diff --git a/docs/assessments/2026-09-08-helixforge-factory-critical-path.md b/docs/assessments/2026-09-08-helixforge-factory-critical-path.md index e1969d7..af3f18b 100644 --- a/docs/assessments/2026-09-08-helixforge-factory-critical-path.md +++ b/docs/assessments/2026-09-08-helixforge-factory-critical-path.md @@ -92,3 +92,30 @@ fourteen-day observation window remain open. [Runtime and custody continuation receipt](2026-09-08-helixforge-factory/runtime-custody-continuation.json) retains source revisions, validations, projection readbacks and progress IDs. + + +## Executable upstream issuer proof prepared + +KEY-WP-0013-T07 closes the missing diagnostic preparation. KeyCape source +`6f33abd` adds a one-shot upstream verifier; source `1b9793f` pins the tested +image and [execution packet](/home/worsch/key-cape/docs/upstream-issuer-proof.md). +The probe verifies a real authorization-code response inside the adapter and +emits only a verified issuer and check metadata. It issues no downstream token. + +The complete Go race suite and vet passed. Five packet/receipt tests and seven +real Traefik 3.6.7 route cases passed; ordinary callbacks remain on their normal +backend. Railiance server dry-run accepted the exact five-resource packet. The +immutable container also produced the expected one-second idle-timeout receipt +as UID 65534 with a read-only filesystem and no network. + +The temporary Job has a ten-minute deadline and no retry; its route, service +and two network policies must carry the real Job UID for bounded cleanup. It +uses only the existing config YAML, without the signing-key mount or a +Kubernetes API token. That YAML contains credential data, so live execution +requires the deployment owner's admission. KEY-WP-0013-T02 retains that decision, +the actual signed issuer receipt, contained configuration pin and subsequent +custody/rollout reviews. No live issuer result is inferred from preparation. + +This replaces an unspecified manual observation with a tested command and +bounded execution packet. The current receipt is +[key-cape/docs/evidence/upstream-issuer-probe.json](/home/worsch/key-cape/docs/evidence/upstream-issuer-probe.json). diff --git a/docs/assessments/2026-09-08-helixforge-factory/README.md b/docs/assessments/2026-09-08-helixforge-factory/README.md index 0fef09d..58580fb 100644 --- a/docs/assessments/2026-09-08-helixforge-factory/README.md +++ b/docs/assessments/2026-09-08-helixforge-factory/README.md @@ -17,6 +17,8 @@ Files: - `dependency-coverage.json`: all 94 dependency responses, including empty ones. - `human-flags.csv`: the nineteen flagged tasks' lifecycle metadata. - `checkout-provenance.json`: principal source revisions and pre-existing dirty state. +- `upstream-issuer-probe-continuation.json`: completed upstream diagnostic + preparation, image and route checks, owner/source sync and pending live decision. - `runtime-custody-continuation.json`: later runtime installation and attended capability proof, with published source/projection and progress receipts. - `consistency-check.json`: session-close consistency result, including thirteen diff --git a/docs/assessments/2026-09-08-helixforge-factory/upstream-issuer-probe-continuation.json b/docs/assessments/2026-09-08-helixforge-factory/upstream-issuer-probe-continuation.json new file mode 100644 index 0000000..277f8f2 --- /dev/null +++ b/docs/assessments/2026-09-08-helixforge-factory/upstream-issuer-probe-continuation.json @@ -0,0 +1,274 @@ +{ + "observed_at": "2026-09-08T21:32:38.862528+00:00", + "preparation_task": "KEY-WP-0013-T07", + "live_owner_task": "KEY-WP-0013-T02", + "project_task": "HFACT-WP-0001-T03", + "published_probe": { + "observed_at": "2026-09-08T21:17:50.880337+00:00", + "image": { + "image": "forgejo.coulomb.social/coulomb/key-cape@sha256:0c85ed377cae7ae6ca5b5c56b1a52930e706b3cb78009747e42f551e869a22e4", + "source_commit": "6f33abddcff6cbc348ced862057973cdcc4f78ec", + "published_tag": "main-6f33abd", + "packaged_command_proven": true, + "container_uid": 65534, + "container_network": "none", + "container_readonly": true, + "fixture_lifetime_seconds": 1, + "expected_exit": 1, + "observed_exit": 1, + "idle_receipt": { + "downstream_credential_issued": false, + "failure": "probe_deadline", + "schema": "keycape.upstream-issuer-proof.v1", + "status": "failed", + "tokens_retained": false + } + }, + "validation": { + "go_test_race_all": "passed", + "go_vet_all": "passed", + "probe_tests_after_cli_fixture": "passed", + "python_renderer_and_receipt_tests": 5, + "traefik_route": { + "traefik": "3.6.7", + "exact_route_cases_passed": 7, + "ordinary_login_callbacks_preserved": true, + "live_cluster_changed": false + }, + "server_dry_run": { + "accepted": true, + "resources": [ + "Job", + "Service", + "IngressRoute", + "NetworkPolicy/probe", + "NetworkPolicy/Authelia" + ], + "image_digest": "sha256:0c85ed377cae7ae6ca5b5c56b1a52930e706b3cb78009747e42f551e869a22e4", + "job_owner_uid": "fixture only; must bind the actual UID at execution" + } + }, + "deployment_metadata": { + "deployment": { + "name": "keycape", + "metadata": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f 55113259 29" + }, + "secret": { + "name": "keycape-config", + "metadata": "2e94519d-1550-41c7-9701-2efe47fe1fd3 51346058" + }, + "production_image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b", + "probe_jobs_before": [] + }, + "live_upstream_issuer_proved": false, + "production_mutated": false, + "credential_values_extracted": false, + "custody_activated": false, + "required_next_return": "Deployment-owner admission for the temporary config-reading probe; attended signed issuer receipt and cleanup, then contained issuer pin and named CCR reviews" + }, + "projection_receipts": [ + { + "repo": "key-cape", + "commit": "7ecc78f4100c04f9b4ea7751240114bcc485de03", + "status": "applied", + "instance_role": "primary", + "instance_label": "railiance01", + "derived_commit": "7ecc78f4100c04f9b4ea7751240114bcc485de03", + "outcome": "applied", + "refused": [] + }, + { + "repo": "prj-helixforge-factory", + "commit": "ceac5eda56c2cd91952c4ae515d7fb226dfd3581", + "status": "applied", + "instance_role": "primary", + "instance_label": "railiance01", + "derived_commit": "ceac5eda56c2cd91952c4ae515d7fb226dfd3581", + "outcome": "applied", + "refused": [] + } + ], + "final_readback": { + "task_readbacks": [ + { + "id": "HFACT-WP-0001-T01", + "uuid": "5cee3251-faf9-5925-8ffd-7a8bf378b0a4", + "expected": { + "status": "wait", + "assignee": "the-custodian", + "blocking_reason": "Project published and registered; both product PR receipts finalized. Exact unattended actor/project/profile, grants, operating owners and enforceable spend contract still require the G0 admission packet.", + "needs_human": false + }, + "repaired_fields": [], + "verified": true, + "verified_after_canonical_sync": true, + "repaired_fields_after_sync": [] + }, + { + "id": "HFACT-WP-0001-T02", + "uuid": "3a3a967d-5bec-52ee-be20-dc94524b8e85", + "expected": { + "status": "progress", + "assignee": "the-custodian" + }, + "repaired_fields": [], + "verified": true, + "verified_after_canonical_sync": true, + "repaired_fields_after_sync": [] + }, + { + "id": "HFACT-WP-0001-T03", + "uuid": "67c80db1-01ba-54f1-80ff-76398f9e7823", + "expected": { + "status": "wait", + "assignee": "the-custodian", + "blocking_reason": "Corrected verifier and bounded issuer-probe images published; exact audit scope and attended first-provision capabilities proved. Await temporary probe admission and actual upstream issuer proof, RPF-WP-0035-T05/CCR-2026-0017/0018 activation, separate client-side/audit custody and live approval/native delivery; WARDEN-WP-0039-T03 retains explicit credential-policy binding refusal.", + "intervention_note": "Approve the prepared ten-minute issuer probe using KeyCape main-6f33abd/digest 0c85ed37...22e4: temporary config-reading Job and exact-state route; packet key-cape/docs/upstream-issuer-proof.md. Actual signed issuer proof and named custody reviews remain subsequent gates.", + "needs_human": true + }, + "repaired_fields": [], + "verified": true, + "verified_after_canonical_sync": true, + "repaired_fields_after_sync": [] + }, + { + "id": "HFACT-WP-0001-T04", + "uuid": "1054b135-f367-57b1-9308-72a1fbb38f62", + "expected": { + "status": "wait", + "assignee": "the-custodian", + "blocking_reason": "Local protected artifact installation and installed-path startup proved by SAND-WP-0015-T06. Await trusted owner configuration, T03 native credentials, real-model acceptance and Railiance-specific placement." + }, + "repaired_fields": [], + "verified": true, + "verified_after_canonical_sync": true, + "repaired_fields_after_sync": [] + }, + { + "id": "HFACT-WP-0001-T05", + "uuid": "2b171ebd-75f3-5ce2-85a9-98e8ab77fd19", + "expected": { + "status": "wait", + "assignee": "the-custodian", + "blocking_reason": "Await actionable admission records, owner credential chain and accepted profile/placement from T02-T04." + }, + "repaired_fields": [], + "verified": true, + "verified_after_canonical_sync": true, + "repaired_fields_after_sync": [] + }, + { + "id": "HFACT-WP-0001-T06", + "uuid": "4d72717a-d5c9-571d-987b-9373f01253fa", + "expected": { + "status": "wait", + "assignee": "the-custodian", + "blocking_reason": "Await the current governed Railiance worker proof in T05." + }, + "repaired_fields": [], + "verified": true, + "verified_after_canonical_sync": true, + "repaired_fields_after_sync": [] + }, + { + "id": "HFACT-WP-0001-T07", + "uuid": "a815d9b3-b03e-5764-95c2-fa1a2940611a", + "expected": { + "status": "wait", + "assignee": "the-custodian", + "blocking_reason": "Recovery matrix and measurement ledger are prepared; final live recovery proof requires the deployed T05/T06 configuration." + }, + "repaired_fields": [], + "verified": true, + "verified_after_canonical_sync": true, + "repaired_fields_after_sync": [] + }, + { + "id": "HFACT-WP-0001-T08", + "uuid": "59cfddfb-7cd6-5103-9444-8764e9d51678", + "expected": { + "status": "wait", + "assignee": "the-custodian", + "blocking_reason": "Await useful delivery and operational controls from T06/T07, then the complete fourteen-day observation window." + }, + "repaired_fields": [], + "verified": true, + "verified_after_canonical_sync": true, + "repaired_fields_after_sync": [] + } + ], + "repositories": [ + { + "repo": "key-cape", + "commit": "7ecc78f4100c04f9b4ea7751240114bcc485de03", + "remote_main_matches": true, + "clean": true + }, + { + "repo": "prj-helixforge-factory", + "commit": "ceac5eda56c2cd91952c4ae515d7fb226dfd3581", + "remote_main_matches": true, + "clean": true + }, + { + "repo": "railiance-platform", + "commit": "a94d06dbcf0c4991d07eb69523c05a713acd59c2", + "remote_main_matches": true, + "clean": true + }, + { + "repo": "net-kingdom", + "commit": "46455439cfbb24fc5d187403c8f9f4465fccc274", + "remote_main_matches": true, + "clean": true + } + ], + "project_consistency": { + "fail": 0, + "automation_error": 0, + "warn": 2, + "info": 0 + }, + "live_execution_approval": "pending" + }, + "progress": { + "progress": [ + { + "id": "dd3e637b-12d5-4788-9be7-c9590aad946f", + "workplan_id": "6e815d88-b0e3-5ce0-be5d-13ab15917f7f", + "task_id": "62bc6d8e-dbb2-57b6-a30b-472ffd06b497", + "summary": "KEY-WP-0013-T07 done: published one-shot upstream issuer probe source 6f33abd and owner packet 1b9793f; main 7ecc78f. Immutable image sha256:0c85ed377cae7ae6ca5b5c56b1a52930e706b3cb78009747e42f551e869a22e4. Full Go race suite/vet, five Python checks, seven real Traefik 3.6.7 routing cases, packaged idle-timeout and Railiance server dry-run passed. T02 retains deployment-owner admission, attended live signed issuer receipt and contained issuer pin. No production probe or custody mutation performed." + }, + { + "id": "f738f145-8999-4f24-b6cc-0881a891df37", + "workplan_id": "ed4fe524-036f-5221-8deb-00e24e944de1", + "task_id": "67c80db1-01ba-54f1-80ff-76398f9e7823", + "summary": "Consumed KEY-WP-0013-T07 executable issuer-probe return in HFACT-WP-0001-T03 and thirteen-source dependency view. Replaced unspecified manual upstream observation with pinned image, ten-minute bounded Job, exact-state callback route, proof and cleanup packet. Concrete deployment-owner decision requested for temporary config use; T03 remains wait. Actual signed issuer evidence, named CCR-2026-0017/0018 reviews, custody/config rollout and factory operating admission remain open." + }, + { + "id": "cbdb3d98-1bef-4bb2-adbf-d284cb007d97", + "workplan_id": null, + "task_id": null, + "summary": "Custodian continued the factory critical path by implementing, testing and publishing the missing upstream issuer diagnostic (KEY-WP-0013-T07 done). Validation includes Go race suite/vet, five renderer/receipt checks, seven real Traefik route cases and Railiance dry-run. KEY-WP-0013-T02 and HFACT-WP-0001-T03 retain temporary deployment admission and live issuer proof; no production deployment, issuer pin, secret extraction or custody activation performed. Source and image packet are concrete for the requested operator decision." + } + ], + "key_task_projection": { + "id": "62bc6d8e-dbb2-57b6-a30b-472ffd06b497", + "assignee": "the-custodian", + "status": "done", + "repaired_fields": [], + "verified": true + } + }, + "keycape_consistency": { + "fail": 0, + "automation_error": 0, + "warn": 15, + "info": 1 + }, + "live_execution_approval": "pending", + "live_upstream_issuer_proved": false, + "production_image_unchanged": true, + "temporary_probe_resources_absent": true, + "custody_activated": false +}