Retain publication receipts and restart handoff
This commit is contained in:
codex
parent
01dc19601b
commit
86ad49852c
20 changed files with 477 additions and 0 deletions
|
|
@ -0,0 +1,14 @@
|
|||
{
|
||||
"started_utc": "2026-10-19T13:34:20.566225+00:00",
|
||||
"command": [
|
||||
"make",
|
||||
"policy-nexus-deploy",
|
||||
"POLICY_NEXUS_TARGET=railiance01"
|
||||
],
|
||||
"atomic": true,
|
||||
"attempt": 1,
|
||||
"approval_ref": "conversation:call_5157a09329d34746a3fdf857d5a47b8d:item0",
|
||||
"completed_utc": "2026-10-19T13:34:26.648713+00:00",
|
||||
"returncode": 0,
|
||||
"raw_output_suppressed": true
|
||||
}
|
||||
|
|
@ -0,0 +1,83 @@
|
|||
{
|
||||
"proposal_id": "POLICY-PUB-20261019-BUILD-MODE-GUARDRAIL-R1",
|
||||
"approved_revision": 1,
|
||||
"approved_packet_hashlist_sha256": "309ef01650b65bc6b28e86daad9b2835a242631cf60e0896e849461bb917504f",
|
||||
"approval_ref": "conversation:call_5157a09329d34746a3fdf857d5a47b8d:item0",
|
||||
"result": "verified",
|
||||
"helm_revision": 10,
|
||||
"rollback_required": false,
|
||||
"rollback_revision": 9,
|
||||
"candidate_source_revision": "9fabcce1cb4c83165bcaba8be58d76788b4d87a1",
|
||||
"candidate_origin": "local owner-format build; native CI run89 retained failed, no new CI success claimed",
|
||||
"change_gate": {
|
||||
"decision": "the-custodian/docs/kubernetes-change-gate-decision.md",
|
||||
"target_tier": "production",
|
||||
"readiness_state": "production-approved",
|
||||
"path": "direct-administer-transition",
|
||||
"auth_mode": "ADMINISTER @ realm:kubernetes/railiance01",
|
||||
"activation": "APPROVED",
|
||||
"evidence_boundary": "target-audited",
|
||||
"transition_ends": "2026-12-21"
|
||||
},
|
||||
"native": {
|
||||
"capture_utc": "2026-10-19T13:35:06.098696+00:00",
|
||||
"cluster_mutated": false,
|
||||
"expected_node_ip": "92.205.62.239",
|
||||
"expected_node_ip_present": true,
|
||||
"helm_revision": 10,
|
||||
"helm_status": "deployed",
|
||||
"image_matches_candidate": true,
|
||||
"machine_id_sha256": "fe7367a60951922122af7ba18ed2cde65c7e0a232bbedfb045cb575de2094c2f",
|
||||
"ready_replicas": 1,
|
||||
"release_pin_matches": {
|
||||
"publication-manifest-digest": true,
|
||||
"source-inventory-digest": true,
|
||||
"source-set-digest": true
|
||||
},
|
||||
"replicas": 1,
|
||||
"secret_values_observed": false,
|
||||
"ssh_alias": "railiance01"
|
||||
},
|
||||
"public": {
|
||||
"verified": true,
|
||||
"capture_utc": "2026-10-19T13:36:20.944233+00:00",
|
||||
"hashes": {
|
||||
"publication_manifest_digest": "8c74b4e414f7760429600b7ba0b3627fcfe438417bfe6695f55acfa6905d352e",
|
||||
"source_inventory_digest": "e84453b6b411a7d66d2b5efbf083cd0033441d6b12983326442933da87bf61fd",
|
||||
"source_lock_digest": "c150c6c0745441b4b69884ecc6cf55e97db26080fcf4c2224775b1f755580529"
|
||||
},
|
||||
"source_set_digest": "b00535063c56ede08f0a292b301a47add18bf70f81904bf3f434c8faa5ebe682",
|
||||
"document_count": 74,
|
||||
"previous73_source_digests_unchanged": true,
|
||||
"added_document": "canon-build-mode-change-authorization",
|
||||
"all_canonical_and_revision_pages_byte_equal_candidate": true,
|
||||
"page_and_artifact_count": 150,
|
||||
"guardrail_expiry_banner": "Expires on: production-close-down",
|
||||
"guardrail_json_byte_equal_verified_candidate": true,
|
||||
"guardrail_json_sha256": "a86462a57bb1df5804d3088881af22569082d43ff68bcab2b67cbe56b6fc46cd",
|
||||
"tls_verified": true,
|
||||
"refinements": [
|
||||
"Initial verifier incorrectly expected hosting transition date2026-12-21 in canon expiry.",
|
||||
"Second verifier expected source expires_on label rather than rendered Expires on.",
|
||||
"Correct final assertion matches approved rendered banner; both failed checks retained, artifact and deployment unchanged."
|
||||
]
|
||||
},
|
||||
"deployment": {
|
||||
"started_utc": "2026-10-19T13:34:20.566225+00:00",
|
||||
"command": [
|
||||
"make",
|
||||
"policy-nexus-deploy",
|
||||
"POLICY_NEXUS_TARGET=railiance01"
|
||||
],
|
||||
"atomic": true,
|
||||
"attempt": 1,
|
||||
"approval_ref": "conversation:call_5157a09329d34746a3fdf857d5a47b8d:item0",
|
||||
"completed_utc": "2026-10-19T13:34:26.648713+00:00",
|
||||
"returncode": 0,
|
||||
"raw_output_suppressed": true
|
||||
},
|
||||
"owner_source_commits": {
|
||||
"rapp-policy-nexus": "6ead90ffa4ae5742c37c292485762e83113382c3",
|
||||
"railiance-apps": "3be92daf74a7572319bfe94dd882a70430528343"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
{
|
||||
"proposal_id": "POLICY-PUB-20261019-BUILD-MODE-GUARDRAIL-R1",
|
||||
"approved_revision": 1,
|
||||
"approved_packet_hashlist_sha256": "309ef01650b65bc6b28e86daad9b2835a242631cf60e0896e849461bb917504f",
|
||||
"approval_ref": "conversation:call_5157a09329d34746a3fdf857d5a47b8d:item0",
|
||||
"approval_text": "Approve this exact publication and deployment",
|
||||
"started_utc": "2026-10-19T13:24:06.363210+00:00",
|
||||
"source_preconditions_verified": true,
|
||||
"status": "started",
|
||||
"image_digest": "sha256:214b122c3d175563f114552fa1826dac9642433be019c736c3265d0a3ef379f1",
|
||||
"live_mutation": false
|
||||
}
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
{
|
||||
"capture_utc": "2026-10-19T13:29:59.232999+00:00",
|
||||
"allocated_resources": {
|
||||
"cpu": {
|
||||
"requests": "3605m",
|
||||
"requests_percent": 90,
|
||||
"limits": "37500m",
|
||||
"limits_percent": 937
|
||||
},
|
||||
"memory": {
|
||||
"requests": "9856Mi",
|
||||
"requests_percent": 61,
|
||||
"limits": "34562Mi",
|
||||
"limits_percent": 216
|
||||
}
|
||||
},
|
||||
"raw_output_suppressed": true
|
||||
}
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
{
|
||||
"capture_utc": "2026-10-19T13:34:21.152132+00:00",
|
||||
"cluster_mutated": false,
|
||||
"expected_node_ip": "92.205.62.239",
|
||||
"expected_node_ip_present": true,
|
||||
"helm_revision": 9,
|
||||
"helm_status": "deployed",
|
||||
"image_matches_rollback": true,
|
||||
"machine_id_sha256": "fe7367a60951922122af7ba18ed2cde65c7e0a232bbedfb045cb575de2094c2f",
|
||||
"ready_replicas": 1,
|
||||
"release_pin_matches": {
|
||||
"publication-manifest-digest": true,
|
||||
"source-inventory-digest": true,
|
||||
"source-set-digest": true
|
||||
},
|
||||
"replicas": 1,
|
||||
"secret_values_observed": false,
|
||||
"ssh_alias": "railiance01"
|
||||
}
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
{
|
||||
"capture_utc": "2026-10-19T13:35:06.098696+00:00",
|
||||
"cluster_mutated": false,
|
||||
"expected_node_ip": "92.205.62.239",
|
||||
"expected_node_ip_present": true,
|
||||
"helm_revision": 10,
|
||||
"helm_status": "deployed",
|
||||
"image_matches_candidate": true,
|
||||
"machine_id_sha256": "fe7367a60951922122af7ba18ed2cde65c7e0a232bbedfb045cb575de2094c2f",
|
||||
"ready_replicas": 1,
|
||||
"release_pin_matches": {
|
||||
"publication-manifest-digest": true,
|
||||
"source-inventory-digest": true,
|
||||
"source-set-digest": true
|
||||
},
|
||||
"replicas": 1,
|
||||
"secret_values_observed": false,
|
||||
"ssh_alias": "railiance01"
|
||||
}
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
import datetime,hashlib,json,os,pathlib,re,subprocess
|
||||
EXPECTED={
|
||||
'image':'forgejo.coulomb.social/coulomb/policy-nexus@sha256:214b122c3d175563f114552fa1826dac9642433be019c736c3265d0a3ef379f1',
|
||||
'publication-manifest-digest':'8c74b4e414f7760429600b7ba0b3627fcfe438417bfe6695f55acfa6905d352e',
|
||||
'source-inventory-digest':'e84453b6b411a7d66d2b5efbf083cd0033441d6b12983326442933da87bf61fd',
|
||||
'source-set-digest':'b00535063c56ede08f0a292b301a47add18bf70f81904bf3f434c8faa5ebe682'}
|
||||
def run(args):
|
||||
p=subprocess.run(args,stdout=subprocess.PIPE,stderr=subprocess.PIPE,env=dict(os.environ,KUBECONFIG='/etc/rancher/k3s/k3s.yaml'),timeout=20)
|
||||
if p.returncode:raise ValueError('command_refused')
|
||||
return p.stdout.decode().strip()
|
||||
try:
|
||||
out={'capture_utc':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ssh_alias':'railiance01','expected_node_ip':'92.205.62.239','secret_values_observed':False,'cluster_mutated':False}
|
||||
nodes=json.loads(run(['kubectl','get','nodes','-o','json']))
|
||||
out['expected_node_ip_present']=any(a.get('address')=='92.205.62.239' for n in nodes['items'] for a in n['status']['addresses'])
|
||||
if not out['expected_node_ip_present']:raise ValueError('target_mismatch')
|
||||
out['machine_id_sha256']=hashlib.sha256(pathlib.Path('/etc/machine-id').read_bytes()).hexdigest()
|
||||
base=['kubectl','-n','policy-nexus','get','deployment','policy-nexus','-o']
|
||||
actual=run(base+['jsonpath={.spec.template.spec.containers[0].image}'])
|
||||
out['image_matches_candidate']=actual==EXPECTED['image']
|
||||
out['release_pin_matches']={}
|
||||
for key in list(EXPECTED)[1:]:
|
||||
value=run(base+['jsonpath={.metadata.annotations.policy\\.coulomb\\.social/'+key+'}'])
|
||||
out['release_pin_matches'][key]=value==EXPECTED[key]
|
||||
for key,expr in [('replicas','.spec.replicas'),('ready_replicas','.status.readyReplicas')]:
|
||||
value=run(base+['jsonpath={'+expr+'}']);out[key]=int(value) if value.isdigit() else None
|
||||
releases=json.loads(run(['helm','list','--namespace','policy-nexus','--filter','^policy-nexus$','-o','json']))
|
||||
if len(releases)!=1:raise ValueError('release_count')
|
||||
r=releases[0];out['helm_revision']=int(r['revision']);out['helm_status']=r['status'] if r['status'] in ['deployed','failed','pending-upgrade','pending-rollback'] else 'other'
|
||||
print(json.dumps(out,sort_keys=True))
|
||||
except Exception:
|
||||
print(json.dumps({'observation_completed':False,'reason':'bounded_read_failed','raw_errors_suppressed':True}))
|
||||
|
|
@ -0,0 +1,38 @@
|
|||
[
|
||||
{
|
||||
"repo": "rapp-policy-nexus",
|
||||
"check": [
|
||||
"make",
|
||||
"check"
|
||||
],
|
||||
"returncode": 0,
|
||||
"raw_output_suppressed": true
|
||||
},
|
||||
{
|
||||
"repo": "railiance-apps",
|
||||
"check": [
|
||||
"make",
|
||||
"policy-nexus-check-binding"
|
||||
],
|
||||
"returncode": 0,
|
||||
"raw_output_suppressed": true
|
||||
},
|
||||
{
|
||||
"repo": "railiance-apps",
|
||||
"check": [
|
||||
"make",
|
||||
"policy-nexus-check-image"
|
||||
],
|
||||
"returncode": 0,
|
||||
"raw_output_suppressed": true
|
||||
},
|
||||
{
|
||||
"repo": "railiance-apps",
|
||||
"check": [
|
||||
"make",
|
||||
"policy-nexus-render"
|
||||
],
|
||||
"returncode": 2,
|
||||
"raw_output_suppressed": true
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
{
|
||||
"capture_utc": "2026-10-19T15:55:47.761612+00:00",
|
||||
"repos": {
|
||||
"policy-nexus": {
|
||||
"head": "fa6ee926b6f4000cebd7903918474ba5ee7beaf6",
|
||||
"status": "",
|
||||
"clean": true
|
||||
},
|
||||
"rapp-policy-nexus": {
|
||||
"head": "5f2f0d6508bf81caff7c7a1852f8d1067d5f9560",
|
||||
"status": "",
|
||||
"clean": true
|
||||
},
|
||||
"railiance-apps": {
|
||||
"head": "3851865c873b3b36550c0aa2c03e53509fe41ad2",
|
||||
"status": "",
|
||||
"clean": true
|
||||
}
|
||||
},
|
||||
"push_performed": false,
|
||||
"new_ci_triggered": false
|
||||
}
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
{
|
||||
"owner_server_dry_run_returncode": 0,
|
||||
"raw_output_suppressed": true
|
||||
}
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
{
|
||||
"owner_smoke_returncode": 0,
|
||||
"raw_errors_suppressed": true
|
||||
}
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
{
|
||||
"capture_utc": "2026-10-19T13:26:26.371772+00:00",
|
||||
"cluster_mutated": false,
|
||||
"expected_node_ip": "92.205.62.239",
|
||||
"expected_node_ip_present": true,
|
||||
"helm_revision": 9,
|
||||
"helm_status": "deployed",
|
||||
"image_matches_rollback": true,
|
||||
"machine_id_sha256": "fe7367a60951922122af7ba18ed2cde65c7e0a232bbedfb045cb575de2094c2f",
|
||||
"ready_replicas": 1,
|
||||
"release_pin_matches": {
|
||||
"publication-manifest-digest": true,
|
||||
"source-inventory-digest": true,
|
||||
"source-set-digest": true
|
||||
},
|
||||
"replicas": 1,
|
||||
"secret_values_observed": false,
|
||||
"ssh_alias": "railiance01"
|
||||
}
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
{
|
||||
"verified": false,
|
||||
"failure_class": "AssertionError",
|
||||
"raw_errors_suppressed": true
|
||||
}
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
{
|
||||
"verified": false,
|
||||
"stage": "guardrail_expiry",
|
||||
"failure_class": "AssertionError",
|
||||
"raw_errors_suppressed": true
|
||||
}
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
{
|
||||
"verified": true,
|
||||
"capture_utc": "2026-10-19T13:36:20.944233+00:00",
|
||||
"hashes": {
|
||||
"publication_manifest_digest": "8c74b4e414f7760429600b7ba0b3627fcfe438417bfe6695f55acfa6905d352e",
|
||||
"source_inventory_digest": "e84453b6b411a7d66d2b5efbf083cd0033441d6b12983326442933da87bf61fd",
|
||||
"source_lock_digest": "c150c6c0745441b4b69884ecc6cf55e97db26080fcf4c2224775b1f755580529"
|
||||
},
|
||||
"source_set_digest": "b00535063c56ede08f0a292b301a47add18bf70f81904bf3f434c8faa5ebe682",
|
||||
"document_count": 74,
|
||||
"previous73_source_digests_unchanged": true,
|
||||
"added_document": "canon-build-mode-change-authorization",
|
||||
"all_canonical_and_revision_pages_byte_equal_candidate": true,
|
||||
"page_and_artifact_count": 150,
|
||||
"guardrail_expiry_banner": "Expires on: production-close-down",
|
||||
"guardrail_json_byte_equal_verified_candidate": true,
|
||||
"guardrail_json_sha256": "a86462a57bb1df5804d3088881af22569082d43ff68bcab2b67cbe56b6fc46cd",
|
||||
"tls_verified": true,
|
||||
"refinements": [
|
||||
"Initial verifier incorrectly expected hosting transition date2026-12-21 in canon expiry.",
|
||||
"Second verifier expected source expires_on label rather than rendered Expires on.",
|
||||
"Correct final assertion matches approved rendered banner; both failed checks retained, artifact and deployment unchanged."
