Prove pinned OpenBao ArgoCD adoption with deterministic native checks

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
codex 2026-10-11 21:30:47 +02:00
parent 5a1a7ee5c1
commit 725d126c77
19 changed files with 1130 additions and 2 deletions

View file

@ -0,0 +1,34 @@
# Verified OpenBao Argo adoption proof
Run from the workstation:
```sh
python3 scripts/argocd_adoption_proof.py --live --source-root . --observation observation.json --receipt proof.json
python3 -m unittest discover -s tests -p 'test_argocd_adoption_proof.py'
```
The helper reads nodes, the exact Application, ClusterSecretStore, ExternalSecret,
Argo configuration and controller version. It never reads a Secret. Raw command
output and errors are captured and discarded. Git archive renders the exact
pin in a disposable directory; only a public ClusterSecretStore is admitted.
Server API dry-runs and native diffs make no persistent native change.
The final proof is verified: both native diffs return zero and both same-version
API dry-runs have no changed field paths after exact Argo tracking injection.
The observed 3.5.3 controller and configuration select annotation mode. Tracking
uses the Application destination namespace even for a cluster-scoped object;
no instance label is injected. This follows the upstream [v3.5.3 resource tracking
implementation](https://github.com/argoproj/argo-cd/blob/v3.5.3/util/argo/resource_tracking.go)
and the [3.0 default change](https://argo-cd.readthedocs.io/en/release-3.5/operator-manual/upgrading/2.14-3.0/).
Only the tracking annotation is injected; live fields are never copied into the
desired source. Raw source diffs remain diagnostic. Structured JSON pointers
identify only tracking/last-applied differences. Unknown or substantive fields
refuse proof; neither parser ambiguity nor a manual ignore can grant success.
Check `status: verified`, never receipt presence. Five-minute stale and future
observations are refused. The successful observation is a point-in-time proof,
not authority or evidence of subsequent automation. Earlier failed receipts are
retained. Thirteen fixture tests include exact identity/pin/destination mismatch,
tracking/render semantics, proving age, readiness changes, extra tracked objects,
unknown/substantive/native diff failures and protected-error-output canaries.
Fixtures are synthetic; native acceptance is the separate final proof.

View file

@ -0,0 +1,14 @@
{
"status": "verified-diagnostic",
"normalized_client_dry_run_changed_paths": [],
"same_version_read": true,
"diffs": {
"client": 0,
"server": 0,
"argo_manager_server": 0,
"argo_manager_client": 0
},
"manager_kubectl_client_side_apply": false,
"manager_argocd_controller": false,
"manager_argocd_application_controller": false
}

View file

@ -0,0 +1,9 @@
{
"spec_equals_pin": true,
"desired_labels_present": true,
"tracking_empty_namespace": false,
"tracking_default_namespace": false,
"tracking_argocd_namespace": false,
"tracking_identity_prefix_matches": true,
"tracking_name_matches": true
}

View file

@ -0,0 +1,12 @@
{
"status": "verified-diagnostic",
"client_dry_run_changed_paths": [
"/apiVersion",
"/metadata/annotations/argocd.argoproj.io~1tracking-id",
"/metadata/annotations/kubectl.kubernetes.io~1last-applied-configuration"
],
"server_dry_run_changed_paths": [
"/apiVersion",
"/metadata/annotations/kubectl.kubernetes.io~1last-applied-configuration"
]
}

View file

@ -0,0 +1,106 @@
{
"application": {
"automated_present": false,
"condition_types": [
"OrphanedResourceWarning"
],
"destination": {
"namespace": "external-secrets",
"server": "https://kubernetes.default.svc"
},
"health": "Healthy",
"name": "openbao-secretstore",
"operation": {
"finishedAt": "2026-09-21T17:09:18Z",
"phase": "Succeeded",
"startedAt": "2026-09-21T17:09:16Z"
},
"operation_revision": "d2dbc19c254247652c49fda8721c80d53bca206a",
"pending_operation": false,
"project": "railiance-platform-addons",
"resources": [
{
"group": "external-secrets.io",
"kind": "ClusterSecretStore",
"name": "openbao",
"namespace": null,
"status": "Synced"
}
],
"revision": "d2dbc19c254247652c49fda8721c80d53bca206a",
"source": {
"path": "argocd/platform-addons/openbao-secretstore",
"repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git",
"targetRevision": "d2dbc19c254247652c49fda8721c80d53bca206a"
},
"sync": "Synced",
"sync_prune": false,
"sync_strategy_apply": true,
"uid": "f2932505-e649-4b99-b505-4789ed21301f"
},
"captured_at": "2026-10-11T19:22:22.892821+00:00",
"estate_ip": "92.205.62.239",
"ready_checks": [
{
"kind": "ClusterSecretStore",
"name": "openbao",
"namespace": "",
"ready": [
{
"lastTransitionTime": "2026-08-19T19:49:59Z",
"status": "True"
}
],
"tracking_matches": true,
"uid": "99563b77-f30f-451b-ac86-16b1b162c6a9"
},
{
"kind": "ExternalSecret",
"name": "issue-core-runtime",
"namespace": "issue-core",
"ready": [
{
"lastTransitionTime": "2026-08-19T19:54:20Z",
"status": "True"
}
],
"tracking_matches": null,
"uid": "490dca37-6364-480a-a757-c3a266d32e47"
}
],
"tracking_settings": {
"controller_version": "v3.5.3",
"installation_id_absent": true,
"instance_label_key": "app.kubernetes.io/instance",
"method": "annotation"
},
"pinned_render_diff": {
"client_side_exit_code": 0,
"exit_code": 0,
"normalization": "argocd-v3-annotation-tracking-destination-namespace",
"normalized_client_changed_paths": [],
"normalized_render_sha256": "94e014dd61b81e09c8b137acae1b797f8976b8607fcaa46f54674d4d407b9843",
"normalized_server_changed_paths": [],
"output_suppressed": true,
"path": "argocd/platform-addons/openbao-secretstore",
"raw_client_changed_paths": [
"/metadata/annotations/argocd.argoproj.io~1tracking-id",
"/metadata/annotations/kubectl.kubernetes.io~1last-applied-configuration"
],
"raw_client_exit_code": 1,
"raw_server_changed_paths": [
"/metadata/annotations/kubectl.kubernetes.io~1last-applied-configuration"
],
"raw_server_exit_code": 1,
"render_resource_count": 1,
"render_sha256": "35585d1b005272ec75e55cb4a68386bc515032693c2c70f6e76f68cad4e29fb3",
"revision": "d2dbc19c254247652c49fda8721c80d53bca206a",
"same_api_version": true,
"tracking_settings": {
"controller_version": "v3.5.3",
"installation_id_absent": true,
"instance_label_key": "app.kubernetes.io/instance",
"method": "annotation"
}
}
}

View file

@ -0,0 +1,83 @@
{
"application": {
"automated_present": false,
"condition_types": [
"OrphanedResourceWarning"
],
"destination": {
"namespace": "external-secrets",
"server": "https://kubernetes.default.svc"
},
"health": "Healthy",
"name": "openbao-secretstore",
"operation": {
"finishedAt": "2026-09-21T17:09:18Z",
"phase": "Succeeded",
"startedAt": "2026-09-21T17:09:16Z"
},
"operation_revision": "d2dbc19c254247652c49fda8721c80d53bca206a",
"pending_operation": false,
"project": "railiance-platform-addons",
"resources": [
{
"group": "external-secrets.io",
"kind": "ClusterSecretStore",
"name": "openbao",
"namespace": null,
"status": "Synced"
}
],
"revision": "d2dbc19c254247652c49fda8721c80d53bca206a",
"source": {
"path": "argocd/platform-addons/openbao-secretstore",
"repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git",
"targetRevision": "d2dbc19c254247652c49fda8721c80d53bca206a"
},
"sync": "Synced",
"sync_prune": false,
"sync_strategy_apply": true,
"uid": "f2932505-e649-4b99-b505-4789ed21301f"
},
"captured_at": "2026-10-11T19:16:28.318163+00:00",
"estate_ip": "92.205.62.239",
"ready_checks": [
{
"kind": "ClusterSecretStore",
"name": "openbao",
"namespace": "",
"ready": [
{
"lastTransitionTime": "2026-08-19T19:49:59Z",
"status": "True"
}
],
"tracking_matches": true,
"uid": "99563b77-f30f-451b-ac86-16b1b162c6a9"
},
{
"kind": "ExternalSecret",
"name": "issue-core-runtime",
"namespace": "issue-core",
"ready": [
{
"lastTransitionTime": "2026-08-19T19:54:20Z",
"status": "True"
}
],
"tracking_matches": null,
"uid": "490dca37-6364-480a-a757-c3a266d32e47"
}
],
"pinned_render_diff": {
"revision": "d2dbc19c254247652c49fda8721c80d53bca206a",
"path": "argocd/platform-addons/openbao-secretstore",
"render_sha256": "35585d1b005272ec75e55cb4a68386bc515032693c2c70f6e76f68cad4e29fb3",
"render_resource_count": 1,
"exit_code": 1,
"output_suppressed": true,
"changed_top_fields": [
"unknown"
],
"client_side_exit_code": 1
}
}

View file

@ -0,0 +1,82 @@
{
"application": {
"automated_present": false,
"condition_types": [
"OrphanedResourceWarning"
],
"destination": {
"namespace": "external-secrets",
"server": "https://kubernetes.default.svc"
},
"health": "Healthy",
"name": "openbao-secretstore",
"operation": {
"finishedAt": "2026-09-21T17:09:18Z",
"phase": "Succeeded",
"startedAt": "2026-09-21T17:09:16Z"
},
"operation_revision": "d2dbc19c254247652c49fda8721c80d53bca206a",
"pending_operation": false,
"project": "railiance-platform-addons",
"resources": [
{
"group": "external-secrets.io",
"kind": "ClusterSecretStore",
"name": "openbao",
"namespace": null,
"status": "Synced"
}
],
"revision": "d2dbc19c254247652c49fda8721c80d53bca206a",
"source": {
"path": "argocd/platform-addons/openbao-secretstore",
"repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git",
"targetRevision": "d2dbc19c254247652c49fda8721c80d53bca206a"
},
"sync": "Synced",
"sync_prune": false,
"sync_strategy_apply": true,
"uid": "f2932505-e649-4b99-b505-4789ed21301f"
},
"captured_at": "2026-10-11T19:15:47.973008+00:00",
"estate_ip": "92.205.62.239",
"ready_checks": [
{
"kind": "ClusterSecretStore",
"name": "openbao",
"namespace": "",
"ready": [
{
"lastTransitionTime": "2026-08-19T19:49:59Z",
"status": "True"
}
],
"tracking_matches": true,
"uid": "99563b77-f30f-451b-ac86-16b1b162c6a9"
},
{
"kind": "ExternalSecret",
"name": "issue-core-runtime",
"namespace": "issue-core",
"ready": [
{
"lastTransitionTime": "2026-08-19T19:54:20Z",
"status": "True"
}
],
"tracking_matches": null,
"uid": "490dca37-6364-480a-a757-c3a266d32e47"
}
],
"pinned_render_diff": {
"revision": "d2dbc19c254247652c49fda8721c80d53bca206a",
"path": "argocd/platform-addons/openbao-secretstore",
"render_sha256": "35585d1b005272ec75e55cb4a68386bc515032693c2c70f6e76f68cad4e29fb3",
"render_resource_count": 1,
"exit_code": 1,
"output_suppressed": true,
"changed_top_fields": [
"unknown"
]
}
}

View file

@ -0,0 +1,79 @@
{
"application": {
"automated_present": false,
"condition_types": [
"OrphanedResourceWarning"
],
"destination": {
"namespace": "external-secrets",
"server": "https://kubernetes.default.svc"
},
"health": "Healthy",
"name": "openbao-secretstore",
"operation": {
"finishedAt": "2026-09-21T17:09:18Z",
"phase": "Succeeded",
"startedAt": "2026-09-21T17:09:16Z"
},
"operation_revision": "d2dbc19c254247652c49fda8721c80d53bca206a",
"pending_operation": false,
"project": "railiance-platform-addons",
"resources": [
{
"group": "external-secrets.io",
"kind": "ClusterSecretStore",
"name": "openbao",
"namespace": null,
"status": "Synced"
}
],
"revision": "d2dbc19c254247652c49fda8721c80d53bca206a",
"source": {
"path": "argocd/platform-addons/openbao-secretstore",
"repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git",
"targetRevision": "d2dbc19c254247652c49fda8721c80d53bca206a"
},
"sync": "Synced",
"sync_prune": false,
"sync_strategy_apply": true,
"uid": "f2932505-e649-4b99-b505-4789ed21301f"
},
"captured_at": "2026-10-11T19:15:05.030899+00:00",
"estate_ip": "92.205.62.239",
"ready_checks": [
{
"kind": "ClusterSecretStore",
"name": "openbao",
"namespace": "",
"ready": [
{
"lastTransitionTime": "2026-08-19T19:49:59Z",
"status": "True"
}
],
"tracking_matches": true,
"uid": "99563b77-f30f-451b-ac86-16b1b162c6a9"
},
{
"kind": "ExternalSecret",
"name": "issue-core-runtime",
"namespace": "issue-core",
"ready": [
{
"lastTransitionTime": "2026-08-19T19:54:20Z",
"status": "True"
}
],
"tracking_matches": null,
"uid": "490dca37-6364-480a-a757-c3a266d32e47"
}
],
"pinned_render_diff": {
"revision": "d2dbc19c254247652c49fda8721c80d53bca206a",
"path": "argocd/platform-addons/openbao-secretstore",
"render_sha256": "35585d1b005272ec75e55cb4a68386bc515032693c2c70f6e76f68cad4e29fb3",
"render_resource_count": 1,
"exit_code": 1,
"output_suppressed": true
}
}

View file

@ -0,0 +1,75 @@
{
"application": {
"automated_present": false,
"condition_types": [
"OrphanedResourceWarning"
],
"health": "Healthy",
"name": "openbao-secretstore",
"operation": {
"finishedAt": "2026-09-21T17:09:18Z",
"phase": "Succeeded",
"startedAt": "2026-09-21T17:09:16Z"
},
"operation_revision": "d2dbc19c254247652c49fda8721c80d53bca206a",
"pending_operation": false,
"project": "railiance-platform-addons",
"resources": [
{
"group": "external-secrets.io",
"kind": "ClusterSecretStore",
"name": "openbao",
"namespace": null,
"status": "Synced"
}
],
"revision": "d2dbc19c254247652c49fda8721c80d53bca206a",
"source": {
"path": "argocd/platform-addons/openbao-secretstore",
"repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git",
"targetRevision": "d2dbc19c254247652c49fda8721c80d53bca206a"
},
"sync": "Synced",
"sync_prune": false,
"sync_strategy_apply": true,
"uid": "f2932505-e649-4b99-b505-4789ed21301f"
},
"captured_at": "2026-10-11T19:12:20.205677+00:00",
"estate_ip": "92.205.62.239",
"ready_checks": [
{
"kind": "ClusterSecretStore",
"name": "openbao",
"namespace": "",
"ready": [
{
"lastTransitionTime": "2026-08-19T19:49:59Z",
"status": "True"
}
],
"tracking_matches": false,
"uid": "99563b77-f30f-451b-ac86-16b1b162c6a9"
},
{
"kind": "ExternalSecret",
"name": "issue-core-runtime",
"namespace": "issue-core",
"ready": [
{
"lastTransitionTime": "2026-08-19T19:54:20Z",
"status": "True"
}
],
"tracking_matches": null,
"uid": "490dca37-6364-480a-a757-c3a266d32e47"
}
],
"pinned_render_diff": {
"revision": "d2dbc19c254247652c49fda8721c80d53bca206a",
"path": "argocd/platform-addons/openbao-secretstore",
"render_sha256": "35585d1b005272ec75e55cb4a68386bc515032693c2c70f6e76f68cad4e29fb3",
"render_resource_count": 1,
"exit_code": 1,
"output_suppressed": true
}
}

View file

@ -0,0 +1,19 @@
{
"schema_version": "argocd-adoption-proof/v1",
"status": "verified",
"application": "openbao-secretstore",
"revision": "d2dbc19c254247652c49fda8721c80d53bca206a",
"captured_at": "2026-10-11T19:22:22.892821+00:00",
"verified_at": "2026-10-11T19:23:40.325446+00:00",
"proving_seconds": 1735984.892821,
"resource_count": 1,
"ready_count": 2,
"manual_apply_prune_off": true,
"warnings": [
"OrphanedResourceWarning"
],
"native_mutation": false,
"verifier_sha256": "c058c0ea646bcc3410e0d26db6b42a5471a8fa45a1df62b9ec85f2bf7d03f660",
"contract_sha256": "427084e4f40d34778534397a99379789e355a3b3573b97a61762da8e43abc31e",
"observation_sha256": "01e0850e496fe9234e91d883f1b4c7e7a574dd14bed60ac4585520bf1ddb79b2"
}

View file

@ -0,0 +1,18 @@
{
"schema_version": "argocd-adoption-proof/v1",
"status": "verified",
"application": "openbao-secretstore",
"revision": "d2dbc19c254247652c49fda8721c80d53bca206a",
"captured_at": "2026-10-11T19:22:22.892821+00:00",
"verified_at": "2026-10-11T19:22:27.223821+00:00",
"proving_seconds": 1735984.892821,
"resource_count": 1,
"ready_count": 2,
"manual_apply_prune_off": true,
"warnings": [
"OrphanedResourceWarning"
],
"native_mutation": false,
"contract_sha256": "427084e4f40d34778534397a99379789e355a3b3573b97a61762da8e43abc31e",
"observation_sha256": "01e0850e496fe9234e91d883f1b4c7e7a574dd14bed60ac4585520bf1ddb79b2"
}

View file

@ -0,0 +1,6 @@
{
"schema_version": "argocd-adoption-proof/v1",
"status": "unverified",
"error": "adoption proof incomplete; raw output suppressed",
"native_mutation": false
}

View file

@ -0,0 +1,6 @@
{
"schema_version": "argocd-adoption-proof/v1",
"status": "unverified",
"error": "adoption proof incomplete; raw output suppressed",
"native_mutation": false
}

View file

@ -0,0 +1,6 @@
{
"schema_version": "argocd-adoption-proof/v1",
"status": "unverified",
"error": "adoption proof incomplete; raw output suppressed",
"native_mutation": false
}

View file

@ -0,0 +1,6 @@
{
"schema_version": "argocd-adoption-proof/v1",
"status": "unverified",
"error": "adoption proof incomplete; raw output suppressed",
"native_mutation": false
}

View file

@ -0,0 +1,44 @@
{
"schema_version": "argocd-adoption-validation/v1",
"workplan": "RPF-WP-0044",
"task": "RPF-WP-0044-T03",
"native_mutation": false,
"task_closed": true,
"tests": {
"passed": 13,
"failed": 0
},
"compilation": "passed",
"native_proof": "verified",
"proof_ref": "proof-argo-normalized-final.json",
"observation_ref": "observation-argo-normalized.json",
"native_diff": {
"canonical_server_side": 0,
"canonical_client_side": 0,
"canonical_client_changed_paths": [],
"canonical_server_changed_paths": [],
"raw_source_server_side": 1,
"raw_source_client_side": 1
},
"normalization": "Argo v3 annotation tracking with Application destination namespace fallback; no live fields copied to desired source",
"upstream_refs": [
"https://github.com/argoproj/argo-cd/blob/v3.5.3/util/argo/resource_tracking.go",
"https://argo-cd.readthedocs.io/en/release-3.5/operator-manual/upgrading/2.14-3.0/"
],
"observed_runtime": {
"controller_version": "v3.5.3",
"installation_id_absent": true,
"instance_label_key": "app.kubernetes.io/instance",
"method": "annotation"
},
"verifier_sha256": "c058c0ea646bcc3410e0d26db6b42a5471a8fa45a1df62b9ec85f2bf7d03f660",
"retained_failure_history": [
"proof.json",
"proof-normalized.json",
"proof-classified.json",
"proof-both-diffs.json"
],
"secret_reads": 0,
"subprocess_output_suppressed": true,
"validated_at": "2026-10-11T19:24:51.574009+00:00"
}