Record verified approved guardrail publication and remaining owner gates
This commit is contained in:
codex
parent
9ea453708f
commit
16837a26fb
16 changed files with 1833 additions and 15 deletions
|
|
@ -141,6 +141,55 @@
|
|||
"execution_ref": "docs/evidence/2026-10-10-security-consolidation/user-readback-approved-execution.json",
|
||||
"verified_outcome": "Exact approved two-object rollout Ready1 gen73/observed73, readyz200; actual admitted readback registry/allow-deny/TTL/unavailable checks passed. Existing enforcement health200/unknown-action200deny; oldnativepurpose200deny is preexisting protocolgap, no allow claimed. Canonical full28objectrender changes exactly2objects. Native catalogue empty: USER26/28 consumer acceptance stillopen, no realhumanlogin/MFA or token-isolation proof. Scope execution succeeded; overall consolidation remains active.",
|
||||
"refinement_or_rescue": false
|
||||
},
|
||||
{
|
||||
"proposal_id": "POLICY-PUB-20261011-SECURITY-LAYER-V08-R1",
|
||||
"disposition": "accepted_unchanged",
|
||||
"outcome": "succeeded",
|
||||
"proposal_ref": "rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/decision-packet.md",
|
||||
"original_revision": "R1-refined-a70fb22f",
|
||||
"original_digest": "076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e",
|
||||
"packet_manifest_sha256": "a70fb22f75871a08358f1cdee2410797cb0a2f01c2001f0012d16866b20e28a8",
|
||||
"target": "realm:kubernetes/railiance01/policy-nexus",
|
||||
"expected_result": "Ready1 exact published Policy Nexus image and paired provenance; accepted v0.8 served,73 current documents and72 existing immutable paths independently match.",
|
||||
"verification_ref": "rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-native-hosting",
|
||||
"rollback_ref": "rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/rollback-binding.json; Helm revision8",
|
||||
"cost_estimate_eur": 0,
|
||||
"risk_estimate": "Stateless public availability/pull/scheduling/runtime incompatibility. Rollback restores72 existing paths but temporarily removes newly introduced v0.8/current revision URLs. Loss bound unpriced, supervised exact human approval required.",
|
||||
"execution_deadline": "2026-10-12T23:59:59Z",
|
||||
"memo_id": "infd-20261011-policy-nexus-hosting-r1",
|
||||
"memo_version": 1,
|
||||
"internal_pre_submission_refinements": "Original27pathd402 packet retained; independent owner review required UID/full defaulted configuration and ServiceAccount reference drift refusal, HTTPS origin/redirect refusal and bounded reads. Refined30patha70 packet prepared before first human submission; one trial, no earlier approval or success.",
|
||||
"promotion_evidence": false,
|
||||
"approved_revision": "R1-refined-a70fb22f",
|
||||
"approved_digest": "076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e",
|
||||
"approval_ref": "informed-decision:infd-20261011-policy-nexus-hosting-r1@1; approval:52a3c479-2cb1-4074-abec-6a88117ad596",
|
||||
"approved_at": "2026-10-11T01:14:23+00:00",
|
||||
"human_disposition_id": "disp-b8bfa6c0-e879-4de2-8243-f4abb9bcd011",
|
||||
"pre_actuation_attempts": [
|
||||
{
|
||||
"at": "2026-10-11T01:19:18Z",
|
||||
"actuator_sha256": "41837e66e8d775f0ecfab42e2d3d3f5063489a3d2f14ae8e86f595ade25e5643",
|
||||
"result": "failed render comparison before Helm upgrade; node,capacity,sealed baseline and server dryrun/diff passed",
|
||||
"attempted_helm_upgrade": false,
|
||||
"receipt_ref": "docs/evidence/2026-10-10-security-consolidation/policy-hosting-pre-actuation-failed.json"
|
||||
},
|
||||
{
|
||||
"result": "local premature read of pending outcome writer failed JSON parsing before any remote execution",
|
||||
"attempted_helm_upgrade": false,
|
||||
"effect": "none",
|
||||
"refinement": "wait for receipt-producing command completion before dependent actuator"
|
||||
}
|
||||
],
|
||||
"operational_actuator_refinement": "Readonly diagnosis proved existing Helm chart omits metadata.namespace; fixed command namespace policy-nexus supplies it. Refined comparison adds only missing namespace, refuses explicit wrong namespace, preserving full9object exact comparison. Approved packet/source/image/effect scope unchanged. Initialfailed pre-actuation preserved.",
|
||||
"refinement_or_rescue": true,
|
||||
"executed_revision": "R1-refined-a70fb22f",
|
||||
"executed_digest": "076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e",
|
||||
"executed_actuator_sha256": "e23fb931f253c8df79fffb922f23a1f476c2167014b06e245a22148fce25dccf",
|
||||
"execution_started_at": "2026-10-11T01:23:27.564865+00:00",
|
||||
"execution_completed_at": "2026-10-11T01:23:42.112194+00:00",
|
||||
"execution_ref": "docs/evidence/2026-10-10-security-consolidation/policy-hosting-approved-execution.json",
|
||||
"verified_outcome": "Helm9 deployed/Ready1 generation9 observed9; exact approved image/paired provenance/all9 UID-defaulted configurations pass.158publicHTTPS byte checks match73currentdocuments+72oldimmutablepaths; CertificateReady,health/index200/legacy308/404. NoArgo adoption/data/credential writes; sourcebindingreconciled. Initialpre-actuation namespace comparison failure retained and refined; no rollback used, no unchanged-success promotion credit. Wholeconsolidation remains active."
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
|
|||
|
|
@ -0,0 +1,37 @@
|
|||
{
|
||||
"workplan_id": null,
|
||||
"id": "74553c13-a1bf-47ad-bdc2-bc662743a087",
|
||||
"topic_id": null,
|
||||
"task_id": null,
|
||||
"decision_id": null,
|
||||
"event_type": "note",
|
||||
"summary": "Confirmed User Engine R2 approval executed: Ready1 exact f239 image, native advisory readback checks pass; real catalogue empty and USER26/28 remain open. Accepted security model/source conformance and publisher artifact prepared; Policy Nexus exact hosting R1 memo now intake-ready, no approval/deployment inferred. Forgejo shared default SA blocks CCR42, attached to ORGREF-WP-0002.",
|
||||
"detail": {
|
||||
"handoff_ids": [
|
||||
"PNEX-WP-0005",
|
||||
"USER-WP-0026",
|
||||
"USER-WP-0028",
|
||||
"INFD-WP-0009-T04",
|
||||
"KEY-WP-0039-T02",
|
||||
"MASON-WP-0010-T03",
|
||||
"WARDEN-WP-0044-T03",
|
||||
"ORGREF-WP-0002",
|
||||
"CCR-2026-0042"
|
||||
],
|
||||
"policy_memo_id": "infd-20261011-policy-nexus-hosting-r1",
|
||||
"policy_review_id": "review-28d16691-3277-461e-aec6-53ad7a0538c7",
|
||||
"user_approval_id": "0dd18a5a-5555-461e-8470-931d530435cf",
|
||||
"user_hub_decision_id": "b9ece441-f7a4-5f44-8cf2-243a24166ce6",
|
||||
"whole_goal_completed": false,
|
||||
"baseline_owner_source_count": {
|
||||
"open": 48,
|
||||
"residual": 2,
|
||||
"nonresidual": 46,
|
||||
"unfinished_tasks": 102
|
||||
}
|
||||
},
|
||||
"author": "codex",
|
||||
"session_id": null,
|
||||
"created_at": "2026-10-11T01:13:35.298178Z",
|
||||
"workstream_id": null
|
||||
}
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
{
|
||||
"proposal_id": "POLICY-PUB-20261011-SECURITY-LAYER-V08-R1",
|
||||
"approval": {
|
||||
"approval_id": "52a3c479-2cb1-4074-abec-6a88117ad596",
|
||||
"disposition_id": "disp-b8bfa6c0-e879-4de2-8243-f4abb9bcd011"
|
||||
},
|
||||
"started_at": "2026-10-11T01:23:27.564865+00:00",
|
||||
"raw_output_withheld": true,
|
||||
"secret_values_observed": false,
|
||||
"attempted_helm_upgrade": true,
|
||||
"all_checks_pass": true,
|
||||
"headroom": {
|
||||
"node_ip": "92.205.62.239",
|
||||
"free_cpu_m": 540,
|
||||
"free_memory_mi": 6521,
|
||||
"surge_cpu_m": 10,
|
||||
"surge_memory_mi": 32,
|
||||
"pressure_checks_pass": true
|
||||
},
|
||||
"fresh_sealed_preflight_pass": true,
|
||||
"helm_exit_code": 0,
|
||||
"helm_revision": 9,
|
||||
"image": "forgejo.coulomb.social/coulomb/policy-nexus@sha256:4e0db6a57eb00f577159aa6ee10f910dd67b03fd0541c6ce849f5426fdb99d06",
|
||||
"generation": 9,
|
||||
"observed_generation": 9,
|
||||
"ready_replicas": 1,
|
||||
"completed_at": "2026-10-11T01:23:42.112194+00:00",
|
||||
"decision_packet_sha256": "076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e"
|
||||
}
|
||||
|
|
@ -0,0 +1,121 @@
|
|||
"""Exact supervised owner Helm operation; credentials never leave the node."""
|
||||
import base64, datetime, hashlib, json, subprocess, sys
|
||||
if sys.flags.optimize: raise RuntimeError("Optimized interpreter refuses supervised execution")
|
||||
from pathlib import Path
|
||||
here=Path('/home/worsch/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal')
|
||||
manifest=Path('/tmp/policy-native-hosting-stage/manifest.json')
|
||||
assert hashlib.sha256(manifest.read_bytes()).hexdigest()=='a70fb22f75871a08358f1cdee2410797cb0a2f01c2001f0012d16866b20e28a8'
|
||||
for entry in json.loads(manifest.read_text()):
|
||||
current=Path('/home/worsch')/entry['repo']/entry['path']
|
||||
assert not current.is_symlink() and hashlib.sha256(current.read_bytes()).hexdigest()==entry['staged_sha256']
|
||||
assert hashlib.sha256((here/'decision-packet.md').read_bytes()).hexdigest()=='076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e'
|
||||
proposal=json.loads((here/'proposal.json').read_text())
|
||||
receipt=json.loads(Path('/tmp/security-policy-hosting-native-outcome-latest.json').read_text())
|
||||
assert receipt['memo_id']=='infd-20261011-policy-nexus-hosting-r1'
|
||||
assert receipt['review']['memo_id']=='review-28d16691-3277-461e-aec6-53ad7a0538c7'
|
||||
assert receipt['review']['stale'] is False and receipt['review']['intake_state']=='ready'
|
||||
accepted=[x for x in receipt['dispositions'] if x.get('submission_state')=='confirmed' and x.get('disposition',{}).get('verb')=='accept' and x['disposition'].get('memo_version')==1]
|
||||
assert len(accepted)==1,'Exact confirmed founder acceptance required'
|
||||
a=accepted[0]['disposition']
|
||||
assert a.get('approval_id')=='52a3c479-2cb1-4074-abec-6a88117ad596'
|
||||
assert a.get('id')=='disp-b8bfa6c0-e879-4de2-8243-f4abb9bcd011'
|
||||
assert a.get('memo_id')=='review-28d16691-3277-461e-aec6-53ad7a0538c7'
|
||||
assert a.get('actor')=={'kind':'person','sub':'uid=platform-root,ou=people,dc=netkingdom,dc=local'}
|
||||
assert a.get('at')=='2026-10-11T01:14:23Z'
|
||||
assert datetime.datetime.now(datetime.timezone.utc)<datetime.datetime.fromisoformat(proposal['execution_deadline'].replace('Z','+00:00'))
|
||||
for name,digest in proposal['preflight_source_hashes'].items():assert hashlib.sha256((here/name).read_bytes()).hexdigest()==digest
|
||||
chart=Path('/home/worsch/rapp-policy-nexus')
|
||||
files={}
|
||||
for item in proposal['chart_source_files']:
|
||||
p=chart/item['path'];data=p.read_bytes();assert hashlib.sha256(data).hexdigest()==item['sha256'];files[item['path']]=base64.b64encode(data).decode()
|
||||
values=(here/'candidate-values.yaml').read_bytes();assert hashlib.sha256(values).hexdigest()==proposal['candidate_values_sha256']
|
||||
binding=json.loads((here/'candidate-binding.json').read_text());assert binding==proposal['candidate']
|
||||
payload={'proposal':proposal,'approval':{'approval_id':a['approval_id'],'disposition_id':a['id']},'chart_files':files,'values':base64.b64encode(values).decode(),'candidate':(here/'candidate-rendered.yaml').read_text(),'baseline':(here/'rollback-rendered.yaml').read_text(),'sealed':json.loads((here/'sealed-live-config.json').read_text())['objects']}
|
||||
remote=r'''
|
||||
import base64,copy,datetime,hashlib,json,os,re,subprocess,sys,tempfile
|
||||
from pathlib import Path
|
||||
if sys.flags.optimize: raise RuntimeError("Optimized interpreter refuses supervised execution")
|
||||
import yaml
|
||||
exec(__GUARD__)
|
||||
p=json.loads(__PAYLOAD__); q=p['proposal']; env={**os.environ,'KUBECONFIG':'/etc/rancher/k3s/k3s.yaml'}
|
||||
r={'proposal_id':q['proposal_id'],'approval':p['approval'],'started_at':datetime.datetime.now(datetime.timezone.utc).isoformat(),'raw_output_withheld':True,'secret_values_observed':False,'attempted_helm_upgrade':False,'all_checks_pass':False}
|
||||
def run(args,body=None,timeout=90):
|
||||
return subprocess.run(args,input=body,text=True,capture_output=True,timeout=timeout,env=env)
|
||||
def get(args):
|
||||
x=run(['kubectl']+args+['-o','json']);assert x.returncode==0,'fixed metadata query failed';return json.loads(x.stdout)
|
||||
def quantity(value):
|
||||
m=re.fullmatch(r'([0-9]+)(m|Ki|Mi|Gi|Ti)?',str(value));assert m,'unsupported resource quantity'
|
||||
n=int(m[1]);unit=m[2];return n*{'m':0.001,'Ki':1024,'Mi':1024**2,'Gi':1024**3,'Ti':1024**4,None:1}[unit]
|
||||
try:
|
||||
assert datetime.datetime.now(datetime.timezone.utc)<datetime.datetime.fromisoformat(q['execution_deadline'].replace('Z','+00:00'))
|
||||
nodes=get(['get','nodes'])['items'];assert len(nodes)==1
|
||||
node=nodes[0];assert any(x['address']=='92.205.62.239' for x in node['status']['addresses'])
|
||||
conditions={x['type']:x['status'] for x in node['status']['conditions']};assert conditions.get('Ready')=='True'
|
||||
assert all(conditions.get(k)=='False' for k in ['MemoryPressure','DiskPressure','PIDPressure'])
|
||||
description=run(['kubectl','describe','node',node['metadata']['name']]);assert description.returncode==0
|
||||
table=description.stdout.split('Allocated resources:',1)[1]
|
||||
cpu=re.search(r'^\s*cpu\s+(\S+)\s+\(',table,re.M);mem=re.search(r'^\s*memory\s+(\S+)\s+\(',table,re.M);assert cpu and mem
|
||||
free_cpu=quantity(node['status']['allocatable']['cpu'])-quantity(cpu[1]);free_mem=quantity(node['status']['allocatable']['memory'])-quantity(mem[1])
|
||||
assert free_cpu>=0.010 and free_mem>=32*1024**2
|
||||
r['headroom']={'node_ip':'92.205.62.239','free_cpu_m':round(free_cpu*1000),'free_memory_mi':int(free_mem/1024**2),'surge_cpu_m':10,'surge_memory_mi':32,'pressure_checks_pass':True}
|
||||
apps=get(['get','applications.argoproj.io','-n','argocd'])['items']
|
||||
for app in apps:
|
||||
spec=app.get('spec',{});assert spec.get('destination',{}).get('namespace')!='policy-nexus'
|
||||
assert 'policy-nexus' not in app['metadata']['name']
|
||||
assert all('policy-nexus' not in str(src.get('path','')) for src in [spec.get('source',{})]+spec.get('sources',[]))
|
||||
status=run(['helm','status','policy-nexus','--namespace','policy-nexus','--output','json']);assert status.returncode==0
|
||||
h=json.loads(status.stdout);assert h['version']==8 and h['info']['status']=='deployed' and h['namespace']=='policy-nexus'
|
||||
candidate=list(yaml.safe_load_all(p['candidate']));baseline=list(yaml.safe_load_all(p['baseline']));strict_source(baseline,candidate)
|
||||
live=[get(['get',x['kind'],x['metadata']['name'],'-n','policy-nexus']) for x in baseline]
|
||||
strict_baseline(baseline,live,p['sealed'])
|
||||
for x in live:
|
||||
md=x['metadata'];ann=md.get('annotations',{});assert md.get('labels',{}).get('app.kubernetes.io/managed-by')=='Helm'
|
||||
assert ann.get('meta.helm.sh/release-name')=='policy-nexus' and ann.get('meta.helm.sh/release-namespace')=='policy-nexus' and not ann.get('argocd.argoproj.io/tracking-id')
|
||||
body=json.dumps({'apiVersion':'v1','kind':'List','items':candidate})
|
||||
dry=run(['kubectl','apply','--dry-run=server','-n','policy-nexus','-f','-','-o','json'],body);assert dry.returncode==0
|
||||
admitted=json.loads(dry.stdout);strict_admitted(live,candidate,admitted.get('items',[admitted]))
|
||||
diff=run(['kubectl','diff','-n','policy-nexus','-f','-'],body);assert diff.returncode in [0,1]
|
||||
r['fresh_sealed_preflight_pass']=True
|
||||
with tempfile.TemporaryDirectory(prefix='policy-nexus-approved-') as directory:
|
||||
root=Path(directory);os.chmod(root,0o700)
|
||||
for name,data in p['chart_files'].items():
|
||||
relative=Path(name);assert relative.parts[:2]==('helm','policy-nexus') and '..' not in relative.parts
|
||||
target=root/relative;target.parent.mkdir(parents=True,exist_ok=True);target.write_bytes(base64.b64decode(data))
|
||||
valuefile=root/'candidate-values.yaml';valuefile.write_bytes(base64.b64decode(p['values']))
|
||||
chart=root/'helm/policy-nexus'
|
||||
rendered=run(['helm','template','policy-nexus',str(chart),'--namespace','policy-nexus','--values',str(valuefile)])
|
||||
assert rendered.returncode==0
|
||||
exact=list(yaml.safe_load_all(rendered.stdout))
|
||||
for obj in exact:
|
||||
# Helm binds omitted namespaced metadata to its fixed --namespace target.
|
||||
md=obj['metadata']
|
||||
if 'namespace' not in md:md['namespace']='policy-nexus'
|
||||
assert md['namespace']=='policy-nexus'
|
||||
assert normalize(objects(exact))==normalize(objects(candidate))
|
||||
r['attempted_helm_upgrade']=True
|
||||
upgrade=run(['helm','upgrade','policy-nexus',str(chart),'--namespace','policy-nexus','--values',str(valuefile),'--atomic','--wait','--timeout','5m'],timeout=330)
|
||||
r['helm_exit_code']=upgrade.returncode
|
||||
assert upgrade.returncode==0,'owner atomic upgrade failed'
|
||||
after=[get(['get',x['kind'],x['metadata']['name'],'-n','policy-nexus']) for x in baseline]
|
||||
expected,_=planned(live,candidate)
|
||||
for key,x in objects(after).items():
|
||||
wanted=copy.deepcopy(expected[key]);actual=copy.deepcopy(x)
|
||||
if key==('Deployment','policy-nexus'):
|
||||
# Deployment controller's rollout counter is bookkeeping, not a source change.
|
||||
for doc in [wanted,actual]:doc['metadata'].get('annotations',{}).pop('deployment.kubernetes.io/revision',None)
|
||||
assert configuration(wanted)==configuration(actual),'post-release configuration differs'
|
||||
deployment=objects(after)[('Deployment','policy-nexus')];st=deployment['status']
|
||||
assert st.get('observedGeneration')==deployment['metadata']['generation'] and st.get('readyReplicas')==1 and st.get('updatedReplicas')==1
|
||||
status=run(['helm','status','policy-nexus','--namespace','policy-nexus','--output','json']);assert status.returncode==0
|
||||
h=json.loads(status.stdout);assert h['version']==9 and h['info']['status']=='deployed'
|
||||
r.update(all_checks_pass=True,helm_revision=h['version'],image=deployment['spec']['template']['spec']['containers'][0]['image'],generation=deployment['metadata']['generation'],observed_generation=st['observedGeneration'],ready_replicas=st['readyReplicas'],completed_at=datetime.datetime.now(datetime.timezone.utc).isoformat())
|
||||
except Exception as error:
|
||||
r['failure_class']=type(error).__name__;r['failure']='fixed supervised preflight/owner upgrade/post-release verification failed; raw outputs withheld'
|
||||
print(json.dumps(r));sys.exit(0 if r['all_checks_pass'] else 1)
|
||||
'''.replace('__GUARD__',repr((here/'change_guard.py').read_text())).replace('__PAYLOAD__',repr(json.dumps(payload)))
|
||||
result=subprocess.run(['ssh','railiance01','python3 -'],input=remote,text=True,capture_output=True,timeout=450)
|
||||
try:out=json.loads(result.stdout)
|
||||
except (ValueError,TypeError):out={'all_checks_pass':False,'failure':'SSH safe receipt unavailable','raw_output_withheld':True}
|
||||
out['decision_packet_sha256']=hashlib.sha256((here/'decision-packet.md').read_bytes()).hexdigest()
|
||||
Path('/tmp/security-policy-approved-owner-execution.json').write_text(json.dumps(out,indent=2)+'\n')
|
||||
print(json.dumps(out));raise SystemExit(0 if result.returncode==0 and out.get('all_checks_pass') is True else 1)
|
||||
|
|
@ -0,0 +1,212 @@
|
|||
[
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/candidate-binding.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/candidate-binding.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "d6d34636e289949d1fd3debb5e2a002b9c9de485e1b462660f0818a7d1d73d22"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/candidate-rendered.yaml",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/candidate-rendered.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "6ea659a33cadd9ee871eda744d737cf4b477b56aeb2e1033f4354987c3125b00"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/candidate-values.yaml",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/candidate-values.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "6e0f5a529b450f6b8f00f6fc59c50a7e5b652520f0a370b199a49cb416fac062"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/change_guard.py",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/change_guard.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f82b95f11ac17a747468ea5e8afd41cb741383c5d4af7609eee1903e1c33acec"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/content-review.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/content-review.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "0e286ce72f63df75c181131722addaf5b26d4f63dc1aa8fc9ef90e09704feb6e"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/decision-packet.md",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/decision-packet.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/intake.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/intake.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "eee7248c1e23a05d525c5efd541374f491754c5dad6513801d331ea468e55efa"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/lifecycle-commands.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/lifecycle-commands.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "bd40a9b02b2a5f17686921dca7c12e8a84be2698d2e127bb10a66bfae4020764"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/live-baseline.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/live-baseline.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "c118d19b760990800ce5f2028e94b9259463722afcdb3743ac95cbeff6b8aac9"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/memo.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/memo.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "fa50ea46953863ec449e827ae73bcdd06f0567f767378746b82b36e8f075a406"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/native-preflight.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/native-preflight.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "19df63011efdf8c9453d4e18d320df4895051d3a681318a09c470befc055744e"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/preflight.py",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/preflight.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "3191a97c8dbc8d79cfab8b028f5bf1e24fb765d7e72db3d327affac2bb631851"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/proposal.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/proposal.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f8aff82fc7cd8b7443803351abf08b5e0590fa6daa1622d33f53429be63a2e7f"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/public-verification-plan.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/public-verification-plan.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "94c919b8e17f27b34aeab8dcad2d9ee8d5c45492057a3adeeb68b531da4b4ca8"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/publication-manifest.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/publication-manifest.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "ba53cc4900e6bb9ab8aa4bac4e58cb5fe7a03d656bafb3f9cb3d9c8ebff7843a"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/published-verification.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/published-verification.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "7c8c4cf74ce642e31f294fadba601c3504c481e0ae34f3a59dc831c6a0496af9"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/review-refinement.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/review-refinement.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "526f5f95e3ae1be10f0ac549b9f021606b8fb522d4de5fc7a564d2435775c413"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/reviewed-publication-scope.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/reviewed-publication-scope.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "007ffdffe2ea1c3984a0eadfa7726019ac742995df43a346cf447b7a9cc8038c"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/rollback-binding.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/rollback-binding.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e55fbdbc46ff7d71049742ff649d351ff326475d1355b3985b126c0e03ed7160"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/rollback-rendered.yaml",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/rollback-rendered.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "b031a6581a2107c73b12bcdfcf7cf0dd8b216b16b580e8cf8c99899a7c6c80b2"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/sealed-live-config.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/sealed-live-config.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "4a698751505b1bd39e05fc8095c65d28cbd811a5fed5b9076d05156c10c87d3f"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/security-summary.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/security-summary.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "afbc38bc3792946d8c204bedbcc2c3fa25e07d918e2026a65dd7e1be07c288a2"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/source-inventory.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/source-inventory.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "40d9e8852fe4c9e75b71f371d0fdae38664b068e7498711b0ac5671d0f41efb5"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/source-lock.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/source-lock.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "99c695f46a54ead4cfe8f560f3648bf4db19404fe198b156c740115c97d3ed40"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/test_change_guard.py",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/test_change_guard.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "3869bf841ced791679795d9fffe5161b585defa92597c5c76b76a8b8a2cbab11"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/test_verify_public.py",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/test_verify_public.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "89cfababd5f0c1b0fcdd22c67aa236c034279d7504772603001d375cf81bc6f5"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/validation.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/validation.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "1283644818fc54e6838bf98f531cf785cecaedb3e148b4f265d96fbeff4c3733"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/verify_public.py",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/verify_public.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "c3130c9dfb47172ec6b5928f2600b924b8f1b4c0c7ff6bc1322533c3d8bcf867"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-apps",
|
||||
"path": "bindings/policy-nexus-production-candidate.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/railiance-apps/bindings/policy-nexus-production-candidate.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "d6d34636e289949d1fd3debb5e2a002b9c9de485e1b462660f0818a7d1d73d22"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-apps",
|
||||
"path": "values/policy-nexus-production-candidate.yaml",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/railiance-apps/values/policy-nexus-production-candidate.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "6e0f5a529b450f6b8f00f6fc59c50a7e5b652520f0a370b199a49cb416fac062"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
{
|
||||
"workplan_id": "20adecb1-98b5-5a8e-9550-9aa0bc5087b8",
|
||||
"id": "99dc9648-2098-4388-89b3-9da27c02af0b",
|
||||
"topic_id": "cee7bedf-2b48-46ef-8601-006474f2ad7a",
|
||||
"title": "Confirmed exact Policy Nexus guardrail hosting disposition",
|
||||
"description": "Authenticated native ACCEPT of infd-20261011-policy-nexus-hosting-r1@1, review28d16691..., approval52a3c479-2cb1-4074-abec-6a88117ad596, dispb8bfa6c0-e879-4de2-8243-f4abb9bcd011 at01:14:23Z. Exact approved packet digest076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e, image4e0db6 and three paired evidence pins; Helm transition only, no Argo adoption. Fresh sealed preflight/context/capacity and actual serving verification required; deployment not yet executed at this receipt.",
|
||||
"decision_type": "made",
|
||||
"status": "resolved",
|
||||
"rationale": null,
|
||||
"decided_by": "native authenticated human approver (confirmed informed-decision receipt)",
|
||||
"decided_at": "2026-10-11T01:14:23Z",
|
||||
"deadline": "2026-10-12T23:59:59Z",
|
||||
"escalation_note": null,
|
||||
"superseded_by": null,
|
||||
"created_at": "2026-10-11T01:18:45.925752Z",
|
||||
"updated_at": "2026-10-11T01:18:45.925752Z",
|
||||
"workstream_id": "20adecb1-98b5-5a8e-9550-9aa0bc5087b8"
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"memo_id": "infd-20261011-policy-nexus-hosting-r1", "review": {"intake_state": "ready", "memo_id": "review-28d16691-3277-461e-aec6-53ad7a0538c7", "path": "/review?memo_id=review-28d16691-3277-461e-aec6-53ad7a0538c7", "stale": false}, "disposition_count": 1, "dispositions": [{"id": null, "approval_id": null, "submission_state": "confirmed", "disposition": {"actor": {"kind": "person", "sub": "uid=platform-root,ou=people,dc=netkingdom,dc=local"}, "approval_id": "52a3c479-2cb1-4074-abec-6a88117ad596", "at": "2026-10-11T01:14:23Z", "id": "disp-b8bfa6c0-e879-4de2-8243-f4abb9bcd011", "memo_id": "review-28d16691-3277-461e-aec6-53ad7a0538c7", "memo_version": 1, "note": null, "presentation_id": "pres-b25f8b48-396b-4052-ae9c-501d7f19ca26", "reasons": [], "verb": "accept"}, "approved_at": "2026-10-11T01:14:23+00:00", "decided_at": null}]}
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"memo_id": "infd-20261011-policy-nexus-hosting-r1", "review": {"intake_state": "ready", "memo_id": "review-28d16691-3277-461e-aec6-53ad7a0538c7", "path": "/review?memo_id=review-28d16691-3277-461e-aec6-53ad7a0538c7", "stale": false}, "disposition_count": 0, "dispositions": []}
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"memo_id": "infd-20261011-policy-nexus-hosting-r1", "version": 1, "register_event_id": "b462404c-b44a-43cd-8b22-c188812b8a4e", "revision_event_id": null, "publication_event_id": "162897da-3ce3-4107-94ce-38456ce0bd87", "review_event_id": "7554fd17-b1ee-4c69-aba3-c12b171a1256", "review_memo_id": "review-28d16691-3277-461e-aec6-53ad7a0538c7", "queue_status": "pending", "queue_detail": "queued", "workspace_url": "https://decisions.coulomb.social/decisions/infd-20261011-policy-nexus-hosting-r1?version=1", "outcome_review": {"intake_state": "not_submitted", "memo_id": "review-28d16691-3277-461e-aec6-53ad7a0538c7", "stale": false}, "human_dispositions": 0}
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
{
|
||||
"proposal_id": "POLICY-PUB-20261011-SECURITY-LAYER-V08-R1",
|
||||
"approval": {
|
||||
"approval_id": "52a3c479-2cb1-4074-abec-6a88117ad596",
|
||||
"disposition_id": "disp-b8bfa6c0-e879-4de2-8243-f4abb9bcd011"
|
||||
},
|
||||
"started_at": "2026-10-11T01:19:18.103362+00:00",
|
||||
"raw_output_withheld": true,
|
||||
"secret_values_observed": false,
|
||||
"attempted_helm_upgrade": false,
|
||||
"all_checks_pass": false,
|
||||
"headroom": {
|
||||
"node_ip": "92.205.62.239",
|
||||
"free_cpu_m": 540,
|
||||
"free_memory_mi": 6521,
|
||||
"surge_cpu_m": 10,
|
||||
"surge_memory_mi": 32,
|
||||
"pressure_checks_pass": true
|
||||
},
|
||||
"fresh_sealed_preflight_pass": true,
|
||||
"failure_class": "ValueError",
|
||||
"failure": "fixed supervised preflight/owner upgrade/post-release verification failed; raw outputs withheld",
|
||||
"decision_packet_sha256": "076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e"
|
||||
}
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,48 @@
|
|||
{
|
||||
"captured_at": "2026-10-11T01:25:22.146567+00:00",
|
||||
"https": true,
|
||||
"redirect_following": false,
|
||||
"checks": [
|
||||
{
|
||||
"path": "/",
|
||||
"status": 200,
|
||||
"expected_status": 200,
|
||||
"location": null,
|
||||
"content_security_policy_present": true,
|
||||
"nosniff": true,
|
||||
"hsts_present": false,
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"path": "/healthz",
|
||||
"status": 200,
|
||||
"expected_status": 200,
|
||||
"location": null,
|
||||
"content_security_policy_present": true,
|
||||
"nosniff": true,
|
||||
"hsts_present": false,
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"path": "/tenancy-posture.html",
|
||||
"status": 308,
|
||||
"expected_status": 308,
|
||||
"location": "/standards/tenancy-posture/v0.1/index.html",
|
||||
"content_security_policy_present": true,
|
||||
"nosniff": true,
|
||||
"hsts_present": false,
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"path": "/security-layer-probe-unexpected-path",
|
||||
"status": 404,
|
||||
"expected_status": 404,
|
||||
"location": null,
|
||||
"content_security_policy_present": true,
|
||||
"nosniff": true,
|
||||
"hsts_present": false,
|
||||
"passed": true
|
||||
}
|
||||
],
|
||||
"all_pass": true
|
||||
}
|
||||
|
|
@ -0,0 +1,72 @@
|
|||
{
|
||||
"proposal_id": "POLICY-PUB-20261011-SECURITY-LAYER-V08-R1",
|
||||
"approval": {
|
||||
"approval_id": "52a3c479-2cb1-4074-abec-6a88117ad596",
|
||||
"disposition_id": "disp-b8bfa6c0-e879-4de2-8243-f4abb9bcd011"
|
||||
},
|
||||
"started_at": "2026-10-11T01:20:45.684658+00:00",
|
||||
"raw_output_withheld": true,
|
||||
"secret_values_observed": false,
|
||||
"attempted_helm_upgrade": false,
|
||||
"all_checks_pass": false,
|
||||
"headroom": {
|
||||
"node_ip": "92.205.62.239",
|
||||
"free_cpu_m": 540,
|
||||
"free_memory_mi": 6521,
|
||||
"surge_cpu_m": 10,
|
||||
"surge_memory_mi": 32,
|
||||
"pressure_checks_pass": true
|
||||
},
|
||||
"fresh_sealed_preflight_pass": true,
|
||||
"rendered_identities": [
|
||||
{
|
||||
"kind": "NetworkPolicy",
|
||||
"name": "policy-nexus-default-deny",
|
||||
"namespace": null
|
||||
},
|
||||
{
|
||||
"kind": "NetworkPolicy",
|
||||
"name": "policy-nexus-traefik",
|
||||
"namespace": null
|
||||
},
|
||||
{
|
||||
"kind": "NetworkPolicy",
|
||||
"name": "policy-nexus-acme-solver",
|
||||
"namespace": null
|
||||
},
|
||||
{
|
||||
"kind": "ServiceAccount",
|
||||
"name": "policy-nexus",
|
||||
"namespace": null
|
||||
},
|
||||
{
|
||||
"kind": "Service",
|
||||
"name": "policy-nexus",
|
||||
"namespace": null
|
||||
},
|
||||
{
|
||||
"kind": "Deployment",
|
||||
"name": "policy-nexus",
|
||||
"namespace": null
|
||||
},
|
||||
{
|
||||
"kind": "Ingress",
|
||||
"name": "policy-nexus-http",
|
||||
"namespace": null
|
||||
},
|
||||
{
|
||||
"kind": "Ingress",
|
||||
"name": "policy-nexus-https",
|
||||
"namespace": null
|
||||
},
|
||||
{
|
||||
"kind": "Middleware",
|
||||
"name": "policy-nexus-https-redirect",
|
||||
"namespace": null
|
||||
}
|
||||
],
|
||||
"read_only_render_diagnosis": true,
|
||||
"failure_class": "RuntimeError",
|
||||
"failure": "fixed supervised preflight/owner upgrade/post-release verification failed; raw outputs withheld",
|
||||
"decision_packet_sha256": "076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e"
|
||||
}
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
{
|
||||
"workplan_id": "20adecb1-98b5-5a8e-9550-9aa0bc5087b8",
|
||||
"id": "f43c5864-6bf0-4c74-9659-679a231ce47b",
|
||||
"topic_id": null,
|
||||
"task_id": null,
|
||||
"decision_id": null,
|
||||
"event_type": "note",
|
||||
"summary": "PNEX-WP-0005 actual native publication complete: exact human R1 approval52a3c479; Helm9 deployed/Ready1, approved4e0db6 image and provenance/all9UID-defaultedconfigs pass.158publicHTTPS bytes match73currentdocuments+72oldimmutablepaths, TLSReady/health/legacy308/404. Sourcebinding reconciled and publisherplanfinished. Prior failedpre-actuation +namespace refinement preserved same trial; no rollback. Argo adoption separate.",
|
||||
"detail": {
|
||||
"approval_id": "52a3c479-2cb1-4074-abec-6a88117ad596",
|
||||
"source_count": {
|
||||
"open": 47,
|
||||
"residual": 2,
|
||||
"nonresidual": 45,
|
||||
"unfinished_tasks": 101
|
||||
},
|
||||
"hub_decision_id": "99dc9648-2098-4388-89b3-9da27c02af0b",
|
||||
"native_owner_commit": "67329ab",
|
||||
"whole_goal_completed": false,
|
||||
"workplan_completion_commit": "601724b",
|
||||
"production_selection_commit": "c435979"
|
||||
},
|
||||
"author": "codex",
|
||||
"session_id": null,
|
||||
"created_at": "2026-10-11T01:30:35.613391Z",
|
||||
"workstream_id": "20adecb1-98b5-5a8e-9550-9aa0bc5087b8"
|
||||
}
|
||||
|
|
@ -392,18 +392,10 @@
|
|||
"unfinished": 1
|
||||
},
|
||||
"policy-nexus": {
|
||||
"plans": [
|
||||
{
|
||||
"id": "PNEX-WP-0005",
|
||||
"file": "/home/worsch/policy-nexus/workplans/PNEX-WP-0005-security-layer-v08-publication.md",
|
||||
"status": "active",
|
||||
"flavor": "implementation",
|
||||
"unfinished_tasks": 1
|
||||
}
|
||||
],
|
||||
"open": 1,
|
||||
"nonresidual": 1,
|
||||
"unfinished": 1
|
||||
"plans": [],
|
||||
"open": 0,
|
||||
"nonresidual": 0,
|
||||
"unfinished": 0
|
||||
},
|
||||
"informed-decision": {
|
||||
"plans": [
|
||||
|
|
@ -427,8 +419,8 @@
|
|||
"unfinished": 5
|
||||
},
|
||||
"_total": {
|
||||
"open": 48,
|
||||
"nonresidual": 46,
|
||||
"unfinished": 102
|
||||
"open": 47,
|
||||
"nonresidual": 45,
|
||||
"unfinished": 101
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -344,3 +344,75 @@ the changed full execution render requires exact rereview. The existing
|
|||
ORGREF-WP-0002 project driver owns the cross-owner follow-through; no duplicate
|
||||
plan or foreign task list was created. Native structural receipts, adapters,
|
||||
contained execution and real login/MFA remain open.
|
||||
|
||||
|
||||
## Exact Policy Nexus hosting proposal ready for human disposition
|
||||
|
||||
Owner package commit `28b60d2` and RailianceApps candidate commit `6953a23`
|
||||
retain the independently agreed exact R1 hosting packet (manifest SHA256
|
||||
`a70fb22f75871a08358f1cdee2410797cb0a2f01c2001f0012d16866b20e28a8`).
|
||||
The original review gaps and failed probes remain separate from the final
|
||||
agreement. Actual package checks pass: nine packaging tests and Helm lint; ten
|
||||
new guard/public verification tests and independent negative probes pass.
|
||||
No production selection or live hosting changed.
|
||||
|
||||
Native memo `infd-20261011-policy-nexus-hosting-r1@1` is registered, published
|
||||
and intake-ready, review
|
||||
[review-28d16691-3277-461e-aec6-53ad7a0538c7](https://decisions.coulomb.social/review?memo_id=review-28d16691-3277-461e-aec6-53ad7a0538c7).
|
||||
The user elected to review there; that response itself is no deployment approval.
|
||||
The supervised record retains the exact packet before human submission.
|
||||
Fresh sealed UID/defaulted configuration, admission/diff, capacity, context and
|
||||
management-owner checks remain mandatory before any confirmed approved rollout.
|
||||
|
||||
|
||||
Gate House's actual T06 doctrine preparation is now source commit `f5e9365`.
|
||||
It proposes carrying the deterministic Staff/evidence tension explicitly and
|
||||
adding the requested Informed Decision catalogue row, while reporting the
|
||||
remaining emission guarantees as owed. This is an unsigned source proposal,
|
||||
not an accepted standard revision or a ruling. T06 is in progress; accepted
|
||||
v0.8 remains byte-identical.
|
||||
|
||||
Informed Decision purpose-hardening publication preparation uses only the
|
||||
existing admitted owner CI registry lane, exact immutable base7f5 and one
|
||||
policy module. Source workflow `f66de50` reached CI but failed on its copied
|
||||
module mode: private build umask made the file unreadable by inherited UID10001.
|
||||
The narrowly proven `COPY --chmod=0644` repair is commit `acecad8`; the failure
|
||||
is retained and registry/native release acceptance is still separate. Protected
|
||||
actual-data backup/restore, manual image-only Argo rollout and same-schema
|
||||
rollback are prepared protocol, not performed actions.
|
||||
|
||||
|
||||
## Accepted guardrails now served; publisher workplan finished
|
||||
|
||||
The exact Policy Nexus R1 disposition is confirmed: approval
|
||||
`52a3c479-2cb1-4074-abec-6a88117ad596` at01:14:23Z. Existing owner Helm
|
||||
upgrade completed01:23:42Z at revision9/deployed, Ready1/generation9. Fresh
|
||||
sealed preflight and all nine post-release UID/defaulted configurations match
|
||||
the approved change. All158 public HTTPS file hashes match the actual image,
|
||||
including73current documents and72original immutable paths. CertificateReady,
|
||||
index/health200, legacy308 and unknownpath404 pass. The original failed
|
||||
pre-actuation and namespace correction remain the same supervised trial; no
|
||||
rollback was needed or extra permission inferred.
|
||||
|
||||
Native owner proof is `rapp-policy-nexus` commit `67329ab`; canonical approved
|
||||
production selection is `railiance-apps` commit `c435979`. Publisher source
|
||||
plan PNEX-WP-0005 is finished in `601724b`. Argo onboarding remains
|
||||
RPF-WP-0043/RAPP-POLICY-NEXUS-WP-0002.
|
||||
|
||||
|
||||
After native publisher completion the same13-owner source count is **47 open
|
||||
plans:45nonresidual and2residual,101unfinished task blocks**. Initial49/48/105
|
||||
baseline and every prior checkpoint remain retained; current snapshot is
|
||||
[source-current-2026-10-11.json](evidence/2026-10-10-security-consolidation/source-current-2026-10-11.json).
|
||||
These are source workplan counts, not runtime safety scores. New RAPP-USER-ENGINE
|
||||
work and risk findings outside the original13owner baseline remain live records
|
||||
and are not hidden by this count.
|
||||
|
||||
The one-app catalogue executor is source commit `c89614e`, with a fresh
|
||||
dedicated User Engine owner agreement and21actual isolatedPostgreSQL checks
|
||||
on corrected b0dbbb97 source. Honest maintenance attribution, persistedoneuse,
|
||||
nativeDBclockexpiry, exactcreated-only recovery and ordinarydenial audit are
|
||||
verified mechanism evidence. Automatic drain excludes dead-lettered events;
|
||||
privileged later replay can revive them and needs separate owner reconciliation.
|
||||
NetKingdom exception review and exact founder decision remain pending; no
|
||||
application/binding row was inserted.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue