Prepare matching service and policy pins for review discovery
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
This commit is contained in:
parent
da2c5a720f
commit
9207a5134f
7 changed files with 323 additions and 7 deletions
32
docs/evidence/2026-10-05-lifecycle-discovery/container.json
Normal file
32
docs/evidence/2026-10-05-lifecycle-discovery/container.json
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
{
|
||||
"status": "passed",
|
||||
"image_id": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
|
||||
"repo_digests": [
|
||||
"forgejo.coulomb.social/coulomb/informed-decision@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173"
|
||||
],
|
||||
"checks_passed": 13,
|
||||
"checks": [
|
||||
"installed container entrypoint serves with projected configuration",
|
||||
"non-root read-only runtime has no external network or published port",
|
||||
"private config/database modes enforced; package installer absent",
|
||||
"configured review refuses anonymous access and reports audit-unready status",
|
||||
"private listener refuses anonymous lifecycle access and exposes no browser routes",
|
||||
"public listener exposes no private workload route",
|
||||
"a second writer cannot acquire the active evidence volume",
|
||||
"synthetic uncertain intent and undelivered evidence remain explicit",
|
||||
"consistent backup created while serving; overwrite refused",
|
||||
"SIGTERM closes the serving writer without forced kill",
|
||||
"restart preserves immutable content and unresolved submission without retry",
|
||||
"separate restored volume preserves exact content and unresolved state",
|
||||
"incomplete owner configuration exits before serving"
|
||||
],
|
||||
"fixture_only": true,
|
||||
"external_network": "none",
|
||||
"content_snapshot_sha256": "4433b3568e29eaa4773047172960e2018d8f7cbeeadc7e20b6c0d3b274ba6fe2",
|
||||
"native_identity_policy_audit_proven": false,
|
||||
"published": false,
|
||||
"deployed": false,
|
||||
"factory_attempts": 0,
|
||||
"paid_model_calls": 0,
|
||||
"cleanup_complete": true
|
||||
}
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
{
|
||||
"artifact": "forgejo.coulomb.social/coulomb/flex-auth:main-f234d01",
|
||||
"scanned_at": "2026-10-04T23:03:30.268617808Z",
|
||||
"scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
|
||||
"high_critical_findings": 0,
|
||||
"report_sha256": "4317202543ea9bc0469152073bf0e6eeee08f7a9cdce14f5a8b1f9d6c1f7ea7a"
|
||||
}
|
||||
|
|
@ -0,0 +1,248 @@
|
|||
{
|
||||
"valid": true,
|
||||
"caring_findings": [
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed canonical roles",
|
||||
"fields": [
|
||||
"caring.canonical_roles"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed organization relations",
|
||||
"fields": [
|
||||
"caring.organization_relations"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed scopes",
|
||||
"fields": [
|
||||
"caring.scopes"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed planes",
|
||||
"fields": [
|
||||
"caring.planes"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed capabilities",
|
||||
"fields": [
|
||||
"caring.capabilities"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed exposure modes",
|
||||
"fields": [
|
||||
"caring.exposure_modes"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed conditions",
|
||||
"fields": [
|
||||
"caring.conditions"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed restrictions",
|
||||
"fields": [
|
||||
"caring.restrictions"
|
||||
]
|
||||
}
|
||||
],
|
||||
"tests": [
|
||||
{
|
||||
"name": "test_allow_does_not_prove_the_pin",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_approval_id_malformed",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_attribute_acts_are_eligible_only_when_sets_admit",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_bad_memo_id_refused",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_digest_mismatch",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_exact_pin_mismatch_is_not_rescued",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_exact_record_ignores_attribute_context",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_future_mfa_is_identity_refused",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_human_control_false",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_initial_release_allows_only_decision_record_class",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_initial_release_sets",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_list_admits_recipient_with_twelve_hour_mfa",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_list_does_not_relax_read_or_accept",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_list_refuses_other_recipient",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_list_requires_explicit_recipient",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_list_retains_approval_and_group_guards",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_listable_is_exact_union",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_memo_review_group_is_not_hardcoded",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_memo_version_refused",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_requester_mismatch",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_review_group_must_be_verified",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_service_subject_is_identity_refused",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_six_exact_metered_memos_allow_human_review",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_stale_mfa_on_attribute_branch",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_t03_records_not_in_act_scope",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_tool_proof_exact_record_allowed",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_tool_proof_without_mfa_denied",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_tool_proof_wrong_digest_denied",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_tool_proof_wrong_native_id_denied",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_unknown_class",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_unknown_request_denied",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_unknown_submitter",
|
||||
"passed": true
|
||||
}
|
||||
],
|
||||
"fixtures": [
|
||||
{
|
||||
"id": "unknown-request-denied",
|
||||
"passed": true,
|
||||
"expected": {
|
||||
"effect": "deny"
|
||||
},
|
||||
"actual": {
|
||||
"effect": "deny",
|
||||
"reason": "compact_sitting_scope_or_identity_refused"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "attribute-non-human-refused",
|
||||
"passed": true,
|
||||
"expected": {
|
||||
"effect": "deny",
|
||||
"reason": "identity_refused"
|
||||
},
|
||||
"actual": {
|
||||
"effect": "deny",
|
||||
"reason": "identity_refused"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "attribute-stale-mfa",
|
||||
"passed": true,
|
||||
"expected": {
|
||||
"effect": "deny",
|
||||
"reason": "stale_mfa"
|
||||
},
|
||||
"actual": {
|
||||
"effect": "deny",
|
||||
"reason": "stale_mfa"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "attribute-future-mfa",
|
||||
"passed": true,
|
||||
"expected": {
|
||||
"effect": "deny",
|
||||
"reason": "identity_refused"
|
||||
},
|
||||
"actual": {
|
||||
"effect": "deny",
|
||||
"reason": "identity_refused"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
{
|
||||
"artifact": "forgejo.coulomb.social/coulomb/informed-decision:lifecycle-discovery-20261005",
|
||||
"scanned_at": "2026-10-04T23:04:20.649108134Z",
|
||||
"scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
|
||||
"high_critical_findings": 0,
|
||||
"report_sha256": "6e70c3438bab4ed78204cf0d1c238152b07913725f2b8359a6f6b2d81b8786a9"
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue