Pin native-verified lifecycle image and production restore evidence
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
This commit is contained in:
parent
03f18d8258
commit
70dc3b969d
15 changed files with 211 additions and 11 deletions
1
.gitignore
vendored
1
.gitignore
vendored
|
|
@ -5,3 +5,4 @@ __pycache__/
|
|||
.venv/
|
||||
dist/
|
||||
build/
|
||||
/.private-backups/
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@ humans and system:serviceaccount:state-hub:state-hub. **Not deployed.**
|
|||
|
||||
| Artifact | Immutable reference |
|
||||
| --- | --- |
|
||||
| Service | forgejo.coulomb.social/coulomb/informed-decision@sha256:2768bd1da3e651cc0be2d0f1ae6eea1af4eb057b31ef63ebb03b004c2ed76c3d |
|
||||
| Service | forgejo.coulomb.social/coulomb/informed-decision@sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1 |
|
||||
| Access Engine | forgejo.coulomb.social/coulomb/flex-auth@sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99 |
|
||||
| Lifecycle package | informed-decision.lifecycle v1, sha256:cee6a79f74e81d0d389a2c2e2451a92be3434ea9dfcee4986e8c7e6cfdbb1827 |
|
||||
| Human review package | informed-decision.compact-sitting v12, sha256:c5387f7d198dc39ab5967e0c218ce05cc779693565c8875e3035e45ec002a2db |
|
||||
|
|
@ -43,10 +43,12 @@ contract; neither is presented as a newly enforced control.
|
|||
|
||||
## Pre-cutover gates
|
||||
|
||||
1. RPF-WP-0051 / CCR-2026-0032: complete the already prepared requester delivery
|
||||
under its separate live go, with exact identity/path negative proofs and
|
||||
mounted-file refresh/rotation evidence. Only the audit ExternalSecret was
|
||||
present in the live namespace at inspection.
|
||||
1. RPF-WP-0051 / CCR-2026-0032 requester delivery is applied: store Valid and
|
||||
ExternalSecret SecretSynced; native candidate-image identity/path/scope,
|
||||
projection and reader-revocation proofs pass. Verify the receiving service's
|
||||
actual mount during cutover. Issuer rotation is a separate governed operation,
|
||||
excluded from this initial delivery by the Platform lane contract; no rotation
|
||||
or predecessor-revocation evidence is claimed here.
|
||||
2. INFD-WP-0005-T08 / STATE-WP-0096: the private dispatcher and separate
|
||||
lifecycle/intake token projections are prepared in dispatcher.candidate.json.
|
||||
Deploy after intake prerequisites. Explicit enqueue requires trusted workload
|
||||
|
|
@ -119,3 +121,24 @@ and credential inputs in that test are synthetic. Native acceptance remains open
|
|||
|
||||
There is no new service-image build for this continuation. The service suite now
|
||||
passes 663 tests (1 skipped); State Hub forwarding/notification tests pass 28.
|
||||
|
||||
## Final requester and restore proof — 2026-10-04
|
||||
|
||||
Service image 804d89fb (source 03f18d8) supersedes 2768bd1 after native testing
|
||||
found KeyCape requires client_secret_basic. Credentials are form-encoded before
|
||||
Basic encoding; requests retain the exact create-only scope and full signature/
|
||||
identity verification. The candidate passes 664 tests (one skipped), 13 installed
|
||||
container checks and a zero HIGH/CRITICAL scan. Its server dry-run passed.
|
||||
|
||||
Actual production snapshot restore was exercised offline in a separate Docker
|
||||
volume with the candidate. Migration from schema 2 to 5 preserved 24 confirmed
|
||||
submissions and 158 delivered outbox rows; lifecycle starts empty. The disposable
|
||||
volume was removed. Original snapshot is retained off-cluster under ignored
|
||||
.private-backups/20261004-pre-lifecycle (0700 parent, 0600 file), with a copy in
|
||||
the live PVC's private directory. Refresh the snapshot after closing writes for
|
||||
cutover; this online drill is not the final maintenance-window backup.
|
||||
|
||||
The requester proof's eight temporary resources were removed. No native approval
|
||||
was created, consumed or human-bound by these tests. The actual review service
|
||||
and State Hub dispatcher have not been rolled out. Concrete cutover approval is
|
||||
the remaining gate for the initial audience and artifacts in this packet.
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
{
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:2768bd1da3e651cc0be2d0f1ae6eea1af4eb057b31ef63ebb03b004c2ed76c3d",
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1",
|
||||
"policy": {
|
||||
"origin": "http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080",
|
||||
"package": "informed-decision.compact-sitting",
|
||||
|
|
|
|||
|
|
@ -96,7 +96,7 @@
|
|||
"containers": [
|
||||
{
|
||||
"name": "informed-decision",
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:2768bd1da3e651cc0be2d0f1ae6eea1af4eb057b31ef63ebb03b004c2ed76c3d",
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1",
|
||||
"securityContext": {
|
||||
"allowPrivilegeEscalation": false,
|
||||
"readOnlyRootFilesystem": true,
|
||||
|
|
|
|||
|
|
@ -0,0 +1,27 @@
|
|||
{
|
||||
"at": "2026-10-04T21:48:43.201341+00:00",
|
||||
"authority": "ADMINISTER @ realm:kubernetes/railiance01",
|
||||
"activation": "APPROVED",
|
||||
"ccr": "CCR-2026-0032",
|
||||
"metadata_helper_exit": 0,
|
||||
"metadata_phase": "metadata_verified",
|
||||
"node_ip": "92.205.62.239",
|
||||
"cpu_requests_millicores": 3445,
|
||||
"server_dry_run_objects": 5,
|
||||
"diff_reviewed": true,
|
||||
"application": "informed-decision-requester",
|
||||
"manifest_revision": "4332c391ea7f66479f67968222a45be4fc6e2f90",
|
||||
"sync": "Succeeded",
|
||||
"automated_sync": false,
|
||||
"store_ready": true,
|
||||
"eso_ready": true,
|
||||
"service_rollout_performed": false,
|
||||
"credential_values_output": false,
|
||||
"verification_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1",
|
||||
"native_proofs_passed": true,
|
||||
"temporary_proof_objects_removed": true,
|
||||
"secret_duplicate_annotation_present": false,
|
||||
"source_fix": "informed-decision 03f18d8: KeyCape requires client_secret_basic",
|
||||
"service_projection_acceptance_pending": true,
|
||||
"issuer_rotation_performed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
{
|
||||
"complete": true,
|
||||
"negative_identity": true,
|
||||
"phase": "wrong_identity_refused",
|
||||
"wrong_identity_refused": true
|
||||
}
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
{
|
||||
"complete": true,
|
||||
"negative_identity": true,
|
||||
"phase": "wrong_identity_refused",
|
||||
"wrong_identity_refused": true
|
||||
}
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
{
|
||||
"approval_approve_refused": true,
|
||||
"approval_consume_refused": true,
|
||||
"approval_read_refused": true,
|
||||
"complete": true,
|
||||
"exact_identity": true,
|
||||
"exact_path_projection_matches": true,
|
||||
"exact_policy_and_ttl": true,
|
||||
"issuer_jwks_request_ok": true,
|
||||
"issuer_token_request_ok": true,
|
||||
"negative_identity": false,
|
||||
"parent_list_refused": true,
|
||||
"phase": "approval_consume_refused",
|
||||
"projection_mode": true,
|
||||
"reader_revoked": true,
|
||||
"revoked_lookup_refused": true,
|
||||
"sibling_get_refused": true,
|
||||
"signed_create_only_exchange": true,
|
||||
"wrong_audience_refused": true
|
||||
}
|
||||
|
|
@ -7,7 +7,7 @@
|
|||
"passed": true
|
||||
},
|
||||
"sha256": {
|
||||
"deploy/lifecycle/admission.candidate.json": "e3054aebb2338146b912121198eba0232973574b9f045710abc802e524fe43f6",
|
||||
"deploy/lifecycle/admission.candidate.json": "c725f55e14356b8b22268e268763032b37611a22354f92f535d31085767411de",
|
||||
"deploy/lifecycle/dispatcher.candidate.json": "e64bdaabfc307caf5f65894ce7e37fd66abaaf9328fd35cfd9103e14bbf739c8",
|
||||
"deploy/lifecycle/intake-submitters.json": "58ba5ef87ecfd40bc7f0eaf2beb5e50f0c1f0e47315e79dbfa9e06411a17eba9",
|
||||
"deploy/lifecycle/lifecycle-callers.json": "0b66382a64bdf81ee75d14a70ba3b19290084922a1e0bc8a873af0f039dc7041",
|
||||
|
|
@ -15,7 +15,7 @@
|
|||
"deploy/lifecycle/registries.candidate.json": "9bad6db5fbc2178d31b04120016a41830c3552fbb9e2517b718f9bbe87cf649e",
|
||||
"deploy/lifecycle/review-groups.json": "1d61d2b82230981130936651a7fc4230e06ecaa51416a8a1be2bb2eb6ec4c353",
|
||||
"deploy/lifecycle/review-policy.candidate.yaml": "1f680eb1184c4a26ae2638b7e0829e5df42237ee09550e7554a3e965edbc8674",
|
||||
"deploy/lifecycle/service.candidate.json": "bf36ecb0160bf893a60fe059a3baf27a63668e2bb7b9f17c9582d6de8e842545"
|
||||
"deploy/lifecycle/service.candidate.json": "5b3cfdce9c622fbf6dbf8b2587809248f20ab0551114ff25e6b5a1f81452690f"
|
||||
},
|
||||
"dispatcher_verification": {
|
||||
"owner_tests_passed": 28,
|
||||
|
|
@ -23,5 +23,11 @@
|
|||
"cross_service_tests_skipped": 1,
|
||||
"installed_container_checks": 5,
|
||||
"high_critical_findings": 0
|
||||
},
|
||||
"requester_basic_fix": {
|
||||
"source_commit": "03f18d8",
|
||||
"image_digest": "sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1",
|
||||
"service_tests_passed": 664,
|
||||
"service_tests_skipped": 1
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -0,0 +1,35 @@
|
|||
{
|
||||
"backup": {
|
||||
"schema_version": 2,
|
||||
"sha256": "b0346c42434cdc375eaa591f4bffeb62b9b2e19bf589a92501c96626142670e6",
|
||||
"submissions": {
|
||||
"confirmed": 24
|
||||
},
|
||||
"outbox": {
|
||||
"delivered": 158
|
||||
},
|
||||
"local_file_mode": "0600",
|
||||
"private_parent_mode": "0700",
|
||||
"backup_consistent": true,
|
||||
"integrity_check": true
|
||||
},
|
||||
"restore": {
|
||||
"schema_version": 5,
|
||||
"lifecycle": {
|
||||
"records": 0,
|
||||
"events": 0,
|
||||
"pending": 0
|
||||
},
|
||||
"outbox": {
|
||||
"delivered": 158
|
||||
},
|
||||
"submissions": {
|
||||
"confirmed": 24
|
||||
}
|
||||
},
|
||||
"restore_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1",
|
||||
"separate_volume": true,
|
||||
"network": "none",
|
||||
"production_writer_unchanged": true,
|
||||
"scope": "Online snapshot drill. Refresh backup after closing writes during approved cutover."
|
||||
}
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
{
|
||||
"status": "passed",
|
||||
"image_id": "sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1",
|
||||
"repo_digests": [
|
||||
"forgejo.coulomb.social/coulomb/informed-decision@sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1"
|
||||
],
|
||||
"checks_passed": 13,
|
||||
"checks": [
|
||||
"installed container entrypoint serves with projected configuration",
|
||||
"non-root read-only runtime has no external network or published port",
|
||||
"private config/database modes enforced; package installer absent",
|
||||
"configured review refuses anonymous access and reports audit-unready status",
|
||||
"private listener refuses anonymous lifecycle access and exposes no browser routes",
|
||||
"public listener exposes no private workload route",
|
||||
"a second writer cannot acquire the active evidence volume",
|
||||
"synthetic uncertain intent and undelivered evidence remain explicit",
|
||||
"consistent backup created while serving; overwrite refused",
|
||||
"SIGTERM closes the serving writer without forced kill",
|
||||
"restart preserves immutable content and unresolved submission without retry",
|
||||
"separate restored volume preserves exact content and unresolved state",
|
||||
"incomplete owner configuration exits before serving"
|
||||
],
|
||||
"fixture_only": true,
|
||||
"external_network": "none",
|
||||
"content_snapshot_sha256": "03b6e2621e66abd71c183e35ee2b2942d484c7cb4c8c239cf1fc23432b444486",
|
||||
"native_identity_policy_audit_proven": false,
|
||||
"published": false,
|
||||
"deployed": false,
|
||||
"factory_attempts": 0,
|
||||
"paid_model_calls": 0,
|
||||
"cleanup_complete": true
|
||||
}
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
{
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1",
|
||||
"source_commit": "03f18d8",
|
||||
"scanner": "Trivy 0.74.0",
|
||||
"created_at": "2026-10-04T21:42:00.007515913Z",
|
||||
"high": 0,
|
||||
"critical": 0
|
||||
}
|
||||
|
|
@ -114,3 +114,18 @@ The founder must run Platform's updated attended checklist in their terminal.
|
|||
No repeated requester-delivery approval is needed. Native metadata application,
|
||||
ESO delivery, negative checks and cleanup receipts are pending; the broader
|
||||
lifecycle cutover and issuer rotation still require their separate reviewed scope.
|
||||
|
||||
## Native requester accepted for cutover preparation — 2026-10-04
|
||||
|
||||
The founder's amended attended run succeeded. Store Valid, ExternalSecret
|
||||
SecretSynced, no duplicate Secret annotation. Real temporary workloads proved
|
||||
exact identity/policy/TTL, wrong account/namespace/audience and sibling/list
|
||||
refusals, 0440 exact-field projection, signed create-only exchange and excess
|
||||
scope refusals. Reader revoked and post-revoke lookup denied; temporary resources
|
||||
removed. Image 804d89fb contains the required KeyCape Basic-auth fix at 03f18d8.
|
||||
Receipts are in docs/evidence/2026-10-04-lifecycle-release/.
|
||||
|
||||
Production receiving-pod projection remains part of cutover acceptance. The
|
||||
Platform lane explicitly excludes issuer rotation from initial delivery; that
|
||||
separate operation still needs its coordinated changed-file/predecessor proof.
|
||||
No rotation evidence is inferred from the current projection match.
|
||||
|
|
|
|||
|
|
@ -113,7 +113,7 @@ status: wait
|
|||
priority: high
|
||||
blocked_on: message-from:railiance-platform
|
||||
needs_human: true
|
||||
blocking_reason: "Founder-approved ESO binding/mount accepted for source integration; private listener and CA-verified TokenReview runtime composed and tested; native custody proof and separate live go remain"
|
||||
blocking_reason: "Native requester custody/identity/path/scope/projection and revocation proofs passed against candidate 804d89fb; actual receiving service mount and separate rollout go remain"
|
||||
state_hub_task_id: "3b0f536c-e8ee-5493-b663-2f60f5f429ad"
|
||||
decision_id: "0d6792b6-59e4-4fa0-887a-c4e51ea8e131"
|
||||
```
|
||||
|
|
@ -167,7 +167,7 @@ id: INFD-WP-0005-T08
|
|||
status: wait
|
||||
priority: medium
|
||||
blocked_on: message-from:state-hub
|
||||
blocking_reason: "STATE-WP-0096 implements private queue/runtime and projected audience proposals; native forwarding acceptance waits on requester custody and approved rollout"
|
||||
blocking_reason: "STATE-WP-0096 implements private queue/runtime and projected audience proposals; native forwarding acceptance waits on approved service/worker rollout; requester custody proofs now pass"
|
||||
state_hub_task_id: "ce2b36b4-ef82-53b7-aee7-e0063855370b"
|
||||
```
|
||||
|
||||
|
|
@ -282,3 +282,9 @@ following one native approval create, restart, replay receipt, human acceptance
|
|||
and Audit Core delivery. 663 service tests pass (1 skipped), including this path;
|
||||
28 State Hub dispatch/contract/notification tests pass. T08 remains waiting only
|
||||
for approved native delivery/acceptance, not implementation of its runtime.
|
||||
|
||||
Native requester verification passed after KeyCape Basic-auth alignment at
|
||||
03f18d8. Candidate 804d89fb passes 664 tests/1 skipped, 13 container checks and
|
||||
zero HIGH/CRITICAL scan. T05 waits only on actual receiving-pod/cutover acceptance;
|
||||
no further requester metadata approval is pending. Production snapshot migration
|
||||
was proven offline without changing live schema or approval state.
|
||||
|
|
|
|||
|
|
@ -306,3 +306,18 @@ e84b68d, consistent with existing ESO readers. Fourteen helper tests pass.
|
|||
Founder approved the exact two self-token permissions; Platform bbb016f records
|
||||
the amended approval. Fresh attended execution is pending. Native delivery is
|
||||
not ready and the lifecycle service has not been rolled out.
|
||||
|
||||
## Native custody and production-data restore ready — 2026-10-04
|
||||
|
||||
Amended attended metadata and all native requester proofs passed. KeyCape
|
||||
requires Basic client authentication; fixed requester at 03f18d8 with regression
|
||||
coverage for special-character encoding. Final image 804d89fb passes 664 tests/
|
||||
one skipped, 13 container checks, zero HIGH/CRITICAL scan and server dry-run.
|
||||
Production online snapshot restore into a separate offline volume migrated
|
||||
schema 2 to 5 preserving 24 submissions/158 delivered outbox rows. Protected
|
||||
off-cluster snapshot retained; refresh during cutover. Proof resources removed.
|
||||
|
||||
Requester metadata approval is complete. T07 still awaits exact service/PDP/
|
||||
worker cutover approval and subsequent native agent-human-agent acceptance.
|
||||
Issuer rotation is separately governed under Platform's lane contract and was
|
||||
not performed or claimed by the initial delivery proof.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue