Prepare source-bound one-use catalogue maintenance exception
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
parent
1eefbfc44a
commit
c89614ec81
12 changed files with 886 additions and 0 deletions
|
|
@ -0,0 +1,68 @@
|
|||
{
|
||||
"recorded_at": "2026-10-11T01:18:48.808601+00:00",
|
||||
"scope": "isolated disposable PostgreSQL only; no native DB/credentials",
|
||||
"postgres_image": "postgres@sha256:b0f9560a2de083e2cc7382e75f808c7381a32852a7ec49117deedb300e552b24",
|
||||
"python_dependency_image": "forgejo.coulomb.social/coulomb/user-engine@sha256:f239bbf332b8eb87320c86390fddca1dcb4f7c628a7af75e79dee8058d446a7b",
|
||||
"resources": {
|
||||
"postgres_memory_bytes": 536870912,
|
||||
"postgres_cpu_limit": 1,
|
||||
"test_worker_memory_bytes": 536870912,
|
||||
"test_worker_cpu_limit": 1,
|
||||
"postgres_network": "none",
|
||||
"worker_network": "isolated PostgreSQL container namespace only",
|
||||
"read_only_source_mounts": true
|
||||
},
|
||||
"final_test_count": 16,
|
||||
"final_test_exit_code": 0,
|
||||
"final_test_seconds": 1.73,
|
||||
"final_test_output": "Ran 16 tests in 1.730s; OK",
|
||||
"test_opt_in": "USER_ENGINE_ISOLATED_CATALOGUE_PG_TEST=network-none-fixture",
|
||||
"preparation_history": [
|
||||
{
|
||||
"tests": 11,
|
||||
"failed_assertions": 5,
|
||||
"cause": "Second service constructor ran readiness rollback inside transaction, discarded ordinary-denial audit and serialization lock.",
|
||||
"corrected": true
|
||||
},
|
||||
{
|
||||
"tests": 11,
|
||||
"passed": 11
|
||||
},
|
||||
{
|
||||
"tests": 15,
|
||||
"passed": 15
|
||||
},
|
||||
{
|
||||
"tests": 16,
|
||||
"passed": 16
|
||||
},
|
||||
{
|
||||
"tests": 16,
|
||||
"passed": 16,
|
||||
"note": "Final portable test path and explicit isolated-fixture opt-in verified."
|
||||
}
|
||||
],
|
||||
"meaningful_gates": [
|
||||
"genuine denial and explicit maintenance audit/event attribution",
|
||||
"full transaction rollback after first-row failure",
|
||||
"dry-run no durable entities/audits/events/grant",
|
||||
"native clock expiration despite stale caller time",
|
||||
"fresh connection native single-use replay refusal",
|
||||
"partial/conflicting record refusal",
|
||||
"exact existing no-change consumes without recovery",
|
||||
"unavailable or unexpected ordinary allow refusal",
|
||||
"source/closed/expired grant refusal",
|
||||
"exact consumed grant digest recovery",
|
||||
"created-only rollback retains history/deadletters unsent event",
|
||||
"claimed/delivered event stops",
|
||||
"changed metadata and later dependency stop",
|
||||
"existing delivery lock blocks recovery without deletion"
|
||||
],
|
||||
"resources_removed": {
|
||||
"test_worker_auto_removed": true,
|
||||
"postgres_container_removed": true,
|
||||
"private_volume_removed": true
|
||||
},
|
||||
"native_invocation": false,
|
||||
"founder_approval": null
|
||||
}
|
||||
|
|
@ -0,0 +1,41 @@
|
|||
# One-app catalogue executor preparation
|
||||
|
||||
This is a separately shipped supervised maintenance command for the existing R1 proposal. No native write, approval, service endpoint, IAM permission or image update has occurred. The prior readback R2 acceptance does not authorize this exception. The applied historical catalogue proposal remains unchanged.
|
||||
|
||||
The executor checks the ordinary provider using a truthful SERVICE principal, issuer `urn:supervised-maintenance`, with no roles, assurance, groups or human identity. A real identified ordinary PDP deny must be retained; unavailable/uncertain responses and unexpected ordinary allows refuse. Only then does an explicitly labelled, one-request maintenance adapter invoke the unchanged `UserEngineService.register_application` for the exact Application and binding. This intentionally overrides the ordinary admission for this single metadata transaction; it does not represent a normal PDP allow or authenticated human session.
|
||||
|
||||
The supervisor must independently verify the founder's native approval of this exact executor AND transport revision, records, deadline, target and recovery. A mode-0600 exact-hash grant is an out-of-band artifact delivered through the existing supervised SSH/kubectl authority. Its JSON is not authentication. Do not derive operator authority from the earlier readback memo, forge JWT claims, reuse a test grant, or ask for credential values. Grant fields are closed and include the native approval/receipt hash and separate maintenance operator attribution. Its lifetime cannot exceed 2026-10-12T23:59:59Z.
|
||||
|
||||
A SERIALIZABLE native transaction and fixed application advisory lock protect absent/exact-match admission. Native DB clock checks run after acquiring the lock and before commit. The audit primary key persists one-use closure across processes/restarts. Exact preexisting match consumes the grant without creating rows/events and therefore has no undo authority. Both services are constructed before BEGIN because the owner's readiness probe rolls back its connection. A tested early version constructed the second service inside BEGIN; five assertions exposed discarded denial/lock state and this was corrected before the final proof.
|
||||
|
||||
Created-only recovery requires the original consumed grant digest before its expiry and exact unchanged rows, no later dependent records, and the existing delivery-worker advisory lock. A missing, claimed or delivered event stops recovery. The original registration event and audit history are retained; only an unclaimed/undelivered event is dead-lettered. This is not reversal of downstream consumers. If recovery is blocked or expiry passed, stop for a separately reviewed owner reconciliation; do not issue a modified grant to defeat the ledger.
|
||||
|
||||
A native dry-run rolls back all User Engine rows, audits, ledger and outbox changes. It calls the genuine authorization provider, which may independently retain its own decision telemetry; dry-run is not globally side-effect free. Owner review of maintenance attribution, event consumers/dead-letter semantics and the precise conditional close-down relaxation remains required before proposing execution.
|
||||
|
||||
## Exact supervised delivery
|
||||
|
||||
After exact source/transport review and founder disposition, create the private grant artifact outside source control, pin its canonical JSON SHA-256 and independently confirm the native receipt. Freeze a fresh Ready pod UID with the approved immutable image and repeat the existing one-app read-only preflight. An unexpected pod, image, partial/conflicting record or provider state stops.
|
||||
|
||||
Run the reviewed transport using `python3 tools/run_approved_catalogue_bootstrap.py --executor tools/catalogue_bootstrap.py --executor-sha256 <proposal.executor_sha256> --grant-file <private-0600-artifact> --grant-sha256 <canonical-json-sha256> --expected-pod-uid <fresh-ready-uid> --mode dry-run`. Source and grant travel on stdin; the workload internally reads its existing database configuration and enforcement token file, with raw output suppressed. No script or grant is installed into the runtime filesystem. Native dry-run is part of the exceptional admission proposal and must not be run before that scope is approved. The `apply` invocation changes only the mode after successful dry-run and unchanged frozen preconditions; `rollback` is the same approved original grant subject to the recovery checks. This transport is prepared, syntax checked and not run against the estate.
|
||||
|
||||
After apply, verify exact two codec payloads, one consumed ledger, actual ordinary-denial and maintenance audits, attributed registered event, three-way Access/KeyCape/User facts and admitted catalogue readback. Do not claim a human MFA/allow proof from metadata registration. USER-WP-0026-T03 and USER-WP-0028-T02 remain open until their actual native acceptance conditions pass.
|
||||
|
||||
## Conditional close-down obligation
|
||||
|
||||
If the founder chooses this alternative, record a narrowly bounded exception to the normal authenticated operator/PDP admission for these exact two records. Retain original checks as unmet and link approval, exact executor/transport/grant hashes, ordinary deny, maintenance audit, native transaction outcome and verification. Remove private local grant/temporary execution inputs after use; no endpoint or ongoing permission exists to remove. Preserve consumed native ledger and audit/event history. Review unsent event delivery or reconcile claimed/delivered downstream effects before declaring closure. Rejection, expiry, error or recovery remains an uncompleted native catalogue gate, not a scored success. No active close-down waiver is created by this preparation.
|
||||
|
||||
|
||||
## Review refinement: retained events and privilege boundary
|
||||
|
||||
Rollback dead-lettering excludes the event from automatic outbox drain. Existing
|
||||
privileged `deliver_outbox(event_id=...)` and `replay_outbox` can revive it. The
|
||||
maintenance exception authorizes neither action and cannot promise permanent
|
||||
prevention of replay. Retain the exact rollback/event IDs and require separate
|
||||
owner reconciliation and applicable authority before any later targeted delivery
|
||||
or replay. Do not erase the event or represent downstream reversal as verified.
|
||||
|
||||
Independent analysis reproduced JSON `true` comparing equal to memo version1;
|
||||
the revised executor requires an exact integer. Five source negatives pass.
|
||||
The original16 PostgreSQL checks are retained as prior-source mechanism proof;
|
||||
the revised source needs its own actual final verification and formal User
|
||||
Engine review before an exact founder exception is requested.
|
||||
|
|
@ -0,0 +1,63 @@
|
|||
{
|
||||
"reviewed_manifest_sha256": "0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7",
|
||||
"executor_sha256": "b0dbbb9786e927055030acf849a72e9a44e9d3d55c84efdf245e419d381684f3",
|
||||
"scope": "isolated disposable PostgreSQL only; no estate credentials or native invocation",
|
||||
"attempts": [
|
||||
{
|
||||
"command": "unittest discover current 21 catalogue tests using installed image package",
|
||||
"exit_code": 0,
|
||||
"output": "test_absent_registration_preserves_real_denial_and_explicit_maintenance_attribution (test_catalogue_bootstrap.Tests.test_absent_registration_preserves_real_denial_and_explicit_maintenance_attribution) ... ok\ntest_changed_created_record_stops_rollback (test_catalogue_bootstrap.Tests.test_changed_created_record_stops_rollback) ... ok\ntest_claimed_event_stops_rollback_without_deleting_entities (test_catalogue_bootstrap.Tests.test_claimed_event_stops_rollback_without_deleting_entities) ... ok\ntest_conflicting_or_partial_metadata_refuses_without_mutation (test_catalogue_bootstrap.Tests.test_conflicting_or_partial_metadata_refuses_without_mutation) ... ok\ntest_created_only_rollback_preserves_history_and_deadletters_unsent_event (test_catalogue_bootstrap.Tests.test_created_only_rollback_preserves_history_and_deadletters_unsent_event) ... ok\ntest_delivered_event_stops_recovery_and_retains_entities (test_catalogue_bootstrap.Tests.test_delivered_event_stops_recovery_and_retains_entities) ... ok\ntest_delivery_worker_lock_blocks_recovery_without_partial_delete (test_catalogue_bootstrap.Tests.test_delivery_worker_lock_blocks_recovery_without_partial_delete) ... ok\ntest_dry_run_rolls_back_application_binding_all_audit_and_outbox (test_catalogue_bootstrap.Tests.test_dry_run_rolls_back_application_binding_all_audit_and_outbox) ... ok\ntest_exact_preexisting_match_is_nochange_and_has_no_undo (test_catalogue_bootstrap.Tests.test_exact_preexisting_match_is_nochange_and_has_no_undo) ... ok\ntest_expired_or_extra_or_wrong_source_grant_refuses (test_catalogue_bootstrap.Tests.test_expired_or_extra_or_wrong_source_grant_refuses) ... ok\ntest_grant_is_closed_after_one_use_across_fresh_connection (test_catalogue_bootstrap.Tests.test_grant_is_closed_after_one_use_across_fresh_connection) ... ok\ntest_later_dependent_record_stops_created_only_recovery (test_catalogue_bootstrap.Tests.test_later_dependent_record_stops_created_only_recovery) ... ok\ntest_native_clock_refuses_expired_grant_even_with_stale_caller_clock (test_catalogue_bootstrap.Tests.test_native_clock_refuses_expired_grant_even_with_stale_caller_clock) ... ok\ntest_recovery_requires_original_consumed_grant (test_catalogue_bootstrap.Tests.test_recovery_requires_original_consumed_grant) ... ok\ntest_transaction_failure_after_first_row_leaves_no_partial_data_or_grant (test_catalogue_bootstrap.Tests.test_transaction_failure_after_first_row_leaves_no_partial_data_or_grant) ... ok\ntest_unavailable_or_unexpected_ordinary_allow_cannot_trigger_exception (test_catalogue_bootstrap.Tests.test_unavailable_or_unexpected_ordinary_allow_cannot_trigger_exception) ... ok\ntest_deadline_hard_cap_and_no_timezone_are_refused (test_catalogue_bootstrap_owner_negatives.OwnerNegatives.test_deadline_hard_cap_and_no_timezone_are_refused) ... ok\ntest_exact_request_adapter_cannot_switch_app_tenant_or_identity (test_catalogue_bootstrap_owner_negatives.OwnerNegatives.test_exact_request_adapter_cannot_switch_app_tenant_or_identity) ... ok\ntest_exception_is_single_request_with_no_pdp_decision_id (test_catalogue_bootstrap_owner_negatives.OwnerNegatives.test_exception_is_single_request_with_no_pdp_decision_id) ... ok\ntest_json_boolean_is_not_an_authenticated_memo_revision (test_catalogue_bootstrap_owner_negatives.OwnerNegatives.test_json_boolean_is_not_an_authenticated_memo_revision) ... ok\ntest_other_memo_or_added_scope_cannot_expand_fixed_exception (test_catalogue_bootstrap_owner_negatives.OwnerNegatives.test_other_memo_or_added_scope_cannot_expand_fixed_exception) ... ok\n\n----------------------------------------------------------------------\nRan 21 tests in 1.561s\n\nOK\n"
|
||||
}
|
||||
],
|
||||
"limits": {
|
||||
"memory": "512m",
|
||||
"cpus": "1",
|
||||
"postgres_network": "none",
|
||||
"worker_network": "container:fixture"
|
||||
},
|
||||
"images": {
|
||||
"postgres": "postgres@sha256:b0f9560a2de083e2cc7382e75f808c7381a32852a7ec49117deedb300e552b24",
|
||||
"worker": "forgejo.coulomb.social/coulomb/user-engine@sha256:f239bbf332b8eb87320c86390fddca1dcb4f7c628a7af75e79dee8058d446a7b"
|
||||
},
|
||||
"cleanup": {
|
||||
"stop_exit_code": 0,
|
||||
"container_absent": false,
|
||||
"private_data_tmpfs": true,
|
||||
"worker_auto_removed": true,
|
||||
"final_confirmation": {
|
||||
"container_absent": true,
|
||||
"verified_command": "docker ps -a --filter name=user-owner-review --format names/status returned empty after auto-removal"
|
||||
}
|
||||
},
|
||||
"current_test_count": 21,
|
||||
"current_test_seconds": 1.561,
|
||||
"prior_failed_preparation_retained": {
|
||||
"original_receipt_sha256": "964cc3755e96330bf6d1ada63410f8adfdb3c45602e0446369d6dddace412405",
|
||||
"prior_tests": 11,
|
||||
"prior_failed_assertions": 5,
|
||||
"cause": "readiness probe rolled back transaction inside second service constructor",
|
||||
"old_receipt_unmodified": true
|
||||
},
|
||||
"independently_confirmed_installed_and_checkout_source_hashes": [
|
||||
{
|
||||
"path": "src/user_engine/service.py",
|
||||
"sha256": "1c60b69e08c36eb3f678893a4a945eeeb9c73d5246c6566857cd8c134f75446d"
|
||||
},
|
||||
{
|
||||
"path": "src/user_engine/adapters/postgres.py",
|
||||
"sha256": "528d75431d1f3a7e55423ffa55d34722ac343582e513985db74ba3add36e6da6"
|
||||
},
|
||||
{
|
||||
"path": "src/user_engine/adapters/flex_auth.py",
|
||||
"sha256": "73d645b7b37904ebfe0df6f7ed397b74b4c47f505cd64a30c39e60717ce71455"
|
||||
},
|
||||
{
|
||||
"path": "src/user_engine/domain/models.py",
|
||||
"sha256": "8c9cb8051a930fa05a1657c8b539510588f1788812d68510df55712d2f4df050"
|
||||
},
|
||||
{
|
||||
"path": "src/user_engine/store_records.py",
|
||||
"sha256": "3cec4575434e82e29932a3e9cc7659f3dd8fa7e5be81d5690487033796bbfc16"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
{
|
||||
"reviewed_current_owner_inputs": [
|
||||
{
|
||||
"path": "src/user_engine/service.py",
|
||||
"sha256": "1c60b69e08c36eb3f678893a4a945eeeb9c73d5246c6566857cd8c134f75446d"
|
||||
},
|
||||
{
|
||||
"path": "src/user_engine/adapters/postgres.py",
|
||||
"sha256": "528d75431d1f3a7e55423ffa55d34722ac343582e513985db74ba3add36e6da6"
|
||||
},
|
||||
{
|
||||
"path": "src/user_engine/adapters/flex_auth.py",
|
||||
"sha256": "73d645b7b37904ebfe0df6f7ed397b74b4c47f505cd64a30c39e60717ce71455"
|
||||
},
|
||||
{
|
||||
"path": "src/user_engine/domain/models.py",
|
||||
"sha256": "8c9cb8051a930fa05a1657c8b539510588f1788812d68510df55712d2f4df050"
|
||||
},
|
||||
{
|
||||
"path": "src/user_engine/store_records.py",
|
||||
"sha256": "3cec4575434e82e29932a3e9cc7659f3dd8fa7e5be81d5690487033796bbfc16"
|
||||
}
|
||||
],
|
||||
"runtime_sources_modified": false,
|
||||
"transport_native_execution_tested": false,
|
||||
"note": "Executor tested with actual published runtime dependencies and current owner source mounted read-only; not a native service execution approval."
|
||||
}
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
{
|
||||
"proposal_id": "USER-CATALOGUE-INFDEC-20261011-R1",
|
||||
"revision": "executor-preparation-2-owner-findings",
|
||||
"status": "prepared-not-approved-not-executed",
|
||||
"historical_proposal_manifest_sha256": "60b185aabbf6a8448c0c3aef57279b6741db1cd1361b8dab48be29df9f14f78e",
|
||||
"executor_sha256": "b0dbbb9786e927055030acf849a72e9a44e9d3d55c84efdf245e419d381684f3",
|
||||
"supervisor_transport_sha256": "3e594e0e8561100ae1eeb34d7208cd5b5e387ae56c29689f155aed94219770f3",
|
||||
"records_sha256": "23577cc4f3ea6c0ca43eb21ca0e3280eb53fb64e29b030dcd31251593f0f3f2f",
|
||||
"expected_runtime_image": "forgejo.coulomb.social/coulomb/user-engine@sha256:f239bbf332b8eb87320c86390fddca1dcb4f7c628a7af75e79dee8058d446a7b",
|
||||
"fresh_pod_uid_required": true,
|
||||
"deadline": "2026-10-12T23:59:59Z",
|
||||
"authority": "separate founder-approved supervised administrative exception; out-of-band supervisor validates native receipt",
|
||||
"existing_r2_does_not_approve_catalogue_mutation": true,
|
||||
"normal_pdp_refusal_required": true,
|
||||
"catalogue_entities": [
|
||||
"applications/informed-decision",
|
||||
"application_bindings/informed-decision"
|
||||
],
|
||||
"target_tenant": "tenant:platform",
|
||||
"retained_events": [
|
||||
"application.registered"
|
||||
],
|
||||
"new_endpoint": false,
|
||||
"runtime_image_change": false,
|
||||
"iam_grants": false,
|
||||
"credentials_exported": false,
|
||||
"budget_estimate": {
|
||||
"cost_eur_upper_bound": 0.1,
|
||||
"supervised_seconds_estimate": 300,
|
||||
"application_downtime_expected_seconds": 0
|
||||
},
|
||||
"risk": "Exactly one administrative catalogue mutation bypasses ordinary application.register PDP admission under an explicit maintenance exception, retaining genuine denial and truthful service attribution. Public browser login/MFA remains unverified; downstream events may prevent automatic rollback.",
|
||||
"rollback": "Only exact originally created rows; original consumed grant digest; before expiry; no dependencies; delivery lock; refuse any claimed/delivered/missing event; retain audits and dead-letter unsent registered event. No full downstream reversal claim. Dead-lettering stops automatic drain only; existing privileged targeted delivery/replay can revive the retained event. This maintenance grant authorizes neither; any later replay requires separate owner reconciliation/disposition.",
|
||||
"owner_review_required": [
|
||||
"User Engine audit/service attribution and transaction semantics",
|
||||
"NetKingdom exception scope, catalogue facts, event consumers/dead-letter semantics",
|
||||
"Custodian precise founder disposition and conditional close-down obligation"
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,66 @@
|
|||
# User Engine owner agreement — exact catalogue maintenance source
|
||||
|
||||
- reviewer: user-engine-owner (agent user-engine, codex)
|
||||
- decision: approved
|
||||
- comment: INTENT §Layer Engine/PIP, Binding rules 1/3/5/6 and Product Boundaries; exact nine-file preparation manifest SHA256 0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7, executor SHA256 b0dbbb9786e927055030acf849a72e9a44e9d3d55c84efdf245e419d381684f3 and transport SHA256 3e594e0e8561100ae1eeb34d7208cd5b5e387ae56c29689f155aed94219770f3. Work item USER-WP-ADHOC-2026-10-11-T03.
|
||||
|
||||
This dedicated worker loaded User Engine AGENTS/INTENT and worked from its
|
||||
checkout, independently inspecting registration, authorization, domain codecs,
|
||||
PostgreSQL persistence/transactions, audit and outbox consumers. This entry
|
||||
reviews User Engine only. Approval is source agreement for the precisely
|
||||
labelled maintenance alternative; it is no founder decision, native execution
|
||||
permission, runtime admission, human authentication proof or active relaxation.
|
||||
|
||||
Catalogue application/binding facts belong to this Engine. Ordinary protected
|
||||
registration still requires access-engine authorization. The standalone tool
|
||||
truthfully overrides an identified genuine ordinary denial for exactly
|
||||
informed-decision / OIDC informed-decision-approver / system informed-decision,
|
||||
with a separate one-use service maintenance actor, empty roles/assurance and no
|
||||
PDP allow ID. This is an exception to normal admission, requiring a separate
|
||||
exact founder disposition and independently verified native receipt covering
|
||||
executor AND transport, frozen Ready pod/image, records, deadline and recovery.
|
||||
The private hash-pinned artifact asserts this external authority; it does not
|
||||
authenticate its author. Prior R2 readback authority does not authorize it.
|
||||
|
||||
Strict integer memo revision rejects JSON true. Fixed request/action/actor/tenant
|
||||
bindings, native database clock checks, serializable transaction and advisory
|
||||
lock protect exact admission; durable audit key prevents reuse after restart.
|
||||
Both services are constructed before the transaction because owner readiness
|
||||
rolls back the connection. The prior constructor defect and five failed
|
||||
assertions remain in original preparation history. Exact preexisting match
|
||||
consumes with no undo. Partial/conflicting rows, provider unavailable, uncertain
|
||||
denial and unexpected ordinary allow refuse. Native dry-run rolls back local
|
||||
records/audit/outbox/ledger while external provider telemetry may remain. Final
|
||||
clock check precedes commit; it is not a measured commit-completion deadline.
|
||||
|
||||
Created-only recovery checks the original grant digest and expiry, unchanged
|
||||
metadata, absent dependencies, original events and the existing delivery-worker
|
||||
lock. Claimed/delivered/missing events stop recovery; history survives.
|
||||
Dead-lettering excludes automatic drain only. Ordinary separately authorized
|
||||
targeted delivery and replay can revive a retained event; this exception grants
|
||||
neither. Owner reconciliation is required before that later action. No complete
|
||||
consumer inventory or reversal of downstream effects is asserted.
|
||||
|
||||
The existing HTTP delivery adapter sends the eight-field platform envelope,
|
||||
including maintenance labels in data. application.registered is attributive,
|
||||
not an invitation mail class. Source attribution does not prove native consumer
|
||||
receipt, stream completeness, MFA success or user access. Verify actual bound
|
||||
rows, consumed ledger, genuine denial/maintenance audit, registered event and
|
||||
its intended consumer under existing sender admission after any separately
|
||||
approved execution. USER-WP-0026-T03 and USER-WP-0028-T02 remain open.
|
||||
|
||||
All 21 current checks passed in 1.561s using real disposable PostgreSQL, installed
|
||||
immutable f239 image package, read-only staged executor/test mount, isolated
|
||||
network and 512Mi/1CPU per container. Installed service/postgres/flex-auth/codec/
|
||||
domain hashes match current owner-source boundary. Both fixture workers and
|
||||
PostgreSQL were auto-removed; data existed only on tmpfs. Initial immediate
|
||||
cleanup query raced auto-removal and is retained as false; a later query
|
||||
confirmed absence. No native database/workload write, login, credential read,
|
||||
transport dispatch or human decision occurred. The original16 prior-source
|
||||
receipt is retained unchanged and is supplemented, not relabelled as new proof.
|
||||
|
||||
Before execution, the requesting Custodian must obtain all required independent
|
||||
owner reviews and the exact separate founder exception, record its conditional
|
||||
close-down obligation and preserve ordinary authentication/admission as unmet.
|
||||
Rejection, expiry, recovery failure and unverified execution cannot be scored
|
||||
as successful native catalogue acceptance.
|
||||
102
docs/reviews/2026-10-11-catalogue-maintenance-source-review.md
Normal file
102
docs/reviews/2026-10-11-catalogue-maintenance-source-review.md
Normal file
|
|
@ -0,0 +1,102 @@
|
|||
# User Engine catalogue maintenance source review — 2026-10-11
|
||||
|
||||
Disposition: changes requested to exact preparation manifest
|
||||
SHA256 8cc315874a58804c9cd6e48c766c26ff08e0b2435a82364100a795bb79ec7a85. This is technical source analysis, not a second formal
|
||||
owner-role approval, founder decision, native admission or execution proof.
|
||||
The same worker previously prepared NetKingdom architectural review, so a
|
||||
fresh dedicated user-engine-owner worker (or founder fallback) must provide
|
||||
any formal review entry required by delegated-owner-review v0.1. All seven
|
||||
staged file digests were verified; applied User Engine HEAD is
|
||||
1eefbfc44a06458ae3cedaf1e79186384c5f558c. Read current AGENTS/INTENT, DTO codec,
|
||||
service authorization/registration/audit/outbox and PostgreSQL transaction/locks.
|
||||
|
||||
## Required narrow corrections
|
||||
|
||||
1. Grant validator compares memo_version by Python equality, so JSON true is
|
||||
accepted as integer1. Original source acceptance was reproduced without a
|
||||
database. The staged correction requires `type(memo_version) is int` before
|
||||
exact equality. Corrected executor SHA256: b0dbbb9786e927055030acf849a72e9a44e9d3d55c84efdf245e419d381684f3. Refresh proposal
|
||||
executor hash and freeze the resulting final packet before human review;
|
||||
the original seven-file manifest is not a review of those changed bytes.
|
||||
2. Recovery dead-letters an unclaimed/undelivered registered event and preserves
|
||||
history. That excludes automatic pending drain. It does **not** permanently
|
||||
prohibit later privileged delivery: existing `deliver_outbox(event_id=...)`
|
||||
bypasses the dead-letter skip, and `replay_outbox` can clear dead_lettered_at
|
||||
after ordinary outbox.replay authorization. Execution/recovery documentation
|
||||
must therefore explicitly require owner reconciliation before such later
|
||||
targeted delivery/replay of a rolled-back registration. Do not describe
|
||||
dead-letter as preventing all downstream observation, or change normal
|
||||
runtime policy to evade this review. Do not authorize targeted replay as part
|
||||
of the one-app maintenance grant. Retain event IDs and the rollback ledger
|
||||
for the reconciliation boundary.
|
||||
|
||||
## Responsibility and authority basis
|
||||
|
||||
INTENT's Engine/PIP/PEP boundary makes catalogue facts owned by User Engine and
|
||||
ordinary protected registration fail closed through access-engine. This tool
|
||||
intentionally invokes an exception adapter after a genuine ordinary denial;
|
||||
it does **not** comply with normal admission and must be explicitly approved
|
||||
as a narrow maintenance exception. Source calls it that truthfully, issues no
|
||||
PDP decision ID and retains the genuine denial. It changes no installed HTTP
|
||||
endpoint, runtime package, normal authorization adapter or IAM policy.
|
||||
|
||||
Maintenance actor is SERVICE, issuer urn:supervised-maintenance and explicit
|
||||
operator attribution, with empty audience/roles/assurance/groups. It is not a
|
||||
verified human or invented IAM login. A mode0600 hash-pinned JSON file is not
|
||||
authentication of its author or proof of the native human receipt. Independent
|
||||
supervisor verification of exact founder disposition, executor AND transport,
|
||||
records, target, deadline and recovery is mandatory before any native dry-run
|
||||
or apply; R2 readback approval does not supply it. No active relaxation is
|
||||
created by preparation. A future relaxation requires the precise conditional
|
||||
security-close-down entry, and must preserve unmet normal admission evidence.
|
||||
|
||||
## Transaction and persistence observations
|
||||
|
||||
Both services are created before BEGIN: readiness invokes rollback, so moving
|
||||
that constructor into the transaction would silently discard denial and lock.
|
||||
SERIALIZABLE transaction plus fixed application advisory lock and native DB
|
||||
clock checks bound the exact two DTOs. Durable audit primary key persists the
|
||||
one-use ledger across processes; exact preexisting rows consume once with no
|
||||
creation/undo. Half-existing or conflicting rows refuse. Hash-bound grant,
|
||||
fixed memo/record/source and maximum deadline are checked, with no schema
|
||||
migration. Final clock check precedes driver commit; it is a precommit check,
|
||||
not a claim PostgreSQL commit completion is observed before the deadline.
|
||||
|
||||
Exception adapter permits only the fixed action/resource/app/tenant/actor and
|
||||
correlation, one check with <=30-second lifetime. Independent negatives verify
|
||||
wrong app, tenant, actor, action or correlation refusal, repeated invocation
|
||||
refusal and no PDP decision ID. Native transaction clocks and persistent ledger
|
||||
are not established by those pure tests; original receipt reports sixteen
|
||||
isolated PostgreSQL tests only, with the earlier constructor defect preserved
|
||||
as failed preparation history. No estate execution is inferred.
|
||||
|
||||
Created-only rollback checks original consumed grant hash and expiry, unchanged
|
||||
DTOs, absence of later dependent records, corresponding worker advisory locks,
|
||||
and absence of missing/claimed/delivered events before compare-delete. Audits
|
||||
and outbox records remain. Actual privileged replay caveat above must be retained.
|
||||
Downstream effects cannot be undone by this command: claimed/delivered event,
|
||||
changed metadata, dependency or expired grant stops for separate owner recovery.
|
||||
|
||||
## Event consumers and retained evidence
|
||||
|
||||
`application.registered` is attributive in User Engine evidence classification.
|
||||
Current HTTPOutboxDeliveryAdapter emits the existing eight-field event envelope
|
||||
and forwards maintenance_exception/proposal_id/approval_id/operator_id in data.
|
||||
It routes only family invitation classes to transactional mail; this registration
|
||||
is not a mail event. Its standard transport is audit-core. No consumer acceptance,
|
||||
complete stream inventory or human MFA outcome is established by this source
|
||||
review. After apply verify actual allowed event envelope and intended consumer
|
||||
receipt under existing sender admission, without assuming audit arrival proves
|
||||
source completeness or inferring grants from the registered app fact.
|
||||
|
||||
## Independent source-only verification
|
||||
|
||||
Five additional meaningful tests pass on the corrected executor: strict numeric
|
||||
memo revision; other memo/extra scope refusal; hard deadline and timezone refusal;
|
||||
fixed request subject/app/tenant/action/correlation refusal; one-check lifetime
|
||||
binding without PDP ID. Original executor accepts the boolean counterexample.
|
||||
Run with PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=/home/worsch/user-engine/src
|
||||
python3 -m unittest discover -s /tmp/identity-catalogue-review-stage/user-engine/tests -v.
|
||||
No database, credential, runtime login, native writes or transport dispatch occurred.
|
||||
These five tests are separate from the original sixteen PostgreSQL tests; no
|
||||
re-run of modified-source PostgreSQL tests is claimed.
|
||||
Loading…
Add table
Add a link
Reference in a new issue