diff --git a/docs/evidence/2026-10-11-infd-purpose-release-owner-review/conditional-review.json b/docs/evidence/2026-10-11-infd-purpose-release-owner-review/conditional-review.json new file mode 100644 index 0000000..8a1dd4d --- /dev/null +++ b/docs/evidence/2026-10-11-infd-purpose-release-owner-review/conditional-review.json @@ -0,0 +1,50 @@ +{ + "review_id": "RPF-REVIEW-20261011-INFD-PURPOSE-R1-CONDITIONAL", + "work_record": "RPF-IN-0005", + "reviewer_role": "railiance-platform technical owner / GitOps and package binding", + "status": "changes-required", + "reviewed_manifest_sha256": "7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300", + "reviewed_paths": 36, + "candidate_image": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "published_source": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168", + "verified": { + "manifest_all_bytes": true, + "bound_document_digests": 20, + "bound_document_bytes": 249719, + "deployment_candidate_rollback_changed_paths": [ + "/spec/template/spec/containers/0/image" + ], + "guard_test_methods_passed": 5, + "synthetic_main_only_backup_clone_schema5_integrity_counts": true + }, + "required_refinements": [ + { + "id": "RPF-INFD-R1-01", + "issue": "Admin Store initialization migrates schemas1-4; post-open schema5 cannot establish no migration", + "required": "Before any admin/Store open, read-only SQLite schema5 plus integrity and bounded table/state baseline; validate frozen snapshot and offline copy before and after inspection. Exact offline command must override service entrypoint. Wrong pre-open schema stops without migration." + }, + { + "id": "RPF-INFD-R1-02", + "issue": "Assertions disappear under optimization, permitting wrong Argo UID and Ready0", + "required": "Explicit local and remote sys.flags.optimize refusal before assertion-based checks, or explicit non-assert guards. Regression must show optimized execution refuses before remote/native operations." + }, + { + "id": "RPF-INFD-R1-03", + "issue": "Deployment references pin names but not actual ConfigMap/PVC identities", + "required": "Freeze and refresh nonsecret runtime ConfigMap UID/immutable/canonical-data hash and PVC UID/volumeName/bound custody metadata. Reject same-name recreation or data/policy drift without reading Secrets." + }, + { + "id": "RPF-INFD-R1-04", + "issue": "Rollback same counts wording can imply frozen-count equality despite allowed live commits", + "required": "Clarify exact equality applies isolated restored snapshot; live rollback retains and reconciles latest evidence and allows legitimate commits, with no replay or snapshot overwrite." + } + ], + "authority_limits": { + "human_approval": false, + "native_backup_export_restore": false, + "native_workload_change": false, + "native_pdp_proof": false, + "new_role_or_autonomy_grant": false + }, + "risk_assessment": "Published scan has one inherited fixable MEDIUM explicitly requested, not a clean scan or risk grade; T05 remains owner follow-through due2026-10-18. Recreate and image rollback preserve same-schema latest DB and unresolved external effects." +} diff --git a/docs/evidence/2026-10-11-infd-purpose-release-owner-review/final-review.json b/docs/evidence/2026-10-11-infd-purpose-release-owner-review/final-review.json new file mode 100644 index 0000000..b3ed87f --- /dev/null +++ b/docs/evidence/2026-10-11-infd-purpose-release-owner-review/final-review.json @@ -0,0 +1,45 @@ +{ + "review_id": "RPF-REVIEW-20261011-INFD-PURPOSE-R1-FINAL", + "work_record": "RPF-IN-0005", + "reviewer_role": "railiance-platform technical owner / GitOps and package binding", + "status": "technical-agreement", + "reviewed_manifest_sha256": "b1e3e66bc4023dc80c6ea59564c3557c7653fb3c307f46a049997b76198a9033", + "reviewed_paths": 78, + "candidate_image": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "published_source": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168", + "prior_conditional_review": "RPF-REVIEW-20261011-INFD-PURPOSE-R1-CONDITIONAL", + "original_manifest_sha256": "7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300", + "verification": { + "all_78_source_hashes_match": true, + "bound_documents": 20, + "bound_document_bytes": 184912, + "all_bound_digests_match": true, + "maker_test_methods_independently_passed": 11, + "additional_independent_methods_passed": 4, + "additional_dependency_drift_negatives": 8, + "actual_owner_schema4_fixture_refused_without_migration_or_main_file_change": true, + "actual_owner_schema5_fixture_counts_match": true, + "symlink_database_refused": true + }, + "resolved": [ + "Stdlib mode=ro/query_only read transaction requires schema5 and integrity before Store/admin open, both native backup source and isolated candidate restored copy; wrong schemas stop before migration.", + "Both local and remote optimization refusals execute before assertion-based checks or transport/native dispatch.", + "Fresh dependency check seals actual immutable ConfigMap UID/metadata/canonical data checksum and PVC UID/fullspec/volumeName/Bound custody; recreations and drift refuse. No Secret reads.", + "Exact offline entrypoint is python checker then informed-decision-admin inspect, networknone/read-only image/no runtime tokens or config. Frozen counters compare offline only; live writes remain preserved and reconciled through same-schema DB-retaining image rollback." + ], + "agreed_scope": "Prepared exact founder proposal for protected consistent online snapshot/copy/offline restore gates, fresh cutover snapshot, then exact owner-source manual Argo Deployment-only image sync prune=false and same-schema DB-retaining rollback. Candidate image/config/policy/credential/PVC/resource scope remains unchanged.", + "retained_native_gates": [ + "Exact confirmed founder disposition on final bound packet before any native custody/runtime action; config-only prior approval not reused.", + "Fresh sealed source/live/dependency/admission and capacity/custody checks before operation.", + "Real consistent protected backup plus actual-data isolated restore proof before cutover; synthetic tests are not native proof.", + "Fresh cutover snapshot, actual rollout/readiness/image/module and installed purpose/native binding checks; retain uncertain outcomes and private originals.", + "Current known inherited fixable MEDIUM is explicitly requested and retained with T05 owner follow-through due2026-10-18; no clean scan/risk grade/autonomy inference." + ], + "authority_limits": { + "human_approval": false, + "native_backup_export_restore": false, + "native_workload_change": false, + "native_pdp_proof": false, + "T04_complete": false + } +} diff --git a/docs/evidence/2026-10-11-infd-purpose-release-owner-review/optimization-findings.json b/docs/evidence/2026-10-11-infd-purpose-release-owner-review/optimization-findings.json new file mode 100644 index 0000000..aee5ded --- /dev/null +++ b/docs/evidence/2026-10-11-infd-purpose-release-owner-review/optimization-findings.json @@ -0,0 +1,6 @@ +{ + "synthetic_transport_only": true, + "native_action": false, + "optimize_0_wrong_uid_and_unready_passed": false, + "optimize_1_wrong_uid_and_unready_passed": true +} diff --git a/docs/evidence/2026-10-11-infd-purpose-release-owner-review/packet-findings.json b/docs/evidence/2026-10-11-infd-purpose-release-owner-review/packet-findings.json new file mode 100644 index 0000000..00324ce --- /dev/null +++ b/docs/evidence/2026-10-11-infd-purpose-release-owner-review/packet-findings.json @@ -0,0 +1,12 @@ +{ + "manifest_sha256": "7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300", + "manifest_paths": 36, + "all_manifest_paths_match": true, + "candidate_rollback_changed_paths": [ + "/spec/template/spec/containers/0/image" + ], + "bound_documents": 20, + "bound_document_bytes": 249719, + "all_bound_digests_match": true, + "native_actions": false +} diff --git a/docs/evidence/2026-10-11-infd-purpose-release-owner-review/probe_preflight_optimization.py b/docs/evidence/2026-10-11-infd-purpose-release-owner-review/probe_preflight_optimization.py new file mode 100644 index 0000000..2fd467c --- /dev/null +++ b/docs/evidence/2026-10-11-infd-purpose-release-owner-review/probe_preflight_optimization.py @@ -0,0 +1,28 @@ +"""Independent isolated probe; fake subprocess transport, no SSH/native calls.""" +import ast,copy,contextlib,io,json,pathlib,subprocess,unittest.mock +root=pathlib.Path('/tmp/infd-purpose-release-stage/informed-decision/docs/evidence/2026-10-11-purpose-image-release') +tree=ast.parse((root/'preflight.py').read_text()) +program=next(node.value.value for node in tree.body if isinstance(node,ast.Assign) and any(isinstance(t,ast.Name) and t.id=='program' for t in node.targets) and isinstance(node.value,ast.Constant)) +sealed=json.loads((root/'sealed-live-deployment.json').read_text());live=copy.deepcopy(sealed);live['status']={'readyReplicas':0,'updatedReplicas':0} +admitted=copy.deepcopy(sealed);admitted['spec']['template']['spec']['containers'][0]['image']='forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a' +argo=json.loads((root/'native-preflight.json').read_text())['argo'];badargo=copy.deepcopy(argo);badargo['uid']='wrong-owner-uid' +app={'metadata':{'uid':badargo['uid']},'spec':{'source':{k:badargo[k] for k in ('repoURL','targetRevision','path')},'destination':badargo['destination']},'status':{'sync':badargo['sync'],'health':badargo['health']}} +for marker,value in [('CANDIDATE_LITERAL',(root/'candidate-deployment.json').read_text()),('SEALED_LITERAL',json.dumps(sealed)),('GUARD_LITERAL',(root/'change_guard.py').read_text()),('ARGO_LITERAL',json.dumps(argo))]:program=program.replace(marker,repr(value)) +def fake(args,**kwargs): + if args[1:3]==['get','deployment']:value=live + elif args[1:3]==['get','application']:value=app + elif args[1:3]==['get','nodes']:value={'items':[{'status':{'allocatable':{'cpu':'4'}}}]} + elif args[1]=='apply':value=admitted + elif args[1]=='describe':return subprocess.CompletedProcess(args,0,'Allocated resources:\n cpu 3460m\nEvents:','') + elif args[1]=='diff':return subprocess.CompletedProcess(args,1,'synthetic-diff','') + else:raise RuntimeError('unrecognized fake call') + return subprocess.CompletedProcess(args,0,json.dumps(value),'') +result={'synthetic_transport_only':True,'native_action':False} +for optimize in (0,1): + out=io.StringIO() + try: + with unittest.mock.patch('subprocess.run',fake),contextlib.redirect_stdout(out):exec(compile(program,'sealed-preflight-synthetic','exec',optimize=optimize),{}) + except AssertionError:passed=False + else:passed=json.loads(out.getvalue())['all_checks_pass'] is True + result['optimize_'+str(optimize)+'_wrong_uid_and_unready_passed']=passed +pathlib.Path('/tmp/infd-platform-owner-review-stage/optimization-findings.json').write_text(json.dumps(result,indent=2)+'\n');print(json.dumps(result)) diff --git a/docs/evidence/2026-10-11-infd-purpose-release-owner-review/refined_independent_probes.py b/docs/evidence/2026-10-11-infd-purpose-release-owner-review/refined_independent_probes.py new file mode 100644 index 0000000..834a954 --- /dev/null +++ b/docs/evidence/2026-10-11-infd-purpose-release-owner-review/refined_independent_probes.py @@ -0,0 +1,31 @@ +"""Independent platform review regressions; synthetic databases and objects only.""" +import copy,hashlib,importlib.util,json,pathlib,sqlite3,sys,tempfile,unittest +ROOT=pathlib.Path('/tmp/infd-purpose-release-stage/informed-decision/docs/evidence/2026-10-11-purpose-image-release') +def load(name): + spec=importlib.util.spec_from_file_location(name,ROOT/(name+'.py'));mod=importlib.util.module_from_spec(spec);spec.loader.exec_module(mod);return mod +G=load('change_guard');Q=load('sqlite_readonly') +class Independent(unittest.TestCase): + def test_additional_dependency_drift(self): + sealed=json.loads((ROOT/'sealed-native-dependencies.json').read_text());cm=copy.deepcopy(sealed['configmap']);cm.pop('canonical_data_sha256');service=json.loads((ROOT.parents[2]/'deploy/lifecycle/service.candidate.json').read_text());cm['data']=next(x for x in service['items'] if x['kind']=='ConfigMap')['data'];pvc=copy.deepcopy(sealed['pvc']);pvc['status']={'phase':'Bound'};G.check_dependencies(cm,pvc,sealed) + changes=[lambda c,p:c['metadata'].update(namespace='wrong'),lambda c,p:c['metadata'].update(ownerReferences=[{'uid':'foreign'}]),lambda c,p:c['data'].update(extra='new'),lambda c,p:p['metadata'].update(namespace='wrong'),lambda c,p:p['metadata'].update(ownerReferences=[{'uid':'foreign'}]),lambda c,p:p['spec'].update(storageClassName='foreign'),lambda c,p:p['spec'].update(accessModes=['ReadWriteMany']),lambda c,p:p['spec']['resources']['requests'].update(storage='100Gi')] + for change in changes: + c,p=copy.deepcopy(cm),copy.deepcopy(pvc);change(c,p) + with self.assertRaises(ValueError):G.check_dependencies(c,p,sealed) + def test_real_schema4_refuses_without_migration(self): + sys.path.insert(0,'/home/worsch/informed-decision');from informed_decision.store import Store + with tempfile.TemporaryDirectory() as d: + p=pathlib.Path(d)/'fixture.sqlite';Store(p) + db=sqlite3.connect(p);db.execute('DROP INDEX lifecycle_review_snapshot');db.execute('DROP INDEX lifecycle_review_revision');db.execute('PRAGMA user_version=4');db.commit();db.close() + before=hashlib.sha256(p.read_bytes()).hexdigest() + with self.assertRaises(ValueError):Q.inspect_readonly(p) + self.assertEqual(hashlib.sha256(p.read_bytes()).hexdigest(),before) + db=sqlite3.connect(p);self.assertEqual(db.execute('PRAGMA user_version').fetchone()[0],4);db.close() + def test_real_schema5_counts_match_owner(self): + sys.path.insert(0,'/home/worsch/informed-decision');from informed_decision.store import Store + with tempfile.TemporaryDirectory() as d: + p=pathlib.Path(d)/'fixture.sqlite';s=Store(p);proof=Q.inspect_readonly(p);self.assertEqual(proof['lifecycle'],s.lifecycle_counts());self.assertEqual(proof['schema_version'],5) + def test_link_database_refused(self): + with tempfile.TemporaryDirectory() as d: + p=pathlib.Path(d)/'fixture.sqlite';p.touch();q=pathlib.Path(d)/'link.sqlite';q.symlink_to(p) + with self.assertRaises(ValueError):Q.inspect_readonly(q) +if __name__=='__main__':unittest.main() diff --git a/docs/evidence/2026-10-11-infd-purpose-release-owner-review/synthetic-findings.json b/docs/evidence/2026-10-11-infd-purpose-release-owner-review/synthetic-findings.json new file mode 100644 index 0000000..be3102b --- /dev/null +++ b/docs/evidence/2026-10-11-infd-purpose-release-owner-review/synthetic-findings.json @@ -0,0 +1,10 @@ +{ + "synthetic_only": true, + "native_data_used": false, + "main_only_clone_integrity_ok": true, + "main_only_clone_documents": 1, + "main_only_clone_schema": 5, + "backup_wal_exists_after_close": false, + "schema4_admin_store_open_became_schema5": true, + "schema4_bytes_changed": false +} diff --git a/intakes/RPF-IN-0005-infd-purpose-release-owner-review.md b/intakes/RPF-IN-0005-infd-purpose-release-owner-review.md new file mode 100644 index 0000000..00e4739 --- /dev/null +++ b/intakes/RPF-IN-0005-infd-purpose-release-owner-review.md @@ -0,0 +1,35 @@ +--- +id: RPF-IN-0005 +kind: intake +type: intake +title: "Independent platform owner review of INFD purpose image release" +repo: railiance-platform +lane: supervised +status: closed +owner: railiance-platform +requested_by: the-custodian +origin: handoff +origin_ref: INFD-WP-0009 +priority: high +created: "2026-10-11" +updated: "2026-10-11" +tags: [security, cross-owner, review] +--- + +Review the exact prepared image-only release, SQLite custody/consistent backup, +actual-data restore gate, cutover writer boundary, manual Argo scope and database +retaining rollback. Initial source manifest SHA256: +7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300. + +This owner record precedes the review evidence. Its scope is independent source +review and local synthetic verification. It does not authorize native backup, +export, restore, credentials or rollout. Final disposition and exact hashes will +be attached after review; existing approval boundaries remain in force. + +## Initial exact review + +Changes required against frozen manifest `7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300`: pre-open schema refusal, optimization-safe admission, actual runtime ConfigMap/PVC identity sealing, and live rollback-count clarification. Review receipt: `docs/evidence/2026-10-11-infd-purpose-release-owner-review/conditional-review.json`. Independent synthetic backup and fake-transport probes are mechanism evidence only; no actual private data or native operation occurred. Intake remains vetted until the refined source receives exact final review. + +## Final owner review + +Absorbed into final technical review `RPF-REVIEW-20261011-INFD-PURPOSE-R1-FINAL`, receipt `docs/evidence/2026-10-11-infd-purpose-release-owner-review/final-review.json`. Technical agreement applies only to refined exact 78-path manifest `b1e3e66bc4023dc80c6ea59564c3557c7653fb3c307f46a049997b76198a9033`. All four initial defects are resolved; original conditional failure/probe evidence remains. Eleven packet methods plus four additional independent methods pass. Owner review is complete; human disposition, actual protected-data drill, rollout and native verification remain gated in INFD-WP-0009-T04. No native action or approval is inferred.