Adopt shared hourly coordination frame and prepare guarded runtime patches
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
This commit is contained in:
parent
a83691398e
commit
2d0681f361
15 changed files with 860 additions and 70 deletions
|
|
@ -0,0 +1,29 @@
|
|||
[
|
||||
{
|
||||
"op": "test",
|
||||
"path": "/metadata/uid",
|
||||
"value": "8b44c901-024f-4472-a822-2fd07aa2be5f"
|
||||
},
|
||||
{
|
||||
"op": "test",
|
||||
"path": "/metadata/resourceVersion",
|
||||
"value": "75292270"
|
||||
},
|
||||
{
|
||||
"op": "add",
|
||||
"path": "/spec/template/metadata/annotations",
|
||||
"value": {
|
||||
"coordination.coulomb.social/frame-sha256": "d15e092387f128ffdfd00b9815707a05ff77c5bb0ba4d9a428fbc37b8c440b67"
|
||||
}
|
||||
},
|
||||
{
|
||||
"op": "add",
|
||||
"path": "/spec/template/spec/containers/0/args/-",
|
||||
"value": "--heartbeat-seconds"
|
||||
},
|
||||
{
|
||||
"op": "add",
|
||||
"path": "/spec/template/spec/containers/0/args/-",
|
||||
"value": "3600"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
{
|
||||
"workplan_id": "04685f94-1991-5e62-80d2-5669913e99fc",
|
||||
"id": "1ac5a70f-082e-4d8f-9ac8-59e4c175da02",
|
||||
"topic_id": null,
|
||||
"title": "Use a configurable ecosystem coordination frame, initially one hour",
|
||||
"description": "Founder directs one base duration frame for ecosystem coordination timelines and deadlines. Set f=1h now, with waits expressed as 2f and 3f rather than independent day constants. First cadence adoption: heartbeat f, registered receiver wait 2f, existing 1.5 grace yields effective 3f.",
|
||||
"decision_type": "made",
|
||||
"status": "resolved",
|
||||
"rationale": "Small team is moving quickly; long-term coordination currently needs an hourly rather than daily pace. Owner-reviewed adoption retains timing formulas and frame provenance. This records the configuration decision, not an approval of an unspecified live rollout.",
|
||||
"decided_by": "Bernd Worsch (founder), explicit session instruction",
|
||||
"decided_at": "2026-10-15T18:05:48.234679Z",
|
||||
"deadline": null,
|
||||
"escalation_note": null,
|
||||
"superseded_by": null,
|
||||
"created_at": "2026-10-15T18:05:49.826919Z",
|
||||
"updated_at": "2026-10-15T18:05:49.826919Z",
|
||||
"workstream_id": "04685f94-1991-5e62-80d2-5669913e99fc"
|
||||
}
|
||||
|
|
@ -0,0 +1,47 @@
|
|||
{
|
||||
"decision_id": "1ac5a70f-082e-4d8f-9ac8-59e4c175da02",
|
||||
"config": {
|
||||
"ref": "coordination-engine/config/coordination-frame.json",
|
||||
"sha256": "d15e092387f128ffdfd00b9815707a05ff77c5bb0ba4d9a428fbc37b8c440b67",
|
||||
"frame_seconds": 3600,
|
||||
"heartbeat_frames": 1,
|
||||
"registered_wait_frames": 2,
|
||||
"effective_deadline_frames": 3,
|
||||
"decision_id": "1ac5a70f-082e-4d8f-9ac8-59e4c175da02"
|
||||
},
|
||||
"tests": {
|
||||
"coordination_engine": {
|
||||
"passed": 73,
|
||||
"skipped": 1
|
||||
},
|
||||
"coordination_frame_and_profile": {
|
||||
"passed": 32
|
||||
},
|
||||
"approval_engine": {
|
||||
"passed": 271
|
||||
},
|
||||
"qonto_assistant": {
|
||||
"passed": 91
|
||||
},
|
||||
"rapp_qonto": {
|
||||
"passed": 25
|
||||
},
|
||||
"kings_guard": {
|
||||
"passed": 128
|
||||
}
|
||||
},
|
||||
"compiler_check": "no drift",
|
||||
"source_assessments": "source-assessments-f1h.json",
|
||||
"manifest_preservation": "semantic comparison against committed manifests proves only heartbeat settings and frame digest annotations changed; image/identity/secrets/routing/scaling preserved",
|
||||
"deployment_applied": false,
|
||||
"registry_applied": false,
|
||||
"independent_live_observer_proved": false,
|
||||
"source_commits": {
|
||||
"coordination-engine": "f658556690f3f6b7efe9c95a445222019182e402",
|
||||
"approval-engine": "a786b061da4d7730c0827cf4919ab9206aed6d3e",
|
||||
"qonto-assistant": "5eb7e86f7a5fccf8bb8c40bd991e32bb9ae440c9",
|
||||
"rapp-qonto": "51de093b4431fc7cc569be84bc20cbff7aa6a4d5",
|
||||
"kings-guard": "164a4cdaf12e7a450ac225f7a645e769a3e76f40"
|
||||
},
|
||||
"runtime_preflight": "Both timing-only patches passed server dry-run on verified railiance01; nothing applied"
|
||||
}
|
||||
|
|
@ -4,6 +4,99 @@
|
|||
"profile_status": "proposed",
|
||||
"live_observer_proved": false,
|
||||
"source_files": {
|
||||
"approval_source": {
|
||||
"path": "../approval-engine/cadence.yaml",
|
||||
"sha256": "cc58c8d53ebf50acf540d73b7607d579942bda7734c3e8722108e9c9204af655"
|
||||
},
|
||||
"qonto_source": {
|
||||
"path": "../qonto-assistant/specs/audit-emission-cadence.yaml",
|
||||
"sha256": "adedbe06e04c38812057db97364557644157eb5f72f16adebb6f7beec1587005"
|
||||
},
|
||||
"generic_schema": {
|
||||
"path": "../info-tech-canon/infospace/schemas/emission-cadence.schema.yaml",
|
||||
"sha256": "6d52692eb1e4d1325e0d6062d95acded98beddaae5bcfe24c6f0e91f1b6be6ae"
|
||||
},
|
||||
"bearer_revocation_receipt": {
|
||||
"path": "../audit-core/docs/evidence/2026-09-15-sender-bearer-revocation.json",
|
||||
"sha256": "8da798005611711f4a3da969597a3763e6c02e41013df5227b0434dc328b6fb3"
|
||||
},
|
||||
"qonto_historical_capture": {
|
||||
"path": "../rapp-qonto/evidence/live/2026-09-05-audit-rollout.json",
|
||||
"sha256": "1cad71fe93ab2a9f7d5dbc99b9aada47c212a7e43813a86ea91f52639e163be9"
|
||||
}
|
||||
},
|
||||
"approval_engine_registration_proposal": {
|
||||
"status": "not-applied; founder selected configurable f=1h",
|
||||
"sender": "approval-engine",
|
||||
"source": "approval-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"preserve": [
|
||||
"tokens",
|
||||
"secret_policy=redact",
|
||||
"may_write=true",
|
||||
"may_read=false",
|
||||
"existing other senders and registry fields"
|
||||
],
|
||||
"emission_cadence": "Import exact source-owned cadence.yaml at the pinned digest; never use a draft/fallback schema",
|
||||
"class_mapping": {
|
||||
"issuance": "approval.issuance",
|
||||
"use": "approval.use",
|
||||
"supersession": "approval.supersession",
|
||||
"revocation": "approval.revocation",
|
||||
"heartbeat": "audit-core.heartbeat"
|
||||
},
|
||||
"heartbeat_transport": "audit-core.heartbeat",
|
||||
"covered_class_field": "data.class",
|
||||
"source_interval_seconds": 3600,
|
||||
"source_requested_bound_seconds": 7200,
|
||||
"receiver_grace_factor": 1.5,
|
||||
"live_steps": [
|
||||
"Verify generated one-hour frame bindings, current runtime/source pins and separately approved rollout scope",
|
||||
"Review exact protected-registry metadata-only patch preserving credentials and all unrelated entries",
|
||||
"Founder approves exact runtime change; use governed owner custody with contained session and CAS/readback",
|
||||
"Receiver reload under owner change gate; prove actual per-class registration and class-isolated heartbeats",
|
||||
"Emit/drain actual lifecycle transitions under owner-scoped authority; correlate occurrence, acknowledgment and receiver acceptance windows including lag and duplicates",
|
||||
"Independent readback/count comparison and missing-class/lag findings; retain value-safe receipts"
|
||||
],
|
||||
"existing_revocation_proof": "2026-09-15 T1 accepted 202, dropped T1 refused 401, incumbent T0 accepted 202; do not repeat unchanged synthetic proof as if absent",
|
||||
"effective_deadline_seconds": 10800,
|
||||
"coordination_frame": {
|
||||
"ref": "coordination-engine/config/coordination-frame.json",
|
||||
"sha256": "d15e092387f128ffdfd00b9815707a05ff77c5bb0ba4d9a428fbc37b8c440b67",
|
||||
"frame_seconds": 3600,
|
||||
"heartbeat_frames": 1,
|
||||
"registered_wait_frames": 2,
|
||||
"effective_deadline_frames": 3,
|
||||
"decision_id": "1ac5a70f-082e-4d8f-9ac8-59e4c175da02"
|
||||
}
|
||||
},
|
||||
"qonto": {
|
||||
"required_owner": "rapp-qonto",
|
||||
"missing": "Actual stdout collector/sender source/image/config and governed delivery lane",
|
||||
"authoritative_workload_tenant": "tenant:friendly:binky (rapp-qonto binding; collector mapping still needs source/receiver review)",
|
||||
"receiver_commitment": "AUDIT-WP-0013-T05",
|
||||
"receiver_instance_filter": "Implemented in AUDIT-WP-0013-T04; reviewed release and native proof still required",
|
||||
"source_coordination": "QONTO-WP-0006-T02",
|
||||
"observer_acceptance": "KG-WP-0005-T03 then QONTO-WP-0006-T03",
|
||||
"historical_receipt_limit": "Source-path capture with startup and deny; not independent collector/feed acceptance",
|
||||
"source_interval_seconds": 3600,
|
||||
"runtime_status": "source settings prepared; not deployed in this session"
|
||||
},
|
||||
"local_identity": {
|
||||
"status": "explicit incompatibility retained",
|
||||
"expected_findings": [
|
||||
"rare-heartbeat-missing:revoke-token",
|
||||
"rare-heartbeat-missing:serve/token.token_issued"
|
||||
],
|
||||
"completeness_claimed": false
|
||||
},
|
||||
"observer_fix": {
|
||||
"defect": "Shared heartbeat event type could mask silence of another covered class",
|
||||
"change": "Require explicit covered_event_classes as well as matching transport class; retain source/adapter coverage, not inferred traffic/count keys",
|
||||
"old_regression": "False COMPLETE for unscoped audit-core.heartbeat across issuance/revocation",
|
||||
"deployment_or_live_acceptance": false
|
||||
},
|
||||
"source_files_before_frame": {
|
||||
"approval_source": {
|
||||
"path": "../approval-engine/cadence.yaml",
|
||||
"sha256": "0389be492628e2df0d84a70755c92aaf4a749bc64fbf2772e0c3301c3e1fe5ed"
|
||||
|
|
@ -25,73 +118,13 @@
|
|||
"sha256": "1cad71fe93ab2a9f7d5dbc99b9aada47c212a7e43813a86ea91f52639e163be9"
|
||||
}
|
||||
},
|
||||
"approval_engine_registration_proposal": {
|
||||
"status": "not-applied; owner deadline decision pending",
|
||||
"sender": "approval-engine",
|
||||
"source": "approval-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"preserve": [
|
||||
"tokens",
|
||||
"secret_policy=redact",
|
||||
"may_write=true",
|
||||
"may_read=false",
|
||||
"existing other senders and registry fields"
|
||||
],
|
||||
"emission_cadence": "Import exact source-owned cadence.yaml at the pinned digest; never use a draft/fallback schema",
|
||||
"class_mapping": {
|
||||
"issuance": "approval.issuance",
|
||||
"use": "approval.use",
|
||||
"supersession": "approval.supersession",
|
||||
"revocation": "approval.revocation",
|
||||
"heartbeat": "audit-core.heartbeat"
|
||||
},
|
||||
"heartbeat_transport": "audit-core.heartbeat",
|
||||
"covered_class_field": "data.class",
|
||||
"source_interval_seconds": 86400,
|
||||
"source_requested_bound_seconds": 172800,
|
||||
"receiver_grace_factor": 1.5,
|
||||
"deadline_options": [
|
||||
{
|
||||
"effective_seconds": 172800,
|
||||
"registration_seconds": 115200
|
||||
},
|
||||
{
|
||||
"effective_seconds": 259200,
|
||||
"registration_seconds": 172800
|
||||
}
|
||||
],
|
||||
"live_steps": [
|
||||
"Owner confirms effective heartbeat deadline and current runtime/source pin",
|
||||
"Review exact protected-registry metadata-only patch preserving credentials and all unrelated entries",
|
||||
"Founder approves exact runtime change; use governed owner custody with contained session and CAS/readback",
|
||||
"Receiver reload under owner change gate; prove actual per-class registration and class-isolated heartbeats",
|
||||
"Emit/drain actual lifecycle transitions under owner-scoped authority; correlate occurrence, acknowledgment and receiver acceptance windows including lag and duplicates",
|
||||
"Independent readback/count comparison and missing-class/lag findings; retain value-safe receipts"
|
||||
],
|
||||
"existing_revocation_proof": "2026-09-15 T1 accepted 202, dropped T1 refused 401, incumbent T0 accepted 202; do not repeat unchanged synthetic proof as if absent"
|
||||
},
|
||||
"qonto": {
|
||||
"required_owner": "rapp-qonto",
|
||||
"missing": "Actual stdout collector/sender source/image/config and governed delivery lane",
|
||||
"authoritative_workload_tenant": "tenant:friendly:binky (rapp-qonto binding; collector mapping still needs source/receiver review)",
|
||||
"receiver_commitment": "AUDIT-WP-0013-T05",
|
||||
"receiver_instance_filter": "Implemented in AUDIT-WP-0013-T04; reviewed release and native proof still required",
|
||||
"source_coordination": "QONTO-WP-0006-T02",
|
||||
"observer_acceptance": "KG-WP-0005-T03 then QONTO-WP-0006-T03",
|
||||
"historical_receipt_limit": "Source-path capture with startup and deny; not independent collector/feed acceptance"
|
||||
},
|
||||
"local_identity": {
|
||||
"status": "explicit incompatibility retained",
|
||||
"expected_findings": [
|
||||
"rare-heartbeat-missing:revoke-token",
|
||||
"rare-heartbeat-missing:serve/token.token_issued"
|
||||
],
|
||||
"completeness_claimed": false
|
||||
},
|
||||
"observer_fix": {
|
||||
"defect": "Shared heartbeat event type could mask silence of another covered class",
|
||||
"change": "Require explicit covered_event_classes as well as matching transport class; retain source/adapter coverage, not inferred traffic/count keys",
|
||||
"old_regression": "False COMPLETE for unscoped audit-core.heartbeat across issuance/revocation",
|
||||
"deployment_or_live_acceptance": false
|
||||
"coordination_frame": {
|
||||
"ref": "coordination-engine/config/coordination-frame.json",
|
||||
"sha256": "d15e092387f128ffdfd00b9815707a05ff77c5bb0ba4d9a428fbc37b8c440b67",
|
||||
"frame_seconds": 3600,
|
||||
"heartbeat_frames": 1,
|
||||
"registered_wait_frames": 2,
|
||||
"effective_deadline_frames": 3,
|
||||
"decision_id": "1ac5a70f-082e-4d8f-9ac8-59e4c175da02"
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -0,0 +1,37 @@
|
|||
[
|
||||
{
|
||||
"op": "test",
|
||||
"path": "/metadata/uid",
|
||||
"value": "a665e1d0-3ada-4b27-ac56-a8d452499003"
|
||||
},
|
||||
{
|
||||
"op": "test",
|
||||
"path": "/metadata/resourceVersion",
|
||||
"value": "57092911"
|
||||
},
|
||||
{
|
||||
"op": "add",
|
||||
"path": "/spec/template/metadata/annotations/coordination.coulomb.social~1frame-sha256",
|
||||
"value": "d15e092387f128ffdfd00b9815707a05ff77c5bb0ba4d9a428fbc37b8c440b67"
|
||||
},
|
||||
{
|
||||
"op": "replace",
|
||||
"path": "/spec/template/spec/containers/0/env/0/value",
|
||||
"value": "3600"
|
||||
},
|
||||
{
|
||||
"op": "add",
|
||||
"path": "/spec/traffic",
|
||||
"value": [
|
||||
{
|
||||
"revisionName": "rapp-qonto-00009",
|
||||
"percent": 100
|
||||
},
|
||||
{
|
||||
"latestRevision": true,
|
||||
"percent": 0,
|
||||
"tag": "frame-preview"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
{
|
||||
"approval-engine": {
|
||||
"patch": "approval-engine-frame-runtime-patch.json",
|
||||
"server_dry_run_exit": 0,
|
||||
"resource_uid": "8b44c901-024f-4472-a822-2fd07aa2be5f",
|
||||
"resource_version": "75292270",
|
||||
"additional_owner_step": "OnDelete requires separately approved controlled restart of approval-engine-0; image and storage schema stay unchanged",
|
||||
"live_mutations": false
|
||||
},
|
||||
"rapp-qonto": {
|
||||
"patch": "rapp-qonto-frame-runtime-patch.json",
|
||||
"server_dry_run_exit": 0,
|
||||
"resource_uid": "a665e1d0-3ada-4b27-ac56-a8d452499003",
|
||||
"resource_version": "57092911",
|
||||
"additional_owner_step": "Keep all traffic on the current Ready revision while creating zero-percent frame-preview candidate; promote only after owner verification",
|
||||
"live_mutations": false
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,34 @@
|
|||
{
|
||||
"live_mutations": false,
|
||||
"cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786",
|
||||
"resources": {
|
||||
"approval-engine": {
|
||||
"available": true,
|
||||
"kind": "statefulset",
|
||||
"namespace": "approval-engine",
|
||||
"uid": "8b44c901-024f-4472-a822-2fd07aa2be5f",
|
||||
"resource_version": "75292270",
|
||||
"image": "forgejo.coulomb.social/coulomb/approval-engine@sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49",
|
||||
"heartbeat_argument_seconds": [],
|
||||
"heartbeat_environment_seconds": [],
|
||||
"frame_digest": null,
|
||||
"status_ready": 1,
|
||||
"rollout_strategy": "OnDelete"
|
||||
},
|
||||
"rapp-qonto": {
|
||||
"available": true,
|
||||
"kind": "ksvc",
|
||||
"namespace": "rapp-qonto",
|
||||
"uid": "a665e1d0-3ada-4b27-ac56-a8d452499003",
|
||||
"resource_version": "57092911",
|
||||
"image": "forgejo.coulomb.social/coulomb/rapp-qonto@sha256:2e42b5e665a19ffa3b3ae8109a8aab64f5485329f72810be063263ff5086cb3f",
|
||||
"heartbeat_argument_seconds": [],
|
||||
"heartbeat_environment_seconds": [
|
||||
"86400"
|
||||
],
|
||||
"frame_digest": null,
|
||||
"status_ready": "rapp-qonto-00009",
|
||||
"rollout_strategy": null
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,92 @@
|
|||
{
|
||||
"live_observer_proved": false,
|
||||
"reports": {
|
||||
"approval-engine": {
|
||||
"assessment_scope": "supplied-inventory",
|
||||
"conformant": true,
|
||||
"contract_schema": "../info-tech-canon/infospace/schemas/emission-cadence.schema.yaml",
|
||||
"contract_valid": true,
|
||||
"declaration": "../approval-engine/cadence.yaml",
|
||||
"findings": [],
|
||||
"inventory": {
|
||||
"attributive": [],
|
||||
"load_bearing": [
|
||||
"heartbeat"
|
||||
],
|
||||
"rare_load_bearing": [
|
||||
"issuance",
|
||||
"revocation",
|
||||
"supersession",
|
||||
"use"
|
||||
]
|
||||
},
|
||||
"profile": "netkingdom-emission-cadence-security-profile-v0.1",
|
||||
"profile_assessed": true,
|
||||
"summary": {
|
||||
"must": 0,
|
||||
"should": 0
|
||||
}
|
||||
},
|
||||
"local-identity": {
|
||||
"assessment_scope": "supplied-inventory",
|
||||
"conformant": false,
|
||||
"contract_schema": "../info-tech-canon/infospace/schemas/emission-cadence.schema.yaml",
|
||||
"contract_valid": true,
|
||||
"declaration": "local-identity/emission-cadence.yaml",
|
||||
"findings": [
|
||||
{
|
||||
"code": "rare-heartbeat-missing",
|
||||
"event_class": "revoke-token",
|
||||
"level": "MUST",
|
||||
"message": "rare load-bearing evidence requires a positive heartbeat"
|
||||
},
|
||||
{
|
||||
"code": "rare-heartbeat-missing",
|
||||
"event_class": "serve/token.token_issued",
|
||||
"level": "MUST",
|
||||
"message": "rare load-bearing evidence requires a positive heartbeat"
|
||||
}
|
||||
],
|
||||
"inventory": {
|
||||
"attributive": [],
|
||||
"load_bearing": [],
|
||||
"rare_load_bearing": [
|
||||
"revoke-token",
|
||||
"serve/token.token_issued"
|
||||
]
|
||||
},
|
||||
"profile": "netkingdom-emission-cadence-security-profile-v0.1",
|
||||
"profile_assessed": true,
|
||||
"summary": {
|
||||
"must": 2,
|
||||
"should": 0
|
||||
}
|
||||
},
|
||||
"qonto-assistant": {
|
||||
"assessment_scope": "supplied-inventory",
|
||||
"conformant": true,
|
||||
"contract_schema": "../info-tech-canon/infospace/schemas/emission-cadence.schema.yaml",
|
||||
"contract_valid": true,
|
||||
"declaration": "../qonto-assistant/specs/audit-emission-cadence.yaml",
|
||||
"findings": [],
|
||||
"inventory": {
|
||||
"attributive": [
|
||||
"audit.allow"
|
||||
],
|
||||
"load_bearing": [
|
||||
"audit.deny",
|
||||
"audit.heartbeat"
|
||||
],
|
||||
"rare_load_bearing": [
|
||||
"audit.deny"
|
||||
]
|
||||
},
|
||||
"profile": "netkingdom-emission-cadence-security-profile-v0.1",
|
||||
"profile_assessed": true,
|
||||
"summary": {
|
||||
"must": 0,
|
||||
"should": 0
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue