Prepare restricted seven-source reuse reader and bounded recovery
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
This commit is contained in:
codex
parent
748fe6c7db
commit
a570bc2f5b
12 changed files with 1367 additions and 0 deletions
83
docs/proposals/2026-10-15-reuse-private-reader/README.md
Normal file
83
docs/proposals/2026-10-15-reuse-private-reader/README.md
Normal file
|
|
@ -0,0 +1,83 @@
|
|||
# Seven private-source reader preparation
|
||||
|
||||
This bundle is prepared under platform's INTENT custody/Q1 remit. Nothing here
|
||||
records founder credential approval or another owner's review. The existing
|
||||
all-repository core-hub provisioner is precedent only and is never executed.
|
||||
|
||||
The exact bounded command, after approved CCR, independent reviews and binding
|
||||
confirmation, is:
|
||||
|
||||
```sh
|
||||
warden access openbao-platform-admin-login --exec -- python3 scripts/provision-reuse-surface-forgejo-source.py --approval /absolute/path/approved-artifact-receipt.json --receipt /absolute/path/durable-0600-receipt.jsonl
|
||||
```
|
||||
|
||||
An approval receipt must contain `ccr_id: CCR-2026-0046`, `decision: approved`,
|
||||
nonempty `supervisor` and `decision_ref`, and `approved_artifacts` mapping exactly
|
||||
these four relative paths to SHA256 digests of their approved bytes:
|
||||
|
||||
- credential-change-requests/CCR-2026-0046-reuse-surface-forgejo-source-read.yaml
|
||||
- scripts/provision-reuse-surface-forgejo-source.py
|
||||
- docs/proposals/2026-10-15-reuse-private-reader/bootstrap-contract.json
|
||||
- openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl
|
||||
|
||||
CCR itself must be approved; preparation hashes do not satisfy that gate. This
|
||||
local check binds revisions and relies on attended platform lane/supervisor
|
||||
custody for authenticity; it is not a signed approval authority or an autopilot
|
||||
grant. Metadata apply is separately governed by existing credential-change CLI.
|
||||
Bootstrap never applies policy or changes cluster delivery.
|
||||
|
||||
`apps-externalsecret-data-item.draft.yaml` is a proposed insertion for apps owner,
|
||||
not a deployable manifest or an apps review. Existing ESO role reads only one new
|
||||
exact data path; caller writer policy is unchanged. Claim confirmation remains
|
||||
false until live owner survey. Consumer delivery must wait for the FULL reviewed
|
||||
image fixing redirects/HTTPS and runtime-controlled exact source URL allowlist,
|
||||
with fourteen consented pinned URLs in REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST.
|
||||
|
||||
Failure recovery: inspect sanitized journal and authoritative identity/team/PAT/
|
||||
KV state quietly. A missing observation is not proof a request did not apply.
|
||||
The script refuses orphan PAT/KV state rather than reminting. Revoke only an
|
||||
identified dedicated PAT through Forgejo owner's attended recovery; if mint
|
||||
response lost, locate its exact recorded attempt-name prefix before revocation.
|
||||
Never delete unrelated token or shared runtime Secret. Rotation/recovery of an
|
||||
existing KV version requires a separately scoped CAS update plan; this create-only
|
||||
bootstrap does not overwrite or automatically rollback ambiguous writes.
|
||||
|
||||
Known execution gates: provisional IDs must be rechecked against current primary;
|
||||
Forgejo owner must confirm the API contracts (team organization username, complete
|
||||
sudo user inventory and token_last_eight metadata) on the deployed server; missing
|
||||
or differing metadata fails closed. Excluded-private rapp-core-hub must still be
|
||||
private. Native verification is a separate consumer-owned proof, not this API
|
||||
bootstrap's index-only custody check. New reader provisioning/production approval,
|
||||
apps config delta, fixed-image digest, live ESO survey and final70 audit all pending.
|
||||
|
||||
Revision2 refines the same CCR after a confirmed server-capped pagination defect.
|
||||
R1 patch and failed review evidence remain retained; no new scored trial is claimed.
|
||||
All list requests now continue until an observed empty page, reject duplicate IDs,
|
||||
and reconcile supplied total counts. Forgejo v11.0.3 source confirms user/repos
|
||||
includes effective direct/team grants. Stable ID sort is requested for that list.
|
||||
Version compatibility and live proof still precede apply.
|
||||
|
||||
Forgejo11.0.3 token DELETE requires Basic authentication, unlike token inventory GET.
|
||||
Admin PAT/Sudo alone is not a valid recovery implementation. The separate reviewed
|
||||
recovery must reset only this dedicated user password to fresh process-memory bytes,
|
||||
Basic-auth DELETE only the reviewed token ID, and verify absence. Recovery
|
||||
helper approval and manual rotation due-date task remain activation gates; no
|
||||
deployed quarterly expiry enforcement is claimed.
|
||||
|
||||
|
||||
The separately reviewed executable credential rollback is:
|
||||
|
||||
```sh
|
||||
warden access openbao-platform-admin-login --exec -- python3 scripts/revoke-reuse-surface-forgejo-source.py --approval /absolute/path/approved-exact-token-recovery.json --receipt /absolute/path/durable-0600-recovery.jsonl
|
||||
```
|
||||
|
||||
Its independent approval record names `action: revoke_exact_pat`, the CCR,
|
||||
`decision: approved`, supervisor and decision_ref, `target: {id: <reviewed id>,
|
||||
name: <exact recorded attempt name>}`, and SHA256s in `approved_artifacts` for
|
||||
exactly recovery helper, bootstrap helper, CCR and bootstrap contract. This
|
||||
receipt also relies on attended supervisor custody; it is not signed authority.
|
||||
Different inventory stops before password mutation. Password stays in memory;
|
||||
DELETE uses Basic authorization captured only by the quiet client. Uncertain
|
||||
DELETE is followed only by read-only absence reconciliation, never another
|
||||
DELETE or mint. KV is deliberately preserved, so rotation needs its separate CAS
|
||||
plan. Credential rollback and apps delivery cleanup have independent receipts.
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
secretKey: REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN
|
||||
remoteRef:
|
||||
key: workloads/reuse/reuse-surface/forgejo-source-read
|
||||
property: FORGEJO_SOURCE_TOKEN
|
||||
|
|
@ -0,0 +1,211 @@
|
|||
{
|
||||
"id": "CCR-2026-0046-BOOTSTRAP-R2",
|
||||
"revision": 2,
|
||||
"sources": [
|
||||
{
|
||||
"repo": "rapp-openbao",
|
||||
"capability_ids": [
|
||||
"capability.railiance.openbao-package"
|
||||
],
|
||||
"consented_commit": "35672be138036c8433a5ac5de91e068c03c2b124",
|
||||
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/indexes/capabilities.yaml?ref=35672be138036c8433a5ac5de91e068c03c2b124",
|
||||
"index_sha256": "044efa3d02b90e1872f2516c581159d388a8080a689f76fcd78bb4d048d6ee64",
|
||||
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"capability_ids": [
|
||||
"capability.railiance.policy-publication-package"
|
||||
],
|
||||
"consented_commit": "088b78ac03b0cebeec34a69aae3569eb7ec2f9c3",
|
||||
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/indexes/capabilities.yaml?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3",
|
||||
"index_sha256": "e68bdedf61eee9ca2026f46a2434ce384c26234616e74f7a5d08a06c75b3bb00",
|
||||
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-postgres",
|
||||
"capability_ids": [
|
||||
"capability.railiance.postgres-isolation-recovery"
|
||||
],
|
||||
"consented_commit": "a9f569c96d74aa384ac8d3ac4aa960e4061550b5",
|
||||
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/indexes/capabilities.yaml?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5",
|
||||
"index_sha256": "d939333eed9d85172e006f526c445fbe2602a721d53f7c0d14bc68286ae08776",
|
||||
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-sbom-nexus",
|
||||
"capability_ids": [
|
||||
"capability.railiance.sbom-runtime-package"
|
||||
],
|
||||
"consented_commit": "adbedd349e8df97be43a1f57db7095af45ff29d1",
|
||||
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/indexes/capabilities.yaml?ref=adbedd349e8df97be43a1f57db7095af45ff29d1",
|
||||
"index_sha256": "d2ee0f193d2198bf8f16ce64c90ae7664e59a2bc307ad711426af3fd47deb057",
|
||||
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-telemetry",
|
||||
"capability_ids": [
|
||||
"capability.railiance.telemetry-package"
|
||||
],
|
||||
"consented_commit": "f158307e24b86bab88a1af4830ff6b4f85afdeb5",
|
||||
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/indexes/capabilities.yaml?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5",
|
||||
"index_sha256": "ee8801f143ed5cf064205710a61c2bb24efc6ea8585d5786d6b679426ec4c1d4",
|
||||
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-tenant-engine",
|
||||
"capability_ids": [
|
||||
"capability.railiance.tenant-engine-package"
|
||||
],
|
||||
"consented_commit": "9bdc86572728783a5ed94266f04f7b12d414c557",
|
||||
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/indexes/capabilities.yaml?ref=9bdc86572728783a5ed94266f04f7b12d414c557",
|
||||
"index_sha256": "d8e9c1282350b5d2fd4f4d69712aa7a5fbcd2367bb1a7fad1b6eb16a97e5d732",
|
||||
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-user-engine",
|
||||
"capability_ids": [
|
||||
"capability.railiance.user-engine-package"
|
||||
],
|
||||
"consented_commit": "f35108f9e1b8702fb6c526fe42b2fec5ca032738",
|
||||
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/indexes/capabilities.yaml?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738",
|
||||
"index_sha256": "95b4ed2d0b189f6847b1c0899f740d1da46933a8f40491e1a02f2d4e57c819fc",
|
||||
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
|
||||
}
|
||||
],
|
||||
"negative_private_probe": "rapp-core-hub",
|
||||
"identity": {
|
||||
"forgejo_user": "reuse-surface-source",
|
||||
"forgejo_org": "coulomb",
|
||||
"forgejo_team": "reuse-surface-source-readers",
|
||||
"restricted": true,
|
||||
"is_admin": false,
|
||||
"visibility": "private",
|
||||
"password": "random value retained only in attended process memory; never stored in evidence",
|
||||
"team_permission": "read",
|
||||
"includes_all_repositories": false,
|
||||
"can_create_org_repo": false,
|
||||
"units_map": {
|
||||
"repo.code": "read",
|
||||
"repo.actions": "none",
|
||||
"repo.packages": "none",
|
||||
"repo.issues": "none",
|
||||
"repo.ext_issues": "none",
|
||||
"repo.wiki": "none",
|
||||
"repo.pulls": "none",
|
||||
"repo.releases": "none",
|
||||
"repo.projects": "none",
|
||||
"repo.ext_wiki": "none"
|
||||
},
|
||||
"team_repositories": [
|
||||
"coulomb/rapp-openbao",
|
||||
"coulomb/rapp-policy-nexus",
|
||||
"coulomb/rapp-postgres",
|
||||
"coulomb/rapp-sbom-nexus",
|
||||
"coulomb/rapp-telemetry",
|
||||
"coulomb/rapp-tenant-engine",
|
||||
"coulomb/rapp-user-engine"
|
||||
],
|
||||
"token_scopes": [
|
||||
"read:repository"
|
||||
],
|
||||
"token_name_prefix": "reuse-surface-source-read-",
|
||||
"reuse_other_workload_token": false,
|
||||
"fail_on_differing_existing_identity_or_team": true,
|
||||
"enforcement": "Verify complete team membership and all effective user repository grants; no other team, collaborator or organisation grants may provide extra private read access."
|
||||
},
|
||||
"delivery": {
|
||||
"kv_mount": "platform",
|
||||
"kv_path": "platform/workloads/reuse/reuse-surface/forgejo-source-read",
|
||||
"field": "FORGEJO_SOURCE_TOKEN",
|
||||
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN",
|
||||
"eso_role": "reuse-surface-runtime-eso",
|
||||
"eso_identity": "reuse/reuse-surface-eso",
|
||||
"audience": "openbao",
|
||||
"ttl": "15m",
|
||||
"cluster_secret_store": "openbao-reuse",
|
||||
"store_namespace_condition": [
|
||||
"reuse"
|
||||
],
|
||||
"external_secret": "reuse/reuse-surface-runtime",
|
||||
"target_secret": "reuse/reuse-surface-env",
|
||||
"existing_consumption": "Deployment reuse/reuse-surface envFrom secretRef reuse-surface-env; environment variable available only after controlled rollout. Existing image and resource requests retained.",
|
||||
"policy_delta": {
|
||||
"file": "railiance-platform/openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl",
|
||||
"add_exact_stanza": "path \"platform/data/workloads/reuse/reuse-surface/forgejo-source-read\" { capabilities = [\"read\"] }",
|
||||
"retain_existing_paths": true,
|
||||
"do_not_change": "Caller-facing workload-kv-read-reuse-surface-runtime policy or writer OIDC role; those remain unable to read this new path."
|
||||
},
|
||||
"external_secret_data_delta": {
|
||||
"secretKey": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN",
|
||||
"remoteRef": {
|
||||
"key": "workloads/reuse/reuse-surface/forgejo-source-read",
|
||||
"property": "FORGEJO_SOURCE_TOKEN"
|
||||
}
|
||||
},
|
||||
"delivery_design_reason": "Uses the existing namespace-limited ESO store and identity plus the existing envFrom interface. Separate new KV path keeps scoped writer callers from also acquiring private-source access. No new static ESO token or new store is needed.",
|
||||
"native_source_auth": {
|
||||
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN",
|
||||
"auth_header": "Authorization",
|
||||
"header_behavior": "Native federation _auth_headers prefixes a bare token with Bearer; owner must verify accepted Forgejo raw API route with this actual native implementation."
|
||||
},
|
||||
"rollout_image": "Pending full consumer fix reviewed image digest; same-image rollout of current consumer is prohibited."
|
||||
},
|
||||
"consumer_gate": "Reader must not be delivered until reuse-surface owner supplies verified image digest containing BOTH authenticated redirect rejection/HTTPS enforcement AND runtime-controlled exact URL allowlist checked before credential lookup. Apps owner must deploy REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST mapping the reader environment to exactly fourteen consented pinned index/entry URLs and inventory existing authenticated sources for migration. Current image and redirect-only fix are not approved. Native owner helper must verify all seven pinned indexes and entry hashes after rollout.",
|
||||
"approval": "No approval recorded. External supervisor approval receipt must bind exactly CCR, script, contract and ESO policy bytes; CCR must be approved. Additional forge/apps/reuse owner reviews and rollout approval remain required.",
|
||||
"metadata_consent_sha256": "4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52",
|
||||
"preparation_sha256": "7819eb51d249f5c7aff4df9fb520afcfb76603b05a4104439499102b6c20af99",
|
||||
"recovery": "On ambiguous mutation stop. Reconcile complete Forgejo identity/team/repository/PAT metadata and exact KV field through suppressed helper before retry. Token without KV or reverse refuses automatically; revoke identified dedicated PAT through attended Forgejo owner recovery before retry. Never remint on observation timeout. KV CAS=0 prevents overwrites. Do not delete shared runtime Secret.",
|
||||
"consumer_preparation": {
|
||||
"owner": "reuse-surface",
|
||||
"allowlist_artifact": "/tmp/cust81-reuse-reader-owner/docs/assessments/cust81-private-reader/runtime-auth-source-allowlist-r1.json",
|
||||
"allowlist_sha256": "e1948c537e206b30fc72b9e4732a3f600d92e131813e6f7ecfd4bfbb18c27286",
|
||||
"federation_py_sha256": "dbaa40f25cc0f090143578cd1c7068cb2cb00960fafd17d5239bf8a5bac514dd",
|
||||
"integration_patch_sha256": "da9634481ce80658dfce815d3539ba023234938dc76163dfd93d7677be95ed51",
|
||||
"review_state": "changes_requested for current consumer; preparation patch alone is not deployed-image evidence"
|
||||
},
|
||||
"pagination_contract": "All list endpoints page until observed empty, max20pages; reject duplicate/missing IDs, reconcile X-Total-Count when supplied, reject changed/mismatched counts and bound exhaustion. Never infer completion from requestedlimit100 versus server-capped50.",
|
||||
"effective_grants_contract": "Forgejo11.0.3 /user/repos?order_by=id with Sudo reader uses OwnerID=reader and Collaborate=None; SearchRepositoryCondition defaults collaborations true and includes direct UserAccessRepoCond plus UserOrgTeamRepoCond. It is not owned-only despite Swagger summary. Independent deployed-version compatibility and live inventory proof pending.",
|
||||
"r1_review_failure": {
|
||||
"patch_sha256": "a94547b419b87e38dc178b02d1d31af61cc11a71e3734052a190167668db8e30",
|
||||
"confirmed_defect": "R1 len(batch)<100 stopped after server-capped50, omitting later grants",
|
||||
"corrected_preliminary_claim": "Owned-only endpoint claim disproved by Forgejo11.0.3 model defaults; no endpoint replacement based on false premise",
|
||||
"same_proposal": "CCR-2026-0046; revision2 is refinement, not a new successful trial"
|
||||
},
|
||||
"api_source_evidence": [
|
||||
{
|
||||
"upstream_path": "models/repo/repo/list.go",
|
||||
"url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/models/repo/repo/list.go",
|
||||
"sha256": "bb7833badf0fe7f6a2c800c2f301cb846b5968ce3f9e9bd29c3f1677db42acd9",
|
||||
"local_cache": "/tmp/cust81-forge-contract-source/source-models_repo_repo_list.go"
|
||||
},
|
||||
{
|
||||
"upstream_path": "routers/api/v1/utils/page.go",
|
||||
"url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/routers/api/v1/utils/page.go",
|
||||
"sha256": "1d286f60b5571513fb5a26a9243c22eae65f05d7be32dfe5d0f0b15d20550954",
|
||||
"local_cache": "/tmp/cust81-forge-contract-source/source-routers_api_v1_utils_page.go"
|
||||
},
|
||||
{
|
||||
"upstream_path": "services/convert/utils.go",
|
||||
"url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/services/convert/utils.go",
|
||||
"sha256": "2689ffc579ea1df69457fbe84410fef101ae4a9580f0e56dcc3113a2988626b3",
|
||||
"local_cache": "/tmp/cust81-forge-contract-source/source-services_convert_utils.go"
|
||||
},
|
||||
{
|
||||
"upstream_path": "modules/setting/api.go",
|
||||
"url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/modules/setting/api.go",
|
||||
"sha256": "1f640ed884afaa6454c4bf427eccd2d6bb9a092fe37ac1aedfdc5eb85de4f7ba",
|
||||
"local_cache": "/tmp/cust81-forge-contract-source/source-modules_setting_api.go"
|
||||
},
|
||||
{
|
||||
"upstream_path": "routers/api/v1/user/repo.go",
|
||||
"url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/routers/api/v1/user/repo.go",
|
||||
"sha256": "adee62e6671aadd95b5013a64dbb690f2d81a0b9b4de0350c70b4153074ca6ec",
|
||||
"local_cache": "/tmp/cust81-forge-contract-source/source-routers_api_v1_user_repo.go"
|
||||
}
|
||||
],
|
||||
"rollback_helper": {
|
||||
"path": "scripts/revoke-reuse-surface-forgejo-source.py",
|
||||
"scope": "Separate approval binds exact PAT id/name and artifact bytes; Basic-auth revocation after dedicated-user memory-only password reset. Preserve KV/sharedruntime; no remint. Reconcile uncertain DELETE by inventory absence."
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
{
|
||||
"id": "RPF-WP-0058-PLATFORM-OWNER-REVIEW-R1",
|
||||
"owner_repo": "railiance-platform",
|
||||
"reviewer": "platform-reader-owner delegated worker",
|
||||
"basis": [
|
||||
"INTENT.md shared stateful service custody, Q1 approval/delegated apply/revocation, stable delivery interface",
|
||||
"AGENTS.md credential-change owner review and founder-gated attended provisioning",
|
||||
"No own supervision record exists; supervised preparation only"
|
||||
],
|
||||
"disposition": "prepared_with_conditions_not_execution_approval",
|
||||
"scope": "Only platform custody/CCR/policy/bootstrap; other repo reviews not authored",
|
||||
"findings": [
|
||||
"Separate exact KV path and exact data-read ESO delta preserve writer-only caller boundary.",
|
||||
"No all-repo Forgejo team; preflight rejects different existing user/team, unexpected team repos/members, other teams/orgs/private grants, orphan PAT/KV, and unverified PAT/KV binding.",
|
||||
"Quiet create-only bootstrap with per-user lane lock, durable fsynced intents/outcomes, CAS=0 KV; uncertainty is reconciled before retry, never blindly reminted.",
|
||||
"Full consumer redirect/HTTPS plus authenticated URL allowlist image and exact config mandatory before credential delivery.",
|
||||
"Approval receipt is locally bound revision evidence, not authenticated authority; attended founder/platform lane remains authorization source."
|
||||
],
|
||||
"validation": {
|
||||
"targeted_tests": 17,
|
||||
"result": "passed",
|
||||
"ccr_validator": "passed with expected unconfirmed ESO binding/apply blocked warning",
|
||||
"diff_check": "passed"
|
||||
},
|
||||
"pending": [
|
||||
"Allocation recheck against owner primary before integration",
|
||||
"Independent Forgejo/apps/reuse owner reviews and actual founder credential provisioning decision",
|
||||
"Live ESO claims and namespace condition confirmation; no token read or live mutations performed",
|
||||
"Forgejo deployed API metadata contract support proof; sudo inventory and token_last_eight missing metadata fail closed",
|
||||
"Apps fixedimage digest/config/migration/dryrun/headroom rollout approval and receipt",
|
||||
"Native seven index+entry verification and final hosted70/70 audit"
|
||||
],
|
||||
"execution_approved": false,
|
||||
"live_changes_performed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,54 @@
|
|||
{
|
||||
"id": "RPF-WP-0058-PLATFORM-OWNER-REVIEW-R2",
|
||||
"owner_repo": "railiance-platform",
|
||||
"reviewer": "platform-reader-owner delegated worker",
|
||||
"basis": [
|
||||
"INTENT.md shared stateful service custody, Q1 approval/delegated apply/revocation, stable delivery interface",
|
||||
"AGENTS.md credential-change owner review and founder-gated attended provisioning",
|
||||
"No own supervision record exists; supervised preparation only"
|
||||
],
|
||||
"disposition": "approved",
|
||||
"scope": "Platform custody PREPARATION artifact revision2 only; not founder credential/production authority or another repo review",
|
||||
"findings": [
|
||||
"Separate exact KV path and exact data-read ESO delta preserve writer-only caller boundary.",
|
||||
"No all-repo Forgejo team; preflight rejects different existing user/team, unexpected team repos/members, other teams/orgs/private grants, orphan PAT/KV, and unverified PAT/KV binding.",
|
||||
"Quiet create-only bootstrap with per-user lane lock, durable fsynced intents/outcomes, CAS=0 KV; uncertainty is reconciled before retry, never blindly reminted.",
|
||||
"Full consumer redirect/HTTPS plus authenticated URL allowlist image and exact config mandatory before credential delivery.",
|
||||
"Approval receipt is locally bound revision evidence, not authenticated authority; attended founder/platform lane remains authorization source.",
|
||||
"Forgejo version source disproves preliminary owned-only /user/repos claim; unchanged endpoint with id sort includes direct and team grants. R2 pages until observed empty, refuses missing/duplicate IDs and inconsistent total counts."
|
||||
],
|
||||
"validation": {
|
||||
"targeted_tests": 28,
|
||||
"result": "passed",
|
||||
"ccr_validator": "passed with expected unconfirmed ESO binding/apply blocked warning",
|
||||
"diff_check": "passed"
|
||||
},
|
||||
"pending": [
|
||||
"Allocation recheck against owner primary before integration",
|
||||
"Independent Forgejo/apps/reuse owner reviews and actual founder credential provisioning decision",
|
||||
"Live ESO claims and namespace condition confirmation; no token read or live mutations performed",
|
||||
"Forgejo deployed API metadata contract support proof; sudo inventory and token_last_eight missing metadata fail closed",
|
||||
"Apps fixedimage digest/config/migration/dryrun/headroom rollout approval and receipt",
|
||||
"Native seven index+entry verification and final hosted70/70 audit",
|
||||
"Separate explicit exact-token recovery approval and manual rotation due-date task/receipt before activation."
|
||||
],
|
||||
"execution_approved": false,
|
||||
"live_changes_performed": false,
|
||||
"revision": 2,
|
||||
"decision": "approved",
|
||||
"work_item": "RPF-WP-0058-T01",
|
||||
"reviewed_artifacts": {
|
||||
"credential-change-requests/CCR-2026-0046-reuse-surface-forgejo-source-read.yaml": "90522912fb78fed72e625382fb7114a0e9aafe76d59e36bffecab83c5bb7d643",
|
||||
"scripts/provision-reuse-surface-forgejo-source.py": "abf60a754596baa1610d23b1fd367385b0222ac8aeaebba0f2cfb7ec4c62055b",
|
||||
"scripts/revoke-reuse-surface-forgejo-source.py": "f78d1b26fbff93c6cc481a896d9fb9b9ce93049b8b3267fa41a64bc57dadb162",
|
||||
"tests/test_reuse_surface_forgejo_source_provision.py": "0d06fd22596a0f17ecd8dd5ff6a12bb1b1782258d00126ad468661099d7d298b",
|
||||
"tests/test_reuse_surface_forgejo_source_recovery.py": "08247129b220c198d8f7d1322ce63956203b9ffcaa0342e52990bb6520fd138d",
|
||||
"docs/proposals/2026-10-15-reuse-private-reader/bootstrap-contract.json": "2bb72671e0a5f230497ab8ef2967a20ee68d1f2cf081f07c84f6db3442e18d8b",
|
||||
"openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl": "6320f6c2d262d924ea16291d301d5f9eeb7efdb6ce7ea141c1a41d277d86b01b",
|
||||
"docs/proposals/2026-10-15-reuse-private-reader/README.md": "dcc8879d96b85b21b52c6cac9d7a58db78169ed903490ef11561bf8d6aa507e5",
|
||||
"workplans/RPF-WP-0058-reuse-private-source-reader.md": "9aeb0fbbb5359b7ba9afb4f5f7f2c55f84dade0d6d95fe98b15901e656aed5b5",
|
||||
"docs/proposals/2026-10-15-reuse-private-reader/apps-externalsecret-data-item.draft.yaml": "e582a7d2eeb68668858ec19a6a32b8b816a4850b5ad1757f7686330b141578b2"
|
||||
},
|
||||
"supersedes_review_artifact_sha256": "0a9746f65bb79982632accd9e20a2a632eafc5ee5410f4eddeadd625e73ca0bd",
|
||||
"refinement_of_same_proposal": "CCR-2026-0046 R1 confirmed capped-page bug retained; R2 fixes pagination, not a new trial"
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue