468 lines
238 KiB
JSON
468 lines
238 KiB
JSON
|
{
|
||
|
|
"schema": "platform.factory-native-acceptance.v1",
|
||
|
|
"run_id": "factory-audit-20260911104152-94aced",
|
||
|
|
"source_commits": {
|
||
|
|
"approval-engine": [
|
||
|
|
"a0a602976eef818f36dde35f76f7f2e589bd051b",
|
||
|
|
"approval_engine"
|
||
|
|
],
|
||
|
|
"informed-decision": [
|
||
|
|
"1a122235741d61b649e39ab86ddfbd317e54ad2f",
|
||
|
|
"informed_decision"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
"source_hashes": {
|
||
|
|
"approval_engine/__init__.py": "6906dae8addc697b52e8fff9265d77c8b37f7f32e5a980dfe8ce645c48d3e774",
|
||
|
|
"approval_engine/api.py": "fba1b10dc584bdcc9adf498110737480a0e895e40fffd470590caa9632ed4dc7",
|
||
|
|
"approval_engine/audit.py": "543b3bde848ea2931683b863cf01e429fa9f6a338bd8a5e25785ef55705d9d0f",
|
||
|
|
"approval_engine/auth.py": "2b4528533b280fdadcd5601acc523635ee96c3bcf3ba1f1707439d9e7509099d",
|
||
|
|
"approval_engine/binding.py": "737081b11040233f3460c32d4a9a1ecf57b5a80961f8a39b07cf879a0fa4263b",
|
||
|
|
"approval_engine/cli.py": "57938336f6c29476d8c77edf86ce0716274ec355296936394ba0a2ea3f5067cb",
|
||
|
|
"approval_engine/errors.py": "0a32d0f1f11323ec932ec1879bb321dc2d5077fabb28d0af68d598e02ad89f4c",
|
||
|
|
"approval_engine/pep.py": "ab3378a0ff0a429b2895a26d8afcdeddeb6d4a00ea14bf3b917feb09ba973941",
|
||
|
|
"approval_engine/store.py": "4d06c2a2f3e59d2c94dfcf825441888515aa2953b9b41e62428bbf3e96e65833",
|
||
|
|
"informed_decision/__init__.py": "0ffebe048ba583e7b623f60e8f449950dc5fd49afce2398381fa143eee834e19",
|
||
|
|
"informed_decision/__main__.py": "3ba1467fa2d47fcf0bd032e8694904450775adf763a6e6f9e4888cc3ce3ed92b",
|
||
|
|
"informed_decision/approval_client.py": "56c201dda358cb4bef11a15da141bb68562cdde9e37b4a880bf1e9257ae82cb6",
|
||
|
|
"informed_decision/approval_http.py": "203f462ff78f1409f2f924d4723197fdd502087c7f6da319f46ffffce2a9d478",
|
||
|
|
"informed_decision/audit.py": "06da36a8f3451b4abc7a46da2df66d5939524c170658b879499b2a47a1b10cd3",
|
||
|
|
"informed_decision/canonicalize.py": "517bbc6b81cc839636b97863ebdefd38aa375d10f4915feb9bf21867f992f765",
|
||
|
|
"informed_decision/container.py": "67536cde916ebdd320f5e835bc2f211dae5717af50971c07f3d080f3a7c5e422",
|
||
|
|
"informed_decision/disposition.py": "5ddd19c2444f8e6c9bb090d04045cf1227a34554e000f07b3f677325bf8089f8",
|
||
|
|
"informed_decision/evidence.py": "5f84997f66409c7b6cec6ab57e73ad5bba2c1b2d669604adcbf36e72a824a88d",
|
||
|
|
"informed_decision/http_transport.py": "fc9c1fd05cc89120d70bfcdb4c60fe244b81c8054d21505df8cfa9c5a229f7bc",
|
||
|
|
"informed_decision/memo.py": "697058863a4e6de2c143a2433eaaf5e15e5e7375dc5459af6911b146567e8b5d",
|
||
|
|
"informed_decision/oidc.py": "35b37bae67968c2179b22af8151afe2981d5468debf4488771eaf3121b75e221",
|
||
|
|
"informed_decision/policy.py": "7bf814a8332ff054bf5f1f651d8816a408138b1f197b17da0abb7f87411e8812",
|
||
|
|
"informed_decision/presentation.py": "54375ccd8358fac41de220bccadbee09f8b7c8ebbeeafaafd381a7456331da50",
|
||
|
|
"informed_decision/provenance.py": "de02c6bf162865ba9619d74cfd68dd0a5d7f81e6c9e427f67f848cb2c2214f83",
|
||
|
|
"informed_decision/records.py": "82f696151895c51b168144a3078d05764da3499b96917c465629ce0836fa8e33",
|
||
|
|
"informed_decision/review.py": "c2d2aa1cf48d10d85b3606acf2830ab22701c1274221e5e2760d29901adfd786",
|
||
|
|
"informed_decision/runtime.py": "6bc6a74657f526743cca6c6cdc0a86fff43d8282e0b867dc9288344636abe5eb",
|
||
|
|
"informed_decision/stance.py": "62b96b76eba4ec277344172f10f6233e979dda4d079f972d9a55c4e5aed96c3c",
|
||
|
|
"informed_decision/store.py": "7a58b36d409cb4161b65985545e13573a5196779b4c6e95ca03ce45c6fada808",
|
||
|
|
"informed_decision/ui.py": "69fb7fc1794c8842f42e7f0f5a261c4cf64176053ef0a532db46ee6566621219",
|
||
|
|
"informed_decision/web.py": "97f7e040237fa3b755e39d13e628181dc2a3f6a31b4331ca7284bef05f8d6038"
|
||
|
|
},
|
||
|
|
"source_zip_sha256": "114215406400f6f5728520bf3d7dc2b7a4ff410784b80201b7a5ae24259f64c0",
|
||
|
|
"probe_sha256": "11359a671d835ea1f2ac739ac4b68dbb747d0f4d124c14af8c338973bb95b7e5",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"apiVersion": "v1",
|
||
|
|
"kind": "ConfigMap",
|
||
|
|
"metadata": {
|
||
|
|
"name": "factory-audit-20260911104152-94aced",
|
||
|
|
"namespace": "approval-engine",
|
||
|
|
"labels": {
|
||
|
|
"app.kubernetes.io/name": "approval-engine",
|
||
|
|
"railiance.io/factory-audit-probe": "factory-audit-20260911104152-94aced"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"immutable": true,
|
||
|
|
"data": {
|
||
|
|
"producer.py": "\"\"\"Bounded synthetic audit probe; credentials stay in the producer process.\"\"\"\nimport hashlib\nimport json\nimport os\nfrom pathlib import Path\nimport sqlite3\nimport subprocess\nimport sys\nimport time\nfrom datetime import datetime, timezone, timedelta\nfrom urllib.error import HTTPError, URLError\nfrom urllib.parse import urlencode\nfrom urllib.request import Request, build_opener, ProxyHandler, HTTPRedirectHandler\n\n\nclass Refused(Exception):\n pass\n\n\ndef require(value, code):\n if not value:\n raise Refused(code)\n\n\nclass NoRedirect(HTTPRedirectHandler):\n def redirect_request(self, *args):\n return None\n\n\ndef http(config, method, path, *, body=None, event_id=None, invalid_token=False):\n token = 'deliberately-invalid-native-probe' if invalid_token else Path('/credential/token').read_text().strip()\n headers = {'Authorization': 'Bearer '+token, 'Content-Type': 'application/json'}\n if event_id:\n headers['Idempotency-Key'] = event_id\n request = Request(config['origin']+path, data=body, headers=headers, method=method)\n opener = build_opener(ProxyHandler({}), NoRedirect())\n try:\n response = opener.open(request, timeout=5)\n except HTTPError as exc:\n response = exc\n with response:\n raw = response.read(262145)\n require(len(raw) <= 262144, 'response_too_large')\n return response.status, json.loads(raw)\n\n\ndef bootstrap(config, dbpath, envelope):\n # Seed only a disposable synthetic outbox, never an approval or disposition.\n # This exercises recovery/delivery, not domain-transaction atomicity.\n if config['sender'] == 'approval-engine':\n from approval_engine.store import Engine\n engine = Engine(dbpath)\n payload = {'schema_version':'audit-core.event.v1alpha1', 'event_id':envelope['id'],\n 'observed_at':envelope['occurred_at'], 'tenant':'tenant:platform',\n 'scope':'synthetic-audit-acceptance', 'source':'approval-engine',\n 'actor':None, 'action':envelope['type'], 'resource':envelope['subject'],\n 'outcome':'probe', 'reason':'synthetic sender verification',\n 'details':dict(envelope['data'], approval_id=envelope['correlation_id'])}\n from approval_engine.audit import audit_envelope\n envelope = audit_envelope(payload)\n engine.close()\n with sqlite3.connect(dbpath) as db:\n require(db.execute('SELECT COUNT(*) FROM approvals').fetchone()[0] == 0, 'unexpected_approval')\n db.execute('INSERT INTO outbox(event_id,class,approval_id,payload_json,created_at) VALUES(?,?,?,?,?)',\n (envelope['id'], envelope['type'], None, json.dumps(payload, sort_keys=True), envelope['occurred_at']))\n else:\n from informed_decision.store import Store\n Store(dbpath)\n with sqlite3.connect(dbpath) as db:\n db.execute('INSERT INTO evidence VALUES(?,?,?,?,?)',\n (envelope['id'], envelope['type'], envelope['occurred_at'], json.dumps(envelope,sort_keys=True), '{}'))\n db.execute('INSERT INTO outbox(id) VALUES(?)', (envelope['id'],))\n return envelope\n\n\ndef delivery_phase(config, phase, dbpath, receipt):\n observed = receipt.setdefault(\"observed_http_statuses\", [])\n lose = phase == 'lost-receipt'\n if config['sender'] == 'approval-engine':\n from approval_engine.store import Engine\n from approval_engine.audit import AuditCoreSink\n real = build_opener(ProxyHandler({}), NoRedirect())\n def opened(request, timeout):\n response = real.open(request, timeout=timeout)\n observed.append(response.status)\n if lose:\n response.close()\n raise URLError('injected receipt loss after native response')\n return response\n engine = Engine(dbpath)\n pending = engine.undrained()\n require(len(pending) == 1 and pending[0]['event_id']
|
||
|
|
"config.json": "{\"event_id\": \"factory-audit-20260911104152-94aced-approval-engine\", \"origin\": \"http://audit-core.audit-core.svc.cluster.local:8080\", \"run_id\": \"factory-audit-20260911104152-94aced\", \"sender\": \"approval-engine\", \"source_zip_sha256\": \"114215406400f6f5728520bf3d7dc2b7a4ff410784b80201b7a5ae24259f64c0\"}"
|
||
|
|
},
|
||
|
|
"binaryData": {
|
||
|
|
"source.zip": "UEsDBBQAAAAIAAAAK10Z4IOs+QAAACMCAAAbAAAAYXBwcm92YWxfZW5naW5lL19faW5pdF9fLnB5ZZFBTgMxDEX3OYWVFUilN2CBoJXYoEqIFUJRZuIZglJ7lGS65hCckJOQTmKgbXb/fdvxT7TWdpoiH2y4QRo9IXx/fsHucQcDR8jvCOIDdx/Y57XWWqkh8h7WnSfnaQS/nzhmaNI4P2LKK+gtMfneBtOc1oYxckzSdaWgnLt2y+borRZ0zzQE3+eqHuapCJuxVmIr2nLsvHNIVT5x3vJMrqrnzBFfyB6sD7YLWGkBcwlGeRnnBJapPaZU667bquk4QTbdLA+klDE2BGPgFl6XXl0NXSfpkygCJYzoizhi/AYSIJFEn4cSfhbrD/8LJvD0p4Re/Fcx3tQPUEsDBBQAAAAIAAAAK12kaqG5MQoAAGoiAAAWAAAAYXBwcm92YWxfZW5naW5lL2FwaS5wecVZbXPbuBH+rl+B44eGvJFl2fHddNQqM0msJO5d7dRW2rlqNByIhCwkFMkSoHOK6/9+uwBIAiRly532qvEkJIhdPNh3LDzP+zCffySiLNY0YiNykcoiEzmLJM9SQtOYJHzNol2UMLItJcXhP5GU3bGCUBKziAsYGXmeNxisi2xLwnBdyrJgYUj4Ns8KCUzSTBOKwcCMfRZZqufLXc7T22ru63Q3JG9pktBVwgzHES3lpp4AzyyVPKIyK4bknKW710nSGr2I8UXuDD0riqwQNYc8L7I7msxwdEjeZcWKx0BgJgvgwKq5s/SWp4Dj3dX1m4vz89lleD57e3FzcXUZ/jT75YZMCRB9Y6lg0r/32BokJb0h8Sq54DNsJvuqB9Od9xAMBoOYrUlYMBqHKAefpXe8yNIJiXkkF0ICKpDDMiBHr1pDkwGBnyx2+gF/CUtvQTxTwlNZcRrdAh7v7dXlfHY5D3+eXb6ff/ACkhVkHChC9mvEckn8+S5nRg5/p0mpnwNCBc5o1igoF8wVnO/xFJ55TKIslSBuAwSWUXIEekXO1xXCP5MxIjBvr8jpDz+S78nJ+PTsiYUK9q+SCUlWWbwjXBCZZSShxS3zgtYS0ykZW8wY2GFK7h8GmvVXEJIR0ML7Km75iKd5Kb3lCFXhax42Sx9oAvLd1LB/AqYsyhTsj8XEBtxgBCdAEPvwOUqNqaSAFq1jlGQ0FghlBFaVxcz3Srk++qMXuKr8lHL8eq7mGJ0q+r/cXF1ao8/ULrLo0SluBiw8FZKmEfMR71DZavAEX+RHstVncBQlJ16w2MjIyAN5VT5ChWCFDGG1sHIpP6c7FMkEHUK5yGWWskkFzAJlJnZwrWgMst3n0n8g6MyGNqiJgDXQNUyaDV6XEGu2Wrj+unb9I7GhORjDF7YTYED0CwPI9wKiCot9YBU8eA33NTjGHTogeDExa4/UgPADd9Femaipxh6SPVJIuLClgEtyybbWigcshBQYwaIEvqJuNY1SVshTLsPQr7kIlqyH9RtTsXRiYmozTu3YPXEDPPm30i6oC/9raL4fWl6kjCjMWSFgh0A6AcfLElQxTYQhahlKhW6kQanAoCK989FBBnPcd/jryz5+4DLp4gNO3cFBLUdukpevxEf2JIchEVGWgzhhRG2uynnNBitGsF53O/Yb8x3FO0kEq4Pw9af5h6vri3++noObWGYbVLvzFRjHW6rVR7A7Cpv+bmpL3Iz2+VOdkH0vgtwJdYbhEGdMqMCzpTLaELmBXEBNdCEqbVvQTDCpUAwsM0WuYKZPiVdSMP6CiRzqFpBzVZQoYaMvLVY7ycSy2cKWyU0WN0lGC/B69rdPs5t5+NcZyPAc64D3s7kXjMoclG8ZS05VFndoP76efwgvLt9d6eTtHXv1dCddKGODEqsUQ50ljaxjLnKUla+hDdUi9Z6btU0OcUJ1J030LALfRxsp87AahxoIab2J+gRpFaJ9iKkHtr1lQlBI2spkffgePLQBNDXIIaufnZ7aK3plCvAjXAXU5D2xYm90Q8a2RlRUrPJwXG5zoaaAcUAYDzGyT+cFBF4waiczDyzElhG5brb27vWGHsj9i6ufXqDT6AEolc7GY4jk4A0vZtfXV9cvHryhQ7xw3vAH9Z4uxI6wqFOFZ54n6N6ws2OdxoePUP2sy7ehkhUWP1UKDFpky+a1424LQ7Rs/K22Qe1v2hKVRrQ5msfHamBZ5glbQH07bH21nA+EpzwIspnvHW8YTeTmG0rh+O6kfg3Ugaby06l2xVYM0hs5HY/RtrQ+0LiyL97DnsWwetzVa5m3A5bCkAXmSdzAaEaNS1kBQqOj2rv1pIUnog3b0jAqiwKU6C3Vqn5HzfX8JuHAXHAzDKd70pTDxIVh481Kucp+VXC7aJUsfRAmikyDV1b9w/hlAPLt4HQF3iICB6d3lCfavftoMQX0k8I+jyA6xKU61x6pTy0eXfWi2lClRnrHBtwBmkX51HncmLb2SBVgJ9kKgs+dna8seSnbe8QkwBHYbQGcdfDZCzuigCBivz9eWdBUcBQ0xH6ojsEuoJC796Dk3KJ+wB0LuWJUHmUFqAIOkBFPuApUPU5WbUcbmlLC/0EHe8y8DbLeWgfhx6ubZ0NkWy4PxIdTw3r1RxBWzLsy7EHYLiEfAxuBU8m2OM1BttvscKeteBpjF2iqCHTxY8Z06XP/4OJaVyR6Lo3ARTx1Vq/rTlGqU+akEyg6ZWbFSnEh21I0JSazi344zRmmrV3CebYVxbUwuoHYLNWNXs2+1bkbNlBtvDsXOz3N/OoUrX1NU530pPo8zsOY3zIhpw1xM9hXHeBXNJ4pHqh8lwrHIeepM1a7RMDfptxS9H/sJybWis54zaBLX9lVyGOLmsdtnHvc42SIWhlREWLJ4NTZhRSgLcQPkbXgOaRwqMcFFEtSPdquowshoAjIqyl5qVxGvS/GS+U0dyeeNXiiBxsfc63P2pNCgCSny9YGhKy/vZws22avukg458kAiL8nnRb9smXMjhhbUQZ1YG0i6JGvwan3MSULL0oo35rK5HcHrBZ3IO8HCosWnIku1J7AqIifERz1Qzs64u+p0Ii/bnyhcRwi3l03xODP2nDXs2zsVZTsnwVnpLLALtLUOgHVpPXXznmonxu746oggR2vpzUXe7SfLi84FAg57EbCyaahdMe7tI9bSX90ULKxjaJgd9kXdrBNHGC/it/hFqwJnu11osRKnsX/RegNyy76A/P8Yxut2dt7HVqJUZQRnu6zIsQs8FjEgcN2uT1858+qcgzv7r7snpdrmrpbnuJ5EipOHunT+S0ewh66aJSMOp0wvWzVOBSEEsML073i1fjJ/0Y/BsJ/GHDcegVU9UjZoeabnoyb/q3RPkIndXtwNI7wJJjqAhjkpHI+S2PxlcsN5Hqs7bKCfwN19nYBzsZnTocJm0VrqLJit7sE41AYQr1oblGtQ8zzGCG+B3P3gV1KLWuQ7QR7c3q/dgNFDTRNFPWKDap2F6WvjW5a6JUI1OlLsWkme2/gPKH6r0IeSYhCKRyZD+rIeJ53kR6Zdhz5x837C7JhCfi3unZAfkJdGSsRqYu5VotNl76dxpoq/M01IDqVAqpO+CvDzZg1cGy6C+0e7MQIsTEgq9OqtWB9sm4KJyR8g01fdTFoTWndtE7qHhrOewS0N7Z6EB5gvP4lvJlfX1y+RyMx37QxAQ9HVTazxnbr682etv3S3GDULBSV7ingyTGG6DvRnW2tXqVUfF8i6cLq6bXampqHaeTt5QT/LJd99zAOghFYO3io71fNXjMO8V5bCxNlghUyKHz0OeMpZosmULvITJJAEzIX5O5iUMTDnyn9A3h0LiJ139q+g1Vrd69hq+swbRw9N2K69YlhbELUrcG+66jQxGl9B1rxUdfTmge4KFc3SEcniseqWdFYSYoX7W40y0o5dPk3L8Pac1ohC4gGhzBYTNKl/XGRWocWi9dvUEsDBBQAAAAIAAAAK13bNwR7VgUAAG4OAAAYAAAAYXBwcm92YWxfZW5naW5lL2F1ZGl0LnB5jVdNj9s2EL37VxDqoVLq1aZbFChcuMAmDdCiRRMkW/Sw
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"apiVersion": "networking.k8s.io/v1",
|
||
|
|
"kind": "NetworkPolicy",
|
||
|
|
"metadata": {
|
||
|
|
"name": "factory-audit-20260911104152-94aced",
|
||
|
|
"namespace": "approval-engine",
|
||
|
|
"labels": {
|
||
|
|
"app.kubernetes.io/name": "approval-engine",
|
||
|
|
"railiance.io/factory-audit-probe": "factory-audit-20260911104152-94aced"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"spec": {
|
||
|
|
"podSelector": {
|
||
|
|
"matchLabels": {
|
||
|
|
"railiance.io/factory-audit-probe": "factory-audit-20260911104152-94aced"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"policyTypes": [
|
||
|
|
"Ingress",
|
||
|
|
"Egress"
|
||
|
|
],
|
||
|
|
"ingress": [],
|
||
|
|
"egress": [
|
||
|
|
{
|
||
|
|
"to": [
|
||
|
|
{
|
||
|
|
"namespaceSelector": {
|
||
|
|
"matchLabels": {
|
||
|
|
"kubernetes.io/metadata.name": "audit-core"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"podSelector": {
|
||
|
|
"matchLabels": {
|
||
|
|
"app.kubernetes.io/name": "audit-core",
|
||
|
|
"app.kubernetes.io/component": "receiver"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"ports": [
|
||
|
|
{
|
||
|
|
"protocol": "TCP",
|
||
|
|
"port": 8080
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"to": [
|
||
|
|
{
|
||
|
|
"namespaceSelector": {
|
||
|
|
"matchLabels": {
|
||
|
|
"kubernetes.io/metadata.name": "kube-system"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"podSelector": {
|
||
|
|
"matchLabels": {
|
||
|
|
"k8s-app": "kube-dns"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"ports": [
|
||
|
|
{
|
||
|
|
"protocol": "UDP",
|
||
|
|
"port": 53
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"protocol": "TCP",
|
||
|
|
"port": 53
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"apiVersion": "batch/v1",
|
||
|
|
"kind": "Job",
|
||
|
|
"metadata": {
|
||
|
|
"name": "factory-audit-20260911104152-94aced",
|
||
|
|
"namespace": "approval-engine",
|
||
|
|
"labels": {
|
||
|
|
"app.kubernetes.io/name": "approval-engine",
|
||
|
|
"railiance.io/factory-audit-probe": "factory-audit-20260911104152-94aced"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"spec": {
|
||
|
|
"backoffLimit": 0,
|
||
|
|
"activeDeadlineSeconds": 150,
|
||
|
|
"ttlSecondsAfterFinished": 3600,
|
||
|
|
"template": {
|
||
|
|
"metadata": {
|
||
|
|
"labels": {
|
||
|
|
"app.kubernetes.io/name": "approval-engine",
|
||
|
|
"railiance.io/factory-audit-probe": "factory-audit-20260911104152-94aced"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"spec": {
|
||
|
|
"restartPolicy": "Never",
|
||
|
|
"automountServiceAccountToken": false,
|
||
|
|
"securityContext": {
|
||
|
|
"runAsNonRoot": true,
|
||
|
|
"runAsUser": 10001,
|
||
|
|
"runAsGroup": 10001,
|
||
|
|
"fsGroup": 10001,
|
||
|
|
"seccompProfile": {
|
||
|
|
"type": "RuntimeDefault"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"containers": [
|
||
|
|
{
|
||
|
|
"name": "probe",
|
||
|
|
"image": "forgejo.coulomb.social/coulomb/approval-engine@sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49",
|
||
|
|
"imagePullPolicy": "IfNotPresent",
|
||
|
|
"command": [
|
||
|
|
"python",
|
||
|
|
"-I",
|
||
|
|
"/probe/producer.py"
|
||
|
|
],
|
||
|
|
"securityContext": {
|
||
|
|
"allowPrivilegeEscalation": false,
|
||
|
|
"readOnlyRootFilesystem": true,
|
||
|
|
"capabilities": {
|
||
|
|
"drop": [
|
||
|
|
"ALL"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"resources": {
|
||
|
|
"requests": {
|
||
|
|
"cpu": "25m",
|
||
|
|
"memory": "64Mi"
|
||
|
|
},
|
||
|
|
"limits": {
|
||
|
|
"cpu": "500m",
|
||
|
|
"memory": "192Mi"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"volumeMounts": [
|
||
|
|
{
|
||
|
|
"name": "probe",
|
||
|
|
"mountPath": "/probe",
|
||
|
|
"readOnly": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "audit",
|
||
|
|
"mountPath": "/credential",
|
||
|
|
"readOnly": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "state",
|
||
|
|
"mountPath": "/state"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"volumes": [
|
||
|
|
{
|
||
|
|
"name": "probe",
|
||
|
|
"configMap": {
|
||
|
|
"name": "factory-audit-20260911104152-94aced",
|
||
|
|
"defaultMode": 292
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "audit",
|
||
|
|
"secret": {
|
||
|
|
"secretName": "approval-engine-audit",
|
||
|
|
"defaultMode": 288,
|
||
|
|
"items": [
|
||
|
|
{
|
||
|
|
"key": "audit-token",
|
||
|
|
"path": "token"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "state",
|
||
|
|
"emptyDir": {
|
||
|
|
"sizeLimit": "32Mi"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"apiVersion": "v1",
|
||
|
|
"kind": "ConfigMap",
|
||
|
|
"metadata": {
|
||
|
|
"name": "factory-audit-20260911104152-94aced",
|
||
|
|
"namespace": "informed-decision",
|
||
|
|
"labels": {
|
||
|
|
"app.kubernetes.io/name": "informed-decision",
|
||
|
|
"railiance.io/factory-audit-probe": "factory-audit-20260911104152-94aced"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"immutable": true,
|
||
|
|
"data": {
|
||
|
|
"producer.py": "\"\"\"Bounded synthetic audit probe; credentials stay in the producer process.\"\"\"\nimport hashlib\nimport json\nimport os\nfrom pathlib import Path\nimport sqlite3\nimport subprocess\nimport sys\nimport time\nfrom datetime import datetime, timezone, timedelta\nfrom urllib.error import HTTPError, URLError\nfrom urllib.parse import urlencode\nfrom urllib.request import Request, build_opener, ProxyHandler, HTTPRedirectHandler\n\n\nclass Refused(Exception):\n pass\n\n\ndef require(value, code):\n if not value:\n raise Refused(code)\n\n\nclass NoRedirect(HTTPRedirectHandler):\n def redirect_request(self, *args):\n return None\n\n\ndef http(config, method, path, *, body=None, event_id=None, invalid_token=False):\n token = 'deliberately-invalid-native-probe' if invalid_token else Path('/credential/token').read_text().strip()\n headers = {'Authorization': 'Bearer '+token, 'Content-Type': 'application/json'}\n if event_id:\n headers['Idempotency-Key'] = event_id\n request = Request(config['origin']+path, data=body, headers=headers, method=method)\n opener = build_opener(ProxyHandler({}), NoRedirect())\n try:\n response = opener.open(request, timeout=5)\n except HTTPError as exc:\n response = exc\n with response:\n raw = response.read(262145)\n require(len(raw) <= 262144, 'response_too_large')\n return response.status, json.loads(raw)\n\n\ndef bootstrap(config, dbpath, envelope):\n # Seed only a disposable synthetic outbox, never an approval or disposition.\n # This exercises recovery/delivery, not domain-transaction atomicity.\n if config['sender'] == 'approval-engine':\n from approval_engine.store import Engine\n engine = Engine(dbpath)\n payload = {'schema_version':'audit-core.event.v1alpha1', 'event_id':envelope['id'],\n 'observed_at':envelope['occurred_at'], 'tenant':'tenant:platform',\n 'scope':'synthetic-audit-acceptance', 'source':'approval-engine',\n 'actor':None, 'action':envelope['type'], 'resource':envelope['subject'],\n 'outcome':'probe', 'reason':'synthetic sender verification',\n 'details':dict(envelope['data'], approval_id=envelope['correlation_id'])}\n from approval_engine.audit import audit_envelope\n envelope = audit_envelope(payload)\n engine.close()\n with sqlite3.connect(dbpath) as db:\n require(db.execute('SELECT COUNT(*) FROM approvals').fetchone()[0] == 0, 'unexpected_approval')\n db.execute('INSERT INTO outbox(event_id,class,approval_id,payload_json,created_at) VALUES(?,?,?,?,?)',\n (envelope['id'], envelope['type'], None, json.dumps(payload, sort_keys=True), envelope['occurred_at']))\n else:\n from informed_decision.store import Store\n Store(dbpath)\n with sqlite3.connect(dbpath) as db:\n db.execute('INSERT INTO evidence VALUES(?,?,?,?,?)',\n (envelope['id'], envelope['type'], envelope['occurred_at'], json.dumps(envelope,sort_keys=True), '{}'))\n db.execute('INSERT INTO outbox(id) VALUES(?)', (envelope['id'],))\n return envelope\n\n\ndef delivery_phase(config, phase, dbpath, receipt):\n observed = receipt.setdefault(\"observed_http_statuses\", [])\n lose = phase == 'lost-receipt'\n if config['sender'] == 'approval-engine':\n from approval_engine.store import Engine\n from approval_engine.audit import AuditCoreSink\n real = build_opener(ProxyHandler({}), NoRedirect())\n def opened(request, timeout):\n response = real.open(request, timeout=timeout)\n observed.append(response.status)\n if lose:\n response.close()\n raise URLError('injected receipt loss after native response')\n return response\n engine = Engine(dbpath)\n pending = engine.undrained()\n require(len(pending) == 1 and pending[0]['event_id']
|
||
|
|
"config.json": "{\"event_id\": \"factory-audit-20260911104152-94aced-informed-decision\", \"origin\": \"http://audit-core.audit-core.svc.cluster.local:8080\", \"run_id\": \"factory-audit-20260911104152-94aced\", \"sender\": \"informed-decision\", \"source_zip_sha256\": \"114215406400f6f5728520bf3d7dc2b7a4ff410784b80201b7a5ae24259f64c0\"}"
|
||
|
|
},
|
||
|
|
"binaryData": {
|
||
|
|
"source.zip": "UEsDBBQAAAAIAAAAK10Z4IOs+QAAACMCAAAbAAAAYXBwcm92YWxfZW5naW5lL19faW5pdF9fLnB5ZZFBTgMxDEX3OYWVFUilN2CBoJXYoEqIFUJRZuIZglJ7lGS65hCckJOQTmKgbXb/fdvxT7TWdpoiH2y4QRo9IXx/fsHucQcDR8jvCOIDdx/Y57XWWqkh8h7WnSfnaQS/nzhmaNI4P2LKK+gtMfneBtOc1oYxckzSdaWgnLt2y+borRZ0zzQE3+eqHuapCJuxVmIr2nLsvHNIVT5x3vJMrqrnzBFfyB6sD7YLWGkBcwlGeRnnBJapPaZU667bquk4QTbdLA+klDE2BGPgFl6XXl0NXSfpkygCJYzoizhi/AYSIJFEn4cSfhbrD/8LJvD0p4Re/Fcx3tQPUEsDBBQAAAAIAAAAK12kaqG5MQoAAGoiAAAWAAAAYXBwcm92YWxfZW5naW5lL2FwaS5wecVZbXPbuBH+rl+B44eGvJFl2fHddNQqM0msJO5d7dRW2rlqNByIhCwkFMkSoHOK6/9+uwBIAiRly532qvEkJIhdPNh3LDzP+zCffySiLNY0YiNykcoiEzmLJM9SQtOYJHzNol2UMLItJcXhP5GU3bGCUBKziAsYGXmeNxisi2xLwnBdyrJgYUj4Ns8KCUzSTBOKwcCMfRZZqufLXc7T22ru63Q3JG9pktBVwgzHES3lpp4AzyyVPKIyK4bknKW710nSGr2I8UXuDD0riqwQNYc8L7I7msxwdEjeZcWKx0BgJgvgwKq5s/SWp4Dj3dX1m4vz89lleD57e3FzcXUZ/jT75YZMCRB9Y6lg0r/32BokJb0h8Sq54DNsJvuqB9Od9xAMBoOYrUlYMBqHKAefpXe8yNIJiXkkF0ICKpDDMiBHr1pDkwGBnyx2+gF/CUtvQTxTwlNZcRrdAh7v7dXlfHY5D3+eXb6ff/ACkhVkHChC9mvEckn8+S5nRg5/p0mpnwNCBc5o1igoF8wVnO/xFJ55TKIslSBuAwSWUXIEekXO1xXCP5MxIjBvr8jpDz+S78nJ+PTsiYUK9q+SCUlWWbwjXBCZZSShxS3zgtYS0ykZW8wY2GFK7h8GmvVXEJIR0ML7Km75iKd5Kb3lCFXhax42Sx9oAvLd1LB/AqYsyhTsj8XEBtxgBCdAEPvwOUqNqaSAFq1jlGQ0FghlBFaVxcz3Srk++qMXuKr8lHL8eq7mGJ0q+r/cXF1ao8/ULrLo0SluBiw8FZKmEfMR71DZavAEX+RHstVncBQlJ16w2MjIyAN5VT5ChWCFDGG1sHIpP6c7FMkEHUK5yGWWskkFzAJlJnZwrWgMst3n0n8g6MyGNqiJgDXQNUyaDV6XEGu2Wrj+unb9I7GhORjDF7YTYED0CwPI9wKiCot9YBU8eA33NTjGHTogeDExa4/UgPADd9Femaipxh6SPVJIuLClgEtyybbWigcshBQYwaIEvqJuNY1SVshTLsPQr7kIlqyH9RtTsXRiYmozTu3YPXEDPPm30i6oC/9raL4fWl6kjCjMWSFgh0A6AcfLElQxTYQhahlKhW6kQanAoCK989FBBnPcd/jryz5+4DLp4gNO3cFBLUdukpevxEf2JIchEVGWgzhhRG2uynnNBitGsF53O/Yb8x3FO0kEq4Pw9af5h6vri3++noObWGYbVLvzFRjHW6rVR7A7Cpv+bmpL3Iz2+VOdkH0vgtwJdYbhEGdMqMCzpTLaELmBXEBNdCEqbVvQTDCpUAwsM0WuYKZPiVdSMP6CiRzqFpBzVZQoYaMvLVY7ycSy2cKWyU0WN0lGC/B69rdPs5t5+NcZyPAc64D3s7kXjMoclG8ZS05VFndoP76efwgvLt9d6eTtHXv1dCddKGODEqsUQ50ljaxjLnKUla+hDdUi9Z6btU0OcUJ1J030LALfRxsp87AahxoIab2J+gRpFaJ9iKkHtr1lQlBI2spkffgePLQBNDXIIaufnZ7aK3plCvAjXAXU5D2xYm90Q8a2RlRUrPJwXG5zoaaAcUAYDzGyT+cFBF4waiczDyzElhG5brb27vWGHsj9i6ufXqDT6AEolc7GY4jk4A0vZtfXV9cvHryhQ7xw3vAH9Z4uxI6wqFOFZ54n6N6ws2OdxoePUP2sy7ehkhUWP1UKDFpky+a1424LQ7Rs/K22Qe1v2hKVRrQ5msfHamBZ5glbQH07bH21nA+EpzwIspnvHW8YTeTmG0rh+O6kfg3Ugaby06l2xVYM0hs5HY/RtrQ+0LiyL97DnsWwetzVa5m3A5bCkAXmSdzAaEaNS1kBQqOj2rv1pIUnog3b0jAqiwKU6C3Vqn5HzfX8JuHAXHAzDKd70pTDxIVh481Kucp+VXC7aJUsfRAmikyDV1b9w/hlAPLt4HQF3iICB6d3lCfavftoMQX0k8I+jyA6xKU61x6pTy0eXfWi2lClRnrHBtwBmkX51HncmLb2SBVgJ9kKgs+dna8seSnbe8QkwBHYbQGcdfDZCzuigCBivz9eWdBUcBQ0xH6ojsEuoJC796Dk3KJ+wB0LuWJUHmUFqAIOkBFPuApUPU5WbUcbmlLC/0EHe8y8DbLeWgfhx6ubZ0NkWy4PxIdTw3r1RxBWzLsy7EHYLiEfAxuBU8m2OM1BttvscKeteBpjF2iqCHTxY8Z06XP/4OJaVyR6Lo3ARTx1Vq/rTlGqU+akEyg6ZWbFSnEh21I0JSazi344zRmmrV3CebYVxbUwuoHYLNWNXs2+1bkbNlBtvDsXOz3N/OoUrX1NU530pPo8zsOY3zIhpw1xM9hXHeBXNJ4pHqh8lwrHIeepM1a7RMDfptxS9H/sJybWis54zaBLX9lVyGOLmsdtnHvc42SIWhlREWLJ4NTZhRSgLcQPkbXgOaRwqMcFFEtSPdquowshoAjIqyl5qVxGvS/GS+U0dyeeNXiiBxsfc63P2pNCgCSny9YGhKy/vZws22avukg458kAiL8nnRb9smXMjhhbUQZ1YG0i6JGvwan3MSULL0oo35rK5HcHrBZ3IO8HCosWnIku1J7AqIifERz1Qzs64u+p0Ii/bnyhcRwi3l03xODP2nDXs2zsVZTsnwVnpLLALtLUOgHVpPXXznmonxu746oggR2vpzUXe7SfLi84FAg57EbCyaahdMe7tI9bSX90ULKxjaJgd9kXdrBNHGC/it/hFqwJnu11osRKnsX/RegNyy76A/P8Yxut2dt7HVqJUZQRnu6zIsQs8FjEgcN2uT1858+qcgzv7r7snpdrmrpbnuJ5EipOHunT+S0ewh66aJSMOp0wvWzVOBSEEsML073i1fjJ/0Y/BsJ/GHDcegVU9UjZoeabnoyb/q3RPkIndXtwNI7wJJjqAhjkpHI+S2PxlcsN5Hqs7bKCfwN19nYBzsZnTocJm0VrqLJit7sE41AYQr1oblGtQ8zzGCG+B3P3gV1KLWuQ7QR7c3q/dgNFDTRNFPWKDap2F6WvjW5a6JUI1OlLsWkme2/gPKH6r0IeSYhCKRyZD+rIeJ53kR6Zdhz5x837C7JhCfi3unZAfkJdGSsRqYu5VotNl76dxpoq/M01IDqVAqpO+CvDzZg1cGy6C+0e7MQIsTEgq9OqtWB9sm4KJyR8g01fdTFoTWndtE7qHhrOewS0N7Z6EB5gvP4lvJlfX1y+RyMx37QxAQ9HVTazxnbr682etv3S3GDULBSV7ingyTGG6DvRnW2tXqVUfF8i6cLq6bXampqHaeTt5QT/LJd99zAOghFYO3io71fNXjMO8V5bCxNlghUyKHz0OeMpZosmULvITJJAEzIX5O5iUMTDnyn9A3h0LiJ139q+g1Vrd69hq+swbRw9N2K69YlhbELUrcG+66jQxGl9B1rxUdfTmge4KFc3SEcniseqWdFYSYoX7W40y0o5dPk3L8Pac1ohC4gGhzBYTNKl/XGRWocWi9dvUEsDBBQAAAAIAAAAK13bNwR7VgUAAG4OAAAYAAAAYXBwcm92YWxfZW5naW5lL2F1ZGl0LnB5jVdNj9s2EL37VxDqoVLq1aZbFChcuMAmDdCiRRMkW/Sw
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"apiVersion": "networking.k8s.io/v1",
|
||
|
|
"kind": "NetworkPolicy",
|
||
|
|
"metadata": {
|
||
|
|
"name": "factory-audit-20260911104152-94aced",
|
||
|
|
"namespace": "informed-decision",
|
||
|
|
"labels": {
|
||
|
|
"app.kubernetes.io/name": "informed-decision",
|
||
|
|
"railiance.io/factory-audit-probe": "factory-audit-20260911104152-94aced"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"spec": {
|
||
|
|
"podSelector": {
|
||
|
|
"matchLabels": {
|
||
|
|
"railiance.io/factory-audit-probe": "factory-audit-20260911104152-94aced"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"policyTypes": [
|
||
|
|
"Ingress",
|
||
|
|
"Egress"
|
||
|
|
],
|
||
|
|
"ingress": [],
|
||
|
|
"egress": [
|
||
|
|
{
|
||
|
|
"to": [
|
||
|
|
{
|
||
|
|
"namespaceSelector": {
|
||
|
|
"matchLabels": {
|
||
|
|
"kubernetes.io/metadata.name": "audit-core"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"podSelector": {
|
||
|
|
"matchLabels": {
|
||
|
|
"app.kubernetes.io/name": "audit-core",
|
||
|
|
"app.kubernetes.io/component": "receiver"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"ports": [
|
||
|
|
{
|
||
|
|
"protocol": "TCP",
|
||
|
|
"port": 8080
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"to": [
|
||
|
|
{
|
||
|
|
"namespaceSelector": {
|
||
|
|
"matchLabels": {
|
||
|
|
"kubernetes.io/metadata.name": "kube-system"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"podSelector": {
|
||
|
|
"matchLabels": {
|
||
|
|
"k8s-app": "kube-dns"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"ports": [
|
||
|
|
{
|
||
|
|
"protocol": "UDP",
|
||
|
|
"port": 53
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"protocol": "TCP",
|
||
|
|
"port": 53
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"apiVersion": "batch/v1",
|
||
|
|
"kind": "Job",
|
||
|
|
"metadata": {
|
||
|
|
"name": "factory-audit-20260911104152-94aced",
|
||
|
|
"namespace": "informed-decision",
|
||
|
|
"labels": {
|
||
|
|
"app.kubernetes.io/name": "informed-decision",
|
||
|
|
"railiance.io/factory-audit-probe": "factory-audit-20260911104152-94aced"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"spec": {
|
||
|
|
"backoffLimit": 0,
|
||
|
|
"activeDeadlineSeconds": 150,
|
||
|
|
"ttlSecondsAfterFinished": 3600,
|
||
|
|
"template": {
|
||
|
|
"metadata": {
|
||
|
|
"labels": {
|
||
|
|
"app.kubernetes.io/name": "informed-decision",
|
||
|
|
"railiance.io/factory-audit-probe": "factory-audit-20260911104152-94aced"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"spec": {
|
||
|
|
"restartPolicy": "Never",
|
||
|
|
"automountServiceAccountToken": false,
|
||
|
|
"securityContext": {
|
||
|
|
"runAsNonRoot": true,
|
||
|
|
"runAsUser": 10001,
|
||
|
|
"runAsGroup": 10001,
|
||
|
|
"fsGroup": 10001,
|
||
|
|
"seccompProfile": {
|
||
|
|
"type": "RuntimeDefault"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"containers": [
|
||
|
|
{
|
||
|
|
"name": "probe",
|
||
|
|
"image": "forgejo.coulomb.social/coulomb/approval-engine@sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49",
|
||
|
|
"imagePullPolicy": "IfNotPresent",
|
||
|
|
"command": [
|
||
|
|
"python",
|
||
|
|
"-I",
|
||
|
|
"/probe/producer.py"
|
||
|
|
],
|
||
|
|
"securityContext": {
|
||
|
|
"allowPrivilegeEscalation": false,
|
||
|
|
"readOnlyRootFilesystem": true,
|
||
|
|
"capabilities": {
|
||
|
|
"drop": [
|
||
|
|
"ALL"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"resources": {
|
||
|
|
"requests": {
|
||
|
|
"cpu": "25m",
|
||
|
|
"memory": "64Mi"
|
||
|
|
},
|
||
|
|
"limits": {
|
||
|
|
"cpu": "500m",
|
||
|
|
"memory": "192Mi"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"volumeMounts": [
|
||
|
|
{
|
||
|
|
"name": "probe",
|
||
|
|
"mountPath": "/probe",
|
||
|
|
"readOnly": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "audit",
|
||
|
|
"mountPath": "/credential",
|
||
|
|
"readOnly": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "state",
|
||
|
|
"mountPath": "/state"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"volumes": [
|
||
|
|
{
|
||
|
|
"name": "probe",
|
||
|
|
"configMap": {
|
||
|
|
"name": "factory-audit-20260911104152-94aced",
|
||
|
|
"defaultMode": 292
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "audit",
|
||
|
|
"secret": {
|
||
|
|
"secretName": "informed-decision-audit",
|
||
|
|
"defaultMode": 288,
|
||
|
|
"items": [
|
||
|
|
{
|
||
|
|
"key": "token",
|
||
|
|
"path": "token"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"name": "state",
|
||
|
|
"emptyDir": {
|
||
|
|
"sizeLimit": "32Mi"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|