diff --git a/deploy/sitting-admission.json b/deploy/sitting-admission.json index d6af160..40b251a 100644 --- a/deploy/sitting-admission.json +++ b/deploy/sitting-admission.json @@ -3,8 +3,8 @@ "policy": { "origin": "http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080", "package": "informed-decision.compact-sitting", - "version": "v10", - "package_digest": "sha256:ede11f888d57809dfce1b04d2323708c7244f36187fd5a58dd738437a05e7e91", + "version": "v11", + "package_digest": "sha256:4fd1961a2ab564a7b3306757ebd5c2c1487c33b29715a3bbf599ad9b79a48fa4", "pod_name": "flex-auth-informed-decision-sitting" }, "keycape_egress_ips": [ diff --git a/docs/batches/2026-10-04-t03-review-act/DEPLOY-v11.md b/docs/batches/2026-10-04-t03-review-act/DEPLOY-v11.md new file mode 100644 index 0000000..2ea3d7c --- /dev/null +++ b/docs/batches/2026-10-04-t03-review-act/DEPLOY-v11.md @@ -0,0 +1,52 @@ +# T03 review acts — deployed 2026-10-04 + +Founder authorized ("Yes, deploy it"). Helm revision 11 is deployed on +`flex-auth-informed-decision-sitting` with image +`sha256:feae06d5cd6c68296437d9df344ab76e44c178b8671ac76bf2d6e83e8ac1f645` +(CI build of access-engine `1aae59f`; pin commit `c0f3f25`). Review runtime +ConfigMap `informed-decision-runtime-f4755c6df69b` is live. Public health and +readiness returned 200. No memo was accepted, declined, or sealed, and hub +decision `62aa95e4-3ccc-4867-8806-5e3db005b483` was not resolved. + +The prepared package follows. + +The live sitting policy v10 lists `SECRETS-WP-0010-T03-apply`, `-verify`, +and `-exec` and refuses `read` and `accept`. v11 adds one act rule for those +three records only. + +## Pins + +| Item | Value | +|---|---| +| Policy source | access-engine `1aae59f`, pin `c0f3f25` | +| Policy version | `v11` | +| Package digest | `sha256:4fd1961a2ab564a7b3306757ebd5c2c1487c33b29715a3bbf599ad9b79a48fa4` | +| Runtime input | `proposed/sitting-admission-v11.json` | +| New ConfigMap | `informed-decision-runtime-f4755c6df69b` in `proposed/review-rollout-v11.json` | +| Review image | unchanged `sha256:ccca0b377bb8ba6af52a37edc453b5b51c96e380840ec8243ffaab3ac2170885` | +| Policy image | `sha256:feae06d5cd6c68296437d9df344ab76e44c178b8671ac76bf2d6e83e8ac1f645` | + +Acts `read`, `acknowledge`, `accept`, `return`, `discuss`, and `decline` +allow only when the memo id, memo version 3, approval id, and binding digest +all match. The 900-second KeyCape bar is the same as the version-1 act rule. +`list` stays `operator_admitted_overview_list`. Version 2, a foreign approval +id, and a wrong digest stay denied. The version-1 sitting records stay on +`operator_admitted_compact_sitting`. + +| Memo | Approval | Binding digest | +|---|---|---| +| `SECRETS-WP-0010-T03-apply` | `b5fcbfcc-ad56-456f-bc36-c823052e9917` | `sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5` | +| `SECRETS-WP-0010-T03-verify` | `4e9ff881-d59f-4143-9155-929afbe8dd43` | `sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2` | +| `SECRETS-WP-0010-T03-exec` | `a24e0898-b3c5-4e50-85a8-18a2c2aa229e` | `sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8` | + +Those approvals expire `2026-10-05T14:24:25Z`. + +## Checks already run + +`go test ./internal/policy/ -run 'TestT03ReviewActs|TestInformedDecisionAttributeAdmission|TestWP0094ExactRecords|TestAdmissionSetGenerator|TestSittingImagePinMatchesRecordedBuild'` passed. `TestT03ReviewActs` covers all six acts and `list` for each of the three memos, refuses version 2 and a wrong digest, and keeps the v9 sitting record on the old act rule. + +## Deployed + +Image `forgejo.coulomb.social/coulomb/flex-auth@sha256:feae06d5cd6c68296437d9df344ab76e44c178b8671ac76bf2d6e83e8ac1f645` matches the policy bytes of `1aae59f`. Helm revision 11 is deployed. The review site serves package digest `sha256:4fd1961a2ab564a7b3306757ebd5c2c1487c33b29715a3bbf599ad9b79a48fa4`, version `v11`. `deploy/sitting-admission.json` records that pin. + +Rollback: `helm rollback flex-auth-informed-decision-sitting 10 -n flex-auth`, then point the review volume back at ConfigMap `informed-decision-runtime-75ab117cc787`. diff --git a/docs/batches/2026-10-04-t03-review-act/proposed/review-rollout-v11.json b/docs/batches/2026-10-04-t03-review-act/proposed/review-rollout-v11.json new file mode 100644 index 0000000..d2370ff --- /dev/null +++ b/docs/batches/2026-10-04-t03-review-act/proposed/review-rollout-v11.json @@ -0,0 +1,531 @@ +{ + "apiVersion": "v1", + "kind": "List", + "items": [ + { + "apiVersion": "v1", + "kind": "ServiceAccount", + "metadata": { + "name": "review", + "namespace": "informed-decision", + "annotations": { + "informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08" + } + }, + "automountServiceAccountToken": false + }, + { + "apiVersion": "v1", + "kind": "PersistentVolumeClaim", + "metadata": { + "name": "informed-decision-data", + "namespace": "informed-decision", + "annotations": { + "informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08" + } + }, + "spec": { + "accessModes": [ + "ReadWriteOnce" + ], + "storageClassName": "local-path", + "resources": { + "requests": { + "storage": "1Gi" + } + } + } + }, + { + "apiVersion": "v1", + "kind": "ConfigMap", + "metadata": { + "name": "informed-decision-runtime-f4755c6df69b", + "namespace": "informed-decision", + "annotations": { + "informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08" + } + }, + "immutable": true, + "data": { + "runtime.json": "{\"approval_origin\":\"http://approval-engine.approval-engine.svc.cluster.local:8080\",\"audit\":{\"origin\":\"http://audit-core.audit-core.svc.cluster.local:8080\",\"sender_token_file\":\"/var/run/secrets/informed-decision/audit/token\"},\"evidence_db\":\"/data/private/review.sqlite\",\"ordinary_approval_ids\":[\"2ce76d7f-01c3-4b63-8476-8d1230679769\",\"c2af4bcf-15b4-4305-aac1-acc7e4dcb099\",\"dc22666a-d5d7-46bc-9490-ebe9fe09dc38\"],\"policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.compact-sitting\",\"package_digest\":\"sha256:4fd1961a2ab564a7b3306757ebd5c2c1487c33b29715a3bbf599ad9b79a48fa4\",\"version\":\"v11\"},\"schema\":\"informed-decision.review-runtime.v1\"}" + } + }, + { + "apiVersion": "apps/v1", + "kind": "Deployment", + "metadata": { + "name": "informed-decision", + "namespace": "informed-decision", + "annotations": { + "informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08" + } + }, + "spec": { + "replicas": 1, + "strategy": { + "type": "Recreate" + }, + "progressDeadlineSeconds": 600, + "selector": { + "matchLabels": { + "app.kubernetes.io/name": "informed-decision" + } + }, + "template": { + "metadata": { + "labels": { + "app.kubernetes.io/name": "informed-decision", + "app.kubernetes.io/component": "review" + } + }, + "spec": { + "automountServiceAccountToken": false, + "serviceAccountName": "review", + "terminationGracePeriodSeconds": 45, + "securityContext": { + "runAsNonRoot": true, + "runAsUser": 10001, + "runAsGroup": 10001, + "fsGroup": 10001, + "fsGroupChangePolicy": "OnRootMismatch", + "seccompProfile": { + "type": "RuntimeDefault" + } + }, + "containers": [ + { + "name": "informed-decision", + "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:ccca0b377bb8ba6af52a37edc453b5b51c96e380840ec8243ffaab3ac2170885", + "securityContext": { + "allowPrivilegeEscalation": false, + "readOnlyRootFilesystem": true, + "capabilities": { + "drop": [ + "ALL" + ] + } + }, + "env": [ + { + "name": "INFD_KEYCAPE_ISSUER", + "value": "https://kc.coulomb.social" + }, + { + "name": "INFD_CONTAINER_CONFIG", + "value": "/configuration/runtime.json" + } + ], + "ports": [ + { + "name": "http", + "containerPort": 8080 + } + ], + "startupProbe": { + "httpGet": { + "path": "/healthz", + "port": "http" + }, + "periodSeconds": 10, + "timeoutSeconds": 2, + "failureThreshold": 12 + }, + "readinessProbe": { + "httpGet": { + "path": "/healthz", + "port": "http" + }, + "periodSeconds": 10, + "timeoutSeconds": 2 + }, + "livenessProbe": { + "httpGet": { + "path": "/healthz", + "port": "http" + }, + "periodSeconds": 10, + "timeoutSeconds": 2 + }, + "resources": { + "requests": { + "cpu": "5m", + "memory": "64Mi" + }, + "limits": { + "cpu": "500m", + "memory": "256Mi" + } + }, + "volumeMounts": [ + { + "name": "data", + "mountPath": "/data" + }, + { + "name": "runtime", + "mountPath": "/run/informed-decision" + }, + { + "name": "tmp", + "mountPath": "/tmp" + }, + { + "name": "configuration", + "mountPath": "/configuration", + "readOnly": true + }, + { + "name": "caller", + "mountPath": "/var/run/secrets/informed-decision/policy", + "readOnly": true + }, + { + "name": "audit", + "mountPath": "/var/run/secrets/informed-decision/audit", + "readOnly": true + } + ] + } + ], + "volumes": [ + { + "name": "data", + "persistentVolumeClaim": { + "claimName": "informed-decision-data" + } + }, + { + "name": "runtime", + "emptyDir": { + "medium": "Memory", + "sizeLimit": "16Mi" + } + }, + { + "name": "tmp", + "emptyDir": { + "medium": "Memory", + "sizeLimit": "16Mi" + } + }, + { + "name": "configuration", + "configMap": { + "name": "informed-decision-runtime-f4755c6df69b", + "defaultMode": 292 + } + }, + { + "name": "caller", + "projected": { + "defaultMode": 288, + "sources": [ + { + "serviceAccountToken": { + "path": "token", + "audience": "flex-auth", + "expirationSeconds": 3600 + } + } + ] + } + }, + { + "name": "audit", + "secret": { + "secretName": "informed-decision-audit", + "defaultMode": 288, + "items": [ + { + "key": "token", + "path": "token" + } + ] + } + } + ] + } + } + } + }, + { + "apiVersion": "v1", + "kind": "Service", + "metadata": { + "name": "informed-decision", + "namespace": "informed-decision", + "annotations": { + "informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08" + } + }, + "spec": { + "type": "ClusterIP", + "selector": { + "app.kubernetes.io/name": "informed-decision", + "app.kubernetes.io/component": "review" + }, + "ports": [ + { + "name": "http", + "port": 80, + "targetPort": "http", + "protocol": "TCP" + } + ] + } + }, + { + "apiVersion": "networking.k8s.io/v1", + "kind": "NetworkPolicy", + "metadata": { + "name": "informed-decision-review", + "namespace": "informed-decision", + "annotations": { + "informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08" + } + }, + "spec": { + "podSelector": { + "matchLabels": { + "app.kubernetes.io/name": "informed-decision", + "app.kubernetes.io/component": "review" + } + }, + "policyTypes": [ + "Ingress", + "Egress" + ], + "ingress": [ + { + "from": [ + { + "namespaceSelector": { + "matchLabels": { + "kubernetes.io/metadata.name": "kube-system" + } + }, + "podSelector": { + "matchLabels": { + "app.kubernetes.io/name": "traefik" + } + } + } + ], + "ports": [ + { + "protocol": "TCP", + "port": 8080 + } + ] + } + ], + "egress": [ + { + "to": [ + { + "namespaceSelector": { + "matchLabels": { + "kubernetes.io/metadata.name": "kube-system" + } + }, + "podSelector": { + "matchLabels": { + "k8s-app": "kube-dns" + } + } + } + ], + "ports": [ + { + "protocol": "UDP", + "port": 53 + }, + { + "protocol": "TCP", + "port": 53 + } + ] + }, + { + "to": [ + { + "namespaceSelector": { + "matchLabels": { + "kubernetes.io/metadata.name": "approval-engine" + } + }, + "podSelector": { + "matchLabels": { + "app.kubernetes.io/name": "approval-engine" + } + } + }, + { + "namespaceSelector": { + "matchLabels": { + "kubernetes.io/metadata.name": "audit-core" + } + }, + "podSelector": { + "matchLabels": { + "app.kubernetes.io/name": "audit-core" + } + } + }, + { + "namespaceSelector": { + "matchLabels": { + "kubernetes.io/metadata.name": "flex-auth" + } + }, + "podSelector": { + "matchLabels": { + "app.kubernetes.io/name": "flex-auth-informed-decision-sitting" + } + } + } + ], + "ports": [ + { + "protocol": "TCP", + "port": 8080 + } + ] + }, + { + "to": [ + { + "namespaceSelector": { + "matchLabels": { + "kubernetes.io/metadata.name": "kube-system" + } + }, + "podSelector": { + "matchLabels": { + "app.kubernetes.io/name": "traefik" + } + } + } + ], + "ports": [ + { + "protocol": "TCP", + "port": 8443 + } + ] + }, + { + "to": [ + { + "ipBlock": { + "cidr": "92.205.62.239/32" + } + } + ], + "ports": [ + { + "protocol": "TCP", + "port": 443 + } + ] + } + ] + } + }, + { + "apiVersion": "networking.k8s.io/v1", + "kind": "NetworkPolicy", + "metadata": { + "name": "informed-decision-review-ingress", + "namespace": "approval-engine", + "annotations": { + "informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08", + "informed-decision.coulomb.social/owner-review": "APPROVAL-WP-0002-T01" + } + }, + "spec": { + "podSelector": { + "matchLabels": { + "app.kubernetes.io/name": "approval-engine" + } + }, + "policyTypes": [ + "Ingress" + ], + "ingress": [ + { + "from": [ + { + "namespaceSelector": { + "matchLabels": { + "kubernetes.io/metadata.name": "informed-decision" + } + }, + "podSelector": { + "matchLabels": { + "app.kubernetes.io/name": "informed-decision", + "app.kubernetes.io/component": "review" + } + } + } + ], + "ports": [ + { + "protocol": "TCP", + "port": 8080 + } + ] + } + ] + } + }, + { + "apiVersion": "networking.k8s.io/v1", + "kind": "NetworkPolicy", + "metadata": { + "name": "informed-decision-review-ingress", + "namespace": "flex-auth", + "annotations": { + "informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08", + "informed-decision.coulomb.social/owner-review": "INFD-WP-0001-T08 policy-owner return" + } + }, + "spec": { + "podSelector": { + "matchLabels": { + "app.kubernetes.io/name": "flex-auth-informed-decision-sitting" + } + }, + "policyTypes": [ + "Ingress" + ], + "ingress": [ + { + "from": [ + { + "namespaceSelector": { + "matchLabels": { + "kubernetes.io/metadata.name": "informed-decision" + } + }, + "podSelector": { + "matchLabels": { + "app.kubernetes.io/name": "informed-decision", + "app.kubernetes.io/component": "review" + } + } + } + ], + "ports": [ + { + "protocol": "TCP", + "port": 8080 + } + ] + } + ] + } + } + ] +} diff --git a/docs/batches/2026-10-04-t03-review-act/proposed/sitting-admission-v11.json b/docs/batches/2026-10-04-t03-review-act/proposed/sitting-admission-v11.json new file mode 100644 index 0000000..40b251a --- /dev/null +++ b/docs/batches/2026-10-04-t03-review-act/proposed/sitting-admission-v11.json @@ -0,0 +1,19 @@ +{ + "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:ccca0b377bb8ba6af52a37edc453b5b51c96e380840ec8243ffaab3ac2170885", + "policy": { + "origin": "http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080", + "package": "informed-decision.compact-sitting", + "version": "v11", + "package_digest": "sha256:4fd1961a2ab564a7b3306757ebd5c2c1487c33b29715a3bbf599ad9b79a48fa4", + "pod_name": "flex-auth-informed-decision-sitting" + }, + "keycape_egress_ips": [ + "92.205.62.239" + ], + "storage_class": "local-path", + "ordinary_approval_ids": [ + "2ce76d7f-01c3-4b63-8476-8d1230679769", + "c2af4bcf-15b4-4305-aac1-acc7e4dcb099", + "dc22666a-d5d7-46bc-9490-ebe9fe09dc38" + ] +}