Prepare reviewed attended reuse-reader custody execution
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
This commit is contained in:
codex
parent
6e8955fcd0
commit
635daec6b4
6 changed files with 496 additions and 0 deletions
|
|
@ -0,0 +1,93 @@
|
|||
{
|
||||
"id": "CCR-2026-0046-ATTENDED-CUSTODY-HANDOFF-R3",
|
||||
"revision": 3,
|
||||
"work_item": "RPF-WP-0058-T03",
|
||||
"status": "prepared; founder/live execution approval pending",
|
||||
"source_published_commit": "6e8955fcd09b278a6f16c14beffd076b72d10c95",
|
||||
"consumer_image_digest": "sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0",
|
||||
"commands": {
|
||||
"read_only_claims_preflight": "env PATH=\"/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/warden-browser-opener-r1:$PATH\" BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 warden access openbao-platform-admin-login --exec -- python3 /home/worsch/railiance-platform/scripts/apply-reuse-surface-reader-custody.py --preflight --receipt /tmp/cust81-installed-claims-r1.jsonl",
|
||||
"approved_policy_and_bootstrap": "env PATH=\"/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/warden-browser-opener-r1:$PATH\" BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 warden access openbao-platform-admin-login --exec -- python3 /home/worsch/railiance-platform/scripts/apply-reuse-surface-reader-custody.py --execute --approval /tmp/cust81-approved-custody-r1.json --receipt /tmp/cust81-policy-custody-r1.jsonl --bootstrap-receipt /tmp/cust81-forge-reader-r1.jsonl",
|
||||
"existing_inner_forgejo_route": "warden access forgejo-admin-api-token --field API_TOKEN --exec -- python3 /home/worsch/railiance-platform/scripts/provision-reuse-surface-forgejo-source.py --inner --approval /tmp/cust81-approved-custody-r1.json --receipt /tmp/cust81-forge-reader-r1.jsonl"
|
||||
},
|
||||
"approval_receipt_schema": {
|
||||
"ccr_id": "CCR-2026-0046",
|
||||
"decision": "approved only after actual founder disposition",
|
||||
"supervisor": "recorded supervisor identity",
|
||||
"decision_ref": "resolved exact founder credential-change decision reference",
|
||||
"approved_artifacts": {
|
||||
"credential-change-requests/CCR-2026-0046-reuse-surface-forgejo-source-read.yaml": "23039fae6137e7bdd71de0ed3278596b1ed60ae636018eb4bfcc83e53c4ada02",
|
||||
"docs/proposals/2026-10-15-reuse-private-reader/bootstrap-contract.json": "2bb72671e0a5f230497ab8ef2967a20ee68d1f2cf081f07c84f6db3442e18d8b",
|
||||
"scripts/provision-reuse-surface-forgejo-source.py": "abf60a754596baa1610d23b1fd367385b0222ac8aeaebba0f2cfb7ec4c62055b",
|
||||
"openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl": "6320f6c2d262d924ea16291d301d5f9eeb7efdb6ce7ea141c1a41d277d86b01b"
|
||||
},
|
||||
"runner_artifacts": {
|
||||
"scripts/apply-reuse-surface-reader-custody.py": "934b421c357e154f6508ab4b7c30f1aadfea2bf9a2f187d83968928d5eecad42",
|
||||
"openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl": "6320f6c2d262d924ea16291d301d5f9eeb7efdb6ce7ea141c1a41d277d86b01b",
|
||||
"docs/proposals/2026-10-15-reuse-private-reader/conditional-approved-ccr-state-candidate-r1.json": "178dd2aeddf3544438d584fa16e3ceb1a541a357d4dff5b8b4b0e95db2f357ac"
|
||||
}
|
||||
},
|
||||
"authorization_caveat": "Schema is explanatory, not an approved receipt. Authentic authority relies on governed attended supervisor lane. Proposal binds exact future CCR bytes plus predecessor and only-two-field transition rule; actual installed role proof is mandatory before transition. StoreReady, mode labels or candidate fields never establish observed claims.",
|
||||
"immutable_role_preflight": {
|
||||
"path": "auth/kubernetes/role/reuse-surface-runtime-eso",
|
||||
"bound_service_account_names": [
|
||||
"reuse-surface-eso"
|
||||
],
|
||||
"bound_service_account_namespaces": [
|
||||
"reuse"
|
||||
],
|
||||
"audience": "openbao",
|
||||
"token_policies": [
|
||||
"workload-kv-read-reuse-surface-runtime-eso"
|
||||
],
|
||||
"token_ttl": 900,
|
||||
"token_max_ttl": 900,
|
||||
"token_explicit_max_ttl": 900,
|
||||
"token_no_default_policy": true,
|
||||
"token_period": 0,
|
||||
"token_bound_cidrs": []
|
||||
},
|
||||
"policy_only_reason": "Generic CCR metadata applier would rewrite existing ESO role; CCR0046 does not carry all CCR0005 maxTTL/no-default fields. This runner NEVER writes role and only adds exact approved ACL path after old-or-approved byte comparison. OpenBao ACL has no CAS; immediate predecessor recheck and successor verification are attended guards, not atomicCAS.",
|
||||
"receipt_semantics": "Durable sanitized JSONL; no role objects/secret/network output stored. Output mismatch or ambiguity stops; inspect child receipt before retry. Warden envelope owns login persistence, session selfrevoke and cleanup; its13 exit means child may have succeeded, revocation unconfirmed.",
|
||||
"gates": [
|
||||
"Integrate/publish/review new quiet runner and tests before handing concrete command to founder.",
|
||||
"Existing owner-prepared WSL opener must match pinned cmd.exe/xdg-open bytes and be prefixed through task-local PATH for attended identity act; no global/browser/BROWSER workaround or capturedURL fallback.",
|
||||
"Actual founder credential provisioning approval, independent owner review of new exact-policy runner, and confirmed installedclaims before execute.",
|
||||
"No default/personal/root session fallback; nested Forgejo route must resolve using existing platform-admin caller custody and capture output.",
|
||||
"No delivery by this runner: apps owner separately deploys approved image+exact14URLconfig with live headroom/dryrun and confirms currentsource inventory.",
|
||||
"Final nativefetch verification and scopedwriter seven registrations plus fresh hosted70/70 remain required."
|
||||
],
|
||||
"validation": {
|
||||
"runner_boundary_tests": 17,
|
||||
"result": "passed",
|
||||
"target": "wrongclaims/ttl/policy refused, approved conditional-state scope, verified policy snapshot stdin, predecessor/idempotent drift, final immutable role+desired ACL revalidation before verified terminal, output suppression"
|
||||
},
|
||||
"live_actions_performed": false,
|
||||
"conditional_ccr_transition": {
|
||||
"candidate_wrapper": "docs/proposals/2026-10-15-reuse-private-reader/conditional-approved-ccr-state-candidate-r1.json",
|
||||
"candidate_wrapper_sha256": "178dd2aeddf3544438d584fa16e3ceb1a541a357d4dff5b8b4b0e95db2f357ac",
|
||||
"source_preimage_sha256": "90522912fb78fed72e625382fb7114a0e9aafe76d59e36bffecab83c5bb7d643",
|
||||
"approved_future_ccr_sha256": "23039fae6137e7bdd71de0ed3278596b1ed60ae636018eb4bfcc83e53c4ada02",
|
||||
"state": "Preparation only: candidate approved/confirmed fields are not observed facts, not active approval, not installed proof.",
|
||||
"rule": "After actual founder decision exact receipt, validate all artifact/candidate/predecessor hashes; prove actual existing role claims from suppressed read; only then atomically install exact two-field approved/confirmed CCR bytes with durable receipt, preserve immutable role. Unchanged provisioner approval check now sees prebound future CCR bytes. Any mismatch stops without installing candidate.",
|
||||
"post_execution_recording": "Source transition must be committed/projected by platform owner with observedclaim receipt and actual supervisor decision. No additional edits to approved CCR bytes are required to execute; preserve original proposed revision and this candidate hash."
|
||||
},
|
||||
"browser_opener": {
|
||||
"path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/warden-browser-opener-r1",
|
||||
"cmd_exe_sha256": "4b91a4dc635e464143bfe1f484eccb2456ccd992326ac7a126b53d0a9a3c7f96",
|
||||
"xdg_open_sha256": "4b91a4dc635e464143bfe1f484eccb2456ccd992326ac7a126b53d0a9a3c7f96",
|
||||
"status": "owner prepared/validated; no GUI or login executed",
|
||||
"contract": "Installed Bao2.5.5 capv0.12.0 WSL calls cmd.exe /c start; task-local PATH adapter preserves existing HOME/token envelope. BROWSER unsupported; no global opener change.",
|
||||
"validation_sha256": "9cbd8be4d9acfc19241e70bcda5df93eb2eacc83cb00771a5543022acc4ed474"
|
||||
},
|
||||
"r2_changes_requested": {
|
||||
"review_path": "/tmp/cust81-forge-reader-owner/docs/proposals/cust81-private-reader/forge-owner-attended-runner-review-r2.json",
|
||||
"review_sha256": "c4e61cd185bfc738fe8e2f7e89b71408ed35d441dfa38183cd83bad9c0832445",
|
||||
"confirmed_defects": [
|
||||
"Mutable approved policy filepath reopened at write",
|
||||
"Idempotent path/final receipt lacked refreshed ACL and immutable-role verification"
|
||||
],
|
||||
"r3_fix": "Capture exact policy bytes and reverify cached approved digest after baseapproval; stdin-only policywrite snapshot. Both before and after bootstrap verify approved desired ACL and immutable role including idempotent path. Drift stops without overwrite or retry.",
|
||||
"same_proposal": "CCR0046 refinement; preserve R2 failures, no new scored trial"
|
||||
}
|
||||
}
|
||||
File diff suppressed because one or more lines are too long
|
|
@ -0,0 +1,18 @@
|
|||
{
|
||||
"id": "RPF-WP-0058-PLATFORM-ATTENDED-RUNNER-REVIEW-R3",
|
||||
"work_item": "RPF-WP-0058-T03",
|
||||
"reviewer": "platform-reader-owner delegated worker",
|
||||
"owner_repo": "railiance-platform",
|
||||
"decision": "approved",
|
||||
"scope": "Exact-policy runner and conditional CCR state transition PREPARATION only; no founder/live authorization, candidate remains unapplied/unverified",
|
||||
"basis": "INTENT shared custody/Q1 delegated apply and stable delivery. Existing ESO role must retain CCR0005 constraints; scoped ACL-only change avoids generic role rewrite. Existing approved credential lane transports retained.",
|
||||
"reviewed_artifacts": {
|
||||
"scripts/apply-reuse-surface-reader-custody.py": "934b421c357e154f6508ab4b7c30f1aadfea2bf9a2f187d83968928d5eecad42",
|
||||
"tests/test_reuse_surface_reader_custody_apply.py": "cb2c4b5f8a96cfb71015d94c5d51de0e1bbf5c8e3d90e866b207a070c1a7a266",
|
||||
"docs/proposals/2026-10-15-reuse-private-reader/conditional-approved-ccr-state-candidate-r1.json": "178dd2aeddf3544438d584fa16e3ceb1a541a357d4dff5b8b4b0e95db2f357ac",
|
||||
"docs/proposals/2026-10-15-reuse-private-reader/attended-custody-handoff-r1.json": "1247ad5aa73289a26a48e999b870ce2d60abb409132783e14456ea318689acff"
|
||||
},
|
||||
"tests": "17 privileged-boundary tests passed;45 allreader tests. Verifiedsnapshot stdin, before/after bootstrap actualrole+desiredACL rechecks on idempotent path; R2 failures preserved, sameproposal refinement. No live calls/credentials/mutations.",
|
||||
"pending": "Founder exact execution disposition, independent owner finalreview of R3, successful installedclaimspreflight. Owner-pinned WSL opener prepared/validated; login itself not performed. No authrole migration or admin-token bypass.",
|
||||
"revision": 3
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue