32 lines
3 KiB
JSON
32 lines
3 KiB
JSON
{
|
|
"proposal_id": "FORGE6-TEMPLATE-LIFECYCLE-001",
|
|
"revision": 3,
|
|
"original_revision": 1,
|
|
"original_digest_sha256": "7eddea55359b25c5ad307ed8ccd392dfadfe167d65cbe34b02f1955350bbcb36",
|
|
"deployment_uid": "e8eff0aa-64bb-4b44-9a80-a66612986355",
|
|
"original_template_digest": "73f6c1ef484c60f93285d61e6df6651b4f1268fafb3e470f35f450bce4f34aba",
|
|
"patched_template_digest": "b10384c9564531bff2ca756854b998fdc520f0a25f6acf195f024f675fc3b3e6",
|
|
"executor_hashes": {
|
|
"deploy_forge_custody.py": "5125b29ac20ab2b0a9bfcf686c2bb2e6e9c143f716bf119035960b345db497b9",
|
|
"probe_forge_installed.sh": "66b571a33822cbd58a4956aef3b2ac484d07ab887c296cd2c9ece354117e9440",
|
|
"forge-custody-init.json": "cccb9999785fe0151a973d9a8b554975daf17c91432ed3e8735e432f3cd80e8f",
|
|
"forge-custody-guard.sh": "75fdd0722a8749d5038f9e575c547fe39f41f599c40344230dbfdfde489c0f1c",
|
|
"activate_forge_template.py": "ef2b38f655d5520d69dcd69cdb4997eaad4b50773f32c1d798d16331b204c789",
|
|
"verify_receive_native.py": "c9120122c6f6f0b7c41fe4fa975e5a2a340e776885d852b861b8c13b7664adcd",
|
|
"activate_receive_hooks.py": "9b01ee383e16463981112226e19156b0de59af2d03dd71b9403e144e280a9fb3"
|
|
},
|
|
"authorization_ref": "canon/standards/build-mode-change-authorization_v0.1.md",
|
|
"diff_ref": "forge-custody-init.json plus owner helm/forgejo-values.yaml; additive first init container, no other changes",
|
|
"rollback": "Same executor --rollback under exact patched-template digest; removes only this init container, waits for Ready then verifies hashes and restores 0755 via the exact guard. After restart-proof remove only owned custody-proof annotation before rollback. Reconcile source by removing preExtraInitContainers before future Helm apply. If rollout cannot become Ready, abort owner may remove exact added init container after inspecting unchanged template; no hook bypass.",
|
|
"abort_owner": "railiance-forge; executor custodian-codex; source railiance-apps",
|
|
"receipt_path": "docs/evidence/2026-10-13-netkingdom-security/forge-custody-rollout.json",
|
|
"expected_result": "New pod runs verified guard to completion; same exact image/artifacts and 22 hooks; modes755; inherited native receive clean, secret refusal, quarantine and recovery pass. Repeat with another replacement pod.",
|
|
"restart_marker": "FORGE6-TEMPLATE-LIFECYCLE-001-r3",
|
|
"cost_estimate_eur": 0,
|
|
"risk_estimate": "Recreate briefly interrupts forge. Existing init maximum100m/128Mi exceeds new10m/32Mi so no increased scheduling reservation; node86percent requests. Bound240s readiness. Mismatched artifacts deliberately block startup; rollback restores prior deployment plus verified755 repair. Mount only existing security subtree, no credentials/RBAC/policy/image changes. No spend.",
|
|
"promotion_evidence": false,
|
|
"preparation_refinement": {
|
|
"original_candidate_ref": "forge-custody-rollout-pre-defaults.json",
|
|
"reason": "Server dry-run defaulted terminationMessagePath/Policy; candidate now declares exact defaults. No live change occurred."
|
|
}
|
|
}
|