From 70dc3b969d428fa3d7304445b814ba1e59ead79f Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 4 Oct 2026 23:50:19 +0200 Subject: [PATCH] Pin native-verified lifecycle image and production restore evidence Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f --- .gitignore | 1 + deploy/lifecycle/README.md | 33 ++++++++++++++--- deploy/lifecycle/admission.candidate.json | 2 +- deploy/lifecycle/service.candidate.json | 2 +- .../2026-10-04-requester-delivery.json | 27 ++++++++++++++ .../infd-requester-proof-wrong-ns.json | 6 ++++ .../infd-requester-proof-wrong-sa.json | 6 ++++ .../infd-requester-proof.json | 20 +++++++++++ .../manifest.json | 10 ++++-- .../production-restore-drill.json | 35 +++++++++++++++++++ .../requester-basic-container.json | 32 +++++++++++++++++ .../requester-basic-scan.json | 8 +++++ docs/requester-workload-owner-review.md | 15 ++++++++ ...FD-WP-0005-frictionless-decision-intake.md | 10 ++++-- ...INFD-WP-0007-decision-lifecycle-service.md | 15 ++++++++ 15 files changed, 211 insertions(+), 11 deletions(-) create mode 100644 docs/evidence/2026-10-04-lifecycle-release/2026-10-04-requester-delivery.json create mode 100644 docs/evidence/2026-10-04-lifecycle-release/infd-requester-proof-wrong-ns.json create mode 100644 docs/evidence/2026-10-04-lifecycle-release/infd-requester-proof-wrong-sa.json create mode 100644 docs/evidence/2026-10-04-lifecycle-release/infd-requester-proof.json create mode 100644 docs/evidence/2026-10-04-lifecycle-release/production-restore-drill.json create mode 100644 docs/evidence/2026-10-04-lifecycle-release/requester-basic-container.json create mode 100644 docs/evidence/2026-10-04-lifecycle-release/requester-basic-scan.json diff --git a/.gitignore b/.gitignore index f397a6b..453d009 100644 --- a/.gitignore +++ b/.gitignore @@ -5,3 +5,4 @@ __pycache__/ .venv/ dist/ build/ +/.private-backups/ diff --git a/deploy/lifecycle/README.md b/deploy/lifecycle/README.md index 63db1fa..bc26a4b 100644 --- a/deploy/lifecycle/README.md +++ b/deploy/lifecycle/README.md @@ -5,7 +5,7 @@ humans and system:serviceaccount:state-hub:state-hub. **Not deployed.** | Artifact | Immutable reference | | --- | --- | -| Service | forgejo.coulomb.social/coulomb/informed-decision@sha256:2768bd1da3e651cc0be2d0f1ae6eea1af4eb057b31ef63ebb03b004c2ed76c3d | +| Service | forgejo.coulomb.social/coulomb/informed-decision@sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1 | | Access Engine | forgejo.coulomb.social/coulomb/flex-auth@sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99 | | Lifecycle package | informed-decision.lifecycle v1, sha256:cee6a79f74e81d0d389a2c2e2451a92be3434ea9dfcee4986e8c7e6cfdbb1827 | | Human review package | informed-decision.compact-sitting v12, sha256:c5387f7d198dc39ab5967e0c218ce05cc779693565c8875e3035e45ec002a2db | @@ -43,10 +43,12 @@ contract; neither is presented as a newly enforced control. ## Pre-cutover gates -1. RPF-WP-0051 / CCR-2026-0032: complete the already prepared requester delivery - under its separate live go, with exact identity/path negative proofs and - mounted-file refresh/rotation evidence. Only the audit ExternalSecret was - present in the live namespace at inspection. +1. RPF-WP-0051 / CCR-2026-0032 requester delivery is applied: store Valid and + ExternalSecret SecretSynced; native candidate-image identity/path/scope, + projection and reader-revocation proofs pass. Verify the receiving service's + actual mount during cutover. Issuer rotation is a separate governed operation, + excluded from this initial delivery by the Platform lane contract; no rotation + or predecessor-revocation evidence is claimed here. 2. INFD-WP-0005-T08 / STATE-WP-0096: the private dispatcher and separate lifecycle/intake token projections are prepared in dispatcher.candidate.json. Deploy after intake prerequisites. Explicit enqueue requires trusted workload @@ -119,3 +121,24 @@ and credential inputs in that test are synthetic. Native acceptance remains open There is no new service-image build for this continuation. The service suite now passes 663 tests (1 skipped); State Hub forwarding/notification tests pass 28. + +## Final requester and restore proof — 2026-10-04 + +Service image 804d89fb (source 03f18d8) supersedes 2768bd1 after native testing +found KeyCape requires client_secret_basic. Credentials are form-encoded before +Basic encoding; requests retain the exact create-only scope and full signature/ +identity verification. The candidate passes 664 tests (one skipped), 13 installed +container checks and a zero HIGH/CRITICAL scan. Its server dry-run passed. + +Actual production snapshot restore was exercised offline in a separate Docker +volume with the candidate. Migration from schema 2 to 5 preserved 24 confirmed +submissions and 158 delivered outbox rows; lifecycle starts empty. The disposable +volume was removed. Original snapshot is retained off-cluster under ignored +.private-backups/20261004-pre-lifecycle (0700 parent, 0600 file), with a copy in +the live PVC's private directory. Refresh the snapshot after closing writes for +cutover; this online drill is not the final maintenance-window backup. + +The requester proof's eight temporary resources were removed. No native approval +was created, consumed or human-bound by these tests. The actual review service +and State Hub dispatcher have not been rolled out. Concrete cutover approval is +the remaining gate for the initial audience and artifacts in this packet. diff --git a/deploy/lifecycle/admission.candidate.json b/deploy/lifecycle/admission.candidate.json index 350a7de..f5565bb 100644 --- a/deploy/lifecycle/admission.candidate.json +++ b/deploy/lifecycle/admission.candidate.json @@ -1,5 +1,5 @@ { - "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:2768bd1da3e651cc0be2d0f1ae6eea1af4eb057b31ef63ebb03b004c2ed76c3d", + "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1", "policy": { "origin": "http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080", "package": "informed-decision.compact-sitting", diff --git a/deploy/lifecycle/service.candidate.json b/deploy/lifecycle/service.candidate.json index fd07dfa..f936428 100644 --- a/deploy/lifecycle/service.candidate.json +++ b/deploy/lifecycle/service.candidate.json @@ -96,7 +96,7 @@ "containers": [ { "name": "informed-decision", - "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:2768bd1da3e651cc0be2d0f1ae6eea1af4eb057b31ef63ebb03b004c2ed76c3d", + "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1", "securityContext": { "allowPrivilegeEscalation": false, "readOnlyRootFilesystem": true, diff --git a/docs/evidence/2026-10-04-lifecycle-release/2026-10-04-requester-delivery.json b/docs/evidence/2026-10-04-lifecycle-release/2026-10-04-requester-delivery.json new file mode 100644 index 0000000..69744ad --- /dev/null +++ b/docs/evidence/2026-10-04-lifecycle-release/2026-10-04-requester-delivery.json @@ -0,0 +1,27 @@ +{ + "at": "2026-10-04T21:48:43.201341+00:00", + "authority": "ADMINISTER @ realm:kubernetes/railiance01", + "activation": "APPROVED", + "ccr": "CCR-2026-0032", + "metadata_helper_exit": 0, + "metadata_phase": "metadata_verified", + "node_ip": "92.205.62.239", + "cpu_requests_millicores": 3445, + "server_dry_run_objects": 5, + "diff_reviewed": true, + "application": "informed-decision-requester", + "manifest_revision": "4332c391ea7f66479f67968222a45be4fc6e2f90", + "sync": "Succeeded", + "automated_sync": false, + "store_ready": true, + "eso_ready": true, + "service_rollout_performed": false, + "credential_values_output": false, + "verification_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1", + "native_proofs_passed": true, + "temporary_proof_objects_removed": true, + "secret_duplicate_annotation_present": false, + "source_fix": "informed-decision 03f18d8: KeyCape requires client_secret_basic", + "service_projection_acceptance_pending": true, + "issuer_rotation_performed": false +} diff --git a/docs/evidence/2026-10-04-lifecycle-release/infd-requester-proof-wrong-ns.json b/docs/evidence/2026-10-04-lifecycle-release/infd-requester-proof-wrong-ns.json new file mode 100644 index 0000000..4974fec --- /dev/null +++ b/docs/evidence/2026-10-04-lifecycle-release/infd-requester-proof-wrong-ns.json @@ -0,0 +1,6 @@ +{ + "complete": true, + "negative_identity": true, + "phase": "wrong_identity_refused", + "wrong_identity_refused": true +} diff --git a/docs/evidence/2026-10-04-lifecycle-release/infd-requester-proof-wrong-sa.json b/docs/evidence/2026-10-04-lifecycle-release/infd-requester-proof-wrong-sa.json new file mode 100644 index 0000000..4974fec --- /dev/null +++ b/docs/evidence/2026-10-04-lifecycle-release/infd-requester-proof-wrong-sa.json @@ -0,0 +1,6 @@ +{ + "complete": true, + "negative_identity": true, + "phase": "wrong_identity_refused", + "wrong_identity_refused": true +} diff --git a/docs/evidence/2026-10-04-lifecycle-release/infd-requester-proof.json b/docs/evidence/2026-10-04-lifecycle-release/infd-requester-proof.json new file mode 100644 index 0000000..cc1f70f --- /dev/null +++ b/docs/evidence/2026-10-04-lifecycle-release/infd-requester-proof.json @@ -0,0 +1,20 @@ +{ + "approval_approve_refused": true, + "approval_consume_refused": true, + "approval_read_refused": true, + "complete": true, + "exact_identity": true, + "exact_path_projection_matches": true, + "exact_policy_and_ttl": true, + "issuer_jwks_request_ok": true, + "issuer_token_request_ok": true, + "negative_identity": false, + "parent_list_refused": true, + "phase": "approval_consume_refused", + "projection_mode": true, + "reader_revoked": true, + "revoked_lookup_refused": true, + "sibling_get_refused": true, + "signed_create_only_exchange": true, + "wrong_audience_refused": true +} diff --git a/docs/evidence/2026-10-04-lifecycle-release/manifest.json b/docs/evidence/2026-10-04-lifecycle-release/manifest.json index eb99bfe..a112704 100644 --- a/docs/evidence/2026-10-04-lifecycle-release/manifest.json +++ b/docs/evidence/2026-10-04-lifecycle-release/manifest.json @@ -7,7 +7,7 @@ "passed": true }, "sha256": { - "deploy/lifecycle/admission.candidate.json": "e3054aebb2338146b912121198eba0232973574b9f045710abc802e524fe43f6", + "deploy/lifecycle/admission.candidate.json": "c725f55e14356b8b22268e268763032b37611a22354f92f535d31085767411de", "deploy/lifecycle/dispatcher.candidate.json": "e64bdaabfc307caf5f65894ce7e37fd66abaaf9328fd35cfd9103e14bbf739c8", "deploy/lifecycle/intake-submitters.json": "58ba5ef87ecfd40bc7f0eaf2beb5e50f0c1f0e47315e79dbfa9e06411a17eba9", "deploy/lifecycle/lifecycle-callers.json": "0b66382a64bdf81ee75d14a70ba3b19290084922a1e0bc8a873af0f039dc7041", @@ -15,7 +15,7 @@ "deploy/lifecycle/registries.candidate.json": "9bad6db5fbc2178d31b04120016a41830c3552fbb9e2517b718f9bbe87cf649e", "deploy/lifecycle/review-groups.json": "1d61d2b82230981130936651a7fc4230e06ecaa51416a8a1be2bb2eb6ec4c353", "deploy/lifecycle/review-policy.candidate.yaml": "1f680eb1184c4a26ae2638b7e0829e5df42237ee09550e7554a3e965edbc8674", - "deploy/lifecycle/service.candidate.json": "bf36ecb0160bf893a60fe059a3baf27a63668e2bb7b9f17c9582d6de8e842545" + "deploy/lifecycle/service.candidate.json": "5b3cfdce9c622fbf6dbf8b2587809248f20ab0551114ff25e6b5a1f81452690f" }, "dispatcher_verification": { "owner_tests_passed": 28, @@ -23,5 +23,11 @@ "cross_service_tests_skipped": 1, "installed_container_checks": 5, "high_critical_findings": 0 + }, + "requester_basic_fix": { + "source_commit": "03f18d8", + "image_digest": "sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1", + "service_tests_passed": 664, + "service_tests_skipped": 1 } } diff --git a/docs/evidence/2026-10-04-lifecycle-release/production-restore-drill.json b/docs/evidence/2026-10-04-lifecycle-release/production-restore-drill.json new file mode 100644 index 0000000..5538469 --- /dev/null +++ b/docs/evidence/2026-10-04-lifecycle-release/production-restore-drill.json @@ -0,0 +1,35 @@ +{ + "backup": { + "schema_version": 2, + "sha256": "b0346c42434cdc375eaa591f4bffeb62b9b2e19bf589a92501c96626142670e6", + "submissions": { + "confirmed": 24 + }, + "outbox": { + "delivered": 158 + }, + "local_file_mode": "0600", + "private_parent_mode": "0700", + "backup_consistent": true, + "integrity_check": true + }, + "restore": { + "schema_version": 5, + "lifecycle": { + "records": 0, + "events": 0, + "pending": 0 + }, + "outbox": { + "delivered": 158 + }, + "submissions": { + "confirmed": 24 + } + }, + "restore_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1", + "separate_volume": true, + "network": "none", + "production_writer_unchanged": true, + "scope": "Online snapshot drill. Refresh backup after closing writes during approved cutover." +} diff --git a/docs/evidence/2026-10-04-lifecycle-release/requester-basic-container.json b/docs/evidence/2026-10-04-lifecycle-release/requester-basic-container.json new file mode 100644 index 0000000..8dad379 --- /dev/null +++ b/docs/evidence/2026-10-04-lifecycle-release/requester-basic-container.json @@ -0,0 +1,32 @@ +{ + "status": "passed", + "image_id": "sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1", + "repo_digests": [ + "forgejo.coulomb.social/coulomb/informed-decision@sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1" + ], + "checks_passed": 13, + "checks": [ + "installed container entrypoint serves with projected configuration", + "non-root read-only runtime has no external network or published port", + "private config/database modes enforced; package installer absent", + "configured review refuses anonymous access and reports audit-unready status", + "private listener refuses anonymous lifecycle access and exposes no browser routes", + "public listener exposes no private workload route", + "a second writer cannot acquire the active evidence volume", + "synthetic uncertain intent and undelivered evidence remain explicit", + "consistent backup created while serving; overwrite refused", + "SIGTERM closes the serving writer without forced kill", + "restart preserves immutable content and unresolved submission without retry", + "separate restored volume preserves exact content and unresolved state", + "incomplete owner configuration exits before serving" + ], + "fixture_only": true, + "external_network": "none", + "content_snapshot_sha256": "03b6e2621e66abd71c183e35ee2b2942d484c7cb4c8c239cf1fc23432b444486", + "native_identity_policy_audit_proven": false, + "published": false, + "deployed": false, + "factory_attempts": 0, + "paid_model_calls": 0, + "cleanup_complete": true +} diff --git a/docs/evidence/2026-10-04-lifecycle-release/requester-basic-scan.json b/docs/evidence/2026-10-04-lifecycle-release/requester-basic-scan.json new file mode 100644 index 0000000..de0ba4e --- /dev/null +++ b/docs/evidence/2026-10-04-lifecycle-release/requester-basic-scan.json @@ -0,0 +1,8 @@ +{ + "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1", + "source_commit": "03f18d8", + "scanner": "Trivy 0.74.0", + "created_at": "2026-10-04T21:42:00.007515913Z", + "high": 0, + "critical": 0 +} diff --git a/docs/requester-workload-owner-review.md b/docs/requester-workload-owner-review.md index 89cd419..90b3ebe 100644 --- a/docs/requester-workload-owner-review.md +++ b/docs/requester-workload-owner-review.md @@ -114,3 +114,18 @@ The founder must run Platform's updated attended checklist in their terminal. No repeated requester-delivery approval is needed. Native metadata application, ESO delivery, negative checks and cleanup receipts are pending; the broader lifecycle cutover and issuer rotation still require their separate reviewed scope. + +## Native requester accepted for cutover preparation — 2026-10-04 + +The founder's amended attended run succeeded. Store Valid, ExternalSecret +SecretSynced, no duplicate Secret annotation. Real temporary workloads proved +exact identity/policy/TTL, wrong account/namespace/audience and sibling/list +refusals, 0440 exact-field projection, signed create-only exchange and excess +scope refusals. Reader revoked and post-revoke lookup denied; temporary resources +removed. Image 804d89fb contains the required KeyCape Basic-auth fix at 03f18d8. +Receipts are in docs/evidence/2026-10-04-lifecycle-release/. + +Production receiving-pod projection remains part of cutover acceptance. The +Platform lane explicitly excludes issuer rotation from initial delivery; that +separate operation still needs its coordinated changed-file/predecessor proof. +No rotation evidence is inferred from the current projection match. diff --git a/workplans/INFD-WP-0005-frictionless-decision-intake.md b/workplans/INFD-WP-0005-frictionless-decision-intake.md index fa23839..3778243 100644 --- a/workplans/INFD-WP-0005-frictionless-decision-intake.md +++ b/workplans/INFD-WP-0005-frictionless-decision-intake.md @@ -113,7 +113,7 @@ status: wait priority: high blocked_on: message-from:railiance-platform needs_human: true -blocking_reason: "Founder-approved ESO binding/mount accepted for source integration; private listener and CA-verified TokenReview runtime composed and tested; native custody proof and separate live go remain" +blocking_reason: "Native requester custody/identity/path/scope/projection and revocation proofs passed against candidate 804d89fb; actual receiving service mount and separate rollout go remain" state_hub_task_id: "3b0f536c-e8ee-5493-b663-2f60f5f429ad" decision_id: "0d6792b6-59e4-4fa0-887a-c4e51ea8e131" ``` @@ -167,7 +167,7 @@ id: INFD-WP-0005-T08 status: wait priority: medium blocked_on: message-from:state-hub -blocking_reason: "STATE-WP-0096 implements private queue/runtime and projected audience proposals; native forwarding acceptance waits on requester custody and approved rollout" +blocking_reason: "STATE-WP-0096 implements private queue/runtime and projected audience proposals; native forwarding acceptance waits on approved service/worker rollout; requester custody proofs now pass" state_hub_task_id: "ce2b36b4-ef82-53b7-aee7-e0063855370b" ``` @@ -282,3 +282,9 @@ following one native approval create, restart, replay receipt, human acceptance and Audit Core delivery. 663 service tests pass (1 skipped), including this path; 28 State Hub dispatch/contract/notification tests pass. T08 remains waiting only for approved native delivery/acceptance, not implementation of its runtime. + +Native requester verification passed after KeyCape Basic-auth alignment at +03f18d8. Candidate 804d89fb passes 664 tests/1 skipped, 13 container checks and +zero HIGH/CRITICAL scan. T05 waits only on actual receiving-pod/cutover acceptance; +no further requester metadata approval is pending. Production snapshot migration +was proven offline without changing live schema or approval state. diff --git a/workplans/INFD-WP-0007-decision-lifecycle-service.md b/workplans/INFD-WP-0007-decision-lifecycle-service.md index 361d6b3..44f1b5a 100644 --- a/workplans/INFD-WP-0007-decision-lifecycle-service.md +++ b/workplans/INFD-WP-0007-decision-lifecycle-service.md @@ -306,3 +306,18 @@ e84b68d, consistent with existing ESO readers. Fourteen helper tests pass. Founder approved the exact two self-token permissions; Platform bbb016f records the amended approval. Fresh attended execution is pending. Native delivery is not ready and the lifecycle service has not been rolled out. + +## Native custody and production-data restore ready — 2026-10-04 + +Amended attended metadata and all native requester proofs passed. KeyCape +requires Basic client authentication; fixed requester at 03f18d8 with regression +coverage for special-character encoding. Final image 804d89fb passes 664 tests/ +one skipped, 13 container checks, zero HIGH/CRITICAL scan and server dry-run. +Production online snapshot restore into a separate offline volume migrated +schema 2 to 5 preserving 24 submissions/158 delivered outbox rows. Protected +off-cluster snapshot retained; refresh during cutover. Proof resources removed. + +Requester metadata approval is complete. T07 still awaits exact service/PDP/ +worker cutover approval and subsequent native agent-human-agent acceptance. +Issuer rotation is separately governed under Platform's lane contract and was +not performed or claimed by the initial delivery proof.