Include critical-path owners in flow reporting and record verified Argo transport
This commit is contained in:
codex
parent
d377b5f30c
commit
5328a6a8b3
11 changed files with 150 additions and 3 deletions
|
|
@ -469,6 +469,30 @@
|
|||
"INFD-IN-0010",
|
||||
"INFD-IN-0009"
|
||||
]
|
||||
},
|
||||
{
|
||||
"proposal_id": "RPF-WP-0044-T04/public-transport-v1",
|
||||
"disposition": "unscored",
|
||||
"outcome": "succeeded",
|
||||
"original_revision": 1,
|
||||
"original_digest_sha256": "2e3094f4970f600b13b145386eab323f41e344e379a9e8b83282178e387a5920",
|
||||
"proposal_ref": "railiance-platform/docs/evidence/2026-10-11-issue-core-transport/transport-plan.json",
|
||||
"authorization_ref": "D2 89f1058f-33bc-47a8-8a49-0b44d426c67e; accepted build-mode blue-lane canon",
|
||||
"target": "railiance01 argocd public host ConfigMap and railiance-tenants AppProject",
|
||||
"expected_result": "Preserve prior public host pins and repository admissions, append only provider-verified Forgejo SSH key and exact private wrapper URL",
|
||||
"verification_ref": "docs/evidence/2026-10-11-issue-core-public-transport/verification.json",
|
||||
"rollback": "UID/preimage-tested inverse fields via same bounded helper; restore owner source",
|
||||
"abort_owner": "railiance-platform with railiance-enablement",
|
||||
"cost_estimate_eur": 0,
|
||||
"risk_estimate": "Public transport admission only; no Secret, credential, network permission or workload change. Partial failures retained; no implicit replay.",
|
||||
"promotion_evidence": false,
|
||||
"reason": "Standing founder authorization; no backfilled exact-revision scoring or autopilot authority.",
|
||||
"executed_revision": 1,
|
||||
"executed_digest_sha256": "2e3094f4970f600b13b145386eab323f41e344e379a9e8b83282178e387a5920",
|
||||
"executed_source_revision": "railiance-platform@1dc1d2f3a11ed74be4a4701167ee60782d616544; railiance-enablement@51a7c4cee68b48ed7a236e661b39c1d3cca92063",
|
||||
"execution_ref": "docs/evidence/2026-10-11-issue-core-public-transport/execution.json",
|
||||
"verified_outcome": "Both exact public fields changed and independently read back; no credential/Secret/network/workload changes. Issuance and adoption remain unexecuted.",
|
||||
"refinement_or_rescue": false
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
|
|||
|
|
@ -50,3 +50,24 @@ In the Claude prompt:
|
|||
|
||||
- **NK-WP-0022-T08:** the CoulombCore deletion batch. It appears here only after Sol's railiance01
|
||||
restore/restart drill has a passing receipt.
|
||||
|
||||
## Added by the critical-path run
|
||||
|
||||
### RPF-WP-0044-T04 — attended OpenBao issuer login
|
||||
|
||||
D2 already approves the exact private issue-core repository reader. The actual
|
||||
remaining human act is the existing Platform OpenBao OIDC/MFA login. No second
|
||||
reader-scope decision is requested. The bounded issuer is prepared in
|
||||
`railiance-platform/scripts/provision_argocd_issue_core_repository.py`; review and
|
||||
rollback are recorded in that repo’s
|
||||
`docs/evidence/2026-10-11-issue-core-credential/owner-review.json`.
|
||||
|
||||
Before the window, complete the public SSH host/project prerequisite and seal
|
||||
the fixed contract with its exact digest, host pin, owner review, existing-egress
|
||||
proof, runtime identity, expiry and rollback references. The example contract is
|
||||
incomplete; it is not an execution approval. During the window, the operator
|
||||
uses the reviewed fixed command through the existing Platform admin login. The
|
||||
agent does not receive credential values. Preserve the exclusive private journal;
|
||||
any ambiguous provider/write/unwrap/destination result stops replay for owner
|
||||
reconciliation. Verify one-time consumption, exact destination and then independent
|
||||
Argo adoption. This has not been executed.
|
||||
|
|
|
|||
|
|
@ -32,3 +32,30 @@ Release remains blocked independently by an unreviewed
|
|||
`net-kingdom/canon/standards/security-layer-model_v0.9.md` source-inventory entry.
|
||||
The source owner must resolve its publication disposition before the full audit
|
||||
passes; batch acceptance cannot bypass that release check.
|
||||
|
||||
## FLEX-WP-0036-T05 — renamed TokenReview principals
|
||||
|
||||
The prepared source creates nine ServiceAccounts in `access-engine`, each with
|
||||
its own identically named `-tokenreviewer` ClusterRole/ClusterRoleBinding. The
|
||||
only permission is cluster-scoped `create` on
|
||||
`authentication.k8s.io/tokenreviews`. Subjects:
|
||||
|
||||
- `access-engine-application-readback`
|
||||
- `access-engine-informed-decision-lifecycle`
|
||||
- `access-engine-informed-decision-sitting`
|
||||
- `access-engine-informed-decision-t03`
|
||||
- `access-engine-ops-warden-fetch`
|
||||
- `access-engine-ops-warden`
|
||||
- `access-engine-secrets-engine`
|
||||
- `access-engine-tenant-engine`
|
||||
- `access-engine-user-engine`
|
||||
|
||||
This adds principals even though capability sets match the existing reviewers,
|
||||
so it requires an exact access-scope disposition. Source preparation is tested;
|
||||
no grant or rollout has run. Receipt:
|
||||
`access-engine/docs/evidence/2026-10-11-runtime-twins/access-runtime-twins-prepared-receipt-v2.json`.
|
||||
The original blue classification is retained as superseded. Scaling Deployments
|
||||
to zero does not revoke RBAC: recovery also removes only these newly issued
|
||||
bindings. Existing reviewers and consumer grants remain available during recovery.
|
||||
Live execution still requires T03/T04 and the ordered predecessor proof, fresh
|
||||
image/inventory reconciliation, server dry-run, headroom and the reviewed receipt.
|
||||
|
|
|
|||
|
|
@ -0,0 +1 @@
|
|||
{"action": "dry-run", "approval_ref": "89f1058f-33bc-47a8-8a49-0b44d426c67e", "captured_at": "2026-10-11T20:45:29.127862+00:00", "mutation_attempted": false, "passed": true, "plan_sha256": "2e3094f4970f600b13b145386eab323f41e344e379a9e8b83282178e387a5920", "resources": [{"after_sha256": "d581e92dd00161e8624bb3ee9e172f31f103ea9655975aaa0cc3ed32323b1dd2", "before_sha256": "54ecbee860c225158ae45e2bd93cba8b5b0418d27c2b06f8f1487b1c7453a8da", "field": "/data/ssh_known_hosts", "kind": "configmap", "name": "argocd-ssh-known-hosts-cm", "server_dry_run": true, "uid": "e1481984-dc5d-4fcc-9f2a-118c054865b7"}, {"after_sha256": "d07d4296f3cb0c726dd30ea2c908982f197a7aaaa48862560e3776960e4fac5d", "before_sha256": "636ee06479d4be73d956cdbeb9d4bddb24cd463bbbb70de10b8cfd043791eb31", "field": "/spec/sourceRepos", "kind": "appproject", "name": "railiance-tenants", "server_dry_run": true, "uid": "f899f3ec-2c55-4cd0-9cb0-b2b4c6eb9be2"}], "schema": "argocd-public-transport-receipt/v1", "secret_or_credential_calls": false, "task": "RPF-WP-0044-T04"}
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"action": "execute", "approval_ref": "89f1058f-33bc-47a8-8a49-0b44d426c67e", "captured_at": "2026-10-11T20:53:54.916972+00:00", "mutation_attempted": true, "passed": true, "pending_target": null, "plan_sha256": "2e3094f4970f600b13b145386eab323f41e344e379a9e8b83282178e387a5920", "resources": [{"after_sha256": "d581e92dd00161e8624bb3ee9e172f31f103ea9655975aaa0cc3ed32323b1dd2", "before_sha256": "54ecbee860c225158ae45e2bd93cba8b5b0418d27c2b06f8f1487b1c7453a8da", "changed_verified": true, "field": "/data/ssh_known_hosts", "kind": "configmap", "name": "argocd-ssh-known-hosts-cm", "server_dry_run": true, "uid": "e1481984-dc5d-4fcc-9f2a-118c054865b7"}, {"after_sha256": "d07d4296f3cb0c726dd30ea2c908982f197a7aaaa48862560e3776960e4fac5d", "before_sha256": "636ee06479d4be73d956cdbeb9d4bddb24cd463bbbb70de10b8cfd043791eb31", "changed_verified": true, "field": "/spec/sourceRepos", "kind": "appproject", "name": "railiance-tenants", "server_dry_run": true, "uid": "f899f3ec-2c55-4cd0-9cb0-b2b4c6eb9be2"}], "schema": "argocd-public-transport-receipt/v1", "secret_or_credential_calls": false, "task": "RPF-WP-0044-T04"}
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
{
|
||||
"schema": "argocd-ssh-transport-observation/v1",
|
||||
"estate_verified": true,
|
||||
"repository_server_tcp_30022_reachable": true,
|
||||
"known_hosts_configmap_uid": "e1481984-dc5d-4fcc-9f2a-118c054865b7",
|
||||
"forgejo_authoritative_public_key_matches_known_hosts": false,
|
||||
"forgejo_public_key": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC7jadWwHX2j1aeXSonkdwP8CI5j1a+ihzj6kq7697h+8B5X2SpYBvwOi2brYmgoiccyapB2aowmctMLLTtrhMaARtvnZPeoFgPhBrdHaUhHdmTeSg7MbRBu5D8yYTt3CwDxF1+MUFE+NuRhCXRHQLbLCqTLlU9hgZV4xuqsv71lvNHzcF3vMcolTBtdVzTsgCfeV9J8wQMXTC7rFfVuRi5fC6m994KN+vt94VHIZcZwFgjdCEZ4uo7U07Fdp3MT6WMqgLftc9ewBL/p+i5BtzVkF725d5QMx6TL6vLrC7X8lrkUWQL+oy5CeUrnOnsyiuwbYwlFVLsdypa2WbdlHtkllBXVD2IdTxeu038BAjWBXkN1WCGEXWJvj829I8FzObnO+QoOsbwdmGSTFqBX7+2vSymbEHtNcS0/0jk5xUvdnvFRvkzDvhQjMgiF8LIVCk4zWTBeWPQ5r5lLooFn8B1hmsgqHVSd2DXMPUMOuTQRTdxpNicNkBlwEQSwFYSCf3vL+x2e2pIx4YvkLD+1bEwNwB8HIuzF1Vex7Cjbo07pTwxhTJ52ZFQNkja/LqyAzO0bOEb9MF6KIxXKS/qL5C2cf8kHB5eXbiAwbv3jkxVzBiYPEMJYxO0pJKaKK8Cvs8cT2MYsxQkly1MENsvf15eOHqg26CPz/PiruHkiifhXw==",
|
||||
"provider_pod_uid": "bc771b51-e9b8-456d-b59c-e7041704389d",
|
||||
"argocd_network_policy_names": [
|
||||
"argocd-application-controller-network-policy",
|
||||
"argocd-applicationset-controller-network-policy",
|
||||
"argocd-redis-network-policy",
|
||||
"argocd-repo-server-network-policy"
|
||||
],
|
||||
"mutation": false,
|
||||
"secret_values_observed": false
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"action": "verify", "approval_ref": "89f1058f-33bc-47a8-8a49-0b44d426c67e", "captured_at": "2026-10-11T20:54:13.283947+00:00", "mutation_attempted": false, "passed": true, "plan_sha256": "2e3094f4970f600b13b145386eab323f41e344e379a9e8b83282178e387a5920", "resources": [{"after_sha256": "d581e92dd00161e8624bb3ee9e172f31f103ea9655975aaa0cc3ed32323b1dd2", "before_sha256": "54ecbee860c225158ae45e2bd93cba8b5b0418d27c2b06f8f1487b1c7453a8da", "field": "/data/ssh_known_hosts", "kind": "configmap", "name": "argocd-ssh-known-hosts-cm", "uid": "e1481984-dc5d-4fcc-9f2a-118c054865b7", "verified": true}, {"after_sha256": "d07d4296f3cb0c726dd30ea2c908982f197a7aaaa48862560e3776960e4fac5d", "before_sha256": "636ee06479d4be73d956cdbeb9d4bddb24cd463bbbb70de10b8cfd043791eb31", "field": "/spec/sourceRepos", "kind": "appproject", "name": "railiance-tenants", "uid": "f899f3ec-2c55-4cd0-9cb0-b2b4c6eb9be2", "verified": true}], "schema": "argocd-public-transport-receipt/v1", "secret_or_credential_calls": false, "task": "RPF-WP-0044-T04"}
|
||||
|
|
@ -45,7 +45,7 @@ def save(path, data):
|
|||
def main():
|
||||
parser = argparse.ArgumentParser(description=__doc__)
|
||||
parser.add_argument("--root", default=str(Path.home()))
|
||||
parser.add_argument("--repos", default=",".join(["the-custodian", *DEFAULT_REPOS]))
|
||||
parser.add_argument("--repos", default=",".join(dict.fromkeys(["the-custodian", *DEFAULT_REPOS])))
|
||||
parser.add_argument("--hub", default="http://127.0.0.1:8000")
|
||||
parser.add_argument("--agent", default="the-custodian")
|
||||
parser.add_argument("--founder", default="human")
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ Usage: security_flow_report.py [--repos a,b,c] [--json]
|
|||
"""
|
||||
import argparse, glob, json, os, re
|
||||
|
||||
DEFAULT_REPOS = ("net-kingdom railiance-platform access-engine secrets-engine ops-mason "
|
||||
DEFAULT_REPOS = ("the-custodian net-kingdom railiance-platform activity-core access-engine secrets-engine ops-mason "
|
||||
"ops-warden key-cape user-engine tenant-engine gate-house kings-guard "
|
||||
"policy-nexus rapp-policy-nexus").split()
|
||||
TERMINAL = {"done", "cancel"}
|
||||
|
|
@ -41,7 +41,7 @@ def load(root, repos):
|
|||
tasks[tid] = {"id": tid, "status": field(b, "status"), "deps": deps,
|
||||
"human": field(b, "needs_human") == "true",
|
||||
"blocked_on": field(b, "blocked_on"),
|
||||
"reason": field(b, "blocking_reason"),
|
||||
"reason": field(b, "blocking_reason") or field(b, "intervention_note"),
|
||||
"priority": field(b, "priority"), "wp": wp}
|
||||
return tasks
|
||||
|
||||
|
|
|
|||
48
tests/test_security_flow_report.py
Normal file
48
tests/test_security_flow_report.py
Normal file
|
|
@ -0,0 +1,48 @@
|
|||
import json
|
||||
from pathlib import Path
|
||||
import subprocess
|
||||
import sys
|
||||
|
||||
|
||||
SCRIPT = Path(__file__).parents[1] / "scripts/security_flow_report.py"
|
||||
|
||||
|
||||
def workplan(root, repo, task):
|
||||
directory = root / repo / "workplans"
|
||||
directory.mkdir(parents=True, exist_ok=True)
|
||||
(directory / "test.md").write_text(
|
||||
"---\nstatus: active\nflavor: implementation\n---\n\n"
|
||||
"## Work\n\n```task\n" + task + "\n```\n"
|
||||
)
|
||||
|
||||
|
||||
def report(root):
|
||||
return json.loads(subprocess.check_output(
|
||||
[sys.executable, str(SCRIPT), "--root", str(root), "--json"], text=True
|
||||
))
|
||||
|
||||
|
||||
def test_default_estate_observes_activity_owner_dependency(tmp_path):
|
||||
workplan(tmp_path, "railiance-platform",
|
||||
"id: RPF-WP-0048-T02\nstatus: wait\npriority: high\n"
|
||||
"depends_on: [ACTIVITY-WP-0041-T03]")
|
||||
workplan(tmp_path, "activity-core",
|
||||
"id: ACTIVITY-WP-0041-T03\nstatus: todo\npriority: high")
|
||||
waiting = report(tmp_path)
|
||||
assert [t["id"] for t in waiting["READY"]] == ["ACTIVITY-WP-0041-T03"]
|
||||
assert waiting["UNBLOCKED"] == []
|
||||
workplan(tmp_path, "activity-core",
|
||||
"id: ACTIVITY-WP-0041-T03\nstatus: done\npriority: high")
|
||||
assert [t["id"] for t in report(tmp_path)["UNBLOCKED"]] == ["RPF-WP-0048-T02"]
|
||||
|
||||
|
||||
def test_default_estate_includes_custodian_and_explains_human_gate(tmp_path):
|
||||
workplan(tmp_path, "the-custodian",
|
||||
"id: CUST-WP-0079-T05\nstatus: progress\npriority: medium")
|
||||
workplan(tmp_path, "policy-nexus",
|
||||
"id: PNEX-WP-0006-T01\nstatus: wait\npriority: high\n"
|
||||
'needs_human: true\nintervention_note: "Public publication in daily batch"')
|
||||
result = report(tmp_path)
|
||||
assert [t["id"] for t in result["READY"]] == ["CUST-WP-0079-T05"]
|
||||
assert result["ATTENDED"][0]["reason"] == "Public publication in daily batch"
|
||||
assert result["UNBLOCKED"] == []
|
||||
|
|
@ -126,6 +126,13 @@ committed the already reviewed, staged implementation as `6fe7201`; that commit
|
|||
includes source code. Future generated-only commits are rejected locally and in
|
||||
CI. The full Custodian suite passes 77 tests.
|
||||
|
||||
The default flow report now includes Custodian and activity-core, both required
|
||||
by the renewed critical path. Cross-owner completion can therefore unblock the
|
||||
platform activation task without an agent polling its wait body. Human gates
|
||||
also retain their intervention note in the generated report instead of a blank
|
||||
reason. CLI regression checks cover the actual owner completion transition and
|
||||
the default Custodian lane.
|
||||
|
||||
## Attended window #1
|
||||
|
||||
```task
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue