From c5367a5a5407389d368895854b9e16a0cfd83189 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 11 Sep 2026 14:23:07 +0200 Subject: [PATCH] Record native sender acceptance and retained audit readback gate Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc --- SCOPE.md | 4 +- .../2026-09-11-factory-native-producers.json | 488 ++++++++++++++++++ tools/smoke_container.py | 4 +- ...ounding-specs-and-approver-ui-ownership.md | 12 +- 4 files changed, 502 insertions(+), 6 deletions(-) create mode 100644 docs/evidence/2026-09-11-factory-native-producers.json diff --git a/SCOPE.md b/SCOPE.md index 701ead2..66398d9 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -48,7 +48,9 @@ actual Flex Auth, Approval Engine and Audit Core with synthetic identity/custody The 2026-09-11 fsGroup startup correction handles newly created private directories on Kubernetes volumes; unsafe existing directories still refuse. Its full local suite passes 335 tests with 39 optional checks skipped. The -earlier local image must be rebuilt with this correction before publication. +corrected local image 92cde609 passes 11 container checks, and its source +adapter passes native audit delivery/retry/scope checks. Independent archive +readback, bearer lifecycle and service image scan/publication remain open. Remaining: native policy package/caller/assignment admission, registered human login and deployed binding, independent production audit custody, image diff --git a/docs/evidence/2026-09-11-factory-native-producers.json b/docs/evidence/2026-09-11-factory-native-producers.json new file mode 100644 index 0000000..5625cd7 --- /dev/null +++ b/docs/evidence/2026-09-11-factory-native-producers.json @@ -0,0 +1,488 @@ +{ + "schema": "helixforge.native-audit-producer-return.v1", + "observed_at": "2026-09-11T12:19:49.844051+00:00", + "status": "native_sender_checks_passed_pending_independent_readback", + "platform_execution_commit": "9654f9e8cf039e267f66c61869a073b20a947610", + "native_success": { + "schema": "platform.factory-native-acceptance-receipt.v1", + "status": "native_sender_checks_passed_pending_independent_readback", + "credential_values_emitted": false, + "started_at": "2026-09-11T10:42:09.254002+00:00", + "run_id": "factory-audit-20260911104152-94aced", + "packet_sha256": "5e8a20e29fb309924005a061939c94d8a40815126c44654b6daeb8adf18424c7", + "source_commits": { + "approval-engine": [ + "a0a602976eef818f36dde35f76f7f2e589bd051b", + "approval_engine" + ], + "informed-decision": [ + "1a122235741d61b649e39ab86ddfbd317e54ad2f", + "informed_decision" + ] + }, + "receiver_before": { + "image": "forgejo.coulomb.social/coulomb/audit-core@sha256:c82e0442de0fd181342916ae9cd5d6de41d859e1efda637bd93936c67873afa5", + "deployment_uid": "b85fe3d0-75c9-4e0d-8c34-c6f1df0881bb", + "deployment_resource_version": "59845369", + "pod_uid": "4d0ee4e5-5427-43f1-94ca-88e5470c4831", + "capabilities": { + "load_bearing": true, + "redact": true, + "write_only": true, + "source_exact": true, + "tenant_exact": true + }, + "synthetic_probe_only": true, + "credential_reads": 0 + }, + "phase": "sender_checks_complete", + "operator_registry_reads": 0, + "created_objects": [ + { + "kind": "ConfigMap", + "name": "factory-audit-20260911104152-94aced", + "namespace": "approval-engine", + "uid": "e847feeb-f847-480a-b4d0-cfc63ddeda94" + }, + { + "kind": "NetworkPolicy", + "name": "factory-audit-20260911104152-94aced", + "namespace": "approval-engine", + "uid": "3cfeab0f-9495-4ac3-916e-4f8ffa7a5b10" + }, + { + "kind": "Job", + "name": "factory-audit-20260911104152-94aced", + "namespace": "approval-engine", + "uid": "42a23f42-657b-4077-8935-6b8315711416" + }, + { + "kind": "ConfigMap", + "name": "factory-audit-20260911104152-94aced", + "namespace": "informed-decision", + "uid": "ed443945-66aa-48db-88c6-f176b5c66c70" + }, + { + "kind": "NetworkPolicy", + "name": "factory-audit-20260911104152-94aced", + "namespace": "informed-decision", + "uid": "21bc3c88-5515-4923-b675-f3648f621e4c" + }, + { + "kind": "Job", + "name": "factory-audit-20260911104152-94aced", + "namespace": "informed-decision", + "uid": "8da3c95a-b194-4acd-aad4-2b0ac1004dbd" + } + ], + "producers": [ + { + "credential_values_emitted": false, + "domain_transaction_atomicity_tested": false, + "event_id": "factory-audit-20260911104152-94aced-approval-engine", + "http_statuses": [ + 202, + 200 + ], + "human_binding_tested": false, + "negatives": { + "audit_bearer_revocation_tested": false, + "invalid_bearer_denied": 401, + "own_reconciliation": true, + "probe_count": 1, + "read_routes_denied": 7, + "sibling_reconciliation_denied": true, + "source_denied": 400, + "tenant_denied": 400 + }, + "phase": "restart-retry", + "process_restart_retry": true, + "producer_service_deployed": false, + "run_id": "factory-audit-20260911104152-94aced", + "sender": "approval-engine", + "source_zip_sha256": "114215406400f6f5728520bf3d7dc2b7a4ff410784b80201b7a5ae24259f64c0", + "status": "passed", + "synthetic_outbox_only": true, + "pod_uid": "27517b95-091f-405c-9185-2fad1678097f", + "image": "forgejo.coulomb.social/coulomb/approval-engine@sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49", + "runtime_image_id": "forgejo.coulomb.social/coulomb/approval-engine@sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49" + }, + { + "credential_values_emitted": false, + "domain_transaction_atomicity_tested": false, + "event_id": "factory-audit-20260911104152-94aced-informed-decision", + "http_statuses": [ + 202, + 200 + ], + "human_binding_tested": false, + "negatives": { + "audit_bearer_revocation_tested": false, + "invalid_bearer_denied": 401, + "own_reconciliation": true, + "probe_count": 1, + "read_routes_denied": 7, + "sibling_reconciliation_denied": true, + "source_denied": 400, + "tenant_denied": 400 + }, + "phase": "restart-retry", + "process_restart_retry": true, + "producer_service_deployed": false, + "run_id": "factory-audit-20260911104152-94aced", + "sender": "informed-decision", + "source_zip_sha256": "114215406400f6f5728520bf3d7dc2b7a4ff410784b80201b7a5ae24259f64c0", + "status": "passed", + "synthetic_outbox_only": true, + "pod_uid": "dd2c4175-553a-40af-a656-5cb3db8e45fd", + "image": "forgejo.coulomb.social/coulomb/approval-engine@sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49", + "runtime_image_id": "forgejo.coulomb.social/coulomb/approval-engine@sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49" + } + ], + "cleanup_requested": true, + "completed_at": "2026-09-11T10:42:29.225372+00:00" + }, + "prior_native_attempts": [ + { + "schema": "platform.factory-native-acceptance-receipt.v1", + "status": "refused", + "credential_values_emitted": false, + "started_at": "2026-09-11T10:33:22.819971+00:00", + "run_id": "factory-audit-20260911092835-933db8", + "packet_sha256": "f8c3292ae181df016e658499b2b6719fe9cbe9843532e0f3c8af6e36e844827d", + "source_commits": { + "approval-engine": [ + "a0a602976eef818f36dde35f76f7f2e589bd051b", + "approval_engine" + ], + "informed-decision": [ + "bda9381f070859ae997474cf44b86bf4eea9bb52", + "informed_decision" + ] + }, + "error": "command_failed" + }, + { + "schema": "platform.factory-native-acceptance-receipt.v1", + "status": "refused", + "credential_values_emitted": false, + "started_at": "2026-09-11T10:35:10.524203+00:00", + "run_id": "factory-audit-20260911092835-933db8", + "packet_sha256": "f8c3292ae181df016e658499b2b6719fe9cbe9843532e0f3c8af6e36e844827d", + "source_commits": { + "approval-engine": [ + "a0a602976eef818f36dde35f76f7f2e589bd051b", + "approval_engine" + ], + "informed-decision": [ + "bda9381f070859ae997474cf44b86bf4eea9bb52", + "informed_decision" + ] + }, + "receiver_before": { + "image": "forgejo.coulomb.social/coulomb/audit-core@sha256:c82e0442de0fd181342916ae9cd5d6de41d859e1efda637bd93936c67873afa5", + "deployment_uid": "b85fe3d0-75c9-4e0d-8c34-c6f1df0881bb", + "deployment_resource_version": "59845369", + "pod_uid": "4d0ee4e5-5427-43f1-94ca-88e5470c4831", + "capabilities": { + "load_bearing": true, + "redact": true, + "write_only": true, + "source_exact": true, + "tenant_exact": true + }, + "synthetic_probe_only": true, + "credential_reads": 0 + }, + "phase": "native_jobs", + "operator_registry_reads": 0, + "created_objects": [ + { + "kind": "ConfigMap", + "name": "factory-audit-20260911092835-933db8", + "namespace": "approval-engine", + "uid": "6f377d22-f3a1-48f2-be88-ad38d99512cc" + }, + { + "kind": "NetworkPolicy", + "name": "factory-audit-20260911092835-933db8", + "namespace": "approval-engine", + "uid": "ada01a82-3123-4d38-9da9-c1e2b36832ad" + }, + { + "kind": "Job", + "name": "factory-audit-20260911092835-933db8", + "namespace": "approval-engine", + "uid": "9006f388-1f12-4cd5-a622-41d3ebed7a91" + }, + { + "kind": "ConfigMap", + "name": "factory-audit-20260911092835-933db8", + "namespace": "informed-decision", + "uid": "83801283-ca24-40d4-a11e-346d886229c4" + }, + { + "kind": "NetworkPolicy", + "name": "factory-audit-20260911092835-933db8", + "namespace": "informed-decision", + "uid": "fdcdaecc-f497-455e-9082-cdf4ea3554e2" + }, + { + "kind": "Job", + "name": "factory-audit-20260911092835-933db8", + "namespace": "informed-decision", + "uid": "f485ae88-5022-446e-b968-04842afd25fa" + } + ], + "producers": [ + { + "credential_values_emitted": false, + "domain_transaction_atomicity_tested": false, + "event_id": "factory-audit-20260911092835-933db8-approval-engine", + "http_statuses": [ + 202, + 200 + ], + "human_binding_tested": false, + "negatives": { + "audit_bearer_revocation_tested": false, + "invalid_bearer_denied": 401, + "own_reconciliation": true, + "probe_count": 1, + "read_routes_denied": 7, + "sibling_reconciliation_denied": true, + "source_denied": 400, + "tenant_denied": 400 + }, + "process_restart_retry": true, + "producer_service_deployed": false, + "run_id": "factory-audit-20260911092835-933db8", + "sender": "approval-engine", + "source_zip_sha256": "2c6f8768a11cd5af042ae13ad339f424ec04c0865cb5dda21e40e8c2c16bce8f", + "status": "passed", + "synthetic_outbox_only": true, + "pod_uid": "3ffa8a47-efbc-4e22-9098-09b54a233b59", + "image": "forgejo.coulomb.social/coulomb/approval-engine@sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49", + "runtime_image_id": "forgejo.coulomb.social/coulomb/approval-engine@sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49" + } + ], + "cleanup_requested": true, + "error": "native_probe_job_failed_informed-decision" + }, + { + "schema": "platform.factory-native-acceptance-receipt.v1", + "status": "refused", + "credential_values_emitted": false, + "started_at": "2026-09-11T10:37:54.801484+00:00", + "run_id": "factory-audit-20260911103731-dec2cb", + "packet_sha256": "61c7fd0c4640633be1a2917b8f6e2cceff2fa65516796c4c6b74eb2009435fe3", + "source_commits": { + "approval-engine": [ + "a0a602976eef818f36dde35f76f7f2e589bd051b", + "approval_engine" + ], + "informed-decision": [ + "bda9381f070859ae997474cf44b86bf4eea9bb52", + "informed_decision" + ] + }, + "receiver_before": { + "image": "forgejo.coulomb.social/coulomb/audit-core@sha256:c82e0442de0fd181342916ae9cd5d6de41d859e1efda637bd93936c67873afa5", + "deployment_uid": "b85fe3d0-75c9-4e0d-8c34-c6f1df0881bb", + "deployment_resource_version": "59845369", + "pod_uid": "4d0ee4e5-5427-43f1-94ca-88e5470c4831", + "capabilities": { + "load_bearing": true, + "redact": true, + "write_only": true, + "source_exact": true, + "tenant_exact": true + }, + "synthetic_probe_only": true, + "credential_reads": 0 + }, + "phase": "native_jobs", + "operator_registry_reads": 0, + "created_objects": [ + { + "kind": "ConfigMap", + "name": "factory-audit-20260911103731-dec2cb", + "namespace": "approval-engine", + "uid": "23370eeb-d048-44d1-a6c2-3d04377598ef" + }, + { + "kind": "NetworkPolicy", + "name": "factory-audit-20260911103731-dec2cb", + "namespace": "approval-engine", + "uid": "c3a9926e-0d8a-47e8-98b7-a0164fdf6135" + }, + { + "kind": "Job", + "name": "factory-audit-20260911103731-dec2cb", + "namespace": "approval-engine", + "uid": "3142e57f-58a2-4ad6-8397-71846793830b" + }, + { + "kind": "ConfigMap", + "name": "factory-audit-20260911103731-dec2cb", + "namespace": "informed-decision", + "uid": "b6979ed9-9dfe-47de-ad94-04cd024e698f" + }, + { + "kind": "NetworkPolicy", + "name": "factory-audit-20260911103731-dec2cb", + "namespace": "informed-decision", + "uid": "02c06383-c207-497a-be4c-3e786c9120dd" + }, + { + "kind": "Job", + "name": "factory-audit-20260911103731-dec2cb", + "namespace": "informed-decision", + "uid": "7f6b970c-282f-4b29-b78d-13889e792063" + } + ], + "producers": [ + { + "credential_values_emitted": false, + "domain_transaction_atomicity_tested": false, + "event_id": "factory-audit-20260911103731-dec2cb-approval-engine", + "http_statuses": [ + 202, + 200 + ], + "human_binding_tested": false, + "negatives": { + "audit_bearer_revocation_tested": false, + "invalid_bearer_denied": 401, + "own_reconciliation": true, + "probe_count": 1, + "read_routes_denied": 7, + "sibling_reconciliation_denied": true, + "source_denied": 400, + "tenant_denied": 400 + }, + "phase": "restart-retry", + "process_restart_retry": true, + "producer_service_deployed": false, + "run_id": "factory-audit-20260911103731-dec2cb", + "sender": "approval-engine", + "source_zip_sha256": "2c6f8768a11cd5af042ae13ad339f424ec04c0865cb5dda21e40e8c2c16bce8f", + "status": "passed", + "synthetic_outbox_only": true, + "pod_uid": "c6554313-7e7f-41af-99bd-a4cd0eb30d7f", + "image": "forgejo.coulomb.social/coulomb/approval-engine@sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49", + "runtime_image_id": "forgejo.coulomb.social/coulomb/approval-engine@sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49" + } + ], + "failed_producer": { + "sender": "informed-decision", + "diagnostics": [ + { + "error": "contained_probe_failed", + "phase": "bootstrap", + "observed_http_statuses": [] + } + ] + }, + "cleanup_requested": true, + "error": "native_probe_job_failed_informed-decision" + } + ], + "cleanup": [ + { + "run_id": "factory-audit-20260911092835-933db8", + "all_probe_objects_absent": true + }, + { + "run_id": "factory-audit-20260911103731-dec2cb", + "all_probe_objects_absent": true + }, + { + "run_id": "factory-audit-20260911104152-94aced", + "all_probe_objects_absent": true + } + ], + "receiver_readiness": { + "status": "ok", + "custody_class": "operational", + "durable": true, + "tamper_evidence": false, + "recoverable_days": 30, + "recoverable_source": "resource-control/data/capability/platform-audit-storage.json#provisions[capability=data.backup]", + "recoverable_basis": "measured" + }, + "operator_readback": { + "status": "pending", + "attended_attempts_this_session": 2, + "last_exit_code": 5, + "command_handoff": false, + "receipt_created": false, + "remote_session_revocation": "unconfirmed", + "credential_values_emitted": false + }, + "informed_decision_correction": { + "source_commit": "1a122235741d61b649e39ab86ddfbd317e54ad2f", + "cause": "new private directory inherits setgid on fsGroup volume; exact mode check refused startup", + "before_regression": "1 failed, 15 passed", + "after_suite": { + "passed": 335, + "skipped": 39 + }, + "native_helper_verified": true + }, + "probe_tests": { + "passed": 6, + "real_adapters": true, + "local_receiver": "actual Audit Core SQLite backend", + "volume_setgid_inheritance_tested": true + }, + "informed_decision_container": { + "status": "passed", + "image_id": "sha256:92cde609fca63141740d53594a80a513e250a4d68cdde98b973a9de66403d8c8", + "repo_digests": [ + "informed-decision@sha256:92cde609fca63141740d53594a80a513e250a4d68cdde98b973a9de66403d8c8" + ], + "checks_passed": 11, + "checks": [ + "installed container entrypoint serves with projected configuration", + "non-root read-only runtime has no external network or published port", + "private config/database modes enforced; package installer absent", + "configured review refuses anonymous access and reports audit-unready status", + "a second writer cannot acquire the active evidence volume", + "synthetic uncertain intent and undelivered evidence remain explicit", + "consistent backup created while serving; overwrite refused", + "SIGTERM closes the serving writer without forced kill", + "restart preserves immutable content and unresolved submission without retry", + "separate restored volume preserves exact content and unresolved state", + "incomplete owner configuration exits before serving" + ], + "fixture_only": true, + "external_network": "none", + "content_snapshot_sha256": "33a5e2399ef7602b9137f1a381411b045857a153e18abc65a325137bc1959c05", + "native_identity_policy_audit_proven": false, + "published": false, + "deployed": false, + "factory_attempts": 0, + "paid_model_calls": 0, + "cleanup_complete": true + }, + "claims": { + "synthetic_outbox_recovery": true, + "real_sender_credential_used_inside_own_job": true, + "operator_credentials_read_by_jobs": false, + "independent_readback": false, + "audit_bearer_revocation": false, + "domain_transaction_atomicity": false, + "human_binding": false, + "producer_service_deployment": false, + "factory_attempts": 0, + "paid_model_calls": 0 + }, + "remaining_owner_records": [ + "AUDIT-WP-0009-T09", + "AUDIT-WP-0009-T11", + "RPF-WP-0035-T08", + "INFD-WP-0001-T08", + "HFACT-WP-0001-T03" + ] +} diff --git a/tools/smoke_container.py b/tools/smoke_container.py index ebec156..3a8d2fc 100644 --- a/tools/smoke_container.py +++ b/tools/smoke_container.py @@ -45,9 +45,9 @@ def main(): def volume(suffix): name=prefix+'-'+suffix docker('volume','create','--label','informed-decision.fixture='+prefix,name);volumes.append(name) - docker('run','--rm','--network','none','--read-only','--user','0:0','--cap-drop','ALL','--cap-add','CHOWN', + docker('run','--rm','--network','none','--read-only','--user','0:0','--cap-drop','ALL','--cap-add','CHOWN','--cap-add','FSETID', '--mount','type=volume,src='+name+',dst=/data','--entrypoint','python',args.image,'-c', - "import os; os.chown('/data',0,10001); os.chmod('/data',0o2770)") + "import os,stat; os.chown('/data',0,10001); os.chmod('/data',0o2770); assert stat.S_IMODE(os.stat('/data').st_mode)==0o2770") return name def start(suffix,data,fixture,backup=None): name=prefix+'-'+suffix;containers.append(name) diff --git a/workplans/INFD-WP-0001-founding-specs-and-approver-ui-ownership.md b/workplans/INFD-WP-0001-founding-specs-and-approver-ui-ownership.md index b20b3dd..19aa4c3 100644 --- a/workplans/INFD-WP-0001-founding-specs-and-approver-ui-ownership.md +++ b/workplans/INFD-WP-0001-founding-specs-and-approver-ui-ownership.md @@ -679,9 +679,15 @@ their mode and remain refused. The private evidence contract stays 0700/0600. The new regression failed before the correction and passes after it; existing 2700/2770 directories remain unchanged and refused. The available full suite passes 335 tests, with 39 optional checks skipped in this environment. The native -sender probe will consume this exact helper from pinned source before image -rebuild/publication. The previously built local image is superseded by this -source correction and must not be published as the final service candidate. +sender retry consumed this exact corrected helper and passed ingestion, +restart/duplicate and scope/read refusal checks. The rebuilt local image +`sha256:92cde609fca63141740d53594a80a513e250a4d68cdde98b973a9de66403d8c8` +passes eleven container checks, including verified setgid-volume startup, +restart and restore. The fixture now asserts the volume's actual 2770 mode; +its one-shot volume initializer explicitly retains FSETID for that setup only. +The service container still drops all capabilities. Independent archive +readback, bearer-revocation acceptance, image scan/publication and cutover remain. +Evidence: `docs/evidence/2026-09-11-factory-native-producers.json`. T08 stays progress for native acceptance and the existing deployment/human binding/recovery gates; no service cutover or human disposition occurred.