"""One fixed supervised phase; never run this during source preparation.""" import argparse import hashlib import json import os from pathlib import Path import re import selectors import stat import subprocess import sys import time if sys.flags.optimize: raise SystemExit('optimized interpreter refused') PHASES = ('drill-copy-rescue-r1', 'offline-verify', 'cleanup-offline', 'cutover-backup', 'cutover-copy', 'release', 'verify', 'rollback', 'rollback-verify') def require(value, reason): if not value: raise ValueError(reason) def sha(path): digest = hashlib.sha256() with Path(path).open('rb') as stream: for block in iter(lambda: stream.read(1024**2), b''): digest.update(block) return digest.hexdigest() def private(path, directory=False): info = Path(path).lstat() require((stat.S_ISDIR(info.st_mode) if directory else stat.S_ISREG(info.st_mode)) and info.st_uid == os.getuid() and stat.S_IMODE(info.st_mode) == (0o700 if directory else 0o600) and (directory or info.st_nlink == 1), 'private owned custody required') ROOT = Path(__file__).resolve().parent CASE = ROOT.parent OWNER = Path('/home/worsch/informed-decision') CUSTODIAN = Path('/home/worsch/the-custodian') CUSTODY = CUSTODIAN / '.private-backups/20261011-infd-purpose-r1' SOCKET = 'unix:///var/run/docker.sock' IMAGE = 'forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a' VOLUME = 'infd-purpose-r1-restore-20261011' MAX_BYTES = 512 * 1024**2 def run(argv, body=None, timeout=90): return subprocess.run(argv, input=body, text=True, capture_output=True, timeout=timeout) def json_result(result): try: value = json.loads(result.stdout) except (ValueError, TypeError): raise ValueError('safe phase receipt unavailable; outcome uncertain') from None require(result.returncode == 0 and isinstance(value, dict) and value.get('all_checks_pass') is True, 'phase did not verify complete; raw output withheld; no retry') permitted = {'phase', 'all_checks_pass', 'raw_output_withheld', 'native_approval_verified_by_root', 'native_authenticated_grant', 'source_readonly_baseline', 'snapshot_readonly', 'snapshot_sha256', 'snapshot_bytes', 'snapshot_file', 'native_parent_private', 'native_uid', 'pod_name', 'pod_uid', 'live_readonly_schema_integrity_counts', 'live_counts_may_include_concurrent_commits', 'operation_requested', 'source_revision', 'resources', 'prune', 'rollout_verified', 'latest_live_database_retained', 'client_diff_sha256', 'native_rollout_verified', 'current_schema5_database_retained', 'private_copy_verified', 'installed_purpose_checks', 'policy_sha256', 'policy_mode', 'policy_uid', 'health_statuses', 'native_provider_probe', 'recovery_verification'} require(set(value) <= permitted, 'unexpected output fields withheld') from receipt_safety import counts for name in ('source_readonly_baseline', 'snapshot_readonly', 'live_readonly_schema_integrity_counts'): if name in value: counts(value[name]) for name in ('snapshot_sha256', 'client_diff_sha256'): if name in value: require(re.fullmatch(r'[a-f0-9]{64}', value[name]) is not None, 'invalid output digest withheld') if 'snapshot_bytes' in value: require(type(value['snapshot_bytes']) is int and 0 < value['snapshot_bytes'] <= MAX_BYTES, 'invalid output size withheld') if 'snapshot_file' in value: require(value['snapshot_file'] in ('drill.sqlite', 'cutover.sqlite'), 'invalid output file withheld') return value def docker(argv, body=None, timeout=120): return run(['docker', '--config', str(CUSTODY / 'empty-docker-config'), '--host', SOCKET] + argv, body=body, timeout=timeout) def remote(phase, revision, approved, snapshot_identity=None): # Fixed module imported only after main verifies every executor source hash. from native_program import PROGRAM payload = {'snapshot_identity': snapshot_identity, 'phase': phase, 'source_revision': revision, 'approval': approved, 'sealed': json.loads((CASE / 'sealed-live-deployment.json').read_text()), 'dependencies': json.loads((CASE / 'sealed-native-dependencies.json').read_text()), 'candidate': json.loads((CASE / 'candidate-deployment.json').read_text()), 'rollback': json.loads((CASE / 'rollback-deployment.json').read_text()), 'receipt_safety': (ROOT / 'receipt_safety.py').read_text(), 'purpose_checks': (CASE / 'check_installed.py').read_text(), 'readonly': (CASE / 'sqlite_readonly.py').read_text()} script = PROGRAM.replace('__PAYLOAD__', repr(json.dumps(payload))).replace( '__GUARD__', repr((CASE / 'change_guard.py').read_text())) return json_result(run(['ssh', 'railiance01', 'python3 -'], script, timeout=200)) def copy_snapshot(phase, revision, approved, journal): prior = (journal.data['identity']['recovery_anchor']['backup_result'] if phase == 'drill-copy-rescue-r1' else journal.data['phases']['cutover-backup']['result']) metadata = remote(phase, revision, approved, snapshot_identity=prior) for key in ('snapshot_sha256', 'snapshot_bytes', 'snapshot_file', 'snapshot_readonly'): require(metadata[key] == prior[key], 'closed frozen snapshot changed') name = metadata['snapshot_file'] require(name in ('drill.sqlite', 'cutover.sqlite') and 0 < metadata['snapshot_bytes'] <= MAX_BYTES, 'fixed bounded snapshot required') pod = metadata['pod_name'] require(re.fullmatch(r'[a-z0-9]([-a-z0-9]*[a-z0-9])?', pod) is not None, 'fixed owner pod name required') local = CUSTODY / name fd = os.open(local, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600) # Binary snapshot stdout goes only to a private file, never tool/chat/log output. # Snapshot schema/count metadata was validated before opening this destination. with os.fdopen(fd, 'wb') as destination: command = ('kubectl exec -n informed-decision ' + pod + ' -c informed-decision -- cat /data/private/purpose-overlay-r1/' + name) transfer = subprocess.Popen(['ssh', 'railiance01', command], stdout=subprocess.PIPE, stderr=subprocess.DEVNULL) selector = selectors.DefaultSelector() selector.register(transfer.stdout, selectors.EVENT_READ) deadline = time.monotonic() + 150 received = 0 try: while True: remaining = deadline - time.monotonic() require(remaining > 0 and selector.select(remaining), 'private transfer timed out') block = os.read(transfer.stdout.fileno(), 1024**2) if not block: break received += len(block) require(received <= metadata['snapshot_bytes'] and received <= MAX_BYTES, 'private copy exceeds frozen snapshot size') destination.write(block) transfer.wait(timeout=max(1, deadline - time.monotonic())) finally: selector.close() transfer.stdout.close() if transfer.poll() is None: transfer.kill() transfer.wait() destination.flush() os.fsync(destination.fileno()) private(local) require(transfer.returncode == 0 and local.stat().st_size == metadata['snapshot_bytes'] and sha(local) == metadata['snapshot_sha256'], 'private copy incomplete/uncertain; retain, no retry') # Re-read identity/hash after transfer. This is verification, not a write retry. after = remote(phase, revision, approved, snapshot_identity=prior) require(after['pod_uid'] == metadata['pod_uid'] and after['snapshot_sha256'] == metadata['snapshot_sha256'], 'source identity/snapshot changed during transfer') return {**metadata, 'off_cluster_private_copy_verified': True, 'snapshot_contents_output': False} def offline_verify(journal): from receipt_safety import counts snapshot = CUSTODY / 'drill.sqlite' private(snapshot) previous = journal.data['phases']['drill-copy-rescue-r1']['result'] require(sha(snapshot) == previous['snapshot_sha256'], 'protected snapshot bytes changed') identity = docker(['info', '--format', '{{json .Name}}']) require(identity.returncode == 0 and json.loads(identity.stdout) == 'bnt-lap001', 'local offline Docker engine identity changed') listed = docker(['volume', 'ls', '--format', '{{.Name}}']) require(listed.returncode == 0 and VOLUME not in listed.stdout.splitlines(), 'disposable volume absence not verified') nonce = journal.data['phases']['offline-verify']['attempt_id'] labels = {'informed-decision.case': 'infd-purpose-20261011-r1', 'informed-decision.use': 'offline-restore-only', 'informed-decision.attempt': nonce} created = docker(['volume', 'create', '--driver', 'local', '--label', 'informed-decision.case=infd-purpose-20261011-r1', '--label', 'informed-decision.attempt=' + nonce, '--label', 'informed-decision.use=offline-restore-only', VOLUME]) require(created.returncode == 0 and created.stdout.strip() == VOLUME, 'volume creation uncertain; no retry') inspected = docker(['volume', 'inspect', VOLUME]) require(inspected.returncode == 0, 'new volume identity unavailable') volume = json.loads(inspected.stdout) require(len(volume) == 1 and volume[0]['Name'] == VOLUME and volume[0].get('Labels') == labels and volume[0].get('Driver') == 'local' and not volume[0].get('Options') and volume[0].get('Scope') == 'local', 'new isolated volume identity changed') identity = {key: volume[0][key] for key in ('Name', 'Labels', 'Driver', 'Scope', 'CreatedAt')} journal.note('offline-verify', 'created_volume_identity', identity) # One-time UID0/CAP_CHOWN initialization is isolated to the NEW named volume. # No host/live PVC/config/token mount exists; this detail needs packet review. initializer = """import hashlib,os,stat,sys if sys.flags.optimize:raise RuntimeError('optimized interpreter refused') folder='/restore';expected=EXPECTED if os.listdir(folder):raise ValueError('new empty private volume required') os.chmod(folder,0o700) fd=os.open(folder+'/review.sqlite',os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW|os.O_WRONLY,0o600) digest=hashlib.sha256();size=0 with os.fdopen(fd,'wb') as target: while True: block=sys.stdin.buffer.read(1024**2) if not block:break size+=len(block) if size>512*1024**2:raise ValueError('private restore size exceeds bound') target.write(block);digest.update(block) target.flush();os.fsync(target.fileno()) if digest.hexdigest()!=expected:raise ValueError('private copied snapshot differs') os.chown(folder+'/review.sqlite',10001,10001);os.chown(folder,10001,10001) print('{"all_checks_pass":true,"private_copy_verified":true}') """.replace('EXPECTED', repr(previous['snapshot_sha256'])) with snapshot.open('rb') as source: argv = ['docker', '--config', str(CUSTODY / 'empty-docker-config'), '--host', SOCKET, 'run', '--rm', '-i', '--network', 'none', '--read-only', '--cpus', '1', '--memory', '128m', '--user', '0:0', '--cap-drop', 'ALL', '--cap-add', 'CHOWN', '--security-opt', 'no-new-privileges', '--mount', 'type=volume,src=' + VOLUME + ',dst=/restore', '--entrypoint', 'python', IMAGE, '-c', initializer] copied = subprocess.run(argv, stdin=source, text=True, capture_output=True, timeout=150) json_result(copied) options = ['run', '--rm', '-i', '--network', 'none', '--read-only', '--cpus', '1', '--memory', '128m', '--user', '10001:10001', '--cap-drop', 'ALL', '--security-opt', 'no-new-privileges', '--mount', 'type=volume,src=' + VOLUME + ',dst=/restore'] readonly = docker(options + ['--entrypoint', 'python', IMAGE, '-', '--db', '/restore/review.sqlite'], (CASE / 'sqlite_readonly.py').read_text()) require(readonly.returncode == 0, 'offline pre-open schema/integrity gate refused; never open Store') checked = counts(json.loads(readonly.stdout)) require(checked == previous['snapshot_readonly'], 'frozen snapshot/clone readonly counts differ') admin = docker(options + ['--entrypoint', 'informed-decision-admin', IMAGE, 'inspect', '--db', '/restore/review.sqlite']) require(admin.returncode == 0, 'offline admin result uncertain') admin_counts = json.loads(admin.stdout) require(admin_counts == {key: checked[key] for key in ('schema_version', 'lifecycle', 'outbox', 'submissions')}, 'offline admin changed frozen snapshot counters') # Admin Store construction must not silently alter schema/integrity/counters. post = docker(options + ['--entrypoint', 'python', IMAGE, '-', '--db', '/restore/review.sqlite'], (CASE / 'sqlite_readonly.py').read_text()) require(post.returncode == 0, 'offline post-admin readonly integrity gate refused') post_checked = counts(json.loads(post.stdout)) require(post_checked == checked == previous['snapshot_readonly'], 'offline admin altered frozen snapshot proof') private(snapshot) require(sha(snapshot) == previous['snapshot_sha256'], 'original protected snapshot changed during drill') return {'all_checks_pass': True, 'offline_volume': VOLUME, 'offline_readonly': checked, 'offline_post_admin_readonly': post_checked, 'original_snapshot_hash_unchanged': True, 'created_volume_identity': identity, 'admin_counts': admin_counts, 'network': 'none', 'runtime_tokens_or_config_mounted': False, 'service_entrypoint_started': False, 'original_snapshot_retained': True} def cleanup_offline(journal): inspected = docker(['volume', 'inspect', VOLUME]) require(inspected.returncode == 0, 'owned disposable volume identity unverified') value = json.loads(inspected.stdout) expected = journal.data['phases']['offline-verify']['result']['created_volume_identity'] require(len(value) == 1 and {key: value[0].get(key) for key in expected} == expected and not value[0].get('Options'), 'volume ownership/recreation changed') removed = docker(['volume', 'rm', VOLUME]) require(removed.returncode == 0 and removed.stdout.strip() == VOLUME and docker(['volume', 'inspect', VOLUME]).returncode != 0, 'cleanup outcome ambiguous; do not retry') return {'all_checks_pass': True, 'only_disposable_offline_volume_removed': VOLUME, 'native_and_offcluster_original_snapshots_retained': True} def main(): parser = argparse.ArgumentParser(description=__doc__) parser.add_argument('--phase', choices=PHASES, required=True) parser.add_argument('--root-authority-receipt', type=Path, required=True) parser.add_argument('--root-native-outcome', type=Path, required=True) parser.add_argument('--source-revision', required=True) args = parser.parse_args() require(args.root_authority_receipt == Path('/tmp/security-infd-purpose-root-authority.json') and args.root_native_outcome == Path('/tmp/security-infd-purpose-native-outcome-latest.json'), 'fixed supervised receipt paths required') require(re.fullmatch(r'[0-9a-f]{40}', args.source_revision) is not None, 'exact source commit required') # Verify all prepared executor/input bytes before reading authority or dispatching. plan = json.loads((ROOT / 'execution-plan.json').read_text()) require(set(plan['executor_files']) == {'actuator.py', 'authority_journal.py', 'native_program.py', 'receipt_safety.py'}, 'fixed executor sources required') require(set(plan['owner_source_files']) == {'deploy/lifecycle/admission.candidate.json', 'deploy/lifecycle/service.candidate.json', 'deploy/lifecycle/kustomization.yaml', 'deploy/lifecycle/registries.candidate.json'}, 'fixed owner image sources required') for relative, digest in plan['executor_files'].items(): target = ROOT / relative require(not target.is_symlink() and sha(target) == digest, 'executor source bytes changed') for relative, digest in plan['case_files'].items(): require(not Path(relative).is_absolute() and '..' not in Path(relative).parts, 'case source path escaped') target = CASE / relative require(not target.is_symlink() and sha(target) == digest, 'case source bytes changed') for relative, digest in plan['owner_source_files'].items(): target = OWNER / relative require(not target.is_symlink() and sha(target) == digest, 'owner image-only source changed') committed = subprocess.run(['git', '-C', str(OWNER), 'show', args.source_revision + ':' + relative], capture_output=True) require(committed.returncode == 0 and hashlib.sha256(committed.stdout).hexdigest() == digest, 'committed owner render source differs from approved inputs') head = run(['git', '-C', str(OWNER), 'rev-parse', 'HEAD']) require(head.returncode == 0 and head.stdout.strip() == args.source_revision, 'owner source HEAD differs') from authority_journal import Journal, authority, original_anchor private(args.root_authority_receipt) private(args.root_native_outcome) receipt = json.loads(args.root_authority_receipt.read_text()) require(receipt.get('native_outcome_sha256') == sha(args.root_native_outcome), 'native outcome bytes changed') require(receipt.get('executor_plan_sha256') == sha(ROOT / 'execution-plan.json'), 'root verified executor plan differs') approved = authority(receipt, json.loads(args.root_native_outcome.read_text()), sha(CASE / 'memo.json'), args.source_revision, args.phase) parent = CUSTODY.parent private(parent, directory=True) ignored = run(['git', '-C', str(CUSTODIAN), 'check-ignore', '--no-index', str(CUSTODY / 'drill.sqlite')]) require(ignored.returncode == 0, 'offcluster custody is not ignored') require(CUSTODY.exists(), 'original protected custody must already exist') private(CUSTODY, directory=True) capacity = os.statvfs(CUSTODY) require(capacity.f_bavail * capacity.f_frsize >= 2 * MAX_BYTES + 16 * 1024**2, 'independent protected custody headroom insufficient') os.makedirs(CUSTODY / 'empty-docker-config', mode=0o700, exist_ok=True) private(CUSTODY / 'empty-docker-config', directory=True) require(not list((CUSTODY / 'empty-docker-config').iterdir()), 'public Docker read config must stay empty') anchor = original_anchor(CUSTODY, plan['recovery']['original_anchor'], json.loads((CASE / 'original-approved-drill-backup.json').read_text()), plan['recovery']['original_identity']) if args.phase == 'drill-copy-rescue-r1': require(not os.path.lexists(CUSTODY / 'drill.sqlite') and not os.path.lexists(CUSTODY / 'cutover.sqlite'), 'rescue destination must be absent') identity = docker(['info', '--format', '{{json .Name}}']) require(identity.returncode == 0 and json.loads(identity.stdout) == 'bnt-lap001', 'local engine identity changed') listed = docker(['volume', 'ls', '--format', '{{.Name}}']) require(listed.returncode == 0 and VOLUME not in listed.stdout.splitlines(), 'existing restore volume forbids rescue') journal = Journal(CUSTODY, {'proposal': plan['proposal_id'], 'source_revision': args.source_revision, 'memo_sha256': sha(CASE / 'memo.json'), 'plan_sha256': sha(ROOT / 'execution-plan.json'), 'recovery_anchor': anchor}) try: journal.start(args.phase, approved) # fsynced RUNNING before any phase effect. if args.phase in ('drill-copy-rescue-r1', 'cutover-copy'): result = copy_snapshot(args.phase, args.source_revision, approved, journal) elif args.phase == 'offline-verify': result = offline_verify(journal) elif args.phase == 'cleanup-offline': result = cleanup_offline(journal) else: result = remote(args.phase, args.source_revision, approved) require(original_anchor(CUSTODY, plan['recovery']['original_anchor'], json.loads((CASE / 'original-approved-drill-backup.json').read_text()), plan['recovery']['original_identity']) == anchor, 'original failed journal changed during new phase') journal.finish(args.phase, result) print(json.dumps(result)) # Only count/hash/identity receipts, never snapshot bytes. except BaseException as error: safe = {'all_checks_pass': False, 'phase': args.phase, 'failure_class': type(error).__name__, 'failure': 'fixed phase outcome uncertain; original evidence retained; no retry', 'raw_output_withheld': True} if journal.data['phases'].get(args.phase, {}).get('state') == 'RUNNING': journal.finish(args.phase, safe) print(json.dumps(safe)) raise SystemExit(1) from None finally: journal.close() if __name__ == '__main__': try: main() except Exception: raise SystemExit('supervised execution refused before phase; raw output withheld') from None