tegwick
d7133e3a04
- canon/schemas/execution-attribution-receipt_v0.1.schema.json: the bounded-executor profile of the PCC v0.2 receipt, both audit-core events (started, receipt), every object closed. - tools/execution-attribution-receipt: EAR-1..EAR-10 validator, fixtures generated from the real executor (completed, reverted, completed-on-retry) with a drift check. - executor: started carries receipt_version, digests, steps_planned and data.window.not_after (audit-core AUDIT-WP-0018-T03 request); receipt carries receipt_version and initiator.iss (configured approver_issuer, else unknown). - bounded-executor/exercise_audit_sender.py: real executor and client against audit-core's real ingestion and the Git scope overlay: 202, duplicate 200, conflict 409 as a defect, wrong source/tenant/token refused and not stored, a receipt-less start flagged by its own window. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 523928@bnt-lap001 Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350
117 lines
3.1 KiB
JSON
117 lines
3.1 KiB
JSON
{
|
|
"correlation_id": "0b7e4a52-3c1d-4f6e-8a90-1b2c3d4e5f60",
|
|
"data": {
|
|
"action": "bounded-execution",
|
|
"artifact_digest": "sha256:df214e02c24e70c6ac799bee873862f0d24d9bd537bf77cfb845a7b880c7565b",
|
|
"attempts": 1,
|
|
"budget": {
|
|
"limit": {
|
|
"attempts": 1,
|
|
"wall_time_seconds": 1200
|
|
},
|
|
"used": {
|
|
"attempts": 1,
|
|
"wall_time_seconds": 28.0
|
|
}
|
|
},
|
|
"decision_refs": [
|
|
{
|
|
"label": "admission",
|
|
"ref": "BEA-2026-0001"
|
|
},
|
|
{
|
|
"label": "admission_digest",
|
|
"ref": "sha256:bbaa3afb2885cc1dd8a4b00f48f3f7265aaf05d4c2f03479fb935c44e5bf013b"
|
|
},
|
|
{
|
|
"label": "approval",
|
|
"ref": "6f1c2b9e-0a4d-4e3b-9c51-7d2f8a6b3e10"
|
|
}
|
|
],
|
|
"environment": "PRODUCTION",
|
|
"executing_workload": "service:nk-bind-executor",
|
|
"initiator": {
|
|
"iss": "https://kc.coulomb.social",
|
|
"role": "approver",
|
|
"sub": "kc-sub-0f3a"
|
|
},
|
|
"outcome": "completed",
|
|
"pdp": "not-evaluated",
|
|
"receipt_version": "0.1",
|
|
"reverted": false,
|
|
"run_id": "0b7e4a52-3c1d-4f6e-8a90-1b2c3d4e5f60",
|
|
"runtime_principal": "system:serviceaccount:sso:nk-bind-executor",
|
|
"source_commit": "15c9cdbef881",
|
|
"steps": [
|
|
{
|
|
"checks": [
|
|
{
|
|
"id": "kv-advanced",
|
|
"result": "pass"
|
|
}
|
|
],
|
|
"consumer": "authelia",
|
|
"id": "generate",
|
|
"kind": "step",
|
|
"operation": "openbao.kv.write-next-version",
|
|
"outcome": "done",
|
|
"target": "openbao:platform/workloads/net-kingdom/directory-binds/svc-authelia"
|
|
},
|
|
{
|
|
"checks": [
|
|
{
|
|
"id": "bind-signs-in",
|
|
"result": "pass"
|
|
}
|
|
],
|
|
"consumer": "authelia",
|
|
"id": "set-directory",
|
|
"kind": "step",
|
|
"operation": "lldap.user.change-own-password-from-kv",
|
|
"outcome": "done",
|
|
"target": "lldap:svc-authelia"
|
|
},
|
|
{
|
|
"checks": [
|
|
{
|
|
"id": "eso-synced",
|
|
"result": "pass"
|
|
}
|
|
],
|
|
"consumer": "authelia",
|
|
"id": "deliver",
|
|
"kind": "step",
|
|
"operation": "eso.force-sync",
|
|
"outcome": "done",
|
|
"target": "k8s:sso/externalsecret/authelia-secrets"
|
|
},
|
|
{
|
|
"checks": [
|
|
{
|
|
"id": "synthetic-journey",
|
|
"result": "pass"
|
|
}
|
|
],
|
|
"consumer": "authelia",
|
|
"id": "restart",
|
|
"kind": "step",
|
|
"operation": "k8s.rollout-restart",
|
|
"outcome": "done",
|
|
"target": "k8s:sso/deployment/authelia"
|
|
}
|
|
],
|
|
"target": "admission:BEA-2026-0001",
|
|
"tenant": "platform",
|
|
"time_interval": {
|
|
"clock_source": "system-utc",
|
|
"end": "2026-11-03T09:30:28Z",
|
|
"start": "2026-11-03T09:30:00Z"
|
|
}
|
|
},
|
|
"id": "run:0b7e4a52-3c1d-4f6e-8a90-1b2c3d4e5f60:receipt",
|
|
"occurred_at": "2026-11-03T09:30:28+00:00",
|
|
"source": "net-kingdom.bounded-executor",
|
|
"subject": "admission:BEA-2026-0001",
|
|
"tenant": "platform",
|
|
"type": "execution.attribution.receipt"
|
|
}
|