diff --git a/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/adapter-result.json b/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/adapter-result.json new file mode 100644 index 00000000..71bc1cba --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/adapter-result.json @@ -0,0 +1,83 @@ +{ + "target": "adapter", + "source_revision": "d328a2601095686f74376d87791bff01e2a3a2a3", + "returncode": 1, + "seconds": 44.29, + "argv": [ + "bwrap", + "--unshare-net", + "--unshare-pid", + "--die-with-parent", + "--new-session", + "--ro-bind", + "/usr", + "/usr", + "--ro-bind", + "/lib", + "/lib", + "--ro-bind", + "/lib64", + "/lib64", + "--symlink", + "usr/bin", + "/bin", + "--proc", + "/proc", + "--dev", + "/dev", + "--tmpfs", + "/tmp", + "--bind", + "/tmp/custodian-resume-adapter-nvx83dsk", + "/work", + "--ro-bind", + "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64", + "/toolchain", + "--ro-bind", + "/home/worsch/go/pkg/mod", + "/modules", + "--chdir", + "/work/source", + "--clearenv", + "--setenv", + "PATH", + "/toolchain/bin:/usr/bin:/bin", + "--setenv", + "HOME", + "/work/home", + "--setenv", + "GOTOOLCHAIN", + "local", + "--setenv", + "GOPROXY", + "off", + "--setenv", + "GOSUMDB", + "off", + "--setenv", + "GOMODCACHE", + "/modules", + "--setenv", + "GOCACHE", + "/work/gocache", + "--setenv", + "GOMAXPROCS", + "4", + "--setenv", + "CGO_ENABLED", + "0", + "--", + "go", + "test", + "-p", + "4", + "-json", + "./...", + "-count=1" + ], + "workspace": "/tmp/custodian-resume-adapter-nvx83dsk", + "network": "disabled", + "pid_namespace": "private", + "real_credentials": false, + "canonical_owner_modified": false +} diff --git a/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/adapter-test.jsonl b/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/adapter-test.jsonl new file mode 100644 index 00000000..3b35ed38 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/adapter-test.jsonl @@ -0,0 +1,148 @@ +{"ImportPath":"github.com/netkingdom/access-engine/testsupport/signfixture","Action":"build-output","Output":"# github.com/netkingdom/access-engine/testsupport/signfixture\n"} +{"ImportPath":"github.com/netkingdom/access-engine/testsupport/signfixture","Action":"build-output","Output":"testsupport/signfixture/sign.go:1:1: expected 'package', found 'EOF'\n"} +{"ImportPath":"github.com/netkingdom/access-engine/testsupport/signfixture","Action":"build-fail"} +{"Time":"2026-10-17T22:31:55.879381978Z","Action":"start","Package":"github.com/netkingdom/access-engine/testsupport/signfixture"} +{"Time":"2026-10-17T22:31:55.879430682Z","Action":"output","Package":"github.com/netkingdom/access-engine/testsupport/signfixture","Output":"FAIL\tgithub.com/netkingdom/access-engine/testsupport/signfixture [setup failed]\n"} +{"Time":"2026-10-17T22:31:55.879451356Z","Action":"fail","Package":"github.com/netkingdom/access-engine/testsupport/signfixture","Elapsed":0,"FailedBuild":"github.com/netkingdom/access-engine/testsupport/signfixture"} +{"Time":"2026-10-17T22:32:14.040406228Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/sign"} +{"Time":"2026-10-17T22:32:14.04045349Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Output":"? \tgithub.com/netkingdom/access-engine/internal/sign\t[no test files]\n"} +{"Time":"2026-10-17T22:32:14.040467818Z","Action":"skip","Package":"github.com/netkingdom/access-engine/internal/sign","Elapsed":0} +{"Time":"2026-10-17T22:32:14.040490953Z","Action":"start","Package":"github.com/netkingdom/access-engine/pkg/api"} +{"Time":"2026-10-17T22:32:14.040499044Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Output":"? \tgithub.com/netkingdom/access-engine/pkg/api\t[no test files]\n"} +{"Time":"2026-10-17T22:32:14.040506116Z","Action":"skip","Package":"github.com/netkingdom/access-engine/pkg/api","Elapsed":0} +{"Time":"2026-10-17T22:32:41.369193307Z","Action":"start","Package":"github.com/netkingdom/access-engine/pkg/decisionpep"} +{"Time":"2026-10-17T22:32:41.403637447Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestAuthenticDecisionProducerCanonicalPrecision"} +{"Time":"2026-10-17T22:32:41.403704906Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestAuthenticDecisionProducerCanonicalPrecision","Output":"=== RUN TestAuthenticDecisionProducerCanonicalPrecision\n"} +{"Time":"2026-10-17T22:32:41.453721935Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestAuthenticDecisionProducerCanonicalPrecision","Output":"--- PASS: TestAuthenticDecisionProducerCanonicalPrecision (0.05s)\n"} +{"Time":"2026-10-17T22:32:41.453807367Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestAuthenticDecisionProducerCanonicalPrecision","Elapsed":0.05} +{"Time":"2026-10-17T22:32:41.453849716Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings"} +{"Time":"2026-10-17T22:32:41.453868047Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings","Output":"=== RUN TestDecisionAdverseBindings\n"} +{"Time":"2026-10-17T22:32:41.454132581Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/submitted"} +{"Time":"2026-10-17T22:32:41.454216598Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/submitted","Output":"=== RUN TestDecisionAdverseBindings/submitted\n"} +{"Time":"2026-10-17T22:32:41.473479791Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/submitted","Output":"--- PASS: TestDecisionAdverseBindings/submitted (0.00s)\n"} +{"Time":"2026-10-17T22:32:41.473623111Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/submitted","Elapsed":0} +{"Time":"2026-10-17T22:32:41.473684223Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-audience"} +{"Time":"2026-10-17T22:32:41.473698219Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-audience","Output":"=== RUN TestDecisionAdverseBindings/caller-audience\n"} +{"Time":"2026-10-17T22:32:41.476643575Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-audience","Output":"--- PASS: TestDecisionAdverseBindings/caller-audience (0.00s)\n"} +{"Time":"2026-10-17T22:32:41.476711015Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-audience","Elapsed":0} +{"Time":"2026-10-17T22:32:41.476725205Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/future-begin"} +{"Time":"2026-10-17T22:32:41.47673482Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/future-begin","Output":"=== RUN TestDecisionAdverseBindings/future-begin\n"} +{"Time":"2026-10-17T22:32:41.484465498Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/future-begin","Output":"--- PASS: TestDecisionAdverseBindings/future-begin (0.01s)\n"} +{"Time":"2026-10-17T22:32:41.484534793Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/future-begin","Elapsed":0.01} +{"Time":"2026-10-17T22:32:41.484551747Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/excess-TTL"} +{"Time":"2026-10-17T22:32:41.484561859Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/excess-TTL","Output":"=== RUN TestDecisionAdverseBindings/excess-TTL\n"} +{"Time":"2026-10-17T22:32:41.488464285Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/excess-TTL","Output":"--- PASS: TestDecisionAdverseBindings/excess-TTL (0.00s)\n"} +{"Time":"2026-10-17T22:32:41.491973975Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/excess-TTL","Elapsed":0} +{"Time":"2026-10-17T22:32:41.492045043Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/unsigned"} +{"Time":"2026-10-17T22:32:41.49205701Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/unsigned","Output":"=== RUN TestDecisionAdverseBindings/unsigned\n"} +{"Time":"2026-10-17T22:32:41.501625367Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/unsigned","Output":"--- PASS: TestDecisionAdverseBindings/unsigned (0.00s)\n"} +{"Time":"2026-10-17T22:32:41.501698097Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/unsigned","Elapsed":0} +{"Time":"2026-10-17T22:32:41.501715014Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/evaluator"} +{"Time":"2026-10-17T22:32:41.501726504Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/evaluator","Output":"=== RUN TestDecisionAdverseBindings/evaluator\n"} +{"Time":"2026-10-17T22:32:41.501739169Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/evaluator","Output":"--- PASS: TestDecisionAdverseBindings/evaluator (0.00s)\n"} +{"Time":"2026-10-17T22:32:41.501750594Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/evaluator","Elapsed":0} +{"Time":"2026-10-17T22:32:41.501786091Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy"} +{"Time":"2026-10-17T22:32:41.501795771Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy","Output":"=== RUN TestDecisionAdverseBindings/policy\n"} +{"Time":"2026-10-17T22:32:41.508415224Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy","Output":"--- PASS: TestDecisionAdverseBindings/policy (0.01s)\n"} +{"Time":"2026-10-17T22:32:41.508488248Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy","Elapsed":0.01} +{"Time":"2026-10-17T22:32:41.508505257Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/version"} +{"Time":"2026-10-17T22:32:41.50851547Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/version","Output":"=== RUN TestDecisionAdverseBindings/version\n"} +{"Time":"2026-10-17T22:32:41.511537992Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/version","Output":"--- PASS: TestDecisionAdverseBindings/version (0.00s)\n"} +{"Time":"2026-10-17T22:32:41.511604192Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/version","Elapsed":0} +{"Time":"2026-10-17T22:32:41.511618097Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/actor"} +{"Time":"2026-10-17T22:32:41.511627446Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/actor","Output":"=== RUN TestDecisionAdverseBindings/actor\n"} +{"Time":"2026-10-17T22:32:41.529799201Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/actor","Output":"--- PASS: TestDecisionAdverseBindings/actor (0.02s)\n"} +{"Time":"2026-10-17T22:32:41.536436121Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/actor","Elapsed":0.02} +{"Time":"2026-10-17T22:32:41.53652125Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/resource"} +{"Time":"2026-10-17T22:32:41.536538406Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/resource","Output":"=== RUN TestDecisionAdverseBindings/resource\n"} +{"Time":"2026-10-17T22:32:41.536560458Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/resource","Output":"--- PASS: TestDecisionAdverseBindings/resource (0.00s)\n"} +{"Time":"2026-10-17T22:32:41.536573095Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/resource","Elapsed":0} +{"Time":"2026-10-17T22:32:41.536584667Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/context"} +{"Time":"2026-10-17T22:32:41.536594779Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/context","Output":"=== RUN TestDecisionAdverseBindings/context\n"} +{"Time":"2026-10-17T22:32:41.539525837Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/context","Output":"--- PASS: TestDecisionAdverseBindings/context (0.00s)\n"} +{"Time":"2026-10-17T22:32:41.541829683Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/context","Elapsed":0} +{"Time":"2026-10-17T22:32:41.564583241Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/legacy-numeric-profile"} +{"Time":"2026-10-17T22:32:41.564654336Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/legacy-numeric-profile","Output":"=== RUN TestDecisionAdverseBindings/legacy-numeric-profile\n"} +{"Time":"2026-10-17T22:32:41.564677379Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/legacy-numeric-profile","Output":"--- PASS: TestDecisionAdverseBindings/legacy-numeric-profile (0.00s)\n"} +{"Time":"2026-10-17T22:32:41.564689861Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/legacy-numeric-profile","Elapsed":0} +{"Time":"2026-10-17T22:32:41.564702103Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/registry"} +{"Time":"2026-10-17T22:32:41.564715283Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/registry","Output":"=== RUN TestDecisionAdverseBindings/registry\n"} +{"Time":"2026-10-17T22:32:41.598648943Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/registry","Output":"--- PASS: TestDecisionAdverseBindings/registry (0.05s)\n"} +{"Time":"2026-10-17T22:32:41.599036408Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/registry","Elapsed":0.05} +{"Time":"2026-10-17T22:32:41.59923453Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/tenant"} +{"Time":"2026-10-17T22:32:41.599265545Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/tenant","Output":"=== RUN TestDecisionAdverseBindings/tenant\n"} +{"Time":"2026-10-17T22:32:41.607387868Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/tenant","Output":"--- PASS: TestDecisionAdverseBindings/tenant (0.01s)\n"} +{"Time":"2026-10-17T22:32:41.617131542Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/tenant","Elapsed":0.01} +{"Time":"2026-10-17T22:32:41.617222217Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-warn"} +{"Time":"2026-10-17T22:32:41.617236049Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-warn","Output":"=== RUN TestDecisionAdverseBindings/caller-warn\n"} +{"Time":"2026-10-17T22:32:41.617255391Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-warn","Output":"--- PASS: TestDecisionAdverseBindings/caller-warn (0.00s)\n"} +{"Time":"2026-10-17T22:32:41.617359402Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-warn","Elapsed":0} +{"Time":"2026-10-17T22:32:41.61755521Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-principal"} +{"Time":"2026-10-17T22:32:41.617586574Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-principal","Output":"=== RUN TestDecisionAdverseBindings/caller-principal\n"} +{"Time":"2026-10-17T22:32:41.623580954Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-principal","Output":"--- PASS: TestDecisionAdverseBindings/caller-principal (0.01s)\n"} +{"Time":"2026-10-17T22:32:41.623822849Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-principal","Elapsed":0.01} +{"Time":"2026-10-17T22:32:41.623978485Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/stale-decision"} +{"Time":"2026-10-17T22:32:41.624004623Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/stale-decision","Output":"=== RUN TestDecisionAdverseBindings/stale-decision\n"} +{"Time":"2026-10-17T22:32:41.62872601Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/stale-decision","Output":"--- PASS: TestDecisionAdverseBindings/stale-decision (0.00s)\n"} +{"Time":"2026-10-17T22:32:41.628960575Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/stale-decision","Elapsed":0} +{"Time":"2026-10-17T22:32:41.629116175Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/expired"} +{"Time":"2026-10-17T22:32:41.629150331Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/expired","Output":"=== RUN TestDecisionAdverseBindings/expired\n"} +{"Time":"2026-10-17T22:32:41.645785834Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/expired","Output":"--- PASS: TestDecisionAdverseBindings/expired (0.01s)\n"} +{"Time":"2026-10-17T22:32:41.645863735Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/expired","Elapsed":0.01} +{"Time":"2026-10-17T22:32:41.645882976Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/obligation"} +{"Time":"2026-10-17T22:32:41.645893253Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/obligation","Output":"=== RUN TestDecisionAdverseBindings/obligation\n"} +{"Time":"2026-10-17T22:32:41.651375651Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/obligation","Output":"--- PASS: TestDecisionAdverseBindings/obligation (0.01s)\n"} +{"Time":"2026-10-17T22:32:41.669361988Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/obligation","Elapsed":0.01} +{"Time":"2026-10-17T22:32:41.66953895Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy-digest"} +{"Time":"2026-10-17T22:32:41.669575209Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy-digest","Output":"=== RUN TestDecisionAdverseBindings/policy-digest\n"} +{"Time":"2026-10-17T22:32:41.669595984Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy-digest","Output":"--- PASS: TestDecisionAdverseBindings/policy-digest (0.00s)\n"} +{"Time":"2026-10-17T22:32:41.669622113Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy-digest","Elapsed":0} +{"Time":"2026-10-17T22:32:41.669636698Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/purpose"} +{"Time":"2026-10-17T22:32:41.669645772Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/purpose","Output":"=== RUN TestDecisionAdverseBindings/purpose\n"} +{"Time":"2026-10-17T22:32:41.669658795Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/purpose","Output":"--- PASS: TestDecisionAdverseBindings/purpose (0.01s)\n"} +{"Time":"2026-10-17T22:32:41.669690683Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/purpose","Elapsed":0.01} +{"Time":"2026-10-17T22:32:41.669703559Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-expired"} +{"Time":"2026-10-17T22:32:41.669711898Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-expired","Output":"=== RUN TestDecisionAdverseBindings/caller-expired\n"} +{"Time":"2026-10-17T22:32:41.67226309Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-expired","Output":"--- PASS: TestDecisionAdverseBindings/caller-expired (0.00s)\n"} +{"Time":"2026-10-17T22:32:41.672331999Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-expired","Elapsed":0} +{"Time":"2026-10-17T22:32:41.672353022Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/subnanosecond-expiry"} +{"Time":"2026-10-17T22:32:41.672366017Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/subnanosecond-expiry","Output":"=== RUN TestDecisionAdverseBindings/subnanosecond-expiry\n"} +{"Time":"2026-10-17T22:32:41.684570838Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/subnanosecond-expiry","Output":"--- PASS: TestDecisionAdverseBindings/subnanosecond-expiry (0.02s)\n"} +{"Time":"2026-10-17T22:32:41.689651989Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/subnanosecond-expiry","Elapsed":0.02} +{"Time":"2026-10-17T22:32:41.689672919Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/missing-TTL"} +{"Time":"2026-10-17T22:32:41.689684446Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/missing-TTL","Output":"=== RUN TestDecisionAdverseBindings/missing-TTL\n"} +{"Time":"2026-10-17T22:32:41.696079966Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/missing-TTL","Output":"--- PASS: TestDecisionAdverseBindings/missing-TTL (0.01s)\n"} +{"Time":"2026-10-17T22:32:41.696157141Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/missing-TTL","Elapsed":0.01} +{"Time":"2026-10-17T22:32:41.69618113Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/effect"} +{"Time":"2026-10-17T22:32:41.696192252Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/effect","Output":"=== RUN TestDecisionAdverseBindings/effect\n"} +{"Time":"2026-10-17T22:32:41.725694864Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/effect","Output":"--- PASS: TestDecisionAdverseBindings/effect (0.01s)\n"} +{"Time":"2026-10-17T22:32:41.725771314Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/effect","Elapsed":0.01} +{"Time":"2026-10-17T22:32:41.725791097Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/action"} +{"Time":"2026-10-17T22:32:41.725802522Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/action","Output":"=== RUN TestDecisionAdverseBindings/action\n"} +{"Time":"2026-10-17T22:32:41.733647496Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/action","Output":"--- PASS: TestDecisionAdverseBindings/action (0.01s)\n"} +{"Time":"2026-10-17T22:32:41.733747659Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/action","Elapsed":0.01} +{"Time":"2026-10-17T22:32:41.733769178Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings","Output":"--- PASS: TestDecisionAdverseBindings (0.28s)\n"} +{"Time":"2026-10-17T22:32:41.733781861Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings","Elapsed":0.28} +{"Time":"2026-10-17T22:32:41.733795463Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay"} +{"Time":"2026-10-17T22:32:41.733806144Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay","Output":"=== RUN TestSignatureForgeryAndReplay\n"} +{"Time":"2026-10-17T22:32:41.733816936Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/forged-payload"} +{"Time":"2026-10-17T22:32:41.73382624Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/forged-payload","Output":"=== RUN TestSignatureForgeryAndReplay/forged-payload\n"} +{"Time":"2026-10-17T22:32:41.733839006Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/forged-payload","Output":"--- PASS: TestSignatureForgeryAndReplay/forged-payload (0.00s)\n"} +{"Time":"2026-10-17T22:32:41.7338501Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/forged-payload","Elapsed":0} +{"Time":"2026-10-17T22:32:41.733860497Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/wrong-key"} +{"Time":"2026-10-17T22:32:41.733869598Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/wrong-key","Output":"=== RUN TestSignatureForgeryAndReplay/wrong-key\n"} +{"Time":"2026-10-17T22:32:41.745690972Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/wrong-key","Output":"--- PASS: TestSignatureForgeryAndReplay/wrong-key (0.01s)\n"} +{"Time":"2026-10-17T22:32:41.749605145Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/wrong-key","Elapsed":0.01} +{"Time":"2026-10-17T22:32:41.750022375Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/replay"} +{"Time":"2026-10-17T22:32:41.750059884Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/replay","Output":"=== RUN TestSignatureForgeryAndReplay/replay\n"} +{"Time":"2026-10-17T22:32:41.778382352Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/replay","Output":"--- PASS: TestSignatureForgeryAndReplay/replay (0.03s)\n"} +{"Time":"2026-10-17T22:32:41.778683567Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/replay","Elapsed":0.03} +{"Time":"2026-10-17T22:32:41.779003215Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay","Output":"--- PASS: TestSignatureForgeryAndReplay (0.05s)\n"} +{"Time":"2026-10-17T22:32:41.779224224Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay","Elapsed":0.05} +{"Time":"2026-10-17T22:32:41.779397907Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestUnavailableAndPublicTokenFileRefuse"} +{"Time":"2026-10-17T22:32:41.779451626Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestUnavailableAndPublicTokenFileRefuse","Output":"=== RUN TestUnavailableAndPublicTokenFileRefuse\n"} +{"Time":"2026-10-17T22:32:41.782470546Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestUnavailableAndPublicTokenFileRefuse","Output":"--- PASS: TestUnavailableAndPublicTokenFileRefuse (0.00s)\n"} +{"Time":"2026-10-17T22:32:41.782552194Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestUnavailableAndPublicTokenFileRefuse","Elapsed":0} +{"Time":"2026-10-17T22:32:41.782567752Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Output":"PASS\n"} +{"Time":"2026-10-17T22:32:41.785901638Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Output":"ok \tgithub.com/netkingdom/access-engine/pkg/decisionpep\t0.404s\n"} +{"Time":"2026-10-17T22:32:41.785981494Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Elapsed":0.417} diff --git a/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/checkpoint-commit-attempt2.json b/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/checkpoint-commit-attempt2.json new file mode 100644 index 00000000..cfc2f046 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/checkpoint-commit-attempt2.json @@ -0,0 +1,78 @@ +{ + "returncode": 0, + "base": "16236ef479135df4361686aa69e9eeb987f33129", + "commit": "8951d32419079a0b699c9ffdeff5d2df971ff4cd", + "files": [ + { + "path": "docs/netkingdom-target-implementation.md", + "sha256": "aa128260f54e12339f3651f4ed8c06b546d822657d01813fbe7aeb7033e5a254" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-forgejo-release-build-r1/README.md", + "sha256": "3d7f003cc537e5bc8246d3b791fda327a3f52b6cfb17fa98a08ebec049bf0a9a" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-forgejo-release-build-r1/source-inventory.json", + "sha256": "1f355db62adda2b4613023d2435962474df2bddd31e04ff5edf5a5e4c747d415" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-forgejo-release-build-r1/validation.json", + "sha256": "011359d4a5ef22a0f4bb0c19def51ab5556f1e74d928110b65682f207b4157f8" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-forgejo-release-build-r1/evidence/binary-reproduction.json", + "sha256": "31a5bf44d45965659efb0f9bbdc413b809e1078df5ee610f4925acc18d0de20f" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-forgejo-release-build-r1/evidence/container-reproduction.json", + "sha256": "0cdafd8d1e78b83ea6378ebe79a620aeed1a83d49b4b5efc0ea1393ca09c9bfa" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-forgejo-release-build-r2/source-refinement.json", + "sha256": "1e96b866284908299b6363c0ddd1363181bd8513ae63eb178967f636de008972" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-release-independent-review-r1/review.json", + "sha256": "df2c23df953e1d4c10bd3abd7aea350cc33d8bbfdb2a99d92a436feba0946f73" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-release-independent-review-r1/proc-boundary-result.json", + "sha256": "d8c7d4ec492dcfbd4bb1584dff74da9c05ec13a730fb58b09138f33d4db00b94" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-release-independent-review-r1/proc-boundary-test.py", + "sha256": "45eb2d6eab745ad4e7bfd5a1fc0b33e0757cab20f314b45aaeca15afe76b8703" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-release-independent-review-r2/review.json", + "sha256": "6f016d53a7ec9ece2f9da9686e76127c52d17066f2b3d371628832ac9537ac5c" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-release-independent-review-r2/results.json", + "sha256": "232827ebb83148b32c67d81b943011f955c0a279604b6c7f764737d22e08c1e5" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-release-source-integration-r1/source-application.json", + "sha256": "14dab3d30f6f89234252bb9231a2fc6fbb3d2418e9ad21a8f565481f0cda86c5" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-release-source-integration-r1/verified-task-bindings.json", + "sha256": "a93a223310a9141c81af7d420061d0f90c7b383c592b33b3149e0b1b236407bf" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-release-source-integration-r1/identifier-assignment.json", + "sha256": "11ee237a166d021b40b213b3071de9f4b880b6fa3ed03226d377aad37cc94b93" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-release-source-integration-r1/workplan.md", + "sha256": "8981cd54aaf858ac35189fb1229c180930428e67eccc68b698d398ca1a18837f" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-release-source-integration-r1/apply_source.py", + "sha256": "b1206011c6199d948696830c3a4911077336b1929e11f0e8fad217d9cc4699d8" + } + ], + "stdout": "[main 8951d32] Record reviewed application build source and remaining authenticated operation work\n 17 files changed, 1115 insertions(+)\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/apps-forgejo-release-build-r1/README.md\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/apps-forgejo-release-build-r1/evidence/binary-reproduction.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/apps-forgejo-release-build-r1/evidence/container-reproduction.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/apps-forgejo-release-build-r1/source-inventory.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/apps-forgejo-release-build-r1/validation.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/apps-forgejo-release-build-r2/source-refinement.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/apps-release-independent-review-r1/proc-boundary-result.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/apps-release-independent-review-r1/proc-boundary-test.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/apps-release-independent-review-r1/review.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/apps-release-independent-review-r2/results.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/apps-release-independent-review-r2/review.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/apps-release-source-integration-r1/apply_source.py\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/apps-release-source-integration-r1/identifier-assignment.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/apps-release-source-integration-r1/source-application.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/apps-release-source-integration-r1/verified-task-bindings.json\n create mode 100644 docs/changes/netkingdom-target-2026-10-17/apps-release-source-integration-r1/workplan.md\n", + "stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 17, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n", + "existing_backup_verified": true +} diff --git a/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/checkpoint-commit.json b/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/checkpoint-commit.json new file mode 100644 index 00000000..0c651231 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/checkpoint-commit.json @@ -0,0 +1,78 @@ +{ + "returncode": 128, + "base": "16236ef479135df4361686aa69e9eeb987f33129", + "commit": "16236ef479135df4361686aa69e9eeb987f33129", + "files": [ + { + "path": "docs/netkingdom-target-implementation.md", + "sha256": "aa128260f54e12339f3651f4ed8c06b546d822657d01813fbe7aeb7033e5a254" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-forgejo-release-build-r1/README.md", + "sha256": "3d7f003cc537e5bc8246d3b791fda327a3f52b6cfb17fa98a08ebec049bf0a9a" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-forgejo-release-build-r1/source-inventory.json", + "sha256": "1f355db62adda2b4613023d2435962474df2bddd31e04ff5edf5a5e4c747d415" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-forgejo-release-build-r1/validation.json", + "sha256": "011359d4a5ef22a0f4bb0c19def51ab5556f1e74d928110b65682f207b4157f8" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-forgejo-release-build-r1/evidence/binary-reproduction.json", + "sha256": "31a5bf44d45965659efb0f9bbdc413b809e1078df5ee610f4925acc18d0de20f" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-forgejo-release-build-r1/evidence/container-reproduction.json", + "sha256": "0cdafd8d1e78b83ea6378ebe79a620aeed1a83d49b4b5efc0ea1393ca09c9bfa" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-forgejo-release-build-r2/source-refinement.json", + "sha256": "1e96b866284908299b6363c0ddd1363181bd8513ae63eb178967f636de008972" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-release-independent-review-r1/review.json", + "sha256": "df2c23df953e1d4c10bd3abd7aea350cc33d8bbfdb2a99d92a436feba0946f73" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-release-independent-review-r1/proc-boundary-result.json", + "sha256": "d8c7d4ec492dcfbd4bb1584dff74da9c05ec13a730fb58b09138f33d4db00b94" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-release-independent-review-r1/proc-boundary-test.py", + "sha256": "45eb2d6eab745ad4e7bfd5a1fc0b33e0757cab20f314b45aaeca15afe76b8703" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-release-independent-review-r2/review.json", + "sha256": "6f016d53a7ec9ece2f9da9686e76127c52d17066f2b3d371628832ac9537ac5c" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-release-independent-review-r2/results.json", + "sha256": "232827ebb83148b32c67d81b943011f955c0a279604b6c7f764737d22e08c1e5" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-release-source-integration-r1/source-application.json", + "sha256": "14dab3d30f6f89234252bb9231a2fc6fbb3d2418e9ad21a8f565481f0cda86c5" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-release-source-integration-r1/verified-task-bindings.json", + "sha256": "a93a223310a9141c81af7d420061d0f90c7b383c592b33b3149e0b1b236407bf" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-release-source-integration-r1/identifier-assignment.json", + "sha256": "11ee237a166d021b40b213b3071de9f4b880b6fa3ed03226d377aad37cc94b93" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-release-source-integration-r1/workplan.md", + "sha256": "8981cd54aaf858ac35189fb1229c180930428e67eccc68b698d398ca1a18837f" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-release-source-integration-r1/apply_source.py", + "sha256": "b1206011c6199d948696830c3a4911077336b1929e11f0e8fad217d9cc4699d8" + } + ], + "stdout": "", + "stderr": "fatal: Unable to create '/home/worsch/the-custodian/.git/index.lock': File exists.\n\nAnother git process seems to be running in this repository, e.g.\nan editor opened by 'git commit'. Please make sure all processes\nare terminated then try again. If it still fails, a git process\nmay have crashed in this repository earlier:\nremove the file manually to continue.\n", + "existing_backup_verified": true +} diff --git a/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/finish_review.py b/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/finish_review.py new file mode 100644 index 00000000..f8b0c2f4 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/finish_review.py @@ -0,0 +1,73 @@ +"""Commit the bounded review and refresh its existing file-backed projection.""" +from pathlib import Path +import argparse +import hashlib +import json +import subprocess + +HERE = Path(__file__).resolve().parent +ROOT = HERE.parents[3] +BACKUP = HERE.parent / 'application-source-checkpoint-publication-r1/publication-backup' +parser = argparse.ArgumentParser() +parser.add_argument('action', choices=['commit', 'sync']) +args = parser.parse_args() + + +def git(*argv): + return subprocess.check_output(['git', '-C', str(ROOT), *argv], stderr=subprocess.PIPE).decode().strip() + + +protected = json.loads((BACKUP / 'originals.json').read_text()) + + +def preserve(restore=False): + for row in protected: + target = ROOT / row['path'] + raw = (BACKUP / (row['path'] + '.worktree')).read_bytes() + if restore: + target.write_bytes(raw) + mode, oid, stage, path = row['index'].split() + assert stage == '0' + git('update-index', '--cacheinfo', mode, oid, path) + assert target.read_bytes() == raw + assert git('ls-files', '--stage', '--', row['path']) == row['index'] + + +preserve() +if args.action == 'commit': + assert git('rev-parse', 'HEAD') == '8951d32419079a0b699c9ffdeff5d2df971ff4cd' + review = json.loads((HERE / 'review.json').read_text()) + for row in review['original_candidate_files']: + assert hashlib.sha256((ROOT / row['path']).read_bytes()).hexdigest() == row['sha256'] + plan = 'workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md' + import re + original = subprocess.check_output(['git', '-C', str(ROOT), 'show', 'HEAD:' + plan], text=True) + assert re.findall(r'```task\n.*?```', original, re.S) == re.findall(r'```task\n.*?```', (ROOT / plan).read_text(), re.S) + paths = [str(item.relative_to(ROOT)) for item in sorted(HERE.iterdir()) if item.is_file()] + paths += ['docs/netkingdom-target-implementation.md', plan] + assert not (HERE / 'review-commit.json').exists() + git('add', '--', *paths) + run = subprocess.run(['git', '-C', str(ROOT), 'commit', '--only', '-m', + 'Record reproduced application policy and source package review failures', '--', *paths], + capture_output=True, text=True, timeout=240) + head = git('rev-parse', 'HEAD') + (HERE / 'review-commit.json').write_text(json.dumps({'returncode': run.returncode, + 'commit': head, 'paths': paths, 'stdout': run.stdout, 'stderr': run.stderr}, indent=2) + '\n') + preserve() + assert run.returncode == 0, 'Normal hook refused; original failure retained' + assert set(git('diff-tree', '--no-commit-id', '--name-only', '-r', head).splitlines()) == set(paths) + print(json.dumps({'status': 'committed', 'commit': head, 'files': len(paths)})) +else: + assert not (HERE / 'consistency.json').exists() + try: + for name, argv in [('consistency', ['statehub', 'fix-consistency', '--repo', 'the-custodian', '--no-writeback', '--json']), + ('projection', ['/home/worsch/repo-manager/.venv/bin/rmgr', 'sync', '--path', str(ROOT), '--push'])]: + run = subprocess.run(argv, cwd=ROOT, capture_output=True, text=True, timeout=300) + (HERE / (name + '.json')).write_text(run.stdout) + (HERE / (name + '.stderr.txt')).write_text(run.stderr) + assert run.returncode == 0, name + ' refused; exact result retained' + finally: + preserve(restore=True) + projection = json.loads((HERE / 'projection.json').read_text()) + assert projection['status'] == 'applied' + print(json.dumps({'status': 'applied', 'commit': projection['commit'], 'protected_state_preserved': True})) diff --git a/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/git-lock-recovery.json b/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/git-lock-recovery.json new file mode 100644 index 00000000..49a67d65 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/git-lock-recovery.json @@ -0,0 +1,10 @@ +{ + "action": "retained stale lock by rename after checking pgrep -x git returned no matches", + "path": ".git/index.lock.interrupted-20261018", + "sha256": "4d78749da807429c4c06fedac1b8c629160b1e17f34953a1cb20b650178ea1d9", + "bytes": 382591, + "mtime_ns": 1792275340005693279, + "index_replaced": false, + "initial_commit_attempt": "failed; retained in checkpoint-commit.json", + "second_commit_attempt": "passed normal hook; retained in checkpoint-commit-attempt2.json" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/producer-result.json b/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/producer-result.json new file mode 100644 index 00000000..7dd0de84 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/producer-result.json @@ -0,0 +1,85 @@ +{ + "target": "producer", + "source_revision": "d328a2601095686f74376d87791bff01e2a3a2a3", + "returncode": 1, + "seconds": 70.97, + "argv": [ + "bwrap", + "--unshare-net", + "--unshare-pid", + "--die-with-parent", + "--new-session", + "--ro-bind", + "/usr", + "/usr", + "--ro-bind", + "/lib", + "/lib", + "--ro-bind", + "/lib64", + "/lib64", + "--symlink", + "usr/bin", + "/bin", + "--proc", + "/proc", + "--dev", + "/dev", + "--tmpfs", + "/tmp", + "--bind", + "/tmp/custodian-resume-producer-fur421ez", + "/work", + "--ro-bind", + "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64", + "/toolchain", + "--ro-bind", + "/home/worsch/go/pkg/mod", + "/modules", + "--chdir", + "/work/source", + "--clearenv", + "--setenv", + "PATH", + "/toolchain/bin:/usr/bin:/bin", + "--setenv", + "HOME", + "/work/home", + "--setenv", + "GOTOOLCHAIN", + "local", + "--setenv", + "GOPROXY", + "off", + "--setenv", + "GOSUMDB", + "off", + "--setenv", + "GOMODCACHE", + "/modules", + "--setenv", + "GOCACHE", + "/work/gocache", + "--setenv", + "GOMAXPROCS", + "4", + "--setenv", + "CGO_ENABLED", + "0", + "--", + "go", + "test", + "-p", + "4", + "-json", + "./cmd/access-engine", + "-run", + "TestForgejoActualPolicySignedLosslessAndLegacy|TestTrustedServiceActualHTTPPositiveAndRefusals|TestTrustedServiceRetainedRegistryPreapprovalAndRefusals", + "-count=1" + ], + "workspace": "/tmp/custodian-resume-producer-fur421ez", + "network": "disabled", + "pid_namespace": "private", + "real_credentials": false, + "canonical_owner_modified": false +} diff --git a/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/producer-test.jsonl b/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/producer-test.jsonl new file mode 100644 index 00000000..8279614b --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/producer-test.jsonl @@ -0,0 +1,150 @@ +{"Time":"2026-10-17T22:33:12.024649155Z","Action":"start","Package":"github.com/netkingdom/access-engine/cmd/access-engine"} +{"Time":"2026-10-17T22:33:12.035411877Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy"} +{"Time":"2026-10-17T22:33:12.035466605Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy\n"} +{"Time":"2026-10-17T22:33:12.03655281Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" forgejo_application_profile_test.go:39: policy: \u003cnil\u003e \u0026{Source:../../examples/forgejo-application-access/policy.md Metadata:{ID:forgejo.application-access Name:Forgejo authenticated application access Namespace:forgejo:application Version:v1 Status:draft Package:flexauth.forgejo.application Actions:[application.access] Owner:railiance-apps Fixtures:[] Caring:{Profile:caring-0.4.0-rc2 Enforce:false CanonicalRoles:[] OrganizationRelations:[] Scopes:[] Planes:[] Capabilities:[] ExposureModes:[] Conditions:[] Restrictions:[] Metadata:map[]} Activation:map[] Metadata:map[] AllowTTL:10s} Prose:This source policy enforces the original three-group any-of in the sole PDP.\n"} +{"Time":"2026-10-17T22:33:12.036602102Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" The registry identifies the application tenant and admitted issuer. This policy requires aal2 assurance.\n"} +{"Time":"2026-10-17T22:33:12.036609018Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" The PEP independently verifies the ID token and supplies fresh UserInfo groups;\n"} +{"Time":"2026-10-17T22:33:12.036616044Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" the authenticated workload caller may represent only the Forgejo system. A\n"} +{"Time":"2026-10-17T22:33:12.036621655Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" decision authorizes one login callback, never a later HTTP/Git/SSH/API operation.\n"} +{"Time":"2026-10-17T22:33:12.036626541Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" The accompanying registry is synthetic test data, not an estate admission. RuleBlocks:[{Language:rego Tags:[] Info:rego Body:import rego.v1\n"} +{"Time":"2026-10-17T22:33:12.036637553Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \n"} +{"Time":"2026-10-17T22:33:12.036643119Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" default decision := {\"effect\": \"deny\", \"reason\": \"application_access_refused\"}\n"} +{"Time":"2026-10-17T22:33:12.036648051Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \n"} +{"Time":"2026-10-17T22:33:12.036652937Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" original_groups := {\"forge-admins\", \"forge-coulomb-owners\", \"forge-coulomb-readers\"}\n"} +{"Time":"2026-10-17T22:33:12.03665774Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \n"} +{"Time":"2026-10-17T22:33:12.036685807Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" decision := {\"effect\": \"allow\", \"reason\": \"current_authenticated_application_access\"} if {\n"} +{"Time":"2026-10-17T22:33:12.036697067Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.action == \"application.access\"\n"} +{"Time":"2026-10-17T22:33:12.036703505Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" object.get(input, \"purpose\", \"\") == \"\"\n"} +{"Time":"2026-10-17T22:33:12.036708033Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.resource.id == \"application:forgejo\"\n"} +{"Time":"2026-10-17T22:33:12.036712799Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.resource.type == \"application\"\n"} +{"Time":"2026-10-17T22:33:12.036717796Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.resource.system == \"forgejo\"\n"} +{"Time":"2026-10-17T22:33:12.036722994Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.tenant == input.resource.tenant\n"} +{"Time":"2026-10-17T22:33:12.036727467Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.tenant == input.resource.attributes.tenant\n"} +{"Time":"2026-10-17T22:33:12.036732132Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.subject.tenant == input.tenant\n"} +{"Time":"2026-10-17T22:33:12.036742804Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.context.identity_tenant == input.tenant\n"} +{"Time":"2026-10-17T22:33:12.036748177Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.subject.id == input.context.identity_subject\n"} +{"Time":"2026-10-17T22:33:12.036753274Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.subject.type == input.context.identity_principal_type\n"} +{"Time":"2026-10-17T22:33:12.036758142Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.subject.type == \"human\"\n"} +{"Time":"2026-10-17T22:33:12.036765554Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.subject.attributes.issuer == input.context.identity_issuer\n"} +{"Time":"2026-10-17T22:33:12.036770449Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.context.identity_issuer == input.resource.attributes.identity_issuer\n"} +{"Time":"2026-10-17T22:33:12.036775307Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.subject.attributes.assurance == input.context.identity_assurance\n"} +{"Time":"2026-10-17T22:33:12.036787486Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.context.identity_assurance == \"aal2\"\n"} +{"Time":"2026-10-17T22:33:12.036793446Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" count(input.context.required_groups_any_of) == 3\n"} +{"Time":"2026-10-17T22:33:12.036801896Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" {g | g := input.context.required_groups_any_of[_]} == original_groups\n"} +{"Time":"2026-10-17T22:33:12.036806956Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.subject.attributes.current_userinfo_groups == input.context.current_userinfo_groups\n"} +{"Time":"2026-10-17T22:33:12.036811906Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" some group in input.context.current_userinfo_groups\n"} +{"Time":"2026-10-17T22:33:12.036817674Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" group in original_groups\n"} +{"Time":"2026-10-17T22:33:12.036822606Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" is_string(input.context.decisionpep_request_nonce)\n"} +{"Time":"2026-10-17T22:33:12.036828172Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" count(input.context.decisionpep_request_nonce) == 64\n"} +{"Time":"2026-10-17T22:33:12.036833342Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" } StartLine:9}] TestBlocks:[] FixtureBlocks:[] RegoModule:package flexauth.forgejo.application\n"} +{"Time":"2026-10-17T22:33:12.036838522Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \n"} +{"Time":"2026-10-17T22:33:12.036842949Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" import rego.v1\n"} +{"Time":"2026-10-17T22:33:12.036849112Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \n"} +{"Time":"2026-10-17T22:33:12.036854136Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" default decision := {\"effect\": \"deny\", \"reason\": \"application_access_refused\"}\n"} +{"Time":"2026-10-17T22:33:12.036859398Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \n"} +{"Time":"2026-10-17T22:33:12.036864183Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" original_groups := {\"forge-admins\", \"forge-coulomb-owners\", \"forge-coulomb-readers\"}\n"} +{"Time":"2026-10-17T22:33:12.036869216Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \n"} +{"Time":"2026-10-17T22:33:12.036873946Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" decision := {\"effect\": \"allow\", \"reason\": \"current_authenticated_application_access\"} if {\n"} +{"Time":"2026-10-17T22:33:12.036884343Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.action == \"application.access\"\n"} +{"Time":"2026-10-17T22:33:12.036890937Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" object.get(input, \"purpose\", \"\") == \"\"\n"} +{"Time":"2026-10-17T22:33:12.036896723Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.resource.id == \"application:forgejo\"\n"} +{"Time":"2026-10-17T22:33:12.036901765Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.resource.type == \"application\"\n"} +{"Time":"2026-10-17T22:33:12.036906881Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.resource.system == \"forgejo\"\n"} +{"Time":"2026-10-17T22:33:12.036911849Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.tenant == input.resource.tenant\n"} +{"Time":"2026-10-17T22:33:12.036916864Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.tenant == input.resource.attributes.tenant\n"} +{"Time":"2026-10-17T22:33:12.036921906Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.subject.tenant == input.tenant\n"} +{"Time":"2026-10-17T22:33:12.036926471Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.context.identity_tenant == input.tenant\n"} +{"Time":"2026-10-17T22:33:12.036931549Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.subject.id == input.context.identity_subject\n"} +{"Time":"2026-10-17T22:33:12.036936243Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.subject.type == input.context.identity_principal_type\n"} +{"Time":"2026-10-17T22:33:12.036941129Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.subject.type == \"human\"\n"} +{"Time":"2026-10-17T22:33:12.036945904Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.subject.attributes.issuer == input.context.identity_issuer\n"} +{"Time":"2026-10-17T22:33:12.036950947Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.context.identity_issuer == input.resource.attributes.identity_issuer\n"} +{"Time":"2026-10-17T22:33:12.036956246Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.subject.attributes.assurance == input.context.identity_assurance\n"} +{"Time":"2026-10-17T22:33:12.036961242Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.context.identity_assurance == \"aal2\"\n"} +{"Time":"2026-10-17T22:33:12.036971868Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" count(input.context.required_groups_any_of) == 3\n"} +{"Time":"2026-10-17T22:33:12.036977498Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" {g | g := input.context.required_groups_any_of[_]} == original_groups\n"} +{"Time":"2026-10-17T22:33:12.036982485Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.subject.attributes.current_userinfo_groups == input.context.current_userinfo_groups\n"} +{"Time":"2026-10-17T22:33:12.036987775Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" some group in input.context.current_userinfo_groups\n"} +{"Time":"2026-10-17T22:33:12.037000018Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" group in original_groups\n"} +{"Time":"2026-10-17T22:33:12.037004803Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" is_string(input.context.decisionpep_request_nonce)\n"} +{"Time":"2026-10-17T22:33:12.037009937Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" count(input.context.decisionpep_request_nonce) == 64\n"} +{"Time":"2026-10-17T22:33:12.037014759Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" }\n"} +{"Time":"2026-10-17T22:33:12.037027681Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" TestModule: TestPackage: Fixtures:[] Validation:{Valid:false Diagnostics:[{Code:POLICY-ATTRIBUTE-UNDECLARED Severity:error Message:package reads input.resource.attributes.identity_issuer, which no sibling registry or manifest supplies; the value can only come from the caller Fields:[input.resource.attributes.identity_issuer] Metadata:map[key:identity_issuer kind:resource]} {Code:POLICY-ATTRIBUTE-UNDECLARED Severity:error Message:package reads input.resource.attributes.tenant, which no sibling registry or manifest supplies; the value can only come from the caller Fields:[input.resource.attributes.tenant] Metadata:map[key:tenant kind:resource]} {Code:POLICY-ATTRIBUTE-UNDECLARED Severity:error Message:package reads input.subject.attributes.assurance, which no sibling registry or manifest supplies; the value can only come from the caller Fields:[input.subject.attributes.assurance] Metadata:map[key:assurance kind:subject]} {Code:POLICY-ATTRIBUTE-UNDECLARED Severity:error Message:package reads input.subjec"} +{"Time":"2026-10-17T22:33:12.037038105Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":"t.attributes.current_userinfo_groups, which no sibling registry or manifest supplies; the value can only come from the caller Fields:[input.subject.attributes.current_userinfo_groups] Metadata:map[key:current_userinfo_groups kind:subject]} {Code:POLICY-ATTRIBUTE-UNDECLARED Severity:error Message:package reads input.subject.attributes.issuer, which no sibling registry or manifest supplies; the value can only come from the caller Fields:[input.subject.attributes.issuer] Metadata:map[key:issuer kind:subject]} {Code:POLICY-FIXTURE-MISSING Severity:error Message:policy package must include at least one embedded or referenced fixture Fields:[] Metadata:map[]} {Code:POLICY-REGO-TEST-MISSING Severity:error Message:policy package must include at least one rego test block Fields:[] Metadata:map[]}] CaringFindings:[{Code:CARING-POLICY-MISSING-DIMENSION Severity:warning Message:policy package should declare governed canonical roles Fields:[caring.canonical_roles] Descriptor: Metadata:map[]} {Code:CARING-POLICY-MISSING-DI"} +{"Time":"2026-10-17T22:33:12.037094606Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":"MENSION Severity:warning Message:policy package should declare governed organization relations Fields:[caring.organization_relations] Descriptor: Metadata:map[]} {Code:CARING-POLICY-MISSING-DIMENSION Severity:warning Message:policy package should declare governed scopes Fields:[caring.scopes] Descriptor: Metadata:map[]} {Code:CARING-POLICY-MISSING-DIMENSION Severity:warning Message:policy package should declare governed planes Fields:[caring.planes] Descriptor: Metadata:map[]} {Code:CARING-POLICY-MISSING-DIMENSION Severity:warning Message:policy package should declare governed capabilities Fields:[caring.capabilities] Descriptor: Metadata:map[]} {Code:CARING-POLICY-MISSING-DIMENSION Severity:warning Message:policy package should declare governed exposure modes Fields:[caring.exposure_modes] Descriptor: Metadata:map[]} {Code:CARING-POLICY-MISSING-DIMENSION Severity:warning Message:policy package should declare governed conditions Fields:[caring.conditions] Descriptor: Metadata:map[]} {Code:CARING-POLICY-MISSIN"} +{"Time":"2026-10-17T22:33:12.037109769Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":"G-DIMENSION Severity:warning Message:policy package should declare governed restrictions Fields:[caring.restrictions] Descriptor: Metadata:map[]}] Tests:[] Fixtures:[]} Valid:false}\n"} +{"Time":"2026-10-17T22:33:12.037124216Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":"--- FAIL: TestForgejoActualPolicySignedLosslessAndLegacy (0.00s)\n"} +{"Time":"2026-10-17T22:33:12.037130654Z","Action":"fail","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Elapsed":0} +{"Time":"2026-10-17T22:33:12.038032946Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals"} +{"Time":"2026-10-17T22:33:12.03806307Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals\n"} +{"Time":"2026-10-17T22:33:12.103716856Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals","Output":" trusted_service_http_test.go:237: actual HTTP source policy pin: secrets-engine.task-execution.service-pilot v2 sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d\n"} +{"Time":"2026-10-17T22:33:12.105111968Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/redirect"} +{"Time":"2026-10-17T22:33:12.105137408Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/redirect","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/redirect\n"} +{"Time":"2026-10-17T22:33:12.10761105Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/redirect","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/redirect (0.00s)\n"} +{"Time":"2026-10-17T22:33:12.107667707Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/redirect","Elapsed":0} +{"Time":"2026-10-17T22:33:12.107683467Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate"} +{"Time":"2026-10-17T22:33:12.107688675Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate\n"} +{"Time":"2026-10-17T22:33:12.115178437Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate (0.01s)\n"} +{"Time":"2026-10-17T22:33:12.115225461Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate","Elapsed":0.01} +{"Time":"2026-10-17T22:33:12.115236362Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/changed"} +{"Time":"2026-10-17T22:33:12.115241643Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/changed","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/changed\n"} +{"Time":"2026-10-17T22:33:12.11821659Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/changed","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/changed (0.00s)\n"} +{"Time":"2026-10-17T22:33:12.118296897Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/changed","Elapsed":0} +{"Time":"2026-10-17T22:33:12.118311298Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/expired"} +{"Time":"2026-10-17T22:33:12.118316588Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/expired","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/expired\n"} +{"Time":"2026-10-17T22:33:12.121532371Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/expired","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/expired (0.00s)\n"} +{"Time":"2026-10-17T22:33:12.121581268Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/expired","Elapsed":0} +{"Time":"2026-10-17T22:33:12.121588918Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh"} +{"Time":"2026-10-17T22:33:12.121593933Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh\n"} +{"Time":"2026-10-17T22:33:12.136687468Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh (0.02s)\n"} +{"Time":"2026-10-17T22:33:12.136734491Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh","Elapsed":0.02} +{"Time":"2026-10-17T22:33:12.136743243Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale"} +{"Time":"2026-10-17T22:33:12.136761153Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale\n"} +{"Time":"2026-10-17T22:33:12.141073974Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale (0.00s)\n"} +{"Time":"2026-10-17T22:33:12.141126801Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale","Elapsed":0} +{"Time":"2026-10-17T22:33:12.141137115Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind"} +{"Time":"2026-10-17T22:33:12.14114191Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind\n"} +{"Time":"2026-10-17T22:33:12.144206681Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind (0.00s)\n"} +{"Time":"2026-10-17T22:33:12.144250389Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind","Elapsed":0} +{"Time":"2026-10-17T22:33:12.239575626Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals (0.20s)\n"} +{"Time":"2026-10-17T22:33:12.239647539Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals","Elapsed":0.2} +{"Time":"2026-10-17T22:33:12.23966711Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals"} +{"Time":"2026-10-17T22:33:12.239672272Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals\n"} +{"Time":"2026-10-17T22:33:12.305899783Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals","Output":" trusted_service_http_test.go:237: actual HTTP source policy pin: secrets-engine.task-execution.service-pilot v2 sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d\n"} +{"Time":"2026-10-17T22:33:12.307309153Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect"} +{"Time":"2026-10-17T22:33:12.307336953Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect\n"} +{"Time":"2026-10-17T22:33:12.311494064Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect (0.00s)\n"} +{"Time":"2026-10-17T22:33:12.311540665Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect","Elapsed":0} +{"Time":"2026-10-17T22:33:12.31156616Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate"} +{"Time":"2026-10-17T22:33:12.311571836Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate\n"} +{"Time":"2026-10-17T22:33:12.31825222Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate (0.01s)\n"} +{"Time":"2026-10-17T22:33:12.31830075Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate","Elapsed":0.01} +{"Time":"2026-10-17T22:33:12.318312561Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed"} +{"Time":"2026-10-17T22:33:12.318317759Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed\n"} +{"Time":"2026-10-17T22:33:12.321409603Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed (0.00s)\n"} +{"Time":"2026-10-17T22:33:12.321455405Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed","Elapsed":0} +{"Time":"2026-10-17T22:33:12.321465379Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired"} +{"Time":"2026-10-17T22:33:12.321470541Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired\n"} +{"Time":"2026-10-17T22:33:12.325703737Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired (0.00s)\n"} +{"Time":"2026-10-17T22:33:12.325755205Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired","Elapsed":0} +{"Time":"2026-10-17T22:33:12.325763425Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh"} +{"Time":"2026-10-17T22:33:12.32576821Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh\n"} +{"Time":"2026-10-17T22:33:12.341051341Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh (0.02s)\n"} +{"Time":"2026-10-17T22:33:12.341099705Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh","Elapsed":0.02} +{"Time":"2026-10-17T22:33:12.341125283Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act"} +{"Time":"2026-10-17T22:33:12.341136047Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act\n"} +{"Time":"2026-10-17T22:33:12.344055595Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act (0.00s)\n"} +{"Time":"2026-10-17T22:33:12.344103032Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act","Elapsed":0} +{"Time":"2026-10-17T22:33:12.344114264Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale"} +{"Time":"2026-10-17T22:33:12.344119196Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale\n"} +{"Time":"2026-10-17T22:33:12.349030895Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale (0.00s)\n"} +{"Time":"2026-10-17T22:33:12.34907891Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale","Elapsed":0} +{"Time":"2026-10-17T22:33:12.34908905Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind"} +{"Time":"2026-10-17T22:33:12.349094028Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind\n"} +{"Time":"2026-10-17T22:33:12.352166356Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind (0.00s)\n"} +{"Time":"2026-10-17T22:33:12.352210605Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind","Elapsed":0} +{"Time":"2026-10-17T22:33:12.449393776Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals (0.21s)\n"} +{"Time":"2026-10-17T22:33:12.449447715Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals","Elapsed":0.21} +{"Time":"2026-10-17T22:33:12.449475699Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Output":"FAIL\n"} +{"Time":"2026-10-17T22:33:12.45305753Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Output":"FAIL\tgithub.com/netkingdom/access-engine/cmd/access-engine\t0.428s\n"} +{"Time":"2026-10-17T22:33:12.453117585Z","Action":"fail","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Elapsed":0.428} diff --git a/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/reproduce.py b/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/reproduce.py new file mode 100644 index 00000000..319c4f23 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/reproduce.py @@ -0,0 +1,91 @@ +"""Reconstruct interrupted public source tests without touching owner checkouts.""" +from pathlib import Path +import argparse +import hashlib +import io +import json +import shutil +import subprocess +import tarfile +import tempfile +import time + +HERE = Path(__file__).resolve().parent +PACKET = HERE.parent / 'apps-access-engine-integration-r1' +OWNER = Path('/home/worsch/access-engine') +REVISION = 'd328a2601095686f74376d87791bff01e2a3a2a3' +TOOLCHAIN = Path('/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64') +MODULES = Path('/home/worsch/go/pkg/mod') + + +def main(): + parser = argparse.ArgumentParser() + parser.add_argument('target', choices=['adapter', 'producer']) + args = parser.parse_args() + result_path = HERE / (args.target + '-result.json') + log_path = HERE / (args.target + '-test.jsonl') + if result_path.exists() or log_path.exists(): + raise SystemExit('Refusing to overwrite an earlier attempt') + work = Path(tempfile.mkdtemp(prefix='custodian-resume-' + args.target + '-')) + source = work / 'source' + overlay = PACKET / 'access-engine-source' + pins = json.loads((overlay / 'adapters/go/decisionpep/producer-source.json').read_text()) + for name, digest in pins['exact_unchanged_files'].items(): + raw = (overlay / 'adapters/go/decisionpep' / name).read_bytes() + assert hashlib.sha256(raw).hexdigest() == digest, name + assert raw == subprocess.check_output(['git', '-C', str(OWNER), 'show', REVISION + ':' + name]), name + if args.target == 'adapter': + shutil.copytree(overlay / 'adapters/go/decisionpep', source) + test = ['go', 'test', '-p', '4', '-json', './...', '-count=1'] + else: + source.mkdir() + archive = subprocess.check_output(['git', '-C', str(OWNER), 'archive', REVISION]) + with tarfile.open(fileobj=io.BytesIO(archive)) as tar: + tar.extractall(source, filter='data') + for preimage in (PACKET / 'preimages/access-engine').rglob('*'): + if preimage.is_file(): + assert preimage.read_bytes() == (source / preimage.relative_to(PACKET / 'preimages/access-engine')).read_bytes() + for item in overlay.rglob('*'): + if item.is_file(): + target = source / item.relative_to(overlay) + target.parent.mkdir(parents=True, exist_ok=True) + shutil.copyfile(item, target) + # Test the exact producer-owned adapter in the real producer module. + for item in (overlay / 'adapters/go/decisionpep').rglob('*.go'): + target = source / item.relative_to(overlay / 'adapters/go/decisionpep') + target.parent.mkdir(parents=True, exist_ok=True) + if target.exists(): + assert target.read_bytes() == item.read_bytes() + else: + shutil.copyfile(item, target) + test = ['go', 'test', '-p', '4', '-json', './cmd/access-engine', '-run', + 'TestForgejoActualPolicySignedLosslessAndLegacy|TestTrustedServiceActualHTTPPositiveAndRefusals|TestTrustedServiceRetainedRegistryPreapprovalAndRefusals', '-count=1'] + (work / 'home').mkdir() + argv = ['bwrap', '--unshare-net', '--unshare-pid', '--die-with-parent', '--new-session'] + for name in ['/usr', '/lib', '/lib64']: + argv += ['--ro-bind', name, name] + argv += ['--symlink', 'usr/bin', '/bin', '--proc', '/proc', '--dev', '/dev', + '--tmpfs', '/tmp', '--bind', str(work), '/work', + '--ro-bind', str(TOOLCHAIN), '/toolchain', '--ro-bind', str(MODULES), '/modules', + '--chdir', '/work/source', '--clearenv'] + environment = {'PATH': '/toolchain/bin:/usr/bin:/bin', 'HOME': '/work/home', + 'GOTOOLCHAIN': 'local', 'GOPROXY': 'off', 'GOSUMDB': 'off', + 'GOMODCACHE': '/modules', 'GOCACHE': '/work/gocache', + 'GOMAXPROCS': '4', 'CGO_ENABLED': '0'} + for key, value in environment.items(): + argv += ['--setenv', key, value] + argv += ['--'] + test + start = time.monotonic() + with log_path.open('xb') as log: + run = subprocess.run(argv, stdout=log, stderr=subprocess.STDOUT, timeout=900) + result = {'target': args.target, 'source_revision': REVISION, 'returncode': run.returncode, + 'seconds': round(time.monotonic() - start, 2), 'argv': argv, + 'workspace': str(work), 'network': 'disabled', 'pid_namespace': 'private', + 'real_credentials': False, 'canonical_owner_modified': False} + result_path.write_text(json.dumps(result, indent=2) + '\n') + print(json.dumps({'target': args.target, 'returncode': run.returncode, 'seconds': result['seconds']})) + raise SystemExit(run.returncode) + + +if __name__ == '__main__': + main() diff --git a/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/resume_checkpoint.py b/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/resume_checkpoint.py new file mode 100644 index 00000000..49661b44 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/resume_checkpoint.py @@ -0,0 +1,49 @@ +"""Complete the already prepared commit after verifying its interrupted backup.""" +from pathlib import Path +import argparse +import hashlib +import json +import subprocess + +ROOT = Path(__file__).resolve().parents[4] +HERE = Path(__file__).resolve().parent +PACKET = HERE.parent / 'application-source-checkpoint-publication-r1' +config = json.loads((PACKET / 'publication-inputs.json').read_text()) +parser = argparse.ArgumentParser() +parser.add_argument('--attempt', type=int, default=1) +args = parser.parse_args() +assert args.attempt > 0 + + +def git(*args): + return subprocess.check_output(['git', '-C', str(ROOT), *args], stderr=subprocess.PIPE) + + +assert git('rev-parse', 'HEAD').decode().strip() == config['base_revision'] +paths = [row['path'] for row in config['files']] +for row in config['files']: + raw = (ROOT / row['path']).read_bytes() + assert hashlib.sha256(raw).hexdigest() == row['sha256'], row['path'] + assert git('show', ':' + row['path']) == raw, row['path'] +protected = json.loads((PACKET / 'publication-backup/originals.json').read_text()) + + +def verify_protected(): + for row in protected: + assert (ROOT / row['path']).read_bytes() == (PACKET / 'publication-backup' / (row['path'] + '.worktree')).read_bytes() + assert git('ls-files', '--stage', '--', row['path']).decode().strip() == row['index'] + + +verify_protected() +receipt_path = HERE / ('checkpoint-commit.json' if args.attempt == 1 else f'checkpoint-commit-attempt{args.attempt}.json') +assert not receipt_path.exists() +run = subprocess.run(['git', '-C', str(ROOT), 'commit', '--only', '-m', config['message'], '--', *paths], + capture_output=True, text=True, timeout=240) +head = git('rev-parse', 'HEAD').decode().strip() +receipt_path.write_text(json.dumps({'returncode': run.returncode, 'base': config['base_revision'], + 'commit': head, 'files': config['files'], 'stdout': run.stdout, 'stderr': run.stderr, + 'existing_backup_verified': True}, indent=2) + '\n') +verify_protected() +assert run.returncode == 0, 'Normal hook refused; exact failure retained in receipt' +assert set(git('diff-tree', '--no-commit-id', '--name-only', '-r', head).decode().splitlines()) == set(paths) +print(json.dumps({'status': 'committed', 'commit': head, 'files': len(paths), 'protected_state_preserved': True})) diff --git a/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/review.json b/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/review.json new file mode 100644 index 00000000..d73eaa28 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/review.json @@ -0,0 +1,251 @@ +{ + "observed_at": "2026-10-17T22:35:03.733845+00:00", + "decision": "changes-required", + "scope": "Independent review of retained interrupted source candidate; no canonical owner implementation changes", + "checkpoint_commit": "8951d32419079a0b699c9ffdeff5d2df971ff4cd", + "producer_base": "d328a2601095686f74376d87791bff01e2a3a2a3", + "results": { + "adapter": { + "returncode": 1, + "test_results_including_subtests": { + "pass": 33 + }, + "failed_packages": [ + "github.com/netkingdom/access-engine/testsupport/signfixture" + ], + "failed_tests": [] + }, + "producer": { + "returncode": 1, + "test_results_including_subtests": { + "fail": 1, + "pass": 17 + }, + "failed_packages": [ + "github.com/netkingdom/access-engine/cmd/access-engine" + ], + "failed_tests": [ + "TestForgejoActualPolicySignedLosslessAndLegacy" + ] + } + }, + "findings": [ + { + "id": "AE-RESUME-01", + "severity": "high", + "finding": "Exported standalone adapter contains an empty Go file; complete go test ./... fails although decisionpep tests pass.", + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/access-engine-source/adapters/go/decisionpep/testsupport/signfixture/sign.go" + }, + { + "id": "AE-RESUME-02", + "severity": "high", + "finding": "Actual producer rejects policy: five undeclared attributes, no policy fixture and no Rego test block. Registry filename is not recognized; subject inventory is empty. Preserve policy validation when correcting trust provenance.", + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/access-engine-source/examples/forgejo-application-access/policy.md" + }, + { + "id": "AE-RESUME-03", + "severity": "high", + "finding": "Retained consumer callback test file is empty. No completed consumer package run exists; login callback code does not implement ongoing HTTP/API/Git/SSH decisions.", + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/forgejo-source/services/auth/source/oauth2/access_engine_callback_test.go" + } + ], + "existing_work_records": [ + "CUST-WP-0080-T03", + "NK-WP-0048-T43", + "RAPPS-WP-0016-T09" + ], + "private_input_and_transaction_review_records": [ + "NK-WP-0048-T41", + "NK-WP-0048-T42" + ], + "original_interrupted_runs": "unverified; retained unchanged", + "native_gates_closed": 0, + "policy_validation_weakened": false, + "original_candidate_files": [ + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/access-engine-source/adapters/go/decisionpep/LICENSE", + "bytes": 17436, + "sha256": "ff413f361a3b3bf44cf50f110fbcc4837064d57eefbcef89df2b43997c6262b6" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/access-engine-source/adapters/go/decisionpep/go.mod", + "bytes": 52, + "sha256": "fea700810e47c1ba5638b86a168f8531c083a6e1222ca80bd2a8947b2ea6f2c3" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/access-engine-source/adapters/go/decisionpep/internal/sign/sign.go", + "bytes": 2769, + "sha256": "0df9515922e90775ebbfac798361dcafb20da8a4213796b44e246b8a92046cde" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/access-engine-source/adapters/go/decisionpep/pkg/api/canonical.go", + "bytes": 36831, + "sha256": "a122a2e8cd524333b13c5939c7a3685e41efbe47497a64e0c7297c92b7f10d19" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/access-engine-source/adapters/go/decisionpep/pkg/api/caring.go", + "bytes": 17781, + "sha256": "1907156f0f889e7b9e9c14970cf7a86a20d00478a496efaf92c7231f27fec5e3" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/access-engine-source/adapters/go/decisionpep/pkg/api/resource_manifest.go", + "bytes": 1930, + "sha256": "f0fa4080287d389ed48c2b1d6af96cc62e57ef72c902333f677f964420be133f" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/access-engine-source/adapters/go/decisionpep/pkg/decisionpep/client.go", + "bytes": 10582, + "sha256": "0d57f6ddaca5c3f81ce426c0e8b14ba14ea5962096d3be5909aa456eef19eeba" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/access-engine-source/adapters/go/decisionpep/pkg/decisionpep/client_test.go", + "bytes": 10276, + "sha256": "bff576b84df6aea607feea19c6372f543b29dbcc74df76ed43a852c9dc3e48ee" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/access-engine-source/adapters/go/decisionpep/producer-source.json", + "bytes": 799, + "sha256": "09039298bb6e2ad32a6c8c9248468ae8a0e20376b52e05be5d6e5ab9bfd5ecfa" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/access-engine-source/adapters/go/decisionpep/testsupport/signfixture/sign.go", + "bytes": 0, + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/access-engine-source/cmd/access-engine/forgejo_application_profile_test.go", + "bytes": 6918, + "sha256": "850fb348e75a2f773dddca6457a9966e08f17d1dc51dab287d096d1fdc2ff6b3" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/access-engine-source/cmd/access-engine/main.go", + "bytes": 25891, + "sha256": "e4b6ad3b3dd4bb72e9a908fa7eb1296c8202ae92b81922c640c632415dbd6445" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/access-engine-source/examples/forgejo-application-access/policy.md", + "bytes": 2276, + "sha256": "ae6bfa400c5a296ecf656cc7355709797562aba06082c1c7b5acc7cef85c5938" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/access-engine-source/examples/forgejo-application-access/registry.synthetic.json", + "bytes": 713, + "sha256": "f83c53afad98ba72dc199ccada552c9e844d903a94a3168229d985e827fa2f0e" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/access-engine-source/internal/decision/engine.go", + "bytes": 25372, + "sha256": "ecbb73644d979b1f15e1df6945536c20507fb3d3f9640f755a7081a344782c7d" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/access-engine-source/internal/decision/json_profile.go", + "bytes": 949, + "sha256": "430d2c89f47d218ec843af76a9766b42e9d938a15063fc8e979f14c56306f4bc" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/adapter-test-attempt1.json", + "bytes": 1180, + "sha256": "c4d4dc980616a4e9f952542525d05941a5cd856f21715af214804935724ce0dd" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/adapter-test-attempt1.jsonl", + "bytes": 27948, + "sha256": "cab82e4a79c9457e722181e307497368f4657f3118cc79e05095829d143f6ba0" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/evidence/before-lossless-profile/client.go", + "bytes": 10369, + "sha256": "e1eb053c80f752372413ffce2ece8f0407e3c1c827e89a9e33701aa295308cbb" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/evidence/before-lossless-profile/client_test.go", + "bytes": 10072, + "sha256": "22e7f9320ef2847043192b724f1b328a9d613eef5c868b732de49c6c1036f0e8" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/forgejo-process.json", + "bytes": 1526, + "sha256": "1231a2a3f49b40b5e99ab705b74186b4e15603896f6091ade212799c250b7e5f" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/forgejo-source/go.mod", + "bytes": 11884, + "sha256": "130138c4c3ecc29fa0d7f1e2eef0589ddf3b06071f3cc0448aa7b2326847653a" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/forgejo-source/routers/web/auth/oauth.go", + "bytes": 49254, + "sha256": "58bff778e0dc17a521706289bf45c3e0d76a759a0874f76c379b3d1ddb419b17" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/forgejo-source/services/auth/source/oauth2/access_engine.go", + "bytes": 7354, + "sha256": "c1f2b4c76d09687b9b66dd13b3ba671ba92ae72f26751f8c273607ab9be65b07" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/forgejo-source/services/auth/source/oauth2/access_engine_callback_test.go", + "bytes": 0, + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/forgejo-source/services/auth/source/oauth2/access_engine_test.go", + "bytes": 3945, + "sha256": "1bbc4a823cdf93005d72a6db2eb77e0096c80903fbdf247a385431d70b9620da" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/forgejo-source/services/auth/source/oauth2/source_callout.go", + "bytes": 2465, + "sha256": "6abba69df97afc62467f0328eaa5a6383cfb4900202a081dec4b84a21b37349c" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/forgejo-test-attempt1.json", + "bytes": 1571, + "sha256": "50d10751ac9fa2bda38fadbe188f0d592e6b40a9c332814862b13018dc7db70e" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/forgejo-test-attempt1.jsonl", + "bytes": 57, + "sha256": "a50e1a4f26d946322e073feaf1db0666ffa1499c21c3a6578816b92a0aabe0fd" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/forgejo-test-attempt2.jsonl", + "bytes": 0, + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/preimages/access-engine/cmd/access-engine/main.go", + "bytes": 25421, + "sha256": "da6d185ac971aaa652a6b242f5c46007f8b0089e71e6d6b499bd7925b1377758" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/preimages/access-engine/internal/decision/engine.go", + "bytes": 25367, + "sha256": "be6ea0e81422dba6b6d2124530263bf6fd4025c8dcac9360c619adbff0ac0bbd" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/preimages/forgejo/go.mod", + "bytes": 11752, + "sha256": "652162a4a95c6d1c349d2a8c0b514def5abd837f001137b77b7b3f4a0f162d00" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/preimages/forgejo/routers/web/auth/oauth.go", + "bytes": 49258, + "sha256": "081bcb94023d6e27289196bbe518bebba0a8a6082ea1a32d2794c5562075907b" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/preimages/forgejo/services/auth/source/oauth2/source_callout.go", + "bytes": 2310, + "sha256": "c30c418182d4cb98b1e448f621c93322accfbbf92d6a59e6df1ae45a7aa8fc7b" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/producer-process.json", + "bytes": 1484, + "sha256": "5dc3c56931e461bf58129b1a78be916583f1068776e7661445eda409fc33ec46" + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/producer-test-attempt1.jsonl", + "bytes": 0, + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + } + ] +} diff --git a/docs/netkingdom-target-implementation.md b/docs/netkingdom-target-implementation.md index 028fe8dc..9921ca93 100644 --- a/docs/netkingdom-target-implementation.md +++ b/docs/netkingdom-target-implementation.md @@ -1273,3 +1273,31 @@ caller/runtime inputs remain within that assignment's acceptance scope. These source activities do not close T34/T37/T39, T06 native acceptance, or any of the sixteen architecture gates. +### Resumed independent source review + +The interrupted release-build evidence checkpoint is committed as `8951d324`. +Its seventeen selected files match the prepared manifest; the existing staged +brief and other work are preserved. The stale Git index lock was retained under +a recovery name after confirming that no Git process was running. + +Fresh offline reproduction of the exact Access Engine candidate fails both full +commands. The standalone adapter contains an empty `testsupport/signfixture/sign.go`: +its verifier tests pass, but `go test ./...` refuses the incomplete package. The +actual producer compiles, then rejects the Forgejo policy for five undeclared +attribute reads, a missing policy fixture and a missing Rego test block. Its two +existing authenticated-service control functions pass. None of these partial +results accepts the Forgejo policy or its producer integration. The sibling +synthetic registry's filename is outside the validator's recognized inventory; +its empty subject inventory also cannot establish the claimed subject attributes. +Corrections must preserve validation and the distinction between verified runtime +identity facts and registry-owned attributes. + +The consumer's retained callback test file is empty, and its source callout covers +login only. Actual package compilation and positive/adverse callback checks, +ongoing HTTP/API/Git/SSH decisions, operation/inverse identities and live owner +admission remain open in NK48-T43 / RAPPS-WP-0016-T09. The interrupted process +receipts remain unverified. Private-input and database primitives retain their +historical tests and still require independent review and owner integration under +T41/T42. Exact runners, failures and source inventory are in +`application-resume-review-r1/`; no native target gate is closed. + diff --git a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md index 8b58c36f..11bef473 100644 --- a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md +++ b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md @@ -78,6 +78,22 @@ bootstrap callers and approved exception evidence. Reuse owner work where it already covers the finding. Record new concrete uncovered implementation work before closing this task. Never populate secret values or invent owner approval. +2026-10-18 resumed application review: completed the interrupted seventeen-file +release-build evidence checkpoint as `8951d324`, preserving the staged brief and +other work. Reconstructed the exact retained Access Engine adapter and producer +candidate against producer source `d328a260` in network-disabled, private-PID +sandboxes. Both full commands fail: the adapter includes an empty Go source file; +the actual producer rejects the Forgejo policy for undeclared attributes and +missing embedded/referenced fixtures and Rego tests. Adapter verifier tests and +two existing producer control functions pass, but do not establish package or +policy acceptance. The consumer callback test file is also empty, and ongoing +HTTP/API/Git/SSH coverage is absent from the candidate. Original interrupted runs +remain unverified; no previous success is overwritten. Evidence and exact source +pins: `docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/`. +NK48-T43 / RAPPS-WP-0016-T09 retain these corrections and full profile acceptance; +T41/T42 retain independent private-input/transaction review and owner integration. +No task or native target gate is closed by this review. + 2026-10-12: KEY-WP-0040 source defect repaired and committed as key-cape `1344fc8`. Twenty recovery tests and the full Go suite pass. Blue-lane code-volume-only deployment reached generation 11 Ready; health 200 and anonymous recovery 403