From 5328a6a8b3ef8b85f7f1537e99e48c3953e4bf8b Mon Sep 17 00:00:00 2001 From: codex Date: Sun, 11 Oct 2026 22:54:28 +0200 Subject: [PATCH] Include critical-path owners in flow reporting and record verified Argo transport --- .../agents/custodian-codex/supervision.json | 24 ++++++++++ docs/attended-window/2026-10-11-checklist.md | 21 ++++++++ .../2026-10-11-daily-red-batch.md | 27 +++++++++++ .../dry-run.json | 1 + .../execution.json | 1 + .../public-authority-observation.json | 17 +++++++ .../verification.json | 1 + scripts/security_flow_daily.py | 2 +- scripts/security_flow_report.py | 4 +- tests/test_security_flow_report.py | 48 +++++++++++++++++++ ...UST-WP-0079-deterministic-security-flow.md | 7 +++ 11 files changed, 150 insertions(+), 3 deletions(-) create mode 100644 docs/evidence/2026-10-11-issue-core-public-transport/dry-run.json create mode 100644 docs/evidence/2026-10-11-issue-core-public-transport/execution.json create mode 100644 docs/evidence/2026-10-11-issue-core-public-transport/public-authority-observation.json create mode 100644 docs/evidence/2026-10-11-issue-core-public-transport/verification.json create mode 100644 tests/test_security_flow_report.py diff --git a/.kaizen/agents/custodian-codex/supervision.json b/.kaizen/agents/custodian-codex/supervision.json index 21ac31f9..a732f670 100644 --- a/.kaizen/agents/custodian-codex/supervision.json +++ b/.kaizen/agents/custodian-codex/supervision.json @@ -469,6 +469,30 @@ "INFD-IN-0010", "INFD-IN-0009" ] + }, + { + "proposal_id": "RPF-WP-0044-T04/public-transport-v1", + "disposition": "unscored", + "outcome": "succeeded", + "original_revision": 1, + "original_digest_sha256": "2e3094f4970f600b13b145386eab323f41e344e379a9e8b83282178e387a5920", + "proposal_ref": "railiance-platform/docs/evidence/2026-10-11-issue-core-transport/transport-plan.json", + "authorization_ref": "D2 89f1058f-33bc-47a8-8a49-0b44d426c67e; accepted build-mode blue-lane canon", + "target": "railiance01 argocd public host ConfigMap and railiance-tenants AppProject", + "expected_result": "Preserve prior public host pins and repository admissions, append only provider-verified Forgejo SSH key and exact private wrapper URL", + "verification_ref": "docs/evidence/2026-10-11-issue-core-public-transport/verification.json", + "rollback": "UID/preimage-tested inverse fields via same bounded helper; restore owner source", + "abort_owner": "railiance-platform with railiance-enablement", + "cost_estimate_eur": 0, + "risk_estimate": "Public transport admission only; no Secret, credential, network permission or workload change. Partial failures retained; no implicit replay.", + "promotion_evidence": false, + "reason": "Standing founder authorization; no backfilled exact-revision scoring or autopilot authority.", + "executed_revision": 1, + "executed_digest_sha256": "2e3094f4970f600b13b145386eab323f41e344e379a9e8b83282178e387a5920", + "executed_source_revision": "railiance-platform@1dc1d2f3a11ed74be4a4701167ee60782d616544; railiance-enablement@51a7c4cee68b48ed7a236e661b39c1d3cca92063", + "execution_ref": "docs/evidence/2026-10-11-issue-core-public-transport/execution.json", + "verified_outcome": "Both exact public fields changed and independently read back; no credential/Secret/network/workload changes. Issuance and adoption remain unexecuted.", + "refinement_or_rescue": false } ] } diff --git a/docs/attended-window/2026-10-11-checklist.md b/docs/attended-window/2026-10-11-checklist.md index f39a7047..51e5fb5b 100644 --- a/docs/attended-window/2026-10-11-checklist.md +++ b/docs/attended-window/2026-10-11-checklist.md @@ -50,3 +50,24 @@ In the Claude prompt: - **NK-WP-0022-T08:** the CoulombCore deletion batch. It appears here only after Sol's railiance01 restore/restart drill has a passing receipt. + +## Added by the critical-path run + +### RPF-WP-0044-T04 — attended OpenBao issuer login + +D2 already approves the exact private issue-core repository reader. The actual +remaining human act is the existing Platform OpenBao OIDC/MFA login. No second +reader-scope decision is requested. The bounded issuer is prepared in +`railiance-platform/scripts/provision_argocd_issue_core_repository.py`; review and +rollback are recorded in that repo’s +`docs/evidence/2026-10-11-issue-core-credential/owner-review.json`. + +Before the window, complete the public SSH host/project prerequisite and seal +the fixed contract with its exact digest, host pin, owner review, existing-egress +proof, runtime identity, expiry and rollback references. The example contract is +incomplete; it is not an execution approval. During the window, the operator +uses the reviewed fixed command through the existing Platform admin login. The +agent does not receive credential values. Preserve the exclusive private journal; +any ambiguous provider/write/unwrap/destination result stops replay for owner +reconciliation. Verify one-time consumption, exact destination and then independent +Argo adoption. This has not been executed. diff --git a/docs/attended-window/2026-10-11-daily-red-batch.md b/docs/attended-window/2026-10-11-daily-red-batch.md index 95834a5b..b2c69124 100644 --- a/docs/attended-window/2026-10-11-daily-red-batch.md +++ b/docs/attended-window/2026-10-11-daily-red-batch.md @@ -32,3 +32,30 @@ Release remains blocked independently by an unreviewed `net-kingdom/canon/standards/security-layer-model_v0.9.md` source-inventory entry. The source owner must resolve its publication disposition before the full audit passes; batch acceptance cannot bypass that release check. + +## FLEX-WP-0036-T05 — renamed TokenReview principals + +The prepared source creates nine ServiceAccounts in `access-engine`, each with +its own identically named `-tokenreviewer` ClusterRole/ClusterRoleBinding. The +only permission is cluster-scoped `create` on +`authentication.k8s.io/tokenreviews`. Subjects: + +- `access-engine-application-readback` +- `access-engine-informed-decision-lifecycle` +- `access-engine-informed-decision-sitting` +- `access-engine-informed-decision-t03` +- `access-engine-ops-warden-fetch` +- `access-engine-ops-warden` +- `access-engine-secrets-engine` +- `access-engine-tenant-engine` +- `access-engine-user-engine` + +This adds principals even though capability sets match the existing reviewers, +so it requires an exact access-scope disposition. Source preparation is tested; +no grant or rollout has run. Receipt: +`access-engine/docs/evidence/2026-10-11-runtime-twins/access-runtime-twins-prepared-receipt-v2.json`. +The original blue classification is retained as superseded. Scaling Deployments +to zero does not revoke RBAC: recovery also removes only these newly issued +bindings. Existing reviewers and consumer grants remain available during recovery. +Live execution still requires T03/T04 and the ordered predecessor proof, fresh +image/inventory reconciliation, server dry-run, headroom and the reviewed receipt. diff --git a/docs/evidence/2026-10-11-issue-core-public-transport/dry-run.json b/docs/evidence/2026-10-11-issue-core-public-transport/dry-run.json new file mode 100644 index 00000000..c6a7b3bf --- /dev/null +++ b/docs/evidence/2026-10-11-issue-core-public-transport/dry-run.json @@ -0,0 +1 @@ +{"action": "dry-run", "approval_ref": "89f1058f-33bc-47a8-8a49-0b44d426c67e", "captured_at": "2026-10-11T20:45:29.127862+00:00", "mutation_attempted": false, "passed": true, "plan_sha256": "2e3094f4970f600b13b145386eab323f41e344e379a9e8b83282178e387a5920", "resources": [{"after_sha256": "d581e92dd00161e8624bb3ee9e172f31f103ea9655975aaa0cc3ed32323b1dd2", "before_sha256": "54ecbee860c225158ae45e2bd93cba8b5b0418d27c2b06f8f1487b1c7453a8da", "field": "/data/ssh_known_hosts", "kind": "configmap", "name": "argocd-ssh-known-hosts-cm", "server_dry_run": true, "uid": "e1481984-dc5d-4fcc-9f2a-118c054865b7"}, {"after_sha256": "d07d4296f3cb0c726dd30ea2c908982f197a7aaaa48862560e3776960e4fac5d", "before_sha256": "636ee06479d4be73d956cdbeb9d4bddb24cd463bbbb70de10b8cfd043791eb31", "field": "/spec/sourceRepos", "kind": "appproject", "name": "railiance-tenants", "server_dry_run": true, "uid": "f899f3ec-2c55-4cd0-9cb0-b2b4c6eb9be2"}], "schema": "argocd-public-transport-receipt/v1", "secret_or_credential_calls": false, "task": "RPF-WP-0044-T04"} diff --git a/docs/evidence/2026-10-11-issue-core-public-transport/execution.json b/docs/evidence/2026-10-11-issue-core-public-transport/execution.json new file mode 100644 index 00000000..4d1a7dff --- /dev/null +++ b/docs/evidence/2026-10-11-issue-core-public-transport/execution.json @@ -0,0 +1 @@ +{"action": "execute", "approval_ref": "89f1058f-33bc-47a8-8a49-0b44d426c67e", "captured_at": "2026-10-11T20:53:54.916972+00:00", "mutation_attempted": true, "passed": true, "pending_target": null, "plan_sha256": "2e3094f4970f600b13b145386eab323f41e344e379a9e8b83282178e387a5920", "resources": [{"after_sha256": "d581e92dd00161e8624bb3ee9e172f31f103ea9655975aaa0cc3ed32323b1dd2", "before_sha256": "54ecbee860c225158ae45e2bd93cba8b5b0418d27c2b06f8f1487b1c7453a8da", "changed_verified": true, "field": "/data/ssh_known_hosts", "kind": "configmap", "name": "argocd-ssh-known-hosts-cm", "server_dry_run": true, "uid": "e1481984-dc5d-4fcc-9f2a-118c054865b7"}, {"after_sha256": "d07d4296f3cb0c726dd30ea2c908982f197a7aaaa48862560e3776960e4fac5d", "before_sha256": "636ee06479d4be73d956cdbeb9d4bddb24cd463bbbb70de10b8cfd043791eb31", "changed_verified": true, "field": "/spec/sourceRepos", "kind": "appproject", "name": "railiance-tenants", "server_dry_run": true, "uid": "f899f3ec-2c55-4cd0-9cb0-b2b4c6eb9be2"}], "schema": "argocd-public-transport-receipt/v1", "secret_or_credential_calls": false, "task": "RPF-WP-0044-T04"} diff --git a/docs/evidence/2026-10-11-issue-core-public-transport/public-authority-observation.json b/docs/evidence/2026-10-11-issue-core-public-transport/public-authority-observation.json new file mode 100644 index 00000000..7d5e26f4 --- /dev/null +++ b/docs/evidence/2026-10-11-issue-core-public-transport/public-authority-observation.json @@ -0,0 +1,17 @@ +{ + "schema": "argocd-ssh-transport-observation/v1", + "estate_verified": true, + "repository_server_tcp_30022_reachable": true, + "known_hosts_configmap_uid": "e1481984-dc5d-4fcc-9f2a-118c054865b7", + "forgejo_authoritative_public_key_matches_known_hosts": false, + "forgejo_public_key": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC7jadWwHX2j1aeXSonkdwP8CI5j1a+ihzj6kq7697h+8B5X2SpYBvwOi2brYmgoiccyapB2aowmctMLLTtrhMaARtvnZPeoFgPhBrdHaUhHdmTeSg7MbRBu5D8yYTt3CwDxF1+MUFE+NuRhCXRHQLbLCqTLlU9hgZV4xuqsv71lvNHzcF3vMcolTBtdVzTsgCfeV9J8wQMXTC7rFfVuRi5fC6m994KN+vt94VHIZcZwFgjdCEZ4uo7U07Fdp3MT6WMqgLftc9ewBL/p+i5BtzVkF725d5QMx6TL6vLrC7X8lrkUWQL+oy5CeUrnOnsyiuwbYwlFVLsdypa2WbdlHtkllBXVD2IdTxeu038BAjWBXkN1WCGEXWJvj829I8FzObnO+QoOsbwdmGSTFqBX7+2vSymbEHtNcS0/0jk5xUvdnvFRvkzDvhQjMgiF8LIVCk4zWTBeWPQ5r5lLooFn8B1hmsgqHVSd2DXMPUMOuTQRTdxpNicNkBlwEQSwFYSCf3vL+x2e2pIx4YvkLD+1bEwNwB8HIuzF1Vex7Cjbo07pTwxhTJ52ZFQNkja/LqyAzO0bOEb9MF6KIxXKS/qL5C2cf8kHB5eXbiAwbv3jkxVzBiYPEMJYxO0pJKaKK8Cvs8cT2MYsxQkly1MENsvf15eOHqg26CPz/PiruHkiifhXw==", + "provider_pod_uid": "bc771b51-e9b8-456d-b59c-e7041704389d", + "argocd_network_policy_names": [ + "argocd-application-controller-network-policy", + "argocd-applicationset-controller-network-policy", + "argocd-redis-network-policy", + "argocd-repo-server-network-policy" + ], + "mutation": false, + "secret_values_observed": false +} diff --git a/docs/evidence/2026-10-11-issue-core-public-transport/verification.json b/docs/evidence/2026-10-11-issue-core-public-transport/verification.json new file mode 100644 index 00000000..cf8c537e --- /dev/null +++ b/docs/evidence/2026-10-11-issue-core-public-transport/verification.json @@ -0,0 +1 @@ +{"action": "verify", "approval_ref": "89f1058f-33bc-47a8-8a49-0b44d426c67e", "captured_at": "2026-10-11T20:54:13.283947+00:00", "mutation_attempted": false, "passed": true, "plan_sha256": "2e3094f4970f600b13b145386eab323f41e344e379a9e8b83282178e387a5920", "resources": [{"after_sha256": "d581e92dd00161e8624bb3ee9e172f31f103ea9655975aaa0cc3ed32323b1dd2", "before_sha256": "54ecbee860c225158ae45e2bd93cba8b5b0418d27c2b06f8f1487b1c7453a8da", "field": "/data/ssh_known_hosts", "kind": "configmap", "name": "argocd-ssh-known-hosts-cm", "uid": "e1481984-dc5d-4fcc-9f2a-118c054865b7", "verified": true}, {"after_sha256": "d07d4296f3cb0c726dd30ea2c908982f197a7aaaa48862560e3776960e4fac5d", "before_sha256": "636ee06479d4be73d956cdbeb9d4bddb24cd463bbbb70de10b8cfd043791eb31", "field": "/spec/sourceRepos", "kind": "appproject", "name": "railiance-tenants", "uid": "f899f3ec-2c55-4cd0-9cb0-b2b4c6eb9be2", "verified": true}], "schema": "argocd-public-transport-receipt/v1", "secret_or_credential_calls": false, "task": "RPF-WP-0044-T04"} diff --git a/scripts/security_flow_daily.py b/scripts/security_flow_daily.py index 6df2e4a3..1d180547 100644 --- a/scripts/security_flow_daily.py +++ b/scripts/security_flow_daily.py @@ -45,7 +45,7 @@ def save(path, data): def main(): parser = argparse.ArgumentParser(description=__doc__) parser.add_argument("--root", default=str(Path.home())) - parser.add_argument("--repos", default=",".join(["the-custodian", *DEFAULT_REPOS])) + parser.add_argument("--repos", default=",".join(dict.fromkeys(["the-custodian", *DEFAULT_REPOS]))) parser.add_argument("--hub", default="http://127.0.0.1:8000") parser.add_argument("--agent", default="the-custodian") parser.add_argument("--founder", default="human") diff --git a/scripts/security_flow_report.py b/scripts/security_flow_report.py index f29c03de..e648cdb0 100644 --- a/scripts/security_flow_report.py +++ b/scripts/security_flow_report.py @@ -13,7 +13,7 @@ Usage: security_flow_report.py [--repos a,b,c] [--json] """ import argparse, glob, json, os, re -DEFAULT_REPOS = ("net-kingdom railiance-platform access-engine secrets-engine ops-mason " +DEFAULT_REPOS = ("the-custodian net-kingdom railiance-platform activity-core access-engine secrets-engine ops-mason " "ops-warden key-cape user-engine tenant-engine gate-house kings-guard " "policy-nexus rapp-policy-nexus").split() TERMINAL = {"done", "cancel"} @@ -41,7 +41,7 @@ def load(root, repos): tasks[tid] = {"id": tid, "status": field(b, "status"), "deps": deps, "human": field(b, "needs_human") == "true", "blocked_on": field(b, "blocked_on"), - "reason": field(b, "blocking_reason"), + "reason": field(b, "blocking_reason") or field(b, "intervention_note"), "priority": field(b, "priority"), "wp": wp} return tasks diff --git a/tests/test_security_flow_report.py b/tests/test_security_flow_report.py new file mode 100644 index 00000000..1bf1db92 --- /dev/null +++ b/tests/test_security_flow_report.py @@ -0,0 +1,48 @@ +import json +from pathlib import Path +import subprocess +import sys + + +SCRIPT = Path(__file__).parents[1] / "scripts/security_flow_report.py" + + +def workplan(root, repo, task): + directory = root / repo / "workplans" + directory.mkdir(parents=True, exist_ok=True) + (directory / "test.md").write_text( + "---\nstatus: active\nflavor: implementation\n---\n\n" + "## Work\n\n```task\n" + task + "\n```\n" + ) + + +def report(root): + return json.loads(subprocess.check_output( + [sys.executable, str(SCRIPT), "--root", str(root), "--json"], text=True + )) + + +def test_default_estate_observes_activity_owner_dependency(tmp_path): + workplan(tmp_path, "railiance-platform", + "id: RPF-WP-0048-T02\nstatus: wait\npriority: high\n" + "depends_on: [ACTIVITY-WP-0041-T03]") + workplan(tmp_path, "activity-core", + "id: ACTIVITY-WP-0041-T03\nstatus: todo\npriority: high") + waiting = report(tmp_path) + assert [t["id"] for t in waiting["READY"]] == ["ACTIVITY-WP-0041-T03"] + assert waiting["UNBLOCKED"] == [] + workplan(tmp_path, "activity-core", + "id: ACTIVITY-WP-0041-T03\nstatus: done\npriority: high") + assert [t["id"] for t in report(tmp_path)["UNBLOCKED"]] == ["RPF-WP-0048-T02"] + + +def test_default_estate_includes_custodian_and_explains_human_gate(tmp_path): + workplan(tmp_path, "the-custodian", + "id: CUST-WP-0079-T05\nstatus: progress\npriority: medium") + workplan(tmp_path, "policy-nexus", + "id: PNEX-WP-0006-T01\nstatus: wait\npriority: high\n" + 'needs_human: true\nintervention_note: "Public publication in daily batch"') + result = report(tmp_path) + assert [t["id"] for t in result["READY"]] == ["CUST-WP-0079-T05"] + assert result["ATTENDED"][0]["reason"] == "Public publication in daily batch" + assert result["UNBLOCKED"] == [] diff --git a/workplans/CUST-WP-0079-deterministic-security-flow.md b/workplans/CUST-WP-0079-deterministic-security-flow.md index dd326f40..17b32599 100644 --- a/workplans/CUST-WP-0079-deterministic-security-flow.md +++ b/workplans/CUST-WP-0079-deterministic-security-flow.md @@ -126,6 +126,13 @@ committed the already reviewed, staged implementation as `6fe7201`; that commit includes source code. Future generated-only commits are rejected locally and in CI. The full Custodian suite passes 77 tests. +The default flow report now includes Custodian and activity-core, both required +by the renewed critical path. Cross-owner completion can therefore unblock the +platform activation task without an agent polling its wait body. Human gates +also retain their intervention note in the generated report instead of a blank +reason. CLI regression checks cover the actual owner completion transition and +the default Custodian lane. + ## Attended window #1 ```task