Repository navigation
Advance Phase 8 qualification and fix AWS runtime projection - #8
Closed
harrisonoconnorhover wants to merge 469 commits into
Closed
harrisonoconnorhover wants to merge 469 commits into
harrisonoconnorhover wants to merge 469 commits into
Conversation
Finalize Phase 5 handoff
…contract Add Azure launcher contract
…infra Add plan-first Azure infrastructure
…operations Add Azure image promotion and job operations
…keyvault-network Fail closed on Azure Key Vault network access
…canonical-preflight Add canonical Azure acceptance preflight
…stagezero-order Correct Azure candidate sequencing
Co-authored-by: Harrison O'Connor-Hoover <harrisonoconnorhover@users.noreply.github.com>
…consumption-profile Fix Azure Container Apps consumption profile drift
…job-consumption-profile Fix Azure Container Apps job profile drift
…secret-bootstrap Stage Azure Key Vault job bootstrap safely
…-only-metadata Allow source-only metadata snapshots
…cancel-ack Report Azure cancellation as a request acknowledgement
…e-verifier-shape Fix GCP bucket verifier CLI shape
…lification # Conflicts: # HANDOFF.md
…erifier-provider-shapes fix(gcp): align live verifier with Cloud Run
…it-service-scaling-defaults fix(gcp): record Cloud Run scaling defaults
…l-plane-live-evidence Record GCP D7 Control-plane live qualification
…ment-authority Authorize scoped AWS D7 deployment resources
…l-plane Add AWS D7 hosted control profile
…lification # Conflicts: # HANDOFF.md
…o-kms-backend-fix Pin AWS state backend to stage-zero KMS key
…lification # Conflicts: # HANDOFF.md
Contributor
Author
|
Closing: this draft was opened against the parent repository by mistake. The active protected main and branch live in harrisonoconnorhover/dander; no review is requested here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Why
Phase 8 needs one exact, reviewable evidence chain before support promotion. The AWS live preflight found that protected RC22 packaged only its GCP and Kubernetes deployments, so AWS-native runtime resolution would fail before provider access. The root cause was a launcher assumption that account-local platform coordinates were baked into the immutable image.
The correction passes a bounded non-secret platform overlay through the saved Fargate plan, validates it in the runtime, materializes it mode
0600in scratch space, and removes it on every terminal path. Secret values remain task-role-resolved and do not enter the overlay.Impact and boundaries
not_evaluated; it does not inherit this correction.Validation