Record conditional and refined informed-decision release owner review
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
codex
parent
6b1c1c700d
commit
c771a17269
8 changed files with 217 additions and 0 deletions
|
|
@ -0,0 +1,50 @@
|
|||
{
|
||||
"review_id": "RPF-REVIEW-20261011-INFD-PURPOSE-R1-CONDITIONAL",
|
||||
"work_record": "RPF-IN-0005",
|
||||
"reviewer_role": "railiance-platform technical owner / GitOps and package binding",
|
||||
"status": "changes-required",
|
||||
"reviewed_manifest_sha256": "7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300",
|
||||
"reviewed_paths": 36,
|
||||
"candidate_image": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"published_source": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
|
||||
"verified": {
|
||||
"manifest_all_bytes": true,
|
||||
"bound_document_digests": 20,
|
||||
"bound_document_bytes": 249719,
|
||||
"deployment_candidate_rollback_changed_paths": [
|
||||
"/spec/template/spec/containers/0/image"
|
||||
],
|
||||
"guard_test_methods_passed": 5,
|
||||
"synthetic_main_only_backup_clone_schema5_integrity_counts": true
|
||||
},
|
||||
"required_refinements": [
|
||||
{
|
||||
"id": "RPF-INFD-R1-01",
|
||||
"issue": "Admin Store initialization migrates schemas1-4; post-open schema5 cannot establish no migration",
|
||||
"required": "Before any admin/Store open, read-only SQLite schema5 plus integrity and bounded table/state baseline; validate frozen snapshot and offline copy before and after inspection. Exact offline command must override service entrypoint. Wrong pre-open schema stops without migration."
|
||||
},
|
||||
{
|
||||
"id": "RPF-INFD-R1-02",
|
||||
"issue": "Assertions disappear under optimization, permitting wrong Argo UID and Ready0",
|
||||
"required": "Explicit local and remote sys.flags.optimize refusal before assertion-based checks, or explicit non-assert guards. Regression must show optimized execution refuses before remote/native operations."
|
||||
},
|
||||
{
|
||||
"id": "RPF-INFD-R1-03",
|
||||
"issue": "Deployment references pin names but not actual ConfigMap/PVC identities",
|
||||
"required": "Freeze and refresh nonsecret runtime ConfigMap UID/immutable/canonical-data hash and PVC UID/volumeName/bound custody metadata. Reject same-name recreation or data/policy drift without reading Secrets."
|
||||
},
|
||||
{
|
||||
"id": "RPF-INFD-R1-04",
|
||||
"issue": "Rollback same counts wording can imply frozen-count equality despite allowed live commits",
|
||||
"required": "Clarify exact equality applies isolated restored snapshot; live rollback retains and reconciles latest evidence and allows legitimate commits, with no replay or snapshot overwrite."
|
||||
}
|
||||
],
|
||||
"authority_limits": {
|
||||
"human_approval": false,
|
||||
"native_backup_export_restore": false,
|
||||
"native_workload_change": false,
|
||||
"native_pdp_proof": false,
|
||||
"new_role_or_autonomy_grant": false
|
||||
},
|
||||
"risk_assessment": "Published scan has one inherited fixable MEDIUM explicitly requested, not a clean scan or risk grade; T05 remains owner follow-through due2026-10-18. Recreate and image rollback preserve same-schema latest DB and unresolved external effects."
|
||||
}
|
||||
|
|
@ -0,0 +1,45 @@
|
|||
{
|
||||
"review_id": "RPF-REVIEW-20261011-INFD-PURPOSE-R1-FINAL",
|
||||
"work_record": "RPF-IN-0005",
|
||||
"reviewer_role": "railiance-platform technical owner / GitOps and package binding",
|
||||
"status": "technical-agreement",
|
||||
"reviewed_manifest_sha256": "b1e3e66bc4023dc80c6ea59564c3557c7653fb3c307f46a049997b76198a9033",
|
||||
"reviewed_paths": 78,
|
||||
"candidate_image": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"published_source": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
|
||||
"prior_conditional_review": "RPF-REVIEW-20261011-INFD-PURPOSE-R1-CONDITIONAL",
|
||||
"original_manifest_sha256": "7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300",
|
||||
"verification": {
|
||||
"all_78_source_hashes_match": true,
|
||||
"bound_documents": 20,
|
||||
"bound_document_bytes": 184912,
|
||||
"all_bound_digests_match": true,
|
||||
"maker_test_methods_independently_passed": 11,
|
||||
"additional_independent_methods_passed": 4,
|
||||
"additional_dependency_drift_negatives": 8,
|
||||
"actual_owner_schema4_fixture_refused_without_migration_or_main_file_change": true,
|
||||
"actual_owner_schema5_fixture_counts_match": true,
|
||||
"symlink_database_refused": true
|
||||
},
|
||||
"resolved": [
|
||||
"Stdlib mode=ro/query_only read transaction requires schema5 and integrity before Store/admin open, both native backup source and isolated candidate restored copy; wrong schemas stop before migration.",
|
||||
"Both local and remote optimization refusals execute before assertion-based checks or transport/native dispatch.",
|
||||
"Fresh dependency check seals actual immutable ConfigMap UID/metadata/canonical data checksum and PVC UID/fullspec/volumeName/Bound custody; recreations and drift refuse. No Secret reads.",
|
||||
"Exact offline entrypoint is python checker then informed-decision-admin inspect, networknone/read-only image/no runtime tokens or config. Frozen counters compare offline only; live writes remain preserved and reconciled through same-schema DB-retaining image rollback."
|
||||
],
|
||||
"agreed_scope": "Prepared exact founder proposal for protected consistent online snapshot/copy/offline restore gates, fresh cutover snapshot, then exact owner-source manual Argo Deployment-only image sync prune=false and same-schema DB-retaining rollback. Candidate image/config/policy/credential/PVC/resource scope remains unchanged.",
|
||||
"retained_native_gates": [
|
||||
"Exact confirmed founder disposition on final bound packet before any native custody/runtime action; config-only prior approval not reused.",
|
||||
"Fresh sealed source/live/dependency/admission and capacity/custody checks before operation.",
|
||||
"Real consistent protected backup plus actual-data isolated restore proof before cutover; synthetic tests are not native proof.",
|
||||
"Fresh cutover snapshot, actual rollout/readiness/image/module and installed purpose/native binding checks; retain uncertain outcomes and private originals.",
|
||||
"Current known inherited fixable MEDIUM is explicitly requested and retained with T05 owner follow-through due2026-10-18; no clean scan/risk grade/autonomy inference."
|
||||
],
|
||||
"authority_limits": {
|
||||
"human_approval": false,
|
||||
"native_backup_export_restore": false,
|
||||
"native_workload_change": false,
|
||||
"native_pdp_proof": false,
|
||||
"T04_complete": false
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
{
|
||||
"synthetic_transport_only": true,
|
||||
"native_action": false,
|
||||
"optimize_0_wrong_uid_and_unready_passed": false,
|
||||
"optimize_1_wrong_uid_and_unready_passed": true
|
||||
}
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
{
|
||||
"manifest_sha256": "7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300",
|
||||
"manifest_paths": 36,
|
||||
"all_manifest_paths_match": true,
|
||||
"candidate_rollback_changed_paths": [
|
||||
"/spec/template/spec/containers/0/image"
|
||||
],
|
||||
"bound_documents": 20,
|
||||
"bound_document_bytes": 249719,
|
||||
"all_bound_digests_match": true,
|
||||
"native_actions": false
|
||||
}
|
||||
|
|
@ -0,0 +1,28 @@
|
|||
"""Independent isolated probe; fake subprocess transport, no SSH/native calls."""
|
||||
import ast,copy,contextlib,io,json,pathlib,subprocess,unittest.mock
|
||||
root=pathlib.Path('/tmp/infd-purpose-release-stage/informed-decision/docs/evidence/2026-10-11-purpose-image-release')
|
||||
tree=ast.parse((root/'preflight.py').read_text())
|
||||
program=next(node.value.value for node in tree.body if isinstance(node,ast.Assign) and any(isinstance(t,ast.Name) and t.id=='program' for t in node.targets) and isinstance(node.value,ast.Constant))
|
||||
sealed=json.loads((root/'sealed-live-deployment.json').read_text());live=copy.deepcopy(sealed);live['status']={'readyReplicas':0,'updatedReplicas':0}
|
||||
admitted=copy.deepcopy(sealed);admitted['spec']['template']['spec']['containers'][0]['image']='forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a'
|
||||
argo=json.loads((root/'native-preflight.json').read_text())['argo'];badargo=copy.deepcopy(argo);badargo['uid']='wrong-owner-uid'
|
||||
app={'metadata':{'uid':badargo['uid']},'spec':{'source':{k:badargo[k] for k in ('repoURL','targetRevision','path')},'destination':badargo['destination']},'status':{'sync':badargo['sync'],'health':badargo['health']}}
|
||||
for marker,value in [('CANDIDATE_LITERAL',(root/'candidate-deployment.json').read_text()),('SEALED_LITERAL',json.dumps(sealed)),('GUARD_LITERAL',(root/'change_guard.py').read_text()),('ARGO_LITERAL',json.dumps(argo))]:program=program.replace(marker,repr(value))
|
||||
def fake(args,**kwargs):
|
||||
if args[1:3]==['get','deployment']:value=live
|
||||
elif args[1:3]==['get','application']:value=app
|
||||
elif args[1:3]==['get','nodes']:value={'items':[{'status':{'allocatable':{'cpu':'4'}}}]}
|
||||
elif args[1]=='apply':value=admitted
|
||||
elif args[1]=='describe':return subprocess.CompletedProcess(args,0,'Allocated resources:\n cpu 3460m\nEvents:','')
|
||||
elif args[1]=='diff':return subprocess.CompletedProcess(args,1,'synthetic-diff','')
|
||||
else:raise RuntimeError('unrecognized fake call')
|
||||
return subprocess.CompletedProcess(args,0,json.dumps(value),'')
|
||||
result={'synthetic_transport_only':True,'native_action':False}
|
||||
for optimize in (0,1):
|
||||
out=io.StringIO()
|
||||
try:
|
||||
with unittest.mock.patch('subprocess.run',fake),contextlib.redirect_stdout(out):exec(compile(program,'sealed-preflight-synthetic','exec',optimize=optimize),{})
|
||||
except AssertionError:passed=False
|
||||
else:passed=json.loads(out.getvalue())['all_checks_pass'] is True
|
||||
result['optimize_'+str(optimize)+'_wrong_uid_and_unready_passed']=passed
|
||||
pathlib.Path('/tmp/infd-platform-owner-review-stage/optimization-findings.json').write_text(json.dumps(result,indent=2)+'\n');print(json.dumps(result))
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
"""Independent platform review regressions; synthetic databases and objects only."""
|
||||
import copy,hashlib,importlib.util,json,pathlib,sqlite3,sys,tempfile,unittest
|
||||
ROOT=pathlib.Path('/tmp/infd-purpose-release-stage/informed-decision/docs/evidence/2026-10-11-purpose-image-release')
|
||||
def load(name):
|
||||
spec=importlib.util.spec_from_file_location(name,ROOT/(name+'.py'));mod=importlib.util.module_from_spec(spec);spec.loader.exec_module(mod);return mod
|
||||
G=load('change_guard');Q=load('sqlite_readonly')
|
||||
class Independent(unittest.TestCase):
|
||||
def test_additional_dependency_drift(self):
|
||||
sealed=json.loads((ROOT/'sealed-native-dependencies.json').read_text());cm=copy.deepcopy(sealed['configmap']);cm.pop('canonical_data_sha256');service=json.loads((ROOT.parents[2]/'deploy/lifecycle/service.candidate.json').read_text());cm['data']=next(x for x in service['items'] if x['kind']=='ConfigMap')['data'];pvc=copy.deepcopy(sealed['pvc']);pvc['status']={'phase':'Bound'};G.check_dependencies(cm,pvc,sealed)
|
||||
changes=[lambda c,p:c['metadata'].update(namespace='wrong'),lambda c,p:c['metadata'].update(ownerReferences=[{'uid':'foreign'}]),lambda c,p:c['data'].update(extra='new'),lambda c,p:p['metadata'].update(namespace='wrong'),lambda c,p:p['metadata'].update(ownerReferences=[{'uid':'foreign'}]),lambda c,p:p['spec'].update(storageClassName='foreign'),lambda c,p:p['spec'].update(accessModes=['ReadWriteMany']),lambda c,p:p['spec']['resources']['requests'].update(storage='100Gi')]
|
||||
for change in changes:
|
||||
c,p=copy.deepcopy(cm),copy.deepcopy(pvc);change(c,p)
|
||||
with self.assertRaises(ValueError):G.check_dependencies(c,p,sealed)
|
||||
def test_real_schema4_refuses_without_migration(self):
|
||||
sys.path.insert(0,'/home/worsch/informed-decision');from informed_decision.store import Store
|
||||
with tempfile.TemporaryDirectory() as d:
|
||||
p=pathlib.Path(d)/'fixture.sqlite';Store(p)
|
||||
db=sqlite3.connect(p);db.execute('DROP INDEX lifecycle_review_snapshot');db.execute('DROP INDEX lifecycle_review_revision');db.execute('PRAGMA user_version=4');db.commit();db.close()
|
||||
before=hashlib.sha256(p.read_bytes()).hexdigest()
|
||||
with self.assertRaises(ValueError):Q.inspect_readonly(p)
|
||||
self.assertEqual(hashlib.sha256(p.read_bytes()).hexdigest(),before)
|
||||
db=sqlite3.connect(p);self.assertEqual(db.execute('PRAGMA user_version').fetchone()[0],4);db.close()
|
||||
def test_real_schema5_counts_match_owner(self):
|
||||
sys.path.insert(0,'/home/worsch/informed-decision');from informed_decision.store import Store
|
||||
with tempfile.TemporaryDirectory() as d:
|
||||
p=pathlib.Path(d)/'fixture.sqlite';s=Store(p);proof=Q.inspect_readonly(p);self.assertEqual(proof['lifecycle'],s.lifecycle_counts());self.assertEqual(proof['schema_version'],5)
|
||||
def test_link_database_refused(self):
|
||||
with tempfile.TemporaryDirectory() as d:
|
||||
p=pathlib.Path(d)/'fixture.sqlite';p.touch();q=pathlib.Path(d)/'link.sqlite';q.symlink_to(p)
|
||||
with self.assertRaises(ValueError):Q.inspect_readonly(q)
|
||||
if __name__=='__main__':unittest.main()
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
{
|
||||
"synthetic_only": true,
|
||||
"native_data_used": false,
|
||||
"main_only_clone_integrity_ok": true,
|
||||
"main_only_clone_documents": 1,
|
||||
"main_only_clone_schema": 5,
|
||||
"backup_wal_exists_after_close": false,
|
||||
"schema4_admin_store_open_became_schema5": true,
|
||||
"schema4_bytes_changed": false
|
||||
}
|
||||
35
intakes/RPF-IN-0005-infd-purpose-release-owner-review.md
Normal file
35
intakes/RPF-IN-0005-infd-purpose-release-owner-review.md
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
---
|
||||
id: RPF-IN-0005
|
||||
kind: intake
|
||||
type: intake
|
||||
title: "Independent platform owner review of INFD purpose image release"
|
||||
repo: railiance-platform
|
||||
lane: supervised
|
||||
status: closed
|
||||
owner: railiance-platform
|
||||
requested_by: the-custodian
|
||||
origin: handoff
|
||||
origin_ref: INFD-WP-0009
|
||||
priority: high
|
||||
created: "2026-10-11"
|
||||
updated: "2026-10-11"
|
||||
tags: [security, cross-owner, review]
|
||||
---
|
||||
|
||||
Review the exact prepared image-only release, SQLite custody/consistent backup,
|
||||
actual-data restore gate, cutover writer boundary, manual Argo scope and database
|
||||
retaining rollback. Initial source manifest SHA256:
|
||||
7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300.
|
||||
|
||||
This owner record precedes the review evidence. Its scope is independent source
|
||||
review and local synthetic verification. It does not authorize native backup,
|
||||
export, restore, credentials or rollout. Final disposition and exact hashes will
|
||||
be attached after review; existing approval boundaries remain in force.
|
||||
|
||||
## Initial exact review
|
||||
|
||||
Changes required against frozen manifest `7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300`: pre-open schema refusal, optimization-safe admission, actual runtime ConfigMap/PVC identity sealing, and live rollback-count clarification. Review receipt: `docs/evidence/2026-10-11-infd-purpose-release-owner-review/conditional-review.json`. Independent synthetic backup and fake-transport probes are mechanism evidence only; no actual private data or native operation occurred. Intake remains vetted until the refined source receives exact final review.
|
||||
|
||||
## Final owner review
|
||||
|
||||
Absorbed into final technical review `RPF-REVIEW-20261011-INFD-PURPOSE-R1-FINAL`, receipt `docs/evidence/2026-10-11-infd-purpose-release-owner-review/final-review.json`. Technical agreement applies only to refined exact 78-path manifest `b1e3e66bc4023dc80c6ea59564c3557c7653fb3c307f46a049997b76198a9033`. All four initial defects are resolved; original conditional failure/probe evidence remains. Eleven packet methods plus four additional independent methods pass. Owner review is complete; human disposition, actual protected-data drill, rollout and native verification remain gated in INFD-WP-0009-T04. No native action or approval is inferred.
|
||||
Loading…
Add table
Add a link
Reference in a new issue