coulomb/informed-decision
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
informed-decision/docs/evidence/2026-10-11-purpose-image-release/intake.json
tegwick bc6494cd1b Bind concrete protected release executor and final owner-reviewed decision packet 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
2026-10-11 04:28:38 +02:00

261 lines
187 KiB
JSON
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

{
"kind": "informed-decision.memo-intake",
"version": 1,
"idempotency_key": "infd-20261011-purpose-overlay-r1-v1",
"memo_class": "decision-record",
"review_group": "net-kingdom-admins",
"drafted_by": "custodian-codex",
"approval_intent": {
"action": "administer",
"principal": "informed-decision",
"purpose": "Approve exact image-only purpose overlay release plus protected native evidence backup/restore gates and explicit inherited fixable-medium owner follow-through; no unrelated grant.",
"target": {
"id": "INFD-WP-0009-T04/purpose-overlay-v1",
"type": "runtime-change",
"system": "railiance01"
}
},
"memo": {
"id": "infd-20261011-purpose-overlay-r1",
"version": 1,
"question": "Approve this exact Informed Decision purpose-only image release on railiance01, including protected native backup/restore gates and explicit temporary acceptance of the inherited fixable MEDIUM zlib finding with owner remediation follow-through?",
"requested_act": "approve",
"binding_level": "organizational",
"brief": "Actual CI763c purpose-only image; eight base layers unchanged, legacy serialization disclosed. Scan0HIGH/CRITICAL,1fixable inheritedMEDIUM zlib/T05 dueOct18. Exact helper binds four Git blobs, protected real-data backup/offline drill (isolated new-volume UID0/CAP_CHOWN init, then UID10001 readonly/admin/postcheck), Deployment-only manualArgo/prune=false, currentDB retention. Rollback needs no Ready candidate; separate recovery verification. ALL phases incl recovery must begin byOct12, fresh founder decision beyond. Ten installed checks are synthetic/native_provider=false. No native backup/image action yet.",
"binding": {
"principal": {
"id": "pending-human-session",
"kind": "person",
"display_name": "Founder review"
},
"target": {
"kind": "environment",
"id": "realm:kubernetes/railiance01/informed-decision",
"label": "Informed Decision image-only purpose hardening on railiance01",
"environment": "production"
},
"terms": "Only attached exact INFD-WP-0009-T04/purpose-overlay-v1 trialinfd-purpose-20261011-r1: protected consistent snapshots/offcluster custody/isolated offline restore with explicit NEW-volume UID0 CAP_CHOWN-only initializer followed by UID10001 readonly schema5/admin/postproof; exact four committed source blobs and helper-bound manual Deployment-only image763c/prune=false. Fresh root-authenticated confirmed founder disposition before each phase; supervised receipt is not signed/autonomous grant. ALL phases including rollback/rollback-verify must begin before2026-10-12T23:59:59Z, new founder decision beyond; no expiry controller. Rollbackprior7f5 retains latestschema5DB and does not need Ready candidate; separate old-image/schema recovery proof. Explicit inheritedfixableMEDIUM permitted with INFD-WP-0009-T05 reviewdueOct18. Syntheticinstallednative_provider=false is not actualPDP authority proof; actualproviderT04gate distinct. No credential/policy/grant change, humanbinding or wholeAppsync."
},
"step_kind": "approve",
"packet": [
{
"item_id": "decision-packet-md",
"label": "decision-packet.md",
"hash": "sha256:a542235221890fa9ffb9c78f65d5e93227f5215d3ac68f0d1fa4addfd17bdaf6"
},
{
"item_id": "proposal-json",
"label": "proposal.json",
"hash": "sha256:7cca98a6c159201823a42fe05218d32e46152031b3f8a2ee26795454df0016df"
},
{
"item_id": "candidate-admission-json",
"label": "candidate-admission.json",
"hash": "sha256:92382a56b349c3b895e5806e975082527bb99d1a001140e69d857e5b0391fa55"
},
{
"item_id": "rollback-admission-json",
"label": "rollback-admission.json",
"hash": "sha256:22f830736ee56f6ed9b62f47d243e4e24a1b68263b261e78e2f1cfcb85adbd50"
},
{
"item_id": "candidate-deployment-json",
"label": "candidate-deployment.json",
"hash": "sha256:722a8e2dc52bec217bf960e23b2fddfc7ac27d343ac8743790e3183db81a6a0e"
},
{
"item_id": "rollback-deployment-json",
"label": "rollback-deployment.json",
"hash": "sha256:39b3f43bb84ef4921cc3a1fbcdc444610741ed8809149d8f8f17ed805f262121"
},
{
"item_id": "published-verification-json",
"label": "published-verification.json",
"hash": "sha256:8a676c38f89f9ca762b8ebe945b5acb90d47a4cb350692687abb985bbb2d8ae2"
},
{
"item_id": "registry-proof-json",
"label": "registry-proof.json",
"hash": "sha256:5aa2c1f780c47f62fa9b59da9543d82c07afa02b1d946e6144b8a042ef86f213"
},
{
"item_id": "security-summary-json",
"label": "security-summary.json",
"hash": "sha256:0ee56400dc703f7c9968c2a0a3ea0390d8362f8d0bbf8002a2bd7fa58f19cb44"
},
{
"item_id": "execution-bundle-json",
"label": "execution-bundle.json",
"hash": "sha256:27d6d6d3133c963da1dde92d498d636617387c16e850a17c598148abc35c775d"
},
{
"item_id": "sqlite-readonly-py",
"label": "sqlite_readonly.py",
"hash": "sha256:eef53dd233eee74c17f20823bd7f5787c60cad79ac648021c9479643c6ce9e38"
},
{
"item_id": "sealed-native-dependencies-json",
"label": "sealed-native-dependencies.json",
"hash": "sha256:042327a036ed254cf95dbeb0c056ac25b03a6a844b95a332c992df2943691369"
},
{
"item_id": "native-backup-restore-protocol-md",
"label": "native-backup-restore-protocol.md",
"hash": "sha256:440932f5975f42f8bc3ef5c7b281f42cf843246ffc8faba64a1d80b43ffa7478"
},
{
"item_id": "inherited-vulnerability-follow-through-json",
"label": "inherited-vulnerability-follow-through.json",
"hash": "sha256:e8da413bf985ef2cb66c71a093ba7fc0636ab884f428e40a18b40ccff8e3b101"
},
{
"item_id": "native-preflight-json",
"label": "native-preflight.json",
"hash": "sha256:eb5f41aefb97666bb0c1279617e95a7c05017a609415624daee724c48b90d262"
},
{
"item_id": "sealed-live-deployment-json",
"label": "sealed-live-deployment.json",
"hash": "sha256:d18d27063d06f535ae884ea01f96747fe301685518ab94b1cba072a1e1519362"
},
{
"item_id": "change-guard-py",
"label": "change_guard.py",
"hash": "sha256:f348e449c49f4d9e49af9e82e01764e7197837fd3df9d756f5891d9b8d9b38be"
},
{
"item_id": "preflight-py",
"label": "preflight.py",
"hash": "sha256:6b4c65f708238c9a9d17fd065876c7a00e1f1745926f990a1dd5e667298340cd"
},
{
"item_id": "preflight-inputs-json",
"label": "preflight-inputs.json",
"hash": "sha256:756e72da9ec36572242421bea8b6d2285394e334f991db5e90e9b409563b5f06"
},
{
"item_id": "fresh-preflight-validation-json",
"label": "fresh-preflight-validation.json",
"hash": "sha256:2ec324aa8e3f97753b3ed87bca80820feb5e542dc0a4799aa848ec77ea92feb7"
}
],
"highlights": [
{
"id": "native-custody-rollout-and-known-medium",
"item_id": "decision-packet-md",
"note": "Protected real-data snapshot/restore and a brief Recreate restart require this separate native approval. Actual scan has one fixable inherited MEDIUM, not zero CVEs; exact owner follow-through due2026-10-18 is manual, with no automatic controller. Rollback preserves latestschema5DB and allnew/uncertain evidence. Synthetic transport tests are not native PDP authority proof. Admin can migrate oldschemas: readonlyschema5/integrity/count check must precede every native/offline Store/admin open. ActualCM/PVC UID/custody drift and optimizedPython stop the operation.",
"required_ack": true,
"severity": "warning",
"locator": {
"kind": "section",
"heading": "Requested decision"
}
}
],
"sealed": false,
"approval_id": null,
"approval_binding_digest": null
},
"packet": [
{
"item_id": "decision-packet-md",
"media_type": "text/markdown",
"content": "# Informed Decision purpose overlay release\n\n## Requested decision\n\nApprove the exact purpose-only image rollout and protected real-data backup/restore protocol for the existing Informed Decision service on railiance01. This request is separate from the already approved config-only repair. Only the existing Deployment image changes through the owner's manual Argo workflow, with prune disabled. Runtime ConfigMap `informed-decision-runtime-6c221878d051`, schema5, PVC, credentials, audience, policies, registries, access, replica1 and Recreate strategy remain fixed. Execute by 2026-10-12T23:59:59Z, after refreshed sealed-source/UID/configuration checks and backup/restore gates. All phases, including recovery and verification, must begin before this deadline. If the window is exhausted, stop and obtain a fresh founder decision; this may delay recovery. No timer/controller automatically changes the released image.\n\n## Artifact and known finding\n\nActual owner CI task11484/run3 published immutable image `sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a` from source `3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168`. Anonymous registry verification preserves all eight base compressed blobs/rootfs layers and adds only policy.py with exact source hash and mode0644. Legacy-builder media-type/default config serialization differences are recorded; the runtime semantics remain unchanged. Pulled published image executes as UID10001/GID10001 and passes ten installed checks: two supported binding forms, eight advisory/malformed refusals. Tests use synthetic transport and do not claim new native PDP authorization proof. The two failed CI attempts remain in the same trial history.\n\nActual unfiltered pinned scanner/DB evidence covers44packages: zero HIGH/CRITICAL, **one fixable MEDIUM**, CVE-2026-85091, zlib1.3.2-r0 fixed in1.3.2-r1. Actual current-base scan has the identical finding. Approving this packet explicitly permits this inherited finding during this narrow purpose release; it is not a RiskNexus estate risk grade or zero-CVE claim. Owner record INFD-RISK-20261011-ZLIB-85091 and live task INFD-WP-0009-T05 require separate base refresh and native approval, reviewed by2026-10-18. That review date is manual follow-through, with no auto-controller claim. Scanner notes Alpine3.24 absent EOL list; OS vulnerability detection ran against38OSpackages. Unknown vulnerabilities remain outside snapshot knowledge.\n\n## Native baseline and gates\n\nOriginal read-only capture01:25:38Z: existing Deployment UIDa588e10a, Ready1, image7f5c, unchanged runtime6c; native admission preserves the full configuration plus exactly the proposed image. Clientdiff returns1. Requests3460/4000mCPU86%, memory9472Mi59%; refresh before release. Existing Argo Application UID499868f2 is manual, target7db8485, Healthy with pre-existing OutOfSync status. Do not treat a scoped Deployment release as full-app reconciliation. Preserve its tracking-id; no unrelated resource sync/prune/adoption.\n\nThe refined read-only helper binds original source/helper/render/baseline hashes and actual immutable ConfigMap/PVC UIDs, runtime-data checksum and bound volume identity, explicitly refuses optimized interpreters, checks exact fresh live UID/configuration and admission, and writes a separate execution receipt outside this sealed packet. Failed initial raw Kustomize metadata check is retained: direct kubectl apply would drop Argo tracking-id. The reviewed selected Deployment explicitly retains that existing ID, matching Argo ownership. Any unrelated drift, different UID, altered admission, unavailable protected backup capacity, uncertain backup, restore mismatch or unhealthy baseline stops the release.\n\n## Protected backup and release\n\nBefore **any** native source or offline-restored Store/admin open, use the attached stdlib SQLite mode=ro/query_only checker to require schema5, integrity=ok and count-only baseline. The admin automatically migrates oldschemas, so a post-open report alone cannot prove no migration. Refuse other schemas before admin. Then use the existing owner admin's SQLite backup API, not a raw copy of the live database/WAL. Protect directories0700/files0600, owned by10001. Retain independently protected off-cluster snapshot custody and only count/hash receipts. No database contents, caller tokens, requester Secret or runtime credential files enter Git, State Hub, logs or this packet. Native backup and offline real-data restore have not yet occurred. Use an isolated private disposable copy, networknone and no runtime config/token mounts, run the pre-open checker and exact offline `--entrypoint informed-decision-admin inspect --db /restore/review.sqlite` after it passes, comparing frozen snapshot counts without service startup, then clean only the disposable restored copy. Retain the original snapshot. The attached protocol binds case-specific paths and fail-closed capacity/custody checks.\n\nRefresh a consistent online snapshot immediately before image-only cutover. This protocol does not assert traffic/dispatcher quiescence. Current and candidate share schema5 and unchanged store code; rollback retains the latest live database and all new/uncertain evidence. Stop the old writer before the new one with existing Recreate and single-writer lock. Do not restore an older snapshot over later writes, discard unresolved external effects, scale other workloads, change policies/identity/custody, or create human dispositions to make checks green.\n\nPin the existing Application to the exact owner commit containing the approved candidate source hashes, and manually sync only Deployment/informed-decision with prune=false. Verify actualimage/module/mode/UID, health/readiness and installed purpose refusals on the real placement; explicitly distinguish synthetic-transport checks from actual provider evidence. Existing native binding/lifecycle behavior must remain available. If unhealthy or verification fails, return Application source to7db8485 and scoped-sync prior same-schema image7f5c, preserving current evidence database; retain failed outcomes. Any data recovery beyond this same-schema image rollback is a separate founder decision.\n\n## Alternatives and estimates\n\nProceed with this narrow release plus explicit inherited-medium follow-through, or defer and prepare a separate base/dependency refresh before any release. No additional recurring hosting is proposed: estimated incremental infrastructure EUR0, with private storage and attended engineering/recovery time unpriced. Risks include a brief Recreate interruption, private backup custody errors, caller refusal when advisory responses were improperly treated as binding, and the disclosed inherited finding. This decision does not promote agent autonomy or grant unrelated work.\n\n## Independent review refinements\n\nThe initial36path/20document packet at manifest7c6738b3 and submissionac41c8ae is preserved in source preparation evidence, with the failed/conditional review. Independent Platform review identified admin auto-migration, optimization bypass, and actual same-name ConfigMap/PVC replacement gaps. The amended packet adds pre-open stdlib read-only schema/integrity/count gates, explicit local/remote optimization refusal, and independently sealed actual native config/PVC custody checks. These are refinements in the same proposal/trial, with no original or amended founder approval claimed.\n\n## Mechanically bound helper and recovery refinement\n\nThe directly attached execution-bundle.json binds exact supervised helper sources, plan, tests and PENDING authority template. It verifies all four committed owner Kustomize inputs and rejects present automated:{} as well as source overrides. Root must freshly authenticate the exact founder native disposition before every phase; receipt bookkeeping is not an autonomous signed grant. The same proposal/trial preserves the earlier36path7c packet, amended78pathb1 packet and original11file653 helper plus conditional review findings.\n\nThe offline copy uses one UID0/CAP_CHOWN-only initializer confined to the NEW nonce-bound local volume, exact candidate image, networknone/readonlyroot/no-newprivileges/CPU1/128Mi, no host/livePVC/config/token mounts. All following pre-open/admin/post-open checks are UID10001. Post-admin readonly schema5/integrity/counts must match the frozen snapshot and original snapshot SHA must remain unchanged. Rollback dispatch never requires the failing candidate to be Ready or opens its database; seals/source/image pair/admission CAS still gate it. A separate rollback-verify proves recovered old-image Ready1/scoped operation/schema5 retained-current-DB integrity. Same-phase retries are refused after ambiguous outcomes.\n\nRaw scan/SBOM/base-scan bytes remain retained unchanged, hash-bound by the directly attached published-verification receipt; the bundle replaces only the direct raw scan attachment to stay within twenty documents. Known fixable inherited MEDIUM and T05 follow-through remain visible. Ten installed synthetic checks, including those later on actual placement, explicitly have native_provider=false. Actual provider/PDP authority evidence is a distinct T04 completion gate and is not supplied by these checks. Source preparation basis e0359bcb6cdfad9ab3e868054121fe0cebec2d68 plus9268c9ac0bbee508fe35c0b90dcefef4c24da2f5 is recorded; the final applied owner commit must be pinned before execution.\n"
},
{
"item_id": "proposal-json",
"media_type": "application/json",
"content": "{\n \"proposal_id\": \"INFD-WP-0009-T04/purpose-overlay-v1\",\n \"trial_id\": \"infd-purpose-20261011-r1\",\n \"state\": \"prepared-unapproved\",\n \"target\": \"realm:kubernetes/railiance01/informed-decision\",\n \"authority\": \"ADMINISTER; activation APPROVED only upon exact founder disposition\",\n \"candidate_image\": \"forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a\",\n \"published_source_revision\": \"3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168\",\n \"prior_image\": \"forgejo.coulomb.social/coulomb/informed-decision@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173\",\n \"prior_argo_revision\": \"7db8485ffecdebfabd77a9daec085553c74bf0bf\",\n \"native_object\": {\n \"apiVersion\": \"apps/v1\",\n \"kind\": \"Deployment\",\n \"namespace\": \"informed-decision\",\n \"name\": \"informed-decision\",\n \"uid\": \"a588e10a-90d2-4883-975e-6dd8b8feca92\"\n },\n \"argo_application_uid\": \"499868f2-eabc-4df4-ae31-b89ce58d750d\",\n \"source_gate\": \"All four exact committed owner Kustomize input blobs in execution-plan.json and clean current owner HEAD must match; source preparation is not native approval\",\n \"sync_scope\": [\n \"apps:Deployment:informed-decision\"\n ],\n \"prune\": false,\n \"automated_sync\": false,\n \"runtime_configmap\": \"informed-decision-runtime-6c221878d051\",\n \"schema\": 5,\n \"requested_operations\": [\n \"Protected SQLite-consistent native backup and independently protected off-cluster custody\",\n \"Offline restore/integrity/count comparison on a private disposable volume with exact candidate, no runtime tokens/config/network\",\n \"Refresh a consistent pre-cutover snapshot, retain private copies and count-only/hash receipts\",\n \"Pin existing manual Argo Application to exact approved owner source and manually sync only existing Deployment image\",\n \"Verify health/readiness/image/module/installed fail-closed purpose checks and retained schema/count evidence; recover to prior same-schema image if needed\"\n ],\n \"execute_by\": \"2026-10-12T23:59:59Z\",\n \"temporary_vulnerability_review_due\": \"2026-10-18\",\n \"known_scan_findings\": \"0HIGH/CRITICAL,1fixable inheritedMEDIUM zlib, actual currentbase+candidate findings identical\",\n \"vulnerability_record\": \"INFD-RISK-20261011-ZLIB-85091 / INFD-WP-0009-T05\",\n \"cost_estimate_EUR\": 0,\n \"cost_limits\": \"No new recurring infrastructure; private backup storage and attended engineering/recovery time unpriced, not an autopilot cost grant\",\n \"risk_estimates\": [\n \"Brief Recreate service interruption; no concurrent new writer/surge\",\n \"Private evidence snapshot custody and disposal errors; no snapshots/tokens in public evidence\",\n \"Candidate purpose refusal may expose callers relying on advisory results as binding\",\n \"Inherited known fixable MEDIUM remains until separately approved owner remediation\",\n \"Existing Argo OutOfSync baseline is retained; no whole-app sync or unrelated repairs permitted\",\n \"All phases, including recovery/verification, must begin before Oct12 deadline; if recovery window is exhausted stop and obtain a fresh founder decision. No automatic expiry controller.\"\n ],\n \"rollback\": \"Manual Argo source pin back to7db8485 and scoped Deployment-only sync to7f5c image; retain current schema5 database and all post-cutover evidence, never restore older snapshot over live writes\",\n \"native_executed\": false,\n \"human_approval\": false,\n \"refinement_of_manifest\": \"7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300\",\n \"mandatory_pre_open_gate\": \"stdlibSQLite mode=ro/query_only: schema5+integrity+count baseline before ANY Store/admin on native source or restoredcopy; refuseoldschemas without migration\",\n \"optimized_interpreters\": \"local+remote explicitlyrefused beforeassert gates\",\n \"native_dependency_gate\": \"sealed actualCM UID/immutable/canonicaldatahash+PVC UID/fullspec/Bound/volumeName, no rawCMdata orSecret reads\",\n \"live_counts\": \"Frozen snapshot/clone exactcounter equality; postcutover/rollback livecounterchanges may reflect legitimate concurrentcommits/state transitions, latestDB alwaysretained\",\n \"source_basis\": {\n \"reviewed_protocol_commit\": \"e0359bcb6cdfad9ab3e868054121fe0cebec2d68\",\n \"owner_followthrough_commit\": \"9268c9ac0bbee508fe35c0b90dcefef4c24da2f5\",\n \"final_execution_source\": \"exact subsequent root-applied source commit must be bound by founder receipt and verified against four approved Git blobs\"\n },\n \"approved_owner_render_blob_sha256\": {\n \"deploy/lifecycle/admission.candidate.json\": \"92382a56b349c3b895e5806e975082527bb99d1a001140e69d857e5b0391fa55\",\n \"deploy/lifecycle/service.candidate.json\": \"38b78b9cbee5ade7750a58d5156ca4c5773352e947acb304ee714b59e749ceb4\",\n \"deploy/lifecycle/kustomization.yaml\": \"1bbce81bc6758434354157f8601534320c5d0290587908fd15a6d25e3fa57f47\",\n \"deploy/lifecycle/registries.candidate.json\": \"9bad6db5fbc2178d31b04120016a41830c3552fbb9e2517b718f9bbe87cf649e\"\n },\n \"execution_bundle_sha256\": \"27d6d6d3133c963da1dde92d498d636617387c16e850a17c598148abc35c775d\",\n \"execution_helper_manifest_sha256\": \"f2fad6c251fbb4420e07c1329802f521b513bbf66e51f64c5d673ef04f16284c\",\n \"execution_plan_sha256\": \"f5e5fa906ff19d3a45d10dcdb2810373ae21f9cf44c0472ff2bd47d3bc3328d6\",\n \"execution_phases\": [\n \"drill-backup\",\n \"drill-copy\",\n \"offline-verify\",\n \"cleanup-offline\",\n \"cutover-backup\",\n \"cutover-copy\",\n \"release\",\n \"verify\",\n \"rollback\",\n \"rollback-verify\"\n ],\n \"deadline_semantics\": \"All phases including verification/recovery must begin before execute_by. No extension or automatic emergency grant; beyond deadline stop and obtain a fresh founder decision. Complete the bounded drill and rollout early enough to allow recovery within the window.\",\n \"offline_initializer\": \"One isolated local UID0:0/CAP_CHOWN-only initializer of the newly created nonce-bound disposable volume, exact candidate image, networknone/readonlyroot/no-newprivileges/CPU1/128Mi; no host/livePVC/token/config mount. Subsequent pre-open/admin/post-open checks UID10001:10001.\",\n \"rollback_dispatch\": \"Sealed Deployment/CM/PVC and same-schema source/image pair plus admission CAS; no Ready candidate or Pod/database exec prerequisite. rollback-verify separately proves recovered old image/Ready1/scoped operation and readonly current schema5/integrity/counts.\",\n \"purpose_proof_limit\": \"Ten installed synthetic-transport checks on actual placement; native_provider=false. Not actual provider/PDP authority proof, which remains a distinct T04 completion gate.\",\n \"refinement_of_amended_manifest\": \"b1e3e66bc4023dc80c6ea59564c3557c7653fb3c307f46a049997b76198a9033\"\n}\n"
},
{
"item_id": "candidate-admission-json",
"media_type": "application/json",
"content": "{\n \"image\": \"forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a\",\n \"policy\": {\n \"origin\": \"http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080\",\n \"package\": \"informed-decision.compact-sitting\",\n \"version\": \"v13\",\n \"package_digest\": \"sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873\",\n \"pod_name\": \"flex-auth-informed-decision-sitting\"\n },\n \"keycape_egress_ips\": [\n \"92.205.62.239\"\n ],\n \"storage_class\": \"local-path\",\n \"ordinary_approval_ids\": [\n \"2ce76d7f-01c3-4b63-8476-8d1230679769\",\n \"c2af4bcf-15b4-4305-aac1-acc7e4dcb099\",\n \"dc22666a-d5d7-46bc-9490-ebe9fe09dc38\"\n ],\n \"lifecycle_policy\": {\n \"package\": \"informed-decision.lifecycle\",\n \"version\": \"v2\",\n \"package_digest\": \"sha256:da01e045fc108adec6b489e5d51f7e57366793016c5a64776963780a6aae457c\",\n \"origin\": \"http://flex-auth-informed-decision-lifecycle.flex-auth.svc.cluster.local:8080\",\n \"pod_name\": \"flex-auth-informed-decision-lifecycle\"\n },\n \"lifecycle_delivery\": true,\n \"intake_attributes\": true,\n \"intake_delivery\": {\n \"hub_origin\": \"http://state-hub.state-hub.svc.cluster.local:8000\"\n },\n \"workload_api\": {\n \"registries_configmap\": \"informed-decision-workload-registry\",\n \"peers\": [\n {\n \"namespace\": \"state-hub\",\n \"app\": \"state-hub\"\n }\n ],\n \"api_egress\": [\n {\n \"ip\": \"10.43.0.1\",\n \"port\": 443\n },\n {\n \"ip\": \"92.205.62.239\",\n \"port\": 6443\n }\n ],\n \"intake\": true,\n \"lifecycle\": true\n }\n}\n"
},
{
"item_id": "rollback-admission-json",
"media_type": "application/json",
"content": "{\n \"image\": \"forgejo.coulomb.social/coulomb/informed-decision@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173\",\n \"policy\": {\n \"origin\": \"http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080\",\n \"package\": \"informed-decision.compact-sitting\",\n \"version\": \"v13\",\n \"package_digest\": \"sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873\",\n \"pod_name\": \"flex-auth-informed-decision-sitting\"\n },\n \"keycape_egress_ips\": [\n \"92.205.62.239\"\n ],\n \"storage_class\": \"local-path\",\n \"ordinary_approval_ids\": [\n \"2ce76d7f-01c3-4b63-8476-8d1230679769\",\n \"c2af4bcf-15b4-4305-aac1-acc7e4dcb099\",\n \"dc22666a-d5d7-46bc-9490-ebe9fe09dc38\"\n ],\n \"lifecycle_policy\": {\n \"package\": \"informed-decision.lifecycle\",\n \"version\": \"v2\",\n \"package_digest\": \"sha256:da01e045fc108adec6b489e5d51f7e57366793016c5a64776963780a6aae457c\",\n \"origin\": \"http://flex-auth-informed-decision-lifecycle.flex-auth.svc.cluster.local:8080\",\n \"pod_name\": \"flex-auth-informed-decision-lifecycle\"\n },\n \"lifecycle_delivery\": true,\n \"intake_attributes\": true,\n \"intake_delivery\": {\n \"hub_origin\": \"http://state-hub.state-hub.svc.cluster.local:8000\"\n },\n \"workload_api\": {\n \"registries_configmap\": \"informed-decision-workload-registry\",\n \"peers\": [\n {\n \"namespace\": \"state-hub\",\n \"app\": \"state-hub\"\n }\n ],\n \"api_egress\": [\n {\n \"ip\": \"10.43.0.1\",\n \"port\": 443\n },\n {\n \"ip\": \"92.205.62.239\",\n \"port\": 6443\n }\n ],\n \"intake\": true,\n \"lifecycle\": true\n }\n}\n"
},
{
"item_id": "candidate-deployment-json",
"media_type": "application/json",
"content": "{\n \"apiVersion\": \"apps/v1\",\n \"kind\": \"Deployment\",\n \"metadata\": {\n \"annotations\": {\n \"informed-decision.coulomb.social/admission\": \"approved; INFD-WP-0007 cutover\",\n \"argocd.argoproj.io/tracking-id\": \"informed-decision:apps/Deployment:informed-decision/informed-decision\"\n },\n \"name\": \"informed-decision\",\n \"namespace\": \"informed-decision\"\n },\n \"spec\": {\n \"progressDeadlineSeconds\": 600,\n \"replicas\": 1,\n \"selector\": {\n \"matchLabels\": {\n \"app.kubernetes.io/name\": \"informed-decision\"\n }\n },\n \"strategy\": {\n \"type\": \"Recreate\"\n },\n \"template\": {\n \"metadata\": {\n \"annotations\": {\n \"informed-decision.coulomb.social/admission\": \"approved; INFD-WP-0007 cutover\"\n },\n \"labels\": {\n \"app.kubernetes.io/component\": \"review\",\n \"app.kubernetes.io/name\": \"informed-decision\"\n }\n },\n \"spec\": {\n \"automountServiceAccountToken\": false,\n \"containers\": [\n {\n \"env\": [\n {\n \"name\": \"INFD_KEYCAPE_ISSUER\",\n \"value\": \"https://kc.coulomb.social\"\n },\n {\n \"name\": \"INFD_CONTAINER_CONFIG\",\n \"value\": \"/configuration/runtime.json\"\n }\n ],\n \"image\": \"forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a\",\n \"livenessProbe\": {\n \"httpGet\": {\n \"path\": \"/healthz\",\n \"port\": \"http\"\n },\n \"periodSeconds\": 10,\n \"timeoutSeconds\": 2\n },\n \"name\": \"informed-decision\",\n \"ports\": [\n {\n \"containerPort\": 8080,\n \"name\": \"http\"\n },\n {\n \"containerPort\": 8081,\n \"name\": \"workload\"\n }\n ],\n \"readinessProbe\": {\n \"httpGet\": {\n \"path\": \"/healthz\",\n \"port\": \"http\"\n },\n \"periodSeconds\": 10,\n \"timeoutSeconds\": 2\n },\n \"resources\": {\n \"limits\": {\n \"cpu\": \"500m\",\n \"memory\": \"256Mi\"\n },\n \"requests\": {\n \"cpu\": \"5m\",\n \"memory\": \"64Mi\"\n }\n },\n \"securityContext\": {\n \"allowPrivilegeEscalation\": false,\n \"capabilities\": {\n \"drop\": [\n \"ALL\"\n ]\n },\n \"readOnlyRootFilesystem\": true\n },\n \"startupProbe\": {\n \"failureThreshold\": 12,\n \"httpGet\": {\n \"path\": \"/healthz\",\n \"port\": \"http\"\n },\n \"periodSeconds\": 10,\n \"timeoutSeconds\": 2\n },\n \"volumeMounts\": [\n {\n \"mountPath\": \"/data\",\n \"name\": \"data\"\n },\n {\n \"mountPath\": \"/run/informed-decision\",\n \"name\": \"runtime\"\n },\n {\n \"mountPath\": \"/tmp\",\n \"name\": \"tmp\"\n },\n {\n \"mountPath\": \"/configuration\",\n \"name\": \"configuration\",\n \"readOnly\": true\n },\n {\n \"mountPath\": \"/var/run/secrets/informed-decision/policy\",\n \"name\": \"caller\",\n \"readOnly\": true\n },\n {\n \"mountPath\": \"/var/run/secrets/informed-decision/audit\",\n \"name\": \"audit\",\n \"readOnly\": true\n },\n {\n \"mountPath\": \"/var/run/secrets/informed-decision/kubernetes\",\n \"name\": \"kubernetes-api\",\n \"readOnly\": true\n },\n {\n \"mountPath\": \"/workload-registry\",\n \"name\": \"workload-registry\",\n \"readOnly\": true\n },\n {\n \"mountPath\": \"/var/run/secrets/informed-decision/requester\",\n \"name\": \"sitting-requester\",\n \"readOnly\": true\n }\n ]\n }\n ],\n \"securityContext\": {\n \"fsGroup\": 10001,\n \"fsGroupChangePolicy\": \"OnRootMismatch\",\n \"runAsGroup\": 10001,\n \"runAsNonRoot\": true,\n \"runAsUser\": 10001,\n \"seccompProfile\": {\n \"type\": \"RuntimeDefault\"\n }\n },\n \"serviceAccountName\": \"review\",\n \"terminationGracePeriodSeconds\": 45,\n \"volumes\": [\n {\n \"name\": \"data\",\n \"persistentVolumeClaim\": {\n \"claimName\": \"informed-decision-data\"\n }\n },\n {\n \"emptyDir\": {\n \"medium\": \"Memory\",\n \"sizeLimit\": \"16Mi\"\n },\n \"name\": \"runtime\"\n },\n {\n \"emptyDir\": {\n \"medium\": \"Memory\",\n \"sizeLimit\": \"16Mi\"\n },\n \"name\": \"tmp\"\n },\n {\n \"configMap\": {\n \"defaultMode\": 292,\n \"name\": \"informed-decision-runtime-6c221878d051\"\n },\n \"name\": \"configuration\"\n },\n {\n \"name\": \"caller\",\n \"projected\": {\n \"defaultMode\": 288,\n \"sources\": [\n {\n \"serviceAccountToken\": {\n \"audience\": \"flex-auth\",\n \"expirationSeconds\": 3600,\n \"path\": \"token\"\n }\n }\n ]\n }\n },\n {\n \"name\": \"audit\",\n \"secret\": {\n \"defaultMode\": 288,\n \"items\": [\n {\n \"key\": \"token\",\n \"path\": \"token\"\n }\n ],\n \"secretName\": \"informed-decision-audit\"\n }\n },\n {\n \"name\": \"kubernetes-api\",\n \"projected\": {\n \"defaultMode\": 288,\n \"sources\": [\n {\n \"serviceAccountToken\": {\n \"expirationSeconds\": 600,\n \"path\": \"token\"\n }\n },\n {\n \"configMap\": {\n \"items\": [\n {\n \"key\": \"ca.crt\",\n \"path\": \"ca.crt\"\n }\n ],\n \"name\": \"kube-root-ca.crt\"\n }\n }\n ]\n }\n },\n {\n \"configMap\": {\n \"defaultMode\": 292,\n \"name\": \"informed-decision-workload-registry\"\n },\n \"name\": \"workload-registry\"\n },\n {\n \"name\": \"sitting-requester\",\n \"secret\": {\n \"defaultMode\": 288,\n \"items\": [\n {\n \"key\": \"client-secret\",\n \"path\": \"client-secret\"\n }\n ],\n \"optional\": false,\n \"secretName\": \"informed-decision-sitting-requester\"\n }\n }\n ]\n }\n }\n }\n}\n"
},
{
"item_id": "rollback-deployment-json",
"media_type": "application/json",
"content": "{\n \"apiVersion\": \"apps/v1\",\n \"kind\": \"Deployment\",\n \"metadata\": {\n \"annotations\": {\n \"informed-decision.coulomb.social/admission\": \"approved; INFD-WP-0007 cutover\",\n \"argocd.argoproj.io/tracking-id\": \"informed-decision:apps/Deployment:informed-decision/informed-decision\"\n },\n \"name\": \"informed-decision\",\n \"namespace\": \"informed-decision\"\n },\n \"spec\": {\n \"progressDeadlineSeconds\": 600,\n \"replicas\": 1,\n \"selector\": {\n \"matchLabels\": {\n \"app.kubernetes.io/name\": \"informed-decision\"\n }\n },\n \"strategy\": {\n \"type\": \"Recreate\"\n },\n \"template\": {\n \"metadata\": {\n \"annotations\": {\n \"informed-decision.coulomb.social/admission\": \"approved; INFD-WP-0007 cutover\"\n },\n \"labels\": {\n \"app.kubernetes.io/component\": \"review\",\n \"app.kubernetes.io/name\": \"informed-decision\"\n }\n },\n \"spec\": {\n \"automountServiceAccountToken\": false,\n \"containers\": [\n {\n \"env\": [\n {\n \"name\": \"INFD_KEYCAPE_ISSUER\",\n \"value\": \"https://kc.coulomb.social\"\n },\n {\n \"name\": \"INFD_CONTAINER_CONFIG\",\n \"value\": \"/configuration/runtime.json\"\n }\n ],\n \"image\": \"forgejo.coulomb.social/coulomb/informed-decision@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173\",\n \"livenessProbe\": {\n \"httpGet\": {\n \"path\": \"/healthz\",\n \"port\": \"http\"\n },\n \"periodSeconds\": 10,\n \"timeoutSeconds\": 2\n },\n \"name\": \"informed-decision\",\n \"ports\": [\n {\n \"containerPort\": 8080,\n \"name\": \"http\"\n },\n {\n \"containerPort\": 8081,\n \"name\": \"workload\"\n }\n ],\n \"readinessProbe\": {\n \"httpGet\": {\n \"path\": \"/healthz\",\n \"port\": \"http\"\n },\n \"periodSeconds\": 10,\n \"timeoutSeconds\": 2\n },\n \"resources\": {\n \"limits\": {\n \"cpu\": \"500m\",\n \"memory\": \"256Mi\"\n },\n \"requests\": {\n \"cpu\": \"5m\",\n \"memory\": \"64Mi\"\n }\n },\n \"securityContext\": {\n \"allowPrivilegeEscalation\": false,\n \"capabilities\": {\n \"drop\": [\n \"ALL\"\n ]\n },\n \"readOnlyRootFilesystem\": true\n },\n \"startupProbe\": {\n \"failureThreshold\": 12,\n \"httpGet\": {\n \"path\": \"/healthz\",\n \"port\": \"http\"\n },\n \"periodSeconds\": 10,\n \"timeoutSeconds\": 2\n },\n \"volumeMounts\": [\n {\n \"mountPath\": \"/data\",\n \"name\": \"data\"\n },\n {\n \"mountPath\": \"/run/informed-decision\",\n \"name\": \"runtime\"\n },\n {\n \"mountPath\": \"/tmp\",\n \"name\": \"tmp\"\n },\n {\n \"mountPath\": \"/configuration\",\n \"name\": \"configuration\",\n \"readOnly\": true\n },\n {\n \"mountPath\": \"/var/run/secrets/informed-decision/policy\",\n \"name\": \"caller\",\n \"readOnly\": true\n },\n {\n \"mountPath\": \"/var/run/secrets/informed-decision/audit\",\n \"name\": \"audit\",\n \"readOnly\": true\n },\n {\n \"mountPath\": \"/var/run/secrets/informed-decision/kubernetes\",\n \"name\": \"kubernetes-api\",\n \"readOnly\": true\n },\n {\n \"mountPath\": \"/workload-registry\",\n \"name\": \"workload-registry\",\n \"readOnly\": true\n },\n {\n \"mountPath\": \"/var/run/secrets/informed-decision/requester\",\n \"name\": \"sitting-requester\",\n \"readOnly\": true\n }\n ]\n }\n ],\n \"securityContext\": {\n \"fsGroup\": 10001,\n \"fsGroupChangePolicy\": \"OnRootMismatch\",\n \"runAsGroup\": 10001,\n \"runAsNonRoot\": true,\n \"runAsUser\": 10001,\n \"seccompProfile\": {\n \"type\": \"RuntimeDefault\"\n }\n },\n \"serviceAccountName\": \"review\",\n \"terminationGracePeriodSeconds\": 45,\n \"volumes\": [\n {\n \"name\": \"data\",\n \"persistentVolumeClaim\": {\n \"claimName\": \"informed-decision-data\"\n }\n },\n {\n \"emptyDir\": {\n \"medium\": \"Memory\",\n \"sizeLimit\": \"16Mi\"\n },\n \"name\": \"runtime\"\n },\n {\n \"emptyDir\": {\n \"medium\": \"Memory\",\n \"sizeLimit\": \"16Mi\"\n },\n \"name\": \"tmp\"\n },\n {\n \"configMap\": {\n \"defaultMode\": 292,\n \"name\": \"informed-decision-runtime-6c221878d051\"\n },\n \"name\": \"configuration\"\n },\n {\n \"name\": \"caller\",\n \"projected\": {\n \"defaultMode\": 288,\n \"sources\": [\n {\n \"serviceAccountToken\": {\n \"audience\": \"flex-auth\",\n \"expirationSeconds\": 3600,\n \"path\": \"token\"\n }\n }\n ]\n }\n },\n {\n \"name\": \"audit\",\n \"secret\": {\n \"defaultMode\": 288,\n \"items\": [\n {\n \"key\": \"token\",\n \"path\": \"token\"\n }\n ],\n \"secretName\": \"informed-decision-audit\"\n }\n },\n {\n \"name\": \"kubernetes-api\",\n \"projected\": {\n \"defaultMode\": 288,\n \"sources\": [\n {\n \"serviceAccountToken\": {\n \"expirationSeconds\": 600,\n \"path\": \"token\"\n }\n },\n {\n \"configMap\": {\n \"items\": [\n {\n \"key\": \"ca.crt\",\n \"path\": \"ca.crt\"\n }\n ],\n \"name\": \"kube-root-ca.crt\"\n }\n }\n ]\n }\n },\n {\n \"configMap\": {\n \"defaultMode\": 292,\n \"name\": \"informed-decision-workload-registry\"\n },\n \"name\": \"workload-registry\"\n },\n {\n \"name\": \"sitting-requester\",\n \"secret\": {\n \"defaultMode\": 288,\n \"items\": [\n {\n \"key\": \"client-secret\",\n \"path\": \"client-secret\"\n }\n ],\n \"optional\": false,\n \"secretName\": \"informed-decision-sitting-requester\"\n }\n }\n ]\n }\n }\n }\n}\n"
},
{
"item_id": "published-verification-json",
"media_type": "application/json",
"content": "{\n \"proposal\": \"INFD-WP-0009-T04/purpose-overlay-v1\",\n \"observed_at\": \"2026-10-11T01:24:01.985128+00:00\",\n \"native_owner_publication_job\": {\n \"id\": 11484,\n \"name\": \"publish-candidate\",\n \"head_branch\": \"main\",\n \"head_sha\": \"3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168\",\n \"run_number\": 3,\n \"event\": \"push\",\n \"display_title\": \"Prepare readable overlay context with the admitted legacy builder\",\n \"status\": \"success\",\n \"workflow_id\": \"purpose-overlay-image.yaml\",\n \"url\": \"https://forgejo.coulomb.social/coulomb/informed-decision/actions/runs/3\",\n \"created_at\": \"2026-10-11T01:20:59Z\",\n \"updated_at\": \"2026-10-11T01:21:08Z\",\n \"run_started_at\": \"2026-10-11T01:20:59Z\"\n },\n \"image\": \"forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a\",\n \"source_revision\": \"3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168\",\n \"policy_sha256\": \"9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62\",\n \"registry_proof_sha256\": \"5aa2c1f780c47f62fa9b59da9543d82c07afa02b1d946e6144b8a042ef86f213\",\n \"source_render_change_only\": \"Deployment/informed-decision spec.template.spec.containers[0].image\",\n \"runtime_configmap_unchanged\": \"informed-decision-runtime-6c221878d051\",\n \"installed_image_execution\": {\n \"immutable_registry_artifact_pulled_anonymously\": true,\n \"UID\": 10001,\n \"GID\": 10001,\n \"policy_file_UID\": 0,\n \"policy_file_mode\": \"0644\",\n \"purpose_variants\": 10,\n \"binding_forms_allowed\": 2,\n \"advisory_or_malformed_refused\": 8,\n \"network\": \"none\",\n \"read_only\": true,\n \"synthetic_transport\": true,\n \"native_PDP_test\": false\n },\n \"scan_summary_sha256\": \"0ee56400dc703f7c9968c2a0a3ea0390d8362f8d0bbf8002a2bd7fa58f19cb44\",\n \"historical_failed_runs_retained\": [\n \"f66de505/task11482/run1\",\n \"acecad887/task11483/run2\"\n ],\n \"native_hosting_changed\": false,\n \"native_backup_restore_executed\": false,\n \"human_approval\": false,\n \"evidence_file_sha256\": {\n \"image-manifest.json\": \"978c575d3c7bf0de39dbe4e9567c39cd36f70b7e55bc17357bdb03fb3b96b0fb\",\n \"image-config.json\": \"4ad7249c75fd9fc039ceb186772419e1cba5fd9759c404556459c80a2d285d10\",\n \"base-image-config.json\": \"b706c9209e324f39a86ffcda2a3e9d94c92649739ad5b21fe4611006e36f6f00\",\n \"registry-proof.json\": \"5aa2c1f780c47f62fa9b59da9543d82c07afa02b1d946e6144b8a042ef86f213\",\n \"trivy-full.json\": \"f38a8f7e6c419eed9154d7762f932b9deb6680a622247b08196b7458b893434e\",\n \"sbom.cdx.json\": \"a4252951e2027472c26d8679cb543e30983180809d6dd3c7c94b883d62803e5d\",\n \"base-trivy-full.json\": \"d44c555aecbb1a4518f4127d48015ea459325c93e8b0371910a55de47293ca80\",\n \"check_installed.py\": \"a34a51be9c9f2b16a06a88173b5c6c492c9957fe021cf412a86a1737730640ad\",\n \"verify_registry.py\": \"413f575c21a2bd18a3696f8f2d939eeadc52d76f282c42813f76bb0e3ee8a2a4\",\n \"sqlite_readonly.py\": \"eef53dd233eee74c17f20823bd7f5787c60cad79ac648021c9479643c6ce9e38\",\n \"sealed-native-dependencies.json\": \"042327a036ed254cf95dbeb0c056ac25b03a6a844b95a332c992df2943691369\",\n \"review-refinement.json\": \"ea62845cee5ee6f4f6cb7f5dcd0af601ba29a21c8ff80efbbc02ad16e35bea75\",\n \"test_change_guard.py\": \"da5350437357ba329236cc137610c03856f38f836ddf2856025bc12011fad07f\",\n \"test_sqlite_readonly.py\": \"c7a91d0c6a373d738c88bb817d9bfb2ff8a179bc61b93063b89677b566520323\",\n \"test_preflight_optimization.py\": \"a0c4fa18c5d6c21476a06c6d05fe7656259d204299138851599e9214d911206d\"\n }\n}\n"
},
{
"item_id": "registry-proof-json",
"media_type": "application/json",
"content": "{\n \"image_digest\": \"sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a\",\n \"source_revision\": \"3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168\",\n \"base_image_digest\": \"sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173\",\n \"base_layer_bytes_identical\": true,\n \"layer_media_type_conversion\": \"OCI gzip to Docker gzip, same digest and size\",\n \"base_runtime_config_semantics_identical\": true,\n \"legacy_builder_config_additions\": {\n \"Hostname\": \"\",\n \"Domainname\": \"\",\n \"AttachStdin\": false,\n \"AttachStdout\": false,\n \"AttachStderr\": false,\n \"Tty\": false,\n \"OpenStdin\": false,\n \"StdinOnce\": false,\n \"Cmd\": null,\n \"Volumes\": null,\n \"OnBuild\": null,\n \"Image\": \"sha256:90f1574f9eda35fa6cb972961beb27a7cb904c36560e381930b0e14065c23883\"\n },\n \"base_rootfs_prefix_identical\": true,\n \"overlay_regular_files\": [\n \"opt/venv/lib/python3.12/site-packages/informed_decision/policy.py\"\n ],\n \"overlay_directories\": [\n \"opt\",\n \"opt/venv\",\n \"opt/venv/lib\",\n \"opt/venv/lib/python3.12\",\n \"opt/venv/lib/python3.12/site-packages\",\n \"opt/venv/lib/python3.12/site-packages/informed_decision\"\n ],\n \"policy_sha256\": \"9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62\",\n \"policy_mode\": \"0644\",\n \"base_user\": \"10001:10001\",\n \"source_scope_labels\": {\n \"org.opencontainers.image.revision\": \"3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168\",\n \"org.opencontainers.image.base.digest\": \"sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173\",\n \"social.coulomb.source.policy.sha256\": \"9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62\",\n \"social.coulomb.release.scope\": \"INFD-WP-0009-T04/purpose-overlay-v1\"\n },\n \"registry_read_route\": \"anonymous public scoped bearer challenge, no token retention\",\n \"image_executed\": false,\n \"native_workload_changed\": false,\n \"native_backup_restore_executed\": false\n}\n"
},
{
"item_id": "security-summary-json",
"media_type": "application/json",
"content": "{\n \"image\": \"forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a\",\n \"source_revision\": \"3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168\",\n \"scanner\": \"aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969\",\n \"version\": \"0.74.0\",\n \"db_metadata\": {\n \"Version\": 2,\n \"NextUpdate\": \"2026-10-11T18:59:50.889010572Z\",\n \"UpdatedAt\": \"2026-10-10T18:59:50.889010923Z\",\n \"DownloadedAt\": \"2026-10-10T23:32:32.380033131Z\"\n },\n \"suppression\": false,\n \"ignore_unfixed\": false,\n \"severity_filter\": null,\n \"package_count\": 44,\n \"findings_by_severity\": {\n \"MEDIUM\": 1\n },\n \"findings\": [\n {\n \"id\": \"CVE-2026-85091\",\n \"package\": \"zlib\",\n \"installed\": \"1.3.2-r0\",\n \"fixed\": \"1.3.2-r1\",\n \"severity\": \"MEDIUM\"\n }\n ],\n \"coverage_limits\": [\n \"Alpine3.24 absent scanner EOL list; OS detector ran against Alpine3.24 repository on38OS packages\",\n \"Known findings asof pinnedDB, not claim absence of unknown vulnerabilities\"\n ],\n \"high_critical\": 0,\n \"same_scanner_actual_base_scan_findings_identical\": true,\n \"base_scan_file\": \"base-trivy-full.json\"\n}\n"
},
{
"item_id": "execution-bundle-json",
"media_type": "application/json",
"content": "{\n \"kind\": \"informed-decision.execution-source-bundle\",\n \"version\": 1,\n \"proposal_id\": \"INFD-WP-0009-T04/purpose-overlay-v1\",\n \"files\": {\n \"README.md\": {\n \"sha256\": \"a6ecdabebce12eeafea61173edb6e6d0e349a76e366546978e2ed02e7b109df2\",\n \"content\": \"# Supervised Informed Decision purpose release executor — unapproved preparation\\n\\nNo native database read, backup/export/restore or workload action has been run. This source implements the reviewed protocol; its additional mechanical details need peer review and an amended hash-bound packet before first human submission. The original78path packet/reviews remain historical technical agreement, not founder approval of this executor.\\n\\nRun one phase at a time only after the coordinator has freshly authenticated the exact founder disposition at the existing fixed Informed Decision origin. Root writes the protected0600 fixed files `/tmp/security-infd-purpose-root-authority.json` and `/tmp/security-infd-purpose-native-outcome-latest.json`. The receipt template is PENDING and cannot authorize anything. The helper checks exact nested confirmed person/platform-root ACCEPT version1, original memo identity/current memo SHA, source commit, plan SHA and freshness120seconds. This is supervised receipt bookkeeping, not cryptographic provider verification, a signed grant or agent autonomy promotion. Root/harness supervision remains the authority boundary. Never synthesize an approval receipt from a technical review or caller assertion.\\n\\nInvocation after actual approval: `python3 execution/actuator.py --phase <fixed-phase> --root-authority-receipt /tmp/security-infd-purpose-root-authority.json --root-native-outcome /tmp/security-infd-purpose-native-outcome-latest.json --source-revision <exact-final-owner-commit>`. Order: drill-backup → drill-copy → offline-verify → cleanup-offline → cutover-backup → cutover-copy → release → verify. Rollback is a distinct authorized recovery after a recorded release attempt, followed by rollback-verify. Rollback dispatch needs no Ready Pod or candidate database exec: sealed Deployment/CM/PVC/source/image pair and admission CAS remain mandatory. Its acknowledgment is not recovery completion; rollback-verify separately requires Ready1 of the old image, succeeded exact scoped operation and readonly schema5/integrity/count proof of the current retained database. Root refreshes actual native acceptance immediately before each phase.\\n\\nThe private ignored Custodian custody parent `.private-backups` must already exist,0700 owned by the workstation agent user; the exact case child20261011-infd-purpose-r1 is created only after authority checks. Native parent `/data/private/purpose-overlay-r1` is uniquely created by UID10001 for drill/cutover SQLite-consistent snapshots, each0600/nonsymlink/single-link. The attached stdlib readonly checker must report schema5/integrity/counts before any Store/admin on native source or offlineclone. Invalid states/count shapes and all raw child outputs are withheld. Main-only snapshot closure is verified before binary transfer; stdin/stdout snapshot bytes reach only private files or the isolated restore copy, never tool/chat/log output. Streams stop beyond frozen byte count/512MiB; failures retain partial private evidence.\\n\\nNew private offline volume `infd-purpose-r1-restore-20261011` is created only on the pinned local workstation Docker socket/engine bnt-lap001, with localdriver/nooptions and attemptnonce labels. One-time initializer runs exact763c as UID0 with only CAP_CHOWN, networknone/read-onlyroot/no-newprivileges, one NEW namedvolume mount, no host/livePVC/credential/config mounts. It receives only the protected snapshot on stdin, verifies bytes, sets folder0700/file0600 owned10001. Then UID10001 performs readonly pre-open validation, `--entrypoint informed-decision-admin inspect --db /restore/review.sqlite`, never the service entrypoint. A second UID10001/network-none readonly integrity/schema/count check after admin must exactly equal the frozen snapshot proof, and the original protected snapshot SHA must remain unchanged. Cleanup compares exact nonce/creation identity and removes only this clone volume, retaining all native/offcluster originals. CPU1/memory128MiB; private offcluster capacity at least1GiB+16MiB and native estimated two/one-snapshot headroom required.\\n\\nEvery phase fsyncs RUNNING intent before dispatch. Any failure/interruption/ambiguous result remains UNCERTAIN; same-phase retry is refused. Separate operator diagnosis and any needed recovery are recorded; neither snapshots nor unresolved/new records are removed to make checks green. Frozen snapshot/clone counters must agree; live post-cutover/rollback counters can include legitimate concurrent commits/state transitions.\\n\\nExisting Application UID and actual Deployment/Pod/CM/PVC custody/source are checked. All four owner render Git blobs must match; overrides/plugins/multiple sources and even automated:{} are rejected. The existing Application.operation API is used (native argocd CLI is absent), with server dry-run, resourceVersion/UID/source tests, one Deployment only, prune=false. Dispatch acknowledgment is not rollout completion. Verify requires exact succeeded operation/controller generation/Ready1, same schema5 DB, actual installed hash/mode/UID and10purpose checks plus bounded localhosthealth/readiness. Purpose transport remains synthetic and is explicitly not a native PDP authority test. Rollback pins prior7db/7f5 through the same scoped workflow and retains the current live database; it never restores an older snapshot over later writes.\\n\\nSixteen synthetic tests pass against frozen case metadata: authority/expiry/actor/ambiguity refusals, crash intent/no retry/order, credential-output withholding, private bounded binarycopy, volume recreation cleanup refusal, source/automation/CM/PVC/Ready drift, pre-open gate refusal and exact Deployment-only operation/dry-run. These are source tests, not native backup or release proof.\\n\\nAll phases, including recovery and verification, are bounded by 2026-10-12T23:59:59Z. This explicitly refines the earlier packet deadline wording for unstarted release: the helper does not extend authority past the deadline. Start sufficiently early to complete drill/cutover/recovery; after expiry stop and obtain a fresh founder decision. This may delay recovery if the window is exhausted, and must be disclosed before acceptance.\\n\\nThe initial 11-file helper freeze SHA653b68c3891c066f40d104bfc67a35da5e436605cd99afd52fbac4b47a9553fe and independent conditional findings remain archived under execution-history/initial-653b68c3. This refinement is the same proposal/trial; no native execution or human acceptance has occurred.\\n\"\n },\n \"actuator.py\": {\n \"sha256\": \"6b9d6439862454f261ee77f05b26519f8109599b1f67078bc4e1f7c7c4061ba5\",\n \"content\": \"\\\"\\\"\\\"One fixed supervised phase; never run this during source preparation.\\\"\\\"\\\"\\nimport argparse\\nimport hashlib\\nimport json\\nimport os\\nfrom pathlib import Path\\nimport re\\nimport selectors\\nimport stat\\nimport subprocess\\nimport sys\\nimport time\\n\\nif sys.flags.optimize:\\n raise SystemExit('optimized interpreter refused')\\n\\nPHASES = ('drill-backup', 'drill-copy', 'offline-verify', 'cleanup-offline',\\n 'cutover-backup', 'cutover-copy', 'release', 'verify', 'rollback', 'rollback-verify')\\n\\n\\ndef require(value, reason):\\n if not value:\\n raise ValueError(reason)\\n\\n\\ndef sha(path):\\n digest = hashlib.sha256()\\n with Path(path).open('rb') as stream:\\n for block in iter(lambda: stream.read(1024**2), b''):\\n digest.update(block)\\n return digest.hexdigest()\\n\\n\\ndef private(path, directory=False):\\n info = Path(path).lstat()\\n require((stat.S_ISDIR(info.st_mode) if directory else stat.S_ISREG(info.st_mode))\\n and info.st_uid == os.getuid() and stat.S_IMODE(info.st_mode) == (0o700 if directory else 0o600)\\n and (directory or info.st_nlink == 1), 'private owned custody required')\\n\\nROOT = Path(__file__).resolve().parent\\nCASE = ROOT.parent\\nOWNER = Path('/home/worsch/informed-decision')\\nCUSTODIAN = Path('/home/worsch/the-custodian')\\nCUSTODY = CUSTODIAN / '.private-backups/20261011-infd-purpose-r1'\\nSOCKET = 'unix:///var/run/docker.sock'\\nIMAGE = 'forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a'\\nVOLUME = 'infd-purpose-r1-restore-20261011'\\nMAX_BYTES = 512 * 1024**2\\n\\n\\ndef run(argv, body=None, timeout=90):\\n return subprocess.run(argv, input=body, text=True, capture_output=True, timeout=timeout)\\n\\n\\ndef json_result(result):\\n try:\\n value = json.loads(result.stdout)\\n except (ValueError, TypeError):\\n raise ValueError('safe phase receipt unavailable; outcome uncertain') from None\\n require(result.returncode == 0 and isinstance(value, dict) and value.get('all_checks_pass') is True,\\n 'phase did not verify complete; raw output withheld; no retry')\\n permitted = {'phase', 'all_checks_pass', 'raw_output_withheld', 'native_approval_verified_by_root',\\n 'native_authenticated_grant', 'source_readonly_baseline', 'snapshot_readonly',\\n 'snapshot_sha256', 'snapshot_bytes', 'snapshot_file', 'native_parent_private',\\n 'native_uid', 'pod_name', 'pod_uid', 'live_readonly_schema_integrity_counts',\\n 'live_counts_may_include_concurrent_commits', 'operation_requested', 'source_revision',\\n 'resources', 'prune', 'rollout_verified', 'latest_live_database_retained',\\n 'client_diff_sha256', 'native_rollout_verified', 'current_schema5_database_retained',\\n 'private_copy_verified', 'installed_purpose_checks', 'policy_sha256',\\n 'policy_mode', 'policy_uid', 'health_statuses', 'native_provider_probe', 'recovery_verification'}\\n require(set(value) <= permitted, 'unexpected output fields withheld')\\n from receipt_safety import counts\\n for name in ('source_readonly_baseline', 'snapshot_readonly', 'live_readonly_schema_integrity_counts'):\\n if name in value:\\n counts(value[name])\\n for name in ('snapshot_sha256', 'client_diff_sha256'):\\n if name in value:\\n require(re.fullmatch(r'[a-f0-9]{64}', value[name]) is not None, 'invalid output digest withheld')\\n if 'snapshot_bytes' in value:\\n require(type(value['snapshot_bytes']) is int and 0 < value['snapshot_bytes'] <= MAX_BYTES,\\n 'invalid output size withheld')\\n if 'snapshot_file' in value:\\n require(value['snapshot_file'] in ('drill.sqlite', 'cutover.sqlite'), 'invalid output file withheld')\\n return value\\n\\n\\ndef docker(argv, body=None, timeout=120):\\n return run(['docker', '--config', str(CUSTODY / 'empty-docker-config'), '--host', SOCKET] + argv,\\n body=body, timeout=timeout)\\n\\n\\ndef remote(phase, revision, approved):\\n # Fixed module imported only after main verifies every executor source hash.\\n from native_program import PROGRAM\\n payload = {'phase': phase, 'source_revision': revision, 'approval': approved,\\n 'sealed': json.loads((CASE / 'sealed-live-deployment.json').read_text()),\\n 'dependencies': json.loads((CASE / 'sealed-native-dependencies.json').read_text()),\\n 'candidate': json.loads((CASE / 'candidate-deployment.json').read_text()),\\n 'rollback': json.loads((CASE / 'rollback-deployment.json').read_text()),\\n 'receipt_safety': (ROOT / 'receipt_safety.py').read_text(),\\n 'purpose_checks': (CASE / 'check_installed.py').read_text(),\\n 'readonly': (CASE / 'sqlite_readonly.py').read_text()}\\n script = PROGRAM.replace('__PAYLOAD__', repr(json.dumps(payload))).replace(\\n '__GUARD__', repr((CASE / 'change_guard.py').read_text()))\\n return json_result(run(['ssh', 'railiance01', 'python3 -'], script, timeout=200))\\n\\n\\ndef copy_snapshot(phase, revision, approved, journal):\\n metadata = remote(phase, revision, approved)\\n backup_phase = 'drill-backup' if phase == 'drill-copy' else 'cutover-backup'\\n prior = journal.data['phases'][backup_phase]['result']\\n for key in ('snapshot_sha256', 'snapshot_bytes', 'snapshot_file', 'snapshot_readonly'):\\n require(metadata[key] == prior[key], 'closed frozen snapshot changed')\\n name = metadata['snapshot_file']\\n require(name in ('drill.sqlite', 'cutover.sqlite') and 0 < metadata['snapshot_bytes'] <= MAX_BYTES,\\n 'fixed bounded snapshot required')\\n pod = metadata['pod_name']\\n require(re.fullmatch(r'[a-z0-9]([-a-z0-9]*[a-z0-9])?', pod) is not None, 'fixed owner pod name required')\\n local = CUSTODY / name\\n fd = os.open(local, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600)\\n # Binary snapshot stdout goes only to a private file, never tool/chat/log output.\\n # Snapshot schema/count metadata was validated before opening this destination.\\n with os.fdopen(fd, 'wb') as destination:\\n command = ('kubectl exec -n informed-decision ' + pod +\\n ' -c informed-decision -- cat /data/private/purpose-overlay-r1/' + name)\\n transfer = subprocess.Popen(['ssh', 'railiance01', command], stdout=subprocess.PIPE,\\n stderr=subprocess.DEVNULL)\\n selector = selectors.DefaultSelector()\\n selector.register(transfer.stdout, selectors.EVENT_READ)\\n deadline = time.monotonic() + 150\\n received = 0\\n try:\\n while True:\\n remaining = deadline - time.monotonic()\\n require(remaining > 0 and selector.select(remaining), 'private transfer timed out')\\n block = os.read(transfer.stdout.fileno(), 1024**2)\\n if not block:\\n break\\n received += len(block)\\n require(received <= metadata['snapshot_bytes'] and received <= MAX_BYTES,\\n 'private copy exceeds frozen snapshot size')\\n destination.write(block)\\n transfer.wait(timeout=max(1, deadline - time.monotonic()))\\n finally:\\n selector.close()\\n transfer.stdout.close()\\n if transfer.poll() is None:\\n transfer.kill()\\n transfer.wait()\\n destination.flush()\\n os.fsync(destination.fileno())\\n private(local)\\n require(transfer.returncode == 0 and local.stat().st_size == metadata['snapshot_bytes']\\n and sha(local) == metadata['snapshot_sha256'], 'private copy incomplete/uncertain; retain, no retry')\\n # Re-read identity/hash after transfer. This is verification, not a write retry.\\n after = remote(phase, revision, approved)\\n require(after['pod_uid'] == metadata['pod_uid'] and after['snapshot_sha256'] == metadata['snapshot_sha256'],\\n 'source identity/snapshot changed during transfer')\\n return {**metadata, 'off_cluster_private_copy_verified': True, 'snapshot_contents_output': False}\\n\\n\\ndef offline_verify(journal):\\n from receipt_safety import counts\\n snapshot = CUSTODY / 'drill.sqlite'\\n private(snapshot)\\n previous = journal.data['phases']['drill-copy']['result']\\n require(sha(snapshot) == previous['snapshot_sha256'], 'protected snapshot bytes changed')\\n identity = docker(['info', '--format', '{{json .Name}}'])\\n require(identity.returncode == 0 and json.loads(identity.stdout) == 'bnt-lap001',\\n 'local offline Docker engine identity changed')\\n listed = docker(['volume', 'ls', '--format', '{{.Name}}'])\\n require(listed.returncode == 0 and VOLUME not in listed.stdout.splitlines(),\\n 'disposable volume absence not verified')\\n nonce = journal.data['phases']['offline-verify']['attempt_id']\\n labels = {'informed-decision.case': 'infd-purpose-20261011-r1',\\n 'informed-decision.use': 'offline-restore-only', 'informed-decision.attempt': nonce}\\n created = docker(['volume', 'create', '--driver', 'local', '--label', 'informed-decision.case=infd-purpose-20261011-r1',\\n '--label', 'informed-decision.attempt=' + nonce,\\n '--label', 'informed-decision.use=offline-restore-only', VOLUME])\\n require(created.returncode == 0 and created.stdout.strip() == VOLUME, 'volume creation uncertain; no retry')\\n inspected = docker(['volume', 'inspect', VOLUME])\\n require(inspected.returncode == 0, 'new volume identity unavailable')\\n volume = json.loads(inspected.stdout)\\n require(len(volume) == 1 and volume[0]['Name'] == VOLUME and volume[0].get('Labels') == labels\\n and volume[0].get('Driver') == 'local' and not volume[0].get('Options')\\n and volume[0].get('Scope') == 'local', 'new isolated volume identity changed')\\n identity = {key: volume[0][key] for key in ('Name', 'Labels', 'Driver', 'Scope', 'CreatedAt')}\\n journal.note('offline-verify', 'created_volume_identity', identity)\\n # One-time UID0/CAP_CHOWN initialization is isolated to the NEW named volume.\\n # No host/live PVC/config/token mount exists; this detail needs packet review.\\n initializer = \\\"\\\"\\\"import hashlib,os,stat,sys\\nif sys.flags.optimize:raise RuntimeError('optimized interpreter refused')\\nfolder='/restore';expected=EXPECTED\\nif os.listdir(folder):raise ValueError('new empty private volume required')\\nos.chmod(folder,0o700)\\nfd=os.open(folder+'/review.sqlite',os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW|os.O_WRONLY,0o600)\\ndigest=hashlib.sha256();size=0\\nwith os.fdopen(fd,'wb') as target:\\n while True:\\n block=sys.stdin.buffer.read(1024**2)\\n if not block:break\\n size+=len(block)\\n if size>512*1024**2:raise ValueError('private restore size exceeds bound')\\n target.write(block);digest.update(block)\\n target.flush();os.fsync(target.fileno())\\nif digest.hexdigest()!=expected:raise ValueError('private copied snapshot differs')\\nos.chown(folder+'/review.sqlite',10001,10001);os.chown(folder,10001,10001)\\nprint('{\\\"all_checks_pass\\\":true,\\\"private_copy_verified\\\":true}')\\n\\\"\\\"\\\".replace('EXPECTED', repr(previous['snapshot_sha256']))\\n with snapshot.open('rb') as source:\\n argv = ['docker', '--config', str(CUSTODY / 'empty-docker-config'), '--host', SOCKET,\\n 'run', '--rm', '-i', '--network', 'none', '--read-only', '--cpus', '1', '--memory', '128m',\\n '--user', '0:0', '--cap-drop', 'ALL', '--cap-add', 'CHOWN',\\n '--security-opt', 'no-new-privileges', '--mount', 'type=volume,src=' + VOLUME + ',dst=/restore',\\n '--entrypoint', 'python', IMAGE, '-c', initializer]\\n copied = subprocess.run(argv, stdin=source, text=True, capture_output=True, timeout=150)\\n json_result(copied)\\n options = ['run', '--rm', '-i', '--network', 'none', '--read-only', '--cpus', '1', '--memory', '128m',\\n '--user', '10001:10001', '--cap-drop', 'ALL', '--security-opt', 'no-new-privileges',\\n '--mount', 'type=volume,src=' + VOLUME + ',dst=/restore']\\n readonly = docker(options + ['--entrypoint', 'python', IMAGE, '-', '--db', '/restore/review.sqlite'],\\n (CASE / 'sqlite_readonly.py').read_text())\\n require(readonly.returncode == 0, 'offline pre-open schema/integrity gate refused; never open Store')\\n checked = counts(json.loads(readonly.stdout))\\n require(checked == previous['snapshot_readonly'], 'frozen snapshot/clone readonly counts differ')\\n admin = docker(options + ['--entrypoint', 'informed-decision-admin', IMAGE,\\n 'inspect', '--db', '/restore/review.sqlite'])\\n require(admin.returncode == 0, 'offline admin result uncertain')\\n admin_counts = json.loads(admin.stdout)\\n require(admin_counts == {key: checked[key] for key in ('schema_version', 'lifecycle', 'outbox', 'submissions')},\\n 'offline admin changed frozen snapshot counters')\\n # Admin Store construction must not silently alter schema/integrity/counters.\\n post = docker(options + ['--entrypoint', 'python', IMAGE, '-', '--db', '/restore/review.sqlite'],\\n (CASE / 'sqlite_readonly.py').read_text())\\n require(post.returncode == 0, 'offline post-admin readonly integrity gate refused')\\n post_checked = counts(json.loads(post.stdout))\\n require(post_checked == checked == previous['snapshot_readonly'],\\n 'offline admin altered frozen snapshot proof')\\n private(snapshot)\\n require(sha(snapshot) == previous['snapshot_sha256'], 'original protected snapshot changed during drill')\\n return {'all_checks_pass': True, 'offline_volume': VOLUME, 'offline_readonly': checked,\\n 'offline_post_admin_readonly': post_checked, 'original_snapshot_hash_unchanged': True,\\n 'created_volume_identity': identity,\\n 'admin_counts': admin_counts, 'network': 'none', 'runtime_tokens_or_config_mounted': False,\\n 'service_entrypoint_started': False, 'original_snapshot_retained': True}\\n\\n\\ndef cleanup_offline(journal):\\n inspected = docker(['volume', 'inspect', VOLUME])\\n require(inspected.returncode == 0, 'owned disposable volume identity unverified')\\n value = json.loads(inspected.stdout)\\n expected = journal.data['phases']['offline-verify']['result']['created_volume_identity']\\n require(len(value) == 1 and {key: value[0].get(key) for key in expected} == expected\\n and not value[0].get('Options'), 'volume ownership/recreation changed')\\n removed = docker(['volume', 'rm', VOLUME])\\n require(removed.returncode == 0 and removed.stdout.strip() == VOLUME\\n and docker(['volume', 'inspect', VOLUME]).returncode != 0,\\n 'cleanup outcome ambiguous; do not retry')\\n return {'all_checks_pass': True, 'only_disposable_offline_volume_removed': VOLUME,\\n 'native_and_offcluster_original_snapshots_retained': True}\\n\\n\\ndef main():\\n parser = argparse.ArgumentParser(description=__doc__)\\n parser.add_argument('--phase', choices=PHASES, required=True)\\n parser.add_argument('--root-authority-receipt', type=Path, required=True)\\n parser.add_argument('--root-native-outcome', type=Path, required=True)\\n parser.add_argument('--source-revision', required=True)\\n args = parser.parse_args()\\n require(args.root_authority_receipt == Path('/tmp/security-infd-purpose-root-authority.json')\\n and args.root_native_outcome == Path('/tmp/security-infd-purpose-native-outcome-latest.json'),\\n 'fixed supervised receipt paths required')\\n require(re.fullmatch(r'[0-9a-f]{40}', args.source_revision) is not None, 'exact source commit required')\\n # Verify all prepared executor/input bytes before reading authority or dispatching.\\n plan = json.loads((ROOT / 'execution-plan.json').read_text())\\n require(set(plan['executor_files']) == {'actuator.py', 'authority_journal.py', 'native_program.py', 'receipt_safety.py'},\\n 'fixed executor sources required')\\n require(set(plan['owner_source_files']) == {'deploy/lifecycle/admission.candidate.json',\\n 'deploy/lifecycle/service.candidate.json',\\n 'deploy/lifecycle/kustomization.yaml',\\n 'deploy/lifecycle/registries.candidate.json'},\\n 'fixed owner image sources required')\\n for relative, digest in plan['executor_files'].items():\\n target = ROOT / relative\\n require(not target.is_symlink() and sha(target) == digest, 'executor source bytes changed')\\n for relative, digest in plan['case_files'].items():\\n require(not Path(relative).is_absolute() and '..' not in Path(relative).parts,\\n 'case source path escaped')\\n target = CASE / relative\\n require(not target.is_symlink() and sha(target) == digest, 'case source bytes changed')\\n for relative, digest in plan['owner_source_files'].items():\\n target = OWNER / relative\\n require(not target.is_symlink() and sha(target) == digest, 'owner image-only source changed')\\n committed = subprocess.run(['git', '-C', str(OWNER), 'show', args.source_revision + ':' + relative],\\n capture_output=True)\\n require(committed.returncode == 0 and hashlib.sha256(committed.stdout).hexdigest() == digest,\\n 'committed owner render source differs from approved inputs')\\n head = run(['git', '-C', str(OWNER), 'rev-parse', 'HEAD'])\\n require(head.returncode == 0 and head.stdout.strip() == args.source_revision, 'owner source HEAD differs')\\n from authority_journal import Journal, authority\\n private(args.root_authority_receipt)\\n private(args.root_native_outcome)\\n receipt = json.loads(args.root_authority_receipt.read_text())\\n require(receipt.get('native_outcome_sha256') == sha(args.root_native_outcome), 'native outcome bytes changed')\\n require(receipt.get('executor_plan_sha256') == sha(ROOT / 'execution-plan.json'),\\n 'root verified executor plan differs')\\n approved = authority(receipt, json.loads(args.root_native_outcome.read_text()), sha(CASE / 'memo.json'),\\n args.source_revision, args.phase)\\n parent = CUSTODY.parent\\n private(parent, directory=True)\\n ignored = run(['git', '-C', str(CUSTODIAN), 'check-ignore', '--no-index', str(CUSTODY / 'drill.sqlite')])\\n require(ignored.returncode == 0, 'offcluster custody is not ignored')\\n if not CUSTODY.exists():\\n require(args.phase == 'drill-backup', 'first approved phase must create unique private custody')\\n os.mkdir(CUSTODY, 0o700)\\n private(CUSTODY, directory=True)\\n capacity = os.statvfs(CUSTODY)\\n require(capacity.f_bavail * capacity.f_frsize >= 2 * MAX_BYTES + 16 * 1024**2,\\n 'independent protected custody headroom insufficient')\\n os.makedirs(CUSTODY / 'empty-docker-config', mode=0o700, exist_ok=True)\\n private(CUSTODY / 'empty-docker-config', directory=True)\\n require(not list((CUSTODY / 'empty-docker-config').iterdir()), 'public Docker read config must stay empty')\\n journal = Journal(CUSTODY, {'proposal': plan['proposal_id'], 'source_revision': args.source_revision,\\n 'memo_sha256': sha(CASE / 'memo.json'), 'plan_sha256': sha(ROOT / 'execution-plan.json')})\\n try:\\n journal.start(args.phase, approved) # fsynced RUNNING before any phase effect.\\n if args.phase in ('drill-copy', 'cutover-copy'):\\n result = copy_snapshot(args.phase, args.source_revision, approved, journal)\\n elif args.phase == 'offline-verify':\\n result = offline_verify(journal)\\n elif args.phase == 'cleanup-offline':\\n result = cleanup_offline(journal)\\n else:\\n result = remote(args.phase, args.source_revision, approved)\\n journal.finish(args.phase, result)\\n print(json.dumps(result)) # Only count/hash/identity receipts, never snapshot bytes.\\n except BaseException as error:\\n safe = {'all_checks_pass': False, 'phase': args.phase, 'failure_class': type(error).__name__,\\n 'failure': 'fixed phase outcome uncertain; original evidence retained; no retry',\\n 'raw_output_withheld': True}\\n if journal.data['phases'].get(args.phase, {}).get('state') == 'RUNNING':\\n journal.finish(args.phase, safe)\\n print(json.dumps(safe))\\n raise SystemExit(1) from None\\n finally:\\n journal.close()\\n\\n\\nif __name__ == '__main__':\\n try:\\n main()\\n except Exception:\\n raise SystemExit('supervised execution refused before phase; raw output withheld') from None\\n\"\n },\n \"authority_journal.py\": {\n \"sha256\": \"74d6a91169296a99fa7dac2d0902567280f910af743580ec4b454f2abf8374aa\",\n \"content\": \"\\\"\\\"\\\"Supervised receipt bookkeeping, not an authenticated approval provider.\\\"\\\"\\\"\\nimport datetime\\nimport fcntl\\nimport hashlib\\nimport json\\nimport os\\nimport re\\nfrom pathlib import Path\\nimport stat\\nimport uuid\\n\\nFOUNDER = {'kind': 'person', 'sub': 'uid=platform-root,ou=people,dc=netkingdom,dc=local'}\\nMEMO_ID = 'infd-20261011-purpose-overlay-r1'\\nPROPOSAL = 'INFD-WP-0009-T04/purpose-overlay-v1'\\nPHASES = ('drill-backup', 'drill-copy', 'offline-verify', 'cleanup-offline',\\n 'cutover-backup', 'cutover-copy', 'release', 'verify', 'rollback', 'rollback-verify')\\n\\n\\ndef require(value, reason):\\n if not value:\\n raise ValueError(reason)\\n\\n\\ndef sha(path):\\n digest = hashlib.sha256()\\n with Path(path).open('rb') as stream:\\n for block in iter(lambda: stream.read(1024**2), b''):\\n digest.update(block)\\n return digest.hexdigest()\\n\\n\\ndef private(path, directory=False):\\n info = Path(path).lstat()\\n require((stat.S_ISDIR(info.st_mode) if directory else stat.S_ISREG(info.st_mode))\\n and info.st_uid == os.getuid() and stat.S_IMODE(info.st_mode) == (0o700 if directory else 0o600)\\n and (directory or info.st_nlink == 1), 'private owned custody required')\\n\\n\\ndef authority(receipt, outcome, memo_sha, source_revision, phase, now=None):\\n \\\"\\\"\\\"Root must freshly verify native outcome at fixed ORIGIN outside this helper.\\n\\n Receipt files/flags are not signed grants. This function checks the exact\\n supervised receipt relation; existing harness/founder authority remains the\\n actual permission boundary. It never authenticates a caller as human.\\n \\\"\\\"\\\"\\n now = now or datetime.datetime.now(datetime.timezone.utc)\\n require(phase in PHASES, 'fixed phase required')\\n require(receipt.get('proposal_id') == PROPOSAL and receipt.get('memo_id') == MEMO_ID\\n and receipt.get('memo_version') == 1 and receipt.get('memo_sha256') == memo_sha\\n and receipt.get('source_revision') == source_revision\\n and receipt.get('activation') == 'APPROVED'\\n and receipt.get('authority_mode') == 'ADMINISTER'\\n and receipt.get('target') == 'realm:kubernetes/railiance01/informed-decision'\\n and receipt.get('verification_method') == 'root-fixed-origin-native-readback'\\n and receipt.get('runtime_authenticated_grant') is False,\\n 'exact externally verified supervised receipt required')\\n verified = datetime.datetime.fromisoformat(receipt['verified_at'].replace('Z', '+00:00'))\\n require(verified.tzinfo is not None and 0 <= (now - verified).total_seconds() <= 120,\\n 'fresh root native readback required before every phase')\\n deadline = datetime.datetime.fromisoformat('2026-10-12T23:59:59+00:00')\\n require(now < deadline, 'approved execution window expired')\\n require(outcome.get('memo_id') == MEMO_ID and outcome.get('review', {}).get('stale') is False\\n and outcome['review'].get('intake_state') == 'ready', 'native review is not ready/current')\\n review_id = outcome['review']['memo_id']\\n require(review_id == receipt.get('review_memo_id'), 'native review identity changed')\\n accepted = [x for x in outcome.get('dispositions', [])\\n if x.get('submission_state') == 'confirmed'\\n and x.get('disposition', {}).get('verb') == 'accept'\\n and x['disposition'].get('memo_version') == 1]\\n require(len(accepted) == 1, 'one confirmed founder acceptance required')\\n accepted = accepted[0]['disposition']\\n require(accepted.get('actor') == FOUNDER and accepted.get('memo_id') == review_id\\n and accepted.get('approval_id') == receipt.get('approval_id')\\n and accepted.get('id') == receipt.get('disposition_id')\\n and accepted.get('at') == receipt.get('accepted_at'), 'exact founder disposition mismatch')\\n require(re.fullmatch(r'[a-f0-9-]{36}', accepted['approval_id']) is not None\\n and re.fullmatch(r'disp-[a-f0-9-]{36}', accepted['id']) is not None\\n and re.fullmatch(r'review-[a-f0-9-]{36}', review_id) is not None,\\n 'native disposition identifiers are malformed')\\n accepted_at = datetime.datetime.fromisoformat(accepted['at'].replace('Z', '+00:00'))\\n require(accepted_at.tzinfo is not None and accepted_at <= verified, 'acceptance time not bounded')\\n return {key: receipt[key] for key in ('approval_id', 'disposition_id', 'accepted_at', 'verified_at')}\\n\\n\\nclass Journal:\\n def __init__(self, parent, identity):\\n self.parent = Path(parent)\\n private(self.parent, directory=True)\\n self.path = self.parent / 'execution-journal.json'\\n self.lock = os.open(self.parent / 'execution.lock', os.O_CREAT | os.O_NOFOLLOW | os.O_RDWR, 0o600)\\n fcntl.flock(self.lock, fcntl.LOCK_EX | fcntl.LOCK_NB)\\n private(self.parent / 'execution.lock')\\n if self.path.exists():\\n private(self.path)\\n self.data = json.loads(self.path.read_text())\\n require(self.data['identity'] == identity, 'journal case/source identity changed')\\n else:\\n self.data = {'identity': identity, 'phases': {}}\\n self.save()\\n\\n def save(self):\\n temporary = self.parent / 'execution-journal.new'\\n fd = os.open(temporary, os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW | os.O_WRONLY, 0o600)\\n try:\\n with os.fdopen(fd, 'w') as stream:\\n json.dump(self.data, stream, indent=2)\\n stream.write('\\\\n')\\n stream.flush()\\n os.fsync(stream.fileno())\\n os.replace(temporary, self.path)\\n directory = os.open(self.parent, os.O_DIRECTORY | os.O_RDONLY)\\n try:\\n os.fsync(directory)\\n finally:\\n os.close(directory)\\n except BaseException:\\n # Retain evidence rather than overwriting an uncertain durable intent.\\n raise\\n\\n def start(self, phase, approval):\\n require(phase not in self.data['phases'], 'already attempted phase; no retry')\\n predecessors = dict(zip(PHASES[1:8], PHASES[:7]))\\n predecessors['rollback-verify'] = 'rollback'\\n if phase in predecessors:\\n require(self.data['phases'].get(predecessors[phase], {}).get('state') == 'COMPLETE',\\n 'preceding phase is not verified complete')\\n if phase == 'rollback':\\n require('release' in self.data['phases'], 'rollback requires a recorded release attempt')\\n self.data['phases'][phase] = {'state': 'RUNNING', 'approval': approval,\\n 'attempt_id': str(uuid.uuid4()),\\n 'started_at': datetime.datetime.now(datetime.timezone.utc).isoformat()}\\n self.save()\\n\\n def note(self, phase, key, value):\\n require(self.data['phases'][phase]['state'] == 'RUNNING', 'phase intent missing')\\n self.data['phases'][phase][key] = value\\n self.save()\\n\\n def finish(self, phase, result):\\n entry = self.data['phases'][phase]\\n require(entry['state'] == 'RUNNING', 'phase intent missing')\\n entry['result'] = result\\n entry['state'] = 'COMPLETE' if result.get('all_checks_pass') is True else 'UNCERTAIN'\\n self.save()\\n\\n def close(self):\\n os.close(self.lock)\\n\"\n },\n \"execution-plan.json\": {\n \"sha256\": \"f5e5fa906ff19d3a45d10dcdb2810373ae21f9cf44c0472ff2bd47d3bc3328d6\",\n \"content\": \"{\\n \\\"kind\\\": \\\"informed-decision.supervised-mechanical-release-plan\\\",\\n \\\"version\\\": 1,\\n \\\"proposal_id\\\": \\\"INFD-WP-0009-T04/purpose-overlay-v1\\\",\\n \\\"trial_id\\\": \\\"infd-purpose-20261011-r1\\\",\\n \\\"state\\\": \\\"prepared-unapproved\\\",\\n \\\"executor_files\\\": {\\n \\\"actuator.py\\\": \\\"6b9d6439862454f261ee77f05b26519f8109599b1f67078bc4e1f7c7c4061ba5\\\",\\n \\\"authority_journal.py\\\": \\\"74d6a91169296a99fa7dac2d0902567280f910af743580ec4b454f2abf8374aa\\\",\\n \\\"native_program.py\\\": \\\"349f516a4e55f7fb47470144ce781a665fb003ebff380d054f642b22133d1cde\\\",\\n \\\"receipt_safety.py\\\": \\\"5c54373f2dc4b064008225c186efb1d5afdeec36d15350bda0a12ded97602d1b\\\"\\n },\\n \\\"case_files\\\": {\\n \\\"change_guard.py\\\": \\\"f348e449c49f4d9e49af9e82e01764e7197837fd3df9d756f5891d9b8d9b38be\\\",\\n \\\"sqlite_readonly.py\\\": \\\"eef53dd233eee74c17f20823bd7f5787c60cad79ac648021c9479643c6ce9e38\\\",\\n \\\"preflight-inputs.json\\\": \\\"756e72da9ec36572242421bea8b6d2285394e334f991db5e90e9b409563b5f06\\\",\\n \\\"sealed-live-deployment.json\\\": \\\"d18d27063d06f535ae884ea01f96747fe301685518ab94b1cba072a1e1519362\\\",\\n \\\"sealed-native-dependencies.json\\\": \\\"042327a036ed254cf95dbeb0c056ac25b03a6a844b95a332c992df2943691369\\\",\\n \\\"candidate-deployment.json\\\": \\\"722a8e2dc52bec217bf960e23b2fddfc7ac27d343ac8743790e3183db81a6a0e\\\",\\n \\\"rollback-deployment.json\\\": \\\"39b3f43bb84ef4921cc3a1fbcdc444610741ed8809149d8f8f17ed805f262121\\\",\\n \\\"check_installed.py\\\": \\\"a34a51be9c9f2b16a06a88173b5c6c492c9957fe021cf412a86a1737730640ad\\\",\\n \\\"published-verification.json\\\": \\\"8a676c38f89f9ca762b8ebe945b5acb90d47a4cb350692687abb985bbb2d8ae2\\\",\\n \\\"security-summary.json\\\": \\\"0ee56400dc703f7c9968c2a0a3ea0390d8362f8d0bbf8002a2bd7fa58f19cb44\\\"\\n },\\n \\\"owner_source_files\\\": {\\n \\\"deploy/lifecycle/admission.candidate.json\\\": \\\"92382a56b349c3b895e5806e975082527bb99d1a001140e69d857e5b0391fa55\\\",\\n \\\"deploy/lifecycle/service.candidate.json\\\": \\\"38b78b9cbee5ade7750a58d5156ca4c5773352e947acb304ee714b59e749ceb4\\\",\\n \\\"deploy/lifecycle/kustomization.yaml\\\": \\\"1bbce81bc6758434354157f8601534320c5d0290587908fd15a6d25e3fa57f47\\\",\\n \\\"deploy/lifecycle/registries.candidate.json\\\": \\\"9bad6db5fbc2178d31b04120016a41830c3552fbb9e2517b718f9bbe87cf649e\\\"\\n },\\n \\\"candidate_image\\\": \\\"forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a\\\",\\n \\\"prior_image\\\": \\\"forgejo.coulomb.social/coulomb/informed-decision@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173\\\",\\n \\\"source_revision\\\": \\\"must-be-exact-final-owner-HEAD-with-approved-four-Git-blobs\\\",\\n \\\"phases\\\": [\\n \\\"drill-backup\\\",\\n \\\"drill-copy\\\",\\n \\\"offline-verify\\\",\\n \\\"cleanup-offline\\\",\\n \\\"cutover-backup\\\",\\n \\\"cutover-copy\\\",\\n \\\"release\\\",\\n \\\"verify\\\",\\n \\\"rollback\\\",\\n \\\"rollback-verify\\\"\\n ],\\n \\\"authorization\\\": \\\"fresh externally authenticated root fixed-origin native readback before each phase; exact confirmed platform-root disposition and current packet SHA/source commit; receipt bookkeeping is not an autonomous signed grant\\\",\\n \\\"execute_by\\\": \\\"2026-10-12T23:59:59Z\\\",\\n \\\"raw_output_withheld\\\": true,\\n \\\"native_data_or_workload_action_executed\\\": false,\\n \\\"deadline_semantics\\\": \\\"All phases including verification/recovery must begin before execute_by. No extension or automatic emergency grant; beyond deadline stop and obtain a fresh founder decision. Complete the bounded drill and rollout early enough to allow recovery within the window.\\\"\\n}\\n\"\n },\n \"native_program.py\": {\n \"sha256\": \"349f516a4e55f7fb47470144ce781a665fb003ebff380d054f642b22133d1cde\",\n \"content\": \"\\\"\\\"\\\"Fixed remote source, passed only after exact supervised approval.\\\"\\\"\\\"\\nPROGRAM = '\\\\nimport copy,datetime,hashlib,json,os,re,subprocess,sys\\\\nif sys.flags.optimize:raise RuntimeError(\\\\'optimized interpreter refused\\\\')\\\\npayload=json.loads(__PAYLOAD__)\\\\nexec(__GUARD__)\\\\nphase=payload[\\\\'phase\\\\']\\\\nif phase not in (\\\\'drill-backup\\\\',\\\\'cutover-backup\\\\',\\\\'drill-copy\\\\',\\\\'cutover-copy\\\\',\\\\'release\\\\',\\\\'verify\\\\',\\\\'rollback\\\\',\\\\'rollback-verify\\\\'):raise ValueError(\\\\'fixed native phase required\\\\')\\\\ndeadline=datetime.datetime.fromisoformat(\\\\'2026-10-12T23:59:59+00:00\\\\')\\\\ndef require(value,reason):\\\\n if not value:raise ValueError(reason)\\\\nrequire(datetime.datetime.now(datetime.timezone.utc)<deadline,\\\\'execution window expired\\\\')\\\\nenv={**os.environ,\\\\'KUBECONFIG\\\\':\\\\'/etc/rancher/k3s/k3s.yaml\\\\'}\\\\ndef run(argv,body=None,timeout=90):\\\\n return subprocess.run(argv,input=body,text=True,capture_output=True,timeout=timeout,env=env)\\\\ndef read(kind,name,namespace):\\\\n result=run([\\\\'kubectl\\\\',\\\\'get\\\\',kind,name,\\\\'-n\\\\',namespace,\\\\'-o\\\\',\\\\'json\\\\'])\\\\n require(result.returncode==0,\\\\'fixed metadata read refused\\\\')\\\\n return json.loads(result.stdout)\\\\nsealed=payload[\\\\'sealed\\\\']; dependencies=payload[\\\\'dependencies\\\\']\\\\nlive=read(\\\\'deployment\\\\',\\\\'informed-decision\\\\',\\\\'informed-decision\\\\')\\\\ncm=read(\\\\'configmap\\\\',\\\\'informed-decision-runtime-6c221878d051\\\\',\\\\'informed-decision\\\\')\\\\npvc=read(\\\\'pvc\\\\',\\\\'informed-decision-data\\\\',\\\\'informed-decision\\\\')\\\\ncheck_dependencies(cm,pvc,dependencies)\\\\napp=read(\\\\'application\\\\',\\\\'informed-decision\\\\',\\\\'argocd\\\\')\\\\nrequire(app[\\\\'metadata\\\\'][\\\\'uid\\\\']==\\\\'499868f2-eabc-4df4-ae31-b89ce58d750d\\\\',\\\\'Application UID changed\\\\')\\\\nrequire(app[\\\\'spec\\\\'][\\\\'source\\\\'][\\\\'repoURL\\\\']==\\\\'https://forgejo.coulomb.social/coulomb/informed-decision.git\\\\'\\\\n and app[\\\\'spec\\\\'][\\\\'source\\\\'][\\\\'path\\\\']==\\\\'deploy/lifecycle\\\\'\\\\n and app[\\\\'spec\\\\'][\\\\'destination\\\\']=={\\\\'namespace\\\\':\\\\'informed-decision\\\\',\\\\'server\\\\':\\\\'https://kubernetes.default.svc\\\\'}\\\\n and app[\\\\'spec\\\\'].get(\\\\'syncPolicy\\\\',{}).get(\\\\'automated\\\\') is None\\\\n and set(app[\\\\'spec\\\\'][\\\\'source\\\\'])=={\\\\'repoURL\\\\',\\\\'path\\\\',\\\\'targetRevision\\\\'} and not app[\\\\'spec\\\\'].get(\\\\'sources\\\\'),\\\\'Application owner/scope changed\\\\')\\\\nexpected=copy.deepcopy(sealed)\\\\nif phase==\\\\'verify\\\\':expected[\\\\'spec\\\\'][\\\\'template\\\\'][\\\\'spec\\\\'][\\\\'containers\\\\'][0][\\\\'image\\\\']=CANDIDATE\\\\nif phase==\\\\'rollback\\\\':\\\\n image=live[\\\\'spec\\\\'][\\\\'template\\\\'][\\\\'spec\\\\'][\\\\'containers\\\\'][0][\\\\'image\\\\']\\\\n require(image in (BASE,CANDIDATE),\\\\'rollback image is outside same-schema pair\\\\')\\\\n expected[\\\\'spec\\\\'][\\\\'template\\\\'][\\\\'spec\\\\'][\\\\'containers\\\\'][0][\\\\'image\\\\']=image\\\\ncheck_current(live,expected)\\\\nif phase!=\\\\'rollback\\\\':\\\\n require(live.get(\\\\'status\\\\',{}).get(\\\\'readyReplicas\\\\')==1\\\\n and live[\\\\'status\\\\'].get(\\\\'updatedReplicas\\\\')==1\\\\n and live[\\\\'status\\\\'].get(\\\\'observedGeneration\\\\')==live[\\\\'metadata\\\\'][\\\\'generation\\\\'],\\\\'service not Ready1\\\\')\\\\ntarget=payload[\\\\'source_revision\\\\'] if phase==\\\\'verify\\\\' else \\\\'7db8485ffecdebfabd77a9daec085553c74bf0bf\\\\'\\\\nif phase==\\\\'rollback\\\\':require(app[\\\\'spec\\\\'][\\\\'source\\\\'][\\\\'targetRevision\\\\'] in (target,payload[\\\\'source_revision\\\\']),\\\\'rollback source is outside pair\\\\')\\\\nelse:require(app[\\\\'spec\\\\'][\\\\'source\\\\'][\\\\'targetRevision\\\\']==target,\\\\'unexpected source pin\\\\')\\\\nresult={\\\\'phase\\\\':phase,\\\\'all_checks_pass\\\\':False,\\\\'raw_output_withheld\\\\':True,\\\\n \\\\'native_approval_verified_by_root\\\\':payload[\\\\'approval\\\\'],\\\\'native_authenticated_grant\\\\':False}\\\\ntry:\\\\n if phase in (\\\\'drill-backup\\\\',\\\\'cutover-backup\\\\',\\\\'drill-copy\\\\',\\\\'cutover-copy\\\\',\\\\'release\\\\',\\\\'verify\\\\',\\\\'rollback-verify\\\\'):\\\\n podlist=run([\\\\'kubectl\\\\',\\\\'get\\\\',\\\\'pods\\\\',\\\\'-n\\\\',\\\\'informed-decision\\\\',\\\\'-l\\\\',\\\\'app.kubernetes.io/name=informed-decision\\\\',\\\\'-o\\\\',\\\\'json\\\\'])\\\\n require(podlist.returncode==0,\\\\'pod metadata query refused\\\\')\\\\n pods=[p for p in json.loads(podlist.stdout)[\\\\'items\\\\'] if not p[\\\\'metadata\\\\'].get(\\\\'deletionTimestamp\\\\')]\\\\n require(len(pods)==1,\\\\'exact single live owner pod required\\\\');pod=pods[0]\\\\n require(pod[\\\\'status\\\\'].get(\\\\'phase\\\\')==\\\\'Running\\\\' and len(pod[\\\\'spec\\\\'][\\\\'containers\\\\'])==1\\\\n and pod[\\\\'spec\\\\'][\\\\'containers\\\\'][0][\\\\'image\\\\']==expected[\\\\'spec\\\\'][\\\\'template\\\\'][\\\\'spec\\\\'][\\\\'containers\\\\'][0][\\\\'image\\\\']\\\\n and len(pod[\\\\'status\\\\'].get(\\\\'containerStatuses\\\\',[]))==1\\\\n and pod[\\\\'status\\\\'][\\\\'containerStatuses\\\\'][0].get(\\\\'name\\\\')==\\\\'informed-decision\\\\'\\\\n and pod[\\\\'status\\\\'][\\\\'containerStatuses\\\\'][0].get(\\\\'ready\\\\') is True,\\\\'owner pod readiness/image changed\\\\')\\\\n template=expected[\\\\'spec\\\\'][\\\\'template\\\\'][\\\\'spec\\\\']\\\\n controlled=set(template)|{\\\\'initContainers\\\\',\\\\'hostNetwork\\\\',\\\\'hostPID\\\\',\\\\'hostIPC\\\\',\\\\'runtimeClassName\\\\',\\\\'shareProcessNamespace\\\\'}\\\\n require(all(pod[\\\\'spec\\\\'].get(key)==template.get(key) for key in controlled),\\\\'actual owner Pod configuration drifted\\\\')\\\\n owners=pod[\\\\'metadata\\\\'].get(\\\\'ownerReferences\\\\',[]);require(len(owners)==1 and owners[0][\\\\'kind\\\\']==\\\\'ReplicaSet\\\\',\\\\'pod owner chain changed\\\\')\\\\n rs=read(\\\\'replicaset\\\\',owners[0][\\\\'name\\\\'],\\\\'informed-decision\\\\')\\\\n require(rs[\\\\'metadata\\\\'][\\\\'uid\\\\']==owners[0][\\\\'uid\\\\'] and any(o.get(\\\\'uid\\\\')==sealed[\\\\'metadata\\\\'][\\\\'uid\\\\']\\\\n and o.get(\\\\'kind\\\\')==\\\\'Deployment\\\\' for o in rs[\\\\'metadata\\\\'].get(\\\\'ownerReferences\\\\',[])),\\\\'ReplicaSet ownership changed\\\\')\\\\n inner=r\\\"\\\"\\\"\\\\nimport hashlib,json,os,stat,subprocess,sys\\\\nif sys.flags.optimize:raise RuntimeError(\\\\'optimized interpreter refused\\\\')\\\\nexec(__READONLY__)\\\\nexec(__SAFETY__)\\\\naction=__ACTION__;db=\\\\'/data/private/review.sqlite\\\\';folder=\\\\'/data/private/purpose-overlay-r1\\\\'\\\\ndef require(v,r):\\\\n if not v:raise ValueError(r)\\\\nrequire(os.getuid()==10001 and os.getgid()==10001,\\\\'native owner UID/GID required\\\\')\\\\ndef private(p,directory=False):\\\\n s=os.lstat(p);require((stat.S_ISDIR(s.st_mode) if directory else stat.S_ISREG(s.st_mode))\\\\n and s.st_uid==10001 and stat.S_IMODE(s.st_mode)==(0o700 if directory else 0o600)\\\\n and (directory or s.st_nlink==1),\\\\'private native custody required\\\\')\\\\nprivate(\\\\'/data/private\\\\',True);private(db)\\\\nbaseline=counts(inspect_readonly(db)) # MUST precede any Store/admin open.\\\\nif action in (\\\\'drill-backup\\\\',\\\\'cutover-backup\\\\'):\\\\n size=os.stat(db).st_size\\\\n if os.path.exists(db+\\\\'-wal\\\\'):size+=os.stat(db+\\\\'-wal\\\\').st_size\\\\n v=os.statvfs(\\\\'/data/private\\\\');free=v.f_bavail*v.f_frsize\\\\n require(size>0 and size<=512*1024**2 and free>=size*(2 if action==\\\\'drill-backup\\\\' else 1)+16*1024**2,\\\\'bounded native snapshot capacity required\\\\')\\\\n if action==\\\\'drill-backup\\\\':\\\\n require(not os.path.lexists(folder),\\\\'native case directory must be unique\\\\')\\\\n os.mkdir(folder,0o700);os.chmod(folder,0o700)\\\\n private(folder,True)\\\\n filename=\\\\'drill.sqlite\\\\' if action==\\\\'drill-backup\\\\' else \\\\'cutover.sqlite\\\\';output=folder+\\\\'/\\\\'+filename\\\\n require(not os.path.lexists(output),\\\\'snapshot output must be unique\\\\')\\\\n admin=subprocess.run([\\\\'informed-decision-admin\\\\',\\\\'backup\\\\',\\\\'--db\\\\',db,\\\\'--output\\\\',output],capture_output=True,text=True,timeout=120)\\\\n require(admin.returncode==0 and json.loads(admin.stdout)=={\\\\'status\\\\':\\\\'backed_up\\\\',\\\\'consistent_snapshot\\\\':True},\\\\'backup completion not verified; do not retry\\\\')\\\\n private(output)\\\\n for suffix in (\\\\'-wal\\\\',\\\\'-shm\\\\'):\\\\n require(not os.path.exists(output+suffix) or os.stat(output+suffix).st_size==0,\\\\'snapshot is not closed main-file custody\\\\')\\\\n snapshot=counts(inspect_readonly(output))\\\\n size=os.stat(output).st_size;require(0<size<=512*1024**2,\\\\'snapshot outside bounded copy size\\\\')\\\\n digest=hashlib.sha256()\\\\n with open(output,\\\\'rb\\\\') as stream:\\\\n for block in iter(lambda:stream.read(1024**2),b\\\\'\\\\'):digest.update(block)\\\\n print(json.dumps({\\\\'all_checks_pass\\\\':True,\\\\'source_readonly_baseline\\\\':baseline,\\\\'snapshot_readonly\\\\':snapshot,\\\\'snapshot_sha256\\\\':digest.hexdigest(),\\\\'snapshot_bytes\\\\':size,\\\\'snapshot_file\\\\':filename,\\\\'native_parent_private\\\\':True,\\\\'native_uid\\\\':os.getuid()}))\\\\nelif action in (\\\\'verify\\\\',\\\\'release\\\\',\\\\'rollback-verify\\\\'):\\\\n proof={\\\\'all_checks_pass\\\\':True,\\\\'live_readonly_schema_integrity_counts\\\\':baseline,\\\\'live_counts_may_include_concurrent_commits\\\\':True}\\\\n if action==\\\\'verify\\\\':\\\\n import urllib.request\\\\n module=\\\\'/opt/venv/lib/python3.12/site-packages/informed_decision/policy.py\\\\';info=os.lstat(module)\\\\n require(stat.S_ISREG(info.st_mode) and info.st_uid==0 and stat.S_IMODE(info.st_mode)==0o644,\\\\'installed policy metadata differs\\\\')\\\\n with open(module,\\\\'rb\\\\') as source:module_digest=hashlib.sha256(source.read()).hexdigest()\\\\n require(module_digest==\\\\'9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62\\\\',\\\\'installed source module differs\\\\')\\\\n purpose=subprocess.run([sys.executable,\\\\'-\\\\'],input=__PURPOSE__,text=True,capture_output=True,timeout=30)\\\\n require(purpose.returncode==0,\\\\'installed native-placement purpose checks failed\\\\')\\\\n tested=json.loads(purpose.stdout)\\\\n require(tested=={\\\\'installed_image_purpose_variants\\\\':10,\\\\'binding_forms_allowed\\\\':2,\\\\'advisory_or_malformed_refused\\\\':8,\\\\'synthetic_only\\\\':True,\\\\'native_provider\\\\':False},\\\\'purpose result differs\\\\')\\\\n class NoRedirect(urllib.request.HTTPRedirectHandler):\\\\n def redirect_request(self,*args,**kwargs):raise ValueError(\\\\'health redirect refused\\\\')\\\\n opener=urllib.request.build_opener(NoRedirect());statuses={}\\\\n for route in (\\\\'/healthz\\\\',\\\\'/readyz\\\\'):\\\\n with opener.open(\\\\'http://127.0.0.1:8080\\\\'+route,timeout=10) as response:\\\\n require(response.status==200 and len(response.read(8193))<=8192,\\\\'bounded health check refused\\\\');statuses[route]=200\\\\n proof.update(installed_purpose_checks=tested,policy_sha256=module_digest,policy_mode=\\\\'0644\\\\',policy_uid=0,health_statuses=statuses,native_provider_probe=False)\\\\n print(json.dumps(proof))\\\\nelif action in (\\\\'drill-copy\\\\',\\\\'cutover-copy\\\\'):\\\\n private(folder,True);filename=\\\\'drill.sqlite\\\\' if action==\\\\'drill-copy\\\\' else \\\\'cutover.sqlite\\\\';output=folder+\\\\'/\\\\'+filename;private(output)\\\\n for suffix in (\\\\'-wal\\\\',\\\\'-shm\\\\'):\\\\n require(not os.path.exists(output+suffix) or os.stat(output+suffix).st_size==0,\\\\'closed main snapshot required\\\\')\\\\n snapshot=counts(inspect_readonly(output));size=os.stat(output).st_size;require(0<size<=512*1024**2,\\\\'snapshot size outside bound\\\\')\\\\n digest=hashlib.sha256()\\\\n with open(output,\\\\'rb\\\\') as stream:\\\\n for block in iter(lambda:stream.read(1024**2),b\\\\'\\\\'):digest.update(block)\\\\n print(json.dumps({\\\\'all_checks_pass\\\\':True,\\\\'snapshot_file\\\\':filename,\\\\'snapshot_bytes\\\\':size,\\\\'snapshot_sha256\\\\':digest.hexdigest(),\\\\'snapshot_readonly\\\\':snapshot}))\\\\nelse:raise ValueError(\\\\'fixed native backup/verify phase required\\\\')\\\\n\\\"\\\"\\\"\\\\n # Strip the CLI branch: exec only the verified stdlib function, never Store.\\\\n readonly=payload[\\\\'readonly\\\\'].split(\\\"if __name__ == \\\\'__main__\\\\':\\\",1)[0]\\\\n inner=inner.replace(\\\\'__READONLY__\\\\',repr(readonly)).replace(\\\\'__SAFETY__\\\\',repr(payload[\\\\'receipt_safety\\\\'])).replace(\\\\'__ACTION__\\\\',repr(phase)).replace(\\\\'__PURPOSE__\\\\',repr(payload[\\\\'purpose_checks\\\\']))\\\\n p=run([\\\\'kubectl\\\\',\\\\'exec\\\\',\\\\'-i\\\\',\\\\'-n\\\\',\\\\'informed-decision\\\\',pod[\\\\'metadata\\\\'][\\\\'name\\\\'],\\\\'-c\\\\',\\\\'informed-decision\\\\',\\\\'--\\\\',\\\\'python\\\\',\\\\'-\\\\'],inner,150)\\\\n require(p.returncode==0,\\\\'native phase outcome unverified; raw output withheld, do not retry\\\\')\\\\n outcome=json.loads(p.stdout);require(outcome.get(\\\\'all_checks_pass\\\\') is True,\\\\'native phase gate refused\\\\')\\\\n result.update(outcome,pod_name=pod[\\\\'metadata\\\\'][\\\\'name\\\\'],pod_uid=pod[\\\\'metadata\\\\'][\\\\'uid\\\\'])\\\\n if phase in (\\\\'release\\\\',\\\\'rollback\\\\'):\\\\n node_read=run([\\\\'kubectl\\\\',\\\\'get\\\\',\\\\'nodes\\\\',\\\\'-o\\\\',\\\\'json\\\\']);require(node_read.returncode==0,\\\\'node metadata unavailable\\\\')\\\\n nodes=json.loads(node_read.stdout)[\\\\'items\\\\'];require(len(nodes)==1,\\\\'one target node required\\\\');node=nodes[0]\\\\n require(any(a.get(\\\\'address\\\\')==\\\\'92.205.62.239\\\\' for a in node[\\\\'status\\\\'][\\\\'addresses\\\\']),\\\\'target node address changed\\\\')\\\\n conditions={c[\\\\'type\\\\']:c[\\\\'status\\\\'] for c in node[\\\\'status\\\\'][\\\\'conditions\\\\']}\\\\n require(conditions.get(\\\\'Ready\\\\')==\\\\'True\\\\' and all(conditions.get(k)==\\\\'False\\\\' for k in (\\\\'MemoryPressure\\\\',\\\\'DiskPressure\\\\',\\\\'PIDPressure\\\\')),\\\\'node unhealthy or pressured\\\\')\\\\n description=run([\\\\'kubectl\\\\',\\\\'describe\\\\',\\\\'node\\\\',node[\\\\'metadata\\\\'][\\\\'name\\\\']]);require(description.returncode==0,\\\\'headroom capture unavailable\\\\')\\\\n table=description.stdout.split(\\\\'Allocated resources:\\\\',1)[1];requested=int(re.search(r\\\\'cpu\\\\\\\\s+(\\\\\\\\d+)m\\\\',table).group(1));alloc=node[\\\\'status\\\\'][\\\\'allocatable\\\\'][\\\\'cpu\\\\'];capacity=int(alloc[:-1]) if alloc.endswith(\\\\'m\\\\') else int(alloc)*1000\\\\n require(requested<=capacity,\\\\'Recreate requested CPU exceeds capacity\\\\')\\\\n require(not app.get(\\\\'operation\\\\') and app.get(\\\\'status\\\\',{}).get(\\\\'operationState\\\\',{}).get(\\\\'phase\\\\') not in (\\\\'Running\\\\',\\\\'Terminating\\\\'),\\\\'existing Argo operation must be settled\\\\')\\\\n destination=payload[\\\\'source_revision\\\\'] if phase==\\\\'release\\\\' else \\\\'7db8485ffecdebfabd77a9daec085553c74bf0bf\\\\'\\\\n body=copy.deepcopy(payload[\\\\'candidate\\\\'] if phase==\\\\'release\\\\' else payload[\\\\'rollback\\\\'])\\\\n dry=run([\\\\'kubectl\\\\',\\\\'apply\\\\',\\\\'--dry-run=server\\\\',\\\\'-f\\\\',\\\\'-\\\\',\\\\'-o\\\\',\\\\'json\\\\'],json.dumps(body))\\\\n require(dry.returncode==0,\\\\'fresh owner server admission refused\\\\')\\\\n admitted=json.loads(dry.stdout);wanted=copy.deepcopy(sealed)\\\\n wanted[\\\\'spec\\\\'][\\\\'template\\\\'][\\\\'spec\\\\'][\\\\'containers\\\\'][0][\\\\'image\\\\']=CANDIDATE if phase==\\\\'release\\\\' else BASE\\\\n require(projection(admitted)==wanted,\\\\'dry-run changed anything beyond exact image\\\\')\\\\n diff=run([\\\\'kubectl\\\\',\\\\'diff\\\\',\\\\'-f\\\\',\\\\'-\\\\'],json.dumps(body));require(diff.returncode in (0,1),\\\\'client diff unavailable\\\\')\\\\n operation={\\\\'initiatedBy\\\\':{\\\\'username\\\\':\\\\'custodian-codex\\\\'},\\\\'sync\\\\':{\\\\'revision\\\\':destination,\\\\'prune\\\\':False,\\\\n \\\\'resources\\\\':[{\\\\'group\\\\':\\\\'apps\\\\',\\\\'kind\\\\':\\\\'Deployment\\\\',\\\\'name\\\\':\\\\'informed-decision\\\\',\\\\'namespace\\\\':\\\\'informed-decision\\\\'}]}}\\\\n patch=[{\\\\'op\\\\':\\\\'test\\\\',\\\\'path\\\\':\\\\'/metadata/uid\\\\',\\\\'value\\\\':app[\\\\'metadata\\\\'][\\\\'uid\\\\']},\\\\n {\\\\'op\\\\':\\\\'test\\\\',\\\\'path\\\\':\\\\'/metadata/resourceVersion\\\\',\\\\'value\\\\':app[\\\\'metadata\\\\'][\\\\'resourceVersion\\\\']},\\\\n {\\\\'op\\\\':\\\\'test\\\\',\\\\'path\\\\':\\\\'/spec/source/targetRevision\\\\',\\\\'value\\\\':app[\\\\'spec\\\\'][\\\\'source\\\\'][\\\\'targetRevision\\\\']},\\\\n {\\\\'op\\\\':\\\\'replace\\\\',\\\\'path\\\\':\\\\'/spec/source/targetRevision\\\\',\\\\'value\\\\':destination},\\\\n {\\\\'op\\\\':\\\\'add\\\\',\\\\'path\\\\':\\\\'/operation\\\\',\\\\'value\\\\':operation}]\\\\n argv=[\\\\'kubectl\\\\',\\\\'patch\\\\',\\\\'application\\\\',\\\\'informed-decision\\\\',\\\\'-n\\\\',\\\\'argocd\\\\',\\\\'--type=json\\\\',\\\\'--patch-file=/dev/stdin\\\\',\\\\'-o\\\\',\\\\'name\\\\']\\\\n patchdry=run(argv+[\\\\'--dry-run=server\\\\'],json.dumps(patch));require(patchdry.returncode==0,\\\\'Application operation dry-run refused\\\\')\\\\n change=run(argv,json.dumps(patch))\\\\n require(change.returncode==0,\\\\'Application patch outcome ambiguous; do not retry\\\\')\\\\n result.update(all_checks_pass=True,operation_requested=True,source_revision=destination,\\\\n resources=operation[\\\\'sync\\\\'][\\\\'resources\\\\'],prune=False,rollout_verified=False,\\\\n latest_live_database_retained=True,client_diff_sha256=hashlib.sha256(diff.stdout.encode()).hexdigest())\\\\n if phase in (\\\\'verify\\\\',\\\\'rollback-verify\\\\'):\\\\n op=app.get(\\\\'status\\\\',{}).get(\\\\'operationState\\\\',{});sync=op.get(\\\\'operation\\\\',{}).get(\\\\'sync\\\\',{})\\\\n require(op.get(\\\\'phase\\\\')==\\\\'Succeeded\\\\' and sync.get(\\\\'revision\\\\')==target and sync.get(\\\\'prune\\\\') is False\\\\n and sync.get(\\\\'resources\\\\')==[{\\\\'group\\\\':\\\\'apps\\\\',\\\\'kind\\\\':\\\\'Deployment\\\\',\\\\'name\\\\':\\\\'informed-decision\\\\',\\\\'namespace\\\\':\\\\'informed-decision\\\\'}],\\\\'exact native Argo operation completion unverified\\\\')\\\\n require(live[\\\\'status\\\\'].get(\\\\'observedGeneration\\\\')==live[\\\\'metadata\\\\'][\\\\'generation\\\\'],\\\\'controller generation not settled\\\\')\\\\n result.update(native_rollout_verified=True,current_schema5_database_retained=True,recovery_verification=phase==\\\\'rollback-verify\\\\')\\\\nexcept BaseException as error:\\\\n result.update(all_checks_pass=False,failure_class=type(error).__name__,\\\\n failure=\\\\'fixed phase outcome refused or ambiguous; raw output withheld; no retry\\\\')\\\\nprint(json.dumps(result));sys.exit(0 if result.get(\\\\'all_checks_pass\\\\') is True else 1)\\\\n'\\n\"\n },\n \"packet-refinement.json\": {\n \"sha256\": \"ef370a491468df28683f3002cb6e8bbb7e47b65e8e4d02ff4d09e9c39f020c8a\",\n \"content\": \"{\\n \\\"proposal_id\\\": \\\"INFD-WP-0009-T04/purpose-overlay-v1\\\",\\n \\\"prior_reviewed_packet_manifest_sha256\\\": \\\"b1e3e66bc4023dc80c6ea59564c3557c7653fb3c307f46a049997b76198a9033\\\",\\n \\\"kind\\\": \\\"mechanical-actuator-packet-refinement-required-before-first-human-post\\\",\\n \\\"changes\\\": [\\n \\\"Hash-bind all executor bytes/executionplan in amended20doc packet, preserve prior78path technical reviews as history\\\",\\n \\\"Require fresh root fixed-origin confirmed founder receipt before each phase, no signed autonomous grant\\\",\\n \\\"Bind all four committed owner Kustomize input blobs and reject Application source overrides or automated:{}\\\",\\n \\\"Explicit new isolated offline volume UID0/CAP_CHOWN initializer, no host/livePVC/token/config mounts, bounded512MiB private snapshot stream and namedVolume nonce ownership\\\",\\n \\\"Durable per-phase RUNNING before action; no same-phase retries after failures/crash, distinct supervised same-schema rollback retains latestDB\\\",\\n \\\"Actual native pre-open readonlyschema5/integrity/count gate before backup/admin, actual Pod/CM/PVC/source seals, offline pre-open check before admininspect, nativeinstalled10syntheticpurpose checks+boundedlocalhosthealth aftercontrollercompletion\\\"\\n ],\\n \\\"unchanged\\\": [\\n \\\"immutable763c purposeonly image\\\",\\n \\\"ConfigMap6c/runtime/policy pins/audiences/credentials\\\",\\n \\\"Deployment-only manualArgo scoped operation/prunefalse\\\",\\n \\\"existingPVC/singlewriter/Recreate/schema5\\\",\\n \\\"explicit inherited1fixableMED ownerT05 follow-through\\\"\\n ],\\n \\\"native_action_executed\\\": false,\\n \\\"founder_approval\\\": false,\\n \\\"mechanical_review_refinement\\\": {\\n \\\"original_manifest_sha256\\\": \\\"653b68c3891c066f40d104bfc67a35da5e436605cd99afd52fbac4b47a9553fe\\\",\\n \\\"archive\\\": \\\"execution-history/initial-653b68c3\\\",\\n \\\"findings\\\": [\\n \\\"rollback incorrectly depended on Ready candidate and database exec\\\",\\n \\\"offline admin lacked post-open readonly full proof and original snapshot SHA check\\\",\\n \\\"all-phase helper deadline was not disclosed by prior unstarted-release packet wording\\\"\\n ],\\n \\\"resolved_by\\\": [\\n \\\"rollback dispatch excludes Pod metadata/exec entirely; separate rollback-verify proves recovered old-image/schema5 DB\\\",\\n \\\"post-admin UID10001 readonly integrity/schema/count proof equals frozen snapshot; retained original SHA unchanged\\\",\\n \\\"explicit all-phase including recovery/verification deadline and fresh-founder-decision requirement beyond expiry\\\"\\n ],\\n \\\"same_proposal_trial\\\": true,\\n \\\"native_actions_executed\\\": false,\\n \\\"human_acceptance\\\": false\\n }\\n}\\n\"\n },\n \"receipt_safety.py\": {\n \"sha256\": \"5c54373f2dc4b064008225c186efb1d5afdeec36d15350bda0a12ded97602d1b\",\n \"content\": \"\\\"\\\"\\\"Only structural count/hash receipts can leave the private execution phase.\\\"\\\"\\\"\\ndef counts(value):\\n if (set(value) != {'schema_version', 'lifecycle', 'outbox', 'submissions', 'integrity',\\n 'read_only_pre_open', 'store_constructed'}\\n or value['schema_version'] != 5 or value['integrity'] != 'ok'\\n or value['read_only_pre_open'] is not True or value['store_constructed'] is not False\\n or set(value['lifecycle']) != {'records', 'events', 'pending'}\\n or not set(value['outbox']) <= {'pending', 'delivered', 'blocked'}\\n or not set(value['submissions']) <= {'prepared', 'in_flight', 'confirmed', 'unresolved'}):\\n raise ValueError('count-only receipt shape/state refused; values withheld')\\n for group in ('lifecycle', 'outbox', 'submissions'):\\n if any(type(number) is not int or number < 0 or number > 10**12\\n for number in value[group].values()):\\n raise ValueError('count-only receipt values refused')\\n return value\\n\"\n },\n \"root-authority-receipt-template.json\": {\n \"sha256\": \"15966b7c6f088a033baf1fef878ddb351de2fa2ae46b5bc710265ed172ab2813\",\n \"content\": \"{\\n \\\"proposal_id\\\": \\\"INFD-WP-0009-T04/purpose-overlay-v1\\\",\\n \\\"memo_id\\\": \\\"infd-20261011-purpose-overlay-r1\\\",\\n \\\"memo_version\\\": 1,\\n \\\"memo_sha256\\\": null,\\n \\\"source_revision\\\": null,\\n \\\"activation\\\": \\\"PENDING\\\",\\n \\\"authority_mode\\\": \\\"ADMINISTER\\\",\\n \\\"target\\\": \\\"realm:kubernetes/railiance01/informed-decision\\\",\\n \\\"verification_method\\\": \\\"root-fixed-origin-native-readback\\\",\\n \\\"runtime_authenticated_grant\\\": false,\\n \\\"verified_at\\\": null,\\n \\\"accepted_at\\\": null,\\n \\\"review_memo_id\\\": null,\\n \\\"approval_id\\\": null,\\n \\\"disposition_id\\\": null,\\n \\\"native_outcome_sha256\\\": null,\\n \\\"executor_plan_sha256\\\": \\\"4d5530e7418f638b10ccff0e0d9a0727adc64a7f3a45907f6deb5739ad2adc85\\\"\\n}\\n\"\n },\n \"test_execution.py\": {\n \"sha256\": \"9ccf6d421bf20f0e8350f6713d6d1cee2ba199f485dcaf2558c387421d9a2b48\",\n \"content\": \"\\\"\\\"\\\"Synthetic custody/transport tests. No native data, Docker or cluster action.\\\"\\\"\\\"\\nimport copy\\nimport datetime\\nimport io\\nimport json\\nimport os\\nfrom pathlib import Path\\nimport subprocess\\nimport sys\\nimport tempfile\\nimport unittest\\nfrom unittest.mock import patch\\nfrom contextlib import redirect_stdout\\n\\nimport actuator\\nfrom authority_journal import Journal, authority\\nfrom native_program import PROGRAM\\nfrom receipt_safety import counts\\n\\nCASE = Path('/home/worsch/informed-decision/docs/evidence/2026-10-11-purpose-image-release')\\nNOW = datetime.datetime(2026, 10, 11, 2, 0, tzinfo=datetime.timezone.utc)\\nREVISION = 'e' * 40\\nCOUNT = {'schema_version': 5, 'integrity': 'ok', 'read_only_pre_open': True, 'store_constructed': False,\\n 'lifecycle': {'records': 3, 'events': 8, 'pending': 1},\\n 'outbox': {'pending': 2, 'delivered': 10}, 'submissions': {'confirmed': 1, 'unresolved': 1}}\\n\\n\\ndef accepted():\\n approval = '11111111-1111-4111-8111-111111111111'\\n review = 'review-22222222-2222-4222-8222-222222222222'\\n disposition = 'disp-33333333-3333-4333-8333-333333333333'\\n receipt = {'proposal_id': 'INFD-WP-0009-T04/purpose-overlay-v1',\\n 'memo_id': 'infd-20261011-purpose-overlay-r1', 'memo_version': 1,\\n 'memo_sha256': 'a' * 64, 'source_revision': REVISION, 'activation': 'APPROVED',\\n 'authority_mode': 'ADMINISTER', 'target': 'realm:kubernetes/railiance01/informed-decision',\\n 'verification_method': 'root-fixed-origin-native-readback', 'runtime_authenticated_grant': False,\\n 'verified_at': '2026-10-11T02:00:00Z', 'accepted_at': '2026-10-11T01:59:00Z',\\n 'review_memo_id': review, 'approval_id': approval, 'disposition_id': disposition}\\n outcome = {'memo_id': receipt['memo_id'], 'review': {'memo_id': review, 'stale': False, 'intake_state': 'ready'},\\n 'dispositions': [{'approval_id': None, 'submission_state': 'confirmed',\\n 'disposition': {'verb': 'accept', 'memo_version': 1, 'memo_id': review,\\n 'approval_id': approval, 'id': disposition,\\n 'actor': {'kind': 'person', 'sub': 'uid=platform-root,ou=people,dc=netkingdom,dc=local'},\\n 'at': receipt['accepted_at']}}]}\\n return receipt, outcome\\n\\n\\nclass AuthorityAndCustody(unittest.TestCase):\\n def test_exact_nested_founder_receipt_not_top_level_approval(self):\\n receipt, outcome = accepted()\\n result = authority(receipt, outcome, 'a' * 64, REVISION, 'drill-backup', NOW)\\n self.assertEqual(result['approval_id'], receipt['approval_id'])\\n\\n def test_pending_stale_wrong_actor_version_and_binding_refuse(self):\\n mutations = [lambda r, o: r.update(activation='PENDING'),\\n lambda r, o: r.update(memo_sha256='changed'),\\n lambda r, o: r.update(source_revision='changed'),\\n lambda r, o: r.update(target='other'),\\n lambda r, o: r.update(verified_at='2026-10-11T01:00:00Z'),\\n lambda r, o: r.update(verification_method='caller-asserted'),\\n lambda r, o: r.update(runtime_authenticated_grant=True),\\n lambda r, o: o['review'].update(stale=True),\\n lambda r, o: o['review'].update(intake_state='pending'),\\n lambda r, o: o['dispositions'][0].update(submission_state='unresolved'),\\n lambda r, o: o['dispositions'][0]['disposition'].update(memo_version=2),\\n lambda r, o: o['dispositions'][0]['disposition'].update(actor={'kind': 'agent', 'sub': 'platform-root'}),\\n lambda r, o: o['dispositions'].append(copy.deepcopy(o['dispositions'][0]))]\\n for mutate in mutations:\\n with self.subTest(mutate=mutate):\\n r, o = accepted()\\n mutate(r, o)\\n with self.assertRaises(ValueError):\\n authority(r, o, 'a' * 64, REVISION, 'release', NOW)\\n\\n def test_expired_window_and_unknown_phase_refuse(self):\\n r, o = accepted()\\n with self.assertRaises(ValueError):\\n authority(r, o, 'a' * 64, REVISION, 'arbitrary', NOW)\\n late = datetime.datetime(2026, 10, 13, tzinfo=datetime.timezone.utc)\\n r['verified_at'] = late.isoformat()\\n with self.assertRaises(ValueError):\\n authority(r, o, 'a' * 64, REVISION, 'rollback', late)\\n\\n def test_durable_intent_precedes_dispatch_and_never_retries(self):\\n with tempfile.TemporaryDirectory() as directory:\\n parent = Path(directory)\\n os.chmod(parent, 0o700)\\n journal = Journal(parent, {'case': 'fixture'})\\n journal.start('drill-backup', {'approval_id': 'fixture'})\\n self.assertEqual(json.loads(journal.path.read_text())['phases']['drill-backup']['state'], 'RUNNING')\\n journal.close() # simulated crash before result\\n recovered = Journal(parent, {'case': 'fixture'})\\n with self.assertRaises(ValueError):\\n recovered.start('drill-backup', {})\\n with self.assertRaises(ValueError):\\n recovered.start('drill-copy', {})\\n recovered.close()\\n\\n def test_phase_order_and_uncertain_release_allows_only_distinct_recovery(self):\\n with tempfile.TemporaryDirectory() as directory:\\n os.chmod(directory, 0o700)\\n j = Journal(directory, {'case': 'fixture'})\\n with self.assertRaises(ValueError):\\n j.start('release', {})\\n for phase in actuator.PHASES[:6]:\\n j.start(phase, {})\\n j.finish(phase, {'all_checks_pass': True})\\n j.start('release', {})\\n j.finish('release', {'all_checks_pass': False})\\n with self.assertRaises(ValueError):\\n j.start('release', {})\\n with self.assertRaises(ValueError):\\n j.start('verify', {})\\n j.start('rollback', {})\\n j.finish('rollback', {'all_checks_pass': True})\\n j.close()\\n\\n def test_secret_or_unknown_child_output_is_withheld(self):\\n for body in ('not-json', '{\\\"all_checks_pass\\\":true,\\\"token\\\":\\\"private-value\\\"}',\\n '{\\\"all_checks_pass\\\":true,\\\"snapshot_readonly\\\":{\\\"schema_version\\\":5}}'):\\n with self.assertRaises(ValueError):\\n actuator.json_result(subprocess.CompletedProcess([], 0, body, ''))\\n wrong = copy.deepcopy(COUNT)\\n wrong['outbox'] = {'private-row-value': 1}\\n with self.assertRaises(ValueError):\\n counts(wrong)\\n counts(COUNT) # blocked/unresolved counts are not required to be zero.\\n\\n def test_binary_copy_is_bounded_private_and_never_echoed(self):\\n blob = b'synthetic private fixture bytes'\\n digest = __import__('hashlib').sha256(blob).hexdigest()\\n metadata = {'all_checks_pass': True, 'snapshot_file': 'drill.sqlite', 'snapshot_bytes': len(blob),\\n 'snapshot_sha256': digest, 'snapshot_readonly': COUNT,\\n 'pod_name': 'fixture-pod', 'pod_uid': 'fixture-uid'}\\n journal = type('FixtureJournal', (), {'data': {'phases': {'drill-backup': {'result': metadata}}}})()\\n real_popen = subprocess.Popen\\n for extra in (b'', b'oversized'):\\n with self.subTest(extra=extra), tempfile.TemporaryDirectory() as folder:\\n os.chmod(folder, 0o700)\\n output = io.StringIO()\\n\\n def child(*args, **kwargs):\\n return real_popen([sys.executable, '-c', 'import sys;sys.stdout.buffer.write(' + repr(blob + extra) + ')'],\\n stdout=subprocess.PIPE, stderr=subprocess.DEVNULL)\\n\\n with patch.object(actuator, 'CUSTODY', Path(folder)), patch.object(actuator, 'remote', return_value=metadata), \\\\\\n patch('subprocess.Popen', side_effect=child), redirect_stdout(output):\\n if extra:\\n with self.assertRaises(ValueError):\\n actuator.copy_snapshot('drill-copy', REVISION, {}, journal)\\n else:\\n result = actuator.copy_snapshot('drill-copy', REVISION, {}, journal)\\n self.assertTrue(result['off_cluster_private_copy_verified'])\\n self.assertEqual((Path(folder) / 'drill.sqlite').read_bytes(), blob)\\n self.assertEqual(output.getvalue(), '')\\n self.assertEqual((Path(folder) / 'drill.sqlite').stat().st_mode & 0o777, 0o600)\\n\\n def test_recreated_offline_volume_cannot_be_deleted(self):\\n identity = {'Name': actuator.VOLUME, 'Labels': {'nonce': 'old'}, 'CreatedAt': 'old'}\\n journal = type('FixtureJournal', (), {'data': {'phases': {\\n 'offline-verify': {'result': {'created_volume_identity': identity}}}}})()\\n inspected = [{**identity, 'CreatedAt': 'recreated'}]\\n with patch.object(actuator, 'docker', return_value=subprocess.CompletedProcess([], 0, json.dumps(inspected), '')) as mocked:\\n with self.assertRaises(ValueError):\\n actuator.cleanup_offline(journal)\\n self.assertEqual(mocked.call_count, 1)\\n\\n def test_offline_post_admin_integrity_and_original_hash_are_rechecked(self):\\n for defect in ('none', 'post-integrity', 'original-hash'):\\n with self.subTest(defect=defect), tempfile.TemporaryDirectory() as directory:\\n folder=Path(directory);os.chmod(folder,0o700)\\n snapshot=folder/'drill.sqlite';snapshot.write_bytes(b'private synthetic snapshot');os.chmod(snapshot,0o600)\\n digest=actuator.sha(snapshot)\\n prior={'snapshot_sha256':digest,'snapshot_readonly':COUNT}\\n journal=type('FixtureJournal',(),{'data':{'phases':{'drill-copy':{'result':prior},'offline-verify':{'attempt_id':'nonce'}}},'note':lambda *args:None})()\\n reads=[]\\n volume={'Name':actuator.VOLUME,'Labels':{'informed-decision.case':'infd-purpose-20261011-r1','informed-decision.use':'offline-restore-only','informed-decision.attempt':'nonce'},'Driver':'local','Scope':'local','CreatedAt':'fixture','Options':None}\\n def docker(argv, body=None, **kwargs):\\n if argv[0]=='info':body=json.dumps('bnt-lap001')\\n elif argv[:2]==['volume','ls']:body=''\\n elif argv[:2]==['volume','create']:body=actuator.VOLUME\\n elif argv[:2]==['volume','inspect']:body=json.dumps([volume])\\n elif 'informed-decision-admin' in argv:\\n body=json.dumps({key:COUNT[key] for key in ('schema_version','lifecycle','outbox','submissions')})\\n if defect=='original-hash':snapshot.write_bytes(b'changed synthetic original')\\n elif '--entrypoint' in argv and 'python' in argv:\\n reads.append(argv);proof=copy.deepcopy(COUNT)\\n if len(reads)==2 and defect=='post-integrity':proof['integrity']='corrupt'\\n body=json.dumps(proof)\\n else:raise AssertionError('unexpected offline command')\\n return subprocess.CompletedProcess(argv,0,body,'')\\n with patch.object(actuator,'CUSTODY',folder),patch.object(actuator,'CASE',CASE),patch.object(actuator,'docker',side_effect=docker),patch('subprocess.run',return_value=subprocess.CompletedProcess([],0,'{\\\"all_checks_pass\\\":true,\\\"private_copy_verified\\\":true}','')):\\n if defect=='none':\\n result=actuator.offline_verify(journal)\\n self.assertEqual(result['offline_post_admin_readonly'],COUNT)\\n self.assertTrue(result['original_snapshot_hash_unchanged'])\\n else:\\n with self.assertRaises(ValueError):actuator.offline_verify(journal)\\n self.assertEqual(len(reads),2)\\n\\n\\nclass FixedNativeProgram(unittest.TestCase):\\n def fixture(self):\\n sealed = json.loads((CASE / 'sealed-live-deployment.json').read_text())\\n live = copy.deepcopy(sealed)\\n live['metadata'].update(generation=42)\\n live['status'] = {'readyReplicas': 1, 'updatedReplicas': 1, 'observedGeneration': 42}\\n dependencies = json.loads((CASE / 'sealed-native-dependencies.json').read_text())\\n cm = copy.deepcopy(dependencies['configmap'])\\n cm.pop('canonical_data_sha256')\\n service = json.loads((CASE / 'candidate-deployment.json').read_text())\\n source_service = json.loads((CASE.parents[2] / 'deploy/lifecycle/service.candidate.json').read_text())\\n cm['data'] = next(x for x in source_service['items'] if x['kind'] == 'ConfigMap')['data']\\n pvc = copy.deepcopy(dependencies['pvc'])\\n pvc['status'] = {'phase': 'Bound'}\\n app = {'metadata': {'uid': '499868f2-eabc-4df4-ae31-b89ce58d750d', 'resourceVersion': '17'},\\n 'spec': {'source': {'repoURL': 'https://forgejo.coulomb.social/coulomb/informed-decision.git',\\n 'path': 'deploy/lifecycle', 'targetRevision': '7db8485ffecdebfabd77a9daec085553c74bf0bf'},\\n 'destination': {'namespace': 'informed-decision', 'server': 'https://kubernetes.default.svc'}}}\\n objects = {'deployment': live, 'configmap': cm, 'pvc': pvc, 'application': app}\\n payload = {'phase': 'release', 'source_revision': REVISION, 'approval': {}, 'sealed': sealed,\\n 'dependencies': dependencies, 'candidate': service,\\n 'rollback': json.loads((CASE / 'rollback-deployment.json').read_text()),\\n 'readonly': (CASE / 'sqlite_readonly.py').read_text(),'purpose_checks':(CASE/'check_installed.py').read_text(),\\n 'receipt_safety': (Path(__file__).parent / 'receipt_safety.py').read_text()}\\n return objects, payload\\n\\n def execute_fake(self, objects, payload, ambiguous=False, schema_refused=False):\\n writes = []\\n calls = []\\n\\n def fake(argv, input=None, **kwargs):\\n calls.append(argv)\\n if argv[:2] == ['kubectl', 'get']:\\n kind = argv[2]\\n if kind in objects:\\n body = objects[kind]\\n elif kind == 'pods':\\n body = {'items': [{'metadata': {'name': 'fixture-pod', 'uid': 'pod-uid',\\n 'ownerReferences': [{'kind': 'ReplicaSet', 'name': 'fixture-rs', 'uid': 'rs-uid'}]},\\n 'spec': objects['deployment']['spec']['template']['spec'],\\n 'status': {'phase': 'Running', 'containerStatuses': [{'name':'informed-decision','ready': True}]}}]}\\n elif kind == 'replicaset':\\n body = {'metadata': {'uid': 'rs-uid', 'ownerReferences': [\\n {'kind': 'Deployment', 'uid': payload['sealed']['metadata']['uid']}]}}\\n elif kind == 'nodes':\\n body = {'items': [{'metadata': {'name': 'fixture-node'}, 'status': {\\n 'addresses': [{'address': '92.205.62.239'}], 'allocatable': {'cpu': '4'},\\n 'conditions': [{'type': key, 'status': 'True' if key == 'Ready' else 'False'}\\n for key in ('Ready', 'MemoryPressure', 'DiskPressure', 'PIDPressure')]}}]}\\n else:\\n raise AssertionError('unexpected fixed metadata route')\\n return subprocess.CompletedProcess(argv, 0, json.dumps(body), '')\\n if argv[:2] == ['kubectl', 'exec']:\\n if schema_refused:\\n return subprocess.CompletedProcess(argv, 1, '', 'withheld')\\n return subprocess.CompletedProcess(argv, 0, json.dumps({\\n 'all_checks_pass': True, 'live_readonly_schema_integrity_counts': COUNT}), '')\\n if argv[:2] == ['kubectl', 'apply']:\\n admitted = copy.deepcopy(payload['sealed'])\\n admitted['spec']['template']['spec']['containers'][0]['image'] = (actuator.IMAGE if payload['phase']=='release' else payload['sealed']['spec']['template']['spec']['containers'][0]['image'])\\n return subprocess.CompletedProcess(argv, 0, json.dumps(admitted), '')\\n if argv[:2] == ['kubectl', 'describe']:\\n return subprocess.CompletedProcess(argv, 0, 'Allocated resources:\\\\n cpu 3460m (86%)\\\\n', '')\\n if argv[:2] == ['kubectl', 'diff']:\\n return subprocess.CompletedProcess(argv, 1, '-image: base\\\\n+image: candidate\\\\n', '')\\n if argv[:2] == ['kubectl', 'patch']:\\n if '--dry-run=server' not in argv:\\n writes.append(json.loads(input))\\n if ambiguous:\\n return subprocess.CompletedProcess(argv, 1, '', 'withheld')\\n return subprocess.CompletedProcess(argv, 0, 'application.argoproj.io/informed-decision\\\\n', '')\\n raise AssertionError('unexpected command')\\n\\n source = PROGRAM.replace('__PAYLOAD__', repr(json.dumps(payload))).replace(\\n '__GUARD__', repr((CASE / 'change_guard.py').read_text()))\\n output = io.StringIO()\\n with patch('subprocess.run', side_effect=fake), redirect_stdout(output):\\n try:\\n exec(compile(source, 'fixed-native-fixture', 'exec'), {'__name__': '__fixture__'})\\n except (ValueError, SystemExit):\\n pass\\n receipt = json.loads(output.getvalue()) if output.getvalue() else {'all_checks_pass': False}\\n return receipt, writes, calls\\n\\n def test_only_existing_application_operation_and_deployment_are_requested(self):\\n objects, payload = self.fixture()\\n receipt, writes, calls = self.execute_fake(objects, payload)\\n self.assertTrue(receipt['all_checks_pass'])\\n self.assertFalse(receipt['rollout_verified'])\\n self.assertEqual(len(writes), 1)\\n operation = writes[0][-1]['value']\\n self.assertFalse(operation['sync']['prune'])\\n self.assertEqual(operation['sync']['resources'], [\\n {'group': 'apps', 'kind': 'Deployment', 'name': 'informed-decision', 'namespace': 'informed-decision'}])\\n self.assertTrue(any('--dry-run=server' in argv and argv[:2] == ['kubectl', 'patch'] for argv in calls))\\n self.assertEqual(writes[0][0]['path'], '/metadata/uid')\\n\\n def test_source_overrides_automation_and_custody_drift_stop_before_write(self):\\n mutations = [lambda o: o['application']['metadata'].update(uid='recreated'),\\n lambda o: o['application']['spec'].update(syncPolicy={'automated': {}}),\\n lambda o: o['application']['spec']['source'].update(kustomize={'images': ['other']}),\\n lambda o: o['application']['spec'].update(sources=[{}]),\\n lambda o: o['configmap']['metadata'].update(uid='recreated'),\\n lambda o: o['pvc']['spec'].update(volumeName='replaced'),\\n lambda o: o['deployment']['status'].update(readyReplicas=0)]\\n for mutate in mutations:\\n with self.subTest(mutate=mutate):\\n objects, payload = self.fixture()\\n mutate(objects)\\n receipt, writes, calls = self.execute_fake(objects, payload)\\n self.assertFalse(receipt['all_checks_pass'])\\n self.assertEqual(writes, [])\\n\\n def test_preopen_schema_refusal_prevents_image_operation(self):\\n objects, payload = self.fixture()\\n receipt, writes, calls = self.execute_fake(objects, payload, schema_refused=True)\\n self.assertFalse(receipt['all_checks_pass'])\\n self.assertEqual(writes, [])\\n\\n\\n def test_rollback_unready_candidate_never_reads_pod_or_database(self):\\n objects, payload = self.fixture()\\n payload['phase'] = 'rollback'\\n objects['deployment']['status'].update(readyReplicas=0, updatedReplicas=0)\\n objects['deployment']['spec']['template']['spec']['containers'][0]['image'] = actuator.IMAGE\\n objects['application']['spec']['source']['targetRevision'] = REVISION\\n receipt, writes, calls = self.execute_fake(objects, payload, schema_refused=True)\\n self.assertTrue(receipt['all_checks_pass'])\\n self.assertFalse(receipt['rollout_verified'])\\n self.assertEqual(len(writes), 1)\\n self.assertFalse(any(argv[:2] == ['kubectl', 'exec'] or argv[:3] == ['kubectl', 'get', 'pods'] for argv in calls))\\n self.assertEqual(writes[0][-1]['value']['sync']['revision'], '7db8485ffecdebfabd77a9daec085553c74bf0bf')\\n\\n def test_rollback_still_refuses_custody_or_nonpair_image_drift(self):\\n for defect in ('cm', 'pvc', 'image'):\\n with self.subTest(defect=defect):\\n objects, payload = self.fixture();payload['phase'] = 'rollback'\\n objects['deployment']['status']['readyReplicas'] = 0\\n if defect == 'cm':objects['configmap']['metadata']['uid'] = 'recreated'\\n elif defect == 'pvc':objects['pvc']['spec']['volumeName'] = 'replaced'\\n else:objects['deployment']['spec']['template']['spec']['containers'][0]['image'] = 'foreign-image'\\n receipt, writes, calls = self.execute_fake(objects, payload)\\n self.assertFalse(receipt['all_checks_pass']);self.assertEqual(writes, [])\\n\\n def test_recovery_verification_is_separate_ready_old_image_schema_proof(self):\\n objects, payload = self.fixture();payload['phase'] = 'rollback-verify'\\n objects['application']['status'] = {'operationState': {'phase': 'Succeeded', 'operation': {'sync': {\\n 'revision': '7db8485ffecdebfabd77a9daec085553c74bf0bf', 'prune': False,\\n 'resources': [{'group':'apps','kind':'Deployment','name':'informed-decision','namespace':'informed-decision'}]}}}}\\n receipt, writes, calls = self.execute_fake(objects, payload)\\n self.assertTrue(receipt['all_checks_pass']);self.assertTrue(receipt['recovery_verification'])\\n self.assertEqual(writes, [])\\n self.assertTrue(any(argv[:2]==['kubectl','exec'] for argv in calls))\\n objects['deployment']['status']['readyReplicas'] = 0\\n receipt, writes, calls = self.execute_fake(objects,payload)\\n self.assertFalse(receipt['all_checks_pass'])\\n\\n def test_ambiguous_patch_is_never_retried(self):\\n objects, payload = self.fixture()\\n receipt, writes, calls = self.execute_fake(objects, payload, ambiguous=True)\\n self.assertFalse(receipt['all_checks_pass'])\\n self.assertEqual(len(writes), 1)\\n\\n\\nif __name__ == '__main__':\\n unittest.main()\\n\"\n },\n \"validation.json\": {\n \"sha256\": \"26c5acfa6e2ef5909ff9f3fc819ca1763b79f3cb65b3c43371f7944a284cde28\",\n \"content\": \"{\\n \\\"tests\\\": 16,\\n \\\"result\\\": \\\"passed\\\",\\n \\\"synthetic_transport_only\\\": true,\\n \\\"real_native_data_read\\\": false,\\n \\\"native_backup_export_restore_executed\\\": false,\\n \\\"native_workload_changed\\\": false,\\n \\\"actual_founder_approval\\\": false,\\n \\\"local_read_only_capability_checks\\\": [\\n \\\"argocdCLI absent, existingApplication.operation path retained\\\",\\n \\\"Dockerunixsocket engineName bnt-lap001\\\"\\n ],\\n \\\"case_source_commit_at_preparation\\\": \\\"e0359bc (owner original78source; final helpercommit mustbe explicitlypinned)\\\",\\n \\\"additional_regressions\\\": [\\n \\\"Ready0 candidate rollback dispatch has no Pod metadata/DB exec and one scoped CAS operation\\\",\\n \\\"rollback still refuses CM/PVC or nonpair-image drift\\\",\\n \\\"separate old-image Ready/schema5 recovery proof\\\",\\n \\\"post-admin readonly integrity refusal and original snapshot tamper refusal\\\"\\n ]\\n}\\n\"\n }\n },\n \"native_execution\": false\n}\n"
},
{
"item_id": "sqlite-readonly-py",
"media_type": "text/plain",
"content": "\"\"\"Pre-open schema/integrity/count proof; stdlib only, never constructs Store.\"\"\"\nimport argparse\nimport json\nfrom pathlib import Path\nimport sqlite3\n\n\ndef inspect_readonly(path):\n path = Path(path)\n if not path.is_file() or path.is_symlink():\n raise ValueError('existing nonsymlink private database required')\n with sqlite3.connect(path.resolve().as_uri() + '?mode=ro', uri=True, timeout=5) as db:\n db.execute('PRAGMA query_only=ON')\n db.execute('BEGIN')\n version = db.execute('PRAGMA user_version').fetchone()[0]\n if version != 5:\n raise ValueError('pre-open database is not schema5; refuse migration')\n if db.execute('PRAGMA integrity_check').fetchall() != [('ok',)]:\n raise ValueError('read-only integrity check refused')\n lifecycle = {name: db.execute('SELECT COUNT(*) FROM ' + table).fetchone()[0]\n for name, table in (('records', 'lifecycle_records'),\n ('events', 'lifecycle_events'),\n ('pending', 'lifecycle_pending'))}\n result = {'schema_version': version, 'lifecycle': lifecycle,\n 'outbox': dict(db.execute('SELECT state,COUNT(*) FROM outbox GROUP BY state')),\n 'submissions': dict(db.execute('SELECT state,COUNT(*) FROM submissions GROUP BY state')),\n 'integrity': 'ok', 'read_only_pre_open': True, 'store_constructed': False}\n db.rollback()\n return result\n\n\nif __name__ == '__main__':\n parser = argparse.ArgumentParser(description=__doc__)\n parser.add_argument('--db', type=Path, required=True)\n args = parser.parse_args()\n try:\n print(json.dumps(inspect_readonly(args.db), sort_keys=True))\n except Exception:\n raise SystemExit('read-only schema5/integrity/count gate refused; no Store/admin open') from None\n"
},
{
"item_id": "sealed-native-dependencies-json",
"media_type": "application/json",
"content": "{\n \"configmap\": {\n \"apiVersion\": \"v1\",\n \"immutable\": true,\n \"kind\": \"ConfigMap\",\n \"metadata\": {\n \"annotations\": {\n \"argocd.argoproj.io/tracking-id\": \"informed-decision:/ConfigMap:informed-decision/informed-decision-runtime-6c221878d051\",\n \"informed-decision.coulomb.social/admission\": \"approved; INFD-WP-0007 cutover\"\n },\n \"name\": \"informed-decision-runtime-6c221878d051\",\n \"namespace\": \"informed-decision\",\n \"uid\": \"90113d2d-54d9-4e82-b1d3-90b49ebed2b5\"\n },\n \"canonical_data_sha256\": \"8ec462d12347548f506eeebf1e3c7cc47648019c8a783804d09bcc79b0f22af6\"\n },\n \"pvc\": {\n \"apiVersion\": \"v1\",\n \"kind\": \"PersistentVolumeClaim\",\n \"metadata\": {\n \"annotations\": {\n \"argocd.argoproj.io/tracking-id\": \"informed-decision:/PersistentVolumeClaim:informed-decision/informed-decision-data\",\n \"informed-decision.coulomb.social/admission\": \"approved; INFD-WP-0007 cutover\",\n \"pv.kubernetes.io/bind-completed\": \"yes\",\n \"pv.kubernetes.io/bound-by-controller\": \"yes\",\n \"volume.beta.kubernetes.io/storage-provisioner\": \"rancher.io/local-path\",\n \"volume.kubernetes.io/selected-node\": \"239.62.205.92.host.secureserver.net\",\n \"volume.kubernetes.io/storage-provisioner\": \"rancher.io/local-path\"\n },\n \"finalizers\": [\n \"kubernetes.io/pvc-protection\"\n ],\n \"name\": \"informed-decision-data\",\n \"namespace\": \"informed-decision\",\n \"uid\": \"d80b25b1-141a-441b-b205-98fa2fd98b7c\"\n },\n \"spec\": {\n \"accessModes\": [\n \"ReadWriteOnce\"\n ],\n \"resources\": {\n \"requests\": {\n \"storage\": \"1Gi\"\n }\n },\n \"storageClassName\": \"local-path\",\n \"volumeMode\": \"Filesystem\",\n \"volumeName\": \"pvc-d80b25b1-141a-441b-b205-98fa2fd98b7c\"\n }\n },\n \"pvc_phase\": \"Bound\"\n}\n"
},
{
"item_id": "native-backup-restore-protocol-md",
"media_type": "text/markdown",
"content": "# Protected native backup/restore and image-only release protocol\n\nPrepared protocol for `INFD-WP-0009-T04/purpose-overlay-v1`. No actual native backup, data export, restore, workload change or approval is recorded here. Candidate registry image identity remains a prerequisite; only after actual artifact proof may the founder approve one exact conditional protocol/rollout packet. The config-only7db8485 approval is outside this scope.\n\n## Preconditions and protected custody\n\nFreeze exact candidate and prior7f5c6cb image digests, source/installed policy hashes, current manually managed Argo Application/revision, runtime ConfigMap6c221878d051, Deployment UID/template/spec, schema5, policy package pins, database path `/data/private/review.sqlite`, PVC binding, replicas1/Recreate and stable keys for intended verification. Confirm no concurrent writer or custody change. Use fixed metadata; never fetch Secret objects or token values. A changed image/config/schema/owner invalidates the packet. Fresh resources/headroom and exact source/native server-dry-run/diff remain required.\n\nBackups are private evidence containing real decision records, not logs or packet attachments. Allocate a unique backup directory under existing protected PVC custody, owned10001, mode0700, snapshot file0600, no symlink/hardlink/reused output path. An off-cluster copy belongs only in the already established ignored `.private-backups/<unique-trial-directory>` custody with0700/0600 permissions; no Git, StateHub, public object store or terminal-content dump. Record only schema, integrity pass/fail, bounded table/state counts and protected receipt identifier; retain byte digests in protected custody if needed for internal copy identity. No credential, record payload or token fingerprint enters public evidence.\n\n## Approved online compatibility drill\n\nWithin the explicit founder-approved action, run the existing base image's `informed-decision-admin backup --db /data/private/review.sqlite --output <new-private-snapshot>` in the actual serving workload. This uses SQLite's backup API for a transactionally consistent snapshot; copying a live main database while ignoring WAL is prohibited. Suppress raw failures/output and retain only sanitized status. Observe schema/integrity and count-only metadata from the resulting snapshot, not record content.\n\nTransfer that consistent snapshot only into protected off-cluster custody through the existing authorized operator lane. The copy is real production data even in build mode. Verify private permissions, unique identity and protected internal digest agreement. Do not export mounted workload credentials or directory trees; copy only the exact snapshot.\n\nCreate a separate private disposable restore volume/directory; retain the original snapshot unchanged. Run the exact published candidate with network disabled, no production ConfigMap/token mounts, read-only image and only that isolated volume writable. Override the service entrypoint with the owner's count-only administrative inspection/integrity check; do not start HTTP listeners, audit delivery, requester exchanges or approval operations. The current candidate changes policy.py only and retains the schema/store module bytes; still prove schema5, SQLite integrity and exact bounded counts before/after opening the restored copy. Refuse any migration/downgrade, lost/changed counts, unexpected write class or unknown outcome. Keep pending/uncertain submission and outbox states; never replay, discard or mark them delivered to green the drill. Cleanup only the disposable copy/volume after verified receipt; retain the original protected backup for the approved recovery interval.\n\nThis step is actual native-data compatibility evidence once performed. Its previous synthetic fixture checks remain mechanism evidence and cannot be renamed native success. A failed drill stops rollout and remains a failed/unverified outcome in the same trial.\n\n## Fresh cutover snapshot and single-writer rollout\n\nAfter successful actual-data compatibility checks, create another unique SQLite-consistent online snapshot immediately before the image cutover, retaining its point-in-time schema/integrity/count receipt. This is an online transactional snapshot, not a claim that dispatchers or human writes were quiesced. Every later committed record remains in the live database; same-schema rollback retains that database and never restores the earlier snapshot over it. The narrow image-only update does not need dispatcher/configuration/PVC/temporary-pod changes or a schema cutover. If fresh verification shows a migration or any data-restoration requirement, stop and refine the proposal rather than applying this protocol.\n\nThe existing Recreate rollout drains/stops the single old writer before starting the new image on the same PVC; the inherited single-writer lock independently refuses concurrent serving processes. Do not add an admin pod, scale-to-zero, dispatcher stop, network-policy rewrite or snapshot overwrite as an improvised image-only step. The existing owner admin backup operation runs inside the admitted serving workload, and its separate protected restore drill runs off-cluster with network disabled and no workload credentials. Those exact custody operations must be enumerated in the founder packet alongside the one Deployment image change.\n\nOnce backup/compatibility/preflight gates pass, manually pin the existing Argo Application to the exact reviewed source revision and sync only Deployment/informed-decision with prune false, keeping the current immutable runtime ConfigMap and all other resources. The source patch changes only the image in admission/rendered Deployment; no Secret, PVC, policy, database or dispatcher change is included unless separately enumerated in the final proposal. Observe five-minute readiness and exact image/config/schema/pins. Run the ten installed purpose variants on the actual native placement using synthetic transport; they prove exact installed module refusal behavior and explicitly report native_provider=false. They do not prove an actual provider response, PDP authority or native lifecycle binding; any required actual-provider proof remains a distinct T04 completion gate with separate authorized preparation, and must not be claimed by this helper. Do not contaminate the live PDP, create human approvals, read credentials through CLI, or replay unknown external outcomes for testing.\n\n## Same-schema rollback and evidence retention\n\nOn startup/readiness/binding/refusal failure, retain current database, cutover backup and every post-cutover evidence/uncertain outcome. Restore only the prior7f5c6cb image through the same manual Argo owner path, retaining schema5 and current DB/configuration; never restore an old snapshot over current live evidence just to roll the image back. Verify old image/Ready1, same schema/counts and prior behavior, and reconcile any external effects using existing lifecycle/audit ownership. The narrow overlay's identical store/schema/dependency bytes permit this image-only rollback; it is not permission for a schema downgrade or data loss.\n\nRecord original/approved/executed source and image revisions, backup/drill/cutover/rollout timestamps, exact disposition and sanitized outcomes in the existing supervised trial receipt. EUR0 incremental infrastructure estimate uses existing service/storage/operator lane; protected temporary copy/storage consumption and15–30minute recovery time remain operational costs. No EUR incident-loss cap or autonomy grant is inferred. TaskT04 cannot close until actual published image, approved native compatibility and release plus post-release refusal/binding evidence all exist.\n\n## Exact release case identifiers\n\nProposal `INFD-WP-0009-T04/purpose-overlay-v1`, trial `infd-purpose-20261011-r1`.\nProtected native parent `/data/private/purpose-overlay-r1` must be unique/non-symlink, owned10001 and0700. The drill snapshot is `drill.sqlite`, the refreshed pre-cutover snapshot `cutover.sqlite`, each new0600 file; refuse any existing output. Off-cluster custody is the existing ignored Custodian `.private-backups/20261011-infd-purpose-r1` parent0700, files0600; no snapshot is an evidence attachment. Check owner UID, no symlinks, ignored status and free capacity for both native snapshots plus independently protected copies before making any snapshot.\n\nThe disposable offline restore volume is `infd-purpose-r1-restore-20261011`; refuse an existing volume, copy only the selected frozen snapshot, and run exact published candidate763c with networknone/read-only image,128MiB/core1 and no runtime config/token mounts. SQLite `PRAGMA integrity_check` must return `ok`, `PRAGMA user_version`/Store inspection must agree with actual schema5 semantics, and installed admin count-only inspection must match the frozen snapshot. Validate the actual schema representation rather than assume PRAGMA user_version is the schema authority. No synthetic restoration is reported as native restoration. Native original/off-cluster copies remain retained; only the disposable restore copy/volume may be removed under the exact approved cleanup scope.\n\n## Mandatory pre-open schema gate and offline command\n\n`informed-decision-admin inspect` and `backup` construct Store, which can migrate schemas1–4 to5. Therefore **before any Store/admin open**, run the exact attached stdlib-only `sqlite_readonly.py` against the native source database using SQLite URI mode=ro, query_only and one read transaction. Require PRAGMA user_version5, integrity_check=ok and retain count-only baseline. Refuse any other/unknown schema or incomplete integrity/count check before constructing Store; do not infer no migration from a post-open admin report. This native gate has not been executed in this source-preparation stage. Repeat before each native backup/admin operation.\n\nAfter copying the selected consistent snapshot to the isolated restored private path `/restore/review.sqlite`, run the same read-only checker **before** any offline candidate admin/Store opens that copy. Frozen snapshot and restored-copy schema/integrity/count reports must agree exactly; the copied main-file digest must match the selected closed snapshot. Reject oldschema fixtures rather than allow migration. Only after this pre-open gate may the offline candidate admin inspect run.\n\nOffline command vectors use exactimage `forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a`, `--network none --read-only --cpus 1 --memory 128m`, private restored volume mounted at `/restore`, and **no runtime config/credential/token mounts**. First override entrypoint to `python`, arguments `- --db /restore/review.sqlite`, streaming only the verified attached checker on stdin. Then override entrypoint to **`informed-decision-admin`**, arguments **`inspect --db /restore/review.sqlite`**. This does not start `informed-decision-container`, the HTTP service, dispatcher or delivery workers. Compare the admin's schema/lifecycle/outbox/submission counters to the frozen pre-open snapshot report; integrity and migration-free pre-open proof come from the stdlib checker, not admin output alone.\n\nLive reads and online snapshots may legitimately differ because reviews, intake and delivery can commit concurrently. Exact counter equality is required between the frozen selected snapshot and its offline restored clone; it is **not** required between a running post-cutover/rollback database and an earlier snapshot. Live count changes must be accounted for as legitimate committed records/state transitions; preserve all current and uncertain entries. Do not discard new commits or restore the old snapshot to force equality. Same-schema image rollback keeps the current live DB, followed by read-only schema5/integrity and count-only health checks; any unexplained evidence loss or required data recovery stops and requires a separate founder decision.\n\nThe fresh preflight also independently reads the actual immutable nonsecret ConfigMap and bound PVC: compares sealed UIDs/fullmetadata/PVCspec+volumeName and canonical runtime data checksum, returning no raw runtime data. Same-name deletion/recreation or content/custody drift stops before admission. Secret values remain excluded. Both local and remote optimized Python interpreters are explicitly refused before assertion-based gates.\n\n## Exact supervised mechanical execution refinement\n\nThe directly attached `execution-bundle.json` contains the exact helper source, plan, tests and PENDING receipt template. It replaces the direct raw scan attachment within the twenty-document limit; `published-verification.json` still binds the unchanged actual unfiltered raw scan, raw SBOM and base scan SHA256 values, retained in the owner evidence package. The known inherited fixable MEDIUM remains explicit, with owner T05/risk follow-through. Neither archive nor technical agreement supplies human approval.\n\nThe reviewed protocol basis is owner commit e0359bcb6cdfad9ab3e868054121fe0cebec2d68, with source follow-through9268c9ac0bbee508fe35c0b90dcefef4c24da2f5. The subsequent exact applied helper/packet owner commit must be named in the externally verified founder receipt before execution. Verify the four committed Git blobs (admission.candidate.json, service.candidate.json, kustomization.yaml, registries.candidate.json) against execution-plan.json as well as current worktree/HEAD; reject overrides/plugins/multiple Application sources and any present automated configuration, including automated:{}.\n\nRoot freshly authenticates the exact confirmed founder person/platform-root ACCEPT of this stable memo/version1 at the fixed native Informed Decision origin before each phase, and supplies protected0600 receipt/outcome files. The helper checks their exact relation and freshness120seconds; these files are supervised bookkeeping, not signed authenticated grants, a human-provider implementation, or autonomous agent authority. Do not derive them from technical reviews or caller assertions.\n\nFixed order: drill-backup → drill-copy → offline-verify → cleanup-offline → cutover-backup → cutover-copy → release → verify. A separate recorded release attempt permits rollback → rollback-verify. Every phase fsyncs an attempt nonce/RUNNING journal before effects. Failure/interruption/ambiguous actuation stays UNCERTAIN and the same phase cannot be retried. No improvised adapter or whole-Application sync is permitted.\n\nThe NEW nonce-labelled local volume requires one explicit isolated initializer as UID0:0 with only CAP_CHOWN, exact763c image, --network none --read-only --cpus 1 --memory 128m --cap-drop ALL --cap-add CHOWN --security-opt no-new-privileges. Its only mount is that new named volume at /restore; no host mount, native PVC, runtime config or token mount. Protected snapshot stdin goes only to a unique0600 main file with exact digest, and directory/file custody is set0700/0600 UID/GID10001. Then all pre-open, admin and post-admin checks run UID10001:10001, capabilities dropped, networknone. The second stdlib readonly schema5/integrity/count proof after admin must exactly equal the frozen snapshot proof; independently recheck the retained original protected snapshot SHA. No service startup occurs.\n\nRollback dispatch must be available if the candidate is unready or cannot start: it checks sealed Deployment/CM/PVC custody, only prior/candidate source/image pair, node health/headroom and fresh old-image server admission plus Application UID/resourceVersion/source CAS, with no failing candidate Pod/exec/database prerequisite. Dispatch acknowledgment is not recovered health. `rollback-verify` separately requires old image Ready1, succeeded exact Deployment-only/prune=false operation and readonly schema5/integrity/count proof of the latest retained live database. No snapshot replaces the current database.\n\n**Deadline refinement:** all phases, including rollback and verification, must begin before2026-10-12T23:59:59Z. The earlier amended packet described unstarted-release expiry; this exact helper also bounds recovery/verification. Start early enough to complete the bounded drill and any recovery within the window. If exhausted, stop and obtain a fresh founder decision rather than silently extend a grant. This may delay recovery and is an explicit operational risk. No timer/controller automatically rolls back or changes service at expiry.\n"
},
{
"item_id": "inherited-vulnerability-follow-through-json",
"media_type": "application/json",
"content": "{\n \"id\": \"INFD-RISK-20261011-ZLIB-85091\",\n \"kind\": \"owner-vulnerability-follow-through\",\n \"owner\": \"informed-decision\",\n \"task\": \"INFD-WP-0009-T05\",\n \"status\": \"open\",\n \"created\": \"2026-10-11\",\n \"review_due\": \"2026-10-18\",\n \"finding\": \"CVE-2026-85091\",\n \"scanner_severity\": \"MEDIUM\",\n \"estate_risk_grade\": null,\n \"affected_package\": \"zlib\",\n \"installed\": \"1.3.2-r0\",\n \"fixed\": \"1.3.2-r1\",\n \"actual_current_base_and_candidate_findings_identical\": true,\n \"source_evidence\": \"security-summary.json, trivy-full.json, base-trivy-full.json\",\n \"human_temporary_disposition\": \"pending\",\n \"follow_through\": \"Prepare a separately source-bound official-base/dependency refresh through normal owner CI, verify full scan and runtime compatibility, obtain distinct native release approval before updating this workload\",\n \"manual_review_expiry\": \"Due date requires owner review/escalation if unresolved; no automatic rollback/controller is installed\",\n \"close_condition\": \"Verified installed native fixed package and full unfiltered rescan; preserve original detection and any human disposition\"\n}\n"
},
{
"item_id": "native-preflight-json",
"media_type": "application/json",
"content": "{\n \"captured_at\": \"2026-10-11T01:25:38.793555+00:00\",\n \"native_workload_changed\": false,\n \"native_backup_restore_executed\": false,\n \"argo\": {\n \"uid\": \"499868f2-eabc-4df4-ae31-b89ce58d750d\",\n \"repoURL\": \"https://forgejo.coulomb.social/coulomb/informed-decision.git\",\n \"targetRevision\": \"7db8485ffecdebfabd77a9daec085553c74bf0bf\",\n \"path\": \"deploy/lifecycle\",\n \"destination\": {\n \"namespace\": \"informed-decision\",\n \"server\": \"https://kubernetes.default.svc\"\n },\n \"automated\": false,\n \"sync\": {\n \"comparedTo\": {\n \"destination\": {\n \"namespace\": \"informed-decision\",\n \"server\": \"https://kubernetes.default.svc\"\n },\n \"source\": {\n \"path\": \"deploy/lifecycle\",\n \"repoURL\": \"https://forgejo.coulomb.social/coulomb/informed-decision.git\",\n \"targetRevision\": \"7db8485ffecdebfabd77a9daec085553c74bf0bf\"\n }\n },\n \"revision\": \"7db8485ffecdebfabd77a9daec085553c74bf0bf\",\n \"status\": \"OutOfSync\"\n },\n \"health\": {\n \"lastTransitionTime\": \"2026-10-10T23:14:52Z\",\n \"status\": \"Healthy\"\n }\n },\n \"live_ready_replicas\": 1,\n \"admitted_uid\": \"a588e10a-90d2-4883-975e-6dd8b8feca92\",\n \"server_dry_run_passed\": true,\n \"admitted_spec_exactly_live_plus_image\": true,\n \"client_diff_exit\": 1,\n \"client_diff_sha256\": \"a4bc024a8cec658f835285ed51964e2e084edbaf103d45a48b89c0950bcd3e7d\",\n \"node_allocated_resources\": \"(Total limits may be over 100 percent, i.e., overcommitted.)\\n Resource Requests Limits\\n -------- -------- ------\\n cpu 3460m (86%) 36200m (905%)\\n memory 9472Mi (59%) 32898Mi (205%)\\n ephemeral-storage 0 (0%) 0 (0%)\\n hugepages-1Gi 0 (0%) 0 (0%)\\n hugepages-2Mi 0 (0%) 0 (0%)\",\n \"all_checks_pass\": true\n}\n"
},
{
"item_id": "sealed-live-deployment-json",
"media_type": "application/json",
"content": "{\n \"apiVersion\": \"apps/v1\",\n \"kind\": \"Deployment\",\n \"metadata\": {\n \"annotations\": {\n \"argocd.argoproj.io/tracking-id\": \"informed-decision:apps/Deployment:informed-decision/informed-decision\",\n \"informed-decision.coulomb.social/admission\": \"approved; INFD-WP-0007 cutover\"\n },\n \"name\": \"informed-decision\",\n \"namespace\": \"informed-decision\",\n \"uid\": \"a588e10a-90d2-4883-975e-6dd8b8feca92\"\n },\n \"spec\": {\n \"progressDeadlineSeconds\": 600,\n \"replicas\": 1,\n \"revisionHistoryLimit\": 10,\n \"selector\": {\n \"matchLabels\": {\n \"app.kubernetes.io/name\": \"informed-decision\"\n }\n },\n \"strategy\": {\n \"type\": \"Recreate\"\n },\n \"template\": {\n \"metadata\": {\n \"annotations\": {\n \"informed-decision.coulomb.social/admission\": \"approved; INFD-WP-0007 cutover\"\n },\n \"labels\": {\n \"app.kubernetes.io/component\": \"review\",\n \"app.kubernetes.io/name\": \"informed-decision\"\n }\n },\n \"spec\": {\n \"automountServiceAccountToken\": false,\n \"containers\": [\n {\n \"env\": [\n {\n \"name\": \"INFD_KEYCAPE_ISSUER\",\n \"value\": \"https://kc.coulomb.social\"\n },\n {\n \"name\": \"INFD_CONTAINER_CONFIG\",\n \"value\": \"/configuration/runtime.json\"\n }\n ],\n \"image\": \"forgejo.coulomb.social/coulomb/informed-decision@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173\",\n \"imagePullPolicy\": \"IfNotPresent\",\n \"livenessProbe\": {\n \"failureThreshold\": 3,\n \"httpGet\": {\n \"path\": \"/healthz\",\n \"port\": \"http\",\n \"scheme\": \"HTTP\"\n },\n \"periodSeconds\": 10,\n \"successThreshold\": 1,\n \"timeoutSeconds\": 2\n },\n \"name\": \"informed-decision\",\n \"ports\": [\n {\n \"containerPort\": 8080,\n \"name\": \"http\",\n \"protocol\": \"TCP\"\n },\n {\n \"containerPort\": 8081,\n \"name\": \"workload\",\n \"protocol\": \"TCP\"\n }\n ],\n \"readinessProbe\": {\n \"failureThreshold\": 3,\n \"httpGet\": {\n \"path\": \"/healthz\",\n \"port\": \"http\",\n \"scheme\": \"HTTP\"\n },\n \"periodSeconds\": 10,\n \"successThreshold\": 1,\n \"timeoutSeconds\": 2\n },\n \"resources\": {\n \"limits\": {\n \"cpu\": \"500m\",\n \"memory\": \"256Mi\"\n },\n \"requests\": {\n \"cpu\": \"5m\",\n \"memory\": \"64Mi\"\n }\n },\n \"securityContext\": {\n \"allowPrivilegeEscalation\": false,\n \"capabilities\": {\n \"drop\": [\n \"ALL\"\n ]\n },\n \"readOnlyRootFilesystem\": true\n },\n \"startupProbe\": {\n \"failureThreshold\": 12,\n \"httpGet\": {\n \"path\": \"/healthz\",\n \"port\": \"http\",\n \"scheme\": \"HTTP\"\n },\n \"periodSeconds\": 10,\n \"successThreshold\": 1,\n \"timeoutSeconds\": 2\n },\n \"terminationMessagePath\": \"/dev/termination-log\",\n \"terminationMessagePolicy\": \"File\",\n \"volumeMounts\": [\n {\n \"mountPath\": \"/data\",\n \"name\": \"data\"\n },\n {\n \"mountPath\": \"/run/informed-decision\",\n \"name\": \"runtime\"\n },\n {\n \"mountPath\": \"/tmp\",\n \"name\": \"tmp\"\n },\n {\n \"mountPath\": \"/configuration\",\n \"name\": \"configuration\",\n \"readOnly\": true\n },\n {\n \"mountPath\": \"/var/run/secrets/informed-decision/policy\",\n \"name\": \"caller\",\n \"readOnly\": true\n },\n {\n \"mountPath\": \"/var/run/secrets/informed-decision/audit\",\n \"name\": \"audit\",\n \"readOnly\": true\n },\n {\n \"mountPath\": \"/var/run/secrets/informed-decision/kubernetes\",\n \"name\": \"kubernetes-api\",\n \"readOnly\": true\n },\n {\n \"mountPath\": \"/workload-registry\",\n \"name\": \"workload-registry\",\n \"readOnly\": true\n },\n {\n \"mountPath\": \"/var/run/secrets/informed-decision/requester\",\n \"name\": \"sitting-requester\",\n \"readOnly\": true\n }\n ]\n }\n ],\n \"dnsPolicy\": \"ClusterFirst\",\n \"restartPolicy\": \"Always\",\n \"schedulerName\": \"default-scheduler\",\n \"securityContext\": {\n \"fsGroup\": 10001,\n \"fsGroupChangePolicy\": \"OnRootMismatch\",\n \"runAsGroup\": 10001,\n \"runAsNonRoot\": true,\n \"runAsUser\": 10001,\n \"seccompProfile\": {\n \"type\": \"RuntimeDefault\"\n }\n },\n \"serviceAccount\": \"review\",\n \"serviceAccountName\": \"review\",\n \"terminationGracePeriodSeconds\": 45,\n \"volumes\": [\n {\n \"name\": \"data\",\n \"persistentVolumeClaim\": {\n \"claimName\": \"informed-decision-data\"\n }\n },\n {\n \"emptyDir\": {\n \"medium\": \"Memory\",\n \"sizeLimit\": \"16Mi\"\n },\n \"name\": \"runtime\"\n },\n {\n \"emptyDir\": {\n \"medium\": \"Memory\",\n \"sizeLimit\": \"16Mi\"\n },\n \"name\": \"tmp\"\n },\n {\n \"configMap\": {\n \"defaultMode\": 292,\n \"name\": \"informed-decision-runtime-6c221878d051\"\n },\n \"name\": \"configuration\"\n },\n {\n \"name\": \"caller\",\n \"projected\": {\n \"defaultMode\": 288,\n \"sources\": [\n {\n \"serviceAccountToken\": {\n \"audience\": \"flex-auth\",\n \"expirationSeconds\": 3600,\n \"path\": \"token\"\n }\n }\n ]\n }\n },\n {\n \"name\": \"audit\",\n \"secret\": {\n \"defaultMode\": 288,\n \"items\": [\n {\n \"key\": \"token\",\n \"path\": \"token\"\n }\n ],\n \"secretName\": \"informed-decision-audit\"\n }\n },\n {\n \"name\": \"kubernetes-api\",\n \"projected\": {\n \"defaultMode\": 288,\n \"sources\": [\n {\n \"serviceAccountToken\": {\n \"expirationSeconds\": 600,\n \"path\": \"token\"\n }\n },\n {\n \"configMap\": {\n \"items\": [\n {\n \"key\": \"ca.crt\",\n \"path\": \"ca.crt\"\n }\n ],\n \"name\": \"kube-root-ca.crt\"\n }\n }\n ]\n }\n },\n {\n \"configMap\": {\n \"defaultMode\": 292,\n \"name\": \"informed-decision-workload-registry\"\n },\n \"name\": \"workload-registry\"\n },\n {\n \"name\": \"sitting-requester\",\n \"secret\": {\n \"defaultMode\": 288,\n \"items\": [\n {\n \"key\": \"client-secret\",\n \"path\": \"client-secret\"\n }\n ],\n \"optional\": false,\n \"secretName\": \"informed-decision-sitting-requester\"\n }\n }\n ]\n }\n }\n }\n}\n"
},
{
"item_id": "change-guard-py",
"media_type": "text/plain",
"content": "\"\"\"Read-only exact Deployment and admission boundaries; no mutation authority.\"\"\"\nimport copy\nimport hashlib\nimport json\n\nBASE = 'forgejo.coulomb.social/coulomb/informed-decision@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173'\nCANDIDATE = 'forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a'\n\n\ndef dependency_projection(configmap, pvc):\n if (configmap.get('kind') != 'ConfigMap' or configmap.get('immutable') is not True\n or configmap['metadata']['namespace'] != 'informed-decision'\n or configmap['metadata']['name'] != 'informed-decision-runtime-6c221878d051'\n or set(configmap.get('data', {})) != {'runtime.json'}\n or configmap.get('binaryData')):\n raise ValueError('unexpected immutable runtime config identity')\n if (pvc.get('kind') != 'PersistentVolumeClaim'\n or pvc['metadata']['namespace'] != 'informed-decision'\n or pvc['metadata']['name'] != 'informed-decision-data'\n or pvc.get('status', {}).get('phase') != 'Bound'\n or not pvc.get('spec', {}).get('volumeName')):\n raise ValueError('unexpected bound PVC custody')\n config = projection(configmap)\n config.pop('data')\n config['canonical_data_sha256'] = hashlib.sha256(json.dumps(\n configmap['data'], sort_keys=True, separators=(',', ':')).encode()).hexdigest()\n return {'configmap': config, 'pvc': projection(pvc), 'pvc_phase': 'Bound'}\n\n\ndef check_dependencies(configmap, pvc, sealed):\n if dependency_projection(configmap, pvc) != sealed:\n raise ValueError('runtime config or PVC identity/custody changed')\n\n\ndef projection(value):\n value = copy.deepcopy(value)\n value.pop('status', None)\n for key in ('resourceVersion', 'generation', 'creationTimestamp', 'managedFields'):\n value['metadata'].pop(key, None)\n for key in ('kubectl.kubernetes.io/last-applied-configuration', 'deployment.kubernetes.io/revision'):\n value['metadata'].get('annotations', {}).pop(key, None)\n return value\n\n\ndef check_current(current, sealed):\n if projection(current) != sealed:\n raise ValueError('sealed live UID or configuration changed')\n\n\ndef check_admitted(admitted, sealed):\n expected = copy.deepcopy(sealed)\n containers = expected['spec']['template']['spec']['containers']\n if len(containers) != 1 or containers[0]['name'] != 'informed-decision' or containers[0]['image'] != BASE:\n raise ValueError('unexpected baseline container identity')\n containers[0]['image'] = CANDIDATE\n if projection(admitted) != expected:\n raise ValueError('admission changed configuration beyond the sole image pin')\n\n\ndef transport_result(exit_code, output):\n import json\n try:\n value = json.loads(output)\n except (ValueError, TypeError):\n return {'all_checks_pass': False, 'reason': 'invalid transport result'}\n if exit_code != 0 or not isinstance(value, dict) or value.get('all_checks_pass') is not True:\n return {'all_checks_pass': False, 'reason': 'read-only preflight refused'}\n return value\n"
},
{
"item_id": "preflight-py",
"media_type": "text/plain",
"content": "\"\"\"Read-only refresh; exact original capture remains immutable; never execute cutover.\"\"\"\nimport argparse,hashlib,json,subprocess,sys\nfrom pathlib import Path\nif sys.flags.optimize:\n raise SystemExit(\"optimized interpreter refused before source/transport execution\")\nROOT=Path(__file__).resolve().parent\np=argparse.ArgumentParser();p.add_argument('--receipt-output',type=Path,required=True);p.add_argument('--source-root',type=Path,default=Path('/home/worsch/informed-decision'));a=p.parse_args()\nout=a.receipt_output.resolve()\nif not a.receipt_output.is_absolute() or out==ROOT or ROOT in out.parents or out==a.source_root.resolve() or a.source_root.resolve() in out.parents or out.exists():\n raise SystemExit('unique execution receipt must be outside the sealed packet')\ninputs=json.loads((ROOT/'preflight-inputs.json').read_text())\nfor relative,digest in inputs['packet_files'].items():\n path=ROOT/relative\n if path.is_symlink() or hashlib.sha256(path.read_bytes()).hexdigest()!=digest:raise SystemExit('sealed helper/input bytes changed')\nfor relative,digest in inputs['owner_source_files'].items():\n path=a.source_root/relative\n if path.is_symlink() or hashlib.sha256(path.read_bytes()).hexdigest()!=digest:raise SystemExit('owner source bytes changed')\nfrom change_guard import transport_result\nprogram='import subprocess,json,hashlib,datetime,sys,copy,re\\nif sys.flags.optimize:raise RuntimeError(\"optimized interpreter refused\")\\ncandidate=json.loads(CANDIDATE_LITERAL)\\nsealed_dependencies=json.loads(DEPENDENCIES_LITERAL)\\nsealed_baseline=json.loads(SEALED_LITERAL)\\nexec(GUARD_LITERAL)\\ndef run(args,data=None):\\n p=subprocess.run(args,input=data,text=True,capture_output=True)\\n if p.returncode: raise ValueError(\\'read-only command failed: \\'+args[1]+\\' \\'+args[2])\\n return p.stdout\\nlive=json.loads(run([\\'kubectl\\',\\'get\\',\\'deployment\\',\\'informed-decision\\',\\'-n\\',\\'informed-decision\\',\\'-o\\',\\'json\\']))\\ncm=json.loads(run([\\'kubectl\\',\\'get\\',\\'configmap\\',\\'informed-decision-runtime-6c221878d051\\',\\'-n\\',\\'informed-decision\\',\\'-o\\',\\'json\\']))\\npvc=json.loads(run([\\'kubectl\\',\\'get\\',\\'pvc\\',\\'informed-decision-data\\',\\'-n\\',\\'informed-decision\\',\\'-o\\',\\'json\\']))\\ncheck_dependencies(cm,pvc,sealed_dependencies)\\ncheck_current(live,sealed_baseline)\\nspec=live[\\'spec\\']; cs=spec[\\'template\\'][\\'spec\\'][\\'containers\\'];assert len(cs)==1 and cs[0][\\'name\\']==\\'informed-decision\\'\\nexpected_env={\\'INFD_KEYCAPE_ISSUER\\':\\'https://kc.coulomb.social\\',\\'INFD_CONTAINER_CONFIG\\':\\'/configuration/runtime.json\\'}\\nassert cs[0].get(\\'env\\')==[{\\'name\\':\\'INFD_KEYCAPE_ISSUER\\',\\'value\\':expected_env[\\'INFD_KEYCAPE_ISSUER\\']},{\\'name\\':\\'INFD_CONTAINER_CONFIG\\',\\'value\\':expected_env[\\'INFD_CONTAINER_CONFIG\\']}]\\nassert cs[0][\\'image\\']==\\'forgejo.coulomb.social/coulomb/informed-decision@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173\\'\\nassert spec[\\'replicas\\']==1 and spec[\\'strategy\\']=={\\'type\\':\\'Recreate\\'}\\nassert next(v for v in spec[\\'template\\'][\\'spec\\'][\\'volumes\\'] if v[\\'name\\']==\\'configuration\\')[\\'configMap\\'][\\'name\\']==\\'informed-decision-runtime-6c221878d051\\'\\nassert live[\\'status\\'].get(\\'readyReplicas\\')==1 and live[\\'status\\'].get(\\'updatedReplicas\\')==1\\nsealed={\\'apiVersion\\':live[\\'apiVersion\\'],\\'kind\\':live[\\'kind\\'],\\'metadata\\':{k:copy.deepcopy(v) for k,v in live[\\'metadata\\'].items() if k not in (\\'resourceVersion\\',\\'generation\\',\\'creationTimestamp\\',\\'managedFields\\')},\\'spec\\':copy.deepcopy(spec)}\\nfor key in (\\'kubectl.kubernetes.io/last-applied-configuration\\',\\'deployment.kubernetes.io/revision\\'):sealed[\\'metadata\\'].get(\\'annotations\\',{}).pop(key,None)\\nadmitted=json.loads(run([\\'kubectl\\',\\'apply\\',\\'--dry-run=server\\',\\'-f\\',\\'-\\',\\'-o\\',\\'json\\'],json.dumps(candidate)))\\ncheck_admitted(admitted,sealed_baseline)\\napp=json.loads(run([\\'kubectl\\',\\'get\\',\\'application\\',\\'informed-decision\\',\\'-n\\',\\'argocd\\',\\'-o\\',\\'json\\']))\\nassert app[\\'spec\\'][\\'source\\'][\\'path\\']==\\'deploy/lifecycle\\' and not app[\\'spec\\'].get(\\'syncPolicy\\',{}).get(\\'automated\\')\\nargo={\\'uid\\':app[\\'metadata\\'][\\'uid\\'],\\'repoURL\\':app[\\'spec\\'][\\'source\\'][\\'repoURL\\'],\\'targetRevision\\':app[\\'spec\\'][\\'source\\'][\\'targetRevision\\'],\\'path\\':app[\\'spec\\'][\\'source\\'][\\'path\\'],\\'destination\\':app[\\'spec\\'][\\'destination\\'],\\'automated\\':False,\\'sync\\':app.get(\\'status\\',{}).get(\\'sync\\'),\\'health\\':app.get(\\'status\\',{}).get(\\'health\\')}\\nexpected_argo=json.loads(ARGO_LITERAL)\\nfor key in (\\'uid\\',\\'repoURL\\',\\'targetRevision\\',\\'path\\',\\'destination\\',\\'automated\\'):\\n assert argo[key]==expected_argo[key]\\nassert argo[\\'health\\'][\\'status\\']==\\'Healthy\\'\\ndiff=subprocess.run([\\'kubectl\\',\\'diff\\',\\'-f\\',\\'-\\'],input=json.dumps(candidate),text=True,capture_output=True);assert diff.returncode in (0,1)\\n# Diff can contain only nonsecret Deployment references; preserve digest rather than raw stdout.\\nnode=run([\\'kubectl\\',\\'describe\\',\\'node\\']);allocated=re.search(r\\'Allocated resources:.*?CPU Requests|Allocated resources:\\',node,re.S)\\nsection=node.split(\\'Allocated resources:\\')[1].split(\\'Events:\\')[0] if \\'Allocated resources:\\' in node else \\'\\'\\nnodes=json.loads(run([\\'kubectl\\',\\'get\\',\\'nodes\\',\\'-o\\',\\'json\\']))[\\'items\\'];assert len(nodes)==1\\nalloc=nodes[0][\\'status\\'][\\'allocatable\\'];cpu=alloc[\\'cpu\\'];cpu_m=int(cpu[:-1]) if cpu.endswith(\\'m\\') else int(cpu)*1000\\nrequested=int(re.search(r\\'cpu\\\\s+(\\\\d+)m\\',section).group(1));assert requested<=cpu_m\\nreceipt={\\'node_allocatable_cpu_m\\':cpu_m,\\'node_requested_cpu_m\\':requested,\\'captured_at\\':datetime.datetime.now(datetime.timezone.utc).isoformat(),\\'native_workload_changed\\':False,\\'native_backup_restore_executed\\':False,\\'argo\\':argo,\\'native_dependencies_checked\\':True,\\'configmap_uid\\':cm[\\'metadata\\'][\\'uid\\'],\\'pvc_uid\\':pvc[\\'metadata\\'][\\'uid\\'],\\'live_ready_replicas\\':1,\\'admitted_uid\\':admitted[\\'metadata\\'][\\'uid\\'],\\'server_dry_run_passed\\':True,\\'admitted_spec_exactly_live_plus_image\\':True,\\'client_diff_exit\\':diff.returncode,\\'client_diff_sha256\\':hashlib.sha256(diff.stdout.encode()).hexdigest(),\\'node_allocated_resources\\':section.strip(),\\'all_checks_pass\\':True}\\nprint(json.dumps(receipt))\\n'\nfor marker,value in [('DEPENDENCIES_LITERAL',(ROOT/'sealed-native-dependencies.json').read_text()),('CANDIDATE_LITERAL',(ROOT/'candidate-deployment.json').read_text()),('SEALED_LITERAL',(ROOT/'sealed-live-deployment.json').read_text()),('GUARD_LITERAL',(ROOT/'change_guard.py').read_text()),('ARGO_LITERAL',json.dumps(json.loads((ROOT/'native-preflight.json').read_text())['argo']))]:\n program=program.replace(marker,repr(value))\nprogram='import traceback,json\\ntry:\\n'+''.join(' '+line+'\\n' for line in program.splitlines())+\"except Exception as error:\\n print(json.dumps({'all_checks_pass':False,'exception_type':type(error).__name__,'exception_line':traceback.extract_tb(error.__traceback__)[-1].lineno}))\\n\"\nr=subprocess.run(['ssh','railiance01','python3 -'],input=program,text=True,capture_output=True)\nresult=transport_result(r.returncode,r.stdout);result['sealed_preflight_inputs_sha256']=hashlib.sha256((ROOT/'preflight-inputs.json').read_bytes()).hexdigest();result['fresh_execution_receipt']=True\nout.write_text(json.dumps(result,indent=2)+'\\n');print(json.dumps(result,indent=2));sys.exit(0 if result.get('all_checks_pass') is True else 1)\n"
},
{
"item_id": "preflight-inputs-json",
"media_type": "application/json",
"content": "{\n \"packet_files\": {\n \"change_guard.py\": \"f348e449c49f4d9e49af9e82e01764e7197837fd3df9d756f5891d9b8d9b38be\",\n \"preflight.py\": \"6b4c65f708238c9a9d17fd065876c7a00e1f1745926f990a1dd5e667298340cd\",\n \"candidate-deployment.json\": \"722a8e2dc52bec217bf960e23b2fddfc7ac27d343ac8743790e3183db81a6a0e\",\n \"rollback-deployment.json\": \"39b3f43bb84ef4921cc3a1fbcdc444610741ed8809149d8f8f17ed805f262121\",\n \"sealed-live-deployment.json\": \"d18d27063d06f535ae884ea01f96747fe301685518ab94b1cba072a1e1519362\",\n \"native-preflight.json\": \"eb5f41aefb97666bb0c1279617e95a7c05017a609415624daee724c48b90d262\",\n \"sealed-native-dependencies.json\": \"042327a036ed254cf95dbeb0c056ac25b03a6a844b95a332c992df2943691369\",\n \"sqlite_readonly.py\": \"eef53dd233eee74c17f20823bd7f5787c60cad79ac648021c9479643c6ce9e38\"\n },\n \"owner_source_files\": {\n \"deploy/lifecycle/admission.candidate.json\": \"92382a56b349c3b895e5806e975082527bb99d1a001140e69d857e5b0391fa55\",\n \"deploy/lifecycle/service.candidate.json\": \"38b78b9cbee5ade7750a58d5156ca4c5773352e947acb304ee714b59e749ceb4\"\n }\n}\n"
},
{
"item_id": "fresh-preflight-validation-json",
"media_type": "application/json",
"content": "{\n \"node_allocatable_cpu_m\": 4000,\n \"node_requested_cpu_m\": 3460,\n \"captured_at\": \"2026-10-11T01:39:14.234277+00:00\",\n \"native_workload_changed\": false,\n \"native_backup_restore_executed\": false,\n \"argo\": {\n \"uid\": \"499868f2-eabc-4df4-ae31-b89ce58d750d\",\n \"repoURL\": \"https://forgejo.coulomb.social/coulomb/informed-decision.git\",\n \"targetRevision\": \"7db8485ffecdebfabd77a9daec085553c74bf0bf\",\n \"path\": \"deploy/lifecycle\",\n \"destination\": {\n \"namespace\": \"informed-decision\",\n \"server\": \"https://kubernetes.default.svc\"\n },\n \"automated\": false,\n \"sync\": {\n \"comparedTo\": {\n \"destination\": {\n \"namespace\": \"informed-decision\",\n \"server\": \"https://kubernetes.default.svc\"\n },\n \"source\": {\n \"path\": \"deploy/lifecycle\",\n \"repoURL\": \"https://forgejo.coulomb.social/coulomb/informed-decision.git\",\n \"targetRevision\": \"7db8485ffecdebfabd77a9daec085553c74bf0bf\"\n }\n },\n \"revision\": \"7db8485ffecdebfabd77a9daec085553c74bf0bf\",\n \"status\": \"OutOfSync\"\n },\n \"health\": {\n \"lastTransitionTime\": \"2026-10-10T23:14:52Z\",\n \"status\": \"Healthy\"\n }\n },\n \"native_dependencies_checked\": true,\n \"configmap_uid\": \"90113d2d-54d9-4e82-b1d3-90b49ebed2b5\",\n \"pvc_uid\": \"d80b25b1-141a-441b-b205-98fa2fd98b7c\",\n \"live_ready_replicas\": 1,\n \"admitted_uid\": \"a588e10a-90d2-4883-975e-6dd8b8feca92\",\n \"server_dry_run_passed\": true,\n \"admitted_spec_exactly_live_plus_image\": true,\n \"client_diff_exit\": 1,\n \"client_diff_sha256\": \"840769c7d2a9c1655c40a3259f833d1fc8f69950ceb3bedb707a955fed711566\",\n \"node_allocated_resources\": \"(Total limits may be over 100 percent, i.e., overcommitted.)\\n Resource Requests Limits\\n -------- -------- ------\\n cpu 3460m (86%) 36200m (905%)\\n memory 9472Mi (59%) 32898Mi (205%)\\n ephemeral-storage 0 (0%) 0 (0%)\\n hugepages-1Gi 0 (0%) 0 (0%)\\n hugepages-2Mi 0 (0%) 0 (0%)\",\n \"all_checks_pass\": true,\n \"sealed_preflight_inputs_sha256\": \"756e72da9ec36572242421bea8b6d2285394e334f991db5e90e9b409563b5f06\",\n \"fresh_execution_receipt\": true\n}\n"
}
]
}
Reference in a new issue View git blame Copy permalink