Prepare source-bound one-use catalogue maintenance exception
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
parent
1eefbfc44a
commit
c89614ec81
12 changed files with 886 additions and 0 deletions
|
|
@ -0,0 +1,68 @@
|
|||
{
|
||||
"recorded_at": "2026-10-11T01:18:48.808601+00:00",
|
||||
"scope": "isolated disposable PostgreSQL only; no native DB/credentials",
|
||||
"postgres_image": "postgres@sha256:b0f9560a2de083e2cc7382e75f808c7381a32852a7ec49117deedb300e552b24",
|
||||
"python_dependency_image": "forgejo.coulomb.social/coulomb/user-engine@sha256:f239bbf332b8eb87320c86390fddca1dcb4f7c628a7af75e79dee8058d446a7b",
|
||||
"resources": {
|
||||
"postgres_memory_bytes": 536870912,
|
||||
"postgres_cpu_limit": 1,
|
||||
"test_worker_memory_bytes": 536870912,
|
||||
"test_worker_cpu_limit": 1,
|
||||
"postgres_network": "none",
|
||||
"worker_network": "isolated PostgreSQL container namespace only",
|
||||
"read_only_source_mounts": true
|
||||
},
|
||||
"final_test_count": 16,
|
||||
"final_test_exit_code": 0,
|
||||
"final_test_seconds": 1.73,
|
||||
"final_test_output": "Ran 16 tests in 1.730s; OK",
|
||||
"test_opt_in": "USER_ENGINE_ISOLATED_CATALOGUE_PG_TEST=network-none-fixture",
|
||||
"preparation_history": [
|
||||
{
|
||||
"tests": 11,
|
||||
"failed_assertions": 5,
|
||||
"cause": "Second service constructor ran readiness rollback inside transaction, discarded ordinary-denial audit and serialization lock.",
|
||||
"corrected": true
|
||||
},
|
||||
{
|
||||
"tests": 11,
|
||||
"passed": 11
|
||||
},
|
||||
{
|
||||
"tests": 15,
|
||||
"passed": 15
|
||||
},
|
||||
{
|
||||
"tests": 16,
|
||||
"passed": 16
|
||||
},
|
||||
{
|
||||
"tests": 16,
|
||||
"passed": 16,
|
||||
"note": "Final portable test path and explicit isolated-fixture opt-in verified."
|
||||
}
|
||||
],
|
||||
"meaningful_gates": [
|
||||
"genuine denial and explicit maintenance audit/event attribution",
|
||||
"full transaction rollback after first-row failure",
|
||||
"dry-run no durable entities/audits/events/grant",
|
||||
"native clock expiration despite stale caller time",
|
||||
"fresh connection native single-use replay refusal",
|
||||
"partial/conflicting record refusal",
|
||||
"exact existing no-change consumes without recovery",
|
||||
"unavailable or unexpected ordinary allow refusal",
|
||||
"source/closed/expired grant refusal",
|
||||
"exact consumed grant digest recovery",
|
||||
"created-only rollback retains history/deadletters unsent event",
|
||||
"claimed/delivered event stops",
|
||||
"changed metadata and later dependency stop",
|
||||
"existing delivery lock blocks recovery without deletion"
|
||||
],
|
||||
"resources_removed": {
|
||||
"test_worker_auto_removed": true,
|
||||
"postgres_container_removed": true,
|
||||
"private_volume_removed": true
|
||||
},
|
||||
"native_invocation": false,
|
||||
"founder_approval": null
|
||||
}
|
||||
|
|
@ -0,0 +1,41 @@
|
|||
# One-app catalogue executor preparation
|
||||
|
||||
This is a separately shipped supervised maintenance command for the existing R1 proposal. No native write, approval, service endpoint, IAM permission or image update has occurred. The prior readback R2 acceptance does not authorize this exception. The applied historical catalogue proposal remains unchanged.
|
||||
|
||||
The executor checks the ordinary provider using a truthful SERVICE principal, issuer `urn:supervised-maintenance`, with no roles, assurance, groups or human identity. A real identified ordinary PDP deny must be retained; unavailable/uncertain responses and unexpected ordinary allows refuse. Only then does an explicitly labelled, one-request maintenance adapter invoke the unchanged `UserEngineService.register_application` for the exact Application and binding. This intentionally overrides the ordinary admission for this single metadata transaction; it does not represent a normal PDP allow or authenticated human session.
|
||||
|
||||
The supervisor must independently verify the founder's native approval of this exact executor AND transport revision, records, deadline, target and recovery. A mode-0600 exact-hash grant is an out-of-band artifact delivered through the existing supervised SSH/kubectl authority. Its JSON is not authentication. Do not derive operator authority from the earlier readback memo, forge JWT claims, reuse a test grant, or ask for credential values. Grant fields are closed and include the native approval/receipt hash and separate maintenance operator attribution. Its lifetime cannot exceed 2026-10-12T23:59:59Z.
|
||||
|
||||
A SERIALIZABLE native transaction and fixed application advisory lock protect absent/exact-match admission. Native DB clock checks run after acquiring the lock and before commit. The audit primary key persists one-use closure across processes/restarts. Exact preexisting match consumes the grant without creating rows/events and therefore has no undo authority. Both services are constructed before BEGIN because the owner's readiness probe rolls back its connection. A tested early version constructed the second service inside BEGIN; five assertions exposed discarded denial/lock state and this was corrected before the final proof.
|
||||
|
||||
Created-only recovery requires the original consumed grant digest before its expiry and exact unchanged rows, no later dependent records, and the existing delivery-worker advisory lock. A missing, claimed or delivered event stops recovery. The original registration event and audit history are retained; only an unclaimed/undelivered event is dead-lettered. This is not reversal of downstream consumers. If recovery is blocked or expiry passed, stop for a separately reviewed owner reconciliation; do not issue a modified grant to defeat the ledger.
|
||||
|
||||
A native dry-run rolls back all User Engine rows, audits, ledger and outbox changes. It calls the genuine authorization provider, which may independently retain its own decision telemetry; dry-run is not globally side-effect free. Owner review of maintenance attribution, event consumers/dead-letter semantics and the precise conditional close-down relaxation remains required before proposing execution.
|
||||
|
||||
## Exact supervised delivery
|
||||
|
||||
After exact source/transport review and founder disposition, create the private grant artifact outside source control, pin its canonical JSON SHA-256 and independently confirm the native receipt. Freeze a fresh Ready pod UID with the approved immutable image and repeat the existing one-app read-only preflight. An unexpected pod, image, partial/conflicting record or provider state stops.
|
||||
|
||||
Run the reviewed transport using `python3 tools/run_approved_catalogue_bootstrap.py --executor tools/catalogue_bootstrap.py --executor-sha256 <proposal.executor_sha256> --grant-file <private-0600-artifact> --grant-sha256 <canonical-json-sha256> --expected-pod-uid <fresh-ready-uid> --mode dry-run`. Source and grant travel on stdin; the workload internally reads its existing database configuration and enforcement token file, with raw output suppressed. No script or grant is installed into the runtime filesystem. Native dry-run is part of the exceptional admission proposal and must not be run before that scope is approved. The `apply` invocation changes only the mode after successful dry-run and unchanged frozen preconditions; `rollback` is the same approved original grant subject to the recovery checks. This transport is prepared, syntax checked and not run against the estate.
|
||||
|
||||
After apply, verify exact two codec payloads, one consumed ledger, actual ordinary-denial and maintenance audits, attributed registered event, three-way Access/KeyCape/User facts and admitted catalogue readback. Do not claim a human MFA/allow proof from metadata registration. USER-WP-0026-T03 and USER-WP-0028-T02 remain open until their actual native acceptance conditions pass.
|
||||
|
||||
## Conditional close-down obligation
|
||||
|
||||
If the founder chooses this alternative, record a narrowly bounded exception to the normal authenticated operator/PDP admission for these exact two records. Retain original checks as unmet and link approval, exact executor/transport/grant hashes, ordinary deny, maintenance audit, native transaction outcome and verification. Remove private local grant/temporary execution inputs after use; no endpoint or ongoing permission exists to remove. Preserve consumed native ledger and audit/event history. Review unsent event delivery or reconcile claimed/delivered downstream effects before declaring closure. Rejection, expiry, error or recovery remains an uncompleted native catalogue gate, not a scored success. No active close-down waiver is created by this preparation.
|
||||
|
||||
|
||||
## Review refinement: retained events and privilege boundary
|
||||
|
||||
Rollback dead-lettering excludes the event from automatic outbox drain. Existing
|
||||
privileged `deliver_outbox(event_id=...)` and `replay_outbox` can revive it. The
|
||||
maintenance exception authorizes neither action and cannot promise permanent
|
||||
prevention of replay. Retain the exact rollback/event IDs and require separate
|
||||
owner reconciliation and applicable authority before any later targeted delivery
|
||||
or replay. Do not erase the event or represent downstream reversal as verified.
|
||||
|
||||
Independent analysis reproduced JSON `true` comparing equal to memo version1;
|
||||
the revised executor requires an exact integer. Five source negatives pass.
|
||||
The original16 PostgreSQL checks are retained as prior-source mechanism proof;
|
||||
the revised source needs its own actual final verification and formal User
|
||||
Engine review before an exact founder exception is requested.
|
||||
|
|
@ -0,0 +1,63 @@
|
|||
{
|
||||
"reviewed_manifest_sha256": "0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7",
|
||||
"executor_sha256": "b0dbbb9786e927055030acf849a72e9a44e9d3d55c84efdf245e419d381684f3",
|
||||
"scope": "isolated disposable PostgreSQL only; no estate credentials or native invocation",
|
||||
"attempts": [
|
||||
{
|
||||
"command": "unittest discover current 21 catalogue tests using installed image package",
|
||||
"exit_code": 0,
|
||||
"output": "test_absent_registration_preserves_real_denial_and_explicit_maintenance_attribution (test_catalogue_bootstrap.Tests.test_absent_registration_preserves_real_denial_and_explicit_maintenance_attribution) ... ok\ntest_changed_created_record_stops_rollback (test_catalogue_bootstrap.Tests.test_changed_created_record_stops_rollback) ... ok\ntest_claimed_event_stops_rollback_without_deleting_entities (test_catalogue_bootstrap.Tests.test_claimed_event_stops_rollback_without_deleting_entities) ... ok\ntest_conflicting_or_partial_metadata_refuses_without_mutation (test_catalogue_bootstrap.Tests.test_conflicting_or_partial_metadata_refuses_without_mutation) ... ok\ntest_created_only_rollback_preserves_history_and_deadletters_unsent_event (test_catalogue_bootstrap.Tests.test_created_only_rollback_preserves_history_and_deadletters_unsent_event) ... ok\ntest_delivered_event_stops_recovery_and_retains_entities (test_catalogue_bootstrap.Tests.test_delivered_event_stops_recovery_and_retains_entities) ... ok\ntest_delivery_worker_lock_blocks_recovery_without_partial_delete (test_catalogue_bootstrap.Tests.test_delivery_worker_lock_blocks_recovery_without_partial_delete) ... ok\ntest_dry_run_rolls_back_application_binding_all_audit_and_outbox (test_catalogue_bootstrap.Tests.test_dry_run_rolls_back_application_binding_all_audit_and_outbox) ... ok\ntest_exact_preexisting_match_is_nochange_and_has_no_undo (test_catalogue_bootstrap.Tests.test_exact_preexisting_match_is_nochange_and_has_no_undo) ... ok\ntest_expired_or_extra_or_wrong_source_grant_refuses (test_catalogue_bootstrap.Tests.test_expired_or_extra_or_wrong_source_grant_refuses) ... ok\ntest_grant_is_closed_after_one_use_across_fresh_connection (test_catalogue_bootstrap.Tests.test_grant_is_closed_after_one_use_across_fresh_connection) ... ok\ntest_later_dependent_record_stops_created_only_recovery (test_catalogue_bootstrap.Tests.test_later_dependent_record_stops_created_only_recovery) ... ok\ntest_native_clock_refuses_expired_grant_even_with_stale_caller_clock (test_catalogue_bootstrap.Tests.test_native_clock_refuses_expired_grant_even_with_stale_caller_clock) ... ok\ntest_recovery_requires_original_consumed_grant (test_catalogue_bootstrap.Tests.test_recovery_requires_original_consumed_grant) ... ok\ntest_transaction_failure_after_first_row_leaves_no_partial_data_or_grant (test_catalogue_bootstrap.Tests.test_transaction_failure_after_first_row_leaves_no_partial_data_or_grant) ... ok\ntest_unavailable_or_unexpected_ordinary_allow_cannot_trigger_exception (test_catalogue_bootstrap.Tests.test_unavailable_or_unexpected_ordinary_allow_cannot_trigger_exception) ... ok\ntest_deadline_hard_cap_and_no_timezone_are_refused (test_catalogue_bootstrap_owner_negatives.OwnerNegatives.test_deadline_hard_cap_and_no_timezone_are_refused) ... ok\ntest_exact_request_adapter_cannot_switch_app_tenant_or_identity (test_catalogue_bootstrap_owner_negatives.OwnerNegatives.test_exact_request_adapter_cannot_switch_app_tenant_or_identity) ... ok\ntest_exception_is_single_request_with_no_pdp_decision_id (test_catalogue_bootstrap_owner_negatives.OwnerNegatives.test_exception_is_single_request_with_no_pdp_decision_id) ... ok\ntest_json_boolean_is_not_an_authenticated_memo_revision (test_catalogue_bootstrap_owner_negatives.OwnerNegatives.test_json_boolean_is_not_an_authenticated_memo_revision) ... ok\ntest_other_memo_or_added_scope_cannot_expand_fixed_exception (test_catalogue_bootstrap_owner_negatives.OwnerNegatives.test_other_memo_or_added_scope_cannot_expand_fixed_exception) ... ok\n\n----------------------------------------------------------------------\nRan 21 tests in 1.561s\n\nOK\n"
|
||||
}
|
||||
],
|
||||
"limits": {
|
||||
"memory": "512m",
|
||||
"cpus": "1",
|
||||
"postgres_network": "none",
|
||||
"worker_network": "container:fixture"
|
||||
},
|
||||
"images": {
|
||||
"postgres": "postgres@sha256:b0f9560a2de083e2cc7382e75f808c7381a32852a7ec49117deedb300e552b24",
|
||||
"worker": "forgejo.coulomb.social/coulomb/user-engine@sha256:f239bbf332b8eb87320c86390fddca1dcb4f7c628a7af75e79dee8058d446a7b"
|
||||
},
|
||||
"cleanup": {
|
||||
"stop_exit_code": 0,
|
||||
"container_absent": false,
|
||||
"private_data_tmpfs": true,
|
||||
"worker_auto_removed": true,
|
||||
"final_confirmation": {
|
||||
"container_absent": true,
|
||||
"verified_command": "docker ps -a --filter name=user-owner-review --format names/status returned empty after auto-removal"
|
||||
}
|
||||
},
|
||||
"current_test_count": 21,
|
||||
"current_test_seconds": 1.561,
|
||||
"prior_failed_preparation_retained": {
|
||||
"original_receipt_sha256": "964cc3755e96330bf6d1ada63410f8adfdb3c45602e0446369d6dddace412405",
|
||||
"prior_tests": 11,
|
||||
"prior_failed_assertions": 5,
|
||||
"cause": "readiness probe rolled back transaction inside second service constructor",
|
||||
"old_receipt_unmodified": true
|
||||
},
|
||||
"independently_confirmed_installed_and_checkout_source_hashes": [
|
||||
{
|
||||
"path": "src/user_engine/service.py",
|
||||
"sha256": "1c60b69e08c36eb3f678893a4a945eeeb9c73d5246c6566857cd8c134f75446d"
|
||||
},
|
||||
{
|
||||
"path": "src/user_engine/adapters/postgres.py",
|
||||
"sha256": "528d75431d1f3a7e55423ffa55d34722ac343582e513985db74ba3add36e6da6"
|
||||
},
|
||||
{
|
||||
"path": "src/user_engine/adapters/flex_auth.py",
|
||||
"sha256": "73d645b7b37904ebfe0df6f7ed397b74b4c47f505cd64a30c39e60717ce71455"
|
||||
},
|
||||
{
|
||||
"path": "src/user_engine/domain/models.py",
|
||||
"sha256": "8c9cb8051a930fa05a1657c8b539510588f1788812d68510df55712d2f4df050"
|
||||
},
|
||||
{
|
||||
"path": "src/user_engine/store_records.py",
|
||||
"sha256": "3cec4575434e82e29932a3e9cc7659f3dd8fa7e5be81d5690487033796bbfc16"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
{
|
||||
"reviewed_current_owner_inputs": [
|
||||
{
|
||||
"path": "src/user_engine/service.py",
|
||||
"sha256": "1c60b69e08c36eb3f678893a4a945eeeb9c73d5246c6566857cd8c134f75446d"
|
||||
},
|
||||
{
|
||||
"path": "src/user_engine/adapters/postgres.py",
|
||||
"sha256": "528d75431d1f3a7e55423ffa55d34722ac343582e513985db74ba3add36e6da6"
|
||||
},
|
||||
{
|
||||
"path": "src/user_engine/adapters/flex_auth.py",
|
||||
"sha256": "73d645b7b37904ebfe0df6f7ed397b74b4c47f505cd64a30c39e60717ce71455"
|
||||
},
|
||||
{
|
||||
"path": "src/user_engine/domain/models.py",
|
||||
"sha256": "8c9cb8051a930fa05a1657c8b539510588f1788812d68510df55712d2f4df050"
|
||||
},
|
||||
{
|
||||
"path": "src/user_engine/store_records.py",
|
||||
"sha256": "3cec4575434e82e29932a3e9cc7659f3dd8fa7e5be81d5690487033796bbfc16"
|
||||
}
|
||||
],
|
||||
"runtime_sources_modified": false,
|
||||
"transport_native_execution_tested": false,
|
||||
"note": "Executor tested with actual published runtime dependencies and current owner source mounted read-only; not a native service execution approval."
|
||||
}
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
{
|
||||
"proposal_id": "USER-CATALOGUE-INFDEC-20261011-R1",
|
||||
"revision": "executor-preparation-2-owner-findings",
|
||||
"status": "prepared-not-approved-not-executed",
|
||||
"historical_proposal_manifest_sha256": "60b185aabbf6a8448c0c3aef57279b6741db1cd1361b8dab48be29df9f14f78e",
|
||||
"executor_sha256": "b0dbbb9786e927055030acf849a72e9a44e9d3d55c84efdf245e419d381684f3",
|
||||
"supervisor_transport_sha256": "3e594e0e8561100ae1eeb34d7208cd5b5e387ae56c29689f155aed94219770f3",
|
||||
"records_sha256": "23577cc4f3ea6c0ca43eb21ca0e3280eb53fb64e29b030dcd31251593f0f3f2f",
|
||||
"expected_runtime_image": "forgejo.coulomb.social/coulomb/user-engine@sha256:f239bbf332b8eb87320c86390fddca1dcb4f7c628a7af75e79dee8058d446a7b",
|
||||
"fresh_pod_uid_required": true,
|
||||
"deadline": "2026-10-12T23:59:59Z",
|
||||
"authority": "separate founder-approved supervised administrative exception; out-of-band supervisor validates native receipt",
|
||||
"existing_r2_does_not_approve_catalogue_mutation": true,
|
||||
"normal_pdp_refusal_required": true,
|
||||
"catalogue_entities": [
|
||||
"applications/informed-decision",
|
||||
"application_bindings/informed-decision"
|
||||
],
|
||||
"target_tenant": "tenant:platform",
|
||||
"retained_events": [
|
||||
"application.registered"
|
||||
],
|
||||
"new_endpoint": false,
|
||||
"runtime_image_change": false,
|
||||
"iam_grants": false,
|
||||
"credentials_exported": false,
|
||||
"budget_estimate": {
|
||||
"cost_eur_upper_bound": 0.1,
|
||||
"supervised_seconds_estimate": 300,
|
||||
"application_downtime_expected_seconds": 0
|
||||
},
|
||||
"risk": "Exactly one administrative catalogue mutation bypasses ordinary application.register PDP admission under an explicit maintenance exception, retaining genuine denial and truthful service attribution. Public browser login/MFA remains unverified; downstream events may prevent automatic rollback.",
|
||||
"rollback": "Only exact originally created rows; original consumed grant digest; before expiry; no dependencies; delivery lock; refuse any claimed/delivered/missing event; retain audits and dead-letter unsent registered event. No full downstream reversal claim. Dead-lettering stops automatic drain only; existing privileged targeted delivery/replay can revive the retained event. This maintenance grant authorizes neither; any later replay requires separate owner reconciliation/disposition.",
|
||||
"owner_review_required": [
|
||||
"User Engine audit/service attribution and transaction semantics",
|
||||
"NetKingdom exception scope, catalogue facts, event consumers/dead-letter semantics",
|
||||
"Custodian precise founder disposition and conditional close-down obligation"
|
||||
]
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue