31 lines
3 KiB
JSON
31 lines
3 KiB
JSON
{
|
|
"proposal_id": "FORGE6-RUNNER-LOOPBACK-001",
|
|
"revision": 2,
|
|
"deployment_uid": "89c8a056-bcae-4940-acdd-2eb2768e108a",
|
|
"original_template_digest": "e9dbbea8192bbf805f4f5838db844d40ac9d3c331739952fd3df412cce09bcca",
|
|
"candidate_template_digest": "1ded8e6fc18d5911bf95d518e19a43cf855802e77582ae04e624fd589937e130",
|
|
"images": {
|
|
"dind": "docker.io/library/docker@sha256:aa3df78ecf320f5fafdce71c659f1629e96e9de0968305fe1de670e0ca9176ce",
|
|
"runner": "code.forgejo.org/forgejo/runner@sha256:5071e6832313bafe71577e05631bece88caff08fcfb372193e4a21941f4ed54b"
|
|
},
|
|
"source_sha256": {
|
|
"close_runner_docker_listener.py": "3763a4f90ed964aad1bf5fc580318d891501dc6d908de8554a2cd7d35854e3e4",
|
|
"verify_receive_native.py": "c9120122c6f6f0b7c41fe4fa975e5a2a340e776885d852b861b8c13b7664adcd"
|
|
},
|
|
"authorization_ref": "canon/standards/build-mode-change-authorization_v0.1.md",
|
|
"target": "forgejo/Deployment forgejo-runner only; existing Docker and runner binaries pinned by digest",
|
|
"expected_result": "Runner remains Ready with same image bytes and loopback Docker ping; actual Docker listener is 127.0.0.1 only and a separate Forgejo pod cannot reach it. No running or queued tasks at apply. No replica, resource-request, credential or policy expansion.",
|
|
"diff_ref": "railiance-apps/manifests/forgejo-runner.yaml; exact conditional template patch and server dry-run",
|
|
"rollback": "Run same executor --rollback with this proposal, ignored original-template.json baseline and a new receipt, only against exact candidate template/UID. Restores original listener and image references; records restored exposure. No automatic rollback on a security-probe failure; abort owner reviews live state.",
|
|
"abort_owner": "railiance-forge, source owner railiance-apps; custodian-codex executes",
|
|
"cost_estimate_eur": 0,
|
|
"risk_estimate": "Brief runner unavailability during existing Recreate rollout and cold ephemeral Docker cache. Abort if running/queued work appears before apply. An external Docker consumer using the pod IP loses access; the declared runner uses loopback. A concurrent newly scheduled job remains a race; preserve any nonterminal outcome. Original private template retained for exact guarded rollback. No new resources/spend or data deletion requested.",
|
|
"scope_limit": "Reduces unauthenticated cross-pod Docker authority only. Host-mode jobs still share the privileged runner boundary; no full CI isolation, workflow authority, required-check or secret detection conformance inferred.",
|
|
"baseline_path": ".private-backups/forge-runner-listener-20261013/original-template.json",
|
|
"original_revision_sha256": "a2d29132c639f76bed0465a30119148d207f9242c29a2229a2e90cfc5a6aecac",
|
|
"original_listener_addresses_hex": [
|
|
"00000000000000000000000000000000:0947"
|
|
],
|
|
"preparation_refinement": "Read-only preflight showed Docker wildcard binding in /proc/net/tcp6, so rollback verification binds the observed original listener instead of assuming an IPv4-only socket. No live mutation in revision 1.",
|
|
"source_commit": "railiance-apps@706461b"
|
|
}
|