640ad",
|
||||
"candidate-runtime.json": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124"
|
||||
},
|
||||
"owner_source_files": {
|
||||
"deploy/lifecycle/admission.candidate.json": "6c76cedd0abc4a4261cfcb69c6597611c282bd4fed8b6aaf77aff04fdf942529",
|
||||
"deploy/lifecycle/service.candidate.json": "383332cd4fd27a8b36e63a4d79addc43eb68615f742328d4577bfc2b467e2278",
|
||||
"deploy/lifecycle/kustomization.yaml": "1bbce81bc6758434354157f8601534320c5d0290587908fd15a6d25e3fa57f47",
|
||||
"deploy/lifecycle/registries.candidate.json": "9bad6db5fbc2178d31b04120016a41830c3552fbb9e2517b718f9bbe87cf649e"
|
||||
},
|
||||
"candidate_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"prior_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"source_revision": "must-be-exact-final-owner-HEAD-with-approved-four-Git-blobs",
|
||||
"phases": [
|
||||
"drill-backup",
|
||||
"drill-copy",
|
||||
"offline-verify",
|
||||
"cleanup-offline",
|
||||
"cutover-backup",
|
||||
"cutover-copy",
|
||||
"release",
|
||||
"verify",
|
||||
"rollback",
|
||||
"rollback-verify"
|
||||
],
|
||||
"authorization": "fresh externally authenticated root fixed-origin native readback before each phase; exact confirmed platform-root disposition and current packet SHA/source commit; receipt bookkeeping is not an autonomous signed grant",
|
||||
"execute_by": "2026-10-12T23:59:59Z",
|
||||
"raw_output_withheld": true,
|
||||
"native_data_or_workload_action_executed": false,
|
||||
"deadline_semantics": "All phases including verification/recovery must begin before execute_by. No extension or automatic emergency grant; beyond deadline stop and obtain a fresh founder decision. Complete the bounded drill and rollout early enough to allow recovery within the window.",
|
||||
"source_memo_version": 1,
|
||||
"native_review_memo_version": 1,
|
||||
"published_artifact_verified": true
|
||||
}
|
||||
File diff suppressed because one or more lines are too long
|
|
@ -0,0 +1,15 @@
|
|||
"""Only structural count/hash receipts can leave the private execution phase."""
|
||||
def counts(value):
|
||||
if (set(value) != {'schema_version', 'lifecycle', 'outbox', 'submissions', 'integrity',
|
||||
'read_only_pre_open', 'store_constructed'}
|
||||
or value['schema_version'] != 5 or value['integrity'] != 'ok'
|
||||
or value['read_only_pre_open'] is not True or value['store_constructed'] is not False
|
||||
or set(value['lifecycle']) != {'records', 'events', 'pending'}
|
||||
or not set(value['outbox']) <= {'pending', 'delivered', 'blocked'}
|
||||
or not set(value['submissions']) <= {'prepared', 'in_flight', 'confirmed', 'unresolved'}):
|
||||
raise ValueError('count-only receipt shape/state refused; values withheld')
|
||||
for group in ('lifecycle', 'outbox', 'submissions'):
|
||||
if any(type(number) is not int or number < 0 or number > 10**12
|
||||
for number in value[group].values()):
|
||||
raise ValueError('count-only receipt values refused')
|
||||
return value
|
||||
|
|
@ -0,0 +1,402 @@
|
|||
"""Synthetic custody/transport tests. No native data, Docker or cluster action."""
|
||||
import copy
|
||||
import datetime
|
||||
import io
|
||||
import json
|
||||
import os
|
||||
from pathlib import Path
|
||||
import subprocess
|
||||
import sys
|
||||
import tempfile
|
||||
import unittest
|
||||
from unittest.mock import patch
|
||||
from contextlib import redirect_stdout
|
||||
|
||||
import actuator
|
||||
from authority_journal import Journal, authority, fresh_scan
|
||||
from native_program import PROGRAM
|
||||
from receipt_safety import counts
|
||||
|
||||
CASE = Path(__file__).resolve().parent.parent
|
||||
NOW = datetime.datetime(2026, 10, 11, 2, 0, tzinfo=datetime.timezone.utc)
|
||||
REVISION = 'e' * 40
|
||||
COUNT = {'schema_version': 5, 'integrity': 'ok', 'read_only_pre_open': True, 'store_constructed': False,
|
||||
'lifecycle': {'records': 3, 'events': 8, 'pending': 1},
|
||||
'outbox': {'pending': 2, 'delivered': 10}, 'submissions': {'confirmed': 1, 'unresolved': 1}}
|
||||
|
||||
|
||||
def accepted():
|
||||
approval = '11111111-1111-4111-8111-111111111111'
|
||||
review = 'review-22222222-2222-4222-8222-222222222222'
|
||||
disposition = 'disp-33333333-3333-4333-8333-333333333333'
|
||||
receipt = {'proposal_id': 'INFD-WP-0009-T05/zlib85091-r1',
|
||||
'memo_id': 'infd-20261011-zlib-remediation-r1', 'memo_version': 1,
|
||||
'memo_sha256': 'a' * 64, 'source_revision': REVISION, 'activation': 'APPROVED',
|
||||
'authority_mode': 'ADMINISTER', 'target': 'realm:kubernetes/railiance01/informed-decision',
|
||||
'verification_method': 'root-fixed-origin-native-readback', 'runtime_authenticated_grant': False, 'outcome_query': '/lifecycle/memos/infd-20261011-zlib-remediation-r1/outcomes?version=1',
|
||||
'verified_at': '2026-10-11T02:00:00Z', 'accepted_at': '2026-10-11T01:59:00Z',
|
||||
'review_memo_id': review, 'approval_id': approval, 'disposition_id': disposition}
|
||||
outcome = {'memo_id': receipt['memo_id'], 'review': {'memo_id': review, 'stale': False, 'intake_state': 'ready'},
|
||||
'dispositions': [{'approval_id': None, 'submission_state': 'confirmed',
|
||||
'disposition': {'verb': 'accept', 'memo_version': 1, 'memo_id': review,
|
||||
'approval_id': approval, 'id': disposition,
|
||||
'actor': {'kind': 'person', 'sub': 'uid=platform-root,ou=people,dc=netkingdom,dc=local'},
|
||||
'at': receipt['accepted_at']}}]}
|
||||
return receipt, outcome
|
||||
|
||||
|
||||
class AuthorityAndCustody(unittest.TestCase):
|
||||
def test_exact_nested_founder_receipt_not_top_level_approval(self):
|
||||
receipt, outcome = accepted()
|
||||
result = authority(receipt, outcome, 'a' * 64, REVISION, 'drill-copy', NOW)
|
||||
self.assertEqual(result['approval_id'], receipt['approval_id'])
|
||||
|
||||
def test_pending_stale_wrong_actor_version_and_binding_refuse(self):
|
||||
mutations = [lambda r, o: r.update(activation='PENDING'),
|
||||
lambda r, o: r.update(memo_sha256='changed'),
|
||||
lambda r, o: r.update(source_revision='changed'),
|
||||
lambda r, o: r.update(target='other'),
|
||||
lambda r, o: r.update(verified_at='2026-10-11T01:00:00Z'),
|
||||
lambda r, o: r.update(verification_method='caller-asserted'),
|
||||
lambda r, o: r.update(runtime_authenticated_grant=True),
|
||||
lambda r, o: o['review'].update(stale=True),
|
||||
lambda r, o: o['review'].update(intake_state='pending'),
|
||||
lambda r, o: o['dispositions'][0].update(submission_state='unresolved'),
|
||||
lambda r, o: o['dispositions'][0]['disposition'].update(memo_version=3),
|
||||
lambda r, o: o['dispositions'][0]['disposition'].update(actor={'kind': 'agent', 'sub': 'platform-root'}),
|
||||
lambda r, o: o['dispositions'].append(copy.deepcopy(o['dispositions'][0]))]
|
||||
for mutate in mutations:
|
||||
with self.subTest(mutate=mutate):
|
||||
r, o = accepted()
|
||||
mutate(r, o)
|
||||
with self.assertRaises(ValueError):
|
||||
authority(r, o, 'a' * 64, REVISION, 'release', NOW)
|
||||
|
||||
def test_expired_window_and_unknown_phase_refuse(self):
|
||||
r, o = accepted()
|
||||
with self.assertRaises(ValueError):
|
||||
authority(r, o, 'a' * 64, REVISION, 'arbitrary', NOW)
|
||||
late = datetime.datetime(2026, 10, 13, tzinfo=datetime.timezone.utc)
|
||||
r['verified_at'] = late.isoformat()
|
||||
with self.assertRaises(ValueError):
|
||||
authority(r, o, 'a' * 64, REVISION, 'rollback', late)
|
||||
|
||||
def test_durable_intent_precedes_dispatch_and_never_retries(self):
|
||||
with tempfile.TemporaryDirectory() as directory:
|
||||
parent = Path(directory)
|
||||
os.chmod(parent, 0o700)
|
||||
journal = Journal(parent, {'case': 'fixture'})
|
||||
journal.start('drill-backup', {'approval_id': 'fixture'})
|
||||
self.assertEqual(json.loads(journal.path.read_text())['phases']['drill-backup']['state'], 'RUNNING')
|
||||
journal.close() # simulated crash before result
|
||||
recovered = Journal(parent, {'case': 'fixture'})
|
||||
with self.assertRaises(ValueError):
|
||||
recovered.start('drill-backup', {})
|
||||
with self.assertRaises(ValueError):
|
||||
recovered.start('drill-backup', {})
|
||||
recovered.close()
|
||||
|
||||
def test_phase_order_and_uncertain_release_allows_only_distinct_recovery(self):
|
||||
with tempfile.TemporaryDirectory() as directory:
|
||||
os.chmod(directory, 0o700)
|
||||
j = Journal(directory, {'case': 'fixture'})
|
||||
with self.assertRaises(ValueError):
|
||||
j.start('release', {})
|
||||
for phase in actuator.PHASES[:6]:
|
||||
j.start(phase, {})
|
||||
j.finish(phase, {'all_checks_pass': True})
|
||||
j.start('release', {})
|
||||
j.finish('release', {'all_checks_pass': False})
|
||||
with self.assertRaises(ValueError):
|
||||
j.start('release', {})
|
||||
with self.assertRaises(ValueError):
|
||||
j.start('verify', {})
|
||||
j.start('rollback', {})
|
||||
j.finish('rollback', {'all_checks_pass': True})
|
||||
j.close()
|
||||
|
||||
def test_secret_or_unknown_child_output_is_withheld(self):
|
||||
for body in ('not-json', '{"all_checks_pass":true,"token":"private-value"}',
|
||||
'{"all_checks_pass":true,"snapshot_readonly":{"schema_version":5}}'):
|
||||
with self.assertRaises(ValueError):
|
||||
actuator.json_result(subprocess.CompletedProcess([], 0, body, ''))
|
||||
wrong = copy.deepcopy(COUNT)
|
||||
wrong['outbox'] = {'private-row-value': 1}
|
||||
with self.assertRaises(ValueError):
|
||||
counts(wrong)
|
||||
counts(COUNT) # blocked/unresolved counts are not required to be zero.
|
||||
|
||||
def test_binary_copy_is_bounded_private_and_never_echoed(self):
|
||||
blob = b'synthetic private fixture bytes'
|
||||
digest = __import__('hashlib').sha256(blob).hexdigest()
|
||||
metadata = {'all_checks_pass': True, 'snapshot_file': 'drill.sqlite', 'snapshot_bytes': len(blob),
|
||||
'snapshot_sha256': digest, 'snapshot_readonly': COUNT,
|
||||
'pod_name': 'fixture-pod', 'pod_uid': 'fixture-uid'}
|
||||
journal = type('FixtureJournal', (), {'data': {'phases': {'drill-backup': {'result': metadata}}}})()
|
||||
real_popen = subprocess.Popen
|
||||
for extra in (b'', b'oversized'):
|
||||
with self.subTest(extra=extra), tempfile.TemporaryDirectory() as folder:
|
||||
os.chmod(folder, 0o700)
|
||||
output = io.StringIO()
|
||||
|
||||
def child(*args, **kwargs):
|
||||
return real_popen([sys.executable, '-c', 'import sys;sys.stdout.buffer.write(' + repr(blob + extra) + ')'],
|
||||
stdout=subprocess.PIPE, stderr=subprocess.DEVNULL)
|
||||
|
||||
with patch.object(actuator, 'CUSTODY', Path(folder)), patch.object(actuator, 'remote', return_value=metadata), \
|
||||
patch('subprocess.Popen', side_effect=child), redirect_stdout(output):
|
||||
if extra:
|
||||
with self.assertRaises(ValueError):
|
||||
actuator.copy_snapshot('drill-copy', REVISION, {}, journal)
|
||||
else:
|
||||
result = actuator.copy_snapshot('drill-copy', REVISION, {}, journal)
|
||||
self.assertTrue(result['off_cluster_private_copy_verified'])
|
||||
self.assertEqual((Path(folder) / 'drill.sqlite').read_bytes(), blob)
|
||||
self.assertEqual(output.getvalue(), '')
|
||||
self.assertEqual((Path(folder) / 'drill.sqlite').stat().st_mode & 0o777, 0o600)
|
||||
|
||||
def test_recreated_offline_volume_cannot_be_deleted(self):
|
||||
identity = {'Name': actuator.VOLUME, 'Labels': {'nonce': 'old'}, 'CreatedAt': 'old'}
|
||||
journal = type('FixtureJournal', (), {'data': {'phases': {
|
||||
'offline-verify': {'result': {'created_volume_identity': identity}}}}})()
|
||||
inspected = [{**identity, 'CreatedAt': 'recreated'}]
|
||||
with patch.object(actuator, 'docker', return_value=subprocess.CompletedProcess([], 0, json.dumps(inspected), '')) as mocked:
|
||||
with self.assertRaises(ValueError):
|
||||
actuator.cleanup_offline(journal)
|
||||
self.assertEqual(mocked.call_count, 1)
|
||||
|
||||
def test_offline_post_admin_integrity_and_original_hash_are_rechecked(self):
|
||||
for defect in ('none', 'post-integrity', 'original-hash'):
|
||||
with self.subTest(defect=defect), tempfile.TemporaryDirectory() as directory:
|
||||
folder=Path(directory);os.chmod(folder,0o700)
|
||||
snapshot=folder/'drill.sqlite';snapshot.write_bytes(b'private synthetic snapshot');os.chmod(snapshot,0o600)
|
||||
digest=actuator.sha(snapshot)
|
||||
prior={'snapshot_sha256':digest,'snapshot_readonly':COUNT}
|
||||
journal=type('FixtureJournal',(),{'data':{'phases':{'drill-copy':{'result':prior},'offline-verify':{'attempt_id':'nonce'}}},'note':lambda *args:None})()
|
||||
reads=[]
|
||||
volume={'Name':actuator.VOLUME,'Labels':{'informed-decision.case':'infd-zlib-20261011-r1','informed-decision.use':'offline-restore-only','informed-decision.attempt':'nonce'},'Driver':'local','Scope':'local','CreatedAt':'fixture','Options':None}
|
||||
def docker(argv, body=None, **kwargs):
|
||||
if argv[0]=='info':body=json.dumps('bnt-lap001')
|
||||
elif argv[:2]==['volume','ls']:body=''
|
||||
elif argv[:2]==['volume','create']:body=actuator.VOLUME
|
||||
elif argv[:2]==['volume','inspect']:body=json.dumps([volume])
|
||||
elif 'informed-decision-admin' in argv:
|
||||
body=json.dumps({key:COUNT[key] for key in ('schema_version','lifecycle','outbox','submissions')})
|
||||
if defect=='original-hash':snapshot.write_bytes(b'changed synthetic original')
|
||||
elif '--entrypoint' in argv and 'python' in argv:
|
||||
reads.append(argv);proof=copy.deepcopy(COUNT)
|
||||
if len(reads)==2 and defect=='post-integrity':proof['integrity']='corrupt'
|
||||
body=json.dumps(proof)
|
||||
else:raise AssertionError('unexpected offline command')
|
||||
return subprocess.CompletedProcess(argv,0,body,'')
|
||||
with patch.object(actuator,'CUSTODY',folder),patch.object(actuator,'CASE',CASE),patch.object(actuator,'docker',side_effect=docker),patch('subprocess.run',return_value=subprocess.CompletedProcess([],0,'{"all_checks_pass":true,"private_copy_verified":true}','')):
|
||||
if defect=='none':
|
||||
result=actuator.offline_verify(journal)
|
||||
self.assertEqual(result['offline_post_admin_readonly'],COUNT)
|
||||
self.assertTrue(result['original_snapshot_hash_unchanged'])
|
||||
else:
|
||||
with self.assertRaises(ValueError):actuator.offline_verify(journal)
|
||||
self.assertEqual(len(reads),2)
|
||||
|
||||
def test_fresh_full_scan_db_expiry_and_new_findings_refuse(self):
|
||||
receipt={'image':actuator.IMAGE,'artifact_source_revision':'9b4bb25d325698ae543e7e8a8a3c3592db1f58fc','scanner':'aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969','no_suppression':True,'full_allseverity_scan':True,'exit_code':0,'completed_at':'2026-10-11T01:59:00Z','db_metadata':{'UpdatedAt':'2026-10-10T19:00:00Z','NextUpdate':'2026-10-11T19:00:00Z','Version':2},'db_sha256':'a'*64,'full_report_sha256':'b'*64}
|
||||
report={'Results':[{'Vulnerabilities':None}]}
|
||||
self.assertEqual(fresh_scan(receipt,report,NOW)['allseverity_findings'],0)
|
||||
mutations=[lambda r,p:r.update(no_suppression=False),lambda r,p:r.update(image='foreign'),lambda r,p:r.update(scanner='other'),lambda r,p:r.update(completed_at='2026-10-10T21:00:00Z'),lambda r,p:r['db_metadata'].update(NextUpdate='2026-10-11T01:59:00Z'),lambda r,p:p['Results'][0].update(Vulnerabilities=[{'Severity':'LOW'}]),lambda r,p:p.update(Results=[])]
|
||||
for mutate in mutations:
|
||||
r,p=copy.deepcopy(receipt),copy.deepcopy(report);mutate(r,p)
|
||||
with self.assertRaises(ValueError):fresh_scan(r,p,NOW)
|
||||
|
||||
|
||||
class FixedNativeProgram(unittest.TestCase):
|
||||
def fixture(self):
|
||||
sealed = json.loads((CASE / 'sealed-live-deployment.json').read_text())
|
||||
live = copy.deepcopy(sealed)
|
||||
live['metadata'].update(generation=42)
|
||||
live['status'] = {'readyReplicas': 1, 'updatedReplicas': 1, 'observedGeneration': 42}
|
||||
dependencies = json.loads((CASE / 'sealed-native-dependencies.json').read_text())
|
||||
cm = copy.deepcopy(dependencies['configmap'])
|
||||
cm.pop('canonical_data_sha256')
|
||||
service = json.loads((CASE / 'candidate-deployment.json').read_text())
|
||||
source_service = json.loads((Path('/home/worsch/informed-decision/deploy/lifecycle/service.candidate.json')).read_text())
|
||||
cm['data'] = next(x for x in source_service['items'] if x['kind'] == 'ConfigMap')['data']
|
||||
pvc = copy.deepcopy(dependencies['pvc'])
|
||||
pvc['status'] = {'phase': 'Bound'}
|
||||
app = {'metadata': {'uid': '499868f2-eabc-4df4-ae31-b89ce58d750d', 'resourceVersion': '17'},
|
||||
'spec': {'source': {'repoURL': 'https://forgejo.coulomb.social/coulomb/informed-decision.git',
|
||||
'path': 'deploy/lifecycle', 'targetRevision': 'c96b0c6d881e855d1d158003c6de90ef390262e2'},
|
||||
'destination': {'namespace': 'informed-decision', 'server': 'https://kubernetes.default.svc'}}}
|
||||
objects = {'deployment': live, 'configmap': cm, 'pvc': pvc, 'application': app}
|
||||
payload = {'phase': 'release', 'source_revision': REVISION, 'approval': {}, 'sealed': sealed,
|
||||
'dependencies': dependencies, 'candidate': service,
|
||||
'rollback': json.loads((CASE / 'rollback-deployment.json').read_text()),
|
||||
'readonly': (CASE / 'sqlite_readonly.py').read_text(),'purpose_checks':(CASE/'check_installed.py').read_text(),
|
||||
'installed_zlib': json.loads((CASE / 'installed-zlib-proof.json').read_text()), 'receipt_safety': (Path(__file__).parent / 'receipt_safety.py').read_text()}
|
||||
return objects, payload
|
||||
|
||||
def execute_fake(self, objects, payload, ambiguous=False, schema_refused=False):
|
||||
writes = []
|
||||
calls = []
|
||||
|
||||
def fake(argv, input=None, **kwargs):
|
||||
calls.append(argv)
|
||||
if argv[:2] == ['kubectl', 'get']:
|
||||
kind = argv[2]
|
||||
if kind in objects:
|
||||
body = objects[kind]
|
||||
elif kind == 'pods':
|
||||
body = {'items': [{'metadata': {'name': 'fixture-pod', 'uid': 'c4cb1550-feda-4097-9de4-d891a657b662',
|
||||
'ownerReferences': [{'kind': 'ReplicaSet', 'name': 'fixture-rs', 'uid': 'rs-uid'}]},
|
||||
'spec': objects['deployment']['spec']['template']['spec'],
|
||||
'status': {'phase': 'Running', 'containerStatuses': [{'name':'informed-decision','ready': True,'imageID':objects['deployment']['spec']['template']['spec']['containers'][0]['image']}] }}]}
|
||||
elif kind == 'replicaset':
|
||||
body = {'metadata': {'uid': 'rs-uid', 'ownerReferences': [
|
||||
{'kind': 'Deployment', 'uid': payload['sealed']['metadata']['uid']}]}}
|
||||
elif kind == 'nodes':
|
||||
body = {'items': [{'metadata': {'name': 'fixture-node'}, 'status': {
|
||||
'addresses': [{'address': '92.205.62.239'}], 'allocatable': {'cpu': '4'},
|
||||
'conditions': [{'type': key, 'status': 'True' if key == 'Ready' else 'False'}
|
||||
for key in ('Ready', 'MemoryPressure', 'DiskPressure', 'PIDPressure')]}}]}
|
||||
else:
|
||||
raise AssertionError('unexpected fixed metadata route')
|
||||
return subprocess.CompletedProcess(argv, 0, json.dumps(body), '')
|
||||
if argv[:2] == ['kubectl', 'exec']:
|
||||
if schema_refused:
|
||||
return subprocess.CompletedProcess(argv, 1, '', 'withheld')
|
||||
return subprocess.CompletedProcess(argv, 0, json.dumps({
|
||||
'all_checks_pass': True, 'live_readonly_schema_integrity_counts': COUNT}), '')
|
||||
if argv[:2] == ['kubectl', 'apply']:
|
||||
admitted = copy.deepcopy(payload['sealed'])
|
||||
admitted['spec']['template']['spec']['containers'][0]['image'] = (actuator.IMAGE if payload['phase']=='release' else payload['sealed']['spec']['template']['spec']['containers'][0]['image'])
|
||||
return subprocess.CompletedProcess(argv, 0, json.dumps(admitted), '')
|
||||
if argv[:2] == ['kubectl', 'describe']:
|
||||
return subprocess.CompletedProcess(argv, 0, 'Allocated resources:\n cpu 3460m (86%)\n', '')
|
||||
if argv[:2] == ['kubectl', 'diff']:
|
||||
return subprocess.CompletedProcess(argv, 1, '-image: base\n+image: candidate\n', '')
|
||||
if argv[:2] == ['kubectl', 'patch']:
|
||||
if '--dry-run=server' not in argv:
|
||||
writes.append(json.loads(input))
|
||||
if ambiguous:
|
||||
return subprocess.CompletedProcess(argv, 1, '', 'withheld')
|
||||
return subprocess.CompletedProcess(argv, 0, 'application.argoproj.io/informed-decision\n', '')
|
||||
raise AssertionError('unexpected command')
|
||||
|
||||
source = PROGRAM.replace('__PAYLOAD__', repr(json.dumps(payload))).replace(
|
||||
'__GUARD__', repr((CASE / 'change_guard.py').read_text()))
|
||||
output = io.StringIO()
|
||||
with patch('subprocess.run', side_effect=fake), redirect_stdout(output):
|
||||
try:
|
||||
exec(compile(source, 'fixed-native-fixture', 'exec'), {'__name__': '__fixture__'})
|
||||
except (ValueError, SystemExit):
|
||||
pass
|
||||
receipt = json.loads(output.getvalue()) if output.getvalue() else {'all_checks_pass': False}
|
||||
return receipt, writes, calls
|
||||
|
||||
def test_only_existing_application_operation_and_deployment_are_requested(self):
|
||||
objects, payload = self.fixture()
|
||||
receipt, writes, calls = self.execute_fake(objects, payload)
|
||||
self.assertTrue(receipt['all_checks_pass'])
|
||||
self.assertFalse(receipt['rollout_verified'])
|
||||
self.assertEqual(len(writes), 1)
|
||||
operation = writes[0][-1]['value']
|
||||
self.assertFalse(operation['sync']['prune'])
|
||||
self.assertEqual(operation['sync']['resources'], [
|
||||
{'group': 'apps', 'kind': 'Deployment', 'name': 'informed-decision', 'namespace': 'informed-decision'}])
|
||||
self.assertTrue(any('--dry-run=server' in argv and argv[:2] == ['kubectl', 'patch'] for argv in calls))
|
||||
self.assertEqual(writes[0][0]['path'], '/metadata/uid')
|
||||
|
||||
def test_source_overrides_automation_and_custody_drift_stop_before_write(self):
|
||||
mutations = [lambda o: o['application']['metadata'].update(uid='recreated'),
|
||||
lambda o: o['application']['spec'].update(syncPolicy={'automated': {}}),
|
||||
lambda o: o['application']['spec']['source'].update(kustomize={'images': ['other']}),
|
||||
lambda o: o['application']['spec'].update(sources=[{}]),
|
||||
lambda o: o['configmap']['metadata'].update(uid='recreated'),
|
||||
lambda o: o['pvc']['spec'].update(volumeName='replaced'),
|
||||
lambda o: o['deployment']['status'].update(readyReplicas=0)]
|
||||
for mutate in mutations:
|
||||
with self.subTest(mutate=mutate):
|
||||
objects, payload = self.fixture()
|
||||
mutate(objects)
|
||||
receipt, writes, calls = self.execute_fake(objects, payload)
|
||||
self.assertFalse(receipt['all_checks_pass'])
|
||||
self.assertEqual(writes, [])
|
||||
|
||||
def test_preopen_schema_refusal_prevents_image_operation(self):
|
||||
objects, payload = self.fixture()
|
||||
receipt, writes, calls = self.execute_fake(objects, payload, schema_refused=True)
|
||||
self.assertFalse(receipt['all_checks_pass'])
|
||||
self.assertEqual(writes, [])
|
||||
|
||||
|
||||
def test_rollback_unready_candidate_never_reads_pod_or_database(self):
|
||||
objects, payload = self.fixture()
|
||||
payload['phase'] = 'rollback'
|
||||
objects['deployment']['status'].update(readyReplicas=0, updatedReplicas=0)
|
||||
objects['deployment']['spec']['template']['spec']['containers'][0]['image'] = actuator.IMAGE
|
||||
objects['application']['spec']['source']['targetRevision'] = REVISION
|
||||
receipt, writes, calls = self.execute_fake(objects, payload, schema_refused=True)
|
||||
self.assertTrue(receipt['all_checks_pass'])
|
||||
self.assertFalse(receipt['rollout_verified'])
|
||||
self.assertEqual(len(writes), 1)
|
||||
self.assertFalse(any(argv[:2] == ['kubectl', 'exec'] or argv[:3] == ['kubectl', 'get', 'pods'] for argv in calls))
|
||||
self.assertEqual(writes[0][-1]['value']['sync']['revision'], 'c96b0c6d881e855d1d158003c6de90ef390262e2')
|
||||
|
||||
def test_rollback_still_refuses_custody_or_nonpair_image_drift(self):
|
||||
for defect in ('cm', 'pvc', 'image'):
|
||||
with self.subTest(defect=defect):
|
||||
objects, payload = self.fixture();payload['phase'] = 'rollback'
|
||||
objects['deployment']['status']['readyReplicas'] = 0
|
||||
if defect == 'cm':objects['configmap']['metadata']['uid'] = 'recreated'
|
||||
elif defect == 'pvc':objects['pvc']['spec']['volumeName'] = 'replaced'
|
||||
else:objects['deployment']['spec']['template']['spec']['containers'][0]['image'] = 'foreign-image'
|
||||
receipt, writes, calls = self.execute_fake(objects, payload)
|
||||
self.assertFalse(receipt['all_checks_pass']);self.assertEqual(writes, [])
|
||||
|
||||
def test_recovery_verification_is_separate_ready_old_image_schema_proof(self):
|
||||
objects, payload = self.fixture();payload['phase'] = 'rollback-verify'
|
||||
resource={'group':'apps','kind':'Deployment','name':'informed-decision','namespace':'informed-decision'}
|
||||
target='c96b0c6d881e855d1d158003c6de90ef390262e2'
|
||||
payload['operation_intent']={'state':'COMPLETE','started_at':'2026-10-11T01:00:00Z','result':{'operation_requested':True,'source_revision':target,'prune':False,'resources':[resource]}}
|
||||
objects['application']['status']={'operationState':{'phase':'Succeeded','startedAt':'2026-10-11T01:00:01Z','finishedAt':'2026-10-11T01:01:00Z','operation':{'initiatedBy':{'username':'custodian-codex'},'sync':{'revision':target,'resources':[resource]}},'syncResult':{'revision':target,'resources':[{**resource,'status':'Synced'}]}}}
|
||||
receipt, writes, calls = self.execute_fake(objects, payload)
|
||||
self.assertTrue(receipt['all_checks_pass']);self.assertTrue(receipt['recovery_verification'])
|
||||
self.assertEqual(writes, [])
|
||||
self.assertTrue(any(argv[:2]==['kubectl','exec'] for argv in calls))
|
||||
objects['deployment']['status']['readyReplicas'] = 0
|
||||
receipt, writes, calls = self.execute_fake(objects,payload)
|
||||
self.assertFalse(receipt['all_checks_pass'])
|
||||
|
||||
def test_ambiguous_patch_is_never_retried(self):
|
||||
objects, payload = self.fixture()
|
||||
receipt, writes, calls = self.execute_fake(objects, payload, ambiguous=True)
|
||||
self.assertFalse(receipt['all_checks_pass'])
|
||||
self.assertEqual(len(writes), 1)
|
||||
|
||||
def test_false_omitempty_needs_bound_current_request_and_exact_completion(self):
|
||||
objects,payload=self.fixture();payload['phase']='rollback-verify'
|
||||
resource={'group':'apps','kind':'Deployment','name':'informed-decision','namespace':'informed-decision'}
|
||||
target='c96b0c6d881e855d1d158003c6de90ef390262e2'
|
||||
payload['operation_intent']={'state':'COMPLETE','started_at':'2026-10-11T01:00:00Z','result':{'operation_requested':True,'source_revision':target,'prune':False,'resources':[resource]}}
|
||||
objects['application']['status']={'operationState':{'phase':'Succeeded','startedAt':'2026-10-11T01:00:01Z','finishedAt':'2026-10-11T01:01:00Z','operation':{'initiatedBy':{'username':'custodian-codex'},'sync':{'revision':target,'resources':[resource]}},'syncResult':{'revision':target,'resources':[{**resource,'status':'Synced'}]}}}
|
||||
self.assertTrue(self.execute_fake(objects,payload)[0]['all_checks_pass'])
|
||||
mutations=[lambda o,p:o['application']['status']['operationState']['operation']['sync'].update(prune=True),
|
||||
lambda o,p:o['application']['status']['operationState']['operation']['sync'].update(prune=None),
|
||||
lambda o,p:o['application']['status']['operationState'].update(startedAt='2026-10-11T00:59:00Z'),
|
||||
lambda o,p:o['application']['status']['operationState']['operation'].update(initiatedBy={'username':'other'}),
|
||||
lambda o,p:o['application']['status']['operationState']['syncResult'].update(revision='foreign'),
|
||||
lambda o,p:o['application']['status']['operationState']['syncResult']['resources'][0].update(status='Pruned'),
|
||||
lambda o,p:p['operation_intent']['result'].update(prune=True),
|
||||
lambda o,p:p.update(operation_intent=None)]
|
||||
for mutate in mutations:
|
||||
o,p=copy.deepcopy(objects),copy.deepcopy(payload);mutate(o,p)
|
||||
receipt,writes,calls=self.execute_fake(o,p)
|
||||
self.assertFalse(receipt['all_checks_pass']);self.assertEqual(writes,[])
|
||||
|
||||
def test_optimized_executor_refuses_before_any_input(self):
|
||||
result=subprocess.run([sys.executable,'-O',str(Path(__file__).parent/'actuator.py'),'--phase','release','--root-authority-receipt','/missing','--root-native-outcome','/missing','--source-revision',REVISION],capture_output=True,text=True)
|
||||
self.assertNotEqual(result.returncode,0)
|
||||
self.assertIn('optimized interpreter refused',result.stderr)
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
unittest.main()
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
{
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"artifact_source_revision": "9b4bb25d325698ae543e7e8a8a3c3592db1f58fc",
|
||||
"scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
|
||||
"full_allseverity_scan": true,
|
||||
"no_suppression": true,
|
||||
"exit_code": null,
|
||||
"completed_at": null,
|
||||
"db_metadata": null,
|
||||
"db_sha256": null,
|
||||
"full_report_sha256": null,
|
||||
"note": "Template is not actual evidence or approval"
|
||||
}
|
||||
|
|
@ -0,0 +1,147 @@
|
|||
[
|
||||
{
|
||||
"original_path": "deploy/lifecycle/admission.candidate.json",
|
||||
"original_sha256": "6c76cedd0abc4a4261cfcb69c6597611c282bd4fed8b6aaf77aff04fdf942529",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/deploy/lifecycle/admission.candidate.json"
|
||||
},
|
||||
{
|
||||
"original_path": "deploy/lifecycle/kustomization.yaml",
|
||||
"original_sha256": "1bbce81bc6758434354157f8601534320c5d0290587908fd15a6d25e3fa57f47",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/deploy/lifecycle/kustomization.yaml"
|
||||
},
|
||||
{
|
||||
"original_path": "deploy/lifecycle/registries.candidate.json",
|
||||
"original_sha256": "9bad6db5fbc2178d31b04120016a41830c3552fbb9e2517b718f9bbe87cf649e",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/deploy/lifecycle/registries.candidate.json"
|
||||
},
|
||||
{
|
||||
"original_path": "deploy/lifecycle/service.candidate.json",
|
||||
"original_sha256": "383332cd4fd27a8b36e63a4d79addc43eb68615f742328d4577bfc2b467e2278",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/deploy/lifecycle/service.candidate.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/artifact-comparison.json",
|
||||
"original_sha256": "a1c5d9e249dc00600449998360faf6e8da0206b568c76d155602c4645fa5fce4",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/artifact-comparison.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/candidate-deployment.json",
|
||||
"original_sha256": "487f834cc86dcbc7a04c2392bde072ecaf87dc116b4baa16c35eb9c599ad5c95",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/candidate-deployment.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/candidate-runtime.json",
|
||||
"original_sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/candidate-runtime.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/change_guard.py",
|
||||
"original_sha256": "b3ee2b89de14e204efedd016d3900b6e31fcc9f0ea0f3125d3a4794d938ca201",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/change_guard.py"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/check_installed.py",
|
||||
"original_sha256": "a34a51be9c9f2b16a06a88173b5c6c492c9957fe021cf412a86a1737730640ad",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/check_installed.py"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/decision-packet.md",
|
||||
"original_sha256": "763f30c1433d1ca872b029519ec46ad1b97c47d60b7ea0eea0275a2c6b647dc3",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/decision-packet.md"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/execution/actuator.py",
|
||||
"original_sha256": "741b490bdb315896f05f2e91404c02765517dc1beea81fa590017fccafd299b4",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/actuator.py"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/execution/authority_journal.py",
|
||||
"original_sha256": "040144321c69622c223a8437832a3c5a4a9595fc37774fde5ff0ad676828ebf0",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/authority_journal.py"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/execution/execution-plan.json",
|
||||
"original_sha256": "9b458e2b4d418525987b6cb1b9a160c4b1a2c621625c1b5c571ea5c77e9d4361",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/execution-plan.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/execution/native_program.py",
|
||||
"original_sha256": "fcf8fc3593910b2e99dd51d159a30aa9b853c40ff00c566a620d20eaadc8af20",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/native_program.py"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/execution/receipt_safety.py",
|
||||
"original_sha256": "5c54373f2dc4b064008225c186efb1d5afdeec36d15350bda0a12ded97602d1b",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/receipt_safety.py"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/execution/test_execution.py",
|
||||
"original_sha256": "aa86921fe37fcff382676490f937af2e62bd6472a6b4700c862aaf3ce4ab8225",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/execution/test_execution.py"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/installed-zlib-proof.json",
|
||||
"original_sha256": "6af62f86f50ac185fab94163c24ac8150ead69e62f8d825b0dce1e75a5a57b68",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/installed-zlib-proof.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/memo.json",
|
||||
"original_sha256": "3c76c6a8f95dcb55183583a937a4428b745a5c918643de8f2a2bc11dee846d98",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/memo.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/native-backup-restore-protocol.md",
|
||||
"original_sha256": "f586a511c1921490185bab95334f27de6d3cca20b348df20d18bcb9257d7ae35",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/native-backup-restore-protocol.md"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/native-preflight.json",
|
||||
"original_sha256": "56637994dfdae46a6f9ab442c2ff9b259212650b35eb98d896c5e837f01ce2f9",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/native-preflight.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/proposal.json",
|
||||
"original_sha256": "48b0f0baf4efc239111411ad7d1c291f8eceaa0ddf1414dac73d49ccdb3bbe70",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/proposal.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/published-verification.json",
|
||||
"original_sha256": "dd4eecf0c103dca7922094a8beeb99b77ae96fd1d5fe532e37bd833daa02614e",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/published-verification.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/rollback-deployment.json",
|
||||
"original_sha256": "f8a9a07abc2eb52cdf6bcdba2d9f79dec073145c31d0444a9e0fe1147e42cc4e",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/rollback-deployment.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/runtime-receipt.json",
|
||||
"original_sha256": "6442676dcfd941f0a05a4cb79a02dea839fcd332d82b2154c15cf6db68de5889",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/runtime-receipt.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/scan-receipt.json",
|
||||
"original_sha256": "aaaa91061bb036e6d228b1c1bd4333578dc948cb2bb5ac8ba269429121e7321a",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/scan-receipt.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/sealed-live-deployment.json",
|
||||
"original_sha256": "f8a9a07abc2eb52cdf6bcdba2d9f79dec073145c31d0444a9e0fe1147e42cc4e",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/sealed-live-deployment.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/sealed-native-dependencies.json",
|
||||
"original_sha256": "042327a036ed254cf95dbeb0c056ac25b03a6a844b95a332c992df2943691369",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/sealed-native-dependencies.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/source-commit-proof.json",
|
||||
"original_sha256": "b0811da2d3bd5938733f0078e5fec8e19a6d9752c4277b80bfe9837ed72c6a3b",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/source-commit-proof.json"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-zlib-image-release/sqlite_readonly.py",
|
||||
"original_sha256": "9093c64f7f0e39b249da9fefdf5aaf4e4258bc31e7a27fd888479ce329a20509",
|
||||
"archive_path": "docs/evidence/2026-10-11-zlib-image-release/initial-7ac1d698/owner-snapshot/docs/evidence/2026-10-11-zlib-image-release/sqlite_readonly.py"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,205 @@
|
|||
[
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/lifecycle/admission.candidate.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/deploy/lifecycle/admission.candidate.json",
|
||||
"original_sha256": "92382a56b349c3b895e5806e975082527bb99d1a001140e69d857e5b0391fa55",
|
||||
"staged_sha256": "6c76cedd0abc4a4261cfcb69c6597611c282bd4fed8b6aaf77aff04fdf942529"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/lifecycle/kustomization.yaml",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/deploy/lifecycle/kustomization.yaml",
|
||||
"original_sha256": "1bbce81bc6758434354157f8601534320c5d0290587908fd15a6d25e3fa57f47",
|
||||
"staged_sha256": "1bbce81bc6758434354157f8601534320c5d0290587908fd15a6d25e3fa57f47"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/lifecycle/registries.candidate.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/deploy/lifecycle/registries.candidate.json",
|
||||
"original_sha256": "9bad6db5fbc2178d31b04120016a41830c3552fbb9e2517b718f9bbe87cf649e",
|
||||
"staged_sha256": "9bad6db5fbc2178d31b04120016a41830c3552fbb9e2517b718f9bbe87cf649e"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/lifecycle/service.candidate.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/deploy/lifecycle/service.candidate.json",
|
||||
"original_sha256": "38b78b9cbee5ade7750a58d5156ca4c5773352e947acb304ee714b59e749ceb4",
|
||||
"staged_sha256": "383332cd4fd27a8b36e63a4d79addc43eb68615f742328d4577bfc2b467e2278"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/artifact-comparison.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/artifact-comparison.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "a1c5d9e249dc00600449998360faf6e8da0206b568c76d155602c4645fa5fce4"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/candidate-deployment.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/candidate-deployment.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "487f834cc86dcbc7a04c2392bde072ecaf87dc116b4baa16c35eb9c599ad5c95"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/candidate-runtime.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/candidate-runtime.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/change_guard.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/change_guard.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "b3ee2b89de14e204efedd016d3900b6e31fcc9f0ea0f3125d3a4794d938ca201"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/check_installed.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/check_installed.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "a34a51be9c9f2b16a06a88173b5c6c492c9957fe021cf412a86a1737730640ad"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/decision-packet.md",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/decision-packet.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "763f30c1433d1ca872b029519ec46ad1b97c47d60b7ea0eea0275a2c6b647dc3"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/execution/actuator.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/execution/actuator.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "741b490bdb315896f05f2e91404c02765517dc1beea81fa590017fccafd299b4"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/execution/authority_journal.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/execution/authority_journal.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "040144321c69622c223a8437832a3c5a4a9595fc37774fde5ff0ad676828ebf0"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/execution/execution-plan.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/execution/execution-plan.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "9b458e2b4d418525987b6cb1b9a160c4b1a2c621625c1b5c571ea5c77e9d4361"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/execution/native_program.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/execution/native_program.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "fcf8fc3593910b2e99dd51d159a30aa9b853c40ff00c566a620d20eaadc8af20"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/execution/receipt_safety.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/execution/receipt_safety.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "5c54373f2dc4b064008225c186efb1d5afdeec36d15350bda0a12ded97602d1b"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/execution/test_execution.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/execution/test_execution.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "aa86921fe37fcff382676490f937af2e62bd6472a6b4700c862aaf3ce4ab8225"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/installed-zlib-proof.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/installed-zlib-proof.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "6af62f86f50ac185fab94163c24ac8150ead69e62f8d825b0dce1e75a5a57b68"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/memo.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/memo.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "3c76c6a8f95dcb55183583a937a4428b745a5c918643de8f2a2bc11dee846d98"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/native-backup-restore-protocol.md",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/native-backup-restore-protocol.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f586a511c1921490185bab95334f27de6d3cca20b348df20d18bcb9257d7ae35"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/native-preflight.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/native-preflight.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "56637994dfdae46a6f9ab442c2ff9b259212650b35eb98d896c5e837f01ce2f9"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/proposal.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/proposal.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "48b0f0baf4efc239111411ad7d1c291f8eceaa0ddf1414dac73d49ccdb3bbe70"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/published-verification.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/published-verification.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "dd4eecf0c103dca7922094a8beeb99b77ae96fd1d5fe532e37bd833daa02614e"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/rollback-deployment.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/rollback-deployment.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f8a9a07abc2eb52cdf6bcdba2d9f79dec073145c31d0444a9e0fe1147e42cc4e"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/runtime-receipt.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/runtime-receipt.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "6442676dcfd941f0a05a4cb79a02dea839fcd332d82b2154c15cf6db68de5889"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/scan-receipt.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/scan-receipt.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "aaaa91061bb036e6d228b1c1bd4333578dc948cb2bb5ac8ba269429121e7321a"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/sealed-live-deployment.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/sealed-live-deployment.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f8a9a07abc2eb52cdf6bcdba2d9f79dec073145c31d0444a9e0fe1147e42cc4e"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/sealed-native-dependencies.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/sealed-native-dependencies.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "042327a036ed254cf95dbeb0c056ac25b03a6a844b95a332c992df2943691369"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/source-commit-proof.json",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/source-commit-proof.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "b0811da2d3bd5938733f0078e5fec8e19a6d9752c4277b80bfe9837ed72c6a3b"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-image-release/sqlite_readonly.py",
|
||||
"staged_path": "/tmp/infd-zlib-release-stage/informed-decision/docs/evidence/2026-10-11-zlib-image-release/sqlite_readonly.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "9093c64f7f0e39b249da9fefdf5aaf4e4258bc31e7a27fd888479ce329a20509"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,52 @@
|
|||
{
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"policy": {
|
||||
"origin": "http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080",
|
||||
"package": "informed-decision.compact-sitting",
|
||||
"version": "v13",
|
||||
"package_digest": "sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873",
|
||||
"pod_name": "flex-auth-informed-decision-sitting"
|
||||
},
|
||||
"keycape_egress_ips": [
|
||||
"92.205.62.239"
|
||||
],
|
||||
"storage_class": "local-path",
|
||||
"ordinary_approval_ids": [
|
||||
"2ce76d7f-01c3-4b63-8476-8d1230679769",
|
||||
"c2af4bcf-15b4-4305-aac1-acc7e4dcb099",
|
||||
"dc22666a-d5d7-46bc-9490-ebe9fe09dc38"
|
||||
],
|
||||
"lifecycle_policy": {
|
||||
"package": "informed-decision.lifecycle",
|
||||
"version": "v2",
|
||||
"package_digest": "sha256:da01e045fc108adec6b489e5d51f7e57366793016c5a64776963780a6aae457c",
|
||||
"origin": "http://flex-auth-informed-decision-lifecycle.flex-auth.svc.cluster.local:8080",
|
||||
"pod_name": "flex-auth-informed-decision-lifecycle"
|
||||
},
|
||||
"lifecycle_delivery": true,
|
||||
"intake_attributes": true,
|
||||
"intake_delivery": {
|
||||
"hub_origin": "http://state-hub.state-hub.svc.cluster.local:8000"
|
||||
},
|
||||
"workload_api": {
|
||||
"registries_configmap": "informed-decision-workload-registry",
|
||||
"peers": [
|
||||
{
|
||||
"namespace": "state-hub",
|
||||
"app": "state-hub"
|
||||
}
|
||||
],
|
||||
"api_egress": [
|
||||
{
|
||||
"ip": "10.43.0.1",
|
||||
"port": 443
|
||||
},
|
||||
{
|
||||
"ip": "92.205.62.239",
|
||||
"port": 6443
|
||||
}
|
||||
],
|
||||
"intake": true,
|
||||
"lifecycle": true
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- service.candidate.json
|
||||
- registries.candidate.json
|
||||
commonAnnotations:
|
||||
informed-decision.coulomb.social/admission: approved; INFD-WP-0007 cutover
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "ConfigMap",
|
||||
"metadata": {
|
||||
"name": "informed-decision-workload-registry",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "proposal; INFD-WP-0007 concrete rollout approval required"
|
||||
}
|
||||
},
|
||||
"data": {
|
||||
"lifecycle-callers.json": "{\n \"system:serviceaccount:state-hub:state-hub\": {\n \"tenant\": \"tenant:platform\"\n }\n}\n",
|
||||
"intake-submitters.json": "{\n \"system:serviceaccount:state-hub:state-hub\": {\n \"submitter_id\": \"state-hub\",\n \"memo_classes\": [\n \"decision-record\"\n ],\n \"review_groups\": [\n \"net-kingdom-admins\"\n ],\n \"daily_limit\": 50\n }\n}\n",
|
||||
"review-groups.json": "{\n \"net-kingdom-admins\": {\n \"subject\": \"uid=platform-root,ou=people,dc=netkingdom,dc=local\",\n \"display_name\": \"Platform reviewer\"\n }\n}\n"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,800 @@
|
|||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "List",
|
||||
"items": [
|
||||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "ServiceAccount",
|
||||
"metadata": {
|
||||
"name": "review",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
||||
}
|
||||
},
|
||||
"automountServiceAccountToken": false
|
||||
},
|
||||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "PersistentVolumeClaim",
|
||||
"metadata": {
|
||||
"name": "informed-decision-data",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"accessModes": [
|
||||
"ReadWriteOnce"
|
||||
],
|
||||
"storageClassName": "local-path",
|
||||
"resources": {
|
||||
"requests": {
|
||||
"storage": "1Gi"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "ConfigMap",
|
||||
"metadata": {
|
||||
"name": "informed-decision-runtime-6c221878d051",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
||||
}
|
||||
},
|
||||
"immutable": true,
|
||||
"data": {
|
||||
"runtime.json": "{\"approval_origin\":\"http://approval-engine.approval-engine.svc.cluster.local:8080\",\"audit\":{\"origin\":\"http://audit-core.audit-core.svc.cluster.local:8080\",\"sender_token_file\":\"/var/run/secrets/informed-decision/audit/token\"},\"evidence_db\":\"/data/private/review.sqlite\",\"intake_attributes\":true,\"intake_delivery\":{\"hub_origin\":\"http://state-hub.state-hub.svc.cluster.local:8000\"},\"lifecycle_delivery\":true,\"lifecycle_policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-lifecycle.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.lifecycle\",\"package_digest\":\"sha256:da01e045fc108adec6b489e5d51f7e57366793016c5a64776963780a6aae457c\",\"version\":\"v2\"},\"ordinary_approval_ids\":[\"2ce76d7f-01c3-4b63-8476-8d1230679769\",\"c2af4bcf-15b4-4305-aac1-acc7e4dcb099\",\"dc22666a-d5d7-46bc-9490-ebe9fe09dc38\"],\"policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.compact-sitting\",\"package_digest\":\"sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873\",\"version\":\"v13\"},\"schema\":\"informed-decision.review-runtime.v1\",\"workload_api\":{\"intake\":{\"groups_file\":\"/workload-registry/review-groups.json\",\"secret_file\":\"/var/run/secrets/informed-decision/requester/client-secret\",\"submitters_file\":\"/workload-registry/intake-submitters.json\"},\"lifecycle_callers_file\":\"/workload-registry/lifecycle-callers.json\",\"token_review\":{\"ca_file\":\"/var/run/secrets/informed-decision/kubernetes/ca.crt\",\"origin\":\"https://kubernetes.default.svc:443\",\"token_file\":\"/var/run/secrets/informed-decision/kubernetes/token\"}}}"
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "apps/v1",
|
||||
"kind": "Deployment",
|
||||
"metadata": {
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"replicas": 1,
|
||||
"strategy": {
|
||||
"type": "Recreate"
|
||||
},
|
||||
"progressDeadlineSeconds": 600,
|
||||
"selector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"template": {
|
||||
"metadata": {
|
||||
"labels": {
|
||||
"app.kubernetes.io/name": "informed-decision",
|
||||
"app.kubernetes.io/component": "review"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"automountServiceAccountToken": false,
|
||||
"serviceAccountName": "review",
|
||||
"terminationGracePeriodSeconds": 45,
|
||||
"securityContext": {
|
||||
"runAsNonRoot": true,
|
||||
"runAsUser": 10001,
|
||||
"runAsGroup": 10001,
|
||||
"fsGroup": 10001,
|
||||
"fsGroupChangePolicy": "OnRootMismatch",
|
||||
"seccompProfile": {
|
||||
"type": "RuntimeDefault"
|
||||
}
|
||||
},
|
||||
"containers": [
|
||||
{
|
||||
"name": "informed-decision",
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"securityContext": {
|
||||
"allowPrivilegeEscalation": false,
|
||||
"readOnlyRootFilesystem": true,
|
||||
"capabilities": {
|
||||
"drop": [
|
||||
"ALL"
|
||||
]
|
||||
}
|
||||
},
|
||||
"env": [
|
||||
{
|
||||
"name": "INFD_KEYCAPE_ISSUER",
|
||||
"value": "https://kc.coulomb.social"
|
||||
},
|
||||
{
|
||||
"name": "INFD_CONTAINER_CONFIG",
|
||||
"value": "/configuration/runtime.json"
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"name": "http",
|
||||
"containerPort": 8080
|
||||
},
|
||||
{
|
||||
"name": "workload",
|
||||
"containerPort": 8081
|
||||
}
|
||||
],
|
||||
"startupProbe": {
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"timeoutSeconds": 2,
|
||||
"failureThreshold": 12
|
||||
},
|
||||
"readinessProbe": {
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"livenessProbe": {
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"resources": {
|
||||
"requests": {
|
||||
"cpu": "5m",
|
||||
"memory": "64Mi"
|
||||
},
|
||||
"limits": {
|
||||
"cpu": "500m",
|
||||
"memory": "256Mi"
|
||||
}
|
||||
},
|
||||
"volumeMounts": [
|
||||
{
|
||||
"name": "data",
|
||||
"mountPath": "/data"
|
||||
},
|
||||
{
|
||||
"name": "runtime",
|
||||
"mountPath": "/run/informed-decision"
|
||||
},
|
||||
{
|
||||
"name": "tmp",
|
||||
"mountPath": "/tmp"
|
||||
},
|
||||
{
|
||||
"name": "configuration",
|
||||
"mountPath": "/configuration",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"name": "caller",
|
||||
"mountPath": "/var/run/secrets/informed-decision/policy",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"name": "audit",
|
||||
"mountPath": "/var/run/secrets/informed-decision/audit",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"name": "kubernetes-api",
|
||||
"mountPath": "/var/run/secrets/informed-decision/kubernetes",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"name": "workload-registry",
|
||||
"mountPath": "/workload-registry",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"name": "sitting-requester",
|
||||
"mountPath": "/var/run/secrets/informed-decision/requester",
|
||||
"readOnly": true
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"volumes": [
|
||||
{
|
||||
"name": "data",
|
||||
"persistentVolumeClaim": {
|
||||
"claimName": "informed-decision-data"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "runtime",
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "tmp",
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "configuration",
|
||||
"configMap": {
|
||||
"name": "informed-decision-runtime-6c221878d051",
|
||||
"defaultMode": 292
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "caller",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"path": "token",
|
||||
"audience": "flex-auth",
|
||||
"expirationSeconds": 3600
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "audit",
|
||||
"secret": {
|
||||
"secretName": "informed-decision-audit",
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "token",
|
||||
"path": "token"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "kubernetes-api",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"path": "token",
|
||||
"expirationSeconds": 600
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"name": "kube-root-ca.crt",
|
||||
"items": [
|
||||
{
|
||||
"key": "ca.crt",
|
||||
"path": "ca.crt"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "workload-registry",
|
||||
"configMap": {
|
||||
"name": "informed-decision-workload-registry",
|
||||
"defaultMode": 292
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "sitting-requester",
|
||||
"secret": {
|
||||
"secretName": "informed-decision-sitting-requester",
|
||||
"defaultMode": 288,
|
||||
"optional": false,
|
||||
"items": [
|
||||
{
|
||||
"key": "client-secret",
|
||||
"path": "client-secret"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "Service",
|
||||
"metadata": {
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"type": "ClusterIP",
|
||||
"selector": {
|
||||
"app.kubernetes.io/name": "informed-decision",
|
||||
"app.kubernetes.io/component": "review"
|
||||
},
|
||||
"ports": [
|
||||
{
|
||||
"name": "http",
|
||||
"port": 80,
|
||||
"targetPort": "http",
|
||||
"protocol": "TCP"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "networking.k8s.io/v1",
|
||||
"kind": "NetworkPolicy",
|
||||
"metadata": {
|
||||
"name": "informed-decision-review",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision",
|
||||
"app.kubernetes.io/component": "review"
|
||||
}
|
||||
},
|
||||
"policyTypes": [
|
||||
"Ingress",
|
||||
"Egress"
|
||||
],
|
||||
"ingress": [
|
||||
{
|
||||
"from": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "kube-system"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "traefik"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 8080
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"from": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "state-hub"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "state-hub"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 8081
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"egress": [
|
||||
{
|
||||
"to": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "kube-system"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"k8s-app": "kube-dns"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "UDP",
|
||||
"port": 53
|
||||
},
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 53
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"to": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "approval-engine"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "approval-engine"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "audit-core"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "audit-core"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "flex-auth"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "flex-auth-informed-decision-sitting"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "flex-auth"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "flex-auth-informed-decision-lifecycle"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 8080
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"to": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "kube-system"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "traefik"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 8443
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"to": [
|
||||
{
|
||||
"ipBlock": {
|
||||
"cidr": "92.205.62.239/32"
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 443
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"to": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "state-hub"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "state-hub"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 8000
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"to": [
|
||||
{
|
||||
"ipBlock": {
|
||||
"cidr": "10.43.0.1/32"
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 443
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"to": [
|
||||
{
|
||||
"ipBlock": {
|
||||
"cidr": "92.205.62.239/32"
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 6443
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "Service",
|
||||
"metadata": {
|
||||
"name": "informed-decision-workload",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"type": "ClusterIP",
|
||||
"selector": {
|
||||
"app.kubernetes.io/name": "informed-decision",
|
||||
"app.kubernetes.io/component": "review"
|
||||
},
|
||||
"ports": [
|
||||
{
|
||||
"name": "workload",
|
||||
"port": 8081,
|
||||
"targetPort": "workload",
|
||||
"protocol": "TCP"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "rbac.authorization.k8s.io/v1",
|
||||
"kind": "ClusterRole",
|
||||
"metadata": {
|
||||
"name": "informed-decision-tokenreview",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "proposal; INFD-WP-0007/INFD-WP-0005 owner review required"
|
||||
}
|
||||
},
|
||||
"rules": [
|
||||
{
|
||||
"apiGroups": [
|
||||
"authentication.k8s.io"
|
||||
],
|
||||
"resources": [
|
||||
"tokenreviews"
|
||||
],
|
||||
"verbs": [
|
||||
"create"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"apiVersion": "rbac.authorization.k8s.io/v1",
|
||||
"kind": "ClusterRoleBinding",
|
||||
"metadata": {
|
||||
"name": "informed-decision-tokenreview",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "proposal; INFD-WP-0007/INFD-WP-0005 owner review required"
|
||||
}
|
||||
},
|
||||
"roleRef": {
|
||||
"apiGroup": "rbac.authorization.k8s.io",
|
||||
"kind": "ClusterRole",
|
||||
"name": "informed-decision-tokenreview"
|
||||
},
|
||||
"subjects": [
|
||||
{
|
||||
"kind": "ServiceAccount",
|
||||
"name": "review",
|
||||
"namespace": "informed-decision"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"apiVersion": "networking.k8s.io/v1",
|
||||
"kind": "NetworkPolicy",
|
||||
"metadata": {
|
||||
"name": "informed-decision-review-ingress",
|
||||
"namespace": "approval-engine",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08",
|
||||
"informed-decision.coulomb.social/owner-review": "APPROVAL-WP-0002-T01"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "approval-engine"
|
||||
}
|
||||
},
|
||||
"policyTypes": [
|
||||
"Ingress"
|
||||
],
|
||||
"ingress": [
|
||||
{
|
||||
"from": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision",
|
||||
"app.kubernetes.io/component": "review"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 8080
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "networking.k8s.io/v1",
|
||||
"kind": "NetworkPolicy",
|
||||
"metadata": {
|
||||
"name": "informed-decision-review-ingress",
|
||||
"namespace": "flex-auth",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08",
|
||||
"informed-decision.coulomb.social/owner-review": "INFD-WP-0001-T08 policy-owner return"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "flex-auth-informed-decision-sitting"
|
||||
}
|
||||
},
|
||||
"policyTypes": [
|
||||
"Ingress"
|
||||
],
|
||||
"ingress": [
|
||||
{
|
||||
"from": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision",
|
||||
"app.kubernetes.io/component": "review"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 8080
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "networking.k8s.io/v1",
|
||||
"kind": "NetworkPolicy",
|
||||
"metadata": {
|
||||
"name": "informed-decision-lifecycle-ingress",
|
||||
"namespace": "flex-auth",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08",
|
||||
"informed-decision.coulomb.social/owner-review": "INFD-WP-0007 lifecycle policy-owner return"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "flex-auth-informed-decision-lifecycle"
|
||||
}
|
||||
},
|
||||
"policyTypes": [
|
||||
"Ingress"
|
||||
],
|
||||
"ingress": [
|
||||
{
|
||||
"from": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision",
|
||||
"app.kubernetes.io/component": "review"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"protocol": "TCP",
|
||||
"port": 8080
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,73 @@
|
|||
{
|
||||
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
|
||||
"candidate_local_image_config_id": "sha256:622becc3ebd97cb66b6e7c36f35bf931a7decd9464b65851123c1cc8c998d75b",
|
||||
"candidate_registry_digest": null,
|
||||
"base_layers_preserved": 9,
|
||||
"new_layers": 2,
|
||||
"effective_runtime_config_identical": true,
|
||||
"raw_config_bytes_identical": false,
|
||||
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
|
||||
"labels_before": {
|
||||
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
|
||||
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"labels_after": {
|
||||
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"org.opencontainers.image.revision": "9b4bb25d325698ae543e7e8a8a3c3592db1f58fc",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
|
||||
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"final_changed_files": {
|
||||
"lib/apk/db/installed": {
|
||||
"before": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
|
||||
]
|
||||
},
|
||||
"usr/lib/libz.so.1.3.2": {
|
||||
"before": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
|
||||
]
|
||||
}
|
||||
},
|
||||
"directory_metadata_compared": true,
|
||||
"directory_count_base": 313,
|
||||
"directory_count_candidate": 313,
|
||||
"directory_metadata_delta": {},
|
||||
"sbom_package_count_base": 44,
|
||||
"sbom_package_count_candidate": 44,
|
||||
"sbom_only_delta": {
|
||||
"zlib": [
|
||||
"1.3.2-r0",
|
||||
"1.3.2-r1"
|
||||
]
|
||||
},
|
||||
"full_scan_baseline_findings": 1,
|
||||
"full_scan_candidate_allseverity_findings": 0,
|
||||
"db_snapshot_same": true,
|
||||
"native_workload_changed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,286 @@
|
|||
{
|
||||
"apiVersion": "apps/v1",
|
||||
"kind": "Deployment",
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"argocd.argoproj.io/tracking-id": "informed-decision:apps/Deployment:informed-decision/informed-decision",
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision",
|
||||
"uid": "a588e10a-90d2-4883-975e-6dd8b8feca92"
|
||||
},
|
||||
"spec": {
|
||||
"progressDeadlineSeconds": 600,
|
||||
"replicas": 1,
|
||||
"revisionHistoryLimit": 10,
|
||||
"selector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"strategy": {
|
||||
"type": "Recreate"
|
||||
},
|
||||
"template": {
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"labels": {
|
||||
"app.kubernetes.io/component": "review",
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"automountServiceAccountToken": false,
|
||||
"containers": [
|
||||
{
|
||||
"env": [
|
||||
{
|
||||
"name": "INFD_KEYCAPE_ISSUER",
|
||||
"value": "https://kc.coulomb.social"
|
||||
},
|
||||
{
|
||||
"name": "INFD_CONTAINER_CONFIG",
|
||||
"value": "/configuration/runtime.json"
|
||||
}
|
||||
],
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"imagePullPolicy": "IfNotPresent",
|
||||
"livenessProbe": {
|
||||
"failureThreshold": 3,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"name": "informed-decision",
|
||||
"ports": [
|
||||
{
|
||||
"containerPort": 8080,
|
||||
"name": "http",
|
||||
"protocol": "TCP"
|
||||
},
|
||||
{
|
||||
"containerPort": 8081,
|
||||
"name": "workload",
|
||||
"protocol": "TCP"
|
||||
}
|
||||
],
|
||||
"readinessProbe": {
|
||||
"failureThreshold": 3,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"resources": {
|
||||
"limits": {
|
||||
"cpu": "500m",
|
||||
"memory": "256Mi"
|
||||
},
|
||||
"requests": {
|
||||
"cpu": "5m",
|
||||
"memory": "64Mi"
|
||||
}
|
||||
},
|
||||
"securityContext": {
|
||||
"allowPrivilegeEscalation": false,
|
||||
"capabilities": {
|
||||
"drop": [
|
||||
"ALL"
|
||||
]
|
||||
},
|
||||
"readOnlyRootFilesystem": true
|
||||
},
|
||||
"startupProbe": {
|
||||
"failureThreshold": 12,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"terminationMessagePath": "/dev/termination-log",
|
||||
"terminationMessagePolicy": "File",
|
||||
"volumeMounts": [
|
||||
{
|
||||
"mountPath": "/data",
|
||||
"name": "data"
|
||||
},
|
||||
{
|
||||
"mountPath": "/run/informed-decision",
|
||||
"name": "runtime"
|
||||
},
|
||||
{
|
||||
"mountPath": "/tmp",
|
||||
"name": "tmp"
|
||||
},
|
||||
{
|
||||
"mountPath": "/configuration",
|
||||
"name": "configuration",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/policy",
|
||||
"name": "caller",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/audit",
|
||||
"name": "audit",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/kubernetes",
|
||||
"name": "kubernetes-api",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/workload-registry",
|
||||
"name": "workload-registry",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/requester",
|
||||
"name": "sitting-requester",
|
||||
"readOnly": true
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"dnsPolicy": "ClusterFirst",
|
||||
"restartPolicy": "Always",
|
||||
"schedulerName": "default-scheduler",
|
||||
"securityContext": {
|
||||
"fsGroup": 10001,
|
||||
"fsGroupChangePolicy": "OnRootMismatch",
|
||||
"runAsGroup": 10001,
|
||||
"runAsNonRoot": true,
|
||||
"runAsUser": 10001,
|
||||
"seccompProfile": {
|
||||
"type": "RuntimeDefault"
|
||||
}
|
||||
},
|
||||
"serviceAccount": "review",
|
||||
"serviceAccountName": "review",
|
||||
"terminationGracePeriodSeconds": 45,
|
||||
"volumes": [
|
||||
{
|
||||
"name": "data",
|
||||
"persistentVolumeClaim": {
|
||||
"claimName": "informed-decision-data"
|
||||
}
|
||||
},
|
||||
{
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
},
|
||||
"name": "runtime"
|
||||
},
|
||||
{
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
},
|
||||
"name": "tmp"
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"defaultMode": 292,
|
||||
"name": "informed-decision-runtime-6c221878d051"
|
||||
},
|
||||
"name": "configuration"
|
||||
},
|
||||
{
|
||||
"name": "caller",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"audience": "flex-auth",
|
||||
"expirationSeconds": 3600,
|
||||
"path": "token"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "audit",
|
||||
"secret": {
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "token",
|
||||
"path": "token"
|
||||
}
|
||||
],
|
||||
"secretName": "informed-decision-audit"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "kubernetes-api",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"expirationSeconds": 600,
|
||||
"path": "token"
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"items": [
|
||||
{
|
||||
"key": "ca.crt",
|
||||
"path": "ca.crt"
|
||||
}
|
||||
],
|
||||
"name": "kube-root-ca.crt"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"defaultMode": 292,
|
||||
"name": "informed-decision-workload-registry"
|
||||
},
|
||||
"name": "workload-registry"
|
||||
},
|
||||
{
|
||||
"name": "sitting-requester",
|
||||
"secret": {
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "client-secret",
|
||||
"path": "client-secret"
|
||||
}
|
||||
],
|
||||
"optional": false,
|
||||
"secretName": "informed-decision-sitting-requester"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
File diff suppressed because one or more lines are too long
|
|
@ -0,0 +1,68 @@
|
|||
"""Read-only exact Deployment and admission boundaries; no mutation authority."""
|
||||
import copy
|
||||
import hashlib
|
||||
import json
|
||||
|
||||
BASE = 'forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a'
|
||||
CANDIDATE = 'forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23'
|
||||
|
||||
|
||||
def dependency_projection(configmap, pvc):
|
||||
if (configmap.get('kind') != 'ConfigMap' or configmap.get('immutable') is not True
|
||||
or configmap['metadata']['namespace'] != 'informed-decision'
|
||||
or configmap['metadata']['name'] != 'informed-decision-runtime-6c221878d051'
|
||||
or set(configmap.get('data', {})) != {'runtime.json'}
|
||||
or configmap.get('binaryData')):
|
||||
raise ValueError('unexpected immutable runtime config identity')
|
||||
if (pvc.get('kind') != 'PersistentVolumeClaim'
|
||||
or pvc['metadata']['namespace'] != 'informed-decision'
|
||||
or pvc['metadata']['name'] != 'informed-decision-data'
|
||||
or pvc.get('status', {}).get('phase') != 'Bound'
|
||||
or not pvc.get('spec', {}).get('volumeName')):
|
||||
raise ValueError('unexpected bound PVC custody')
|
||||
config = projection(configmap)
|
||||
config.pop('data')
|
||||
config['canonical_data_sha256'] = hashlib.sha256(json.dumps(
|
||||
configmap['data'], sort_keys=True, separators=(',', ':')).encode()).hexdigest()
|
||||
return {'configmap': config, 'pvc': projection(pvc), 'pvc_phase': 'Bound'}
|
||||
|
||||
|
||||
def check_dependencies(configmap, pvc, sealed):
|
||||
if dependency_projection(configmap, pvc) != sealed:
|
||||
raise ValueError('runtime config or PVC identity/custody changed')
|
||||
|
||||
|
||||
def projection(value):
|
||||
value = copy.deepcopy(value)
|
||||
value.pop('status', None)
|
||||
for key in ('resourceVersion', 'generation', 'creationTimestamp', 'managedFields'):
|
||||
value['metadata'].pop(key, None)
|
||||
for key in ('kubectl.kubernetes.io/last-applied-configuration', 'deployment.kubernetes.io/revision'):
|
||||
value['metadata'].get('annotations', {}).pop(key, None)
|
||||
return value
|
||||
|
||||
|
||||
def check_current(current, sealed):
|
||||
if projection(current) != sealed:
|
||||
raise ValueError('sealed live UID or configuration changed')
|
||||
|
||||
|
||||
def check_admitted(admitted, sealed):
|
||||
expected = copy.deepcopy(sealed)
|
||||
containers = expected['spec']['template']['spec']['containers']
|
||||
if len(containers) != 1 or containers[0]['name'] != 'informed-decision' or containers[0]['image'] != BASE:
|
||||
raise ValueError('unexpected baseline container identity')
|
||||
containers[0]['image'] = CANDIDATE
|
||||
if projection(admitted) != expected:
|
||||
raise ValueError('admission changed configuration beyond the sole image pin')
|
||||
|
||||
|
||||
def transport_result(exit_code, output):
|
||||
import json
|
||||
try:
|
||||
value = json.loads(output)
|
||||
except (ValueError, TypeError):
|
||||
return {'all_checks_pass': False, 'reason': 'invalid transport result'}
|
||||
if exit_code != 0 or not isinstance(value, dict) or value.get('all_checks_pass') is not True:
|
||||
return {'all_checks_pass': False, 'reason': 'read-only preflight refused'}
|
||||
return value
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
import copy,json,time
|
||||
from datetime import datetime,timezone
|
||||
from informed_decision.policy import PolicyClient,CONTRACT,submitted_digest
|
||||
pin='sha256:'+'b'*64
|
||||
req={'id':'image-purpose-fixture','tenant':'tenant:platform','subject':{'id':'synthetic','type':'service','tenant':'tenant:platform'},'resource':{'id':'memo:fixture','type':'memo','system':'informed-decision','tenant':'tenant:platform'},'action':'register','context':{}}
|
||||
class Transport:
|
||||
def request(self,*args,**kwargs):
|
||||
now=time.time(); stamp=lambda t:datetime.fromtimestamp(t,timezone.utc).isoformat()
|
||||
b={**copy.deepcopy({k:req[k] for k in ('tenant','subject','action','resource','context')}),'request_digest':'sha256:'+'e'*64,'submitted_request_digest':submitted_digest(req)}
|
||||
if self.purpose!='ABSENT':b['purpose']=self.purpose
|
||||
d={'id':'synthetic-decision','contract_version':CONTRACT,'request_id':req['id'],'effect':'allow','matched_policy_version':'v1','subject':req['subject'],'resource':req['resource'],'binding':b,'lifetime':{'kind':'ttl','not_before':stamp(now-1),'expires_at':stamp(now+60)},'provenance':{'policy_package':'fixture','policy_version':'v1','policy_package_digest':pin,'registry_snapshot_digest':'sha256:'+'c'*64,'evaluator':'flex-auth/fixture','decision_time':stamp(now)}}
|
||||
return 200,d
|
||||
checks=[]
|
||||
for purpose in ('ABSENT','','readback','enforcement','unknown',None,False,0,[],{}):
|
||||
t=Transport();t.purpose=purpose
|
||||
c=PolicyClient('https://fixture.invalid',lambda:'synthetic-only',package='fixture',version='v1',package_digest=pin,transport=t)
|
||||
o=c.check(req)
|
||||
if purpose in ('ABSENT',''):assert o.outcome=='allow';o.require_current(time.time())
|
||||
else:assert o.outcome=='invalid_decision' and o.decision_json is None
|
||||
checks.append(str(purpose))
|
||||
print(json.dumps({'installed_image_purpose_variants':len(checks),'binding_forms_allowed':2,'advisory_or_malformed_refused':8,'synthetic_only':True,'native_provider':False}))
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
# Requested decision
|
||||
|
||||
Approve the exact new T05 zlib-only image release and protected same-schema compatibility drill, after final independent Product and Platform acknowledgments. This packet is prepared and unapproved; its final committed source and rollback dry-run are still pending. The prior T04 approval is excluded.
|
||||
|
||||
The admitted owner CI published immutable image f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23 from source9b4bb25d325698ae543e7e8a8a3c3592db1f58fc. Its actual full scan reports zero findings across44packages. The same scan DB finds oneMEDIUM on currentimage763c. Signed official Alpine zlib1.3.2-r1 is the sole package change; actual published filesystem proof shows onlylibz andAPKinstalleddatabase changes, zero313directorymetadata changes, retainedninebaselayers and unchanged36applicationfiles/purposepolicy/config/credentials/audience/resources. Registry-to-daemon config serialization differs under closed verified normalization, without runtime change.
|
||||
|
||||
The exact ordered protected drill and release are specified in native-backup-restore-protocol.md and hash-bound execution bundle. New backup paths, isolated clone and journal are distinct from old evidence. Real private data will enter only approved private custody and the isolated no-network clone; content never enters public evidence. Failed/uncertain phase states remain durable and cannot be retried. Prior T04 failed copy/verify are preserved.
|
||||
|
||||
After schema5/integrity/exactclonecounts pass and clone cleanup succeeds, fresh cutover backup/copy precedes the exact manual image-only Deployment sync. Current baseline is healthygeneration25/image763c/Applicationc96. ImmutableCM6c/PVC/Podconfiguration/PDP origins remain sealed. FreshnodeCPU3460of4000m supports unchangedRecreate, with another check before effect. Brief availability interruption expected.
|
||||
|
||||
Rollback restores Deploymentimage763c andApplicationc96 while retaining latestschema5database; no old snapshot restoration. Separate installed/native health/custody/PDP-gated readback and actual native image rescan precede T05 closure. Allphase starts expireOct12 23:59:59Z; release reserves30minutesforverificationandrecovery. Afterexpiry a newfounderdecision is required. EUR0newrecurringinfrastructure, boundedprivate storage andunpricedattendedtime. No newdoctrine/autopilot/credentialgrant is authorized.
|
||||
|
|
@ -0,0 +1,354 @@
|
|||
"""One fixed supervised phase; never run this during source preparation."""
