diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 2952e5b..b97ec58 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -11,7 +11,7 @@ | workplan | RPF-WP-ADHOC-2026-10-10 | finished | — | workplans/ADHOC-2026-10-10.md | | workplan | RPF-WP-ADHOC-2026-10-11 | finished | — | workplans/ADHOC-2026-10-11.md | | workplan | RPF-WP-ADHOC-2026-10-19 | finished | — | workplans/ADHOC-2026-10-19.md | -| workplan | RPF-WP-ADHOC-2026-11-03 | active | — | workplans/ADHOC-2026-11-03.md | +| workplan | RPF-WP-ADHOC-2026-11-03 | finished | — | workplans/ADHOC-2026-11-03.md | | workplan | RPF-WP-0015 | finished | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md | | workplan | RPF-WP-0025 | finished | — | workplans/RPF-WP-0025-openbao-operator-only-access.md | | workplan | RPF-WP-0027 | blocked | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md | @@ -65,6 +65,7 @@ | task | RPF-WP-ADHOC-2026-11-03-T03 | done | — | workplans/ADHOC-2026-11-03.md | | task | RPF-WP-ADHOC-2026-11-03-T04 | done | — | workplans/ADHOC-2026-11-03.md | | task | RPF-WP-ADHOC-2026-11-03-T05 | done | — | workplans/ADHOC-2026-11-03.md | +| task | RPF-WP-ADHOC-2026-11-03-T06 | done | — | workplans/ADHOC-2026-11-03.md | | task | RPF-WP-0015-T01 | done | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md | | task | RPF-WP-0015-T02 | done | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md | | task | RPF-WP-0015-T03 | done | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md | diff --git a/scripts/factory_audit_delivery.py b/scripts/factory_audit_delivery.py index 91274e3..8d38e60 100644 --- a/scripts/factory_audit_delivery.py +++ b/scripts/factory_audit_delivery.py @@ -20,7 +20,8 @@ from keycape_approval_custody import require_denied, read_optional, role_matches from state_hub_preflight_lane import ROOT, LaneError, command, bao, data, revoke CONFIRM='DELIVER CCR-2026-0021 CCR-2026-0022' -MANIFEST_SHA256='bca0f6b318baf6bccebf7faec48dd5a69d686cfc7ba9f4c769c7a60b9dc72cc9' +# Re-pinned 2026-11-04 after reviewing 80e0539 (CUST-WP-0073): metadata-only target templates. +MANIFEST_SHA256='a28aecfeb4afa5821b67bd555b45dfd590d1ecb481e673b6eb005365ca1d0cfe' def custody_value(lane, raw): @@ -92,7 +93,11 @@ def preflight_projection(kube, objects): live=data(result) # Ignore API default fields, but never redirect an existing delivery lane. require(all(live['spec'].get(k)==v for k,v in obj['spec'].items()),'existing_projection_drift') - require(not live['spec'].get('dataFrom') and not live['spec'].get('target',{}).get('template'),'unexpected_projection_template') + # A target template may only carry the reviewed Secret metadata (CUST-WP-0073); + # anything that could transform or inject data is refused. + template=live['spec'].get('target',{}).get('template') + expected=obj['spec'].get('target',{}).get('template') + require(not live['spec'].get('dataFrom') and (template is None or (set(template)<={'metadata'} and template==expected)),'unexpected_projection_template') def deliver(kube, lanes, values, receipt, save): diff --git a/tests/test_factory_audit_delivery.py b/tests/test_factory_audit_delivery.py index d3a2eca..ff38ad5 100644 --- a/tests/test_factory_audit_delivery.py +++ b/tests/test_factory_audit_delivery.py @@ -50,6 +50,19 @@ class DeliveryContracts(unittest.TestCase): with self.assertRaisesRegex(delivery.LaneError,'existing_projection_drift'):delivery.preflight_projection(['kubectl'],[expected]) self.assertTrue(all('apply' not in call.args[0] for call in command.call_args_list)) + def test_only_the_reviewed_metadata_template_is_accepted(self): + _,objects=delivery.guarded_manifest();expected=objects[1] + self.assertEqual(set(expected['spec']['target']['template']),{'metadata'}) + def preflight(live,obj): + def result(argv, **kwargs):return subprocess.CompletedProcess(argv,0,json.dumps(live).encode(),b'') + with patch.object(delivery,'command',side_effect=result):delivery.preflight_projection(['kubectl'],[obj]) + preflight(copy.deepcopy(expected),expected) + for change in ({'data':{'x':'{{ .AUDIT_TOKEN }}'}},{'type':'Opaque'}): + obj=copy.deepcopy(expected);obj['spec']['target']['template'].update(change) + with self.assertRaisesRegex(delivery.LaneError,'unexpected_projection_template'):preflight(copy.deepcopy(obj),obj) + live=copy.deepcopy(expected);live['spec']['dataFrom']=[{'extract':{'key':'x'}}] + with self.assertRaisesRegex(delivery.LaneError,'unexpected_projection_template'):preflight(live,expected) + def test_presence_errors_are_not_treated_as_absence(self): _,objects=delivery.guarded_manifest() with patch.object(delivery,'command',return_value=subprocess.CompletedProcess([],1,b'',b'Forbidden')): diff --git a/tests/test_flex_auth_signer_native_preparation.py b/tests/test_flex_auth_signer_native_preparation.py index bd1b357..6c9bc5b 100644 --- a/tests/test_flex_auth_signer_native_preparation.py +++ b/tests/test_flex_auth_signer_native_preparation.py @@ -1,3 +1,4 @@ +import hashlib """Real CCR schema/applier contract, no credentials or backend invocation.""" from copy import deepcopy import importlib.util @@ -18,7 +19,13 @@ def test_real_schema_and_apply_refusal(): assert len(blockers)==2 assert any('status, got proposed' in x for x in blockers) assert any('confirmed OpenBao auth binding' in x for x in blockers) - assert ccr['review']['comments']==[] and ccr['access_frontdoor']['resolvable'] is False + assert ccr['access_frontdoor']['resolvable'] is False + # 2026-10-21: scoped owner reviews are recorded (RPF-WP-0035-T14), but the founder and + # cluster-runtime-storage-owner have not approved, so the CCR stays proposed. + approvers=set(ccr['review']['required_approvers']) + for comment in ccr['review']['comments']: + role=comment['reviewer'].split(' (')[0] + assert role in approvers and role not in {'founder','cluster-runtime-storage-owner'} # Pure synthetic candidate only: ensure admitted-pattern scope has no latent # schema/applier role/field failures once the real owners eventually approve. admitted=deepcopy(ccr);admitted['status']='approved';admitted['openbao']['auth']['bound_claims_confirmed']=True @@ -43,7 +50,14 @@ def test_native_scope_separates_read_grant_and_unadmitted_execution(): assert plan['authority_granted'] is False and plan['status']=='prepared-unapproved' assert plan['bootstrap']['expected_version']==0 assert all(x['disposition'].startswith('pending ') for x in plan['reviews_required']) - assert 'implementation/independent tests still required' in plan['protected_adapter']['state'] + # The plan is the exact artifact the owners reviewed (native plan sha256 in CCR-2026-0050). + assert hashlib.sha256((ROOT/'docs/credential-lane-designs/flex-auth-envelope-signing-native-plan.json').read_bytes()).hexdigest().startswith('22306d50e082fc35') + state=plan['protected_adapter']['state'] + assert 'implemented and tested' in state and 'not a native execution approval' in state + assert 'remain mandatory' in state and 'dev-process gate remains preserved' in state assert plan['receipts']['maximum_bytes']==65536 assert all('platform/' in x['path'] for x in plan['bootstrap']['allowed_native_methods']) - assert 'zero flex-auth PVCs' in plan['requested_scope']['new_resources'] + # 84c529f: Platform creates no storage; the outbox PVC is Access's separate proposal and + # its provisioning stays with cluster-runtime-storage review. + resources=plan['requested_scope']['new_resources'] + assert 'Platform creates no storage resources' in resources and 'remain open' in resources diff --git a/workplans/ADHOC-2026-11-03.md b/workplans/ADHOC-2026-11-03.md index f852f77..2cee342 100644 --- a/workplans/ADHOC-2026-11-03.md +++ b/workplans/ADHOC-2026-11-03.md @@ -4,7 +4,7 @@ type: workplan title: "Ad hoc tasks 2026-11-03: MAS backup alerting, test-suite, admission-check and credential-test repair" domain: financials repo: railiance-platform -status: active +status: finished flavor: implementation owner: claude-code topic_slug: coulomb-social @@ -131,6 +131,7 @@ were all equal. Only three rapp-postgres source digests had drifted from the id: RPF-WP-ADHOC-2026-11-03-T04 status: done priority: medium +state_hub_task_id: "aabbe169-82bf-55e7-a172-d12870b1c5e8" ``` Three of the T02 drift failures were in `tests/test_credential_change.py`. For @@ -170,6 +171,7 @@ was on the T02 list and fails the same way without this change. id: RPF-WP-ADHOC-2026-11-03-T05 status: done priority: medium +state_hub_task_id: "c584e656-5aa1-5fe0-a3e7-f18bc6cfc01a" ``` `test_eso_auth_recovery` expected exactly three paths in each recovery lane's @@ -189,3 +191,44 @@ The policy comment still says "CCR-2026-0046 proposed" and was deliberately left alone. `repair_eso_kubernetes_auth.py` requires the live policy to equal this file byte for byte (`policy_drift`), so editing the comment would make the next attended recovery refuse. + +## Repair the last five drifted tests + +```task +id: RPF-WP-ADHOC-2026-11-03-T06 +status: done +priority: medium +``` + +These are the last five of the nine T02 drift failures. In each case the +source was right, and two were more than test drift. + +- **`test_factory_audit_delivery` (3).** The attended delivery tool itself + was stale, not just the tests. `80e0539` (CUST-WP-0073, a security fix) + added a metadata-only `target.template` to `manifests/factory-audit-senders.yaml`. + `scripts/factory_audit_delivery.py` still pinned the old manifest digest + and refused any template, so it would have refused a re-delivery. I + reviewed the diff: it adds only Secret annotations. The manifest is + re-pinned to `a28aecfe…0cfe`. The template rule is narrowed rather than + dropped: `dataFrom` is still refused, and a template may only contain + `metadata`, exactly as the reviewed manifest declares. A new test proves + that data, type and `dataFrom` changes are still refused. +- **`test_flex_auth_signer_native_preparation` (2).** These tests froze the + 2026-10-16 "prepared" state. Since then CCR-2026-0050 has recorded scoped + owner reviews (RPF-WP-0035-T14). The founder and + cluster-runtime-storage-owner have not approved, so the CCR stays + `proposed`. The native plan's adapter state and storage scope changed in + reviewed commits (`a3e8eb6`, `84c529f`). The tests now check: + - that no founder or storage-owner approval is recorded; + - that the plan bytes still equal the reviewed digest `22306d50…`; + - the invariants that still hold: no native execution approval, mandatory + gates remain, and Platform creates no storage. + The plan still lists every review as "pending". I left that alone, + because the plan is a pinned, reviewed artifact. + +Result 2026-11-04: the full suite runs green, with 1547 passed, 18 skipped +and 0 failed in 17m35s. + +T04 and T05 were registered by reopening this plan briefly; C-11 does not +create tasks in a finished workplan. RPF-WP-0064-T05's 422 needed an +`intervention_note`, because `needs_human` requires one.