coulomb/informed-decision
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Package protected review runtime and prepare deployment admission

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-11 01:21:37 +02:00
parent bb5b607bbd
commit bda9381f07
20 changed files with 3534 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

143
docs/evidence/2026-09-11-container-candidate.json Normal file
View file

@ -0,0 +1,143 @@
{
"schema": "informed-decision.container-candidate.v1",
"observed_at": "2026-09-10T23:15:35.252989+00:00",
"base_commit": "83849b75d44cab3d01d7ea56f6c839aef8e20046",
"contract_sources": {
"approval-engine": "a0a602976eef818f36dde35f76f7f2e589bd051b",
"audit-core": "5c0ad522fb36092aa7ec2e8d72f63a5a91853b5b",
"flex-auth": "88b354377c8e26b162f1234e673072f1c06dcd89",
"railiance-apps": "eff457ef52a29afc7b9beccf38480a9955c5233e"
},
"source_task": "INFD-WP-0001-T08",
"status": "progress",
"image": {
"local_tag": "informed-decision:hfact-20260911",
"local_image_id": "sha256:c882d6c10ce61b29eed06594a0eb01abe5b1adb136a0343101f991c2305701b4",
"wheel_sha256": "00930d4fe7415c93f36ee82735abcbc69ca7cad694e2963b8f0ad8abdac6cb34",
"runtime_files": {
"container.py": "a8e7516ef6a7f110d8ed95493ae3b9492d913cc7a5650b88a519334ba544f9dd",
"presentation.py": "54375ccd8358fac41de220bccadbee09f8b7c8ebbeeafaafd381a7456331da50",
"disposition.py": "5ddd19c2444f8e6c9bb090d04045cf1227a34554e000f07b3f677325bf8089f8",
"records.py": "82f696151895c51b168144a3078d05764da3499b96917c465629ce0836fa8e33",
"audit.py": "06da36a8f3451b4abc7a46da2df66d5939524c170658b879499b2a47a1b10cd3",
"oidc.py": "35b37bae67968c2179b22af8151afe2981d5468debf4488771eaf3121b75e221",
"__main__.py": "3ba1467fa2d47fcf0bd032e8694904450775adf763a6e6f9e4888cc3ce3ed92b",
"stance.py": "62b96b76eba4ec277344172f10f6233e979dda4d079f972d9a55c4e5aed96c3c",
"policy.py": "7bf814a8332ff054bf5f1f651d8816a408138b1f197b17da0abb7f87411e8812",
"review.py": "c2d2aa1cf48d10d85b3606acf2830ab22701c1274221e5e2760d29901adfd786",
"http_transport.py": "fc9c1fd05cc89120d70bfcdb4c60fe244b81c8054d21505df8cfa9c5a229f7bc",
"approval_client.py": "56c201dda358cb4bef11a15da141bb68562cdde9e37b4a880bf1e9257ae82cb6",
"runtime.py": "6bc6a74657f526743cca6c6cdc0a86fff43d8282e0b867dc9288344636abe5eb",
"provenance.py": "de02c6bf162865ba9619d74cfd68dd0a5d7f81e6c9e427f67f848cb2c2214f83",
"memo.py": "697058863a4e6de2c143a2433eaaf5e15e5e7375dc5459af6911b146567e8b5d",
"canonicalize.py": "517bbc6b81cc839636b97863ebdefd38aa375d10f4915feb9bf21867f992f765",
"evidence.py": "5f84997f66409c7b6cec6ab57e73ad5bba2c1b2d669604adcbf36e72a824a88d",
"__init__.py": "0ffebe048ba583e7b623f60e8f449950dc5fd49afce2398381fa143eee834e19",
"approval_http.py": "203f462ff78f1409f2f924d4723197fdd502087c7f6da319f46ffffce2a9d478",
"web.py": "97f7e040237fa3b755e39d13e628181dc2a3f6a31b4331ca7284bef05f8d6038",
"store.py": "7a58b36d409cb4161b65985545e13573a5196779b4c6e95ca03ce45c6fada808",
"ui.py": "69fb7fc1794c8842f42e7f0f5a261c4cf64176053ef0a532db46ee6566621219"
},
"installed_versions": {
"informed-decision": "0.2.0",
"PyJWT": "2.13.0",
"cryptography": "50.0.1",
"cffi": "2.1.1",
"pycparser": "3.0",
"waitress": "3.0.2"
},
"requirements_lock_sha256": "539072cb7def057c170c065363d365fe7fb7cf540bef04b2a4c9fab8ee05a7db",
"all_22_runtime_files_match_source": true,
"published": false
},
"verification": {
"command": "INFD_APPROVAL_ENGINE_SOURCE=/home/worsch/approval-engine INFD_AUDIT_CORE_SOURCE=/home/worsch/audit-core INFD_FLEX_AUTH_BINARY=<compiled-flex-auth> make check",
"tests_passed": 371,
"tests_failed": 0,
"tests_skipped": 0,
"new_tests": 27,
"schema_json_valid": true,
"container_checks_passed": 11,
"container_receipt": "2026-09-11-container-smoke.json",
"container_network": "none",
"fixture_cleanup_complete": true,
"prior_browser_checks": {
"owner_commit": "83849b75d44cab3d01d7ea56f6c839aef8e20046",
"passed": 12,
"rerun_in_this_increment": false
}
},
"scan": {
"scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
"created_at": "2026-09-10T23:13:55.674183643Z",
"high": 0,
"critical": 0,
"exit_code": 0,
"report": "2026-09-11-container-scan.json",
"warning": "Alpine 3.24 is not on the scanner lifecycle/EOL list; no lifecycle acceptance is inferred."
},
"cluster_schema_check": {
"apply_mode": "dry-run=server",
"candidate_objects": 8,
"exact_namespace_objects_passed": 7,
"refusal": "approval-engine namespace absent; peer ingress cannot be created there yet",
"representative_namespace_schema_check_passed": true,
"representative_change": "metadata namespace/name only for the missing peer rule",
"fixture_policy_pins": true,
"unpublished_image_reference": true,
"cluster_changes_applied": 0,
"schema_only_image_reference": "unpublished pre-shutdown-fix local image 3d2b62f; image bytes are not evaluated by API schema validation"
},
"native_metadata_observations": {
"traefik_namespace": "kube-system",
"traefik_app_label": "traefik",
"websecure_container_port": 8443,
"keycape_public_addresses": [
"92.205.62.239"
],
"storage_class": "local-path",
"storage_provisioner": "rancher.io/local-path"
},
"source_sha256": {
".dockerignore": "fa81d3c056779e8fd5fea58022e42cf9704b16e4d24d75896a2ef2f413f426e8",
".gitignore": "bde5cbd5d9797b283d92cd9c69b12981a2539f4b7fb6d191ab63dd015c4a2cc3",
"Containerfile": "a598563e9b2b4a80fd3c3ac580cf1e63ec44466a893d0068566036487aed20d2",
"Makefile": "15ffb7f2621dacd6145609119994193cd0c7962f01b4e869d4a415200f55e9fa",
"SCOPE.md": "d7e59d6906326846e4bc9ca8300215596fd316b7af9abce55dad67b229b1aa8d",
"deploy/README.md": "5705c1c317834b71087692b2209bbe33b447c5f4ffcbc7b2434cc0b1f87a165b",
"deploy/admission.example.json": "09de47289135c415927d524edf6c20f256a6f10fb467ceebccf08f221e64dfdb",
"docs/evidence/2026-09-11-container-scan.json": "e926951ef4f085542116b8bb9c68c9717688957ad2913b0c94fd141c11f4dd03",
"docs/evidence/2026-09-11-container-smoke.json": "6a71afa39cfd58b1502e300d8a9176905006b0d6bcd4f4989e200dcf371eeb38",
"docs/protected-browser-review.md": "6c9b1323e0eb28553033a9d7c3e5e0f8c2c02350f13ea5e5da1395499baf81c9",
"informed_decision/container.py": "a8e7516ef6a7f110d8ed95493ae3b9492d913cc7a5650b88a519334ba544f9dd",
"informed_decision/web.py": "97f7e040237fa3b755e39d13e628181dc2a3f6a31b4331ca7284bef05f8d6038",
"pyproject.toml": "5ce28585861413c0835699c5e14ac0ae80185fdf342dc1c765f1d9a0d1b6e211",
"requirements.lock": "539072cb7def057c170c065363d365fe7fb7cf540bef04b2a4c9fab8ee05a7db",
"tests/test_container_runtime.py": "475bf316bd9a1a014ccdbdb3267f40f42678d89849dc2e29d8345c27d1fc68e3",
"tests/test_deployment_candidate.py": "296bc1090db5e33e025ccb53d780c0523ab6368278d8cf1778f7df91af13fe50",
"tools/render_deployment.py": "51ea03afeb6c8986dfeb05bd76f4aa7fa8a22e8c6c1e522cc92dcaa6e348e377",
"tools/smoke_container.py": "1385986cbef1d673e7ea3ed57c8d50b5ca34520a298eaf70e1a9af988b210644",
"workplans/INFD-WP-0001-founding-specs-and-approver-ui-ownership.md": "4cc4a953a8e17adacc9d8fc19f1fd2cab441e8e8b47df07d533c2bf2732f25b4"
},
"remaining": [
"native policy package/caller/assignment and exact peer admission",
"AUDIT-WP-0009-T11 custody and protected receiver registration",
"image publication and approved Railiance Apps cutover",
"Approval Engine namespace/service admission and registered human binding",
"native CNI/readiness/audit receipt proof and platform backup/restore operating admission",
"existing T08 broader product acceptance"
],
"native_secret_reads": 0,
"cluster_apply": false,
"factory_attempts": 0,
"paid_model_calls": 0,
"lifecycle_finding": {
"initial_local_image": "sha256:3d2b62f6ce8914b04c4d944d30996331b3c80028a3763da53055cb4b8d71a7c3",
"initial_exit_code": 137,
"corrected_exit_code": 0,
"graceful_stop_window_seconds": 15,
"correction": "explicit PID-1 SIGTERM handler through Waitress and audit-pump shutdown"
},
"integrated_parent_commit": "bb5b607bbd3ae518f3dc101dc6402753564b84ed",
"concurrent_owner_change_preserved": "T07 premise correction; no runtime code changed"
}

2321
docs/evidence/2026-09-11-container-scan.json Normal file
View file

File diff suppressed because it is too large Load diff

30
docs/evidence/2026-09-11-container-smoke.json Normal file
View file

@ -0,0 +1,30 @@
{
"status": "passed",
"image_id": "sha256:c882d6c10ce61b29eed06594a0eb01abe5b1adb136a0343101f991c2305701b4",
"repo_digests": [
"informed-decision@sha256:c882d6c10ce61b29eed06594a0eb01abe5b1adb136a0343101f991c2305701b4"
],
"checks_passed": 11,
"checks": [
"installed container entrypoint serves with projected configuration",
"non-root read-only runtime has no external network or published port",
"private config/database modes enforced; package installer absent",
"configured review refuses anonymous access and reports audit-unready status",
"a second writer cannot acquire the active evidence volume",
"synthetic uncertain intent and undelivered evidence remain explicit",
"consistent backup created while serving; overwrite refused",
"SIGTERM closes the serving writer without forced kill",
"restart preserves immutable content and unresolved submission without retry",
"separate restored volume preserves exact content and unresolved state",
"incomplete owner configuration exits before serving"
],
"fixture_only": true,
"external_network": "none",
"content_snapshot_sha256": "08669bc5e86f292e516045483d9889b05881d0278add97c92a905a58d077d69a",
"native_identity_policy_audit_proven": false,
"published": false,
"deployed": false,
"factory_attempts": 0,
"paid_model_calls": 0,
"cleanup_complete": true
}

4
docs/protected-browser-review.md
View file

@ -108,7 +108,9 @@ needed, so projected rotation does not require storing a token in configuration
or SQLite. Runtime loading provisions nothing. Fixed internal `.svc` origins
are supported explicitly; public cleartext origins and redirects are refused.
The server remains one Waitress process, loopback port 8080, four threads.
Multi-replica sessions/storage and deployment packaging require separate work.
Multi-replica sessions/storage require separate work. Single-writer container
packaging and the review-only deployment packet are now supplied in
[deploy/README.md](../deploy/README.md); publication and native rollout remain open.
The audit thread ticks every 30 seconds, generates the declared per-class
heartbeats, drains at most ten records per tick and writes a private