431 lines
16 KiB
JSON
431 lines
16 KiB
JSON
{
|
|
"schema": "custodian.factory-live-upstream-issuer-continuation.v1",
|
|
"recorded_at": "2026-09-08T22:15:16.787538+00:00",
|
|
"supersedes_preparation_state": "upstream-issuer-probe-continuation.json",
|
|
"owner_tasks": [
|
|
"KEY-WP-0013-T02",
|
|
"RPF-WP-0035-T05"
|
|
],
|
|
"project_task": "HFACT-WP-0001-T03",
|
|
"live_proof": {
|
|
"recorded_at": "2026-09-08T21:50:10.049099+00:00",
|
|
"authorization": {
|
|
"source": "User response in this session: yes, go on",
|
|
"scope": "Prepared ten-minute temporary issuer probe; existing config read in workload, exact-state callback and cleanup",
|
|
"custody_activation_authorized": false
|
|
},
|
|
"source": {
|
|
"repo": "key-cape",
|
|
"code_commit": "6f33abddcff6cbc348ced862057973cdcc4f78ec",
|
|
"published_owner_commit": "7ecc78f4100c04f9b4ea7751240114bcc485de03",
|
|
"packet": "docs/upstream-issuer-proof.md",
|
|
"image": "forgejo.coulomb.social/coulomb/key-cape@sha256:0c85ed377cae7ae6ca5b5c56b1a52930e706b3cb78009747e42f551e869a22e4"
|
|
},
|
|
"proof": {
|
|
"audience_verified": true,
|
|
"downstream_credential_issued": false,
|
|
"issuer": "https://auth.coulomb.social",
|
|
"nonce_verified": true,
|
|
"observed_at": "2026-09-08T21:44:44Z",
|
|
"schema": "keycape.upstream-issuer-proof.v1",
|
|
"signature_verified": true,
|
|
"status": "verified",
|
|
"tokens_retained": false,
|
|
"validity_window_verified": true
|
|
},
|
|
"job": {
|
|
"name": "keycape-issuer-proof-532da53dc96a",
|
|
"started_at": "2026-09-08T21:43:34.019545+00:00",
|
|
"created_resources": [
|
|
{
|
|
"kind": "Job",
|
|
"name": "keycape-issuer-proof-532da53dc96a",
|
|
"uid": "4e01daef-9184-4866-ac4d-9d61cd8d79ae"
|
|
},
|
|
{
|
|
"kind": "Service",
|
|
"name": "keycape-issuer-proof-532da53dc96a",
|
|
"uid": "3359ce09-cbe2-487b-b9d9-a4cc5c484047"
|
|
},
|
|
{
|
|
"kind": "NetworkPolicy",
|
|
"name": "keycape-issuer-proof-532da53dc96a",
|
|
"uid": "8940e5b4-3665-4395-8a0d-39b4b08ae12d"
|
|
},
|
|
{
|
|
"kind": "NetworkPolicy",
|
|
"name": "keycape-issuer-proof-532da53dc96a-authelia",
|
|
"uid": "13d72383-0864-4665-af28-eefc76452131"
|
|
},
|
|
{
|
|
"kind": "IngressRoute",
|
|
"name": "keycape-issuer-proof-532da53dc96a",
|
|
"uid": "7d705d80-f491-408f-a133-0bc4abd2c867"
|
|
}
|
|
]
|
|
},
|
|
"pod_evidence": [
|
|
{
|
|
"name": "keycape-issuer-proof-532da53dc96a-tgpxh",
|
|
"uid": "c9230c57-0fad-4dcf-b798-d586385db9a2",
|
|
"phase": "Succeeded",
|
|
"containers": [
|
|
{
|
|
"name": "probe",
|
|
"image": "sha256:204d8a4b04f47fa93c508b0a74c600e9954cfeab8e4e6566a8feaab327e8f793",
|
|
"imageID": "forgejo.coulomb.social/coulomb/key-cape@sha256:0c85ed377cae7ae6ca5b5c56b1a52930e706b3cb78009747e42f551e869a22e4",
|
|
"ready": false,
|
|
"state": {
|
|
"terminated": {
|
|
"exitCode": 0,
|
|
"finishedAt": "2026-09-08T21:44:44Z",
|
|
"reason": "Completed",
|
|
"startedAt": "2026-09-08T21:43:37Z"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"browser": {
|
|
"route_head_status": 405,
|
|
"launcher_exit": 0,
|
|
"url_scope": "exact generated HTTPS issuer-proof start path"
|
|
},
|
|
"cleanup": {
|
|
"completed_at": "2026-09-08T21:45:17.886281+00:00",
|
|
"removed": [
|
|
{
|
|
"kind": "IngressRoute",
|
|
"name": "keycape-issuer-proof-532da53dc96a",
|
|
"uid_precondition": true
|
|
},
|
|
{
|
|
"kind": "Job",
|
|
"name": "keycape-issuer-proof-532da53dc96a",
|
|
"uid_precondition": true
|
|
},
|
|
{
|
|
"kind": "Service",
|
|
"name": "keycape-issuer-proof-532da53dc96a",
|
|
"already_absent": true
|
|
},
|
|
{
|
|
"kind": "NetworkPolicy",
|
|
"name": "keycape-issuer-proof-532da53dc96a",
|
|
"already_absent": true
|
|
},
|
|
{
|
|
"kind": "NetworkPolicy",
|
|
"name": "keycape-issuer-proof-532da53dc96a-authelia",
|
|
"already_absent": true
|
|
}
|
|
],
|
|
"all_temporary_resources_absent": true,
|
|
"production_metadata_unchanged": true,
|
|
"before": {
|
|
"production_image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b",
|
|
"deployment": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f 55113259 29",
|
|
"secret": "2e94519d-1550-41c7-9701-2efe47fe1fd3 51346058"
|
|
},
|
|
"after": {
|
|
"production_image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b",
|
|
"deployment": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f 55113259 29",
|
|
"secret": "2e94519d-1550-41c7-9701-2efe47fe1fd3 51346058"
|
|
}
|
|
},
|
|
"config_issuer_pinned_by_this_run": false,
|
|
"custody_activated": false,
|
|
"normal_keycape_deployment_changed": false,
|
|
"downstream_mfa_or_application_login_proved": false,
|
|
"next_return": "Configuration owner ensures authelia.issuer equals the verified HTTPS issuer; named CCR reviews and attended custody/compatible image rollout remain open"
|
|
},
|
|
"projection_receipts": [
|
|
{
|
|
"repo": "key-cape",
|
|
"commit": "e30ba7b3c06112f49f85e79601a7e985885ba53c",
|
|
"status": "applied",
|
|
"instance_role": "primary",
|
|
"instance_label": "railiance01",
|
|
"derived_commit": "e30ba7b3c06112f49f85e79601a7e985885ba53c",
|
|
"outcome": "applied",
|
|
"counts": {
|
|
"created": 0,
|
|
"updated": 29,
|
|
"retired": 0,
|
|
"refused": 0,
|
|
"released": 0,
|
|
"created_tasks": 0,
|
|
"updated_tasks": 13,
|
|
"cancelled_tasks": 0
|
|
},
|
|
"refused": []
|
|
},
|
|
{
|
|
"repo": "railiance-platform",
|
|
"commit": "e06d7fc3903ec79579a104b511fd2ef224c8fefb",
|
|
"status": "applied",
|
|
"instance_role": "primary",
|
|
"instance_label": "railiance01",
|
|
"derived_commit": "e06d7fc3903ec79579a104b511fd2ef224c8fefb",
|
|
"outcome": "applied",
|
|
"counts": {
|
|
"created": 0,
|
|
"updated": 41,
|
|
"retired": 0,
|
|
"refused": 0,
|
|
"released": 0,
|
|
"created_tasks": 0,
|
|
"updated_tasks": 0,
|
|
"cancelled_tasks": 0
|
|
},
|
|
"refused": []
|
|
},
|
|
{
|
|
"repo": "prj-helixforge-factory",
|
|
"commit": "0a8a80cedf627dfdeb04d4737e119b7f4057b976",
|
|
"status": "applied",
|
|
"instance_role": "primary",
|
|
"instance_label": "railiance01",
|
|
"derived_commit": "0a8a80cedf627dfdeb04d4737e119b7f4057b976",
|
|
"outcome": "applied",
|
|
"counts": {
|
|
"created": 0,
|
|
"updated": 1,
|
|
"retired": 0,
|
|
"refused": 0,
|
|
"released": 0,
|
|
"created_tasks": 0,
|
|
"updated_tasks": 0,
|
|
"cancelled_tasks": 0
|
|
},
|
|
"refused": []
|
|
}
|
|
],
|
|
"consistency_checks": [
|
|
{
|
|
"repo": "key-cape",
|
|
"command": "statehub fix-consistency",
|
|
"summary": {
|
|
"fail": 0,
|
|
"automation_error": 0,
|
|
"warn": 14,
|
|
"info": 1
|
|
},
|
|
"result": "warn"
|
|
},
|
|
{
|
|
"repo": "prj-helixforge-factory",
|
|
"command": "statehub fix-consistency",
|
|
"summary": {
|
|
"fail": 0,
|
|
"automation_error": 0,
|
|
"warn": 3,
|
|
"info": 0
|
|
},
|
|
"result": "warn"
|
|
}
|
|
],
|
|
"final_readback": {
|
|
"recorded_at": "2026-09-08T22:14:28.496514+00:00",
|
|
"readbacks": [
|
|
{
|
|
"source_id": "RPF-WP-0035-T05",
|
|
"uuid": "e15d62c9-e5da-5721-a135-87c050f7851c",
|
|
"status": "wait",
|
|
"description_sha256": "ecf62d2324b14d5954546fc5dda757a8b2883695adf34787cb5672a6b88ecec0",
|
|
"description_repaired_from_source": true,
|
|
"repair_note": "Repaired in first closeout attempt before the KeyCape description assertion; verified again here.",
|
|
"verified": true
|
|
},
|
|
{
|
|
"source_id": "HFACT-WP-0001-T01",
|
|
"uuid": "5cee3251-faf9-5925-8ffd-7a8bf378b0a4",
|
|
"fields": {
|
|
"status": "wait",
|
|
"assignee": "the-custodian",
|
|
"needs_human": false,
|
|
"blocking_reason": "Project published and registered; both product PR receipts finalized. Exact unattended actor/project/profile, grants, operating owners and enforceable spend contract still require the G0 admission packet."
|
|
},
|
|
"repaired_fields": [],
|
|
"verified": true
|
|
},
|
|
{
|
|
"source_id": "HFACT-WP-0001-T02",
|
|
"uuid": "3a3a967d-5bec-52ee-be20-dc94524b8e85",
|
|
"fields": {
|
|
"status": "progress",
|
|
"assignee": "the-custodian"
|
|
},
|
|
"repaired_fields": [],
|
|
"verified": true
|
|
},
|
|
{
|
|
"source_id": "HFACT-WP-0001-T03",
|
|
"uuid": "67c80db1-01ba-54f1-80ff-76398f9e7823",
|
|
"fields": {
|
|
"status": "wait",
|
|
"assignee": "the-custodian",
|
|
"needs_human": false,
|
|
"intervention_note": "",
|
|
"blocking_reason": "Actual signed upstream issuer proved as https://auth.coulomb.social; probe admission and cleanup complete. Await configuration-owner pin, named CCR-2026-0017/0018 reviews, custody/compatible rollout and separate audit/client-side/native delivery returns."
|
|
},
|
|
"repaired_fields": [],
|
|
"verified": true
|
|
},
|
|
{
|
|
"source_id": "HFACT-WP-0001-T04",
|
|
"uuid": "1054b135-f367-57b1-9308-72a1fbb38f62",
|
|
"fields": {
|
|
"status": "wait",
|
|
"assignee": "the-custodian",
|
|
"blocking_reason": "Local protected artifact installation and installed-path startup proved by SAND-WP-0015-T06. Await trusted owner configuration, T03 native credentials, real-model acceptance and Railiance-specific placement."
|
|
},
|
|
"repaired_fields": [],
|
|
"verified": true
|
|
},
|
|
{
|
|
"source_id": "HFACT-WP-0001-T05",
|
|
"uuid": "2b171ebd-75f3-5ce2-85a9-98e8ab77fd19",
|
|
"fields": {
|
|
"status": "wait",
|
|
"assignee": "the-custodian",
|
|
"blocking_reason": "Await actionable admission records, owner credential chain and accepted profile/placement from T02-T04."
|
|
},
|
|
"repaired_fields": [],
|
|
"verified": true
|
|
},
|
|
{
|
|
"source_id": "HFACT-WP-0001-T06",
|
|
"uuid": "4d72717a-d5c9-571d-987b-9373f01253fa",
|
|
"fields": {
|
|
"status": "wait",
|
|
"assignee": "the-custodian",
|
|
"blocking_reason": "Await the current governed Railiance worker proof in T05."
|
|
},
|
|
"repaired_fields": [],
|
|
"verified": true
|
|
},
|
|
{
|
|
"source_id": "HFACT-WP-0001-T07",
|
|
"uuid": "a815d9b3-b03e-5764-95c2-fa1a2940611a",
|
|
"fields": {
|
|
"status": "wait",
|
|
"assignee": "the-custodian",
|
|
"blocking_reason": "Recovery matrix and measurement ledger are prepared; final live recovery proof requires the deployed T05/T06 configuration."
|
|
},
|
|
"repaired_fields": [],
|
|
"verified": true
|
|
},
|
|
{
|
|
"source_id": "HFACT-WP-0001-T08",
|
|
"uuid": "59cfddfb-7cd6-5103-9444-8764e9d51678",
|
|
"fields": {
|
|
"status": "wait",
|
|
"assignee": "the-custodian",
|
|
"blocking_reason": "Await useful delivery and operational controls from T06/T07, then the complete fourteen-day observation window."
|
|
},
|
|
"repaired_fields": [],
|
|
"verified": true
|
|
},
|
|
{
|
|
"source_id": "KEY-WP-0013-T02",
|
|
"uuid": "607897c5-bad9-55e5-86df-7802f592d6e8",
|
|
"status": "wait",
|
|
"description_sha256": "c7298c0b96f986c1ad16c54b86441b3129bdd96a5d461b9a97cb3c5feed9b745",
|
|
"description_repaired_from_source": true,
|
|
"live_proof_in_description": true,
|
|
"verified": true
|
|
}
|
|
],
|
|
"decision": {
|
|
"id": "1c0d9fd1-4790-4d9a-be6c-0ed4c4890549",
|
|
"status": "resolved"
|
|
},
|
|
"progress": [
|
|
{
|
|
"id": "df89c3c4-e2a9-4dfa-ad15-606ee58205eb",
|
|
"workplan_id": "6e815d88-b0e3-5ce0-be5d-13ab15917f7f",
|
|
"task_id": "607897c5-bad9-55e5-86df-7802f592d6e8",
|
|
"summary": "User-admitted upstream issuer probe completed: actual signed issuer https://auth.coulomb.social verified at 2026-09-08T21:44:44Z, signature/audience/validity/nonce passed, pinned Job exit 0. All five temporary resources and Pod removed with UID-scoped cleanup; normal KeyCape Deployment/config metadata unchanged. KEY-WP-0013-T02 unknown-issuer input resolved; configuration-owner pin, named custody reviews and compatible rollout remain open. No token retained or downstream credential issued."
|
|
},
|
|
{
|
|
"id": "893d78bb-4ec6-4eca-999d-053f55a62674",
|
|
"workplan_id": "975db491-5412-5e27-8e34-14a2417bb039",
|
|
"task_id": "e15d62c9-e5da-5721-a135-87c050f7851c",
|
|
"summary": "Accepted KeyCape live signed upstream issuer https://auth.coulomb.social. Probe approval is HFACT-DEC-2026-002; signature/audience/time/nonce checks and complete scoped cleanup proved. RPF-WP-0035-T05 stays wait for configuration pin and named CCR-2026-0017/0018 reviews before custody activation; separate client/audit returns remain. Canonical repository reconciliation omitted the updated task description; exact source-backed T05 description was repaired through the supported API and read back."
|
|
},
|
|
{
|
|
"id": "4062ff36-20c8-4f64-94cf-e971704d5c72",
|
|
"workplan_id": "ed4fe524-036f-5221-8deb-00e24e944de1",
|
|
"task_id": "67c80db1-01ba-54f1-80ff-76398f9e7823",
|
|
"summary": "HFACT-DEC-2026-002 resolved and executed: signed issuer https://auth.coulomb.social proved with four checks and pinned Job exit 0; all temporary resources removed, normal config/deployment unchanged. Cleared completed probe intervention and consumed KEY-WP-0013-T02/RPF-WP-0035-T05 owner returns. T03 still waits for exact config pin, named custody reviews and admitted custody/compatible rollout; no factory operating grant or paid execution."
|
|
},
|
|
{
|
|
"id": "8903b14e-0696-4bcc-b9c6-33c6f64ba4e3",
|
|
"workplan_id": null,
|
|
"task_id": null,
|
|
"summary": "Custodian completed the explicitly approved live issuer probe. At 2026-09-08T21:44:44Z it proved signed upstream issuer https://auth.coulomb.social, exited 0 and left no temporary resources; normal KeyCape deployment/config metadata unchanged. Published owner returns and HFACT-DEC-2026-002, cleared the completed probe decision and verified task/source parity including source-backed KeyCape and Platform description repairs. Existing KEY-WP-0013-T02, RPF-WP-0035-T05 and HFACT-WP-0001-T03 retain config pin, named custody reviews and activation/rollout residuals. No custody activated or downstream/paid factory credential issued."
|
|
}
|
|
],
|
|
"repositories": [
|
|
{
|
|
"repo": "key-cape",
|
|
"commit": "e30ba7b3c06112f49f85e79601a7e985885ba53c",
|
|
"remote_main_matches": true,
|
|
"clean": true
|
|
},
|
|
{
|
|
"repo": "railiance-platform",
|
|
"commit": "e06d7fc3903ec79579a104b511fd2ef224c8fefb",
|
|
"remote_main_matches": true,
|
|
"clean": true
|
|
},
|
|
{
|
|
"repo": "prj-helixforge-factory",
|
|
"commit": "0a8a80cedf627dfdeb04d4737e119b7f4057b976",
|
|
"remote_main_matches": true,
|
|
"clean": true
|
|
},
|
|
{
|
|
"repo": "net-kingdom",
|
|
"commit": "46455439cfbb24fc5d187403c8f9f4465fccc274",
|
|
"remote_main_matches": true,
|
|
"clean": true
|
|
}
|
|
],
|
|
"human_needed_count": 15
|
|
},
|
|
"projection_limit": {
|
|
"finding": "Applied repository reconciliation did not preserve both updated owner task descriptions.",
|
|
"repaired_from_published_source": [
|
|
"KEY-WP-0013-T02",
|
|
"RPF-WP-0035-T05"
|
|
],
|
|
"repair_method": "Supported task description PATCH, followed by exact source-body and status readback.",
|
|
"systemic_issue_resolved": false,
|
|
"existing_owner_task": "HFACT-WP-0001-T02"
|
|
},
|
|
"efficiency_change": {
|
|
"actual_signed_issuer_unknown_resolved": true,
|
|
"probe_approval_resolved": true,
|
|
"probe_intervention_flag_cleared": true,
|
|
"repeat_observation_required_without_context_change": false,
|
|
"autonomous_factory_throughput_proved": false,
|
|
"fourteen_day_factory_observation_started": false
|
|
},
|
|
"next_returns": [
|
|
{
|
|
"owner_task": "KEY-WP-0013-T02",
|
|
"return": "Configuration owner ensures authelia.issuer equals https://auth.coulomb.social before compatible rollout."
|
|
},
|
|
{
|
|
"owner_task": "RPF-WP-0035-T05",
|
|
"return": "Named CCR-2026-0017/0018 reviews, then admitted attended custody activation and verifier-side delivery."
|
|
},
|
|
{
|
|
"owner_task": "HFACT-WP-0001-T03",
|
|
"return": "Consume compatible KeyCape rollout and live verification, separate audit/client-side custody, live approval and native credential delivery."
|
|
}
|
|
]
|
|
}
|