Prepare reviewed Forgejo consumer ESO scope and truthful recovery records
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
parent
f52c94cd4e
commit
a41312e5a4
8 changed files with 278 additions and 5 deletions
|
|
@ -0,0 +1,27 @@
|
|||
{
|
||||
"schema": "owner-source-review.v1",
|
||||
"owner_role": "ops-mason-owner",
|
||||
"work_item": "ops-mason ADHOC-2026-10-11-T02",
|
||||
"work_item_sha256": "e035a058220a070ce7bf368bd001f27594e1591a00ede9bf41a690db8306bea1",
|
||||
"prior_review_preserved": "docs/evidence/2026-10-11-forgejo-consumer-eso-independent-mason-review.json",
|
||||
"reviewed_manifest": "sha256:5dbd04cf96d73a2604cbf113073d618c03434fc87508ba614cbe3820a1a0e431",
|
||||
"reviewed_render": "sha256:c0afd5576cdae0cbc807eccb2b9fa87ac668f15e32ec7cf79d295bdb23c75b35",
|
||||
"formal_owner_entry": {
|
||||
"reviewer": "ops-mason-owner (agent ops-mason, codex)",
|
||||
"decision": "approved",
|
||||
"comment": "Fresh exact19 source review under completed own ADHOC-2026-10-11-T02 supporting MASON-WP-0010-T03; frozen manifest sha256:5dbd04cf96d73a2604cbf113073d618c03434fc87508ba614cbe3820a1a0e431 and full proposed render sha256:c0afd5576cdae0cbc807eccb2b9fa87ac668f15e32ec7cf79d295bdb23c75b35. INTENT.md Mission consistency review and Responsibility boundary support deriving the actual consumer workload and requiring authenticated created-only recovery, owner issued-token revocation or verified expiry, retained provenance and no recovery login/remint.44 independent tests pass; both new counterexamples fail against earlier c48 source. KeyCape CCR remains unchanged; current1.1 consumer target intentionally corrects to forgejo and unchanged historical bundle correctly refuses exact matching. Prior42 review/original failures preserved. Role-before-policy order remains in type/CCR42 rollback. This approves source only: exact1.2 acknowledgment, source rebundle, confirmed binding, authenticated native evidence and founder live go remain pending; no native approval or recovery authority supplied."
|
||||
},
|
||||
"checks": {
|
||||
"focused_passed": 44,
|
||||
"pre_refinement_counterexamples_failed_as_expected": 2,
|
||||
"historical_bundle_refusal_test": "passed",
|
||||
"actual_proposed_admission": "refused",
|
||||
"all_19_hashes_verified": true,
|
||||
"all_3_baselines_verified": true,
|
||||
"owner_native_mutation": false
|
||||
},
|
||||
"limits": [
|
||||
"Generated lifecycle obligations are not an implemented custody/revocation adapter.",
|
||||
"Historical1.1 source approval is not reassigned; corrected source build/bundle needs explicit reconciliation after exact acceptance."
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
{
|
||||
"schema": "owner-source-review.v1",
|
||||
"owner_role": "ops-mason-owner",
|
||||
"work_item": "ops-mason/workplans/ADHOC-2026-10-11.md#ADHOC-2026-10-11-T01",
|
||||
"work_item_sha256": "41d1cb7475e8b199f3f593899a1d4098275a92bcd95f3c115bb0a8183b78af7f",
|
||||
"reviewed_manifest": "sha256:c48b64e5e704e8f11ca65095c376c8a9fecc2b3a58e74b9eb62096c80d00f4fb",
|
||||
"reviewed_render": "sha256:c0afd5576cdae0cbc807eccb2b9fa87ac668f15e32ec7cf79d295bdb23c75b35",
|
||||
"formal_owner_entry": {
|
||||
"reviewer": "ops-mason-owner (agent ops-mason, codex)",
|
||||
"decision": "approved",
|
||||
"comment": "INTENT.md Mission four-phase process and Responsibility boundary: exact-path policy/auth-role source construction is Mason work; native custody/apply remains Platform, Kubernetes delivery remains Apps, and catalog activation remains Warden. Review approves only the frozen17-file source refinement manifest sha256:c48b64e5e704e8f11ca65095c376c8a9fecc2b3a58e74b9eb62096c80d00f4fb and proposed full render sha256:c0afd5576cdae0cbc807eccb2b9fa87ac668f15e32ec7cf79d295bdb23c75b35 under ops-mason ADHOC-2026-10-11-T01 (completed before this entry), supporting MASON-WP-0010-T03. Independent42 tests pass; original two-role collision reproduces; proposed1.2 admission refuses. Dedicated reader namespace/SA/audience and sixth typed structural object are valid source proposals. Current1.1 behavior and reused-policy guard are preserved. Created-only, role-before-policy rollback requires authenticated ownership plus issued-token revocation/verified expiry. No acknowledgment, binding confirmation, materialization, credential grant, admission change or live approval is recorded."
|
||||
},
|
||||
"checks": {
|
||||
"all_17_hashes_verified": true,
|
||||
"baseline_hashes_verified": true,
|
||||
"focused_tests": {
|
||||
"passed": 42,
|
||||
"failed": 0
|
||||
},
|
||||
"original_duplicate_role_regression": "fails as expected: 2 CCR paths, 1 unique identity",
|
||||
"proposed_type_admission": "refused: allow_unimplemented requires acknowledged, got proposed",
|
||||
"native_actions": false
|
||||
},
|
||||
"limitations": [
|
||||
"Source preparation can leave partial files on duplicate refusal; no manifest or overwrite is produced.",
|
||||
"Legacy planned rollback inventory is not native ownership proof.",
|
||||
"Exact1.2 acknowledgment, verified binding, independent native owner evidence, live founder go and first-case completion remain pending."
|
||||
]
|
||||
}
|
||||
11
docs/forgejo-consumer-eso-builder-review.md
Normal file
11
docs/forgejo-consumer-eso-builder-review.md
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
# Forgejo consumer ESO successor builder review
|
||||
|
||||
The existing builder silently assigns the same CCR-DRAFT-...-ESO path to two role-backed policies. The staged source fixes the consumer-reader-policy suffix to the actual consuming service, retains KeyCape's ESO suffix, and refuses duplicate write identities. The real regression first fails against current owner source, then 42 builder/plan/structural tests pass against the staged source. It verifies two role-backed CCRs, platform validator compatibility, exact independent namespace/SA bindings and all six structural objects. A failed source build can leave partial preparation files; it performs no native apply and such files confer no approval.
|
||||
|
||||
Acknowledged1.1 remains untouched; proposed 1.2 is refused by current Mason admission until accepted owner source exists. Its dedicated role uses the current typed StructuralObject openbao_role contract, so no new framework or weaker verifier is needed. Actual role/policy evidence must be owner-authenticated and independently classify created/preexisting before Warden receives a materialized-case binding. No native verifier/adapter or session is installed by this patch, and the legacy planned rollback inventory remains insufficient creation proof.
|
||||
|
||||
## Supplementary generated-CCR refinement after Platform conditional review
|
||||
|
||||
Exact prior 271 packet is preserved at /tmp/forgejo-consumer-eso-refinement-original-271, alongside original c48. Platform found two additional generator gaps: hardcoded keycape target for the consumer, and delete-only consumer-role lifecycle. Both meaningful counterexamples fail against 271 source before the fix. Current staged generator derives target.workload from consuming_service only for consumer-reader-policy, preserving all KeyCape ESO output fields. A role-backed consumer CCR requires reverting consumer reference, authenticated case-created ownership, preservation of preexisting/shared objects, issued-token owner revocation or independently verified expiry before deactivation, and no new login/remint during recovery. Actual owner native authority remains required; generated wording is not an implemented revocation adapter.
|
||||
|
||||
Forty-four focused builder/plan/structure tests now pass. Earlier 42 and original counterexample/failure history remain retained. The old committed 1.1 bundle still mislabels the consumer workload keycape and therefore correctly fails fresh exact target matching after this correction. That historical bundle is preserved; the checker is not weakened or grandfathered. Local fixtures alone use corrected/rehashed consumer metadata, with a separate regression proving old bundle refusal. Current 1.1 unbound consumer generation changes only its previously wrong target.workload; KeyCape reader output remains unchanged. The proposed 1.2 render/type/case/source remains pending exact acknowledgment, with identical six-object structural body and no native completion claim. Fresh source build/bundle owner reconciliation must occur after exact acceptance before any native apply/materialization; old CCR or bundle approval is not silently reassigned. New source/test hashes are in validation.json and generated projection receipt.
|
||||
64
docs/forgejo-consumer-generated-ccr-refinement.json
Normal file
64
docs/forgejo-consumer-generated-ccr-refinement.json
Normal file
|
|
@ -0,0 +1,64 @@
|
|||
{
|
||||
"scope": "source-only _ccr target/auth/lifecycle projection; proposed successor public build remains refused",
|
||||
"target": {
|
||||
"domain": "infotech",
|
||||
"tenant": "platform",
|
||||
"workload": "forgejo",
|
||||
"environment": "production",
|
||||
"purpose": "The consuming service reads the same secret. No metadata, list, parent or sibling access."
|
||||
},
|
||||
"openbao": {
|
||||
"mount": "platform",
|
||||
"kv_path": "platform/workloads/keycape/forgejo",
|
||||
"fields": [
|
||||
"CLIENT_SECRET"
|
||||
],
|
||||
"policy_name": "workload-kv-read-keycape-forgejo-forgejo",
|
||||
"policy_file": "openbao/policies/workload-kv-read-keycape-forgejo-forgejo.hcl",
|
||||
"metadata_read": false,
|
||||
"token_self_lifecycle": true,
|
||||
"auth": {
|
||||
"method": "kubernetes",
|
||||
"mount": "kubernetes",
|
||||
"role": "external-secrets-keycape-forgejo-forgejo",
|
||||
"audience": "openbao",
|
||||
"ttl": "15m",
|
||||
"token_max_ttl": "15m",
|
||||
"token_explicit_max_ttl": "15m",
|
||||
"token_no_default_policy": true,
|
||||
"policies": [
|
||||
"workload-kv-read-keycape-forgejo-forgejo"
|
||||
],
|
||||
"bound_claims": {
|
||||
"service_account_names": [
|
||||
"forgejo-keycape-forgejo-eso"
|
||||
],
|
||||
"service_account_namespaces": [
|
||||
"forgejo"
|
||||
]
|
||||
},
|
||||
"bound_claims_confirmed": false
|
||||
}
|
||||
},
|
||||
"lifecycle": {
|
||||
"deactivate": "Revert the consumer reference first; remove only independently proved case-created delivery objects, role and policy, preserving preexisting-matched and shared objects. Revoke issued reader tokens through owner custody or prove independently verified expiry before declaring deactivation; role/SA/store deletion alone does not revoke tokens. Recovery uses existing owner admission: no new login and no remint. Preserve authenticated creation/ownership/recovery receipts and stop on changed references, UIDs or ownership.",
|
||||
"rotate": "roll-forward through the credential broker (mint-secret); never a read of the old value",
|
||||
"compromised": "owner incident process; no automatic read, reseed or cleanup"
|
||||
},
|
||||
"live_apply": false,
|
||||
"acceptance_inferred": false,
|
||||
"current1.1_output_checks": [
|
||||
{
|
||||
"policy": "keycape-reader-policy",
|
||||
"changed_fields": [],
|
||||
"keycape_output_byte_semantics_preserved": true
|
||||
},
|
||||
{
|
||||
"policy": "consumer-reader-policy",
|
||||
"changed_fields": [
|
||||
"target.workload"
|
||||
],
|
||||
"keycape_output_byte_semantics_preserved": false
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -34,7 +34,7 @@ RAILIANCE_PLATFORM = Path.home() / "railiance-platform"
|
|||
|
||||
|
||||
class CaseBuildRefused(RuntimeError):
|
||||
"""The case cannot be built yet; nothing was written."""
|
||||
"""The case admission or prepared source inventory is invalid."""
|
||||
|
||||
|
||||
def _plan_front(path: Path) -> dict:
|
||||
|
|
@ -83,7 +83,20 @@ def _ccr(case: dict, rendered: dict, policy: dict, role: dict | None, kv_path: s
|
|||
"service_account_namespaces": list(role_body.get("bound_service_account_namespaces") or [])},
|
||||
"bound_claims_confirmed": False,
|
||||
}
|
||||
reader = "eso" if role else params["consuming_service"]
|
||||
consumer = policy["id"] == "consumer-reader-policy"
|
||||
reader = "eso" if role and not consumer else params["consuming_service"]
|
||||
workload = params["consuming_service"] if consumer else "keycape"
|
||||
deactivate = f"delete the role, then policy {policy['template']} (case rollback)"
|
||||
if consumer and role:
|
||||
deactivate = (
|
||||
"Revert the consumer reference first; remove only independently proved "
|
||||
"case-created delivery objects, role and policy, preserving preexisting-matched "
|
||||
"and shared objects. Revoke issued reader tokens through owner custody or "
|
||||
"prove independently verified expiry before declaring deactivation; role/SA/store "
|
||||
"deletion alone does not revoke tokens. Recovery uses existing owner admission: "
|
||||
"no new login and no remint. Preserve authenticated creation/ownership/recovery "
|
||||
"receipts and stop on changed references, UIDs or ownership."
|
||||
)
|
||||
doc = {
|
||||
"id": f"CCR-DRAFT-{prov['case']}-{reader}".upper(),
|
||||
"kind": "credential-change-request",
|
||||
|
|
@ -98,7 +111,7 @@ def _ccr(case: dict, rendered: dict, policy: dict, role: dict | None, kv_path: s
|
|||
f"{prov['render_digest']}. Accepted by {', '.join(prov['accepted_by'])} on {prov['accepted_at']}: "
|
||||
f"{prov['acceptance_record']}. The case acceptance replaces a fresh executive summary.")},
|
||||
"review": {"required": True, "required_approvers": ["platform-owner"], "comments": []},
|
||||
"target": {"domain": "infotech", "tenant": "platform", "workload": "keycape", "environment": "production",
|
||||
"target": {"domain": "infotech", "tenant": "platform", "workload": workload, "environment": "production",
|
||||
"purpose": policy.get("description") or policy["id"]},
|
||||
"openbao": openbao,
|
||||
"access_frontdoor": {"type": "external-secrets" if role else "none",
|
||||
|
|
@ -111,7 +124,7 @@ def _ccr(case: dict, rendered: dict, policy: dict, role: dict | None, kv_path: s
|
|||
"positive": [f"policy {policy['template']} grants read on {kv_path.replace('/', '/data/', 1)} only (capabilities check)"],
|
||||
"negative": ["a default-only identity has no read capability on the path", "sibling GET and parent LIST are denied"],
|
||||
"activation_conditions": ["case acceptance present", "bound claims confirmed by the platform owner"]},
|
||||
"lifecycle": {"deactivate": f"delete the role, then policy {policy['template']} (case rollback)",
|
||||
"lifecycle": {"deactivate": deactivate,
|
||||
"rotate": "roll-forward through the credential broker (mint-secret); never a read of the old value",
|
||||
"compromised": "owner incident process; no automatic read, reseed or cleanup"},
|
||||
"security_case": prov,
|
||||
|
|
@ -193,6 +206,8 @@ def build_from_case(case_path: Path, plan_path: Path, out_dir: Path, *, nk_root:
|
|||
files: dict[str, str] = {}
|
||||
|
||||
def write(rel: str, text: str) -> Path:
|
||||
if rel in files:
|
||||
raise CaseBuildRefused("duplicate output identity in case bundle")
|
||||
path = out_dir / rel
|
||||
path.parent.mkdir(parents=True, exist_ok=True)
|
||||
path.write_text(text)
|
||||
|
|
|
|||
|
|
@ -109,3 +109,64 @@ def test_platform_validator_accepts_the_drafts(tmp_path, types_root):
|
|||
r = cb.build_from_case(case, _plan(tmp_path, case, types_root), tmp_path / "b", types_root=types_root,
|
||||
audit_log=tmp_path / "a.jsonl")
|
||||
assert cb.validate_with_platform([Path(p) for p in r["ccrs"]]) == []
|
||||
|
||||
|
||||
def test_two_role_backed_readers_keep_distinct_ccrs_and_complete_structure(tmp_path, types_root):
|
||||
from ops_mason import case_structure
|
||||
type_path = types_root / TYPE.name / "type.yaml"
|
||||
doc = yaml.safe_load(type_path.read_text())
|
||||
doc["spec"]["materialization"].insert(-1, {
|
||||
"id": "consumer-eso-role", "kind": "openbao_role",
|
||||
"when": "client_type == confidential",
|
||||
"template": "external-secrets-keycape-{client_id}-{consuming_service}",
|
||||
"body": "auth: kubernetes\nbound_service_account_names: [forgejo-keycape-forgejo-eso]\nbound_service_account_namespaces: [forgejo]\ntoken_policies: [workload-kv-read-keycape-{client_id}-{consuming_service}]\ntoken_no_default_policy: true\ntoken_ttl: 15m\ntoken_max_ttl: 15m\n",
|
||||
})
|
||||
doc["spec"]["rollback"].append({"reverses": "consumer-eso-role", "when": "client_type == confidential", "action": "remove this created role only"})
|
||||
type_path.write_text(yaml.safe_dump(doc, sort_keys=False))
|
||||
case = _case(tmp_path)
|
||||
plan = _plan(tmp_path, case, types_root)
|
||||
out = tmp_path / "bundle"
|
||||
result = cb.build_from_case(case, plan, out, types_root=types_root, audit_log=tmp_path / "a.jsonl")
|
||||
assert len(result["ccrs"]) == len(set(result["ccrs"])) == 2
|
||||
ccrs = {Path(p).name: yaml.safe_load(Path(p).read_text()) for p in result["ccrs"]}
|
||||
assert ccrs["CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-ESO.yaml"]["openbao"]["auth"]["role"] == "external-secrets-keycape-forgejo"
|
||||
consumer = ccrs["CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-FORGEJO.yaml"]
|
||||
assert ccrs["CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-ESO.yaml"]["target"]["workload"] == "keycape"
|
||||
assert consumer["target"]["workload"] == "forgejo"
|
||||
assert consumer["openbao"]["auth"]["role"] == "external-secrets-keycape-forgejo-forgejo"
|
||||
assert consumer["openbao"]["auth"]["bound_claims"] == {"service_account_names": ["forgejo-keycape-forgejo-eso"], "service_account_namespaces": ["forgejo"]}
|
||||
assert not consumer["openbao"]["auth"]["bound_claims_confirmed"]
|
||||
deactivate = consumer["lifecycle"]["deactivate"].lower()
|
||||
for guard in ["created", "preexisting", "consumer reference", "revoke issued", "verified expiry", "no new login", "no remint"]:
|
||||
assert guard in deactivate
|
||||
assert "delete the role, then policy" in ccrs["CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-ESO.yaml"]["lifecycle"]["deactivate"]
|
||||
assert cb.validate_with_platform([Path(p) for p in result["ccrs"]]) == []
|
||||
request = case_structure.prepare(case, plan, out, types_root=types_root)
|
||||
assert len(request.objects) == 6
|
||||
assert {o.id for o in request.objects} >= {"eso-role", "consumer-eso-role"}
|
||||
|
||||
|
||||
def test_duplicate_source_output_refuses_before_overwriting_first_ccr(tmp_path, types_root, monkeypatch):
|
||||
original = cb._ccr
|
||||
def same_identity(*args, **kwargs):
|
||||
doc = original(*args, **kwargs)
|
||||
doc["id"] = "CCR-DRAFT-COLLISION"
|
||||
return doc
|
||||
monkeypatch.setattr(cb, "_ccr", same_identity)
|
||||
case = _case(tmp_path)
|
||||
out = tmp_path / "bundle"
|
||||
with pytest.raises(cb.CaseBuildRefused, match="duplicate output identity"):
|
||||
cb.build_from_case(case, _plan(tmp_path, case, types_root), out, types_root=types_root, audit_log=tmp_path / "a.jsonl")
|
||||
first = yaml.safe_load((out / "credential-change-requests/CCR-DRAFT-COLLISION.yaml").read_text())
|
||||
assert first["openbao"]["policy_name"] == "workload-kv-read-keycape-forgejo-eso"
|
||||
assert not (out / "manifest.json").exists()
|
||||
|
||||
|
||||
def test_generated_consumer_lifecycle_requires_created_only_token_recovery(types_root):
|
||||
case = yaml.safe_load(CASE.read_text())
|
||||
policy = {"id": "consumer-reader-policy", "template": "workload-kv-read-keycape-forgejo-forgejo"}
|
||||
role = {"template": "external-secrets-keycape-forgejo-forgejo", "body": "auth: kubernetes\nbound_service_account_names: [forgejo-keycape-forgejo-eso]\nbound_service_account_namespaces: [forgejo]\ntoken_policies: [workload-kv-read-keycape-forgejo-forgejo]\n"}
|
||||
provenance = {"case": "forgejo-netkingdom-oidc", "type": "fixture-source-only", "render_digest": "fixture", "accepted_by": ["fixture-owner"], "accepted_at": "fixture-date", "acceptance_record": "fixture-not-authority"}
|
||||
doc = cb._ccr(case, {}, policy, role, "platform/workloads/keycape/forgejo", provenance)
|
||||
for guard in ["created", "preexisting", "consumer reference", "revoke issued", "verified expiry", "no new login", "no remint"]:
|
||||
assert guard in doc["lifecycle"]["deactivate"].lower()
|
||||
|
|
|
|||
|
|
@ -20,6 +20,16 @@ def prepared(tmp_path):
|
|||
shutil.copytree(ROOT / "builds/case-forgejo-netkingdom-oidc", bundle)
|
||||
plan = tmp_path / "plan.md"
|
||||
shutil.copy2(ROOT / "plans/case-forgejo-netkingdom-oidc.md", plan)
|
||||
# The committed historical bundle mislabels its consumer target keycape.
|
||||
# Preserve it in the owner checkout; corrected fixture metadata must match
|
||||
# the current generator rather than weakening the exact structural checker.
|
||||
rel = "credential-change-requests/CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-FORGEJO.yaml"
|
||||
ccr = yaml.safe_load((bundle / rel).read_text())
|
||||
ccr["target"]["workload"] = "forgejo"
|
||||
(bundle / rel).write_text(yaml.safe_dump(ccr, sort_keys=False, width=110))
|
||||
manifest = json.loads((bundle / "manifest.json").read_text())
|
||||
manifest["files"][rel] = hashlib.sha256((bundle / rel).read_bytes()).hexdigest()
|
||||
(bundle / "manifest.json").write_text(json.dumps(manifest, indent=1, sort_keys=True)+"\n")
|
||||
request = structure.prepare(CASE, plan, bundle, allow_unimplemented=True)
|
||||
return request, plan, bundle
|
||||
|
||||
|
|
@ -42,7 +52,7 @@ def observations(request):
|
|||
return tuple(result)
|
||||
|
||||
|
||||
def test_actual_first_case_structure_matches_but_full_execution_guard_drift_remains(
|
||||
def test_corrected_first_case_fixture_structure_and_full_execution_drift_remain(
|
||||
prepared,
|
||||
):
|
||||
request, _, _ = prepared
|
||||
|
|
@ -322,3 +332,13 @@ def test_constructed_request_closed_identity_and_change_flag(prepared, field, va
|
|||
forged = replace(request, **{field: value})
|
||||
with pytest.raises(structure.StructureRefused):
|
||||
structure.verify(forged, observations(request), lambda *args: True)
|
||||
|
||||
|
||||
def test_historical_bundle_wrong_consumer_target_is_not_grandfathered(tmp_path):
|
||||
bundle = tmp_path / "historical-bundle"
|
||||
shutil.copytree(ROOT / "builds/case-forgejo-netkingdom-oidc", bundle)
|
||||
plan = tmp_path / "plan.md"
|
||||
shutil.copy2(ROOT / "plans/case-forgejo-netkingdom-oidc.md", plan)
|
||||
assert yaml.safe_load((bundle / "credential-change-requests/CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-FORGEJO.yaml").read_text())["target"]["workload"] == "keycape"
|
||||
with pytest.raises(structure.StructureRefused, match="role or reader binding differs"):
|
||||
structure.prepare(CASE, plan, bundle, allow_unimplemented=True)
|
||||
|
|
|
|||
46
workplans/ADHOC-2026-10-11.md
Normal file
46
workplans/ADHOC-2026-10-11.md
Normal file
|
|
@ -0,0 +1,46 @@
|
|||
---
|
||||
id: ADHOC-2026-10-11
|
||||
type: workplan
|
||||
title: "Independent ops-mason owner review of Forgejo consumer ESO refinement"
|
||||
domain: infotech
|
||||
repo: ops-mason
|
||||
status: finished
|
||||
owner: codex
|
||||
created: "2026-10-11"
|
||||
updated: "2026-10-11"
|
||||
flavor: implementation
|
||||
---
|
||||
|
||||
## Review the frozen consumer-reader source refinement
|
||||
|
||||
```task
|
||||
id: ADHOC-2026-10-11-T01
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Independent dedicated ops-mason-owner review under MASON-WP-0010-T03. Loaded ops-mason AGENTS.md, INTENT.md and SCOPE.md in its checkout; read delegated-owner-review_v0.1.md and agent-environment-orientation.md. Review was performed in an isolated checkout, with no owner source/native writes, authentication, credential values or approval recording.
|
||||
|
||||
Exact frozen 17-file manifest: sha256:c48b64e5e704e8f11ca65095c376c8a9fecc2b3a58e74b9eb62096c80d00f4fb. Proposed full render: sha256:c0afd5576cdae0cbc807eccb2b9fa87ac668f15e32ec7cf79d295bdb23c75b35. All staged file hashes and both owner implementation baselines verified. Source review approved: minimal duplicate-CCR fix preserves current1.1 naming and gates; proposed1.2 adds the consumer role without transferring acceptance.
|
||||
|
||||
Independent verification: 42 builder/plan/structure tests pass in /tmp/forgejo-eso-mason-independent-review/checkout. The two-role regression fails against original case_build.py with two CCR paths collapsing to one identity, demonstrating the original defect. Proposed1.2 is refused by real Mason admission with allow_unimplemented because its type remains proposed. Structural tests cover exact policy/role pins, authenticated owner observations, created/preexisting separation and rollback exclusion for shared objects. Actual Platform apply guard requires approved status and confirmed binding; the proposal remains proposed/unconfirmed. Original reused-policy SHA256 guard remains unchanged.
|
||||
|
||||
INTENT basis: Mission four-phase process and Responsibility boundary: construction of exact-path policies/auth roles is Mason work; native custody and delegated application belong to railiance-platform, consumer Kubernetes delivery belongs to railiance-apps, catalog activation belongs to ops-warden. A source review is no founder decision or live grant. Sixth object needs exact successor acknowledgment and authenticated per-object evidence, not old five-object acceptance or planned rollback inventory. Dedicated forgejo/forgejo-keycape-forgejo-eso avoids shared forgejo/default. Shared ESO controller trust, legacy-token fallback, retained target and issued-token expiry/revocation are explicit. Rollback deletes only independently proven created objects, removes role before policy, and preserves preexisting matches.
|
||||
|
||||
Review outcome and formal review entry are stored in docs/evidence/2026-10-11-forgejo-consumer-eso-independent-mason-review.json. This local review task is complete; MASON-WP-0010-T03, owner source reconciliation, native proof, exact acknowledgment and first-case/live gates remain with their existing workplans. No new residual is created by this bounded review.
|
||||
|
||||
## Review revised workload and token recovery generation
|
||||
|
||||
```task
|
||||
id: ADHOC-2026-10-11-T02
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
Fresh dedicated ops-mason-owner review under MASON-WP-0010-T03, retaining T01 and its exact c48 review without rewriting its historical outcome. Exact frozen19 manifest sha256:5dbd04cf96d73a2604cbf113073d618c03434fc87508ba614cbe3820a1a0e431; unchanged proposed full render sha256:c0afd5576cdae0cbc807eccb2b9fa87ac668f15e32ec7cf79d295bdb23c75b35. All19 hashes and three current owner source baselines verified. Independent isolated builder/plan/structure suites:44 passed. New workload and lifecycle counterexamples both fail against the earlier c48 builder, reproducing mislabelled keycape consumer target and delete-only recovery wording. Earlier42 suite and original duplicate-role failure remain preserved in /tmp/forgejo-eso-mason-independent-review.
|
||||
|
||||
Revised source review approved against INTENT Mission construction consistency and Responsibility boundary: consumer-reader-policy now derives consuming_service as workload, while KeyCape reader output remains unchanged. Current1.1 consumer generation intentionally corrects target.workload from keycape to forgejo. The committed historical1.1 bundle is unchanged and fresh exact matching correctly refuses that stale target. Only local fixtures correct and rehash historical consumer metadata; no verifier grandfathering or native acceptance transfer is introduced. A new explicit regression proves original historical bundle refusal.
|
||||
|
||||
Role-backed consumer recovery first reverts the consumer reference; restricts cleanup to independently proven created objects; preserves shared/preexisting matches; requires owner token revocation or independently verified expiry before declaring deactivation; forbids a new login/remint during recovery; and stops on changed references/UIDs/ownership. Proposed type rollback and CCR42 retain role-before-policy ordering. These are source obligations, not an installed recovery adapter or supplied custody authority. Real proposed1.2 admission remains refused, CCR42 remains proposed with unconfirmed binding, and exact acknowledgment/native per-owner evidence/founder live go remain pending.
|
||||
|
||||
Own task completed before formal refined review entry in docs/evidence/2026-10-11-forgejo-consumer-eso-independent-mason-review-refined.json. No source writes in owner checkout, native act, authentication, credential value, acknowledgment, admission/binding/status mutation or completion claim. Fresh source build/bundle reconciliation follows exact acceptance; earlier approval does not migrate to the corrected output. Existing MASON-WP-0010-T03 and first-case owner work retain these next steps.
|
||||
Loading…
Add table
Add a link
Reference in a new issue