coulomb/informed-decision
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Pin lifecycle policy proposal to verified Forgejo build

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
This commit is contained in:
tegwick 2026-10-04 21:46:31 +02:00
parent 4f546ae3b1
commit 4898c9b764
5 changed files with 17 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

6
deploy/lifecycle/README.md
View file

@ -6,7 +6,7 @@ humans and system:serviceaccount:state-hub:state-hub. **Not deployed.**
| Artifact | Immutable reference |
| --- | --- |
| Service | forgejo.coulomb.social/coulomb/informed-decision@sha256:2768bd1da3e651cc0be2d0f1ae6eea1af4eb057b31ef63ebb03b004c2ed76c3d |
| Access Engine | forgejo.coulomb.social/coulomb/flex-auth@sha256:f6ed8af69af766d7e9498465a23c292d91185b79352065736a2132216aac1d37 |
| Access Engine | forgejo.coulomb.social/coulomb/flex-auth@sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99 |
| Lifecycle package | informed-decision.lifecycle v1, sha256:cee6a79f74e81d0d389a2c2e2451a92be3434ea9dfcee4986e8c7e6cfdbb1827 |
| Human review package | informed-decision.compact-sitting v12, sha256:c5387f7d198dc39ab5967e0c218ce05cc779693565c8875e3035e45ec002a2db |
@ -94,3 +94,7 @@ Both artifact scans contain zero HIGH/CRITICAL findings. Actual evaluator tests
cover first-audience collaboration across revisions and verify unchanged package
pins; authentication custody in those tests is synthetic. Native activation and
broader browser packet/binding profiles remain explicit workplan tasks.
The final Access Engine pin is the Forgejo image built from commit d2d0b6f
(run https://forgejo.coulomb.social/coulomb/access-engine/actions/runs/316).
It supersedes the locally built candidate for the proposed deployment.

2
deploy/lifecycle/policy.candidate.yaml
View file

@ -128,7 +128,7 @@ spec:
type: RuntimeDefault
containers:
- name: flex-auth
image: forgejo.coulomb.social/coulomb/flex-auth@sha256:f6ed8af69af766d7e9498465a23c292d91185b79352065736a2132216aac1d37
image: forgejo.coulomb.social/coulomb/flex-auth@sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99
imagePullPolicy: IfNotPresent
args:
- serve

2
deploy/lifecycle/review-policy.candidate.yaml
View file

@ -128,7 +128,7 @@ spec:
type: RuntimeDefault
containers:
- name: flex-auth
image: forgejo.coulomb.social/coulomb/flex-auth@sha256:f6ed8af69af766d7e9498465a23c292d91185b79352065736a2132216aac1d37
image: forgejo.coulomb.social/coulomb/flex-auth@sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99
imagePullPolicy: IfNotPresent
args:
- serve

4
docs/evidence/2026-10-04-lifecycle-release/manifest.json
View file

@ -10,10 +10,10 @@
"deploy/lifecycle/admission.candidate.json": "e3054aebb2338146b912121198eba0232973574b9f045710abc802e524fe43f6",
"deploy/lifecycle/intake-submitters.json": "58ba5ef87ecfd40bc7f0eaf2beb5e50f0c1f0e47315e79dbfa9e06411a17eba9",
"deploy/lifecycle/lifecycle-callers.json": "0b66382a64bdf81ee75d14a70ba3b19290084922a1e0bc8a873af0f039dc7041",
"deploy/lifecycle/policy.candidate.yaml": "e08fcb494d8d29f45b5fbce949246ce2de28e73a56efd2064f42dbfee8f3d11f",
"deploy/lifecycle/policy.candidate.yaml": "850d96aa7807b0e81e28278d380543770012a006b5dc3ebb06a5a8f5fcb43c4a",
"deploy/lifecycle/registries.candidate.json": "9bad6db5fbc2178d31b04120016a41830c3552fbb9e2517b718f9bbe87cf649e",
"deploy/lifecycle/review-groups.json": "1d61d2b82230981130936651a7fc4230e06ecaa51416a8a1be2bb2eb6ec4c353",
"deploy/lifecycle/review-policy.candidate.yaml": "6c49a9d520a553778935555351c70b3823b72dd0f1ed3a5383d5a4fc0e5e7998",
"deploy/lifecycle/review-policy.candidate.yaml": "1f680eb1184c4a26ae2638b7e0829e5df42237ee09550e7554a3e965edbc8674",
"deploy/lifecycle/service.candidate.json": "bf36ecb0160bf893a60fe059a3baf27a63668e2bb7b9f17c9582d6de8e842545"
}
}

13
docs/evidence/2026-10-04-lifecycle-release/policy-scan.json
View file

@ -1,17 +1,20 @@
{
"scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
"scanner_version": "0.74.0",
"scanned_at": "2026-10-04T19:35:45.454792771Z",
"artifact": "flex-auth:wp0007-candidate",
"image_id": "sha256:f6ed8af69af766d7e9498465a23c292d91185b79352065736a2132216aac1d37",
"scanned_at": "2026-10-04T19:45:06.255864835Z",
"artifact": "forgejo.coulomb.social/coulomb/flex-auth:main-d2d0b6f",
"image_id": "sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99",
"severities": [
"HIGH",
"CRITICAL"
],
"vulnerabilities": 0,
"full_report_sha256": "e41d19c961f0e0d3a4051362c6769edc3069b4286612239861818d403c16ee6a",
"full_report_sha256": "a3f2cefbef113ea150072efacfefbe9d6f0195bb7cf728776eac136fc8995466",
"warnings": [
"vendor severity selection"
],
"scope": "candidate artifact scan; not a general security attestation"
"scope": "candidate artifact scan; not a general security attestation",
"source_commit": "d2d0b6feeb",
"build_url": "https://forgejo.coulomb.social/coulomb/access-engine/actions/runs/316",
"immutable_image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99"
}