coulomb/railiance-apps
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-apps/docs/assessments/cust81-private-reader/phase-a-local-image-r1/phase-a-supplement.patch
tegwick fb7d56d3dc Prepare scoped reuse reader release with qualified content digests 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
2026-10-15 01:47:29 +02:00

665 lines
29 KiB
Diff
Raw Blame History

diff --git a/docs/assessments/cust81-private-reader/phase-a-local-image-r1/apps-owner-release-review.md b/docs/assessments/cust81-private-reader/phase-a-local-image-r1/apps-owner-release-review.md
new file mode 100644
index 0000000..0079fe5
--- /dev/null
+++ b/docs/assessments/cust81-private-reader/phase-a-local-image-r1/apps-owner-release-review.md
@@ -0,0 +1,57 @@
+# Apps concrete phase A proposal review
+
+Disposition: `approved` for proposal preparation and local render only.
+This supplement preserves the reviewed core R2 patch unchanged. It supplies
+actual `reuse` Helm release / `reuse` namespace chart rendering with the locally
+built hardened image digest. It does not authorize publication, execute a live
+change or approve platform's CCR. INTENT basis: source-controlled release
+contracts, explicit S3 handoff and evidence before confidence.
+
+The proposed image is
+`forgejo.coulomb.social/coulomb/reuse-surface@sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0`.
+The local build receipt confirms no-network/read-only health and native source
+hash smoke. Registry publication is false. Before apply the exact reviewed
+artifact must be published and independently verified by registry manifest
+digest. If publication changes manifest representation/digest, revise and review
+the bound proposal rather than silently replacing the digest.
+
+Current observations are node `92.205.62.239`, CPU requests3560m of4000m (440m
+free), API100m/256Mi, replicas1 with surge1/unavailable0, PVC
+`reuse-surface-data` Bound RWO1Gi, and Helm ownership without Argo tracking.
+The proposed chart retains resources, strategy and PVC. One100m/256Mi surge fits
+observed CPU headroom; recheck memory, pending pods and node headroom immediately
+before rollout. RWO single-node does not prohibit two pods on that same node,
+but driver mount behavior and SQLite concurrent-access readiness remain
+verification gates. Do not change deployment strategy or PVC to bypass a failure.
+
+Exact readonly authenticated-source inventory is0 at its receipt timestamp.
+This clears the observed migration gate, but recheck before apply; no credential
+or Secret/env was read. Existing Kubernetes-auth `openbao-reuse` store is Ready
+with namespace/ServiceAccount/role matching the consumer; its current
+ExternalSecret contains only the two old fields and remains unchanged in phase A.
+
+Local full-chart render and assertions passed: exact proposed image and14 URL
+allowlist; same100m/256Mi requests; same1surge/0unavailable/replicas1; no Secret,
+ExternalSecret or store objects added. Full chart includes existing landing,
+ingress, services and PVC and must receive normal full-chart server dry-run and
+client diff, not a Deployment-only narrow review.
+
+Incremental infrastructure cost is EUR0 because node, replica steady state,
+requests, services and PVC capacity remain unchanged. Build/registry execution
+cost is not independently accounted. Credible operational loss is qualitative
+and not priced in EUR: rollout failure or concurrent SQLite/PVC access may cause
+service interruption or recovery work. No autopilot grant is inferred. Exact
+human review must accept these estimates and remaining readiness gates.
+
+Before founder-authorized deploy, capture current Helm revision and safe rollback
+reference (old running digest
+`sha256:2c1514cb3f5e1297ffeeac912ba36a70f8a2591588a5a4643bc58293e97132de`),
+known recovery receipt and63 public capability baseline. Use actual Helm release
+`reuse`, namespace`reuse`, owner atomic/wait/timeout path after safe dry-run/diff.
+No exact deploy command is executed by this proposal. Phase A retains the current
+runtime Secret fields and supplies no reader. Verify running imageID, readiness,
+public federation and credential refusal/redirect behavior before phase B.
+If phase A fails with no reader delivered, restore the approved previous release.
+After phase B, revoke/remove reader and verify its absence before any vulnerable
+image restoration. Phase B is independently gated by approved/executed CCR and
+native14 URL/7 entry-hash proof before70/70 hosted discovery.
diff --git a/docs/assessments/cust81-private-reader/phase-a-local-image-r1/phase-a-full-chart.proposed.yaml b/docs/assessments/cust81-private-reader/phase-a-local-image-r1/phase-a-full-chart.proposed.yaml
new file mode 100644
index 0000000..4059c3a
--- /dev/null
+++ b/docs/assessments/cust81-private-reader/phase-a-local-image-r1/phase-a-full-chart.proposed.yaml
@@ -0,0 +1,478 @@
+# PREPARATION RENDER ONLY; no registry publication or server validation proved.
+---
+# Source: reuse-surface/templates/landing-configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: reuse-surface-landing
+ labels:
+ app.kubernetes.io/name: reuse-surface
+ app.kubernetes.io/instance: reuse
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/version: "0.1.0"
+ app.kubernetes.io/part-of: railiance-apps
+ helm.sh/chart: reuse-surface-0.1.0
+ app.kubernetes.io/component: landing
+data:
+ index.html: |
+
+ <!doctype html>
+ <html lang="en">
+ <head>
+ <meta charset="utf-8">
+ <meta name="viewport" content="width=device-width, initial-scale=1">
+ <meta name="robots" content="noindex,nofollow">
+ <title>REUSE federation endpoint</title>
+ <style>
+ :root {
+ color-scheme: light;
+ --ink: #1d2733;
+ --muted: #536271;
+ --line: #d9e0e7;
+ --paper: #f8fafc;
+ --accent: #2066a8;
+ --accent-dark: #164b7e;
+ }
+ * {
+ box-sizing: border-box;
+ }
+ body {
+ margin: 0;
+ min-height: 100vh;
+ font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+ color: var(--ink);
+ background: var(--paper);
+ display: grid;
+ place-items: center;
+ padding: 32px 18px;
+ }
+ main {
+ width: min(100%, 720px);
+ border: 1px solid var(--line);
+ border-radius: 8px;
+ background: #ffffff;
+ padding: clamp(28px, 5vw, 48px);
+ box-shadow: 0 18px 48px rgba(29, 39, 51, 0.08);
+ }
+ .eyebrow {
+ margin: 0 0 12px;
+ color: var(--accent-dark);
+ font-size: 0.86rem;
+ font-weight: 700;
+ text-transform: uppercase;
+ }
+ h1 {
+ margin: 0;
+ font-size: clamp(2rem, 7vw, 3rem);
+ line-height: 1.05;
+ }
+ p {
+ max-width: 62ch;
+ margin: 18px 0 0;
+ color: var(--muted);
+ font-size: 1rem;
+ line-height: 1.65;
+ }
+ .actions {
+ display: flex;
+ flex-wrap: wrap;
+ gap: 12px;
+ margin-top: 28px;
+ }
+ a {
+ color: var(--accent);
+ }
+ .button {
+ display: inline-flex;
+ min-height: 44px;
+ align-items: center;
+ justify-content: center;
+ border-radius: 6px;
+ background: var(--accent);
+ color: #ffffff;
+ padding: 0 18px;
+ font-weight: 700;
+ text-decoration: none;
+ }
+ .button:focus,
+ .button:hover {
+ background: var(--accent-dark);
+ }
+ .links {
+ margin-top: 26px;
+ padding-top: 22px;
+ border-top: 1px solid var(--line);
+ display: grid;
+ gap: 10px;
+ }
+ </style>
+ </head>
+ <body>
+ <main>
+ <p class="eyebrow">reuse.coulomb.social</p>
+ <h1>REUSE federation endpoint</h1>
+ <p>This is the Railiance REUSE capability federation service. It is an API endpoint for automated clients and operators; there is no browser login for this service.</p>
+ <div class="actions">
+ <a class="button" href="/v1/federated">Open federated index</a>
+ </div>
+ <nav class="links" aria-label="Service links">
+ <a href="/health">Health check</a>
+ <a href="/v1/federated">Federated capability index</a>
+ <a href="https://forgejo.coulomb.social/coulomb/railiance-apps/src/branch/main/docs/reuse-surface-on-railiance01.md">Operator runbook</a>
+ </nav>
+ </main>
+ </body>
+ </html>
+---
+# Source: reuse-surface/templates/pvc.yaml
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+ name: reuse-surface-data
+ labels:
+ app.kubernetes.io/name: reuse-surface
+ app.kubernetes.io/instance: reuse
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/version: "0.1.0"
+ app.kubernetes.io/part-of: railiance-apps
+ helm.sh/chart: reuse-surface-0.1.0
+spec:
+ accessModes:
+ - ReadWriteOnce
+ resources:
+ requests:
+ storage: 1Gi
+---
+# Source: reuse-surface/templates/landing-service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+ name: reuse-surface-landing
+ labels:
+ app.kubernetes.io/name: reuse-surface
+ app.kubernetes.io/instance: reuse
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/version: "0.1.0"
+ app.kubernetes.io/part-of: railiance-apps
+ helm.sh/chart: reuse-surface-0.1.0
+ app.kubernetes.io/component: landing
+spec:
+ type: ClusterIP
+ selector:
+ app.kubernetes.io/name: reuse-surface
+ app.kubernetes.io/instance: reuse
+ app.kubernetes.io/component: landing
+ ports:
+ - name: http
+ port: 8080
+ targetPort: http
+ protocol: TCP
+---
+# Source: reuse-surface/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+ name: reuse-surface
+ labels:
+ app.kubernetes.io/name: reuse-surface
+ app.kubernetes.io/instance: reuse
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/version: "0.1.0"
+ app.kubernetes.io/part-of: railiance-apps
+ helm.sh/chart: reuse-surface-0.1.0
+spec:
+ type: ClusterIP
+ selector:
+ app.kubernetes.io/name: reuse-surface
+ app.kubernetes.io/instance: reuse
+ app.kubernetes.io/component: api
+ ports:
+ - name: http
+ port: 8000
+ targetPort: http
+ protocol: TCP
+---
+# Source: reuse-surface/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: reuse-surface
+ labels:
+ app.kubernetes.io/name: reuse-surface
+ app.kubernetes.io/instance: reuse
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/version: "0.1.0"
+ app.kubernetes.io/part-of: railiance-apps
+ helm.sh/chart: reuse-surface-0.1.0
+ app.kubernetes.io/component: api
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app.kubernetes.io/name: reuse-surface
+ app.kubernetes.io/instance: reuse
+ strategy:
+ type: RollingUpdate
+ rollingUpdate:
+ maxSurge: 1
+ maxUnavailable: 0
+ template:
+ metadata:
+ labels:
+ app.kubernetes.io/name: reuse-surface
+ app.kubernetes.io/instance: reuse
+ app.kubernetes.io/component: api
+ spec:
+ enableServiceLinks: false
+ securityContext:
+ {}
+ containers:
+ - name: reuse-surface
+ image: "forgejo.coulomb.social/coulomb/reuse-surface@sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0"
+ imagePullPolicy: IfNotPresent
+ command: ["reuse-surface", "serve"]
+ securityContext:
+ {}
+ ports:
+ - name: http
+ containerPort: 8000
+ protocol: TCP
+ envFrom:
+ - secretRef:
+ name: "reuse-surface-env"
+ env:
+ - name: REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST
+ value: "{\"REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN\":[\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/capabilities/capability.railiance.openbao-package.md?ref=35672be138036c8433a5ac5de91e068c03c2b124\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/indexes/capabilities.yaml?ref=35672be138036c8433a5ac5de91e068c03c2b124\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/capabilities/capability.railiance.policy-publication-package.md?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/indexes/capabilities.yaml?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/capabilities/capability.railiance.postgres-isolation-recovery.md?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/indexes/capabilities.yaml?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/capabilities/capability.railiance.sbom-runtime-package.md?ref=adbedd349e8df97be43a1f57db7095af45ff29d1\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/indexes/capabilities.yaml?ref=adbedd349e8df97be43a1f57db7095af45ff29d1\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/capabilities/capability.railiance.telemetry-package.md?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/indexes/capabilities.yaml?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/capabilities/capability.railiance.tenant-engine-package.md?ref=9bdc86572728783a5ed94266f04f7b12d414c557\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/indexes/capabilities.yaml?ref=9bdc86572728783a5ed94266f04f7b12d414c557\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/capabilities/capability.railiance.user-engine-package.md?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/indexes/capabilities.yaml?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738\"]}"
+ - name: REUSE_SURFACE_LISTEN_HOST
+ value: "0.0.0.0"
+ - name: REUSE_SURFACE_LISTEN_PORT
+ value: "8000"
+ - name: REUSE_SURFACE_DB
+ value: "/data/reuse.db"
+ - name: REUSE_SURFACE_CACHE_DIR
+ value: "/data/cache"
+ volumeMounts:
+ - name: data
+ mountPath: /data
+ readinessProbe:
+ httpGet:
+ path: /health
+ port: 8000
+ initialDelaySeconds: 10
+ periodSeconds: 10
+ timeoutSeconds: 5
+ failureThreshold: 3
+ livenessProbe:
+ httpGet:
+ path: /health
+ port: 8000
+ initialDelaySeconds: 15
+ periodSeconds: 30
+ timeoutSeconds: 5
+ failureThreshold: 3
+ resources:
+ limits:
+ cpu: 500m
+ memory: 512Mi
+ requests:
+ cpu: 100m
+ memory: 256Mi
+ volumes:
+ - name: data
+ persistentVolumeClaim:
+ claimName: reuse-surface-data
+---
+# Source: reuse-surface/templates/landing-deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: reuse-surface-landing
+ labels:
+ app.kubernetes.io/name: reuse-surface
+ app.kubernetes.io/instance: reuse
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/version: "0.1.0"
+ app.kubernetes.io/part-of: railiance-apps
+ helm.sh/chart: reuse-surface-0.1.0
+ app.kubernetes.io/component: landing
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app.kubernetes.io/name: reuse-surface
+ app.kubernetes.io/instance: reuse
+ app.kubernetes.io/component: landing
+ strategy:
+ type: RollingUpdate
+ rollingUpdate:
+ maxSurge: 1
+ maxUnavailable: 0
+ template:
+ metadata:
+ labels:
+ app.kubernetes.io/name: reuse-surface
+ app.kubernetes.io/instance: reuse
+ app.kubernetes.io/component: landing
+ spec:
+ enableServiceLinks: false
+ containers:
+ - name: landing
+ image: "nginxinc/nginx-unprivileged:1.27-alpine"
+ imagePullPolicy: IfNotPresent
+ ports:
+ - name: http
+ containerPort: 8080
+ protocol: TCP
+ readinessProbe:
+ httpGet:
+ path: /
+ port: http
+ initialDelaySeconds: 3
+ periodSeconds: 10
+ timeoutSeconds: 3
+ failureThreshold: 3
+ livenessProbe:
+ httpGet:
+ path: /
+ port: http
+ initialDelaySeconds: 10
+ periodSeconds: 30
+ timeoutSeconds: 3
+ failureThreshold: 3
+ resources:
+ limits:
+ cpu: 50m
+ memory: 64Mi
+ requests:
+ cpu: 10m
+ memory: 32Mi
+ volumeMounts:
+ - name: landing-page
+ mountPath: /usr/share/nginx/html/index.html
+ subPath: index.html
+ readOnly: true
+ volumes:
+ - name: landing-page
+ configMap:
+ name: reuse-surface-landing
+---
+# Source: reuse-surface/templates/ingress.yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+ name: reuse-surface
+ labels:
+ app.kubernetes.io/name: reuse-surface
+ app.kubernetes.io/instance: reuse
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/version: "0.1.0"
+ app.kubernetes.io/part-of: railiance-apps
+ helm.sh/chart: reuse-surface-0.1.0
+ annotations:
+ cert-manager.io/cluster-issuer: letsencrypt-prod
+ traefik.ingress.kubernetes.io/router.entrypoints: websecure
+ traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+ ingressClassName: traefik
+ tls:
+ - hosts:
+ - reuse.coulomb.social
+ secretName: reuse-surface-tls
+ rules:
+ - host: reuse.coulomb.social
+ http:
+ paths:
+ - path: /health
+ pathType: Exact
+ backend:
+ service:
+ name: reuse-surface
+ port:
+ number: 8000
+ - path: /v1
+ pathType: Prefix
+ backend:
+ service:
+ name: reuse-surface
+ port:
+ number: 8000
+---
+# Source: reuse-surface/templates/landing-ingress.yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+ name: reuse-surface-landing
+ labels:
+ app.kubernetes.io/name: reuse-surface
+ app.kubernetes.io/instance: reuse
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/version: "0.1.0"
+ app.kubernetes.io/part-of: railiance-apps
+ helm.sh/chart: reuse-surface-0.1.0
+ annotations:
+ traefik.ingress.kubernetes.io/router.entrypoints: websecure
+ traefik.ingress.kubernetes.io/router.tls: "true"
+ traefik.ingress.kubernetes.io/router.priority: "1"
+spec:
+ ingressClassName: traefik
+ tls:
+ - hosts:
+ - reuse.coulomb.social
+ secretName: reuse-surface-tls
+ rules:
+ - host: reuse.coulomb.social
+ http:
+ paths:
+ - path: /
+ pathType: Prefix
+ backend:
+ service:
+ name: reuse-surface-landing
+ port:
+ number: 8080
+---
+# Source: reuse-surface/templates/redirect-ingress.yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+ name: reuse-surface-http-redirect
+ labels:
+ app.kubernetes.io/name: reuse-surface
+ app.kubernetes.io/instance: reuse
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/version: "0.1.0"
+ app.kubernetes.io/part-of: railiance-apps
+ helm.sh/chart: reuse-surface-0.1.0
+ annotations:
+ traefik.ingress.kubernetes.io/router.entrypoints: web
+ traefik.ingress.kubernetes.io/router.middlewares: "reuse-reuse-surface-redirect-https@kubernetescrd"
+spec:
+ ingressClassName: traefik
+ rules:
+ - host: reuse.coulomb.social
+ http:
+ paths:
+ - path: /
+ pathType: Prefix
+ backend:
+ service:
+ name: reuse-surface
+ port:
+ number: 8000
+---
+# Source: reuse-surface/templates/redirect-middleware.yaml
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+ name: reuse-surface-redirect-https
+ labels:
+ app.kubernetes.io/name: reuse-surface
+ app.kubernetes.io/instance: reuse
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/version: "0.1.0"
+ app.kubernetes.io/part-of: railiance-apps
+ helm.sh/chart: reuse-surface-0.1.0
+spec:
+ redirectScheme:
+ scheme: https
+ permanent: true
diff --git a/docs/assessments/cust81-private-reader/phase-a-local-image-r1/phase-a-preparation-receipt.json b/docs/assessments/cust81-private-reader/phase-a-local-image-r1/phase-a-preparation-receipt.json
new file mode 100644
index 0000000..c58f4b4
--- /dev/null
+++ b/docs/assessments/cust81-private-reader/phase-a-local-image-r1/phase-a-preparation-receipt.json
@@ -0,0 +1,67 @@
+{
+ "proposal_id": "CUST81-APPS-PHASE-A-LOCAL-IMAGE-R1",
+ "disposition": "approved",
+ "approved_scope": "concrete proposal preparation and local render only; not publish or production deploy",
+ "workitem": "RAPPS-WP-0017-T02",
+ "release": "reuse",
+ "namespace": "reuse",
+ "deployment": "reuse-surface",
+ "image_reference": "forgejo.coulomb.social/coulomb/reuse-surface@sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0",
+ "registry_publication_verified": false,
+ "phase_b_credential_delivery_included": false,
+ "incremental_infrastructure_cost_eur": 0,
+ "cost_basis": "existing node, same requests and replicas, same PVC, no new service or purchased capacity; build/registry execution cost not independently accounted",
+ "credible_loss_bound_eur": null,
+ "risk_basis": "qualitative supervised change: transient rollout or SQLite concurrent-access outage; RWO PVC single-node mounts need preflight; no customer production admitted; data recovery and exact atomic rollback required before execution",
+ "autopilot_authority": false,
+ "local_render_checks": "passed",
+ "evidence": {
+ "hardened-reader-local-image-r1.json": {
+ "path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/hardened-reader-local-image-r1.json",
+ "sha256": "ed7c2516925d7f16b573a70b5e48d5656a4875e9eb94bcc8760a8bdcbe07f59c"
+ },
+ "live-authenticated-source-inventory-r1.json": {
+ "path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/live-authenticated-source-inventory-r1.json",
+ "sha256": "ba669d6231c8c611191c7ad28f5914d6c47332032b23b0ea40a13f753e883073"
+ },
+ "reuse-release-runtime-metadata-r1.json": {
+ "path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/reuse-release-runtime-metadata-r1.json",
+ "sha256": "5ec901cf41b9f52628ff636c23b5bbc4789df6a9118f5cff0ff8518b287357e9"
+ },
+ "reuse-release-owner-eso-metadata-r1.json": {
+ "path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/reuse-release-owner-eso-metadata-r1.json",
+ "sha256": "ff9aa207ae081d27d86820747a993d4bbc290ba2c354eef72388233d6733adb3"
+ }
+ },
+ "observed_runtime": {
+ "node_ip": "92.205.62.239",
+ "cpu_free_m": 440,
+ "api_surge_cpu_m": 100,
+ "api_surge_memory_mi": 256,
+ "pvc": "reuse-surface-data",
+ "pvc_access": "ReadWriteOnce",
+ "pvc_capacity": "1Gi",
+ "previous_image_digest": "forgejo.coulomb.social/coulomb/reuse-surface@sha256:2c1514cb3f5e1297ffeeac912ba36a70f8a2591588a5a4643bc58293e97132de",
+ "authenticated_sources": 0
+ },
+ "gates": [
+ "publish exact reviewed image and verify registry digest; local digest may require reviewed update if registry transforms manifest",
+ "founder approval for exact phase A and later credential CCR/phase B",
+ "recheck target headroom memory node/PVC mount scheduling and authenticated inventory immediately before apply",
+ "bounded safe server dry-run/client diff and current release revision/rollback capture",
+ "no ESO reader field during phase A; verify actual imageID health and63public baseline before phase B",
+ "revoke/remove delivered reader before any downgrade to old vulnerable image"
+ ],
+ "render_command": [
+ "helm",
+ "template",
+ "reuse",
+ "charts/reuse-surface",
+ "--namespace",
+ "reuse",
+ "-f",
+ "helm/reuse-surface-values.yaml",
+ "-f",
+ "docs/assessments/cust81-private-reader/phase-a-local-image-r1/phase-a-values.proposed.yaml"
+ ]
+}
diff --git a/docs/assessments/cust81-private-reader/phase-a-local-image-r1/phase-a-values.proposed.yaml b/docs/assessments/cust81-private-reader/phase-a-local-image-r1/phase-a-values.proposed.yaml
new file mode 100644
index 0000000..6e6f81e
--- /dev/null
+++ b/docs/assessments/cust81-private-reader/phase-a-local-image-r1/phase-a-values.proposed.yaml
@@ -0,0 +1,21 @@
+# PROPOSAL ONLY; digest is locally built, NOT published.
+# Publish exact reviewed artifact and verify registry digest before any apply.
+image:
+ repository: forgejo.coulomb.social/coulomb/reuse-surface
+ digest: sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0
+authSourceAllowlist:
+ REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN:
+ - https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/capabilities/capability.railiance.openbao-package.md?ref=35672be138036c8433a5ac5de91e068c03c2b124
+ - https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/indexes/capabilities.yaml?ref=35672be138036c8433a5ac5de91e068c03c2b124
+ - https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/capabilities/capability.railiance.policy-publication-package.md?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3
+ - https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/indexes/capabilities.yaml?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3
+ - https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/capabilities/capability.railiance.postgres-isolation-recovery.md?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5
+ - https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/indexes/capabilities.yaml?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5
+ - https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/capabilities/capability.railiance.sbom-runtime-package.md?ref=adbedd349e8df97be43a1f57db7095af45ff29d1
+ - https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/indexes/capabilities.yaml?ref=adbedd349e8df97be43a1f57db7095af45ff29d1
+ - https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/capabilities/capability.railiance.telemetry-package.md?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5
+ - https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/indexes/capabilities.yaml?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5
+ - https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/capabilities/capability.railiance.tenant-engine-package.md?ref=9bdc86572728783a5ed94266f04f7b12d414c557
+ - https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/indexes/capabilities.yaml?ref=9bdc86572728783a5ed94266f04f7b12d414c557
+ - https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/capabilities/capability.railiance.user-engine-package.md?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738
+ - https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/indexes/capabilities.yaml?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738
diff --git a/docs/assessments/cust81-private-reader/phase-a-local-image-r1/manifest.json b/docs/assessments/cust81-private-reader/phase-a-local-image-r1/manifest.json
new file mode 100644
index 0000000..15cc477
--- /dev/null
+++ b/docs/assessments/cust81-private-reader/phase-a-local-image-r1/manifest.json
@@ -0,0 +1,12 @@
+{
+ "proposal_id": "CUST81-APPS-PHASE-A-LOCAL-IMAGE-R1",
+ "reviewer_owner": "railiance-apps",
+ "disposition": "approved",
+ "approved_scope": "preparation only, local full-chart render, supervised founder review required",
+ "files": {
+ "docs/assessments/cust81-private-reader/phase-a-local-image-r1/apps-owner-release-review.md": "a74e96986798a727fc87c0d3c578601579778dfd8521796d0bb81df8451c751b",
+ "docs/assessments/cust81-private-reader/phase-a-local-image-r1/phase-a-full-chart.proposed.yaml": "36c20c3e16757d3e888a3db02853032b33e791aa04a6055fe001121254345b81",
+ "docs/assessments/cust81-private-reader/phase-a-local-image-r1/phase-a-preparation-receipt.json": "3282a17ae3724619e40dd1f34846d83b2297d9ae00030618dbd269e8e2fd7d39",
+ "docs/assessments/cust81-private-reader/phase-a-local-image-r1/phase-a-values.proposed.yaml": "35284857ec987fc7a929f5c2eecdb44c7d3367f7835904692947de09918ab8f1"
+ }
+}
Reference in a new issue View git blame Copy permalink