tegwick
e0359bcb6c
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
141 lines
6.6 KiB
JSON
141 lines
6.6 KiB
JSON
{
|
|
"id": "infd-20261011-purpose-overlay-r1",
|
|
"version": 1,
|
|
"question": "Approve this exact Informed Decision purpose-only image release on railiance01, including protected native backup/restore gates and explicit temporary acceptance of the inherited fixable MEDIUM zlib finding with owner remediation follow-through?",
|
|
"requested_act": "approve",
|
|
"binding_level": "organizational",
|
|
"brief": "Actual owner CI published763c from3e4bcb26; unchanged8base layers plus one policy.py, installedUID10001 and10purpose checks pass. Full44package scan0HIGH/CRITICAL,1fixable inheritedMEDIUM zlib, identical actualbase scan. Only Deploymentimage changes; manualArgo prune=false, runtime6c/schema5/PVC/identity/policies unchanged. Before ANY admin/Store, readonly schema5/integrity/count gate; protected backup/restore, sealedDeployment+actualCM/PVC identities and unoptimizedpreflight required, not executed. Live owner riskrecord/T05 dueOct18; Recreate briefly interrupts service. No priorconfigapproval reused.",
|
|
"binding": {
|
|
"principal": {
|
|
"id": "pending-human-session",
|
|
"kind": "person",
|
|
"display_name": "Founder review"
|
|
},
|
|
"target": {
|
|
"kind": "environment",
|
|
"id": "realm:kubernetes/railiance01/informed-decision",
|
|
"label": "Informed Decision image-only purpose hardening on railiance01",
|
|
"environment": "production"
|
|
},
|
|
"terms": "Only attached exact INFD-WP-0009-T04/purpose-overlay-v1 trialinfd-purpose-20261011-r1: protected consistent snapshots/off-cluster custody/offline restore plus exact owner-source pin/manual Deployment-only image release763c, prune=false. ADMINISTER activationAPPROVED only upon actualdisposition, execute by2026-10-12T23:59:59Z afterfresh sealedCM/PVC/Deploymentpreflight+pre-openreadonlyschema5+restoregates; rollbackprior7f5 retaining latestschema5DB. Explicit inheritedfixableMEDIUM permitted with INFD-WP-0009-T05 ownerreviewdue2026-10-18. No credential/policy/grant change, humanbinding, wholeAppsync or autonomygrant."
|
|
},
|
|
"step_kind": "approve",
|
|
"packet": [
|
|
{
|
|
"item_id": "decision-packet-md",
|
|
"label": "decision-packet.md",
|
|
"hash": "sha256:23da78cf998a32af0481e68567db94bb40781cc18f147461f779d40ebd329fd1"
|
|
},
|
|
{
|
|
"item_id": "proposal-json",
|
|
"label": "proposal.json",
|
|
"hash": "sha256:a59bcddc6c79e3ba8265a95b4b68facda2683abda8e47e5bb48ce402b9e1fa82"
|
|
},
|
|
{
|
|
"item_id": "candidate-admission-json",
|
|
"label": "candidate-admission.json",
|
|
"hash": "sha256:92382a56b349c3b895e5806e975082527bb99d1a001140e69d857e5b0391fa55"
|
|
},
|
|
{
|
|
"item_id": "rollback-admission-json",
|
|
"label": "rollback-admission.json",
|
|
"hash": "sha256:22f830736ee56f6ed9b62f47d243e4e24a1b68263b261e78e2f1cfcb85adbd50"
|
|
},
|
|
{
|
|
"item_id": "candidate-deployment-json",
|
|
"label": "candidate-deployment.json",
|
|
"hash": "sha256:722a8e2dc52bec217bf960e23b2fddfc7ac27d343ac8743790e3183db81a6a0e"
|
|
},
|
|
{
|
|
"item_id": "rollback-deployment-json",
|
|
"label": "rollback-deployment.json",
|
|
"hash": "sha256:39b3f43bb84ef4921cc3a1fbcdc444610741ed8809149d8f8f17ed805f262121"
|
|
},
|
|
{
|
|
"item_id": "published-verification-json",
|
|
"label": "published-verification.json",
|
|
"hash": "sha256:8a676c38f89f9ca762b8ebe945b5acb90d47a4cb350692687abb985bbb2d8ae2"
|
|
},
|
|
{
|
|
"item_id": "registry-proof-json",
|
|
"label": "registry-proof.json",
|
|
"hash": "sha256:5aa2c1f780c47f62fa9b59da9543d82c07afa02b1d946e6144b8a042ef86f213"
|
|
},
|
|
{
|
|
"item_id": "security-summary-json",
|
|
"label": "security-summary.json",
|
|
"hash": "sha256:0ee56400dc703f7c9968c2a0a3ea0390d8362f8d0bbf8002a2bd7fa58f19cb44"
|
|
},
|
|
{
|
|
"item_id": "trivy-full-json",
|
|
"label": "trivy-full.json",
|
|
"hash": "sha256:f38a8f7e6c419eed9154d7762f932b9deb6680a622247b08196b7458b893434e"
|
|
},
|
|
{
|
|
"item_id": "sqlite-readonly-py",
|
|
"label": "sqlite_readonly.py",
|
|
"hash": "sha256:eef53dd233eee74c17f20823bd7f5787c60cad79ac648021c9479643c6ce9e38"
|
|
},
|
|
{
|
|
"item_id": "sealed-native-dependencies-json",
|
|
"label": "sealed-native-dependencies.json",
|
|
"hash": "sha256:042327a036ed254cf95dbeb0c056ac25b03a6a844b95a332c992df2943691369"
|
|
},
|
|
{
|
|
"item_id": "native-backup-restore-protocol-md",
|
|
"label": "native-backup-restore-protocol.md",
|
|
"hash": "sha256:2f8d4894c2861b34977ec020593b7515a8ee35a43ce2e6aef2d96a6d34a94ddc"
|
|
},
|
|
{
|
|
"item_id": "inherited-vulnerability-follow-through-json",
|
|
"label": "inherited-vulnerability-follow-through.json",
|
|
"hash": "sha256:e8da413bf985ef2cb66c71a093ba7fc0636ab884f428e40a18b40ccff8e3b101"
|
|
},
|
|
{
|
|
"item_id": "native-preflight-json",
|
|
"label": "native-preflight.json",
|
|
"hash": "sha256:eb5f41aefb97666bb0c1279617e95a7c05017a609415624daee724c48b90d262"
|
|
},
|
|
{
|
|
"item_id": "sealed-live-deployment-json",
|
|
"label": "sealed-live-deployment.json",
|
|
"hash": "sha256:d18d27063d06f535ae884ea01f96747fe301685518ab94b1cba072a1e1519362"
|
|
},
|
|
{
|
|
"item_id": "change-guard-py",
|
|
"label": "change_guard.py",
|
|
"hash": "sha256:f348e449c49f4d9e49af9e82e01764e7197837fd3df9d756f5891d9b8d9b38be"
|
|
},
|
|
{
|
|
"item_id": "preflight-py",
|
|
"label": "preflight.py",
|
|
"hash": "sha256:6b4c65f708238c9a9d17fd065876c7a00e1f1745926f990a1dd5e667298340cd"
|
|
},
|
|
{
|
|
"item_id": "preflight-inputs-json",
|
|
"label": "preflight-inputs.json",
|
|
"hash": "sha256:756e72da9ec36572242421bea8b6d2285394e334f991db5e90e9b409563b5f06"
|
|
},
|
|
{
|
|
"item_id": "fresh-preflight-validation-json",
|
|
"label": "fresh-preflight-validation.json",
|
|
"hash": "sha256:2ec324aa8e3f97753b3ed87bca80820feb5e542dc0a4799aa848ec77ea92feb7"
|
|
}
|
|
],
|
|
"highlights": [
|
|
{
|
|
"id": "native-custody-rollout-and-known-medium",
|
|
"item_id": "decision-packet-md",
|
|
"note": "Protected real-data snapshot/restore and a brief Recreate restart require this separate native approval. Actual scan has one fixable inherited MEDIUM, not zero CVEs; exact owner follow-through due2026-10-18 is manual, with no automatic controller. Rollback preserves latestschema5DB and allnew/uncertain evidence. Synthetic transport tests are not native PDP authority proof. Admin can migrate oldschemas: readonlyschema5/integrity/count check must precede every native/offline Store/admin open. ActualCM/PVC UID/custody drift and optimizedPython stop the operation.",
|
|
"required_ack": true,
|
|
"severity": "warning",
|
|
"locator": {
|
|
"kind": "section",
|
|
"heading": "Requested decision"
|
|
}
|
|
}
|
|
],
|
|
"sealed": false,
|
|
"approval_id": null,
|
|
"approval_binding_digest": null
|
|
}
|