From 42aaf6006228004a82dc7175bb0202120c68d3df Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 11 Oct 2026 02:44:21 +0200 Subject: [PATCH] Record exact conditional technical review of user readback rollout Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade --- .../amended-confirmation.json | 166 +++++++++++++++ .../amended-validation.json | 14 ++ .../receipt.json | 191 ++++++++++++++++++ .../review.md | 19 ++ .../validation.json | 14 ++ 5 files changed, 404 insertions(+) create mode 100644 docs/evidence/2026-10-11-user-readback-integration-review/amended-confirmation.json create mode 100644 docs/evidence/2026-10-11-user-readback-integration-review/amended-validation.json create mode 100644 docs/evidence/2026-10-11-user-readback-integration-review/receipt.json create mode 100644 docs/evidence/2026-10-11-user-readback-integration-review/review.md create mode 100644 docs/evidence/2026-10-11-user-readback-integration-review/validation.json diff --git a/docs/evidence/2026-10-11-user-readback-integration-review/amended-confirmation.json b/docs/evidence/2026-10-11-user-readback-integration-review/amended-confirmation.json new file mode 100644 index 0000000..f75ed50 --- /dev/null +++ b/docs/evidence/2026-10-11-user-readback-integration-review/amended-confirmation.json @@ -0,0 +1,166 @@ +{ + "schema_version": 1, + "review_role": "net-kingdom-integration-technical-review", + "reviewer": "custodian-codex/infd_image_preparation-independent-from-author", + "disposition": "agree-exact-amended-technical-packet-with-existing-human-and-native-gates", + "same_proposal_trial": "RAPP-USER-ENGINE-READBACK-2026-10-11-R2", + "original_conditional_packet_manifest_sha256": "3faf8e2b9b5c04b0e280268106519f52a3ff10eadba1c594c1fcca14630f3b98", + "amended_packet_manifest_sha256": "b4d45051aaa3de9cd7a4a4414a3a2c0a9672773fc6a1cd1e6931b2e21a6087c4", + "original_review_sha256": "2b5b4bb891f22c4c598d59be6c524c68be27d8f824a4d859a03a8c8502c13da5", + "original_receipt_sha256": "37884ee102d354366fbb651721dff7e4885f48951d2717148a4fefeeb26152b6", + "submission_digest": "sha256:0511d2ce7caff063db1d74f986f86e953f4ddb9b7b3affdf78558438f1958416", + "amended_packet_sources": [ + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/argocd-before.json", + "sha256": "bd2aca067d8fd80e104e83b0de89e5705226c278ec99207c171eab2a48ea7e0e" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/baseline-source-match.json", + "sha256": "4cc7747b4aafc5f5ca44c93e0f8670ff818dc7c9ff0250e145a8dea081d713a5" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/before-metadata.json", + "sha256": "88a16f59557f5c06f9877d84f4c323905054f1c847a77dbf0474d0b2b343aca9" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/candidate.yaml", + "sha256": "3c0700c9d6505bf3c48b3e01e3b3537855cf0dd09486d4deb4812443d6509d99" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/change-path-before.json", + "sha256": "2e9426f2c1c7fa3ef0b77b17ade11651a823784564f52f043ba6a84069f7a6ca" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/decision-packet.md", + "sha256": "76814d47e33d652c39c78b11ee5a0498c3f10ff89a41c4219048d7d0eab0f5f2" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/exposure-inventory.json", + "sha256": "0597480b6539d0e5f27d2f90096cffa93c8820bceb6074d09ed4e778697de296" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/initial-checker-mismatch.json", + "sha256": "aeb19931ef8022765d1f0fdf6cd610a195687200de622d8d62ba7ba9bea464a3" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/intake.json", + "sha256": "17737f7d6973514095801ba01be995b945331e2ef6d3d0ac010ded72acb85480" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/lifecycle-commands.json", + "sha256": "37b0c9f35fc18180eeb62f3e3fc84ae34e60af05b24f774622f2e72d3c153792" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/memo.json", + "sha256": "117e4468ef00a8d80199e1fdcfb5a6ee8b2da3293505dab8073cfa35cebee6b0" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/proposal.json", + "sha256": "f890fcd61f5614628dfabeef76fc4a609360245fe43a607ff81dd5448c3da219" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/provider-before-metadata.json", + "sha256": "824023edfb175528353ceb3977277fb78811a3b1e7e778aa6b18be9829199f0b" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/published-ci-repair-native-outcome.json", + "sha256": "81a9115550b22d2ec1079e178383439601931d0658bc24a87ba8409205693bdc" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/published-receipt.json", + "sha256": "2f84959e36d442860fb2b5a5817bb707c4f8372797a3ef8dd0d5cab956af86ce" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/review-refinement.json", + "sha256": "abdf518d27d6a6f78429159fa7e01c40ed68ef890a630abfacb92272b3cac12a" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/risk-assessment.md", + "sha256": "db5a9d37d45b4f04dd6841ee77f16b2024c7e7d85c9b880e8f0f8efedfbc0a5d" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/rollback.yaml", + "sha256": "a859b68d9e5c1bc94ef90c286c183c53fc09473572fbd017604383fb8828fa7d" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/server-dry-run.json", + "sha256": "af5924ae0428124a897af979f111e629b85b15b3a06daf924d856afc58fe6bac" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/strict-guard-regressions.json", + "sha256": "777548c530c253b4d62291acc99e73bf9ac182ade4f11567625867c93a7c45b8" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/strict-guard.py", + "sha256": "6b0944584d2bd76177e84c047f3714f6dfac4537c21e00102d270e8a1373876e" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/test-strict-guard.py", + "sha256": "180134191b94db33f53a8708749639814ed8bee3da149f53eeb5533349e86287" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/validation.json", + "sha256": "7d3c57fd6b9aa9f7a2b2a6315a4f2f44e51080ae20a03e980ac31eaadb4944eb" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/verify-dry-run.py", + "sha256": "c5da990c21499cdac04d4592efdfcceb09251a77cce4473d58959fa1e3ca8060" + }, + { + "repo": "rapp-user-engine", + "path": "workplans/RAPP-USER-ENGINE-WP-0004-published-readback-rollout.md", + "sha256": "083f7cfcf7f45387a72e28c76a70f2ae8ff8607314265f830907ca7bbf100742" + }, + { + "repo": "risk-nexus", + "path": "findings/RISK-F-0016-user-engine-os-runtime-findings.md", + "sha256": "caea6a4232e2b73bc24756721c947016ca7ce0e4b8500ac204b2436e372aea26" + } + ], + "verified_refinements": [ + "Decision/risk/memo explicitly disclose same workload ServiceAccount audience and3600s projection, routing/rotation separation without cryptographic capability-isolation claim; substitution untested and not prevented", + "Candidate and rollback bytes unchanged from original exact reviewed packet", + "Independent actual-source intake/memo/12documents/lifecycle validation and all26filehash checks pass", + "Strict declared/admitted negative fixtures:8mutations x2checks rejected; exact candidate passes", + "Fresh serverdryrun00:37:02Z read-only all2unique identities and exactly live specs+prescribedchanges; source/serverchecks and clientdiff passed", + "Original conditional snapshot and initial failed refinement checks retained" + ], + "source_request_narrowed_or_widened": false, + "risk_nexus_grade_assigned": false, + "human_risk_acceptance": false, + "human_deployment_approval": false, + "native_readback_accepted": false, + "reviewer_native_action_executed": false, + "remaining_execution_gates": [ + "Authenticated informed-decision human disposition bound to exact amended packet and twoobjectcandidate, accepting44HIGHresidual risk", + "Fresh strictbaseline/provider/admission/headroom/context/ownership preflight immediately beforeexecution", + "Execute only approved twoobjects before2026-10-12T23:59:59Z; no catalogue/policy/credential/database writes", + "Manualriskreview/renewal or exactrollback by2026-10-18T23:59:59Z; projectedtokenrotation doesnotendtrial", + "Real admitted consumer/catalogue verification; syntheticcases do not establishlogin/MFA or finishtasks" + ], + "authority": "Owner technical source review only; no RiskNexus grade, human disposition, runtime grant or scored privileged success created" +} diff --git a/docs/evidence/2026-10-11-user-readback-integration-review/amended-validation.json b/docs/evidence/2026-10-11-user-readback-integration-review/amended-validation.json new file mode 100644 index 0000000..dc25535 --- /dev/null +++ b/docs/evidence/2026-10-11-user-readback-integration-review/amended-validation.json @@ -0,0 +1,14 @@ +{ + "manifest_sha256": "b4d45051aaa3de9cd7a4a4414a3a2c0a9672773fc6a1cd1e6931b2e21a6087c4", + "manifest_files_digest_verified": 26, + "intake_valid_offline": true, + "submission_digest": "sha256:0511d2ce7caff063db1d74f986f86e953f4ddb9b7b3affdf78558438f1958416", + "memo_typed_valid": true, + "all_12_packet_document_hashes_and_actual_files_match": true, + "all_12_lifecycle_documents_valid": true, + "candidate_rollback_exact_two_object_identity_match": true, + "NP_adds_only_one_conjunctive_TCP8080_provider_rule": true, + "Recreate_replica_and_resource_requests_unchanged": true, + "readback_and_enforcement_same_serviceaccount_audience": true, + "independent_native_action_executed": false +} diff --git a/docs/evidence/2026-10-11-user-readback-integration-review/receipt.json b/docs/evidence/2026-10-11-user-readback-integration-review/receipt.json new file mode 100644 index 0000000..68107d6 --- /dev/null +++ b/docs/evidence/2026-10-11-user-readback-integration-review/receipt.json @@ -0,0 +1,191 @@ +{ + "schema_version": 1, + "review_role": "net-kingdom-integration-technical-review", + "reviewer": "custodian-codex/infd_image_preparation-independent-from-author", + "review_date": "2026-10-11", + "exact_original_packet_manifest_sha256": "3faf8e2b9b5c04b0e280268106519f52a3ff10eadba1c594c1fcca14630f3b98", + "disposition": "technical-agreement-with-required-disclosure-refinement-and-native-execution-gates", + "risk_nexus_grade_assigned": false, + "human_risk_acceptance": false, + "live_action_approved": false, + "native_action_executed": false, + "review_sha256": "2b5b4bb891f22c4c598d59be6c524c68be27d8f824a4d859a03a8c8502c13da5", + "reviewed_packet_sources": [ + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/argocd-before.json", + "sha256": "bd2aca067d8fd80e104e83b0de89e5705226c278ec99207c171eab2a48ea7e0e" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/baseline-source-match.json", + "sha256": "4cc7747b4aafc5f5ca44c93e0f8670ff818dc7c9ff0250e145a8dea081d713a5" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/before-metadata.json", + "sha256": "88a16f59557f5c06f9877d84f4c323905054f1c847a77dbf0474d0b2b343aca9" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/candidate.yaml", + "sha256": "3c0700c9d6505bf3c48b3e01e3b3537855cf0dd09486d4deb4812443d6509d99" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/change-path-before.json", + "sha256": "2e9426f2c1c7fa3ef0b77b17ade11651a823784564f52f043ba6a84069f7a6ca" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/decision-packet.md", + "sha256": "34a555f0a6a778fd43712d4cdef86668189dca015c9dc2dc9f2915ea3231c8e6" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/exposure-inventory.json", + "sha256": "0597480b6539d0e5f27d2f90096cffa93c8820bceb6074d09ed4e778697de296" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/initial-checker-mismatch.json", + "sha256": "aeb19931ef8022765d1f0fdf6cd610a195687200de622d8d62ba7ba9bea464a3" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/intake.json", + "sha256": "909c0a1deae53820e1ea08b2ac7c4d38810550f8d49dbf0ceefcda6c529588df" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/lifecycle-commands.json", + "sha256": "bc05f4317e6df688f496bb87eb08fce6a78459d38b5493364c07b7e12683fda8" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/memo.json", + "sha256": "bdcbee866c9a296a0501d185daadf5d45f3542257232c5ff2b34860a1a618ce8" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/proposal.json", + "sha256": "ed503194028d22386efc5195b813ac0aa0caed5bd0d74ada301a654c4bf02754" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/provider-before-metadata.json", + "sha256": "824023edfb175528353ceb3977277fb78811a3b1e7e778aa6b18be9829199f0b" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/published-ci-repair-native-outcome.json", + "sha256": "81a9115550b22d2ec1079e178383439601931d0658bc24a87ba8409205693bdc" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/published-receipt.json", + "sha256": "2f84959e36d442860fb2b5a5817bb707c4f8372797a3ef8dd0d5cab956af86ce" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/risk-assessment.md", + "sha256": "030a161d3fe0ee7c141ced8ef24f37c85bcfb6379ece4b838b329047ae569da0" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/rollback.yaml", + "sha256": "a859b68d9e5c1bc94ef90c286c183c53fc09473572fbd017604383fb8828fa7d" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/server-dry-run.json", + "sha256": "9384b00e4d10eefbb18c4dbba2f7e58eae01d02e2acd5fa41b243c1b475b4d0e" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/validation.json", + "sha256": "2fc86e37f5e0df4bb18820697ff71ce9258176cd25c9ff005c3fb4b6f970c715" + }, + { + "repo": "rapp-user-engine", + "path": "docs/evidence/2026-10-11-published-readback-proposal/verify-dry-run.py", + "sha256": "de88e7d1e33673a69f64d865e02464baa64b1f6729379c4f6e9065e27e911028" + }, + { + "repo": "rapp-user-engine", + "path": "workplans/RAPP-USER-ENGINE-WP-0004-published-readback-rollout.md", + "sha256": "083f7cfcf7f45387a72e28c76a70f2ae8ff8607314265f830907ca7bbf100742" + }, + { + "repo": "risk-nexus", + "path": "findings/RISK-F-0016-user-engine-os-runtime-findings.md", + "sha256": "caea6a4232e2b73bc24756721c947016ca7ce0e4b8500ac204b2436e372aea26" + } + ], + "owner_source_hashes": [ + { + "path": "/home/worsch/net-kingdom/AGENTS.md", + "sha256": "065d47b7bdbfe829672a2a6161a7f8cf243237a1210fb61d82f153fa37f22131" + }, + { + "path": "/home/worsch/net-kingdom/INTENT.md", + "sha256": "fd2ba8dff9dfd5583ec6d8b0348f273bfe00c59923b5d5d47cd22b1fb4658c54" + }, + { + "path": "/home/worsch/net-kingdom/SECURITY-COMPANION.md", + "sha256": "06374445ca888549f1bf79527d1345d94918d7a7ec363160d8427d0e7a31d643" + }, + { + "path": "/home/worsch/net-kingdom/canon/standards/security-layer-model_v0.8.md", + "sha256": "3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b" + }, + { + "path": "/home/worsch/user-engine/INTENT.md", + "sha256": "8aa0f276e0879d3545338727188a1fd5af973c43acbfa986a135b20979ec7ba4" + }, + { + "path": "/home/worsch/user-engine/src/user_engine/application_access.py", + "sha256": "798f180474d98e1c6abacc7b8bfba3184d40ecb77d9ca90f6526cd4f774cf363" + }, + { + "path": "/home/worsch/user-engine/src/user_engine/adapters/application_access.py", + "sha256": "adf1fac707446f41b5859ba5102e820cd88f60af5daf20a42f13dfa2067d5481" + }, + { + "path": "/home/worsch/user-engine/src/user_engine/adapters/flex_auth.py", + "sha256": "73d645b7b37904ebfe0df6f7ed397b74b4c47f505cd64a30c39e60717ce71455" + }, + { + "path": "/home/worsch/user-engine/src/user_engine/web.py", + "sha256": "c5fbd412102238219f3b231557815fb30c0a7f822c28a371bcffc63076456a14" + }, + { + "path": "/home/worsch/rapp-user-engine/AGENTS.md", + "sha256": "458931a839e65f752f265a332a54522aff9cb65868c5cc1531479850b4496d5e" + }, + { + "path": "/home/worsch/informed-decision/informed_decision/intake.py", + "sha256": "a733b4b608b9ea90b2c8293901aa14388a0bf0d3719f121038bfdcc1faca2038" + }, + { + "path": "/home/worsch/informed-decision/informed_decision/memo.py", + "sha256": "697058863a4e6de2c143a2433eaaf5e15e5e7375dc5459af6911b146567e8b5d" + }, + { + "path": "/home/worsch/informed-decision/informed_decision/lifecycle_commands.py", + "sha256": "783ec451dd7ef33dc0cfd72c1633ea5208dfd463afeaa0b68d279f156a9b0828" + } + ], + "conditions": [ + "same-ServiceAccount/audience projection is not proven authority isolation disclosed in packet and risk assessment; regenerate hashes and obtain amended exact review", + "strict fresh preflight exact2uniqueobjectidentities and intendedNPpeer, no zip truncation/duplicate names acceptance", + "explicit human conditional44HIGHrisk+exactrollout disposition", + "manual review/renewal or rollback by dateddeadline; no automaticcontrollerclaim", + "native actualcatalogue/consumer tests before task closure" + ], + "knowledge_orientation": { + "version": "0.2.6", + "digest": "8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02", + "source_status": "withheld; actual NetKingdom owner sources reviewed" + } +} diff --git a/docs/evidence/2026-10-11-user-readback-integration-review/review.md b/docs/evidence/2026-10-11-user-readback-integration-review/review.md new file mode 100644 index 0000000..63688a8 --- /dev/null +++ b/docs/evidence/2026-10-11-user-readback-integration-review/review.md @@ -0,0 +1,19 @@ +# Independent NetKingdom integration review of User Engine readback R2 + +Role: NetKingdom integration technical review, independently performed by custodian-codex worker infd_image_preparation. This is neither RiskNexus grading nor human residual-risk acceptance, live rollout approval or an autonomous authority grant. Exact reviewed source packet manifest SHA256: `3faf8e2b9b5c04b0e280268106519f52a3ff10eadba1c594c1fcca14630f3b98` (22 files). Disposition: technical agreement conditional on the credential-separation disclosure refinement below and existing execution gates. The original revision remains reviewed evidence; any amended memo/packet hashes require explicit amended-hash confirmation. + +The packet honestly retains a failed clean-scan gate: actual immutable f239bbf image scan SHA17b793f13bd19fa87bba840ced3c9c40a78a78feda569019e92c347dc7f3e76a contains44 HIGH package/CVE occurrences,8 distinct CVEs,0 CRITICAL and0 fixed HIGH versions for scanned packages. Independent recount agrees. Every primary Debian tracker record was checked on2026-10-11; the stated vulnerable Trixie/unfixed-package observations and upstream fix availability agree. Privileged utility prerequisites constrain plausible paths; they do not prove unreachability. The bounded missing homed/Archive::Tar observations, possible denial of service/application compromise/mounted credential exposure, unchanged old-image uncertainty, and unpriced security incident consequences remain explicit. No scanner severity is downgraded by this review. + +The change follows owner intent: User Engine remains a PIP/domain and integration owner; KeyCape owns authentication/client identity, Access Engine remains the sole PDP, and User Engine's local catalogue only joins matching client issuer/id and protected-system registration. The readback cache includes session, issuer, subject and tenant, bounds reuse by lifetime, retries unavailable results and renders expired/missing/non-allow results unavailable. Readback is used for advisory display; the protected mutation adapter still calls its separate enforcement endpoint. The packet correctly leaves catalogue and actual admitted consumer tests open; synthetic policy fixtures are not a real human login/MFA receipt. This source review does not assert that catalogue records already exist or that native consumer acceptance is complete. + +Required disclosure refinement: the readback token and existing enforcement token are both Kubernetes projections for the same User Engine ServiceAccount and audience `flex-auth`, expiration3600s. Separate files/projections and distinct HTTP adapters are routing/rotation separation, not demonstrated cryptographic authority isolation. Tokens may be substitutable across existing provider registrations for the same subject/audience; this proposal neither tests nor prevents that substitution. Its statement that no enforcement grant changes is valid only as unchanged admission/policy, not as a new token incapable of enforcement. State this directly in both decision packet and risk assessment and regenerate the exact memo/intake/lifecycle hashes. No credential values, token fingerprints or secret metadata were read. + +Candidate and rollback hashes match; both contain exactly Deployment/user-engine and NetworkPolicy/user-engine-runtime in namespace user-engine. Independent comparison confirms the only NP delta is one conjunctive namespace+provider-pod peer on TCP8080; ingress and all prior peers remain identical. The Deployment retains Recreate/one replica, resource requests/limits, database/Secret references and enforcement mounts. The projected readback token and corresponding env/mount plus exact immutable image are the documented deltas. Baseline server-dry-run receipt shows the expected two identities and scoped changes at00:28:18Z; no mutation occurred. No new Secret, ServiceAccount, catalogue seed, policy grant, provider deployment or database write is within the rollout approval. + +Fresh preflight must assert exact object counts and unique identities for baseline/candidate/server-admitted objects, exact approved image/hash, unchanged declared baseline/provider readiness/admission and native management ownership. Treat NetworkPolicy additions by their exact new peer, not an unrestricted `spec/egress` allowance. The preserved checker uses zip/list-to-name normalization and a whole-egress change path; the observed current receipt is complete, but that helper alone must not accept a truncated future response or duplicate names. These strict checks fit the existing packet's mandatory two-object/diff stop conditions. Reobserve requested CPU/headroom;3460m/4000m is historical, and no request/surge increase is included. + +Execution expires2026-10-12T23:59:59Z; approved residual-risk disposition requires review/renewal or the exact rollback by2026-10-18T23:59:59Z. The service has no controller enforcing either deadline, and expiring projected tokens are routinely renewed while the pod runs. Credential TTL therefore does not end the trial or replace manual risk-review responsibility. Follow the existing supervised record and native change gate; require explicit informed human disposition for both the residual OS risk and exact two-object rollout. No source acceptance or technical review substitutes for it. + +Rollback is one coordinated two-object restoration to the exact old immutable image/configuration and prior NP, preserving database/enforcement custody. It must be used on failed readiness/enforcement/unexpected effects and at manual review expiry without renewal; verify recovered readiness, old image/NP and enforcement behavior. The old image is not assumed clean. Deployment readiness, source/CI checks and this technical receipt cannot finish USER-WP0026-T03 or USER-WP0028-T02 without actual admitted consumer/catalogue acceptance. + +Primary exposure references: [mount](https://security-tracker.debian.org/tracker/CVE-2026-76642), [nsenter](https://security-tracker.debian.org/tracker/CVE-2026-78408), [subdir](https://security-tracker.debian.org/tracker/CVE-2026-78409), [bind mount](https://security-tracker.debian.org/tracker/CVE-2026-78410), [ACL](https://security-tracker.debian.org/tracker/CVE-2026-54369), [ncurses](https://security-tracker.debian.org/tracker/CVE-2025-69720), [systemd](https://security-tracker.debian.org/tracker/CVE-2026-16742), [Perl](https://security-tracker.debian.org/tracker/CVE-2026-9538). diff --git a/docs/evidence/2026-10-11-user-readback-integration-review/validation.json b/docs/evidence/2026-10-11-user-readback-integration-review/validation.json new file mode 100644 index 0000000..af9c2ee --- /dev/null +++ b/docs/evidence/2026-10-11-user-readback-integration-review/validation.json @@ -0,0 +1,14 @@ +{ + "manifest_sha256": "3faf8e2b9b5c04b0e280268106519f52a3ff10eadba1c594c1fcca14630f3b98", + "manifest_files_digest_verified": 22, + "intake_valid_offline": true, + "submission_digest": "sha256:a1aa280ee929f1c88e7b88570ad5b173aff23dc255c554b62c6e7397662d59e4", + "memo_typed_valid": true, + "all_12_packet_document_hashes_and_actual_files_match": true, + "all_12_lifecycle_documents_valid": true, + "candidate_rollback_exact_two_object_identity_match": true, + "NP_adds_only_one_conjunctive_TCP8080_provider_rule": true, + "Recreate_replica_and_resource_requests_unchanged": true, + "readback_and_enforcement_same_serviceaccount_audience": true, + "independent_native_action_executed": false +}