diff --git a/.gitignore b/.gitignore index a81dbd0..fe45a79 100644 --- a/.gitignore +++ b/.gitignore @@ -194,3 +194,6 @@ state-hub/kubectl # Local agent definition backups (migration artifacts) agents_backup_*/ + +# Protected native evidence snapshots; custody receipts are tracked separately. +.private-backups/ diff --git a/.kaizen/agents/custodian-codex/supervision.json b/.kaizen/agents/custodian-codex/supervision.json index 7d7260f..fb3a206 100644 --- a/.kaizen/agents/custodian-codex/supervision.json +++ b/.kaizen/agents/custodian-codex/supervision.json @@ -226,6 +226,88 @@ "execution_ref": "docs/evidence/2026-10-10-security-consolidation/user-catalogue-approved-apply.json", "verified_outcome": "Exact2cataloguefacts/1consumedledger/3truthfulaudits/1unsentunclaimedevent; ordinaryidentifieddenialretained, noPDPallowclaim; native3waycatalogue1 andSERVICEaccountrowdenied. Nativefixturechecksnotrealhumanlogin/MFA/grantrevocation; broaderUsertasksremainopen. No rollback/replay/delivery used.", "refinement_or_rescue": false + }, + { + "proposal_id": "INFD-WP-0009-T04/purpose-overlay-v1", + "trial_id": "infd-purpose-20261011-r1", + "disposition": "accepted_unchanged", + "outcome": "partial_execution_stopped_unverified", + "proposal_ref": "informed-decision/docs/evidence/2026-10-11-purpose-image-release/decision-packet.md", + "original_revision": "combined-ffa2679a", + "original_digest": "fd78d486174670e12efb2f812bac02e68f294e7791b9302d0d458c053240f5a9", + "packet_manifest_sha256": "ffa2679a94a24e69a75d1248a808825498a80e711ceda98f3639a4143c40ec1b", + "memo_sha256": "506d3956beb7c62ab2bbdfda783c05905d183452a1f67a1817f3fb8c2e522937", + "source_revision": "bc6494cd1b290783ef3aef0763bf28d1deabf4b0", + "approved_source_blob_sha256": { + "deploy/lifecycle/admission.candidate.json": "92382a56b349c3b895e5806e975082527bb99d1a001140e69d857e5b0391fa55", + "deploy/lifecycle/service.candidate.json": "38b78b9cbee5ade7750a58d5156ca4c5773352e947acb304ee714b59e749ceb4", + "deploy/lifecycle/kustomization.yaml": "1bbce81bc6758434354157f8601534320c5d0290587908fd15a6d25e3fa57f47", + "deploy/lifecycle/registries.candidate.json": "9bad6db5fbc2178d31b04120016a41830c3552fbb9e2517b718f9bbe87cf649e" + }, + "target": "realm:kubernetes/railiance01/informed-decision", + "expected_result": "Protected native schema5 backup/off-cluster drill independently matches snapshot integrity/counts; exact image763c Deployment-only manual Argo release Ready1; installed purpose refusal and separate actual-provider acceptance evidence, retained current database.", + "verification_ref": "informed-decision/docs/evidence/2026-10-11-purpose-image-release/execution/execution-plan.json", + "rollback_ref": "same packet: failedcandidate-independent Deployment-only7db/7f5 source/image recovery plus separateReady/schema5/currentDB verification; no old snapshot overwrite", + "cost_estimate_eur": 0, + "risk_estimate": "Brief Recreate disruption, protected evidence snapshot custody/restore and operator recovery time unpriced; inherited1fixableMEDIUM remains INFD9T05. Allphases including recovery begin beforeOct12deadline; freshdecision if windowexhausted. No autopilot cost/risk grant.", + "execution_deadline": "2026-10-12T23:59:59Z", + "memo_id": "infd-20261011-purpose-overlay-r1", + "memo_version": 1, + "execution_bundle_sha256": "27d6d6d3133c963da1dde92d498d636617387c16e850a17c598148abc35c775d", + "execution_plan_sha256": "f5e5fa906ff19d3a45d10dcdb2810373ae21f9cf44c0472ff2bd47d3bc3328d6", + "internal_pre_submission_refinements": "Initial36manifest7c6738b3 and amended78b1e3 preserved; Platform found old-schema migration/optimizedassertion/dependencyseal/livecount gaps. Initial11helper653b68c3 preserved; independent rollbackReadyfailure/postadminintegrity/deadline findings corrected23f2fad with16synthetic+5recovery negatives. Final112/20document packet distinctProduct/PlatformACK; no previous human approval or native action.", + "promotion_evidence": false, + "native_execution": true, + "approved_revision": "combined-ffa2679a", + "approved_digest": "fd78d486174670e12efb2f812bac02e68f294e7791b9302d0d458c053240f5a9", + "approved_source_revision": "bc6494cd1b290783ef3aef0763bf28d1deabf4b0", + "approved_at": "2026-10-11T02:34:20+00:00", + "approval_ref": "informed-decision:infd-20261011-purpose-overlay-r1@1;approval:ec92806a-9aa6-494f-a76b-0385f39ba609", + "human_disposition_id": "disp-0968373d-294d-42bf-8979-36a7c5dd38cf", + "pre_actuation_attempts": [ + { + "result": "pre-phase refusal: Git custody ignore rule absent", + "native_phase_started": false, + "native_backup_or_image_change": false, + "journal_or_case_custody_created": false, + "source_hashes_and_fresh_authority_relation": "independently passed", + "recovery": "Add scoped Custodian .gitignore exclusion for exact approved private custody parent; unchanged approved helper/source/effect scope" + } + ], + "refinement_or_rescue": true, + "execution_results": { + "source_revision": "bc6494cd1b290783ef3aef0763bf28d1deabf4b0", + "drill_backup": "verified complete", + "drill_copy": "UNCERTAIN; stopped before local snapshot destination creation", + "offline_restore": "not executed", + "image_rollout": "not executed", + "database_preserved": true, + "failure_ref": "docs/evidence/2026-10-10-security-consolidation/infd-purpose-approved-drill-copy-failure.json", + "diagnosis_ref": "docs/evidence/2026-10-10-security-consolidation/infd-purpose-drill-copy-diagnosis.json", + "backup_ref": "docs/evidence/2026-10-10-security-consolidation/infd-purpose-approved-drill-backup.json", + "original_journal_retained": true, + "retry_executed": false + } + }, + { + "proposal_id": "NK-FORGEJO-TYPE12-SOURCE-20261011-R1", + "trial_id": "forgejo-type12-source-20261011-r1", + "disposition": "pending", + "outcome": "not_executed", + "proposal_ref": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/proposal.json", + "original_revision": "final34-0b377d647ca748cd03c92f9792396412048055d4bde9f7bb06ff6d413f7acd68", + "original_digest": "585cee731de30d2b37883a57abfd9eb32f023ee694e8d911989109d5caf80569", + "packet_manifest_sha256": "0b377d647ca748cd03c92f9792396412048055d4bde9f7bb06ff6d413f7acd68", + "memo_id": "infd-20261011-forgejo-type12-source-r1", + "memo_version": 1, + "target": "NetKingdom proposed oidc-browser-relying-party type1.2 and separate Forgejo reference-migration design receipt", + "expected_result": "Source-only human acknowledgment of complete reviewed type package; canonical case remains proposed, type unimplemented, execution forbidden. No native credential or rollout action.", + "verification_ref": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/recording-gates.md", + "rollback_ref": "Immutable previous type/case1.1 retained; proposed1.2 not admitted for execution.", + "cost_estimate_eur": 0.1, + "risk_estimate": "Source-only decision. No credential exposure or live runtime change authorized.", + "promotion_evidence": false, + "native_execution": false } ] } diff --git a/docs/evidence/2026-10-10-security-consolidation/infd-purpose-approved-drill-backup.json b/docs/evidence/2026-10-10-security-consolidation/infd-purpose-approved-drill-backup.json new file mode 100644 index 0000000..25e207d --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/infd-purpose-approved-drill-backup.json @@ -0,0 +1,53 @@ +{ + "all_checks_pass": true, + "native_approval_verified_by_root": { + "accepted_at": "2026-10-11T02:34:20Z", + "approval_id": "ec92806a-9aa6-494f-a76b-0385f39ba609", + "disposition_id": "disp-0968373d-294d-42bf-8979-36a7c5dd38cf", + "verified_at": "2026-10-11T02:38:41.777949+00:00" + }, + "native_authenticated_grant": false, + "native_parent_private": true, + "native_uid": 10001, + "phase": "drill-backup", + "pod_name": "informed-decision-f557556df-mwpz7", + "pod_uid": "e8561ae0-4b09-4455-924d-64c27b625fc7", + "raw_output_withheld": true, + "snapshot_bytes": 19537920, + "snapshot_file": "drill.sqlite", + "snapshot_readonly": { + "integrity": "ok", + "lifecycle": { + "events": 50, + "pending": 0, + "records": 15 + }, + "outbox": { + "delivered": 320 + }, + "read_only_pre_open": true, + "schema_version": 5, + "store_constructed": false, + "submissions": { + "confirmed": 41 + } + }, + "snapshot_sha256": "8756cf825df9e7b5b74bb4a0106a5027f5cff2c59ff45d7b48eed8522a7d33f3", + "source_readonly_baseline": { + "integrity": "ok", + "lifecycle": { + "events": 50, + "pending": 0, + "records": 15 + }, + "outbox": { + "delivered": 320 + }, + "read_only_pre_open": true, + "schema_version": 5, + "store_constructed": false, + "submissions": { + "confirmed": 41 + } + } +} diff --git a/docs/evidence/2026-10-10-security-consolidation/infd-purpose-approved-drill-copy-failure.json b/docs/evidence/2026-10-10-security-consolidation/infd-purpose-approved-drill-copy-failure.json new file mode 100644 index 0000000..8c100bd --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/infd-purpose-approved-drill-copy-failure.json @@ -0,0 +1,7 @@ +{ + "all_checks_pass": false, + "failure": "fixed phase outcome uncertain; original evidence retained; no retry", + "failure_class": "ValueError", + "phase": "drill-copy", + "raw_output_withheld": true +} diff --git a/docs/evidence/2026-10-10-security-consolidation/infd-purpose-drill-copy-diagnosis.json b/docs/evidence/2026-10-10-security-consolidation/infd-purpose-drill-copy-diagnosis.json new file mode 100644 index 0000000..31d466a --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/infd-purpose-drill-copy-diagnosis.json @@ -0,0 +1,19 @@ +{ + "diagnosis_only": true, + "database_opened": false, + "snapshot_main": { + "bytes": 19537920, + "sha256": "8756cf825df9e7b5b74bb4a0106a5027f5cff2c59ff45d7b48eed8522a7d33f3", + "uid": 10001, + "mode": "0600", + "links": 1 + }, + "snapshot_sidecars": { + "wal_bytes": 0, + "shm_bytes": 32768 + }, + "off_cluster_database_file_created": false, + "image_change_executed": false, + "phase_retry_executed": false, + "diagnosis": "Readonly WAL-mode snapshot inspection created a nonzero SHM sidecar; subsequent closed-main snapshot gate refused. Frozen main hash matches successful backup. Preserve uncertain journal; source amendment and fresh exact review required before recovery." +} diff --git a/docs/evidence/2026-10-10-security-consolidation/infd-purpose-native-authoring-receipt.json b/docs/evidence/2026-10-10-security-consolidation/infd-purpose-native-authoring-receipt.json new file mode 100644 index 0000000..f158a14 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/infd-purpose-native-authoring-receipt.json @@ -0,0 +1,18 @@ +{ + "human_dispositions": 0, + "memo_id": "infd-20261011-purpose-overlay-r1", + "outcome_review": { + "intake_state": "not_submitted", + "memo_id": "review-73d9dbf7-644b-42b8-8a0c-eff274f274a1", + "stale": false + }, + "publication_event_id": "c7fa7b8a-d4fd-418b-8362-39ba8e64848d", + "queue_detail": "queued", + "queue_status": "pending", + "register_event_id": "b3787a49-3e22-43c1-8557-823435d35530", + "review_event_id": "5cd5280a-31bf-428c-88b0-0d9bf9327cee", + "review_memo_id": "review-73d9dbf7-644b-42b8-8a0c-eff274f274a1", + "revision_event_id": null, + "version": 1, + "workspace_url": "https://decisions.coulomb.social/decisions/infd-20261011-purpose-overlay-r1?version=1" +} diff --git a/docs/evidence/2026-10-10-security-consolidation/user-ordinary-admission-coordination-receipt.json b/docs/evidence/2026-10-10-security-consolidation/user-ordinary-admission-coordination-receipt.json new file mode 100644 index 0000000..27a0159 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/user-ordinary-admission-coordination-receipt.json @@ -0,0 +1,24 @@ +{ + "workplan_id": null, + "id": "693786bb-470a-40c0-b992-b7113fa99b4a", + "topic_id": null, + "task_id": null, + "decision_id": null, + "event_type": "coordination_receipt", + "summary": "Observed completedFLEX-WP0035 and verified one-appcatalogue. Attached existingUSER26T03/28T02 beneficiary to boundedAccessFLEX-IN0003 response for ordinaryapplication.register policy/claims restoration. Actualsigned-in projection isUser-owned humanacceptance; T05mustnameauthoritativefactowner, genericAccessgrantAPI notowed. Cross-ownerwaitingcase recorded; no workerwake/nativechange/foreigntaskcopy.", + "detail": { + "state": "waiting", + "reason": "Provider ordinary-management response proposed in FLEX-IN-0003; genuine human projection and any T05 scope choice remain separate", + "case_id": "case:cross-owner:user-engine:USER-WP-0026-T03:access-engine:FLEX-IN-0003", + "scenario_type": "cross_owner_wait", + "obligor_record_id": "FLEX-IN-0003", + "central_publication": "submitted-by-this-request", + "obligor_record_kind": "intake", + "worker_wake_enabled": false, + "beneficiary_workplan_id": "USER-WP-0026" + }, + "author": "codex", + "session_id": null, + "created_at": "2026-10-11T02:18:54.710494Z", + "workstream_id": null +} diff --git a/docs/security-collaboration-review-2026-10-10.md b/docs/security-collaboration-review-2026-10-10.md index 16c8d0f..eac31ae 100644 --- a/docs/security-collaboration-review-2026-10-10.md +++ b/docs/security-collaboration-review-2026-10-10.md @@ -462,3 +462,27 @@ bound before human submission; no actual native backup/image rollout occurred. Prior config-only7dbapproval does not authorize this image release. The updated same13-owner checkpoint is **47 open plans:45nonresidual,2residual,102unfinished task blocks**. The extra unfinished block is the explicit INFD9T05 inherited vulnerability follow-through; successful bounded catalogue mutation did not erase broader User journey obligations. Previous47/101publisher checkpoint is preserved separately. + + +INFD source evidence reconciliation9268c9a replaces stale outbox/AUDIT-WP0009 +blockers with actual transactional outbox, per-class86400s heartbeat,30s pump +and300s reconciliation mechanisms. Full class-specific verification remains +owed: retained native receipts omit stance-application/per-target rare-class +proof and reconciliation explicitly does not prove completeness. One unpromoted +residual intake INFD-IN-0009 retains that gap without reopening finishedWP5/7. +INFD-IN-0007 has GH025's bounded doctrine answer, pending acceptedstandardvoice +underNET-IN-0004. No conformance upgrade or native evidence action occurred. + +Distinct Access owner response c829e53 and User owner wording c676a52 remove +the invented generic grant API debt from finishedFLEX35. USER26T03 initial +signed-in account projection is a human acceptance gate; ordinary catalogue +management restoration remains there beforecustomers, with bounded provider +policy/claims response FLEX-IN-0003. USER28T02 distinguishes U09readback from +T05management: name User membership/IAM coarse role/tenant-role/Access policy +fact and exact owner before scopedmutation/revocation evidence. A schema-based +response CoordinationCase references the intake, not a fakeworkplan, and central +metadata receipt693786bb is confirmed; no live workerwake or foreigntaskcopy. + +### Informed-decision image trial: verified backup, transfer stopped + +The founder confirmed exact purpose-overlay R1 at 02:34:20Z on 2026-10-11. The approved native backup completed and verified schema 5, integrity and count consistency. The subsequent drill-copy entered UNCERTAIN before creating an off-cluster database file; no offline restore or image rollout ran. Metadata-only inspection confirms the frozen main snapshot retains its approved hash and size, with zero WAL bytes and a 32 KB SHM sidecar left by read-only inspection. Source owners are preparing a bounded correction; the original journal and failed outcome remain retained. The approved helper is unchanged and no phase was retried. See `docs/evidence/2026-10-10-security-consolidation/infd-purpose-drill-copy-diagnosis.json`.