INFD-WP-0010-T02: record the founder-run present-existing release (2026-11-01)
The founder ran the release:
- access-engine compact-sitting v14 (Helm revision 14) first, then Argo
005709a: image ca75f0be, runtime ConfigMap b488b96a0953
- backup ed4469e7, held off-cluster
- health and readiness 200; private routes 404 on the public origin
- store counts unchanged, and an existing memo loaded under v14
- executor-identity probe 503 approval_unreadable; sso/default probe 403
submitter_unknown
T02 stays open until the executor's present-existing memo is accepted at aal2 and
consumed (NK-WP-0056 pilot).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
This commit is contained in:
parent
005709a372
commit
83fd105465
4 changed files with 98 additions and 1 deletions
|
|
@ -222,3 +222,29 @@ equal to c228583, 13/13 container checks, 0 HIGH/CRITICAL. The runtime ConfigMap
|
|||
Never pair these registries with the old image: it rejects the new row, so all intake would fail. Founder runbook,
|
||||
verification and rollback:
|
||||
[RELEASE-INFD-WP-0010-T02.md](RELEASE-INFD-WP-0010-T02.md).
|
||||
|
||||
## Present-existing release — 2026-11-01
|
||||
|
||||
Founder-run per [RELEASE-INFD-WP-0010-T02.md](RELEASE-INFD-WP-0010-T02.md), with the net-kingdom coordinator
|
||||
guiding.
|
||||
|
||||
**Before the rollout.** Preflight counts: schema 5, lifecycle 20 records / 70 events / 0 pending, 472 delivered
|
||||
outbox rows, 48 confirmed submissions. The server dry-run passed. The diff showed exactly the image, the new
|
||||
runtime ConfigMap (v14 pin), the registry row, the 8081 peer, and removal of the Argo tracking annotations. The
|
||||
consistent backup was copied off-cluster to `.private-backups/20261101T132600Z-pre-v14`, sha256
|
||||
`ed4469e7f40ae15f19f467d14e22155dfecd25525f31cfd58d6b821687752ab3`.
|
||||
|
||||
**Rollout.** Access-engine compact-sitting v14 went first (Helm revision 14). Then Argo moved to source `005709a`:
|
||||
image `ca75f0be03af0bd96a66b08d2949bdc2d16365a93ffabcd6593074b565e8f01b`, runtime ConfigMap
|
||||
`informed-decision-runtime-b488b96a0953`. Sync succeeded and the application is Healthy.
|
||||
|
||||
**Checks after the rollout.**
|
||||
- `/healthz` and `/readyz` return 200; the private routes return 404 on the public origin.
|
||||
- The counts are unchanged.
|
||||
- The founder opened an existing memo, so the v14 pins match.
|
||||
- Probe as `sso/nk-bind-executor` with a random approval id: `503 approval_unreadable`.
|
||||
- Probe as `sso/default`: `403 submitter_unknown`.
|
||||
|
||||
**Not yet proven.** The executor's own present-existing memo, the founder's aal2 accept of it, and its
|
||||
consumption all come in the NK-WP-0056 pilot. Rollback reference: Argo `312ab97` with Helm revision 13.
|
||||
Evidence: `docs/evidence/2026-11-01-present-existing-release/`.
|
||||
|
|
|
|||
|
|
@ -1,6 +1,8 @@
|
|||
# Release runbook: present_existing for nk-bind-executor + compact-sitting v14 (INFD-WP-0010-T02)
|
||||
|
||||
Prepared 2026-11-01 by the informed-decision owner agent. **Nothing in this file has been applied.**
|
||||
Prepared 2026-11-01 by the informed-decision owner agent. **Applied by the founder on 2026-11-01** (RELEASE_SHA
|
||||
`005709a`, Helm revision 14). Results are in `docs/evidence/2026-11-01-present-existing-release/release.json` and in
|
||||
the deploy/lifecycle/README.md section "Present-existing release — 2026-11-01".
|
||||
Founder approval (2026-11-01, relayed by the net-kingdom coordinator): release present_existing together with
|
||||
access-engine compact-sitting v14. Every command below is founder-run, with
|
||||
`export KUBECONFIG=$HOME/.kube/config-railiance01`.
|
||||
|
|
|
|||
|
|
@ -0,0 +1,57 @@
|
|||
{
|
||||
"phase": "release",
|
||||
"task": "INFD-WP-0010-T02",
|
||||
"date": "2026-11-01",
|
||||
"run_by": "founder (net-kingdom coordinator guiding); observations relayed to the owner agent, which recorded them",
|
||||
"runbook": "deploy/lifecycle/RELEASE-INFD-WP-0010-T02.md",
|
||||
"preflight": {
|
||||
"argo_target_revision_before": "312ab97e876e17341bf16f9e95397e14c2ac2720",
|
||||
"argo_status_before": "OutOfSync (known orphan ConfigMap informed-decision-runtime-c81577741a09), Healthy",
|
||||
"image_before": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"service_account_sso_nk_bind_executor": "present",
|
||||
"inspect": {"schema_version": 5, "lifecycle": {"records": 20, "events": 70, "pending": 0},
|
||||
"outbox": {"delivered": 472}, "submissions": {"confirmed": 48}},
|
||||
"server_dry_run": "all objects accepted",
|
||||
"diff": ["image", "new runtime ConfigMap informed-decision-runtime-b488b96a0953 (v14 pin)",
|
||||
"registry ConfigMap: nk-bind-executor row added",
|
||||
"informed-decision-review NetworkPolicy: 8081 peer sso + app.kubernetes.io/name=bounded-executor",
|
||||
"removal of argocd tracking-id annotations only"]
|
||||
},
|
||||
"backup": {
|
||||
"consistent_snapshot": true,
|
||||
"off_cluster_copy": ".private-backups/20261101T132600Z-pre-v14/review.sqlite",
|
||||
"sha256": "ed4469e7f40ae15f19f467d14e22155dfecd25525f31cfd58d6b821687752ab3"
|
||||
},
|
||||
"rollout": {
|
||||
"order": ["access-engine flex-auth-informed-decision-sitting Helm revision 14 (compact-sitting v14) deployed first",
|
||||
"Argo informed-decision targetRevision 005709a37228ba9e6d5a658aada0b62bf49649f5, sync Succeeded, Healthy, rollout complete"],
|
||||
"helm_revision_before": 13,
|
||||
"helm_revision_after": 14,
|
||||
"argo_target_revision_after": "005709a37228ba9e6d5a658aada0b62bf49649f5",
|
||||
"image_after": "forgejo.coulomb.social/coulomb/informed-decision@sha256:ca75f0be03af0bd96a66b08d2949bdc2d16365a93ffabcd6593074b565e8f01b",
|
||||
"runtime_configmap_after": "informed-decision-runtime-b488b96a0953",
|
||||
"policy_pin_after": {"package": "informed-decision.compact-sitting", "version": "v14",
|
||||
"package_digest": "sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde"}
|
||||
},
|
||||
"verification": {
|
||||
"deployment_image_and_configmap": "ca75f0be... with informed-decision-runtime-b488b96a0953",
|
||||
"public": {"healthz": 200, "readyz": 200, "v1_memos": 404, "v1_decisions": 404},
|
||||
"inspect_after": {"schema_version": 5, "lifecycle": {"records": 20, "events": 70, "pending": 0},
|
||||
"outbox": {"delivered": 472}, "submissions": {"confirmed": 48}},
|
||||
"v14_pin_match_human": "founder opened an existing memo ('Establish the bounded OpenRouter access role?'); it loaded",
|
||||
"probe_executor_identity_random_uuid": {"service_account": "sso/nk-bind-executor", "label": "app.kubernetes.io/name=bounded-executor",
|
||||
"result": "503 approval_unreadable",
|
||||
"proves": "NetworkPolicy admits the executor label on 8081; TokenReview with audience informed-decision-intake; registry parses (state-hub row loaded); present_existing profile and envelope validation; reservation released"},
|
||||
"probe_default_service_account": {"service_account": "sso/default", "result": "403 submitter_unknown"},
|
||||
"probe_pods_removed": true,
|
||||
"approval_read_proven_by_probe": false,
|
||||
"executor_egress_policy_to_8081": "live (rapp-bounded-executor)"
|
||||
},
|
||||
"not_claimed": [
|
||||
"a present-existing memo with a real executor-created approval",
|
||||
"a founder aal2 accept of such an approval, or its consumption by the executor (T02 done-when; NK-WP-0056 pilot)",
|
||||
"KeyCape approval:read exercised by this service (the random-UUID probe stops at approval_unreadable)"
|
||||
],
|
||||
"rollback_reference": "Argo 312ab97e876e17341bf16f9e95397e14c2ac2720 + helm rollback flex-auth-informed-decision-sitting 13; schema 5 retained",
|
||||
"credentials_recorded": false
|
||||
}
|
||||
|
|
@ -120,6 +120,18 @@ waits for the digest from CI.
|
|||
|
||||
It is pinned in `admission.candidate.json` and `service.candidate.json`. The runtime ConfigMap is unchanged
|
||||
(`…b488b96a0953`). The pin commit is RELEASE_SHA. The release itself is founder-run.
|
||||
**Released 2026-11-01 (founder-run).**
|
||||
- access-engine compact-sitting v14 (Helm revision 14) went first, then Argo `005709a`: image `ca75f0be…`,
|
||||
ConfigMap `…b488b96a0953`.
|
||||
- The backup is sha256 `ed4469e7…`, held off-cluster.
|
||||
- healthz and readyz return 200, and the private routes return 404 on the public origin.
|
||||
- The counts are unchanged (20/70/0, 472, 48), and an existing memo loaded for the founder under v14.
|
||||
- The executor-identity probe returned 503 `approval_unreadable` (random id); the `sso/default` probe returned 403
|
||||
`submitter_unknown`.
|
||||
- The executor's egress to 8081 is live.
|
||||
|
||||
Evidence: `docs/evidence/2026-11-01-present-existing-release/release.json`. **Still open, per done-when:** the
|
||||
founder's aal2 accept of an executor-created approval and the executor's consume (NK-WP-0056 pilot). T02 stays `wait`.
|
||||
|
||||
Then here: the policy pin, a registry row, a release, and a native proof with synthetic BEA content. Optional: for
|
||||
`bounded-execution`, require a packet item whose digest equals `target.admission_digest`, once the admission
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue