WARDEN-WP-0040-T02: compile activity-core's backup-daily declaration
Commit zone-engine's resolved view of activity-core's backup-daily declaration and rebuild the flex-auth snapshot from it. atm-backup-daily now resolves to z2-protected declared, admission unsatisfied (M1 below the M2 floor), and effective zone unknown. Signing-target coverage is unchanged at 0/3. Also regenerate the high-risk-paths artifact. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 327285@bnt-lap001 Assistant-Session: d6532cd1-7cd5-417b-baac-b841c9103a6b
This commit is contained in:
parent
e187b74593
commit
b6b9b95616
5 changed files with 110 additions and 7 deletions
|
|
@ -154,8 +154,10 @@
|
|||
"max_ttl_hours": 8,
|
||||
"workload_id": "backup-daily",
|
||||
"security_zone": "unknown",
|
||||
"security_zone_admission": "unknown",
|
||||
"security_zone_reason": "workload_resolution_absent"
|
||||
"security_zone_declared": "z2-protected",
|
||||
"security_zone_admission": "unsatisfied",
|
||||
"security_zone_reason": "M1_below_M2_zone_floor",
|
||||
"security_zone_revision": "sha256:4b937fce814a937a034f63598f4c7f4d8a76cf92e82cada752ae31dbe5f3dc8f"
|
||||
}
|
||||
}
|
||||
],
|
||||
|
|
|
|||
75
registry/flex-auth/zone-resolutions.json
Normal file
75
registry/flex-auth/zone-resolutions.json
Normal file
|
|
@ -0,0 +1,75 @@
|
|||
{
|
||||
"changes": {
|
||||
"added": [
|
||||
"backup-daily"
|
||||
],
|
||||
"baseline": "initial",
|
||||
"changed": [],
|
||||
"removed": []
|
||||
},
|
||||
"errors": [],
|
||||
"ok": true,
|
||||
"profile_errors": [],
|
||||
"records": [
|
||||
{
|
||||
"admission": "unsatisfied",
|
||||
"admission_reason": "M1_below_M2_zone_floor",
|
||||
"control_profile": {
|
||||
"id": "netkingdom-build-v0.1",
|
||||
"version": "flex-auth@e521e7b+ops-warden@7ce58ae"
|
||||
},
|
||||
"controls": [
|
||||
{
|
||||
"failure_mode": "fail_open",
|
||||
"id": "flex-auth/pre-sign",
|
||||
"pep_owner": "ops-warden",
|
||||
"policy_owner": "flex-auth",
|
||||
"policy_ref": "flex-auth@e521e7b:examples/ops-warden/policy_package.md",
|
||||
"stance": "advisory"
|
||||
},
|
||||
{
|
||||
"failure_mode": "fail_closed",
|
||||
"id": "ops-warden/agent-high-risk-read",
|
||||
"pep_owner": "ops-warden",
|
||||
"policy_owner": "ops-warden",
|
||||
"policy_ref": "ops-warden@7ce58ae:src/warden/routing/models.py",
|
||||
"stance": "enforced"
|
||||
},
|
||||
{
|
||||
"failure_mode": "fail_closed",
|
||||
"id": "ops-warden/plan-zone-rule",
|
||||
"pep_owner": "ops-warden",
|
||||
"policy_owner": "ops-warden",
|
||||
"policy_ref": "security-zones_v0.1@104d5c6:section-5.1",
|
||||
"stance": "enforced"
|
||||
}
|
||||
],
|
||||
"declared_zone": "z2-protected",
|
||||
"effective_zone": "unknown",
|
||||
"guarantees": [
|
||||
"authoritative-workload-identity",
|
||||
"explicit-workload-reference",
|
||||
"explicit-zone-membership",
|
||||
"non-inferred-resolution",
|
||||
"source-revision-bound-membership"
|
||||
],
|
||||
"identity_bindings": [
|
||||
"kubernetes-service-account/railiance01/system:serviceaccount:activity-core:default",
|
||||
"ssh-certificate/ops-warden/atm-backup-daily"
|
||||
],
|
||||
"membership_revision": "sha256:4b937fce814a937a034f63598f4c7f4d8a76cf92e82cada752ae31dbe5f3dc8f",
|
||||
"membership_revision_reason": "source_bound",
|
||||
"source": "activity-core/declarations/backup-daily/tenancy.yaml",
|
||||
"source_revision": "activity-core@fd84f2b6518ff17509930499099ec2a6692d088c",
|
||||
"subject_id": "backup-daily",
|
||||
"workload_id": "backup-daily",
|
||||
"workload_ref": {
|
||||
"applicability": "applicable",
|
||||
"deployable": null,
|
||||
"name": "backup-daily",
|
||||
"rapp_id": null
|
||||
}
|
||||
}
|
||||
],
|
||||
"standard": "security-zones_v0.1"
|
||||
}
|
||||
|
|
@ -10,11 +10,11 @@
|
|||
# declares it, and is null where the field set has not been established --
|
||||
# null means unknown, never 'one field'.
|
||||
|
||||
generated_at: "2026-10-08T21:24:31Z"
|
||||
generated_at: "2026-10-08T22:12:56Z"
|
||||
source: ops-warden/registry/routing/catalog.yaml
|
||||
catalog_revision: "139f77dd557ca4139cd4a8ec4d0ef90e7ca607ee"
|
||||
catalog_revision_date: "2026-10-08T23:21:46+02:00"
|
||||
catalog_dirty: true
|
||||
catalog_revision: "d470f2e5a7443db04119eb4d369687abb922e777"
|
||||
catalog_revision_date: "2026-10-08T23:25:22+02:00"
|
||||
catalog_dirty: false
|
||||
high_risk_lane_count: 33
|
||||
concrete_path_count: 17
|
||||
|
||||
|
|
|
|||
|
|
@ -78,6 +78,12 @@ python3 scripts/build_flex_auth_registry.py \
|
|||
-o registry/flex-auth/production_registry_snapshot.json
|
||||
```
|
||||
|
||||
The committed snapshot is built from `examples/inventory.seed.yaml` with
|
||||
`--zone-resolutions registry/flex-auth/zone-resolutions.json`, which is zone-engine's
|
||||
`tools/resolve_zones.py` output over owner declarations (today: activity-core
|
||||
`declarations/backup-daily/tenancy.yaml`). Run the resolver from the estate root so
|
||||
`source` paths stay relative.
|
||||
|
||||
Omitting `--zone-resolutions` is safe: applicable actors resolve `unknown`, not
|
||||
to a guessed zone.
|
||||
|
||||
|
|
|
|||
|
|
@ -71,7 +71,7 @@ outcome this workplan exists to prevent.
|
|||
id: WARDEN-WP-0040-T02
|
||||
status: wait
|
||||
blocked_on: message-from:ops-bridge
|
||||
blocking_reason: "Owners of agt-codex-interhub-bootstrap (ops-hub) and agt-state-hub-bridge (ops-bridge) must publish authoritative workload identity declarations; atm-backup-daily: founder confirmed activity-core as owner 2026-10-08; waits on its declaration (ACTIVITY-WP-0042-T03)."
|
||||
blocking_reason: "Owners of agt-codex-interhub-bootstrap (ops-hub) and agt-state-hub-bridge (ops-bridge) must publish authoritative workload identity declarations; atm-backup-daily declared by activity-core and compiled 2026-10-09 (z2-protected, admission unsatisfied: M1 below M2 floor)."
|
||||
priority: high
|
||||
state_hub_task_id: "54ad4864-7bcf-592e-a187-9239a81a0b11"
|
||||
```
|
||||
|
|
@ -213,3 +213,23 @@ is classed as ordinary. The confirmation was relayed to activity-core for
|
|||
ACTIVITY-WP-0042-T03. Decision 89f1058f (D2) was deliberately left open,
|
||||
because it also gates production ArgoCD go-aheads. `atm-backup-daily` now waits
|
||||
only on activity-core publishing its declaration.
|
||||
|
||||
### 2026-10-09 atm-backup-daily compiled
|
||||
|
||||
activity-core published `declarations/backup-daily/tenancy.yaml` (c1533fe).
|
||||
zone-engine's `resolve_zones.py` resolves it with the
|
||||
`netkingdom-build-v0.1` profile:
|
||||
|
||||
- declared zone: `z2-protected` (ordinary, not z2-continuity)
|
||||
- admission: `unsatisfied`, reason `M1_below_M2_zone_floor`
|
||||
- effective zone: `unknown`
|
||||
|
||||
The resolved view is committed as `registry/flex-auth/zone-resolutions.json`,
|
||||
and the snapshot was rebuilt from it. Resolution is no longer absent. The actor
|
||||
stays `unknown` because the owner declared M1, below the M2 floor, which is
|
||||
accurate rather than a gap ops-warden may close. Coverage, stated as T02
|
||||
requires: signing targets 0/3 resolved, 3 unknown, 1 not-applicable. The
|
||||
figure is unchanged because `report_coverage.py` counts effective zones.
|
||||
`atm-backup-daily` now waits on owner M2 evidence. It does not wait on a
|
||||
declaration. Still unanswered: `agt-state-hub-bridge` (ops-bridge) and
|
||||
`agt-codex-interhub-bootstrap` (ops-hub).
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue