diff --git a/.kaizen/agents/custodian-codex/supervision.json b/.kaizen/agents/custodian-codex/supervision.json index 3acc9b78..cd689b7d 100644 --- a/.kaizen/agents/custodian-codex/supervision.json +++ b/.kaizen/agents/custodian-codex/supervision.json @@ -231,7 +231,7 @@ "proposal_id": "INFD-WP-0009-T04/purpose-overlay-v1", "trial_id": "infd-purpose-20261011-r1", "disposition": "accepted_unchanged", - "outcome": "verified_with_rescue_and_independent_readonly_reconciliation", + "outcome": "failed", "proposal_ref": "informed-decision/docs/evidence/2026-10-11-purpose-image-release/decision-packet.md", "original_revision": "combined-ffa2679a", "original_digest": "fd78d486174670e12efb2f812bac02e68f294e7791b9302d0d458c053240f5a9", @@ -246,7 +246,7 @@ }, "target": "realm:kubernetes/railiance01/informed-decision", "expected_result": "Protected native schema5 backup/off-cluster drill independently matches snapshot integrity/counts; exact image763c Deployment-only manual Argo release Ready1; installed purpose refusal and separate actual-provider acceptance evidence, retained current database.", - "verification_ref": "informed-decision/docs/evidence/2026-10-11-purpose-image-release/execution/execution-plan.json", + "verification_ref": "docs/evidence/2026-10-10-security-consolidation/infd-purpose-approved-drill-copy-failure.json; docs/evidence/2026-10-10-security-consolidation/infd-independent-readonly-verification-receipt.json", "rollback_ref": "same packet: failedcandidate-independent Deployment-only7db/7f5 source/image recovery plus separateReady/schema5/currentDB verification; no old snapshot overwrite", "cost_estimate_eur": 0, "risk_estimate": "Brief Recreate disruption, protected evidence snapshot custody/restore and operator recovery time unpriced; inherited1fixableMEDIUM remains INFD9T05. Allphases including recovery begin beforeOct12deadline; freshdecision if windowexhausted. No autopilot cost/risk grant.", @@ -342,13 +342,16 @@ "live_unpromoted_verifier_residual": "INFD-IN-0010" } ], - "current_revision_status": "owner_scoped_task_acceptance_recorded" + "current_revision_status": "owner_scoped_task_acceptance_recorded", + "outcome_detail": "verified_with_rescue_and_independent_readonly_reconciliation", + "executed_digest": "fd78d486174670e12efb2f812bac02e68f294e7791b9302d0d458c053240f5a9", + "scoring_semantics": "Original approved trial failed during copy; separately approved same-trial recovery target independently verified. Original failed/uncertain outcomes remain; no unchanged execution success scored." }, { "proposal_id": "NK-FORGEJO-TYPE12-SOURCE-20261011-R1", "trial_id": "forgejo-type12-source-20261011-r1", "disposition": "accepted_unchanged", - "outcome": "verified_source_acknowledgment_recorded", + "outcome": "not_executed", "proposal_ref": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/proposal.json", "original_revision": "final34-0b377d647ca748cd03c92f9792396412048055d4bde9f7bb06ff6d413f7acd68", "original_digest": "585cee731de30d2b37883a57abfd9eb32f023ee694e8d911989109d5caf80569", @@ -371,7 +374,9 @@ "approved_source_revision": "584a964684a28e759edc19862a91938bda161cb3", "source_recording_commit": "f6856cd", "application_design_receipt_commit": "d349815", - "followthrough_version_selection_commit": "bb9b9b5" + "followthrough_version_selection_commit": "bb9b9b5", + "source_recording_outcome": "verified_source_acknowledgment_recorded", + "scoring_semantics": "Source-only acknowledgment independently recorded; no privileged native execution authorized or performed. Source acknowledgment is retained separately from the supervision native-execution outcome axis." } ] } diff --git a/docs/evidence/2026-10-10-security-consolidation/infd-zlib-published-preparation-progress-receipt.json b/docs/evidence/2026-10-10-security-consolidation/infd-zlib-published-preparation-progress-receipt.json new file mode 100644 index 00000000..d9995ed8 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/infd-zlib-published-preparation-progress-receipt.json @@ -0,0 +1,14 @@ +{ + "workplan_id": "77eaeabf-0644-595f-b3d5-1168e6a294c4", + "id": "06b5fd7f-44a6-4497-9943-3469fb4af040", + "topic_id": null, + "task_id": "1743596f-8558-5a6b-afef-4dd5c1e9c0ae", + "decision_id": null, + "event_type": "note", + "summary": "INFD-WP0009 T05 exact zlib-only source candidate 9b4bb25 and separate Platform review2fe072a published via consistency. Actual owner CI11534/run4 succeeded; immutable f5588f49 artifact independently readback verified, current full scan zero findings,44packages only zlib r0-to-r1,313directories unchanged/two changed files and runtime/purpose checks pass. Native image remains763c/gen25; new T05 backup/compatibility/image-only proposal in preparation, no new deployment approval or protected-data action. Same13 source count47open/101unfinished; three historical Platform C07 aliases remain visible. Supervision enum repair retains original failed T04 trial and independent same-trial rescue, no authority/promotion.", + "detail": null, + "author": "codex", + "session_id": null, + "created_at": "2026-10-11T09:41:35.584527Z", + "workstream_id": "77eaeabf-0644-595f-b3d5-1168e6a294c4" +} diff --git a/docs/evidence/2026-10-10-security-consolidation/supervision-before-outcome-enum-repair.json b/docs/evidence/2026-10-10-security-consolidation/supervision-before-outcome-enum-repair.json new file mode 100644 index 00000000..3acc9b78 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/supervision-before-outcome-enum-repair.json @@ -0,0 +1,377 @@ +{ + "schema": "custodian.agent-supervision.v1", + "agent_id": "custodian-codex", + "identity_binding": "logical supervised coding-agent record; interactive runtime isolation not yet enforced", + "scope": "CUST-WP-0071 and CUST-WP-0073 preparation and founder-authorized Railiance changes", + "mode": "supervised", + "supervisor": "Bernd Worsch", + "policy_ref": "docs/agent-autonomy-decision.md", + "runtime_enforcement": "not_yet_migrated", + "autopilot_grant": null, + "cost_budget_eur": null, + "risk_limit_eur": null, + "proposals": [ + { + "proposal_id": "CUST-WP-0073-T03-annotation-guard", + "disposition": "unscored", + "outcome": "failed", + "reason": "Conversation authorization predates exact-revision scoring. Native admission tests passed, but ESO refresh failed under the guard. Binding rolled back and 39/39 ExternalSecrets recovered. Retain this adverse outcome; it is not promotion evidence.", + "proposal_ref": "docs/changes/CUST-WP-0073/README.md", + "execution_ref": "railiance-platform@54885ac1589074a68d9607d1be250c84c5c2307a", + "refinement_or_rescue": true, + "verification_ref": "docs/evidence/2026-09-28-secret-annotation-rollout.md", + "remediation": { + "authorization_ref": "Founder continuation: Good, go on, after the 31-declaration fix was described", + "source_changes_ref": "docs/evidence/2026-09-28-eso-metadata-publication.json", + "verification_ref": "docs/evidence/2026-09-28-secret-annotation-enforced.json", + "integration_ref": "docs/evidence/2026-09-28-eso-refresh-after-binding.json", + "outcome": "39/39 fresh successful refreshes under Deny; nine native admission checks pass", + "refinement_or_rescue": true, + "new_scored_trial": false + } + }, + { + "proposal_id": "STATE-WP-0094-T05-receiving-rollout-2026-10-04", + "disposition": "unscored", + "outcome": "succeeded", + "reason": "Founder explicitly authorized rollout before exact-revision proposal capture. Retain actual execution evidence without backfilling unchanged acceptance.", + "proposal_ref": "docs/changes/state-hub-qualifier-rollout-2026-10-04.json", + "original_revision": 1, + "original_digest_sha256": "32834917c4c6f80277abcf543a278f0b9eaa52ebdf28cd05a0e66f2047d3053a", + "approved_revision": null, + "authorization_ref": "User instruction: Do the rollout", + "executed_revision": 1, + "refinement_or_rescue": false, + "executed_digest_sha256": "32834917c4c6f80277abcf543a278f0b9eaa52ebdf28cd05a0e66f2047d3053a", + "execution_started_at": "2026-10-04T00:45:00Z", + "verification_ref": "state-hub/docs/evidence/2026-10-04-receiving-rollout.json", + "execution_ref": "railiance01 Helm state-hub revision 71; image main-3791e60", + "verified_outcome": "API/MCP Ready; schema/current receiving digest verified; fresh state-hub and ops-warden Forge derivation applied then independently noop", + "failed_checks": [ + "Custodian full reconciliation rolled back: historical ADHOC tasks_pkey UUID collision d8af3e6b-26ae-580c-bbeb-caa8ad419bec" + ], + "recovery": "No rollout rollback required; failed Custodian transaction rolled back", + "promotion_evidence": false, + "closing_verification_ref": "docs/evidence/2026-10-04-state-hub-rollout-close.json" + }, + { + "proposal_id": "STATE-WP-0095-T03-historical-receiving", + "disposition": "accepted_unchanged", + "outcome": "succeeded", + "proposal_ref": "docs/changes/state-hub-historical-receiving-2026-10-04.json", + "original_revision": 1, + "original_digest_sha256": "d6789359b3fe7988a6201fff6f367cb46948aa197e1cc0ca66c31f45e1ea9981", + "refinement_or_rescue": false, + "approval_ref": "Founder reply: Approve rollout and registrar verification; request_user_input_async call_o87uEfFs3AtXfxO5YqUnSpcg item0", + "approved_revision": 1, + "approved_digest_sha256": "d6789359b3fe7988a6201fff6f367cb46948aa197e1cc0ca66c31f45e1ea9981", + "approved_at": "2026-10-04T09:21:00.486372+00:00", + "executed_revision": 1, + "executed_digest_sha256": "d6789359b3fe7988a6201fff6f367cb46948aa197e1cc0ca66c31f45e1ea9981", + "execution_started_at": "2026-10-04T09:21:05.271010+00:00", + "original_digest": "d6789359b3fe7988a6201fff6f367cb46948aa197e1cc0ca66c31f45e1ea9981", + "approved_digest": "d6789359b3fe7988a6201fff6f367cb46948aa197e1cc0ca66c31f45e1ea9981", + "executed_digest": "d6789359b3fe7988a6201fff6f367cb46948aa197e1cc0ca66c31f45e1ea9981", + "verification_ref": "docs/evidence/2026-10-04-dependency-root-wave/verified-deployment.json", + "execution_ref": "railiance01 Helm state-hub revision72 image main-5dd3df9; exact approved revision1", + "verified_outcome": "Exact approved revision1 deployed main-5dd3df9 Helm72. API/MCP Ready, schema/source match, five frozen parents/65tasks entire rows unchanged; global retired-holder collision refused in rolled-back native transaction. Gated registrar actual38 tests passed; normal Repo Manager/Custodian receiving applied. Activity correctly refused three unrelated retirements, as expected scope requires; no acknowledgement issued.", + "registrar_verification_ref": "docs/evidence/2026-10-04-dependency-root-wave/normal-owner-sync.json", + "recovery": "No rollout rollback or rescue required; unrelated Activity receiving refused before changes. Initial supervision receipt used digest_sha256 keys; added exact matching canonical aliases for the descriptive utility without changing authority or evidence." + }, + { + "proposal_id": "INFD-WP-0009-T02/config-repin-v1", + "disposition": "accepted_unchanged", + "outcome": "succeeded", + "proposal_ref": "docs/evidence/2026-10-10-security-consolidation/infd-pin-repair-preflight.json", + "original_revision": "7db8485ffecdebfabd77a9daec085553c74bf0bf", + "original_digest_sha256": "1dcc1f01d7b6469aee7a6504d38b81cd6ef8a5c5358493ad17d8825c3aec16e7", + "approved_revision": "7db8485ffecdebfabd77a9daec085553c74bf0bf", + "approval_ref": "Founder: Approve the scoped repair; call_57c1f1615d7d459bbe3bd0f125a50bee", + "executed_revision": "7db8485ffecdebfabd77a9daec085553c74bf0bf", + "verified_outcome": "Only immutable ConfigMap/Deployment synced; Healthy, Ready1, unchanged image, readyz200, v2 pin and native registration/publication succeeded.", + "execution_adaptation": "argocd CLI absent; same approved two-resource manual sync through Application operation API with atomic baseline checks and prune false.", + "refinement_or_rescue": false, + "promotion_evidence": false, + "original_digest": "1dcc1f01d7b6469aee7a6504d38b81cd6ef8a5c5358493ad17d8825c3aec16e7", + "approved_digest": "1dcc1f01d7b6469aee7a6504d38b81cd6ef8a5c5358493ad17d8825c3aec16e7", + "executed_digest": "1dcc1f01d7b6469aee7a6504d38b81cd6ef8a5c5358493ad17d8825c3aec16e7", + "approved_digest_sha256": "1dcc1f01d7b6469aee7a6504d38b81cd6ef8a5c5358493ad17d8825c3aec16e7", + "executed_digest_sha256": "1dcc1f01d7b6469aee7a6504d38b81cd6ef8a5c5358493ad17d8825c3aec16e7", + "verification_ref": "docs/evidence/2026-10-10-security-consolidation/infd-pin-repair-preflight.json; informed-decision/docs/evidence/2026-10-10-lifecycle-consumer-pin-repair.md", + "reporting_correction": "Canonical digest aliases and verification reference copied from existing exact approved revision evidence; no new approval or authority inferred." + }, + { + "proposal_id": "CUST-SECURITY-DECISION-POSING-2026-10-10-R1", + "disposition": "unscored", + "outcome": "succeeded", + "proposal_ref": "docs/evidence/2026-10-10-security-consolidation/decision-posing-proposal.json", + "reason": "Existing founder instruction authorizes informed decisions; no backfilled exact-revision acceptance. Retain initial503 policy pin failure and subsequent review400 packet validation failure.", + "refinement_or_rescue": true, + "promotion_evidence": false, + "verified_outcome": "Both native intake records delivered; revision-specific human ACCEPT dispositions confirmed, submission_state confirmed and stale=false for each. Initial503 and packet400 failures retained in same unscored trial.", + "verification_ref": "docs/evidence/2026-10-10-security-consolidation/decision-submission-receipts.json", + "human_disposition_verification_ref": "docs/evidence/2026-10-10-security-consolidation/human-acceptance-receipts.json" + }, + { + "proposal_id": "RAPP-USER-ENGINE-READBACK-2026-10-11-R2", + "disposition": "accepted_unchanged", + "outcome": "succeeded", + "proposal_ref": "rapp-user-engine/docs/evidence/2026-10-11-published-readback-proposal/decision-packet.md", + "original_revision": "R2-amended-b4d45051", + "original_digest": "76814d47e33d652c39c78b11ee5a0498c3f10ff89a41c4219048d7d0eab0f5f2", + "target": "realm:kubernetes/railiance01/user-engine", + "expected_result": "Exact User Engine image and advisory readback integration Ready; native catalogue acceptance remains separately verified; conditional44HIGHrisk trial only.", + "verification_ref": "rapp-user-engine/docs/evidence/2026-10-11-native-readback/receipt.json; docs/evidence/2026-10-10-security-consolidation/user-readback-enforcement-check.json", + "rollback_ref": "rapp-user-engine/docs/evidence/2026-10-11-published-readback-proposal/rollback.yaml", + "cost_estimate_eur": 0, + "risk_estimate": "BriefRecreate interruption/pullfailure;44unfixedHIGH occurrences/8CVEs. Incidentlossunpriced; noautopilotgrant. Exacthumanconditionalriskdisposition required.", + "internal_pre_submission_refinements": "Original22file3faf packet retained; independentreview requiredsameSAaudiencedisclosure andstrictpreflight. Both refinedbeforefirsthuman submission; notapprovedorreclassified success.", + "memo_id": "infd-20261011-user-engine-readback-r2", + "memo_version": 1, + "promotion_evidence": false, + "approved_revision": "R2-amended-b4d45051", + "approved_digest": "76814d47e33d652c39c78b11ee5a0498c3f10ff89a41c4219048d7d0eab0f5f2", + "approval_ref": "informed-decision:infd-20261011-user-engine-readback-r2@1; approval:0dd18a5a-5555-461e-8470-931d530435cf", + "approved_at": "2026-10-11T00:48:11+00:00", + "human_disposition_id": "disp-9ab2caba-6d3d-4fac-bc64-618f9c82aa9a", + "executed_revision": "R2-amended-b4d45051", + "executed_digest": "76814d47e33d652c39c78b11ee5a0498c3f10ff89a41c4219048d7d0eab0f5f2", + "executed_candidate_sha256": "3c0700c9d6505bf3c48b3e01e3b3537855cf0dd09486d4deb4812443d6509d99", + "execution_started_at": "2026-10-11T00:52:05.905810+00:00", + "execution_ref": "docs/evidence/2026-10-10-security-consolidation/user-readback-approved-execution.json", + "verified_outcome": "Exact approved two-object rollout Ready1 gen73/observed73, readyz200; actual admitted readback registry/allow-deny/TTL/unavailable checks passed. Existing enforcement health200/unknown-action200deny; oldnativepurpose200deny is preexisting protocolgap, no allow claimed. Canonical full28objectrender changes exactly2objects. Native catalogue empty: USER26/28 consumer acceptance stillopen, no realhumanlogin/MFA or token-isolation proof. Scope execution succeeded; overall consolidation remains active.", + "refinement_or_rescue": false + }, + { + "proposal_id": "POLICY-PUB-20261011-SECURITY-LAYER-V08-R1", + "disposition": "accepted_unchanged", + "outcome": "succeeded", + "proposal_ref": "rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/decision-packet.md", + "original_revision": "R1-refined-a70fb22f", + "original_digest": "076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e", + "packet_manifest_sha256": "a70fb22f75871a08358f1cdee2410797cb0a2f01c2001f0012d16866b20e28a8", + "target": "realm:kubernetes/railiance01/policy-nexus", + "expected_result": "Ready1 exact published Policy Nexus image and paired provenance; accepted v0.8 served,73 current documents and72 existing immutable paths independently match.", + "verification_ref": "rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-native-hosting", + "rollback_ref": "rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/rollback-binding.json; Helm revision8", + "cost_estimate_eur": 0, + "risk_estimate": "Stateless public availability/pull/scheduling/runtime incompatibility. Rollback restores72 existing paths but temporarily removes newly introduced v0.8/current revision URLs. Loss bound unpriced, supervised exact human approval required.", + "execution_deadline": "2026-10-12T23:59:59Z", + "memo_id": "infd-20261011-policy-nexus-hosting-r1", + "memo_version": 1, + "internal_pre_submission_refinements": "Original27pathd402 packet retained; independent owner review required UID/full defaulted configuration and ServiceAccount reference drift refusal, HTTPS origin/redirect refusal and bounded reads. Refined30patha70 packet prepared before first human submission; one trial, no earlier approval or success.", + "promotion_evidence": false, + "approved_revision": "R1-refined-a70fb22f", + "approved_digest": "076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e", + "approval_ref": "informed-decision:infd-20261011-policy-nexus-hosting-r1@1; approval:52a3c479-2cb1-4074-abec-6a88117ad596", + "approved_at": "2026-10-11T01:14:23+00:00", + "human_disposition_id": "disp-b8bfa6c0-e879-4de2-8243-f4abb9bcd011", + "pre_actuation_attempts": [ + { + "at": "2026-10-11T01:19:18Z", + "actuator_sha256": "41837e66e8d775f0ecfab42e2d3d3f5063489a3d2f14ae8e86f595ade25e5643", + "result": "failed render comparison before Helm upgrade; node,capacity,sealed baseline and server dryrun/diff passed", + "attempted_helm_upgrade": false, + "receipt_ref": "docs/evidence/2026-10-10-security-consolidation/policy-hosting-pre-actuation-failed.json" + }, + { + "result": "local premature read of pending outcome writer failed JSON parsing before any remote execution", + "attempted_helm_upgrade": false, + "effect": "none", + "refinement": "wait for receipt-producing command completion before dependent actuator" + } + ], + "operational_actuator_refinement": "Readonly diagnosis proved existing Helm chart omits metadata.namespace; fixed command namespace policy-nexus supplies it. Refined comparison adds only missing namespace, refuses explicit wrong namespace, preserving full9object exact comparison. Approved packet/source/image/effect scope unchanged. Initialfailed pre-actuation preserved.", + "refinement_or_rescue": true, + "executed_revision": "R1-refined-a70fb22f", + "executed_digest": "076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e", + "executed_actuator_sha256": "e23fb931f253c8df79fffb922f23a1f476c2167014b06e245a22148fce25dccf", + "execution_started_at": "2026-10-11T01:23:27.564865+00:00", + "execution_completed_at": "2026-10-11T01:23:42.112194+00:00", + "execution_ref": "docs/evidence/2026-10-10-security-consolidation/policy-hosting-approved-execution.json", + "verified_outcome": "Helm9 deployed/Ready1 generation9 observed9; exact approved image/paired provenance/all9 UID-defaulted configurations pass.158publicHTTPS byte checks match73currentdocuments+72oldimmutablepaths; CertificateReady,health/index200/legacy308/404. NoArgo adoption/data/credential writes; sourcebindingreconciled. Initialpre-actuation namespace comparison failure retained and refined; no rollback used, no unchanged-success promotion credit. Wholeconsolidation remains active." + }, + { + "proposal_id": "USER-CATALOGUE-INFDEC-20261011-R1", + "disposition": "accepted_unchanged", + "outcome": "succeeded", + "proposal_ref": "user-engine/docs/evidence/2026-10-11-one-app-catalogue-human-packet/decision-packet.md", + "original_revision": "human-packet-1-after-independent-owner-reviews", + "original_digest": "026b7daa970920f468bb1cfd9e2df1eaaa99d1d5ce1945ea5db0bb33ee9e6f82", + "packet_manifest_sha256": "307c4fc5c3c352a99a1b04c1ea886faf84f2aa3b679694aa6a1d828a44501f7c", + "source_revision": "5d80644", + "target": "railiance01/user-engine exact informed-decision Application and binding through admitted f239 workload", + "expected_result": "Exact two catalogue facts, genuine ordinary denial retained, truthful maintenance audit/event and one-use consumed ledger; native three-owner readback verified without fabricated human claims.", + "verification_ref": "docs/evidence/2026-10-10-security-consolidation/user-catalogue-independent-postapply-verification.json", + "rollback_ref": "same packet; original consumed grant before expiry, unchanged created rows/no dependencies, unsent-unclaimed event only; preserve audit/outbox and forbid targeted replay", + "cost_estimate_eur": 0.1, + "risk_estimate_eur": 100, + "risk_estimate": "Build-mode two metadata facts; one owner-hour straightforward repair assumption, uncontrolled downstream effects require stop/new disposition. No IAM/runtime changes; direct supervisor external authority verification required.", + "execution_deadline": "2026-10-12T23:59:59Z", + "memo_id": "infd-20261011-user-catalogue-bootstrap-r1", + "memo_version": 1, + "executor_sha256": "b0dbbb9786e927055030acf849a72e9a44e9d3d55c84efdf245e419d381684f3", + "transport_sha256": "3e594e0e8561100ae1eeb34d7208cd5b5e387ae56c29689f155aed94219770f3", + "promotion_evidence": false, + "native_execution": false, + "approved_revision": "human-packet-1-after-independent-owner-reviews", + "approved_digest": "026b7daa970920f468bb1cfd9e2df1eaaa99d1d5ce1945ea5db0bb33ee9e6f82", + "approval_ref": "informed-decision:infd-20261011-user-catalogue-bootstrap-r1@1;approval:b859698b-5d08-4da5-9599-4760c6a799f1", + "approved_at": "2026-10-11T02:07:09+00:00", + "human_disposition_id": "disp-7683bfbb-3743-4c9f-8ae3-962b6514c92e", + "executed_revision": "human-packet-1-after-independent-owner-reviews", + "executed_digest": "026b7daa970920f468bb1cfd9e2df1eaaa99d1d5ce1945ea5db0bb33ee9e6f82", + "executed_executor_sha256": "b0dbbb9786e927055030acf849a72e9a44e9d3d55c84efdf245e419d381684f3", + "executed_transport_sha256": "3e594e0e8561100ae1eeb34d7208cd5b5e387ae56c29689f155aed94219770f3", + "execution_ref": "docs/evidence/2026-10-10-security-consolidation/user-catalogue-approved-apply.json", + "verified_outcome": "Exact2cataloguefacts/1consumedledger/3truthfulaudits/1unsentunclaimedevent; ordinaryidentifieddenialretained, noPDPallowclaim; native3waycatalogue1 andSERVICEaccountrowdenied. Nativefixturechecksnotrealhumanlogin/MFA/grantrevocation; broaderUsertasksremainopen. No rollback/replay/delivery used.", + "refinement_or_rescue": false + }, + { + "proposal_id": "INFD-WP-0009-T04/purpose-overlay-v1", + "trial_id": "infd-purpose-20261011-r1", + "disposition": "accepted_unchanged", + "outcome": "verified_with_rescue_and_independent_readonly_reconciliation", + "proposal_ref": "informed-decision/docs/evidence/2026-10-11-purpose-image-release/decision-packet.md", + "original_revision": "combined-ffa2679a", + "original_digest": "fd78d486174670e12efb2f812bac02e68f294e7791b9302d0d458c053240f5a9", + "packet_manifest_sha256": "ffa2679a94a24e69a75d1248a808825498a80e711ceda98f3639a4143c40ec1b", + "memo_sha256": "506d3956beb7c62ab2bbdfda783c05905d183452a1f67a1817f3fb8c2e522937", + "source_revision": "bc6494cd1b290783ef3aef0763bf28d1deabf4b0", + "approved_source_blob_sha256": { + "deploy/lifecycle/admission.candidate.json": "92382a56b349c3b895e5806e975082527bb99d1a001140e69d857e5b0391fa55", + "deploy/lifecycle/service.candidate.json": "38b78b9cbee5ade7750a58d5156ca4c5773352e947acb304ee714b59e749ceb4", + "deploy/lifecycle/kustomization.yaml": "1bbce81bc6758434354157f8601534320c5d0290587908fd15a6d25e3fa57f47", + "deploy/lifecycle/registries.candidate.json": "9bad6db5fbc2178d31b04120016a41830c3552fbb9e2517b718f9bbe87cf649e" + }, + "target": "realm:kubernetes/railiance01/informed-decision", + "expected_result": "Protected native schema5 backup/off-cluster drill independently matches snapshot integrity/counts; exact image763c Deployment-only manual Argo release Ready1; installed purpose refusal and separate actual-provider acceptance evidence, retained current database.", + "verification_ref": "informed-decision/docs/evidence/2026-10-11-purpose-image-release/execution/execution-plan.json", + "rollback_ref": "same packet: failedcandidate-independent Deployment-only7db/7f5 source/image recovery plus separateReady/schema5/currentDB verification; no old snapshot overwrite", + "cost_estimate_eur": 0, + "risk_estimate": "Brief Recreate disruption, protected evidence snapshot custody/restore and operator recovery time unpriced; inherited1fixableMEDIUM remains INFD9T05. Allphases including recovery begin beforeOct12deadline; freshdecision if windowexhausted. No autopilot cost/risk grant.", + "execution_deadline": "2026-10-12T23:59:59Z", + "memo_id": "infd-20261011-purpose-overlay-r1", + "memo_version": 1, + "execution_bundle_sha256": "27d6d6d3133c963da1dde92d498d636617387c16e850a17c598148abc35c775d", + "execution_plan_sha256": "f5e5fa906ff19d3a45d10dcdb2810373ae21f9cf44c0472ff2bd47d3bc3328d6", + "internal_pre_submission_refinements": "Initial36manifest7c6738b3 and amended78b1e3 preserved; Platform found old-schema migration/optimizedassertion/dependencyseal/livecount gaps. Initial11helper653b68c3 preserved; independent rollbackReadyfailure/postadminintegrity/deadline findings corrected23f2fad with16synthetic+5recovery negatives. Final112/20document packet distinctProduct/PlatformACK; no previous human approval or native action.", + "promotion_evidence": false, + "native_execution": true, + "approved_revision": "combined-ffa2679a", + "approved_digest": "fd78d486174670e12efb2f812bac02e68f294e7791b9302d0d458c053240f5a9", + "approved_source_revision": "bc6494cd1b290783ef3aef0763bf28d1deabf4b0", + "approved_at": "2026-10-11T02:34:20+00:00", + "approval_ref": "informed-decision:infd-20261011-purpose-overlay-r1@1;approval:ec92806a-9aa6-494f-a76b-0385f39ba609", + "human_disposition_id": "disp-0968373d-294d-42bf-8979-36a7c5dd38cf", + "pre_actuation_attempts": [ + { + "result": "pre-phase refusal: Git custody ignore rule absent", + "native_phase_started": false, + "native_backup_or_image_change": false, + "journal_or_case_custody_created": false, + "source_hashes_and_fresh_authority_relation": "independently passed", + "recovery": "Add scoped Custodian .gitignore exclusion for exact approved private custody parent; unchanged approved helper/source/effect scope" + } + ], + "refinement_or_rescue": true, + "execution_results": { + "source_revision": "bc6494cd1b290783ef3aef0763bf28d1deabf4b0", + "drill_backup": "verified complete", + "drill_copy": "UNCERTAIN; stopped before local snapshot destination creation", + "offline_restore": "not executed", + "image_rollout": "not executed", + "database_preserved": true, + "failure_ref": "docs/evidence/2026-10-10-security-consolidation/infd-purpose-approved-drill-copy-failure.json", + "diagnosis_ref": "docs/evidence/2026-10-10-security-consolidation/infd-purpose-drill-copy-diagnosis.json", + "backup_ref": "docs/evidence/2026-10-10-security-consolidation/infd-purpose-approved-drill-backup.json", + "original_journal_retained": true, + "retry_executed": false + }, + "revisions": [ + { + "revision": "rescue-r2-d05d6e3b", + "status": "actual_target_verified_with_refinement", + "manifest_sha256": "d05d6e3b15df9acf1d7aef0ba2ec82a5a00d979ab1f324e981025cffe2cc753d", + "memo_version": 2, + "memo_sha256": "391330d062ede170a546415886d18b4895ba24d313a0dd50dcc1591c1aa3c2fa", + "revision_request_sha256": "feb946218e9611e1b686c1672fd9142896c55fd88aa2e59fabc6cfadbe22e327", + "revision_command_digest": "ccbeca292dd4ffcd0ed8a4669c82a93f9b773a30186966d3f146d5db8e5e6b8a", + "source_revision": "c96b0c6d881e855d1d158003c6de90ef390262e2", + "execution_bundle_sha256": "49c9cb70f36f6ceb7b0d22400b2ec9232a5e1a8a00d17e92b92fe367c98effb5", + "execution_plan_sha256": "9ce5728a561e6d38f8497201baa2b840d11444a0af8ad6234dfc37428113f258", + "delta": "Explicitly close WAL-aware readers; frozen zero-WAL hash-bound snapshot inspection uses immutable mode; distinct drill-copy-rescue-r1 and new linked journal preserve original uncertain attempt and SHM. Conditional remaining same-image phases only after new approval. Historical helper manifest label corrected.", + "verification": "26 synthetic executor/reader tests plus independent scope, custody and replay counterexamples; actual live drill/rollout remains pending.", + "rollback": "Deployment-only previous image/source recovery preserves latest database; old uncertain journal never rewritten.", + "cost_estimate": "EUR0 recurring infrastructure; existing temporary private-copy storage and attended time unpriced.", + "risk_estimate": "Existing approved snapshot contains private live data; metadata-only logging/private custody, no native sidecar deletion, no rollback over current database. Scoped Recreate restart and reversible Deployment-only image change conditional on actual compatibility drill.", + "approval_id": "7a34e7cc-5bad-40ea-a2f5-d6d269dc56f1", + "disposition_id": "disp-c6529331-e9d7-4466-9528-2e839739e751", + "approved_at": "2026-10-11T06:53:43Z", + "approved_source_revision": "c96b0c6d881e855d1d158003c6de90ef390262e2", + "approval_version": 2, + "review_version": 1, + "review_memo_id": "review-cda20761-f6ff-4d02-9c34-5097fc27539f", + "pre_actuation_attempts": [ + { + "outcome": "refused_before_phase", + "reason": "Root invocation supplied alternate receipt filenames instead of approved fixed interface", + "rescue_journal_created": false, + "native_operation_executed": false, + "correction": "Invoke unchanged approved helper using its original fixed receipt paths; fresh native source2 authority refresh" + } + ], + "native_execution": true, + "original_verify_phase_state": "UNCERTAIN", + "original_failed_copy_state": "UNCERTAIN", + "phase_replay_executed": false, + "independent_verification_ref": "docs/evidence/2026-10-10-security-consolidation/infd-independent-readonly-verification-receipt.json", + "actual_source_revision": "c96b0c6d881e855d1d158003c6de90ef390262e2", + "actual_image": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "actual_pod_uid": "c4cb1550-feda-4097-9de4-d891a657b662", + "ready_replicas": 1, + "rollback_executed": false, + "actual_native_provider_allow": true, + "synthetic_installed_refusal_variants": 8, + "medium_finding_due": "2026-10-18T23:59:59Z", + "product_acceptance_commit": "0693c40", + "platform_actual_acceptance_commit": "d47cbd0", + "task_closed": "INFD-WP-0009-T04", + "workplan_status": "active", + "risk_task": "INFD-WP-0009-T05", + "live_unpromoted_verifier_residual": "INFD-IN-0010" + } + ], + "current_revision_status": "owner_scoped_task_acceptance_recorded" + }, + { + "proposal_id": "NK-FORGEJO-TYPE12-SOURCE-20261011-R1", + "trial_id": "forgejo-type12-source-20261011-r1", + "disposition": "accepted_unchanged", + "outcome": "verified_source_acknowledgment_recorded", + "proposal_ref": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/proposal.json", + "original_revision": "final34-0b377d647ca748cd03c92f9792396412048055d4bde9f7bb06ff6d413f7acd68", + "original_digest": "585cee731de30d2b37883a57abfd9eb32f023ee694e8d911989109d5caf80569", + "packet_manifest_sha256": "0b377d647ca748cd03c92f9792396412048055d4bde9f7bb06ff6d413f7acd68", + "memo_id": "infd-20261011-forgejo-type12-source-r1", + "memo_version": 1, + "target": "NetKingdom proposed oidc-browser-relying-party type1.2 and separate Forgejo reference-migration design receipt", + "expected_result": "Source-only human acknowledgment of complete reviewed type package; canonical case remains proposed, type unimplemented, execution forbidden. No native credential or rollout action.", + "verification_ref": "/home/worsch/net-kingdom/docs/proposals/2026-10-11-forgejo-type12-acknowledgment/recording-gates.md", + "rollback_ref": "Immutable previous type/case1.1 retained; proposed1.2 not admitted for execution.", + "cost_estimate_eur": 0.1, + "risk_estimate": "Source-only decision. No credential exposure or live runtime change authorized.", + "promotion_evidence": false, + "native_execution": false, + "approved_digest": "585cee731de30d2b37883a57abfd9eb32f023ee694e8d911989109d5caf80569", + "approved_revision": "final34-0b377d647ca748cd03c92f9792396412048055d4bde9f7bb06ff6d413f7acd68", + "approved_at": "2026-10-11T06:47:39Z", + "approval_ref": "8e9332c8-754a-420c-b8b7-445cb4fe6765", + "human_disposition_id": "disp-315d54ad-20f1-40e6-862c-6c7d2e8f0ea8", + "approved_source_revision": "584a964684a28e759edc19862a91938bda161cb3", + "source_recording_commit": "f6856cd", + "application_design_receipt_commit": "d349815", + "followthrough_version_selection_commit": "bb9b9b5" + } + ] +} diff --git a/docs/evidence/2026-10-10-security-consolidation/supervision-outcome-enum-repair.json b/docs/evidence/2026-10-10-security-consolidation/supervision-outcome-enum-repair.json new file mode 100644 index 00000000..55f557d2 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/supervision-outcome-enum-repair.json @@ -0,0 +1,7 @@ +{ + "original_record_sha256": "25eb03c3e682046cfc369dd74a567ed89785d748da8ab4d6b37621966204af7b", + "changed_fields": "Allowed outcome enum plus exact original failed trial execution digest/ref and explicit source-only semantics; all original proposals/revisions/approval evidence retained", + "authority_changed": false, + "promotion": false, + "original_failed_trial_preserved": true +} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-remediation-preparation/evidence-hashes.json b/docs/evidence/2026-10-10-security-consolidation/zlib-remediation-preparation/evidence-hashes.json new file mode 100644 index 00000000..8be66717 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-remediation-preparation/evidence-hashes.json @@ -0,0 +1,38 @@ +[ + { + "file": "infd-zlib-source-commits.json", + "sha256": "9b8994072ab8f6d7096ddbe3694ad332419dff2a1c1c13e4f6bdf8c0b771c200" + }, + { + "file": "infd-zlib-reviewed-stage-receipts.json", + "sha256": "8ab4c526ea31b5fa55ba73d0b9aafdc95a3bbf489dd18329916076faeafa651c" + }, + { + "file": "infd-zlib-ci-publication-observation.json", + "sha256": "ffe6f2508bc9bebbdc85ac63eae5765562efbb8e920cc85b8da30a12ee1e4b17" + }, + { + "file": "infd-zlib-publication-digest.json", + "sha256": "ca2a1dec38db8c5fbbc00ef4f27aa865edbbd4a7ca9dc21b2ba023664c507f38" + }, + { + "file": "infd-zlib-fresh-native-preparation.json", + "sha256": "56637994dfdae46a6f9ab442c2ff9b259212650b35eb98d896c5e837f01ce2f9" + }, + { + "file": "security-infd-zlib-source-consistency.json", + "sha256": "4d8c4401bc182ffaad3a6a478f111c1fde15f0cedb8d2445550abea7483f851d" + }, + { + "file": "security-platform-zlib-source-consistency.json", + "sha256": "e98e733cedb7693fb04e7b891e52662ee40cfbad847072261fafef8159409f2d" + }, + { + "file": "security-root-eeb-consistency.json", + "sha256": "3db12a6b147078ed11465df9c788bd59efc2780140ee5044af9fce52f5a9c62c" + }, + { + "file": "security-platform-d47-consistency.json", + "sha256": "d84d1051e2ed3da08f149b5767bd74a4086ebc7855c0e29a616a9e54440ce013" + } +] diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-remediation-preparation/infd-zlib-ci-publication-observation.json b/docs/evidence/2026-10-10-security-consolidation/zlib-remediation-preparation/infd-zlib-ci-publication-observation.json new file mode 100644 index 00000000..67f75a0d --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-remediation-preparation/infd-zlib-ci-publication-observation.json @@ -0,0 +1 @@ +{"workflow_runs":[{"id":11534,"name":"publish-candidate","head_branch":"main","head_sha":"9b4bb25d325698ae543e7e8a8a3c3592db1f58fc","run_number":4,"event":"push","display_title":"Prepare independently reviewed zlib-only image candidate","status":"success","workflow_id":"zlib-overlay-image.yaml","url":"https://forgejo.coulomb.social/coulomb/informed-decision/actions/runs/4","created_at":"2026-10-11T09:36:59Z","updated_at":"2026-10-11T09:37:12Z","run_started_at":"2026-10-11T09:36:59Z"},{"id":11484,"name":"publish-candidate","head_branch":"main","head_sha":"3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168","run_number":3,"event":"push","display_title":"Prepare readable overlay context with the admitted legacy builder","status":"success","workflow_id":"purpose-overlay-image.yaml","url":"https://forgejo.coulomb.social/coulomb/informed-decision/actions/runs/3","created_at":"2026-10-11T01:20:59Z","updated_at":"2026-10-11T01:21:08Z","run_started_at":"2026-10-11T01:20:59Z"},{"id":11483,"name":"publish-candidate","head_branch":"main","head_sha":"acecad887378120b62bd3513b4f04e9fb5cea924","run_number":2,"event":"push","display_title":"Keep overlay module readable by the inherited service user","status":"failure","workflow_id":"purpose-overlay-image.yaml","url":"https://forgejo.coulomb.social/coulomb/informed-decision/actions/runs/2","created_at":"2026-10-11T01:18:25Z","updated_at":"2026-10-11T01:18:31Z","run_started_at":"2026-10-11T01:18:25Z"},{"id":11482,"name":"publish-candidate","head_branch":"main","head_sha":"f66de505b301c03d2fddfa90fd18a53347c62858","run_number":1,"event":"push","display_title":"Publish source-bound advisory-purpose overlay candidates through owner CI","status":"failure","workflow_id":"purpose-overlay-image.yaml","url":"https://forgejo.coulomb.social/coulomb/informed-decision/actions/runs/1","created_at":"2026-10-11T01:15:05Z","updated_at":"2026-10-11T01:15:13Z","run_started_at":"2026-10-11T01:15:05Z"}],"total_count":4} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-remediation-preparation/infd-zlib-fresh-native-preparation.json b/docs/evidence/2026-10-10-security-consolidation/zlib-remediation-preparation/infd-zlib-fresh-native-preparation.json new file mode 100644 index 00000000..2121afb9 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-remediation-preparation/infd-zlib-fresh-native-preparation.json @@ -0,0 +1,672 @@ +{ + "all_checks_pass": true, + "observed_at": "2026-10-11T09:40:15.540874+00:00", + "native_changed": false, + "protected_database_read": false, + "secret_read": false, + "deployment_generation": 25, + "ready_replicas": 1, + "sealed_live_deployment": { + "apiVersion": "apps/v1", + "kind": "Deployment", + "metadata": { + "annotations": { + "argocd.argoproj.io/tracking-id": "informed-decision:apps/Deployment:informed-decision/informed-decision", + "informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover" + }, + "name": "informed-decision", + "namespace": "informed-decision", + "uid": "a588e10a-90d2-4883-975e-6dd8b8feca92" + }, + "spec": { + "progressDeadlineSeconds": 600, + "replicas": 1, + "revisionHistoryLimit": 10, + "selector": { + "matchLabels": { + "app.kubernetes.io/name": "informed-decision" + } + }, + "strategy": { + "type": "Recreate" + }, + "template": { + "metadata": { + "annotations": { + "informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover" + }, + "labels": { + "app.kubernetes.io/component": "review", + "app.kubernetes.io/name": "informed-decision" + } + }, + "spec": { + "automountServiceAccountToken": false, + "containers": [ + { + "env": [ + { + "name": "INFD_KEYCAPE_ISSUER", + "value": "https://kc.coulomb.social" + }, + { + "name": "INFD_CONTAINER_CONFIG", + "value": "/configuration/runtime.json" + } + ], + "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "imagePullPolicy": "IfNotPresent", + "livenessProbe": { + "failureThreshold": 3, + "httpGet": { + "path": "/healthz", + "port": "http", + "scheme": "HTTP" + }, + "periodSeconds": 10, + "successThreshold": 1, + "timeoutSeconds": 2 + }, + "name": "informed-decision", + "ports": [ + { + "containerPort": 8080, + "name": "http", + "protocol": "TCP" + }, + { + "containerPort": 8081, + "name": "workload", + "protocol": "TCP" + } + ], + "readinessProbe": { + "failureThreshold": 3, + "httpGet": { + "path": "/healthz", + "port": "http", + "scheme": "HTTP" + }, + "periodSeconds": 10, + "successThreshold": 1, + "timeoutSeconds": 2 + }, + "resources": { + "limits": { + "cpu": "500m", + "memory": "256Mi" + }, + "requests": { + "cpu": "5m", + "memory": "64Mi" + } + }, + "securityContext": { + "allowPrivilegeEscalation": false, + "capabilities": { + "drop": [ + "ALL" + ] + }, + "readOnlyRootFilesystem": true + }, + "startupProbe": { + "failureThreshold": 12, + "httpGet": { + "path": "/healthz", + "port": "http", + "scheme": "HTTP" + }, + "periodSeconds": 10, + "successThreshold": 1, + "timeoutSeconds": 2 + }, + "terminationMessagePath": "/dev/termination-log", + "terminationMessagePolicy": "File", + "volumeMounts": [ + { + "mountPath": "/data", + "name": "data" + }, + { + "mountPath": "/run/informed-decision", + "name": "runtime" + }, + { + "mountPath": "/tmp", + "name": "tmp" + }, + { + "mountPath": "/configuration", + "name": "configuration", + "readOnly": true + }, + { + "mountPath": "/var/run/secrets/informed-decision/policy", + "name": "caller", + "readOnly": true + }, + { + "mountPath": "/var/run/secrets/informed-decision/audit", + "name": "audit", + "readOnly": true + }, + { + "mountPath": "/var/run/secrets/informed-decision/kubernetes", + "name": "kubernetes-api", + "readOnly": true + }, + { + "mountPath": "/workload-registry", + "name": "workload-registry", + "readOnly": true + }, + { + "mountPath": "/var/run/secrets/informed-decision/requester", + "name": "sitting-requester", + "readOnly": true + } + ] + } + ], + "dnsPolicy": "ClusterFirst", + "restartPolicy": "Always", + "schedulerName": "default-scheduler", + "securityContext": { + "fsGroup": 10001, + "fsGroupChangePolicy": "OnRootMismatch", + "runAsGroup": 10001, + "runAsNonRoot": true, + "runAsUser": 10001, + "seccompProfile": { + "type": "RuntimeDefault" + } + }, + "serviceAccount": "review", + "serviceAccountName": "review", + "terminationGracePeriodSeconds": 45, + "volumes": [ + { + "name": "data", + "persistentVolumeClaim": { + "claimName": "informed-decision-data" + } + }, + { + "emptyDir": { + "medium": "Memory", + "sizeLimit": "16Mi" + }, + "name": "runtime" + }, + { + "emptyDir": { + "medium": "Memory", + "sizeLimit": "16Mi" + }, + "name": "tmp" + }, + { + "configMap": { + "defaultMode": 292, + "name": "informed-decision-runtime-6c221878d051" + }, + "name": "configuration" + }, + { + "name": "caller", + "projected": { + "defaultMode": 288, + "sources": [ + { + "serviceAccountToken": { + "audience": "flex-auth", + "expirationSeconds": 3600, + "path": "token" + } + } + ] + } + }, + { + "name": "audit", + "secret": { + "defaultMode": 288, + "items": [ + { + "key": "token", + "path": "token" + } + ], + "secretName": "informed-decision-audit" + } + }, + { + "name": "kubernetes-api", + "projected": { + "defaultMode": 288, + "sources": [ + { + "serviceAccountToken": { + "expirationSeconds": 600, + "path": "token" + } + }, + { + "configMap": { + "items": [ + { + "key": "ca.crt", + "path": "ca.crt" + } + ], + "name": "kube-root-ca.crt" + } + } + ] + } + }, + { + "configMap": { + "defaultMode": 292, + "name": "informed-decision-workload-registry" + }, + "name": "workload-registry" + }, + { + "name": "sitting-requester", + "secret": { + "defaultMode": 288, + "items": [ + { + "key": "client-secret", + "path": "client-secret" + } + ], + "optional": false, + "secretName": "informed-decision-sitting-requester" + } + } + ] + } + } + } + }, + "candidate_deployment": { + "apiVersion": "apps/v1", + "kind": "Deployment", + "metadata": { + "annotations": { + "argocd.argoproj.io/tracking-id": "informed-decision:apps/Deployment:informed-decision/informed-decision", + "informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover" + }, + "name": "informed-decision", + "namespace": "informed-decision", + "uid": "a588e10a-90d2-4883-975e-6dd8b8feca92" + }, + "spec": { + "progressDeadlineSeconds": 600, + "replicas": 1, + "revisionHistoryLimit": 10, + "selector": { + "matchLabels": { + "app.kubernetes.io/name": "informed-decision" + } + }, + "strategy": { + "type": "Recreate" + }, + "template": { + "metadata": { + "annotations": { + "informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover" + }, + "labels": { + "app.kubernetes.io/component": "review", + "app.kubernetes.io/name": "informed-decision" + } + }, + "spec": { + "automountServiceAccountToken": false, + "containers": [ + { + "env": [ + { + "name": "INFD_KEYCAPE_ISSUER", + "value": "https://kc.coulomb.social" + }, + { + "name": "INFD_CONTAINER_CONFIG", + "value": "/configuration/runtime.json" + } + ], + "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23", + "imagePullPolicy": "IfNotPresent", + "livenessProbe": { + "failureThreshold": 3, + "httpGet": { + "path": "/healthz", + "port": "http", + "scheme": "HTTP" + }, + "periodSeconds": 10, + "successThreshold": 1, + "timeoutSeconds": 2 + }, + "name": "informed-decision", + "ports": [ + { + "containerPort": 8080, + "name": "http", + "protocol": "TCP" + }, + { + "containerPort": 8081, + "name": "workload", + "protocol": "TCP" + } + ], + "readinessProbe": { + "failureThreshold": 3, + "httpGet": { + "path": "/healthz", + "port": "http", + "scheme": "HTTP" + }, + "periodSeconds": 10, + "successThreshold": 1, + "timeoutSeconds": 2 + }, + "resources": { + "limits": { + "cpu": "500m", + "memory": "256Mi" + }, + "requests": { + "cpu": "5m", + "memory": "64Mi" + } + }, + "securityContext": { + "allowPrivilegeEscalation": false, + "capabilities": { + "drop": [ + "ALL" + ] + }, + "readOnlyRootFilesystem": true + }, + "startupProbe": { + "failureThreshold": 12, + "httpGet": { + "path": "/healthz", + "port": "http", + "scheme": "HTTP" + }, + "periodSeconds": 10, + "successThreshold": 1, + "timeoutSeconds": 2 + }, + "terminationMessagePath": "/dev/termination-log", + "terminationMessagePolicy": "File", + "volumeMounts": [ + { + "mountPath": "/data", + "name": "data" + }, + { + "mountPath": "/run/informed-decision", + "name": "runtime" + }, + { + "mountPath": "/tmp", + "name": "tmp" + }, + { + "mountPath": "/configuration", + "name": "configuration", + "readOnly": true + }, + { + "mountPath": "/var/run/secrets/informed-decision/policy", + "name": "caller", + "readOnly": true + }, + { + "mountPath": "/var/run/secrets/informed-decision/audit", + "name": "audit", + "readOnly": true + }, + { + "mountPath": "/var/run/secrets/informed-decision/kubernetes", + "name": "kubernetes-api", + "readOnly": true + }, + { + "mountPath": "/workload-registry", + "name": "workload-registry", + "readOnly": true + }, + { + "mountPath": "/var/run/secrets/informed-decision/requester", + "name": "sitting-requester", + "readOnly": true + } + ] + } + ], + "dnsPolicy": "ClusterFirst", + "restartPolicy": "Always", + "schedulerName": "default-scheduler", + "securityContext": { + "fsGroup": 10001, + "fsGroupChangePolicy": "OnRootMismatch", + "runAsGroup": 10001, + "runAsNonRoot": true, + "runAsUser": 10001, + "seccompProfile": { + "type": "RuntimeDefault" + } + }, + "serviceAccount": "review", + "serviceAccountName": "review", + "terminationGracePeriodSeconds": 45, + "volumes": [ + { + "name": "data", + "persistentVolumeClaim": { + "claimName": "informed-decision-data" + } + }, + { + "emptyDir": { + "medium": "Memory", + "sizeLimit": "16Mi" + }, + "name": "runtime" + }, + { + "emptyDir": { + "medium": "Memory", + "sizeLimit": "16Mi" + }, + "name": "tmp" + }, + { + "configMap": { + "defaultMode": 292, + "name": "informed-decision-runtime-6c221878d051" + }, + "name": "configuration" + }, + { + "name": "caller", + "projected": { + "defaultMode": 288, + "sources": [ + { + "serviceAccountToken": { + "audience": "flex-auth", + "expirationSeconds": 3600, + "path": "token" + } + } + ] + } + }, + { + "name": "audit", + "secret": { + "defaultMode": 288, + "items": [ + { + "key": "token", + "path": "token" + } + ], + "secretName": "informed-decision-audit" + } + }, + { + "name": "kubernetes-api", + "projected": { + "defaultMode": 288, + "sources": [ + { + "serviceAccountToken": { + "expirationSeconds": 600, + "path": "token" + } + }, + { + "configMap": { + "items": [ + { + "key": "ca.crt", + "path": "ca.crt" + } + ], + "name": "kube-root-ca.crt" + } + } + ] + } + }, + { + "configMap": { + "defaultMode": 292, + "name": "informed-decision-workload-registry" + }, + "name": "workload-registry" + }, + { + "name": "sitting-requester", + "secret": { + "defaultMode": 288, + "items": [ + { + "key": "client-secret", + "path": "client-secret" + } + ], + "optional": false, + "secretName": "informed-decision-sitting-requester" + } + } + ] + } + } + } + }, + "sealed_dependencies": { + "configmap": { + "apiVersion": "v1", + "immutable": true, + "kind": "ConfigMap", + "metadata": { + "annotations": { + "argocd.argoproj.io/tracking-id": "informed-decision:/ConfigMap:informed-decision/informed-decision-runtime-6c221878d051", + "informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover" + }, + "name": "informed-decision-runtime-6c221878d051", + "namespace": "informed-decision", + "uid": "90113d2d-54d9-4e82-b1d3-90b49ebed2b5" + }, + "canonical_data_sha256": "8ec462d12347548f506eeebf1e3c7cc47648019c8a783804d09bcc79b0f22af6" + }, + "pvc": { + "apiVersion": "v1", + "kind": "PersistentVolumeClaim", + "metadata": { + "annotations": { + "argocd.argoproj.io/tracking-id": "informed-decision:/PersistentVolumeClaim:informed-decision/informed-decision-data", + "informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover", + "pv.kubernetes.io/bind-completed": "yes", + "pv.kubernetes.io/bound-by-controller": "yes", + "volume.beta.kubernetes.io/storage-provisioner": "rancher.io/local-path", + "volume.kubernetes.io/selected-node": "239.62.205.92.host.secureserver.net", + "volume.kubernetes.io/storage-provisioner": "rancher.io/local-path" + }, + "finalizers": [ + "kubernetes.io/pvc-protection" + ], + "name": "informed-decision-data", + "namespace": "informed-decision", + "uid": "d80b25b1-141a-441b-b205-98fa2fd98b7c" + }, + "spec": { + "accessModes": [ + "ReadWriteOnce" + ], + "resources": { + "requests": { + "storage": "1Gi" + } + }, + "storageClassName": "local-path", + "volumeMode": "Filesystem", + "volumeName": "pvc-d80b25b1-141a-441b-b205-98fa2fd98b7c" + } + }, + "pvc_phase": "Bound" + }, + "argo": { + "uid": "499868f2-eabc-4df4-ae31-b89ce58d750d", + "source": { + "path": "deploy/lifecycle", + "repoURL": "https://forgejo.coulomb.social/coulomb/informed-decision.git", + "targetRevision": "c96b0c6d881e855d1d158003c6de90ef390262e2" + }, + "destination": { + "namespace": "informed-decision", + "server": "https://kubernetes.default.svc" + }, + "automated": false, + "health": { + "lastTransitionTime": "2026-10-11T07:00:42Z", + "status": "Healthy" + }, + "sync": { + "comparedTo": { + "destination": { + "namespace": "informed-decision", + "server": "https://kubernetes.default.svc" + }, + "source": { + "path": "deploy/lifecycle", + "repoURL": "https://forgejo.coulomb.social/coulomb/informed-decision.git", + "targetRevision": "c96b0c6d881e855d1d158003c6de90ef390262e2" + } + }, + "revision": "c96b0c6d881e855d1d158003c6de90ef390262e2", + "status": "OutOfSync" + } + }, + "server_dry_run_passed": true, + "admission_only_image_delta": true, + "client_diff_exit": 1, + "client_diff_sha256": "ccff7c1ecfd9eb59fc0ce566c1013a2af5df514af048c68474a272997024ef7b", + "allocatable_cpu_m": 4000, + "requested_cpu_m": 3460, + "strategy": "Recreate" +} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-remediation-preparation/infd-zlib-publication-digest.json b/docs/evidence/2026-10-10-security-consolidation/zlib-remediation-preparation/infd-zlib-publication-digest.json new file mode 100644 index 00000000..345c17c6 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-remediation-preparation/infd-zlib-publication-digest.json @@ -0,0 +1,7 @@ +{ + "tag": "zlib-85091-9b4bb25d325698ae543e7e8a8a3c3592db1f58fc", + "digest": "sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23", + "source_revision": "9b4bb25d325698ae543e7e8a8a3c3592db1f58fc", + "candidate_only": true, + "native_changed": false +} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-remediation-preparation/infd-zlib-reviewed-stage-receipts.json b/docs/evidence/2026-10-10-security-consolidation/zlib-remediation-preparation/infd-zlib-reviewed-stage-receipts.json new file mode 100644 index 00000000..8e013d5d --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-remediation-preparation/infd-zlib-reviewed-stage-receipts.json @@ -0,0 +1,17 @@ +[ + { + "manifest": "/tmp/infd-zlib-candidate-stage/manifest.json", + "sha256": "724aa4777eb1c8976d868e5f504473f4b6d58f13d750d87aefa5c8d5ca0747ec", + "file_count": 74 + }, + { + "manifest": "/tmp/infd-zlib-product-complete-ack-stage/manifest.json", + "sha256": "6e2176b7c281e1969c051d8a15a283878ce380001ecfd48c7071e96bf1566c91", + "file_count": 80 + }, + { + "manifest": "/tmp/infd-zlib-platform-final-order-review-stage/manifest.json", + "sha256": "f09881a6ff538703241aba0a2d0072b4eaa21ddbad3a593b09e7659d3843a373", + "file_count": 22 + } +] diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-remediation-preparation/infd-zlib-source-commits.json b/docs/evidence/2026-10-10-security-consolidation/zlib-remediation-preparation/infd-zlib-source-commits.json new file mode 100644 index 00000000..173b1b5c --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-remediation-preparation/infd-zlib-source-commits.json @@ -0,0 +1,16 @@ +[ + { + "repo": "informed-decision", + "revision": "9b4bb25d325698ae543e7e8a8a3c3592db1f58fc", + "files": 154, + "source_only": true, + "native_change": false + }, + { + "repo": "railiance-platform", + "revision": "2fe072a866a4cd9140ade5a7477b9043bd07de7e", + "files": 22, + "source_only": true, + "native_change": false + } +] diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-remediation-preparation/security-infd-zlib-source-consistency.json b/docs/evidence/2026-10-10-security-consolidation/zlib-remediation-preparation/security-infd-zlib-source-consistency.json new file mode 100644 index 00000000..6cb4d157 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-remediation-preparation/security-infd-zlib-source-consistency.json @@ -0,0 +1,149 @@ +{ + "repo_slug": "informed-decision", + "repo_path": "/home/worsch/informed-decision", + "issues": [ + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager warning: GOAL.md: durable flavors use INTENT.md; GOAL.md is the project-flavor purpose document", + "file_path": "GOAL.md", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-33", + "message": "WORK-RECORDS.md is missing or stale \u2014 regenerate via fix-consistency (CUST-WP-0061-T04 generated work-record index)", + "file_path": "WORK-RECORDS.md", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Task 'INFD-WP-ADHOC-2026-10-11-T02' has no state_hub_task_id", + "file_path": "workplans/ADHOC-2026-10-11.md#INFD-WP-ADHOC-2026-10-11-T02", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Task 'INFD-WP-ADHOC-2026-10-11-T03' has no state_hub_task_id", + "file_path": "workplans/ADHOC-2026-10-11.md#INFD-WP-ADHOC-2026-10-11-T03", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Task 'INFD-WP-ADHOC-2026-10-11-T04' has no state_hub_task_id", + "file_path": "workplans/ADHOC-2026-10-11.md#INFD-WP-ADHOC-2026-10-11-T04", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Task 'INFD-WP-ADHOC-2026-10-11-T05' has no state_hub_task_id", + "file_path": "workplans/ADHOC-2026-10-11.md#INFD-WP-ADHOC-2026-10-11-T05", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Task 'INFD-WP-ADHOC-2026-10-11-T06' has no state_hub_task_id", + "file_path": "workplans/ADHOC-2026-10-11.md#INFD-WP-ADHOC-2026-10-11-T06", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Task 'INFD-WP-ADHOC-2026-10-11-T07' has no state_hub_task_id", + "file_path": "workplans/ADHOC-2026-10-11.md#INFD-WP-ADHOC-2026-10-11-T07", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Task 'INFD-WP-ADHOC-2026-10-11-T08' has no state_hub_task_id", + "file_path": "workplans/ADHOC-2026-10-11.md#INFD-WP-ADHOC-2026-10-11-T08", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-10", + "message": "Task status drift 'INFD-WP-0009-T05': file='progress' db='todo' (file wins)", + "file_path": "workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md#INFD-WP-0009-T05", + "db_id": "1743596f-8558-5a6b-afef-4dd5c1e9c0ae", + "file_value": "progress", + "db_value": "todo", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-22", + "message": "Task description drift 'INFD-WP-0009-T05': file content differs from DB (file wins)", + "file_path": "workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md#INFD-WP-0009-T05", + "db_id": "1743596f-8558-5a6b-afef-4dd5c1e9c0ae", + "file_value": "Owner follow-through `INFD-RISK-20261011-ZLIB-85091` tracks actual published\nbase and purpose-overlay scan finding CVE-2", + "db_value": "Owner follow-through `INFD-RISK-20261011-ZLIB-85091` tracks actual published\nbase and purpose-overlay scan finding CVE-2", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-28", + "message": "1 unread message(s) lack thread_id for supersession tracking: access-engine:7fcb1eb7", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 11/11", + "C-17 cleared: pushed 1 backlogged commit(s)", + "C-33 fixed: regenerated WORK-RECORDS.md", + "C-11 skipped: task 'INFD-WP-ADHOC-2026-10-11-T02' in finished workstream \u2014 not created", + "C-11 skipped: task 'INFD-WP-ADHOC-2026-10-11-T03' in finished workstream \u2014 not created", + "C-11 skipped: task 'INFD-WP-ADHOC-2026-10-11-T04' in finished workstream \u2014 not created", + "C-11 skipped: task 'INFD-WP-ADHOC-2026-10-11-T05' in finished workstream \u2014 not created", + "C-11 skipped: task 'INFD-WP-ADHOC-2026-10-11-T06' in finished workstream \u2014 not created", + "C-11 skipped: task 'INFD-WP-ADHOC-2026-10-11-T07' in finished workstream \u2014 not created", + "C-11 skipped: task 'INFD-WP-ADHOC-2026-10-11-T08' in finished workstream \u2014 not created", + "C-10 fixed: task 1743596f\u2026 status \u2192 'progress'", + "C-22 fixed: task 1743596f\u2026 description updated", + "brief: .custodian-brief.md updated", + "push: pushed" + ], + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 12, + "info": 0 + }, + "result": "warn" +} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-remediation-preparation/security-platform-d47-consistency.json b/docs/evidence/2026-10-10-security-consolidation/zlib-remediation-preparation/security-platform-d47-consistency.json new file mode 100644 index 00000000..2764434e --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-remediation-preparation/security-platform-d47-consistency.json @@ -0,0 +1,398 @@ +{ + "repo_slug": "railiance-platform", + "repo_path": "/home/worsch/railiance-platform", + "issues": [ + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager missing: README.md: README.md is required for flavor tooling", + "file_path": "README.md", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-23", + "message": "Lifecycle drift in 'rpf-wp-0053': workplan status 'proposed' has an active task \u2014 report only (ADR-007: do not auto-promote proposed)", + "file_path": "workplans/RPF-WP-0053-coulomb-paired-backup-admission.md", + "db_id": "cb55e474-c7a5-5c6f-bd72-ce65f853e3e3", + "file_value": "proposed", + "db_value": "proposed", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0004' is not linked to State Hub", + "file_path": "workplans/archived/260702-RPF-WP-0023-workload-kv-access-lanes.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0004", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0005' is not linked to State Hub", + "file_path": "workplans/archived/260702-RPF-WP-0024-credential-change-approval-workflow.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0005", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0006' is not linked to State Hub", + "file_path": "workplans/archived/260702-RPF-WP-0024-credential-change-approval-workflow.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0006", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0005' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0005", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0006' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0006", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0007' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0007", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0004' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0004", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0007' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0007", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0008' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0008", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0004' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0004", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0007' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0007", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0008' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0008", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0007' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0007", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0008' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0008", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0003@retired-20260826' (id=665b3b9b\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "665b3b9b-608a-4be4-84b6-dcb8261ff57b", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0004@retired-20260826' (id=e57e487b\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "e57e487b-8557-439d-8093-0457c73ede93", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0005@retired-20260826' (id=2731fece\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "2731fece-6c49-45b8-ab8a-4ea6c04ac603", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0006@retired-20260826' (id=96c8a93d\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "96c8a93d-7a5a-4fa9-8f7b-865119551da3", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0007@retired-20260826' (id=4d7ce243\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "4d7ce243-f40a-4249-a46a-a24f75d6fe4c", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0008@retired-20260826' (id=671898ef\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "671898ef-2378-4814-b8f6-066148cdad46", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0009@retired-20260826' (id=b059c81d\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "b059c81d-96f1-451f-896f-a05cd73744a1", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0010@retired-20260826' (id=f364d405\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "f364d405-a85d-4b89-b600-1964ab436cad", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "FAIL", + "check_id": "C-07", + "message": "Non-closed DB workstream 'railiance-wp-0029@retired-20260826' (id=038bc3c0\u2026) has no backing workplan file \u2014 ADR-001 violation", + "file_path": "", + "db_id": "038bc3c0-4492-5b91-95eb-ae515ca205df", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "FAIL", + "check_id": "C-07", + "message": "Non-closed DB workstream 'railiance-wp-0024@retired-20260826' (id=88c4ef7f\u2026) has no backing workplan file \u2014 ADR-001 violation", + "file_path": "", + "db_id": "88c4ef7f-0af8-580e-90dc-a2bae2675a4d", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0016@retired-20260826' (id=857ca302\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "857ca302-bb94-5d41-a649-1aa966368df4", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0017@retired-20260826' (id=16e8f234\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "16e8f234-9305-5ff3-af82-4639215a0c54", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0022@retired-20260826' (id=a7977cbf\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "a7977cbf-ab43-56b7-b7a9-ceb52382b341", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0026@retired-20260826' (id=73878f8d\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "73878f8d-d8bb-5845-8a5c-91cdd83c1066", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "FAIL", + "check_id": "C-07", + "message": "Non-closed DB workstream 'railiance-wp-0027@retired-20260826' (id=6f8a6cbc\u2026) has no backing workplan file \u2014 ADR-001 violation", + "file_path": "", + "db_id": "6f8a6cbc-c076-5f0a-ade2-281a7ec71360", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0011@retired-20260826' (id=3f9fd8de\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "3f9fd8de-7235-4486-aaa7-634dba2bb6fa", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0025@retired-20260826' (id=2422d4e7\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "2422d4e7-2125-591e-8e95-80ecc6e09da0", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0028@retired-20260826' (id=022dda1f\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "022dda1f-8772-57ad-862e-672924455f11", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0023@retired-20260826' (id=ec52fbe6\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "ec52fbe6-571b-570e-884b-c7a32ff7bcc8", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0015@retired-20260826' (id=1c73af72\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "1c73af72-fd4b-5ab6-8ff7-a3c302bf55a5", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'RAIL-PL-WP-0002' uses prefix 'RAIL-PL-WP' but repo canonical prefix is 'RPF-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260702-RAIL-PL-WP-0002-openbao-platform-secrets-service.md", + "db_id": "", + "file_value": "RAIL-PL-WP-0002", + "db_value": "RPF-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'RAIL-PL-WP-0001' uses prefix 'RAIL-PL-WP' but repo canonical prefix is 'RPF-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/RAIL-PL-WP-0001-platform-baseline.md", + "db_id": "", + "file_value": "RAIL-PL-WP-0001", + "db_value": "RPF-WP", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 59/59", + "C-17 cleared: pushed 1 backlogged commit(s)", + "push: pushed" + ], + "summary": { + "fail": 3, + "automation_error": 0, + "warn": 18, + "info": 17 + }, + "result": "fail" +} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-remediation-preparation/security-platform-zlib-source-consistency.json b/docs/evidence/2026-10-10-security-consolidation/zlib-remediation-preparation/security-platform-zlib-source-consistency.json new file mode 100644 index 00000000..5909fc91 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-remediation-preparation/security-platform-zlib-source-consistency.json @@ -0,0 +1,398 @@ +{ + "repo_slug": "railiance-platform", + "repo_path": "/home/worsch/railiance-platform", + "issues": [ + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager missing: README.md: README.md is required for flavor tooling", + "file_path": "README.md", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-23", + "message": "Lifecycle drift in 'rpf-wp-0053': workplan status 'proposed' has an active task \u2014 report only (ADR-007: do not auto-promote proposed)", + "file_path": "workplans/RPF-WP-0053-coulomb-paired-backup-admission.md", + "db_id": "cb55e474-c7a5-5c6f-bd72-ce65f853e3e3", + "file_value": "proposed", + "db_value": "proposed", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0004' is not linked to State Hub", + "file_path": "workplans/archived/260702-RPF-WP-0023-workload-kv-access-lanes.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0004", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0005' is not linked to State Hub", + "file_path": "workplans/archived/260702-RPF-WP-0024-credential-change-approval-workflow.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0005", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0006' is not linked to State Hub", + "file_path": "workplans/archived/260702-RPF-WP-0024-credential-change-approval-workflow.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0006", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0005' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0005", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0006' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0006", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0007' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0007", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0004' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0004", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0007' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0007", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0008' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0008", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0004' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0004", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0007' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0007", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0008' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0008", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0007' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0007", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0008' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0008", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0003@retired-20260826' (id=665b3b9b\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "665b3b9b-608a-4be4-84b6-dcb8261ff57b", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0004@retired-20260826' (id=e57e487b\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "e57e487b-8557-439d-8093-0457c73ede93", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0005@retired-20260826' (id=2731fece\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "2731fece-6c49-45b8-ab8a-4ea6c04ac603", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0006@retired-20260826' (id=96c8a93d\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "96c8a93d-7a5a-4fa9-8f7b-865119551da3", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0007@retired-20260826' (id=4d7ce243\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "4d7ce243-f40a-4249-a46a-a24f75d6fe4c", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0008@retired-20260826' (id=671898ef\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "671898ef-2378-4814-b8f6-066148cdad46", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0009@retired-20260826' (id=b059c81d\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "b059c81d-96f1-451f-896f-a05cd73744a1", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0010@retired-20260826' (id=f364d405\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "f364d405-a85d-4b89-b600-1964ab436cad", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "FAIL", + "check_id": "C-07", + "message": "Non-closed DB workstream 'railiance-wp-0029@retired-20260826' (id=038bc3c0\u2026) has no backing workplan file \u2014 ADR-001 violation", + "file_path": "", + "db_id": "038bc3c0-4492-5b91-95eb-ae515ca205df", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "FAIL", + "check_id": "C-07", + "message": "Non-closed DB workstream 'railiance-wp-0024@retired-20260826' (id=88c4ef7f\u2026) has no backing workplan file \u2014 ADR-001 violation", + "file_path": "", + "db_id": "88c4ef7f-0af8-580e-90dc-a2bae2675a4d", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0023@retired-20260826' (id=ec52fbe6\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "ec52fbe6-571b-570e-884b-c7a32ff7bcc8", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0016@retired-20260826' (id=857ca302\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "857ca302-bb94-5d41-a649-1aa966368df4", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "FAIL", + "check_id": "C-07", + "message": "Non-closed DB workstream 'railiance-wp-0027@retired-20260826' (id=6f8a6cbc\u2026) has no backing workplan file \u2014 ADR-001 violation", + "file_path": "", + "db_id": "6f8a6cbc-c076-5f0a-ade2-281a7ec71360", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0011@retired-20260826' (id=3f9fd8de\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "3f9fd8de-7235-4486-aaa7-634dba2bb6fa", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0025@retired-20260826' (id=2422d4e7\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "2422d4e7-2125-591e-8e95-80ecc6e09da0", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0026@retired-20260826' (id=73878f8d\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "73878f8d-d8bb-5845-8a5c-91cdd83c1066", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0022@retired-20260826' (id=a7977cbf\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "a7977cbf-ab43-56b7-b7a9-ceb52382b341", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0028@retired-20260826' (id=022dda1f\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "022dda1f-8772-57ad-862e-672924455f11", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0017@retired-20260826' (id=16e8f234\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "16e8f234-9305-5ff3-af82-4639215a0c54", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0015@retired-20260826' (id=1c73af72\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "1c73af72-fd4b-5ab6-8ff7-a3c302bf55a5", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'RAIL-PL-WP-0002' uses prefix 'RAIL-PL-WP' but repo canonical prefix is 'RPF-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260702-RAIL-PL-WP-0002-openbao-platform-secrets-service.md", + "db_id": "", + "file_value": "RAIL-PL-WP-0002", + "db_value": "RPF-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'RAIL-PL-WP-0001' uses prefix 'RAIL-PL-WP' but repo canonical prefix is 'RPF-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/RAIL-PL-WP-0001-platform-baseline.md", + "db_id": "", + "file_value": "RAIL-PL-WP-0001", + "db_value": "RPF-WP", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 59/59", + "C-17 cleared: pushed 1 backlogged commit(s)", + "push: pushed" + ], + "summary": { + "fail": 3, + "automation_error": 0, + "warn": 18, + "info": 17 + }, + "result": "fail" +} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-remediation-preparation/security-root-eeb-consistency.json b/docs/evidence/2026-10-10-security-consolidation/zlib-remediation-preparation/security-root-eeb-consistency.json new file mode 100644 index 00000000..a82475eb --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-remediation-preparation/security-root-eeb-consistency.json @@ -0,0 +1,88 @@ +{ + "repo_slug": "the-custodian", + "repo_path": "/home/worsch/the-custodian", + "issues": [ + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager warning: workplans/: repository uses more than one workplan prefix: ['CUST-WP', 'THE-WP']", + "file_path": "workplans/", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager contradictory: workplans/ADHOC-2026-08-25-retired.md: workplan id 'CUST-WP-ADHOC-2026-08-25-RETIRED' is not accepted by the canon kind registry", + "file_path": "workplans/ADHOC-2026-08-25-retired.md", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'cust-wp-0010b' (id=416ff571\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "416ff571-18cf-5cb2-9c8b-836f68a301b3", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'interactive-the-custodian@retired-20260828' (id=370c2481\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "370c2481-6806-41eb-a917-f8874f03184f", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'the-custodian-adhoc-2026-07-02@retired-20260827' (id=5c53733b\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "5c53733b-c077-4a93-be66-9c3af8f9b6fd", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'adhoc-2026-05-02@retired-20260827' (id=3f54ce9c\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "3f54ce9c-1f95-42de-894f-0f81a52ba2e8", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'THE-WP-0001' uses prefix 'THE-WP' but repo canonical prefix is 'CUST-WP' \u2014 new plans must conform", + "file_path": "workplans/THE-WP-0001-federation-interface.md", + "db_id": "", + "file_value": "THE-WP-0001", + "db_value": "CUST-WP", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 86/86", + "C-17 cleared: pushed 1 backlogged commit(s)", + "push: pushed" + ], + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 3, + "info": 4 + }, + "result": "warn" +}