coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-platform/docs/proposals/2026-10-15-reuse-private-reader/bootstrap-contract.json
codex a570bc2f5b Prepare restricted seven-source reuse reader and bounded recovery 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
2026-10-15 01:25:46 +02:00

211 lines
12 KiB
JSON
Raw Blame History

{
"id": "CCR-2026-0046-BOOTSTRAP-R2",
"revision": 2,
"sources": [
{
"repo": "rapp-openbao",
"capability_ids": [
"capability.railiance.openbao-package"
],
"consented_commit": "35672be138036c8433a5ac5de91e068c03c2b124",
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/indexes/capabilities.yaml?ref=35672be138036c8433a5ac5de91e068c03c2b124",
"index_sha256": "044efa3d02b90e1872f2516c581159d388a8080a689f76fcd78bb4d048d6ee64",
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
},
{
"repo": "rapp-policy-nexus",
"capability_ids": [
"capability.railiance.policy-publication-package"
],
"consented_commit": "088b78ac03b0cebeec34a69aae3569eb7ec2f9c3",
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/indexes/capabilities.yaml?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3",
"index_sha256": "e68bdedf61eee9ca2026f46a2434ce384c26234616e74f7a5d08a06c75b3bb00",
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
},
{
"repo": "rapp-postgres",
"capability_ids": [
"capability.railiance.postgres-isolation-recovery"
],
"consented_commit": "a9f569c96d74aa384ac8d3ac4aa960e4061550b5",
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/indexes/capabilities.yaml?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5",
"index_sha256": "d939333eed9d85172e006f526c445fbe2602a721d53f7c0d14bc68286ae08776",
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
},
{
"repo": "rapp-sbom-nexus",
"capability_ids": [
"capability.railiance.sbom-runtime-package"
],
"consented_commit": "adbedd349e8df97be43a1f57db7095af45ff29d1",
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/indexes/capabilities.yaml?ref=adbedd349e8df97be43a1f57db7095af45ff29d1",
"index_sha256": "d2ee0f193d2198bf8f16ce64c90ae7664e59a2bc307ad711426af3fd47deb057",
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
},
{
"repo": "rapp-telemetry",
"capability_ids": [
"capability.railiance.telemetry-package"
],
"consented_commit": "f158307e24b86bab88a1af4830ff6b4f85afdeb5",
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/indexes/capabilities.yaml?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5",
"index_sha256": "ee8801f143ed5cf064205710a61c2bb24efc6ea8585d5786d6b679426ec4c1d4",
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
},
{
"repo": "rapp-tenant-engine",
"capability_ids": [
"capability.railiance.tenant-engine-package"
],
"consented_commit": "9bdc86572728783a5ed94266f04f7b12d414c557",
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/indexes/capabilities.yaml?ref=9bdc86572728783a5ed94266f04f7b12d414c557",
"index_sha256": "d8e9c1282350b5d2fd4f4d69712aa7a5fbcd2367bb1a7fad1b6eb16a97e5d732",
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
},
{
"repo": "rapp-user-engine",
"capability_ids": [
"capability.railiance.user-engine-package"
],
"consented_commit": "f35108f9e1b8702fb6c526fe42b2fec5ca032738",
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/indexes/capabilities.yaml?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738",
"index_sha256": "95b4ed2d0b189f6847b1c0899f740d1da46933a8f40491e1a02f2d4e57c819fc",
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
}
],
"negative_private_probe": "rapp-core-hub",
"identity": {
"forgejo_user": "reuse-surface-source",
"forgejo_org": "coulomb",
"forgejo_team": "reuse-surface-source-readers",
"restricted": true,
"is_admin": false,
"visibility": "private",
"password": "random value retained only in attended process memory; never stored in evidence",
"team_permission": "read",
"includes_all_repositories": false,
"can_create_org_repo": false,
"units_map": {
"repo.code": "read",
"repo.actions": "none",
"repo.packages": "none",
"repo.issues": "none",
"repo.ext_issues": "none",
"repo.wiki": "none",
"repo.pulls": "none",
"repo.releases": "none",
"repo.projects": "none",
"repo.ext_wiki": "none"
},
"team_repositories": [
"coulomb/rapp-openbao",
"coulomb/rapp-policy-nexus",
"coulomb/rapp-postgres",
"coulomb/rapp-sbom-nexus",
"coulomb/rapp-telemetry",
"coulomb/rapp-tenant-engine",
"coulomb/rapp-user-engine"
],
"token_scopes": [
"read:repository"
],
"token_name_prefix": "reuse-surface-source-read-",
"reuse_other_workload_token": false,
"fail_on_differing_existing_identity_or_team": true,
"enforcement": "Verify complete team membership and all effective user repository grants; no other team, collaborator or organisation grants may provide extra private read access."
},
"delivery": {
"kv_mount": "platform",
"kv_path": "platform/workloads/reuse/reuse-surface/forgejo-source-read",
"field": "FORGEJO_SOURCE_TOKEN",
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN",
"eso_role": "reuse-surface-runtime-eso",
"eso_identity": "reuse/reuse-surface-eso",
"audience": "openbao",
"ttl": "15m",
"cluster_secret_store": "openbao-reuse",
"store_namespace_condition": [
"reuse"
],
"external_secret": "reuse/reuse-surface-runtime",
"target_secret": "reuse/reuse-surface-env",
"existing_consumption": "Deployment reuse/reuse-surface envFrom secretRef reuse-surface-env; environment variable available only after controlled rollout. Existing image and resource requests retained.",
"policy_delta": {
"file": "railiance-platform/openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl",
"add_exact_stanza": "path \"platform/data/workloads/reuse/reuse-surface/forgejo-source-read\" { capabilities = [\"read\"] }",
"retain_existing_paths": true,
"do_not_change": "Caller-facing workload-kv-read-reuse-surface-runtime policy or writer OIDC role; those remain unable to read this new path."
},
"external_secret_data_delta": {
"secretKey": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN",
"remoteRef": {
"key": "workloads/reuse/reuse-surface/forgejo-source-read",
"property": "FORGEJO_SOURCE_TOKEN"
}
},
"delivery_design_reason": "Uses the existing namespace-limited ESO store and identity plus the existing envFrom interface. Separate new KV path keeps scoped writer callers from also acquiring private-source access. No new static ESO token or new store is needed.",
"native_source_auth": {
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN",
"auth_header": "Authorization",
"header_behavior": "Native federation _auth_headers prefixes a bare token with Bearer; owner must verify accepted Forgejo raw API route with this actual native implementation."
},
"rollout_image": "Pending full consumer fix reviewed image digest; same-image rollout of current consumer is prohibited."
},
"consumer_gate": "Reader must not be delivered until reuse-surface owner supplies verified image digest containing BOTH authenticated redirect rejection/HTTPS enforcement AND runtime-controlled exact URL allowlist checked before credential lookup. Apps owner must deploy REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST mapping the reader environment to exactly fourteen consented pinned index/entry URLs and inventory existing authenticated sources for migration. Current image and redirect-only fix are not approved. Native owner helper must verify all seven pinned indexes and entry hashes after rollout.",
"approval": "No approval recorded. External supervisor approval receipt must bind exactly CCR, script, contract and ESO policy bytes; CCR must be approved. Additional forge/apps/reuse owner reviews and rollout approval remain required.",
"metadata_consent_sha256": "4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52",
"preparation_sha256": "7819eb51d249f5c7aff4df9fb520afcfb76603b05a4104439499102b6c20af99",
"recovery": "On ambiguous mutation stop. Reconcile complete Forgejo identity/team/repository/PAT metadata and exact KV field through suppressed helper before retry. Token without KV or reverse refuses automatically; revoke identified dedicated PAT through attended Forgejo owner recovery before retry. Never remint on observation timeout. KV CAS=0 prevents overwrites. Do not delete shared runtime Secret.",
"consumer_preparation": {
"owner": "reuse-surface",
"allowlist_artifact": "/tmp/cust81-reuse-reader-owner/docs/assessments/cust81-private-reader/runtime-auth-source-allowlist-r1.json",
"allowlist_sha256": "e1948c537e206b30fc72b9e4732a3f600d92e131813e6f7ecfd4bfbb18c27286",
"federation_py_sha256": "dbaa40f25cc0f090143578cd1c7068cb2cb00960fafd17d5239bf8a5bac514dd",
"integration_patch_sha256": "da9634481ce80658dfce815d3539ba023234938dc76163dfd93d7677be95ed51",
"review_state": "changes_requested for current consumer; preparation patch alone is not deployed-image evidence"
},
"pagination_contract": "All list endpoints page until observed empty, max20pages; reject duplicate/missing IDs, reconcile X-Total-Count when supplied, reject changed/mismatched counts and bound exhaustion. Never infer completion from requestedlimit100 versus server-capped50.",
"effective_grants_contract": "Forgejo11.0.3 /user/repos?order_by=id with Sudo reader uses OwnerID=reader and Collaborate=None; SearchRepositoryCondition defaults collaborations true and includes direct UserAccessRepoCond plus UserOrgTeamRepoCond. It is not owned-only despite Swagger summary. Independent deployed-version compatibility and live inventory proof pending.",
"r1_review_failure": {
"patch_sha256": "a94547b419b87e38dc178b02d1d31af61cc11a71e3734052a190167668db8e30",
"confirmed_defect": "R1 len(batch)<100 stopped after server-capped50, omitting later grants",
"corrected_preliminary_claim": "Owned-only endpoint claim disproved by Forgejo11.0.3 model defaults; no endpoint replacement based on false premise",
"same_proposal": "CCR-2026-0046; revision2 is refinement, not a new successful trial"
},
"api_source_evidence": [
{
"upstream_path": "models/repo/repo/list.go",
"url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/models/repo/repo/list.go",
"sha256": "bb7833badf0fe7f6a2c800c2f301cb846b5968ce3f9e9bd29c3f1677db42acd9",
"local_cache": "/tmp/cust81-forge-contract-source/source-models_repo_repo_list.go"
},
{
"upstream_path": "routers/api/v1/utils/page.go",
"url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/routers/api/v1/utils/page.go",
"sha256": "1d286f60b5571513fb5a26a9243c22eae65f05d7be32dfe5d0f0b15d20550954",
"local_cache": "/tmp/cust81-forge-contract-source/source-routers_api_v1_utils_page.go"
},
{
"upstream_path": "services/convert/utils.go",
"url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/services/convert/utils.go",
"sha256": "2689ffc579ea1df69457fbe84410fef101ae4a9580f0e56dcc3113a2988626b3",
"local_cache": "/tmp/cust81-forge-contract-source/source-services_convert_utils.go"
},
{
"upstream_path": "modules/setting/api.go",
"url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/modules/setting/api.go",
"sha256": "1f640ed884afaa6454c4bf427eccd2d6bb9a092fe37ac1aedfdc5eb85de4f7ba",
"local_cache": "/tmp/cust81-forge-contract-source/source-modules_setting_api.go"
},
{
"upstream_path": "routers/api/v1/user/repo.go",
"url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/routers/api/v1/user/repo.go",
"sha256": "adee62e6671aadd95b5013a64dbb690f2d81a0b9b4de0350c70b4153074ca6ec",
"local_cache": "/tmp/cust81-forge-contract-source/source-routers_api_v1_user_repo.go"
}
],
"rollback_helper": {
"path": "scripts/revoke-reuse-surface-forgejo-source.py",
"scope": "Separate approval binds exact PAT id/name and artifact bytes; Basic-auth revocation after dedicated-user memory-only password reset. Preserve KV/sharedruntime; no remint. Reconcile uncertain DELETE by inventory absence."
}
}
Reference in a new issue View git blame Copy permalink