Pin native-verified lifecycle image and production restore evidence
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
This commit is contained in:
parent
03f18d8258
commit
70dc3b969d
15 changed files with 211 additions and 11 deletions
|
|
@ -0,0 +1,27 @@
|
|||
{
|
||||
"at": "2026-10-04T21:48:43.201341+00:00",
|
||||
"authority": "ADMINISTER @ realm:kubernetes/railiance01",
|
||||
"activation": "APPROVED",
|
||||
"ccr": "CCR-2026-0032",
|
||||
"metadata_helper_exit": 0,
|
||||
"metadata_phase": "metadata_verified",
|
||||
"node_ip": "92.205.62.239",
|
||||
"cpu_requests_millicores": 3445,
|
||||
"server_dry_run_objects": 5,
|
||||
"diff_reviewed": true,
|
||||
"application": "informed-decision-requester",
|
||||
"manifest_revision": "4332c391ea7f66479f67968222a45be4fc6e2f90",
|
||||
"sync": "Succeeded",
|
||||
"automated_sync": false,
|
||||
"store_ready": true,
|
||||
"eso_ready": true,
|
||||
"service_rollout_performed": false,
|
||||
"credential_values_output": false,
|
||||
"verification_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1",
|
||||
"native_proofs_passed": true,
|
||||
"temporary_proof_objects_removed": true,
|
||||
"secret_duplicate_annotation_present": false,
|
||||
"source_fix": "informed-decision 03f18d8: KeyCape requires client_secret_basic",
|
||||
"service_projection_acceptance_pending": true,
|
||||
"issuer_rotation_performed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
{
|
||||
"complete": true,
|
||||
"negative_identity": true,
|
||||
"phase": "wrong_identity_refused",
|
||||
"wrong_identity_refused": true
|
||||
}
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
{
|
||||
"complete": true,
|
||||
"negative_identity": true,
|
||||
"phase": "wrong_identity_refused",
|
||||
"wrong_identity_refused": true
|
||||
}
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
{
|
||||
"approval_approve_refused": true,
|
||||
"approval_consume_refused": true,
|
||||
"approval_read_refused": true,
|
||||
"complete": true,
|
||||
"exact_identity": true,
|
||||
"exact_path_projection_matches": true,
|
||||
"exact_policy_and_ttl": true,
|
||||
"issuer_jwks_request_ok": true,
|
||||
"issuer_token_request_ok": true,
|
||||
"negative_identity": false,
|
||||
"parent_list_refused": true,
|
||||
"phase": "approval_consume_refused",
|
||||
"projection_mode": true,
|
||||
"reader_revoked": true,
|
||||
"revoked_lookup_refused": true,
|
||||
"sibling_get_refused": true,
|
||||
"signed_create_only_exchange": true,
|
||||
"wrong_audience_refused": true
|
||||
}
|
||||
|
|
@ -7,7 +7,7 @@
|
|||
"passed": true
|
||||
},
|
||||
"sha256": {
|
||||
"deploy/lifecycle/admission.candidate.json": "e3054aebb2338146b912121198eba0232973574b9f045710abc802e524fe43f6",
|
||||
"deploy/lifecycle/admission.candidate.json": "c725f55e14356b8b22268e268763032b37611a22354f92f535d31085767411de",
|
||||
"deploy/lifecycle/dispatcher.candidate.json": "e64bdaabfc307caf5f65894ce7e37fd66abaaf9328fd35cfd9103e14bbf739c8",
|
||||
"deploy/lifecycle/intake-submitters.json": "58ba5ef87ecfd40bc7f0eaf2beb5e50f0c1f0e47315e79dbfa9e06411a17eba9",
|
||||
"deploy/lifecycle/lifecycle-callers.json": "0b66382a64bdf81ee75d14a70ba3b19290084922a1e0bc8a873af0f039dc7041",
|
||||
|
|
@ -15,7 +15,7 @@
|
|||
"deploy/lifecycle/registries.candidate.json": "9bad6db5fbc2178d31b04120016a41830c3552fbb9e2517b718f9bbe87cf649e",
|
||||
"deploy/lifecycle/review-groups.json": "1d61d2b82230981130936651a7fc4230e06ecaa51416a8a1be2bb2eb6ec4c353",
|
||||
"deploy/lifecycle/review-policy.candidate.yaml": "1f680eb1184c4a26ae2638b7e0829e5df42237ee09550e7554a3e965edbc8674",
|
||||
"deploy/lifecycle/service.candidate.json": "bf36ecb0160bf893a60fe059a3baf27a63668e2bb7b9f17c9582d6de8e842545"
|
||||
"deploy/lifecycle/service.candidate.json": "5b3cfdce9c622fbf6dbf8b2587809248f20ab0551114ff25e6b5a1f81452690f"
|
||||
},
|
||||
"dispatcher_verification": {
|
||||
"owner_tests_passed": 28,
|
||||
|
|
@ -23,5 +23,11 @@
|
|||
"cross_service_tests_skipped": 1,
|
||||
"installed_container_checks": 5,
|
||||
"high_critical_findings": 0
|
||||
},
|
||||
"requester_basic_fix": {
|
||||
"source_commit": "03f18d8",
|
||||
"image_digest": "sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1",
|
||||
"service_tests_passed": 664,
|
||||
"service_tests_skipped": 1
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -0,0 +1,35 @@
|
|||
{
|
||||
"backup": {
|
||||
"schema_version": 2,
|
||||
"sha256": "b0346c42434cdc375eaa591f4bffeb62b9b2e19bf589a92501c96626142670e6",
|
||||
"submissions": {
|
||||
"confirmed": 24
|
||||
},
|
||||
"outbox": {
|
||||
"delivered": 158
|
||||
},
|
||||
"local_file_mode": "0600",
|
||||
"private_parent_mode": "0700",
|
||||
"backup_consistent": true,
|
||||
"integrity_check": true
|
||||
},
|
||||
"restore": {
|
||||
"schema_version": 5,
|
||||
"lifecycle": {
|
||||
"records": 0,
|
||||
"events": 0,
|
||||
"pending": 0
|
||||
},
|
||||
"outbox": {
|
||||
"delivered": 158
|
||||
},
|
||||
"submissions": {
|
||||
"confirmed": 24
|
||||
}
|
||||
},
|
||||
"restore_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1",
|
||||
"separate_volume": true,
|
||||
"network": "none",
|
||||
"production_writer_unchanged": true,
|
||||
"scope": "Online snapshot drill. Refresh backup after closing writes during approved cutover."
|
||||
}
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
{
|
||||
"status": "passed",
|
||||
"image_id": "sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1",
|
||||
"repo_digests": [
|
||||
"forgejo.coulomb.social/coulomb/informed-decision@sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1"
|
||||
],
|
||||
"checks_passed": 13,
|
||||
"checks": [
|
||||
"installed container entrypoint serves with projected configuration",
|
||||
"non-root read-only runtime has no external network or published port",
|
||||
"private config/database modes enforced; package installer absent",
|
||||
"configured review refuses anonymous access and reports audit-unready status",
|
||||
"private listener refuses anonymous lifecycle access and exposes no browser routes",
|
||||
"public listener exposes no private workload route",
|
||||
"a second writer cannot acquire the active evidence volume",
|
||||
"synthetic uncertain intent and undelivered evidence remain explicit",
|
||||
"consistent backup created while serving; overwrite refused",
|
||||
"SIGTERM closes the serving writer without forced kill",
|
||||
"restart preserves immutable content and unresolved submission without retry",
|
||||
"separate restored volume preserves exact content and unresolved state",
|
||||
"incomplete owner configuration exits before serving"
|
||||
],
|
||||
"fixture_only": true,
|
||||
"external_network": "none",
|
||||
"content_snapshot_sha256": "03b6e2621e66abd71c183e35ee2b2942d484c7cb4c8c239cf1fc23432b444486",
|
||||
"native_identity_policy_audit_proven": false,
|
||||
"published": false,
|
||||
"deployed": false,
|
||||
"factory_attempts": 0,
|
||||
"paid_model_calls": 0,
|
||||
"cleanup_complete": true
|
||||
}
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
{
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1",
|
||||
"source_commit": "03f18d8",
|
||||
"scanner": "Trivy 0.74.0",
|
||||
"created_at": "2026-10-04T21:42:00.007515913Z",
|
||||
"high": 0,
|
||||
"critical": 0
|
||||
}
|
||||
|
|
@ -114,3 +114,18 @@ The founder must run Platform's updated attended checklist in their terminal.
|
|||
No repeated requester-delivery approval is needed. Native metadata application,
|
||||
ESO delivery, negative checks and cleanup receipts are pending; the broader
|
||||
lifecycle cutover and issuer rotation still require their separate reviewed scope.
|
||||
|
||||
## Native requester accepted for cutover preparation — 2026-10-04
|
||||
|
||||
The founder's amended attended run succeeded. Store Valid, ExternalSecret
|
||||
SecretSynced, no duplicate Secret annotation. Real temporary workloads proved
|
||||
exact identity/policy/TTL, wrong account/namespace/audience and sibling/list
|
||||
refusals, 0440 exact-field projection, signed create-only exchange and excess
|
||||
scope refusals. Reader revoked and post-revoke lookup denied; temporary resources
|
||||
removed. Image 804d89fb contains the required KeyCape Basic-auth fix at 03f18d8.
|
||||
Receipts are in docs/evidence/2026-10-04-lifecycle-release/.
|
||||
|
||||
Production receiving-pod projection remains part of cutover acceptance. The
|
||||
Platform lane explicitly excludes issuer rotation from initial delivery; that
|
||||
separate operation still needs its coordinated changed-file/predecessor proof.
|
||||
No rotation evidence is inferred from the current projection match.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue