coulomb/informed-decision
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare purpose image release with bounded custody protocol and owner reviews

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 03:54:35 +02:00
parent cf79c71f0a
commit e0359bcb6c
83 changed files with 22144 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

59
workplans/ADHOC-2026-10-11.md
View file

@ -10,6 +10,7 @@ topic_slug: netkingdom
created: "2026-10-11"
updated: "2026-10-11"
flavor: planning
state_hub_workstream_id: "4594d714-a6ec-5ab6-ad44-4227a27fc7be"
---
## Review exact one-application catalogue facts
@ -18,6 +19,7 @@ flavor: planning
id: INFD-WP-ADHOC-2026-10-11-T01
status: done
priority: medium
state_hub_task_id: "cfe1ec8c-c635-5f23-847c-bf8296965305"
```
Completed informed-decision application-owner source review under INTENT.md
@ -39,3 +41,60 @@ release or human disposition. Existing User Engine native acceptance work
remains with USER-WP-0026-T03 and USER-WP-0028-T02; no new residual work is
created by this bounded review. No tests were needed for this evidence-only
review; no native, credential or login action occurred.
## Independently review purpose overlay release preparation
```task
id: INFD-WP-ADHOC-2026-10-11-T02
status: done
priority: medium
```
Completed same-role informed-decision-owner technical review of frozen36-path
purpose release manifest SHA-256
`7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300`.
All36 staged file hashes and exact source PolicyClient9d7 hash were verified.
Source candidates and captured candidate Deployment differ only in the image.
Actual raw base/candidate scans contain the same one fixable MEDIUM zlib finding;
T05 keeps its2026-10-18 follow-through. Actual published-image receipts and
sealed native read-only preflight support preparation, not native deployment.
Independent owner negatives:50 passed in4.21s, covering10 advisory/malformed
binding forms across register, replay, publish, annotate and revise. Each
refusal preserves every domain table, records a truthful invalid-decision
observation and leaves the same idempotency key reusable after restoring a
canonical enforcement response. These are synthetic source tests only.
Test: tests/test_purpose_owner_mutation_negatives.py.
Receipt: docs/evidence/2026-10-11-purpose-image-release/product-owner-review-validation.json.
Review: docs/reviews/2026-10-11-purpose-release-product-owner-review.md.
This bounded review grants no native backup/export/restore, image rollout,
credentials, login, human disposition or vulnerability acceptance. Existing
INFD-WP-0009-T04/T05 retain release/remediation obligations; no separate residual
is created or claimed completed. Catalogue ACK/T01 remains unchanged.
## Confirm amended purpose release custody and preflight gates
```task
id: INFD-WP-ADHOC-2026-10-11-T03
status: done
priority: medium
```
Same informed-decision-owner reviewed amended78-path release manifest SHA-256
`b1e3e66bc4023dc80c6ea59564c3557c7653fb3c307f46a049997b76198a9033`.
All78 file hashes verified, original36 archive retained, source PolicyClient9d7
and both image-only source candidates unchanged. Prior50 source lifecycle
mutation/idempotency negatives remain applicable and were not repeated.
Confirmed stdlib read-only schema5/integrity/count gate before ANY native or
restored Store/admin open, explicit local/remote optimized-interpreter refusal,
sealed actual ConfigMap/PVC identity/data/custody and frozen offline clone count
equality distinguished from legitimate concurrent live commits. Revised20-doc
184912-byte packet and01:39 read-only dry-run receipts remain preparation.
Native schema gate, backup/export/restore/release and founder disposition remain
unperformed; T04/T05 obligations and temporary vulnerability review persist.
Confirmation: docs/reviews/2026-10-11-purpose-release-amended-product-owner-review.md.
Prior T01 catalogue ACK including hub identifiers and T02 initial36 review/test/
receipt remain unchanged. No new residual or authority is created by this review.

51
workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md
View file

@ -93,7 +93,7 @@ compatibility evidence, prepare a separate scoped image proposal, and verify
native binding/refusal after the owner's approved release. Do not fold an image
change into the config-only T02 proposal. Current runtime 7f5c6cb remains exact.
**Prepared 2026-10-11:** narrow single-module image overlay on immutable running
**Historical local preparation 2026-10-11:** narrow single-module image overlay on immutable running
7f5c6cb; exact source policy SHA-256 9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62.
Local image/index b8b58944786015a5375304241c149d1dab885eb539d6d8945f56b01a3c2bc821
is built and retained, unpublished and undeployed. Base layer prefix and runtime
@ -105,3 +105,52 @@ Remaining gates: source-bound registry publication and exact digest verification
fresh native snapshot/restore compatibility, owner GitOps server dry-run/diff,
separate scoped supervisor approval and native post-release binding/refusal.
No release approval or actual production-data restore is inferred from fixtures.
**Publication and release preparation 2026-10-11:** actual owner CI
task11484/run3 succeeds at source3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168,
publishing immutable image763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a.
The failed run1/f66 and run2/ace are retained as refinements in the same trial.
Anonymous registry readback proves all8base compressed blobs/rootfs unchanged
plus only policy.py; legacy media-type/default-config serialization differences
are explicit. Pulled published artifact UID10001/GID10001, installed mode0644
and exactpolicy hash, all10purpose forms pass. Full pinned scanner/DB covers
44packages: 0HIGH/CRITICAL, 1fixableMEDIUM CVE-2026-85091 in zlib1.3.2-r0,
identical actual current-base scan. This is not a zero-CVE release or estate
risk grade. T05 and INFD-RISK-20261011-ZLIB-85091 are live owner follow-through.
The exact separate20document informed-decision packet is prepared and
offline typed/intake validated, with no submission or founder disposition
claimed. Source candidates differ solely in Deploymentimage and retain
ConfigMap6c221878d051/schema5/PVC/identity/policy pins. Fresh read-only
serverdryrun/clientdiff pass with sealedUID/fullconfiguration and actualCM/PVC
UID/contentchecksum/boundvolume custody; optimizedinterpreters refused.
Independent review refinement requires stdlib mode=ro schema5/integrity/count
checks before any native/offline admin/Store open (native gate notexecuted); existingmanual
Argo remains Healthy/OutOfSync at7db8485, not whole-app reconciled.
Remaining gates: independent owner review, actual founder native approval,
fresh protected native consistent snapshot/off-cluster custody/offline restore,
refresh preflight, exact owner-source pin/Deployment-only manual sync and
verified native installed purpose/refusal/lifecycle behavior. Synthetic native
placement checks are not new provider authorization evidence. Runtime remains7f5c.
Evidence: `docs/evidence/2026-10-11-purpose-image-release/`.
## Resolve inherited published-image zlib finding
```task
id: INFD-WP-0009-T05
status: todo
priority: medium
```
Owner follow-through `INFD-RISK-20261011-ZLIB-85091` tracks actual published
base and purpose-overlay scan finding CVE-2026-85091: zlib 1.3.2-r0, fixed
1.3.2-r1, scanner MEDIUM; this is not an estate risk grade. Prepare and verify a
separate source-bound base/dependency refresh, then obtain distinct native
release approval before changing the workload. Review due 2026-10-18; the date
is a manual owner follow-up, with no automatic expiry/rollback controller.
T04 cannot be treated as a zero-CVE release or silently include the base fix.
Preserve the original detection, pending founder disposition and remediation
evidence. Close only after actual installed-package proof and full rescan.
Evidence: `docs/evidence/2026-10-11-purpose-image-release/inherited-vulnerability-follow-through.json`.