coulomb/state-hub
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Pin verified dispatcher image and retain release evidence
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
This commit is contained in:
tegwick 2026-10-04 22:43:52 +02:00
parent a64aa58b38
commit 46bcfe20f2
5 changed files with 41 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

9
deploy/informed-decision/README.md
View file

@ -56,3 +56,12 @@ This is a per-decision data operation, not a deployment. Headless clients call
8081 with the appropriate projected audience and the normal API idempotency key;
they never request approval:approve or approval:consume. Automatic scanning and
a public delegate endpoint are deliberately outside this worker's contract.
Final candidate image (Forgejo commit 4a59b23):
forgejo.coulomb.social/coulomb/state-hub-memo-dispatch@sha256:410fb6b6c9fd7a7ee0b63d727fd3249fb3ae13943421d6a5ce88b7ad2520bd2f
Live observation: State Hub's API Service selects app=state-hub. This worker
does not carry that label, so it cannot enter the API endpoints. At inspection
there were no other State Hub NetworkPolicies; recheck effective selection before
activation. Its own policy allows only DNS and the exact intake peer on 8081.

2
deploy/informed-decision/dispatcher.candidate.json
View file

@ -69,7 +69,7 @@
"containers": [
{
"name": "dispatcher",
"image": "forgejo.coulomb.social/coulomb/state-hub-memo-dispatch@sha256:a3b311ab99f08ab51a2919e72537ffb1176aad2448fa892bf1bf826e1a11161a",
"image": "forgejo.coulomb.social/coulomb/state-hub-memo-dispatch@sha256:410fb6b6c9fd7a7ee0b63d727fd3249fb3ae13943421d6a5ce88b7ad2520bd2f",
"securityContext": {
"allowPrivilegeEscalation": false,
"readOnlyRootFilesystem": true,

16
docs/evidence/2026-10-04-memo-dispatch/dispatcher-container.json Normal file
View file

@ -0,0 +1,16 @@
{
"status": "passed",
"image_id": "sha256:410fb6b6c9fd7a7ee0b63d727fd3249fb3ae13943421d6a5ce88b7ad2520bd2f",
"checks": [
"non-root read-only worker starts without external network",
"explicit enqueue persists a lifecycle envelope without inventing a Hub relationship",
"SIGTERM stops without forced kill",
"restart retains the exact pending envelope; missing custody does not drop it",
"private queue and database modes enforced"
],
"fixture_only": true,
"external_network": "none",
"native_identity_proven": false,
"envelope_sha256": "ce0b8e1c6e861fde2da584363b695932bd0c74f923d1688211cc8b3d9a2f8c2e",
"cleanup_complete": true
}

9
docs/evidence/2026-10-04-memo-dispatch/dispatcher-scan.json Normal file
View file

@ -0,0 +1,9 @@
{
"image": "forgejo.coulomb.social/coulomb/state-hub-memo-dispatch@sha256:410fb6b6c9fd7a7ee0b63d727fd3249fb3ae13943421d6a5ce88b7ad2520bd2f",
"source_commit": "4a59b23",
"scanner": "Trivy 0.74.0",
"created_at": "2026-10-04T20:38:44.831801093Z",
"high": 0,
"critical": 0,
"scope": "Image vulnerabilities in the scanner database at scan time; not universal security attestation."
}

7
workplans/STATE-WP-0096-private-decision-dispatch.md
View file

@ -35,7 +35,7 @@ versus unresolved refusal. Only reviewed local workload execution queues content
```task
id: STATE-WP-0096-T02
status: progress
status: done
priority: high
```
@ -76,3 +76,8 @@ lost response after native creation, restart, same-key receipt replay (201 then
Five installed-container checks prove private storage, explicit enqueue, restart
and SIGTERM with no network. The three deployment objects pass server dry-run;
no live worker or token projection has been created.
Final Forgejo image 410fb6b (source 4a59b23) passed five installed-container
checks and Trivy HIGH/CRITICAL scan (zero findings). Owner tests: 28 passed.
Cross-service suite: 663 passed, one skipped. Both projected audiences and final
image pin passed server dry-run. Receipts: docs/evidence/2026-10-04-memo-dispatch/.