Deploy fresh review login image and record live readiness evidence
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029c-c003-7283-acc9-930b434e6cae
This commit is contained in:
parent
6d322eb210
commit
333a6dcf95
5 changed files with 83 additions and 3 deletions
|
|
@ -1,5 +1,10 @@
|
|||
# Fresh review authentication rollout candidate
|
||||
|
||||
Deployed on founder instruction "please deploy", 2026-10-03 18:39 UTC.
|
||||
Deployment revision 17 Ready; public health/readiness and fresh-login redirect
|
||||
verified. Native human browser proof pending. Evidence:
|
||||
`docs/evidence/2026-10-03-fresh-auth-live-rollout.json`.
|
||||
|
||||
INFD-WP-0006. Source `50adfa0326f2366a2e9d9b5e39d50273e9589e7d`.
|
||||
Published immutable candidate:
|
||||
`forgejo.coulomb.social/coulomb/informed-decision@sha256:ccca0b377bb8ba6af52a37edc453b5b51c96e380840ec8243ffaab3ac2170885`.
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
{
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:0557edffb0efccc2e283cb878bc3f85deacd8165b45eefde830c21f6f02710c8",
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:ccca0b377bb8ba6af52a37edc453b5b51c96e380840ec8243ffaab3ac2170885",
|
||||
"policy": {
|
||||
"origin": "http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080",
|
||||
"package": "informed-decision.compact-sitting",
|
||||
|
|
|
|||
58
docs/evidence/2026-10-03-fresh-auth-live-rollout.json
Normal file
58
docs/evidence/2026-10-03-fresh-auth-live-rollout.json
Normal file
|
|
@ -0,0 +1,58 @@
|
|||
{
|
||||
"at": "2026-10-03T18:39:16.801706+00:00",
|
||||
"authority": {
|
||||
"actor": "founder",
|
||||
"instruction": "please deploy",
|
||||
"mode": "ADMINISTER",
|
||||
"scope": "realm:kubernetes/railiance01",
|
||||
"activation": "APPROVED"
|
||||
},
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:ccca0b377bb8ba6af52a37edc453b5b51c96e380840ec8243ffaab3ac2170885",
|
||||
"previous_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:0557edffb0efccc2e283cb878bc3f85deacd8165b45eefde830c21f6f02710c8",
|
||||
"deployment_revision": "17",
|
||||
"strategy": "Recreate",
|
||||
"ready_replicas": 1,
|
||||
"resources": {
|
||||
"limits": {
|
||||
"cpu": "500m",
|
||||
"memory": "256Mi"
|
||||
},
|
||||
"requests": {
|
||||
"cpu": "5m",
|
||||
"memory": "64Mi"
|
||||
}
|
||||
},
|
||||
"node_preflight": {
|
||||
"ip": "92.205.62.239",
|
||||
"cpu_requests_millicores": 3445,
|
||||
"cpu_allocatable_millicores": 4000,
|
||||
"additional_cpu_requests_millicores": 0
|
||||
},
|
||||
"public_checks": {
|
||||
"/healthz": {
|
||||
"status": 200
|
||||
},
|
||||
"/readyz": {
|
||||
"status": 200
|
||||
},
|
||||
"/auth/start": {
|
||||
"status": 303,
|
||||
"issuer_origin": "https://kc.coulomb.social",
|
||||
"issuer_path": "/authorize",
|
||||
"prompt": [
|
||||
"login"
|
||||
],
|
||||
"max_age": [
|
||||
"0"
|
||||
]
|
||||
}
|
||||
},
|
||||
"store_readback": {
|
||||
"schema_version": 2,
|
||||
"p01_memo_count": 1,
|
||||
"policy_version": "v7",
|
||||
"policy_package_digest": "sha256:2490955f175c52574543e210be06f468a01e56c778d38d4fdcad731875e37cc7"
|
||||
},
|
||||
"native_browser_proof": "awaiting founder password/OTP login and exact p01 read",
|
||||
"agent_performed_human_act": false
|
||||
}
|
||||
|
|
@ -40,7 +40,7 @@ id: INFD-WP-ADHOC-2026-10-03-T02
|
|||
status: wait
|
||||
needs_human: true
|
||||
decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483
|
||||
blocking_reason: "p01 is loaded, but repeated browser read attempts retain KeyCape MFA time 17:08:08 UTC and fail the 900-second policy limit. Obtain genuinely fresh password/OTP authentication; if fresh OTP still emits the old time, KeyCape owns the correction (INFD-IN-0005). Then founder reviews, acknowledges and chooses a disposition."
|
||||
blocking_reason: "p01 is loaded and fresh-login fix deployed; founder must sign in at decisions.coulomb.social/auth/start with password/OTP, open p01, acknowledge the required highlight and choose a disposition. If actual fresh MFA still emits old assurance, KeyCape owns correction under INFD-IN-0005."
|
||||
priority: high
|
||||
state_hub_task_id: "ffbc2e30-7a6a-5fb4-86c9-3db1e4a0bacf"
|
||||
```
|
||||
|
|
@ -130,3 +130,9 @@ it with a completed browser journey. Retain all policy freshness limits.
|
|||
Evidence: `docs/evidence/2026-10-03-provisioning-window-review-refusal.json`.
|
||||
`INFD-WP-0006` implements an explicit fresh-authentication request from review
|
||||
sign-in; its narrow image rollout and native browser proof remain blocked.
|
||||
|
||||
Fresh-login image rollout completed under founder instruction "please deploy"
|
||||
at 18:39 UTC (INFD-WP-0006). Revision 17 is Ready; public login now requests
|
||||
fresh authentication from KeyCape. p01 and policy pins remain intact. Native
|
||||
read and the founder's disposition are still pending. See
|
||||
`docs/evidence/2026-10-03-fresh-auth-live-rollout.json`.
|
||||
|
|
|
|||
|
|
@ -44,7 +44,7 @@ id: INFD-WP-0006-T02
|
|||
status: wait
|
||||
priority: high
|
||||
needs_human: true
|
||||
blocking_reason: "Narrow pinned review image and rollback are published/prepared; obtain founder approval for the live rollout, then complete human password/OTP login and verify a new signed authentication time and p01 read allowance."
|
||||
blocking_reason: "Fresh-login image deployed on founder approval; founder must complete review password/OTP login so we can verify a new signed authentication time and p01 read allowance."
|
||||
state_hub_task_id: "dfcc2723-42bd-5b8f-b1b8-e205dc506764"
|
||||
```
|
||||
|
||||
|
|
@ -64,3 +64,14 @@ Installed fresh-login parameter check, base-layer equality check and all 11
|
|||
container lifecycle checks pass. Concrete rollout/rollback and acceptance
|
||||
requirements are in `deploy/FRESH-AUTH.md`; image-only strategic patches are
|
||||
prepared alongside it. Live deployment has not changed.
|
||||
|
||||
2026-10-03 18:39 UTC: founder instructed "please deploy".
|
||||
ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED.
|
||||
Image-only patch deployed successfully as Deployment revision 17, one Ready
|
||||
replica, Recreate, unchanged 5m CPU/64Mi memory requests. Node preflight showed
|
||||
3445m of 4000m CPU requested; no additional request introduced. Public health
|
||||
and readiness return 200; public sign-in redirects to the exact KeyCape issuer
|
||||
with `prompt=login` and `max_age=0`. Read-only store verification confirms
|
||||
schema 2, retained p01 and v7 policy digest. All process-local sessions reset.
|
||||
Evidence: `docs/evidence/2026-10-03-fresh-auth-live-rollout.json`.
|
||||
T02 remains wait solely for native human browser proof; no agent bound a memo.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue