80 lines
3.4 KiB
JSON
80 lines
3.4 KiB
JSON
{
|
|
"task_id": "DEV-000036",
|
|
"task_revision": 1,
|
|
"architecture_revision": "ADR-0004",
|
|
"base_repo_revision": "e9594306e589591b76a15bd6a955f5d74e5f6a10",
|
|
"risk_tier": "E",
|
|
"intent": "Remove Creator authentication secrets from the production container environment by adding fail-closed file-backed secret loading and a read-only external Docker volume.",
|
|
"requirement_ids": ["INV-AUTH-001", "CONSTITUTION-1.3.28", "USER-DOCKER-PROD-ONLY"],
|
|
"allowed_change_scope": {
|
|
"modules": ["identity"],
|
|
"paths": [
|
|
"cmd/core-runtime/main.go",
|
|
"cmd/core-runtime/main_test.go",
|
|
"deploy/docker-compose.prod.yml",
|
|
"docs/CREDENTIALS_AND_SECRETS.md",
|
|
"docs/DEPLOYMENT.md",
|
|
"dev/ACTIVE_TASK.json",
|
|
"dev/tasks/DEV-000036-creator-secret-files.json"
|
|
]
|
|
},
|
|
"forbidden_change_scope": {
|
|
"paths": [
|
|
"architecture/**",
|
|
"ci/**",
|
|
".gitea/**",
|
|
"cmd/devctl/**",
|
|
"contracts/**",
|
|
"modules/authority/**",
|
|
"modules/commit/**",
|
|
"database/**",
|
|
"security/**"
|
|
]
|
|
},
|
|
"allowed_architecture_delta": {
|
|
"new_cross_module_dependencies": 0,
|
|
"new_canonical_owners": 0,
|
|
"new_privileges": 0
|
|
},
|
|
"contracts": {
|
|
"consume": ["Creator credentials and bounded session contract", "Docker read-only volume"],
|
|
"may_change": []
|
|
},
|
|
"semantic_owner": "identity",
|
|
"canonical_state": ["none; Creator identity and sessions are unchanged"],
|
|
"state_transitions": ["valid configured credentials still issue the existing eight-hour bounded Creator session"],
|
|
"side_effects_and_privileges": ["core-runtime reads three existing secrets from files instead of environment values in production", "external Docker volume is mounted read-only only into core-runtime"],
|
|
"persistence_and_migrations": ["no database migration", "existing Creator secrets move to the external assistant_core_secrets Docker volume"],
|
|
"failure_retry_restart": ["missing, empty, multiline, unreadable, or ambiguously configured secrets fail startup", "direct environment values remain supported for development but cannot be combined with a corresponding _FILE setting", "the existing production container remains available for rollback until the replacement is healthy"],
|
|
"assumptions": [
|
|
"The current production secrets are valid and can be migrated without revealing their values",
|
|
"core-runtime continues to run as uid 100 and gid 101",
|
|
"Docker administrators retain necessary recovery access to the external secret volume"
|
|
],
|
|
"acceptance_scenarios": [
|
|
"direct environment secret loading remains supported for development",
|
|
"file-backed secrets trim line endings and reject empty or multiline content",
|
|
"simultaneous direct and file configuration fails closed",
|
|
"production core-runtime Env contains only _FILE paths for the three Creator secrets",
|
|
"the secret volume is read-only in core-runtime and absent from other application containers",
|
|
"Creator login and current-session checks succeed after deployment",
|
|
"exact diff validation observes only declared paths"
|
|
],
|
|
"required_tests": [
|
|
"unit",
|
|
"adversarial secret loading",
|
|
"architecture preflight",
|
|
"exact diff scope",
|
|
"go vet",
|
|
"production compose validation",
|
|
"remote Creator login smoke",
|
|
"production environment and mount audit",
|
|
"CI"
|
|
],
|
|
"terminal_gap_states": [
|
|
"BLOCKED_BY_MISSING_CAPABILITY",
|
|
"BLOCKED_BY_CONFLICT",
|
|
"BLOCKED_BY_ARCHITECTURE_GAP"
|
|
]
|
|
}
|