|
||||
import argparse
|
||||
import hashlib
|
||||
import json
|
||||
import os
|
||||
from pathlib import Path
|
||||
import re
|
||||
import selectors
|
||||
import stat
|
||||
import subprocess
|
||||
import sys
|
||||
import time
|
||||
|
||||
if sys.flags.optimize:
|
||||
raise SystemExit('optimized interpreter refused')
|
||||
|
||||
PHASES = ('drill-backup', 'drill-copy', 'offline-verify', 'cleanup-offline',
|
||||
'cutover-backup', 'cutover-copy', 'release', 'verify', 'rollback', 'rollback-verify')
|
||||
|
||||
|
||||
def require(value, reason):
|
||||
if not value:
|
||||
raise ValueError(reason)
|
||||
|
||||
|
||||
def sha(path):
|
||||
digest = hashlib.sha256()
|
||||
with Path(path).open('rb') as stream:
|
||||
for block in iter(lambda: stream.read(1024**2), b''):
|
||||
digest.update(block)
|
||||
return digest.hexdigest()
|
||||
|
||||
|
||||
def private(path, directory=False):
|
||||
info = Path(path).lstat()
|
||||
require((stat.S_ISDIR(info.st_mode) if directory else stat.S_ISREG(info.st_mode))
|
||||
and info.st_uid == os.getuid() and stat.S_IMODE(info.st_mode) == (0o700 if directory else 0o600)
|
||||
and (directory or info.st_nlink == 1), 'private owned custody required')
|
||||
|
||||
ROOT = Path(__file__).resolve().parent
|
||||
CASE = ROOT.parent
|
||||
OWNER = Path('/home/worsch/informed-decision')
|
||||
CUSTODIAN = Path('/home/worsch/the-custodian')
|
||||
CUSTODY = CUSTODIAN / '.private-backups/20261011-infd-zlib-r1'
|
||||
SOCKET = 'unix:///var/run/docker.sock'
|
||||
IMAGE = 'forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23'
|
||||
VOLUME = 'infd-zlib-r1-restore-20261011'
|
||||
MAX_BYTES = 512 * 1024**2
|
||||
|
||||
|
||||
def run(argv, body=None, timeout=90):
|
||||
return subprocess.run(argv, input=body, text=True, capture_output=True, timeout=timeout)
|
||||
|
||||
|
||||
def json_result(result):
|
||||
try:
|
||||
value = json.loads(result.stdout)
|
||||
except (ValueError, TypeError):
|
||||
raise ValueError('safe phase receipt unavailable; outcome uncertain') from None
|
||||
require(result.returncode == 0 and isinstance(value, dict) and value.get('all_checks_pass') is True,
|
||||
'phase did not verify complete; raw output withheld; no retry')
|
||||
permitted = {'phase', 'all_checks_pass', 'raw_output_withheld', 'native_approval_verified_by_root',
|
||||
'native_authenticated_grant', 'source_readonly_baseline', 'snapshot_readonly',
|
||||
'snapshot_sha256', 'snapshot_bytes', 'snapshot_file', 'native_parent_private',
|
||||
'native_uid', 'pod_name', 'pod_uid', 'live_readonly_schema_integrity_counts',
|
||||
'live_counts_may_include_concurrent_commits', 'operation_requested', 'source_revision',
|
||||
'resources', 'prune', 'rollout_verified', 'latest_live_database_retained',
|
||||
'client_diff_sha256', 'native_rollout_verified', 'current_schema5_database_retained',
|
||||
'private_copy_verified', 'installed_purpose_checks', 'policy_sha256',
|
||||
'policy_mode', 'policy_uid', 'installed_zlib_files', 'zlib_package', 'health_statuses', 'native_provider_probe', 'recovery_verification'}
|
||||
require(set(value) <= permitted, 'unexpected output fields withheld')
|
||||
from receipt_safety import counts
|
||||
for name in ('source_readonly_baseline', 'snapshot_readonly', 'live_readonly_schema_integrity_counts'):
|
||||
if name in value:
|
||||
counts(value[name])
|
||||
for name in ('snapshot_sha256', 'client_diff_sha256'):
|
||||
if name in value:
|
||||
require(re.fullmatch(r'[a-f0-9]{64}', value[name]) is not None, 'invalid output digest withheld')
|
||||
if 'snapshot_bytes' in value:
|
||||
require(type(value['snapshot_bytes']) is int and 0 < value['snapshot_bytes'] <= MAX_BYTES,
|
||||
'invalid output size withheld')
|
||||
if 'snapshot_file' in value:
|
||||
require(value['snapshot_file'] in ('drill.sqlite', 'cutover.sqlite'), 'invalid output file withheld')
|
||||
return value
|
||||
|
||||
|
||||
def docker(argv, body=None, timeout=120):
|
||||
return run(['docker', '--config', str(CUSTODY / 'empty-docker-config'), '--host', SOCKET] + argv,
|
||||
body=body, timeout=timeout)
|
||||
|
||||
|
||||
def remote(phase, revision, approved):
|
||||
# Fixed module imported only after main verifies every executor source hash.
|
||||
from native_program import PROGRAM
|
||||
payload = {'phase': phase, 'source_revision': revision, 'approval': approved,
|
||||
'sealed': json.loads((CASE / 'sealed-live-deployment.json').read_text()),
|
||||
'dependencies': json.loads((CASE / 'sealed-native-dependencies.json').read_text()),
|
||||
'candidate': json.loads((CASE / 'candidate-deployment.json').read_text()),
|
||||
'rollback': json.loads((CASE / 'rollback-deployment.json').read_text()),
|
||||
'receipt_safety': (ROOT / 'receipt_safety.py').read_text(),
|
||||
'purpose_checks': (CASE / 'check_installed.py').read_text(),
|
||||
'installed_zlib': json.loads((CASE / 'installed-zlib-proof.json').read_text()), 'readonly': (CASE / 'sqlite_readonly.py').read_text()}
|
||||
script = PROGRAM.replace('__PAYLOAD__', repr(json.dumps(payload))).replace(
|
||||
'__GUARD__', repr((CASE / 'change_guard.py').read_text()))
|
||||
return json_result(run(['ssh', 'railiance01', 'python3 -'], script, timeout=200))
|
||||
|
||||
|
||||
def copy_snapshot(phase, revision, approved, journal):
|
||||
metadata = remote(phase, revision, approved)
|
||||
backup_phase = 'drill-backup' if phase == 'drill-copy' else 'cutover-backup'
|
||||
prior = journal.data['phases'][backup_phase]['result']
|
||||
for key in ('snapshot_sha256', 'snapshot_bytes', 'snapshot_file', 'snapshot_readonly'):
|
||||
require(metadata[key] == prior[key], 'closed frozen snapshot changed')
|
||||
name = metadata['snapshot_file']
|
||||
require(name in ('drill.sqlite', 'cutover.sqlite') and 0 < metadata['snapshot_bytes'] <= MAX_BYTES,
|
||||
'fixed bounded snapshot required')
|
||||
pod = metadata['pod_name']
|
||||
require(re.fullmatch(r'[a-z0-9]([-a-z0-9]*[a-z0-9])?', pod) is not None, 'fixed owner pod name required')
|
||||
local = CUSTODY / name
|
||||
fd = os.open(local, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600)
|
||||
# Binary snapshot stdout goes only to a private file, never tool/chat/log output.
|
||||
# Snapshot schema/count metadata was validated before opening this destination.
|
||||
with os.fdopen(fd, 'wb') as destination:
|
||||
command = ('kubectl exec -n informed-decision ' + pod +
|
||||
' -c informed-decision -- cat /data/private/zlib85091-r1/' + name)
|
||||
transfer = subprocess.Popen(['ssh', 'railiance01', command], stdout=subprocess.PIPE,
|
||||
stderr=subprocess.DEVNULL)
|
||||
selector = selectors.DefaultSelector()
|
||||
selector.register(transfer.stdout, selectors.EVENT_READ)
|
||||
deadline = time.monotonic() + 150
|
||||
received = 0
|
||||
try:
|
||||
while True:
|
||||
remaining = deadline - time.monotonic()
|
||||
require(remaining > 0 and selector.select(remaining), 'private transfer timed out')
|
||||
block = os.read(transfer.stdout.fileno(), 1024**2)
|
||||
if not block:
|
||||
break
|
||||
received += len(block)
|
||||
require(received <= metadata['snapshot_bytes'] and received <= MAX_BYTES,
|
||||
'private copy exceeds frozen snapshot size')
|
||||
destination.write(block)
|
||||
transfer.wait(timeout=max(1, deadline - time.monotonic()))
|
||||
finally:
|
||||
selector.close()
|
||||
transfer.stdout.close()
|
||||
if transfer.poll() is None:
|
||||
transfer.kill()
|
||||
transfer.wait()
|
||||
destination.flush()
|
||||
os.fsync(destination.fileno())
|
||||
private(local)
|
||||
require(transfer.returncode == 0 and local.stat().st_size == metadata['snapshot_bytes']
|
||||
and sha(local) == metadata['snapshot_sha256'], 'private copy incomplete/uncertain; retain, no retry')
|
||||
# Re-read identity/hash after transfer. This is verification, not a write retry.
|
||||
after = remote(phase, revision, approved)
|
||||
require(after['pod_uid'] == metadata['pod_uid'] and after['snapshot_sha256'] == metadata['snapshot_sha256'],
|
||||
'source identity/snapshot changed during transfer')
|
||||
return {**metadata, 'off_cluster_private_copy_verified': True, 'snapshot_contents_output': False}
|
||||
|
||||
|
||||
def offline_verify(journal):
|
||||
from receipt_safety import counts
|
||||
snapshot = CUSTODY / 'drill.sqlite'
|
||||
private(snapshot)
|
||||
previous = journal.data['phases']['drill-copy']['result']
|
||||
require(sha(snapshot) == previous['snapshot_sha256'], 'protected snapshot bytes changed')
|
||||
identity = docker(['info', '--format', '{{json .Name}}'])
|
||||
require(identity.returncode == 0 and json.loads(identity.stdout) == 'bnt-lap001',
|
||||
'local offline Docker engine identity changed')
|
||||
listed = docker(['volume', 'ls', '--format', '{{.Name}}'])
|
||||
require(listed.returncode == 0 and VOLUME not in listed.stdout.splitlines(),
|
||||
'disposable volume absence not verified')
|
||||
nonce = journal.data['phases']['offline-verify']['attempt_id']
|
||||
labels = {'informed-decision.case': 'infd-zlib-20261011-r1',
|
||||
'informed-decision.use': 'offline-restore-only', 'informed-decision.attempt': nonce}
|
||||
created = docker(['volume', 'create', '--driver', 'local', '--label', 'informed-decision.case=infd-zlib-20261011-r1',
|
||||
'--label', 'informed-decision.attempt=' + nonce,
|
||||
'--label', 'informed-decision.use=offline-restore-only', VOLUME])
|
||||
require(created.returncode == 0 and created.stdout.strip() == VOLUME, 'volume creation uncertain; no retry')
|
||||
inspected = docker(['volume', 'inspect', VOLUME])
|
||||
require(inspected.returncode == 0, 'new volume identity unavailable')
|
||||
volume = json.loads(inspected.stdout)
|
||||
require(len(volume) == 1 and volume[0]['Name'] == VOLUME and volume[0].get('Labels') == labels
|
||||
and volume[0].get('Driver') == 'local' and not volume[0].get('Options')
|
||||
and volume[0].get('Scope') == 'local', 'new isolated volume identity changed')
|
||||
identity = {key: volume[0][key] for key in ('Name', 'Labels', 'Driver', 'Scope', 'CreatedAt')}
|
||||
journal.note('offline-verify', 'created_volume_identity', identity)
|
||||
# One-time UID0/CAP_CHOWN initialization is isolated to the NEW named volume.
|
||||
# No host/live PVC/config/token mount exists; this detail needs packet review.
|
||||
initializer = """import hashlib,os,stat,sys
|
||||
if sys.flags.optimize:raise RuntimeError('optimized interpreter refused')
|
||||
folder='/restore';expected=EXPECTED
|
||||
if os.listdir(folder):raise ValueError('new empty private volume required')
|
||||
os.chmod(folder,0o700)
|
||||
fd=os.open(folder+'/review.sqlite',os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW|os.O_WRONLY,0o600)
|
||||
digest=hashlib.sha256();size=0
|
||||
with os.fdopen(fd,'wb') as target:
|
||||
while True:
|
||||
block=sys.stdin.buffer.read(1024**2)
|
||||
if not block:break
|
||||
size+=len(block)
|
||||
if size>512*1024**2:raise ValueError('private restore size exceeds bound')
|
||||
target.write(block);digest.update(block)
|
||||
target.flush();os.fsync(target.fileno())
|
||||
if digest.hexdigest()!=expected:raise ValueError('private copied snapshot differs')
|
||||
os.chown(folder+'/review.sqlite',10001,10001);os.chown(folder,10001,10001)
|
||||
print('{"all_checks_pass":true,"private_copy_verified":true}')
|
||||
""".replace('EXPECTED', repr(previous['snapshot_sha256']))
|
||||
with snapshot.open('rb') as source:
|
||||
argv = ['docker', '--config', str(CUSTODY / 'empty-docker-config'), '--host', SOCKET,
|
||||
'run', '--rm', '-i', '--network', 'none', '--read-only', '--cpus', '1', '--memory', '128m',
|
||||
'--user', '0:0', '--cap-drop', 'ALL', '--cap-add', 'CHOWN',
|
||||
'--security-opt', 'no-new-privileges', '--mount', 'type=volume,src=' + VOLUME + ',dst=/restore',
|
||||
'--entrypoint', 'python', IMAGE, '-c', initializer]
|
||||
copied = subprocess.run(argv, stdin=source, text=True, capture_output=True, timeout=150)
|
||||
json_result(copied)
|
||||
options = ['run', '--rm', '-i', '--network', 'none', '--read-only', '--cpus', '1', '--memory', '128m',
|
||||
'--user', '10001:10001', '--cap-drop', 'ALL', '--security-opt', 'no-new-privileges',
|
||||
'--mount', 'type=volume,src=' + VOLUME + ',dst=/restore']
|
||||
readonly = docker(options + ['--entrypoint', 'python', IMAGE, '-', '--db', '/restore/review.sqlite'],
|
||||
(CASE / 'sqlite_readonly.py').read_text())
|
||||
require(readonly.returncode == 0, 'offline pre-open schema/integrity gate refused; never open Store')
|
||||
checked = counts(json.loads(readonly.stdout))
|
||||
require(checked == previous['snapshot_readonly'], 'frozen snapshot/clone readonly counts differ')
|
||||
admin = docker(options + ['--entrypoint', 'informed-decision-admin', IMAGE,
|
||||
'inspect', '--db', '/restore/review.sqlite'])
|
||||
require(admin.returncode == 0, 'offline admin result uncertain')
|
||||
admin_counts = json.loads(admin.stdout)
|
||||
require(admin_counts == {key: checked[key] for key in ('schema_version', 'lifecycle', 'outbox', 'submissions')},
|
||||
'offline admin changed frozen snapshot counters')
|
||||
# Admin Store construction must not silently alter schema/integrity/counters.
|
||||
post = docker(options + ['--entrypoint', 'python', IMAGE, '-', '--db', '/restore/review.sqlite'],
|
||||
(CASE / 'sqlite_readonly.py').read_text())
|
||||
require(post.returncode == 0, 'offline post-admin readonly integrity gate refused')
|
||||
post_checked = counts(json.loads(post.stdout))
|
||||
require(post_checked == checked == previous['snapshot_readonly'],
|
||||
'offline admin altered frozen snapshot proof')
|
||||
private(snapshot)
|
||||
require(sha(snapshot) == previous['snapshot_sha256'], 'original protected snapshot changed during drill')
|
||||
return {'all_checks_pass': True, 'offline_volume': VOLUME, 'offline_readonly': checked,
|
||||
'offline_post_admin_readonly': post_checked, 'original_snapshot_hash_unchanged': True,
|
||||
'created_volume_identity': identity,
|
||||
'admin_counts': admin_counts, 'network': 'none', 'runtime_tokens_or_config_mounted': False,
|
||||
'service_entrypoint_started': False, 'original_snapshot_retained': True}
|
||||
|
||||
|
||||
def cleanup_offline(journal):
|
||||
inspected = docker(['volume', 'inspect', VOLUME])
|
||||
require(inspected.returncode == 0, 'owned disposable volume identity unverified')
|
||||
value = json.loads(inspected.stdout)
|
||||
expected = journal.data['phases']['offline-verify']['result']['created_volume_identity']
|
||||
require(len(value) == 1 and {key: value[0].get(key) for key in expected} == expected
|
||||
and not value[0].get('Options'), 'volume ownership/recreation changed')
|
||||
removed = docker(['volume', 'rm', VOLUME])
|
||||
require(removed.returncode == 0 and removed.stdout.strip() == VOLUME
|
||||
and docker(['volume', 'inspect', VOLUME]).returncode != 0,
|
||||
'cleanup outcome ambiguous; do not retry')
|
||||
return {'all_checks_pass': True, 'only_disposable_offline_volume_removed': VOLUME,
|
||||
'native_and_offcluster_original_snapshots_retained': True}
|
||||
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser(description=__doc__)
|
||||
parser.add_argument('--phase', choices=PHASES, required=True)
|
||||
parser.add_argument('--root-authority-receipt', type=Path, required=True)
|
||||
parser.add_argument('--root-native-outcome', type=Path, required=True)
|
||||
parser.add_argument('--source-revision', required=True)
|
||||
args = parser.parse_args()
|
||||
require(args.root_authority_receipt == Path('/tmp/security-infd-zlib-root-authority.json')
|
||||
and args.root_native_outcome == Path('/tmp/security-infd-zlib-native-outcome-latest.json'),
|
||||
'fixed supervised receipt paths required')
|
||||
require(re.fullmatch(r'[0-9a-f]{40}', args.source_revision) is not None, 'exact source commit required')
|
||||
# Verify all prepared executor/input bytes before reading authority or dispatching.
|
||||
plan = json.loads((ROOT / 'execution-plan.json').read_text())
|
||||
require(plan.get('state') == 'prepared-reviewed' and plan.get('published_artifact_verified') is True, 'unfrozen proposal cannot execute')
|
||||
require(set(plan['executor_files']) == {'actuator.py', 'authority_journal.py', 'native_program.py', 'receipt_safety.py'},
|
||||
'fixed executor sources required')
|
||||
require(set(plan['owner_source_files']) == {'deploy/lifecycle/admission.candidate.json',
|
||||
'deploy/lifecycle/service.candidate.json',
|
||||
'deploy/lifecycle/kustomization.yaml',
|
||||
'deploy/lifecycle/registries.candidate.json'},
|
||||
'fixed owner image sources required')
|
||||
for relative, digest in plan['executor_files'].items():
|
||||
target = ROOT / relative
|
||||
require(not target.is_symlink() and sha(target) == digest, 'executor source bytes changed')
|
||||
for relative, digest in plan['case_files'].items():
|
||||
require(not Path(relative).is_absolute() and '..' not in Path(relative).parts,
|
||||
'case source path escaped')
|
||||
target = CASE / relative
|
||||
require(not target.is_symlink() and sha(target) == digest, 'case source bytes changed')
|
||||
for relative, digest in plan['owner_source_files'].items():
|
||||
target = OWNER / relative
|
||||
require(not target.is_symlink() and sha(target) == digest, 'owner image-only source changed')
|
||||
committed = subprocess.run(['git', '-C', str(OWNER), 'show', args.source_revision + ':' + relative],
|
||||
capture_output=True)
|
||||
require(committed.returncode == 0 and hashlib.sha256(committed.stdout).hexdigest() == digest,
|
||||
'committed owner render source differs from approved inputs')
|
||||
head = run(['git', '-C', str(OWNER), 'rev-parse', 'HEAD'])
|
||||
require(head.returncode == 0 and head.stdout.strip() == args.source_revision, 'owner source HEAD differs')
|
||||
from authority_journal import Journal, authority
|
||||
private(args.root_authority_receipt)
|
||||
private(args.root_native_outcome)
|
||||
receipt = json.loads(args.root_authority_receipt.read_text())
|
||||
require(receipt.get('native_outcome_sha256') == sha(args.root_native_outcome), 'native outcome bytes changed')
|
||||
require(receipt.get('executor_plan_sha256') == sha(ROOT / 'execution-plan.json'),
|
||||
'root verified executor plan differs')
|
||||
approved = authority(receipt, json.loads(args.root_native_outcome.read_text()), sha(CASE / 'memo.json'),
|
||||
args.source_revision, args.phase)
|
||||
parent = CUSTODY.parent
|
||||
private(parent, directory=True)
|
||||
ignored = run(['git', '-C', str(CUSTODIAN), 'check-ignore', '--no-index', str(CUSTODY / 'drill.sqlite')])
|
||||
require(ignored.returncode == 0, 'offcluster custody is not ignored')
|
||||
if not CUSTODY.exists():
|
||||
require(args.phase == 'drill-backup', 'first approved phase must create unique private custody')
|
||||
os.mkdir(CUSTODY, 0o700)
|
||||
private(CUSTODY, directory=True)
|
||||
capacity = os.statvfs(CUSTODY)
|
||||
require(capacity.f_bavail * capacity.f_frsize >= 2 * MAX_BYTES + 16 * 1024**2,
|
||||
'independent protected custody headroom insufficient')
|
||||
os.makedirs(CUSTODY / 'empty-docker-config', mode=0o700, exist_ok=True)
|
||||
private(CUSTODY / 'empty-docker-config', directory=True)
|
||||
require(not list((CUSTODY / 'empty-docker-config').iterdir()), 'public Docker read config must stay empty')
|
||||
journal = Journal(CUSTODY, {'proposal': plan['proposal_id'], 'source_revision': args.source_revision,
|
||||
'memo_sha256': sha(CASE / 'memo.json'), 'plan_sha256': sha(ROOT / 'execution-plan.json')})
|
||||
try:
|
||||
journal.start(args.phase, approved) # fsynced RUNNING before any phase effect.
|
||||
if args.phase in ('drill-copy', 'cutover-copy'):
|
||||
result = copy_snapshot(args.phase, args.source_revision, approved, journal)
|
||||
elif args.phase == 'offline-verify':
|
||||
result = offline_verify(journal)
|
||||
elif args.phase == 'cleanup-offline':
|
||||
result = cleanup_offline(journal)
|
||||
else:
|
||||
result = remote(args.phase, args.source_revision, approved, operation_intent=journal.data['phases'].get('rollback' if args.phase == 'rollback-verify' else 'release') if args.phase in ('verify', 'rollback-verify') else None)
|
||||
journal.finish(args.phase, result)
|
||||
print(json.dumps(result)) # Only count/hash/identity receipts, never snapshot bytes.
|
||||
except BaseException as error:
|
||||
safe = {'all_checks_pass': False, 'phase': args.phase, 'failure_class': type(error).__name__,
|
||||
'failure': 'fixed phase outcome uncertain; original evidence retained; no retry',
|
||||
'raw_output_withheld': True}
|
||||
if journal.data['phases'].get(args.phase, {}).get('state') == 'RUNNING':
|
||||
journal.finish(args.phase, safe)
|
||||
print(json.dumps(safe))
|
||||
raise SystemExit(1) from None
|
||||
finally:
|
||||
journal.close()
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
try:
|
||||
main()
|
||||
except Exception:
|
||||
raise SystemExit('supervised execution refused before phase; raw output withheld') from None
|
||||
|
|
@ -0,0 +1,150 @@
|
|||
"""Supervised receipt bookkeeping, not an authenticated approval provider."""
|
||||
import datetime
|
||||
import fcntl
|
||||
import hashlib
|
||||
import json
|
||||
import os
|
||||
import re
|
||||
from pathlib import Path
|
||||
import stat
|
||||
import uuid
|
||||
|
||||
FOUNDER = {'kind': 'person', 'sub': 'uid=platform-root,ou=people,dc=netkingdom,dc=local'}
|
||||
MEMO_ID = 'infd-20261011-zlib-remediation-r1'
|
||||
PROPOSAL = 'INFD-WP-0009-T05/zlib85091-r1'
|
||||
PHASES = ('drill-backup', 'drill-copy', 'offline-verify', 'cleanup-offline',
|
||||
'cutover-backup', 'cutover-copy', 'release', 'verify', 'rollback', 'rollback-verify')
|
||||
|
||||
|
||||
def require(value, reason):
|
||||
if not value:
|
||||
raise ValueError(reason)
|
||||
|
||||
|
||||
def sha(path):
|
||||
digest = hashlib.sha256()
|
||||
with Path(path).open('rb') as stream:
|
||||
for block in iter(lambda: stream.read(1024**2), b''):
|
||||
digest.update(block)
|
||||
return digest.hexdigest()
|
||||
|
||||
|
||||
def private(path, directory=False):
|
||||
info = Path(path).lstat()
|
||||
require((stat.S_ISDIR(info.st_mode) if directory else stat.S_ISREG(info.st_mode))
|
||||
and info.st_uid == os.getuid() and stat.S_IMODE(info.st_mode) == (0o700 if directory else 0o600)
|
||||
and (directory or info.st_nlink == 1), 'private owned custody required')
|
||||
|
||||
|
||||
def authority(receipt, outcome, memo_sha, source_revision, phase, now=None):
|
||||
"""Root must freshly verify native outcome at fixed ORIGIN outside this helper.
|
||||
|
||||
Receipt files/flags are not signed grants. This function checks the exact
|
||||
supervised receipt relation; existing harness/founder authority remains the
|
||||
actual permission boundary. It never authenticates a caller as human.
|
||||
"""
|
||||
now = now or datetime.datetime.now(datetime.timezone.utc)
|
||||
require(phase in PHASES, 'fixed phase required')
|
||||
require(receipt.get('proposal_id') == PROPOSAL and receipt.get('memo_id') == MEMO_ID
|
||||
and receipt.get('memo_version') == 1 and receipt.get('memo_sha256') == memo_sha
|
||||
and receipt.get('source_revision') == source_revision
|
||||
and receipt.get('activation') == 'APPROVED'
|
||||
and receipt.get('authority_mode') == 'ADMINISTER'
|
||||
and receipt.get('target') == 'realm:kubernetes/railiance01/informed-decision'
|
||||
and receipt.get('verification_method') == 'root-fixed-origin-native-readback'
|
||||
and receipt.get('runtime_authenticated_grant') is False
|
||||
and receipt.get('outcome_query') == '/lifecycle/memos/' + MEMO_ID + '/outcomes?version=1',
|
||||
'exact externally verified supervised receipt required')
|
||||
verified = datetime.datetime.fromisoformat(receipt['verified_at'].replace('Z', '+00:00'))
|
||||
require(verified.tzinfo is not None and 0 <= (now - verified).total_seconds() <= 120,
|
||||
'fresh root native readback required before every phase')
|
||||
deadline = datetime.datetime.fromisoformat('2026-10-12T23:59:59+00:00')
|
||||
require(now < deadline, 'approved execution window expired')
|
||||
if phase == 'release':
|
||||
require((deadline-now).total_seconds() >= 1800, 'reserve thirty minutes for verification and recovery')
|
||||
require(outcome.get('memo_id') == MEMO_ID and outcome.get('review', {}).get('stale') is False
|
||||
and outcome['review'].get('intake_state') == 'ready', 'native review is not ready/current')
|
||||
review_id = outcome['review']['memo_id']
|
||||
require(review_id == receipt.get('review_memo_id'), 'native review identity changed')
|
||||
accepted = [x for x in outcome.get('dispositions', [])
|
||||
if x.get('submission_state') == 'confirmed'
|
||||
and x.get('disposition', {}).get('verb') == 'accept'
|
||||
and x['disposition'].get('memo_version') == 1]
|
||||
require(len(accepted) == 1, 'one confirmed founder acceptance required')
|
||||
accepted = accepted[0]['disposition']
|
||||
require(accepted.get('actor') == FOUNDER and accepted.get('memo_id') == review_id
|
||||
and accepted.get('approval_id') == receipt.get('approval_id')
|
||||
and accepted.get('id') == receipt.get('disposition_id')
|
||||
and accepted.get('at') == receipt.get('accepted_at'), 'exact founder disposition mismatch')
|
||||
require(re.fullmatch(r'[a-f0-9-]{36}', accepted['approval_id']) is not None
|
||||
and re.fullmatch(r'disp-[a-f0-9-]{36}', accepted['id']) is not None
|
||||
and re.fullmatch(r'review-[a-f0-9-]{36}', review_id) is not None,
|
||||
'native disposition identifiers are malformed')
|
||||
accepted_at = datetime.datetime.fromisoformat(accepted['at'].replace('Z', '+00:00'))
|
||||
require(accepted_at.tzinfo is not None and accepted_at <= verified, 'acceptance time not bounded')
|
||||
return {key: receipt[key] for key in ('approval_id', 'disposition_id', 'accepted_at', 'verified_at')}
|
||||
|
||||
|
||||
class Journal:
|
||||
def __init__(self, parent, identity):
|
||||
self.parent = Path(parent)
|
||||
private(self.parent, directory=True)
|
||||
self.path = self.parent / 'execution-journal.json'
|
||||
self.lock = os.open(self.parent / 'execution.lock', os.O_CREAT | os.O_NOFOLLOW | os.O_RDWR, 0o600)
|
||||
fcntl.flock(self.lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
|
||||
private(self.parent / 'execution.lock')
|
||||
if self.path.exists():
|
||||
private(self.path)
|
||||
self.data = json.loads(self.path.read_text())
|
||||
require(self.data['identity'] == identity, 'journal case/source identity changed')
|
||||
else:
|
||||
self.data = {'identity': identity, 'phases': {}}
|
||||
self.save()
|
||||
|
||||
def save(self):
|
||||
temporary = self.parent / 'execution-journal.new'
|
||||
fd = os.open(temporary, os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW | os.O_WRONLY, 0o600)
|
||||
try:
|
||||
with os.fdopen(fd, 'w') as stream:
|
||||
json.dump(self.data, stream, indent=2)
|
||||
stream.write('\n')
|
||||
stream.flush()
|
||||
os.fsync(stream.fileno())
|
||||
os.replace(temporary, self.path)
|
||||
directory = os.open(self.parent, os.O_DIRECTORY | os.O_RDONLY)
|
||||
try:
|
||||
os.fsync(directory)
|
||||
finally:
|
||||
os.close(directory)
|
||||
except BaseException:
|
||||
# Retain evidence rather than overwriting an uncertain durable intent.
|
||||
raise
|
||||
|
||||
def start(self, phase, approval):
|
||||
require(phase not in self.data['phases'], 'already attempted phase; no retry')
|
||||
predecessors = dict(zip(PHASES[1:8], PHASES[:7]))
|
||||
predecessors['rollback-verify'] = 'rollback'
|
||||
if phase in predecessors:
|
||||
require(self.data['phases'].get(predecessors[phase], {}).get('state') == 'COMPLETE',
|
||||
'preceding phase is not verified complete')
|
||||
if phase == 'rollback':
|
||||
require('release' in self.data['phases'], 'rollback requires a recorded release attempt')
|
||||
self.data['phases'][phase] = {'state': 'RUNNING', 'approval': approval,
|
||||
'attempt_id': str(uuid.uuid4()),
|
||||
'started_at': datetime.datetime.now(datetime.timezone.utc).isoformat()}
|
||||
self.save()
|
||||
|
||||
def note(self, phase, key, value):
|
||||
require(self.data['phases'][phase]['state'] == 'RUNNING', 'phase intent missing')
|
||||
self.data['phases'][phase][key] = value
|
||||
self.save()
|
||||
|
||||
def finish(self, phase, result):
|
||||
entry = self.data['phases'][phase]
|
||||
require(entry['state'] == 'RUNNING', 'phase intent missing')
|
||||
entry['result'] = result
|
||||
entry['state'] = 'COMPLETE' if result.get('all_checks_pass') is True else 'UNCERTAIN'
|
||||
self.save()
|
||||
|
||||
def close(self):
|
||||
os.close(self.lock)
|
||||
|
|
@ -0,0 +1,59 @@
|
|||
{
|
||||
"kind": "informed-decision.supervised-mechanical-release-plan",
|
||||
"version": 1,
|
||||
"proposal_id": "INFD-WP-0009-T05/zlib85091-r1",
|
||||
"trial_id": "infd-zlib-20261011-r1",
|
||||
"state": "prepared-awaiting-independent-owner-acknowledgments",
|
||||
"executor_files": {
|
||||
"actuator.py": "741b490bdb315896f05f2e91404c02765517dc1beea81fa590017fccafd299b4",
|
||||
"authority_journal.py": "040144321c69622c223a8437832a3c5a4a9595fc37774fde5ff0ad676828ebf0",
|
||||
"native_program.py": "fcf8fc3593910b2e99dd51d159a30aa9b853c40ff00c566a620d20eaadc8af20",
|
||||
"receipt_safety.py": "5c54373f2dc4b064008225c186efb1d5afdeec36d15350bda0a12ded97602d1b"
|
||||
},
|
||||
"case_files": {
|
||||
"scan-receipt.json": "aaaa91061bb036e6d228b1c1bd4333578dc948cb2bb5ac8ba269429121e7321a",
|
||||
"source-commit-proof.json": "b0811da2d3bd5938733f0078e5fec8e19a6d9752c4277b80bfe9837ed72c6a3b",
|
||||
"candidate-deployment.json": "487f834cc86dcbc7a04c2392bde072ecaf87dc116b4baa16c35eb9c599ad5c95",
|
||||
"artifact-comparison.json": "a1c5d9e249dc00600449998360faf6e8da0206b568c76d155602c4645fa5fce4",
|
||||
"rollback-deployment.json": "f8a9a07abc2eb52cdf6bcdba2d9f79dec073145c31d0444a9e0fe1147e42cc4e",
|
||||
"sqlite_readonly.py": "9093c64f7f0e39b249da9fefdf5aaf4e4258bc31e7a27fd888479ce329a20509",
|
||||
"published-verification.json": "dd4eecf0c103dca7922094a8beeb99b77ae96fd1d5fe532e37bd833daa02614e",
|
||||
"sealed-native-dependencies.json": "042327a036ed254cf95dbeb0c056ac25b03a6a844b95a332c992df2943691369",
|
||||
"sealed-live-deployment.json": "f8a9a07abc2eb52cdf6bcdba2d9f79dec073145c31d0444a9e0fe1147e42cc4e",
|
||||
"native-preflight.json": "56637994dfdae46a6f9ab442c2ff9b259212650b35eb98d896c5e837f01ce2f9",
|
||||
"installed-zlib-proof.json": "6af62f86f50ac185fab94163c24ac8150ead69e62f8d825b0dce1e75a5a57b68",
|
||||
"runtime-receipt.json": "6442676dcfd941f0a05a4cb79a02dea839fcd332d82b2154c15cf6db68de5889",
|
||||
"change_guard.py": "b3ee2b89de14e204efedd016d3900b6e31fcc9f0ea0f3125d3a4794d938ca201",
|
||||
"check_installed.py": "a34a51be9c9f2b16a06a88173b5c6c492c9957fe021cf412a86a1737730640ad",
|
||||
"candidate-runtime.json": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124"
|
||||
},
|
||||
"owner_source_files": {
|
||||
"deploy/lifecycle/admission.candidate.json": "6c76cedd0abc4a4261cfcb69c6597611c282bd4fed8b6aaf77aff04fdf942529",
|
||||
"deploy/lifecycle/service.candidate.json": "383332cd4fd27a8b36e63a4d79addc43eb68615f742328d4577bfc2b467e2278",
|
||||
"deploy/lifecycle/kustomization.yaml": "1bbce81bc6758434354157f8601534320c5d0290587908fd15a6d25e3fa57f47",
|
||||
"deploy/lifecycle/registries.candidate.json": "9bad6db5fbc2178d31b04120016a41830c3552fbb9e2517b718f9bbe87cf649e"
|
||||
},
|
||||
"candidate_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"prior_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"source_revision": "must-be-exact-final-owner-HEAD-with-approved-four-Git-blobs",
|
||||
"phases": [
|
||||
"drill-backup",
|
||||
"drill-copy",
|
||||
"offline-verify",
|
||||
"cleanup-offline",
|
||||
"cutover-backup",
|
||||
"cutover-copy",
|
||||
"release",
|
||||
"verify",
|
||||
"rollback",
|
||||
"rollback-verify"
|
||||
],
|
||||
"authorization": "fresh externally authenticated root fixed-origin native readback before each phase; exact confirmed platform-root disposition and current packet SHA/source commit; receipt bookkeeping is not an autonomous signed grant",
|
||||
"execute_by": "2026-10-12T23:59:59Z",
|
||||
"raw_output_withheld": true,
|
||||
"native_data_or_workload_action_executed": false,
|
||||
"deadline_semantics": "All phases including verification/recovery must begin before execute_by. No extension or automatic emergency grant; beyond deadline stop and obtain a fresh founder decision. Complete the bounded drill and rollout early enough to allow recovery within the window.",
|
||||
"source_memo_version": 1,
|
||||
"native_review_memo_version": 1,
|
||||
"published_artifact_verified": true
|
||||
}
|
||||
File diff suppressed because one or more lines are too long
|
|
@ -0,0 +1,15 @@
|
|||
"""Only structural count/hash receipts can leave the private execution phase."""
|
||||
def counts(value):
|
||||
if (set(value) != {'schema_version', 'lifecycle', 'outbox', 'submissions', 'integrity',
|
||||
'read_only_pre_open', 'store_constructed'}
|
||||
or value['schema_version'] != 5 or value['integrity'] != 'ok'
|
||||
or value['read_only_pre_open'] is not True or value['store_constructed'] is not False
|
||||
or set(value['lifecycle']) != {'records', 'events', 'pending'}
|
||||
or not set(value['outbox']) <= {'pending', 'delivered', 'blocked'}
|
||||
or not set(value['submissions']) <= {'prepared', 'in_flight', 'confirmed', 'unresolved'}):
|
||||
raise ValueError('count-only receipt shape/state refused; values withheld')
|
||||
for group in ('lifecycle', 'outbox', 'submissions'):
|
||||
if any(type(number) is not int or number < 0 or number > 10**12
|
||||
for number in value[group].values()):
|
||||
raise ValueError('count-only receipt values refused')
|
||||
return value
|
||||
|
|
@ -0,0 +1,393 @@
|
|||
"""Synthetic custody/transport tests. No native data, Docker or cluster action."""
|
||||
import copy
|
||||
import datetime
|
||||
import io
|
||||
import json
|
||||
import os
|
||||
from pathlib import Path
|
||||
import subprocess
|
||||
import sys
|
||||
import tempfile
|
||||
import unittest
|
||||
from unittest.mock import patch
|
||||
from contextlib import redirect_stdout
|
||||
|
||||
import actuator
|
||||
from authority_journal import Journal, authority
|
||||
from native_program import PROGRAM
|
||||
from receipt_safety import counts
|
||||
|
||||
CASE = Path(__file__).resolve().parent.parent
|
||||
NOW = datetime.datetime(2026, 10, 11, 2, 0, tzinfo=datetime.timezone.utc)
|
||||
REVISION = 'e' * 40
|
||||
COUNT = {'schema_version': 5, 'integrity': 'ok', 'read_only_pre_open': True, 'store_constructed': False,
|
||||
'lifecycle': {'records': 3, 'events': 8, 'pending': 1},
|
||||
'outbox': {'pending': 2, 'delivered': 10}, 'submissions': {'confirmed': 1, 'unresolved': 1}}
|
||||
|
||||
|
||||
def accepted():
|
||||
approval = '11111111-1111-4111-8111-111111111111'
|
||||
review = 'review-22222222-2222-4222-8222-222222222222'
|
||||
disposition = 'disp-33333333-3333-4333-8333-333333333333'
|
||||
receipt = {'proposal_id': 'INFD-WP-0009-T05/zlib85091-r1',
|
||||
'memo_id': 'infd-20261011-zlib-remediation-r1', 'memo_version': 1,
|
||||
'memo_sha256': 'a' * 64, 'source_revision': REVISION, 'activation': 'APPROVED',
|
||||
'authority_mode': 'ADMINISTER', 'target': 'realm:kubernetes/railiance01/informed-decision',
|
||||
'verification_method': 'root-fixed-origin-native-readback', 'runtime_authenticated_grant': False, 'outcome_query': '/lifecycle/memos/infd-20261011-zlib-remediation-r1/outcomes?version=1',
|
||||
'verified_at': '2026-10-11T02:00:00Z', 'accepted_at': '2026-10-11T01:59:00Z',
|
||||
'review_memo_id': review, 'approval_id': approval, 'disposition_id': disposition}
|
||||
outcome = {'memo_id': receipt['memo_id'], 'review': {'memo_id': review, 'stale': False, 'intake_state': 'ready'},
|
||||
'dispositions': [{'approval_id': None, 'submission_state': 'confirmed',
|
||||
'disposition': {'verb': 'accept', 'memo_version': 1, 'memo_id': review,
|
||||
'approval_id': approval, 'id': disposition,
|
||||
'actor': {'kind': 'person', 'sub': 'uid=platform-root,ou=people,dc=netkingdom,dc=local'},
|
||||
'at': receipt['accepted_at']}}]}
|
||||
return receipt, outcome
|
||||
|
||||
|
||||
class AuthorityAndCustody(unittest.TestCase):
|
||||
def test_exact_nested_founder_receipt_not_top_level_approval(self):
|
||||
receipt, outcome = accepted()
|
||||
result = authority(receipt, outcome, 'a' * 64, REVISION, 'drill-copy', NOW)
|
||||
self.assertEqual(result['approval_id'], receipt['approval_id'])
|
||||
|
||||
def test_pending_stale_wrong_actor_version_and_binding_refuse(self):
|
||||
mutations = [lambda r, o: r.update(activation='PENDING'),
|
||||
lambda r, o: r.update(memo_sha256='changed'),
|
||||
lambda r, o: r.update(source_revision='changed'),
|
||||
lambda r, o: r.update(target='other'),
|
||||
lambda r, o: r.update(verified_at='2026-10-11T01:00:00Z'),
|
||||
lambda r, o: r.update(verification_method='caller-asserted'),
|
||||
lambda r, o: r.update(runtime_authenticated_grant=True),
|
||||
lambda r, o: o['review'].update(stale=True),
|
||||
lambda r, o: o['review'].update(intake_state='pending'),
|
||||
lambda r, o: o['dispositions'][0].update(submission_state='unresolved'),
|
||||
lambda r, o: o['dispositions'][0]['disposition'].update(memo_version=3),
|
||||
lambda r, o: o['dispositions'][0]['disposition'].update(actor={'kind': 'agent', 'sub': 'platform-root'}),
|
||||
lambda r, o: o['dispositions'].append(copy.deepcopy(o['dispositions'][0]))]
|
||||
for mutate in mutations:
|
||||
with self.subTest(mutate=mutate):
|
||||
r, o = accepted()
|
||||
mutate(r, o)
|
||||
with self.assertRaises(ValueError):
|
||||
authority(r, o, 'a' * 64, REVISION, 'release', NOW)
|
||||
|
||||
def test_expired_window_and_unknown_phase_refuse(self):
|
||||
r, o = accepted()
|
||||
with self.assertRaises(ValueError):
|
||||
authority(r, o, 'a' * 64, REVISION, 'arbitrary', NOW)
|
||||
late = datetime.datetime(2026, 10, 13, tzinfo=datetime.timezone.utc)
|
||||
r['verified_at'] = late.isoformat()
|
||||
with self.assertRaises(ValueError):
|
||||
authority(r, o, 'a' * 64, REVISION, 'rollback', late)
|
||||
|
||||
def test_durable_intent_precedes_dispatch_and_never_retries(self):
|
||||
with tempfile.TemporaryDirectory() as directory:
|
||||
parent = Path(directory)
|
||||
os.chmod(parent, 0o700)
|
||||
journal = Journal(parent, {'case': 'fixture'})
|
||||
journal.start('drill-backup', {'approval_id': 'fixture'})
|
||||
self.assertEqual(json.loads(journal.path.read_text())['phases']['drill-backup']['state'], 'RUNNING')
|
||||
journal.close() # simulated crash before result
|
||||
recovered = Journal(parent, {'case': 'fixture'})
|
||||
with self.assertRaises(ValueError):
|
||||
recovered.start('drill-backup', {})
|
||||
with self.assertRaises(ValueError):
|
||||
recovered.start('drill-backup', {})
|
||||
recovered.close()
|
||||
|
||||
def test_phase_order_and_uncertain_release_allows_only_distinct_recovery(self):
|
||||
with tempfile.TemporaryDirectory() as directory:
|
||||
os.chmod(directory, 0o700)
|
||||
j = Journal(directory, {'case': 'fixture'})
|
||||
with self.assertRaises(ValueError):
|
||||
j.start('release', {})
|
||||
for phase in actuator.PHASES[:6]:
|
||||
j.start(phase, {})
|
||||
j.finish(phase, {'all_checks_pass': True})
|
||||
j.start('release', {})
|
||||
j.finish('release', {'all_checks_pass': False})
|
||||
with self.assertRaises(ValueError):
|
||||
j.start('release', {})
|
||||
with self.assertRaises(ValueError):
|
||||
j.start('verify', {})
|
||||
j.start('rollback', {})
|
||||
j.finish('rollback', {'all_checks_pass': True})
|
||||
j.close()
|
||||
|
||||
def test_secret_or_unknown_child_output_is_withheld(self):
|
||||
for body in ('not-json', '{"all_checks_pass":true,"token":"private-value"}',
|
||||
'{"all_checks_pass":true,"snapshot_readonly":{"schema_version":5}}'):
|
||||
with self.assertRaises(ValueError):
|
||||
actuator.json_result(subprocess.CompletedProcess([], 0, body, ''))
|
||||
wrong = copy.deepcopy(COUNT)
|
||||
wrong['outbox'] = {'private-row-value': 1}
|
||||
with self.assertRaises(ValueError):
|
||||
counts(wrong)
|
||||
counts(COUNT) # blocked/unresolved counts are not required to be zero.
|
||||
|
||||
def test_binary_copy_is_bounded_private_and_never_echoed(self):
|
||||
blob = b'synthetic private fixture bytes'
|
||||
digest = __import__('hashlib').sha256(blob).hexdigest()
|
||||
metadata = {'all_checks_pass': True, 'snapshot_file': 'drill.sqlite', 'snapshot_bytes': len(blob),
|
||||
'snapshot_sha256': digest, 'snapshot_readonly': COUNT,
|
||||
'pod_name': 'fixture-pod', 'pod_uid': 'fixture-uid'}
|
||||
journal = type('FixtureJournal', (), {'data': {'phases': {'drill-backup': {'result': metadata}}}})()
|
||||
real_popen = subprocess.Popen
|
||||
for extra in (b'', b'oversized'):
|
||||
with self.subTest(extra=extra), tempfile.TemporaryDirectory() as folder:
|
||||
os.chmod(folder, 0o700)
|
||||
output = io.StringIO()
|
||||
|
||||
def child(*args, **kwargs):
|
||||
return real_popen([sys.executable, '-c', 'import sys;sys.stdout.buffer.write(' + repr(blob + extra) + ')'],
|
||||
stdout=subprocess.PIPE, stderr=subprocess.DEVNULL)
|
||||
|
||||
with patch.object(actuator, 'CUSTODY', Path(folder)), patch.object(actuator, 'remote', return_value=metadata), \
|
||||
patch('subprocess.Popen', side_effect=child), redirect_stdout(output):
|
||||
if extra:
|
||||
with self.assertRaises(ValueError):
|
||||
actuator.copy_snapshot('drill-copy', REVISION, {}, journal)
|
||||
else:
|
||||
result = actuator.copy_snapshot('drill-copy', REVISION, {}, journal)
|
||||
self.assertTrue(result['off_cluster_private_copy_verified'])
|
||||
self.assertEqual((Path(folder) / 'drill.sqlite').read_bytes(), blob)
|
||||
self.assertEqual(output.getvalue(), '')
|
||||
self.assertEqual((Path(folder) / 'drill.sqlite').stat().st_mode & 0o777, 0o600)
|
||||
|
||||
def test_recreated_offline_volume_cannot_be_deleted(self):
|
||||
identity = {'Name': actuator.VOLUME, 'Labels': {'nonce': 'old'}, 'CreatedAt': 'old'}
|
||||
journal = type('FixtureJournal', (), {'data': {'phases': {
|
||||
'offline-verify': {'result': {'created_volume_identity': identity}}}}})()
|
||||
inspected = [{**identity, 'CreatedAt': 'recreated'}]
|
||||
with patch.object(actuator, 'docker', return_value=subprocess.CompletedProcess([], 0, json.dumps(inspected), '')) as mocked:
|
||||
with self.assertRaises(ValueError):
|
||||
actuator.cleanup_offline(journal)
|
||||
self.assertEqual(mocked.call_count, 1)
|
||||
|
||||
def test_offline_post_admin_integrity_and_original_hash_are_rechecked(self):
|
||||
for defect in ('none', 'post-integrity', 'original-hash'):
|
||||
with self.subTest(defect=defect), tempfile.TemporaryDirectory() as directory:
|
||||
folder=Path(directory);os.chmod(folder,0o700)
|
||||
snapshot=folder/'drill.sqlite';snapshot.write_bytes(b'private synthetic snapshot');os.chmod(snapshot,0o600)
|
||||
digest=actuator.sha(snapshot)
|
||||
prior={'snapshot_sha256':digest,'snapshot_readonly':COUNT}
|
||||
journal=type('FixtureJournal',(),{'data':{'phases':{'drill-copy':{'result':prior},'offline-verify':{'attempt_id':'nonce'}}},'note':lambda *args:None})()
|
||||
reads=[]
|
||||
volume={'Name':actuator.VOLUME,'Labels':{'informed-decision.case':'infd-zlib-20261011-r1','informed-decision.use':'offline-restore-only','informed-decision.attempt':'nonce'},'Driver':'local','Scope':'local','CreatedAt':'fixture','Options':None}
|
||||
def docker(argv, body=None, **kwargs):
|
||||
if argv[0]=='info':body=json.dumps('bnt-lap001')
|
||||
elif argv[:2]==['volume','ls']:body=''
|
||||
elif argv[:2]==['volume','create']:body=actuator.VOLUME
|
||||
elif argv[:2]==['volume','inspect']:body=json.dumps([volume])
|
||||
elif 'informed-decision-admin' in argv:
|
||||
body=json.dumps({key:COUNT[key] for key in ('schema_version','lifecycle','outbox','submissions')})
|
||||
if defect=='original-hash':snapshot.write_bytes(b'changed synthetic original')
|
||||
elif '--entrypoint' in argv and 'python' in argv:
|
||||
reads.append(argv);proof=copy.deepcopy(COUNT)
|
||||
if len(reads)==2 and defect=='post-integrity':proof['integrity']='corrupt'
|
||||
body=json.dumps(proof)
|
||||
else:raise AssertionError('unexpected offline command')
|
||||
return subprocess.CompletedProcess(argv,0,body,'')
|
||||
with patch.object(actuator,'CUSTODY',folder),patch.object(actuator,'CASE',CASE),patch.object(actuator,'docker',side_effect=docker),patch('subprocess.run',return_value=subprocess.CompletedProcess([],0,'{"all_checks_pass":true,"private_copy_verified":true}','')):
|
||||
if defect=='none':
|
||||
result=actuator.offline_verify(journal)
|
||||
self.assertEqual(result['offline_post_admin_readonly'],COUNT)
|
||||
self.assertTrue(result['original_snapshot_hash_unchanged'])
|
||||
else:
|
||||
with self.assertRaises(ValueError):actuator.offline_verify(journal)
|
||||
self.assertEqual(len(reads),2)
|
||||
|
||||
|
||||
class FixedNativeProgram(unittest.TestCase):
|
||||
def fixture(self):
|
||||
sealed = json.loads((CASE / 'sealed-live-deployment.json').read_text())
|
||||
live = copy.deepcopy(sealed)
|
||||
live['metadata'].update(generation=42)
|
||||
live['status'] = {'readyReplicas': 1, 'updatedReplicas': 1, 'observedGeneration': 42}
|
||||
dependencies = json.loads((CASE / 'sealed-native-dependencies.json').read_text())
|
||||
cm = copy.deepcopy(dependencies['configmap'])
|
||||
cm.pop('canonical_data_sha256')
|
||||
service = json.loads((CASE / 'candidate-deployment.json').read_text())
|
||||
source_service = json.loads((Path('/home/worsch/informed-decision/deploy/lifecycle/service.candidate.json')).read_text())
|
||||
cm['data'] = next(x for x in source_service['items'] if x['kind'] == 'ConfigMap')['data']
|
||||
pvc = copy.deepcopy(dependencies['pvc'])
|
||||
pvc['status'] = {'phase': 'Bound'}
|
||||
app = {'metadata': {'uid': '499868f2-eabc-4df4-ae31-b89ce58d750d', 'resourceVersion': '17'},
|
||||
'spec': {'source': {'repoURL': 'https://forgejo.coulomb.social/coulomb/informed-decision.git',
|
||||
'path': 'deploy/lifecycle', 'targetRevision': 'c96b0c6d881e855d1d158003c6de90ef390262e2'},
|
||||
'destination': {'namespace': 'informed-decision', 'server': 'https://kubernetes.default.svc'}}}
|
||||
objects = {'deployment': live, 'configmap': cm, 'pvc': pvc, 'application': app}
|
||||
payload = {'phase': 'release', 'source_revision': REVISION, 'approval': {}, 'sealed': sealed,
|
||||
'dependencies': dependencies, 'candidate': service,
|
||||
'rollback': json.loads((CASE / 'rollback-deployment.json').read_text()),
|
||||
'readonly': (CASE / 'sqlite_readonly.py').read_text(),'purpose_checks':(CASE/'check_installed.py').read_text(),
|
||||
'installed_zlib': json.loads((CASE / 'installed-zlib-proof.json').read_text()), 'receipt_safety': (Path(__file__).parent / 'receipt_safety.py').read_text()}
|
||||
return objects, payload
|
||||
|
||||
def execute_fake(self, objects, payload, ambiguous=False, schema_refused=False):
|
||||
writes = []
|
||||
calls = []
|
||||
|
||||
def fake(argv, input=None, **kwargs):
|
||||
calls.append(argv)
|
||||
if argv[:2] == ['kubectl', 'get']:
|
||||
kind = argv[2]
|
||||
if kind in objects:
|
||||
body = objects[kind]
|
||||
elif kind == 'pods':
|
||||
body = {'items': [{'metadata': {'name': 'fixture-pod', 'uid': 'c4cb1550-feda-4097-9de4-d891a657b662',
|
||||
'ownerReferences': [{'kind': 'ReplicaSet', 'name': 'fixture-rs', 'uid': 'rs-uid'}]},
|
||||
'spec': objects['deployment']['spec']['template']['spec'],
|
||||
'status': {'phase': 'Running', 'containerStatuses': [{'name':'informed-decision','ready': True,'imageID':objects['deployment']['spec']['template']['spec']['containers'][0]['image']}] }}]}
|
||||
elif kind == 'replicaset':
|
||||
body = {'metadata': {'uid': 'rs-uid', 'ownerReferences': [
|
||||
{'kind': 'Deployment', 'uid': payload['sealed']['metadata']['uid']}]}}
|
||||
elif kind == 'nodes':
|
||||
body = {'items': [{'metadata': {'name': 'fixture-node'}, 'status': {
|
||||
'addresses': [{'address': '92.205.62.239'}], 'allocatable': {'cpu': '4'},
|
||||
'conditions': [{'type': key, 'status': 'True' if key == 'Ready' else 'False'}
|
||||
for key in ('Ready', 'MemoryPressure', 'DiskPressure', 'PIDPressure')]}}]}
|
||||
else:
|
||||
raise AssertionError('unexpected fixed metadata route')
|
||||
return subprocess.CompletedProcess(argv, 0, json.dumps(body), '')
|
||||
if argv[:2] == ['kubectl', 'exec']:
|
||||
if schema_refused:
|
||||
return subprocess.CompletedProcess(argv, 1, '', 'withheld')
|
||||
return subprocess.CompletedProcess(argv, 0, json.dumps({
|
||||
'all_checks_pass': True, 'live_readonly_schema_integrity_counts': COUNT}), '')
|
||||
if argv[:2] == ['kubectl', 'apply']:
|
||||
admitted = copy.deepcopy(payload['sealed'])
|
||||
admitted['spec']['template']['spec']['containers'][0]['image'] = (actuator.IMAGE if payload['phase']=='release' else payload['sealed']['spec']['template']['spec']['containers'][0]['image'])
|
||||
return subprocess.CompletedProcess(argv, 0, json.dumps(admitted), '')
|
||||
if argv[:2] == ['kubectl', 'describe']:
|
||||
return subprocess.CompletedProcess(argv, 0, 'Allocated resources:\n cpu 3460m (86%)\n', '')
|
||||
if argv[:2] == ['kubectl', 'diff']:
|
||||
return subprocess.CompletedProcess(argv, 1, '-image: base\n+image: candidate\n', '')
|
||||
if argv[:2] == ['kubectl', 'patch']:
|
||||
if '--dry-run=server' not in argv:
|
||||
writes.append(json.loads(input))
|
||||
if ambiguous:
|
||||
return subprocess.CompletedProcess(argv, 1, '', 'withheld')
|
||||
return subprocess.CompletedProcess(argv, 0, 'application.argoproj.io/informed-decision\n', '')
|
||||
raise AssertionError('unexpected command')
|
||||
|
||||
source = PROGRAM.replace('__PAYLOAD__', repr(json.dumps(payload))).replace(
|
||||
'__GUARD__', repr((CASE / 'change_guard.py').read_text()))
|
||||
output = io.StringIO()
|
||||
with patch('subprocess.run', side_effect=fake), redirect_stdout(output):
|
||||
try:
|
||||
exec(compile(source, 'fixed-native-fixture', 'exec'), {'__name__': '__fixture__'})
|
||||
except (ValueError, SystemExit):
|
||||
pass
|
||||
receipt = json.loads(output.getvalue()) if output.getvalue() else {'all_checks_pass': False}
|
||||
return receipt, writes, calls
|
||||
|
||||
def test_only_existing_application_operation_and_deployment_are_requested(self):
|
||||
objects, payload = self.fixture()
|
||||
receipt, writes, calls = self.execute_fake(objects, payload)
|
||||
self.assertTrue(receipt['all_checks_pass'])
|
||||
self.assertFalse(receipt['rollout_verified'])
|
||||
self.assertEqual(len(writes), 1)
|
||||
operation = writes[0][-1]['value']
|
||||
self.assertFalse(operation['sync']['prune'])
|
||||
self.assertEqual(operation['sync']['resources'], [
|
||||
{'group': 'apps', 'kind': 'Deployment', 'name': 'informed-decision', 'namespace': 'informed-decision'}])
|
||||
self.assertTrue(any('--dry-run=server' in argv and argv[:2] == ['kubectl', 'patch'] for argv in calls))
|
||||
self.assertEqual(writes[0][0]['path'], '/metadata/uid')
|
||||
|
||||
def test_source_overrides_automation_and_custody_drift_stop_before_write(self):
|
||||
mutations = [lambda o: o['application']['metadata'].update(uid='recreated'),
|
||||
lambda o: o['application']['spec'].update(syncPolicy={'automated': {}}),
|
||||
lambda o: o['application']['spec']['source'].update(kustomize={'images': ['other']}),
|
||||
lambda o: o['application']['spec'].update(sources=[{}]),
|
||||
lambda o: o['configmap']['metadata'].update(uid='recreated'),
|
||||
lambda o: o['pvc']['spec'].update(volumeName='replaced'),
|
||||
lambda o: o['deployment']['status'].update(readyReplicas=0)]
|
||||
for mutate in mutations:
|
||||
with self.subTest(mutate=mutate):
|
||||
objects, payload = self.fixture()
|
||||
mutate(objects)
|
||||
receipt, writes, calls = self.execute_fake(objects, payload)
|
||||
self.assertFalse(receipt['all_checks_pass'])
|
||||
self.assertEqual(writes, [])
|
||||
|
||||
def test_preopen_schema_refusal_prevents_image_operation(self):
|
||||
objects, payload = self.fixture()
|
||||
receipt, writes, calls = self.execute_fake(objects, payload, schema_refused=True)
|
||||
self.assertFalse(receipt['all_checks_pass'])
|
||||
self.assertEqual(writes, [])
|
||||
|
||||
|
||||
def test_rollback_unready_candidate_never_reads_pod_or_database(self):
|
||||
objects, payload = self.fixture()
|
||||
payload['phase'] = 'rollback'
|
||||
objects['deployment']['status'].update(readyReplicas=0, updatedReplicas=0)
|
||||
objects['deployment']['spec']['template']['spec']['containers'][0]['image'] = actuator.IMAGE
|
||||
objects['application']['spec']['source']['targetRevision'] = REVISION
|
||||
receipt, writes, calls = self.execute_fake(objects, payload, schema_refused=True)
|
||||
self.assertTrue(receipt['all_checks_pass'])
|
||||
self.assertFalse(receipt['rollout_verified'])
|
||||
self.assertEqual(len(writes), 1)
|
||||
self.assertFalse(any(argv[:2] == ['kubectl', 'exec'] or argv[:3] == ['kubectl', 'get', 'pods'] for argv in calls))
|
||||
self.assertEqual(writes[0][-1]['value']['sync']['revision'], 'c96b0c6d881e855d1d158003c6de90ef390262e2')
|
||||
|
||||
def test_rollback_still_refuses_custody_or_nonpair_image_drift(self):
|
||||
for defect in ('cm', 'pvc', 'image'):
|
||||
with self.subTest(defect=defect):
|
||||
objects, payload = self.fixture();payload['phase'] = 'rollback'
|
||||
objects['deployment']['status']['readyReplicas'] = 0
|
||||
if defect == 'cm':objects['configmap']['metadata']['uid'] = 'recreated'
|
||||
elif defect == 'pvc':objects['pvc']['spec']['volumeName'] = 'replaced'
|
||||
else:objects['deployment']['spec']['template']['spec']['containers'][0]['image'] = 'foreign-image'
|
||||
receipt, writes, calls = self.execute_fake(objects, payload)
|
||||
self.assertFalse(receipt['all_checks_pass']);self.assertEqual(writes, [])
|
||||
|
||||
def test_recovery_verification_is_separate_ready_old_image_schema_proof(self):
|
||||
objects, payload = self.fixture();payload['phase'] = 'rollback-verify'
|
||||
resource={'group':'apps','kind':'Deployment','name':'informed-decision','namespace':'informed-decision'}
|
||||
target='c96b0c6d881e855d1d158003c6de90ef390262e2'
|
||||
payload['operation_intent']={'state':'COMPLETE','started_at':'2026-10-11T01:00:00Z','result':{'operation_requested':True,'source_revision':target,'prune':False,'resources':[resource]}}
|
||||
objects['application']['status']={'operationState':{'phase':'Succeeded','startedAt':'2026-10-11T01:00:01Z','finishedAt':'2026-10-11T01:01:00Z','operation':{'initiatedBy':{'username':'custodian-codex'},'sync':{'revision':target,'resources':[resource]}},'syncResult':{'revision':target,'resources':[{**resource,'status':'Synced'}]}}}
|
||||
receipt, writes, calls = self.execute_fake(objects, payload)
|
||||
self.assertTrue(receipt['all_checks_pass']);self.assertTrue(receipt['recovery_verification'])
|
||||
self.assertEqual(writes, [])
|
||||
self.assertTrue(any(argv[:2]==['kubectl','exec'] for argv in calls))
|
||||
objects['deployment']['status']['readyReplicas'] = 0
|
||||
receipt, writes, calls = self.execute_fake(objects,payload)
|
||||
self.assertFalse(receipt['all_checks_pass'])
|
||||
|
||||
def test_ambiguous_patch_is_never_retried(self):
|
||||
objects, payload = self.fixture()
|
||||
receipt, writes, calls = self.execute_fake(objects, payload, ambiguous=True)
|
||||
self.assertFalse(receipt['all_checks_pass'])
|
||||
self.assertEqual(len(writes), 1)
|
||||
|
||||
def test_false_omitempty_needs_bound_current_request_and_exact_completion(self):
|
||||
objects,payload=self.fixture();payload['phase']='rollback-verify'
|
||||
resource={'group':'apps','kind':'Deployment','name':'informed-decision','namespace':'informed-decision'}
|
||||
target='c96b0c6d881e855d1d158003c6de90ef390262e2'
|
||||
payload['operation_intent']={'state':'COMPLETE','started_at':'2026-10-11T01:00:00Z','result':{'operation_requested':True,'source_revision':target,'prune':False,'resources':[resource]}}
|
||||
objects['application']['status']={'operationState':{'phase':'Succeeded','startedAt':'2026-10-11T01:00:01Z','finishedAt':'2026-10-11T01:01:00Z','operation':{'initiatedBy':{'username':'custodian-codex'},'sync':{'revision':target,'resources':[resource]}},'syncResult':{'revision':target,'resources':[{**resource,'status':'Synced'}]}}}
|
||||
self.assertTrue(self.execute_fake(objects,payload)[0]['all_checks_pass'])
|
||||
mutations=[lambda o,p:o['application']['status']['operationState']['operation']['sync'].update(prune=True),
|
||||
lambda o,p:o['application']['status']['operationState']['operation']['sync'].update(prune=None),
|
||||
lambda o,p:o['application']['status']['operationState'].update(startedAt='2026-10-11T00:59:00Z'),
|
||||
lambda o,p:o['application']['status']['operationState']['operation'].update(initiatedBy={'username':'other'}),
|
||||
lambda o,p:o['application']['status']['operationState']['syncResult'].update(revision='foreign'),
|
||||
lambda o,p:o['application']['status']['operationState']['syncResult']['resources'][0].update(status='Pruned'),
|
||||
lambda o,p:p['operation_intent']['result'].update(prune=True),
|
||||
lambda o,p:p.update(operation_intent=None)]
|
||||
for mutate in mutations:
|
||||
o,p=copy.deepcopy(objects),copy.deepcopy(payload);mutate(o,p)
|
||||
receipt,writes,calls=self.execute_fake(o,p)
|
||||
self.assertFalse(receipt['all_checks_pass']);self.assertEqual(writes,[])
|
||||
|
||||
def test_optimized_executor_refuses_before_any_input(self):
|
||||
result=subprocess.run([sys.executable,'-O',str(Path(__file__).parent/'actuator.py'),'--phase','release','--root-authority-receipt','/missing','--root-native-outcome','/missing','--source-revision',REVISION],capture_output=True,text=True)
|
||||
self.assertNotEqual(result.returncode,0)
|
||||
self.assertIn('optimized interpreter refused',result.stderr)
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
unittest.main()
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
{
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"zlib_package": "1.3.2-r1",
|
||||
"files": {
|
||||
"lib/apk/db/installed": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
|
||||
],
|
||||
"usr/lib/libz.so.1.3.2": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,101 @@
|
|||
{
|
||||
"id": "infd-20261011-zlib-remediation-r1",
|
||||
"version": 1,
|
||||
"question": "Approve the exact zlib85091 fixed image-only release, new protected backup/restore compatibility drill and database-preserving rollback?",
|
||||
"requested_act": "approve",
|
||||
"binding_level": "organizational",
|
||||
"brief": "Published owner CI image f558 has zero full-scan findings across44packages; only zlib1.3.2-r0 to r1 changes. Fresh schema5 private backup/isolated clone drill and cutover snapshot precede one Deployment manual prune=false Recreate sync. Separate founder go required; old T04 acceptance/history unchanged. Rollback image763c/Applicationc96 retains latestDB. Release reserves30minutes before Oct12 deadline.",
|
||||
"binding": {
|
||||
"principal": {
|
||||
"id": "pending-human-session",
|
||||
"kind": "person",
|
||||
"display_name": "Founder review"
|
||||
},
|
||||
"target": {
|
||||
"kind": "environment",
|
||||
"id": "realm:kubernetes/railiance01/informed-decision",
|
||||
"label": "Informed Decision zlib85091 image-only remediation on railiance01",
|
||||
"environment": "production"
|
||||
},
|
||||
"terms": "Approve only INFD-WP-0009-T05/zlib85091-r1 trialinfd-zlib-20261011-r1 and exact attached digests: new private drillbackup/copy, isolatedschema5pre/admin/postintegrityandcounts, exactcreatedclonecleanup, freshcutoverbackup/copy, manualfinalsourceDeployment-onlyimagef558/prune=false. ImmutableCM/PVC/config/credentials/audience/resources sealed. Freshrootnativeauthenticated confirmed founderACCEPTsource1 beforeeveryphase; receiptsarebookkeeping/noautonomousgrant. Rollbackonlyimage763c/Applicationc96 preserveslatestDB, separateverification. AllphasesbeginbeforeOct12 23:59:59Z; releasereserves30minutes; newdecisionbeyond. ExistingT04UNCERTAINEvidenceunaltered, nooldhelperamendment/phase retry, noresidualpromotion ordoctrinechange."
|
||||
},
|
||||
"step_kind": "approve",
|
||||
"packet": [
|
||||
{
|
||||
"item_id": "decision-packet-md",
|
||||
"label": "decision-packet.md",
|
||||
"hash": "sha256:763f30c1433d1ca872b029519ec46ad1b97c47d60b7ea0eea0275a2c6b647dc3"
|
||||
},
|
||||
{
|
||||
"item_id": "proposal-json",
|
||||
"label": "proposal.json",
|
||||
"hash": "sha256:48b0f0baf4efc239111411ad7d1c291f8eceaa0ddf1414dac73d49ccdb3bbe70"
|
||||
},
|
||||
{
|
||||
"item_id": "native-backup-restore-protocol-md",
|
||||
"label": "native-backup-restore-protocol.md",
|
||||
"hash": "sha256:f586a511c1921490185bab95334f27de6d3cca20b348df20d18bcb9257d7ae35"
|
||||
},
|
||||
{
|
||||
"item_id": "native-preflight-json",
|
||||
"label": "native-preflight.json",
|
||||
"hash": "sha256:56637994dfdae46a6f9ab442c2ff9b259212650b35eb98d896c5e837f01ce2f9"
|
||||
},
|
||||
{
|
||||
"item_id": "published-verification-json",
|
||||
"label": "published-verification.json",
|
||||
"hash": "sha256:dd4eecf0c103dca7922094a8beeb99b77ae96fd1d5fe532e37bd833daa02614e"
|
||||
},
|
||||
{
|
||||
"item_id": "artifact-comparison-json",
|
||||
"label": "artifact-comparison.json",
|
||||
"hash": "sha256:a1c5d9e249dc00600449998360faf6e8da0206b568c76d155602c4645fa5fce4"
|
||||
},
|
||||
{
|
||||
"item_id": "installed-zlib-proof-json",
|
||||
"label": "installed-zlib-proof.json",
|
||||
"hash": "sha256:6af62f86f50ac185fab94163c24ac8150ead69e62f8d825b0dce1e75a5a57b68"
|
||||
},
|
||||
{
|
||||
"item_id": "sealed-live-deployment-json",
|
||||
"label": "sealed-live-deployment.json",
|
||||
"hash": "sha256:f8a9a07abc2eb52cdf6bcdba2d9f79dec073145c31d0444a9e0fe1147e42cc4e"
|
||||
},
|
||||
{
|
||||
"item_id": "sealed-native-dependencies-json",
|
||||
"label": "sealed-native-dependencies.json",
|
||||
"hash": "sha256:042327a036ed254cf95dbeb0c056ac25b03a6a844b95a332c992df2943691369"
|
||||
},
|
||||
{
|
||||
"item_id": "candidate-deployment-json",
|
||||
"label": "candidate-deployment.json",
|
||||
"hash": "sha256:487f834cc86dcbc7a04c2392bde072ecaf87dc116b4baa16c35eb9c599ad5c95"
|
||||
},
|
||||
{
|
||||
"item_id": "rollback-deployment-json",
|
||||
"label": "rollback-deployment.json",
|
||||
"hash": "sha256:f8a9a07abc2eb52cdf6bcdba2d9f79dec073145c31d0444a9e0fe1147e42cc4e"
|
||||
},
|
||||
{
|
||||
"item_id": "execution-plan-json",
|
||||
"label": "execution-plan.json",
|
||||
"hash": "sha256:9b458e2b4d418525987b6cb1b9a160c4b1a2c621625c1b5c571ea5c77e9d4361"
|
||||
}
|
||||
],
|
||||
"highlights": [
|
||||
{
|
||||
"id": "protected-drill-and-recreate",
|
||||
"item_id": "decision-packet-md",
|
||||
"note": "This new T05 decision authorizes protected real-data backup/copy and no-network same-schema restore drill plus brief Recreate image release. Scan0 is actual published44package result, not installed acceptance. Rollback preserves latestDB; priorfailedT04evidence retained. No oldapprovalreuse. Allphase starts expireOct12; release reserves30minutesforrecovery; noautomaticextension.",
|
||||
"required_ack": true,
|
||||
"severity": "warning",
|
||||
"locator": {
|
||||
"kind": "section",
|
||||
"heading": "Requested decision"
|
||||
}
|
||||
}
|
||||
],
|
||||
"sealed": false,
|
||||
"approval_id": null,
|
||||
"approval_binding_digest": null
|
||||
}
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
# T05 zlib85091 release — preliminary, unapproved
|
||||
|
||||
This is a distinct proposal/trial for existing INFD-WP-0009-T05. The actual T04 source2 acceptance does not authorize it. Previous R1 copy and R2 verify UNCERTAIN journal states remain untouched. INFD-IN-0010 remains an unpromoted general verifier residual; this new task-specific verifier is a prerequisite of active T05, not an amendment of the old approved helper.
|
||||
|
||||
Exact intended image f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23 was built by admitted owner CI11534/run4 from 9b4bb25d325698ae543e7e8a8a3c3592db1f58fc. Publication is not installed acceptance. Final packet requires independent published-image scan/runtime/filesystem/source proof and fresh read-only native projection/one-object dry-run evidence. Until all final inputs and independent owner acknowledgments are frozen, execution-plan state remains preliminary and the actuator refuses before any authority, journal or native action.
|
||||
|
||||
After a NEW exact confirmed founder acceptance, root freshly authenticates fixed-origin native source-version1 outcomes before each phase. Receipt files are supervised bookkeeping, not signed grants or autonomy. Wrong task, source, memo/version, stale/pending/agent disposition, old T04 acceptance or changed inputs refuse. Root retains exact approved source revision/digests and action results in supervision. Approval does not promote any agent.
|
||||
|
||||
Fixed phase order: drill-backup → drill-copy → offline-verify → cleanup-offline → cutover-backup → cutover-copy → release → verify. New private native /data/private/zlib85091-r1, root .private-backups/20261011-infd-zlib-r1 and local volume infd-zlib-r1-restore-20261011 are distinct from all T04 custody. New private journal intent is fsynced RUNNING before dispatch; no attempted phase replay. Fixed output schema contains only counts, hashes, object identity and boolean results; raw errors and private content are withheld. Existing native snapshots/database/sidecars are never removed or restored over current data.
|
||||
|
||||
Fresh backup inspection uses copied explicit-close SQLite helpers: live and offline clone readers are mode=ro/query_only and WAL-aware, before any Store/admin open. Immutable reader is used only for freshly closed hash-bound private snapshot with absent/zero WAL frames and stable identity/metadata/digest before/after read/copy. Main and sidecars remain retained. Schema must equal5, integrity ok, and exact snapshot/isolated clone counts match before/admin/after. The detached local clone has network none, readonly root, no service/runtime config/credential mounts; only narrowly scoped UID0 CAP_CHOWN initializer precedes UID10001 reads/admin. Original private copy is hash-stable. Cleanup removes only the disposable volume whose nonce/labels/creation metadata match this trial, before cutover.
|
||||
|
||||
Each snapshot is bounded512MiB. At most two new snapshots occupy each native/offcluster custody (1GiB payload each); the disposable offcluster clone adds512MiB while present, plus16MiB sidecar/metadata reserve. New native drill phase checks free space for both; local custody checks two snapshot bounds plus reserve. Existing T04 retention consumes additional pre-existing space. EUR0 recurring infrastructure estimate; human/compute time unpriced.
|
||||
|
||||
Cutover takes a fresh native backup and exact offcluster copy. Release then requires latest schema5 readonly proof, sealed Pod/Deployment/config/PVC custody and same baseline image763c/current Application sourcec96, a healthy single target92.205.62.239 node and fresh requested CPU ≤ allocatable capacity. Recreate and resources remain unchanged. Server dry-run/client diff must show only the image. Application UID/resourceVersion/source CAS dispatches manual exact final revision, initiatedBy custodian-codex, explicit prune=false and only apps/Deployment informed-decision in its namespace. No whole-Application sync, namespace/config/credential/resource change or pruning.
|
||||
|
||||
Verification reads imageID/readiness/owner chain/exact configured Pod fields, schema5/integrity/metadata counts, installed policy hash and synthetic purpose refusals, health200, installed fixed zlib and exact image proof. Real PDP-gated lifecycle readback is a separate root authenticated observation and not replaced by synthetic checks. Argo3.5.3 omits false prune in operation status: missing or exactfalse is accepted only together with this journal's COMPLETE explicitfalse request, exact source/resources/initiation, operation start after our durable attempt, bounded finish and one Synced Deployment result. True/null/string/prior/foreign/extra-resource results refuse.
|
||||
|
||||
Rollback → rollback-verify is separate and permitted only after a recorded release attempt. It switches only Application source back to c96 and Deployment image763c; it never restores an old snapshot over the latest database. Recovery dispatch works even if candidate Pod is absent/unready and never depends on candidate DB inspection. Recovery verification separately requires Ready1/old image/current schema5/data-custody and exact recorded scoped completion. All phases must begin before2026-10-12T23:59:59Z; release must begin at least30minutes earlier. Beyond expiry stop and obtain a new founder decision; no automatic extension or emergency grant. A failed/uncertain attempt requires informed recovery rather than retry.
|
||||
|
||||
T05 remains progress until actual installed acceptance and native rescan prove the finding absent. No Risk Engine grade is assigned. Only then may owner close T05/risk and consider finishing WP9, with existing residuals live first.
|
||||
|
|
@ -0,0 +1,672 @@
|
|||
{
|
||||
"all_checks_pass": true,
|
||||
"observed_at": "2026-10-11T09:40:15.540874+00:00",
|
||||
"native_changed": false,
|
||||
"protected_database_read": false,
|
||||
"secret_read": false,
|
||||
"deployment_generation": 25,
|
||||
"ready_replicas": 1,
|
||||
"sealed_live_deployment": {
|
||||
"apiVersion": "apps/v1",
|
||||
"kind": "Deployment",
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"argocd.argoproj.io/tracking-id": "informed-decision:apps/Deployment:informed-decision/informed-decision",
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision",
|
||||
"uid": "a588e10a-90d2-4883-975e-6dd8b8feca92"
|
||||
},
|
||||
"spec": {
|
||||
"progressDeadlineSeconds": 600,
|
||||
"replicas": 1,
|
||||
"revisionHistoryLimit": 10,
|
||||
"selector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"strategy": {
|
||||
"type": "Recreate"
|
||||
},
|
||||
"template": {
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"labels": {
|
||||
"app.kubernetes.io/component": "review",
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"automountServiceAccountToken": false,
|
||||
"containers": [
|
||||
{
|
||||
"env": [
|
||||
{
|
||||
"name": "INFD_KEYCAPE_ISSUER",
|
||||
"value": "https://kc.coulomb.social"
|
||||
},
|
||||
{
|
||||
"name": "INFD_CONTAINER_CONFIG",
|
||||
"value": "/configuration/runtime.json"
|
||||
}
|
||||
],
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"imagePullPolicy": "IfNotPresent",
|
||||
"livenessProbe": {
|
||||
"failureThreshold": 3,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"name": "informed-decision",
|
||||
"ports": [
|
||||
{
|
||||
"containerPort": 8080,
|
||||
"name": "http",
|
||||
"protocol": "TCP"
|
||||
},
|
||||
{
|
||||
"containerPort": 8081,
|
||||
"name": "workload",
|
||||
"protocol": "TCP"
|
||||
}
|
||||
],
|
||||
"readinessProbe": {
|
||||
"failureThreshold": 3,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"resources": {
|
||||
"limits": {
|
||||
"cpu": "500m",
|
||||
"memory": "256Mi"
|
||||
},
|
||||
"requests": {
|
||||
"cpu": "5m",
|
||||
"memory": "64Mi"
|
||||
}
|
||||
},
|
||||
"securityContext": {
|
||||
"allowPrivilegeEscalation": false,
|
||||
"capabilities": {
|
||||
"drop": [
|
||||
"ALL"
|
||||
]
|
||||
},
|
||||
"readOnlyRootFilesystem": true
|
||||
},
|
||||
"startupProbe": {
|
||||
"failureThreshold": 12,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"terminationMessagePath": "/dev/termination-log",
|
||||
"terminationMessagePolicy": "File",
|
||||
"volumeMounts": [
|
||||
{
|
||||
"mountPath": "/data",
|
||||
"name": "data"
|
||||
},
|
||||
{
|
||||
"mountPath": "/run/informed-decision",
|
||||
"name": "runtime"
|
||||
},
|
||||
{
|
||||
"mountPath": "/tmp",
|
||||
"name": "tmp"
|
||||
},
|
||||
{
|
||||
"mountPath": "/configuration",
|
||||
"name": "configuration",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/policy",
|
||||
"name": "caller",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/audit",
|
||||
"name": "audit",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/kubernetes",
|
||||
"name": "kubernetes-api",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/workload-registry",
|
||||
"name": "workload-registry",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/requester",
|
||||
"name": "sitting-requester",
|
||||
"readOnly": true
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"dnsPolicy": "ClusterFirst",
|
||||
"restartPolicy": "Always",
|
||||
"schedulerName": "default-scheduler",
|
||||
"securityContext": {
|
||||
"fsGroup": 10001,
|
||||
"fsGroupChangePolicy": "OnRootMismatch",
|
||||
"runAsGroup": 10001,
|
||||
"runAsNonRoot": true,
|
||||
"runAsUser": 10001,
|
||||
"seccompProfile": {
|
||||
"type": "RuntimeDefault"
|
||||
}
|
||||
},
|
||||
"serviceAccount": "review",
|
||||
"serviceAccountName": "review",
|
||||
"terminationGracePeriodSeconds": 45,
|
||||
"volumes": [
|
||||
{
|
||||
"name": "data",
|
||||
"persistentVolumeClaim": {
|
||||
"claimName": "informed-decision-data"
|
||||
}
|
||||
},
|
||||
{
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
},
|
||||
"name": "runtime"
|
||||
},
|
||||
{
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
},
|
||||
"name": "tmp"
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"defaultMode": 292,
|
||||
"name": "informed-decision-runtime-6c221878d051"
|
||||
},
|
||||
"name": "configuration"
|
||||
},
|
||||
{
|
||||
"name": "caller",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"audience": "flex-auth",
|
||||
"expirationSeconds": 3600,
|
||||
"path": "token"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "audit",
|
||||
"secret": {
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "token",
|
||||
"path": "token"
|
||||
}
|
||||
],
|
||||
"secretName": "informed-decision-audit"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "kubernetes-api",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"expirationSeconds": 600,
|
||||
"path": "token"
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"items": [
|
||||
{
|
||||
"key": "ca.crt",
|
||||
"path": "ca.crt"
|
||||
}
|
||||
],
|
||||
"name": "kube-root-ca.crt"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"defaultMode": 292,
|
||||
"name": "informed-decision-workload-registry"
|
||||
},
|
||||
"name": "workload-registry"
|
||||
},
|
||||
{
|
||||
"name": "sitting-requester",
|
||||
"secret": {
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "client-secret",
|
||||
"path": "client-secret"
|
||||
}
|
||||
],
|
||||
"optional": false,
|
||||
"secretName": "informed-decision-sitting-requester"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"candidate_deployment": {
|
||||
"apiVersion": "apps/v1",
|
||||
"kind": "Deployment",
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"argocd.argoproj.io/tracking-id": "informed-decision:apps/Deployment:informed-decision/informed-decision",
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision",
|
||||
"uid": "a588e10a-90d2-4883-975e-6dd8b8feca92"
|
||||
},
|
||||
"spec": {
|
||||
"progressDeadlineSeconds": 600,
|
||||
"replicas": 1,
|
||||
"revisionHistoryLimit": 10,
|
||||
"selector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"strategy": {
|
||||
"type": "Recreate"
|
||||
},
|
||||
"template": {
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"labels": {
|
||||
"app.kubernetes.io/component": "review",
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"automountServiceAccountToken": false,
|
||||
"containers": [
|
||||
{
|
||||
"env": [
|
||||
{
|
||||
"name": "INFD_KEYCAPE_ISSUER",
|
||||
"value": "https://kc.coulomb.social"
|
||||
},
|
||||
{
|
||||
"name": "INFD_CONTAINER_CONFIG",
|
||||
"value": "/configuration/runtime.json"
|
||||
}
|
||||
],
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"imagePullPolicy": "IfNotPresent",
|
||||
"livenessProbe": {
|
||||
"failureThreshold": 3,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"name": "informed-decision",
|
||||
"ports": [
|
||||
{
|
||||
"containerPort": 8080,
|
||||
"name": "http",
|
||||
"protocol": "TCP"
|
||||
},
|
||||
{
|
||||
"containerPort": 8081,
|
||||
"name": "workload",
|
||||
"protocol": "TCP"
|
||||
}
|
||||
],
|
||||
"readinessProbe": {
|
||||
"failureThreshold": 3,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"resources": {
|
||||
"limits": {
|
||||
"cpu": "500m",
|
||||
"memory": "256Mi"
|
||||
},
|
||||
"requests": {
|
||||
"cpu": "5m",
|
||||
"memory": "64Mi"
|
||||
}
|
||||
},
|
||||
"securityContext": {
|
||||
"allowPrivilegeEscalation": false,
|
||||
"capabilities": {
|
||||
"drop": [
|
||||
"ALL"
|
||||
]
|
||||
},
|
||||
"readOnlyRootFilesystem": true
|
||||
},
|
||||
"startupProbe": {
|
||||
"failureThreshold": 12,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"terminationMessagePath": "/dev/termination-log",
|
||||
"terminationMessagePolicy": "File",
|
||||
"volumeMounts": [
|
||||
{
|
||||
"mountPath": "/data",
|
||||
"name": "data"
|
||||
},
|
||||
{
|
||||
"mountPath": "/run/informed-decision",
|
||||
"name": "runtime"
|
||||
},
|
||||
{
|
||||
"mountPath": "/tmp",
|
||||
"name": "tmp"
|
||||
},
|
||||
{
|
||||
"mountPath": "/configuration",
|
||||
"name": "configuration",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/policy",
|
||||
"name": "caller",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/audit",
|
||||
"name": "audit",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/kubernetes",
|
||||
"name": "kubernetes-api",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/workload-registry",
|
||||
"name": "workload-registry",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/requester",
|
||||
"name": "sitting-requester",
|
||||
"readOnly": true
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"dnsPolicy": "ClusterFirst",
|
||||
"restartPolicy": "Always",
|
||||
"schedulerName": "default-scheduler",
|
||||
"securityContext": {
|
||||
"fsGroup": 10001,
|
||||
"fsGroupChangePolicy": "OnRootMismatch",
|
||||
"runAsGroup": 10001,
|
||||
"runAsNonRoot": true,
|
||||
"runAsUser": 10001,
|
||||
"seccompProfile": {
|
||||
"type": "RuntimeDefault"
|
||||
}
|
||||
},
|
||||
"serviceAccount": "review",
|
||||
"serviceAccountName": "review",
|
||||
"terminationGracePeriodSeconds": 45,
|
||||
"volumes": [
|
||||
{
|
||||
"name": "data",
|
||||
"persistentVolumeClaim": {
|
||||
"claimName": "informed-decision-data"
|
||||
}
|
||||
},
|
||||
{
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
},
|
||||
"name": "runtime"
|
||||
},
|
||||
{
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
},
|
||||
"name": "tmp"
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"defaultMode": 292,
|
||||
"name": "informed-decision-runtime-6c221878d051"
|
||||
},
|
||||
"name": "configuration"
|
||||
},
|
||||
{
|
||||
"name": "caller",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"audience": "flex-auth",
|
||||
"expirationSeconds": 3600,
|
||||
"path": "token"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "audit",
|
||||
"secret": {
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "token",
|
||||
"path": "token"
|
||||
}
|
||||
],
|
||||
"secretName": "informed-decision-audit"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "kubernetes-api",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"expirationSeconds": 600,
|
||||
"path": "token"
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"items": [
|
||||
{
|
||||
"key": "ca.crt",
|
||||
"path": "ca.crt"
|
||||
}
|
||||
],
|
||||
"name": "kube-root-ca.crt"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"defaultMode": 292,
|
||||
"name": "informed-decision-workload-registry"
|
||||
},
|
||||
"name": "workload-registry"
|
||||
},
|
||||
{
|
||||
"name": "sitting-requester",
|
||||
"secret": {
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "client-secret",
|
||||
"path": "client-secret"
|
||||
}
|
||||
],
|
||||
"optional": false,
|
||||
"secretName": "informed-decision-sitting-requester"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"sealed_dependencies": {
|
||||
"configmap": {
|
||||
"apiVersion": "v1",
|
||||
"immutable": true,
|
||||
"kind": "ConfigMap",
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"argocd.argoproj.io/tracking-id": "informed-decision:/ConfigMap:informed-decision/informed-decision-runtime-6c221878d051",
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"name": "informed-decision-runtime-6c221878d051",
|
||||
"namespace": "informed-decision",
|
||||
"uid": "90113d2d-54d9-4e82-b1d3-90b49ebed2b5"
|
||||
},
|
||||
"canonical_data_sha256": "8ec462d12347548f506eeebf1e3c7cc47648019c8a783804d09bcc79b0f22af6"
|
||||
},
|
||||
"pvc": {
|
||||
"apiVersion": "v1",
|
||||
"kind": "PersistentVolumeClaim",
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"argocd.argoproj.io/tracking-id": "informed-decision:/PersistentVolumeClaim:informed-decision/informed-decision-data",
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover",
|
||||
"pv.kubernetes.io/bind-completed": "yes",
|
||||
"pv.kubernetes.io/bound-by-controller": "yes",
|
||||
"volume.beta.kubernetes.io/storage-provisioner": "rancher.io/local-path",
|
||||
"volume.kubernetes.io/selected-node": "239.62.205.92.host.secureserver.net",
|
||||
"volume.kubernetes.io/storage-provisioner": "rancher.io/local-path"
|
||||
},
|
||||
"finalizers": [
|
||||
"kubernetes.io/pvc-protection"
|
||||
],
|
||||
"name": "informed-decision-data",
|
||||
"namespace": "informed-decision",
|
||||
"uid": "d80b25b1-141a-441b-b205-98fa2fd98b7c"
|
||||
},
|
||||
"spec": {
|
||||
"accessModes": [
|
||||
"ReadWriteOnce"
|
||||
],
|
||||
"resources": {
|
||||
"requests": {
|
||||
"storage": "1Gi"
|
||||
}
|
||||
},
|
||||
"storageClassName": "local-path",
|
||||
"volumeMode": "Filesystem",
|
||||
"volumeName": "pvc-d80b25b1-141a-441b-b205-98fa2fd98b7c"
|
||||
}
|
||||
},
|
||||
"pvc_phase": "Bound"
|
||||
},
|
||||
"argo": {
|
||||
"uid": "499868f2-eabc-4df4-ae31-b89ce58d750d",
|
||||
"source": {
|
||||
"path": "deploy/lifecycle",
|
||||
"repoURL": "https://forgejo.coulomb.social/coulomb/informed-decision.git",
|
||||
"targetRevision": "c96b0c6d881e855d1d158003c6de90ef390262e2"
|
||||
},
|
||||
"destination": {
|
||||
"namespace": "informed-decision",
|
||||
"server": "https://kubernetes.default.svc"
|
||||
},
|
||||
"automated": false,
|
||||
"health": {
|
||||
"lastTransitionTime": "2026-10-11T07:00:42Z",
|
||||
"status": "Healthy"
|
||||
},
|
||||
"sync": {
|
||||
"comparedTo": {
|
||||
"destination": {
|
||||
"namespace": "informed-decision",
|
||||
"server": "https://kubernetes.default.svc"
|
||||
},
|
||||
"source": {
|
||||
"path": "deploy/lifecycle",
|
||||
"repoURL": "https://forgejo.coulomb.social/coulomb/informed-decision.git",
|
||||
"targetRevision": "c96b0c6d881e855d1d158003c6de90ef390262e2"
|
||||
}
|
||||
},
|
||||
"revision": "c96b0c6d881e855d1d158003c6de90ef390262e2",
|
||||
"status": "OutOfSync"
|
||||
}
|
||||
},
|
||||
"server_dry_run_passed": true,
|
||||
"admission_only_image_delta": true,
|
||||
"client_diff_exit": 1,
|
||||
"client_diff_sha256": "ccff7c1ecfd9eb59fc0ce566c1013a2af5df514af048c68474a272997024ef7b",
|
||||
"allocatable_cpu_m": 4000,
|
||||
"requested_cpu_m": 3460,
|
||||
"strategy": "Recreate"
|
||||
}
|
||||
|
|
@ -0,0 +1,37 @@
|
|||
{
|
||||
"kind": "informed-decision.supervised-release-proposal",
|
||||
"version": 1,
|
||||
"proposal_id": "INFD-WP-0009-T05/zlib85091-r1",
|
||||
"trial_id": "infd-zlib-20261011-r1",
|
||||
"state": "prepared-awaiting-independent-owner-acknowledgments",
|
||||
"memo_id": "infd-20261011-zlib-remediation-r1",
|
||||
"memo_version": 1,
|
||||
"task": "INFD-WP-0009-T05",
|
||||
"candidate_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"artifact_source_revision": "9b4bb25d325698ae543e7e8a8a3c3592db1f58fc",
|
||||
"prior_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"prior_application_revision": "c96b0c6d881e855d1d158003c6de90ef390262e2",
|
||||
"source_revision": null,
|
||||
"published_artifact_verified": true,
|
||||
"native_actions_executed": false,
|
||||
"approval_id": null,
|
||||
"authority_mode": "ADMINISTER",
|
||||
"target": "realm:kubernetes/railiance01/informed-decision",
|
||||
"cost_estimate_eur": 0,
|
||||
"risk": "Private same-schema backup copies and brief Recreate availability gap. Failed or ambiguous phases retained; no replay. Rollback changes Deployment image/source only, retains latest database.",
|
||||
"execute_by": "2026-10-12T23:59:59Z",
|
||||
"release_must_start_by": "2026-10-12T23:29:59Z",
|
||||
"max_snapshot_bytes": 536870912,
|
||||
"maximum_new_snapshot_payload_bytes_each_site": 1073741824,
|
||||
"local_extra_disposable_clone_max_bytes": 536870912,
|
||||
"private_metadata_and_sqlite_sidecars_additional_headroom_bytes": 16777216,
|
||||
"unbound_inputs": [
|
||||
"fresh rollback server admission",
|
||||
"exact committed owner rendering revision",
|
||||
"Product and Platform final acknowledgments",
|
||||
"confirmed founder exact new disposition"
|
||||
],
|
||||
"published_verification_sha256": "dd4eecf0c103dca7922094a8beeb99b77ae96fd1d5fe532e37bd833daa02614e",
|
||||
"native_readonly_preflight_sha256": "56637994dfdae46a6f9ab442c2ff9b259212650b35eb98d896c5e837f01ce2f9",
|
||||
"executor_plan_sha256": "9b458e2b4d418525987b6cb1b9a160c4b1a2c621625c1b5c571ea5c77e9d4361"
|
||||
}
|
||||
|
|
@ -0,0 +1,96 @@
|
|||
{
|
||||
"proposal_id": "INFD-WP-0009-T05/zlib-85091-r1",
|
||||
"task_id": "INFD-WP-0009-T05",
|
||||
"risk_record": "INFD-RISK-20261011-ZLIB-85091",
|
||||
"state": "actual-owner-CI-published-independent-verification-passed-native-unapproved",
|
||||
"verified_utc": "2026-10-11T09:40:24.469646+00:00",
|
||||
"source_revision": "9b4bb25d325698ae543e7e8a8a3c3592db1f58fc",
|
||||
"ci_task": 11534,
|
||||
"ci_run": 4,
|
||||
"ci_status": "success",
|
||||
"reviewed_source_manifest_sha256": "724aa4777eb1c8976d868e5f504473f4b6d58f13d750d87aefa5c8d5ca0747ec",
|
||||
"all74_source_hashes_match_actual_commit": true,
|
||||
"published_image_digest": "sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"base_image_digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"registry_config_digest": "sha256:622becc3ebd97cb66b6e7c36f35bf931a7decd9464b65851123c1cc8c998d75b",
|
||||
"executed_local_daemon_image_id": "sha256:f2e07e3dd839b55afd5d517243a765a26965325e4e6750f508771ad556bd6d01",
|
||||
"serialization_caveat": "Daemon load reserializes config; all diffIDs/platform/effective config+labels independently equal to registry; neither config nor daemon ID substitutes for registry image digest",
|
||||
"actual_registry_descriptors_and_layers_verified": true,
|
||||
"base9layers_unchanged": true,
|
||||
"overlay_layers": 2,
|
||||
"fullscan_baseline": {
|
||||
"MEDIUM": 1,
|
||||
"id": "CVE-2026-85091"
|
||||
},
|
||||
"fullscan_candidate_allseverity_findings": 0,
|
||||
"fullscan_no_suppressions": true,
|
||||
"same_fresh_DB_both_images": true,
|
||||
"scanner_db_sha256": "03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917",
|
||||
"scanner_db_metadata": {
|
||||
"Version": 2,
|
||||
"NextUpdate": "2026-10-11T18:59:50.889010572Z",
|
||||
"UpdatedAt": "2026-10-10T18:59:50.889010923Z",
|
||||
"DownloadedAt": "2026-10-10T23:32:32.380033131Z"
|
||||
},
|
||||
"scanner_caveat": "Alpine3.24 absent EOL list warning; actual38OS+6Python detectors ran. Zero means this verified DB snapshot, not unknown-future assurance or estate risk grade.",
|
||||
"sbom_count": 44,
|
||||
"sbom_only_delta": {
|
||||
"zlib": [
|
||||
"1.3.2-r0",
|
||||
"1.3.2-r1"
|
||||
]
|
||||
},
|
||||
"final_changed_files": [
|
||||
"lib/apk/db/installed",
|
||||
"usr/lib/libz.so.1.3.2"
|
||||
],
|
||||
"directory_count": 313,
|
||||
"directory_metadata_delta": {},
|
||||
"app_files_identical": 36,
|
||||
"installed_UID": 10001,
|
||||
"installed_GID": 10001,
|
||||
"policy_sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62",
|
||||
"policy_mode": "0o644",
|
||||
"policy_UID": 0,
|
||||
"candidate_image_executed": true,
|
||||
"public_registry_layer_readback": true,
|
||||
"native_provider_test": false,
|
||||
"installed_purpose_variants": 10,
|
||||
"purpose_forms_allow": 2,
|
||||
"purpose_forms_refuse": 8,
|
||||
"runtime_readonly_networknone": true,
|
||||
"native_workload_or_database_or_snapshot_or_credentials_accessed": false,
|
||||
"native_rollout": false,
|
||||
"founder_release_approval": false,
|
||||
"risk_followthrough": "T05 remains active; manual review due2026-10-18, no controller or estate risk grade. Actual native installation/fresh scoped founder decision still required before closure.",
|
||||
"verification_refinement": "First run used registry config as daemon handle and refused before candidate execution125. Corrected by independently proving loaded daemon ID semantics+diffIDs exact, then executed. Not actual image failure.",
|
||||
"evidence_sha256": {
|
||||
"artifact-comparison.json": "a1c5d9e249dc00600449998360faf6e8da0206b568c76d155602c4645fa5fce4",
|
||||
"base-image-config.json": "4ad7249c75fd9fc039ceb186772419e1cba5fd9759c404556459c80a2d285d10",
|
||||
"base-image-manifest.json": "978c575d3c7bf0de39dbe4e9567c39cd36f70b7e55bc17357bdb03fb3b96b0fb",
|
||||
"base-runtime.json": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24",
|
||||
"base-sbom.cdx.json": "dd7d64c9571391acd4d1f86c6026a1b094abab4ee56e5a9f799ec2fd3c7d915a",
|
||||
"base-sbom.cdx.json.log": "8ab4473a5f74b36e82a4095e9c8d6e66d80aec64bd1cebd6c9f6734531869fca",
|
||||
"base-trivy-full.json": "3e91a3001adb008cec37d9ae3c08342f5d43c8ba0111eee75c63a6a7918808a9",
|
||||
"base-trivy-full.json.log": "96a48dc39f7d674b4954d5fa98a76645528ec0fe705782fe114e3b4b9d776862",
|
||||
"candidate-runtime.json": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124",
|
||||
"ci-publication-observation.json": "ffe6f2508bc9bebbdc85ac63eae5765562efbb8e920cc85b8da30a12ee1e4b17",
|
||||
"image-config.json": "253ab359013aeb3457d2abe0852bacd33697f973dd32c1b5738800e5dc633f43",
|
||||
"image-manifest.json": "9ca2abec6a26d9a9f802dfe75efa8bffdc28485e6bcaf525cc9b075df3700194",
|
||||
"installed-purpose.json": "312312c6f0bd2751401b3bc5bcd30ee6af01ed7cb380f85b863d03b0c7e9d1ad",
|
||||
"loaded-daemon-image-proof.json": "2e5c043a101d75e4c569adb6bc2f09020679b28ed2ad836c954f7d27101ce719",
|
||||
"publication-digest.json": "ca2a1dec38db8c5fbbc00ef4f27aa865edbbd4a7ca9dc21b2ba023664c507f38",
|
||||
"read_public_artifact.py": "eaa31da1ebb2095ea5e1bc7c570311cc4747f0d7f718034dad934351d1920daf",
|
||||
"registry-proof.json": "3ef52d9e4800fc9bd238072241dc15f13a0260ee3df1e82e6f63e72902749d92",
|
||||
"run_published_runtime.py": "d9bd33fecd2a98c2381b4ba2dce12b5c3d9a69faa5e350291924fc885f5e775f",
|
||||
"run_published_scan.py": "2583ab96350412fb3f20b5b05ded0949eb3ee8e5c0e8923a9c2c42d419d36639",
|
||||
"runtime-comparison.json": "993b80b9285e227a0bdfde4927cd2f053bcc4a58dd9bd1b633ac7a4637d6713c",
|
||||
"runtime-receipt.json": "6442676dcfd941f0a05a4cb79a02dea839fcd332d82b2154c15cf6db68de5889",
|
||||
"sbom.cdx.json": "4202263059780eae0448328044c1cf68b59758f329ae6bc981d916610527eae3",
|
||||
"sbom.cdx.json.log": "51873b37a0846ee1a618ea7591d79809dc0f8624f77a03fae7af953bcbd7282f",
|
||||
"scan-receipt.json": "aaaa91061bb036e6d228b1c1bd4333578dc948cb2bb5ac8ba269429121e7321a",
|
||||
"source-commit-proof.json": "b0811da2d3bd5938733f0078e5fec8e19a6d9752c4277b80bfe9837ed72c6a3b",
|
||||
"trivy-full.json": "2ff68e765b9c65292611d5a969202a7654637168edefcedac5d2c7634009edae",
|
||||
"trivy-full.json.log": "b3419af860d264449f61986f562491edaead27dfd3638ceabe94b4fe177f4bf1"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,286 @@
|
|||
{
|
||||
"apiVersion": "apps/v1",
|
||||
"kind": "Deployment",
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"argocd.argoproj.io/tracking-id": "informed-decision:apps/Deployment:informed-decision/informed-decision",
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision",
|
||||
"uid": "a588e10a-90d2-4883-975e-6dd8b8feca92"
|
||||
},
|
||||
"spec": {
|
||||
"progressDeadlineSeconds": 600,
|
||||
"replicas": 1,
|
||||
"revisionHistoryLimit": 10,
|
||||
"selector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"strategy": {
|
||||
"type": "Recreate"
|
||||
},
|
||||
"template": {
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"labels": {
|
||||
"app.kubernetes.io/component": "review",
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"automountServiceAccountToken": false,
|
||||
"containers": [
|
||||
{
|
||||
"env": [
|
||||
{
|
||||
"name": "INFD_KEYCAPE_ISSUER",
|
||||
"value": "https://kc.coulomb.social"
|
||||
},
|
||||
{
|
||||
"name": "INFD_CONTAINER_CONFIG",
|
||||
"value": "/configuration/runtime.json"
|
||||
}
|
||||
],
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"imagePullPolicy": "IfNotPresent",
|
||||
"livenessProbe": {
|
||||
"failureThreshold": 3,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"name": "informed-decision",
|
||||
"ports": [
|
||||
{
|
||||
"containerPort": 8080,
|
||||
"name": "http",
|
||||
"protocol": "TCP"
|
||||
},
|
||||
{
|
||||
"containerPort": 8081,
|
||||
"name": "workload",
|
||||
"protocol": "TCP"
|
||||
}
|
||||
],
|
||||
"readinessProbe": {
|
||||
"failureThreshold": 3,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"resources": {
|
||||
"limits": {
|
||||
"cpu": "500m",
|
||||
"memory": "256Mi"
|
||||
},
|
||||
"requests": {
|
||||
"cpu": "5m",
|
||||
"memory": "64Mi"
|
||||
}
|
||||
},
|
||||
"securityContext": {
|
||||
"allowPrivilegeEscalation": false,
|
||||
"capabilities": {
|
||||
"drop": [
|
||||
"ALL"
|
||||
]
|
||||
},
|
||||
"readOnlyRootFilesystem": true
|
||||
},
|
||||
"startupProbe": {
|
||||
"failureThreshold": 12,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"terminationMessagePath": "/dev/termination-log",
|
||||
"terminationMessagePolicy": "File",
|
||||
"volumeMounts": [
|
||||
{
|
||||
"mountPath": "/data",
|
||||
"name": "data"
|
||||
},
|
||||
{
|
||||
"mountPath": "/run/informed-decision",
|
||||
"name": "runtime"
|
||||
},
|
||||
{
|
||||
"mountPath": "/tmp",
|
||||
"name": "tmp"
|
||||
},
|
||||
{
|
||||
"mountPath": "/configuration",
|
||||
"name": "configuration",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/policy",
|
||||
"name": "caller",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/audit",
|
||||
"name": "audit",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/kubernetes",
|
||||
"name": "kubernetes-api",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/workload-registry",
|
||||
"name": "workload-registry",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/requester",
|
||||
"name": "sitting-requester",
|
||||
"readOnly": true
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"dnsPolicy": "ClusterFirst",
|
||||
"restartPolicy": "Always",
|
||||
"schedulerName": "default-scheduler",
|
||||
"securityContext": {
|
||||
"fsGroup": 10001,
|
||||
"fsGroupChangePolicy": "OnRootMismatch",
|
||||
"runAsGroup": 10001,
|
||||
"runAsNonRoot": true,
|
||||
"runAsUser": 10001,
|
||||
"seccompProfile": {
|
||||
"type": "RuntimeDefault"
|
||||
}
|
||||
},
|
||||
"serviceAccount": "review",
|
||||
"serviceAccountName": "review",
|
||||
"terminationGracePeriodSeconds": 45,
|
||||
"volumes": [
|
||||
{
|
||||
"name": "data",
|
||||
"persistentVolumeClaim": {
|
||||
"claimName": "informed-decision-data"
|
||||
}
|
||||
},
|
||||
{
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
},
|
||||
"name": "runtime"
|
||||
},
|
||||
{
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
},
|
||||
"name": "tmp"
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"defaultMode": 292,
|
||||
"name": "informed-decision-runtime-6c221878d051"
|
||||
},
|
||||
"name": "configuration"
|
||||
},
|
||||
{
|
||||
"name": "caller",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"audience": "flex-auth",
|
||||
"expirationSeconds": 3600,
|
||||
"path": "token"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "audit",
|
||||
"secret": {
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "token",
|
||||
"path": "token"
|
||||
}
|
||||
],
|
||||
"secretName": "informed-decision-audit"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "kubernetes-api",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"expirationSeconds": 600,
|
||||
"path": "token"
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"items": [
|
||||
{
|
||||
"key": "ca.crt",
|
||||
"path": "ca.crt"
|
||||
}
|
||||
],
|
||||
"name": "kube-root-ca.crt"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"defaultMode": 292,
|
||||
"name": "informed-decision-workload-registry"
|
||||
},
|
||||
"name": "workload-registry"
|
||||
},
|
||||
{
|
||||
"name": "sitting-requester",
|
||||
"secret": {
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "client-secret",
|
||||
"path": "client-secret"
|
||||
}
|
||||
],
|
||||
"optional": false,
|
||||
"secretName": "informed-decision-sitting-requester"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
{
|
||||
"revision": "9b4bb25d325698ae543e7e8a8a3c3592db1f58fc",
|
||||
"published_digest": "sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"verified_registry_config_digest": "sha256:622becc3ebd97cb66b6e7c36f35bf931a7decd9464b65851123c1cc8c998d75b",
|
||||
"executed_loaded_daemon_id": "sha256:f2e07e3dd839b55afd5d517243a765a26965325e4e6750f508771ad556bd6d01",
|
||||
"image_source": "actual anonymous verified descriptor/layer archive loaded locally",
|
||||
"candidate_image_executed": true,
|
||||
"network": "none",
|
||||
"read_only_root": true,
|
||||
"memory": "128MiB",
|
||||
"cpus": 1,
|
||||
"checker_source": "exact gitshow pinnedcommit",
|
||||
"native_provider_test": false,
|
||||
"native_workload_changed": false,
|
||||
"database_or_admin_or_provider_credentials": false,
|
||||
"verified_utc": "2026-10-11T09:39:37.502275+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,170 @@
|
|||
{
|
||||
"scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
|
||||
"db_sha256": "03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917",
|
||||
"db_metadata": {
|
||||
"Version": 2,
|
||||
"NextUpdate": "2026-10-11T18:59:50.889010572Z",
|
||||
"UpdatedAt": "2026-10-10T18:59:50.889010923Z",
|
||||
"DownloadedAt": "2026-10-10T23:32:32.380033131Z"
|
||||
},
|
||||
"same_fresh_db_both_images": true,
|
||||
"no_suppression": true,
|
||||
"records": [
|
||||
{
|
||||
"archive": "base-image.tar",
|
||||
"format": "json",
|
||||
"started_utc": "2026-10-11T09:38:34.774672+00:00",
|
||||
"exit_code": 0,
|
||||
"command": [
|
||||
"docker",
|
||||
"--config",
|
||||
"/tmp/infd-purpose-published-verification/empty-docker-config",
|
||||
"--host",
|
||||
"unix:///var/run/docker.sock",
|
||||
"run",
|
||||
"--rm",
|
||||
"--network",
|
||||
"none",
|
||||
"--cpus",
|
||||
"1",
|
||||
"--memory",
|
||||
"1g",
|
||||
"-v",
|
||||
"/tmp/infd-zlib-published-9b4bb25d:/artifact",
|
||||
"-v",
|
||||
"/tmp/infd-zlib-published-scan-cache:/cache",
|
||||
"aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
|
||||
"image",
|
||||
"--input",
|
||||
"/artifact/base-image.tar",
|
||||
"--cache-dir",
|
||||
"/cache",
|
||||
"--skip-db-update",
|
||||
"--skip-java-db-update",
|
||||
"--scanners",
|
||||
"vuln",
|
||||
"--format",
|
||||
"json",
|
||||
"--output",
|
||||
"/artifact/base-trivy-full.json"
|
||||
]
|
||||
},
|
||||
{
|
||||
"archive": "base-image.tar",
|
||||
"format": "cyclonedx",
|
||||
"started_utc": "2026-10-11T09:38:38.856254+00:00",
|
||||
"exit_code": 0,
|
||||
"command": [
|
||||
"docker",
|
||||
"--config",
|
||||
"/tmp/infd-purpose-published-verification/empty-docker-config",
|
||||
"--host",
|
||||
"unix:///var/run/docker.sock",
|
||||
"run",
|
||||
"--rm",
|
||||
"--network",
|
||||
"none",
|
||||
"--cpus",
|
||||
"1",
|
||||
"--memory",
|
||||
"1g",
|
||||
"-v",
|
||||
"/tmp/infd-zlib-published-9b4bb25d:/artifact",
|
||||
"-v",
|
||||
"/tmp/infd-zlib-published-scan-cache:/cache",
|
||||
"aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
|
||||
"image",
|
||||
"--input",
|
||||
"/artifact/base-image.tar",
|
||||
"--cache-dir",
|
||||
"/cache",
|
||||
"--skip-db-update",
|
||||
"--skip-java-db-update",
|
||||
"--scanners",
|
||||
"vuln",
|
||||
"--format",
|
||||
"cyclonedx",
|
||||
"--output",
|
||||
"/artifact/base-sbom.cdx.json"
|
||||
]
|
||||
},
|
||||
{
|
||||
"archive": "image.tar",
|
||||
"format": "json",
|
||||
"started_utc": "2026-10-11T09:38:39.729798+00:00",
|
||||
"exit_code": 0,
|
||||
"command": [
|
||||
"docker",
|
||||
"--config",
|
||||
"/tmp/infd-purpose-published-verification/empty-docker-config",
|
||||
"--host",
|
||||
"unix:///var/run/docker.sock",
|
||||
"run",
|
||||
"--rm",
|
||||
"--network",
|
||||
"none",
|
||||
"--cpus",
|
||||
"1",
|
||||
"--memory",
|
||||
"1g",
|
||||
"-v",
|
||||
"/tmp/infd-zlib-published-9b4bb25d:/artifact",
|
||||
"-v",
|
||||
"/tmp/infd-zlib-published-scan-cache:/cache",
|
||||
"aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
|
||||
"image",
|
||||
"--input",
|
||||
"/artifact/image.tar",
|
||||
"--cache-dir",
|
||||
"/cache",
|
||||
"--skip-db-update",
|
||||
"--skip-java-db-update",
|
||||
"--scanners",
|
||||
"vuln",
|
||||
"--format",
|
||||
"json",
|
||||
"--output",
|
||||
"/artifact/trivy-full.json"
|
||||
]
|
||||
},
|
||||
{
|
||||
"archive": "image.tar",
|
||||
"format": "cyclonedx",
|
||||
"started_utc": "2026-10-11T09:38:40.675048+00:00",
|
||||
"exit_code": 0,
|
||||
"command": [
|
||||
"docker",
|
||||
"--config",
|
||||
"/tmp/infd-purpose-published-verification/empty-docker-config",
|
||||
"--host",
|
||||
"unix:///var/run/docker.sock",
|
||||
"run",
|
||||
"--rm",
|
||||
"--network",
|
||||
"none",
|
||||
"--cpus",
|
||||
"1",
|
||||
"--memory",
|
||||
"1g",
|
||||
"-v",
|
||||
"/tmp/infd-zlib-published-9b4bb25d:/artifact",
|
||||
"-v",
|
||||
"/tmp/infd-zlib-published-scan-cache:/cache",
|
||||
"aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
|
||||
"image",
|
||||
"--input",
|
||||
"/artifact/image.tar",
|
||||
"--cache-dir",
|
||||
"/cache",
|
||||
"--skip-db-update",
|
||||
"--skip-java-db-update",
|
||||
"--scanners",
|
||||
"vuln",
|
||||
"--format",
|
||||
"cyclonedx",
|
||||
"--output",
|
||||
"/artifact/sbom.cdx.json"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,286 @@
|
|||
{
|
||||
"apiVersion": "apps/v1",
|
||||
"kind": "Deployment",
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"argocd.argoproj.io/tracking-id": "informed-decision:apps/Deployment:informed-decision/informed-decision",
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision",
|
||||
"uid": "a588e10a-90d2-4883-975e-6dd8b8feca92"
|
||||
},
|
||||
"spec": {
|
||||
"progressDeadlineSeconds": 600,
|
||||
"replicas": 1,
|
||||
"revisionHistoryLimit": 10,
|
||||
"selector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"strategy": {
|
||||
"type": "Recreate"
|
||||
},
|
||||
"template": {
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"labels": {
|
||||
"app.kubernetes.io/component": "review",
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"automountServiceAccountToken": false,
|
||||
"containers": [
|
||||
{
|
||||
"env": [
|
||||
{
|
||||
"name": "INFD_KEYCAPE_ISSUER",
|
||||
"value": "https://kc.coulomb.social"
|
||||
},
|
||||
{
|
||||
"name": "INFD_CONTAINER_CONFIG",
|
||||
"value": "/configuration/runtime.json"
|
||||
}
|
||||
],
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"imagePullPolicy": "IfNotPresent",
|
||||
"livenessProbe": {
|
||||
"failureThreshold": 3,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"name": "informed-decision",
|
||||
"ports": [
|
||||
{
|
||||
"containerPort": 8080,
|
||||
"name": "http",
|
||||
"protocol": "TCP"
|
||||
},
|
||||
{
|
||||
"containerPort": 8081,
|
||||
"name": "workload",
|
||||
"protocol": "TCP"
|
||||
}
|
||||
],
|
||||
"readinessProbe": {
|
||||
"failureThreshold": 3,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"resources": {
|
||||
"limits": {
|
||||
"cpu": "500m",
|
||||
"memory": "256Mi"
|
||||
},
|
||||
"requests": {
|
||||
"cpu": "5m",
|
||||
"memory": "64Mi"
|
||||
}
|
||||
},
|
||||
"securityContext": {
|
||||
"allowPrivilegeEscalation": false,
|
||||
"capabilities": {
|
||||
"drop": [
|
||||
"ALL"
|
||||
]
|
||||
},
|
||||
"readOnlyRootFilesystem": true
|
||||
},
|
||||
"startupProbe": {
|
||||
"failureThreshold": 12,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"terminationMessagePath": "/dev/termination-log",
|
||||
"terminationMessagePolicy": "File",
|
||||
"volumeMounts": [
|
||||
{
|
||||
"mountPath": "/data",
|
||||
"name": "data"
|
||||
},
|
||||
{
|
||||
"mountPath": "/run/informed-decision",
|
||||
"name": "runtime"
|
||||
},
|
||||
{
|
||||
"mountPath": "/tmp",
|
||||
"name": "tmp"
|
||||
},
|
||||
{
|
||||
"mountPath": "/configuration",
|
||||
"name": "configuration",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/policy",
|
||||
"name": "caller",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/audit",
|
||||
"name": "audit",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/kubernetes",
|
||||
"name": "kubernetes-api",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/workload-registry",
|
||||
"name": "workload-registry",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/requester",
|
||||
"name": "sitting-requester",
|
||||
"readOnly": true
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"dnsPolicy": "ClusterFirst",
|
||||
"restartPolicy": "Always",
|
||||
"schedulerName": "default-scheduler",
|
||||
"securityContext": {
|
||||
"fsGroup": 10001,
|
||||
"fsGroupChangePolicy": "OnRootMismatch",
|
||||
"runAsGroup": 10001,
|
||||
"runAsNonRoot": true,
|
||||
"runAsUser": 10001,
|
||||
"seccompProfile": {
|
||||
"type": "RuntimeDefault"
|
||||
}
|
||||
},
|
||||
"serviceAccount": "review",
|
||||
"serviceAccountName": "review",
|
||||
"terminationGracePeriodSeconds": 45,
|
||||
"volumes": [
|
||||
{
|
||||
"name": "data",
|
||||
"persistentVolumeClaim": {
|
||||
"claimName": "informed-decision-data"
|
||||
}
|
||||
},
|
||||
{
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
},
|
||||
"name": "runtime"
|
||||
},
|
||||
{
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
},
|
||||
"name": "tmp"
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"defaultMode": 292,
|
||||
"name": "informed-decision-runtime-6c221878d051"
|
||||
},
|
||||
"name": "configuration"
|
||||
},
|
||||
{
|
||||
"name": "caller",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"audience": "flex-auth",
|
||||
"expirationSeconds": 3600,
|
||||
"path": "token"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "audit",
|
||||
"secret": {
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "token",
|
||||
"path": "token"
|
||||
}
|
||||
],
|
||||
"secretName": "informed-decision-audit"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "kubernetes-api",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"expirationSeconds": 600,
|
||||
"path": "token"
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"items": [
|
||||
{
|
||||
"key": "ca.crt",
|
||||
"path": "ca.crt"
|
||||
}
|
||||
],
|
||||
"name": "kube-root-ca.crt"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"defaultMode": 292,
|
||||
"name": "informed-decision-workload-registry"
|
||||
},
|
||||
"name": "workload-registry"
|
||||
},
|
||||
{
|
||||
"name": "sitting-requester",
|
||||
"secret": {
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "client-secret",
|
||||
"path": "client-secret"
|
||||
}
|
||||
],
|
||||
"optional": false,
|
||||
"secretName": "informed-decision-sitting-requester"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,52 @@
|
|||
{
|
||||
"configmap": {
|
||||
"apiVersion": "v1",
|
||||
"immutable": true,
|
||||
"kind": "ConfigMap",
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"argocd.argoproj.io/tracking-id": "informed-decision:/ConfigMap:informed-decision/informed-decision-runtime-6c221878d051",
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"name": "informed-decision-runtime-6c221878d051",
|
||||
"namespace": "informed-decision",
|
||||
"uid": "90113d2d-54d9-4e82-b1d3-90b49ebed2b5"
|
||||
},
|
||||
"canonical_data_sha256": "8ec462d12347548f506eeebf1e3c7cc47648019c8a783804d09bcc79b0f22af6"
|
||||
},
|
||||
"pvc": {
|
||||
"apiVersion": "v1",
|
||||
"kind": "PersistentVolumeClaim",
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"argocd.argoproj.io/tracking-id": "informed-decision:/PersistentVolumeClaim:informed-decision/informed-decision-data",
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover",
|
||||
"pv.kubernetes.io/bind-completed": "yes",
|
||||
"pv.kubernetes.io/bound-by-controller": "yes",
|
||||
"volume.beta.kubernetes.io/storage-provisioner": "rancher.io/local-path",
|
||||
"volume.kubernetes.io/selected-node": "239.62.205.92.host.secureserver.net",
|
||||
"volume.kubernetes.io/storage-provisioner": "rancher.io/local-path"
|
||||
},
|
||||
"finalizers": [
|
||||
"kubernetes.io/pvc-protection"
|
||||
],
|
||||
"name": "informed-decision-data",
|
||||
"namespace": "informed-decision",
|
||||
"uid": "d80b25b1-141a-441b-b205-98fa2fd98b7c"
|
||||
},
|
||||
"spec": {
|
||||
"accessModes": [
|
||||
"ReadWriteOnce"
|
||||
],
|
||||
"resources": {
|
||||
"requests": {
|
||||
"storage": "1Gi"
|
||||
}
|
||||
},
|
||||
"storageClassName": "local-path",
|
||||
"volumeMode": "Filesystem",
|
||||
"volumeName": "pvc-d80b25b1-141a-441b-b205-98fa2fd98b7c"
|
||||
}
|
||||
},
|
||||
"pvc_phase": "Bound"
|
||||
}
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
{
|
||||
"revision": "9b4bb25d325698ae543e7e8a8a3c3592db1f58fc",
|
||||
"reviewed_manifest_sha256": "724aa4777eb1c8976d868e5f504473f4b6d58f13d750d87aefa5c8d5ca0747ec",
|
||||
"reviewed_paths": 74,
|
||||
"mismatches": [],
|
||||
"owner_read_only_git_show": true
|
||||
}
|
||||
|
|
@ -0,0 +1,95 @@
|
|||
"""Pre-open schema/integrity/count proof; stdlib only, never constructs Store."""
|
||||
import argparse
|
||||
from contextlib import closing
|
||||
import hashlib
|
||||
import os
|
||||
import re
|
||||
import stat
|
||||
import json
|
||||
from pathlib import Path
|
||||
import sqlite3
|
||||
|
||||
|
||||
def inspect_readonly(path, *, _closed_snapshot=False):
|
||||
path = Path(path)
|
||||
if not path.is_file() or path.is_symlink():
|
||||
raise ValueError('existing nonsymlink private database required')
|
||||
uri = path.resolve().as_uri() + '?mode=ro' + ('&immutable=1' if _closed_snapshot else '')
|
||||
# sqlite3.Connection context management ends transactions; it does not close.
|
||||
with closing(sqlite3.connect(uri, uri=True, timeout=5)) as db:
|
||||
db.execute('PRAGMA query_only=ON')
|
||||
db.execute('BEGIN')
|
||||
version = db.execute('PRAGMA user_version').fetchone()[0]
|
||||
if version != 5:
|
||||
raise ValueError('pre-open database is not schema5; refuse migration')
|
||||
if db.execute('PRAGMA integrity_check').fetchall() != [('ok',)]:
|
||||
raise ValueError('read-only integrity check refused')
|
||||
lifecycle = {name: db.execute('SELECT COUNT(*) FROM ' + table).fetchone()[0]
|
||||
for name, table in (('records', 'lifecycle_records'),
|
||||
('events', 'lifecycle_events'),
|
||||
('pending', 'lifecycle_pending'))}
|
||||
result = {'schema_version': version, 'lifecycle': lifecycle,
|
||||
'outbox': dict(db.execute('SELECT state,COUNT(*) FROM outbox GROUP BY state')),
|
||||
'submissions': dict(db.execute('SELECT state,COUNT(*) FROM submissions GROUP BY state')),
|
||||
'integrity': 'ok', 'read_only_pre_open': True, 'store_constructed': False}
|
||||
db.rollback()
|
||||
return result
|
||||
|
||||
|
||||
def inspect_closed_snapshot(path, expected_sha256):
|
||||
"""Only a privately retained, frozen main-file snapshot with no WAL frames.
|
||||
|
||||
Caller must establish exclusive snapshot creation/admin exit/no writer, and
|
||||
supply the recorded frozen main digest. Never use for the live database.
|
||||
Immutable SQLite reads ignore stale SHM and never create/change sidecars.
|
||||
Existing sidecars remain custody evidence; nothing is deleted/checkpointed.
|
||||
"""
|
||||
path = Path(path)
|
||||
if re.fullmatch(r'[0-9a-f]{64}', expected_sha256) is None:
|
||||
raise ValueError('exact frozen snapshot digest required')
|
||||
def metadata(target):
|
||||
info = target.lstat()
|
||||
if not stat.S_ISREG(info.st_mode) or stat.S_IMODE(info.st_mode) != 0o600 or info.st_nlink != 1:
|
||||
raise ValueError('private single-link snapshot custody required')
|
||||
return info
|
||||
main = metadata(path)
|
||||
if not 0 < main.st_size <= 512 * 1024**2:
|
||||
raise ValueError('bounded frozen snapshot required')
|
||||
def sidecars():
|
||||
identities = {}
|
||||
for suffix in ('-wal', '-shm'):
|
||||
target = Path(str(path) + suffix)
|
||||
if os.path.lexists(target):
|
||||
info = metadata(target)
|
||||
if info.st_uid != main.st_uid or info.st_gid != main.st_gid:
|
||||
raise ValueError('snapshot sidecar custody changed')
|
||||
if suffix == '-wal' and info.st_size != 0:
|
||||
raise ValueError('snapshot has WAL frames; immutable read refused')
|
||||
identities[suffix] = (info.st_dev, info.st_ino, info.st_size, info.st_mtime_ns)
|
||||
return identities
|
||||
before_sidecars = sidecars()
|
||||
def digest():
|
||||
value = hashlib.sha256()
|
||||
with path.open('rb') as stream:
|
||||
for block in iter(lambda: stream.read(1024**2), b''):
|
||||
value.update(block)
|
||||
return value.hexdigest()
|
||||
if digest() != expected_sha256:
|
||||
raise ValueError('frozen main-file digest changed before inspection')
|
||||
proof = inspect_readonly(path, _closed_snapshot=True)
|
||||
after = metadata(path)
|
||||
if (after.st_dev, after.st_ino, after.st_uid, after.st_gid, after.st_size) != (main.st_dev, main.st_ino, main.st_uid, main.st_gid, main.st_size):
|
||||
raise ValueError('frozen main-file identity changed')
|
||||
if digest() != expected_sha256 or sidecars() != before_sidecars:
|
||||
raise ValueError('frozen snapshot changed during inspection')
|
||||
return proof
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
parser = argparse.ArgumentParser(description=__doc__)
|
||||
parser.add_argument('--db', type=Path, required=True)
|
||||
args = parser.parse_args()
|
||||
try:
|
||||
print(json.dumps(inspect_readonly(args.db), sort_keys=True))
|
||||
except Exception:
|
||||
raise SystemExit('read-only schema5/integrity/count gate refused; no Store/admin open') from None
|
||||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Add table
Add a link
Reference in a new issue