coulomb/informed-decision
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Support exact-ID human review of ordinary approvals and prepare metered memos

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e387-534d-70e3-ad53-4ea05676db8c
This commit is contained in:
tegwick 2026-09-27 20:45:28 +02:00
parent 13ca3a5372
commit 34eda52755
18 changed files with 1048 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

9
tools/render_deployment.py
View file

@ -13,7 +13,7 @@ LABEL = {'app.kubernetes.io/name': NAME}
def render(inputs):
if not isinstance(inputs,dict) or set(inputs)!={'image','policy','keycape_egress_ips','storage_class'}:
if not isinstance(inputs,dict) or (set(inputs)-{'ordinary_approval_ids'})!={'image','policy','keycape_egress_ips','storage_class'}:
raise ValueError('exact image, policy, KeyCape egress IPs and storage class inputs required')
if not re.fullmatch(r'forgejo\.coulomb\.social/coulomb/informed-decision@sha256:[0-9a-f]{64}',inputs['image']):
raise ValueError('immutable Informed Decision registry digest required')
@ -43,6 +43,13 @@ def render(inputs):
'policy':{key:policy[key] for key in ['origin','package','version','package_digest']},
'audit':{'origin':'http://audit-core.audit-core.svc.cluster.local:8080',
'sender_token_file':'/var/run/secrets/informed-decision/audit/token'}}
if 'ordinary_approval_ids' in inputs:
ids=inputs['ordinary_approval_ids']
if (not isinstance(ids,list) or len(ids)>32
or any(not isinstance(i,str) or not re.fullmatch(r'[A-Za-z0-9][A-Za-z0-9_-]{0,127}',i) for i in ids)
or len(set(ids))!=len(ids)):
raise ValueError('exact ordinary approval ids required')
config['ordinary_approval_ids']=sorted(ids)
config['policy']['caller_token_file']='/var/run/secrets/informed-decision/policy/token'
raw=json.dumps(config,sort_keys=True,separators=(',',':'))
config_name=NAME+'-runtime-'+hashlib.sha256(raw.encode()).hexdigest()[:12]