docs: accept native factory audit sender delivery
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
codex
parent
47223007ba
commit
1ec5b587db
5 changed files with 179 additions and 11 deletions
|
|
@ -120,6 +120,23 @@ verification:
|
|||
docs/evidence/2026-09-11-factory-audit-sender-seed.json.'
|
||||
- 'Status applied: native ESO delivery, scope verification, receiver reload and
|
||||
producer acceptance remain.'
|
||||
- at: '2026-09-11T08:30:43+00:00'
|
||||
actor: codex via attended user platform-admin
|
||||
kind: factory_audit_native_delivery
|
||||
result: passed
|
||||
details:
|
||||
- Fresh attended retry completed in 28 seconds; wrapper exit 0 and session self-revocation
|
||||
confirmed. Both exact projections are ESO-owned and match independent version-1
|
||||
custody.
|
||||
- Native readers denied sibling, registry, metadata and listing access. Wrong
|
||||
service account and namespace login failed; disallowed store namespace created
|
||||
no Secret. Coding-agent deny boundary prevailed. Temporary readers revoked and
|
||||
namespace deletion verified.
|
||||
- 'Registry version 8 was delivered exactly before Audit Core reload. Receiver
|
||||
c82e0442 is Ready and operational/durable. Receipt: docs/evidence/2026-09-11-factory-audit-delivery-live.json.'
|
||||
- Status remains applied pending native producer accepted/duplicate, source/tenant/read-refusal
|
||||
and bearer-revocation evidence. Reader-session revocation does not revoke audit
|
||||
bearer credentials.
|
||||
lifecycle:
|
||||
deactivate: Stop the exact producer; remove only its admitted token from the registry
|
||||
using CAS and reload/verify receiver refusal. Then detach its reader policy and
|
||||
|
|
|
|||
|
|
@ -121,6 +121,23 @@ verification:
|
|||
docs/evidence/2026-09-11-factory-audit-sender-seed.json.'
|
||||
- 'Status applied: native ESO delivery, scope verification, receiver reload and
|
||||
producer acceptance remain.'
|
||||
- at: '2026-09-11T08:30:43+00:00'
|
||||
actor: codex via attended user platform-admin
|
||||
kind: factory_audit_native_delivery
|
||||
result: passed
|
||||
details:
|
||||
- Fresh attended retry completed in 28 seconds; wrapper exit 0 and session self-revocation
|
||||
confirmed. Both exact projections are ESO-owned and match independent version-1
|
||||
custody.
|
||||
- Native readers denied sibling, registry, metadata and listing access. Wrong
|
||||
service account and namespace login failed; disallowed store namespace created
|
||||
no Secret. Coding-agent deny boundary prevailed. Temporary readers revoked and
|
||||
namespace deletion verified.
|
||||
- 'Registry version 8 was delivered exactly before Audit Core reload. Receiver
|
||||
c82e0442 is Ready and operational/durable. Receipt: docs/evidence/2026-09-11-factory-audit-delivery-live.json.'
|
||||
- Status remains applied pending native producer accepted/duplicate, source/tenant/read-refusal
|
||||
and bearer-revocation evidence. Reader-session revocation does not revoke audit
|
||||
bearer credentials.
|
||||
lifecycle:
|
||||
deactivate: Stop the exact producer; remove only its admitted token from the registry
|
||||
using CAS and reload/verify receiver refusal. Then detach its reader policy and
|
||||
|
|
|
|||
|
|
@ -54,14 +54,21 @@ workload or network permission. Its owner must supply that prerequisite.
|
|||
|
||||
## Current execution status
|
||||
|
||||
The compatible receiver c82e0442de0f is live and both namespaces exist. The
|
||||
attended retry seeded both independent version-1 credentials and advanced the
|
||||
registry with CAS 7→8, preserving existing senders and fields. Both CCRs are
|
||||
**applied**; Warden exited 0 and confirmed revocation for that session. See the
|
||||
[seed receipt](../evidence/2026-09-11-factory-audit-sender-seed.json). Delivery,
|
||||
receiver reload and producer acceptance remain distinct checks. The next attended
|
||||
delivery login failed before handoff (exit 5); no delivery mutation occurred.
|
||||
[Delivery return](../evidence/2026-09-11-factory-audit-delivery-login.json).
|
||||
Both independent version-1 credentials are provisioned and the authoritative
|
||||
registry advanced with CAS 7→8, preserving existing senders and fields. The
|
||||
fresh attended delivery retry completed at 2026-09-11 08:27 UTC: exact native
|
||||
reader/scope/namespace checks passed; both ESO projections are Ready and match
|
||||
custody; registry JSON matched before Audit Core reloaded. The temporary
|
||||
namespace is absent and Warden exited 0 with session revocation confirmed.
