coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ADHOC-2026-11-03-T06: repair the last five drifted tests; suite green.
Some checks failed
CCR intake gate / gate (push) Has been cancelled
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Has been cancelled
Details

Browse source 
factory_audit_delivery re-pins the reviewed manifest after the CUST-WP-0073
metadata-only template fix and accepts only that exact template (data, type
and dataFrom still refused). Flex-auth signer tests assert the reviewed
state of CCR-2026-0050 and its pinned native plan instead of the
pre-review snapshot. Full suite: 1547 passed, 18 skipped, 0 failed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 509845@bnt-lap001
Assistant-Session: ed7a7d95-d8eb-455c-b594-963fb1830f76
This commit is contained in:
codex 2026-11-04 06:26:27 +01:00
parent 3686b55649
commit ea028c1de6
5 changed files with 83 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

9
scripts/factory_audit_delivery.py
View file

@ -20,7 +20,8 @@ from keycape_approval_custody import require_denied, read_optional, role_matches
from state_hub_preflight_lane import ROOT, LaneError, command, bao, data, revoke
CONFIRM='DELIVER CCR-2026-0021 CCR-2026-0022'
MANIFEST_SHA256='bca0f6b318baf6bccebf7faec48dd5a69d686cfc7ba9f4c769c7a60b9dc72cc9'
# Re-pinned 2026-11-04 after reviewing 80e0539 (CUST-WP-0073): metadata-only target templates.
MANIFEST_SHA256='a28aecfeb4afa5821b67bd555b45dfd590d1ecb481e673b6eb005365ca1d0cfe'
def custody_value(lane, raw):
@ -92,7 +93,11 @@ def preflight_projection(kube, objects):
live=data(result)
# Ignore API default fields, but never redirect an existing delivery lane.
require(all(live['spec'].get(k)==v for k,v in obj['spec'].items()),'existing_projection_drift')
require(not live['spec'].get('dataFrom') and not live['spec'].get('target',{}).get('template'),'unexpected_projection_template')
# A target template may only carry the reviewed Secret metadata (CUST-WP-0073);
# anything that could transform or inject data is refused.
template=live['spec'].get('target',{}).get('template')
expected=obj['spec'].get('target',{}).get('template')
require(not live['spec'].get('dataFrom') and (template is None or (set(template)<={'metadata'} and template==expected)),'unexpected_projection_template')
def deliver(kube, lanes, values, receipt, save):