Verify admitted scanner activation cb9a20f9 before publication acceptance
This commit is contained in:
codex
parent
f4f26a61d5
commit
c1fcd94812
6 changed files with 184 additions and 17 deletions
|
|
@ -1,6 +1,12 @@
|
|||
# T20: exact receive-scanner activation and recovery
|
||||
|
||||
Status: **prepared and tested; no live change, owner assent or founder go**.
|
||||
Status: **native stage and activation verified; ordinary Custodian publication/readback pending**.
|
||||
|
||||
Founder decision `cb9a20f9-5f8d-411f-b034-b15856c0efb5` records the actual
|
||||
conditional go, now satisfied by the two independent owner approvals in
|
||||
`owner-reviews.json`. Native receipts: `stage-r1.json` and `activation-r1.json`.
|
||||
The two Apps declarations are published at `2fdc198b2bb8e6d4ad50768c22cf99328828eb4f`.
|
||||
The prepared proposal remains byte-for-byte unchanged.
|
||||
|
||||
Stable proposal `FORGE10-RECEIVE-BATCH-20261018`, revision **1**, exact
|
||||
[`proposal.json`](proposal.json) digest:
|
||||
|
|
@ -96,12 +102,13 @@ and verifies all protected metadata. Then restore only exact Apps postimages to
|
|||
their sealed preimages and normally publish that inverse in the same session.
|
||||
Do not overwrite unknown drift. Retain inert public binaries/ConfigMap.
|
||||
|
||||
## Admission still needed
|
||||
## Admission history
|
||||
|
||||
The founder decides the exact supervised live change; Forge and Apps supply
|
||||
The founder decided the exact supervised live change; Forge and Apps supplied
|
||||
their owner judgements. A founder may personally supply both reviews under the
|
||||
[founder fallback](../../../../canon/standards/delegated-owner-review_v0.1.md).
|
||||
No owner verdict is written here by the requesting Custodian agent.
|
||||
The independently written owner verdicts are retained separately; the requesting
|
||||
Custodian agent recorded their return and the actual founder decision.
|
||||
|
||||
Review questions, for the owner or founder to answer:
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,98 @@
|
|||
{
|
||||
"proposal_id": "FORGE10-RECEIVE-BATCH-20261018",
|
||||
"proposal_sha256": "sha256:90bb3a1a35729396b02a377d8db62e1d1f8f38d8e24e601dbc3d4446cffd05e8",
|
||||
"revision": 1,
|
||||
"mode": "apply",
|
||||
"result": "verified",
|
||||
"events": [
|
||||
{
|
||||
"phase": "preflight-verified",
|
||||
"pod_uid": "d4728052-b8df-4574-8a3e-74490a04472d",
|
||||
"hook_profiles": 166,
|
||||
"allocated_resources": [
|
||||
"Allocated resources:",
|
||||
" (Total limits may be over 100 percent, i.e., overcommitted.)",
|
||||
" Resource Requests Limits",
|
||||
" -------- -------- ------",
|
||||
" cpu 3605m (90%) 37500m (937%)",
|
||||
" memory 9856Mi (61%) 34562Mi (216%)",
|
||||
" ephemeral-storage 256Mi (0%) 1Gi (0%)",
|
||||
" hugepages-1Gi 0 (0%) 0 (0%)",
|
||||
" hugepages-2Mi 0 (0%) 0 (0%)"
|
||||
],
|
||||
"incremental_requests": "0; same containers/resources, Recreate strategy"
|
||||
},
|
||||
{
|
||||
"phase": "owner-source-verified",
|
||||
"commit": "2fdc198b2bb8e6d4ad50768c22cf99328828eb4f"
|
||||
},
|
||||
{
|
||||
"phase": "native-exact-binary-probe",
|
||||
"clean_push": true,
|
||||
"intermediate_secret_refused": true,
|
||||
"quarantine_discarded": true,
|
||||
"scanner_unavailable_refused": true,
|
||||
"clean_recovery": true,
|
||||
"temporary_probe_removed": true,
|
||||
"builtin_authorization_excluded": true
|
||||
},
|
||||
{
|
||||
"phase": "configmap-create-intent",
|
||||
"name": "forgejo-secret-template-832f6dc6b809"
|
||||
},
|
||||
{
|
||||
"phase": "deployment-patch-intent",
|
||||
"before_pod_uid": "d4728052-b8df-4574-8a3e-74490a04472d"
|
||||
},
|
||||
{
|
||||
"phase": "hook-control-create-intent",
|
||||
"direction": "apply"
|
||||
},
|
||||
{
|
||||
"phase": "hook-update-intent",
|
||||
"direction": "apply",
|
||||
"control_directory": "/tmp/custodian-scanner-migration-XXPAGEMF"
|
||||
},
|
||||
{
|
||||
"phase": "hook-update-verified",
|
||||
"hook_files_verified": 166,
|
||||
"direction": "apply"
|
||||
},
|
||||
{
|
||||
"phase": "control-directory-removed",
|
||||
"directory": "/tmp/custodian-scanner-migration-XXPAGEMF"
|
||||
},
|
||||
{
|
||||
"phase": "native-exact-binary-probe",
|
||||
"clean_push": true,
|
||||
"intermediate_secret_refused": true,
|
||||
"quarantine_discarded": true,
|
||||
"scanner_unavailable_refused": true,
|
||||
"clean_recovery": true,
|
||||
"temporary_probe_removed": true,
|
||||
"builtin_authorization_excluded": true
|
||||
},
|
||||
{
|
||||
"phase": "template-inheritance-probe-intent"
|
||||
},
|
||||
{
|
||||
"phase": "template-inheritance-verified",
|
||||
"mounted_hook_regular": true,
|
||||
"inherited_hook_regular_executable": true,
|
||||
"hook_sha256": "832f6dc6b809de4dad401b283a77eb1372b9d29f62b893010f1cecd0af5d01de",
|
||||
"inherited_hook_malformed_input_refused": true,
|
||||
"scope": "Native Git init with actual Forgejo global configuration in an owned temporary bare repository; not production API repository creation."
|
||||
},
|
||||
{
|
||||
"phase": "all-scoped-runtime-checks-verified",
|
||||
"pod_uid": "b9c59178-2223-46e8-842b-2bc473f55940"
|
||||
},
|
||||
{
|
||||
"phase": "activation-verified",
|
||||
"pod_uid": "b9c59178-2223-46e8-842b-2bc473f55940"
|
||||
},
|
||||
{
|
||||
"phase": "completed"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
{
|
||||
"owner": "railiance-apps",
|
||||
"source_commit": "2fdc198b2bb8e6d4ad50768c22cf99328828eb4f",
|
||||
"normal_publication_verified": true,
|
||||
"expected_commit": "2fdc198b2bb8e6d4ad50768c22cf99328828eb4f",
|
||||
"derived_commit": "2fdc198b2bb8e6d4ad50768c22cf99328828eb4f",
|
||||
"instance_role": "primary",
|
||||
"instance_label": "railiance01",
|
||||
"unrelated_state_preserved": true,
|
||||
"scope": "Exact two Apps declaration files; no Helm replay."
|
||||
}
|
||||
|
|
@ -0,0 +1,48 @@
|
|||
{
|
||||
"proposal_id": "FORGE10-RECEIVE-BATCH-20261018",
|
||||
"proposal_sha256": "sha256:90bb3a1a35729396b02a377d8db62e1d1f8f38d8e24e601dbc3d4446cffd05e8",
|
||||
"revision": 1,
|
||||
"mode": "stage",
|
||||
"result": "verified",
|
||||
"events": [
|
||||
{
|
||||
"phase": "preflight-verified",
|
||||
"pod_uid": "d4728052-b8df-4574-8a3e-74490a04472d",
|
||||
"hook_profiles": 166,
|
||||
"allocated_resources": [
|
||||
"Allocated resources:",
|
||||
" (Total limits may be over 100 percent, i.e., overcommitted.)",
|
||||
" Resource Requests Limits",
|
||||
" -------- -------- ------",
|
||||
" cpu 3605m (90%) 37500m (937%)",
|
||||
" memory 9856Mi (61%) 34562Mi (216%)",
|
||||
" ephemeral-storage 256Mi (0%) 1Gi (0%)",
|
||||
" hugepages-1Gi 0 (0%) 0 (0%)",
|
||||
" hugepages-2Mi 0 (0%) 0 (0%)"
|
||||
],
|
||||
"incremental_requests": "0; same containers/resources, Recreate strategy"
|
||||
},
|
||||
{
|
||||
"phase": "stage-intent",
|
||||
"directory": "/data/security/receive-secret-scan/20261018-73ee04078786"
|
||||
},
|
||||
{
|
||||
"phase": "native-exact-binary-probe",
|
||||
"clean_push": true,
|
||||
"intermediate_secret_refused": true,
|
||||
"quarantine_discarded": true,
|
||||
"scanner_unavailable_refused": true,
|
||||
"clean_recovery": true,
|
||||
"temporary_probe_removed": true,
|
||||
"builtin_authorization_excluded": true
|
||||
},
|
||||
{
|
||||
"phase": "stage-complete",
|
||||
"stage_verified": true,
|
||||
"already_staged": false
|
||||
},
|
||||
{
|
||||
"phase": "completed"
|
||||
}
|
||||
]
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue