Record verified published runtime and complete policy history candidate
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
parent
d62970f39a
commit
645d5af213
38 changed files with 62746 additions and 1 deletions
|
|
@ -0,0 +1,43 @@
|
|||
# PolicyNexus runtime release verification — 2026-10-11
|
||||
|
||||
Owner workplan: PNEX-WP-0005. Historical finished PNEX-WP-0004 is preserved.
|
||||
This packet verifies a published candidate; it does not activate hosting or
|
||||
record a new human approval.
|
||||
|
||||
Native task 11467 / run 78 succeeded at b64a0c52ec1ea8d1efa99dd7f870e580d7c60df8.
|
||||
The immutable image is sha256:4e0db6a57eb00f577159aa6ee10f910dd67b03fd0541c6ce849f5426fdb99d06.
|
||||
Published receipts contain exact image/publication/inventory/source-set/raw-lock
|
||||
pins. The raw source-lock was directly observed in registry layers and installed
|
||||
container files; its schema, exact deterministic serializer, source config and
|
||||
all repository revisions agree with the image labels and installed inventory.
|
||||
All 73 document source hashes match their exact Git commits and paths. Independent
|
||||
HTTP checks verify all 73 canonical pages and all 72 prior immutable page hashes,
|
||||
existing headers, health, unknown 404, ETag 304 and the legacy 308 redirect. Native
|
||||
nginx-t and image-default UID/GID 101 pass with read-only root and writable /tmp.
|
||||
All 52 owner tests independently pass with POLICY_NEXUS_SOURCE_ROOT=/workspace/_sources.
|
||||
|
||||
The full pinned scan and CycloneDX SBOM cover 70 packages with zero findings;
|
||||
no severity or unfixed findings were suppressed. Scanner 0.74 and its 2026-10-10
|
||||
DB are pinned in receipts. Its bundled EOL list does not know Alpine 3.24; this
|
||||
warning remains recorded. Vulnerability coverage is demonstrated by the same
|
||||
scanner finding the unfixed tiff/zlib issues in the official base, then removing
|
||||
those findings after exact package fixes. Zero findings describes this scan and
|
||||
its database, not an assertion that every security property is complete.
|
||||
|
||||
Runtime changes: Nginx 1.27.5 → 1.30.5; Alpine 3.21.3 → 3.24.2; official full stable
|
||||
Alpine index15c994d10d6d78658721c3bcafff14cb281fba2a4bdf9d5ba92c416a472516e3;
|
||||
exact tiff 4.7.2-r0 and zlib 1.3.2-r1 updates. Old/new Nginx configure flags match;
|
||||
the full optional module set and owner nginx.conf are retained. Upstream source
|
||||
is pinned at [588b4cbc](https://github.com/nginx/docker-nginx-unprivileged/tree/588b4cbc88065a313909f47a02510639e01cc508).
|
||||
|
||||
The previous b955 artifact, its source/history checks, full 159 fixable findings
|
||||
(2 CRITICAL / 39 HIGH / 76 MEDIUM / 42 LOW) and SBOM remain in previous-b955. Native run 76's
|
||||
CI fixture failure is retained in trial receipts. Local preparation separately
|
||||
records the sandbox build-metadata failure and the corrected explicit
|
||||
Containerfile invocation; none is relabeled a clean published candidate.
|
||||
|
||||
The evidence manifest hashes every retained artifact. No tokens, credential
|
||||
values or raw CI logs were captured. No Helm or ArgoCD hosting change occurred.
|
||||
|
||||
The image was executed locally for container HTTP/configuration checks. Registry
|
||||
layer readback itself did not execute code; native hosting remained unchanged.
|
||||
|
|
@ -0,0 +1,146 @@
|
|||
[
|
||||
{
|
||||
"path": "README.md",
|
||||
"sha256": "2438af8124e9cc0c42816b3bc71713c94bd64338cf9640a1d1b58e0263875e5c"
|
||||
},
|
||||
{
|
||||
"path": "image-readback-recipe.py",
|
||||
"sha256": "d143b820880a7edfa8a9d0f25e2496c9d3884146249fc9116d0287fab69ba913"
|
||||
},
|
||||
{
|
||||
"path": "previous-b955/ci-run-receipt.json",
|
||||
"sha256": "866934b24d4d62350e68ec18b5d2953c0be5ff9ea5820060405b06a058a1332c"
|
||||
},
|
||||
{
|
||||
"path": "previous-b955/history-transition-verification.json",
|
||||
"sha256": "9e6b2301fbcd231d01e43d75c9ca4e9f0b7ad0f286eb14914a93fb73b807d000"
|
||||
},
|
||||
{
|
||||
"path": "previous-b955/image-readback-receipt.json",
|
||||
"sha256": "664c70e7054ce65a1b62552db632cec32fe9d4e2fee6bb9fc76efe57901d60fd"
|
||||
},
|
||||
{
|
||||
"path": "previous-b955/installed-source-provenance-audit.json",
|
||||
"sha256": "35bcb4b470034eea933da03b858763d866883cc202549e044a8f4b65e9ef140a"
|
||||
},
|
||||
{
|
||||
"path": "previous-b955/release-verification.json",
|
||||
"sha256": "00a19b0344c3c4331e4924071543262f914f9cea348f5618c83667b13689f055"
|
||||
},
|
||||
{
|
||||
"path": "previous-b955/scan-summary.json",
|
||||
"sha256": "8e1fe39f32f3dd6f6db38aaebeff73698b14e690b16bd74f580d388bd532cc38"
|
||||
},
|
||||
{
|
||||
"path": "previous-b955/trivy-full.json",
|
||||
"sha256": "1748f48c2d1b96cedf9e534c7f37ff09099e84f510db5433a9a28980e580c963"
|
||||
},
|
||||
{
|
||||
"path": "previous-b955/vulnerable-b955-sbom.cdx.json",
|
||||
"sha256": "62681b169efa2dd61065e8f942822b9398490a302b1f3224324a9a2912a8cac4"
|
||||
},
|
||||
{
|
||||
"path": "published/image-readback-receipt.json",
|
||||
"sha256": "573ccb8d4027cf0b98efba8a9fb9d963a4b738f6b30e63de864774e582bc6907"
|
||||
},
|
||||
{
|
||||
"path": "published/publication-manifest.json",
|
||||
"sha256": "ba53cc4900e6bb9ab8aa4bac4e58cb5fe7a03d656bafb3f9cb3d9c8ebff7843a"
|
||||
},
|
||||
{
|
||||
"path": "published/published-ci-receipt.json",
|
||||
"sha256": "4824fbdce3c18845a4e0c329cc65c511a66da57db24590790465b0407adb8636"
|
||||
},
|
||||
{
|
||||
"path": "published/published-installed-verification.json",
|
||||
"sha256": "b152ccc6b64b4c46346cf7cf3a60d2ddb3562149abca1c1dfba806b9a3fc902c"
|
||||
},
|
||||
{
|
||||
"path": "published/published-sbom.cdx.json",
|
||||
"sha256": "bb6ac6ba8316c7348c4f637b870996546fc84a94eaa62543af16638eb4ebe0d6"
|
||||
},
|
||||
{
|
||||
"path": "published/published-source-provenance-audit.json",
|
||||
"sha256": "6ff7dbc5e117d50ddcf78a2a6f507286bbb053d250d78d4b564da72fcbbe1825"
|
||||
},
|
||||
{
|
||||
"path": "published/published-trivy-full.json",
|
||||
"sha256": "da6c947a0239b8529ed57d273562b73e8f0286f697567d46be81c5adf146888b"
|
||||
},
|
||||
{
|
||||
"path": "published/published-verification.json",
|
||||
"sha256": "7c8c4cf74ce642e31f294fadba601c3504c481e0ae34f3a59dc831c6a0496af9"
|
||||
},
|
||||
{
|
||||
"path": "published/source-inventory.json",
|
||||
"sha256": "40d9e8852fe4c9e75b71f371d0fdae38664b068e7498711b0ac5671d0f41efb5"
|
||||
},
|
||||
{
|
||||
"path": "published/source-lock.json",
|
||||
"sha256": "99c695f46a54ead4cfe8f560f3648bf4db19404fe198b156c740115c97d3ed40"
|
||||
},
|
||||
{
|
||||
"path": "runtime-preparation/alpine-fix-versions.json",
|
||||
"sha256": "e6774114aef7e338d09309005786f953b8d032933af10a60cfee2bca7dc4f128"
|
||||
},
|
||||
{
|
||||
"path": "runtime-preparation/base-resolution.json",
|
||||
"sha256": "88fbfa3f04ab6d8fac8d31cebbac9d222b6fd5a37a98e6585deed25070031286"
|
||||
},
|
||||
{
|
||||
"path": "runtime-preparation/base-trivy-full.json",
|
||||
"sha256": "bf18b6ccc664fb011081e00502cfa09d81b09460fc80505f3c26ae8ffff43f3e"
|
||||
},
|
||||
{
|
||||
"path": "runtime-preparation/http-compatibility-verification.json",
|
||||
"sha256": "c92e087b263ef4a071568105baeeac2bad52727c97d9962d0d4c8ae87ca22453"
|
||||
},
|
||||
{
|
||||
"path": "runtime-preparation/local-installed-verification.json",
|
||||
"sha256": "8158dcf04fcc4d83f669cf21ebbb8a74716fd9b17247469f7111dc829512d828"
|
||||
},
|
||||
{
|
||||
"path": "runtime-preparation/local-runtime-sbom.cdx.json",
|
||||
"sha256": "f555c5ca8c6b6b9fa9de350b8872bc324d4e0543dd240ecb0c824fc8033fde93"
|
||||
},
|
||||
{
|
||||
"path": "runtime-preparation/local-runtime-trivy-full.json",
|
||||
"sha256": "3cc2436a6fb9fe04390366983c2cf534d6846b1e7390ad61b22fbf0a5973427c"
|
||||
},
|
||||
{
|
||||
"path": "runtime-preparation/manifest.json",
|
||||
"sha256": "96b875462c83480a19686bf61d72008534f323676a586d8f7bc226c2970c4ad9"
|
||||
},
|
||||
{
|
||||
"path": "runtime-preparation/new-nginx-build.txt",
|
||||
"sha256": "e668729c0238b4083ae5b3bd1fb887b026bc03e723f301e509e7e03483d65534"
|
||||
},
|
||||
{
|
||||
"path": "runtime-preparation/nginx-build-compatibility.json",
|
||||
"sha256": "28fc8d0d55c254b194c2c0552c8fbc3eb5a679a98ecabccfbfba6de5d1558fbf"
|
||||
},
|
||||
{
|
||||
"path": "runtime-preparation/old-nginx-build.txt",
|
||||
"sha256": "ba98a7950dcc4b60ee0fba067739cf16af72e8f111a406c7c6c23608268e3610"
|
||||
},
|
||||
{
|
||||
"path": "runtime-preparation/stable-alpine-index.json",
|
||||
"sha256": "15c994d10d6d78658721c3bcafff14cb281fba2a4bdf9d5ba92c416a472516e3"
|
||||
},
|
||||
{
|
||||
"path": "runtime-preparation/upstream-Dockerfile",
|
||||
"sha256": "0b9eb1da1c867d790024cfa3a692f059dd104509e3fa026366bf544d9f0560e9"
|
||||
},
|
||||
{
|
||||
"path": "runtime-preparation/upstream-alpine-slim-Dockerfile",
|
||||
"sha256": "ebbaa3b3b12595e1a99ad7231e21d7d8c186ec29b59b27e9b778fdc82dcb85c4"
|
||||
},
|
||||
{
|
||||
"path": "runtime-preparation/upstream-source.json",
|
||||
"sha256": "0107134aec15d02eb79be9a9adf5f5c970ccef2f61662989ccc45ef57f0b679a"
|
||||
},
|
||||
{
|
||||
"path": "runtime-preparation/verification.json",
|
||||
"sha256": "c478fb48d2913c1bc97d26e94e6345d9fa3c83e0e3c84a4d82a6faa556e6b41e"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,135 @@
|
|||
"""Read a public policy image without executing it or retaining registry tokens."""
|
||||
import argparse
|
||||
import hashlib
|
||||
import io
|
||||
import json
|
||||
from pathlib import Path, PurePosixPath
|
||||
import re
|
||||
import tarfile
|
||||
import urllib.error
|
||||
import urllib.parse
|
||||
import urllib.request
|
||||
|
||||
ORIGIN = 'https://forgejo.coulomb.social'
|
||||
BASE = ORIGIN + '/v2/coulomb/policy-nexus/'
|
||||
LIMIT = 300 * 1024 * 1024
|
||||
|
||||
|
||||
def fetch(url, accept=None):
|
||||
headers = {'Accept': accept} if accept else {}
|
||||
try:
|
||||
response = urllib.request.urlopen(urllib.request.Request(url, headers=headers), timeout=30)
|
||||
except urllib.error.HTTPError as error:
|
||||
if error.code != 401:
|
||||
raise
|
||||
fields = dict(re.findall(r'(\w+)="([^"]*)"', error.headers.get('WWW-Authenticate', '')))
|
||||
realm = fields['realm']
|
||||
parsed = urllib.parse.urlparse(realm)
|
||||
if parsed.scheme != 'https' or parsed.netloc != 'forgejo.coulomb.social':
|
||||
raise ValueError('unexpected registry challenge origin')
|
||||
query = urllib.parse.urlencode({k: fields[k] for k in ('service', 'scope') if k in fields})
|
||||
with urllib.request.urlopen(realm + '?' + query, timeout=30) as auth:
|
||||
token = json.load(auth)['token']
|
||||
headers['Authorization'] = 'Bearer ' + token
|
||||
response = urllib.request.urlopen(urllib.request.Request(url, headers=headers), timeout=60)
|
||||
with response:
|
||||
body = response.read(LIMIT + 1)
|
||||
if len(body) > LIMIT:
|
||||
raise ValueError('registry artifact exceeds local verification bound')
|
||||
return body
|
||||
|
||||
|
||||
def sha(data):
|
||||
return hashlib.sha256(data).hexdigest()
|
||||
|
||||
|
||||
def blob(descriptor):
|
||||
digest = descriptor['digest']
|
||||
if not re.fullmatch(r'sha256:[a-f0-9]{64}', digest):
|
||||
raise ValueError('unknown image digest')
|
||||
data = fetch(BASE + 'blobs/' + digest)
|
||||
if 'sha256:' + sha(data) != digest or len(data) != descriptor['size']:
|
||||
raise ValueError('image blob hash or size mismatch')
|
||||
return data
|
||||
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument('--digest', required=True)
|
||||
parser.add_argument('--policy-revision', required=True)
|
||||
parser.add_argument('--output', type=Path, required=True)
|
||||
parser.add_argument('--require-source-lock', action='store_true')
|
||||
args = parser.parse_args()
|
||||
if not re.fullmatch(r'sha256:[a-f0-9]{64}', args.digest):
|
||||
raise ValueError('candidate must be pinned by SHA256 digest')
|
||||
data = fetch(BASE + 'manifests/' + args.digest, 'application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json')
|
||||
if 'sha256:' + sha(data) != args.digest:
|
||||
raise ValueError('candidate manifest hash mismatch')
|
||||
manifest = json.loads(data)
|
||||
config = json.loads(blob(manifest['config']))
|
||||
args.output.mkdir(parents=True, exist_ok=False)
|
||||
site = args.output / 'site'
|
||||
site.mkdir()
|
||||
files = {}
|
||||
for layer in manifest['layers']:
|
||||
with tarfile.open(fileobj=io.BytesIO(blob(layer)), mode='r:*') as archive:
|
||||
for item in archive:
|
||||
path = PurePosixPath(item.name.removeprefix('./'))
|
||||
prefix = PurePosixPath('usr/share/nginx/html')
|
||||
if not path.is_relative_to(prefix):
|
||||
continue
|
||||
relative = path.relative_to(prefix)
|
||||
if '..' in relative.parts or relative.is_absolute():
|
||||
raise ValueError('unsafe site layer path')
|
||||
if any(part.startswith('.wh.') for part in relative.parts):
|
||||
raise ValueError('site whiteout needs explicit review')
|
||||
if not item.isfile():
|
||||
if not item.isdir():
|
||||
raise ValueError('site artifact must not be a link or special file')
|
||||
continue
|
||||
if item.size > 8 * 1024 * 1024:
|
||||
raise ValueError('site artifact exceeds bound')
|
||||
stream = archive.extractfile(item)
|
||||
content = stream.read()
|
||||
target = site / relative
|
||||
target.parent.mkdir(parents=True, exist_ok=True)
|
||||
target.write_bytes(content)
|
||||
files[str(relative)] = sha(content)
|
||||
publication = json.loads((site / 'publication-manifest.json').read_bytes())
|
||||
inventory = json.loads((site / 'source-inventory.json').read_bytes())
|
||||
revisions = {r['name']: r['revision'] for r in inventory['repositories']}
|
||||
if len(revisions) != len(inventory['repositories']):
|
||||
raise ValueError('duplicate source repository')
|
||||
source_set = sha(json.dumps(revisions, sort_keys=True, separators=(',', ':')).encode())
|
||||
labels = config['config']['Labels']
|
||||
if source_set != inventory['source_set_digest'] or source_set != labels['org.coulomb.policy.source-set-digest']:
|
||||
raise ValueError('installed source inventory and image labels disagree')
|
||||
if revisions['policy-nexus'] != args.policy_revision or labels['org.opencontainers.image.revision'] != args.policy_revision:
|
||||
raise ValueError('candidate policy source revision differs')
|
||||
for document in publication['documents']:
|
||||
if document['source_revision'] != revisions[document['source_repo']]:
|
||||
raise ValueError('publication source revision differs from inventory')
|
||||
lock_path = site / 'source-lock.json'
|
||||
lock_digest = None
|
||||
if args.require_source_lock or lock_path.exists():
|
||||
lock_bytes = lock_path.read_bytes()
|
||||
lock = json.loads(lock_bytes)
|
||||
if (lock.get('schema_version') != 1 or lock.get('source_set_digest') != source_set
|
||||
or {name: record['revision'] for name, record in lock['repositories'].items()} != revisions):
|
||||
raise ValueError('installed original source-lock differs from inventory or image labels')
|
||||
lock_digest = sha(lock_bytes)
|
||||
receipt = {'image_digest': args.digest, 'policy_revision': args.policy_revision,
|
||||
'publication_manifest_digest': files['publication-manifest.json'],
|
||||
'source_inventory_digest': files['source-inventory.json'],
|
||||
'source_set_digest': source_set, 'documents': len(publication['documents']),
|
||||
'installed_site_files': len(files), 'source_revisions': revisions,
|
||||
'source_lock_digest': lock_digest, 'source_lock_observed': lock_digest is not None,
|
||||
'image_executed': False, 'registry_credentials_persisted': False}
|
||||
(args.output / 'image-manifest.json').write_bytes(data)
|
||||
(args.output / 'source-lock-reconstructed.json').write_text(json.dumps({'repositories': revisions, 'source_set_digest': source_set}, indent=2) + '\n')
|
||||
(args.output / 'receipt.json').write_text(json.dumps(receipt, indent=2) + '\n')
|
||||
print(json.dumps({k: v for k,v in receipt.items() if k != 'source_revisions'}, sort_keys=True))
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
{
|
||||
"id": 11466,
|
||||
"run_number": 77,
|
||||
"head_sha": "65862b1e0c6eaa4c96e1e48131db2ac7e914eb36",
|
||||
"status": "success",
|
||||
"url": "https://forgejo.coulomb.social/coulomb/policy-nexus/actions/runs/77",
|
||||
"created_at": "2026-10-11T00:33:57Z",
|
||||
"updated_at": "2026-10-11T00:35:23Z",
|
||||
"prior_failed_trial": {
|
||||
"task_id": 11461,
|
||||
"run_number": 76,
|
||||
"head_sha": "6d2c7eef779c823731e6f793b3adcf44afddd183",
|
||||
"status": "failure",
|
||||
"reason": "HistoricalRevisionTest fixture inherited nonfixture CI source-root"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
{
|
||||
"previous_documents": 72,
|
||||
"candidate_documents": 73,
|
||||
"reviewed_semantic_changes": [
|
||||
"CUST-ADR-002",
|
||||
"CUST-ADR-004",
|
||||
"RISK-F-0008",
|
||||
"RMASTER-ADR-0006",
|
||||
"canon-work-record-types",
|
||||
"canon-workplan-terminology-fleet",
|
||||
"net-kingdom-architecture",
|
||||
"netkingdom-security-layer-model-v0.7",
|
||||
"netkingdom-security-layer-model-v0.8",
|
||||
"netkingdom-tenancy-posture",
|
||||
"ops-warden-adr-0004"
|
||||
],
|
||||
"history_preserved": 72
|
||||
}
|
||||
|
|
@ -0,0 +1,37 @@
|
|||
{
|
||||
"image_digest": "sha256:b955359f68ccd98ca6e906ef57b74c9bd6e732083b9e2b6857a358cd5196f9a1",
|
||||
"policy_revision": "65862b1e0c6eaa4c96e1e48131db2ac7e914eb36",
|
||||
"publication_manifest_digest": "7e2a0d89c909ac3243ee7a57198834949d69e53e60804107e5780fd74ee1ae3f",
|
||||
"source_inventory_digest": "e61b848f497d530ce4cfba153a0fff058e1924eff4d457caeb152863b688b405",
|
||||
"source_set_digest": "6e8458caf1da600a7a0b71a44dd1ccba713fd1a25e22b0a6f6af67c2c5a97792",
|
||||
"documents": 73,
|
||||
"installed_site_files": 183,
|
||||
"source_revisions": {
|
||||
"access-engine": "f5fad7c2851708be41c82891430deffe5f4af0ac",
|
||||
"activity-core": "fd84f2b6518ff17509930499099ec2a6692d088c",
|
||||
"artifact-store": "94541a29e2758ea5da86a41f4d2016c6ef98d026",
|
||||
"binect-js": "d128f03a700bd9a5f6e6a6e3b3f68fa07d597243",
|
||||
"coulomb-loop": "d07455fbacd3e125e1ba6d991041c811b5c353d2",
|
||||
"coulomb-social": "1af71a4f61f80b4c58d30cad2cc0ccd5cc02979f",
|
||||
"evidence-binder": "4f115e38b84960038df92b5755cc33387fdec574",
|
||||
"glas-harness": "5ce4f38aedfd27cc783131f18480df02e2951514",
|
||||
"kaizen-agentic": "894d34c466eb7f949e136fbeca4fcf201cdb1086",
|
||||
"key-cape": "f97f006edef72a8a4dec2fc47c1097ab9642774a",
|
||||
"markitect-main": "9fbfe76ebb43ff84358d2f2a36ca6b958431e22d",
|
||||
"net-kingdom": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"ops-warden": "eaabb4216186f4fee2d830376a381740b140087c",
|
||||
"policy-nexus": "65862b1e0c6eaa4c96e1e48131db2ac7e914eb36",
|
||||
"railiance-hosts": "53344177f3de1d0a417504e798b80c1d89798867",
|
||||
"railiance-infra": "ef64e324b61e9aa9b9ed03aad7dd2101915057ca",
|
||||
"railiance-master": "078515b5adc7ac742ffad1b20577fcf88400acbb",
|
||||
"railiance-platform": "8c152d012a44664f51969f2cb3456e28a3a0e5ff",
|
||||
"rapp-postgres": "03744030c9258e920f6403a9ce184a26d7b75268",
|
||||
"rein-aharness": "c2471657605a61e8c62469b619bbc822baea945c",
|
||||
"risk-nexus": "b5b80aafca83469f6eabe5860c1265f39a147cbe",
|
||||
"state-hub": "cccc27ce44928e579627aa86ccee38ae4fb1ca10",
|
||||
"target-revenue": "a3a8a27a8cda32ae3c7b55353ee16a131c50a0a0",
|
||||
"the-custodian": "dcdec162d61398f0def4990957455d45a74a1b01"
|
||||
},
|
||||
"image_executed": false,
|
||||
"registry_credentials_persisted": false
|
||||
}
|
||||
|
|
@ -0,0 +1,513 @@
|
|||
[
|
||||
{
|
||||
"id": "netkingdom-tenancy-posture",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "canon/standards/tenancy-posture_v0.1.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "canon-autonomy-lanes",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/standards/autonomy-lanes_v0.1.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "canon-contrib-convention",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/standards/contribution-convention_v0.1.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "canon-project-repository-flavor",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/standards/project-repository-flavor_v0.1.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "canon-work-record-types",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/standards/work-record-types_v0.1.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "canon-workplan-terminology-fleet",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/standards/workplan-terminology-fleet_v0.1.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "coulomb-estate-architecture",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/architecture/coulomb-estate_v0.1.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "railiance-architecture",
|
||||
"source_commit": "078515b5adc7ac742ffad1b20577fcf88400acbb",
|
||||
"source_path": "docs/architecture/railiance_v0.1.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "net-kingdom-architecture",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "docs/architecture/net-kingdom_v0.1.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "state-hub-architecture",
|
||||
"source_commit": "cccc27ce44928e579627aa86ccee38ae4fb1ca10",
|
||||
"source_path": "docs/architecture/state-hub_v0.1.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "policy-nexus-architecture",
|
||||
"source_commit": "65862b1e0c6eaa4c96e1e48131db2ac7e914eb36",
|
||||
"source_path": "docs/architecture/policy-nexus_v0.1.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "policy-nexus-adr-0001",
|
||||
"source_commit": "65862b1e0c6eaa4c96e1e48131db2ac7e914eb36",
|
||||
"source_path": "docs/adr/ADR-0001-addressing-and-permanence.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RMASTER-ADR-0001",
|
||||
"source_commit": "078515b5adc7ac742ffad1b20577fcf88400acbb",
|
||||
"source_path": "docs/adr/ADR-0001-repository-prefix-architecture.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RMASTER-ADR-0002",
|
||||
"source_commit": "078515b5adc7ac742ffad1b20577fcf88400acbb",
|
||||
"source_path": "docs/adr/ADR-0002-rail-kubernetes-wave-1-boundary.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RMASTER-ADR-0003",
|
||||
"source_commit": "078515b5adc7ac742ffad1b20577fcf88400acbb",
|
||||
"source_path": "docs/adr/ADR-0003-rapp-first-wave-selection.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RMASTER-ADR-0004",
|
||||
"source_commit": "078515b5adc7ac742ffad1b20577fcf88400acbb",
|
||||
"source_path": "docs/adr/ADR-0004-first-wave-reef-rollout.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RMASTER-ADR-0005",
|
||||
"source_commit": "078515b5adc7ac742ffad1b20577fcf88400acbb",
|
||||
"source_path": "docs/adr/ADR-0005-derived-rail-composition.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RMASTER-ADR-0006",
|
||||
"source_commit": "078515b5adc7ac742ffad1b20577fcf88400acbb",
|
||||
"source_path": "docs/adr/ADR-0006-reef-production-admission.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RMASTER-ADR-0007",
|
||||
"source_commit": "078515b5adc7ac742ffad1b20577fcf88400acbb",
|
||||
"source_path": "docs/adr/ADR-0007-rapp-declaration-contract.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RMASTER-ADR-0008",
|
||||
"source_commit": "078515b5adc7ac742ffad1b20577fcf88400acbb",
|
||||
"source_path": "docs/adr/ADR-0008-private-by-default-exposure.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ACT-ADR-001",
|
||||
"source_commit": "fd84f2b6518ff17509930499099ec2a6692d088c",
|
||||
"source_path": "docs/adr/adr-001-event-bridge-architecture.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ACT-ADR-002",
|
||||
"source_commit": "fd84f2b6518ff17509930499099ec2a6692d088c",
|
||||
"source_path": "docs/adr/adr-002-definition-format.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ACT-ADR-003",
|
||||
"source_commit": "fd84f2b6518ff17509930499099ec2a6692d088c",
|
||||
"source_path": "docs/adr/adr-003-rule-instruction-model.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ACT-ADR-004",
|
||||
"source_commit": "fd84f2b6518ff17509930499099ec2a6692d088c",
|
||||
"source_path": "docs/adr/adr-004-producer-trust-boundary.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ACT-ADR-005",
|
||||
"source_commit": "fd84f2b6518ff17509930499099ec2a6692d088c",
|
||||
"source_path": "docs/adr/adr-005-ops-runs-vs-dev-work-records.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ops-warden-adr-0001",
|
||||
"source_commit": "eaabb4216186f4fee2d830376a381740b140087c",
|
||||
"source_path": "docs/adr/ADR-0001-catalog-is-a-pointer-layer.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ops-warden-adr-0002",
|
||||
"source_commit": "eaabb4216186f4fee2d830376a381740b140087c",
|
||||
"source_path": "docs/adr/ADR-0002-conduit-not-broker.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ops-warden-adr-0003",
|
||||
"source_commit": "eaabb4216186f4fee2d830376a381740b140087c",
|
||||
"source_path": "docs/adr/ADR-0003-cover-gaps-never-silently-own-them.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ops-warden-adr-0004",
|
||||
"source_commit": "eaabb4216186f4fee2d830376a381740b140087c",
|
||||
"source_path": "docs/adr/ADR-0004-agent-read-boundary-on-high-risk-lanes.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ops-warden-adr-0005",
|
||||
"source_commit": "eaabb4216186f4fee2d830376a381740b140087c",
|
||||
"source_path": "docs/adr/ADR-0005-implement-narrowly-route-broadly.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "CUST-ADR-001",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/architecture/adr-001-workplans-as-repo-artefacts.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "CUST-ADR-002",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/architecture/adr-002-custodian-agent-runtime-design.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "CUST-ADR-003",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/architecture/adr-003-materialized-derived-state.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "CUST-ADR-004",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/architecture/adr-004-connectivity-first-network-posture.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "CUST-ADR-005",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/architecture/adr-005-cross-repo-workplans-project-repos.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "CUST-ADR-006",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/architecture/adr-006-canon-federation-concept-ownership.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "CUST-ADR-007",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/architecture/adr-007-workplan-identity-and-repo-worker-topology.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "CUST-ADR-010",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/architecture/adr-010-hub-authority-and-local-cache-model.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "CUST-ADR-011",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/architecture/adr-011-federated-namespaces-and-reconciliation-limits.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RPLAT-ADR-0001",
|
||||
"source_commit": "8c152d012a44664f51969f2cb3456e28a3a0e5ff",
|
||||
"source_path": "docs/adr/ADR-0001-s3-platform-service-boundary.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RPLAT-ADR-0002",
|
||||
"source_commit": "8c152d012a44664f51969f2cb3456e28a3a0e5ff",
|
||||
"source_path": "docs/adr/ADR-0002-placement-policy-ownership.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RPLAT-ADR-0003",
|
||||
"source_commit": "8c152d012a44664f51969f2cb3456e28a3a0e5ff",
|
||||
"source_path": "docs/adr/ADR-0003-decisions-live-in-the-repo.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "netkingdom-iam-profile-v0.3",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "canon/standards/iam-profile_v0.3.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "NK-ADR-0006",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "docs/adr/ADR-0006-recursive-multi-tenant-identity-authorization.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "NK-ADR-0007",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "docs/adr/ADR-0007-security-orchestration-boundary.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "NK-ADR-0008",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "docs/adr/ADR-0008-object-storage-sts-credential-vending.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "NK-ADR-0010",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "docs/adr/ADR-0010-orchestration-vs-dependency-self-coherent-intent.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "NK-ADR-0011",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "docs/adr/ADR-0011-iam-profile-ownership-and-version-governance.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "NK-ADR-0012",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "docs/adr/ADR-0012-playbook-capability-contract-ownership.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "NK-ADR-0013",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "docs/adr/ADR-0013-tenant-onboarding-grouping-taxonomy.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "NK-ADR-0014",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "docs/adr/ADR-0014-tenant-capability-roles-and-tenant-engine-ownership.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "NK-ADR-0015",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "docs/adr/ADR-0015-netkingdom-railiance-workload-packaging-and-relational-platform.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RINFRA-ADR-0005",
|
||||
"source_commit": "ef64e324b61e9aa9b9ed03aad7dd2101915057ca",
|
||||
"source_path": "docs/adr/ADR-005-k3s-api-tunnel-only.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ACT-ADR-006",
|
||||
"source_commit": "fd84f2b6518ff17509930499099ec2a6692d088c",
|
||||
"source_path": "docs/adr/adr-006-glas-profile-execution.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ACT-ADR-007",
|
||||
"source_commit": "fd84f2b6518ff17509930499099ec2a6692d088c",
|
||||
"source_path": "docs/adr/adr-007-bounded-operations.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ops-warden-adr-0007",
|
||||
"source_commit": "eaabb4216186f4fee2d830376a381740b140087c",
|
||||
"source_path": "docs/adr/ADR-0007-build-stage-stops-at-credential-disclosure.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ops-warden-adr-0008",
|
||||
"source_commit": "eaabb4216186f4fee2d830376a381740b140087c",
|
||||
"source_path": "docs/adr/ADR-0008-grade-the-path-not-the-field.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ops-warden-adr-0009",
|
||||
"source_commit": "eaabb4216186f4fee2d830376a381740b140087c",
|
||||
"source_path": "docs/adr/ADR-0009-adopt-security-zones-as-a-consumer.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ops-warden-adr-0010",
|
||||
"source_commit": "eaabb4216186f4fee2d830376a381740b140087c",
|
||||
"source_path": "docs/adr/ADR-0010-ops-warden-is-staff.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RMASTER-ADR-0009",
|
||||
"source_commit": "078515b5adc7ac742ffad1b20577fcf88400acbb",
|
||||
"source_path": "docs/adr/ADR-0009-netkingdom-security-layer-interaction.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "CUST-ADR-012",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/architecture/adr-012-projection-source-and-preliminary-overlay.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "netkingdom-posture-feedback-v0.1",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "canon/standards/posture-feedback_v0.1.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "netkingdom-security-layer-model-v0.7",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "canon/standards/security-layer-model_v0.7.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "netkingdom-security-layer-model-v0.8",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "canon/standards/security-layer-model_v0.8.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "netkingdom-security-scenario-composition-v0.1",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "canon/standards/security-scenario-composition_v0.1.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "netkingdom-security-zones-v0.1",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "canon/standards/security-zones_v0.1.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RISK-F-0001",
|
||||
"source_commit": "b5b80aafca83469f6eabe5860c1265f39a147cbe",
|
||||
"source_path": "findings/RISK-F-0001-flex-auth-unauthenticated-check.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RISK-F-0008",
|
||||
"source_commit": "b5b80aafca83469f6eabe5860c1265f39a147cbe",
|
||||
"source_path": "findings/RISK-F-0008-audit-retention-legal-basis-assumed.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RISK-METHOD-SEVERITY",
|
||||
"source_commit": "b5b80aafca83469f6eabe5860c1265f39a147cbe",
|
||||
"source_path": "docs/method/severity.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RISK-METHOD-DISCLOSURE",
|
||||
"source_commit": "b5b80aafca83469f6eabe5860c1265f39a147cbe",
|
||||
"source_path": "docs/method/disclosure.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RISK-METHOD-REVIEW",
|
||||
"source_commit": "b5b80aafca83469f6eabe5860c1265f39a147cbe",
|
||||
"source_path": "docs/method/review.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RISK-METHOD-VERIFICATION",
|
||||
"source_commit": "b5b80aafca83469f6eabe5860c1265f39a147cbe",
|
||||
"source_path": "docs/method/verification.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RISK-METHOD-DEPENDENCIES",
|
||||
"source_commit": "b5b80aafca83469f6eabe5860c1265f39a147cbe",
|
||||
"source_path": "docs/method/dependencies.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,82 @@
|
|||
{
|
||||
"schema_version": "policy-nexus-release/v1",
|
||||
"publication_manifest_digest": "7e2a0d89c909ac3243ee7a57198834949d69e53e60804107e5780fd74ee1ae3f",
|
||||
"source_inventory_digest": "e61b848f497d530ce4cfba153a0fff058e1924eff4d457caeb152863b688b405",
|
||||
"source_set_digest": "6e8458caf1da600a7a0b71a44dd1ccba713fd1a25e22b0a6f6af67c2c5a97792",
|
||||
"generated_as_of": "2026-10-11",
|
||||
"documents": [
|
||||
"netkingdom-tenancy-posture",
|
||||
"canon-autonomy-lanes",
|
||||
"canon-contrib-convention",
|
||||
"canon-project-repository-flavor",
|
||||
"canon-work-record-types",
|
||||
"canon-workplan-terminology-fleet",
|
||||
"coulomb-estate-architecture",
|
||||
"railiance-architecture",
|
||||
"net-kingdom-architecture",
|
||||
"state-hub-architecture",
|
||||
"policy-nexus-architecture",
|
||||
"policy-nexus-adr-0001",
|
||||
"RMASTER-ADR-0001",
|
||||
"RMASTER-ADR-0002",
|
||||
"RMASTER-ADR-0003",
|
||||
"RMASTER-ADR-0004",
|
||||
"RMASTER-ADR-0005",
|
||||
"RMASTER-ADR-0006",
|
||||
"RMASTER-ADR-0007",
|
||||
"RMASTER-ADR-0008",
|
||||
"ACT-ADR-001",
|
||||
"ACT-ADR-002",
|
||||
"ACT-ADR-003",
|
||||
"ACT-ADR-004",
|
||||
"ACT-ADR-005",
|
||||
"ops-warden-adr-0001",
|
||||
"ops-warden-adr-0002",
|
||||
"ops-warden-adr-0003",
|
||||
"ops-warden-adr-0004",
|
||||
"ops-warden-adr-0005",
|
||||
"CUST-ADR-001",
|
||||
"CUST-ADR-002",
|
||||
"CUST-ADR-003",
|
||||
"CUST-ADR-004",
|
||||
"CUST-ADR-005",
|
||||
"CUST-ADR-006",
|
||||
"CUST-ADR-007",
|
||||
"CUST-ADR-010",
|
||||
"CUST-ADR-011",
|
||||
"RPLAT-ADR-0001",
|
||||
"RPLAT-ADR-0002",
|
||||
"RPLAT-ADR-0003",
|
||||
"netkingdom-iam-profile-v0.3",
|
||||
"NK-ADR-0006",
|
||||
"NK-ADR-0007",
|
||||
"NK-ADR-0008",
|
||||
"NK-ADR-0010",
|
||||
"NK-ADR-0011",
|
||||
"NK-ADR-0012",
|
||||
"NK-ADR-0013",
|
||||
"NK-ADR-0014",
|
||||
"NK-ADR-0015",
|
||||
"RINFRA-ADR-0005",
|
||||
"ACT-ADR-006",
|
||||
"ACT-ADR-007",
|
||||
"ops-warden-adr-0007",
|
||||
"ops-warden-adr-0008",
|
||||
"ops-warden-adr-0009",
|
||||
"ops-warden-adr-0010",
|
||||
"RMASTER-ADR-0009",
|
||||
"CUST-ADR-012",
|
||||
"netkingdom-posture-feedback-v0.1",
|
||||
"netkingdom-security-layer-model-v0.7",
|
||||
"netkingdom-security-layer-model-v0.8",
|
||||
"netkingdom-security-scenario-composition-v0.1",
|
||||
"netkingdom-security-zones-v0.1",
|
||||
"RISK-F-0001",
|
||||
"RISK-F-0008",
|
||||
"RISK-METHOD-SEVERITY",
|
||||
"RISK-METHOD-DISCLOSURE",
|
||||
"RISK-METHOD-REVIEW",
|
||||
"RISK-METHOD-VERIFICATION",
|
||||
"RISK-METHOD-DEPENDENCIES"
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
{
|
||||
"scanner_image": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
|
||||
"scanner_version": "0.74.0",
|
||||
"db_metadata": {
|
||||
"Version": 2,
|
||||
"NextUpdate": "2026-10-11T18:59:50.889010572Z",
|
||||
"UpdatedAt": "2026-10-10T18:59:50.889010923Z",
|
||||
"DownloadedAt": "2026-10-10T23:32:32.380033131Z"
|
||||
},
|
||||
"image_digest": "sha256:b955359f68ccd98ca6e906ef57b74c9bd6e732083b9e2b6857a358cd5196f9a1",
|
||||
"all_findings": 159,
|
||||
"severities": {
|
||||
"CRITICAL": 2,
|
||||
"HIGH": 39,
|
||||
"MEDIUM": 76,
|
||||
"LOW": 42,
|
||||
"UNKNOWN": 0
|
||||
},
|
||||
"fixed_available": 159,
|
||||
"critical": [
|
||||
{
|
||||
"VulnerabilityID": "CVE-2026-31789",
|
||||
"PkgName": "libcrypto3",
|
||||
"InstalledVersion": "3.3.3-r0",
|
||||
"FixedVersion": "3.3.7-r0",
|
||||
"Severity": "CRITICAL"
|
||||
},
|
||||
{
|
||||
"VulnerabilityID": "CVE-2026-31789",
|
||||
"PkgName": "libssl3",
|
||||
"InstalledVersion": "3.3.3-r0",
|
||||
"FixedVersion": "3.3.7-r0",
|
||||
"Severity": "CRITICAL"
|
||||
}
|
||||
],
|
||||
"full_report_sha256": "1748f48c2d1b96cedf9e534c7f37ff09099e84f510db5433a9a28980e580c963",
|
||||
"suppressed_findings": false,
|
||||
"hosting_changed": false
|
||||
}
|
||||
File diff suppressed because it is too large
Load diff
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,39 @@
|
|||
{
|
||||
"image_digest": "sha256:4e0db6a57eb00f577159aa6ee10f910dd67b03fd0541c6ce849f5426fdb99d06",
|
||||
"policy_revision": "b64a0c52ec1ea8d1efa99dd7f870e580d7c60df8",
|
||||
"publication_manifest_digest": "ba53cc4900e6bb9ab8aa4bac4e58cb5fe7a03d656bafb3f9cb3d9c8ebff7843a",
|
||||
"source_inventory_digest": "40d9e8852fe4c9e75b71f371d0fdae38664b068e7498711b0ac5671d0f41efb5",
|
||||
"source_set_digest": "15bda2e332285afc862df8974cf29de403737df5073fa362adfc6d203cf2f256",
|
||||
"documents": 73,
|
||||
"installed_site_files": 183,
|
||||
"source_revisions": {
|
||||
"access-engine": "f5fad7c2851708be41c82891430deffe5f4af0ac",
|
||||
"activity-core": "fd84f2b6518ff17509930499099ec2a6692d088c",
|
||||
"artifact-store": "94541a29e2758ea5da86a41f4d2016c6ef98d026",
|
||||
"binect-js": "d128f03a700bd9a5f6e6a6e3b3f68fa07d597243",
|
||||
"coulomb-loop": "d07455fbacd3e125e1ba6d991041c811b5c353d2",
|
||||
"coulomb-social": "1af71a4f61f80b4c58d30cad2cc0ccd5cc02979f",
|
||||
"evidence-binder": "4f115e38b84960038df92b5755cc33387fdec574",
|
||||
"glas-harness": "5ce4f38aedfd27cc783131f18480df02e2951514",
|
||||
"kaizen-agentic": "894d34c466eb7f949e136fbeca4fcf201cdb1086",
|
||||
"key-cape": "f97f006edef72a8a4dec2fc47c1097ab9642774a",
|
||||
"markitect-main": "9fbfe76ebb43ff84358d2f2a36ca6b958431e22d",
|
||||
"net-kingdom": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"ops-warden": "eaabb4216186f4fee2d830376a381740b140087c",
|
||||
"policy-nexus": "b64a0c52ec1ea8d1efa99dd7f870e580d7c60df8",
|
||||
"railiance-hosts": "53344177f3de1d0a417504e798b80c1d89798867",
|
||||
"railiance-infra": "ef64e324b61e9aa9b9ed03aad7dd2101915057ca",
|
||||
"railiance-master": "078515b5adc7ac742ffad1b20577fcf88400acbb",
|
||||
"railiance-platform": "8c152d012a44664f51969f2cb3456e28a3a0e5ff",
|
||||
"rapp-postgres": "03744030c9258e920f6403a9ce184a26d7b75268",
|
||||
"rein-aharness": "c2471657605a61e8c62469b619bbc822baea945c",
|
||||
"risk-nexus": "b5b80aafca83469f6eabe5860c1265f39a147cbe",
|
||||
"state-hub": "cccc27ce44928e579627aa86ccee38ae4fb1ca10",
|
||||
"target-revenue": "a3a8a27a8cda32ae3c7b55353ee16a131c50a0a0",
|
||||
"the-custodian": "dcdec162d61398f0def4990957455d45a74a1b01"
|
||||
},
|
||||
"source_lock_digest": "99c695f46a54ead4cfe8f560f3648bf4db19404fe198b156c740115c97d3ed40",
|
||||
"source_lock_observed": true,
|
||||
"image_executed": false,
|
||||
"registry_credentials_persisted": false
|
||||
}
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,29 @@
|
|||
{
|
||||
"id": 11467,
|
||||
"run_number": 78,
|
||||
"head_sha": "b64a0c52ec1ea8d1efa99dd7f870e580d7c60df8",
|
||||
"status": "success",
|
||||
"url": "https://forgejo.coulomb.social/coulomb/policy-nexus/actions/runs/78",
|
||||
"created_at": "2026-10-11T00:48:37Z",
|
||||
"updated_at": "2026-10-11T00:50:05Z",
|
||||
"owner_tests": {
|
||||
"passed": 52,
|
||||
"environment": "POLICY_NEXUS_SOURCE_ROOT=/workspace/_sources",
|
||||
"independent_local": true
|
||||
},
|
||||
"prior_trials": [
|
||||
{
|
||||
"task_id": 11461,
|
||||
"run": 76,
|
||||
"source": "6d2c7eef779c823731e6f793b3adcf44afddd183",
|
||||
"outcome": "failure, inherited fixture source-root"
|
||||
},
|
||||
{
|
||||
"task_id": 11466,
|
||||
"run": 77,
|
||||
"source": "65862b1e0c6eaa4c96e1e48131db2ac7e914eb36",
|
||||
"image": "sha256:b955359f68ccd98ca6e906ef57b74c9bd6e732083b9e2b6857a358cd5196f9a1",
|
||||
"outcome": "source/history passed; runtime159 fixable findings incl2critical39high"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,107 @@
|
|||
{
|
||||
"local_installed_canonical_http_hashes": 73,
|
||||
"local_installed_historical_http_hashes": 72,
|
||||
"release": {
|
||||
"schema_version": "policy-nexus-release/v1",
|
||||
"publication_manifest_digest": "ba53cc4900e6bb9ab8aa4bac4e58cb5fe7a03d656bafb3f9cb3d9c8ebff7843a",
|
||||
"source_inventory_digest": "40d9e8852fe4c9e75b71f371d0fdae38664b068e7498711b0ac5671d0f41efb5",
|
||||
"source_set_digest": "15bda2e332285afc862df8974cf29de403737df5073fa362adfc6d203cf2f256",
|
||||
"generated_as_of": "2026-10-11",
|
||||
"documents": [
|
||||
"netkingdom-tenancy-posture",
|
||||
"canon-autonomy-lanes",
|
||||
"canon-contrib-convention",
|
||||
"canon-project-repository-flavor",
|
||||
"canon-work-record-types",
|
||||
"canon-workplan-terminology-fleet",
|
||||
"coulomb-estate-architecture",
|
||||
"railiance-architecture",
|
||||
"net-kingdom-architecture",
|
||||
"state-hub-architecture",
|
||||
"policy-nexus-architecture",
|
||||
"policy-nexus-adr-0001",
|
||||
"RMASTER-ADR-0001",
|
||||
"RMASTER-ADR-0002",
|
||||
"RMASTER-ADR-0003",
|
||||
"RMASTER-ADR-0004",
|
||||
"RMASTER-ADR-0005",
|
||||
"RMASTER-ADR-0006",
|
||||
"RMASTER-ADR-0007",
|
||||
"RMASTER-ADR-0008",
|
||||
"ACT-ADR-001",
|
||||
"ACT-ADR-002",
|
||||
"ACT-ADR-003",
|
||||
"ACT-ADR-004",
|
||||
"ACT-ADR-005",
|
||||
"ops-warden-adr-0001",
|
||||
"ops-warden-adr-0002",
|
||||
"ops-warden-adr-0003",
|
||||
"ops-warden-adr-0004",
|
||||
"ops-warden-adr-0005",
|
||||
"CUST-ADR-001",
|
||||
"CUST-ADR-002",
|
||||
"CUST-ADR-003",
|
||||
"CUST-ADR-004",
|
||||
"CUST-ADR-005",
|
||||
"CUST-ADR-006",
|
||||
"CUST-ADR-007",
|
||||
"CUST-ADR-010",
|
||||
"CUST-ADR-011",
|
||||
"RPLAT-ADR-0001",
|
||||
"RPLAT-ADR-0002",
|
||||
"RPLAT-ADR-0003",
|
||||
"netkingdom-iam-profile-v0.3",
|
||||
"NK-ADR-0006",
|
||||
"NK-ADR-0007",
|
||||
"NK-ADR-0008",
|
||||
"NK-ADR-0010",
|
||||
"NK-ADR-0011",
|
||||
"NK-ADR-0012",
|
||||
"NK-ADR-0013",
|
||||
"NK-ADR-0014",
|
||||
"NK-ADR-0015",
|
||||
"RINFRA-ADR-0005",
|
||||
"ACT-ADR-006",
|
||||
"ACT-ADR-007",
|
||||
"ops-warden-adr-0007",
|
||||
"ops-warden-adr-0008",
|
||||
"ops-warden-adr-0009",
|
||||
"ops-warden-adr-0010",
|
||||
"RMASTER-ADR-0009",
|
||||
"CUST-ADR-012",
|
||||
"netkingdom-posture-feedback-v0.1",
|
||||
"netkingdom-security-layer-model-v0.7",
|
||||
"netkingdom-security-layer-model-v0.8",
|
||||
"netkingdom-security-scenario-composition-v0.1",
|
||||
"netkingdom-security-zones-v0.1",
|
||||
"RISK-F-0001",
|
||||
"RISK-F-0008",
|
||||
"RISK-METHOD-SEVERITY",
|
||||
"RISK-METHOD-DISCLOSURE",
|
||||
"RISK-METHOD-REVIEW",
|
||||
"RISK-METHOD-VERIFICATION",
|
||||
"RISK-METHOD-DEPENDENCIES"
|
||||
]
|
||||
},
|
||||
"transition": {
|
||||
"previous_documents": 72,
|
||||
"candidate_documents": 73,
|
||||
"reviewed_semantic_changes": [
|
||||
"CUST-ADR-002",
|
||||
"CUST-ADR-004",
|
||||
"RISK-F-0008",
|
||||
"RMASTER-ADR-0006",
|
||||
"canon-work-record-types",
|
||||
"canon-workplan-terminology-fleet",
|
||||
"net-kingdom-architecture",
|
||||
"netkingdom-security-layer-model-v0.7",
|
||||
"netkingdom-security-layer-model-v0.8",
|
||||
"netkingdom-tenancy-posture",
|
||||
"ops-warden-adr-0004"
|
||||
],
|
||||
"history_preserved": 72
|
||||
},
|
||||
"security_headers_health_404_etag_legacy_redirect": "passed",
|
||||
"new_ci_artifact": "native run78/task11467 success at b64a0c52ec1ea8d1efa99dd7f870e580d7c60df8",
|
||||
"hosting_changed": false
|
||||
}
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,513 @@
|
|||
[
|
||||
{
|
||||
"id": "netkingdom-tenancy-posture",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "canon/standards/tenancy-posture_v0.1.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "canon-autonomy-lanes",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/standards/autonomy-lanes_v0.1.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "canon-contrib-convention",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/standards/contribution-convention_v0.1.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "canon-project-repository-flavor",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/standards/project-repository-flavor_v0.1.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "canon-work-record-types",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/standards/work-record-types_v0.1.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "canon-workplan-terminology-fleet",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/standards/workplan-terminology-fleet_v0.1.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "coulomb-estate-architecture",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/architecture/coulomb-estate_v0.1.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "railiance-architecture",
|
||||
"source_commit": "078515b5adc7ac742ffad1b20577fcf88400acbb",
|
||||
"source_path": "docs/architecture/railiance_v0.1.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "net-kingdom-architecture",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "docs/architecture/net-kingdom_v0.1.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "state-hub-architecture",
|
||||
"source_commit": "cccc27ce44928e579627aa86ccee38ae4fb1ca10",
|
||||
"source_path": "docs/architecture/state-hub_v0.1.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "policy-nexus-architecture",
|
||||
"source_commit": "b64a0c52ec1ea8d1efa99dd7f870e580d7c60df8",
|
||||
"source_path": "docs/architecture/policy-nexus_v0.1.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "policy-nexus-adr-0001",
|
||||
"source_commit": "b64a0c52ec1ea8d1efa99dd7f870e580d7c60df8",
|
||||
"source_path": "docs/adr/ADR-0001-addressing-and-permanence.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RMASTER-ADR-0001",
|
||||
"source_commit": "078515b5adc7ac742ffad1b20577fcf88400acbb",
|
||||
"source_path": "docs/adr/ADR-0001-repository-prefix-architecture.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RMASTER-ADR-0002",
|
||||
"source_commit": "078515b5adc7ac742ffad1b20577fcf88400acbb",
|
||||
"source_path": "docs/adr/ADR-0002-rail-kubernetes-wave-1-boundary.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RMASTER-ADR-0003",
|
||||
"source_commit": "078515b5adc7ac742ffad1b20577fcf88400acbb",
|
||||
"source_path": "docs/adr/ADR-0003-rapp-first-wave-selection.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RMASTER-ADR-0004",
|
||||
"source_commit": "078515b5adc7ac742ffad1b20577fcf88400acbb",
|
||||
"source_path": "docs/adr/ADR-0004-first-wave-reef-rollout.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RMASTER-ADR-0005",
|
||||
"source_commit": "078515b5adc7ac742ffad1b20577fcf88400acbb",
|
||||
"source_path": "docs/adr/ADR-0005-derived-rail-composition.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RMASTER-ADR-0006",
|
||||
"source_commit": "078515b5adc7ac742ffad1b20577fcf88400acbb",
|
||||
"source_path": "docs/adr/ADR-0006-reef-production-admission.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RMASTER-ADR-0007",
|
||||
"source_commit": "078515b5adc7ac742ffad1b20577fcf88400acbb",
|
||||
"source_path": "docs/adr/ADR-0007-rapp-declaration-contract.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RMASTER-ADR-0008",
|
||||
"source_commit": "078515b5adc7ac742ffad1b20577fcf88400acbb",
|
||||
"source_path": "docs/adr/ADR-0008-private-by-default-exposure.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ACT-ADR-001",
|
||||
"source_commit": "fd84f2b6518ff17509930499099ec2a6692d088c",
|
||||
"source_path": "docs/adr/adr-001-event-bridge-architecture.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ACT-ADR-002",
|
||||
"source_commit": "fd84f2b6518ff17509930499099ec2a6692d088c",
|
||||
"source_path": "docs/adr/adr-002-definition-format.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ACT-ADR-003",
|
||||
"source_commit": "fd84f2b6518ff17509930499099ec2a6692d088c",
|
||||
"source_path": "docs/adr/adr-003-rule-instruction-model.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ACT-ADR-004",
|
||||
"source_commit": "fd84f2b6518ff17509930499099ec2a6692d088c",
|
||||
"source_path": "docs/adr/adr-004-producer-trust-boundary.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ACT-ADR-005",
|
||||
"source_commit": "fd84f2b6518ff17509930499099ec2a6692d088c",
|
||||
"source_path": "docs/adr/adr-005-ops-runs-vs-dev-work-records.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ops-warden-adr-0001",
|
||||
"source_commit": "eaabb4216186f4fee2d830376a381740b140087c",
|
||||
"source_path": "docs/adr/ADR-0001-catalog-is-a-pointer-layer.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ops-warden-adr-0002",
|
||||
"source_commit": "eaabb4216186f4fee2d830376a381740b140087c",
|
||||
"source_path": "docs/adr/ADR-0002-conduit-not-broker.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ops-warden-adr-0003",
|
||||
"source_commit": "eaabb4216186f4fee2d830376a381740b140087c",
|
||||
"source_path": "docs/adr/ADR-0003-cover-gaps-never-silently-own-them.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ops-warden-adr-0004",
|
||||
"source_commit": "eaabb4216186f4fee2d830376a381740b140087c",
|
||||
"source_path": "docs/adr/ADR-0004-agent-read-boundary-on-high-risk-lanes.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ops-warden-adr-0005",
|
||||
"source_commit": "eaabb4216186f4fee2d830376a381740b140087c",
|
||||
"source_path": "docs/adr/ADR-0005-implement-narrowly-route-broadly.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "CUST-ADR-001",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/architecture/adr-001-workplans-as-repo-artefacts.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "CUST-ADR-002",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/architecture/adr-002-custodian-agent-runtime-design.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "CUST-ADR-003",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/architecture/adr-003-materialized-derived-state.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "CUST-ADR-004",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/architecture/adr-004-connectivity-first-network-posture.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "CUST-ADR-005",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/architecture/adr-005-cross-repo-workplans-project-repos.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "CUST-ADR-006",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/architecture/adr-006-canon-federation-concept-ownership.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "CUST-ADR-007",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/architecture/adr-007-workplan-identity-and-repo-worker-topology.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "CUST-ADR-010",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/architecture/adr-010-hub-authority-and-local-cache-model.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "CUST-ADR-011",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/architecture/adr-011-federated-namespaces-and-reconciliation-limits.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RPLAT-ADR-0001",
|
||||
"source_commit": "8c152d012a44664f51969f2cb3456e28a3a0e5ff",
|
||||
"source_path": "docs/adr/ADR-0001-s3-platform-service-boundary.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RPLAT-ADR-0002",
|
||||
"source_commit": "8c152d012a44664f51969f2cb3456e28a3a0e5ff",
|
||||
"source_path": "docs/adr/ADR-0002-placement-policy-ownership.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RPLAT-ADR-0003",
|
||||
"source_commit": "8c152d012a44664f51969f2cb3456e28a3a0e5ff",
|
||||
"source_path": "docs/adr/ADR-0003-decisions-live-in-the-repo.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "netkingdom-iam-profile-v0.3",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "canon/standards/iam-profile_v0.3.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "NK-ADR-0006",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "docs/adr/ADR-0006-recursive-multi-tenant-identity-authorization.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "NK-ADR-0007",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "docs/adr/ADR-0007-security-orchestration-boundary.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "NK-ADR-0008",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "docs/adr/ADR-0008-object-storage-sts-credential-vending.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "NK-ADR-0010",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "docs/adr/ADR-0010-orchestration-vs-dependency-self-coherent-intent.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "NK-ADR-0011",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "docs/adr/ADR-0011-iam-profile-ownership-and-version-governance.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "NK-ADR-0012",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "docs/adr/ADR-0012-playbook-capability-contract-ownership.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "NK-ADR-0013",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "docs/adr/ADR-0013-tenant-onboarding-grouping-taxonomy.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "NK-ADR-0014",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "docs/adr/ADR-0014-tenant-capability-roles-and-tenant-engine-ownership.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "NK-ADR-0015",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "docs/adr/ADR-0015-netkingdom-railiance-workload-packaging-and-relational-platform.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RINFRA-ADR-0005",
|
||||
"source_commit": "ef64e324b61e9aa9b9ed03aad7dd2101915057ca",
|
||||
"source_path": "docs/adr/ADR-005-k3s-api-tunnel-only.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ACT-ADR-006",
|
||||
"source_commit": "fd84f2b6518ff17509930499099ec2a6692d088c",
|
||||
"source_path": "docs/adr/adr-006-glas-profile-execution.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ACT-ADR-007",
|
||||
"source_commit": "fd84f2b6518ff17509930499099ec2a6692d088c",
|
||||
"source_path": "docs/adr/adr-007-bounded-operations.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ops-warden-adr-0007",
|
||||
"source_commit": "eaabb4216186f4fee2d830376a381740b140087c",
|
||||
"source_path": "docs/adr/ADR-0007-build-stage-stops-at-credential-disclosure.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ops-warden-adr-0008",
|
||||
"source_commit": "eaabb4216186f4fee2d830376a381740b140087c",
|
||||
"source_path": "docs/adr/ADR-0008-grade-the-path-not-the-field.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ops-warden-adr-0009",
|
||||
"source_commit": "eaabb4216186f4fee2d830376a381740b140087c",
|
||||
"source_path": "docs/adr/ADR-0009-adopt-security-zones-as-a-consumer.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "ops-warden-adr-0010",
|
||||
"source_commit": "eaabb4216186f4fee2d830376a381740b140087c",
|
||||
"source_path": "docs/adr/ADR-0010-ops-warden-is-staff.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RMASTER-ADR-0009",
|
||||
"source_commit": "078515b5adc7ac742ffad1b20577fcf88400acbb",
|
||||
"source_path": "docs/adr/ADR-0009-netkingdom-security-layer-interaction.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "CUST-ADR-012",
|
||||
"source_commit": "dcdec162d61398f0def4990957455d45a74a1b01",
|
||||
"source_path": "canon/architecture/adr-012-projection-source-and-preliminary-overlay.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "netkingdom-posture-feedback-v0.1",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "canon/standards/posture-feedback_v0.1.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "netkingdom-security-layer-model-v0.7",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "canon/standards/security-layer-model_v0.7.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "netkingdom-security-layer-model-v0.8",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "canon/standards/security-layer-model_v0.8.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "netkingdom-security-scenario-composition-v0.1",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "canon/standards/security-scenario-composition_v0.1.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "netkingdom-security-zones-v0.1",
|
||||
"source_commit": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"source_path": "canon/standards/security-zones_v0.1.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RISK-F-0001",
|
||||
"source_commit": "b5b80aafca83469f6eabe5860c1265f39a147cbe",
|
||||
"source_path": "findings/RISK-F-0001-flex-auth-unauthenticated-check.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RISK-F-0008",
|
||||
"source_commit": "b5b80aafca83469f6eabe5860c1265f39a147cbe",
|
||||
"source_path": "findings/RISK-F-0008-audit-retention-legal-basis-assumed.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RISK-METHOD-SEVERITY",
|
||||
"source_commit": "b5b80aafca83469f6eabe5860c1265f39a147cbe",
|
||||
"source_path": "docs/method/severity.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RISK-METHOD-DISCLOSURE",
|
||||
"source_commit": "b5b80aafca83469f6eabe5860c1265f39a147cbe",
|
||||
"source_path": "docs/method/disclosure.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RISK-METHOD-REVIEW",
|
||||
"source_commit": "b5b80aafca83469f6eabe5860c1265f39a147cbe",
|
||||
"source_path": "docs/method/review.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RISK-METHOD-VERIFICATION",
|
||||
"source_commit": "b5b80aafca83469f6eabe5860c1265f39a147cbe",
|
||||
"source_path": "docs/method/verification.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
},
|
||||
{
|
||||
"id": "RISK-METHOD-DEPENDENCIES",
|
||||
"source_commit": "b5b80aafca83469f6eabe5860c1265f39a147cbe",
|
||||
"source_path": "docs/method/dependencies.md",
|
||||
"git_object_available": true,
|
||||
"exact_source_hash_matches": true
|
||||
}
|
||||
]
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,101 @@
|
|||
{
|
||||
"image_digest": "sha256:4e0db6a57eb00f577159aa6ee10f910dd67b03fd0541c6ce849f5426fdb99d06",
|
||||
"policy_revision": "b64a0c52ec1ea8d1efa99dd7f870e580d7c60df8",
|
||||
"publication_manifest_digest": "ba53cc4900e6bb9ab8aa4bac4e58cb5fe7a03d656bafb3f9cb3d9c8ebff7843a",
|
||||
"source_inventory_digest": "40d9e8852fe4c9e75b71f371d0fdae38664b068e7498711b0ac5671d0f41efb5",
|
||||
"source_set_digest": "15bda2e332285afc862df8974cf29de403737df5073fa362adfc6d203cf2f256",
|
||||
"documents": 73,
|
||||
"installed_site_files": 183,
|
||||
"source_revisions": {
|
||||
"access-engine": "f5fad7c2851708be41c82891430deffe5f4af0ac",
|
||||
"activity-core": "fd84f2b6518ff17509930499099ec2a6692d088c",
|
||||
"artifact-store": "94541a29e2758ea5da86a41f4d2016c6ef98d026",
|
||||
"binect-js": "d128f03a700bd9a5f6e6a6e3b3f68fa07d597243",
|
||||
"coulomb-loop": "d07455fbacd3e125e1ba6d991041c811b5c353d2",
|
||||
"coulomb-social": "1af71a4f61f80b4c58d30cad2cc0ccd5cc02979f",
|
||||
"evidence-binder": "4f115e38b84960038df92b5755cc33387fdec574",
|
||||
"glas-harness": "5ce4f38aedfd27cc783131f18480df02e2951514",
|
||||
"kaizen-agentic": "894d34c466eb7f949e136fbeca4fcf201cdb1086",
|
||||
"key-cape": "f97f006edef72a8a4dec2fc47c1097ab9642774a",
|
||||
"markitect-main": "9fbfe76ebb43ff84358d2f2a36ca6b958431e22d",
|
||||
"net-kingdom": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537",
|
||||
"ops-warden": "eaabb4216186f4fee2d830376a381740b140087c",
|
||||
"policy-nexus": "b64a0c52ec1ea8d1efa99dd7f870e580d7c60df8",
|
||||
"railiance-hosts": "53344177f3de1d0a417504e798b80c1d89798867",
|
||||
"railiance-infra": "ef64e324b61e9aa9b9ed03aad7dd2101915057ca",
|
||||
"railiance-master": "078515b5adc7ac742ffad1b20577fcf88400acbb",
|
||||
"railiance-platform": "8c152d012a44664f51969f2cb3456e28a3a0e5ff",
|
||||
"rapp-postgres": "03744030c9258e920f6403a9ce184a26d7b75268",
|
||||
"rein-aharness": "c2471657605a61e8c62469b619bbc822baea945c",
|
||||
"risk-nexus": "b5b80aafca83469f6eabe5860c1265f39a147cbe",
|
||||
"state-hub": "cccc27ce44928e579627aa86ccee38ae4fb1ca10",
|
||||
"target-revenue": "a3a8a27a8cda32ae3c7b55353ee16a131c50a0a0",
|
||||
"the-custodian": "dcdec162d61398f0def4990957455d45a74a1b01"
|
||||
},
|
||||
"source_lock_digest": "99c695f46a54ead4cfe8f560f3648bf4db19404fe198b156c740115c97d3ed40",
|
||||
"source_lock_observed": true,
|
||||
"image_executed": true,
|
||||
"registry_credentials_persisted": false,
|
||||
"record_type": "verified-published-release-candidate",
|
||||
"workplan": "PNEX-WP-0005",
|
||||
"ci": {
|
||||
"id": 11467,
|
||||
"run_number": 78,
|
||||
"head_sha": "b64a0c52ec1ea8d1efa99dd7f870e580d7c60df8",
|
||||
"status": "success",
|
||||
"url": "https://forgejo.coulomb.social/coulomb/policy-nexus/actions/runs/78",
|
||||
"created_at": "2026-10-11T00:48:37Z",
|
||||
"updated_at": "2026-10-11T00:50:05Z",
|
||||
"owner_tests": {
|
||||
"passed": 52,
|
||||
"environment": "POLICY_NEXUS_SOURCE_ROOT=/workspace/_sources",
|
||||
"independent_local": true
|
||||
},
|
||||
"prior_trials": [
|
||||
{
|
||||
"task_id": 11461,
|
||||
"run": 76,
|
||||
"source": "6d2c7eef779c823731e6f793b3adcf44afddd183",
|
||||
"outcome": "failure, inherited fixture source-root"
|
||||
},
|
||||
{
|
||||
"task_id": 11466,
|
||||
"run": 77,
|
||||
"source": "65862b1e0c6eaa4c96e1e48131db2ac7e914eb36",
|
||||
"image": "sha256:b955359f68ccd98ca6e906ef57b74c9bd6e732083b9e2b6857a358cd5196f9a1",
|
||||
"outcome": "source/history passed; runtime159 fixable findings incl2critical39high"
|
||||
}
|
||||
]
|
||||
},
|
||||
"independent_source_hashes": 73,
|
||||
"immutable_http_hashes": 72,
|
||||
"current_http_hashes": 73,
|
||||
"native_runtime_user": "uid=101(nginx) gid=101(nginx) groups=101(nginx)",
|
||||
"read_only_root": true,
|
||||
"nginx_config_check": "passed",
|
||||
"scanner_image": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
|
||||
"scanned_packages": 70,
|
||||
"scan_counts": {
|
||||
"CRITICAL": 0,
|
||||
"HIGH": 0,
|
||||
"MEDIUM": 0,
|
||||
"LOW": 0,
|
||||
"UNKNOWN": 0
|
||||
},
|
||||
"findings_suppressed": false,
|
||||
"db_metadata": {
|
||||
"Version": 2,
|
||||
"NextUpdate": "2026-10-11T18:59:50.889010572Z",
|
||||
"UpdatedAt": "2026-10-10T18:59:50.889010923Z",
|
||||
"DownloadedAt": "2026-10-10T23:32:32.380033131Z"
|
||||
},
|
||||
"eol_warning": "Alpine3.24 absent from bundled EOL list; vulnerability detector scanned70packages, raw official base found2 vulnerabilities before explicit fixes",
|
||||
"original_source_lock_observed": true,
|
||||
"source_lock_exact_serializer_matches": true,
|
||||
"source_lock_config_matches_exact_source": true,
|
||||
"hosting_changed": false,
|
||||
"new_native_approval_inferred": false,
|
||||
"local_candidate_container_executed": true,
|
||||
"native_hosting_changed": false,
|
||||
"registry_layer_readback_executed_image": false
|
||||
}
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,125 @@
|
|||
{
|
||||
"repositories": {
|
||||
"access-engine": {
|
||||
"branch": "main",
|
||||
"remote": "https://forgejo.coulomb.social/coulomb/access-engine.git",
|
||||
"revision": "f5fad7c2851708be41c82891430deffe5f4af0ac"
|
||||
},
|
||||
"activity-core": {
|
||||
"branch": "main",
|
||||
"remote": "https://forgejo.coulomb.social/coulomb/activity-core.git",
|
||||
"revision": "fd84f2b6518ff17509930499099ec2a6692d088c"
|
||||
},
|
||||
"artifact-store": {
|
||||
"branch": "main",
|
||||
"remote": "https://forgejo.coulomb.social/coulomb/artifact-store.git",
|
||||
"revision": "94541a29e2758ea5da86a41f4d2016c6ef98d026"
|
||||
},
|
||||
"binect-js": {
|
||||
"branch": "main",
|
||||
"remote": "https://forgejo.coulomb.social/coulomb/binect-js.git",
|
||||
"revision": "d128f03a700bd9a5f6e6a6e3b3f68fa07d597243"
|
||||
},
|
||||
"coulomb-loop": {
|
||||
"branch": "main",
|
||||
"remote": "https://forgejo.coulomb.social/coulomb/coulomb-loop.git",
|
||||
"revision": "d07455fbacd3e125e1ba6d991041c811b5c353d2"
|
||||
},
|
||||
"coulomb-social": {
|
||||
"branch": "main",
|
||||
"remote": "https://forgejo.coulomb.social/coulomb/coulomb-social.git",
|
||||
"revision": "1af71a4f61f80b4c58d30cad2cc0ccd5cc02979f"
|
||||
},
|
||||
"evidence-binder": {
|
||||
"branch": "main",
|
||||
"remote": "https://forgejo.coulomb.social/coulomb/evidence-binder.git",
|
||||
"revision": "4f115e38b84960038df92b5755cc33387fdec574"
|
||||
},
|
||||
"glas-harness": {
|
||||
"branch": "main",
|
||||
"remote": "https://forgejo.coulomb.social/coulomb/glas-harness.git",
|
||||
"revision": "5ce4f38aedfd27cc783131f18480df02e2951514"
|
||||
},
|
||||
"kaizen-agentic": {
|
||||
"branch": "main",
|
||||
"remote": "https://forgejo.coulomb.social/coulomb/kaizen-agentic.git",
|
||||
"revision": "894d34c466eb7f949e136fbeca4fcf201cdb1086"
|
||||
},
|
||||
"key-cape": {
|
||||
"branch": "main",
|
||||
"remote": "https://forgejo.coulomb.social/coulomb/key-cape.git",
|
||||
"revision": "f97f006edef72a8a4dec2fc47c1097ab9642774a"
|
||||
},
|
||||
"markitect-main": {
|
||||
"branch": "main",
|
||||
"remote": "https://forgejo.coulomb.social/coulomb/markitect-main.git",
|
||||
"revision": "9fbfe76ebb43ff84358d2f2a36ca6b958431e22d"
|
||||
},
|
||||
"net-kingdom": {
|
||||
"branch": "main",
|
||||
"remote": "https://forgejo.coulomb.social/coulomb/net-kingdom.git",
|
||||
"revision": "81fa1769e049a28e6c2db3d0be1eaacd0cc37537"
|
||||
},
|
||||
"ops-warden": {
|
||||
"branch": "main",
|
||||
"remote": "https://forgejo.coulomb.social/coulomb/ops-warden.git",
|
||||
"revision": "eaabb4216186f4fee2d830376a381740b140087c"
|
||||
},
|
||||
"policy-nexus": {
|
||||
"revision": "b64a0c52ec1ea8d1efa99dd7f870e580d7c60df8",
|
||||
"source": "workflow-checkout"
|
||||
},
|
||||
"railiance-hosts": {
|
||||
"branch": "main",
|
||||
"remote": "https://forgejo.coulomb.social/coulomb/railiance-hosts.git",
|
||||
"revision": "53344177f3de1d0a417504e798b80c1d89798867"
|
||||
},
|
||||
"railiance-infra": {
|
||||
"branch": "main",
|
||||
"remote": "https://forgejo.coulomb.social/coulomb/railiance-infra.git",
|
||||
"revision": "ef64e324b61e9aa9b9ed03aad7dd2101915057ca"
|
||||
},
|
||||
"railiance-master": {
|
||||
"branch": "main",
|
||||
"remote": "https://forgejo.coulomb.social/coulomb/railiance-master.git",
|
||||
"revision": "078515b5adc7ac742ffad1b20577fcf88400acbb"
|
||||
},
|
||||
"railiance-platform": {
|
||||
"branch": "main",
|
||||
"remote": "https://forgejo.coulomb.social/coulomb/railiance-platform.git",
|
||||
"revision": "8c152d012a44664f51969f2cb3456e28a3a0e5ff"
|
||||
},
|
||||
"rapp-postgres": {
|
||||
"branch": "main",
|
||||
"remote": "https://forgejo.coulomb.social/coulomb/rapp-postgres.git",
|
||||
"revision": "03744030c9258e920f6403a9ce184a26d7b75268"
|
||||
},
|
||||
"rein-aharness": {
|
||||
"branch": "main",
|
||||
"remote": "https://forgejo.coulomb.social/coulomb/rein-aharness.git",
|
||||
"revision": "c2471657605a61e8c62469b619bbc822baea945c"
|
||||
},
|
||||
"risk-nexus": {
|
||||
"branch": "main",
|
||||
"remote": "https://forgejo.coulomb.social/coulomb/risk-nexus.git",
|
||||
"revision": "b5b80aafca83469f6eabe5860c1265f39a147cbe"
|
||||
},
|
||||
"state-hub": {
|
||||
"branch": "main",
|
||||
"remote": "https://forgejo.coulomb.social/coulomb/state-hub.git",
|
||||
"revision": "cccc27ce44928e579627aa86ccee38ae4fb1ca10"
|
||||
},
|
||||
"target-revenue": {
|
||||
"branch": "main",
|
||||
"remote": "https://forgejo.coulomb.social/coulomb/target-revenue.git",
|
||||
"revision": "a3a8a27a8cda32ae3c7b55353ee16a131c50a0a0"
|
||||
},
|
||||
"the-custodian": {
|
||||
"branch": "main",
|
||||
"remote": "https://forgejo.coulomb.social/coulomb/the-custodian.git",
|
||||
"revision": "dcdec162d61398f0def4990957455d45a74a1b01"
|
||||
}
|
||||
},
|
||||
"schema_version": 1,
|
||||
"source_set_digest": "15bda2e332285afc862df8974cf29de403737df5073fa362adfc6d203cf2f256"
|
||||
}
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
{
|
||||
"tiff": {
|
||||
"version": "4.7.2-r0",
|
||||
"repository": "main",
|
||||
"index_url": "https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/APKINDEX.tar.gz"
|
||||
},
|
||||
"zlib": {
|
||||
"version": "1.3.2-r1",
|
||||
"repository": "main",
|
||||
"index_url": "https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/APKINDEX.tar.gz"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
{
|
||||
"repository": "nginxinc/nginx-unprivileged",
|
||||
"tag": "stable-alpine",
|
||||
"index_digest": "sha256:15c994d10d6d78658721c3bcafff14cb281fba2a4bdf9d5ba92c416a472516e3",
|
||||
"linux_amd64_digest": "sha256:4483b2e4c12fe77211e051cd0546ee79770d5174535c961b04ac918ebb75b469"
|
||||
}
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,24 @@
|
|||
{
|
||||
"base_digest": "sha256:15c994d10d6d78658721c3bcafff14cb281fba2a4bdf9d5ba92c416a472516e3",
|
||||
"nginx_version": "1.30.5",
|
||||
"old_nginx_version": "1.27.5",
|
||||
"uid_gid": "101:101",
|
||||
"port": 8080,
|
||||
"read_only_root": true,
|
||||
"capabilities_dropped": "ALL",
|
||||
"no_new_privileges": true,
|
||||
"writable_tmp_only": true,
|
||||
"existing_nginx_config_unchanged": true,
|
||||
"current_canonical_http_hashes": 73,
|
||||
"historical_immutable_http_hashes": 72,
|
||||
"security_headers": [
|
||||
"Content-Security-Policy",
|
||||
"Permissions-Policy",
|
||||
"Referrer-Policy",
|
||||
"X-Content-Type-Options",
|
||||
"X-Frame-Options"
|
||||
],
|
||||
"health_404_etag_legacy_redirect": "passed",
|
||||
"site_source_candidate": "sha256:b955359f68ccd98ca6e906ef57b74c9bd6e732083b9e2b6857a358cd5196f9a1",
|
||||
"new_ci_candidate": "pending exact staged source application"
|
||||
}
|
||||
|
|
@ -0,0 +1,107 @@
|
|||
{
|
||||
"local_installed_canonical_http_hashes": 73,
|
||||
"local_installed_historical_http_hashes": 72,
|
||||
"release": {
|
||||
"schema_version": "policy-nexus-release/v1",
|
||||
"publication_manifest_digest": "7e2a0d89c909ac3243ee7a57198834949d69e53e60804107e5780fd74ee1ae3f",
|
||||
"source_inventory_digest": "e61b848f497d530ce4cfba153a0fff058e1924eff4d457caeb152863b688b405",
|
||||
"source_set_digest": "6e8458caf1da600a7a0b71a44dd1ccba713fd1a25e22b0a6f6af67c2c5a97792",
|
||||
"generated_as_of": "2026-10-11",
|
||||
"documents": [
|
||||
"netkingdom-tenancy-posture",
|
||||
"canon-autonomy-lanes",
|
||||
"canon-contrib-convention",
|
||||
"canon-project-repository-flavor",
|
||||
"canon-work-record-types",
|
||||
"canon-workplan-terminology-fleet",
|
||||
"coulomb-estate-architecture",
|
||||
"railiance-architecture",
|
||||
"net-kingdom-architecture",
|
||||
"state-hub-architecture",
|
||||
"policy-nexus-architecture",
|
||||
"policy-nexus-adr-0001",
|
||||
"RMASTER-ADR-0001",
|
||||
"RMASTER-ADR-0002",
|
||||
"RMASTER-ADR-0003",
|
||||
"RMASTER-ADR-0004",
|
||||
"RMASTER-ADR-0005",
|
||||
"RMASTER-ADR-0006",
|
||||
"RMASTER-ADR-0007",
|
||||
"RMASTER-ADR-0008",
|
||||
"ACT-ADR-001",
|
||||
"ACT-ADR-002",
|
||||
"ACT-ADR-003",
|
||||
"ACT-ADR-004",
|
||||
"ACT-ADR-005",
|
||||
"ops-warden-adr-0001",
|
||||
"ops-warden-adr-0002",
|
||||
"ops-warden-adr-0003",
|
||||
"ops-warden-adr-0004",
|
||||
"ops-warden-adr-0005",
|
||||
"CUST-ADR-001",
|
||||
"CUST-ADR-002",
|
||||
"CUST-ADR-003",
|
||||
"CUST-ADR-004",
|
||||
"CUST-ADR-005",
|
||||
"CUST-ADR-006",
|
||||
"CUST-ADR-007",
|
||||
"CUST-ADR-010",
|
||||
"CUST-ADR-011",
|
||||
"RPLAT-ADR-0001",
|
||||
"RPLAT-ADR-0002",
|
||||
"RPLAT-ADR-0003",
|
||||
"netkingdom-iam-profile-v0.3",
|
||||
"NK-ADR-0006",
|
||||
"NK-ADR-0007",
|
||||
"NK-ADR-0008",
|
||||
"NK-ADR-0010",
|
||||
"NK-ADR-0011",
|
||||
"NK-ADR-0012",
|
||||
"NK-ADR-0013",
|
||||
"NK-ADR-0014",
|
||||
"NK-ADR-0015",
|
||||
"RINFRA-ADR-0005",
|
||||
"ACT-ADR-006",
|
||||
"ACT-ADR-007",
|
||||
"ops-warden-adr-0007",
|
||||
"ops-warden-adr-0008",
|
||||
"ops-warden-adr-0009",
|
||||
"ops-warden-adr-0010",
|
||||
"RMASTER-ADR-0009",
|
||||
"CUST-ADR-012",
|
||||
"netkingdom-posture-feedback-v0.1",
|
||||
"netkingdom-security-layer-model-v0.7",
|
||||
"netkingdom-security-layer-model-v0.8",
|
||||
"netkingdom-security-scenario-composition-v0.1",
|
||||
"netkingdom-security-zones-v0.1",
|
||||
"RISK-F-0001",
|
||||
"RISK-F-0008",
|
||||
"RISK-METHOD-SEVERITY",
|
||||
"RISK-METHOD-DISCLOSURE",
|
||||
"RISK-METHOD-REVIEW",
|
||||
"RISK-METHOD-VERIFICATION",
|
||||
"RISK-METHOD-DEPENDENCIES"
|
||||
]
|
||||
},
|
||||
"transition": {
|
||||
"previous_documents": 72,
|
||||
"candidate_documents": 73,
|
||||
"reviewed_semantic_changes": [
|
||||
"CUST-ADR-002",
|
||||
"CUST-ADR-004",
|
||||
"RISK-F-0008",
|
||||
"RMASTER-ADR-0006",
|
||||
"canon-work-record-types",
|
||||
"canon-workplan-terminology-fleet",
|
||||
"net-kingdom-architecture",
|
||||
"netkingdom-security-layer-model-v0.7",
|
||||
"netkingdom-security-layer-model-v0.8",
|
||||
"netkingdom-tenancy-posture",
|
||||
"ops-warden-adr-0004"
|
||||
],
|
||||
"history_preserved": 72
|
||||
},
|
||||
"security_headers_health_404_etag_legacy_redirect": "passed",
|
||||
"new_ci_artifact": "not yet built; root applies exact staged source",
|
||||
"hosting_changed": false
|
||||
}
|
||||
File diff suppressed because it is too large
Load diff
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,9 @@
|
|||
[
|
||||
{
|
||||
"repo": "policy-nexus",
|
||||
"path": "Containerfile",
|
||||
"original_sha256": "7a1315632c6fbef0d68c7b2ebe60f6e5ab37bb680db69ee981b8fb8d4fbde593",
|
||||
"staged_path": "/tmp/policy-runtime-refresh-stage/policy-nexus/Containerfile",
|
||||
"staged_sha256": "21346cf88f53599e4d0bd36e260ad698065d0d83d658c96e1d82bbb6d04dbd3c"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
nginx version: nginx/1.30.5
|
||||
built by gcc 15.2.0 (Alpine 15.2.0)
|
||||
built with OpenSSL 3.5.7 9 Jun 2026 (running with OpenSSL 3.5.9 29 Sep 2026)
|
||||
TLS SNI support enabled
|
||||
configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/run/nginx.pid --lock-path=/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --with-perl_modules_path=/usr/lib/perl5/vendor_perl --user=nginx --group=nginx --with-compat --with-file-aio --with-threads --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-http_v3_module --with-mail --with-mail_ssl_module --with-stream --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-cc-opt='-Os -fstack-clash-protection -Wformat -Werror=format-security -fno-plt -g' --with-ld-opt='-Wl,--as-needed,-O1,--sort-common -Wl,-z,pack-relative-relocs'
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
{
|
||||
"removed_flags": [],
|
||||
"added_flags": []
|
||||
}
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
nginx version: nginx/1.27.5
|
||||
built by gcc 14.2.0 (Alpine 14.2.0)
|
||||
built with OpenSSL 3.3.3 11 Feb 2025
|
||||
TLS SNI support enabled
|
||||
configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/run/nginx.pid --lock-path=/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --with-perl_modules_path=/usr/lib/perl5/vendor_perl --user=nginx --group=nginx --with-compat --with-file-aio --with-threads --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-http_v3_module --with-mail --with-mail_ssl_module --with-stream --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-cc-opt='-Os -fstack-clash-protection -Wformat -Werror=format-security -fno-plt -g' --with-ld-opt='-Wl,--as-needed,-O1,--sort-common -Wl,-z,pack-relative-relocs'
|
||||
|
|
@ -0,0 +1,194 @@
|
|||
{
|
||||
"schemaVersion": 2,
|
||||
"mediaType": "application/vnd.oci.image.index.v1+json",
|
||||
"manifests": [
|
||||
{
|
||||
"mediaType": "application/vnd.oci.image.manifest.v1+json",
|
||||
"digest": "sha256:4483b2e4c12fe77211e051cd0546ee79770d5174535c961b04ac918ebb75b469",
|
||||
"size": 2614,
|
||||
"platform": {
|
||||
"architecture": "amd64",
|
||||
"os": "linux"
|
||||
}
|
||||
},
|
||||
{
|
||||
"mediaType": "application/vnd.oci.image.manifest.v1+json",
|
||||
"digest": "sha256:f4b79de8037939f63df50d079c09669949251dd6db8b860c0735fb60af951b34",
|
||||
"size": 2614,
|
||||
"platform": {
|
||||
"architecture": "arm",
|
||||
"os": "linux",
|
||||
"variant": "v6"
|
||||
}
|
||||
},
|
||||
{
|
||||
"mediaType": "application/vnd.oci.image.manifest.v1+json",
|
||||
"digest": "sha256:55be6504d185e6fbcf23d187cc290081fda34ba274df0d5268bf7282bd753308",
|
||||
"size": 2614,
|
||||
"platform": {
|
||||
"architecture": "arm",
|
||||
"os": "linux",
|
||||
"variant": "v7"
|
||||
}
|
||||
},
|
||||
{
|
||||
"mediaType": "application/vnd.oci.image.manifest.v1+json",
|
||||
"digest": "sha256:4538a98ff4262f70babae95a74ecc5cff3de466445f4ef022cc42be5a29b10c2",
|
||||
"size": 2614,
|
||||
"platform": {
|
||||
"architecture": "arm64",
|
||||
"os": "linux"
|
||||
}
|
||||
},
|
||||
{
|
||||
"mediaType": "application/vnd.oci.image.manifest.v1+json",
|
||||
"digest": "sha256:ec80fccb8a02a30d7611791fac6e4522256c64ccb12d71958801f91037b8f8fb",
|
||||
"size": 2614,
|
||||
"platform": {
|
||||
"architecture": "386",
|
||||
"os": "linux"
|
||||
}
|
||||
},
|
||||
{
|
||||
"mediaType": "application/vnd.oci.image.manifest.v1+json",
|
||||
"digest": "sha256:58c784c79e00dc81e176203b853df89a6fe18875b95820ae639048b416684e81",
|
||||
"size": 2614,
|
||||
"platform": {
|
||||
"architecture": "ppc64le",
|
||||
"os": "linux"
|
||||
}
|
||||
},
|
||||
{
|
||||
"mediaType": "application/vnd.oci.image.manifest.v1+json",
|
||||
"digest": "sha256:603e1a4d6bfd87d2a2b8c22e528e563cf9d127763211bec89029ea922b32ed0d",
|
||||
"size": 2614,
|
||||
"platform": {
|
||||
"architecture": "riscv64",
|
||||
"os": "linux"
|
||||
}
|
||||
},
|
||||
{
|
||||
"mediaType": "application/vnd.oci.image.manifest.v1+json",
|
||||
"digest": "sha256:3c0ccaaf4fd30ab4a5c0ba0e0d9e35fc18b4c90372262c7e32d1cd5ba60f94e5",
|
||||
"size": 2614,
|
||||
"platform": {
|
||||
"architecture": "s390x",
|
||||
"os": "linux"
|
||||
}
|
||||
},
|
||||
{
|
||||
"mediaType": "application/vnd.oci.image.manifest.v1+json",
|
||||
"digest": "sha256:60921f00c1c35f07c2813d15b05891e6168818b17ca88831c1a2ccf043319035",
|
||||
"size": 838,
|
||||
"annotations": {
|
||||
"vnd.docker.reference.digest": "sha256:4483b2e4c12fe77211e051cd0546ee79770d5174535c961b04ac918ebb75b469",
|
||||
"vnd.docker.reference.type": "attestation-manifest"
|
||||
},
|
||||
"platform": {
|
||||
"architecture": "unknown",
|
||||
"os": "unknown"
|
||||
}
|
||||
},
|
||||
{
|
||||
"mediaType": "application/vnd.oci.image.manifest.v1+json",
|
||||
"digest": "sha256:f4f184cc0fe11432837c039b18cca3d462098f87ad6075b8f584dd3df6c761e8",
|
||||
"size": 838,
|
||||
"annotations": {
|
||||
"vnd.docker.reference.digest": "sha256:f4b79de8037939f63df50d079c09669949251dd6db8b860c0735fb60af951b34",
|
||||
"vnd.docker.reference.type": "attestation-manifest"
|
||||
},
|
||||
"platform": {
|
||||
"architecture": "unknown",
|
||||
"os": "unknown"
|
||||
}
|
||||
},
|
||||
{
|
||||
"mediaType": "application/vnd.oci.image.manifest.v1+json",
|
||||
"digest": "sha256:9f6f8a15347e0059d6227afb9aafa203f55c42c7d57131dea2274d6ba25f31b6",
|
||||
"size": 838,
|
||||
"annotations": {
|
||||
"vnd.docker.reference.digest": "sha256:55be6504d185e6fbcf23d187cc290081fda34ba274df0d5268bf7282bd753308",
|
||||
"vnd.docker.reference.type": "attestation-manifest"
|
||||
},
|
||||
"platform": {
|
||||
"architecture": "unknown",
|
||||
"os": "unknown"
|
||||
}
|
||||
},
|
||||
{
|
||||
"mediaType": "application/vnd.oci.image.manifest.v1+json",
|
||||
"digest": "sha256:240d1c3f9bc35c6b90f12cd0d68196f114b857005cd7650791cb1dd6a698b652",
|
||||
"size": 838,
|
||||
"annotations": {
|
||||
"vnd.docker.reference.digest": "sha256:4538a98ff4262f70babae95a74ecc5cff3de466445f4ef022cc42be5a29b10c2",
|
||||
"vnd.docker.reference.type": "attestation-manifest"
|
||||
},
|
||||
"platform": {
|
||||
"architecture": "unknown",
|
||||
"os": "unknown"
|
||||
}
|
||||
},
|
||||
{
|
||||
"mediaType": "application/vnd.oci.image.manifest.v1+json",
|
||||
"digest": "sha256:cee66699053686fc465453c7d898eb449198fe8c8a16777f22246f20d46e6fbe",
|
||||
"size": 838,
|
||||
"annotations": {
|
||||
"vnd.docker.reference.digest": "sha256:ec80fccb8a02a30d7611791fac6e4522256c64ccb12d71958801f91037b8f8fb",
|
||||
"vnd.docker.reference.type": "attestation-manifest"
|
||||
},
|
||||
"platform": {
|
||||
"architecture": "unknown",
|
||||
"os": "unknown"
|
||||
}
|
||||
},
|
||||
{
|
||||
"mediaType": "application/vnd.oci.image.manifest.v1+json",
|
||||
"digest": "sha256:5be1f9e748b1f59e5eff9c3c6203555bcefa8e2ecb8c2b781e25119bf94f78b9",
|
||||
"size": 838,
|
||||
"annotations": {
|
||||
"vnd.docker.reference.digest": "sha256:58c784c79e00dc81e176203b853df89a6fe18875b95820ae639048b416684e81",
|
||||
"vnd.docker.reference.type": "attestation-manifest"
|
||||
},
|
||||
"platform": {
|
||||
"architecture": "unknown",
|
||||
"os": "unknown"
|
||||
}
|
||||
},
|
||||
{
|
||||
"mediaType": "application/vnd.oci.image.manifest.v1+json",
|
||||
"digest": "sha256:ec00c5d67e71f55a9a3e47fe4a92fb6601f6f6944ac69f2b812f91165ec630e3",
|
||||
"size": 838,
|
||||
"annotations": {
|
||||
"vnd.docker.reference.digest": "sha256:603e1a4d6bfd87d2a2b8c22e528e563cf9d127763211bec89029ea922b32ed0d",
|
||||
"vnd.docker.reference.type": "attestation-manifest"
|
||||
},
|
||||
"platform": {
|
||||
"architecture": "unknown",
|
||||
"os": "unknown"
|
||||
}
|
||||
},
|
||||
{
|
||||
"mediaType": "application/vnd.oci.image.manifest.v1+json",
|
||||
"digest": "sha256:fdd41f737f39a7dfb98ac32ed142523625ed153472886a4d9ae491d67148e096",
|
||||
"size": 838,
|
||||
"annotations": {
|
||||
"vnd.docker.reference.digest": "sha256:3c0ccaaf4fd30ab4a5c0ba0e0d9e35fc18b4c90372262c7e32d1cd5ba60f94e5",
|
||||
"vnd.docker.reference.type": "attestation-manifest"
|
||||
},
|
||||
"platform": {
|
||||
"architecture": "unknown",
|
||||
"os": "unknown"
|
||||
}
|
||||
}
|
||||
],
|
||||
"annotations": {
|
||||
"org.opencontainers.image.created": "2026-10-05T01:51:51.520Z",
|
||||
"org.opencontainers.image.description": "Unprivileged NGINX Dockerfiles",
|
||||
"org.opencontainers.image.licenses": "Apache-2.0",
|
||||
"org.opencontainers.image.revision": "588b4cbc88065a313909f47a02510639e01cc508",
|
||||
"org.opencontainers.image.source": "https://github.com/nginx/docker-nginx-unprivileged",
|
||||
"org.opencontainers.image.title": "docker-nginx-unprivileged",
|
||||
"org.opencontainers.image.url": "https://github.com/nginx/docker-nginx-unprivileged",
|
||||
"org.opencontainers.image.version": "1.30.5-alpine"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,87 @@
|
|||
#
|
||||
# NOTE: THIS DOCKERFILE IS GENERATED VIA "update.sh"
|
||||
#
|
||||
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||
#
|
||||
ARG IMAGE=nginxinc/nginx-unprivileged:1.30.5-alpine-slim
|
||||
FROM $IMAGE
|
||||
|
||||
ENV NJS_VERSION=1.0.1
|
||||
ENV NJS_RELEASE=1
|
||||
|
||||
ARG UID=101
|
||||
ARG GID=101
|
||||
|
||||
USER root
|
||||
|
||||
RUN set -x \
|
||||
&& apkArch="$(cat /etc/apk/arch)" \
|
||||
&& nginxPackages=" \
|
||||
nginx=${NGINX_VERSION}-r${PKG_RELEASE} \
|
||||
nginx-module-xslt=${NGINX_VERSION}-r${DYNPKG_RELEASE} \
|
||||
nginx-module-geoip=${NGINX_VERSION}-r${DYNPKG_RELEASE} \
|
||||
nginx-module-image-filter=${NGINX_VERSION}-r${DYNPKG_RELEASE} \
|
||||
nginx-module-njs=${NGINX_VERSION}.${NJS_VERSION}-r${NJS_RELEASE} \
|
||||
" \
|
||||
# install prerequisites for public key and pkg-oss checks
|
||||
&& apk add --no-cache --virtual .checksum-deps \
|
||||
openssl \
|
||||
&& case "$apkArch" in \
|
||||
x86_64|aarch64) \
|
||||
# arches officially built by upstream
|
||||
apk add -X "https://nginx.org/packages/alpine/v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" --no-cache $nginxPackages \
|
||||
;; \
|
||||
*) \
|
||||
# we're on an architecture upstream doesn't officially build for
|
||||
# let's build binaries from the published packaging sources
|
||||
set -x \
|
||||
&& tempDir="$(mktemp -d)" \
|
||||
&& chown nobody:nobody $tempDir \
|
||||
&& apk add --no-cache --virtual .build-deps \
|
||||
gcc \
|
||||
libc-dev \
|
||||
make \
|
||||
openssl-dev \
|
||||
pcre2-dev \
|
||||
zlib-dev \
|
||||
linux-headers \
|
||||
libxslt-dev \
|
||||
gd-dev \
|
||||
geoip-dev \
|
||||
libedit-dev \
|
||||
bash \
|
||||
alpine-sdk \
|
||||
findutils \
|
||||
curl \
|
||||
&& su nobody -s /bin/sh -c " \
|
||||
export HOME=${tempDir} \
|
||||
&& cd ${tempDir} \
|
||||
&& curl -f -L -O https://github.com/nginx/pkg-oss/archive/${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \
|
||||
&& PKGOSSCHECKSUM=\"feaa7c9e587e59a01e229c2396433a9f0bccd6ce381afae9311b7496d1c2b53f93b2b0b2adece8f76fa06b92ca6b6a706103ef2c0a26e00afe82dfcdf8135a23 *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \
|
||||
&& if [ \"\$(openssl sha512 -r ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \
|
||||
echo \"pkg-oss tarball checksum verification succeeded!\"; \
|
||||
else \
|
||||
echo \"pkg-oss tarball checksum verification failed!\"; \
|
||||
exit 1; \
|
||||
fi \
|
||||
&& tar xzvf ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \
|
||||
&& cd pkg-oss-${NGINX_VERSION}-${PKG_RELEASE} \
|
||||
&& cd alpine \
|
||||
&& make module-geoip module-image-filter module-njs module-xslt \
|
||||
&& apk index --allow-untrusted -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \
|
||||
&& abuild-sign -k ${tempDir}/.abuild/abuild-key.rsa ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz \
|
||||
" \
|
||||
&& cp ${tempDir}/.abuild/abuild-key.rsa.pub /etc/apk/keys/ \
|
||||
&& apk del --no-network .build-deps \
|
||||
&& apk add -X ${tempDir}/packages/alpine/ --no-cache $nginxPackages \
|
||||
;; \
|
||||
esac \
|
||||
# remove checksum deps
|
||||
&& apk del --no-network .checksum-deps \
|
||||
# if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
|
||||
&& if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \
|
||||
&& if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
|
||||
# Bring in curl and ca-certificates to make registering on DNS SD easier
|
||||
&& apk add --no-cache curl ca-certificates
|
||||
|
||||
USER $UID
|
||||
|
|
@ -0,0 +1,140 @@
|
|||
#
|
||||
# NOTE: THIS DOCKERFILE IS GENERATED VIA "update.sh"
|
||||
#
|
||||
# PLEASE DO NOT EDIT IT DIRECTLY.
|
||||
#
|
||||
ARG IMAGE=alpine:3.24
|
||||
FROM $IMAGE
|
||||
|
||||
LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>"
|
||||
|
||||
ENV NGINX_VERSION=1.30.5
|
||||
ENV PKG_RELEASE=1
|
||||
ENV DYNPKG_RELEASE=1
|
||||
|
||||
ARG UID=101
|
||||
ARG GID=101
|
||||
|
||||
RUN set -x \
|
||||
# create nginx user/group first, to be consistent throughout docker variants
|
||||
&& addgroup -g $GID -S nginx || true \
|
||||
&& adduser -S -D -H -u $UID -h /var/cache/nginx -s /sbin/nologin -G nginx -g nginx nginx || true \
|
||||
&& apkArch="$(cat /etc/apk/arch)" \
|
||||
&& nginxPackages=" \
|
||||
nginx=${NGINX_VERSION}-r${PKG_RELEASE} \
|
||||
" \
|
||||
# install prerequisites for public key and pkg-oss checks
|
||||
&& apk add --no-cache --virtual .checksum-deps \
|
||||
openssl \
|
||||
&& case "$apkArch" in \
|
||||
x86_64|aarch64) \
|
||||
# arches officially built by upstream
|
||||
set -x \
|
||||
&& KEY_SHA512="e09fa32f0a0eab2b879ccbbc4d0e4fb9751486eedda75e35fac65802cc9faa266425edf83e261137a2f4d16281ce2c1a5f4502930fe75154723da014214f0655" \
|
||||
&& wget -O /tmp/nginx_signing.rsa.pub https://nginx.org/keys/nginx_signing.rsa.pub \
|
||||
&& if echo "$KEY_SHA512 */tmp/nginx_signing.rsa.pub" | sha512sum -c -; then \
|
||||
echo "key verification succeeded!"; \
|
||||
mv /tmp/nginx_signing.rsa.pub /etc/apk/keys/; \
|
||||
else \
|
||||
echo "key verification failed!"; \
|
||||
exit 1; \
|
||||
fi \
|
||||
# we need to make sure nginx.org packages are pulled in, which isnt guaranteed
|
||||
# as Alpine repos might have the same version in the repos.
|
||||
# query nginx.org binaries for the dependencies
|
||||
&& DEPS=$(apk query --summarize depends --recursive --no-cache \
|
||||
--repository "@nginxorg https://nginx.org/packages/alpine/v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" \
|
||||
${nginxPackages/=/@nginxorg=}) \
|
||||
# install those dependencies from Alpine repos
|
||||
&& apk add --no-cache $DEPS \
|
||||
# limit apk to nginx.org repos only to install the requested packages
|
||||
&& apk add --repositories-file /dev/null -X "https://nginx.org/packages/alpine/v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" --no-cache $nginxPackages \
|
||||
;; \
|
||||
*) \
|
||||
# we're on an architecture upstream doesn't officially build for
|
||||
# let's build binaries from the published packaging sources
|
||||
set -x \
|
||||
&& tempDir="$(mktemp -d)" \
|
||||
&& chown nobody:nobody $tempDir \
|
||||
&& apk add --no-cache --virtual .build-deps \
|
||||
gcc \
|
||||
libc-dev \
|
||||
make \
|
||||
openssl-dev \
|
||||
pcre2-dev \
|
||||
zlib-dev \
|
||||
linux-headers \
|
||||
bash \
|
||||
alpine-sdk \
|
||||
findutils \
|
||||
curl \
|
||||
&& su nobody -s /bin/sh -c " \
|
||||
export HOME=${tempDir} \
|
||||
&& cd ${tempDir} \
|
||||
&& curl -f -L -O https://github.com/nginx/pkg-oss/archive/${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \
|
||||
&& PKGOSSCHECKSUM=\"feaa7c9e587e59a01e229c2396433a9f0bccd6ce381afae9311b7496d1c2b53f93b2b0b2adece8f76fa06b92ca6b6a706103ef2c0a26e00afe82dfcdf8135a23 *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \
|
||||
&& if [ \"\$(openssl sha512 -r ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \
|
||||
echo \"pkg-oss tarball checksum verification succeeded!\"; \
|
||||
else \
|
||||
echo \"pkg-oss tarball checksum verification failed!\"; \
|
||||
exit 1; \
|
||||
fi \
|
||||
&& tar xzvf ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \
|
||||
&& cd pkg-oss-${NGINX_VERSION}-${PKG_RELEASE} \
|
||||
&& cd alpine \
|
||||
&& make base \
|
||||
&& apk index --allow-untrusted -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \
|
||||
&& abuild-sign -k ${tempDir}/.abuild/abuild-key.rsa ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz \
|
||||
" \
|
||||
&& cp ${tempDir}/.abuild/abuild-key.rsa.pub /etc/apk/keys/ \
|
||||
&& apk del --no-network .build-deps \
|
||||
# same as in the "arches officially built by upstream" block, we want to make
|
||||
# sure the packages we've just built will get installed
|
||||
&& DEPS=$(apk query --summarize depends --recursive --no-cache \
|
||||
--repository "@nginxorg ${tempDir}/packages/alpine/" \
|
||||
${nginxPackages/=/@nginxorg=}) \
|
||||
&& apk add --no-cache $DEPS \
|
||||
&& apk add --repositories-file /dev/null -X ${tempDir}/packages/alpine/ --no-cache $nginxPackages \
|
||||
;; \
|
||||
esac \
|
||||
# remove checksum deps
|
||||
&& apk del --no-network .checksum-deps \
|
||||
# if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
|
||||
&& if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \
|
||||
&& if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
|
||||
# Add `envsubst` for templating environment variables
|
||||
&& apk add --no-cache gettext-envsubst \
|
||||
# Bring in tzdata so users could set the timezones through the environment
|
||||
# variables
|
||||
&& apk add --no-cache tzdata \
|
||||
# forward request and error logs to docker log collector
|
||||
&& ln -sf /dev/stdout /var/log/nginx/access.log \
|
||||
&& ln -sf /dev/stderr /var/log/nginx/error.log \
|
||||
# create a docker-entrypoint.d directory
|
||||
&& mkdir /docker-entrypoint.d
|
||||
|
||||
# implement changes required to run NGINX as an unprivileged user
|
||||
RUN sed -i 's,listen 80;,listen 8080;,' /etc/nginx/conf.d/default.conf \
|
||||
&& sed -i '/user nginx;/d' /etc/nginx/nginx.conf \
|
||||
&& sed -i 's,\(/var\)\{0\,1\}/run/nginx.pid,/tmp/nginx.pid,' /etc/nginx/nginx.conf \
|
||||
&& sed -i "/^http {/a \ proxy_temp_path /tmp/proxy_temp;\n client_body_temp_path /tmp/client_temp;\n fastcgi_temp_path /tmp/fastcgi_temp;\n uwsgi_temp_path /tmp/uwsgi_temp;\n scgi_temp_path /tmp/scgi_temp;\n" /etc/nginx/nginx.conf \
|
||||
# nginx user must own the cache and etc directory to write cache and tweak the nginx config
|
||||
&& chown -R $UID:0 /var/cache/nginx \
|
||||
&& chmod -R g+w /var/cache/nginx \
|
||||
&& chown -R $UID:0 /etc/nginx \
|
||||
&& chmod -R g+w /etc/nginx
|
||||
|
||||
COPY docker-entrypoint.sh /
|
||||
COPY 10-listen-on-ipv6-by-default.sh /docker-entrypoint.d
|
||||
COPY 15-local-resolvers.envsh /docker-entrypoint.d
|
||||
COPY 20-envsubst-on-templates.sh /docker-entrypoint.d
|
||||
COPY 30-tune-worker-processes.sh /docker-entrypoint.d
|
||||
ENTRYPOINT ["/docker-entrypoint.sh"]
|
||||
|
||||
EXPOSE 8080
|
||||
|
||||
STOPSIGNAL SIGQUIT
|
||||
|
||||
USER $UID
|
||||
|
||||
CMD ["nginx", "-g", "daemon off;"]
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
{
|
||||
"commit": "588b4cbc88065a313909f47a02510639e01cc508",
|
||||
"url": "https://raw.githubusercontent.com/nginx/docker-nginx-unprivileged/588b4cbc88065a313909f47a02510639e01cc508/stable/alpine/Dockerfile",
|
||||
"commit_time": "2026-09-22T20:04:26Z"
|
||||
}
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
{
|
||||
"source_manifest": "/tmp/policy-runtime-refresh-stage/manifest.json",
|
||||
"source_sha256": "21346cf88f53599e4d0bd36e260ad698065d0d83d658c96e1d82bbb6d04dbd3c",
|
||||
"old_artifact": "sha256:b955359f68ccd98ca6e906ef57b74c9bd6e732083b9e2b6857a358cd5196f9a1",
|
||||
"old_findings": {
|
||||
"CRITICAL": 2,
|
||||
"HIGH": 39,
|
||||
"MEDIUM": 76,
|
||||
"LOW": 42,
|
||||
"all_fixable": 159
|
||||
},
|
||||
"official_base_index": "sha256:15c994d10d6d78658721c3bcafff14cb281fba2a4bdf9d5ba92c416a472516e3",
|
||||
"new_nginx": "1.30.5",
|
||||
"old_nginx": "1.27.5",
|
||||
"new_alpine": "3.24.2",
|
||||
"old_alpine": "3.21.3",
|
||||
"exact_additional_package_fixes": {
|
||||
"tiff": "4.7.2-r0",
|
||||
"zlib": "1.3.2-r1"
|
||||
},
|
||||
"module_configure_flags": "identical old and new; full module set retained",
|
||||
"local_image_index": "sha256:29f87195bd9478a706c88c8732948e59a118fcf342f1215ea08b30f87946a71f",
|
||||
"local_image_amd64_manifest": "sha256:e0edbf00d9266a92e82b6b12680e1d0cd7e145c5c6f1d7e6115aaa2b4fa34fec",
|
||||
"local_findings": 0,
|
||||
"scanned_packages": 70,
|
||||
"database_metadata": {
|
||||
"Version": 2,
|
||||
"NextUpdate": "2026-10-11T18:59:50.889010572Z",
|
||||
"UpdatedAt": "2026-10-10T18:59:50.889010923Z",
|
||||
"DownloadedAt": "2026-10-10T23:32:32.380033131Z"
|
||||
},
|
||||
"scanner_eol_warning": "Alpine3.24 not present on bundled EOL list; vulnerability detector examined70packages and original unpatched base reported2fixed findings",
|
||||
"native_published_candidate": "pending root application/commit/CI",
|
||||
"hosting_changed": false,
|
||||
"initial_local_build_failures": [
|
||||
"sandbox denied home buildx activity write",
|
||||
"default Dockerfile name absent; corrected explicit Containerfile"
|
||||
],
|
||||
"source_lock_recipe": "native CI exact source revision; resolved upstream archives + canonical JSON repository revisions SHA256; installed inventory reconstructed by verify-policy-candidate-image.py; current local site uses exact previously reviewed source pins"
|
||||
}
|
||||
|
|
@ -11,6 +11,7 @@ created: "2026-10-11"
|
|||
updated: "2026-10-11"
|
||||
flavor: implementation
|
||||
depends_on: []
|
||||
state_hub_workstream_id: "20adecb1-98b5-5a8e-9550-9aa0bc5087b8"
|
||||
---
|
||||
|
||||
Native human memo `infd-20261010-security-layer-v08` revision2 accepted exact
|
||||
|
|
@ -25,6 +26,7 @@ migration. GH-WP-0004-T11 is source-complete; hosting is this owner's task.
|
|||
id: PNEX-WP-0005-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "0c18f3d3-2cb3-5677-a901-326b8c86865f"
|
||||
```
|
||||
|
||||
Register accepted-1 v0.8 and superseded currentv0.7 notice; retain immutable
|
||||
|
|
@ -37,8 +39,9 @@ and native acceptance receipts stay with NetKingdom and Custodian evidence.
|
|||
|
||||
```task
|
||||
id: PNEX-WP-0005-T02
|
||||
status: progress
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "8adf9d79-2a4f-5441-9eaa-9e74fbe87c5d"
|
||||
```
|
||||
|
||||
Retain immutable fetched source revision lock, content/manifest hashes and full
|
||||
|
|
@ -57,6 +60,7 @@ checks and exact release output before proposing native activation.
|
|||
id: PNEX-WP-0005-T03
|
||||
status: todo
|
||||
priority: high
|
||||
state_hub_task_id: "d4d28d79-4991-5079-93bf-16c66d678cb3"
|
||||
```
|
||||
|
||||
Prepare exact hosting revision/image and rollback, native resource/headroom
|
||||
|
|
@ -70,3 +74,14 @@ or PDP/runtime capability is introduced by publishing static guardrails.
|
|||
collided with the finished fleet-standards/source-auth plan. This new demand
|
||||
is PNEX-WP-0005; older plan/tasks/UUIDs remain unchanged. The failed create
|
||||
receipt is preserved; no historical task or workstream is retired to hide it.
|
||||
|
||||
2026-10-11 verified published candidate: CIrun78 exactb64a0c5 SUCCESS; image
|
||||
4e0db6a57eb00f577159aa6ee10f910dd67b03fd0541c6ce849f5426fdb99d06.
|
||||
Rawsource-lock/inventory/manifest/source-set/image labels verified;73 source
|
||||
hashes/currentHTTPpages and72 immutablehistoryHTTPpages match. Fullscan70
|
||||
packages zero all-severity findings;52tests pass withCIenvironment. Earlier
|
||||
fixture failure, two-CRITICAL/39-HIGH candidate, localbuild mistakes and review
|
||||
refinements remain in docs/evidence/2026-10-11-runtime-release-verification.
|
||||
T03 remains open pending exacthostingpacket ownerreview/humandisposition/native
|
||||
activation, with oldHelmrev8 stilllive. No hosting grant inferred fromsource
|
||||
acceptance orCI.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue