468 lines
17 KiB
JSON
468 lines
17 KiB
JSON
{
|
|
"observed_at": "2026-09-08T20:52:36.518131+00:00",
|
|
"scope": "Published local runtime installation and attended custody capability preflight; factory admission remains open",
|
|
"runtime": {
|
|
"date": "2026-09-08",
|
|
"scope": "local owner artifact installation; not Railiance admission",
|
|
"host": "bnt-lap001",
|
|
"owner_uid": 1000,
|
|
"store_mode": "0700",
|
|
"runtime_path": "/home/worsch/.local/share/sandboxer/runtimes/5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922",
|
|
"runtime_sha256": "5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922",
|
|
"binary_version": "2.1.263",
|
|
"binary_sha256": "26d020351e8112f4006790f3cfce43b4c9df0c1bb1d0e542364d64151b81d5ba",
|
|
"candidate_rebuilt": false,
|
|
"installed_entries": 358,
|
|
"installed_regular_bytes": 245176062,
|
|
"root_owned": false,
|
|
"smoke": {
|
|
"ok": true,
|
|
"sandbox_id": "51b59587",
|
|
"rein_cli_started": true,
|
|
"adapter_imported": true,
|
|
"claude_version": "2.1.263 (Claude Code)",
|
|
"runtime_readonly": true,
|
|
"source_absent": true,
|
|
"home_outside_workspace": true,
|
|
"home_mode": "0700",
|
|
"worktree_clean": true,
|
|
"interfaces": [
|
|
"lo"
|
|
],
|
|
"python_prefix": "/opt/sandboxer/runtime",
|
|
"https_proxy_present": true,
|
|
"credential_refs": [],
|
|
"private_state_persisted": true,
|
|
"workspace_removed": true,
|
|
"proxy_removed": true,
|
|
"exit_code": 0
|
|
},
|
|
"model_run_proven": false,
|
|
"profile_activated": false,
|
|
"credential_delivery_configured": false
|
|
},
|
|
"runtime_validation": {
|
|
"source_commit": "df5e941",
|
|
"make_check": {
|
|
"tests_passed": 188,
|
|
"ruff": "passed"
|
|
},
|
|
"installed_path_smoke": "passed"
|
|
},
|
|
"custody_preflight": {
|
|
"observed_at": "2026-09-08T20:36:47.042499+00:00",
|
|
"requests": [
|
|
"CCR-2026-0017",
|
|
"CCR-2026-0018"
|
|
],
|
|
"operation": "capabilities-self only",
|
|
"credential_data_read": false,
|
|
"metadata_applied": false,
|
|
"custody_activated": false,
|
|
"upstream_issuer_proven": false,
|
|
"status": "observed",
|
|
"capabilities": {
|
|
"sys/policies/acl/workload-kv-read-keycape-secrets-engine-approval": [
|
|
"create",
|
|
"delete",
|
|
"list",
|
|
"read",
|
|
"sudo",
|
|
"update"
|
|
],
|
|
"sys/policies/acl/workload-kv-read-keycape-approval-engine-operator": [
|
|
"create",
|
|
"delete",
|
|
"list",
|
|
"read",
|
|
"sudo",
|
|
"update"
|
|
],
|
|
"auth/kubernetes/role/external-secrets-keycape-secrets-engine-approval": [
|
|
"create",
|
|
"delete",
|
|
"list",
|
|
"read",
|
|
"sudo",
|
|
"update"
|
|
],
|
|
"auth/kubernetes/role/external-secrets-keycape-approval-engine-operator": [
|
|
"create",
|
|
"delete",
|
|
"list",
|
|
"read",
|
|
"sudo",
|
|
"update"
|
|
],
|
|
"platform/data/workloads/secrets-engine/approval-client": [
|
|
"create",
|
|
"delete",
|
|
"list",
|
|
"read",
|
|
"update"
|
|
],
|
|
"platform/data/workloads/approval-engine/operator-client": [
|
|
"create",
|
|
"delete",
|
|
"list",
|
|
"read",
|
|
"update"
|
|
]
|
|
},
|
|
"required_metadata_capabilities_present": true,
|
|
"paths_verified": 6,
|
|
"login_lane": "openbao-platform-admin-login",
|
|
"launcher": "scripts/openbao-attended-exec.py",
|
|
"command": "scripts/keycape-approval-custody-preflight.py --receipt <new-private-file>",
|
|
"wrapper_exit": 0,
|
|
"session_self_revoked": true,
|
|
"helper_root_removed": true,
|
|
"attempt_notes": [
|
|
{
|
|
"attempt": 1,
|
|
"result": "direct launcher unavailable; no child handoff; revocation unconfirmed",
|
|
"credential_data_read": false
|
|
},
|
|
{
|
|
"attempt": 2,
|
|
"result": "owner wrapper login/self-revocation succeeded; capability command rejected unsupported multiple-path syntax",
|
|
"credential_data_read": false
|
|
},
|
|
{
|
|
"attempt": 3,
|
|
"result": "six single-path capability queries succeeded; session self-revoked and helper removed",
|
|
"credential_data_read": false
|
|
}
|
|
]
|
|
},
|
|
"projection_receipts": [
|
|
{
|
|
"repo": "sand-boxer",
|
|
"commit": "3e49a98a0e2c4a64539a5ccd674be8cd67ac9845",
|
|
"status": "applied",
|
|
"instance_role": "primary",
|
|
"instance_label": "railiance01",
|
|
"derived_commit": "3e49a98a0e2c4a64539a5ccd674be8cd67ac9845",
|
|
"outcome": "applied",
|
|
"refused": []
|
|
},
|
|
{
|
|
"repo": "glas-harness",
|
|
"commit": "44991600f377fa7b2bb380d4f4f255c33c480369",
|
|
"status": "applied",
|
|
"instance_role": "primary",
|
|
"instance_label": "railiance01",
|
|
"derived_commit": "44991600f377fa7b2bb380d4f4f255c33c480369",
|
|
"outcome": "applied",
|
|
"refused": []
|
|
},
|
|
{
|
|
"repo": "prj-helixforge-factory",
|
|
"commit": "044c52075c360adaef8327d7a1d8639c7435526e",
|
|
"status": "applied",
|
|
"instance_role": "primary",
|
|
"instance_label": "railiance01",
|
|
"derived_commit": "044c52075c360adaef8327d7a1d8639c7435526e",
|
|
"outcome": "applied",
|
|
"refused": []
|
|
},
|
|
{
|
|
"repo": "railiance-platform",
|
|
"commit": "a94d06dbcf0c4991d07eb69523c05a713acd59c2",
|
|
"status": "applied",
|
|
"instance_role": "primary",
|
|
"instance_label": "railiance01",
|
|
"derived_commit": "a94d06dbcf0c4991d07eb69523c05a713acd59c2",
|
|
"outcome": "applied",
|
|
"refused": []
|
|
}
|
|
],
|
|
"final_source_projection": {
|
|
"task_readbacks": [
|
|
{
|
|
"source_id": "HFACT-WP-0001-T01",
|
|
"uuid": "5cee3251-faf9-5925-8ffd-7a8bf378b0a4",
|
|
"source_fields": {
|
|
"status": "wait",
|
|
"assignee": "the-custodian",
|
|
"blocking_reason": "Project published and registered; both product PR receipts finalized. Exact unattended actor/project/profile, grants, operating owners and enforceable spend contract still require the G0 admission packet.",
|
|
"needs_human": false
|
|
},
|
|
"repaired_fields": [],
|
|
"verified": true
|
|
},
|
|
{
|
|
"source_id": "HFACT-WP-0001-T02",
|
|
"uuid": "3a3a967d-5bec-52ee-be20-dc94524b8e85",
|
|
"source_fields": {
|
|
"status": "progress",
|
|
"assignee": "the-custodian"
|
|
},
|
|
"repaired_fields": [],
|
|
"verified": true
|
|
},
|
|
{
|
|
"source_id": "HFACT-WP-0001-T03",
|
|
"uuid": "67c80db1-01ba-54f1-80ff-76398f9e7823",
|
|
"source_fields": {
|
|
"status": "wait",
|
|
"assignee": "the-custodian",
|
|
"blocking_reason": "Corrected verifier image and exact audit scope published; attended first-provision capabilities proved on six paths. Await actual upstream issuer proof, RPF-WP-0035-T05/CCR-2026-0017/0018 activation, separate client-side/audit custody and live approval/native delivery; WARDEN-WP-0039-T03 retains explicit credential-policy binding refusal."
|
|
},
|
|
"repaired_fields": [],
|
|
"verified": true
|
|
},
|
|
{
|
|
"source_id": "HFACT-WP-0001-T04",
|
|
"uuid": "1054b135-f367-57b1-9308-72a1fbb38f62",
|
|
"source_fields": {
|
|
"status": "wait",
|
|
"assignee": "the-custodian",
|
|
"blocking_reason": "Local protected artifact installation and installed-path startup proved by SAND-WP-0015-T06. Await trusted owner configuration, T03 native credentials, real-model acceptance and Railiance-specific placement."
|
|
},
|
|
"repaired_fields": [],
|
|
"verified": true
|
|
},
|
|
{
|
|
"source_id": "HFACT-WP-0001-T05",
|
|
"uuid": "2b171ebd-75f3-5ce2-85a9-98e8ab77fd19",
|
|
"source_fields": {
|
|
"status": "wait",
|
|
"assignee": "the-custodian",
|
|
"blocking_reason": "Await actionable admission records, owner credential chain and accepted profile/placement from T02-T04."
|
|
},
|
|
"repaired_fields": [],
|
|
"verified": true
|
|
},
|
|
{
|
|
"source_id": "HFACT-WP-0001-T06",
|
|
"uuid": "4d72717a-d5c9-571d-987b-9373f01253fa",
|
|
"source_fields": {
|
|
"status": "wait",
|
|
"assignee": "the-custodian",
|
|
"blocking_reason": "Await the current governed Railiance worker proof in T05."
|
|
},
|
|
"repaired_fields": [],
|
|
"verified": true
|
|
},
|
|
{
|
|
"source_id": "HFACT-WP-0001-T07",
|
|
"uuid": "a815d9b3-b03e-5764-95c2-fa1a2940611a",
|
|
"source_fields": {
|
|
"status": "wait",
|
|
"assignee": "the-custodian",
|
|
"blocking_reason": "Recovery matrix and measurement ledger are prepared; final live recovery proof requires the deployed T05/T06 configuration."
|
|
},
|
|
"repaired_fields": [],
|
|
"verified": true
|
|
},
|
|
{
|
|
"source_id": "HFACT-WP-0001-T08",
|
|
"uuid": "59cfddfb-7cd6-5103-9444-8764e9d51678",
|
|
"source_fields": {
|
|
"status": "wait",
|
|
"assignee": "the-custodian",
|
|
"blocking_reason": "Await useful delivery and operational controls from T06/T07, then the complete fourteen-day observation window."
|
|
},
|
|
"repaired_fields": [],
|
|
"verified": true
|
|
},
|
|
{
|
|
"source_id": "SAND-WP-0015-T06",
|
|
"uuid": "f85f54c9-1081-5d0c-95ad-aca20ede8d66",
|
|
"status": "done",
|
|
"verified": true
|
|
},
|
|
{
|
|
"source_id": "RPF-WP-0035-T05",
|
|
"uuid": "e15d62c9-e5da-5721-a135-87c050f7851c",
|
|
"status": "wait",
|
|
"verified": true
|
|
}
|
|
],
|
|
"project_topic_verified": true,
|
|
"repositories": [
|
|
{
|
|
"repo": "sand-boxer",
|
|
"commit": "3e49a98a0e2c4a64539a5ccd674be8cd67ac9845",
|
|
"remote_main": "3e49a98a0e2c4a64539a5ccd674be8cd67ac9845",
|
|
"published": true,
|
|
"clean": true,
|
|
"dirty_paths": []
|
|
},
|
|
{
|
|
"repo": "glas-harness",
|
|
"commit": "44991600f377fa7b2bb380d4f4f255c33c480369",
|
|
"remote_main": "44991600f377fa7b2bb380d4f4f255c33c480369",
|
|
"published": true,
|
|
"clean": true,
|
|
"dirty_paths": []
|
|
},
|
|
{
|
|
"repo": "railiance-platform",
|
|
"commit": "a94d06dbcf0c4991d07eb69523c05a713acd59c2",
|
|
"remote_main": "a94d06dbcf0c4991d07eb69523c05a713acd59c2",
|
|
"published": true,
|
|
"clean": true,
|
|
"dirty_paths": []
|
|
},
|
|
{
|
|
"repo": "prj-helixforge-factory",
|
|
"commit": "044c52075c360adaef8327d7a1d8639c7435526e",
|
|
"remote_main": "044c52075c360adaef8327d7a1d8639c7435526e",
|
|
"published": true,
|
|
"clean": true,
|
|
"dirty_paths": []
|
|
},
|
|
{
|
|
"repo": "ops-warden",
|
|
"commit": "3a01b8f1b50d5f20cbbbfca1aaec619f95cacf2c",
|
|
"remote_main": "3a01b8f1b50d5f20cbbbfca1aaec619f95cacf2c",
|
|
"published": true,
|
|
"clean": true,
|
|
"dirty_paths": []
|
|
},
|
|
{
|
|
"repo": "key-cape",
|
|
"commit": "5c7db26b7cb128141b4d6cd8de020a44036dba05",
|
|
"remote_main": "5c7db26b7cb128141b4d6cd8de020a44036dba05",
|
|
"published": true,
|
|
"clean": true,
|
|
"dirty_paths": []
|
|
},
|
|
{
|
|
"repo": "approval-engine",
|
|
"commit": "b46b0f26669dc83c944ee5145426bad03d5ef720",
|
|
"remote_main": "b46b0f26669dc83c944ee5145426bad03d5ef720",
|
|
"published": true,
|
|
"clean": true,
|
|
"dirty_paths": []
|
|
},
|
|
{
|
|
"repo": "audit-core",
|
|
"commit": "565e7e38d486ca2fe2fc15f93e32617c2fb89992",
|
|
"remote_main": "565e7e38d486ca2fe2fc15f93e32617c2fb89992",
|
|
"published": true,
|
|
"clean": true,
|
|
"dirty_paths": []
|
|
},
|
|
{
|
|
"repo": "net-kingdom",
|
|
"commit": "46455439cfbb24fc5d187403c8f9f4465fccc274",
|
|
"remote_main": "46455439cfbb24fc5d187403c8f9f4465fccc274",
|
|
"published": true,
|
|
"clean": true,
|
|
"dirty_paths": []
|
|
}
|
|
]
|
|
},
|
|
"consistency_checks": {
|
|
"sand-boxer": {
|
|
"summary": {
|
|
"fail": 0,
|
|
"automation_error": 0,
|
|
"warn": 13,
|
|
"info": 0
|
|
},
|
|
"result": "warn",
|
|
"fixes_applied": [
|
|
"bindings: synced 15/15",
|
|
"C-33 fixed: regenerated WORK-RECORDS.md",
|
|
"C-22 fixed: task a95755fb\u2026 description updated",
|
|
"C-22 fixed: task 3a1bb3e1\u2026 description updated",
|
|
"C-22 fixed: task 435a3993\u2026 description updated",
|
|
"C-22 fixed: task 0683b09a\u2026 description updated",
|
|
"C-22 fixed: task 3aebb3be\u2026 description updated",
|
|
"C-22 fixed: task 849e0701\u2026 description updated",
|
|
"C-22 fixed: task 2378cd6a\u2026 description updated",
|
|
"C-11 fixed: task 'SAND-WP-0015-T06' \u2192 f85f54c9\u2026",
|
|
"brief: .custodian-brief.md updated",
|
|
"push: pushed"
|
|
]
|
|
},
|
|
"glas-harness": {
|
|
"summary": {
|
|
"fail": 0,
|
|
"automation_error": 0,
|
|
"warn": 1,
|
|
"info": 0
|
|
},
|
|
"result": "warn",
|
|
"fixes_applied": [
|
|
"bindings: synced 16/16",
|
|
"brief: .custodian-brief.md updated",
|
|
"push: pushed"
|
|
]
|
|
},
|
|
"prj-helixforge-factory": {
|
|
"summary": {
|
|
"fail": 0,
|
|
"automation_error": 0,
|
|
"warn": 2,
|
|
"info": 0
|
|
},
|
|
"result": "warn",
|
|
"fixes_applied": [
|
|
"bindings: synced 1/1",
|
|
"C-22 fixed: task 67c80db1\u2026 description updated",
|
|
"brief: .custodian-brief.md updated",
|
|
"push: pushed"
|
|
]
|
|
}
|
|
},
|
|
"progress_receipts": [
|
|
{
|
|
"id": "41e32b8e-2166-487e-b043-542ab6e3b30d",
|
|
"workplan_id": "975db491-5412-5e27-8e34-14a2417bb039",
|
|
"task_id": "e15d62c9-e5da-5721-a135-87c050f7851c",
|
|
"summary": "Published railiance-platform a94d06d: native attended OpenBao capability-only preflight confirms create/update on all six CCR-2026-0017/0018 policy/role/data paths. Successful session self-revoked and helper removed. First failed direct-launcher attempt retains unconfirmed revocation. No credential data read or custody/production mutation. RPF-WP-0035-T05 remains wait for actual upstream issuer proof and named CCR reviews before activation.",
|
|
"http_status": 201
|
|
},
|
|
{
|
|
"id": "f51deb9d-91d3-4fbb-99f8-be1ca431bfb8",
|
|
"workplan_id": "ed4fe524-036f-5221-8deb-00e24e944de1",
|
|
"task_id": "1054b135-f367-57b1-9308-72a1fbb38f62",
|
|
"summary": "Accepted SAND-WP-0015-T06 local protected installation return: sand-boxer 3e49a98, 188 tests and Ruff passed, installed-path startup/isolation/private-state/teardown smoke succeeded on bnt-lap001; Glas 4499160 consumes receipt. HFACT-WP-0001-T04 remains wait for trusted execution configuration, native credential/model acceptance and Railiance placement. No profile or model run activated.",
|
|
"http_status": 201
|
|
},
|
|
{
|
|
"id": "e6acc585-d4dd-4b87-b945-83918af7b350",
|
|
"workplan_id": "ed4fe524-036f-5221-8deb-00e24e944de1",
|
|
"task_id": "67c80db1-01ba-54f1-80ff-76398f9e7823",
|
|
"summary": "Accepted RPF-WP-0035-T05 capability preflight return from platform a94d06d. Updated the thirteen-source dependency view and admission sequence: native first-provision authority availability is proved; actual upstream issuer proof and named CCR-2026-0017/0018 reviews remain before custody activation. Separate client-side/audit custody and live approval/native delivery remain open; G0-G5 not passed, no paid execution.",
|
|
"http_status": 201
|
|
},
|
|
{
|
|
"id": "a08406b1-2a84-4242-a212-9bfebe7600db",
|
|
"workplan_id": null,
|
|
"task_id": null,
|
|
"summary": "Custodian factory critical-path continuation: published protected local runtime installation (SAND-WP-0015-T06 done), 188 checks plus installed-path smoke; proved native attended OpenBao capabilities for CCR-2026-0017/0018 without secret data or custody mutation. Returned evidence through GLAS-WP-0012-T02, RPF-WP-0035-T05 and HFACT-WP-0001-T03/T04; existing owner records retain all residuals. Two concrete setup uncertainties resolved, throughput/time saved unmeasured; first failed launcher attempt retains unconfirmed revocation. Next: actual upstream issuer proof and named custody reviews, then activation/rollout.",
|
|
"http_status": 201
|
|
}
|
|
],
|
|
"earlier_owner_progress_ids": [
|
|
"5cc0a533-ecb8-49af-8007-f3d5f4d502b7",
|
|
"9048f258-269e-439a-b632-c47a97faba4d"
|
|
],
|
|
"platform_generated_changes_preserved": {
|
|
"files": [
|
|
"WORK-RECORDS.md",
|
|
"workplans/RPF-WP-0035-credential-lane-implementation.md"
|
|
],
|
|
"published_commit": "a94d06dbcf0c4991d07eb69523c05a713acd59c2",
|
|
"recovery_stash_retained": true
|
|
},
|
|
"remaining_gates": [
|
|
"Actual signed upstream ID-token issuer proof",
|
|
"Named CCR-2026-0017/0018 reviews before custody activation and compatible KeyCape rollout",
|
|
"Separate client-side and audit credential admission; live approval/native delivery",
|
|
"Trusted execution configuration, real-model acceptance and Railiance placement",
|
|
"Exact unattended factory actor/project/profile/grants and enforceable currency/time limits",
|
|
"Natural worker trace, useful governed delivery, recovery and fourteen-day observation"
|
|
],
|
|
"factory_gates_passed": [],
|
|
"paid_model_execution_performed": false,
|
|
"custody_activated": false,
|
|
"production_deployed": false,
|
|
"efficiency_claim": "Two concrete setup uncertainties resolved; no measured throughput or time saving claimed"
|
|
}
|