docs(factory): record executable issuer probe and pending live admission
This commit is contained in:
codex
parent
e52c47ff39
commit
a632b7aa87
3 changed files with 303 additions and 0 deletions
|
|
@ -92,3 +92,30 @@ fourteen-day observation window remain open.
|
|||
|
||||
[Runtime and custody continuation receipt](2026-09-08-helixforge-factory/runtime-custody-continuation.json)
|
||||
retains source revisions, validations, projection readbacks and progress IDs.
|
||||
|
||||
|
||||
## Executable upstream issuer proof prepared
|
||||
|
||||
KEY-WP-0013-T07 closes the missing diagnostic preparation. KeyCape source
|
||||
`6f33abd` adds a one-shot upstream verifier; source `1b9793f` pins the tested
|
||||
image and [execution packet](/home/worsch/key-cape/docs/upstream-issuer-proof.md).
|
||||
The probe verifies a real authorization-code response inside the adapter and
|
||||
emits only a verified issuer and check metadata. It issues no downstream token.
|
||||
|
||||
The complete Go race suite and vet passed. Five packet/receipt tests and seven
|
||||
real Traefik 3.6.7 route cases passed; ordinary callbacks remain on their normal
|
||||
backend. Railiance server dry-run accepted the exact five-resource packet. The
|
||||
immutable container also produced the expected one-second idle-timeout receipt
|
||||
as UID 65534 with a read-only filesystem and no network.
|
||||
|
||||
The temporary Job has a ten-minute deadline and no retry; its route, service
|
||||
and two network policies must carry the real Job UID for bounded cleanup. It
|
||||
uses only the existing config YAML, without the signing-key mount or a
|
||||
Kubernetes API token. That YAML contains credential data, so live execution
|
||||
requires the deployment owner's admission. KEY-WP-0013-T02 retains that decision,
|
||||
the actual signed issuer receipt, contained configuration pin and subsequent
|
||||
custody/rollout reviews. No live issuer result is inferred from preparation.
|
||||
|
||||
This replaces an unspecified manual observation with a tested command and
|
||||
bounded execution packet. The current receipt is
|
||||
[key-cape/docs/evidence/upstream-issuer-probe.json](/home/worsch/key-cape/docs/evidence/upstream-issuer-probe.json).
|
||||
|
|
|
|||
|
|
@ -17,6 +17,8 @@ Files:
|
|||
- `dependency-coverage.json`: all 94 dependency responses, including empty ones.
|
||||
- `human-flags.csv`: the nineteen flagged tasks' lifecycle metadata.
|
||||
- `checkout-provenance.json`: principal source revisions and pre-existing dirty state.
|
||||
- `upstream-issuer-probe-continuation.json`: completed upstream diagnostic
|
||||
preparation, image and route checks, owner/source sync and pending live decision.
|
||||
- `runtime-custody-continuation.json`: later runtime installation and attended
|
||||
capability proof, with published source/projection and progress receipts.
|
||||
- `consistency-check.json`: session-close consistency result, including thirteen
|
||||
|
|
|
|||
|
|
@ -0,0 +1,274 @@
|
|||
{
|
||||
"observed_at": "2026-09-08T21:32:38.862528+00:00",
|
||||
"preparation_task": "KEY-WP-0013-T07",
|
||||
"live_owner_task": "KEY-WP-0013-T02",
|
||||
"project_task": "HFACT-WP-0001-T03",
|
||||
"published_probe": {
|
||||
"observed_at": "2026-09-08T21:17:50.880337+00:00",
|
||||
"image": {
|
||||
"image": "forgejo.coulomb.social/coulomb/key-cape@sha256:0c85ed377cae7ae6ca5b5c56b1a52930e706b3cb78009747e42f551e869a22e4",
|
||||
"source_commit": "6f33abddcff6cbc348ced862057973cdcc4f78ec",
|
||||
"published_tag": "main-6f33abd",
|
||||
"packaged_command_proven": true,
|
||||
"container_uid": 65534,
|
||||
"container_network": "none",
|
||||
"container_readonly": true,
|
||||
"fixture_lifetime_seconds": 1,
|
||||
"expected_exit": 1,
|
||||
"observed_exit": 1,
|
||||
"idle_receipt": {
|
||||
"downstream_credential_issued": false,
|
||||
"failure": "probe_deadline",
|
||||
"schema": "keycape.upstream-issuer-proof.v1",
|
||||
"status": "failed",
|
||||
"tokens_retained": false
|
||||
}
|
||||
},
|
||||
"validation": {
|
||||
"go_test_race_all": "passed",
|
||||
"go_vet_all": "passed",
|
||||
"probe_tests_after_cli_fixture": "passed",
|
||||
"python_renderer_and_receipt_tests": 5,
|
||||
"traefik_route": {
|
||||
"traefik": "3.6.7",
|
||||
"exact_route_cases_passed": 7,
|
||||
"ordinary_login_callbacks_preserved": true,
|
||||
"live_cluster_changed": false
|
||||
},
|
||||
"server_dry_run": {
|
||||
"accepted": true,
|
||||
"resources": [
|
||||
"Job",
|
||||
"Service",
|
||||
"IngressRoute",
|
||||
"NetworkPolicy/probe",
|
||||
"NetworkPolicy/Authelia"
|
||||
],
|
||||
"image_digest": "sha256:0c85ed377cae7ae6ca5b5c56b1a52930e706b3cb78009747e42f551e869a22e4",
|
||||
"job_owner_uid": "fixture only; must bind the actual UID at execution"
|
||||
}
|
||||
},
|
||||
"deployment_metadata": {
|
||||
"deployment": {
|
||||
"name": "keycape",
|
||||
"metadata": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f 55113259 29"
|
||||
},
|
||||
"secret": {
|
||||
"name": "keycape-config",
|
||||
"metadata": "2e94519d-1550-41c7-9701-2efe47fe1fd3 51346058"
|
||||
},
|
||||
"production_image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b",
|
||||
"probe_jobs_before": []
|
||||
},
|
||||
"live_upstream_issuer_proved": false,
|
||||
"production_mutated": false,
|
||||
"credential_values_extracted": false,
|
||||
"custody_activated": false,
|
||||
"required_next_return": "Deployment-owner admission for the temporary config-reading probe; attended signed issuer receipt and cleanup, then contained issuer pin and named CCR reviews"
|
||||
},
|
||||
"projection_receipts": [
|
||||
{
|
||||
"repo": "key-cape",
|
||||
"commit": "7ecc78f4100c04f9b4ea7751240114bcc485de03",
|
||||
"status": "applied",
|
||||
"instance_role": "primary",
|
||||
"instance_label": "railiance01",
|
||||
"derived_commit": "7ecc78f4100c04f9b4ea7751240114bcc485de03",
|
||||
"outcome": "applied",
|
||||
"refused": []
|
||||
},
|
||||
{
|
||||
"repo": "prj-helixforge-factory",
|
||||
"commit": "ceac5eda56c2cd91952c4ae515d7fb226dfd3581",
|
||||
"status": "applied",
|
||||
"instance_role": "primary",
|
||||
"instance_label": "railiance01",
|
||||
"derived_commit": "ceac5eda56c2cd91952c4ae515d7fb226dfd3581",
|
||||
"outcome": "applied",
|
||||
"refused": []
|
||||
}
|
||||
],
|
||||
"final_readback": {
|
||||
"task_readbacks": [
|
||||
{
|
||||
"id": "HFACT-WP-0001-T01",
|
||||
"uuid": "5cee3251-faf9-5925-8ffd-7a8bf378b0a4",
|
||||
"expected": {
|
||||
"status": "wait",
|
||||
"assignee": "the-custodian",
|
||||
"blocking_reason": "Project published and registered; both product PR receipts finalized. Exact unattended actor/project/profile, grants, operating owners and enforceable spend contract still require the G0 admission packet.",
|
||||
"needs_human": false
|
||||
},
|
||||
"repaired_fields": [],
|
||||
"verified": true,
|
||||
"verified_after_canonical_sync": true,
|
||||
"repaired_fields_after_sync": []
|
||||
},
|
||||
{
|
||||
"id": "HFACT-WP-0001-T02",
|
||||
"uuid": "3a3a967d-5bec-52ee-be20-dc94524b8e85",
|
||||
"expected": {
|
||||
"status": "progress",
|
||||
"assignee": "the-custodian"
|
||||
},
|
||||
"repaired_fields": [],
|
||||
"verified": true,
|
||||
"verified_after_canonical_sync": true,
|
||||
"repaired_fields_after_sync": []
|
||||
},
|
||||
{
|
||||
"id": "HFACT-WP-0001-T03",
|
||||
"uuid": "67c80db1-01ba-54f1-80ff-76398f9e7823",
|
||||
"expected": {
|
||||
"status": "wait",
|
||||
"assignee": "the-custodian",
|
||||
"blocking_reason": "Corrected verifier and bounded issuer-probe images published; exact audit scope and attended first-provision capabilities proved. Await temporary probe admission and actual upstream issuer proof, RPF-WP-0035-T05/CCR-2026-0017/0018 activation, separate client-side/audit custody and live approval/native delivery; WARDEN-WP-0039-T03 retains explicit credential-policy binding refusal.",
|
||||
"intervention_note": "Approve the prepared ten-minute issuer probe using KeyCape main-6f33abd/digest 0c85ed37...22e4: temporary config-reading Job and exact-state route; packet key-cape/docs/upstream-issuer-proof.md. Actual signed issuer proof and named custody reviews remain subsequent gates.",
|
||||
"needs_human": true
|
||||
},
|
||||
"repaired_fields": [],
|
||||
"verified": true,
|
||||
"verified_after_canonical_sync": true,
|
||||
"repaired_fields_after_sync": []
|
||||
},
|
||||
{
|
||||
"id": "HFACT-WP-0001-T04",
|
||||
"uuid": "1054b135-f367-57b1-9308-72a1fbb38f62",
|
||||
"expected": {
|
||||
"status": "wait",
|
||||
"assignee": "the-custodian",
|
||||
"blocking_reason": "Local protected artifact installation and installed-path startup proved by SAND-WP-0015-T06. Await trusted owner configuration, T03 native credentials, real-model acceptance and Railiance-specific placement."
|
||||
},
|
||||
"repaired_fields": [],
|
||||
"verified": true,
|
||||
"verified_after_canonical_sync": true,
|
||||
"repaired_fields_after_sync": []
|
||||
},
|
||||
{
|
||||
"id": "HFACT-WP-0001-T05",
|
||||
"uuid": "2b171ebd-75f3-5ce2-85a9-98e8ab77fd19",
|
||||
"expected": {
|
||||
"status": "wait",
|
||||
"assignee": "the-custodian",
|
||||
"blocking_reason": "Await actionable admission records, owner credential chain and accepted profile/placement from T02-T04."
|
||||
},
|
||||
"repaired_fields": [],
|
||||
"verified": true,
|
||||
"verified_after_canonical_sync": true,
|
||||
"repaired_fields_after_sync": []
|
||||
},
|
||||
{
|
||||
"id": "HFACT-WP-0001-T06",
|
||||
"uuid": "4d72717a-d5c9-571d-987b-9373f01253fa",
|
||||
"expected": {
|
||||
"status": "wait",
|
||||
"assignee": "the-custodian",
|
||||
"blocking_reason": "Await the current governed Railiance worker proof in T05."
|
||||
},
|
||||
"repaired_fields": [],
|
||||
"verified": true,
|
||||
"verified_after_canonical_sync": true,
|
||||
"repaired_fields_after_sync": []
|
||||
},
|
||||
{
|
||||
"id": "HFACT-WP-0001-T07",
|
||||
"uuid": "a815d9b3-b03e-5764-95c2-fa1a2940611a",
|
||||
"expected": {
|
||||
"status": "wait",
|
||||
"assignee": "the-custodian",
|
||||
"blocking_reason": "Recovery matrix and measurement ledger are prepared; final live recovery proof requires the deployed T05/T06 configuration."
|
||||
},
|
||||
"repaired_fields": [],
|
||||
"verified": true,
|
||||
"verified_after_canonical_sync": true,
|
||||
"repaired_fields_after_sync": []
|
||||
},
|
||||
{
|
||||
"id": "HFACT-WP-0001-T08",
|
||||
"uuid": "59cfddfb-7cd6-5103-9444-8764e9d51678",
|
||||
"expected": {
|
||||
"status": "wait",
|
||||
"assignee": "the-custodian",
|
||||
"blocking_reason": "Await useful delivery and operational controls from T06/T07, then the complete fourteen-day observation window."
|
||||
},
|
||||
"repaired_fields": [],
|
||||
"verified": true,
|
||||
"verified_after_canonical_sync": true,
|
||||
"repaired_fields_after_sync": []
|
||||
}
|
||||
],
|
||||
"repositories": [
|
||||
{
|
||||
"repo": "key-cape",
|
||||
"commit": "7ecc78f4100c04f9b4ea7751240114bcc485de03",
|
||||
"remote_main_matches": true,
|
||||
"clean": true
|
||||
},
|
||||
{
|
||||
"repo": "prj-helixforge-factory",
|
||||
"commit": "ceac5eda56c2cd91952c4ae515d7fb226dfd3581",
|
||||
"remote_main_matches": true,
|
||||
"clean": true
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"commit": "a94d06dbcf0c4991d07eb69523c05a713acd59c2",
|
||||
"remote_main_matches": true,
|
||||
"clean": true
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"commit": "46455439cfbb24fc5d187403c8f9f4465fccc274",
|
||||
"remote_main_matches": true,
|
||||
"clean": true
|
||||
}
|
||||
],
|
||||
"project_consistency": {
|
||||
"fail": 0,
|
||||
"automation_error": 0,
|
||||
"warn": 2,
|
||||
"info": 0
|
||||
},
|
||||
"live_execution_approval": "pending"
|
||||
},
|
||||
"progress": {
|
||||
"progress": [
|
||||
{
|
||||
"id": "dd3e637b-12d5-4788-9be7-c9590aad946f",
|
||||
"workplan_id": "6e815d88-b0e3-5ce0-be5d-13ab15917f7f",
|
||||
"task_id": "62bc6d8e-dbb2-57b6-a30b-472ffd06b497",
|
||||
"summary": "KEY-WP-0013-T07 done: published one-shot upstream issuer probe source 6f33abd and owner packet 1b9793f; main 7ecc78f. Immutable image sha256:0c85ed377cae7ae6ca5b5c56b1a52930e706b3cb78009747e42f551e869a22e4. Full Go race suite/vet, five Python checks, seven real Traefik 3.6.7 routing cases, packaged idle-timeout and Railiance server dry-run passed. T02 retains deployment-owner admission, attended live signed issuer receipt and contained issuer pin. No production probe or custody mutation performed."
|
||||
},
|
||||
{
|
||||
"id": "f738f145-8999-4f24-b6cc-0881a891df37",
|
||||
"workplan_id": "ed4fe524-036f-5221-8deb-00e24e944de1",
|
||||
"task_id": "67c80db1-01ba-54f1-80ff-76398f9e7823",
|
||||
"summary": "Consumed KEY-WP-0013-T07 executable issuer-probe return in HFACT-WP-0001-T03 and thirteen-source dependency view. Replaced unspecified manual upstream observation with pinned image, ten-minute bounded Job, exact-state callback route, proof and cleanup packet. Concrete deployment-owner decision requested for temporary config use; T03 remains wait. Actual signed issuer evidence, named CCR-2026-0017/0018 reviews, custody/config rollout and factory operating admission remain open."
|
||||
},
|
||||
{
|
||||
"id": "cbdb3d98-1bef-4bb2-adbf-d284cb007d97",
|
||||
"workplan_id": null,
|
||||
"task_id": null,
|
||||
"summary": "Custodian continued the factory critical path by implementing, testing and publishing the missing upstream issuer diagnostic (KEY-WP-0013-T07 done). Validation includes Go race suite/vet, five renderer/receipt checks, seven real Traefik route cases and Railiance dry-run. KEY-WP-0013-T02 and HFACT-WP-0001-T03 retain temporary deployment admission and live issuer proof; no production deployment, issuer pin, secret extraction or custody activation performed. Source and image packet are concrete for the requested operator decision."
|
||||
}
|
||||
],
|
||||
"key_task_projection": {
|
||||
"id": "62bc6d8e-dbb2-57b6-a30b-472ffd06b497",
|
||||
"assignee": "the-custodian",
|
||||
"status": "done",
|
||||
"repaired_fields": [],
|
||||
"verified": true
|
||||
}
|
||||
},
|
||||
"keycape_consistency": {
|
||||
"fail": 0,
|
||||
"automation_error": 0,
|
||||
"warn": 15,
|
||||
"info": 1
|
||||
},
|
||||
"live_execution_approval": "pending",
|
||||
"live_upstream_issuer_proved": false,
|
||||
"production_image_unchanged": true,
|
||||
"temporary_probe_resources_absent": true,
|
||||
"custody_activated": false
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue