Verify deployed purpose image through independent readonly reconciliation
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
codex
parent
9ec57c0dff
commit
d47cbd05a5
16 changed files with 327 additions and 0 deletions
|
|
@ -0,0 +1,27 @@
|
|||
{
|
||||
"original_manifest_sha256": "d59ef787d0173be52a11a2f8bba85e803475f56f9c51d66a676ffab94fe64389",
|
||||
"kind": "exact-original-source-review-history",
|
||||
"scope": "Historical original4file snapshot only; current owner anchor and finalactualACK/approvedhelper unchanged. Original manifest paths describe historical staging; this map locates durable byte-identical archive copies.",
|
||||
"files": [
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-infd-purpose-actuator-owner-review/prune-primary-source-provenance.json",
|
||||
"archive_path": "docs/evidence/2026-10-11-infd-purpose-actuator-owner-review/initial-d59ef787/owner-snapshot/docs/evidence/2026-10-11-infd-purpose-actuator-owner-review/prune-primary-source-provenance.json",
|
||||
"sha256": "ae641b0251e1fe119a720c4c7efbfbf6999c03660b836103cf4ffb0afe868f72"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-infd-purpose-actuator-owner-review/prune-semantic-probe.py",
|
||||
"archive_path": "docs/evidence/2026-10-11-infd-purpose-actuator-owner-review/initial-d59ef787/owner-snapshot/docs/evidence/2026-10-11-infd-purpose-actuator-owner-review/prune-semantic-probe.py",
|
||||
"sha256": "2aca5d4a3576ab4601098e2346a2141419c48382fdca7e6655f388e8487d45bf"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-infd-purpose-actuator-owner-review/r2-readonly-reconciliation-source-review.json",
|
||||
"archive_path": "docs/evidence/2026-10-11-infd-purpose-actuator-owner-review/initial-d59ef787/owner-snapshot/docs/evidence/2026-10-11-infd-purpose-actuator-owner-review/r2-readonly-reconciliation-source-review.json",
|
||||
"sha256": "5a5423a90152b40f7e905ad60cf24f76dc6777ff70d250dd7600cea419d7c1c1"
|
||||
},
|
||||
{
|
||||
"original_path": "intakes/RPF-IN-0007-infd-purpose-actuator-review.md",
|
||||
"archive_path": "docs/evidence/2026-10-11-infd-purpose-actuator-owner-review/initial-d59ef787/owner-snapshot/intakes/RPF-IN-0007-infd-purpose-actuator-review.md",
|
||||
"sha256": "fd4df8d55a87fbad9bc0f5dd88019608f562968e1f5a90e301453cdc9ef193fc"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
[
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"path": "docs/evidence/2026-10-11-infd-purpose-actuator-owner-review/prune-primary-source-provenance.json",
|
||||
"staged_path": "/tmp/infd-prune-omission-platform-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-purpose-actuator-owner-review/prune-primary-source-provenance.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "ae641b0251e1fe119a720c4c7efbfbf6999c03660b836103cf4ffb0afe868f72"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"path": "docs/evidence/2026-10-11-infd-purpose-actuator-owner-review/prune-semantic-probe.py",
|
||||
"staged_path": "/tmp/infd-prune-omission-platform-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-purpose-actuator-owner-review/prune-semantic-probe.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "2aca5d4a3576ab4601098e2346a2141419c48382fdca7e6655f388e8487d45bf"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"path": "docs/evidence/2026-10-11-infd-purpose-actuator-owner-review/r2-readonly-reconciliation-source-review.json",
|
||||
"staged_path": "/tmp/infd-prune-omission-platform-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-purpose-actuator-owner-review/r2-readonly-reconciliation-source-review.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "5a5423a90152b40f7e905ad60cf24f76dc6777ff70d250dd7600cea419d7c1c1"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"path": "intakes/RPF-IN-0007-infd-purpose-actuator-review.md",
|
||||
"staged_path": "/tmp/infd-prune-omission-platform-review-stage/railiance-platform/intakes/RPF-IN-0007-infd-purpose-actuator-review.md",
|
||||
"original_sha256": "0c415b0c92da948b8a3e097ea46fcdfb5ad3aeea9bfd774eefdb3a68fd6ba36c",
|
||||
"staged_sha256": "fd4df8d55a87fbad9bc0f5dd88019608f562968e1f5a90e301453cdc9ef193fc"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
{
|
||||
"url": "https://raw.githubusercontent.com/argoproj/argo-cd/master/pkg/apis/application/v1alpha1/types.go",
|
||||
"source_sha256": "2228837378905e38c54805c66dd7bbbf96bf8fe2b9aaf1feee6a0fb96e837405",
|
||||
"sync_operation_declaration": "Prune bool `json:\"prune,omitempty\" protobuf:\"bytes,2,opt,name=prune\"`",
|
||||
"installed_version_correspondence": "pending retained metadata; master alone not proof of installed binary"
|
||||
}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
"""Synthetic analysis predicate; never an executor, authority gate or native verifier."""
|
||||
import copy,json
|
||||
RESOURCE={'group':'apps','kind':'Deployment','name':'informed-decision','namespace':'informed-decision'}
|
||||
def consistent(request, status, revision):
|
||||
sync=status.get('operation',{}).get('sync',{})
|
||||
return (request.get('revision')==revision and request.get('prune') is False
|
||||
and request.get('resources')==[RESOURCE] and status.get('phase')=='Succeeded'
|
||||
and sync.get('revision')==revision and sync.get('resources')==[RESOURCE]
|
||||
and sync.get('prune',False) is False)
|
||||
request={'revision':'synthetic-exact-revision','prune':False,'resources':[RESOURCE]};status={'phase':'Succeeded','operation':{'sync':{'revision':request['revision'],'resources':[RESOURCE]}}}
|
||||
assert consistent(request,status,request['revision'])
|
||||
accepted_false=copy.deepcopy(status);accepted_false['operation']['sync']['prune']=False;assert consistent(request,accepted_false,request['revision'])
|
||||
for value in (True,None,0,'false',[]):
|
||||
bad=copy.deepcopy(status);bad['operation']['sync']['prune']=value;assert not consistent(request,bad,request['revision'])
|
||||
for defect in ('revision','resource','namespace','phase','original_request'):
|
||||
bad=copy.deepcopy(status);original=copy.deepcopy(request)
|
||||
if defect=='revision':bad['operation']['sync']['revision']='wrong'
|
||||
elif defect=='resource':bad['operation']['sync']['resources'].append({'kind':'Secret'})
|
||||
elif defect=='namespace':bad['operation']['sync']['resources'][0]['namespace']='wrong'
|
||||
elif defect=='phase':bad['phase']='Running'
|
||||
else:original['prune']=True
|
||||
assert not consistent(original,bad,request['revision'])
|
||||
print(json.dumps({'synthetic_only':True,'native_commands':False,'omitted_false_agrees_with_explicit_false_request':True,'explicit_false_agrees':True,'five_nonfalse_values_refused':True,'five_scope_request_completion_drift_cases_refused':True}))
|
||||
|
|
@ -0,0 +1,41 @@
|
|||
{
|
||||
"review_id": "RPF-REVIEW-20261011-INFD-R2-READONLY-RECONCILIATION",
|
||||
"work_record": "RPF-IN-0007",
|
||||
"role": "railiance-platform technical owner only",
|
||||
"status": "agrees-with-bounded-readonly-independent-reconciliation",
|
||||
"question": "Can independent read-only target evidence verify an approved completed release despite helper verify UNCERTAIN from omitted prune=false serialization?",
|
||||
"judgement": "Yes. Gather only already-approved verification evidence through existing contained owner/read paths. Preserve original approved helper/source and original UNCERTAIN verify journal; do not rerun that phase, modify its flags or treat it as an unchanged scored success. Independent evidence may refine the trial outcome after actual review, with failure retained. No further privilege/effect is requested by this read-only reconciliation.",
|
||||
"source_defect": {
|
||||
"file": "execution/native_program.py",
|
||||
"line": 179,
|
||||
"check": "sync.get(prune) is False",
|
||||
"effect": "Missing serialized false becomes None and refuses even when original explicit prune=false request was correctly applied."
|
||||
},
|
||||
"api_primary_source": {
|
||||
"url": "https://raw.githubusercontent.com/argoproj/argo-cd/master/pkg/apis/application/v1alpha1/types.go",
|
||||
"declaration": "Prune bool `json:\"prune,omitempty\" protobuf:\"bytes,2,opt,name=prune\"`",
|
||||
"installed_version_correspondence": "Current upstream field semantics verified; retained installed-version/API evidence requested from coordinator, not independently read from native estate."
|
||||
},
|
||||
"required_readonly_correlations": [
|
||||
"Recorded approved release request explicitly prune=false and exact source revision/single Deployment namespace; correlate succeeded operation revision/resource/initiator/start/finish with that release, not an arbitrary later status.",
|
||||
"Accept omitted false only as documented serialization coupled to exact original request and succeeded scoped status. Reject present true/null/string/number or changed resource/source/UID.",
|
||||
"Fresh exact Deployment/CM/PVC/pod ownership/configuration and controller observed-generation/Ready/image pins, actual installed module hash/mode/UID, retained schema5/integrity/counts/current DB and bounded health checks.",
|
||||
"Retain installed ten checks as synthetic transport/native_provider=false; actual authenticated native service/provider binding evidence remains independently identified.",
|
||||
"No operation/patch/sync/retry/database restore/cleanup/credential changes. If independent evidence indicates actual target failure or altered effects, stop and use approved recovery or a separately proposed mutation."
|
||||
],
|
||||
"synthetic_analysis": {
|
||||
"omitted_and_explicit_false_with_matching_request_accepted": true,
|
||||
"five_wrong_value_cases_refused": true,
|
||||
"five_request_scope_completion_drift_cases_refused": true,
|
||||
"native_commands": false
|
||||
},
|
||||
"limits": {
|
||||
"reviewer_native_commands": false,
|
||||
"helper_source_or_owner_head_mutation": false,
|
||||
"journal_rewrite_or_same_phase_retry": false,
|
||||
"new_privileged_go": false,
|
||||
"actual_native_target_completion_claimed_here": false,
|
||||
"T04_complete": false,
|
||||
"other_owner_role": false
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
---
|
||||
id: RPF-IN-0007
|
||||
kind: intake
|
||||
type: intake
|
||||
title: "Platform review of INFD protected custody and image release actuator"
|
||||
repo: railiance-platform
|
||||
lane: supervised
|
||||
status: closed
|
||||
owner: railiance-platform
|
||||
requested_by: the-custodian
|
||||
origin: handoff
|
||||
origin_ref: INFD-WP-0009
|
||||
priority: high
|
||||
created: "2026-10-11"
|
||||
updated: "2026-10-11"
|
||||
tags: [security, cross-owner, review]
|
||||
---
|
||||
|
||||
Review exact11-path execution source manifest `653b68c3891c066f40d104bfc67a35da5e436605cd99afd52fbac4b47a9553fe` and bundle `0a79eda40fe0954fd3828bf06fd6ccf149e294ac194bc6fe605e585b878fa8d3`, approval gate, private real-data custody, offline clone isolation, single-writer cutover, uncertain recovery, manual Argo scope and current-database rollback. Record precedes formal technical review. Synthetic verification only; no native backup/export/restore, mutation, credential read or founder approval is authorized.
|
||||
|
||||
## Completed initial source review
|
||||
|
||||
Absorbed into technical review `RPF-REVIEW-20261011-INFD-ACTUATOR-R1-CONDITIONAL`. Changes required: unhealthy-candidate rollback must not depend on candidate readiness/exec; offline restore must repeat integrity/schema/count proof after admin. Deadline/recovery semantics require explicit amended-packet agreement. Initial12tests passed but independent failure probe reproduced zero rollback dispatch for an unready candidate. Native work remains in INFD-WP-0009-T04; no native action/approval occurred. Completed record precedes formal review entry.
|
||||
|
||||
## Final exact helper review
|
||||
|
||||
Final technical agreement `RPF-REVIEW-20261011-INFD-ACTUATOR-R1-FINAL` covers helper manifest `f2fad6c251fbb4420e07c1329802f521b513bbf66e51f64c5d673ef04f16284c`,23paths, execution bundle `27d6d6d3133c963da1dde92d498d636617387c16e850a17c598148abc35c775d`. Sixteen synthetic tests independently pass; additional recovery probes reject wrong operation/source/UID/prune/resource scope and confirm unhealthy-candidate recovery request without Pod/exec. Original conditional evidence remains. Final founder packet must hash-bind this executor/four render inputs and explicitly disclose the all-phase deadline before submission; source agreement is not approval or native custody/provider evidence.
|
||||
|
||||
## Snapshot failure source review work
|
||||
|
||||
Same Platform owner preparation trial, following successful native backup and retained UNCERTAIN drill-copy reported by the coordinator. Completed independent source-mechanism check reproduces WAL0/SHM32768 on a synthetic Store backup after the initial checker. No native database was opened or copied, no retry/cleanup/source HEAD change occurred. The exact recovery-source technical review entry follows this owner work record when maker source is frozen; original failed journal and approval remain evidence, not backfilled success. Fresh exact supervisor disposition on the recovery delta is required before any action.
|
||||
|
||||
## Completed existing-snapshot rescue source review
|
||||
|
||||
Same Platform role final technical agreement `RPF-REVIEW-20261011-INFD-SNAPSHOT-RESCUE-R2` covers exact66-path stage `0867e27a6754dddff3eedbb333ab4ca4faa98ee31d383ebe940b8e054c6cabf7`. Twenty-one executor and five mocked reader tests independently pass; additional ordinary-file/mock and journal crash probes refuse unsafe custody/replay without altering the original. This work note precedes its formal entry. Fresh exact source-version2 founder disposition, newly committed source and authenticated fixed-origin readback are required before any recovery phase. Original COMPLETE backup/UNCERTAIN copy and approval remain historical unchanged; no native recovery, copy or deletion occurred in this review.
|
||||
|
||||
## Independent read-only outcome reconciliation review
|
||||
|
||||
Completed same Platform source judgement after coordinator-reported approved R2 release and original verify UNCERTAIN caused by serialized prune omission. Independent read-only evidence may verify the already-approved target while retaining the original failure/journal unchanged; this does not authorize native mutation or helper retry. Source judgement precedes the formal review entry. Actual collected evidence remains subject to exact owner review and is not claimed complete here.
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
{
|
||||
"namespace": "argocd",
|
||||
"kind": "StatefulSet",
|
||||
"name": "argocd-application-controller",
|
||||
"image": "quay.io/argoproj/argocd:v3.5.3",
|
||||
"native_metadata_observed": true
|
||||
}
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
{
|
||||
"url": "https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.3/pkg/apis/application/v1alpha1/types.go",
|
||||
"source_sha256": "f39d3024cb4bc7e20d0180260a8284422b6a66066870c2a8f368356d8935a3c8",
|
||||
"source_version": "v3.5.3",
|
||||
"prune_bool_omitempty_declarations": [
|
||||
[
|
||||
1421,
|
||||
"Prune bool `json:\"prune,omitempty\" protobuf:\"bytes,2,opt,name=prune\"`"
|
||||
]
|
||||
],
|
||||
"installed_metadata_receipt_sha256": "62b85702ca73d8c349a52be9c8196e2f85c6e9e0aafb07f17a15d5c988fee82b"
|
||||
}
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
{
|
||||
"url": "https://raw.githubusercontent.com/argoproj/argo-cd/master/pkg/apis/application/v1alpha1/types.go",
|
||||
"source_sha256": "2228837378905e38c54805c66dd7bbbf96bf8fe2b9aaf1feee6a0fb96e837405",
|
||||
"sync_operation_declaration": "Prune bool `json:\"prune,omitempty\" protobuf:\"bytes,2,opt,name=prune\"`",
|
||||
"installed_version_correspondence": "pending retained metadata; master alone not proof of installed binary"
|
||||
}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
"""Synthetic analysis predicate; never an executor, authority gate or native verifier."""
|
||||
import copy,json
|
||||
RESOURCE={'group':'apps','kind':'Deployment','name':'informed-decision','namespace':'informed-decision'}
|
||||
def consistent(request, status, revision):
|
||||
sync=status.get('operation',{}).get('sync',{})
|
||||
return (request.get('revision')==revision and request.get('prune') is False
|
||||
and request.get('resources')==[RESOURCE] and status.get('phase')=='Succeeded'
|
||||
and sync.get('revision')==revision and sync.get('resources')==[RESOURCE]
|
||||
and sync.get('prune',False) is False)
|
||||
request={'revision':'synthetic-exact-revision','prune':False,'resources':[RESOURCE]};status={'phase':'Succeeded','operation':{'sync':{'revision':request['revision'],'resources':[RESOURCE]}}}
|
||||
assert consistent(request,status,request['revision'])
|
||||
accepted_false=copy.deepcopy(status);accepted_false['operation']['sync']['prune']=False;assert consistent(request,accepted_false,request['revision'])
|
||||
for value in (True,None,0,'false',[]):
|
||||
bad=copy.deepcopy(status);bad['operation']['sync']['prune']=value;assert not consistent(request,bad,request['revision'])
|
||||
for defect in ('revision','resource','namespace','phase','original_request'):
|
||||
bad=copy.deepcopy(status);original=copy.deepcopy(request)
|
||||
if defect=='revision':bad['operation']['sync']['revision']='wrong'
|
||||
elif defect=='resource':bad['operation']['sync']['resources'].append({'kind':'Secret'})
|
||||
elif defect=='namespace':bad['operation']['sync']['resources'][0]['namespace']='wrong'
|
||||
elif defect=='phase':bad['phase']='Running'
|
||||
else:original['prune']=True
|
||||
assert not consistent(original,bad,request['revision'])
|
||||
print(json.dumps({'synthetic_only':True,'native_commands':False,'omitted_false_agrees_with_explicit_false_request':True,'explicit_false_agrees':True,'five_nonfalse_values_refused':True,'five_scope_request_completion_drift_cases_refused':True}))
|
||||
|
|
@ -0,0 +1,44 @@
|
|||
{
|
||||
"review_id": "RPF-REVIEW-20261011-INFD-R2-ACTUAL-TARGET-ACK",
|
||||
"work_record": "RPF-IN-0007",
|
||||
"role": "railiance-platform technical owner only",
|
||||
"status": "approved-target-verified-by-independent-readonly-evidence",
|
||||
"approved_source_revision": "c96b0c6d881e855d1d158003c6de90ef390262e2",
|
||||
"candidate_image": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"original_verify_state": "UNCERTAIN_preserved",
|
||||
"initial_source_judgement_manifest_sha256": "d59ef787d0173be52a11a2f8bba85e803475f56f9c51d66a676ffab94fe64389",
|
||||
"evidence_sha256": {
|
||||
"independent_target": "c3fc07400204a4821e65aebcbfd228ce571f2b0402a52e0719d29d3704ec0a60",
|
||||
"post_rollout_native_allow_path": "c534f5fa96d4d3e66b1a8f72cae9be15c62c4d0dd0b35fbefdfe13e3f51e89b7",
|
||||
"additional_pod_custody": "078fff224931bc3ddaa916b5179511b5dbe1d856e4073ce8176bdcfb23769ae5",
|
||||
"installed_argocd_version": "62b85702ca73d8c349a52be9c8196e2f85c6e9e0aafb07f17a15d5c988fee82b",
|
||||
"independent_readonly_command": "5483bcd84f6658960e2339b6c3f29ad75027748af993fa46cd527e12ff912ff8",
|
||||
"additional_pod_readonly_command": "77962916a5f4cb4d3b110a30b13cba961dd87bbc476261c0c9f5aa29f096e6a6"
|
||||
},
|
||||
"verified_target": [
|
||||
"Exact immutable image and imageID763c, existing DeploymentUID a588/currentgeneration25 Ready1/observed generation; exact CMUID90113 and PVCUIDd80b/full custody seals retained.",
|
||||
"PodUIDc4cb1550-feda-4097-9de4-d891a657b662 Running/exactsinglecontainer Ready, owner chain intact; all sealed template and forbidden optional controls match approved image-only target, canonical controlled digestbb6e6ef2809d15ef27db05fa75cabd40fc4e4bfe43e1f7a3ac750ed69380adaa; actual UID/GID10001.",
|
||||
"Actual installed policy module9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62/rootowned0644; healthz/readyz200.",
|
||||
"Read-only WAL-aware schema5/integrityok current database; counts16records56events0pending,336delivered outbox43confirmed submissions. No old snapshot restoration or forced equality with earlier live counts.",
|
||||
"ActualArgo Succeeded at07:00:30 exactc96 source/single Synced Deployment namespace and custodian-codex initiator/startafterrecordedrelease07:00:23; original request explicitprunefalse, actual false omitted.",
|
||||
"Installed controller v3.5.3 matches independently fetched primary types.go SHA f39d3024cb4bc7e20d0180260a8284422b6a66066870c2a8f368356d8935a3c8 Prune bool jsonomitempty; omission adjudication confined to recorded exact false request/succeeded scoped operation."
|
||||
],
|
||||
"provider_evidence": "Fresh authenticated canonical lifecycle.outcomes sourceversion2 HTTP success07:01:37 after new-image rollout, together with installed source/configuration seals and LifecycleService.outcomes->_authorize->PolicyClient.check fresh POST/current binding/lifetime checks, supports actual canonical native allow-path preservation. It does not claim provider emitted advisory responses or native denial variants.",
|
||||
"synthetic_evidence": "Installed10 variants2bindingallows8advisory/malformedrefusals remain synthetic transport/native_providerfalse. No extra provider denial probe claimed.",
|
||||
"outcome_recording": "Same supervised trial refined by independent actual evidence; original verifier failure/UNCERTAIN and immutable approved helper/source remain retained. No same-phase rerun or journaldone rewrite. Any scoring must preserve both failed verifier and independently verified target outcome.",
|
||||
"owner_followthrough": [
|
||||
"Product owner determines T04 closure using all original/rescue/drill/cleanup/cutover/release receipts plus these actual target/provider proofs.",
|
||||
"Record prune serialization helper correction as live unpromoted residual before future executor reuse; do not mutate approvedR2helper retrospectively.",
|
||||
"Known inherited fixable MEDIUM zlib/T05dueOct18 remains a separate live owner risk/remediation gate; no zero-CVE/estate grade inference."
|
||||
],
|
||||
"limits": {
|
||||
"reviewer_native_commands": false,
|
||||
"new_privileged_approval": false,
|
||||
"helper_or_owner_head_mutation": false,
|
||||
"journal_rewrite_or_phase_replay": false,
|
||||
"extra_mutation": false,
|
||||
"native_provider_denial_variants_claimed": false,
|
||||
"other_owner_role": false,
|
||||
"blanket_workplan_completion": false
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,41 @@
|
|||
{
|
||||
"review_id": "RPF-REVIEW-20261011-INFD-R2-READONLY-RECONCILIATION",
|
||||
"work_record": "RPF-IN-0007",
|
||||
"role": "railiance-platform technical owner only",
|
||||
"status": "agrees-with-bounded-readonly-independent-reconciliation",
|
||||
"question": "Can independent read-only target evidence verify an approved completed release despite helper verify UNCERTAIN from omitted prune=false serialization?",
|
||||
"judgement": "Yes. Gather only already-approved verification evidence through existing contained owner/read paths. Preserve original approved helper/source and original UNCERTAIN verify journal; do not rerun that phase, modify its flags or treat it as an unchanged scored success. Independent evidence may refine the trial outcome after actual review, with failure retained. No further privilege/effect is requested by this read-only reconciliation.",
|
||||
"source_defect": {
|
||||
"file": "execution/native_program.py",
|
||||
"line": 179,
|
||||
"check": "sync.get(prune) is False",
|
||||
"effect": "Missing serialized false becomes None and refuses even when original explicit prune=false request was correctly applied."
|
||||
},
|
||||
"api_primary_source": {
|
||||
"url": "https://raw.githubusercontent.com/argoproj/argo-cd/master/pkg/apis/application/v1alpha1/types.go",
|
||||
"declaration": "Prune bool `json:\"prune,omitempty\" protobuf:\"bytes,2,opt,name=prune\"`",
|
||||
"installed_version_correspondence": "Current upstream field semantics verified; retained installed-version/API evidence requested from coordinator, not independently read from native estate."
|
||||
},
|
||||
"required_readonly_correlations": [
|
||||
"Recorded approved release request explicitly prune=false and exact source revision/single Deployment namespace; correlate succeeded operation revision/resource/initiator/start/finish with that release, not an arbitrary later status.",
|
||||
"Accept omitted false only as documented serialization coupled to exact original request and succeeded scoped status. Reject present true/null/string/number or changed resource/source/UID.",
|
||||
"Fresh exact Deployment/CM/PVC/pod ownership/configuration and controller observed-generation/Ready/image pins, actual installed module hash/mode/UID, retained schema5/integrity/counts/current DB and bounded health checks.",
|
||||
"Retain installed ten checks as synthetic transport/native_provider=false; actual authenticated native service/provider binding evidence remains independently identified.",
|
||||
"No operation/patch/sync/retry/database restore/cleanup/credential changes. If independent evidence indicates actual target failure or altered effects, stop and use approved recovery or a separately proposed mutation."
|
||||
],
|
||||
"synthetic_analysis": {
|
||||
"omitted_and_explicit_false_with_matching_request_accepted": true,
|
||||
"five_wrong_value_cases_refused": true,
|
||||
"five_request_scope_completion_drift_cases_refused": true,
|
||||
"native_commands": false
|
||||
},
|
||||
"limits": {
|
||||
"reviewer_native_commands": false,
|
||||
"helper_source_or_owner_head_mutation": false,
|
||||
"journal_rewrite_or_same_phase_retry": false,
|
||||
"new_privileged_go": false,
|
||||
"actual_native_target_completion_claimed_here": false,
|
||||
"T04_complete": false,
|
||||
"other_owner_role": false
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"all_checks_pass": true, "additional_readonly_metadata_proof": true, "pod_uid": "c4cb1550-feda-4097-9de4-d891a657b662", "exact_one_container": true, "controlled_pod_fields_match_sealed_candidate": true, "controlled_field_names": ["automountServiceAccountToken", "containers", "dnsPolicy", "hostIPC", "hostNetwork", "hostPID", "initContainers", "restartPolicy", "runtimeClassName", "schedulerName", "securityContext", "serviceAccount", "serviceAccountName", "shareProcessNamespace", "terminationGracePeriodSeconds", "volumes"], "canonical_controlled_values_sha256": "bb6e6ef2809d15ef27db05fa75cabd40fc4e4bfe43e1f7a3ac750ed69380adaa", "native_uid": 10001, "native_gid": 10001, "database_opened": false, "original_phase_replayed": false, "mutation_executed": false}
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"independent_readonly_reconciliation": true, "all_checks_pass": true, "original_verify_journal_state": "UNCERTAIN_preserved", "original_phase_replayed": false, "helper_source_amended": false, "mutation_executed": false, "deployment_uid": "a588e10a-90d2-4883-975e-6dd8b8feca92", "generation": 25, "ready_replicas": 1, "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", "pod_name": "informed-decision-5557446c88-lvm88", "pod_uid": "c4cb1550-feda-4097-9de4-d891a657b662", "pod_image_id": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", "configmap_uid": "90113d2d-54d9-4e82-b1d3-90b49ebed2b5", "pvc_uid": "d80b25b1-141a-441b-b205-98fa2fd98b7c", "dependency_seals_match": true, "application_uid": "499868f2-eabc-4df4-ae31-b89ce58d750d", "source_revision": "c96b0c6d881e855d1d158003c6de90ef390262e2", "operation": {"phase": "Succeeded", "started_at": "2026-10-11T07:00:30Z", "finished_at": "2026-10-11T07:00:30Z", "initiated_by": {"username": "custodian-codex"}, "exact_resources": [{"group": "apps", "kind": "Deployment", "name": "informed-decision", "namespace": "informed-decision"}], "prune_field_present": false, "prune_effective": false, "original_release_request_explicit_prune_false": true, "sync_result_resources": [{"group": "apps", "kind": "Deployment", "name": "informed-decision", "namespace": "informed-decision", "status": "Synced", "syncPhase": "Sync"}]}, "native_provider_allow_path_proof": "Separate root-authenticated outcomes readback after new Ready image; installed refusal checks below are synthetic", "live_readonly_schema_integrity_counts": {"schema_version": 5, "lifecycle": {"records": 16, "events": 56, "pending": 0}, "outbox": {"delivered": 336}, "submissions": {"confirmed": 43}, "integrity": "ok", "read_only_pre_open": true, "store_constructed": false}, "module_sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62", "module_mode": "0644", "module_uid": 0, "native_uid": 10001, "installed_purpose_checks": {"installed_image_purpose_variants": 10, "binding_forms_allowed": 2, "advisory_or_malformed_refused": 8, "synthetic_only": true, "native_provider": false}, "health_statuses": {"/healthz": 200, "/readyz": 200}, "database_opened_readonly": true, "store_or_admin_constructed": false}
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
{
|
||||
"verification_kind": "post-rollout canonical provider-backed outcomes operation",
|
||||
"source_memo_id": "infd-20261011-purpose-overlay-r1",
|
||||
"source_memo_version": 2,
|
||||
"new_image": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"pod_uid": "c4cb1550-feda-4097-9de4-d891a657b662",
|
||||
"verified_at": "2026-10-11T07:01:37.243411+00:00",
|
||||
"operation": "lifecycle.outcomes",
|
||||
"service": "State Hub admitted memo dispatcher using internal mounted credential",
|
||||
"transport": "fixed internal ORIGIN, no redirects, GET /v1/decisions/infd-20261011-purpose-overlay-r1/outcomes?version=2",
|
||||
"actual_native_provider_operation": true,
|
||||
"evidence_basis": "Authenticated native HTTP success after image rollout; installed LifecycleService.outcomes invokes _authorize/PolicyClient.check and current() before returning. Actual installed module hash and configuration seals independently verified.",
|
||||
"installed_module_sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62",
|
||||
"synthetic_installed_refusal_variants": 8,
|
||||
"synthetic_variant_check_is_native_provider_response": false,
|
||||
"extra_provider_denial_probe_executed": false,
|
||||
"limitation": "Proves actual canonical allow-path preservation; does not claim provider emitted advisory responses or all refusal variants came from native provider."
|
||||
}
|
||||
|
|
@ -33,3 +33,11 @@ Same Platform owner preparation trial, following successful native backup and re
|
|||
## Completed existing-snapshot rescue source review
|
||||
|
||||
Same Platform role final technical agreement `RPF-REVIEW-20261011-INFD-SNAPSHOT-RESCUE-R2` covers exact66-path stage `0867e27a6754dddff3eedbb333ab4ca4faa98ee31d383ebe940b8e054c6cabf7`. Twenty-one executor and five mocked reader tests independently pass; additional ordinary-file/mock and journal crash probes refuse unsafe custody/replay without altering the original. This work note precedes its formal entry. Fresh exact source-version2 founder disposition, newly committed source and authenticated fixed-origin readback are required before any recovery phase. Original COMPLETE backup/UNCERTAIN copy and approval remain historical unchanged; no native recovery, copy or deletion occurred in this review.
|
||||
|
||||
## Independent read-only outcome reconciliation review
|
||||
|
||||
Completed same Platform source judgement after coordinator-reported approved R2 release and original verify UNCERTAIN caused by serialized prune omission. Independent read-only evidence may verify the already-approved target while retaining the original failure/journal unchanged; this does not authorize native mutation or helper retry. Source judgement precedes the formal review entry. Actual collected evidence remains subject to exact owner review and is not claimed complete here.
|
||||
|
||||
## Final actual target outcome assessment
|
||||
|
||||
Same Platform owner ACK `RPF-REVIEW-20261011-INFD-R2-ACTUAL-TARGET-ACK` verifies coordinator-collected read-only target receipt c3fc0740, additional exact Pod/UID/GID receipt078fff22 and separate post-rollout native provider allow-path c534f5fa. Matching installed Argo v3.5.3 primary source substantiates false omission; original explicit prune=false and exact succeeded scoped operation correlate to the release. Original verify remains UNCERTAIN; independent evidence refines the same trial outcome without helper/source/journal replay or backfilled success. Product closure and live unpromoted future-helper residual remain owner follow-through, with inherited MEDIUM/T05 retained. Completed cumulative owner record precedes final ACK.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue