From 9207a5134f92904f3843c200645ced91f247af72 Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 5 Oct 2026 01:05:54 +0200 Subject: [PATCH] Prepare matching service and policy pins for review discovery Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f --- deploy/lifecycle/README.md | 22 ++ deploy/lifecycle/admission.candidate.json | 6 +- deploy/lifecycle/service.candidate.json | 8 +- .../container.json | 32 +++ .../policy-scan.json | 7 + .../policy-validation.json | 248 ++++++++++++++++++ .../service-scan.json | 7 + 7 files changed, 323 insertions(+), 7 deletions(-) create mode 100644 docs/evidence/2026-10-05-lifecycle-discovery/container.json create mode 100644 docs/evidence/2026-10-05-lifecycle-discovery/policy-scan.json create mode 100644 docs/evidence/2026-10-05-lifecycle-discovery/policy-validation.json create mode 100644 docs/evidence/2026-10-05-lifecycle-discovery/service-scan.json diff --git a/deploy/lifecycle/README.md b/deploy/lifecycle/README.md index 2cd757a..9a3c7cc 100644 --- a/deploy/lifecycle/README.md +++ b/deploy/lifecycle/README.md @@ -188,3 +188,25 @@ annotations supplied by Argo at sync. No direct resource apply is intended. The existing Recreate strategy prevents two writers; allow a short restart. If startup fails, revert the image pin to 804d89fb through Argo (same schema), retaining the current database and all post-backup evidence. + +## Named-recipient discovery release — 2026-10-05 + +Same founder instruction authorizes this INFD-WP-0007 continuation. Service source +da2c5a7, image 7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173; +owner policy source f234d01, image +6c6dc263f4a7f6461e109e133c004c080e8e373acfead8611856c5fb3e44168e. +Compact-sitting v13 digest: +sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873. + +Update the existing owner review Helm release through its values, then sync the +matching service image/config through Argo. During the short pin transition, +review fails closed; no policy fallback is enabled. Existing exact mandates and +fifteen-minute read/act assurance remain. Attribute listing now requires the +named recipient, admitted class/submitter/group and live approval evidence, with +the existing twelve-hour list assurance window. No broader audience is admitted. + +671 tests (one skipped), 32 embedded owner checks, owner regressions and 13 +container checks pass. Both scans have zero HIGH/CRITICAL findings. Fresh +schema-5 backup: 8ac7bbe79de7cdcff5ebc9fa8adc9c49498bf8a3298c8fbc9bd7501be1a379bb. +Rollback, if needed: owner Helm prior revision 12 and Argo source dfcef87 together, +retaining the current schema-5 database. Evidence: docs/evidence/2026-10-05-lifecycle-discovery/. diff --git a/deploy/lifecycle/admission.candidate.json b/deploy/lifecycle/admission.candidate.json index b640b1a..44dee00 100644 --- a/deploy/lifecycle/admission.candidate.json +++ b/deploy/lifecycle/admission.candidate.json @@ -1,10 +1,10 @@ { - "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:79aabf37e3920261189996020f84562c27709937f74632582331712d74c5f289", + "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173", "policy": { "origin": "http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080", "package": "informed-decision.compact-sitting", - "version": "v12", - "package_digest": "sha256:c5387f7d198dc39ab5967e0c218ce05cc779693565c8875e3035e45ec002a2db", + "version": "v13", + "package_digest": "sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873", "pod_name": "flex-auth-informed-decision-sitting" }, "keycape_egress_ips": [ diff --git a/deploy/lifecycle/service.candidate.json b/deploy/lifecycle/service.candidate.json index bda709c..4579c51 100644 --- a/deploy/lifecycle/service.candidate.json +++ b/deploy/lifecycle/service.candidate.json @@ -40,7 +40,7 @@ "apiVersion": "v1", "kind": "ConfigMap", "metadata": { - "name": "informed-decision-runtime-92d01402eb05", + "name": "informed-decision-runtime-c81577741a09", "namespace": "informed-decision", "annotations": { "informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08" @@ -48,7 +48,7 @@ }, "immutable": true, "data": { - "runtime.json": "{\"approval_origin\":\"http://approval-engine.approval-engine.svc.cluster.local:8080\",\"audit\":{\"origin\":\"http://audit-core.audit-core.svc.cluster.local:8080\",\"sender_token_file\":\"/var/run/secrets/informed-decision/audit/token\"},\"evidence_db\":\"/data/private/review.sqlite\",\"intake_attributes\":true,\"intake_delivery\":{\"hub_origin\":\"http://state-hub.state-hub.svc.cluster.local:8000\"},\"lifecycle_delivery\":true,\"lifecycle_policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-lifecycle.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.lifecycle\",\"package_digest\":\"sha256:cee6a79f74e81d0d389a2c2e2451a92be3434ea9dfcee4986e8c7e6cfdbb1827\",\"version\":\"v1\"},\"ordinary_approval_ids\":[\"2ce76d7f-01c3-4b63-8476-8d1230679769\",\"c2af4bcf-15b4-4305-aac1-acc7e4dcb099\",\"dc22666a-d5d7-46bc-9490-ebe9fe09dc38\"],\"policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.compact-sitting\",\"package_digest\":\"sha256:c5387f7d198dc39ab5967e0c218ce05cc779693565c8875e3035e45ec002a2db\",\"version\":\"v12\"},\"schema\":\"informed-decision.review-runtime.v1\",\"workload_api\":{\"intake\":{\"groups_file\":\"/workload-registry/review-groups.json\",\"secret_file\":\"/var/run/secrets/informed-decision/requester/client-secret\",\"submitters_file\":\"/workload-registry/intake-submitters.json\"},\"lifecycle_callers_file\":\"/workload-registry/lifecycle-callers.json\",\"token_review\":{\"ca_file\":\"/var/run/secrets/informed-decision/kubernetes/ca.crt\",\"origin\":\"https://kubernetes.default.svc:443\",\"token_file\":\"/var/run/secrets/informed-decision/kubernetes/token\"}}}" + "runtime.json": "{\"approval_origin\":\"http://approval-engine.approval-engine.svc.cluster.local:8080\",\"audit\":{\"origin\":\"http://audit-core.audit-core.svc.cluster.local:8080\",\"sender_token_file\":\"/var/run/secrets/informed-decision/audit/token\"},\"evidence_db\":\"/data/private/review.sqlite\",\"intake_attributes\":true,\"intake_delivery\":{\"hub_origin\":\"http://state-hub.state-hub.svc.cluster.local:8000\"},\"lifecycle_delivery\":true,\"lifecycle_policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-lifecycle.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.lifecycle\",\"package_digest\":\"sha256:cee6a79f74e81d0d389a2c2e2451a92be3434ea9dfcee4986e8c7e6cfdbb1827\",\"version\":\"v1\"},\"ordinary_approval_ids\":[\"2ce76d7f-01c3-4b63-8476-8d1230679769\",\"c2af4bcf-15b4-4305-aac1-acc7e4dcb099\",\"dc22666a-d5d7-46bc-9490-ebe9fe09dc38\"],\"policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.compact-sitting\",\"package_digest\":\"sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873\",\"version\":\"v13\"},\"schema\":\"informed-decision.review-runtime.v1\",\"workload_api\":{\"intake\":{\"groups_file\":\"/workload-registry/review-groups.json\",\"secret_file\":\"/var/run/secrets/informed-decision/requester/client-secret\",\"submitters_file\":\"/workload-registry/intake-submitters.json\"},\"lifecycle_callers_file\":\"/workload-registry/lifecycle-callers.json\",\"token_review\":{\"ca_file\":\"/var/run/secrets/informed-decision/kubernetes/ca.crt\",\"origin\":\"https://kubernetes.default.svc:443\",\"token_file\":\"/var/run/secrets/informed-decision/kubernetes/token\"}}}" } }, { @@ -96,7 +96,7 @@ "containers": [ { "name": "informed-decision", - "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:79aabf37e3920261189996020f84562c27709937f74632582331712d74c5f289", + "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173", "securityContext": { "allowPrivilegeEscalation": false, "readOnlyRootFilesystem": true, @@ -231,7 +231,7 @@ { "name": "configuration", "configMap": { - "name": "informed-decision-runtime-92d01402eb05", + "name": "informed-decision-runtime-c81577741a09", "defaultMode": 292 } }, diff --git a/docs/evidence/2026-10-05-lifecycle-discovery/container.json b/docs/evidence/2026-10-05-lifecycle-discovery/container.json new file mode 100644 index 0000000..d2ceec9 --- /dev/null +++ b/docs/evidence/2026-10-05-lifecycle-discovery/container.json @@ -0,0 +1,32 @@ +{ + "status": "passed", + "image_id": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173", + "repo_digests": [ + "forgejo.coulomb.social/coulomb/informed-decision@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173" + ], + "checks_passed": 13, + "checks": [ + "installed container entrypoint serves with projected configuration", + "non-root read-only runtime has no external network or published port", + "private config/database modes enforced; package installer absent", + "configured review refuses anonymous access and reports audit-unready status", + "private listener refuses anonymous lifecycle access and exposes no browser routes", + "public listener exposes no private workload route", + "a second writer cannot acquire the active evidence volume", + "synthetic uncertain intent and undelivered evidence remain explicit", + "consistent backup created while serving; overwrite refused", + "SIGTERM closes the serving writer without forced kill", + "restart preserves immutable content and unresolved submission without retry", + "separate restored volume preserves exact content and unresolved state", + "incomplete owner configuration exits before serving" + ], + "fixture_only": true, + "external_network": "none", + "content_snapshot_sha256": "4433b3568e29eaa4773047172960e2018d8f7cbeeadc7e20b6c0d3b274ba6fe2", + "native_identity_policy_audit_proven": false, + "published": false, + "deployed": false, + "factory_attempts": 0, + "paid_model_calls": 0, + "cleanup_complete": true +} diff --git a/docs/evidence/2026-10-05-lifecycle-discovery/policy-scan.json b/docs/evidence/2026-10-05-lifecycle-discovery/policy-scan.json new file mode 100644 index 0000000..bc55e42 --- /dev/null +++ b/docs/evidence/2026-10-05-lifecycle-discovery/policy-scan.json @@ -0,0 +1,7 @@ +{ + "artifact": "forgejo.coulomb.social/coulomb/flex-auth:main-f234d01", + "scanned_at": "2026-10-04T23:03:30.268617808Z", + "scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969", + "high_critical_findings": 0, + "report_sha256": "4317202543ea9bc0469152073bf0e6eeee08f7a9cdce14f5a8b1f9d6c1f7ea7a" +} diff --git a/docs/evidence/2026-10-05-lifecycle-discovery/policy-validation.json b/docs/evidence/2026-10-05-lifecycle-discovery/policy-validation.json new file mode 100644 index 0000000..6cf43e0 --- /dev/null +++ b/docs/evidence/2026-10-05-lifecycle-discovery/policy-validation.json @@ -0,0 +1,248 @@ +{ + "valid": true, + "caring_findings": [ + { + "code": "CARING-POLICY-MISSING-DIMENSION", + "severity": "warning", + "message": "policy package should declare governed canonical roles", + "fields": [ + "caring.canonical_roles" + ] + }, + { + "code": "CARING-POLICY-MISSING-DIMENSION", + "severity": "warning", + "message": "policy package should declare governed organization relations", + "fields": [ + "caring.organization_relations" + ] + }, + { + "code": "CARING-POLICY-MISSING-DIMENSION", + "severity": "warning", + "message": "policy package should declare governed scopes", + "fields": [ + "caring.scopes" + ] + }, + { + "code": "CARING-POLICY-MISSING-DIMENSION", + "severity": "warning", + "message": "policy package should declare governed planes", + "fields": [ + "caring.planes" + ] + }, + { + "code": "CARING-POLICY-MISSING-DIMENSION", + "severity": "warning", + "message": "policy package should declare governed capabilities", + "fields": [ + "caring.capabilities" + ] + }, + { + "code": "CARING-POLICY-MISSING-DIMENSION", + "severity": "warning", + "message": "policy package should declare governed exposure modes", + "fields": [ + "caring.exposure_modes" + ] + }, + { + "code": "CARING-POLICY-MISSING-DIMENSION", + "severity": "warning", + "message": "policy package should declare governed conditions", + "fields": [ + "caring.conditions" + ] + }, + { + "code": "CARING-POLICY-MISSING-DIMENSION", + "severity": "warning", + "message": "policy package should declare governed restrictions", + "fields": [ + "caring.restrictions" + ] + } + ], + "tests": [ + { + "name": "test_allow_does_not_prove_the_pin", + "passed": true + }, + { + "name": "test_approval_id_malformed", + "passed": true + }, + { + "name": "test_attribute_acts_are_eligible_only_when_sets_admit", + "passed": true + }, + { + "name": "test_bad_memo_id_refused", + "passed": true + }, + { + "name": "test_digest_mismatch", + "passed": true + }, + { + "name": "test_exact_pin_mismatch_is_not_rescued", + "passed": true + }, + { + "name": "test_exact_record_ignores_attribute_context", + "passed": true + }, + { + "name": "test_future_mfa_is_identity_refused", + "passed": true + }, + { + "name": "test_human_control_false", + "passed": true + }, + { + "name": "test_initial_release_allows_only_decision_record_class", + "passed": true + }, + { + "name": "test_initial_release_sets", + "passed": true + }, + { + "name": "test_list_admits_recipient_with_twelve_hour_mfa", + "passed": true + }, + { + "name": "test_list_does_not_relax_read_or_accept", + "passed": true + }, + { + "name": "test_list_refuses_other_recipient", + "passed": true + }, + { + "name": "test_list_requires_explicit_recipient", + "passed": true + }, + { + "name": "test_list_retains_approval_and_group_guards", + "passed": true + }, + { + "name": "test_listable_is_exact_union", + "passed": true + }, + { + "name": "test_memo_review_group_is_not_hardcoded", + "passed": true + }, + { + "name": "test_memo_version_refused", + "passed": true + }, + { + "name": "test_requester_mismatch", + "passed": true + }, + { + "name": "test_review_group_must_be_verified", + "passed": true + }, + { + "name": "test_service_subject_is_identity_refused", + "passed": true + }, + { + "name": "test_six_exact_metered_memos_allow_human_review", + "passed": true + }, + { + "name": "test_stale_mfa_on_attribute_branch", + "passed": true + }, + { + "name": "test_t03_records_not_in_act_scope", + "passed": true + }, + { + "name": "test_tool_proof_exact_record_allowed", + "passed": true + }, + { + "name": "test_tool_proof_without_mfa_denied", + "passed": true + }, + { + "name": "test_tool_proof_wrong_digest_denied", + "passed": true + }, + { + "name": "test_tool_proof_wrong_native_id_denied", + "passed": true + }, + { + "name": "test_unknown_class", + "passed": true + }, + { + "name": "test_unknown_request_denied", + "passed": true + }, + { + "name": "test_unknown_submitter", + "passed": true + } + ], + "fixtures": [ + { + "id": "unknown-request-denied", + "passed": true, + "expected": { + "effect": "deny" + }, + "actual": { + "effect": "deny", + "reason": "compact_sitting_scope_or_identity_refused" + } + }, + { + "id": "attribute-non-human-refused", + "passed": true, + "expected": { + "effect": "deny", + "reason": "identity_refused" + }, + "actual": { + "effect": "deny", + "reason": "identity_refused" + } + }, + { + "id": "attribute-stale-mfa", + "passed": true, + "expected": { + "effect": "deny", + "reason": "stale_mfa" + }, + "actual": { + "effect": "deny", + "reason": "stale_mfa" + } + }, + { + "id": "attribute-future-mfa", + "passed": true, + "expected": { + "effect": "deny", + "reason": "identity_refused" + }, + "actual": { + "effect": "deny", + "reason": "identity_refused" + } + } + ] +} diff --git a/docs/evidence/2026-10-05-lifecycle-discovery/service-scan.json b/docs/evidence/2026-10-05-lifecycle-discovery/service-scan.json new file mode 100644 index 0000000..244ee46 --- /dev/null +++ b/docs/evidence/2026-10-05-lifecycle-discovery/service-scan.json @@ -0,0 +1,7 @@ +{ + "artifact": "forgejo.coulomb.social/coulomb/informed-decision:lifecycle-discovery-20261005", + "scanned_at": "2026-10-04T23:04:20.649108134Z", + "scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969", + "high_critical_findings": 0, + "report_sha256": "6e70c3438bab4ed78204cf0d1c238152b07913725f2b8359a6f6b2d81b8786a9" +}