From b6b9b95616e39c37bf5eaab5a08d125200bb0be8 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 9 Oct 2026 00:13:47 +0200 Subject: [PATCH] WARDEN-WP-0040-T02: compile activity-core's backup-daily declaration Commit zone-engine's resolved view of activity-core's backup-daily declaration and rebuild the flex-auth snapshot from it. atm-backup-daily now resolves to z2-protected declared, admission unsatisfied (M1 below the M2 floor), and effective zone unknown. Signing-target coverage is unchanged at 0/3. Also regenerate the high-risk-paths artifact. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 327285@bnt-lap001 Assistant-Session: d6532cd1-7cd5-417b-baac-b841c9103a6b --- .../production_registry_snapshot.json | 6 +- registry/flex-auth/zone-resolutions.json | 75 +++++++++++++++++++ registry/generated/high-risk-data-paths.yaml | 8 +- wiki/PolicyGatedSigning.md | 6 ++ ...-0040-unknown-zone-fail-closed-adoption.md | 22 +++++- 5 files changed, 110 insertions(+), 7 deletions(-) create mode 100644 registry/flex-auth/zone-resolutions.json diff --git a/registry/flex-auth/production_registry_snapshot.json b/registry/flex-auth/production_registry_snapshot.json index cba4291..7ebb0af 100644 --- a/registry/flex-auth/production_registry_snapshot.json +++ b/registry/flex-auth/production_registry_snapshot.json @@ -154,8 +154,10 @@ "max_ttl_hours": 8, "workload_id": "backup-daily", "security_zone": "unknown", - "security_zone_admission": "unknown", - "security_zone_reason": "workload_resolution_absent" + "security_zone_declared": "z2-protected", + "security_zone_admission": "unsatisfied", + "security_zone_reason": "M1_below_M2_zone_floor", + "security_zone_revision": "sha256:4b937fce814a937a034f63598f4c7f4d8a76cf92e82cada752ae31dbe5f3dc8f" } } ], diff --git a/registry/flex-auth/zone-resolutions.json b/registry/flex-auth/zone-resolutions.json new file mode 100644 index 0000000..cd79cd7 --- /dev/null +++ b/registry/flex-auth/zone-resolutions.json @@ -0,0 +1,75 @@ +{ + "changes": { + "added": [ + "backup-daily" + ], + "baseline": "initial", + "changed": [], + "removed": [] + }, + "errors": [], + "ok": true, + "profile_errors": [], + "records": [ + { + "admission": "unsatisfied", + "admission_reason": "M1_below_M2_zone_floor", + "control_profile": { + "id": "netkingdom-build-v0.1", + "version": "flex-auth@e521e7b+ops-warden@7ce58ae" + }, + "controls": [ + { + "failure_mode": "fail_open", + "id": "flex-auth/pre-sign", + "pep_owner": "ops-warden", + "policy_owner": "flex-auth", + "policy_ref": "flex-auth@e521e7b:examples/ops-warden/policy_package.md", + "stance": "advisory" + }, + { + "failure_mode": "fail_closed", + "id": "ops-warden/agent-high-risk-read", + "pep_owner": "ops-warden", + "policy_owner": "ops-warden", + "policy_ref": "ops-warden@7ce58ae:src/warden/routing/models.py", + "stance": "enforced" + }, + { + "failure_mode": "fail_closed", + "id": "ops-warden/plan-zone-rule", + "pep_owner": "ops-warden", + "policy_owner": "ops-warden", + "policy_ref": "security-zones_v0.1@104d5c6:section-5.1", + "stance": "enforced" + } + ], + "declared_zone": "z2-protected", + "effective_zone": "unknown", + "guarantees": [ + "authoritative-workload-identity", + "explicit-workload-reference", + "explicit-zone-membership", + "non-inferred-resolution", + "source-revision-bound-membership" + ], + "identity_bindings": [ + "kubernetes-service-account/railiance01/system:serviceaccount:activity-core:default", + "ssh-certificate/ops-warden/atm-backup-daily" + ], + "membership_revision": "sha256:4b937fce814a937a034f63598f4c7f4d8a76cf92e82cada752ae31dbe5f3dc8f", + "membership_revision_reason": "source_bound", + "source": "activity-core/declarations/backup-daily/tenancy.yaml", + "source_revision": "activity-core@fd84f2b6518ff17509930499099ec2a6692d088c", + "subject_id": "backup-daily", + "workload_id": "backup-daily", + "workload_ref": { + "applicability": "applicable", + "deployable": null, + "name": "backup-daily", + "rapp_id": null + } + } + ], + "standard": "security-zones_v0.1" +} diff --git a/registry/generated/high-risk-data-paths.yaml b/registry/generated/high-risk-data-paths.yaml index afabb89..b323433 100644 --- a/registry/generated/high-risk-data-paths.yaml +++ b/registry/generated/high-risk-data-paths.yaml @@ -10,11 +10,11 @@ # declares it, and is null where the field set has not been established -- # null means unknown, never 'one field'. -generated_at: "2026-10-08T21:24:31Z" +generated_at: "2026-10-08T22:12:56Z" source: ops-warden/registry/routing/catalog.yaml -catalog_revision: "139f77dd557ca4139cd4a8ec4d0ef90e7ca607ee" -catalog_revision_date: "2026-10-08T23:21:46+02:00" -catalog_dirty: true +catalog_revision: "d470f2e5a7443db04119eb4d369687abb922e777" +catalog_revision_date: "2026-10-08T23:25:22+02:00" +catalog_dirty: false high_risk_lane_count: 33 concrete_path_count: 17 diff --git a/wiki/PolicyGatedSigning.md b/wiki/PolicyGatedSigning.md index a60542b..85f53ea 100644 --- a/wiki/PolicyGatedSigning.md +++ b/wiki/PolicyGatedSigning.md @@ -78,6 +78,12 @@ python3 scripts/build_flex_auth_registry.py \ -o registry/flex-auth/production_registry_snapshot.json ``` +The committed snapshot is built from `examples/inventory.seed.yaml` with +`--zone-resolutions registry/flex-auth/zone-resolutions.json`, which is zone-engine's +`tools/resolve_zones.py` output over owner declarations (today: activity-core +`declarations/backup-daily/tenancy.yaml`). Run the resolver from the estate root so +`source` paths stay relative. + Omitting `--zone-resolutions` is safe: applicable actors resolve `unknown`, not to a guessed zone. diff --git a/workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md b/workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md index 4627a8c..0479cfe 100644 --- a/workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md +++ b/workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md @@ -71,7 +71,7 @@ outcome this workplan exists to prevent. id: WARDEN-WP-0040-T02 status: wait blocked_on: message-from:ops-bridge -blocking_reason: "Owners of agt-codex-interhub-bootstrap (ops-hub) and agt-state-hub-bridge (ops-bridge) must publish authoritative workload identity declarations; atm-backup-daily: founder confirmed activity-core as owner 2026-10-08; waits on its declaration (ACTIVITY-WP-0042-T03)." +blocking_reason: "Owners of agt-codex-interhub-bootstrap (ops-hub) and agt-state-hub-bridge (ops-bridge) must publish authoritative workload identity declarations; atm-backup-daily declared by activity-core and compiled 2026-10-09 (z2-protected, admission unsatisfied: M1 below M2 floor)." priority: high state_hub_task_id: "54ad4864-7bcf-592e-a187-9239a81a0b11" ``` @@ -213,3 +213,23 @@ is classed as ordinary. The confirmation was relayed to activity-core for ACTIVITY-WP-0042-T03. Decision 89f1058f (D2) was deliberately left open, because it also gates production ArgoCD go-aheads. `atm-backup-daily` now waits only on activity-core publishing its declaration. + +### 2026-10-09 atm-backup-daily compiled + +activity-core published `declarations/backup-daily/tenancy.yaml` (c1533fe). +zone-engine's `resolve_zones.py` resolves it with the +`netkingdom-build-v0.1` profile: + +- declared zone: `z2-protected` (ordinary, not z2-continuity) +- admission: `unsatisfied`, reason `M1_below_M2_zone_floor` +- effective zone: `unknown` + +The resolved view is committed as `registry/flex-auth/zone-resolutions.json`, +and the snapshot was rebuilt from it. Resolution is no longer absent. The actor +stays `unknown` because the owner declared M1, below the M2 floor, which is +accurate rather than a gap ops-warden may close. Coverage, stated as T02 +requires: signing targets 0/3 resolved, 3 unknown, 1 not-applicable. The +figure is unchanged because `report_coverage.py` counts effective zones. +`atm-backup-daily` now waits on owner M2 evidence. It does not wait on a +declaration. Still unanswered: `agt-state-hub-bridge` (ops-bridge) and +`agt-codex-interhub-bootstrap` (ops-hub).