tegwick
5d80644efa
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
30 lines
5.5 KiB
Python
30 lines
5.5 KiB
Python
"""Offline exact human packet preparation; no submission or credential access."""
|
|
import argparse,base64,hashlib,json
|
|
from pathlib import Path
|
|
|
|
FILES=['decision-packet.md','execution-and-verification.md','proposal.json','private-grant.schema.json','conditional-close-down-entry.md','executor.py','supervisor-transport.py','canonical-records.json','executor-proposal.json','executor-source-boundary.json','original-postgres-receipt.json','final-owner-postgres-receipt.json','user-owner-agreement.md','netkingdom-owner-agreement.md','application-owner-facts-ack.md','retained-native-preflight.json','retained-native-entry-metadata.json','retained-keycape-client-presence.json','transport-guard-receipt.json','transport-guard-tests.py']
|
|
ID='infd-20261011-user-catalogue-bootstrap-r1'
|
|
PROPOSAL='USER-CATALOGUE-INFDEC-20261011-R1'
|
|
EX='b0dbbb9786e927055030acf849a72e9a44e9d3d55c84efdf245e419d381684f3'
|
|
TR='3e594e0e8561100ae1eeb34d7208cd5b5e387ae56c29689f155aed94219770f3'
|
|
|
|
def build(root):
|
|
sha=lambda b:'sha256:'+hashlib.sha256(b).hexdigest()
|
|
assert sha((root/'executor.py').read_bytes())=='sha256:'+EX
|
|
assert sha((root/'supervisor-transport.py').read_bytes())=='sha256:'+TR
|
|
contents=[];items=[];documents=[]
|
|
for name in FILES:
|
|
data=(root/name).read_bytes();item=name.replace('.','-');media='application/json' if name.endswith('.json') else 'text/markdown' if name.endswith('.md') else 'text/plain'
|
|
contents.append({'item_id':item,'media_type':media,'content':data.decode()});items.append({'item_id':item,'label':name,'hash':sha(data)});documents.append({'digest':sha(data),'media_type':media,'content_base64':base64.b64encode(data).decode()})
|
|
question='Approve the exact one-time User Engine catalogue registration for Informed Decision, with genuine PDP denial retained, explicit supervised maintenance attribution, native dry-run and guarded recovery by October 12 at 23:59 UTC, plus restoration of ordinary authenticated management before customer production?'
|
|
memo={'id':ID,'version':1,'question':question,'requested_act':'approve','binding_level':'organizational','brief':'One fixed Application/browser-client/protected-system binding; ordinary application.register admission remains unmet. Exact reviewed executor and transport, 21 isolated PostgreSQL checks and 6 offline transport guards. Separate founder exception required before native dry-run/apply; private JSON/hash is not authentication. No image/config/IAM/human claims; created-only recovery may stop on delivery/expiry. Conditional restoration owner and criterion attached.','binding':{'principal':{'id':'pending-human-session','kind':'person','display_name':'Founder review'},'target':{'kind':'resource','id':'realm:kubernetes/railiance01/user-engine/catalogue/informed-decision','label':'Fixed Informed Decision Application and binding in User Engine','environment':'build'},'terms':'Only '+PROPOSAL+' and attached executor '+EX+' AND supervisor transport '+TR+' with attached fixed records; execute by 2026-10-12T23:59:59Z after independent native founder-receipt confirmation and fresh frozen pod/image/package/provider/absence checks. Approve native dry-run with external PDP telemetry, one atomic mutation/no-change, read-only verification, private-input cleanup and original-grant created-only recovery before expiry. No targeted replay or future registrations; conditional ordinary management restoration before customer production.'},'step_kind':'approve','packet':items,'highlights':[{'id':'explicit-maintenance-exception','item_id':'decision-packet-md','note':'This overrides genuine ordinary application.register denial for exactly two metadata facts; it does not satisfy normal PDP admission or authenticate a human. Recovery stops on changed dependencies,expiry or claimed/delivered/missing event. Targeted replay/delivery is excluded. Preserve one conditional restoration obligation before customer production.','required_ack':True,'severity':'warning','locator':{'kind':'section','heading':'Requested decision'}}],'sealed':False,'approval_id':None,'approval_binding_digest':None}
|
|
intent={'action':'administer','principal':'user-engine','purpose':'Approve one supervised catalogue metadata exception with exact source/transport, expiry, verification and guarded recovery; ordinary management admission remains unmet.','target':{'id':PROPOSAL,'type':'catalogue-maintenance-exception','system':'railiance01'}}
|
|
intake={'kind':'informed-decision.memo-intake','version':1,'idempotency_key':ID+'-v1','memo_class':'decision-record','review_group':'net-kingdom-admins','drafted_by':'custodian-codex','approval_intent':intent,'memo':memo,'packet':contents}
|
|
lifecycle=[{'id':ID,'register':{'memo':memo,'documents':documents},'publish':{'version':1,'audience':{'subjects':[],'groups':['net-kingdom-admins']}},'review':{'version':1,'options':{'submitter':'state-hub','memo_class':'decision-record','review_group':'net-kingdom-admins','approval_intent':intent}}}]
|
|
# Prepared whole register payload stays <=256KiB; no network call is made.
|
|
assert len(json.dumps(lifecycle[0]['register'],separators=(',',':')).encode())<=256*1024
|
|
for name,value in [('memo.json',memo),('intake.json',intake),('lifecycle-commands.json',lifecycle)]:
|
|
(root/name).write_text(json.dumps(value,indent=2,ensure_ascii=False)+'\n')
|
|
return {'memo_id':ID,'packet_items':len(items),'register_payload_bytes':len(json.dumps(lifecycle[0]['register'],separators=(',',':')).encode())}
|
|
if __name__=='__main__':
|
|
p=argparse.ArgumentParser(description=__doc__);p.add_argument('packet',type=Path);args=p.parse_args();print(json.dumps(build(args.packet)))
|