tegwick
c96b0c6d88
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
141 lines
7 KiB
JSON
141 lines
7 KiB
JSON
{
|
|
"id": "infd-20261011-purpose-overlay-r1",
|
|
"version": 1,
|
|
"question": "Approve this exact Informed Decision purpose-only image release on railiance01, including protected native backup/restore gates and explicit temporary acceptance of the inherited fixable MEDIUM zlib finding with owner remediation follow-through?",
|
|
"requested_act": "approve",
|
|
"binding_level": "organizational",
|
|
"brief": "Actual CI763c purpose-only image; eight base layers unchanged, legacy serialization disclosed. Scan0HIGH/CRITICAL,1fixable inheritedMEDIUM zlib/T05 dueOct18. Exact helper binds four Git blobs, protected real-data backup/offline drill (isolated new-volume UID0/CAP_CHOWN init, then UID10001 readonly/admin/postcheck), Deployment-only manualArgo/prune=false, currentDB retention. Rollback needs no Ready candidate; separate recovery verification. ALL phases incl recovery must begin byOct12, fresh founder decision beyond. Ten installed checks are synthetic/native_provider=false. No native backup/image action yet.",
|
|
"binding": {
|
|
"principal": {
|
|
"id": "pending-human-session",
|
|
"kind": "person",
|
|
"display_name": "Founder review"
|
|
},
|
|
"target": {
|
|
"kind": "environment",
|
|
"id": "realm:kubernetes/railiance01/informed-decision",
|
|
"label": "Informed Decision image-only purpose hardening on railiance01",
|
|
"environment": "production"
|
|
},
|
|
"terms": "Only attached exact INFD-WP-0009-T04/purpose-overlay-v1 trialinfd-purpose-20261011-r1: protected consistent snapshots/offcluster custody/isolated offline restore with explicit NEW-volume UID0 CAP_CHOWN-only initializer followed by UID10001 readonly schema5/admin/postproof; exact four committed source blobs and helper-bound manual Deployment-only image763c/prune=false. Fresh root-authenticated confirmed founder disposition before each phase; supervised receipt is not signed/autonomous grant. ALL phases including rollback/rollback-verify must begin before2026-10-12T23:59:59Z, new founder decision beyond; no expiry controller. Rollbackprior7f5 retains latestschema5DB and does not need Ready candidate; separate old-image/schema recovery proof. Explicit inheritedfixableMEDIUM permitted with INFD-WP-0009-T05 reviewdueOct18. Syntheticinstallednative_provider=false is not actualPDP authority proof; actualproviderT04gate distinct. No credential/policy/grant change, humanbinding or wholeAppsync."
|
|
},
|
|
"step_kind": "approve",
|
|
"packet": [
|
|
{
|
|
"item_id": "decision-packet-md",
|
|
"label": "decision-packet.md",
|
|
"hash": "sha256:a542235221890fa9ffb9c78f65d5e93227f5215d3ac68f0d1fa4addfd17bdaf6"
|
|
},
|
|
{
|
|
"item_id": "proposal-json",
|
|
"label": "proposal.json",
|
|
"hash": "sha256:7cca98a6c159201823a42fe05218d32e46152031b3f8a2ee26795454df0016df"
|
|
},
|
|
{
|
|
"item_id": "candidate-admission-json",
|
|
"label": "candidate-admission.json",
|
|
"hash": "sha256:92382a56b349c3b895e5806e975082527bb99d1a001140e69d857e5b0391fa55"
|
|
},
|
|
{
|
|
"item_id": "rollback-admission-json",
|
|
"label": "rollback-admission.json",
|
|
"hash": "sha256:22f830736ee56f6ed9b62f47d243e4e24a1b68263b261e78e2f1cfcb85adbd50"
|
|
},
|
|
{
|
|
"item_id": "candidate-deployment-json",
|
|
"label": "candidate-deployment.json",
|
|
"hash": "sha256:722a8e2dc52bec217bf960e23b2fddfc7ac27d343ac8743790e3183db81a6a0e"
|
|
},
|
|
{
|
|
"item_id": "rollback-deployment-json",
|
|
"label": "rollback-deployment.json",
|
|
"hash": "sha256:39b3f43bb84ef4921cc3a1fbcdc444610741ed8809149d8f8f17ed805f262121"
|
|
},
|
|
{
|
|
"item_id": "published-verification-json",
|
|
"label": "published-verification.json",
|
|
"hash": "sha256:8a676c38f89f9ca762b8ebe945b5acb90d47a4cb350692687abb985bbb2d8ae2"
|
|
},
|
|
{
|
|
"item_id": "registry-proof-json",
|
|
"label": "registry-proof.json",
|
|
"hash": "sha256:5aa2c1f780c47f62fa9b59da9543d82c07afa02b1d946e6144b8a042ef86f213"
|
|
},
|
|
{
|
|
"item_id": "security-summary-json",
|
|
"label": "security-summary.json",
|
|
"hash": "sha256:0ee56400dc703f7c9968c2a0a3ea0390d8362f8d0bbf8002a2bd7fa58f19cb44"
|
|
},
|
|
{
|
|
"item_id": "execution-bundle-json",
|
|
"label": "execution-bundle.json",
|
|
"hash": "sha256:27d6d6d3133c963da1dde92d498d636617387c16e850a17c598148abc35c775d"
|
|
},
|
|
{
|
|
"item_id": "sqlite-readonly-py",
|
|
"label": "sqlite_readonly.py",
|
|
"hash": "sha256:eef53dd233eee74c17f20823bd7f5787c60cad79ac648021c9479643c6ce9e38"
|
|
},
|
|
{
|
|
"item_id": "sealed-native-dependencies-json",
|
|
"label": "sealed-native-dependencies.json",
|
|
"hash": "sha256:042327a036ed254cf95dbeb0c056ac25b03a6a844b95a332c992df2943691369"
|
|
},
|
|
{
|
|
"item_id": "native-backup-restore-protocol-md",
|
|
"label": "native-backup-restore-protocol.md",
|
|
"hash": "sha256:440932f5975f42f8bc3ef5c7b281f42cf843246ffc8faba64a1d80b43ffa7478"
|
|
},
|
|
{
|
|
"item_id": "inherited-vulnerability-follow-through-json",
|
|
"label": "inherited-vulnerability-follow-through.json",
|
|
"hash": "sha256:e8da413bf985ef2cb66c71a093ba7fc0636ab884f428e40a18b40ccff8e3b101"
|
|
},
|
|
{
|
|
"item_id": "native-preflight-json",
|
|
"label": "native-preflight.json",
|
|
"hash": "sha256:eb5f41aefb97666bb0c1279617e95a7c05017a609415624daee724c48b90d262"
|
|
},
|
|
{
|
|
"item_id": "sealed-live-deployment-json",
|
|
"label": "sealed-live-deployment.json",
|
|
"hash": "sha256:d18d27063d06f535ae884ea01f96747fe301685518ab94b1cba072a1e1519362"
|
|
},
|
|
{
|
|
"item_id": "change-guard-py",
|
|
"label": "change_guard.py",
|
|
"hash": "sha256:f348e449c49f4d9e49af9e82e01764e7197837fd3df9d756f5891d9b8d9b38be"
|
|
},
|
|
{
|
|
"item_id": "preflight-py",
|
|
"label": "preflight.py",
|
|
"hash": "sha256:6b4c65f708238c9a9d17fd065876c7a00e1f1745926f990a1dd5e667298340cd"
|
|
},
|
|
{
|
|
"item_id": "preflight-inputs-json",
|
|
"label": "preflight-inputs.json",
|
|
"hash": "sha256:756e72da9ec36572242421bea8b6d2285394e334f991db5e90e9b409563b5f06"
|
|
},
|
|
{
|
|
"item_id": "fresh-preflight-validation-json",
|
|
"label": "fresh-preflight-validation.json",
|
|
"hash": "sha256:2ec324aa8e3f97753b3ed87bca80820feb5e542dc0a4799aa848ec77ea92feb7"
|
|
}
|
|
],
|
|
"highlights": [
|
|
{
|
|
"id": "native-custody-rollout-and-known-medium",
|
|
"item_id": "decision-packet-md",
|
|
"note": "Protected real-data snapshot/restore and a brief Recreate restart require this separate native approval. Actual scan has one fixable inherited MEDIUM, not zero CVEs; exact owner follow-through due2026-10-18 is manual, with no automatic controller. Rollback preserves latestschema5DB and allnew/uncertain evidence. Synthetic transport tests are not native PDP authority proof. Admin can migrate oldschemas: readonlyschema5/integrity/count check must precede every native/offline Store/admin open. ActualCM/PVC UID/custody drift and optimizedPython stop the operation.",
|
|
"required_ack": true,
|
|
"severity": "warning",
|
|
"locator": {
|
|
"kind": "section",
|
|
"heading": "Requested decision"
|
|
}
|
|
}
|
|
],
|
|
"sealed": false,
|
|
"approval_id": null,
|
|
"approval_binding_digest": null
|
|
}
|