Prepare matching service and policy pins for review discovery
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
This commit is contained in:
parent
da2c5a720f
commit
9207a5134f
7 changed files with 323 additions and 7 deletions
|
|
@ -188,3 +188,25 @@ annotations supplied by Argo at sync. No direct resource apply is intended.
|
|||
The existing Recreate strategy prevents two writers; allow a short restart.
|
||||
If startup fails, revert the image pin to 804d89fb through Argo (same schema),
|
||||
retaining the current database and all post-backup evidence.
|
||||
|
||||
## Named-recipient discovery release — 2026-10-05
|
||||
|
||||
Same founder instruction authorizes this INFD-WP-0007 continuation. Service source
|
||||
da2c5a7, image 7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173;
|
||||
owner policy source f234d01, image
|
||||
6c6dc263f4a7f6461e109e133c004c080e8e373acfead8611856c5fb3e44168e.
|
||||
Compact-sitting v13 digest:
|
||||
sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873.
|
||||
|
||||
Update the existing owner review Helm release through its values, then sync the
|
||||
matching service image/config through Argo. During the short pin transition,
|
||||
review fails closed; no policy fallback is enabled. Existing exact mandates and
|
||||
fifteen-minute read/act assurance remain. Attribute listing now requires the
|
||||
named recipient, admitted class/submitter/group and live approval evidence, with
|
||||
the existing twelve-hour list assurance window. No broader audience is admitted.
|
||||
|
||||
671 tests (one skipped), 32 embedded owner checks, owner regressions and 13
|
||||
container checks pass. Both scans have zero HIGH/CRITICAL findings. Fresh
|
||||
schema-5 backup: 8ac7bbe79de7cdcff5ebc9fa8adc9c49498bf8a3298c8fbc9bd7501be1a379bb.
|
||||
Rollback, if needed: owner Helm prior revision 12 and Argo source dfcef87 together,
|
||||
retaining the current schema-5 database. Evidence: docs/evidence/2026-10-05-lifecycle-discovery/.
|
||||
|
|
|
|||
|
|
@ -1,10 +1,10 @@
|
|||
{
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:79aabf37e3920261189996020f84562c27709937f74632582331712d74c5f289",
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
|
||||
"policy": {
|
||||
"origin": "http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080",
|
||||
"package": "informed-decision.compact-sitting",
|
||||
"version": "v12",
|
||||
"package_digest": "sha256:c5387f7d198dc39ab5967e0c218ce05cc779693565c8875e3035e45ec002a2db",
|
||||
"version": "v13",
|
||||
"package_digest": "sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873",
|
||||
"pod_name": "flex-auth-informed-decision-sitting"
|
||||
},
|
||||
"keycape_egress_ips": [
|
||||
|
|
|
|||
|
|
@ -40,7 +40,7 @@
|
|||
"apiVersion": "v1",
|
||||
"kind": "ConfigMap",
|
||||
"metadata": {
|
||||
"name": "informed-decision-runtime-92d01402eb05",
|
||||
"name": "informed-decision-runtime-c81577741a09",
|
||||
"namespace": "informed-decision",
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
|
||||
|
|
@ -48,7 +48,7 @@
|
|||
},
|
||||
"immutable": true,
|
||||
"data": {
|
||||
"runtime.json": "{\"approval_origin\":\"http://approval-engine.approval-engine.svc.cluster.local:8080\",\"audit\":{\"origin\":\"http://audit-core.audit-core.svc.cluster.local:8080\",\"sender_token_file\":\"/var/run/secrets/informed-decision/audit/token\"},\"evidence_db\":\"/data/private/review.sqlite\",\"intake_attributes\":true,\"intake_delivery\":{\"hub_origin\":\"http://state-hub.state-hub.svc.cluster.local:8000\"},\"lifecycle_delivery\":true,\"lifecycle_policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-lifecycle.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.lifecycle\",\"package_digest\":\"sha256:cee6a79f74e81d0d389a2c2e2451a92be3434ea9dfcee4986e8c7e6cfdbb1827\",\"version\":\"v1\"},\"ordinary_approval_ids\":[\"2ce76d7f-01c3-4b63-8476-8d1230679769\",\"c2af4bcf-15b4-4305-aac1-acc7e4dcb099\",\"dc22666a-d5d7-46bc-9490-ebe9fe09dc38\"],\"policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.compact-sitting\",\"package_digest\":\"sha256:c5387f7d198dc39ab5967e0c218ce05cc779693565c8875e3035e45ec002a2db\",\"version\":\"v12\"},\"schema\":\"informed-decision.review-runtime.v1\",\"workload_api\":{\"intake\":{\"groups_file\":\"/workload-registry/review-groups.json\",\"secret_file\":\"/var/run/secrets/informed-decision/requester/client-secret\",\"submitters_file\":\"/workload-registry/intake-submitters.json\"},\"lifecycle_callers_file\":\"/workload-registry/lifecycle-callers.json\",\"token_review\":{\"ca_file\":\"/var/run/secrets/informed-decision/kubernetes/ca.crt\",\"origin\":\"https://kubernetes.default.svc:443\",\"token_file\":\"/var/run/secrets/informed-decision/kubernetes/token\"}}}"
|
||||
"runtime.json": "{\"approval_origin\":\"http://approval-engine.approval-engine.svc.cluster.local:8080\",\"audit\":{\"origin\":\"http://audit-core.audit-core.svc.cluster.local:8080\",\"sender_token_file\":\"/var/run/secrets/informed-decision/audit/token\"},\"evidence_db\":\"/data/private/review.sqlite\",\"intake_attributes\":true,\"intake_delivery\":{\"hub_origin\":\"http://state-hub.state-hub.svc.cluster.local:8000\"},\"lifecycle_delivery\":true,\"lifecycle_policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-lifecycle.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.lifecycle\",\"package_digest\":\"sha256:cee6a79f74e81d0d389a2c2e2451a92be3434ea9dfcee4986e8c7e6cfdbb1827\",\"version\":\"v1\"},\"ordinary_approval_ids\":[\"2ce76d7f-01c3-4b63-8476-8d1230679769\",\"c2af4bcf-15b4-4305-aac1-acc7e4dcb099\",\"dc22666a-d5d7-46bc-9490-ebe9fe09dc38\"],\"policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.compact-sitting\",\"package_digest\":\"sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873\",\"version\":\"v13\"},\"schema\":\"informed-decision.review-runtime.v1\",\"workload_api\":{\"intake\":{\"groups_file\":\"/workload-registry/review-groups.json\",\"secret_file\":\"/var/run/secrets/informed-decision/requester/client-secret\",\"submitters_file\":\"/workload-registry/intake-submitters.json\"},\"lifecycle_callers_file\":\"/workload-registry/lifecycle-callers.json\",\"token_review\":{\"ca_file\":\"/var/run/secrets/informed-decision/kubernetes/ca.crt\",\"origin\":\"https://kubernetes.default.svc:443\",\"token_file\":\"/var/run/secrets/informed-decision/kubernetes/token\"}}}"
|
||||
}
|
||||
},
|
||||
{
|
||||
|
|
@ -96,7 +96,7 @@
|
|||
"containers": [
|
||||
{
|
||||
"name": "informed-decision",
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:79aabf37e3920261189996020f84562c27709937f74632582331712d74c5f289",
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
|
||||
"securityContext": {
|
||||
"allowPrivilegeEscalation": false,
|
||||
"readOnlyRootFilesystem": true,
|
||||
|
|
@ -231,7 +231,7 @@
|
|||
{
|
||||
"name": "configuration",
|
||||
"configMap": {
|
||||
"name": "informed-decision-runtime-92d01402eb05",
|
||||
"name": "informed-decision-runtime-c81577741a09",
|
||||
"defaultMode": 292
|
||||
}
|
||||
},
|
||||
|
|
|
|||
32
docs/evidence/2026-10-05-lifecycle-discovery/container.json
Normal file
32
docs/evidence/2026-10-05-lifecycle-discovery/container.json
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
{
|
||||
"status": "passed",
|
||||
"image_id": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
|
||||
"repo_digests": [
|
||||
"forgejo.coulomb.social/coulomb/informed-decision@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173"
|
||||
],
|
||||
"checks_passed": 13,
|
||||
"checks": [
|
||||
"installed container entrypoint serves with projected configuration",
|
||||
"non-root read-only runtime has no external network or published port",
|
||||
"private config/database modes enforced; package installer absent",
|
||||
"configured review refuses anonymous access and reports audit-unready status",
|
||||
"private listener refuses anonymous lifecycle access and exposes no browser routes",
|
||||
"public listener exposes no private workload route",
|
||||
"a second writer cannot acquire the active evidence volume",
|
||||
"synthetic uncertain intent and undelivered evidence remain explicit",
|
||||
"consistent backup created while serving; overwrite refused",
|
||||
"SIGTERM closes the serving writer without forced kill",
|
||||
"restart preserves immutable content and unresolved submission without retry",
|
||||
"separate restored volume preserves exact content and unresolved state",
|
||||
"incomplete owner configuration exits before serving"
|
||||
],
|
||||
"fixture_only": true,
|
||||
"external_network": "none",
|
||||
"content_snapshot_sha256": "4433b3568e29eaa4773047172960e2018d8f7cbeeadc7e20b6c0d3b274ba6fe2",
|
||||
"native_identity_policy_audit_proven": false,
|
||||
"published": false,
|
||||
"deployed": false,
|
||||
"factory_attempts": 0,
|
||||
"paid_model_calls": 0,
|
||||
"cleanup_complete": true
|
||||
}
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
{
|
||||
"artifact": "forgejo.coulomb.social/coulomb/flex-auth:main-f234d01",
|
||||
"scanned_at": "2026-10-04T23:03:30.268617808Z",
|
||||
"scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
|
||||
"high_critical_findings": 0,
|
||||
"report_sha256": "4317202543ea9bc0469152073bf0e6eeee08f7a9cdce14f5a8b1f9d6c1f7ea7a"
|
||||
}
|
||||
|
|
@ -0,0 +1,248 @@
|
|||
{
|
||||
"valid": true,
|
||||
"caring_findings": [
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed canonical roles",
|
||||
"fields": [
|
||||
"caring.canonical_roles"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed organization relations",
|
||||
"fields": [
|
||||
"caring.organization_relations"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed scopes",
|
||||
"fields": [
|
||||
"caring.scopes"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed planes",
|
||||
"fields": [
|
||||
"caring.planes"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed capabilities",
|
||||
"fields": [
|
||||
"caring.capabilities"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed exposure modes",
|
||||
"fields": [
|
||||
"caring.exposure_modes"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed conditions",
|
||||
"fields": [
|
||||
"caring.conditions"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed restrictions",
|
||||
"fields": [
|
||||
"caring.restrictions"
|
||||
]
|
||||
}
|
||||
],
|
||||
"tests": [
|
||||
{
|
||||
"name": "test_allow_does_not_prove_the_pin",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_approval_id_malformed",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_attribute_acts_are_eligible_only_when_sets_admit",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_bad_memo_id_refused",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_digest_mismatch",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_exact_pin_mismatch_is_not_rescued",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_exact_record_ignores_attribute_context",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_future_mfa_is_identity_refused",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_human_control_false",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_initial_release_allows_only_decision_record_class",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_initial_release_sets",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_list_admits_recipient_with_twelve_hour_mfa",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_list_does_not_relax_read_or_accept",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_list_refuses_other_recipient",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_list_requires_explicit_recipient",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_list_retains_approval_and_group_guards",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_listable_is_exact_union",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_memo_review_group_is_not_hardcoded",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_memo_version_refused",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_requester_mismatch",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_review_group_must_be_verified",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_service_subject_is_identity_refused",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_six_exact_metered_memos_allow_human_review",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_stale_mfa_on_attribute_branch",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_t03_records_not_in_act_scope",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_tool_proof_exact_record_allowed",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_tool_proof_without_mfa_denied",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_tool_proof_wrong_digest_denied",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_tool_proof_wrong_native_id_denied",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_unknown_class",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_unknown_request_denied",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_unknown_submitter",
|
||||
"passed": true
|
||||
}
|
||||
],
|
||||
"fixtures": [
|
||||
{
|
||||
"id": "unknown-request-denied",
|
||||
"passed": true,
|
||||
"expected": {
|
||||
"effect": "deny"
|
||||
},
|
||||
"actual": {
|
||||
"effect": "deny",
|
||||
"reason": "compact_sitting_scope_or_identity_refused"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "attribute-non-human-refused",
|
||||
"passed": true,
|
||||
"expected": {
|
||||
"effect": "deny",
|
||||
"reason": "identity_refused"
|
||||
},
|
||||
"actual": {
|
||||
"effect": "deny",
|
||||
"reason": "identity_refused"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "attribute-stale-mfa",
|
||||
"passed": true,
|
||||
"expected": {
|
||||
"effect": "deny",
|
||||
"reason": "stale_mfa"
|
||||
},
|
||||
"actual": {
|
||||
"effect": "deny",
|
||||
"reason": "stale_mfa"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "attribute-future-mfa",
|
||||
"passed": true,
|
||||
"expected": {
|
||||
"effect": "deny",
|
||||
"reason": "identity_refused"
|
||||
},
|
||||
"actual": {
|
||||
"effect": "deny",
|
||||
"reason": "identity_refused"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
{
|
||||
"artifact": "forgejo.coulomb.social/coulomb/informed-decision:lifecycle-discovery-20261005",
|
||||
"scanned_at": "2026-10-04T23:04:20.649108134Z",
|
||||
"scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
|
||||
"high_critical_findings": 0,
|
||||
"report_sha256": "6e70c3438bab4ed78204cf0d1c238152b07913725f2b8359a6f6b2d81b8786a9"
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue