Record verified approved guardrail publication and remaining owner gates
This commit is contained in:
codex
parent
9ea453708f
commit
16837a26fb
16 changed files with 1833 additions and 15 deletions
|
|
@ -0,0 +1,37 @@
|
|||
{
|
||||
"workplan_id": null,
|
||||
"id": "74553c13-a1bf-47ad-bdc2-bc662743a087",
|
||||
"topic_id": null,
|
||||
"task_id": null,
|
||||
"decision_id": null,
|
||||
"event_type": "note",
|
||||
"summary": "Confirmed User Engine R2 approval executed: Ready1 exact f239 image, native advisory readback checks pass; real catalogue empty and USER26/28 remain open. Accepted security model/source conformance and publisher artifact prepared; Policy Nexus exact hosting R1 memo now intake-ready, no approval/deployment inferred. Forgejo shared default SA blocks CCR42, attached to ORGREF-WP-0002.",
|
||||
"detail": {
|
||||
"handoff_ids": [
|
||||
"PNEX-WP-0005",
|
||||
"USER-WP-0026",
|
||||
"USER-WP-0028",
|
||||
"INFD-WP-0009-T04",
|
||||
"KEY-WP-0039-T02",
|
||||
"MASON-WP-0010-T03",
|
||||
"WARDEN-WP-0044-T03",
|
||||
"ORGREF-WP-0002",
|
||||
"CCR-2026-0042"
|
||||
],
|
||||
"policy_memo_id": "infd-20261011-policy-nexus-hosting-r1",
|
||||
"policy_review_id": "review-28d16691-3277-461e-aec6-53ad7a0538c7",
|
||||
"user_approval_id": "0dd18a5a-5555-461e-8470-931d530435cf",
|
||||
"user_hub_decision_id": "b9ece441-f7a4-5f44-8cf2-243a24166ce6",
|
||||
"whole_goal_completed": false,
|
||||
"baseline_owner_source_count": {
|
||||
"open": 48,
|
||||
"residual": 2,
|
||||
"nonresidual": 46,
|
||||
"unfinished_tasks": 102
|
||||
}
|
||||
},
|
||||
"author": "codex",
|
||||
"session_id": null,
|
||||
"created_at": "2026-10-11T01:13:35.298178Z",
|
||||
"workstream_id": null
|
||||
}
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
{
|
||||
"proposal_id": "POLICY-PUB-20261011-SECURITY-LAYER-V08-R1",
|
||||
"approval": {
|
||||
"approval_id": "52a3c479-2cb1-4074-abec-6a88117ad596",
|
||||
"disposition_id": "disp-b8bfa6c0-e879-4de2-8243-f4abb9bcd011"
|
||||
},
|
||||
"started_at": "2026-10-11T01:23:27.564865+00:00",
|
||||
"raw_output_withheld": true,
|
||||
"secret_values_observed": false,
|
||||
"attempted_helm_upgrade": true,
|
||||
"all_checks_pass": true,
|
||||
"headroom": {
|
||||
"node_ip": "92.205.62.239",
|
||||
"free_cpu_m": 540,
|
||||
"free_memory_mi": 6521,
|
||||
"surge_cpu_m": 10,
|
||||
"surge_memory_mi": 32,
|
||||
"pressure_checks_pass": true
|
||||
},
|
||||
"fresh_sealed_preflight_pass": true,
|
||||
"helm_exit_code": 0,
|
||||
"helm_revision": 9,
|
||||
"image": "forgejo.coulomb.social/coulomb/policy-nexus@sha256:4e0db6a57eb00f577159aa6ee10f910dd67b03fd0541c6ce849f5426fdb99d06",
|
||||
"generation": 9,
|
||||
"observed_generation": 9,
|
||||
"ready_replicas": 1,
|
||||
"completed_at": "2026-10-11T01:23:42.112194+00:00",
|
||||
"decision_packet_sha256": "076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e"
|
||||
}
|
||||
|
|
@ -0,0 +1,121 @@
|
|||
"""Exact supervised owner Helm operation; credentials never leave the node."""
|
||||
import base64, datetime, hashlib, json, subprocess, sys
|
||||
if sys.flags.optimize: raise RuntimeError("Optimized interpreter refuses supervised execution")
|
||||
from pathlib import Path
|
||||
here=Path('/home/worsch/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal')
|
||||
manifest=Path('/tmp/policy-native-hosting-stage/manifest.json')
|
||||
assert hashlib.sha256(manifest.read_bytes()).hexdigest()=='a70fb22f75871a08358f1cdee2410797cb0a2f01c2001f0012d16866b20e28a8'
|
||||
for entry in json.loads(manifest.read_text()):
|
||||
current=Path('/home/worsch')/entry['repo']/entry['path']
|
||||
assert not current.is_symlink() and hashlib.sha256(current.read_bytes()).hexdigest()==entry['staged_sha256']
|
||||
assert hashlib.sha256((here/'decision-packet.md').read_bytes()).hexdigest()=='076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e'
|
||||
proposal=json.loads((here/'proposal.json').read_text())
|
||||
receipt=json.loads(Path('/tmp/security-policy-hosting-native-outcome-latest.json').read_text())
|
||||
assert receipt['memo_id']=='infd-20261011-policy-nexus-hosting-r1'
|
||||
assert receipt['review']['memo_id']=='review-28d16691-3277-461e-aec6-53ad7a0538c7'
|
||||
assert receipt['review']['stale'] is False and receipt['review']['intake_state']=='ready'
|
||||
accepted=[x for x in receipt['dispositions'] if x.get('submission_state')=='confirmed' and x.get('disposition',{}).get('verb')=='accept' and x['disposition'].get('memo_version')==1]
|
||||
assert len(accepted)==1,'Exact confirmed founder acceptance required'
|
||||
a=accepted[0]['disposition']
|
||||
assert a.get('approval_id')=='52a3c479-2cb1-4074-abec-6a88117ad596'
|
||||
assert a.get('id')=='disp-b8bfa6c0-e879-4de2-8243-f4abb9bcd011'
|
||||
assert a.get('memo_id')=='review-28d16691-3277-461e-aec6-53ad7a0538c7'
|
||||
assert a.get('actor')=={'kind':'person','sub':'uid=platform-root,ou=people,dc=netkingdom,dc=local'}
|
||||
assert a.get('at')=='2026-10-11T01:14:23Z'
|
||||
assert datetime.datetime.now(datetime.timezone.utc)<datetime.datetime.fromisoformat(proposal['execution_deadline'].replace('Z','+00:00'))
|
||||
for name,digest in proposal['preflight_source_hashes'].items():assert hashlib.sha256((here/name).read_bytes()).hexdigest()==digest
|
||||
chart=Path('/home/worsch/rapp-policy-nexus')
|
||||
files={}
|
||||
for item in proposal['chart_source_files']:
|
||||
p=chart/item['path'];data=p.read_bytes();assert hashlib.sha256(data).hexdigest()==item['sha256'];files[item['path']]=base64.b64encode(data).decode()
|
||||
values=(here/'candidate-values.yaml').read_bytes();assert hashlib.sha256(values).hexdigest()==proposal['candidate_values_sha256']
|
||||
binding=json.loads((here/'candidate-binding.json').read_text());assert binding==proposal['candidate']
|
||||
payload={'proposal':proposal,'approval':{'approval_id':a['approval_id'],'disposition_id':a['id']},'chart_files':files,'values':base64.b64encode(values).decode(),'candidate':(here/'candidate-rendered.yaml').read_text(),'baseline':(here/'rollback-rendered.yaml').read_text(),'sealed':json.loads((here/'sealed-live-config.json').read_text())['objects']}
|
||||
remote=r'''
|
||||
import base64,copy,datetime,hashlib,json,os,re,subprocess,sys,tempfile
|
||||
from pathlib import Path
|
||||
if sys.flags.optimize: raise RuntimeError("Optimized interpreter refuses supervised execution")
|
||||
import yaml
|
||||
exec(__GUARD__)
|
||||
p=json.loads(__PAYLOAD__); q=p['proposal']; env={**os.environ,'KUBECONFIG':'/etc/rancher/k3s/k3s.yaml'}
|
||||
r={'proposal_id':q['proposal_id'],'approval':p['approval'],'started_at':datetime.datetime.now(datetime.timezone.utc).isoformat(),'raw_output_withheld':True,'secret_values_observed':False,'attempted_helm_upgrade':False,'all_checks_pass':False}
|
||||
def run(args,body=None,timeout=90):
|
||||
return subprocess.run(args,input=body,text=True,capture_output=True,timeout=timeout,env=env)
|
||||
def get(args):
|
||||
x=run(['kubectl']+args+['-o','json']);assert x.returncode==0,'fixed metadata query failed';return json.loads(x.stdout)
|
||||
def quantity(value):
|
||||
m=re.fullmatch(r'([0-9]+)(m|Ki|Mi|Gi|Ti)?',str(value));assert m,'unsupported resource quantity'
|
||||
n=int(m[1]);unit=m[2];return n*{'m':0.001,'Ki':1024,'Mi':1024**2,'Gi':1024**3,'Ti':1024**4,None:1}[unit]
|
||||
try:
|
||||
assert datetime.datetime.now(datetime.timezone.utc)<datetime.datetime.fromisoformat(q['execution_deadline'].replace('Z','+00:00'))
|
||||
nodes=get(['get','nodes'])['items'];assert len(nodes)==1
|
||||
node=nodes[0];assert any(x['address']=='92.205.62.239' for x in node['status']['addresses'])
|
||||
conditions={x['type']:x['status'] for x in node['status']['conditions']};assert conditions.get('Ready')=='True'
|
||||
assert all(conditions.get(k)=='False' for k in ['MemoryPressure','DiskPressure','PIDPressure'])
|
||||
description=run(['kubectl','describe','node',node['metadata']['name']]);assert description.returncode==0
|
||||
table=description.stdout.split('Allocated resources:',1)[1]
|
||||
cpu=re.search(r'^\s*cpu\s+(\S+)\s+\(',table,re.M);mem=re.search(r'^\s*memory\s+(\S+)\s+\(',table,re.M);assert cpu and mem
|
||||
free_cpu=quantity(node['status']['allocatable']['cpu'])-quantity(cpu[1]);free_mem=quantity(node['status']['allocatable']['memory'])-quantity(mem[1])
|
||||
assert free_cpu>=0.010 and free_mem>=32*1024**2
|
||||
r['headroom']={'node_ip':'92.205.62.239','free_cpu_m':round(free_cpu*1000),'free_memory_mi':int(free_mem/1024**2),'surge_cpu_m':10,'surge_memory_mi':32,'pressure_checks_pass':True}
|
||||
apps=get(['get','applications.argoproj.io','-n','argocd'])['items']
|
||||
for app in apps:
|
||||
spec=app.get('spec',{});assert spec.get('destination',{}).get('namespace')!='policy-nexus'
|
||||
assert 'policy-nexus' not in app['metadata']['name']
|
||||
assert all('policy-nexus' not in str(src.get('path','')) for src in [spec.get('source',{})]+spec.get('sources',[]))
|
||||
status=run(['helm','status','policy-nexus','--namespace','policy-nexus','--output','json']);assert status.returncode==0
|
||||
h=json.loads(status.stdout);assert h['version']==8 and h['info']['status']=='deployed' and h['namespace']=='policy-nexus'
|
||||
candidate=list(yaml.safe_load_all(p['candidate']));baseline=list(yaml.safe_load_all(p['baseline']));strict_source(baseline,candidate)
|
||||
live=[get(['get',x['kind'],x['metadata']['name'],'-n','policy-nexus']) for x in baseline]
|
||||
strict_baseline(baseline,live,p['sealed'])
|
||||
for x in live:
|
||||
md=x['metadata'];ann=md.get('annotations',{});assert md.get('labels',{}).get('app.kubernetes.io/managed-by')=='Helm'
|
||||
assert ann.get('meta.helm.sh/release-name')=='policy-nexus' and ann.get('meta.helm.sh/release-namespace')=='policy-nexus' and not ann.get('argocd.argoproj.io/tracking-id')
|
||||
body=json.dumps({'apiVersion':'v1','kind':'List','items':candidate})
|
||||
dry=run(['kubectl','apply','--dry-run=server','-n','policy-nexus','-f','-','-o','json'],body);assert dry.returncode==0
|
||||
admitted=json.loads(dry.stdout);strict_admitted(live,candidate,admitted.get('items',[admitted]))
|
||||
diff=run(['kubectl','diff','-n','policy-nexus','-f','-'],body);assert diff.returncode in [0,1]
|
||||
r['fresh_sealed_preflight_pass']=True
|
||||
with tempfile.TemporaryDirectory(prefix='policy-nexus-approved-') as directory:
|
||||
root=Path(directory);os.chmod(root,0o700)
|
||||
for name,data in p['chart_files'].items():
|
||||
relative=Path(name);assert relative.parts[:2]==('helm','policy-nexus') and '..' not in relative.parts
|
||||
target=root/relative;target.parent.mkdir(parents=True,exist_ok=True);target.write_bytes(base64.b64decode(data))
|
||||
valuefile=root/'candidate-values.yaml';valuefile.write_bytes(base64.b64decode(p['values']))
|
||||
chart=root/'helm/policy-nexus'
|
||||
rendered=run(['helm','template','policy-nexus',str(chart),'--namespace','policy-nexus','--values',str(valuefile)])
|
||||
assert rendered.returncode==0
|
||||
exact=list(yaml.safe_load_all(rendered.stdout))
|
||||
for obj in exact:
|
||||
# Helm binds omitted namespaced metadata to its fixed --namespace target.
|
||||
md=obj['metadata']
|
||||
if 'namespace' not in md:md['namespace']='policy-nexus'
|
||||
assert md['namespace']=='policy-nexus'
|
||||
assert normalize(objects(exact))==normalize(objects(candidate))
|
||||
r['attempted_helm_upgrade']=True
|
||||
upgrade=run(['helm','upgrade','policy-nexus',str(chart),'--namespace','policy-nexus','--values',str(valuefile),'--atomic','--wait','--timeout','5m'],timeout=330)
|
||||
r['helm_exit_code']=upgrade.returncode
|
||||
assert upgrade.returncode==0,'owner atomic upgrade failed'
|
||||
after=[get(['get',x['kind'],x['metadata']['name'],'-n','policy-nexus']) for x in baseline]
|
||||
expected,_=planned(live,candidate)
|
||||
for key,x in objects(after).items():
|
||||
wanted=copy.deepcopy(expected[key]);actual=copy.deepcopy(x)
|
||||
if key==('Deployment','policy-nexus'):
|
||||
# Deployment controller's rollout counter is bookkeeping, not a source change.
|
||||
for doc in [wanted,actual]:doc['metadata'].get('annotations',{}).pop('deployment.kubernetes.io/revision',None)
|
||||
assert configuration(wanted)==configuration(actual),'post-release configuration differs'
|
||||
deployment=objects(after)[('Deployment','policy-nexus')];st=deployment['status']
|
||||
assert st.get('observedGeneration')==deployment['metadata']['generation'] and st.get('readyReplicas')==1 and st.get('updatedReplicas')==1
|
||||
status=run(['helm','status','policy-nexus','--namespace','policy-nexus','--output','json']);assert status.returncode==0
|
||||
h=json.loads(status.stdout);assert h['version']==9 and h['info']['status']=='deployed'
|
||||
r.update(all_checks_pass=True,helm_revision=h['version'],image=deployment['spec']['template']['spec']['containers'][0]['image'],generation=deployment['metadata']['generation'],observed_generation=st['observedGeneration'],ready_replicas=st['readyReplicas'],completed_at=datetime.datetime.now(datetime.timezone.utc).isoformat())
|
||||
except Exception as error:
|
||||
r['failure_class']=type(error).__name__;r['failure']='fixed supervised preflight/owner upgrade/post-release verification failed; raw outputs withheld'
|
||||
print(json.dumps(r));sys.exit(0 if r['all_checks_pass'] else 1)
|
||||
'''.replace('__GUARD__',repr((here/'change_guard.py').read_text())).replace('__PAYLOAD__',repr(json.dumps(payload)))
|
||||
result=subprocess.run(['ssh','railiance01','python3 -'],input=remote,text=True,capture_output=True,timeout=450)
|
||||
try:out=json.loads(result.stdout)
|
||||
except (ValueError,TypeError):out={'all_checks_pass':False,'failure':'SSH safe receipt unavailable','raw_output_withheld':True}
|
||||
out['decision_packet_sha256']=hashlib.sha256((here/'decision-packet.md').read_bytes()).hexdigest()
|
||||
Path('/tmp/security-policy-approved-owner-execution.json').write_text(json.dumps(out,indent=2)+'\n')
|
||||
print(json.dumps(out));raise SystemExit(0 if result.returncode==0 and out.get('all_checks_pass') is True else 1)
|
||||
|
|
@ -0,0 +1,212 @@
|
|||
[
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/candidate-binding.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/candidate-binding.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "d6d34636e289949d1fd3debb5e2a002b9c9de485e1b462660f0818a7d1d73d22"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/candidate-rendered.yaml",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/candidate-rendered.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "6ea659a33cadd9ee871eda744d737cf4b477b56aeb2e1033f4354987c3125b00"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/candidate-values.yaml",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/candidate-values.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "6e0f5a529b450f6b8f00f6fc59c50a7e5b652520f0a370b199a49cb416fac062"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/change_guard.py",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/change_guard.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f82b95f11ac17a747468ea5e8afd41cb741383c5d4af7609eee1903e1c33acec"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/content-review.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/content-review.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "0e286ce72f63df75c181131722addaf5b26d4f63dc1aa8fc9ef90e09704feb6e"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/decision-packet.md",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/decision-packet.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/intake.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/intake.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "eee7248c1e23a05d525c5efd541374f491754c5dad6513801d331ea468e55efa"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/lifecycle-commands.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/lifecycle-commands.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "bd40a9b02b2a5f17686921dca7c12e8a84be2698d2e127bb10a66bfae4020764"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/live-baseline.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/live-baseline.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "c118d19b760990800ce5f2028e94b9259463722afcdb3743ac95cbeff6b8aac9"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/memo.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/memo.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "fa50ea46953863ec449e827ae73bcdd06f0567f767378746b82b36e8f075a406"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/native-preflight.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/native-preflight.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "19df63011efdf8c9453d4e18d320df4895051d3a681318a09c470befc055744e"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/preflight.py",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/preflight.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "3191a97c8dbc8d79cfab8b028f5bf1e24fb765d7e72db3d327affac2bb631851"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/proposal.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/proposal.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f8aff82fc7cd8b7443803351abf08b5e0590fa6daa1622d33f53429be63a2e7f"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/public-verification-plan.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/public-verification-plan.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "94c919b8e17f27b34aeab8dcad2d9ee8d5c45492057a3adeeb68b531da4b4ca8"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/publication-manifest.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/publication-manifest.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "ba53cc4900e6bb9ab8aa4bac4e58cb5fe7a03d656bafb3f9cb3d9c8ebff7843a"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/published-verification.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/published-verification.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "7c8c4cf74ce642e31f294fadba601c3504c481e0ae34f3a59dc831c6a0496af9"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/review-refinement.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/review-refinement.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "526f5f95e3ae1be10f0ac549b9f021606b8fb522d4de5fc7a564d2435775c413"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/reviewed-publication-scope.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/reviewed-publication-scope.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "007ffdffe2ea1c3984a0eadfa7726019ac742995df43a346cf447b7a9cc8038c"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/rollback-binding.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/rollback-binding.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e55fbdbc46ff7d71049742ff649d351ff326475d1355b3985b126c0e03ed7160"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/rollback-rendered.yaml",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/rollback-rendered.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "b031a6581a2107c73b12bcdfcf7cf0dd8b216b16b580e8cf8c99899a7c6c80b2"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/sealed-live-config.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/sealed-live-config.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "4a698751505b1bd39e05fc8095c65d28cbd811a5fed5b9076d05156c10c87d3f"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/security-summary.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/security-summary.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "afbc38bc3792946d8c204bedbcc2c3fa25e07d918e2026a65dd7e1be07c288a2"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/source-inventory.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/source-inventory.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "40d9e8852fe4c9e75b71f371d0fdae38664b068e7498711b0ac5671d0f41efb5"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/source-lock.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/source-lock.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "99c695f46a54ead4cfe8f560f3648bf4db19404fe198b156c740115c97d3ed40"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/test_change_guard.py",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/test_change_guard.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "3869bf841ced791679795d9fffe5161b585defa92597c5c76b76a8b8a2cbab11"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/test_verify_public.py",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/test_verify_public.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "89cfababd5f0c1b0fcdd22c67aa236c034279d7504772603001d375cf81bc6f5"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/validation.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/validation.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "1283644818fc54e6838bf98f531cf785cecaedb3e148b4f265d96fbeff4c3733"
|
||||
},
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/verify_public.py",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/verify_public.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "c3130c9dfb47172ec6b5928f2600b924b8f1b4c0c7ff6bc1322533c3d8bcf867"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-apps",
|
||||
"path": "bindings/policy-nexus-production-candidate.json",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/railiance-apps/bindings/policy-nexus-production-candidate.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "d6d34636e289949d1fd3debb5e2a002b9c9de485e1b462660f0818a7d1d73d22"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-apps",
|
||||
"path": "values/policy-nexus-production-candidate.yaml",
|
||||
"staged_path": "/tmp/policy-native-hosting-stage/railiance-apps/values/policy-nexus-production-candidate.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "6e0f5a529b450f6b8f00f6fc59c50a7e5b652520f0a370b199a49cb416fac062"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
{
|
||||
"workplan_id": "20adecb1-98b5-5a8e-9550-9aa0bc5087b8",
|
||||
"id": "99dc9648-2098-4388-89b3-9da27c02af0b",
|
||||
"topic_id": "cee7bedf-2b48-46ef-8601-006474f2ad7a",
|
||||
"title": "Confirmed exact Policy Nexus guardrail hosting disposition",
|
||||
"description": "Authenticated native ACCEPT of infd-20261011-policy-nexus-hosting-r1@1, review28d16691..., approval52a3c479-2cb1-4074-abec-6a88117ad596, dispb8bfa6c0-e879-4de2-8243-f4abb9bcd011 at01:14:23Z. Exact approved packet digest076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e, image4e0db6 and three paired evidence pins; Helm transition only, no Argo adoption. Fresh sealed preflight/context/capacity and actual serving verification required; deployment not yet executed at this receipt.",
|
||||
"decision_type": "made",
|
||||
"status": "resolved",
|
||||
"rationale": null,
|
||||
"decided_by": "native authenticated human approver (confirmed informed-decision receipt)",
|
||||
"decided_at": "2026-10-11T01:14:23Z",
|
||||
"deadline": "2026-10-12T23:59:59Z",
|
||||
"escalation_note": null,
|
||||
"superseded_by": null,
|
||||
"created_at": "2026-10-11T01:18:45.925752Z",
|
||||
"updated_at": "2026-10-11T01:18:45.925752Z",
|
||||
"workstream_id": "20adecb1-98b5-5a8e-9550-9aa0bc5087b8"
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"memo_id": "infd-20261011-policy-nexus-hosting-r1", "review": {"intake_state": "ready", "memo_id": "review-28d16691-3277-461e-aec6-53ad7a0538c7", "path": "/review?memo_id=review-28d16691-3277-461e-aec6-53ad7a0538c7", "stale": false}, "disposition_count": 1, "dispositions": [{"id": null, "approval_id": null, "submission_state": "confirmed", "disposition": {"actor": {"kind": "person", "sub": "uid=platform-root,ou=people,dc=netkingdom,dc=local"}, "approval_id": "52a3c479-2cb1-4074-abec-6a88117ad596", "at": "2026-10-11T01:14:23Z", "id": "disp-b8bfa6c0-e879-4de2-8243-f4abb9bcd011", "memo_id": "review-28d16691-3277-461e-aec6-53ad7a0538c7", "memo_version": 1, "note": null, "presentation_id": "pres-b25f8b48-396b-4052-ae9c-501d7f19ca26", "reasons": [], "verb": "accept"}, "approved_at": "2026-10-11T01:14:23+00:00", "decided_at": null}]}
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"memo_id": "infd-20261011-policy-nexus-hosting-r1", "review": {"intake_state": "ready", "memo_id": "review-28d16691-3277-461e-aec6-53ad7a0538c7", "path": "/review?memo_id=review-28d16691-3277-461e-aec6-53ad7a0538c7", "stale": false}, "disposition_count": 0, "dispositions": []}
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"memo_id": "infd-20261011-policy-nexus-hosting-r1", "version": 1, "register_event_id": "b462404c-b44a-43cd-8b22-c188812b8a4e", "revision_event_id": null, "publication_event_id": "162897da-3ce3-4107-94ce-38456ce0bd87", "review_event_id": "7554fd17-b1ee-4c69-aba3-c12b171a1256", "review_memo_id": "review-28d16691-3277-461e-aec6-53ad7a0538c7", "queue_status": "pending", "queue_detail": "queued", "workspace_url": "https://decisions.coulomb.social/decisions/infd-20261011-policy-nexus-hosting-r1?version=1", "outcome_review": {"intake_state": "not_submitted", "memo_id": "review-28d16691-3277-461e-aec6-53ad7a0538c7", "stale": false}, "human_dispositions": 0}
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
{
|
||||
"proposal_id": "POLICY-PUB-20261011-SECURITY-LAYER-V08-R1",
|
||||
"approval": {
|
||||
"approval_id": "52a3c479-2cb1-4074-abec-6a88117ad596",
|
||||
"disposition_id": "disp-b8bfa6c0-e879-4de2-8243-f4abb9bcd011"
|
||||
},
|
||||
"started_at": "2026-10-11T01:19:18.103362+00:00",
|
||||
"raw_output_withheld": true,
|
||||
"secret_values_observed": false,
|
||||
"attempted_helm_upgrade": false,
|
||||
"all_checks_pass": false,
|
||||
"headroom": {
|
||||
"node_ip": "92.205.62.239",
|
||||
"free_cpu_m": 540,
|
||||
"free_memory_mi": 6521,
|
||||
"surge_cpu_m": 10,
|
||||
"surge_memory_mi": 32,
|
||||
"pressure_checks_pass": true
|
||||
},
|
||||
"fresh_sealed_preflight_pass": true,
|
||||
"failure_class": "ValueError",
|
||||
"failure": "fixed supervised preflight/owner upgrade/post-release verification failed; raw outputs withheld",
|
||||
"decision_packet_sha256": "076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e"
|
||||
}
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,48 @@
|
|||
{
|
||||
"captured_at": "2026-10-11T01:25:22.146567+00:00",
|
||||
"https": true,
|
||||
"redirect_following": false,
|
||||
"checks": [
|
||||
{
|
||||
"path": "/",
|
||||
"status": 200,
|
||||
"expected_status": 200,
|
||||
"location": null,
|
||||
"content_security_policy_present": true,
|
||||
"nosniff": true,
|
||||
"hsts_present": false,
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"path": "/healthz",
|
||||
"status": 200,
|
||||
"expected_status": 200,
|
||||
"location": null,
|
||||
"content_security_policy_present": true,
|
||||
"nosniff": true,
|
||||
"hsts_present": false,
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"path": "/tenancy-posture.html",
|
||||
"status": 308,
|
||||
"expected_status": 308,
|
||||
"location": "/standards/tenancy-posture/v0.1/index.html",
|
||||
"content_security_policy_present": true,
|
||||
"nosniff": true,
|
||||
"hsts_present": false,
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"path": "/security-layer-probe-unexpected-path",
|
||||
"status": 404,
|
||||
"expected_status": 404,
|
||||
"location": null,
|
||||
"content_security_policy_present": true,
|
||||
"nosniff": true,
|
||||
"hsts_present": false,
|
||||
"passed": true
|
||||
}
|
||||
],
|
||||
"all_pass": true
|
||||
}
|
||||
|
|
@ -0,0 +1,72 @@
|
|||
{
|
||||
"proposal_id": "POLICY-PUB-20261011-SECURITY-LAYER-V08-R1",
|
||||
"approval": {
