diff --git a/docs/evidence/2026-10-11-infd-purpose-actuator-owner-review/conditional-review.json b/docs/evidence/2026-10-11-infd-purpose-actuator-owner-review/conditional-review.json new file mode 100644 index 0000000..fbb1384 --- /dev/null +++ b/docs/evidence/2026-10-11-infd-purpose-actuator-owner-review/conditional-review.json @@ -0,0 +1,43 @@ +{ + "review_id": "RPF-REVIEW-20261011-INFD-ACTUATOR-R1-CONDITIONAL", + "work_record": "RPF-IN-0007", + "role": "railiance-platform technical owner only", + "status": "changes-required", + "manifest_sha256": "653b68c3891c066f40d104bfc67a35da5e436605cd99afd52fbac4b47a9553fe", + "source_bundle_sha256": "0a79eda40fe0954fd3828bf06fd6ccf149e294ac194bc6fe605e585b878fa8d3", + "independently_rerun_tests": 12, + "required_changes": [ + { + "id": "RPF-INFD-EXEC-01", + "source": "execution/native_program.py", + "finding": "Rollback requires Running/ready candidate Pod and candidate exec before operation; unhealthy startup/readiness failure cannot recover.", + "required": "Separate bounded rollback request from post-rollback verification. Request gates retain sealed Deployment/CM/PVC, exact same-schema source/image pair, node headroom, owner dryrun and Application CAS/scoped sync, without requiring candidate Ready/exec. Verify reverted image/Ready/schema/integrity afterward under an explicit recovery phase; no data snapshot restore or broader mutation." + }, + { + "id": "RPF-INFD-EXEC-02", + "source": "execution/actuator.py::offline_verify", + "finding": "Only pre-open read-only integrity proof exists; admin counters alone do not establish post-open integrity/schema/counts required by protocol.", + "required": "Repeat exact read-only checker under same isolated UID10001 after admin; compare full frozen proof, retain original private snapshot digest unchanged, fail on any mismatch." + }, + { + "id": "RPF-INFD-EXEC-03", + "source": "authority_journal.py / native_program.py / amended founder packet", + "finding": "All phases including recovery are denied after execution deadline, while earlier packet describes expiry for unstarted release only.", + "required": "Make recovery expiry semantics explicit in amended packet. Do not silently broaden authorization: either retain clearly disclosed bounded recovery deadline and stop for fresh recovery decision beyond it, or bind any allowed recovery-after-start semantics to exact persisted release attempt and fresh actual acceptance." + } + ], + "sound_boundaries": [ + "Nested exact founder/current native receipt bookkeeping remains supervised and expressly not authenticated autonomous grant.", + "Four committed render blobs plus source HEAD, exact executor/input hashes and actual UID/CM/PVC seals; automatic:{} and source override refusal.", + "Protected binarycopy byte/hash/size bounds, no raw snapshot output, networknone isolated newly labeled localvolume with confined initializer and UID10001 pre-Store checks.", + "Fsynced RUNNING intent and no same-phase retry after uncertain/crash; Deployment-only manual Argo operation prunefalse via CAS, dispatch distinct from rollout completion." + ], + "limits": { + "native_action": false, + "backup_export_restore": false, + "credential_read": false, + "founder_approval": false, + "native_custody_proof": false, + "other_owner_role": false + } +} diff --git a/docs/evidence/2026-10-11-infd-purpose-actuator-owner-review/final-review.json b/docs/evidence/2026-10-11-infd-purpose-actuator-owner-review/final-review.json new file mode 100644 index 0000000..ba4c1cc --- /dev/null +++ b/docs/evidence/2026-10-11-infd-purpose-actuator-owner-review/final-review.json @@ -0,0 +1,40 @@ +{ + "review_id": "RPF-REVIEW-20261011-INFD-ACTUATOR-R1-FINAL", + "work_record": "RPF-IN-0007", + "role": "railiance-platform technical owner only", + "status": "technical-agreement-for-exact-helper-source", + "manifest_sha256": "f2fad6c251fbb4420e07c1329802f521b513bbf66e51f64c5d673ef04f16284c", + "source_bundle_sha256": "27d6d6d3133c963da1dde92d498d636617387c16e850a17c598148abc35c775d", + "source_bundle_bytes": 85747, + "paths": 23, + "all_manifest_hashes_match": true, + "independently_rerun_tests": 16, + "additional_recovery_negative_cases": 5, + "resolved": [ + "Rollback request requires sealed Deployment/CM/PVC/source/image pair/headroom/admission/CAS but no candidate Pod/readiness/database exec; distinct rollback-verify proves old-image Ready1/scoped succeeded operation/current schema5 integrity/counts.", + "Offline UID10001/networknone post-admin checker repeats full readonly integrity/schema/count proof against frozen snapshot and verifies protected original hash unchanged.", + "All phases including verification and recovery have explicit fixed expiry; no silent extension. A fresh founder decision is required beyond the deadline, and the resulting recovery-delay risk is disclosed in helper README." + ], + "independent_probe": "refined-recovery-probes.json", + "scope": "Exact bounded supervised helper source only; no final founder packet acceptance or runtime execution implied. Durable no-retry intent, protected binary copy/new confined offline volume, exact owner hash/source/UID custody gates and Deployment-only Argo CAS/manual prunefalse scope remain.", + "before_first_human_post": [ + "Amend and validate exact hash-bound founder packet to include current helper bundle/plan, all four owner render inputs, confined UID0 initializer, separate rollback verification and explicit all-phase deadline with recovery-delay risk.", + "Retain original78-path/initial11-path/conditional review evidence without backfilling approval." + ], + "native_gates": [ + "Fresh root authenticated fixed-origin exact founder disposition per phase; bookkeeping files are not autonomous grants.", + "Actual protected real-data backup/copy/offline restoration/fresh cutover snapshot remain unexecuted and required.", + "Installed ten-variant checks use synthetic transport even on native placement; native_provider=false. Actual-provider/native binding acceptance remains a distinct T04 completion gate.", + "Image request acknowledgment is not rollout completion; recovery acknowledgment is not recovered Ready/schema proof; uncertain outcomes retain evidence and refuse same-phase retries." + ], + "limits": { + "native_action": false, + "backup_export_restore": false, + "credentials_read": false, + "founder_approval": false, + "native_custody_proof": false, + "native_provider_proof": false, + "other_owner_role": false, + "T04_complete": false + } +} diff --git a/docs/evidence/2026-10-11-infd-purpose-actuator-owner-review/refined-recovery-probes.json b/docs/evidence/2026-10-11-infd-purpose-actuator-owner-review/refined-recovery-probes.json new file mode 100644 index 0000000..3c736ac --- /dev/null +++ b/docs/evidence/2026-10-11-infd-purpose-actuator-owner-review/refined-recovery-probes.json @@ -0,0 +1,27 @@ +{ + "synthetic_transport_only": true, + "native_action": false, + "negative_recovery_cases": { + "wrong_operation_revision": { + "refused": true, + "writes": 0 + }, + "prune_true": { + "refused": true, + "writes": 0 + }, + "extra_resource": { + "refused": true, + "writes": 0 + }, + "wrong_source": { + "refused": true, + "writes": 0 + }, + "recreated_application": { + "refused": true, + "writes": 0 + } + }, + "unready_rollback_dispatches_once_without_pod_or_exec": true +} diff --git a/docs/evidence/2026-10-11-infd-purpose-actuator-owner-review/unready-rollback-probe.json b/docs/evidence/2026-10-11-infd-purpose-actuator-owner-review/unready-rollback-probe.json new file mode 100644 index 0000000..328ac77 --- /dev/null +++ b/docs/evidence/2026-10-11-infd-purpose-actuator-owner-review/unready-rollback-probe.json @@ -0,0 +1,8 @@ +{ + "synthetic_transport_only": true, + "native_action": false, + "unready_same_schema_candidate_rollback_accepted": false, + "rollback_patches_requested": 0, + "unready_candidate_exec_calls": 0, + "rollback_fail_class": "ValueError" +} diff --git a/intakes/RPF-IN-0007-infd-purpose-actuator-review.md b/intakes/RPF-IN-0007-infd-purpose-actuator-review.md new file mode 100644 index 0000000..1aa7f9b --- /dev/null +++ b/intakes/RPF-IN-0007-infd-purpose-actuator-review.md @@ -0,0 +1,27 @@ +--- +id: RPF-IN-0007 +kind: intake +type: intake +title: "Platform review of INFD protected custody and image release actuator" +repo: railiance-platform +lane: supervised +status: closed +owner: railiance-platform +requested_by: the-custodian +origin: handoff +origin_ref: INFD-WP-0009 +priority: high +created: "2026-10-11" +updated: "2026-10-11" +tags: [security, cross-owner, review] +--- + +Review exact11-path execution source manifest `653b68c3891c066f40d104bfc67a35da5e436605cd99afd52fbac4b47a9553fe` and bundle `0a79eda40fe0954fd3828bf06fd6ccf149e294ac194bc6fe605e585b878fa8d3`, approval gate, private real-data custody, offline clone isolation, single-writer cutover, uncertain recovery, manual Argo scope and current-database rollback. Record precedes formal technical review. Synthetic verification only; no native backup/export/restore, mutation, credential read or founder approval is authorized. + +## Completed initial source review + +Absorbed into technical review `RPF-REVIEW-20261011-INFD-ACTUATOR-R1-CONDITIONAL`. Changes required: unhealthy-candidate rollback must not depend on candidate readiness/exec; offline restore must repeat integrity/schema/count proof after admin. Deadline/recovery semantics require explicit amended-packet agreement. Initial12tests passed but independent failure probe reproduced zero rollback dispatch for an unready candidate. Native work remains in INFD-WP-0009-T04; no native action/approval occurred. Completed record precedes formal review entry. + +## Final exact helper review + +Final technical agreement `RPF-REVIEW-20261011-INFD-ACTUATOR-R1-FINAL` covers helper manifest `f2fad6c251fbb4420e07c1329802f521b513bbf66e51f64c5d673ef04f16284c`,23paths, execution bundle `27d6d6d3133c963da1dde92d498d636617387c16e850a17c598148abc35c775d`. Sixteen synthetic tests independently pass; additional recovery probes reject wrong operation/source/UID/prune/resource scope and confirm unhealthy-candidate recovery request without Pod/exec. Original conditional evidence remains. Final founder packet must hash-bind this executor/four render inputs and explicitly disclose the all-phase deadline before submission; source agreement is not approval or native custody/provider evidence.