diff --git a/credential-change-requests/CCR-2026-0021-approval-engine-audit.yaml b/credential-change-requests/CCR-2026-0021-approval-engine-audit.yaml index 91c46df..fc09fb2 100644 --- a/credential-change-requests/CCR-2026-0021-approval-engine-audit.yaml +++ b/credential-change-requests/CCR-2026-0021-approval-engine-audit.yaml @@ -137,6 +137,22 @@ verification: - Status remains applied pending native producer accepted/duplicate, source/tenant/read-refusal and bearer-revocation evidence. Reader-session revocation does not revoke audit bearer credentials. + - at: '2026-09-11T13:11:08+00:00' + actor: codex via attended user platform-admin + kind: factory_audit_native_producer_and_independent_readback + result: passed + details: + - Native adapters accepted synthetic events (202), retried after process restart + as duplicates (200), reconciled count one and refused wrong source/tenant, + sibling reconciliation, seven read routes and invalid bearers. + - Independent read-only operator found both retained exact source/tenant events; + the 36-event chain is intact. Readback wrapper exit 0 confirms this session + self-revocation and private-helper cleanup; earlier failed-session uncertainty + is not retroactively closed. + - 'Receipt: docs/evidence/2026-09-11-factory-native-readback.json.' + - Status remains applied pending formerly-valid audit-bearer revocation proof. + Invalid-bearer refusal and OpenBao session revocation are distinct checks. + lifecycle: deactivate: Stop the exact producer; remove only its admitted token from the registry using CAS and reload/verify receiver refusal. Then detach its reader policy and diff --git a/credential-change-requests/CCR-2026-0022-informed-decision-audit.yaml b/credential-change-requests/CCR-2026-0022-informed-decision-audit.yaml index ace1b5c..cadbe46 100644 --- a/credential-change-requests/CCR-2026-0022-informed-decision-audit.yaml +++ b/credential-change-requests/CCR-2026-0022-informed-decision-audit.yaml @@ -138,6 +138,22 @@ verification: - Status remains applied pending native producer accepted/duplicate, source/tenant/read-refusal and bearer-revocation evidence. Reader-session revocation does not revoke audit bearer credentials. + - at: '2026-09-11T13:11:08+00:00' + actor: codex via attended user platform-admin + kind: factory_audit_native_producer_and_independent_readback + result: passed + details: + - Native adapters accepted synthetic events (202), retried after process restart + as duplicates (200), reconciled count one and refused wrong source/tenant, + sibling reconciliation, seven read routes and invalid bearers. + - Independent read-only operator found both retained exact source/tenant events; + the 36-event chain is intact. Readback wrapper exit 0 confirms this session + self-revocation and private-helper cleanup; earlier failed-session uncertainty + is not retroactively closed. + - 'Receipt: docs/evidence/2026-09-11-factory-native-readback.json.' + - Status remains applied pending formerly-valid audit-bearer revocation proof. + Invalid-bearer refusal and OpenBao session revocation are distinct checks. + lifecycle: deactivate: Stop the exact producer; remove only its admitted token from the registry using CAS and reload/verify receiver refusal. Then detach its reader policy and diff --git a/docs/evidence/2026-09-11-factory-native-readback.json b/docs/evidence/2026-09-11-factory-native-readback.json new file mode 100644 index 0000000..d901224 --- /dev/null +++ b/docs/evidence/2026-09-11-factory-native-readback.json @@ -0,0 +1,197 @@ +{ + "schema": "platform.factory-native-acceptance-receipt.v1", + "status": "native_producer_delivery_verified_pending_bearer_revocation_and_service_admission", + "credential_values_emitted": false, + "started_at": "2026-09-11T10:42:09.254002+00:00", + "run_id": "factory-audit-20260911104152-94aced", + "packet_sha256": "5e8a20e29fb309924005a061939c94d8a40815126c44654b6daeb8adf18424c7", + "source_commits": { + "approval-engine": [ + "a0a602976eef818f36dde35f76f7f2e589bd051b", + "approval_engine" + ], + "informed-decision": [ + "1a122235741d61b649e39ab86ddfbd317e54ad2f", + "informed_decision" + ] + }, + "receiver_before": { + "image": "forgejo.coulomb.social/coulomb/audit-core@sha256:c82e0442de0fd181342916ae9cd5d6de41d859e1efda637bd93936c67873afa5", + "deployment_uid": "b85fe3d0-75c9-4e0d-8c34-c6f1df0881bb", + "deployment_resource_version": "59845369", + "pod_uid": "4d0ee4e5-5427-43f1-94ca-88e5470c4831", + "capabilities": { + "load_bearing": true, + "redact": true, + "write_only": true, + "source_exact": true, + "tenant_exact": true + }, + "synthetic_probe_only": true, + "credential_reads": 0 + }, + "phase": "complete", + "operator_registry_reads": 0, + "created_objects": [ + { + "kind": "ConfigMap", + "name": "factory-audit-20260911104152-94aced", + "namespace": "approval-engine", + "uid": "e847feeb-f847-480a-b4d0-cfc63ddeda94" + }, + { + "kind": "NetworkPolicy", + "name": "factory-audit-20260911104152-94aced", + "namespace": "approval-engine", + "uid": "3cfeab0f-9495-4ac3-916e-4f8ffa7a5b10" + }, + { + "kind": "Job", + "name": "factory-audit-20260911104152-94aced", + "namespace": "approval-engine", + "uid": "42a23f42-657b-4077-8935-6b8315711416" + }, + { + "kind": "ConfigMap", + "name": "factory-audit-20260911104152-94aced", + "namespace": "informed-decision", + "uid": "ed443945-66aa-48db-88c6-f176b5c66c70" + }, + { + "kind": "NetworkPolicy", + "name": "factory-audit-20260911104152-94aced", + "namespace": "informed-decision", + "uid": "21bc3c88-5515-4923-b675-f3648f621e4c" + }, + { + "kind": "Job", + "name": "factory-audit-20260911104152-94aced", + "namespace": "informed-decision", + "uid": "8da3c95a-b194-4acd-aad4-2b0ac1004dbd" + } + ], + "producers": [ + { + "credential_values_emitted": false, + "domain_transaction_atomicity_tested": false, + "event_id": "factory-audit-20260911104152-94aced-approval-engine", + "http_statuses": [ + 202, + 200 + ], + "human_binding_tested": false, + "negatives": { + "audit_bearer_revocation_tested": false, + "invalid_bearer_denied": 401, + "own_reconciliation": true, + "probe_count": 1, + "read_routes_denied": 7, + "sibling_reconciliation_denied": true, + "source_denied": 400, + "tenant_denied": 400 + }, + "phase": "restart-retry", + "process_restart_retry": true, + "producer_service_deployed": false, + "run_id": "factory-audit-20260911104152-94aced", + "sender": "approval-engine", + "source_zip_sha256": "114215406400f6f5728520bf3d7dc2b7a4ff410784b80201b7a5ae24259f64c0", + "status": "passed", + "synthetic_outbox_only": true, + "pod_uid": "27517b95-091f-405c-9185-2fad1678097f", + "image": "forgejo.coulomb.social/coulomb/approval-engine@sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49", + "runtime_image_id": "forgejo.coulomb.social/coulomb/approval-engine@sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49", + "independent_readback": { + "event_id": "factory-audit-20260911104152-94aced-approval-engine", + "accepted_at": "2026-09-11T10:42:19+00:00", + "source": "approval-engine", + "tenant": "tenant:platform", + "synthetic": true + } + }, + { + "credential_values_emitted": false, + "domain_transaction_atomicity_tested": false, + "event_id": "factory-audit-20260911104152-94aced-informed-decision", + "http_statuses": [ + 202, + 200 + ], + "human_binding_tested": false, + "negatives": { + "audit_bearer_revocation_tested": false, + "invalid_bearer_denied": 401, + "own_reconciliation": true, + "probe_count": 1, + "read_routes_denied": 7, + "sibling_reconciliation_denied": true, + "source_denied": 400, + "tenant_denied": 400 + }, + "phase": "restart-retry", + "process_restart_retry": true, + "producer_service_deployed": false, + "run_id": "factory-audit-20260911104152-94aced", + "sender": "informed-decision", + "source_zip_sha256": "114215406400f6f5728520bf3d7dc2b7a4ff410784b80201b7a5ae24259f64c0", + "status": "passed", + "synthetic_outbox_only": true, + "pod_uid": "dd2c4175-553a-40af-a656-5cb3db8e45fd", + "image": "forgejo.coulomb.social/coulomb/approval-engine@sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49", + "runtime_image_id": "forgejo.coulomb.social/coulomb/approval-engine@sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49", + "independent_readback": { + "event_id": "factory-audit-20260911104152-94aced-informed-decision", + "accepted_at": "2026-09-11T10:42:20+00:00", + "source": "informed-decision", + "tenant": "tenant:platform", + "synthetic": true + } + } + ], + "cleanup_requested": true, + "completed_at": "2026-09-11T13:11:08.775531+00:00", + "readback_started_at": "2026-09-11T13:11:05.169589+00:00", + "receiver_at_readback": { + "image": "forgejo.coulomb.social/coulomb/audit-core@sha256:c82e0442de0fd181342916ae9cd5d6de41d859e1efda637bd93936c67873afa5", + "deployment_uid": "b85fe3d0-75c9-4e0d-8c34-c6f1df0881bb", + "deployment_resource_version": "59897385", + "pod_uid": "4d0ee4e5-5427-43f1-94ca-88e5470c4831", + "capabilities": { + "load_bearing": true, + "redact": true, + "write_only": true, + "source_exact": true, + "tenant_exact": true + }, + "synthetic_probe_only": true, + "credential_reads": 0 + }, + "reader_candidates": [ + { + "name": "operator", + "may_read": true, + "may_write": false, + "tenants": [ + "*" + ] + } + ], + "registry_version": 8, + "reader_name": "operator", + "integrity_after": { + "intact": true, + "events": 36, + "head": "ec50d25a1298a83ed1b82ede473ebd792acf6e2b3e78b13d19df958717d3fb83", + "head_event_id": "factory-audit-20260911104152-94aced-informed-decision", + "head_accepted_at": "2026-09-11T10:42:20+00:00", + "first_break": null, + "attestation_match": null + }, + "attended_execution": { + "wrapper_exit_code": 0, + "session_self_revocation_confirmed": true, + "private_helper_cleanup_confirmed": true, + "earlier_failed_session_revocation_resolved": false + }, + "operator_registry_reads_scope": "Inherited zero count applies to producer Jobs only; the attended independent readback read registry version 8." +} diff --git a/workplans/RPF-WP-0035-credential-lane-implementation.md b/workplans/RPF-WP-0035-credential-lane-implementation.md index d093f54..a3905b6 100644 --- a/workplans/RPF-WP-0035-credential-lane-implementation.md +++ b/workplans/RPF-WP-0035-credential-lane-implementation.md @@ -582,3 +582,23 @@ acceptance; CCR21/22 remain applied. Service/policy/human admission and native runtime/spend gates remain separate. Factory attempts and paid calls remain 0. [Native producer receipt](../docs/evidence/2026-09-11-factory-native-producers.json). + + +## Independent audit readback — 2026-09-11 13:11 UTC + +The existing attended readback command completed with exit 0 while the user +was present. Independent read-only identity `operator` found both retained +`factory-audit-20260911104152-94aced` producer events with exact source and +`tenant:platform`; receiver integrity is intact across 36 events. The wrapper +confirmed this session's self-revocation and private-helper cleanup. Prior +failed sessions' unconfirmed revocation remains historical unresolved evidence. + +This supersedes the earlier readback-login wait. No producer jobs were rerun, +no credentials were reseeded and no event was written by the reader. The +inherited zero registry-read count belongs to the producer phase; the attended +reader did consume registry version 8. CCR21/22 stay applied and owner tasks +stay progress pending formerly-valid audit-bearer revocation acceptance. +Service/domain-transaction/human and factory runtime/spend admission remain +separate; factory attempts and paid model calls remain zero. + +Receipt: [native readback](../docs/evidence/2026-09-11-factory-native-readback.json).