tegwick
35d966dacd
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
57 lines
5.4 KiB
JSON
57 lines
5.4 KiB
JSON
{
|
|
"reviewer": "railiance-forge-owner (agent railiance-forge, codex)",
|
|
"decision": "approved",
|
|
"comment": "FORGE-WP-0007-T02; INTENT Core Principles 1/4/6: dependable provider-owned target grants and stable handoffs. Approve CCR-2026-0046 revision2 bounded design/preparation, refreshed against final exact artifacts including executable rollback. Page-completeness correction remains verified; recovery resets only dedicated user password, Basic-revokes exactly approved PAT ID/name after single-token inventory, read-only reconciles ambiguity, and never remints or changes KV/delivery. This owner review is not founder authorization or authenticated live proof. Preserve separate exact-token recovery authorization, manual due-date task/receipt and independently reviewed image/allowlist/apps rollout gates before activation. Same proposal/review workitem, not a new successful trial.",
|
|
"reviewed_revision": 2,
|
|
"reviewed_at": "2026-10-14T23:08:34.771501+00:00",
|
|
"work_item": "FORGE-WP-0007-T02",
|
|
"reviewed_artifacts": {
|
|
"credential-change-requests/CCR-2026-0046-reuse-surface-forgejo-source-read.yaml": "90522912fb78fed72e625382fb7114a0e9aafe76d59e36bffecab83c5bb7d643",
|
|
"scripts/provision-reuse-surface-forgejo-source.py": "abf60a754596baa1610d23b1fd367385b0222ac8aeaebba0f2cfb7ec4c62055b",
|
|
"docs/proposals/2026-10-15-reuse-private-reader/bootstrap-contract.json": "2bb72671e0a5f230497ab8ef2967a20ee68d1f2cf081f07c84f6db3442e18d8b",
|
|
"openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl": "6320f6c2d262d924ea16291d301d5f9eeb7efdb6ce7ea141c1a41d277d86b01b",
|
|
"tests/test_reuse_surface_forgejo_source_provision.py": "0d06fd22596a0f17ecd8dd5ff6a12bb1b1782258d00126ad468661099d7d298b",
|
|
"scripts/revoke-reuse-surface-forgejo-source.py": "f78d1b26fbff93c6cc481a896d9fb9b9ce93049b8b3267fa41a64bc57dadb162",
|
|
"tests/test_reuse_surface_forgejo_source_recovery.py": "08247129b220c198d8f7d1322ce63956203b9ffcaa0342e52990bb6520fd138d"
|
|
},
|
|
"validation": {
|
|
"targeted_unittest": "28 passed independently rerun (23 provisioning + 5 recovery)",
|
|
"independent_capped_page_fixture": "R1 50/51, R2 51/51 and page2 excluded-private grant visible",
|
|
"fixture_receipt": "pagination-independent-fixture-results.json",
|
|
"static_target_contract": "target-api-contract-r1.json",
|
|
"live_credentials_used": false,
|
|
"live_mutations": false,
|
|
"live_effective_grants_verified": false,
|
|
"live_native_fetch_verified": false,
|
|
"recovery_contract": "Observed version-tag API requires Basic/reverse-proxy for DELETE. Recovery PATCH uses admin API then reader Basic DELETE exactly approved ID; current inventory checks matching name/scopes and fails on any additional token."
|
|
},
|
|
"r1_disposition_preserved": "forge-owner-review-r1.json changes_requested; same CCR trial refined, not unchanged success",
|
|
"contract_findings_resolved": [
|
|
{
|
|
"id": "FORGE-CUST81-F01",
|
|
"resolution": "Bounded page-until-empty; duplicate/missingID and optional stable-total reconciliation; independent capped50 fixture includes excluded page2 grant; late-collaborator test rejects before mutation."
|
|
},
|
|
{
|
|
"id": "FORGE-CUST81-F02",
|
|
"resolution": "Executable separately approved recovery helper now supplied and reviewed: exact bounded single PAT inventory then dedicated password reset and Basic delete; ambiguous DELETE read-only reconciliation with no repeat; absent-token noop no mutations; no KV/delete/remint. CCR still requires manual due-date task/receipt and separate exact-token recovery approval before activation."
|
|
},
|
|
{
|
|
"id": "FORGE-CUST81-F03",
|
|
"resolution": "Public deployed version/schema inspected; matching version source establishes contract support. Installed target grants, Sudoidentity, machinefederation/ephemeral issuance, and native consumer route behavior remain explicit attended verification gates."
|
|
}
|
|
],
|
|
"sec_dsm_order": {
|
|
"Q1": "No direct Kubernetes identity accepted by current raw HTTP route is demonstrated.",
|
|
"Q2": "KeyCape human login does not establish machine API federation; no installed workload JWT trust demonstrated.",
|
|
"Q3": "Upstream Forgejo OAuth can issue expiring access tokens, but supports authorization_code/refresh_token only; no viable workload client_credentials/token_exchange demonstrated. Therefore static fallback is conditional, not universal target incapability claim.",
|
|
"Q4": "No automatic rotation demonstrated; manual90day policy and target owner due-date record required before activation.",
|
|
"Q5": "Dedicated read:repository PAT vault custody conditional fallback, exact7private grants; ESO15minute token is delivery authentication, not PATexpiry."
|
|
},
|
|
"execution_boundary": [
|
|
"Founder exact revision disposition and independent otherowner reviews remain required.",
|
|
"Before any mutation revalidate public expected version/schema; quiet attended Sudo /user identity and complete grant inventory must prove restricted targetreader rather than administrator.",
|
|
"Manual due-date task/receipt and separate exact-token recovery approval remain required before activation; executable recovery helper is prepared, not live-tested. Separately reviewed scoped CAS update before rotation.",
|
|
"No credential delivery until verified consumer redirect/HTTPS/exact14URL allowlist image and appsowner rollout.",
|
|
"Target token inventory IDs/token_last_eight and actual grants are only claimed after authenticated sanitized receipts; final nativefetch and hosted70/70 remain unproven."
|
|
]
|
|
}
|