tegwick
0ef57537ac
Candidate files: review policy pin v14 (sha256:8911458f...), the nk-bind-executor present_existing registry row (daily limit 10), and an 8081 ingress peer for exactly sso + app.kubernetes.io/name=bounded-executor. The state-hub row is unchanged and outcome_read stays off. The image pin stays at the live f5588f49 because no owner-CI full-service image exists yet; the founder runbook (deploy/lifecycle/RELEASE-INFD-WP-0010-T02.md) gates the release on it. Adds a side-effect-free present_existing probe and release tests. Nothing applied. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
88 lines
4.6 KiB
Python
88 lines
4.6 KiB
Python
"""Build one synthetic present_existing intake envelope (INFD-WP-0010-T02 release check).
|
|
|
|
The envelope pins an approval id the caller names and a deliberately wrong binding
|
|
digest, so a successful approval read always ends in a 409 refusal and no memo is
|
|
stored, no budget is spent and no approval is created, entered or consumed. It only
|
|
prints JSON; posting it is a separate, founder-run step (see
|
|
deploy/lifecycle/RELEASE-INFD-WP-0010-T02.md). The content is synthetic and secret-free.
|
|
"""
|
|
|
|
import argparse
|
|
from datetime import datetime, timezone
|
|
import hashlib
|
|
import json
|
|
import sys
|
|
|
|
ACTOR = "service:nk-bind-executor"
|
|
SUBMITTER = "nk-bind-executor"
|
|
PROFILE_ACTIONS = ["bounded-execution"]
|
|
WRONG_DIGEST = "sha256:" + "0" * 64
|
|
WORKLOAD = "http://informed-decision-workload.informed-decision.svc.cluster.local:8081/v1/memos"
|
|
TOKEN_FILE = "/var/run/secrets/informed-decision-intake/token"
|
|
|
|
# Runs inside the founder's probe pod (python from the service image). Prints status and the
|
|
# refusal body only; never prints the token.
|
|
POSTER = """import json, urllib.error, urllib.request
|
|
token = open(%r).read().strip()
|
|
request = urllib.request.Request(%r, data=ENVELOPE.encode(), method="POST",
|
|
headers={"Authorization": "Bearer " + token, "Content-Type": "application/json"})
|
|
try:
|
|
response = urllib.request.urlopen(request, timeout=20)
|
|
print(response.status, response.read().decode()[:400])
|
|
except urllib.error.HTTPError as error:
|
|
print(error.code, error.read().decode()[:400])
|
|
""" % (TOKEN_FILE, WORKLOAD)
|
|
|
|
|
|
def build(approval_id, stamp):
|
|
memo_id = "probe-" + stamp
|
|
item_id = memo_id + "-packet"
|
|
content = ("Synthetic release probe for the present_existing intake profile. "
|
|
"It is refused by design and must never be shown for review.\n")
|
|
packet_hash = "sha256:" + hashlib.sha256(content.encode()).hexdigest()
|
|
memo = {
|
|
"id": memo_id, "version": 1, "sealed": False, "locale": "en",
|
|
"question": "Synthetic release probe: is this refused before review?",
|
|
"requested_act": "approve", "binding_level": "organizational", "step_kind": "approve",
|
|
"brief": "Synthetic present_existing release probe; never bound.",
|
|
"binding": {"justification": None, "terms": None,
|
|
"principal": {"id": "pending-human-session", "kind": "person", "role": "reviewer",
|
|
"display_name": "Named reviewer in net-kingdom-admins", "identifiers": []},
|
|
"target": {"environment": "prod", "id": "probe:" + memo_id, "kind": "bounded-execution",
|
|
"label": "synthetic release probe", "requires_new_bind": False}},
|
|
"packet": [{"item_id": item_id, "label": item_id, "hash": packet_hash}],
|
|
"highlights": [],
|
|
"approval_id": approval_id, "approval_binding_digest": WRONG_DIGEST,
|
|
}
|
|
return {
|
|
"kind": "informed-decision.memo-intake", "version": 1,
|
|
"idempotency_key": memo_id, "memo_class": "bounded-execution",
|
|
"review_group": "net-kingdom-admins", "drafted_by": "informed-decision-release-probe",
|
|
"approval_intent": {"action": "bounded-execution", "principal": "admin",
|
|
"purpose": "Synthetic present_existing release probe",
|
|
"target": {"admission_id": "PROBE-" + stamp, "admission_digest": WRONG_DIGEST}},
|
|
"memo": memo,
|
|
"packet": [{"item_id": item_id, "media_type": "text/plain", "content": content}],
|
|
}
|
|
|
|
|
|
def main():
|
|
parser = argparse.ArgumentParser(description=__doc__)
|
|
parser.add_argument("--approval-id", required=True, help="existing approval UUID, or a random UUID")
|
|
parser.add_argument("--program", action="store_true",
|
|
help="print a self-contained python program that posts the envelope (for `python -`)")
|
|
parser.add_argument("--stamp", default=datetime.now(timezone.utc).strftime("%Y%m%d%H%M%S"))
|
|
args = parser.parse_args()
|
|
envelope = build(args.approval_id, args.stamp)
|
|
# Offline self-check against the same validator intake uses.
|
|
from informed_decision.intake import PresentExisting, SubmitterGrant, validate_submission
|
|
validate_submission(envelope, submitter_id=SUBMITTER,
|
|
grant=SubmitterGrant(SUBMITTER, frozenset({"bounded-execution"}),
|
|
frozenset({"net-kingdom-admins"})),
|
|
present_existing=PresentExisting(ACTOR, frozenset(PROFILE_ACTIONS)))
|
|
raw = json.dumps(envelope, separators=(",", ":"))
|
|
sys.stdout.write("ENVELOPE = %r\n%s" % (raw, POSTER) if args.program else raw + "\n")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|