|
||||
The receiver is operational/durable and 1/1 Ready on c82e0442de0f.
|
||||
|
||||
Both CCRs remain **applied**, pending actual producer accepted/duplicate and
|
||||
receiver scope/read-refusal plus audit bearer-revocation acceptance. The
|
||||
completed reader-session revocation does not expire those audit bearers.
|
||||
See the [seed](../evidence/2026-09-11-factory-audit-sender-seed.json) and
|
||||
[native delivery](../evidence/2026-09-11-factory-audit-delivery-live.json) receipts.
|
||||
Earlier failed login receipts remain historical. Do not repeat provisioning
|
||||
or delivery for this unchanged successful result; continue producer acceptance.
|
||||
|
||||
## Executable sequence
|
||||
|
||||
|
|
|
|||
104
docs/evidence/2026-09-11-factory-audit-delivery-live.json
Normal file
104
docs/evidence/2026-09-11-factory-audit-delivery-live.json
Normal file
|
|
@ -0,0 +1,104 @@
|
|||
{
|
||||
"schema": "platform.factory-audit-delivery.v1",
|
||||
"status": "delivered_and_scope_verified_pending_producer_acceptance",
|
||||
"started_at": "2026-09-11T08:27:09.975750+00:00",
|
||||
"credential_values_emitted": false,
|
||||
"receiver_before": {
|
||||
"image": "forgejo.coulomb.social/coulomb/audit-core@sha256:c82e0442de0fd181342916ae9cd5d6de41d859e1efda637bd93936c67873afa5",
|
||||
"deployment_uid": "b85fe3d0-75c9-4e0d-8c34-c6f1df0881bb",
|
||||
"deployment_resource_version": "59807531",
|
||||
"pod_uid": "6642c414-a942-4b11-b048-267423e12da8",
|
||||
"capabilities": {
|
||||
"load_bearing": true,
|
||||
"redact": true,
|
||||
"write_only": true,
|
||||
"source_exact": true,
|
||||
"tenant_exact": true
|
||||
},
|
||||
"synthetic_probe_only": true,
|
||||
"credential_reads": 0
|
||||
},
|
||||
"lanes": [
|
||||
{
|
||||
"ccr": "CCR-2026-0021",
|
||||
"name": "approval-engine",
|
||||
"kv": "platform/data/workloads/approval-engine/audit-sender",
|
||||
"store": "openbao-approval-engine-audit",
|
||||
"secret": "approval-engine-audit",
|
||||
"secret_key": "audit-token",
|
||||
"reader_exact_path": true,
|
||||
"registry_and_sibling_denied": true,
|
||||
"metadata_and_listing_denied": true,
|
||||
"reader_ttl": 900,
|
||||
"reader_revocation_verified": true,
|
||||
"wrong_service_account_denied": true,
|
||||
"coding_agent_deny_wins": true,
|
||||
"external_secret_ready": true,
|
||||
"projection_matches": true,
|
||||
"secret_uid": "3e0f42a6-36b0-4094-8aac-9538fcdcb46f",
|
||||
"secret_resource_version": "59808872",
|
||||
"wrong_namespace_denied": true,
|
||||
"store_namespace_denied": true
|
||||
},
|
||||
{
|
||||
"ccr": "CCR-2026-0022",
|
||||
"name": "informed-decision",
|
||||
"kv": "platform/data/workloads/informed-decision/audit-sender",
|
||||
"store": "openbao-informed-decision-audit",
|
||||
"secret": "informed-decision-audit",
|
||||
"secret_key": "token",
|
||||
"reader_exact_path": true,
|
||||
"registry_and_sibling_denied": true,
|
||||
"metadata_and_listing_denied": true,
|
||||
"reader_ttl": 900,
|
||||
"reader_revocation_verified": true,
|
||||
"wrong_service_account_denied": true,
|
||||
"coding_agent_deny_wins": true,
|
||||
"external_secret_ready": true,
|
||||
"projection_matches": true,
|
||||
"secret_uid": "8bb040ec-e1ad-4c46-9f51-488d5db66c0c",
|
||||
"secret_resource_version": "59808881",
|
||||
"wrong_namespace_denied": true,
|
||||
"store_namespace_denied": true
|
||||
}
|
||||
],
|
||||
"phase": "namespace_verification",
|
||||
"check": "informed-decision:wrong_namespace",
|
||||
"registry_version": 8,
|
||||
"receiver_registry_matches": true,
|
||||
"receiver_secret_resource_version": "59808896",
|
||||
"receiver_after": {
|
||||
"image": "forgejo.coulomb.social/coulomb/audit-core@sha256:c82e0442de0fd181342916ae9cd5d6de41d859e1efda637bd93936c67873afa5",
|
||||
"deployment_uid": "b85fe3d0-75c9-4e0d-8c34-c6f1df0881bb",
|
||||
"deployment_resource_version": "59808967",
|
||||
"pod_uid": "4d0ee4e5-5427-43f1-94ca-88e5470c4831",
|
||||
"capabilities": {
|
||||
"load_bearing": true,
|
||||
"redact": true,
|
||||
"write_only": true,
|
||||
"source_exact": true,
|
||||
"tenant_exact": true
|
||||
},
|
||||
"synthetic_probe_only": true,
|
||||
"credential_reads": 0
|
||||
},
|
||||
"receiver_reloaded": true,
|
||||
"temporary_namespace": {
|
||||
"name": "factory-audit-check-731ba3bdf5",
|
||||
"uid": "794cbc75-291b-47e8-8df0-c62c27703cc8"
|
||||
},
|
||||
"namespace_cleanup_requested": true,
|
||||
"completed_at": "2026-09-11T08:27:37.299698+00:00",
|
||||
"namespace_cleanup_verified": true,
|
||||
"attended_wrapper_exit": 0,
|
||||
"attended_session_self_revocation": "confirmed_by_successful_wrapper",
|
||||
"readiness": {
|
||||
"status": "ok",
|
||||
"custody_class": "operational",
|
||||
"durable": true,
|
||||
"tamper_evidence": false,
|
||||
"recoverable_days": 30,
|
||||
"recoverable_source": "resource-control/data/capability/platform-audit-storage.json#provisions[capability=data.backup]",
|
||||
"recoverable_basis": "measured"
|
||||
}
|
||||
}
|
||||
|
|
@ -397,11 +397,11 @@ into this client-identity grant.
|
|||
|
||||
```task
|
||||
id: RPF-WP-0035-T08
|
||||
status: wait
|
||||
status: progress
|
||||
priority: high
|
||||
assignee: railiance-platform
|
||||
needs_human: true
|
||||
intervention_note: "Custody succeeded; fresh attended login for delivery failed before handoff. Need browser/MFA feedback and delivery login; do not reseed or reapprove CCR21/22."
|
||||
needs_human: false
|
||||
intervention_note: null
|
||||
state_hub_task_id: "0ef52c26-2669-5cd1-8149-b1f6fcdda6cb"
|
||||
```
|
||||
|
||||
|
|
@ -525,3 +525,26 @@ for this delivery identity act. Neither CCR review nor first provision reopens.
|
|||
Use the reviewed delivery command with a new receipt after login feedback.
|
||||
Actual producer ingestion/duplicate/refusal and bearer revocation acceptance
|
||||
remain open under AUDIT-WP-0009-T09/T11.
|
||||
|
||||
### Native delivery accepted — 2026-09-11 08:27 UTC
|
||||
|
||||
The user returned and requested another login attempt. It succeeded and the
|
||||
reviewed delivery command completed in 28 seconds. Both native ESO readers
|
||||
passed exact-path access and explicit sibling/registry/metadata/listing denials,
|
||||
wrong-SA/namespace refusal and the coding-agent deny check. Each 900-second
|
||||
reader session was revoked and lookup refusal verified. Both intended
|
||||
ExternalSecrets are Ready; exact producer value and ESO ownership match. The
|
||||
disallowed namespace produced an explicit store restriction and no Secret;
|
||||
the uniquely owned namespace is now absent.
|
||||
|
||||
Registry version 8 matches the delivered receiver JSON. Audit Core reloaded
|
||||
and remains 1/1 Ready on c82e0442de0f; /readyz reports operational/durable with
|
||||
tamper_evidence=false, as bounded by AUDIT-WP-0009-T12. Warden exited 0 and
|
||||
confirmed self-revocation for this successful session. Earlier failed login
|
||||
receipts remain historical and are not retroactively attested.
|
||||
|
||||
The login wait is cleared. T08 remains progress and CCR21/22 remain applied
|
||||
for native producer ingestion/duplicate/scope/read-refusal and bearer
|
||||
revocation acceptance under AUDIT T09/T11. No credentials were reseeded or
|
||||
rotated. No producer was deployed and no factory attempt or paid call ran.
|
||||
[Native delivery receipt](../docs/evidence/2026-09-11-factory-audit-delivery-live.json).
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue