From fa6ee926b6f4000cebd7903918474ba5ee7beaf6 Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 19 Oct 2026 15:37:32 +0200 Subject: [PATCH] Close approved build-mode guardrail publication with live proof Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a15374-f59f-7a31-86d2-d23b5d2ed181 --- SCOPE.md | 12 +-- WORK-RECORDS.md | 6 +- .../receipt.json | 83 +++++++++++++++++++ ...WP-0006-build-mode-change-authorization.md | 40 +++++++-- 4 files changed, 126 insertions(+), 15 deletions(-) create mode 100644 docs/evidence/2026-10-19-build-mode-publication/receipt.json diff --git a/SCOPE.md b/SCOPE.md index 87a07da..c3d2a85 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -37,11 +37,13 @@ implement identity or credential custody, or enforce downstream authorization. Workplans, evidence, runbooks and general documentation are not publication content. Source owners retain control of publication disposition. -The build-mode guardrail implementation is available as source; public release -acceptance remains tracked in `PNEX-WP-0006`. That record requires founder batch -publication disposition. The two discovered source rows were reviewed on 2026-10-19 -and retained as metadata-pending without changing publication admission. Source -availability and passing local checks do not establish live publication. +The build-mode guardrail and canon-derived machine-readable JSON were published +under founder-approved proposal POLICY-PUB-20261019-BUILD-MODE-GUARDRAIL-R1 on +2026-10-19. PNEX-WP-0006 is complete: Helm revision 10, 1/1 ready, exact release +hashes and all 150 page/artifact responses verified. See +`docs/evidence/2026-10-19-build-mode-publication/receipt.json`. This proves the +pinned public release, not downstream enforcement or a fresh native CI run. +The two discovery rows remain metadata-pending without publication admission. ## Staged work-record generator adoption diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 583ea32..105b540 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -12,7 +12,7 @@ | workplan | PNEX-WP-0003 | finished | — | workplans/PNEX-WP-0003-adr-review-cleanup-publish.md | | workplan | PNEX-WP-0004 | finished | — | workplans/PNEX-WP-0004-fleet-standards-publication-and-ci-source-auth.md | | workplan | PNEX-WP-0005 | finished | — | workplans/PNEX-WP-0005-security-layer-v08-publication.md | -| workplan | PNEX-WP-0006 | blocked | — | workplans/PNEX-WP-0006-build-mode-change-authorization.md | +| workplan | PNEX-WP-0006 | finished | — | workplans/PNEX-WP-0006-build-mode-change-authorization.md | | workplan | POLICY-NEXUS-WP-0001 | finished | — | workplans/POLICY-NEXUS-WP-0001-permanent-publication-surface.md | | task | PNEX-WP-0002-T01 | done | — | workplans/PNEX-WP-0002-arc42-architecture-collection.md | | task | PNEX-WP-0002-T02 | done | — | workplans/PNEX-WP-0002-arc42-architecture-collection.md | @@ -36,8 +36,8 @@ | task | PNEX-WP-0005-T01 | done | — | workplans/PNEX-WP-0005-security-layer-v08-publication.md | | task | PNEX-WP-0005-T02 | done | — | workplans/PNEX-WP-0005-security-layer-v08-publication.md | | task | PNEX-WP-0005-T03 | done | — | workplans/PNEX-WP-0005-security-layer-v08-publication.md | -| task | PNEX-WP-0006-T01 | wait | — | workplans/PNEX-WP-0006-build-mode-change-authorization.md | -| task | PNEX-WP-0006-T02 | wait | — | workplans/PNEX-WP-0006-build-mode-change-authorization.md | +| task | PNEX-WP-0006-T01 | done | — | workplans/PNEX-WP-0006-build-mode-change-authorization.md | +| task | PNEX-WP-0006-T02 | done | — | workplans/PNEX-WP-0006-build-mode-change-authorization.md | | task | POLICY-NEXUS-WP-0001-T01 | done | — | workplans/POLICY-NEXUS-WP-0001-permanent-publication-surface.md | | task | POLICY-NEXUS-WP-0001-T02 | done | — | workplans/POLICY-NEXUS-WP-0001-permanent-publication-surface.md | | task | POLICY-NEXUS-WP-0001-T03 | done | — | workplans/POLICY-NEXUS-WP-0001-permanent-publication-surface.md | diff --git a/docs/evidence/2026-10-19-build-mode-publication/receipt.json b/docs/evidence/2026-10-19-build-mode-publication/receipt.json new file mode 100644 index 0000000..054b82f --- /dev/null +++ b/docs/evidence/2026-10-19-build-mode-publication/receipt.json @@ -0,0 +1,83 @@ +{ + "proposal_id": "POLICY-PUB-20261019-BUILD-MODE-GUARDRAIL-R1", + "approved_revision": 1, + "approved_packet_hashlist_sha256": "309ef01650b65bc6b28e86daad9b2835a242631cf60e0896e849461bb917504f", + "approval_ref": "conversation:call_5157a09329d34746a3fdf857d5a47b8d:item0", + "result": "verified", + "helm_revision": 10, + "rollback_required": false, + "rollback_revision": 9, + "candidate_source_revision": "9fabcce1cb4c83165bcaba8be58d76788b4d87a1", + "candidate_origin": "local owner-format build; native CI run89 retained failed, no new CI success claimed", + "change_gate": { + "decision": "the-custodian/docs/kubernetes-change-gate-decision.md", + "target_tier": "production", + "readiness_state": "production-approved", + "path": "direct-administer-transition", + "auth_mode": "ADMINISTER @ realm:kubernetes/railiance01", + "activation": "APPROVED", + "evidence_boundary": "target-audited", + "transition_ends": "2026-12-21" + }, + "native": { + "capture_utc": "2026-10-19T13:35:06.098696+00:00", + "cluster_mutated": false, + "expected_node_ip": "92.205.62.239", + "expected_node_ip_present": true, + "helm_revision": 10, + "helm_status": "deployed", + "image_matches_candidate": true, + "machine_id_sha256": "fe7367a60951922122af7ba18ed2cde65c7e0a232bbedfb045cb575de2094c2f", + "ready_replicas": 1, + "release_pin_matches": { + "publication-manifest-digest": true, + "source-inventory-digest": true, + "source-set-digest": true + }, + "replicas": 1, + "secret_values_observed": false, + "ssh_alias": "railiance01" + }, + "public": { + "verified": true, + "capture_utc": "2026-10-19T13:36:20.944233+00:00", + "hashes": { + "publication_manifest_digest": "8c74b4e414f7760429600b7ba0b3627fcfe438417bfe6695f55acfa6905d352e", + "source_inventory_digest": "e84453b6b411a7d66d2b5efbf083cd0033441d6b12983326442933da87bf61fd", + "source_lock_digest": "c150c6c0745441b4b69884ecc6cf55e97db26080fcf4c2224775b1f755580529" + }, + "source_set_digest": "b00535063c56ede08f0a292b301a47add18bf70f81904bf3f434c8faa5ebe682", + "document_count": 74, + "previous73_source_digests_unchanged": true, + "added_document": "canon-build-mode-change-authorization", + "all_canonical_and_revision_pages_byte_equal_candidate": true, + "page_and_artifact_count": 150, + "guardrail_expiry_banner": "Expires on: production-close-down", + "guardrail_json_byte_equal_verified_candidate": true, + "guardrail_json_sha256": "a86462a57bb1df5804d3088881af22569082d43ff68bcab2b67cbe56b6fc46cd", + "tls_verified": true, + "refinements": [ + "Initial verifier incorrectly expected hosting transition date2026-12-21 in canon expiry.", + "Second verifier expected source expires_on label rather than rendered Expires on.", + "Correct final assertion matches approved rendered banner; both failed checks retained, artifact and deployment unchanged." + ] + }, + "deployment": { + "started_utc": "2026-10-19T13:34:20.566225+00:00", + "command": [ + "make", + "policy-nexus-deploy", + "POLICY_NEXUS_TARGET=railiance01" + ], + "atomic": true, + "attempt": 1, + "approval_ref": "conversation:call_5157a09329d34746a3fdf857d5a47b8d:item0", + "completed_utc": "2026-10-19T13:34:26.648713+00:00", + "returncode": 0, + "raw_output_suppressed": true + }, + "owner_source_commits": { + "rapp-policy-nexus": "6ead90ffa4ae5742c37c292485762e83113382c3", + "railiance-apps": "3be92daf74a7572319bfe94dd882a70430528343" + } +} diff --git a/workplans/PNEX-WP-0006-build-mode-change-authorization.md b/workplans/PNEX-WP-0006-build-mode-change-authorization.md index 4f1a8a7..47d7114 100644 --- a/workplans/PNEX-WP-0006-build-mode-change-authorization.md +++ b/workplans/PNEX-WP-0006-build-mode-change-authorization.md @@ -4,7 +4,7 @@ type: workplan title: "Publish the build-mode change authorization guardrail" domain: infotech repo: policy-nexus -status: blocked +status: finished owner: codex topic_slug: custodian created: "2026-10-11" @@ -23,10 +23,9 @@ repo's intent: publication only, the content stays in canon. ```task id: PNEX-WP-0006-T01 -status: wait +status: done priority: high -needs_human: true -intervention_note: "Public publication is red-lane; add PNEX-WP-0006 to the single daily founder batch. Local code and tests are prepared; no per-item approval request." +needs_human: false state_hub_task_id: "ee3c6f88-91b5-5dac-94e7-d1b05b0276bc" ``` @@ -37,10 +36,9 @@ machine-checkable YAML block intact. Show `expires_on: production-close-down` pr ```task id: PNEX-WP-0006-T02 -status: wait +status: done priority: high -needs_human: true -intervention_note: "Public publication is red-lane; add PNEX-WP-0006 to the single daily founder batch. Local code and tests are prepared; no per-item approval request." +needs_human: false state_hub_task_id: "92247888-82ad-52ca-962f-1a578adeb9f7" ``` @@ -123,3 +121,31 @@ Local validation: `make check` passed all 65 tests and source-audit (186 sources rendering, immutable release verification and currency for all 74 entries. Source-set digest: `a70bafe26e45d262d062764b955ff9f98ae1e6780c3eee0ef52af6c8ddf00be2`. These are local candidate checks, not a served-site or scheduled-CI receipt. + + +## Approved publication and native verification — 2026-10-19 + +Founder approved exact proposal POLICY-PUB-20261019-BUILD-MODE-GUARDRAIL-R1, +revision 1, at `conversation:call_5157a09329d34746a3fdf857d5a47b8d:item0`. +The immutable Custodian packet SHA256SUMS digest is +`309ef01650b65bc6b28e86daad9b2835a242631cf60e0896e849461bb917504f`. +Owner hosting paths deployed the exact retained OCI image +`sha256:214b122c3d175563f114552fa1826dac9642433be019c736c3265d0a3ef379f1` +in one atomic upgrade. Helm revision 10 is deployed with 1/1 ready; no rollback +was required. Revision 9 remains the verified rollback target. + +Both tasks are complete: the public canonical/revision pages carry the visible +`Expires on: production-close-down` banner, and the stable machine-readable JSON +is byte-identical to the canon-derived, locally verified artifact. All 150 +canonical/revision/index/artifact responses match the retained candidate; all +release hashes match; exactly one document was added, with the previous 73 source +digests unchanged. Evidence: `docs/evidence/2026-10-19-build-mode-publication/receipt.json`. + +Failed native CI run 89 remains historical failed evidence. Source commit +`9fabcce1cb4c83165bcaba8be58d76788b4d87a1` fixed the observed test/build defects; +65 local tests and the owner-format release build passed. This deployment uses +the verified local artifact and does not claim a subsequent native CI success or +a new vulnerability scan. Two public-verifier date/label assertions were corrected +to the authored rendered banner; failed checks remain in the Custodian execution +receipt, with no image or deployment change. No publication-scope residual remains; +metadata-pending source rows retain their existing independent publication gates.