Record independent INFD custody and failed-candidate recovery review
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
codex
parent
5b9c8262be
commit
4493360317
5 changed files with 145 additions and 0 deletions
|
|
@ -0,0 +1,43 @@
|
|||
{
|
||||
"review_id": "RPF-REVIEW-20261011-INFD-ACTUATOR-R1-CONDITIONAL",
|
||||
"work_record": "RPF-IN-0007",
|
||||
"role": "railiance-platform technical owner only",
|
||||
"status": "changes-required",
|
||||
"manifest_sha256": "653b68c3891c066f40d104bfc67a35da5e436605cd99afd52fbac4b47a9553fe",
|
||||
"source_bundle_sha256": "0a79eda40fe0954fd3828bf06fd6ccf149e294ac194bc6fe605e585b878fa8d3",
|
||||
"independently_rerun_tests": 12,
|
||||
"required_changes": [
|
||||
{
|
||||
"id": "RPF-INFD-EXEC-01",
|
||||
"source": "execution/native_program.py",
|
||||
"finding": "Rollback requires Running/ready candidate Pod and candidate exec before operation; unhealthy startup/readiness failure cannot recover.",
|
||||
"required": "Separate bounded rollback request from post-rollback verification. Request gates retain sealed Deployment/CM/PVC, exact same-schema source/image pair, node headroom, owner dryrun and Application CAS/scoped sync, without requiring candidate Ready/exec. Verify reverted image/Ready/schema/integrity afterward under an explicit recovery phase; no data snapshot restore or broader mutation."
|
||||
},
|
||||
{
|
||||
"id": "RPF-INFD-EXEC-02",
|
||||
"source": "execution/actuator.py::offline_verify",
|
||||
"finding": "Only pre-open read-only integrity proof exists; admin counters alone do not establish post-open integrity/schema/counts required by protocol.",
|
||||
"required": "Repeat exact read-only checker under same isolated UID10001 after admin; compare full frozen proof, retain original private snapshot digest unchanged, fail on any mismatch."
|
||||
},
|
||||
{
|
||||
"id": "RPF-INFD-EXEC-03",
|
||||
"source": "authority_journal.py / native_program.py / amended founder packet",
|
||||
"finding": "All phases including recovery are denied after execution deadline, while earlier packet describes expiry for unstarted release only.",
|
||||
"required": "Make recovery expiry semantics explicit in amended packet. Do not silently broaden authorization: either retain clearly disclosed bounded recovery deadline and stop for fresh recovery decision beyond it, or bind any allowed recovery-after-start semantics to exact persisted release attempt and fresh actual acceptance."
|
||||
}
|
||||
],
|
||||
"sound_boundaries": [
|
||||
"Nested exact founder/current native receipt bookkeeping remains supervised and expressly not authenticated autonomous grant.",
|
||||
"Four committed render blobs plus source HEAD, exact executor/input hashes and actual UID/CM/PVC seals; automatic:{} and source override refusal.",
|
||||
"Protected binarycopy byte/hash/size bounds, no raw snapshot output, networknone isolated newly labeled localvolume with confined initializer and UID10001 pre-Store checks.",
|
||||
"Fsynced RUNNING intent and no same-phase retry after uncertain/crash; Deployment-only manual Argo operation prunefalse via CAS, dispatch distinct from rollout completion."
|
||||
],
|
||||
"limits": {
|
||||
"native_action": false,
|
||||
"backup_export_restore": false,
|
||||
"credential_read": false,
|
||||
"founder_approval": false,
|
||||
"native_custody_proof": false,
|
||||
"other_owner_role": false
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
{
|
||||
"review_id": "RPF-REVIEW-20261011-INFD-ACTUATOR-R1-FINAL",
|
||||
"work_record": "RPF-IN-0007",
|
||||
"role": "railiance-platform technical owner only",
|
||||
"status": "technical-agreement-for-exact-helper-source",
|
||||
"manifest_sha256": "f2fad6c251fbb4420e07c1329802f521b513bbf66e51f64c5d673ef04f16284c",
|
||||
"source_bundle_sha256": "27d6d6d3133c963da1dde92d498d636617387c16e850a17c598148abc35c775d",
|
||||
"source_bundle_bytes": 85747,
|
||||
"paths": 23,
|
||||
"all_manifest_hashes_match": true,
|
||||
"independently_rerun_tests": 16,
|
||||
"additional_recovery_negative_cases": 5,
|
||||
"resolved": [
|
||||
"Rollback request requires sealed Deployment/CM/PVC/source/image pair/headroom/admission/CAS but no candidate Pod/readiness/database exec; distinct rollback-verify proves old-image Ready1/scoped succeeded operation/current schema5 integrity/counts.",
|
||||
"Offline UID10001/networknone post-admin checker repeats full readonly integrity/schema/count proof against frozen snapshot and verifies protected original hash unchanged.",
|
||||
"All phases including verification and recovery have explicit fixed expiry; no silent extension. A fresh founder decision is required beyond the deadline, and the resulting recovery-delay risk is disclosed in helper README."
|
||||
],
|
||||
"independent_probe": "refined-recovery-probes.json",
|
||||
"scope": "Exact bounded supervised helper source only; no final founder packet acceptance or runtime execution implied. Durable no-retry intent, protected binary copy/new confined offline volume, exact owner hash/source/UID custody gates and Deployment-only Argo CAS/manual prunefalse scope remain.",
|
||||
"before_first_human_post": [
|
||||
"Amend and validate exact hash-bound founder packet to include current helper bundle/plan, all four owner render inputs, confined UID0 initializer, separate rollback verification and explicit all-phase deadline with recovery-delay risk.",
|
||||
"Retain original78-path/initial11-path/conditional review evidence without backfilling approval."
|
||||
],
|
||||
"native_gates": [
|
||||
"Fresh root authenticated fixed-origin exact founder disposition per phase; bookkeeping files are not autonomous grants.",
|
||||
"Actual protected real-data backup/copy/offline restoration/fresh cutover snapshot remain unexecuted and required.",
|
||||
"Installed ten-variant checks use synthetic transport even on native placement; native_provider=false. Actual-provider/native binding acceptance remains a distinct T04 completion gate.",
|
||||
"Image request acknowledgment is not rollout completion; recovery acknowledgment is not recovered Ready/schema proof; uncertain outcomes retain evidence and refuse same-phase retries."
|
||||
],
|
||||
"limits": {
|
||||
"native_action": false,
|
||||
"backup_export_restore": false,
|
||||
"credentials_read": false,
|
||||
"founder_approval": false,
|
||||
"native_custody_proof": false,
|
||||
"native_provider_proof": false,
|
||||
"other_owner_role": false,
|
||||
"T04_complete": false
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
{
|
||||
"synthetic_transport_only": true,
|
||||
"native_action": false,
|
||||
"negative_recovery_cases": {
|
||||
"wrong_operation_revision": {
|
||||
"refused": true,
|
||||
"writes": 0
|
||||
},
|
||||
"prune_true": {
|
||||
"refused": true,
|
||||
"writes": 0
|
||||
},
|
||||
"extra_resource": {
|
||||
"refused": true,
|
||||
"writes": 0
|
||||
},
|
||||
"wrong_source": {
|
||||
"refused": true,
|
||||
"writes": 0
|
||||
},
|
||||
"recreated_application": {
|
||||
"refused": true,
|
||||
"writes": 0
|
||||
}
|
||||
},
|
||||
"unready_rollback_dispatches_once_without_pod_or_exec": true
|
||||
}
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
{
|
||||
"synthetic_transport_only": true,
|
||||
"native_action": false,
|
||||
"unready_same_schema_candidate_rollback_accepted": false,
|
||||
"rollback_patches_requested": 0,
|
||||
"unready_candidate_exec_calls": 0,
|
||||
"rollback_fail_class": "ValueError"
|
||||
}
|
||||
27
intakes/RPF-IN-0007-infd-purpose-actuator-review.md
Normal file
27
intakes/RPF-IN-0007-infd-purpose-actuator-review.md
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
---
|
||||
id: RPF-IN-0007
|
||||
kind: intake
|
||||
type: intake
|
||||
title: "Platform review of INFD protected custody and image release actuator"
|
||||
repo: railiance-platform
|
||||
lane: supervised
|
||||
status: closed
|
||||
owner: railiance-platform
|
||||
requested_by: the-custodian
|
||||
origin: handoff
|
||||
origin_ref: INFD-WP-0009
|
||||
priority: high
|
||||
created: "2026-10-11"
|
||||
updated: "2026-10-11"
|
||||
tags: [security, cross-owner, review]
|
||||
---
|
||||
|
||||
Review exact11-path execution source manifest `653b68c3891c066f40d104bfc67a35da5e436605cd99afd52fbac4b47a9553fe` and bundle `0a79eda40fe0954fd3828bf06fd6ccf149e294ac194bc6fe605e585b878fa8d3`, approval gate, private real-data custody, offline clone isolation, single-writer cutover, uncertain recovery, manual Argo scope and current-database rollback. Record precedes formal technical review. Synthetic verification only; no native backup/export/restore, mutation, credential read or founder approval is authorized.
|
||||
|
||||
## Completed initial source review
|
||||
|
||||
Absorbed into technical review `RPF-REVIEW-20261011-INFD-ACTUATOR-R1-CONDITIONAL`. Changes required: unhealthy-candidate rollback must not depend on candidate readiness/exec; offline restore must repeat integrity/schema/count proof after admin. Deadline/recovery semantics require explicit amended-packet agreement. Initial12tests passed but independent failure probe reproduced zero rollback dispatch for an unready candidate. Native work remains in INFD-WP-0009-T04; no native action/approval occurred. Completed record precedes formal review entry.
|
||||
|
||||
## Final exact helper review
|
||||
|
||||
Final technical agreement `RPF-REVIEW-20261011-INFD-ACTUATOR-R1-FINAL` covers helper manifest `f2fad6c251fbb4420e07c1329802f521b513bbf66e51f64c5d673ef04f16284c`,23paths, execution bundle `27d6d6d3133c963da1dde92d498d636617387c16e850a17c598148abc35c775d`. Sixteen synthetic tests independently pass; additional recovery probes reject wrong operation/source/UID/prune/resource scope and confirm unhealthy-candidate recovery request without Pod/exec. Original conditional evidence remains. Final founder packet must hash-bind this executor/four render inputs and explicitly disclose the all-phase deadline before submission; source agreement is not approval or native custody/provider evidence.
|
||||
Loading…
Add table
Add a link
Reference in a new issue