vrr/Pulse
2
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-10-19 10:33:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 13

Bind secure runtime proof to committed main

Browse source
This commit is contained in:
Pulse Test 2026-08-30 09:27:45 +01:00
parent cb843e37e8
commit 36dd5b9119
4 changed files with 60 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

11
docs/release-control/v6/internal/AGENT_PRIVILEGE_BOUNDARY_PLAN.md
View file

@ -93,13 +93,14 @@ without changing the product default:
This is a qualification foundation, not the Slice E ratchet. The generated
setup default remains the legacy/root profile. A clean disposable arm64 Ubuntu
systemd exercise now proves exact-working-tree install, migration, explicit and
automatic rollback, ordinary update isolation, typed helper health, fresh
systemd exercise now proves exact-committed-main install, migration, explicit
and automatic rollback, ordinary update isolation, typed helper health, fresh
registration, continued reporting, separate runner enrollment, durable typed
receipt replay, exact credential rotation invalidation, and runner self-revoke;
its secret-free receipt is recorded in
`internal/records/secure-agent-runtime-systemd-receipt-2026-08-30.json`. The
repository still needs exact committed release-candidate reproduction,
its secret-free receipt and commit binding are recorded in
`internal/records/secure-agent-runtime-systemd-receipt-2026-08-30.json` and its
committed-main attestation. The repository still needs exact committed
release-candidate reproduction,
representative Proxmox, SMART, Docker and rootless Podman telemetry/action
parity, appliance profiles, and the external security review. Until those
proofs are recorded, the safe profile remains opt-in and provider degradation

31
docs/release-control/v6/internal/records/secure-agent-runtime-committed-main-attestation-2026-08-30.json Normal file
View file

@ -0,0 +1,31 @@
{
"schema_version": 1,
"proof_classification": "exact-committed-main",
"qualified_commit": "cb843e37e8a92c56d88a8a2922c23ccd2e4fd21b",
"qualified_ref_at_run": "main",
"build_checkout": "detached-worktree",
"build_checkout_clean_except_ignored_artifacts": true,
"fresh_disposable_vm": true,
"receipt_path": "docs/release-control/v6/internal/records/secure-agent-runtime-systemd-receipt-2026-08-30.json",
"receipt_sha256": "adeeec6bf02a73c27483da31d9e058a8686900324e32960399985e847487a271",
"source_hashes_match_commit": true,
"source_hashes": {
"scripts/install.sh": "0b557c9394f3f0741cbf4287e5ee16a88fe03e189678bddf754606458c4e276e",
"scripts/installtests/secure_runtime_systemd_lab_test.go": "46082cf9247cd626f9b746ec9a3acfcc4f58ca3c1ced762498376d4bfccaf3f1"
},
"host": {
"os": "Ubuntu 24.04.4 LTS",
"kernel": "6.8.0-117-generic",
"systemd": "255 (255.4-1ubuntu8.15)",
"architecture": "arm64"
},
"scenario_count": 12,
"all_scenarios_passed": true,
"test_elapsed_seconds": 113.43,
"default_changed": false,
"residual_proof": [
"exact-release-candidate",
"representative-provider-and-appliance",
"external-security-review"
]
}

24
docs/release-control/v6/internal/records/secure-agent-runtime-qualification-foundation-2026-08-30.md
View file

@ -4,7 +4,7 @@
This slice closes implementation defects found while preparing a real Linux
systemd qualification of the optional collector/helper/action-runner split. It
also records a managed-development real-systemd qualification of the
also records an exact committed-main real-systemd qualification of the
collector/helper migration boundary and the separately credentialed action
runner lifecycle. It does not flip the installer default and is not exact
committed release-candidate or representative live-provider proof.
@ -37,13 +37,18 @@ committed release-candidate or representative live-provider proof.
separate authoritative registration proof. Installed collector binaries are
pinned to mode `0755` rather than inheriting `mktemp` permissions.
## Managed-development systemd proof
## Exact committed-main systemd proof
The disposable arm64 Colima profile `pulse-agent-qual` ran Ubuntu 24.04.4,
kernel 6.8.0-117, and systemd 255. The exact working-tree installer and lab
source are bound by the hashes in
`secure-agent-runtime-systemd-receipt-2026-08-30.json`; the receipt itself has
SHA-256 `7bf8695c2f8dd185be7552bc9192b59a054f529f8f227773f8cb9b52c495a16b`.
kernel 6.8.0-117, and systemd 255. A clean detached worktree at commit
`cb843e37e8a92c56d88a8a2922c23ccd2e4fd21b` built every exercised artifact and
the lab binary. The source hashes in
`secure-agent-runtime-systemd-receipt-2026-08-30.json` match that commit; the
receipt has SHA-256
`adeeec6bf02a73c27483da31d9e058a8686900324e32960399985e847487a271` and the
separate `secure-agent-runtime-committed-main-attestation-2026-08-30.json`
binds the receipt, commit, clean checkout, and fresh disposable VM without
altering the generated receipt.
The guarded lab passed all of these destructive scenarios from a clean VM:
- legacy root/command-capable install with rootful Docker enabled;
@ -69,13 +74,14 @@ The guarded lab passed all of these destructive scenarios from a clean VM:
The receipt is intentionally secret-free and contains source/artifact hashes,
host facts, resulting privilege posture, report timestamps, and the twelve
scenario outcomes. This is managed-development proof because it exercised the
working tree before its eventual commit identity existed.
scenario outcomes. This is exact committed-main proof. It is still not exact
release-candidate proof because no release candidate was designated for this
run.
## Proof classification and residuals
The focused protocol, update, runner, API, and installer regressions plus the
managed systemd receipt are proof for these semantics. They are not a
committed-main systemd receipt are proof for these semantics. They are not a
substitute for exact committed release-candidate evidence, representative
provider/appliance qualification, or external review.

16
docs/release-control/v6/internal/records/secure-agent-runtime-systemd-receipt-2026-08-30.json
View file

@ -1,15 +1,15 @@
{
"schema_version": 2,
"completed_at": "2026-08-30T07:49:40.116396211Z",
"completed_at": "2026-08-30T08:25:55.305586949Z",
"source_hashes": {
"scripts/install.sh": "0b557c9394f3f0741cbf4287e5ee16a88fe03e189678bddf754606458c4e276e",
"scripts/installtests/secure_runtime_systemd_lab_test.go": "46082cf9247cd626f9b746ec9a3acfcc4f58ca3c1ced762498376d4bfccaf3f1"
},
"artifact_hashes": {
"collector_v1": "76844200cec5d2ee4c015d2858d0afb37bce078fdf5cc6e0015997ae97c95400",
"collector_v2": "b493b9d7c498b41cd2615d3900ed53f9bbdaeeeebd1da93f7d2657e7bb4d38a2",
"helper": "a0932c8ce3bb5b7e94428afb061999750e8e8a4cece7d48df6a35b125eec2f59",
"runner": "7429b0b28cc711b59a8f9a6b444f21254ec7a201f145f446dda5dc13d93bbf8b"
"collector_v1": "3f3e4bbff51143de399c0da4ee9a27f2e32294187da88f566018ae45e46edc07",
"collector_v2": "7bdcfa0a66402700fa9653d3d74ecebf874ea495d74b80cca2b6d0fe7af19e09",
"helper": "35afded11d0f2e69a6ab309f839a132fa4cd0be905adda798939de310261b1cd",
"runner": "51faf0e967bb8117fd6e05329caca6df56f64e38bec86f5c59f7fb2b35d2eecd"
},
"os_release": "PRETTY_NAME=\"Ubuntu 24.04.4 LTS\"\nNAME=\"Ubuntu\"\nVERSION_ID=\"24.04\"\nVERSION=\"24.04.4 LTS (Noble Numbat)\"\nVERSION_CODENAME=noble\nID=ubuntu\nID_LIKE=debian\nHOME_URL=\"https://www.ubuntu.com/\"\nSUPPORT_URL=\"https://help.ubuntu.com/\"\nBUG_REPORT_URL=\"https://bugs.launchpad.net/ubuntu/\"\nPRIVACY_POLICY_URL=\"https://www.ubuntu.com/legal/terms-and-policies/privacy-policy\"\nUBUNTU_CODENAME=noble\nLOGO=ubuntu-logo",
"kernel": "Linux 6.8.0-117-generic #117-Ubuntu SMP PREEMPT_DYNAMIC Thu May 7 17:26:37 UTC 2026 aarch64 GNU/Linux",
@ -27,9 +27,9 @@
"credential_rotated": true,
"self_revoke_observed": true,
"collector_continuity": true,
"report_count": 48,
"first_report_at": "2026-08-30T07:47:53.132981202Z",
"last_report_at": "2026-08-30T07:49:39.989110328Z",
"report_count": 49,
"first_report_at": "2026-08-30T08:24:04.556483257Z",
"last_report_at": "2026-08-30T08:25:54.775477196Z",
"scenarios": [
{
"name": "legacy_root_command_capable_install",