|
||||
"approval_id": "52a3c479-2cb1-4074-abec-6a88117ad596",
|
||||
"disposition_id": "disp-b8bfa6c0-e879-4de2-8243-f4abb9bcd011"
|
||||
},
|
||||
"started_at": "2026-10-11T01:20:45.684658+00:00",
|
||||
"raw_output_withheld": true,
|
||||
"secret_values_observed": false,
|
||||
"attempted_helm_upgrade": false,
|
||||
"all_checks_pass": false,
|
||||
"headroom": {
|
||||
"node_ip": "92.205.62.239",
|
||||
"free_cpu_m": 540,
|
||||
"free_memory_mi": 6521,
|
||||
"surge_cpu_m": 10,
|
||||
"surge_memory_mi": 32,
|
||||
"pressure_checks_pass": true
|
||||
},
|
||||
"fresh_sealed_preflight_pass": true,
|
||||
"rendered_identities": [
|
||||
{
|
||||
"kind": "NetworkPolicy",
|
||||
"name": "policy-nexus-default-deny",
|
||||
"namespace": null
|
||||
},
|
||||
{
|
||||
"kind": "NetworkPolicy",
|
||||
"name": "policy-nexus-traefik",
|
||||
"namespace": null
|
||||
},
|
||||
{
|
||||
"kind": "NetworkPolicy",
|
||||
"name": "policy-nexus-acme-solver",
|
||||
"namespace": null
|
||||
},
|
||||
{
|
||||
"kind": "ServiceAccount",
|
||||
"name": "policy-nexus",
|
||||
"namespace": null
|
||||
},
|
||||
{
|
||||
"kind": "Service",
|
||||
"name": "policy-nexus",
|
||||
"namespace": null
|
||||
},
|
||||
{
|
||||
"kind": "Deployment",
|
||||
"name": "policy-nexus",
|
||||
"namespace": null
|
||||
},
|
||||
{
|
||||
"kind": "Ingress",
|
||||
"name": "policy-nexus-http",
|
||||
"namespace": null
|
||||
},
|
||||
{
|
||||
"kind": "Ingress",
|
||||
"name": "policy-nexus-https",
|
||||
"namespace": null
|
||||
},
|
||||
{
|
||||
"kind": "Middleware",
|
||||
"name": "policy-nexus-https-redirect",
|
||||
"namespace": null
|
||||
}
|
||||
],
|
||||
"read_only_render_diagnosis": true,
|
||||
"failure_class": "RuntimeError",
|
||||
"failure": "fixed supervised preflight/owner upgrade/post-release verification failed; raw outputs withheld",
|
||||
"decision_packet_sha256": "076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e"
|
||||
}
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
{
|
||||
"workplan_id": "20adecb1-98b5-5a8e-9550-9aa0bc5087b8",
|
||||
"id": "f43c5864-6bf0-4c74-9659-679a231ce47b",
|
||||
"topic_id": null,
|
||||
"task_id": null,
|
||||
"decision_id": null,
|
||||
"event_type": "note",
|
||||
"summary": "PNEX-WP-0005 actual native publication complete: exact human R1 approval52a3c479; Helm9 deployed/Ready1, approved4e0db6 image and provenance/all9UID-defaultedconfigs pass.158publicHTTPS bytes match73currentdocuments+72oldimmutablepaths, TLSReady/health/legacy308/404. Sourcebinding reconciled and publisherplanfinished. Prior failedpre-actuation +namespace refinement preserved same trial; no rollback. Argo adoption separate.",
|
||||
"detail": {
|
||||
"approval_id": "52a3c479-2cb1-4074-abec-6a88117ad596",
|
||||
"source_count": {
|
||||
"open": 47,
|
||||
"residual": 2,
|
||||
"nonresidual": 45,
|
||||
"unfinished_tasks": 101
|
||||
},
|
||||
"hub_decision_id": "99dc9648-2098-4388-89b3-9da27c02af0b",
|
||||
"native_owner_commit": "67329ab",
|
||||
"whole_goal_completed": false,
|
||||
"workplan_completion_commit": "601724b",
|
||||
"production_selection_commit": "c435979"
|
||||
},
|
||||
"author": "codex",
|
||||
"session_id": null,
|
||||
"created_at": "2026-10-11T01:30:35.613391Z",
|
||||
"workstream_id": "20adecb1-98b5-5a8e-9550-9aa0bc5087b8"
|
||||
}
|
||||
|
|
@ -392,18 +392,10 @@
|
|||
"unfinished": 1
|
||||
},
|
||||
"policy-nexus": {
|
||||
"plans": [
|
||||
{
|
||||
"id": "PNEX-WP-0005",
|
||||
"file": "/home/worsch/policy-nexus/workplans/PNEX-WP-0005-security-layer-v08-publication.md",
|
||||
"status": "active",
|
||||
"flavor": "implementation",
|
||||
"unfinished_tasks": 1
|
||||
}
|
||||
],
|
||||
"open": 1,
|
||||
"nonresidual": 1,
|
||||
"unfinished": 1
|
||||
"plans": [],
|
||||
"open": 0,
|
||||
"nonresidual": 0,
|
||||
"unfinished": 0
|
||||
},
|
||||
"informed-decision": {
|
||||
"plans": [
|
||||
|
|
@ -427,8 +419,8 @@
|
|||
"unfinished": 5
|
||||
},
|
||||
"_total": {
|
||||
"open": 48,
|
||||
"nonresidual": 46,
|
||||
"unfinished": 102
|
||||
"open": 47,
|
||||
"nonresidual": 45,
|
||||
"unfinished": 101
|
||||
}
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue