tegwick
47881fc1ff
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
42 lines
4.5 KiB
Python
42 lines
4.5 KiB
Python
import datetime,hashlib,json,os,stat,subprocess
|
|
from pathlib import Path
|
|
base=Path('/home/worsch/informed-decision/docs/evidence/2026-10-11-zlib-image-release')
|
|
revision='312ab97e876e17341bf16f9e95397e14c2ac2720'
|
|
program='''import json,re,urllib.request
|
|
from datetime import datetime,timezone
|
|
from api.services.memo_dispatch import ORIGIN,NoRedirect,token_file
|
|
ident='infd-20261011-zlib-remediation-r1';expected='review-2cf690a6-8c46-4faa-826c-a24a88d53dea'
|
|
try:
|
|
request=urllib.request.Request(ORIGIN+'/v1/decisions/'+ident+'/outcomes?version=1',headers={'Authorization':'Bearer '+token_file('/var/run/secrets/state-hub/informed-decision/lifecycle-token')})
|
|
opener=urllib.request.build_opener(urllib.request.ProxyHandler({}),NoRedirect())
|
|
with opener.open(request,timeout=20) as response:
|
|
raw=response.read(1024*1024+1)
|
|
if response.code!=200 or len(raw)>1024*1024:raise ValueError('response_refused')
|
|
value=json.loads(raw);review=value['review'];rows=value['dispositions']
|
|
if not isinstance(review,dict) or review.get('memo_id')!=expected or review.get('stale') is not False or review.get('intake_state')!='ready' or not isinstance(rows,list):raise ValueError('review_refused')
|
|
if len(rows)!=1:print(json.dumps({'status':'approval_pending','disposition_count':len(rows)}));raise SystemExit(3)
|
|
row=rows[0];d=row['disposition'];founder={'kind':'person','sub':'uid=platform-root,ou=people,dc=netkingdom,dc=local'}
|
|
if row.get('submission_state')!='confirmed' or d.get('verb')!='accept':print(json.dumps({'status':'approval_not_confirmed_accept'}));raise SystemExit(3)
|
|
if d.get('actor')!=founder or d.get('memo_version')!=1 or d.get('memo_id')!=expected or not re.fullmatch('[a-f0-9-]{36}',d.get('approval_id','')) or not re.fullmatch('disp-[a-f0-9-]{36}',d.get('id','')):raise ValueError('founder_refused')
|
|
accepted=datetime.fromisoformat(d['at'].replace('Z','+00:00'));now=datetime.now(timezone.utc)
|
|
if accepted.tzinfo is None or accepted>now:raise ValueError('time_refused')
|
|
normalized={'memo_id':ident,'request_identity_origin':'fixed_authenticated_request_route','review':{'memo_id':expected,'intake_state':'ready','stale':False},'dispositions':[{'submission_state':'confirmed','disposition':{k:d[k] for k in ['id','at','memo_id','memo_version','verb','approval_id','actor']}}],'observed_at':now.isoformat()}
|
|
print(json.dumps({'status':'confirmed_founder_acceptance','normalized_outcome':normalized}),flush=True)
|
|
except SystemExit:raise
|
|
except Exception:print(json.dumps({'status':'native_readback_unverified'}),flush=True);raise SystemExit(1) from None
|
|
'''
|
|
run=subprocess.run(['ssh','railiance01','kubectl -n state-hub exec -i deployment/state-hub-memo-dispatch -c dispatcher -- python -'],input=program,text=True,capture_output=True,timeout=60)
|
|
try:result=json.loads(run.stdout)
|
|
except Exception:raise SystemExit('Native readback unverified; raw transport suppressed')
|
|
if run.returncode or result.get('status')!='confirmed_founder_acceptance':print(json.dumps({'status':result.get('status','native_readback_unverified'),'native_action':False}));raise SystemExit(3)
|
|
outcome=result['normalized_outcome'];d=outcome['dispositions'][0]['disposition']
|
|
raw=(json.dumps(outcome,sort_keys=True,indent=2)+'\n').encode()
|
|
receipt=json.loads((base/'root-authority-receipt-template.json').read_text())
|
|
receipt.update(memo_sha256=hashlib.sha256((base/'memo.json').read_bytes()).hexdigest(),source_revision=revision,executor_plan_sha256=hashlib.sha256((base/'execution/execution-plan.json').read_bytes()).hexdigest(),native_outcome_sha256=hashlib.sha256(raw).hexdigest(),activation='APPROVED',verified_at=datetime.datetime.now(datetime.timezone.utc).isoformat(),native_observed_at=outcome['observed_at'],review_memo_id=outcome['review']['memo_id'],approval_id=d['approval_id'],disposition_id=d['id'],accepted_at=d['at'],bounded_outage_rollback_pre_authorized=True)
|
|
for path,data in [(Path('/tmp/security-infd-zlib-native-outcome-latest.json'),raw),(Path('/tmp/security-infd-zlib-root-authority.json'),(json.dumps(receipt,indent=2)+'\n').encode())]:
|
|
if path.exists():
|
|
info=path.lstat()
|
|
if not stat.S_ISREG(info.st_mode) or info.st_uid!=os.getuid() or info.st_nlink!=1:raise SystemExit('Authority custody refused')
|
|
fd=os.open(path,os.O_CREAT|os.O_TRUNC|os.O_WRONLY|os.O_NOFOLLOW,0o600);os.fchmod(fd,0o600)
|
|
with os.fdopen(fd,'wb') as f:f.write(data);f.flush();os.fsync(f.fileno())
|
|
print(json.dumps({'status':'confirmed_founder_acceptance','approval_id':d['approval_id'],'disposition_id':d['id'],'accepted_at':d['at'],'source_revision':revision,'verified_at':receipt['verified_at'],'native_action':False}))
|