33 lines
2.8 KiB
JSON
33 lines
2.8 KiB
JSON
{
|
|
"proposal_id": "FORGE6-TEMPLATE-LIFECYCLE-001",
|
|
"revision": 4,
|
|
"original_revision": 1,
|
|
"original_digest_sha256": "7eddea55359b25c5ad307ed8ccd392dfadfe167d65cbe34b02f1955350bbcb36",
|
|
"deployment_uid": "e8eff0aa-64bb-4b44-9a80-a66612986355",
|
|
"original_template_digest": "b10384c9564531bff2ca756854b998fdc520f0a25f6acf195f024f675fc3b3e6",
|
|
"executor_hashes": {
|
|
"deploy_forge_custody.py": "5125b29ac20ab2b0a9bfcf686c2bb2e6e9c143f716bf119035960b345db497b9",
|
|
"probe_forge_installed.sh": "66b571a33822cbd58a4956aef3b2ac484d07ab887c296cd2c9ece354117e9440",
|
|
"forge-custody-init.json": "cccb9999785fe0151a973d9a8b554975daf17c91432ed3e8735e432f3cd80e8f",
|
|
"forge-custody-guard.sh": "75fdd0722a8749d5038f9e575c547fe39f41f599c40344230dbfdfde489c0f1c",
|
|
"activate_forge_template.py": "ef2b38f655d5520d69dcd69cdb4997eaad4b50773f32c1d798d16331b204c789",
|
|
"verify_receive_native.py": "c9120122c6f6f0b7c41fe4fa975e5a2a340e776885d852b861b8c13b7664adcd",
|
|
"activate_receive_hooks.py": "9b01ee383e16463981112226e19156b0de59af2d03dd71b9403e144e280a9fb3",
|
|
"restart_forge_custody.py": "104ed6ce5f88739f64b6f6f62e2869252408a390b6780117a499dcc9be0496f2"
|
|
},
|
|
"authorization_ref": "canon/standards/build-mode-change-authorization_v0.1.md",
|
|
"diff_ref": "Only add owned custody-proof pod-template annotation; no config or image change.",
|
|
"rollback": "Marker may remain inert. To undo guard, conditionally remove only custody-proof annotation matching this marker, wait for replacement, then use revision3 --rollback. No workload spec reversion from a stale snapshot.",
|
|
"abort_owner": "railiance-forge; executor custodian-codex; source railiance-apps",
|
|
"receipt_path": "docs/evidence/2026-10-13-netkingdom-security/forge-custody-restart.json",
|
|
"expected_result": "New pod runs verified guard to completion; same exact image/artifacts and 22 hooks; modes755; inherited native receive clean, secret refusal, quarantine and recovery pass. Repeat with another replacement pod.",
|
|
"restart_marker": "FORGE6-TEMPLATE-LIFECYCLE-001-r4",
|
|
"cost_estimate_eur": 0,
|
|
"risk_estimate": "Recreate briefly interrupts forge. Existing init maximum100m/128Mi exceeds new10m/32Mi so no increased scheduling reservation; node86percent requests. Bound240s readiness. Mismatched artifacts deliberately block startup; rollback restores prior deployment plus verified755 repair. Mount only existing security subtree, no credentials/RBAC/policy/image changes. No spend.",
|
|
"promotion_evidence": false,
|
|
"preparation_refinement": {
|
|
"previous_revision": 3,
|
|
"failure": "Second restart dry-run refused because original local patch helper did not decode JSON Pointer ~1. No second restart occurred. New executor replaces the annotations map while preserving existing fields; server equality remains required."
|
|
},
|
|
"annotation_key": "custodian.coulomb.social/custody-proof"
|
|
}
|