Record independent zlib rollout acceptance
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
codex
parent
dc73e9cbf6
commit
8647587ca2
25 changed files with 3969 additions and 0 deletions
|
|
@ -0,0 +1,23 @@
|
|||
{
|
||||
"original_root_manifest_sha256": "0e4799f709e097312c18ef0124afc153003efef0627902591939a218dbd66d4d",
|
||||
"original20_hashes_verified_before_and_after": true,
|
||||
"all20_safemetadata_source_history_bytes_preserved_exact": true,
|
||||
"approved_git_source": "312ab97e876e17341bf16f9e95397e14c2ac2720",
|
||||
"approved_git_memo_sha256": "5dea0d404e4d13683fbf71d56273c06db7a6a916ab68759a90d7394005eee206",
|
||||
"approved_git_plan_sha256": "d871081999215bd3850ab1173064ed6cb6d7c23b26d9c3d5b3c5940e698d4c61",
|
||||
"committed_executor_and_four_render_blobs_match": true,
|
||||
"provider_command_git_hash_matches": true,
|
||||
"eight_phase_receipts_all_checks_pass": true,
|
||||
"snapshot_backup_copy_metadata_exact_for_both_drill_and_cutover": true,
|
||||
"offline_pre_post_exact_snapshot_counts_and_original_hash_unchanged": true,
|
||||
"only_nonce_owned_clone_removed": true,
|
||||
"freshscan_report_hash_exact": true,
|
||||
"actual_fullscan_contract_passed_at_provider_observation_time": true,
|
||||
"package_count": 44,
|
||||
"allseverity_findings": 0,
|
||||
"freshscan_completed_at": "2026-10-11T10:48:46.790940+00:00",
|
||||
"freshscan_age_expiry": "2026-10-11T14:48:46.790940+00:00",
|
||||
"db_next_update": "2026-10-11T18:59:50.889010572Z",
|
||||
"same_pod_generation_image_source_before_after_provider_check": true,
|
||||
"reviewer_native_requests_or_private_data_access": false
|
||||
}
|
||||
|
|
@ -0,0 +1,94 @@
|
|||
{
|
||||
"review_id": "RPF-ACCEPT-20261011-INFD-ZLIB-NATIVE-R1",
|
||||
"work_record": "RPF-IN-0010",
|
||||
"role": "railiance-platform technical owner only",
|
||||
"status": "native-technical-acceptance-exact-observed-release",
|
||||
"basis": "Independent owner assessment of immutable retained root native execution/verification evidence and exact approved Git source; reviewer issued no native commands and did not read private custody/journal/database/credentials. Root completed-phase journal attestation is corroborated by each safe successful phase receipt.",
|
||||
"root_evidence_manifest_sha256": "0e4799f709e097312c18ef0124afc153003efef0627902591939a218dbd66d4d",
|
||||
"validation": {
|
||||
"original_root_manifest_sha256": "0e4799f709e097312c18ef0124afc153003efef0627902591939a218dbd66d4d",
|
||||
"original20_hashes_verified_before_and_after": true,
|
||||
"all20_safemetadata_source_history_bytes_preserved_exact": true,
|
||||
"approved_git_source": "312ab97e876e17341bf16f9e95397e14c2ac2720",
|
||||
"approved_git_memo_sha256": "5dea0d404e4d13683fbf71d56273c06db7a6a916ab68759a90d7394005eee206",
|
||||
"approved_git_plan_sha256": "d871081999215bd3850ab1173064ed6cb6d7c23b26d9c3d5b3c5940e698d4c61",
|
||||
"committed_executor_and_four_render_blobs_match": true,
|
||||
"provider_command_git_hash_matches": true,
|
||||
"eight_phase_receipts_all_checks_pass": true,
|
||||
"snapshot_backup_copy_metadata_exact_for_both_drill_and_cutover": true,
|
||||
"offline_pre_post_exact_snapshot_counts_and_original_hash_unchanged": true,
|
||||
"only_nonce_owned_clone_removed": true,
|
||||
"freshscan_report_hash_exact": true,
|
||||
"actual_fullscan_contract_passed_at_provider_observation_time": true,
|
||||
"package_count": 44,
|
||||
"allseverity_findings": 0,
|
||||
"freshscan_completed_at": "2026-10-11T10:48:46.790940+00:00",
|
||||
"freshscan_age_expiry": "2026-10-11T14:48:46.790940+00:00",
|
||||
"db_next_update": "2026-10-11T18:59:50.889010572Z",
|
||||
"same_pod_generation_image_source_before_after_provider_check": true,
|
||||
"reviewer_native_requests_or_private_data_access": false
|
||||
},
|
||||
"confirmed_founder_go": {
|
||||
"approval_id": "b5ce337c-5d7d-44fa-864d-706b54039f7c",
|
||||
"disposition_id": "disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f",
|
||||
"accepted_at": "2026-10-11T10:40:55Z",
|
||||
"source_memo": "infd-20261011-zlib-remediation-r1",
|
||||
"source_memo_version": 1,
|
||||
"memo_sha256": "5dea0d404e4d13683fbf71d56273c06db7a6a916ab68759a90d7394005eee206",
|
||||
"source_revision": "312ab97e876e17341bf16f9e95397e14c2ac2720",
|
||||
"authority": "root-confirmed native founder readback, not inferred from provider preservation proof or a new grant"
|
||||
},
|
||||
"accepted_actual_outcome": {
|
||||
"candidate_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"deployment_uid": "a588e10a-90d2-4883-975e-6dd8b8feca92",
|
||||
"generation": 26,
|
||||
"ready_replicas": 1,
|
||||
"pod_uid": "1153f806-1e05-4596-baf3-a4fa8adf08be",
|
||||
"eight_phases": [
|
||||
"drill-backup",
|
||||
"drill-copy",
|
||||
"offline-verify",
|
||||
"cleanup-offline",
|
||||
"cutover-backup",
|
||||
"cutover-copy",
|
||||
"release",
|
||||
"verify"
|
||||
],
|
||||
"scoped_argo": "Exact source312ab97, one apps/Deployment informed-decision in its namespace, explicitfalse request and exact completion with guarded false omission; no broad sync/prune.",
|
||||
"latest_database_retained": true,
|
||||
"schema": 5,
|
||||
"integrity": "ok",
|
||||
"installed_zlib": "1.3.2-r1",
|
||||
"installed_policy_sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62",
|
||||
"healthz": 200,
|
||||
"readyz": 200,
|
||||
"installed_purpose_checks": "10 synthetic only:2allow/8refuse; not native provider/advisory evidence",
|
||||
"native_provider_preservation": "Canonical fixed authenticated source1 outcomes HTTP200 at2026-10-11T11:20:25.876927+00:00, same exact ReadyPod/source/image before11:20:14 andafter11:20:27; minimal shape/count proof, no founder approval inference.",
|
||||
"fullscan": "Exact actual44package immutableartifact zeroallseverity at10:48:46, valid through actual verification/provider observation; freshness expires14:48:46 rather than a perpetual zero claim."
|
||||
},
|
||||
"failed_trial_and_refinement_history": {
|
||||
"prephase_refusals": 3,
|
||||
"custody_or_durable_phase_native_effects_in_refusals": "none per root diagnosis; immutable original failure metadata retained",
|
||||
"actual_cause": "Root copied remote native observed_at into root verified_at; remote clock ahead produced negativeage -1.1806s.",
|
||||
"correction": "Root bookkeeping ONLY now records workstation local time after authenticated readback as verified_at and preserves remote native_observed_at separately. Exact one-line helper diff retained.",
|
||||
"approved_source_runtime_render_helper_plan_changed": false,
|
||||
"sandbox_hypothesis": "Earlier provisional sandbox write-denial hypothesis disproven; not recorded as final cause.",
|
||||
"failed_records_backfilled_to_success": false,
|
||||
"same_trial_not_three_or_four_successes": true,
|
||||
"outage_recovery_used": false,
|
||||
"rollback_used": false,
|
||||
"standing_or_customer_recovery_authority_created": false
|
||||
},
|
||||
"closure_boundaries": {
|
||||
"supports_product_specific_T05_risk_and_WP9_closure": true,
|
||||
"product_records_edited_by_reviewer": false,
|
||||
"C07_alias_diagnosis": "unsettled; no alias adjudication or tombstone deletion",
|
||||
"unpromoted_residuals": "remain unpromoted; no generic verifier or recovery mechanism implementation",
|
||||
"estate_grade_or_broad_security_standard_claim": false,
|
||||
"customer_ready_claim": false,
|
||||
"new_privileged_approval": false,
|
||||
"owner_source_write_or_push": false,
|
||||
"reviewer_native_or_private_database_secret_access": false
|
||||
},
|
||||
"preservation": "Full original20 safe metadata/sourcefiles plus exactoriginalmanifest and path/hashmap retained under root-evidence. New completed IN10 precedes formal acceptance; IN9source-review scope not stretched."
|
||||
}
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
{
|
||||
"exact_image_available": true,
|
||||
"pulled": true,
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"image_config_id": "sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"exact_registry_digest_bound": true,
|
||||
"source_labels_match": true,
|
||||
"container_execution": false,
|
||||
"credentials_used": false
|
||||
}
|
||||
|
|
@ -0,0 +1,672 @@
|
|||
{
|
||||
"all_checks_pass": true,
|
||||
"observed_at": "2026-10-11T10:44:51.809259+00:00",
|
||||
"native_changed": false,
|
||||
"protected_database_read": false,
|
||||
"secret_read": false,
|
||||
"deployment_generation": 25,
|
||||
"ready_replicas": 1,
|
||||
"sealed_live_deployment": {
|
||||
"apiVersion": "apps/v1",
|
||||
"kind": "Deployment",
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"argocd.argoproj.io/tracking-id": "informed-decision:apps/Deployment:informed-decision/informed-decision",
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision",
|
||||
"uid": "a588e10a-90d2-4883-975e-6dd8b8feca92"
|
||||
},
|
||||
"spec": {
|
||||
"progressDeadlineSeconds": 600,
|
||||
"replicas": 1,
|
||||
"revisionHistoryLimit": 10,
|
||||
"selector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"strategy": {
|
||||
"type": "Recreate"
|
||||
},
|
||||
"template": {
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"labels": {
|
||||
"app.kubernetes.io/component": "review",
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"automountServiceAccountToken": false,
|
||||
"containers": [
|
||||
{
|
||||
"env": [
|
||||
{
|
||||
"name": "INFD_KEYCAPE_ISSUER",
|
||||
"value": "https://kc.coulomb.social"
|
||||
},
|
||||
{
|
||||
"name": "INFD_CONTAINER_CONFIG",
|
||||
"value": "/configuration/runtime.json"
|
||||
}
|
||||
],
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"imagePullPolicy": "IfNotPresent",
|
||||
"livenessProbe": {
|
||||
"failureThreshold": 3,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"name": "informed-decision",
|
||||
"ports": [
|
||||
{
|
||||
"containerPort": 8080,
|
||||
"name": "http",
|
||||
"protocol": "TCP"
|
||||
},
|
||||
{
|
||||
"containerPort": 8081,
|
||||
"name": "workload",
|
||||
"protocol": "TCP"
|
||||
}
|
||||
],
|
||||
"readinessProbe": {
|
||||
"failureThreshold": 3,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"resources": {
|
||||
"limits": {
|
||||
"cpu": "500m",
|
||||
"memory": "256Mi"
|
||||
},
|
||||
"requests": {
|
||||
"cpu": "5m",
|
||||
"memory": "64Mi"
|
||||
}
|
||||
},
|
||||
"securityContext": {
|
||||
"allowPrivilegeEscalation": false,
|
||||
"capabilities": {
|
||||
"drop": [
|
||||
"ALL"
|
||||
]
|
||||
},
|
||||
"readOnlyRootFilesystem": true
|
||||
},
|
||||
"startupProbe": {
|
||||
"failureThreshold": 12,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"terminationMessagePath": "/dev/termination-log",
|
||||
"terminationMessagePolicy": "File",
|
||||
"volumeMounts": [
|
||||
{
|
||||
"mountPath": "/data",
|
||||
"name": "data"
|
||||
},
|
||||
{
|
||||
"mountPath": "/run/informed-decision",
|
||||
"name": "runtime"
|
||||
},
|
||||
{
|
||||
"mountPath": "/tmp",
|
||||
"name": "tmp"
|
||||
},
|
||||
{
|
||||
"mountPath": "/configuration",
|
||||
"name": "configuration",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/policy",
|
||||
"name": "caller",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/audit",
|
||||
"name": "audit",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/kubernetes",
|
||||
"name": "kubernetes-api",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/workload-registry",
|
||||
"name": "workload-registry",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/requester",
|
||||
"name": "sitting-requester",
|
||||
"readOnly": true
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"dnsPolicy": "ClusterFirst",
|
||||
"restartPolicy": "Always",
|
||||
"schedulerName": "default-scheduler",
|
||||
"securityContext": {
|
||||
"fsGroup": 10001,
|
||||
"fsGroupChangePolicy": "OnRootMismatch",
|
||||
"runAsGroup": 10001,
|
||||
"runAsNonRoot": true,
|
||||
"runAsUser": 10001,
|
||||
"seccompProfile": {
|
||||
"type": "RuntimeDefault"
|
||||
}
|
||||
},
|
||||
"serviceAccount": "review",
|
||||
"serviceAccountName": "review",
|
||||
"terminationGracePeriodSeconds": 45,
|
||||
"volumes": [
|
||||
{
|
||||
"name": "data",
|
||||
"persistentVolumeClaim": {
|
||||
"claimName": "informed-decision-data"
|
||||
}
|
||||
},
|
||||
{
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
},
|
||||
"name": "runtime"
|
||||
},
|
||||
{
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
},
|
||||
"name": "tmp"
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"defaultMode": 292,
|
||||
"name": "informed-decision-runtime-6c221878d051"
|
||||
},
|
||||
"name": "configuration"
|
||||
},
|
||||
{
|
||||
"name": "caller",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"audience": "flex-auth",
|
||||
"expirationSeconds": 3600,
|
||||
"path": "token"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "audit",
|
||||
"secret": {
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "token",
|
||||
"path": "token"
|
||||
}
|
||||
],
|
||||
"secretName": "informed-decision-audit"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "kubernetes-api",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"expirationSeconds": 600,
|
||||
"path": "token"
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"items": [
|
||||
{
|
||||
"key": "ca.crt",
|
||||
"path": "ca.crt"
|
||||
}
|
||||
],
|
||||
"name": "kube-root-ca.crt"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"defaultMode": 292,
|
||||
"name": "informed-decision-workload-registry"
|
||||
},
|
||||
"name": "workload-registry"
|
||||
},
|
||||
{
|
||||
"name": "sitting-requester",
|
||||
"secret": {
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "client-secret",
|
||||
"path": "client-secret"
|
||||
}
|
||||
],
|
||||
"optional": false,
|
||||
"secretName": "informed-decision-sitting-requester"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"candidate_deployment": {
|
||||
"apiVersion": "apps/v1",
|
||||
"kind": "Deployment",
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"argocd.argoproj.io/tracking-id": "informed-decision:apps/Deployment:informed-decision/informed-decision",
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision",
|
||||
"uid": "a588e10a-90d2-4883-975e-6dd8b8feca92"
|
||||
},
|
||||
"spec": {
|
||||
"progressDeadlineSeconds": 600,
|
||||
"replicas": 1,
|
||||
"revisionHistoryLimit": 10,
|
||||
"selector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"strategy": {
|
||||
"type": "Recreate"
|
||||
},
|
||||
"template": {
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"labels": {
|
||||
"app.kubernetes.io/component": "review",
|
||||
"app.kubernetes.io/name": "informed-decision"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"automountServiceAccountToken": false,
|
||||
"containers": [
|
||||
{
|
||||
"env": [
|
||||
{
|
||||
"name": "INFD_KEYCAPE_ISSUER",
|
||||
"value": "https://kc.coulomb.social"
|
||||
},
|
||||
{
|
||||
"name": "INFD_CONTAINER_CONFIG",
|
||||
"value": "/configuration/runtime.json"
|
||||
}
|
||||
],
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"imagePullPolicy": "IfNotPresent",
|
||||
"livenessProbe": {
|
||||
"failureThreshold": 3,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"name": "informed-decision",
|
||||
"ports": [
|
||||
{
|
||||
"containerPort": 8080,
|
||||
"name": "http",
|
||||
"protocol": "TCP"
|
||||
},
|
||||
{
|
||||
"containerPort": 8081,
|
||||
"name": "workload",
|
||||
"protocol": "TCP"
|
||||
}
|
||||
],
|
||||
"readinessProbe": {
|
||||
"failureThreshold": 3,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"resources": {
|
||||
"limits": {
|
||||
"cpu": "500m",
|
||||
"memory": "256Mi"
|
||||
},
|
||||
"requests": {
|
||||
"cpu": "5m",
|
||||
"memory": "64Mi"
|
||||
}
|
||||
},
|
||||
"securityContext": {
|
||||
"allowPrivilegeEscalation": false,
|
||||
"capabilities": {
|
||||
"drop": [
|
||||
"ALL"
|
||||
]
|
||||
},
|
||||
"readOnlyRootFilesystem": true
|
||||
},
|
||||
"startupProbe": {
|
||||
"failureThreshold": 12,
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http",
|
||||
"scheme": "HTTP"
|
||||
},
|
||||
"periodSeconds": 10,
|
||||
"successThreshold": 1,
|
||||
"timeoutSeconds": 2
|
||||
},
|
||||
"terminationMessagePath": "/dev/termination-log",
|
||||
"terminationMessagePolicy": "File",
|
||||
"volumeMounts": [
|
||||
{
|
||||
"mountPath": "/data",
|
||||
"name": "data"
|
||||
},
|
||||
{
|
||||
"mountPath": "/run/informed-decision",
|
||||
"name": "runtime"
|
||||
},
|
||||
{
|
||||
"mountPath": "/tmp",
|
||||
"name": "tmp"
|
||||
},
|
||||
{
|
||||
"mountPath": "/configuration",
|
||||
"name": "configuration",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/policy",
|
||||
"name": "caller",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/audit",
|
||||
"name": "audit",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/kubernetes",
|
||||
"name": "kubernetes-api",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/workload-registry",
|
||||
"name": "workload-registry",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/informed-decision/requester",
|
||||
"name": "sitting-requester",
|
||||
"readOnly": true
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"dnsPolicy": "ClusterFirst",
|
||||
"restartPolicy": "Always",
|
||||
"schedulerName": "default-scheduler",
|
||||
"securityContext": {
|
||||
"fsGroup": 10001,
|
||||
"fsGroupChangePolicy": "OnRootMismatch",
|
||||
"runAsGroup": 10001,
|
||||
"runAsNonRoot": true,
|
||||
"runAsUser": 10001,
|
||||
"seccompProfile": {
|
||||
"type": "RuntimeDefault"
|
||||
}
|
||||
},
|
||||
"serviceAccount": "review",
|
||||
"serviceAccountName": "review",
|
||||
"terminationGracePeriodSeconds": 45,
|
||||
"volumes": [
|
||||
{
|
||||
"name": "data",
|
||||
"persistentVolumeClaim": {
|
||||
"claimName": "informed-decision-data"
|
||||
}
|
||||
},
|
||||
{
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
},
|
||||
"name": "runtime"
|
||||
},
|
||||
{
|
||||
"emptyDir": {
|
||||
"medium": "Memory",
|
||||
"sizeLimit": "16Mi"
|
||||
},
|
||||
"name": "tmp"
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"defaultMode": 292,
|
||||
"name": "informed-decision-runtime-6c221878d051"
|
||||
},
|
||||
"name": "configuration"
|
||||
},
|
||||
{
|
||||
"name": "caller",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"audience": "flex-auth",
|
||||
"expirationSeconds": 3600,
|
||||
"path": "token"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "audit",
|
||||
"secret": {
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "token",
|
||||
"path": "token"
|
||||
}
|
||||
],
|
||||
"secretName": "informed-decision-audit"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "kubernetes-api",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"expirationSeconds": 600,
|
||||
"path": "token"
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"items": [
|
||||
{
|
||||
"key": "ca.crt",
|
||||
"path": "ca.crt"
|
||||
}
|
||||
],
|
||||
"name": "kube-root-ca.crt"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"defaultMode": 292,
|
||||
"name": "informed-decision-workload-registry"
|
||||
},
|
||||
"name": "workload-registry"
|
||||
},
|
||||
{
|
||||
"name": "sitting-requester",
|
||||
"secret": {
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "client-secret",
|
||||
"path": "client-secret"
|
||||
}
|
||||
],
|
||||
"optional": false,
|
||||
"secretName": "informed-decision-sitting-requester"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"sealed_dependencies": {
|
||||
"configmap": {
|
||||
"apiVersion": "v1",
|
||||
"immutable": true,
|
||||
"kind": "ConfigMap",
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"argocd.argoproj.io/tracking-id": "informed-decision:/ConfigMap:informed-decision/informed-decision-runtime-6c221878d051",
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
||||
},
|
||||
"name": "informed-decision-runtime-6c221878d051",
|
||||
"namespace": "informed-decision",
|
||||
"uid": "90113d2d-54d9-4e82-b1d3-90b49ebed2b5"
|
||||
},
|
||||
"canonical_data_sha256": "8ec462d12347548f506eeebf1e3c7cc47648019c8a783804d09bcc79b0f22af6"
|
||||
},
|
||||
"pvc": {
|
||||
"apiVersion": "v1",
|
||||
"kind": "PersistentVolumeClaim",
|
||||
"metadata": {
|
||||
"annotations": {
|
||||
"argocd.argoproj.io/tracking-id": "informed-decision:/PersistentVolumeClaim:informed-decision/informed-decision-data",
|
||||
"informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover",
|
||||
"pv.kubernetes.io/bind-completed": "yes",
|
||||
"pv.kubernetes.io/bound-by-controller": "yes",
|
||||
"volume.beta.kubernetes.io/storage-provisioner": "rancher.io/local-path",
|
||||
"volume.kubernetes.io/selected-node": "239.62.205.92.host.secureserver.net",
|
||||
"volume.kubernetes.io/storage-provisioner": "rancher.io/local-path"
|
||||
},
|
||||
"finalizers": [
|
||||
"kubernetes.io/pvc-protection"
|
||||
],
|
||||
"name": "informed-decision-data",
|
||||
"namespace": "informed-decision",
|
||||
"uid": "d80b25b1-141a-441b-b205-98fa2fd98b7c"
|
||||
},
|
||||
"spec": {
|
||||
"accessModes": [
|
||||
"ReadWriteOnce"
|
||||
],
|
||||
"resources": {
|
||||
"requests": {
|
||||
"storage": "1Gi"
|
||||
}
|
||||
},
|
||||
"storageClassName": "local-path",
|
||||
"volumeMode": "Filesystem",
|
||||
"volumeName": "pvc-d80b25b1-141a-441b-b205-98fa2fd98b7c"
|
||||
}
|
||||
},
|
||||
"pvc_phase": "Bound"
|
||||
},
|
||||
"argo": {
|
||||
"uid": "499868f2-eabc-4df4-ae31-b89ce58d750d",
|
||||
"source": {
|
||||
"path": "deploy/lifecycle",
|
||||
"repoURL": "https://forgejo.coulomb.social/coulomb/informed-decision.git",
|
||||
"targetRevision": "c96b0c6d881e855d1d158003c6de90ef390262e2"
|
||||
},
|
||||
"destination": {
|
||||
"namespace": "informed-decision",
|
||||
"server": "https://kubernetes.default.svc"
|
||||
},
|
||||
"automated": false,
|
||||
"health": {
|
||||
"lastTransitionTime": "2026-10-11T07:00:42Z",
|
||||
"status": "Healthy"
|
||||
},
|
||||
"sync": {
|
||||
"comparedTo": {
|
||||
"destination": {
|
||||
"namespace": "informed-decision",
|
||||
"server": "https://kubernetes.default.svc"
|
||||
},
|
||||
"source": {
|
||||
"path": "deploy/lifecycle",
|
||||
"repoURL": "https://forgejo.coulomb.social/coulomb/informed-decision.git",
|
||||
"targetRevision": "c96b0c6d881e855d1d158003c6de90ef390262e2"
|
||||
}
|
||||
},
|
||||
"revision": "c96b0c6d881e855d1d158003c6de90ef390262e2",
|
||||
"status": "OutOfSync"
|
||||
}
|
||||
},
|
||||
"server_dry_run_passed": true,
|
||||
"admission_only_image_delta": true,
|
||||
"client_diff_exit": 1,
|
||||
"client_diff_sha256": "ee53537b71df69ea1ce4a67498a47524d1aef87aa5ad1e9499c3f699f142762e",
|
||||
"allocatable_cpu_m": 4000,
|
||||
"requested_cpu_m": 3460,
|
||||
"strategy": "Recreate"
|
||||
}
|
||||
|
|
@ -0,0 +1,102 @@
|
|||
[
|
||||
{
|
||||
"original_path": "drill-backup.json",
|
||||
"archived_owner_path": "docs/evidence/2026-10-11-infd-zlib-native-acceptance/root-evidence/drill-backup.json",
|
||||
"sha256": "53ea89341b3ed9d62b6db11070c19a3f1a97aa705ca5e69f75e5badb6d0f085e"
|
||||
},
|
||||
{
|
||||
"original_path": "drill-copy.json",
|
||||
"archived_owner_path": "docs/evidence/2026-10-11-infd-zlib-native-acceptance/root-evidence/drill-copy.json",
|
||||
"sha256": "06011d148a022d7249f85e794455f297bf8193e19480762b667c8a42afa30e4e"
|
||||
},
|
||||
{
|
||||
"original_path": "offline-verify.json",
|
||||
"archived_owner_path": "docs/evidence/2026-10-11-infd-zlib-native-acceptance/root-evidence/offline-verify.json",
|
||||
"sha256": "4cf2df2c91877c87be8eebb279640473bb3627fe93ed4467467058e8f7baa7ab"
|
||||
},
|
||||
{
|
||||
"original_path": "cleanup-offline.json",
|
||||
"archived_owner_path": "docs/evidence/2026-10-11-infd-zlib-native-acceptance/root-evidence/cleanup-offline.json",
|
||||
"sha256": "ee89cddb506e65959c96b8da453443cd77e3a5cce927e0102acf56f28c38408c"
|
||||
},
|
||||
{
|
||||
"original_path": "cutover-backup.json",
|
||||
"archived_owner_path": "docs/evidence/2026-10-11-infd-zlib-native-acceptance/root-evidence/cutover-backup.json",
|
||||
"sha256": "3d7a79ddb6f29368284a2d87ffbf350e27a0548750e29e8a532ad9736b3e2cc7"
|
||||
},
|
||||
{
|
||||
"original_path": "cutover-copy.json",
|
||||
"archived_owner_path": "docs/evidence/2026-10-11-infd-zlib-native-acceptance/root-evidence/cutover-copy.json",
|
||||
"sha256": "14f008e0b8a7b1447847c3c02f1a07ffa13285832f91a6c5a795200f1c68c12f"
|
||||
},
|
||||
{
|
||||
"original_path": "release.json",
|
||||
"archived_owner_path": "docs/evidence/2026-10-11-infd-zlib-native-acceptance/root-evidence/release.json",
|
||||
"sha256": "05cb8b520c9414b5f3a39b2fa5f9b6bf07e93145390fd252c7ddf8cd618687d7"
|
||||
},
|
||||
{
|
||||
"original_path": "verify.json",
|
||||
"archived_owner_path": "docs/evidence/2026-10-11-infd-zlib-native-acceptance/root-evidence/verify.json",
|
||||
"sha256": "efe87612f116839340a8e4c777ee7a66f806c8b8ded7f4a13451ec858c838f9a"
|
||||
},
|
||||
{
|
||||
"original_path": "canonical-provider-verification.json",
|
||||
"archived_owner_path": "docs/evidence/2026-10-11-infd-zlib-native-acceptance/root-evidence/canonical-provider-verification.json",
|
||||
"sha256": "bee994ec4a965f2dccdd252feeb4b527f523fad172db8999849e7c9bc2b12794"
|
||||
},
|
||||
{
|
||||
"original_path": "fresh-scan-receipt.json",
|
||||
"archived_owner_path": "docs/evidence/2026-10-11-infd-zlib-native-acceptance/root-evidence/fresh-scan-receipt.json",
|
||||
"sha256": "0336de3a48d9e1af3e0d74ef7c4a4c01c3a0ac4418a1d84856e87c424dda6db1"
|
||||
},
|
||||
{
|
||||
"original_path": "fresh-scan-full.json",
|
||||
"archived_owner_path": "docs/evidence/2026-10-11-infd-zlib-native-acceptance/root-evidence/fresh-scan-full.json",
|
||||
"sha256": "42473695abfb99cb32ae29e607120996d339683da7987e9a91117aab9a7e5c00"
|
||||
},
|
||||
{
|
||||
"original_path": "confirmed-root-authority.json",
|
||||
"archived_owner_path": "docs/evidence/2026-10-11-infd-zlib-native-acceptance/root-evidence/confirmed-root-authority.json",
|
||||
"sha256": "0d64760ba43581a19ec74489e655e89af150083aa59cea2414c12faa76912e88"
|
||||
},
|
||||
{
|
||||
"original_path": "approved-native-preflight.json",
|
||||
"archived_owner_path": "docs/evidence/2026-10-11-infd-zlib-native-acceptance/root-evidence/approved-native-preflight.json",
|
||||
"sha256": "90a8222c400c8e21e4850111fd91c22be9d33c3de9e3351da2bb49c69c3d40eb"
|
||||
},
|
||||
{
|
||||
"original_path": "root-clock-diagnosis.json",
|
||||
"archived_owner_path": "docs/evidence/2026-10-11-infd-zlib-native-acceptance/root-evidence/root-clock-diagnosis.json",
|
||||
"sha256": "6e3cf5fee7471a58016652b7aa8a11756b40e0c8c75c5b74292fad8e11ec6ffe"
|
||||
},
|
||||
{
|
||||
"original_path": "prephase-refusal-first.json",
|
||||
"archived_owner_path": "docs/evidence/2026-10-11-infd-zlib-native-acceptance/root-evidence/prephase-refusal-first.json",
|
||||
"sha256": "ea63e675da65771a2971030e2b9f55b5c466f70209718be3d0bad8e0b314843d"
|
||||
},
|
||||
{
|
||||
"original_path": "prephase-refusal-second.json",
|
||||
"archived_owner_path": "docs/evidence/2026-10-11-infd-zlib-native-acceptance/root-evidence/prephase-refusal-second.json",
|
||||
"sha256": "ea63e675da65771a2971030e2b9f55b5c466f70209718be3d0bad8e0b314843d"
|
||||
},
|
||||
{
|
||||
"original_path": "prephase-refusal-traced.json",
|
||||
"archived_owner_path": "docs/evidence/2026-10-11-infd-zlib-native-acceptance/root-evidence/prephase-refusal-traced.json",
|
||||
"sha256": "2932b60db10ce8295b376e6b5964ce695a489699782dd03eb02d9cff9c25bfb6"
|
||||
},
|
||||
{
|
||||
"original_path": "root-authority-helper-before-clock-correction.py",
|
||||
"archived_owner_path": "docs/evidence/2026-10-11-infd-zlib-native-acceptance/root-evidence/root-authority-helper-before-clock-correction.py",
|
||||
"sha256": "64afd31c9776bd38c84f82972800fe59cbfb34b5315e9cb56aa25f5eb0e4c96d"
|
||||
},
|
||||
{
|
||||
"original_path": "root-authority-helper-final.py",
|
||||
"archived_owner_path": "docs/evidence/2026-10-11-infd-zlib-native-acceptance/root-evidence/root-authority-helper-final.py",
|
||||
"sha256": "0e4fde2db800d0055c5ef94bd4efcb4f29207dfdb7fbab5df370bac0c65aa42a"
|
||||
},
|
||||
{
|
||||
"original_path": "approved-local-image-readiness.json",
|
||||
"archived_owner_path": "docs/evidence/2026-10-11-infd-zlib-native-acceptance/root-evidence/approved-local-image-readiness.json",
|
||||
"sha256": "285bd23bc05a41fe9942e399527594da896f9a2160af757c9b7ffa9e006fbf37"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,48 @@
|
|||
{
|
||||
"before": {
|
||||
"all_checks_pass": true,
|
||||
"observed_at": "2026-10-11T11:20:14.889361+00:00",
|
||||
"deployment_uid": "a588e10a-90d2-4883-975e-6dd8b8feca92",
|
||||
"generation": 26,
|
||||
"ready_replicas": 1,
|
||||
"pod_name": "informed-decision-68d5f488d8-c576r",
|
||||
"pod_uid": "1153f806-1e05-4596-baf3-a4fa8adf08be",
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"image_id": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"application_revision": "312ab97e876e17341bf16f9e95397e14c2ac2720",
|
||||
"application_health": "Healthy",
|
||||
"native_data_change": false
|
||||
},
|
||||
"native_provider": {
|
||||
"request_memo_id": "infd-20261011-zlib-remediation-r1",
|
||||
"request_memo_version": 1,
|
||||
"request_identity_source": "fixed-authenticated-route",
|
||||
"has_review": true,
|
||||
"disposition_count": 1,
|
||||
"dispositions_interpreted": false,
|
||||
"approval_inferred": false,
|
||||
"current_approval_claimed": false,
|
||||
"http_status": 200,
|
||||
"observed_at": "2026-10-11T11:20:25.876927+00:00",
|
||||
"native_authenticated_canonical_lifecycle_outcomes": true,
|
||||
"native_provider_path_returned": true,
|
||||
"credential_material_output": false
|
||||
},
|
||||
"after": {
|
||||
"all_checks_pass": true,
|
||||
"observed_at": "2026-10-11T11:20:27.541827+00:00",
|
||||
"deployment_uid": "a588e10a-90d2-4883-975e-6dd8b8feca92",
|
||||
"generation": 26,
|
||||
"ready_replicas": 1,
|
||||
"pod_name": "informed-decision-68d5f488d8-c576r",
|
||||
"pod_uid": "1153f806-1e05-4596-baf3-a4fa8adf08be",
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"image_id": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"application_revision": "312ab97e876e17341bf16f9e95397e14c2ac2720",
|
||||
"application_health": "Healthy",
|
||||
"native_data_change": false
|
||||
},
|
||||
"provider_command_sha256": "ddfe2619f4847238fe79ec779a15b0d8df5d178cbed989ac2d73c1480b57a706",
|
||||
"founder_approval_inferred": false,
|
||||
"protected_database_contents_exported": false
|
||||
}
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
{
|
||||
"all_checks_pass": true,
|
||||
"only_disposable_offline_volume_removed": "infd-zlib-r1-restore-20261011",
|
||||
"native_and_offcluster_original_snapshots_retained": true
|
||||
}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
{
|
||||
"proposal_id": "INFD-WP-0009-T05/zlib85091-r1",
|
||||
"memo_id": "infd-20261011-zlib-remediation-r1",
|
||||
"memo_version": 1,
|
||||
"memo_sha256": "5dea0d404e4d13683fbf71d56273c06db7a6a916ab68759a90d7394005eee206",
|
||||
"source_revision": "312ab97e876e17341bf16f9e95397e14c2ac2720",
|
||||
"executor_plan_sha256": "d871081999215bd3850ab1173064ed6cb6d7c23b26d9c3d5b3c5940e698d4c61",
|
||||
"native_outcome_sha256": "7cd00372d1a7c4fb4dc92e2c550d8d4c586f96cda3aecec8016a883370893c86",
|
||||
"activation": "APPROVED",
|
||||
"authority_mode": "ADMINISTER",
|
||||
"target": "realm:kubernetes/railiance01/informed-decision",
|
||||
"verification_method": "root-fixed-origin-native-readback",
|
||||
"runtime_authenticated_grant": false,
|
||||
"outcome_query": "/lifecycle/memos/infd-20261011-zlib-remediation-r1/outcomes?version=1",
|
||||
"verified_at": "2026-10-11T11:19:17.592644+00:00",
|
||||
"review_memo_id": "review-2cf690a6-8c46-4faa-826c-a24a88d53dea",
|
||||
"approval_id": "b5ce337c-5d7d-44fa-864d-706b54039f7c",
|
||||
"disposition_id": "disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f",
|
||||
"accepted_at": "2026-10-11T10:40:55Z",
|
||||
"bounded_outage_rollback_pre_authorized": true,
|
||||
"note": "Template is not evidence/approval. Root sets scopedpreauthorizationtrue only after actual confirmed founder acceptance of this exact new packet/terms, retains original currentreadback before release.",
|
||||
"native_observed_at": "2026-10-11T11:19:18.476232+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,53 @@
|
|||
{
|
||||
"phase": "cutover-backup",
|
||||
"all_checks_pass": true,
|
||||
"raw_output_withheld": true,
|
||||
"native_approval_verified_by_root": {
|
||||
"approval_id": "b5ce337c-5d7d-44fa-864d-706b54039f7c",
|
||||
"disposition_id": "disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f",
|
||||
"accepted_at": "2026-10-11T10:40:55Z",
|
||||
"verified_at": "2026-10-11T11:17:33.972874+00:00"
|
||||
},
|
||||
"native_authenticated_grant": false,
|
||||
"source_readonly_baseline": {
|
||||
"schema_version": 5,
|
||||
"lifecycle": {
|
||||
"records": 17,
|
||||
"events": 59,
|
||||
"pending": 0
|
||||
},
|
||||
"outbox": {
|
||||
"delivered": 344
|
||||
},
|
||||
"submissions": {
|
||||
"confirmed": 44
|
||||
},
|
||||
"integrity": "ok",
|
||||
"read_only_pre_open": true,
|
||||
"store_constructed": false
|
||||
},
|
||||
"snapshot_readonly": {
|
||||
"schema_version": 5,
|
||||
"lifecycle": {
|
||||
"records": 17,
|
||||
"events": 59,
|
||||
"pending": 0
|
||||
},
|
||||
"outbox": {
|
||||
"delivered": 344
|
||||
},
|
||||
"submissions": {
|
||||
"confirmed": 44
|
||||
},
|
||||
"integrity": "ok",
|
||||
"read_only_pre_open": true,
|
||||
"store_constructed": false
|
||||
},
|
||||
"snapshot_sha256": "e0bac513f7445bf702c504ec7c15a1eb277ed7a48529099437d0dd63cf0679bb",
|
||||
"snapshot_bytes": 23347200,
|
||||
"snapshot_file": "cutover.sqlite",
|
||||
"native_parent_private": true,
|
||||
"native_uid": 10001,
|
||||
"pod_name": "informed-decision-5557446c88-lvm88",
|
||||
"pod_uid": "c4cb1550-feda-4097-9de4-d891a657b662"
|
||||
}
|
||||
|
|
@ -0,0 +1,36 @@
|
|||
{
|
||||
"phase": "cutover-copy",
|
||||
"all_checks_pass": true,
|
||||
"raw_output_withheld": true,
|
||||
"native_approval_verified_by_root": {
|
||||
"approval_id": "b5ce337c-5d7d-44fa-864d-706b54039f7c",
|
||||
"disposition_id": "disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f",
|
||||
"accepted_at": "2026-10-11T10:40:55Z",
|
||||
"verified_at": "2026-10-11T11:18:05.531924+00:00"
|
||||
},
|
||||
"native_authenticated_grant": false,
|
||||
"snapshot_file": "cutover.sqlite",
|
||||
"snapshot_bytes": 23347200,
|
||||
"snapshot_sha256": "e0bac513f7445bf702c504ec7c15a1eb277ed7a48529099437d0dd63cf0679bb",
|
||||
"snapshot_readonly": {
|
||||
"schema_version": 5,
|
||||
"lifecycle": {
|
||||
"records": 17,
|
||||
"events": 59,
|
||||
"pending": 0
|
||||
},
|
||||
"outbox": {
|
||||
"delivered": 344
|
||||
},
|
||||
"submissions": {
|
||||
"confirmed": 44
|
||||
},
|
||||
"integrity": "ok",
|
||||
"read_only_pre_open": true,
|
||||
"store_constructed": false
|
||||
},
|
||||
"pod_name": "informed-decision-5557446c88-lvm88",
|
||||
"pod_uid": "c4cb1550-feda-4097-9de4-d891a657b662",
|
||||
"off_cluster_private_copy_verified": true,
|
||||
"snapshot_contents_output": false
|
||||
}
|
||||
|
|
@ -0,0 +1,53 @@
|
|||
{
|
||||
"phase": "drill-backup",
|
||||
"all_checks_pass": true,
|
||||
"raw_output_withheld": true,
|
||||
"native_approval_verified_by_root": {
|
||||
"approval_id": "b5ce337c-5d7d-44fa-864d-706b54039f7c",
|
||||
"disposition_id": "disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f",
|
||||
"accepted_at": "2026-10-11T10:40:55Z",
|
||||
"verified_at": "2026-10-11T11:11:32.769166+00:00"
|
||||
},
|
||||
"native_authenticated_grant": false,
|
||||
"source_readonly_baseline": {
|
||||
"schema_version": 5,
|
||||
"lifecycle": {
|
||||
"records": 17,
|
||||
"events": 59,
|
||||
"pending": 0
|
||||
},
|
||||
"outbox": {
|
||||
"delivered": 344
|
||||
},
|
||||
"submissions": {
|
||||
"confirmed": 44
|
||||
},
|
||||
"integrity": "ok",
|
||||
"read_only_pre_open": true,
|
||||
"store_constructed": false
|
||||
},
|
||||
"snapshot_readonly": {
|
||||
"schema_version": 5,
|
||||
"lifecycle": {
|
||||
"records": 17,
|
||||
"events": 59,
|
||||
"pending": 0
|
||||
},
|
||||
"outbox": {
|
||||
"delivered": 344
|
||||
},
|
||||
"submissions": {
|
||||
"confirmed": 44
|
||||
},
|
||||
"integrity": "ok",
|
||||
"read_only_pre_open": true,
|
||||
"store_constructed": false
|
||||
},
|
||||
"snapshot_sha256": "97d7dfb8fce4f720456468ff169f5e2b2bcb1edc328687b1a6c1225b66f2b0ba",
|
||||
"snapshot_bytes": 23330816,
|
||||
"snapshot_file": "drill.sqlite",
|
||||
"native_parent_private": true,
|
||||
"native_uid": 10001,
|
||||
"pod_name": "informed-decision-5557446c88-lvm88",
|
||||
"pod_uid": "c4cb1550-feda-4097-9de4-d891a657b662"
|
||||
}
|
||||
|
|
@ -0,0 +1,36 @@
|
|||
{
|
||||
"phase": "drill-copy",
|
||||
"all_checks_pass": true,
|
||||
"raw_output_withheld": true,
|
||||
"native_approval_verified_by_root": {
|
||||
"approval_id": "b5ce337c-5d7d-44fa-864d-706b54039f7c",
|
||||
"disposition_id": "disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f",
|
||||
"accepted_at": "2026-10-11T10:40:55Z",
|
||||
"verified_at": "2026-10-11T11:12:17.399753+00:00"
|
||||
},
|
||||
"native_authenticated_grant": false,
|
||||
"snapshot_file": "drill.sqlite",
|
||||
"snapshot_bytes": 23330816,
|
||||
"snapshot_sha256": "97d7dfb8fce4f720456468ff169f5e2b2bcb1edc328687b1a6c1225b66f2b0ba",
|
||||
"snapshot_readonly": {
|
||||
"schema_version": 5,
|
||||
"lifecycle": {
|
||||
"records": 17,
|
||||
"events": 59,
|
||||
"pending": 0
|
||||
},
|
||||
"outbox": {
|
||||
"delivered": 344
|
||||
},
|
||||
"submissions": {
|
||||
"confirmed": 44
|
||||
},
|
||||
"integrity": "ok",
|
||||
"read_only_pre_open": true,
|
||||
"store_constructed": false
|
||||
},
|
||||
"pod_name": "informed-decision-5557446c88-lvm88",
|
||||
"pod_uid": "c4cb1550-feda-4097-9de4-d891a657b662",
|
||||
"off_cluster_private_copy_verified": true,
|
||||
"snapshot_contents_output": false
|
||||
}
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,68 @@
|
|||
{
|
||||
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
|
||||
"artifact_source_revision": "9b4bb25d325698ae543e7e8a8a3c3592db1f58fc",
|
||||
"scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
|
||||
"full_allseverity_scan": true,
|
||||
"no_suppression": true,
|
||||
"exit_code": 0,
|
||||
"completed_at": "2026-10-11T10:48:46.790940+00:00",
|
||||
"db_metadata": {
|
||||
"Version": 2,
|
||||
"NextUpdate": "2026-10-11T18:59:50.889010572Z",
|
||||
"UpdatedAt": "2026-10-10T18:59:50.889010923Z",
|
||||
"DownloadedAt": "2026-10-10T23:32:32.380033131Z"
|
||||
},
|
||||
"db_sha256": "03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917",
|
||||
"full_report_sha256": "42473695abfb99cb32ae29e607120996d339683da7987e9a91117aab9a7e5c00",
|
||||
"public_archive_sha256": "d24993af69028c6ac43640ee17dcccdc3e962cda4bc28dc8000b4ac77728bc2d",
|
||||
"archive_config_and_11_layers_verified": true,
|
||||
"started_at": "2026-10-11T10:48:21.420853+00:00",
|
||||
"command": [
|
||||
"docker",
|
||||
"--config",
|
||||
"/tmp/infd-zlib-fresh-rescan-20261011T104821420853Z/empty-docker-config",
|
||||
"--host",
|
||||
"unix:///var/run/docker.sock",
|
||||
"run",
|
||||
"--rm",
|
||||
"--user",
|
||||
"1000:1000",
|
||||
"--network",
|
||||
"none",
|
||||
"--cpus",
|
||||
"1",
|
||||
"--memory",
|
||||
"1g",
|
||||
"--read-only",
|
||||
"--tmpfs",
|
||||
"/tmp:rw,nosuid,nodev,noexec,size=268435456",
|
||||
"--cap-drop",
|
||||
"ALL",
|
||||
"--security-opt",
|
||||
"no-new-privileges",
|
||||
"-v",
|
||||
"/tmp/infd-zlib-published-9b4bb25d/image.tar:/artifact/image.tar:ro",
|
||||
"-v",
|
||||
"/tmp/infd-zlib-fresh-rescan-20261011T104821420853Z/scanner-cache:/cache",
|
||||
"-v",
|
||||
"/tmp/infd-zlib-fresh-rescan-20261011T104821420853Z:/output",
|
||||
"aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
|
||||
"image",
|
||||
"--input",
|
||||
"/artifact/image.tar",
|
||||
"--cache-dir",
|
||||
"/cache",
|
||||
"--skip-db-update",
|
||||
"--skip-java-db-update",
|
||||
"--scanners",
|
||||
"vuln",
|
||||
"--format",
|
||||
"json",
|
||||
"--output",
|
||||
"/output/trivy-full.json"
|
||||
],
|
||||
"raw_output_withheld": true,
|
||||
"native_actions": false,
|
||||
"native_database_read": false,
|
||||
"credential_read": false
|
||||
}
|
||||
|
|
@ -0,0 +1,68 @@
|
|||
{
|
||||
"all_checks_pass": true,
|
||||
"offline_volume": "infd-zlib-r1-restore-20261011",
|
||||
"offline_readonly": {
|
||||
"integrity": "ok",
|
||||
"lifecycle": {
|
||||
"events": 59,
|
||||
"pending": 0,
|
||||
"records": 17
|
||||
},
|
||||
"outbox": {
|
||||
"delivered": 344
|
||||
},
|
||||
"read_only_pre_open": true,
|
||||
"schema_version": 5,
|
||||
"store_constructed": false,
|
||||
"submissions": {
|
||||
"confirmed": 44
|
||||
}
|
||||
},
|
||||
"offline_post_admin_readonly": {
|
||||
"integrity": "ok",
|
||||
"lifecycle": {
|
||||
"events": 59,
|
||||
"pending": 0,
|
||||
"records": 17
|
||||
},
|
||||
"outbox": {
|
||||
"delivered": 344
|
||||
},
|
||||
"read_only_pre_open": true,
|
||||
"schema_version": 5,
|
||||
"store_constructed": false,
|
||||
"submissions": {
|
||||
"confirmed": 44
|
||||
}
|
||||
},
|
||||
"original_snapshot_hash_unchanged": true,
|
||||
"created_volume_identity": {
|
||||
"Name": "infd-zlib-r1-restore-20261011",
|
||||
"Labels": {
|
||||
"informed-decision.attempt": "643de582-9501-45dd-bac1-754b8524f5b9",
|
||||
"informed-decision.case": "infd-zlib-20261011-r1",
|
||||
"informed-decision.use": "offline-restore-only"
|
||||
},
|
||||
"Driver": "local",
|
||||
"Scope": "local",
|
||||
"CreatedAt": "2026-10-11T13:16:36+02:00"
|
||||
},
|
||||
"admin_counts": {
|
||||
"schema_version": 5,
|
||||
"lifecycle": {
|
||||
"records": 17,
|
||||
"events": 59,
|
||||
"pending": 0
|
||||
},
|
||||
"outbox": {
|
||||
"delivered": 344
|
||||
},
|
||||
"submissions": {
|
||||
"confirmed": 44
|
||||
}
|
||||
},
|
||||
"network": "none",
|
||||
"runtime_tokens_or_config_mounted": false,
|
||||
"service_entrypoint_started": false,
|
||||
"original_snapshot_retained": true
|
||||
}
|
||||
|
|
@ -0,0 +1,82 @@
|
|||
[
|
||||
{
|
||||
"path": "drill-backup.json",
|
||||
"sha256": "53ea89341b3ed9d62b6db11070c19a3f1a97aa705ca5e69f75e5badb6d0f085e"
|
||||
},
|
||||
{
|
||||
"path": "drill-copy.json",
|
||||
"sha256": "06011d148a022d7249f85e794455f297bf8193e19480762b667c8a42afa30e4e"
|
||||
},
|
||||
{
|
||||
"path": "offline-verify.json",
|
||||
"sha256": "4cf2df2c91877c87be8eebb279640473bb3627fe93ed4467467058e8f7baa7ab"
|
||||
},
|
||||
{
|
||||
"path": "cleanup-offline.json",
|
||||
"sha256": "ee89cddb506e65959c96b8da453443cd77e3a5cce927e0102acf56f28c38408c"
|
||||
},
|
||||
{
|
||||
"path": "cutover-backup.json",
|
||||
"sha256": "3d7a79ddb6f29368284a2d87ffbf350e27a0548750e29e8a532ad9736b3e2cc7"
|
||||
},
|
||||
{
|
||||
"path": "cutover-copy.json",
|
||||
"sha256": "14f008e0b8a7b1447847c3c02f1a07ffa13285832f91a6c5a795200f1c68c12f"
|
||||
},
|
||||
{
|
||||
"path": "release.json",
|
||||
"sha256": "05cb8b520c9414b5f3a39b2fa5f9b6bf07e93145390fd252c7ddf8cd618687d7"
|
||||
},
|
||||
{
|
||||
"path": "verify.json",
|
||||
"sha256": "efe87612f116839340a8e4c777ee7a66f806c8b8ded7f4a13451ec858c838f9a"
|
||||
},
|
||||
{
|
||||
"path": "canonical-provider-verification.json",
|
||||
"sha256": "bee994ec4a965f2dccdd252feeb4b527f523fad172db8999849e7c9bc2b12794"
|
||||
},
|
||||
{
|
||||
"path": "fresh-scan-receipt.json",
|
||||
"sha256": "0336de3a48d9e1af3e0d74ef7c4a4c01c3a0ac4418a1d84856e87c424dda6db1"
|
||||
},
|
||||
{
|
||||
"path": "fresh-scan-full.json",
|
||||
"sha256": "42473695abfb99cb32ae29e607120996d339683da7987e9a91117aab9a7e5c00"
|
||||
},
|
||||
{
|
||||
"path": "confirmed-root-authority.json",
|
||||
"sha256": "0d64760ba43581a19ec74489e655e89af150083aa59cea2414c12faa76912e88"
|
||||
},
|
||||
{
|
||||
"path": "approved-native-preflight.json",
|
||||
"sha256": "90a8222c400c8e21e4850111fd91c22be9d33c3de9e3351da2bb49c69c3d40eb"
|
||||
},
|
||||
{
|
||||
"path": "root-clock-diagnosis.json",
|
||||
"sha256": "6e3cf5fee7471a58016652b7aa8a11756b40e0c8c75c5b74292fad8e11ec6ffe"
|
||||
},
|
||||
{
|
||||
"path": "prephase-refusal-first.json",
|
||||
"sha256": "ea63e675da65771a2971030e2b9f55b5c466f70209718be3d0bad8e0b314843d"
|
||||
},
|
||||
{
|
||||
"path": "prephase-refusal-second.json",
|
||||
"sha256": "ea63e675da65771a2971030e2b9f55b5c466f70209718be3d0bad8e0b314843d"
|
||||
},
|
||||
{
|
||||
"path": "prephase-refusal-traced.json",
|
||||
"sha256": "2932b60db10ce8295b376e6b5964ce695a489699782dd03eb02d9cff9c25bfb6"
|
||||
},
|
||||
{
|
||||
"path": "root-authority-helper-before-clock-correction.py",
|
||||
"sha256": "64afd31c9776bd38c84f82972800fe59cbfb34b5315e9cb56aa25f5eb0e4c96d"
|
||||
},
|
||||
{
|
||||
"path": "root-authority-helper-final.py",
|
||||
"sha256": "0e4fde2db800d0055c5ef94bd4efcb4f29207dfdb7fbab5df370bac0c65aa42a"
|
||||
},
|
||||
{
|
||||
"path": "approved-local-image-readiness.json",
|
||||
"sha256": "285bd23bc05a41fe9942e399527594da896f9a2160af757c9b7ffa9e006fbf37"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
{
|
||||
"all_checks_pass": false,
|
||||
"phase": "drill-backup",
|
||||
"status": "phase_receipt_unverified",
|
||||
"raw_output_withheld": true
|
||||
}
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
{
|
||||
"all_checks_pass": false,
|
||||
"phase": "drill-backup",
|
||||
"status": "phase_receipt_unverified",
|
||||
"raw_output_withheld": true
|
||||
}
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
{
|
||||
"all_checks_pass": false,
|
||||
"phase": "drill-backup",
|
||||
"status": "prephase_receipt_unverified",
|
||||
"exception_locations": [
|
||||
{
|
||||
"file": "actuator.py",
|
||||
"line": 321,
|
||||
"exception_type": "ValueError"
|
||||
},
|
||||
{
|
||||
"file": "actuator.py",
|
||||
"line": 23,
|
||||
"exception_type": "ValueError"
|
||||
},
|
||||
{
|
||||
"file": "actuator.py",
|
||||
"line": 325,
|
||||
"exception_type": "ValueError"
|
||||
},
|
||||
{
|
||||
"file": "actuator.py",
|
||||
"line": 397,
|
||||
"exception_type": "ValueError"
|
||||
},
|
||||
{
|
||||
"file": "actuator.py",
|
||||
"line": 399,
|
||||
"exception_type": "SystemExit"
|
||||
}
|
||||
],
|
||||
"raw_output_withheld": true
|
||||
}
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
{
|
||||
"phase": "release",
|
||||
"all_checks_pass": true,
|
||||
"raw_output_withheld": true,
|
||||
"native_approval_verified_by_root": {
|
||||
"approval_id": "b5ce337c-5d7d-44fa-864d-706b54039f7c",
|
||||
"disposition_id": "disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f",
|
||||
"accepted_at": "2026-10-11T10:40:55Z",
|
||||
"verified_at": "2026-10-11T11:18:37.429056+00:00"
|
||||
},
|
||||
"native_authenticated_grant": false,
|
||||
"live_readonly_schema_integrity_counts": {
|
||||
"schema_version": 5,
|
||||
"lifecycle": {
|
||||
"records": 17,
|
||||
"events": 59,
|
||||
"pending": 0
|
||||
},
|
||||
"outbox": {
|
||||
"delivered": 344
|
||||
},
|
||||
"submissions": {
|
||||
"confirmed": 44
|
||||
},
|
||||
"integrity": "ok",
|
||||
"read_only_pre_open": true,
|
||||
"store_constructed": false
|
||||
},
|
||||
"live_counts_may_include_concurrent_commits": true,
|
||||
"pod_name": "informed-decision-5557446c88-lvm88",
|
||||
"pod_uid": "c4cb1550-feda-4097-9de4-d891a657b662",
|
||||
"operation_requested": true,
|
||||
"source_revision": "312ab97e876e17341bf16f9e95397e14c2ac2720",
|
||||
"resources": [
|
||||
{
|
||||
"group": "apps",
|
||||
"kind": "Deployment",
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision"
|
||||
}
|
||||
],
|
||||
"prune": false,
|
||||
"rollout_verified": false,
|
||||
"latest_live_database_retained": true,
|
||||
"client_diff_sha256": "d61acc1da118dbd1dee8a94080c8b48a2e12f4b144704b2cb49f3443c49a3587"
|
||||
}
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
import datetime,hashlib,json,os,stat,subprocess
|
||||
from pathlib import Path
|
||||
base=Path('/home/worsch/informed-decision/docs/evidence/2026-10-11-zlib-image-release')
|
||||
revision='312ab97e876e17341bf16f9e95397e14c2ac2720'
|
||||
program='''import json,re,urllib.request
|
||||
from datetime import datetime,timezone
|
||||
from api.services.memo_dispatch import ORIGIN,NoRedirect,token_file
|
||||
ident='infd-20261011-zlib-remediation-r1';expected='review-2cf690a6-8c46-4faa-826c-a24a88d53dea'
|
||||
try:
|
||||
request=urllib.request.Request(ORIGIN+'/v1/decisions/'+ident+'/outcomes?version=1',headers={'Authorization':'Bearer '+token_file('/var/run/secrets/state-hub/informed-decision/lifecycle-token')})
|
||||
opener=urllib.request.build_opener(urllib.request.ProxyHandler({}),NoRedirect())
|
||||
with opener.open(request,timeout=20) as response:
|
||||
raw=response.read(1024*1024+1)
|
||||
if response.code!=200 or len(raw)>1024*1024:raise ValueError('response_refused')
|
||||
value=json.loads(raw);review=value['review'];rows=value['dispositions']
|
||||
if not isinstance(review,dict) or review.get('memo_id')!=expected or review.get('stale') is not False or review.get('intake_state')!='ready' or not isinstance(rows,list):raise ValueError('review_refused')
|
||||
if len(rows)!=1:print(json.dumps({'status':'approval_pending','disposition_count':len(rows)}));raise SystemExit(3)
|
||||
row=rows[0];d=row['disposition'];founder={'kind':'person','sub':'uid=platform-root,ou=people,dc=netkingdom,dc=local'}
|
||||
if row.get('submission_state')!='confirmed' or d.get('verb')!='accept':print(json.dumps({'status':'approval_not_confirmed_accept'}));raise SystemExit(3)
|
||||
if d.get('actor')!=founder or d.get('memo_version')!=1 or d.get('memo_id')!=expected or not re.fullmatch('[a-f0-9-]{36}',d.get('approval_id','')) or not re.fullmatch('disp-[a-f0-9-]{36}',d.get('id','')):raise ValueError('founder_refused')
|
||||
accepted=datetime.fromisoformat(d['at'].replace('Z','+00:00'));now=datetime.now(timezone.utc)
|
||||
if accepted.tzinfo is None or accepted>now:raise ValueError('time_refused')
|
||||
normalized={'memo_id':ident,'request_identity_origin':'fixed_authenticated_request_route','review':{'memo_id':expected,'intake_state':'ready','stale':False},'dispositions':[{'submission_state':'confirmed','disposition':{k:d[k] for k in ['id','at','memo_id','memo_version','verb','approval_id','actor']}}],'observed_at':now.isoformat()}
|
||||
print(json.dumps({'status':'confirmed_founder_acceptance','normalized_outcome':normalized}),flush=True)
|
||||
except SystemExit:raise
|
||||
except Exception:print(json.dumps({'status':'native_readback_unverified'}),flush=True);raise SystemExit(1) from None
|
||||
'''
|
||||
run=subprocess.run(['ssh','railiance01','kubectl -n state-hub exec -i deployment/state-hub-memo-dispatch -c dispatcher -- python -'],input=program,text=True,capture_output=True,timeout=60)
|
||||
try:result=json.loads(run.stdout)
|
||||
except Exception:raise SystemExit('Native readback unverified; raw transport suppressed')
|
||||
if run.returncode or result.get('status')!='confirmed_founder_acceptance':print(json.dumps({'status':result.get('status','native_readback_unverified'),'native_action':False}));raise SystemExit(3)
|
||||
outcome=result['normalized_outcome'];d=outcome['dispositions'][0]['disposition']
|
||||
raw=(json.dumps(outcome,sort_keys=True,indent=2)+'\n').encode()
|
||||
receipt=json.loads((base/'root-authority-receipt-template.json').read_text())
|
||||
receipt.update(memo_sha256=hashlib.sha256((base/'memo.json').read_bytes()).hexdigest(),source_revision=revision,executor_plan_sha256=hashlib.sha256((base/'execution/execution-plan.json').read_bytes()).hexdigest(),native_outcome_sha256=hashlib.sha256(raw).hexdigest(),activation='APPROVED',verified_at=outcome['observed_at'],review_memo_id=outcome['review']['memo_id'],approval_id=d['approval_id'],disposition_id=d['id'],accepted_at=d['at'],bounded_outage_rollback_pre_authorized=True)
|
||||
for path,data in [(Path('/tmp/security-infd-zlib-native-outcome-latest.json'),raw),(Path('/tmp/security-infd-zlib-root-authority.json'),(json.dumps(receipt,indent=2)+'\n').encode())]:
|
||||
if path.exists():
|
||||
info=path.lstat()
|
||||
if not stat.S_ISREG(info.st_mode) or info.st_uid!=os.getuid() or info.st_nlink!=1:raise SystemExit('Authority custody refused')
|
||||
fd=os.open(path,os.O_CREAT|os.O_TRUNC|os.O_WRONLY|os.O_NOFOLLOW,0o600);os.fchmod(fd,0o600)
|
||||
with os.fdopen(fd,'wb') as f:f.write(data);f.flush();os.fsync(f.fileno())
|
||||
print(json.dumps({'status':'confirmed_founder_acceptance','approval_id':d['approval_id'],'disposition_id':d['id'],'accepted_at':d['at'],'source_revision':revision,'verified_at':receipt['verified_at'],'native_action':False}))
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
import datetime,hashlib,json,os,stat,subprocess
|
||||
from pathlib import Path
|
||||
base=Path('/home/worsch/informed-decision/docs/evidence/2026-10-11-zlib-image-release')
|
||||
revision='312ab97e876e17341bf16f9e95397e14c2ac2720'
|
||||
program='''import json,re,urllib.request
|
||||
from datetime import datetime,timezone
|
||||
from api.services.memo_dispatch import ORIGIN,NoRedirect,token_file
|
||||
ident='infd-20261011-zlib-remediation-r1';expected='review-2cf690a6-8c46-4faa-826c-a24a88d53dea'
|
||||
try:
|
||||
request=urllib.request.Request(ORIGIN+'/v1/decisions/'+ident+'/outcomes?version=1',headers={'Authorization':'Bearer '+token_file('/var/run/secrets/state-hub/informed-decision/lifecycle-token')})
|
||||
opener=urllib.request.build_opener(urllib.request.ProxyHandler({}),NoRedirect())
|
||||
with opener.open(request,timeout=20) as response:
|
||||
raw=response.read(1024*1024+1)
|
||||
if response.code!=200 or len(raw)>1024*1024:raise ValueError('response_refused')
|
||||
value=json.loads(raw);review=value['review'];rows=value['dispositions']
|
||||
if not isinstance(review,dict) or review.get('memo_id')!=expected or review.get('stale') is not False or review.get('intake_state')!='ready' or not isinstance(rows,list):raise ValueError('review_refused')
|
||||
if len(rows)!=1:print(json.dumps({'status':'approval_pending','disposition_count':len(rows)}));raise SystemExit(3)
|
||||
row=rows[0];d=row['disposition'];founder={'kind':'person','sub':'uid=platform-root,ou=people,dc=netkingdom,dc=local'}
|
||||
if row.get('submission_state')!='confirmed' or d.get('verb')!='accept':print(json.dumps({'status':'approval_not_confirmed_accept'}));raise SystemExit(3)
|
||||
if d.get('actor')!=founder or d.get('memo_version')!=1 or d.get('memo_id')!=expected or not re.fullmatch('[a-f0-9-]{36}',d.get('approval_id','')) or not re.fullmatch('disp-[a-f0-9-]{36}',d.get('id','')):raise ValueError('founder_refused')
|
||||
accepted=datetime.fromisoformat(d['at'].replace('Z','+00:00'));now=datetime.now(timezone.utc)
|
||||
if accepted.tzinfo is None or accepted>now:raise ValueError('time_refused')
|
||||
normalized={'memo_id':ident,'request_identity_origin':'fixed_authenticated_request_route','review':{'memo_id':expected,'intake_state':'ready','stale':False},'dispositions':[{'submission_state':'confirmed','disposition':{k:d[k] for k in ['id','at','memo_id','memo_version','verb','approval_id','actor']}}],'observed_at':now.isoformat()}
|
||||
print(json.dumps({'status':'confirmed_founder_acceptance','normalized_outcome':normalized}),flush=True)
|
||||
except SystemExit:raise
|
||||
except Exception:print(json.dumps({'status':'native_readback_unverified'}),flush=True);raise SystemExit(1) from None
|
||||
'''
|
||||
run=subprocess.run(['ssh','railiance01','kubectl -n state-hub exec -i deployment/state-hub-memo-dispatch -c dispatcher -- python -'],input=program,text=True,capture_output=True,timeout=60)
|
||||
try:result=json.loads(run.stdout)
|
||||
except Exception:raise SystemExit('Native readback unverified; raw transport suppressed')
|
||||
if run.returncode or result.get('status')!='confirmed_founder_acceptance':print(json.dumps({'status':result.get('status','native_readback_unverified'),'native_action':False}));raise SystemExit(3)
|
||||
outcome=result['normalized_outcome'];d=outcome['dispositions'][0]['disposition']
|
||||
raw=(json.dumps(outcome,sort_keys=True,indent=2)+'\n').encode()
|
||||
receipt=json.loads((base/'root-authority-receipt-template.json').read_text())
|
||||
receipt.update(memo_sha256=hashlib.sha256((base/'memo.json').read_bytes()).hexdigest(),source_revision=revision,executor_plan_sha256=hashlib.sha256((base/'execution/execution-plan.json').read_bytes()).hexdigest(),native_outcome_sha256=hashlib.sha256(raw).hexdigest(),activation='APPROVED',verified_at=datetime.datetime.now(datetime.timezone.utc).isoformat(),native_observed_at=outcome['observed_at'],review_memo_id=outcome['review']['memo_id'],approval_id=d['approval_id'],disposition_id=d['id'],accepted_at=d['at'],bounded_outage_rollback_pre_authorized=True)
|
||||
for path,data in [(Path('/tmp/security-infd-zlib-native-outcome-latest.json'),raw),(Path('/tmp/security-infd-zlib-root-authority.json'),(json.dumps(receipt,indent=2)+'\n').encode())]:
|
||||
if path.exists():
|
||||
info=path.lstat()
|
||||
if not stat.S_ISREG(info.st_mode) or info.st_uid!=os.getuid() or info.st_nlink!=1:raise SystemExit('Authority custody refused')
|
||||
fd=os.open(path,os.O_CREAT|os.O_TRUNC|os.O_WRONLY|os.O_NOFOLLOW,0o600);os.fchmod(fd,0o600)
|
||||
with os.fdopen(fd,'wb') as f:f.write(data);f.flush();os.fsync(f.fileno())
|
||||
print(json.dumps({'status':'confirmed_founder_acceptance','approval_id':d['approval_id'],'disposition_id':d['id'],'accepted_at':d['at'],'source_revision':revision,'verified_at':receipt['verified_at'],'native_action':False}))
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
{
|
||||
"immediate_authority_pass": false,
|
||||
"delta_seconds": -1.1806,
|
||||
"static_reason": "fresh root native readback required before every phase"
|
||||
}
|
||||
|
|
@ -0,0 +1,55 @@
|
|||
{
|
||||
"phase": "verify",
|
||||
"all_checks_pass": true,
|
||||
"raw_output_withheld": true,
|
||||
"native_approval_verified_by_root": {
|
||||
"approval_id": "b5ce337c-5d7d-44fa-864d-706b54039f7c",
|
||||
"disposition_id": "disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f",
|
||||
"accepted_at": "2026-10-11T10:40:55Z",
|
||||
"verified_at": "2026-10-11T11:19:17.592644+00:00"
|
||||
},
|
||||
"native_authenticated_grant": false,
|
||||
"live_readonly_schema_integrity_counts": {
|
||||
"schema_version": 5,
|
||||
"lifecycle": {
|
||||
"records": 17,
|
||||
"events": 59,
|
||||
"pending": 0
|
||||
},
|
||||
"outbox": {
|
||||
"delivered": 344
|
||||
},
|
||||
"submissions": {
|
||||
"confirmed": 44
|
||||
},
|
||||
"integrity": "ok",
|
||||
"read_only_pre_open": true,
|
||||
"store_constructed": false
|
||||
},
|
||||
"live_counts_may_include_concurrent_commits": true,
|
||||
"installed_zlib_files": {
|
||||
"lib/apk/db/installed": "f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001",
|
||||
"usr/lib/libz.so.1.3.2": "ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
|
||||
},
|
||||
"zlib_package": "1.3.2-r1",
|
||||
"installed_purpose_checks": {
|
||||
"installed_image_purpose_variants": 10,
|
||||
"binding_forms_allowed": 2,
|
||||
"advisory_or_malformed_refused": 8,
|
||||
"synthetic_only": true,
|
||||
"native_provider": false
|
||||
},
|
||||
"policy_sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62",
|
||||
"policy_mode": "0644",
|
||||
"policy_uid": 0,
|
||||
"health_statuses": {
|
||||
"/healthz": 200,
|
||||
"/readyz": 200
|
||||
},
|
||||
"native_provider_probe": false,
|
||||
"pod_name": "informed-decision-68d5f488d8-c576r",
|
||||
"pod_uid": "1153f806-1e05-4596-baf3-a4fa8adf08be",
|
||||
"native_rollout_verified": true,
|
||||
"current_schema5_database_retained": true,
|
||||
"recovery_verification": false
|
||||
}
|
||||
23
intakes/RPF-IN-0010-infd-zlib-native-post-acceptance.md
Normal file
23
intakes/RPF-IN-0010-infd-zlib-native-post-acceptance.md
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
---
|
||||
id: RPF-IN-0010
|
||||
kind: intake
|
||||
type: intake
|
||||
title: "Platform native post-acceptance of exact INFD zlib release"
|
||||
repo: railiance-platform
|
||||
lane: supervised
|
||||
status: closed
|
||||
owner: railiance-platform
|
||||
requested_by: the-custodian
|
||||
origin: handoff
|
||||
origin_ref: INFD-WP-0009-T05
|
||||
priority: high
|
||||
created: "2026-10-11"
|
||||
updated: "2026-10-11"
|
||||
tags: [security, cross-owner, acceptance]
|
||||
---
|
||||
|
||||
New small Platform owner native post-acceptance record, separate from closed RPF-IN-0009 source preparation. Scope only actual accepted source312ab97/imagef558 completion, retained metadata proof, and no expanded estate/customer/runtime authority. Reviewer reads safe retained root evidence, never private snapshots/database/credentials/native APIs.
|
||||
|
||||
## Completed actual-evidence assessment
|
||||
|
||||
Root immutable20-file manifest0e4799f709e097312c18ef0124afc153003efef0627902591939a218dbd66d4d checked before/after and full unchanged safe metadata/source history retained. Eight native phase receipts pass; matching frozen backup/copy and isolated clone pre/post counts, created-only cleanup, image-only manual falseprune release/current database retention, installed zlibr1/policy9d/schema5/health and postReady fixed-route current-PDPHTTP200 bracket exact same Pod/source/image. Full exact44-package fresh unsuppressed report checked against approved scan contract at actual verification time. Root three prephase refusals and negative1.1806second clock diagnosis retained; only root bookkeeping verified_at moved to workstation observation while native_observed_at retained. Approved source/helper/render/plan unchanged. Previous sandbox hypothesis was disproven, no custody/durable phase/native effect in those refusals. No recovery used, no automaticgrant inferred. Product closes foreign task/risk/WP records separately; no C07 alias/tombstone determination or deletion. This completed owner workrecord precedes formal native post-acceptance.
|
||||
Loading…
Add table
Add a link
Reference in a new issue