From f4f26a61d5fad4871e59e65ce09714a514f2e689 Mon Sep 17 00:00:00 2001 From: codex Date: Sun, 18 Oct 2026 16:46:24 +0200 Subject: [PATCH] Record exact scanner admission cb9a20f9 with independent owner reviews --- .kaizen/agents/custodian-codex/supervision.json | 13 +++++++------ .../decision-approval.json | 9 +++++++++ .../founder-conditional-go.json | 17 +++++++++++++++++ .../owner-reviews.json | 16 ++++++++++++++++ .../owner-reviews/railiance-apps.json | 7 +++++++ .../owner-reviews/railiance-forge.json | 7 +++++++ 6 files changed, 63 insertions(+), 6 deletions(-) create mode 100644 docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/decision-approval.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/founder-conditional-go.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/owner-reviews.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/owner-reviews/railiance-apps.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/owner-reviews/railiance-forge.json diff --git a/.kaizen/agents/custodian-codex/supervision.json b/.kaizen/agents/custodian-codex/supervision.json index ab5dba5..68d77ab 100644 --- a/.kaizen/agents/custodian-codex/supervision.json +++ b/.kaizen/agents/custodian-codex/supervision.json @@ -1054,14 +1054,15 @@ "risk_estimate_eur": null, "cost_note": "No added infrastructure or paid service; human effort and availability risk are unpriced.", "risk_estimate": "Moderate availability risk: one Recreate restart, another if rollback is needed. No Secret, policy, image, database or credential changes. Existing single uncovered repository remains out of scope.", - "disposition": "unscored", + "disposition": "accepted_unchanged", "outcome": "not_executed", - "approval_ref": null, - "approved_revision": null, - "approved_digest_sha256": null, + "approval_ref": "cb9a20f9-5f8d-411f-b034-b15856c0efb5", + "approved_revision": 1, + "approved_digest_sha256": "90bb3a1a35729396b02a377d8db62e1d1f8f38d8e24e601dbc3d4446cffd05e8", "executed_revision": null, - "reason": "Exact revision prepared and tested; independent owner judgements and founder live go not supplied. Offline fixture failures retained. No native execution and no authority promotion.", - "decision_request_ref": "cb9a20f9-5f8d-411f-b034-b15856c0efb5" + "reason": "Founder actual conditional go; both independent owner reviews accepted exact original sealed revision1. No execution yet; failed/unverified outcomes will be retained and no authority promotion granted.", + "decision_request_ref": "cb9a20f9-5f8d-411f-b034-b15856c0efb5", + "owner_reviews_ref": "docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/owner-reviews.json" } ], "trials": [ diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/decision-approval.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/decision-approval.json new file mode 100644 index 0000000..b897a79 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/decision-approval.json @@ -0,0 +1,9 @@ +{ + "id": "cb9a20f9-5f8d-411f-b034-b15856c0efb5", + "status": "resolved", + "decided_by": "Bernd Worsch", + "proposal_sha256": "sha256:90bb3a1a35729396b02a377d8db62e1d1f8f38d8e24e601dbc3d4446cffd05e8", + "owner_condition_met": true, + "actual_reply": "Approve this exact rollout conditional on independent Forge and Apps reviews; authorize those owner agents to review it.", + "native_executed": false +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/founder-conditional-go.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/founder-conditional-go.json new file mode 100644 index 0000000..bb9de19 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/founder-conditional-go.json @@ -0,0 +1,17 @@ +{ + "proposal_id": "FORGE10-RECEIVE-BATCH-20261018", + "revision": 1, + "proposal_sha256": "sha256:90bb3a1a35729396b02a377d8db62e1d1f8f38d8e24e601dbc3d4446cffd05e8", + "founder": "Bernd Worsch", + "received_at": "2026-10-18T14:43:53.482497+00:00", + "actual_reply": "Approve this exact rollout conditional on independent Forge and Apps reviews; authorize those owner agents to review it.", + "scope": "Exact revision1 staging, two Apps source files, startup guard/template,166hooks,oneRecreate restart (second only for rollback),native verification and ordinary publication.", + "condition": "Both independent owner reviews approve the unchanged exact digest. Any requested revision needs fresh founder disposition.", + "owner_reviews_complete": false, + "execution_admitted": false, + "agents_authorized": [ + "railiance-forge-owner", + "railiance-apps-owner" + ], + "authority_promotion": false +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/owner-reviews.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/owner-reviews.json new file mode 100644 index 0000000..46e7e3a --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/owner-reviews.json @@ -0,0 +1,16 @@ +{ + "railiance-forge": { + "reviewer": "railiance-forge-owner (agent railiance-forge, codex)", + "decision": "approved", + "proposal_sha256": "sha256:90bb3a1a35729396b02a377d8db62e1d1f8f38d8e24e601dbc3d4446cffd05e8", + "work_item_id": "FORGE-WP-0010-T02", + "comment": "Independent Forge owner review, conducted from /home/worsch/railiance-forge with its AGENTS.md and INTENT.md loaded, under FORGE-WP-0010-T02. Reviewed FORGE10-RECEIVE-BATCH-20261018 revision 1, exact proposal SHA256 90bb3a1a35729396b02a377d8db62e1d1f8f38d8e24e601dbc3d4446cffd05e8, including the sealed controller, shell scripts, source images, recovery path, tests and retained receipts. Forge INTENT basis: Mission and Core Principles 1 (Forge Runtime), 2 (Artifacts With Evidence), 4 (Stable Handoffs), 5 (Restore Before Trust), and 6 (Forgejo Is the Current Forge). This is a bounded correction to Forge-owned receive infrastructure and its operating evidence; the Apps source declaration remains an independent Apps-owner boundary. No blocking Forge defect found in the reviewed scope. Independently matched every proposal input hash, all three Forge implementation hashes at published HEAD ea65606c1298db782f721f9443bafeb03cdef138, the candidate executable digest 73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a, and the 166 scanner-fragment/1328 protected-hook denominator; independently reran all nine offline controller tests successfully. Inspected batching and volatile-storage custody: at most 64 small inputs of at most 4096 bytes, pinned Gitleaks 8.30.1/default rules without repository suppression, strict diagnostic/report validation, original larger-input path, unchanged traversal/ref/object/byte/deadline limits, private checked tmpfs input storage, parent-bound cleanup and child termination. Read the 54-case source proof and 16-scenario filesystem receipt; these include boundary detection, scanner/storage failure, receiver loss, partial hook recovery and quarantine discard. The retained exact 278-object clean delta result (58.18 seconds under the existing 90-second budget) supports the availability correction without relaxing refusal. Deployment changes are conditional on exact UID/resourceVersion, original full template and reviewed field preimages; only the startup command and immutable template ConfigMap reference change. The combined guard verifies and repairs executable modes for both versions across the migration. Hook replacement validates the complete declared scope before writing, uses atomic replacements, and verifies protected metadata; recovery restores known old/new scanner fragments and exact original Deployment fields while refusing unknown drift. The lost patch-response branch attempts guarded rollback and retains the failed/unverified activation. Apps postimages must be committed and ordinarily published before apply. Recreate adds no resource requests or overlapping Forgejo application pod; the recorded 90-percent CPU allocation does not establish runtime latency or outage guarantees. Limits and execution conditions: this owner judgement is not human approval or native acceptance. Exact resolved founder authority, matching recorded supervision revision/digest and independent Apps approval remain required by admission. A live run must retain its fresh preflight, readiness, both executable custody checks, full hook metadata, installed/mounted/inherited hook checks, real receive-pack clean/blocked/unavailable/cleanup results and ordinary publication/projection readback before T20 closes. The isolated receive probe intentionally excludes built-in Forgejo authorization; native Git-init inheritance is not production API repository creation. The existing uncovered repository remains outside the claim. Rollback may cause a second restart and intentionally retains inert public artifacts; its separate same-session Apps source inverse must restore only exact postimages to sealed preimages and publish normally. Source publication failure or unknown drift leaves work open for owner-led recovery rather than a success claim. Availability loss and human recovery effort remain unpriced. No live state, sealed inputs, approval fields, or existing Forge WORK-RECORDS.md changes were modified by this review." + }, + "railiance-apps": { + "reviewer": "railiance-apps-owner (agent railiance-apps, codex)", + "decision": "approved", + "proposal_sha256": "sha256:90bb3a1a35729396b02a377d8db62e1d1f8f38d8e24e601dbc3d4446cffd05e8", + "work_item_id": "RAPPS-WP-0016-T02", + "comment": "Independent Apps owner review performed from /home/worsch/railiance-apps at HEAD ab3cf5cdc56d085d040256e2e84633b0289ab0af after reading its AGENTS.md, INTENT.md and existing RAPPS-WP-0016 tasks; existing release/deploy/recovery task RAPPS-WP-0016-T02 is the review work item, with no duplicate backlog. INTENT basis: Mission source-controlled application release contracts and repeatable deploy/verify/recover operations; Core Principles 1 Workloads, Not Runtime, 2 Release Contracts over Source Internals, 3 Repeatable Operations, 4 Clear Lower-Layer Handoffs, 5 Evidence Before Confidence and 6 App Workloads, Forge Consumers. Reviewed FORGE10-RECEIVE-BATCH-20261018 revision 1, exact proposal digest sha256:90bb3a1a35729396b02a377d8db62e1d1f8f38d8e24e601dbc3d4446cffd05e8, packet README, both sealed Apps preimages/postimages, executor/helpers, tests and receipts. No blocking Apps finding. Independently verified every proposal input hash, current worktree and HEAD preimage hashes, semantic equality outside the two values fields, original live guard parity, immutable ConfigMap source/JSON parity, 166 scanner fragments and 1328 protected hook metadata records. The combined old/new guard preserves existing hooks across fsGroup processing, pins both executable hashes and the unchanged Gitleaks provider, and refuses symlinks, unexpected modes or content drift. The live change tests Deployment UID/resourceVersion/current fields and replaces only the guard command and ConfigMap reference while retaining one replica, Recreate, the existing image/mounts/resources and zero added requests. It never replays stale July Helm revision 9. The bounded recovery can inverse the two fields without a ready new application, waits for original readiness, restores only known old/new hook fragments to the sealed old bytes/modes, verifies all other hook metadata and retains inert public artifacts. Apps source inverse must then restore only exact postimages to their sealed preimages and publish normally. Unknown drift requires review rather than overwrite. Independently reran python3 -B test_rollout.py -v from the Apps checkout: all 9 methods pass, no skips. Reviewed the 16 passing isolated filesystem scenarios, original failed fixture attempts, server dry-run/preflight receipts and native move compatibility evidence; these are preparation evidence, not native acceptance. Native stage/probe, readiness/startup status, mounted and inherited template, real clean/intermediate-secret/unavailable/quarantine/recovery probes, cleanup, full inventory and ordinary publication/readback remain execution acceptance conditions. Admission must still verify the exact recorded supervision revision/digest, resolved human decision and separate Forge review. This entry supplies only Apps owner judgement, not founder approval, supervision promotion or execution authority. Reviewed normal file-scoped publication helper: commit only the two declared files, enforce guarded base/remote and exact postimage hashes, preserve existing unrelated staged/worktree brief, then ordinary consistency/projection with primary railiance01 and remote readback; apply refuses uncommitted/unpublished declarations. Historical consistency receipt still reports unpushed/projection work, so T20 cannot close on the local checkpoint or this review. The one uncovered repository stays explicitly outside the migration. Residual operational risk is the acknowledged Recreate interruption and possible second restart on rollback at 90% CPU requests; recovery may refuse unrelated drift and require owner intervention. No secrets, policy, image, database, source extension or lower-layer runtime change is admitted. The Apps staged .custodian-brief.md remained byte/index exact (worktree SHA256 07f96d4120b25a046a5a82a89d2d1d1c77cad380a80772a6fc0d024da2f0c4d4; index blob 1f9b6fae4362945f96aa9a2a9647be9c83d8296a). No Apps source or native object was changed during this review." + } +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/owner-reviews/railiance-apps.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/owner-reviews/railiance-apps.json new file mode 100644 index 0000000..82d0efc --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/owner-reviews/railiance-apps.json @@ -0,0 +1,7 @@ +{ + "reviewer": "railiance-apps-owner (agent railiance-apps, codex)", + "decision": "approved", + "proposal_sha256": "sha256:90bb3a1a35729396b02a377d8db62e1d1f8f38d8e24e601dbc3d4446cffd05e8", + "work_item_id": "RAPPS-WP-0016-T02", + "comment": "Independent Apps owner review performed from /home/worsch/railiance-apps at HEAD ab3cf5cdc56d085d040256e2e84633b0289ab0af after reading its AGENTS.md, INTENT.md and existing RAPPS-WP-0016 tasks; existing release/deploy/recovery task RAPPS-WP-0016-T02 is the review work item, with no duplicate backlog. INTENT basis: Mission source-controlled application release contracts and repeatable deploy/verify/recover operations; Core Principles 1 Workloads, Not Runtime, 2 Release Contracts over Source Internals, 3 Repeatable Operations, 4 Clear Lower-Layer Handoffs, 5 Evidence Before Confidence and 6 App Workloads, Forge Consumers. Reviewed FORGE10-RECEIVE-BATCH-20261018 revision 1, exact proposal digest sha256:90bb3a1a35729396b02a377d8db62e1d1f8f38d8e24e601dbc3d4446cffd05e8, packet README, both sealed Apps preimages/postimages, executor/helpers, tests and receipts. No blocking Apps finding. Independently verified every proposal input hash, current worktree and HEAD preimage hashes, semantic equality outside the two values fields, original live guard parity, immutable ConfigMap source/JSON parity, 166 scanner fragments and 1328 protected hook metadata records. The combined old/new guard preserves existing hooks across fsGroup processing, pins both executable hashes and the unchanged Gitleaks provider, and refuses symlinks, unexpected modes or content drift. The live change tests Deployment UID/resourceVersion/current fields and replaces only the guard command and ConfigMap reference while retaining one replica, Recreate, the existing image/mounts/resources and zero added requests. It never replays stale July Helm revision 9. The bounded recovery can inverse the two fields without a ready new application, waits for original readiness, restores only known old/new hook fragments to the sealed old bytes/modes, verifies all other hook metadata and retains inert public artifacts. Apps source inverse must then restore only exact postimages to their sealed preimages and publish normally. Unknown drift requires review rather than overwrite. Independently reran python3 -B test_rollout.py -v from the Apps checkout: all 9 methods pass, no skips. Reviewed the 16 passing isolated filesystem scenarios, original failed fixture attempts, server dry-run/preflight receipts and native move compatibility evidence; these are preparation evidence, not native acceptance. Native stage/probe, readiness/startup status, mounted and inherited template, real clean/intermediate-secret/unavailable/quarantine/recovery probes, cleanup, full inventory and ordinary publication/readback remain execution acceptance conditions. Admission must still verify the exact recorded supervision revision/digest, resolved human decision and separate Forge review. This entry supplies only Apps owner judgement, not founder approval, supervision promotion or execution authority. Reviewed normal file-scoped publication helper: commit only the two declared files, enforce guarded base/remote and exact postimage hashes, preserve existing unrelated staged/worktree brief, then ordinary consistency/projection with primary railiance01 and remote readback; apply refuses uncommitted/unpublished declarations. Historical consistency receipt still reports unpushed/projection work, so T20 cannot close on the local checkpoint or this review. The one uncovered repository stays explicitly outside the migration. Residual operational risk is the acknowledged Recreate interruption and possible second restart on rollback at 90% CPU requests; recovery may refuse unrelated drift and require owner intervention. No secrets, policy, image, database, source extension or lower-layer runtime change is admitted. The Apps staged .custodian-brief.md remained byte/index exact (worktree SHA256 07f96d4120b25a046a5a82a89d2d1d1c77cad380a80772a6fc0d024da2f0c4d4; index blob 1f9b6fae4362945f96aa9a2a9647be9c83d8296a). No Apps source or native object was changed during this review." +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/owner-reviews/railiance-forge.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/owner-reviews/railiance-forge.json new file mode 100644 index 0000000..488afba --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/owner-reviews/railiance-forge.json @@ -0,0 +1,7 @@ +{ + "reviewer": "railiance-forge-owner (agent railiance-forge, codex)", + "decision": "approved", + "proposal_sha256": "sha256:90bb3a1a35729396b02a377d8db62e1d1f8f38d8e24e601dbc3d4446cffd05e8", + "work_item_id": "FORGE-WP-0010-T02", + "comment": "Independent Forge owner review, conducted from /home/worsch/railiance-forge with its AGENTS.md and INTENT.md loaded, under FORGE-WP-0010-T02. Reviewed FORGE10-RECEIVE-BATCH-20261018 revision 1, exact proposal SHA256 90bb3a1a35729396b02a377d8db62e1d1f8f38d8e24e601dbc3d4446cffd05e8, including the sealed controller, shell scripts, source images, recovery path, tests and retained receipts. Forge INTENT basis: Mission and Core Principles 1 (Forge Runtime), 2 (Artifacts With Evidence), 4 (Stable Handoffs), 5 (Restore Before Trust), and 6 (Forgejo Is the Current Forge). This is a bounded correction to Forge-owned receive infrastructure and its operating evidence; the Apps source declaration remains an independent Apps-owner boundary. No blocking Forge defect found in the reviewed scope. Independently matched every proposal input hash, all three Forge implementation hashes at published HEAD ea65606c1298db782f721f9443bafeb03cdef138, the candidate executable digest 73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a, and the 166 scanner-fragment/1328 protected-hook denominator; independently reran all nine offline controller tests successfully. Inspected batching and volatile-storage custody: at most 64 small inputs of at most 4096 bytes, pinned Gitleaks 8.30.1/default rules without repository suppression, strict diagnostic/report validation, original larger-input path, unchanged traversal/ref/object/byte/deadline limits, private checked tmpfs input storage, parent-bound cleanup and child termination. Read the 54-case source proof and 16-scenario filesystem receipt; these include boundary detection, scanner/storage failure, receiver loss, partial hook recovery and quarantine discard. The retained exact 278-object clean delta result (58.18 seconds under the existing 90-second budget) supports the availability correction without relaxing refusal. Deployment changes are conditional on exact UID/resourceVersion, original full template and reviewed field preimages; only the startup command and immutable template ConfigMap reference change. The combined guard verifies and repairs executable modes for both versions across the migration. Hook replacement validates the complete declared scope before writing, uses atomic replacements, and verifies protected metadata; recovery restores known old/new scanner fragments and exact original Deployment fields while refusing unknown drift. The lost patch-response branch attempts guarded rollback and retains the failed/unverified activation. Apps postimages must be committed and ordinarily published before apply. Recreate adds no resource requests or overlapping Forgejo application pod; the recorded 90-percent CPU allocation does not establish runtime latency or outage guarantees. Limits and execution conditions: this owner judgement is not human approval or native acceptance. Exact resolved founder authority, matching recorded supervision revision/digest and independent Apps approval remain required by admission. A live run must retain its fresh preflight, readiness, both executable custody checks, full hook metadata, installed/mounted/inherited hook checks, real receive-pack clean/blocked/unavailable/cleanup results and ordinary publication/projection readback before T20 closes. The isolated receive probe intentionally excludes built-in Forgejo authorization; native Git-init inheritance is not production API repository creation. The existing uncovered repository remains outside the claim. Rollback may cause a second restart and intentionally retains inert public artifacts; its separate same-session Apps source inverse must restore only exact postimages to sealed preimages and publish normally. Source publication failure or unknown drift leaves work open for owner-led recovery rather than a success claim. Availability loss and human recovery effort remain unpriced. No live state, sealed inputs, approval fields, or existing Forge WORK-RECORDS.md changes were modified by this review." +}