coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare reviewed Forgejo consumer ESO scope and truthful recovery records

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 04:09:26 +02:00
parent f52c94cd4e
commit a41312e5a4
8 changed files with 278 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

27
docs/evidence/2026-10-11-forgejo-consumer-eso-independent-mason-review-refined.json Normal file
View file

@ -0,0 +1,27 @@
{
"schema": "owner-source-review.v1",
"owner_role": "ops-mason-owner",
"work_item": "ops-mason ADHOC-2026-10-11-T02",
"work_item_sha256": "e035a058220a070ce7bf368bd001f27594e1591a00ede9bf41a690db8306bea1",
"prior_review_preserved": "docs/evidence/2026-10-11-forgejo-consumer-eso-independent-mason-review.json",
"reviewed_manifest": "sha256:5dbd04cf96d73a2604cbf113073d618c03434fc87508ba614cbe3820a1a0e431",
"reviewed_render": "sha256:c0afd5576cdae0cbc807eccb2b9fa87ac668f15e32ec7cf79d295bdb23c75b35",
"formal_owner_entry": {
"reviewer": "ops-mason-owner (agent ops-mason, codex)",
"decision": "approved",
"comment": "Fresh exact19 source review under completed own ADHOC-2026-10-11-T02 supporting MASON-WP-0010-T03; frozen manifest sha256:5dbd04cf96d73a2604cbf113073d618c03434fc87508ba614cbe3820a1a0e431 and full proposed render sha256:c0afd5576cdae0cbc807eccb2b9fa87ac668f15e32ec7cf79d295bdb23c75b35. INTENT.md Mission consistency review and Responsibility boundary support deriving the actual consumer workload and requiring authenticated created-only recovery, owner issued-token revocation or verified expiry, retained provenance and no recovery login/remint.44 independent tests pass; both new counterexamples fail against earlier c48 source. KeyCape CCR remains unchanged; current1.1 consumer target intentionally corrects to forgejo and unchanged historical bundle correctly refuses exact matching. Prior42 review/original failures preserved. Role-before-policy order remains in type/CCR42 rollback. This approves source only: exact1.2 acknowledgment, source rebundle, confirmed binding, authenticated native evidence and founder live go remain pending; no native approval or recovery authority supplied."
},
"checks": {
"focused_passed": 44,
"pre_refinement_counterexamples_failed_as_expected": 2,
"historical_bundle_refusal_test": "passed",
"actual_proposed_admission": "refused",
"all_19_hashes_verified": true,
"all_3_baselines_verified": true,
"owner_native_mutation": false
},
"limits": [
"Generated lifecycle obligations are not an implemented custody/revocation adapter.",
"Historical1.1 source approval is not reassigned; corrected source build/bundle needs explicit reconciliation after exact acceptance."
]
}

29
docs/evidence/2026-10-11-forgejo-consumer-eso-independent-mason-review.json Normal file
View file

@ -0,0 +1,29 @@
{
"schema": "owner-source-review.v1",
"owner_role": "ops-mason-owner",
"work_item": "ops-mason/workplans/ADHOC-2026-10-11.md#ADHOC-2026-10-11-T01",
"work_item_sha256": "41d1cb7475e8b199f3f593899a1d4098275a92bcd95f3c115bb0a8183b78af7f",
"reviewed_manifest": "sha256:c48b64e5e704e8f11ca65095c376c8a9fecc2b3a58e74b9eb62096c80d00f4fb",
"reviewed_render": "sha256:c0afd5576cdae0cbc807eccb2b9fa87ac668f15e32ec7cf79d295bdb23c75b35",
"formal_owner_entry": {
"reviewer": "ops-mason-owner (agent ops-mason, codex)",
"decision": "approved",
"comment": "INTENT.md Mission four-phase process and Responsibility boundary: exact-path policy/auth-role source construction is Mason work; native custody/apply remains Platform, Kubernetes delivery remains Apps, and catalog activation remains Warden. Review approves only the frozen17-file source refinement manifest sha256:c48b64e5e704e8f11ca65095c376c8a9fecc2b3a58e74b9eb62096c80d00f4fb and proposed full render sha256:c0afd5576cdae0cbc807eccb2b9fa87ac668f15e32ec7cf79d295bdb23c75b35 under ops-mason ADHOC-2026-10-11-T01 (completed before this entry), supporting MASON-WP-0010-T03. Independent42 tests pass; original two-role collision reproduces; proposed1.2 admission refuses. Dedicated reader namespace/SA/audience and sixth typed structural object are valid source proposals. Current1.1 behavior and reused-policy guard are preserved. Created-only, role-before-policy rollback requires authenticated ownership plus issued-token revocation/verified expiry. No acknowledgment, binding confirmation, materialization, credential grant, admission change or live approval is recorded."
},
"checks": {
"all_17_hashes_verified": true,
"baseline_hashes_verified": true,
"focused_tests": {
"passed": 42,
"failed": 0
},
"original_duplicate_role_regression": "fails as expected: 2 CCR paths, 1 unique identity",
"proposed_type_admission": "refused: allow_unimplemented requires acknowledged, got proposed",
"native_actions": false
},
"limitations": [
"Source preparation can leave partial files on duplicate refusal; no manifest or overwrite is produced.",
"Legacy planned rollback inventory is not native ownership proof.",
"Exact1.2 acknowledgment, verified binding, independent native owner evidence, live founder go and first-case completion remain pending."
]
}

11
docs/forgejo-consumer-eso-builder-review.md Normal file
View file

@ -0,0 +1,11 @@
# Forgejo consumer ESO successor builder review
The existing builder silently assigns the same CCR-DRAFT-...-ESO path to two role-backed policies. The staged source fixes the consumer-reader-policy suffix to the actual consuming service, retains KeyCape's ESO suffix, and refuses duplicate write identities. The real regression first fails against current owner source, then 42 builder/plan/structural tests pass against the staged source. It verifies two role-backed CCRs, platform validator compatibility, exact independent namespace/SA bindings and all six structural objects. A failed source build can leave partial preparation files; it performs no native apply and such files confer no approval.
Acknowledged1.1 remains untouched; proposed 1.2 is refused by current Mason admission until accepted owner source exists. Its dedicated role uses the current typed StructuralObject openbao_role contract, so no new framework or weaker verifier is needed. Actual role/policy evidence must be owner-authenticated and independently classify created/preexisting before Warden receives a materialized-case binding. No native verifier/adapter or session is installed by this patch, and the legacy planned rollback inventory remains insufficient creation proof.
## Supplementary generated-CCR refinement after Platform conditional review
Exact prior 271 packet is preserved at /tmp/forgejo-consumer-eso-refinement-original-271, alongside original c48. Platform found two additional generator gaps: hardcoded keycape target for the consumer, and delete-only consumer-role lifecycle. Both meaningful counterexamples fail against 271 source before the fix. Current staged generator derives target.workload from consuming_service only for consumer-reader-policy, preserving all KeyCape ESO output fields. A role-backed consumer CCR requires reverting consumer reference, authenticated case-created ownership, preservation of preexisting/shared objects, issued-token owner revocation or independently verified expiry before deactivation, and no new login/remint during recovery. Actual owner native authority remains required; generated wording is not an implemented revocation adapter.
Forty-four focused builder/plan/structure tests now pass. Earlier 42 and original counterexample/failure history remain retained. The old committed 1.1 bundle still mislabels the consumer workload keycape and therefore correctly fails fresh exact target matching after this correction. That historical bundle is preserved; the checker is not weakened or grandfathered. Local fixtures alone use corrected/rehashed consumer metadata, with a separate regression proving old bundle refusal. Current 1.1 unbound consumer generation changes only its previously wrong target.workload; KeyCape reader output remains unchanged. The proposed 1.2 render/type/case/source remains pending exact acknowledgment, with identical six-object structural body and no native completion claim. Fresh source build/bundle owner reconciliation must occur after exact acceptance before any native apply/materialization; old CCR or bundle approval is not silently reassigned. New source/test hashes are in validation.json and generated projection receipt.

64
docs/forgejo-consumer-generated-ccr-refinement.json Normal file
View file

@ -0,0 +1,64 @@
{
"scope": "source-only _ccr target/auth/lifecycle projection; proposed successor public build remains refused",
"target": {
"domain": "infotech",
"tenant": "platform",
"workload": "forgejo",
"environment": "production",
"purpose": "The consuming service reads the same secret. No metadata, list, parent or sibling access."
},
"openbao": {
"mount": "platform",
"kv_path": "platform/workloads/keycape/forgejo",
"fields": [
"CLIENT_SECRET"
],
"policy_name": "workload-kv-read-keycape-forgejo-forgejo",
"policy_file": "openbao/policies/workload-kv-read-keycape-forgejo-forgejo.hcl",
"metadata_read": false,
"token_self_lifecycle": true,
"auth": {
"method": "kubernetes",
"mount": "kubernetes",
"role": "external-secrets-keycape-forgejo-forgejo",
"audience": "openbao",
"ttl": "15m",
"token_max_ttl": "15m",
"token_explicit_max_ttl": "15m",
"token_no_default_policy": true,
"policies": [
"workload-kv-read-keycape-forgejo-forgejo"
],
"bound_claims": {
"service_account_names": [
"forgejo-keycape-forgejo-eso"
],
"service_account_namespaces": [
"forgejo"
]
},
"bound_claims_confirmed": false
}
},
"lifecycle": {
"deactivate": "Revert the consumer reference first; remove only independently proved case-created delivery objects, role and policy, preserving preexisting-matched and shared objects. Revoke issued reader tokens through owner custody or prove independently verified expiry before declaring deactivation; role/SA/store deletion alone does not revoke tokens. Recovery uses existing owner admission: no new login and no remint. Preserve authenticated creation/ownership/recovery receipts and stop on changed references, UIDs or ownership.",
"rotate": "roll-forward through the credential broker (mint-secret); never a read of the old value",
"compromised": "owner incident process; no automatic read, reseed or cleanup"
},
"live_apply": false,
"acceptance_inferred": false,
"current1.1_output_checks": [
{
"policy": "keycape-reader-policy",
"changed_fields": [],
"keycape_output_byte_semantics_preserved": true
},
{
"policy": "consumer-reader-policy",
"changed_fields": [
"target.workload"
],
"keycape_output_byte_semantics_preserved": false
}
]
}