5b9c8262be
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
47 lines
3.6 KiB
JSON
47 lines
3.6 KiB
JSON
{
|
|
"review_id": "RPF-REVIEW-20261011-FORGEJO-ESO-R1",
|
|
"work_record": "RPF-IN-0006",
|
|
"reviewer_role": "railiance-platform technical owner only",
|
|
"status": "changes-required",
|
|
"exact_manifest_sha256": "271afd04512b3dac642b3385013cac03d28afde22ff97bcca8d0e262ab3d9279",
|
|
"reviewed_paths": 17,
|
|
"all_source_hashes_match": true,
|
|
"primary_eso_source_sha256": "e53f43c0748e43f408b5a7c5323c12c0fb5fb4299a33718181f6d70945112071",
|
|
"primary_eso_source_url": "https://raw.githubusercontent.com/external-secrets/external-secrets/v0.16.1/pkg/provider/vault/auth_kubernetes.go",
|
|
"platform_ccr_validation": "passes with expected unconfirmed-bound-claim apply-block warning",
|
|
"sound_preparation": [
|
|
"Dedicated forgejo namespace reader SA and audience openbao, exact role and one data path plus existing token self lifecycle; no default policy or parent/sibling/list permission.",
|
|
"Installed CRD supports referenced SA/audiences; retained native RBAC confirms common controller TokenRequest/Secret authority. Independently fetched installed-version provider source confirms600second TokenRequest, namespace-local SA and legacy-token fallback.",
|
|
"Proposal explicitly discloses common-controller trust, HTTP custody and no cryptographic isolation; new SA legacy token refs must be absent, with no static fallback or manual secret seeding.",
|
|
"Original acknowledged1.1/acceptedcase/history unchanged; proposed1.2 adds sixth object and requires new exact acknowledgment and native provenance before structural/materialized claims.",
|
|
"Manual proposed CCR42 and owner design correctly require created-only rollback, consumer reference reversal, issued-reader-token revocation or independently verified expiry before declaring deactivation."
|
|
],
|
|
"required_changes": [
|
|
{
|
|
"id": "RPF-FORGEJO-ESO-01",
|
|
"source": "ops-mason/src/ops_mason/case_build.py::_ccr",
|
|
"finding": "Generated consumer CCR target.workload is keycape, while dedicated consumer role is Forgejo and proposed CCR42 target.workload is forgejo.",
|
|
"required": "Derive consumer workload from consuming_service for consumer-reader-policy, preserving KeyCape ESO reader target; regression must distinguish both generated CCR targets."
|
|
},
|
|
{
|
|
"id": "RPF-FORGEJO-ESO-02",
|
|
"source": "ops-mason/src/ops_mason/case_build.py::_ccr",
|
|
"finding": "Generated lifecycle.deactivate only says delete role then policy; deletion does not revoke issued OpenBao tokens and omits created/preexisting distinction.",
|
|
"required": "Generated successor consumer CCR must retain owner-native created-only/custody rollback and revoke issued reader tokens or verify expiry before deactivation; no new login or remint allowed during recovery. Preserve existing historical source and add meaningful output regression."
|
|
}
|
|
],
|
|
"native_preconditions": [
|
|
"Fresh exact ESO runtime identity/CRD/RBAC and dedicated SA absence of legacy token refs. Tag observation is compatibility preparation, not cryptographic image identity proof.",
|
|
"Exact founder/type/case1.2 acknowledgment plus platform CCR approval/bound claims confirmed and authenticated per-owner structural/custody receipts before native apply or credential mint.",
|
|
"Future consumer Helm secret consumption/group enforcement/break-glass/browser/MFA handover remains separately incomplete.",
|
|
"Ready status/metadata never substitute for native authorization, issued-token revocation, key rotation or cross-owner completion."
|
|
],
|
|
"limits": {
|
|
"native_changes": false,
|
|
"credential_mint": false,
|
|
"secret_read": false,
|
|
"founder_acknowledgment": false,
|
|
"other_owner_role_review": false,
|
|
"first_case_completion": false
|
|
}
|
|
}
|