tegwick
ea2d4632a1
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
88 lines
5.4 KiB
JSON
88 lines
5.4 KiB
JSON
{
|
|
"id": "CUST81-APPS-PHASE-B-EXECUTION-PROPOSAL-R1",
|
|
"disposition": "approved",
|
|
"approved_scope": "bounded preparation only; founder live go still required",
|
|
"status": "prepared_not_executed",
|
|
"workitem": "RAPPS-WP-0017-T03",
|
|
"active_predecessor_sha256": "e036084aec9fad3bea63cc0d591c3b40a392ab9f54d9226a2d2b3fd7194d8a47",
|
|
"replacement_sha256": "adfb34c0ee4d01bc602f57cd2320f1658465fb8f8660978828fffa05a5b604b5",
|
|
"preconditions": [
|
|
"verified phase A current API pod ready pinned hardened image/source hashes",
|
|
"platform provisioner terminal verified and approved CCR revision executed",
|
|
"Forgejo exact7 readonly grants and PAT receipt verified",
|
|
"native ESO path-read policy/store issuer receipt verified",
|
|
"founder consent to exact phase B source update and delivery"
|
|
],
|
|
"source_update_after_consent": {
|
|
"command": "cp docs/assessments/cust81-private-reader/reuse-surface-runtime-externalsecret.r1.yaml manifests/reuse-surface-runtime-externalsecret.yaml",
|
|
"publication": "owner commits only exact replacement and normal rmgr sync --push; verify primary exact source commit before liveapply",
|
|
"not_executed": true
|
|
},
|
|
"apply_command": "ssh railiance01 'KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl apply -f /tmp/cust81-phase-b/reuse-surface-runtime-externalsecret.yaml'",
|
|
"sync_verify_before_restart": "wait for ESO Ready and selected reader-key-presence boolean via reviewed captured-output wrapper; never raw Secret/annotation/env output",
|
|
"restart_command": "ssh railiance01 'KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl rollout restart deployment/reuse-surface --namespace reuse'",
|
|
"restart_wait_command": "ssh railiance01 'KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl rollout status deployment/reuse-surface --namespace reuse --timeout=300s'",
|
|
"headroom_gate": "recheck100m/256Mi surge headroom/PVC and actual hardened deployment before restart",
|
|
"cleanup_order": [
|
|
"credential owner revokes exact dedicated Forgejo PAT and verifies revocation; no oldtoken fallback",
|
|
"restore reviewed two-field ESO manifest through source-controlled owner lane and apply, stops rematerialization",
|
|
"remove only REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN from reuse/reuse-surface-env with captured-output exact JSON patch",
|
|
"restart/wait current hardened deployment, verify reader-key absence boolean in new pod and materialized Secret plus exact token revocation",
|
|
"only then may separately approved Helm rollback reuse10 restore vulnerable priorimage; do not restore DB by default"
|
|
],
|
|
"raw_output_contract": "all mutating/proof child stdout/stderr captured/discarded; only whitelisted outcome/proof JSON may reach receipts",
|
|
"runtime_proof": {
|
|
"pod_metadata_schema": [
|
|
"verified API pod name and UID",
|
|
"Ready true",
|
|
"expected spec image OCI indexsha2364b7e...",
|
|
"actual imageID equals index or linux/amd64childsha1a69354af2bc87d4baaecc4b02e13fda468efd3746024f440cc6d138beeee2ab",
|
|
"node92.205.62.239",
|
|
"source/header-routing/native helper hashes verified",
|
|
"exact14 allowlist boolean",
|
|
"reader-key presence boolean",
|
|
"native14fetch/7consentedhashall_verified"
|
|
],
|
|
"wrapper_path": "/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/native_runtime_proof_stdin.py",
|
|
"wrapper_sha256": "1edc317e8563a120b62a6830eebb2875c144b45c57a491eb7da849095c5d1933",
|
|
"packets": {
|
|
"proposal": {
|
|
"path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/private-reader-provisioning-preparation-r1.json",
|
|
"sha256": "7819eb51d249f5c7aff4df9fb520afcfb76603b05a4104439499102b6c20af99"
|
|
},
|
|
"disclosure": {
|
|
"path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/private-source-disclosure-proposal-r1.json",
|
|
"sha256": "46ac4fe49a08054cc215aade2fbaf3b36ee334520997857ed84f530b52da9d35"
|
|
},
|
|
"consent": {
|
|
"path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/private-source-owner-consent-r1.json",
|
|
"sha256": "4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52"
|
|
}
|
|
},
|
|
"invocation": "capture kubectl --kubeconfig <verifiedconfig> -n reuse exec -i <metadata-verified current API pod> -c reuse-surface -- python3 -c <exact hash-bound wrapper source>; stdin JSON envelope {proposal:base64(exactbytes),disclosure:base64(exactbytes),consent:base64(exactbytes)}; no token/credential in argv or stdin; wrapper writes/removes only temporary nonsecret packet files",
|
|
"exit_success_required": true
|
|
},
|
|
"no_live_credential_or_apply_action": true,
|
|
"revision": 2,
|
|
"refinement_or_rescue": true,
|
|
"original_revision_sha256": "sha256:572af68fcf56072c1fd846101a76611885acd6efedfe5dba10d96d9f77f701e0",
|
|
"reader_key_removal_ssh_argv": [
|
|
"ssh",
|
|
"railiance01",
|
|
"env KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl patch secret reuse-surface-env --namespace reuse --type=json -p '[{\"op\":\"remove\",\"path\":\"/data/REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN\"}]'"
|
|
],
|
|
"reader_key_removal_remote_argv": [
|
|
"env",
|
|
"KUBECONFIG=/etc/rancher/k3s/k3s.yaml",
|
|
"kubectl",
|
|
"patch",
|
|
"secret",
|
|
"reuse-surface-env",
|
|
"--namespace",
|
|
"reuse",
|
|
"--type=json",
|
|
"-p",
|
|
"[{\"op\":\"remove\",\"path\":\"/data/REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN\"}]"
|
|
],
|
|
"reader_key_removal_offline_check": "passed shell roundtrip exact single remove op on only selected reader key; no other data field/annotation/spec touched"
|
|
}
|