Prepare authenticated lifecycle runtime and production release candidate
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
This commit is contained in:
parent
f3b71b1521
commit
4f546ae3b1
41 changed files with 2598 additions and 52 deletions
32
docs/evidence/2026-10-04-lifecycle-release/container.json
Normal file
32
docs/evidence/2026-10-04-lifecycle-release/container.json
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
{
|
||||
"status": "passed",
|
||||
"image_id": "sha256:2768bd1da3e651cc0be2d0f1ae6eea1af4eb057b31ef63ebb03b004c2ed76c3d",
|
||||
"repo_digests": [
|
||||
"informed-decision@sha256:2768bd1da3e651cc0be2d0f1ae6eea1af4eb057b31ef63ebb03b004c2ed76c3d"
|
||||
],
|
||||
"checks_passed": 13,
|
||||
"checks": [
|
||||
"installed container entrypoint serves with projected configuration",
|
||||
"non-root read-only runtime has no external network or published port",
|
||||
"private config/database modes enforced; package installer absent",
|
||||
"configured review refuses anonymous access and reports audit-unready status",
|
||||
"private listener refuses anonymous lifecycle access and exposes no browser routes",
|
||||
"public listener exposes no private workload route",
|
||||
"a second writer cannot acquire the active evidence volume",
|
||||
"synthetic uncertain intent and undelivered evidence remain explicit",
|
||||
"consistent backup created while serving; overwrite refused",
|
||||
"SIGTERM closes the serving writer without forced kill",
|
||||
"restart preserves immutable content and unresolved submission without retry",
|
||||
"separate restored volume preserves exact content and unresolved state",
|
||||
"incomplete owner configuration exits before serving"
|
||||
],
|
||||
"fixture_only": true,
|
||||
"external_network": "none",
|
||||
"content_snapshot_sha256": "7bcbffb5652f7784de477241c4fcc464f8f5fa26288c44876db87beec964a904",
|
||||
"native_identity_policy_audit_proven": false,
|
||||
"published": false,
|
||||
"deployed": false,
|
||||
"factory_attempts": 0,
|
||||
"paid_model_calls": 0,
|
||||
"cleanup_complete": true
|
||||
}
|
||||
|
|
@ -0,0 +1,88 @@
|
|||
{
|
||||
"valid": true,
|
||||
"caring_findings": [
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed canonical roles",
|
||||
"fields": [
|
||||
"caring.canonical_roles"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed organization relations",
|
||||
"fields": [
|
||||
"caring.organization_relations"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed scopes",
|
||||
"fields": [
|
||||
"caring.scopes"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed planes",
|
||||
"fields": [
|
||||
"caring.planes"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed capabilities",
|
||||
"fields": [
|
||||
"caring.capabilities"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed exposure modes",
|
||||
"fields": [
|
||||
"caring.exposure_modes"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed conditions",
|
||||
"fields": [
|
||||
"caring.conditions"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed restrictions",
|
||||
"fields": [
|
||||
"caring.restrictions"
|
||||
]
|
||||
}
|
||||
],
|
||||
"tests": [
|
||||
{
|
||||
"name": "test_empty_denied",
|
||||
"passed": true
|
||||
}
|
||||
],
|
||||
"fixtures": [
|
||||
{
|
||||
"id": "unknown-request-denied",
|
||||
"passed": true,
|
||||
"expected": {
|
||||
"effect": "deny"
|
||||
},
|
||||
"actual": {
|
||||
"effect": "deny",
|
||||
"reason": "lifecycle_scope_or_identity_refused"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
19
docs/evidence/2026-10-04-lifecycle-release/manifest.json
Normal file
19
docs/evidence/2026-10-04-lifecycle-release/manifest.json
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
{
|
||||
"date": "2026-10-04",
|
||||
"status": "prepared-not-deployed",
|
||||
"server_dry_run": {
|
||||
"cluster": "railiance01",
|
||||
"objects": 25,
|
||||
"passed": true
|
||||
},
|
||||
"sha256": {
|
||||
"deploy/lifecycle/admission.candidate.json": "e3054aebb2338146b912121198eba0232973574b9f045710abc802e524fe43f6",
|
||||
"deploy/lifecycle/intake-submitters.json": "58ba5ef87ecfd40bc7f0eaf2beb5e50f0c1f0e47315e79dbfa9e06411a17eba9",
|
||||
"deploy/lifecycle/lifecycle-callers.json": "0b66382a64bdf81ee75d14a70ba3b19290084922a1e0bc8a873af0f039dc7041",
|
||||
"deploy/lifecycle/policy.candidate.yaml": "e08fcb494d8d29f45b5fbce949246ce2de28e73a56efd2064f42dbfee8f3d11f",
|
||||
"deploy/lifecycle/registries.candidate.json": "9bad6db5fbc2178d31b04120016a41830c3552fbb9e2517b718f9bbe87cf649e",
|
||||
"deploy/lifecycle/review-groups.json": "1d61d2b82230981130936651a7fc4230e06ecaa51416a8a1be2bb2eb6ec4c353",
|
||||
"deploy/lifecycle/review-policy.candidate.yaml": "6c49a9d520a553778935555351c70b3823b72dd0f1ed3a5383d5a4fc0e5e7998",
|
||||
"deploy/lifecycle/service.candidate.json": "bf36ecb0160bf893a60fe059a3baf27a63668e2bb7b9f17c9582d6de8e842545"
|
||||
}
|
||||
}
|
||||
17
docs/evidence/2026-10-04-lifecycle-release/policy-scan.json
Normal file
17
docs/evidence/2026-10-04-lifecycle-release/policy-scan.json
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
{
|
||||
"scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
|
||||
"scanner_version": "0.74.0",
|
||||
"scanned_at": "2026-10-04T19:35:45.454792771Z",
|
||||
"artifact": "flex-auth:wp0007-candidate",
|
||||
"image_id": "sha256:f6ed8af69af766d7e9498465a23c292d91185b79352065736a2132216aac1d37",
|
||||
"severities": [
|
||||
"HIGH",
|
||||
"CRITICAL"
|
||||
],
|
||||
"vulnerabilities": 0,
|
||||
"full_report_sha256": "e41d19c961f0e0d3a4051362c6769edc3069b4286612239861818d403c16ee6a",
|
||||
"warnings": [
|
||||
"vendor severity selection"
|
||||
],
|
||||
"scope": "candidate artifact scan; not a general security attestation"
|
||||
}
|
||||
|
|
@ -0,0 +1,232 @@
|
|||
{
|
||||
"valid": true,
|
||||
"caring_findings": [
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed canonical roles",
|
||||
"fields": [
|
||||
"caring.canonical_roles"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed organization relations",
|
||||
"fields": [
|
||||
"caring.organization_relations"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed scopes",
|
||||
"fields": [
|
||||
"caring.scopes"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed planes",
|
||||
"fields": [
|
||||
"caring.planes"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed capabilities",
|
||||
"fields": [
|
||||
"caring.capabilities"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed exposure modes",
|
||||
"fields": [
|
||||
"caring.exposure_modes"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed conditions",
|
||||
"fields": [
|
||||
"caring.conditions"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed restrictions",
|
||||
"fields": [
|
||||
"caring.restrictions"
|
||||
]
|
||||
}
|
||||
],
|
||||
"tests": [
|
||||
{
|
||||
"name": "test_allow_does_not_prove_the_pin",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_approval_id_malformed",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_attribute_acts_are_eligible_only_when_sets_admit",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_bad_memo_id_refused",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_digest_mismatch",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_exact_pin_mismatch_is_not_rescued",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_exact_record_ignores_attribute_context",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_future_mfa_is_identity_refused",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_human_control_false",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_initial_release_allows_only_decision_record_class",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_initial_release_sets",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_list_does_not_use_attribute_admission",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_listable_is_exact_union",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_memo_review_group_is_not_hardcoded",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_memo_version_refused",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_requester_mismatch",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_review_group_must_be_verified",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_service_subject_is_identity_refused",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_six_exact_metered_memos_allow_human_review",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_stale_mfa_on_attribute_branch",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_t03_records_not_in_act_scope",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_tool_proof_exact_record_allowed",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_tool_proof_without_mfa_denied",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_tool_proof_wrong_digest_denied",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_tool_proof_wrong_native_id_denied",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_unknown_class",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_unknown_request_denied",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_unknown_submitter",
|
||||
"passed": true
|
||||
}
|
||||
],
|
||||
"fixtures": [
|
||||
{
|
||||
"id": "unknown-request-denied",
|
||||
"passed": true,
|
||||
"expected": {
|
||||
"effect": "deny"
|
||||
},
|
||||
"actual": {
|
||||
"effect": "deny",
|
||||
"reason": "compact_sitting_scope_or_identity_refused"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "attribute-non-human-refused",
|
||||
"passed": true,
|
||||
"expected": {
|
||||
"effect": "deny",
|
||||
"reason": "identity_refused"
|
||||
},
|
||||
"actual": {
|
||||
"effect": "deny",
|
||||
"reason": "identity_refused"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "attribute-stale-mfa",
|
||||
"passed": true,
|
||||
"expected": {
|
||||
"effect": "deny",
|
||||
"reason": "stale_mfa"
|
||||
},
|
||||
"actual": {
|
||||
"effect": "deny",
|
||||
"reason": "stale_mfa"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "attribute-future-mfa",
|
||||
"passed": true,
|
||||
"expected": {
|
||||
"effect": "deny",
|
||||
"reason": "identity_refused"
|
||||
},
|
||||
"actual": {
|
||||
"effect": "deny",
|
||||
"reason": "identity_refused"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
17
docs/evidence/2026-10-04-lifecycle-release/service-scan.json
Normal file
17
docs/evidence/2026-10-04-lifecycle-release/service-scan.json
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
{
|
||||
"scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
|
||||
"scanner_version": "0.74.0",
|
||||
"scanned_at": "2026-10-04T19:30:26.955785485Z",
|
||||
"artifact": "informed-decision:wp0007-candidate",
|
||||
"image_id": "sha256:2768bd1da3e651cc0be2d0f1ae6eea1af4eb057b31ef63ebb03b004c2ed76c3d",
|
||||
"severities": [
|
||||
"HIGH",
|
||||
"CRITICAL"
|
||||
],
|
||||
"vulnerabilities": 0,
|
||||
"full_report_sha256": "86543b4d8850008ada40e10f99f3b26c0564a77cab5932f61115e574e21a2ee4",
|
||||
"warnings": [
|
||||
"Alpine 3.24 absent from scanner EOL list"
|
||||
],
|
||||
"scope": "candidate artifact scan; not a general security attestation"
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue