diff --git a/docs/reviews/2026-10-11-access-audit-delivery-v1-platform-review.json b/docs/reviews/2026-10-11-access-audit-delivery-v1-platform-review.json new file mode 100644 index 0000000..40bb93e --- /dev/null +++ b/docs/reviews/2026-10-11-access-audit-delivery-v1-platform-review.json @@ -0,0 +1,75 @@ +{ + "completed_same_owner_record_precedes_formal_review": true, + "decision": "changes_requested", + "findings": [ + { + "counterexamples": [ + "YAML numeric8000.5 (--set-json) passes int-converted range check and renders NetworkPolicy ports.port=8000.5", + "YAML numeric1.5 passes int-converted range check and renders ports.port=1.5", + "YAML numeric65535.5 truncates within range for validation and renders ports.port=65535.5" + ], + "id": "RPF-ACCESS-AUDIT-V1-F01", + "impact": "Helm succeeds but numeric NetworkPolicy port requires an integer. Current valid-port guard does not validate the value actually emitted; source setup can fail Kubernetes admission. No native apply was attempted.", + "location": "charts/flex-auth/templates/networkpolicy.yaml:24", + "required_change": "Reject noninteger receiverPort types/values before range validation and raw rendering, including numeric fractions and booleans, while preserving exact integer1..65535 values. Add independent renderer counterexamples using actual YAML/--set-json numeric values, not only --set strings. Keep default disabled and custody scope unchanged.", + "severity": "blocking_source_validation" + } + ], + "intent_basis": "Platform secure custody, durable platform delivery and stable service interfaces: exact admitted mounted sender credential and route; no independent application logic or native authority from source review.", + "native_executed": false, + "not_approved": [ + "native credential/Secret/API access, token mint or receiver registration", + "native rollout/route/ingress change or source application", + "full emission/adoption/loss completeness or originalowner task closure" + ], + "owner_record": { + "path": "workplans/ADHOC-2026-10-11.md", + "persisted_commit": "431df1d", + "sha256": "9b5f43f4a1b84fbada4f175d445a68f13ea54e47e290fe4fb11d57ac4c08cd69" + }, + "qualified_verified": [ + "Default auditDelivery.enabled=false generates no credential mount/sender flags/new receiver-DNS egress; creates no Secret or sender registration.", + "Enablement requires serve, durable single-writer outbox/Recreate, exact existingSecret/key, explicit receiver/DNS selectors and /v1/events endpoint. No payload/commit semantics code changed.", + "Exactly one projected sender key, readOnly0440 directory without subPath; fsGroup65532, no automountServiceAccountToken, existing auth reviewer mount preserved. Native Secret ownership and actual same-process reread/rotation not proved.", + "New receiver namespace+pod selectors are ANDed in one peer and exact TCPport; DNS peer ANDed with UDP/TCP53. Existing auth TCP443/6443 egress rule is retained and remains broader; do not claim whole-pod traffic is limited to receiver/DNS.", + "Actual source audit-core Service is namespace audit-core, app.kubernetes.io/name=audit-core, port8080; current receiver NetworkPolicy lacks general Access decision-pin sender ingress. No runtime route or registration admission inferred." + ], + "remaining_admission_gates": [ + "Audit owner final per-pin source/tenant/eventclass/cadence/secretpolicy/rate thresholds and writertrue/readfalse sender admission; actual inventory/renames reconciled, no new registry payload invented.", + "Platform/route owner admitted existingSecret/key, attended credential mint/delivery/rotation/revoke custody receipts; old audit-core-senders draft routing is not executable admission.", + "Exact receiver URL Service/targetport, namespace/podlabels and DNS runtime coordinates plus matching receiver ingress approved by network/receiver owners.", + "Immutable Access image with mandatory-commit and current chart provenance, renderer pins and founder rollout go; PVC/free disk/backuprestore and singlewriter Recreate window, rollback preserves pending evidence and never reverts mandatorycommit for availability.", + "Actual native commit-before-every-effect failure503 and withholding proof, same eventIDs receiver accepted202/duplicate200, restartcursor/drain and bounded backlog, private credential revoke/readrefusal/heartbeat/silence findings.", + "Compatible acceptance-time vs commit-time evidence before loss/completeness reconciliation; transport failure/503 cannot be conflated with authorization denial. Existing AccessT08/AuditT02 and reconciliation gates stay open." + ], + "review_scope": "inert Access auditDelivery chart sender mount/custody/network interface source only", + "reviewed_files": { + "/home/worsch/access-engine/charts/flex-auth/templates/deployment.yaml": "a57ad96b676110df4c307a379d13919f5039636146893ed84e256e0b0673393f", + "/home/worsch/access-engine/charts/flex-auth/templates/networkpolicy.yaml": "b42f0e1f4c56e6ced5b9f7f19ed6592df593206b4236b92d30099778527dfbe9", + "/home/worsch/access-engine/charts/flex-auth/values.yaml": "f98d3ded5702adcb648190b943c73c391b72a6334ab54d906a7505be9093ba0b", + "/home/worsch/access-engine/docs/audit-delivery-rollout-preparation.md": "1b29912ccea9e0cf2de82adfa5d460b6c4f7bd4c0de876ddc33ef01bff5f7bb0", + "/home/worsch/access-engine/tests/test_outbox_chart.py": "d405ef381ef154354e5ba1b5c09b81cfa806ecac92df883a8eb6a5448c8e2acf", + "/home/worsch/access-engine/workplans/FLEX-WP-0031-decision-record-emission.md": "9326544af33734937904108e1b3848e557fa7b22808fba98d016a0f27ca55e72" + }, + "reviewed_input_unchanged": true, + "reviewed_manifest": "/tmp/access-audit-delivery-stage/manifest.json", + "reviewed_manifest_sha256": "f4ce9aa88b517d5bfe3e97ff19c62d0bf61f5872fd9c58b6770978961083b293", + "reviewer": "railiance-platform-owner (agent railiance-platform, codex)", + "schema": "owner-source-review/v1", + "source_only": true, + "source_pins": { + "access-engine/cmd/access-engine/main.go": "da24fa10e174f117e6cf44f1ba765d5b66078113198fa48fb911f5a91b5cec83", + "access-engine/internal/emission/delivery.go": "8d4bf346c175704b36daa07e7eef1b8deb3a8cbff22d43dc67ccf120fc9dbdc0", + "audit-core/deploy/audit-core.yaml": "227bd366d984c3bb5055303fd63f1eb9faabcf901b3be76ec31dda4fe23fb888", + "audit-core/deploy/networkpolicies.yaml": "c1ba896c9d29ac690ce2059759c46f0152a1e179d0322f505fab0c9e96c51463", + "railiance-platform/INTENT.md": "12c6540735af591f7a4a9fe85ff10d3cd00eec55b5b6b1ddf148abf2d3ac9a9c" + }, + "validation": { + "go": "go test -mod=readonly ./internal/decision ./internal/emission ./internal/readback ./cmd/access-engine ./pkg/api passed with GOCACHE/GOTMPDIR in/tmp; readback has no tests", + "helm_lint": "1chartpassed,0failed; optional icon informational", + "independent_platform_checks": 8, + "renderer": "python3 tests/test_outbox_chart.py passed against isolated exact-stage chart", + "result": "allpass including three expected fractional-port counterexamples; no native/credential action" + }, + "work_item": "RPF-WP-ADHOC-2026-10-11-T01" +} diff --git a/docs/reviews/2026-10-11-access-audit-delivery-v2-platform-review.json b/docs/reviews/2026-10-11-access-audit-delivery-v2-platform-review.json new file mode 100644 index 0000000..c88bc5f --- /dev/null +++ b/docs/reviews/2026-10-11-access-audit-delivery-v2-platform-review.json @@ -0,0 +1,74 @@ +{ + "completed_same_owner_record_precedes_formal_review": true, + "correction": "RPF-ACCESS-AUDIT-V1-F01 corrected: rendered decimalinteger shape validated before1..65535 bounds and rawport emission. Original8000.5/1.5/65535.5, boolean/null/named inputs refuse. Exact1/65535 render integers; no custody/default/Go payload or commit-semantics change.", + "decision": "approved", + "intent_basis": "Platform secure custody, durable platform delivery and stable service interfaces: exact admitted mounted sender credential and route; no independent application logic or native authority from source review.", + "maker_completed_record": { + "persisted_commit": "c8a3766", + "record_sha256": "be19dec8bc278e6fd3173175b864a309ac67c49b8c4be1d5b3b319b8b3e2c43a", + "repo": "access-engine", + "scope": "completed source preparation, not nativeadmission; original advancement intentional", + "task": "FLEX-WP-ADHOC-2026-10-11-T03" + }, + "native_executed": false, + "not_approved": [ + "native credential/Secret/API access, token mint or receiver registration", + "native rollout/route/ingress change or source application", + "full emission/adoption/loss completeness or originalowner task closure" + ], + "owner_record": { + "managed_identifiers_now_present": true, + "original_completed_record_sha256": "9b5f43f4a1b84fbada4f175d445a68f13ea54e47e290fe4fb11d57ac4c08cd69", + "path": "workplans/ADHOC-2026-10-11.md", + "persisted_commit": "431df1d", + "sha256": "da876fcb075c3e645dcfd6c602a3875ac98f0101b6ae57cf4c4eba70c8206e6c" + }, + "prior_review_retained_sha256": "e972a54e36b13dae05983fcd14b100551dffe9a11d14099273d5698c7353499a", + "qualified_verified": [ + "Default auditDelivery.enabled=false generates no credential mount/sender flags/new receiver-DNS egress; creates no Secret or sender registration.", + "Enablement requires serve, durable single-writer outbox/Recreate, exact existingSecret/key, explicit receiver/DNS selectors and /v1/events endpoint. No payload/commit semantics code changed.", + "Exactly one projected sender key, readOnly0440 directory without subPath; fsGroup65532, no automountServiceAccountToken, existing auth reviewer mount preserved. Native Secret ownership and actual same-process reread/rotation not proved.", + "New receiver namespace+pod selectors are ANDed in one peer and exact TCPport; DNS peer ANDed with UDP/TCP53. Existing auth TCP443/6443 egress rule is retained and remains broader; do not claim whole-pod traffic is limited to receiver/DNS.", + "Actual source audit-core Service is namespace audit-core, app.kubernetes.io/name=audit-core, port8080; current receiver NetworkPolicy lacks general Access decision-pin sender ingress. No runtime route or registration admission inferred." + ], + "remaining_admission_gates": [ + "Audit owner final per-pin source/tenant/eventclass/cadence/secretpolicy/rate thresholds and writertrue/readfalse sender admission; actual inventory/renames reconciled, no new registry payload invented.", + "Platform/route owner admitted existingSecret/key, attended credential mint/delivery/rotation/revoke custody receipts; old audit-core-senders draft routing is not executable admission.", + "Exact receiver URL Service/targetport, namespace/podlabels and DNS runtime coordinates plus matching receiver ingress approved by network/receiver owners.", + "Immutable Access image with mandatory-commit and current chart provenance, renderer pins and founder rollout go; PVC/free disk/backuprestore and singlewriter Recreate window, rollback preserves pending evidence and never reverts mandatorycommit for availability.", + "Actual native commit-before-every-effect failure503 and withholding proof, same eventIDs receiver accepted202/duplicate200, restartcursor/drain and bounded backlog, private credential revoke/readrefusal/heartbeat/silence findings.", + "Compatible acceptance-time vs commit-time evidence before loss/completeness reconciliation; transport failure/503 cannot be conflated with authorization denial. Existing AccessT08/AuditT02 and reconciliation gates stay open." + ], + "review_scope": "corrected disabled-by-default auditDelivery chart mount/custody/network preparation source only", + "reviewed_files": { + "/home/worsch/access-engine/charts/flex-auth/templates/deployment.yaml": "a57ad96b676110df4c307a379d13919f5039636146893ed84e256e0b0673393f", + "/home/worsch/access-engine/charts/flex-auth/templates/networkpolicy.yaml": "53d8ae1851b66c8c9f990fc56bc8ad9076741e2684f39470a7e1583b093d9c14", + "/home/worsch/access-engine/charts/flex-auth/values.yaml": "f98d3ded5702adcb648190b943c73c391b72a6334ab54d906a7505be9093ba0b", + "/home/worsch/access-engine/docs/audit-delivery-rollout-preparation.md": "47805cd51baceea91a45fe6c53a6cca0c58a9acb9ba42354e9c5b426ec188f4f", + "/home/worsch/access-engine/tests/test_outbox_chart.py": "f6c68dfc6f8a1a8dbf2afcab18b428111765b965a419890f52fb19eb51d3ceea", + "/home/worsch/access-engine/workplans/ADHOC-2026-10-11.md": "be19dec8bc278e6fd3173175b864a309ac67c49b8c4be1d5b3b319b8b3e2c43a", + "/home/worsch/access-engine/workplans/FLEX-WP-0031-decision-record-emission.md": "24d228f33a1a76f266ecf8ca9d403d885717df08ba08714eda928a7b1f3007ad" + }, + "reviewed_input_unchanged": true, + "reviewed_manifest": "/tmp/access-audit-delivery-v2-stage/manifest.json", + "reviewed_manifest_sha256": "90d5b7e962da046f205cdfa3267c25d22539c500c537c89033aefa568c3c5e16", + "reviewer": "railiance-platform-owner (agent railiance-platform, codex)", + "same_trial": true, + "schema": "owner-source-review/v1", + "source_only": true, + "source_pins": { + "access-engine/cmd/access-engine/main.go": "da24fa10e174f117e6cf44f1ba765d5b66078113198fa48fb911f5a91b5cec83", + "access-engine/internal/emission/delivery.go": "8d4bf346c175704b36daa07e7eef1b8deb3a8cbff22d43dc67ccf120fc9dbdc0", + "audit-core/deploy/audit-core.yaml": "227bd366d984c3bb5055303fd63f1eb9faabcf901b3be76ec31dda4fe23fb888", + "audit-core/deploy/networkpolicies.yaml": "c1ba896c9d29ac690ce2059759c46f0152a1e179d0322f505fab0c9e96c51463", + "railiance-platform/INTENT.md": "12c6540735af591f7a4a9fe85ff10d3cd00eec55b5b6b1ddf148abf2d3ac9a9c" + }, + "validation": { + "go": "previous passed ABI/commit/emission suites retained against identical main.go and delivery.go source hashes; no unnecessary rerun", + "helm_lint": "1chartpassed,0failed", + "independent_platform_checks": 15, + "renderer": "supplied frozen v2 tests pass including22 YAML/JSON refused values and integer boundaries in isolated chart", + "result": "passed offline renderer and counterexamples; no native Secret/credential/route/image/runtime proof" + }, + "work_item": "RPF-WP-ADHOC-2026-10-11-T01" +} diff --git a/workplans/ADHOC-2026-10-11.md b/workplans/ADHOC-2026-10-11.md index 3c5ce63..3b5be0e 100644 --- a/workplans/ADHOC-2026-10-11.md +++ b/workplans/ADHOC-2026-10-11.md @@ -10,6 +10,7 @@ owner: codex topic_slug: railiance created: "2026-10-11" updated: "2026-10-11" +state_hub_workstream_id: "e333bf0f-2767-5522-a948-dc77a89e0d85" --- ## Complete bounded audit-delivery deployment and custody source review preparation @@ -18,6 +19,7 @@ updated: "2026-10-11" id: RPF-WP-ADHOC-2026-10-11-T01 status: done priority: low +state_hub_task_id: "fe5e509b-cf41-52eb-af7e-e374a6417e00" ``` Loaded own Platform AGENTS/INTENT and actual audit-core receiver Deployment/Service/ @@ -39,3 +41,23 @@ execution/KEY39 work records are not reused. Native Access image/provenance, PVC/free capacity/backup/singlewriter rollout and accepted/duplicate/revoke/ heartbeat/recovery/loss-completeness proof remain open under original Access/ Audit owners. No credentials, actual Secret objects or owner checkout writes. + + +2026-10-11 sameT01 correction preparation: exact Access auditDelivery v2 manifest +`90d5b7e962da046f205cdfa3267c25d22539c500c537c89033aefa568c3c5e16` verified +against seven staged files. Access own completed source-preparation T03 anchor +`be19dec8bc278e6fd3173175b864a309ac67c49b8c4be1d5b3b319b8b3e2c43a` is now +persisted; its deliberate original-hash advancement does not alter reviewed chart +bytes. Supplied renderer including22 YAML/JSON rejected-port cases and integer +boundaries, Helm lint and15 fresh Platform checks pass. Three initial fractional +port counterexamples now refuse before rendering; booleans/null/namedvalues also +refuse, integer1/65535 render exact numeric integers. Readonly0440 single-key mount +without subPath, original caller-auth mount and exactAND receiver/DNS peers remain +unchanged. Completed ownT01 preparation record preceded formal correction review. +Retain initial e972a54e requestchanges and exact original counterexamples. +Source agreement covers disabled chart preparation only. Existing auth443/6443 +egress remains broader; receiver ingress/registration, per-pin Secret custody, +rotation/revocation/cleanup, exact runtime coordinates and immutable Access image +with mandatorycommit, attended rollout/PVC recovery and native accepted/duplicate/ +restart/heartbeat/reconciliation proof remain owner gates. No native/Secret access, +credential/API request or owner checkout writes; original live task states retained.