Prepare reviewed audit delivery chart and native acceptance packet
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
codex
parent
6bb406eb15
commit
aa3dbda733
3 changed files with 171 additions and 0 deletions
|
|
@ -0,0 +1,75 @@
|
|||
{
|
||||
"completed_same_owner_record_precedes_formal_review": true,
|
||||
"decision": "changes_requested",
|
||||
"findings": [
|
||||
{
|
||||
"counterexamples": [
|
||||
"YAML numeric8000.5 (--set-json) passes int-converted range check and renders NetworkPolicy ports.port=8000.5",
|
||||
"YAML numeric1.5 passes int-converted range check and renders ports.port=1.5",
|
||||
"YAML numeric65535.5 truncates within range for validation and renders ports.port=65535.5"
|
||||
],
|
||||
"id": "RPF-ACCESS-AUDIT-V1-F01",
|
||||
"impact": "Helm succeeds but numeric NetworkPolicy port requires an integer. Current valid-port guard does not validate the value actually emitted; source setup can fail Kubernetes admission. No native apply was attempted.",
|
||||
"location": "charts/flex-auth/templates/networkpolicy.yaml:24",
|
||||
"required_change": "Reject noninteger receiverPort types/values before range validation and raw rendering, including numeric fractions and booleans, while preserving exact integer1..65535 values. Add independent renderer counterexamples using actual YAML/--set-json numeric values, not only --set strings. Keep default disabled and custody scope unchanged.",
|
||||
"severity": "blocking_source_validation"
|
||||
}
|
||||
],
|
||||
"intent_basis": "Platform secure custody, durable platform delivery and stable service interfaces: exact admitted mounted sender credential and route; no independent application logic or native authority from source review.",
|
||||
"native_executed": false,
|
||||
"not_approved": [
|
||||
"native credential/Secret/API access, token mint or receiver registration",
|
||||
"native rollout/route/ingress change or source application",
|
||||
"full emission/adoption/loss completeness or originalowner task closure"
|
||||
],
|
||||
"owner_record": {
|
||||
"path": "workplans/ADHOC-2026-10-11.md",
|
||||
"persisted_commit": "431df1d",
|
||||
"sha256": "9b5f43f4a1b84fbada4f175d445a68f13ea54e47e290fe4fb11d57ac4c08cd69"
|
||||
},
|
||||
"qualified_verified": [
|
||||
"Default auditDelivery.enabled=false generates no credential mount/sender flags/new receiver-DNS egress; creates no Secret or sender registration.",
|
||||
"Enablement requires serve, durable single-writer outbox/Recreate, exact existingSecret/key, explicit receiver/DNS selectors and /v1/events endpoint. No payload/commit semantics code changed.",
|
||||
"Exactly one projected sender key, readOnly0440 directory without subPath; fsGroup65532, no automountServiceAccountToken, existing auth reviewer mount preserved. Native Secret ownership and actual same-process reread/rotation not proved.",
|
||||
"New receiver namespace+pod selectors are ANDed in one peer and exact TCPport; DNS peer ANDed with UDP/TCP53. Existing auth TCP443/6443 egress rule is retained and remains broader; do not claim whole-pod traffic is limited to receiver/DNS.",
|
||||
"Actual source audit-core Service is namespace audit-core, app.kubernetes.io/name=audit-core, port8080; current receiver NetworkPolicy lacks general Access decision-pin sender ingress. No runtime route or registration admission inferred."
|
||||
],
|
||||
"remaining_admission_gates": [
|
||||
"Audit owner final per-pin source/tenant/eventclass/cadence/secretpolicy/rate thresholds and writertrue/readfalse sender admission; actual inventory/renames reconciled, no new registry payload invented.",
|
||||
"Platform/route owner admitted existingSecret/key, attended credential mint/delivery/rotation/revoke custody receipts; old audit-core-senders draft routing is not executable admission.",
|
||||
"Exact receiver URL Service/targetport, namespace/podlabels and DNS runtime coordinates plus matching receiver ingress approved by network/receiver owners.",
|
||||
"Immutable Access image with mandatory-commit and current chart provenance, renderer pins and founder rollout go; PVC/free disk/backuprestore and singlewriter Recreate window, rollback preserves pending evidence and never reverts mandatorycommit for availability.",
|
||||
"Actual native commit-before-every-effect failure503 and withholding proof, same eventIDs receiver accepted202/duplicate200, restartcursor/drain and bounded backlog, private credential revoke/readrefusal/heartbeat/silence findings.",
|
||||
"Compatible acceptance-time vs commit-time evidence before loss/completeness reconciliation; transport failure/503 cannot be conflated with authorization denial. Existing AccessT08/AuditT02 and reconciliation gates stay open."
|
||||
],
|
||||
"review_scope": "inert Access auditDelivery chart sender mount/custody/network interface source only",
|
||||
"reviewed_files": {
|
||||
"/home/worsch/access-engine/charts/flex-auth/templates/deployment.yaml": "a57ad96b676110df4c307a379d13919f5039636146893ed84e256e0b0673393f",
|
||||
"/home/worsch/access-engine/charts/flex-auth/templates/networkpolicy.yaml": "b42f0e1f4c56e6ced5b9f7f19ed6592df593206b4236b92d30099778527dfbe9",
|
||||
"/home/worsch/access-engine/charts/flex-auth/values.yaml": "f98d3ded5702adcb648190b943c73c391b72a6334ab54d906a7505be9093ba0b",
|
||||
"/home/worsch/access-engine/docs/audit-delivery-rollout-preparation.md": "1b29912ccea9e0cf2de82adfa5d460b6c4f7bd4c0de876ddc33ef01bff5f7bb0",
|
||||
"/home/worsch/access-engine/tests/test_outbox_chart.py": "d405ef381ef154354e5ba1b5c09b81cfa806ecac92df883a8eb6a5448c8e2acf",
|
||||
"/home/worsch/access-engine/workplans/FLEX-WP-0031-decision-record-emission.md": "9326544af33734937904108e1b3848e557fa7b22808fba98d016a0f27ca55e72"
|
||||
},
|
||||
"reviewed_input_unchanged": true,
|
||||
"reviewed_manifest": "/tmp/access-audit-delivery-stage/manifest.json",
|
||||
"reviewed_manifest_sha256": "f4ce9aa88b517d5bfe3e97ff19c62d0bf61f5872fd9c58b6770978961083b293",
|
||||
"reviewer": "railiance-platform-owner (agent railiance-platform, codex)",
|
||||
"schema": "owner-source-review/v1",
|
||||
"source_only": true,
|
||||
"source_pins": {
|
||||
"access-engine/cmd/access-engine/main.go": "da24fa10e174f117e6cf44f1ba765d5b66078113198fa48fb911f5a91b5cec83",
|
||||
"access-engine/internal/emission/delivery.go": "8d4bf346c175704b36daa07e7eef1b8deb3a8cbff22d43dc67ccf120fc9dbdc0",
|
||||
"audit-core/deploy/audit-core.yaml": "227bd366d984c3bb5055303fd63f1eb9faabcf901b3be76ec31dda4fe23fb888",
|
||||
"audit-core/deploy/networkpolicies.yaml": "c1ba896c9d29ac690ce2059759c46f0152a1e179d0322f505fab0c9e96c51463",
|
||||
"railiance-platform/INTENT.md": "12c6540735af591f7a4a9fe85ff10d3cd00eec55b5b6b1ddf148abf2d3ac9a9c"
|
||||
},
|
||||
"validation": {
|
||||
"go": "go test -mod=readonly ./internal/decision ./internal/emission ./internal/readback ./cmd/access-engine ./pkg/api passed with GOCACHE/GOTMPDIR in/tmp; readback has no tests",
|
||||
"helm_lint": "1chartpassed,0failed; optional icon informational",
|
||||
"independent_platform_checks": 8,
|
||||
"renderer": "python3 tests/test_outbox_chart.py passed against isolated exact-stage chart",
|
||||
"result": "allpass including three expected fractional-port counterexamples; no native/credential action"
|
||||
},
|
||||
"work_item": "RPF-WP-ADHOC-2026-10-11-T01"
|
||||
}
|
||||
|
|
@ -0,0 +1,74 @@
|
|||
{
|
||||
"completed_same_owner_record_precedes_formal_review": true,
|
||||
"correction": "RPF-ACCESS-AUDIT-V1-F01 corrected: rendered decimalinteger shape validated before1..65535 bounds and rawport emission. Original8000.5/1.5/65535.5, boolean/null/named inputs refuse. Exact1/65535 render integers; no custody/default/Go payload or commit-semantics change.",
|
||||
"decision": "approved",
|
||||
"intent_basis": "Platform secure custody, durable platform delivery and stable service interfaces: exact admitted mounted sender credential and route; no independent application logic or native authority from source review.",
|
||||
"maker_completed_record": {
|
||||
"persisted_commit": "c8a3766",
|
||||
"record_sha256": "be19dec8bc278e6fd3173175b864a309ac67c49b8c4be1d5b3b319b8b3e2c43a",
|
||||
"repo": "access-engine",
|
||||
"scope": "completed source preparation, not nativeadmission; original advancement intentional",
|
||||
"task": "FLEX-WP-ADHOC-2026-10-11-T03"
|
||||
},
|
||||
"native_executed": false,
|
||||
"not_approved": [
|
||||
"native credential/Secret/API access, token mint or receiver registration",
|
||||
"native rollout/route/ingress change or source application",
|
||||
"full emission/adoption/loss completeness or originalowner task closure"
|
||||
],
|
||||
"owner_record": {
|
||||
"managed_identifiers_now_present": true,
|
||||
"original_completed_record_sha256": "9b5f43f4a1b84fbada4f175d445a68f13ea54e47e290fe4fb11d57ac4c08cd69",
|
||||
"path": "workplans/ADHOC-2026-10-11.md",
|
||||
"persisted_commit": "431df1d",
|
||||
"sha256": "da876fcb075c3e645dcfd6c602a3875ac98f0101b6ae57cf4c4eba70c8206e6c"
|
||||
},
|
||||
"prior_review_retained_sha256": "e972a54e36b13dae05983fcd14b100551dffe9a11d14099273d5698c7353499a",
|
||||
"qualified_verified": [
|
||||
"Default auditDelivery.enabled=false generates no credential mount/sender flags/new receiver-DNS egress; creates no Secret or sender registration.",
|
||||
"Enablement requires serve, durable single-writer outbox/Recreate, exact existingSecret/key, explicit receiver/DNS selectors and /v1/events endpoint. No payload/commit semantics code changed.",
|
||||
"Exactly one projected sender key, readOnly0440 directory without subPath; fsGroup65532, no automountServiceAccountToken, existing auth reviewer mount preserved. Native Secret ownership and actual same-process reread/rotation not proved.",
|
||||
"New receiver namespace+pod selectors are ANDed in one peer and exact TCPport; DNS peer ANDed with UDP/TCP53. Existing auth TCP443/6443 egress rule is retained and remains broader; do not claim whole-pod traffic is limited to receiver/DNS.",
|
||||
"Actual source audit-core Service is namespace audit-core, app.kubernetes.io/name=audit-core, port8080; current receiver NetworkPolicy lacks general Access decision-pin sender ingress. No runtime route or registration admission inferred."
|
||||
],
|
||||
"remaining_admission_gates": [
|
||||
"Audit owner final per-pin source/tenant/eventclass/cadence/secretpolicy/rate thresholds and writertrue/readfalse sender admission; actual inventory/renames reconciled, no new registry payload invented.",
|
||||
"Platform/route owner admitted existingSecret/key, attended credential mint/delivery/rotation/revoke custody receipts; old audit-core-senders draft routing is not executable admission.",
|
||||
"Exact receiver URL Service/targetport, namespace/podlabels and DNS runtime coordinates plus matching receiver ingress approved by network/receiver owners.",
|
||||
"Immutable Access image with mandatory-commit and current chart provenance, renderer pins and founder rollout go; PVC/free disk/backuprestore and singlewriter Recreate window, rollback preserves pending evidence and never reverts mandatorycommit for availability.",
|
||||
"Actual native commit-before-every-effect failure503 and withholding proof, same eventIDs receiver accepted202/duplicate200, restartcursor/drain and bounded backlog, private credential revoke/readrefusal/heartbeat/silence findings.",
|
||||
"Compatible acceptance-time vs commit-time evidence before loss/completeness reconciliation; transport failure/503 cannot be conflated with authorization denial. Existing AccessT08/AuditT02 and reconciliation gates stay open."
|
||||
],
|
||||
"review_scope": "corrected disabled-by-default auditDelivery chart mount/custody/network preparation source only",
|
||||
"reviewed_files": {
|
||||
"/home/worsch/access-engine/charts/flex-auth/templates/deployment.yaml": "a57ad96b676110df4c307a379d13919f5039636146893ed84e256e0b0673393f",
|
||||
"/home/worsch/access-engine/charts/flex-auth/templates/networkpolicy.yaml": "53d8ae1851b66c8c9f990fc56bc8ad9076741e2684f39470a7e1583b093d9c14",
|
||||
"/home/worsch/access-engine/charts/flex-auth/values.yaml": "f98d3ded5702adcb648190b943c73c391b72a6334ab54d906a7505be9093ba0b",
|
||||
"/home/worsch/access-engine/docs/audit-delivery-rollout-preparation.md": "47805cd51baceea91a45fe6c53a6cca0c58a9acb9ba42354e9c5b426ec188f4f",
|
||||
"/home/worsch/access-engine/tests/test_outbox_chart.py": "f6c68dfc6f8a1a8dbf2afcab18b428111765b965a419890f52fb19eb51d3ceea",
|
||||
"/home/worsch/access-engine/workplans/ADHOC-2026-10-11.md": "be19dec8bc278e6fd3173175b864a309ac67c49b8c4be1d5b3b319b8b3e2c43a",
|
||||
"/home/worsch/access-engine/workplans/FLEX-WP-0031-decision-record-emission.md": "24d228f33a1a76f266ecf8ca9d403d885717df08ba08714eda928a7b1f3007ad"
|
||||
},
|
||||
"reviewed_input_unchanged": true,
|
||||
"reviewed_manifest": "/tmp/access-audit-delivery-v2-stage/manifest.json",
|
||||
"reviewed_manifest_sha256": "90d5b7e962da046f205cdfa3267c25d22539c500c537c89033aefa568c3c5e16",
|
||||
"reviewer": "railiance-platform-owner (agent railiance-platform, codex)",
|
||||
"same_trial": true,
|
||||
"schema": "owner-source-review/v1",
|
||||
"source_only": true,
|
||||
"source_pins": {
|
||||
"access-engine/cmd/access-engine/main.go": "da24fa10e174f117e6cf44f1ba765d5b66078113198fa48fb911f5a91b5cec83",
|
||||
"access-engine/internal/emission/delivery.go": "8d4bf346c175704b36daa07e7eef1b8deb3a8cbff22d43dc67ccf120fc9dbdc0",
|
||||
"audit-core/deploy/audit-core.yaml": "227bd366d984c3bb5055303fd63f1eb9faabcf901b3be76ec31dda4fe23fb888",
|
||||
"audit-core/deploy/networkpolicies.yaml": "c1ba896c9d29ac690ce2059759c46f0152a1e179d0322f505fab0c9e96c51463",
|
||||
"railiance-platform/INTENT.md": "12c6540735af591f7a4a9fe85ff10d3cd00eec55b5b6b1ddf148abf2d3ac9a9c"
|
||||
},
|
||||
"validation": {
|
||||
"go": "previous passed ABI/commit/emission suites retained against identical main.go and delivery.go source hashes; no unnecessary rerun",
|
||||
"helm_lint": "1chartpassed,0failed",
|
||||
"independent_platform_checks": 15,
|
||||
"renderer": "supplied frozen v2 tests pass including22 YAML/JSON refused values and integer boundaries in isolated chart",
|
||||
"result": "passed offline renderer and counterexamples; no native Secret/credential/route/image/runtime proof"
|
||||
},
|
||||
"work_item": "RPF-WP-ADHOC-2026-10-11-T01"
|
||||
}
|
||||
|
|
@ -10,6 +10,7 @@ owner: codex
|
|||
topic_slug: railiance
|
||||
created: "2026-10-11"
|
||||
updated: "2026-10-11"
|
||||
state_hub_workstream_id: "e333bf0f-2767-5522-a948-dc77a89e0d85"
|
||||
---
|
||||
|
||||
## Complete bounded audit-delivery deployment and custody source review preparation
|
||||
|
|
@ -18,6 +19,7 @@ updated: "2026-10-11"
|
|||
id: RPF-WP-ADHOC-2026-10-11-T01
|
||||
status: done
|
||||
priority: low
|
||||
state_hub_task_id: "fe5e509b-cf41-52eb-af7e-e374a6417e00"
|
||||
```
|
||||
|
||||
Loaded own Platform AGENTS/INTENT and actual audit-core receiver Deployment/Service/
|
||||
|
|
@ -39,3 +41,23 @@ execution/KEY39 work records are not reused. Native Access image/provenance,
|
|||
PVC/free capacity/backup/singlewriter rollout and accepted/duplicate/revoke/
|
||||
heartbeat/recovery/loss-completeness proof remain open under original Access/
|
||||
Audit owners. No credentials, actual Secret objects or owner checkout writes.
|
||||
|
||||
|
||||
2026-10-11 sameT01 correction preparation: exact Access auditDelivery v2 manifest
|
||||
`90d5b7e962da046f205cdfa3267c25d22539c500c537c89033aefa568c3c5e16` verified
|
||||
against seven staged files. Access own completed source-preparation T03 anchor
|
||||
`be19dec8bc278e6fd3173175b864a309ac67c49b8c4be1d5b3b319b8b3e2c43a` is now
|
||||
persisted; its deliberate original-hash advancement does not alter reviewed chart
|
||||
bytes. Supplied renderer including22 YAML/JSON rejected-port cases and integer
|
||||
boundaries, Helm lint and15 fresh Platform checks pass. Three initial fractional
|
||||
port counterexamples now refuse before rendering; booleans/null/namedvalues also
|
||||
refuse, integer1/65535 render exact numeric integers. Readonly0440 single-key mount
|
||||
without subPath, original caller-auth mount and exactAND receiver/DNS peers remain
|
||||
unchanged. Completed ownT01 preparation record preceded formal correction review.
|
||||
Retain initial e972a54e requestchanges and exact original counterexamples.
|
||||
Source agreement covers disabled chart preparation only. Existing auth443/6443
|
||||
egress remains broader; receiver ingress/registration, per-pin Secret custody,
|
||||
rotation/revocation/cleanup, exact runtime coordinates and immutable Access image
|
||||
with mandatorycommit, attended rollout/PVC recovery and native accepted/duplicate/
|
||||
restart/heartbeat/reconciliation proof remain owner gates. No native/Secret access,
|
||||
credential/API request or owner checkout writes; original live task states retained.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue