tegwick
3e4bcb26f8
All checks were successful
Publish exact advisory-purpose overlay candidate / publish-candidate (push) Successful in 8s
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade |
||
|---|---|---|
| .. | ||
| native-backup-restore-protocol.md | ||
| publication-run-1-failure-and-mode-refinement.json | ||
| publication-run-2-failure-and-legacy-refinement.json | ||
| README.md | ||
| validation.json | ||
INFD-WP0009-T04 source publication preparation
Stable trial/proposal: INFD-WP-0009-T04/purpose-overlay-v1. Source correction is committed1e0df2f; exact policy.py SHA9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62. The earlier b8b589 local overlay and its13 synthetic container/10 purpose checks remain historical; no registry/native result is backfilled into that receipt. New publication retains the exact7f5c6cb running base and replaces only its installed policy.py, adding source/scope labels. It does not build the whole current repository, migrate storage or change dependencies/configuration.
The public Forgejo repository has Actions enabled and0 recorded jobs at discovery; remote main caab9a90. Fleet User Engine/State Hub/PolicyNexus source already uses the admitted container-build runner and normal REGISTRY_USER/REGISTRY_TOKEN bindings. Availability to this repository is not proven by sibling success. The proposed owner workflow fails closed when its admitted bindings are absent and does not borrow a workstation Docker configuration, PAT or sibling secret. It fetches the exact pushed public Git archive anonymously, checks full source SHA and exact policy hash, builds only a private two-file context with network disabled, checks installed source/ten synthetic purpose forms, and publishes only a full-source-revision candidate tag to the owner's image repository. No moving main/latest tag or cluster operation is included. Registry authentication exists only inside the normal job's private temporary Docker custody, removed on exit.
Normal source commit/consistency triggering this owner job is construction/publication preparation, not native release approval. Observe the exact Actions head SHA/status and actual pushed manifest, source/scope labels, base layer prefix and installed module before making any Deployment pin. Preserve job failure if registry capability is not admitted; route that concrete prerequisite to the existing platform owner, without requesting/reading a new credential or borrowing one. Source preparation itself remains useful and does not imply admitted execution.
Publication gates before image rollout proposal: exact registry digest and source labels; original immutable base layers/config preserved except labels and one policy.py layer; installed module hash and all10 purpose variants; all13 container/schema/restart/synthetic restore checks; fresh unfiltered vulnerability scan/SBOM of actual published image; exact currently serving config/schema5/policy packages/audiences/credentials/network/PVC unchanged in source and native dry-run/diff. Local synthetic recovery is never native production-data recovery.
Runtime rollout remains separate founder-approved supervised authority. The attached protected protocol makes consistent native backup and isolated actual-data restore part of the same concrete conditional release proposal, gated by exact founder approval; neither operation has occurred in this preparation. No source acceptance, existing config-only approval7db8485 or publication job result substitutes for it.