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
{
|
||||
"utc": "2026-10-19T13:26:48.865571+00:00",
|
||||
"tag": "forgejo.coulomb.social/coulomb/policy-nexus:source-b00535063c56ede08f0a292b301a47add18bf70f81904bf3f434c8faa5ebe682",
|
||||
"returncode": 0,
|
||||
"manifest_digests": [
|
||||
"sha256:214b122c3d175563f114552fa1826dac9642433be019c736c3265d0a3ef379f1"
|
||||
],
|
||||
"raw_errors_suppressed": true,
|
||||
"main_updated": false
|
||||
}
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
{
|
||||
"manifest_digest": "sha256:214b122c3d175563f114552fa1826dac9642433be019c736c3265d0a3ef379f1",
|
||||
"remote_blob_count": 13,
|
||||
"remote_blobs_byte_equal_to_verified_local_oci": true,
|
||||
"paired_release_files_in_verified_layers": true,
|
||||
"anonymous_pull_verified": true
|
||||
}
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
{
|
||||
"render_byte_equal_approved": true,
|
||||
"render_sha256": "62b369b913d610508fb135834e7cb166f62649f3d9e61eddbe02e8fca542a953",
|
||||
"escalated_owner_render_returncode": 0,
|
||||
"diff_check_passed": true
|
||||
}
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
{
|
||||
"capture_utc": "2026-10-19T13:30:00.318306+00:00",
|
||||
"returncode": 0,
|
||||
"server_dry_run_passed": true,
|
||||
"resource_names_match": true,
|
||||
"resource_count": 9,
|
||||
"stderr_present": false,
|
||||
"raw_errors_suppressed": true,
|
||||
"cluster_mutated": false
|
||||
}
|
||||
126
docs/changes/custodian-delivery-restart-2026-10-19.md
Normal file
126
docs/changes/custodian-delivery-restart-2026-10-19.md
Normal file
|
|
@ -0,0 +1,126 @@
|
|||
# Restart handoff — 2026-10-19
|
||||
|
||||
User requested wind-down because of token limits. Resume the existing goal for
|
||||
CUST-WP-0071, CUST-WP-0073 and CUST-WP-0079; do not start a new plan or repeat
|
||||
completed measurements. Goal is paused, not complete. Source workplans retain
|
||||
open acceptance tasks.
|
||||
|
||||
## Decisions that remain authoritative
|
||||
|
||||
- Keep generated briefs locally and ignored; do not track Git snapshots. Fleet
|
||||
migration and State Hub installed CLI repair are complete.
|
||||
- Use the existing Activity Core worker, pinned scripts and private retained state.
|
||||
Both daily/weekly definitions stay disabled until exact runtime acceptance.
|
||||
- Isolate this actual interactive Codex assignment first. A child-agent rehearsal
|
||||
is not acceptance. No credential cutover, WSL provisioning or rotation occurred.
|
||||
- Configurable synthetic workloads may establish provisional sizing; human
|
||||
workflow acceptance remains separate. Do not require a human pilot merely to
|
||||
continue the authorized synthetic work.
|
||||
|
||||
## Verified live change: Policy Nexus
|
||||
|
||||
Founder explicitly approved exact publication and deployment in
|
||||
`call_5157a09329d34746a3fdf857d5a47b8d`, item 0. Original immutable packet:
|
||||
`docs/changes/CUST-WP-0079/policy-publication-r1/PLAN.md`; SHA256SUMS digest
|
||||
`309ef01650b65bc6b28e86daad9b2835a242631cf60e0896e849461bb917504f`.
|
||||
|
||||
One atomic upgrade deployed approved image
|
||||
`sha256:214b122c3d175563f114552fa1826dac9642433be019c736c3265d0a3ef379f1`
|
||||
as Helm revision10, Ready1/1. Native/public proof at13:36:20Z verifies all paired
|
||||
release hashes, 74 documents, previous73 source digests unchanged, all150 pages
|
||||
and artifacts byte-equal candidate. Standard and derived JSON are public.
|
||||
CUST-WP-0079-T04 is done. Evidence is the sibling `policy-publication-r1-execution/`.
|
||||
Two verifier-only date/label failures are retained; full corrected proof passed.
|
||||
No artifact refinement or rollback occurred. No fresh vulnerability scan/native
|
||||
CI success is claimed. Do not redeploy merely to resume this session.
|
||||
Supervision record retains approval, exact execution and refinements; no autopilot.
|
||||
Rollback is verified prior Helm revision9/image4e0db6, not stale rApp23df0ab3.
|
||||
|
||||
## Provisional sizing and allocation
|
||||
|
||||
Vergabe commits `11f7c8a`, `bfd1a2d`, `44e5458` retain maintained configs/driver,
|
||||
raw samples and failures. Latest `config/synthetic-pilot-phases.json` covers
|
||||
edits, idle, ordinary, burst, restart and recovery at1CPU/1Gi. 2971requests,
|
||||
zero errors; phase p95 256/303/336ms; startup7.266s/restart7.128s; complete coverage;
|
||||
17 focused tests. Evidence: `docs/evidence/2026-10-19-synthetic-sizing/` in owner.
|
||||
Earlier Docker restart changed its random port; failure retained, driver fixed.
|
||||
|
||||
Keep current prototype limits provisionally. The60m request is not validated
|
||||
under shared contention. No production resources changed. CUST71T02 remains
|
||||
progress. RAPPS-WP-0014-T04 receives exact deployed-release/hardware and
|
||||
shared-contention evidence; T03 human/recovery acceptance is unchanged.
|
||||
Resource-control `RESOURCE-WP-0008` active, latest initial review `e3e996f`.
|
||||
Next consume phased evidence there and finish qualified allocation/owner review.
|
||||
|
||||
Read-only allocation capture12:50:41Z:4000m capacity,3605m scheduled,0pending,
|
||||
395m reservation residual (not spare CPU). Retained JSON/MD/provenance in root
|
||||
`docs/evidence/2026-10-19-allocation-reconcile.*`. Subsequent source map identifies
|
||||
mas→mail-address-semantics, playwright→railiance-platform (package rapp-playwright),
|
||||
rapp-qonto→rapp-qonto. Historical capture/hash is unchanged. No tenant invented.
|
||||
|
||||
## Disabled recurring jobs: next implementation boundary
|
||||
|
||||
Activity Core `fed119a` embeds pinned owner scripts and mandatory input admission;
|
||||
`3b25aea` uses a protected descriptor selecting retained immutable snapshots.
|
||||
Repo Manager `3e2726f` supplies pinned Git-object offline exporter. Native issuer
|
||||
noop receipts are valid only through protected issuer custody; don't break its
|
||||
existing contract by requiring fields native noop does not emit.
|
||||
|
||||
Existing core-hub publisher holds Forge read custody. No accepted snapshot
|
||||
transport to Activity Core exists. Prepared endpoint/receiver work is disabled;
|
||||
new downstream disclosure of exact15 private repositories needs review of the
|
||||
concrete endpoint/network delta. No new token mount or access expansion occurred.
|
||||
See Activity Core `k8s/custodian-release/publisher-access-delta.md`.
|
||||
Preserve single bounded operation per ActivityDefinition: integrate capture as
|
||||
fixed pre-run step inside custodian_security_flow, not a second operation.
|
||||
Proposed45s capture+240s command must fit existing300s envelope; actual15-repo
|
||||
capture duration/cancellation, retry idempotency and producer concurrency remain
|
||||
runtime readiness requirements, not proven by mocks. Do not loosen freshness.
|
||||
After source integration: exact image/mount/state/PVC capacity/backup/network
|
||||
review, scoped access disposition, paused real run, then unattended/delivery/
|
||||
acknowledgment/failure recovery evidence. Never enable just because source tests pass.
|
||||
|
||||
## Interactive isolation: preparation only
|
||||
|
||||
Retained locked proposals under `docs/changes/CUST-WP-0073/interactive-launch-r1/`,
|
||||
`interactive-launch-r2/`, `interactive-launch-r3/` and `ubuntu-dependencies-r1/`.
|
||||
Selected target: new dedicated WSL2 distribution/account custodian-codex, not
|
||||
existing production host or second UID sharing operator credentials. No import,
|
||||
admin action, auth transfer or negative-boundary acceptance performed.
|
||||
Pending user UI question: whether this chat interface offers SSH run-location or
|
||||
Hand off. No answer yet; do not treat silence as support or permission.
|
||||
Full signed dependency/rootfs bundle is `/tmp/cust73-ubuntu-dependencies-r1`;
|
||||
Git contains review subset only. Reverify full hashes/reacquire exact pins if gone.
|
||||
Actual runtime/binary, namespace/network denial, scoped auth/connector boundaries
|
||||
and real chat handoff/native allow-deny proof still required. Locked scripts are
|
||||
not executable approvals. CUST73T05 rotation remains founder-deferred.
|
||||
|
||||
## Restart discipline
|
||||
|
||||
Read AGENTS, environment orientation and this assignment's supervision record.
|
||||
Preserve pre-existing unrelated root dirt (old netkingdom assessment files,
|
||||
large untracked evidence tree and .kube); never blanket add/restore/delete.
|
||||
No new deployment or access approval is inferred from this handoff. Existing
|
||||
exact approval is already fulfilled for Policy Nexus; no repeat confirmation.
|
||||
Run State Hub consistency only after coherent source commits; it may push source
|
||||
and local origin tracking can be stale. Check remote SHA if needed. Previous
|
||||
sandbox sync could not write Git index; escalated retry passed90/90 with0errors.
|
||||
Record progress at close; do not score preparation as supervision success.
|
||||
|
||||
Final provider commit/checkpoint additions follow below.
|
||||
|
||||
- Flow final: Vergabe clean at `44e5458`; Railiance-apps handoff `170e9b7`,
|
||||
RAPPS-WP-0014-T04 UUID `c53fcaa9-859c-5b37-a17b-0a4cd2fb0e26`.
|
||||
Owner consistency session79197 exited0, no automation/assessment failures.
|
||||
No active flow sessions; zero synthetic/port-check containers or networks.
|
||||
Phased raw data `phased-sizing-run.json.gz` and `phased-comparison.json` remain
|
||||
in Vergabe's evidence directory. No need to rerun this local workload on resume.
|
||||
|
||||
- Policy closeout: clean owner commits `policy-nexus@fa6ee926`,
|
||||
`rapp-policy-nexus@5f2f0d65`, `railiance-apps@3851865c` (includes prior
|
||||
flow handoff170e9b7). No new source push/CI/rebuild was initiated by this
|
||||
closeout. Execution sibling `execution-receipt.json` and `owner-closeout.json`
|
||||
retain final results. Publication is complete; any source-ahead status is
|
||||
bookkeeping, not a reason to deploy again.
|
||||
- Aggregate progress receipt: `7c6a2833-e56c-4bf8-9288-6f1d523afe62`.
|
||||
Root closeout source commit `01dc196` records T04 done and phased sizing.
|
||||
Loading…
Add table
Add a link
Reference in a new issue