tegwick
b6b9b95616
Commit zone-engine's resolved view of activity-core's backup-daily declaration and rebuild the flex-auth snapshot from it. atm-backup-daily now resolves to z2-protected declared, admission unsatisfied (M1 below the M2 floor), and effective zone unknown. Signing-target coverage is unchanged at 0/3. Also regenerate the high-risk-paths artifact. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 327285@bnt-lap001 Assistant-Session: d6532cd1-7cd5-417b-baac-b841c9103a6b
75 lines
2.3 KiB
JSON
75 lines
2.3 KiB
JSON
{
|
|
"changes": {
|
|
"added": [
|
|
"backup-daily"
|
|
],
|
|
"baseline": "initial",
|
|
"changed": [],
|
|
"removed": []
|
|
},
|
|
"errors": [],
|
|
"ok": true,
|
|
"profile_errors": [],
|
|
"records": [
|
|
{
|
|
"admission": "unsatisfied",
|
|
"admission_reason": "M1_below_M2_zone_floor",
|
|
"control_profile": {
|
|
"id": "netkingdom-build-v0.1",
|
|
"version": "flex-auth@e521e7b+ops-warden@7ce58ae"
|
|
},
|
|
"controls": [
|
|
{
|
|
"failure_mode": "fail_open",
|
|
"id": "flex-auth/pre-sign",
|
|
"pep_owner": "ops-warden",
|
|
"policy_owner": "flex-auth",
|
|
"policy_ref": "flex-auth@e521e7b:examples/ops-warden/policy_package.md",
|
|
"stance": "advisory"
|
|
},
|
|
{
|
|
"failure_mode": "fail_closed",
|
|
"id": "ops-warden/agent-high-risk-read",
|
|
"pep_owner": "ops-warden",
|
|
"policy_owner": "ops-warden",
|
|
"policy_ref": "ops-warden@7ce58ae:src/warden/routing/models.py",
|
|
"stance": "enforced"
|
|
},
|
|
{
|
|
"failure_mode": "fail_closed",
|
|
"id": "ops-warden/plan-zone-rule",
|
|
"pep_owner": "ops-warden",
|
|
"policy_owner": "ops-warden",
|
|
"policy_ref": "security-zones_v0.1@104d5c6:section-5.1",
|
|
"stance": "enforced"
|
|
}
|
|
],
|
|
"declared_zone": "z2-protected",
|
|
"effective_zone": "unknown",
|
|
"guarantees": [
|
|
"authoritative-workload-identity",
|
|
"explicit-workload-reference",
|
|
"explicit-zone-membership",
|
|
"non-inferred-resolution",
|
|
"source-revision-bound-membership"
|
|
],
|
|
"identity_bindings": [
|
|
"kubernetes-service-account/railiance01/system:serviceaccount:activity-core:default",
|
|
"ssh-certificate/ops-warden/atm-backup-daily"
|
|
],
|
|
"membership_revision": "sha256:4b937fce814a937a034f63598f4c7f4d8a76cf92e82cada752ae31dbe5f3dc8f",
|
|
"membership_revision_reason": "source_bound",
|
|
"source": "activity-core/declarations/backup-daily/tenancy.yaml",
|
|
"source_revision": "activity-core@fd84f2b6518ff17509930499099ec2a6692d088c",
|
|
"subject_id": "backup-daily",
|
|
"workload_id": "backup-daily",
|
|
"workload_ref": {
|
|
"applicability": "applicable",
|
|
"deployable": null,
|
|
"name": "backup-daily",
|
|
"rapp_id": null
|
|
}
|
|
}
|
|
],
|
|
"standard": "security-zones_v0.1"
|
|
}
|