From 83fd105465a630d84ec562e3c61253ea733d3d64 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 1 Nov 2026 14:40:35 +0100 Subject: [PATCH] INFD-WP-0010-T02: record the founder-run present-existing release (2026-11-01) The founder ran the release: - access-engine compact-sitting v14 (Helm revision 14) first, then Argo 005709a: image ca75f0be, runtime ConfigMap b488b96a0953 - backup ed4469e7, held off-cluster - health and readiness 200; private routes 404 on the public origin - store counts unchanged, and an existing memo loaded under v14 - executor-identity probe 503 approval_unreadable; sso/default probe 403 submitter_unknown T02 stays open until the executor's present-existing memo is accepted at aal2 and consumed (NK-WP-0056 pilot). Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196 --- deploy/lifecycle/README.md | 26 +++++++++ deploy/lifecycle/RELEASE-INFD-WP-0010-T02.md | 4 +- .../release.json | 57 +++++++++++++++++++ ...nt-existing-and-proportionate-decisions.md | 12 ++++ 4 files changed, 98 insertions(+), 1 deletion(-) create mode 100644 docs/evidence/2026-11-01-present-existing-release/release.json diff --git a/deploy/lifecycle/README.md b/deploy/lifecycle/README.md index 3263cfd..f2ba86a 100644 --- a/deploy/lifecycle/README.md +++ b/deploy/lifecycle/README.md @@ -222,3 +222,29 @@ equal to c228583, 13/13 container checks, 0 HIGH/CRITICAL. The runtime ConfigMap Never pair these registries with the old image: it rejects the new row, so all intake would fail. Founder runbook, verification and rollback: [RELEASE-INFD-WP-0010-T02.md](RELEASE-INFD-WP-0010-T02.md). + +## Present-existing release — 2026-11-01 + +Founder-run per [RELEASE-INFD-WP-0010-T02.md](RELEASE-INFD-WP-0010-T02.md), with the net-kingdom coordinator +guiding. + +**Before the rollout.** Preflight counts: schema 5, lifecycle 20 records / 70 events / 0 pending, 472 delivered +outbox rows, 48 confirmed submissions. The server dry-run passed. The diff showed exactly the image, the new +runtime ConfigMap (v14 pin), the registry row, the 8081 peer, and removal of the Argo tracking annotations. The +consistent backup was copied off-cluster to `.private-backups/20261101T132600Z-pre-v14`, sha256 +`ed4469e7f40ae15f19f467d14e22155dfecd25525f31cfd58d6b821687752ab3`. + +**Rollout.** Access-engine compact-sitting v14 went first (Helm revision 14). Then Argo moved to source `005709a`: +image `ca75f0be03af0bd96a66b08d2949bdc2d16365a93ffabcd6593074b565e8f01b`, runtime ConfigMap +`informed-decision-runtime-b488b96a0953`. Sync succeeded and the application is Healthy. + +**Checks after the rollout.** +- `/healthz` and `/readyz` return 200; the private routes return 404 on the public origin. +- The counts are unchanged. +- The founder opened an existing memo, so the v14 pins match. +- Probe as `sso/nk-bind-executor` with a random approval id: `503 approval_unreadable`. +- Probe as `sso/default`: `403 submitter_unknown`. + +**Not yet proven.** The executor's own present-existing memo, the founder's aal2 accept of it, and its +consumption all come in the NK-WP-0056 pilot. Rollback reference: Argo `312ab97` with Helm revision 13. +Evidence: `docs/evidence/2026-11-01-present-existing-release/`. diff --git a/deploy/lifecycle/RELEASE-INFD-WP-0010-T02.md b/deploy/lifecycle/RELEASE-INFD-WP-0010-T02.md index 31bc88d..3d863e2 100644 --- a/deploy/lifecycle/RELEASE-INFD-WP-0010-T02.md +++ b/deploy/lifecycle/RELEASE-INFD-WP-0010-T02.md @@ -1,6 +1,8 @@ # Release runbook: present_existing for nk-bind-executor + compact-sitting v14 (INFD-WP-0010-T02) -Prepared 2026-11-01 by the informed-decision owner agent. **Nothing in this file has been applied.** +Prepared 2026-11-01 by the informed-decision owner agent. **Applied by the founder on 2026-11-01** (RELEASE_SHA +`005709a`, Helm revision 14). Results are in `docs/evidence/2026-11-01-present-existing-release/release.json` and in +the deploy/lifecycle/README.md section "Present-existing release — 2026-11-01". Founder approval (2026-11-01, relayed by the net-kingdom coordinator): release present_existing together with access-engine compact-sitting v14. Every command below is founder-run, with `export KUBECONFIG=$HOME/.kube/config-railiance01`. diff --git a/docs/evidence/2026-11-01-present-existing-release/release.json b/docs/evidence/2026-11-01-present-existing-release/release.json new file mode 100644 index 0000000..76b8e3b --- /dev/null +++ b/docs/evidence/2026-11-01-present-existing-release/release.json @@ -0,0 +1,57 @@ +{ + "phase": "release", + "task": "INFD-WP-0010-T02", + "date": "2026-11-01", + "run_by": "founder (net-kingdom coordinator guiding); observations relayed to the owner agent, which recorded them", + "runbook": "deploy/lifecycle/RELEASE-INFD-WP-0010-T02.md", + "preflight": { + "argo_target_revision_before": "312ab97e876e17341bf16f9e95397e14c2ac2720", + "argo_status_before": "OutOfSync (known orphan ConfigMap informed-decision-runtime-c81577741a09), Healthy", + "image_before": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23", + "service_account_sso_nk_bind_executor": "present", + "inspect": {"schema_version": 5, "lifecycle": {"records": 20, "events": 70, "pending": 0}, + "outbox": {"delivered": 472}, "submissions": {"confirmed": 48}}, + "server_dry_run": "all objects accepted", + "diff": ["image", "new runtime ConfigMap informed-decision-runtime-b488b96a0953 (v14 pin)", + "registry ConfigMap: nk-bind-executor row added", + "informed-decision-review NetworkPolicy: 8081 peer sso + app.kubernetes.io/name=bounded-executor", + "removal of argocd tracking-id annotations only"] + }, + "backup": { + "consistent_snapshot": true, + "off_cluster_copy": ".private-backups/20261101T132600Z-pre-v14/review.sqlite", + "sha256": "ed4469e7f40ae15f19f467d14e22155dfecd25525f31cfd58d6b821687752ab3" + }, + "rollout": { + "order": ["access-engine flex-auth-informed-decision-sitting Helm revision 14 (compact-sitting v14) deployed first", + "Argo informed-decision targetRevision 005709a37228ba9e6d5a658aada0b62bf49649f5, sync Succeeded, Healthy, rollout complete"], + "helm_revision_before": 13, + "helm_revision_after": 14, + "argo_target_revision_after": "005709a37228ba9e6d5a658aada0b62bf49649f5", + "image_after": "forgejo.coulomb.social/coulomb/informed-decision@sha256:ca75f0be03af0bd96a66b08d2949bdc2d16365a93ffabcd6593074b565e8f01b", + "runtime_configmap_after": "informed-decision-runtime-b488b96a0953", + "policy_pin_after": {"package": "informed-decision.compact-sitting", "version": "v14", + "package_digest": "sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde"} + }, + "verification": { + "deployment_image_and_configmap": "ca75f0be... with informed-decision-runtime-b488b96a0953", + "public": {"healthz": 200, "readyz": 200, "v1_memos": 404, "v1_decisions": 404}, + "inspect_after": {"schema_version": 5, "lifecycle": {"records": 20, "events": 70, "pending": 0}, + "outbox": {"delivered": 472}, "submissions": {"confirmed": 48}}, + "v14_pin_match_human": "founder opened an existing memo ('Establish the bounded OpenRouter access role?'); it loaded", + "probe_executor_identity_random_uuid": {"service_account": "sso/nk-bind-executor", "label": "app.kubernetes.io/name=bounded-executor", + "result": "503 approval_unreadable", + "proves": "NetworkPolicy admits the executor label on 8081; TokenReview with audience informed-decision-intake; registry parses (state-hub row loaded); present_existing profile and envelope validation; reservation released"}, + "probe_default_service_account": {"service_account": "sso/default", "result": "403 submitter_unknown"}, + "probe_pods_removed": true, + "approval_read_proven_by_probe": false, + "executor_egress_policy_to_8081": "live (rapp-bounded-executor)" + }, + "not_claimed": [ + "a present-existing memo with a real executor-created approval", + "a founder aal2 accept of such an approval, or its consumption by the executor (T02 done-when; NK-WP-0056 pilot)", + "KeyCape approval:read exercised by this service (the random-UUID probe stops at approval_unreadable)" + ], + "rollback_reference": "Argo 312ab97e876e17341bf16f9e95397e14c2ac2720 + helm rollback flex-auth-informed-decision-sitting 13; schema 5 retained", + "credentials_recorded": false +} diff --git a/workplans/INFD-WP-0010-present-existing-and-proportionate-decisions.md b/workplans/INFD-WP-0010-present-existing-and-proportionate-decisions.md index a7d9b1c..d335a88 100644 --- a/workplans/INFD-WP-0010-present-existing-and-proportionate-decisions.md +++ b/workplans/INFD-WP-0010-present-existing-and-proportionate-decisions.md @@ -120,6 +120,18 @@ waits for the digest from CI. It is pinned in `admission.candidate.json` and `service.candidate.json`. The runtime ConfigMap is unchanged (`…b488b96a0953`). The pin commit is RELEASE_SHA. The release itself is founder-run. +**Released 2026-11-01 (founder-run).** +- access-engine compact-sitting v14 (Helm revision 14) went first, then Argo `005709a`: image `ca75f0be…`, + ConfigMap `…b488b96a0953`. +- The backup is sha256 `ed4469e7…`, held off-cluster. +- healthz and readyz return 200, and the private routes return 404 on the public origin. +- The counts are unchanged (20/70/0, 472, 48), and an existing memo loaded for the founder under v14. +- The executor-identity probe returned 503 `approval_unreadable` (random id); the `sso/default` probe returned 403 + `submitter_unknown`. +- The executor's egress to 8081 is live. + +Evidence: `docs/evidence/2026-11-01-present-existing-release/release.json`. **Still open, per done-when:** the +founder's aal2 accept of an executor-created approval and the executor's consume (NK-WP-0056 pilot). T02 stays `wait`. Then here: the policy pin, a registry row, a release, and a native proof with synthetic BEA content. Optional: for `bounded-execution`, require a packet item whose digest equals `target.admission_digest`, once the admission