Close approved build-mode guardrail publication with live proof
All checks were successful
Build and publish policy-nexus image / build-and-push (push) Successful in 2m21s
All checks were successful
Build and publish policy-nexus image / build-and-push (push) Successful in 2m21s
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a15374-f59f-7a31-86d2-d23b5d2ed181
This commit is contained in:
parent
9fabcce1cb
commit
fa6ee926b6
4 changed files with 126 additions and 15 deletions
12
SCOPE.md
12
SCOPE.md
|
|
@ -37,11 +37,13 @@ implement identity or credential custody, or enforce downstream authorization.
|
|||
Workplans, evidence, runbooks and general documentation are not publication
|
||||
content. Source owners retain control of publication disposition.
|
||||
|
||||
The build-mode guardrail implementation is available as source; public release
|
||||
acceptance remains tracked in `PNEX-WP-0006`. That record requires founder batch
|
||||
publication disposition. The two discovered source rows were reviewed on 2026-10-19
|
||||
and retained as metadata-pending without changing publication admission. Source
|
||||
availability and passing local checks do not establish live publication.
|
||||
The build-mode guardrail and canon-derived machine-readable JSON were published
|
||||
under founder-approved proposal POLICY-PUB-20261019-BUILD-MODE-GUARDRAIL-R1 on
|
||||
2026-10-19. PNEX-WP-0006 is complete: Helm revision 10, 1/1 ready, exact release
|
||||
hashes and all 150 page/artifact responses verified. See
|
||||
`docs/evidence/2026-10-19-build-mode-publication/receipt.json`. This proves the
|
||||
pinned public release, not downstream enforcement or a fresh native CI run.
|
||||
The two discovery rows remain metadata-pending without publication admission.
|
||||
|
||||
|
||||
## Staged work-record generator adoption
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@
|
|||
| workplan | PNEX-WP-0003 | finished | — | workplans/PNEX-WP-0003-adr-review-cleanup-publish.md |
|
||||
| workplan | PNEX-WP-0004 | finished | — | workplans/PNEX-WP-0004-fleet-standards-publication-and-ci-source-auth.md |
|
||||
| workplan | PNEX-WP-0005 | finished | — | workplans/PNEX-WP-0005-security-layer-v08-publication.md |
|
||||
| workplan | PNEX-WP-0006 | blocked | — | workplans/PNEX-WP-0006-build-mode-change-authorization.md |
|
||||
| workplan | PNEX-WP-0006 | finished | — | workplans/PNEX-WP-0006-build-mode-change-authorization.md |
|
||||
| workplan | POLICY-NEXUS-WP-0001 | finished | — | workplans/POLICY-NEXUS-WP-0001-permanent-publication-surface.md |
|
||||
| task | PNEX-WP-0002-T01 | done | — | workplans/PNEX-WP-0002-arc42-architecture-collection.md |
|
||||
| task | PNEX-WP-0002-T02 | done | — | workplans/PNEX-WP-0002-arc42-architecture-collection.md |
|
||||
|
|
@ -36,8 +36,8 @@
|
|||
| task | PNEX-WP-0005-T01 | done | — | workplans/PNEX-WP-0005-security-layer-v08-publication.md |
|
||||
| task | PNEX-WP-0005-T02 | done | — | workplans/PNEX-WP-0005-security-layer-v08-publication.md |
|
||||
| task | PNEX-WP-0005-T03 | done | — | workplans/PNEX-WP-0005-security-layer-v08-publication.md |
|
||||
| task | PNEX-WP-0006-T01 | wait | — | workplans/PNEX-WP-0006-build-mode-change-authorization.md |
|
||||
| task | PNEX-WP-0006-T02 | wait | — | workplans/PNEX-WP-0006-build-mode-change-authorization.md |
|
||||
| task | PNEX-WP-0006-T01 | done | — | workplans/PNEX-WP-0006-build-mode-change-authorization.md |
|
||||
| task | PNEX-WP-0006-T02 | done | — | workplans/PNEX-WP-0006-build-mode-change-authorization.md |
|
||||
| task | POLICY-NEXUS-WP-0001-T01 | done | — | workplans/POLICY-NEXUS-WP-0001-permanent-publication-surface.md |
|
||||
| task | POLICY-NEXUS-WP-0001-T02 | done | — | workplans/POLICY-NEXUS-WP-0001-permanent-publication-surface.md |
|
||||
| task | POLICY-NEXUS-WP-0001-T03 | done | — | workplans/POLICY-NEXUS-WP-0001-permanent-publication-surface.md |
|
||||
|
|
|
|||
83
docs/evidence/2026-10-19-build-mode-publication/receipt.json
Normal file
83
docs/evidence/2026-10-19-build-mode-publication/receipt.json
Normal file
|
|
@ -0,0 +1,83 @@
|
|||
{
|
||||
"proposal_id": "POLICY-PUB-20261019-BUILD-MODE-GUARDRAIL-R1",
|
||||
"approved_revision": 1,
|
||||
"approved_packet_hashlist_sha256": "309ef01650b65bc6b28e86daad9b2835a242631cf60e0896e849461bb917504f",
|
||||
"approval_ref": "conversation:call_5157a09329d34746a3fdf857d5a47b8d:item0",
|
||||
"result": "verified",
|
||||
"helm_revision": 10,
|
||||
"rollback_required": false,
|
||||
"rollback_revision": 9,
|
||||
"candidate_source_revision": "9fabcce1cb4c83165bcaba8be58d76788b4d87a1",
|
||||
"candidate_origin": "local owner-format build; native CI run89 retained failed, no new CI success claimed",
|
||||
"change_gate": {
|
||||
"decision": "the-custodian/docs/kubernetes-change-gate-decision.md",
|
||||
"target_tier": "production",
|
||||
"readiness_state": "production-approved",
|
||||
"path": "direct-administer-transition",
|
||||
"auth_mode": "ADMINISTER @ realm:kubernetes/railiance01",
|
||||
"activation": "APPROVED",
|
||||
"evidence_boundary": "target-audited",
|
||||
"transition_ends": "2026-12-21"
|
||||
},
|
||||
"native": {
|
||||
"capture_utc": "2026-10-19T13:35:06.098696+00:00",
|
||||
"cluster_mutated": false,
|
||||
"expected_node_ip": "92.205.62.239",
|
||||
"expected_node_ip_present": true,
|
||||
"helm_revision": 10,
|
||||
"helm_status": "deployed",
|
||||
"image_matches_candidate": true,
|
||||
"machine_id_sha256": "fe7367a60951922122af7ba18ed2cde65c7e0a232bbedfb045cb575de2094c2f",
|
||||
"ready_replicas": 1,
|
||||
"release_pin_matches": {
|
||||
"publication-manifest-digest": true,
|
||||
"source-inventory-digest": true,
|
||||
"source-set-digest": true
|
||||
},
|
||||
"replicas": 1,
|
||||
"secret_values_observed": false,
|
||||
"ssh_alias": "railiance01"
|
||||
},
|
||||
"public": {
|
||||
"verified": true,
|
||||
"capture_utc": "2026-10-19T13:36:20.944233+00:00",
|
||||
"hashes": {
|
||||
"publication_manifest_digest": "8c74b4e414f7760429600b7ba0b3627fcfe438417bfe6695f55acfa6905d352e",
|
||||
"source_inventory_digest": "e84453b6b411a7d66d2b5efbf083cd0033441d6b12983326442933da87bf61fd",
|
||||
"source_lock_digest": "c150c6c0745441b4b69884ecc6cf55e97db26080fcf4c2224775b1f755580529"
|
||||
},
|
||||
"source_set_digest": "b00535063c56ede08f0a292b301a47add18bf70f81904bf3f434c8faa5ebe682",
|
||||
"document_count": 74,
|
||||
"previous73_source_digests_unchanged": true,
|
||||
"added_document": "canon-build-mode-change-authorization",
|
||||
"all_canonical_and_revision_pages_byte_equal_candidate": true,
|
||||
"page_and_artifact_count": 150,
|
||||
"guardrail_expiry_banner": "Expires on: production-close-down",
|
||||
"guardrail_json_byte_equal_verified_candidate": true,
|
||||
"guardrail_json_sha256": "a86462a57bb1df5804d3088881af22569082d43ff68bcab2b67cbe56b6fc46cd",
|
||||
"tls_verified": true,
|
||||
"refinements": [
|
||||
"Initial verifier incorrectly expected hosting transition date2026-12-21 in canon expiry.",
|
||||
"Second verifier expected source expires_on label rather than rendered Expires on.",
|
||||
"Correct final assertion matches approved rendered banner; both failed checks retained, artifact and deployment unchanged."
|
||||
]
|
||||
},
|
||||
"deployment": {
|
||||
"started_utc": "2026-10-19T13:34:20.566225+00:00",
|
||||
"command": [
|
||||
"make",
|
||||
"policy-nexus-deploy",
|
||||
"POLICY_NEXUS_TARGET=railiance01"
|
||||
],
|
||||
"atomic": true,
|
||||
"attempt": 1,
|
||||
"approval_ref": "conversation:call_5157a09329d34746a3fdf857d5a47b8d:item0",
|
||||
"completed_utc": "2026-10-19T13:34:26.648713+00:00",
|
||||
"returncode": 0,
|
||||
"raw_output_suppressed": true
|
||||
},
|
||||
"owner_source_commits": {
|
||||
"rapp-policy-nexus": "6ead90ffa4ae5742c37c292485762e83113382c3",
|
||||
"railiance-apps": "3be92daf74a7572319bfe94dd882a70430528343"
|
||||
}
|
||||
}
|
||||
|
|
@ -4,7 +4,7 @@ type: workplan
|
|||
title: "Publish the build-mode change authorization guardrail"
|
||||
domain: infotech
|
||||
repo: policy-nexus
|
||||
status: blocked
|
||||
status: finished
|
||||
owner: codex
|
||||
topic_slug: custodian
|
||||
created: "2026-10-11"
|
||||
|
|
@ -23,10 +23,9 @@ repo's intent: publication only, the content stays in canon.
|
|||
|
||||
```task
|
||||
id: PNEX-WP-0006-T01
|
||||
status: wait
|
||||
status: done
|
||||
priority: high
|
||||
needs_human: true
|
||||
intervention_note: "Public publication is red-lane; add PNEX-WP-0006 to the single daily founder batch. Local code and tests are prepared; no per-item approval request."
|
||||
needs_human: false
|
||||
state_hub_task_id: "ee3c6f88-91b5-5dac-94e7-d1b05b0276bc"
|
||||
```
|
||||
|
||||
|
|
@ -37,10 +36,9 @@ machine-checkable YAML block intact. Show `expires_on: production-close-down` pr
|
|||
|
||||
```task
|
||||
id: PNEX-WP-0006-T02
|
||||
status: wait
|
||||
status: done
|
||||
priority: high
|
||||
needs_human: true
|
||||
intervention_note: "Public publication is red-lane; add PNEX-WP-0006 to the single daily founder batch. Local code and tests are prepared; no per-item approval request."
|
||||
needs_human: false
|
||||
state_hub_task_id: "92247888-82ad-52ca-962f-1a578adeb9f7"
|
||||
```
|
||||
|
||||
|
|
@ -123,3 +121,31 @@ Local validation: `make check` passed all 65 tests and source-audit (186 sources
|
|||
rendering, immutable release verification and currency for all 74 entries.
|
||||
Source-set digest: `a70bafe26e45d262d062764b955ff9f98ae1e6780c3eee0ef52af6c8ddf00be2`.
|
||||
These are local candidate checks, not a served-site or scheduled-CI receipt.
|
||||
|
||||
|
||||
## Approved publication and native verification — 2026-10-19
|
||||
|
||||
Founder approved exact proposal POLICY-PUB-20261019-BUILD-MODE-GUARDRAIL-R1,
|
||||
revision 1, at `conversation:call_5157a09329d34746a3fdf857d5a47b8d:item0`.
|
||||
The immutable Custodian packet SHA256SUMS digest is
|
||||
`309ef01650b65bc6b28e86daad9b2835a242631cf60e0896e849461bb917504f`.
|
||||
Owner hosting paths deployed the exact retained OCI image
|
||||
`sha256:214b122c3d175563f114552fa1826dac9642433be019c736c3265d0a3ef379f1`
|
||||
in one atomic upgrade. Helm revision 10 is deployed with 1/1 ready; no rollback
|
||||
was required. Revision 9 remains the verified rollback target.
|
||||
|
||||
Both tasks are complete: the public canonical/revision pages carry the visible
|
||||
`Expires on: production-close-down` banner, and the stable machine-readable JSON
|
||||
is byte-identical to the canon-derived, locally verified artifact. All 150
|
||||
canonical/revision/index/artifact responses match the retained candidate; all
|
||||
release hashes match; exactly one document was added, with the previous 73 source
|
||||
digests unchanged. Evidence: `docs/evidence/2026-10-19-build-mode-publication/receipt.json`.
|
||||
|
||||
Failed native CI run 89 remains historical failed evidence. Source commit
|
||||
`9fabcce1cb4c83165bcaba8be58d76788b4d87a1` fixed the observed test/build defects;
|
||||
65 local tests and the owner-format release build passed. This deployment uses
|
||||
the verified local artifact and does not claim a subsequent native CI success or
|
||||
a new vulnerability scan. Two public-verifier date/label assertions were corrected
|
||||
to the authored rendered banner; failed checks remain in the Custodian execution
|
||||
receipt, with no image or deployment change. No publication-scope residual remains;
|
||||
metadata-pending source rows retain their existing independent publication gates.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue