tegwick
c52ca7f405
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa
124 lines
8.8 KiB
JSON
124 lines
8.8 KiB
JSON
{
|
|
"schema": "nk49.keycape-native-fixture-proposal.v1",
|
|
"status": "prepared_not_executed_not_approved",
|
|
"source_sha256": {
|
|
"sso-mfa/bootstrap/sops-private.py": "sha256:acac68e2936ed38b7d7c9e35eb4619647c99c117a3928a1c5ce704b570906780",
|
|
"sso-mfa/k8s/privacyidea/key-custody-remote.py": "sha256:27b2b885c81923d85054e3999c5613e104fe627779b2b50398ed9bed5088f47e",
|
|
"tests/run_isolated_keycape_native_fixture.py": "sha256:ecbadecc475622eaaf20a726110aebef5f4fe7af141110a98aca1640179b4a03",
|
|
"tests/test_identity_bundle.py": "sha256:be5ce74097594cc7f7e77dbccd6cb53aa72f263cd1bb442ce5464038aed1116c",
|
|
"tests/test_isolated_keycape_fixture_plan.py": "sha256:5945619f4c5957187763276cc900870a9f08f9475b63c240694688e0c2eca7dd",
|
|
"tests/test_isolated_keycape_recovery.py": "sha256:5f729e077db51dd6b17d00dc3eb71c0e652849f55fe68505a07befa663c91dea",
|
|
"tests/test_isolated_keycape_session.py": "sha256:cbdf51efde26eff337e9303a2c431f80b333b8846d763eb62853f81eb3f13e2c",
|
|
"tools/bootstrap-recovery/capture-identity.py": "sha256:47dca7c4dc96fa7eb9fb02c81fca9ca8dc5281aac918979eb7367148168ba705",
|
|
"tools/bootstrap-recovery/check-privacyidea-database.py": "sha256:90f454c87998d7f5d625e3c6656c3418f8f56275dc1879a9d19ed605431b94a4",
|
|
"tools/bootstrap-recovery/fetch-privacyidea-backup.py": "sha256:233160e1206643a5cf7ad05141d733f0a75aff651190e27f77515a124ff0a59f",
|
|
"tools/bootstrap-recovery/identity-backup-profile.json": "sha256:40f9e5b5bb957e5b23e03b31701702b850502d16a92a0fa0ebf92618cc3f18a1",
|
|
"tools/bootstrap-recovery/identity-bundle.py": "sha256:524a03c065db4307fcde83d33af39503f3de19cb6ef3a8ca72c991d4a8c08ee6",
|
|
"tools/bootstrap-recovery/identity-credential-setup.py": "sha256:ddd6127fa331c0185523ec3bb22d743a791edd56a2e6af7ad8d7949b7c051141",
|
|
"tools/bootstrap-recovery/identity-custody.json": "sha256:f8aee8487ed01d7940b82676bb4a5c8d61f51b6c598521b8b8a73588aaea4d4f",
|
|
"tools/bootstrap-recovery/identity-files.py": "sha256:d0063a9eedd3610e3d45bd2d834aae83cff74e4b3504d138b3548f427e89331d",
|
|
"tools/bootstrap-recovery/identity-isolation.py": "sha256:88d1e13112a44c79571825af89d3fe5b01fa490cff2653badef4c62a45c844f1",
|
|
"tools/bootstrap-recovery/identity-offsite.py": "sha256:e7c31fa9ee081961af873348ee3b4829a645d40c7dc7f1e22c564aa9ed01bc49",
|
|
"tools/bootstrap-recovery/identity-retention.py": "sha256:a41ea4759f69c35548149fc8d0d5ace547f16cf9fe4c9dac10b119a4d0becdec",
|
|
"tools/bootstrap-recovery/identity-runtime.py": "sha256:a2c0acf567c204705b90be64d561d0fda2285e0fc71a962d6e1b149f571e1940",
|
|
"tools/bootstrap-recovery/install-identity-backup.py": "sha256:5c612a2a51c9b59aad8cc01d418c2f563cbd92c62dc1fa8be994e5fb59df90f1",
|
|
"tools/bootstrap-recovery/inventory-scaleway.py": "sha256:a219df205708fa4ed44b763a418585d63c820c25434bc0fd14e805eb5c2f79d3",
|
|
"tools/bootstrap-recovery/inventory-storage-share.py": "sha256:673f9b17fb2f3fef6fcdb5c50a2bcca69e3df3157a9e5582a2d995c6b87640b5",
|
|
"tools/bootstrap-recovery/isolated-keycape-session.py": "sha256:8fa38efe28167b59a6307f342b2ac8fcda78ecda60e6228f22017424d2343c22",
|
|
"tools/bootstrap-recovery/isolated-keycape.py": "sha256:86f37add7221e4c73e3f9d878c09a3cc81061627cbf024ed6887d973d929b718",
|
|
"tools/bootstrap-recovery/isolated-lldap.py": "sha256:35bfa8411186ad936a199bd450c7e18c2ad51059301a6db9650e6bd055ab1b81",
|
|
"tools/bootstrap-recovery/isolated-privacyidea.py": "sha256:4df7196678aac1ad594f32abf45c68dc21a9d2760d9e8a536a215a4a3c5d277f",
|
|
"tools/bootstrap-recovery/prepare-identity-coverage.py": "sha256:cd5f3067d28b4c7cc93ed08b8cf3869218bdecf7c54b5dffed22d697de71dbb1",
|
|
"tools/bootstrap-recovery/recovery-kit.py": "sha256:6fa0f1494dccaf003b6c6396c5de8b36faa2b276eeb16badd04383f5efb71e66",
|
|
"tools/bootstrap-recovery/retrieve-identity-offline.py": "sha256:3421dbb3f3280a001d33ea2deb12ab609404a0b4254cd43c21518d77d166f972",
|
|
"tools/bootstrap-recovery/retrieve-identity.py": "sha256:ec123d47a07305253570dacab7e103f8c193a23f20c9fc87466ea4a95ae0ec13",
|
|
"tools/bootstrap-recovery/run-isolated-keycape.sh": "sha256:0d994c9c14ebdffdbf7879bd7562042531083d0e8955424d0ae099898a141668",
|
|
"tools/bootstrap-recovery/verify-bundle.py": "sha256:885b05a2011e711228e42e316bda70bbe0d97d481383d61aa8469d0f10452370",
|
|
"tools/bootstrap-recovery/verify-identity-delivery.py": "sha256:63658d1976806f8d0ce80ba8f750bbcfdca59da936b6eb6a78a250f0e53710f1",
|
|
"tools/bootstrap-recovery/verify-identity.py": "sha256:039864d0141b552887752bf17cfdcf1bef4bdc9126f946a9c0533e4fd54ebf4f",
|
|
"sso-mfa/bootstrap/sops-custody-unlock.sh": "sha256:86c527a8ae0d0cca66a2345c566b25fbff5bc52c1e22c725548c0fbb2f86a58e",
|
|
"sso-mfa/bootstrap/sops-custody-fd.py": "sha256:df29eaba83ec6b5fc311664dcf4b22d8f3c8ed7274ed8e6c419ada0dcd169c0f",
|
|
"tools/bootstrap-recovery/prepare-isolated-keycape.py": "sha256:5098bdfa4e0ad30627c1716e5e355a2c78dca6ccc607bd2148a2e06126632288",
|
|
"tests/test_prepare_isolated_keycape.py": "sha256:4b0871f9a11a3940983464f1b40eca1613110b1cb3cb9694f4891d58e14c700a",
|
|
"tests/test_sealed_custody.py": "sha256:f0fa07c89e2419464dbee0489462864a4533770417a554b1ab1d1ed5d7b6c49f",
|
|
"tests/test_private_manifest_binding.py": "sha256:2e7ee16af65390343435b7210ef191aa2a10e9dcbb8759ed95fa8bf6fb81893b"
|
|
},
|
|
"fixed_endpoint": "unix:///var/run/docker.sock",
|
|
"engine_id": "74f93783-6cef-43a8-a3c4-f62586cd3bc1",
|
|
"engine_name": "bnt-lap001",
|
|
"images": [
|
|
"forgejo.coulomb.social/coulomb/key-cape@sha256:cdec9dd7c515f7e0a6169fc3fa560ee2cc47bf40d899755dec808c362f5ce010",
|
|
"ghcr.io/gpappsoft/privacyidea-docker@sha256:af7841adad262f129e0c1d4f553af13f21cb2f4dc713533f316cfe43ed0b4473"
|
|
],
|
|
"pull_policy": "never",
|
|
"synthetic_issuer": "https://nk49-fixture.invalid",
|
|
"cases": [
|
|
"positive",
|
|
"hard-parent-loss",
|
|
"deadline",
|
|
"nonzero-after-accept"
|
|
],
|
|
"limits": {
|
|
"sequential_cases": true,
|
|
"max_live_service_containers": 2,
|
|
"max_tmpfs_volumes": 4,
|
|
"max_public_probe_containers": 1,
|
|
"service_memory_bytes_each": 536870912,
|
|
"service_cpus_each": 1,
|
|
"tmpfs_volume_bytes_each": 33554432,
|
|
"host_tmpfs_fixture_limit_expected_bytes": 8388608,
|
|
"execution_deadline_seconds": {
|
|
"deadline_case": 20,
|
|
"other_cases": 120
|
|
},
|
|
"driver_wait_seconds_per_case": 150
|
|
},
|
|
"resources": {
|
|
"container_names": "nk49-kc-<fresh-run-id>-{transport,issuer,image-probe}",
|
|
"volume_names": "nk49-kc-<fresh-run-id>-v{0,1,2,3}",
|
|
"label": "net-kingdom.recovery-run=<fresh-run-id>",
|
|
"host_plaintext": "exact private /dev/shm/nk49-keycape-<run-id>-<suffix> registered before writes",
|
|
"synthetic_source_root": "private /dev/shm/nk49-keycape-fixture-<suffix>",
|
|
"safe_result": "private /tmp/nk49-keycape-native-fixture-review-<suffix>/result.json"
|
|
},
|
|
"scope": "candidate itself on complete synthetic format/integrity archive fixture; no native PI/LLDAP/Authelia proof, real custody, real factor or real client credential; successor binds sealed-descriptor custody preparation sources; synthetic fixture itself overrides custody with generated fixture key as before; unexecuted exact-one-selector adapter successor: no new native outcome inferred from earlier fixtures",
|
|
"mutations": [
|
|
"conditional creation of exact fresh local containers and local-driver tmpfs volumes",
|
|
"private synthetic file import to those volumes",
|
|
"original-image KeyCape service/client exchange within same loopback-only namespace",
|
|
"exact owned quiescent removal and bounded safe receipts"
|
|
],
|
|
"forbidden": [
|
|
"Docker execution before independent approval",
|
|
"image pulls/builds/pushes",
|
|
"production routes/ports/host networking/host directory mounts",
|
|
"OpenBao/Kubernetes/provider APIs",
|
|
"actual identity archive, age key, TLS key, user password, factor or client secret"
|
|
],
|
|
"cleanup": "candidate exact ownership/volume-driver/inode checks; quiesce fresh owner SID/PGID via pidfds first; retained inflight uncertainty never accepted even on absent readback",
|
|
"oracles": [
|
|
"positive issuer-native verify-client must establish original-hostname HTTPS trust; helper alone never suffices",
|
|
"same original single RS256 key-1 JWKS and exact config/registry/policy/history/lock/deliveries",
|
|
"correct service exchange and explicit wrong-secret/excess-scope denial through existing native verifier",
|
|
"hard-parent-loss and tightened deadline both quiesce before exact resource/plaintext cleanup",
|
|
"after real Docker run accepts a synthetic container, inject returncode1; require failed recovery and sticky daemon uncertainty after cleanup"
|
|
],
|
|
"proposed_command": [
|
|
"python3",
|
|
"tests/run_isolated_keycape_native_fixture.py",
|
|
"--execute-reviewed-fixture",
|
|
"--expected-manifest-sha256",
|
|
"<SHA256-of-this-file>",
|
|
"--case",
|
|
"positive"
|
|
],
|
|
"extended_command": [
|
|
"python3",
|
|
"tests/run_isolated_keycape_native_fixture.py",
|
|
"--execute-reviewed-fixture",
|
|
"--expected-manifest-sha256",
|
|
"<SHA256-of-this-file>",
|
|
"--case",
|
|
"all"
|
|
]
|
|
}
|