Jon Chery
e74a8c2f5d
---ci--- project: acdl phase: 42 milestone: v1.9 status: execute ---/ci--- Phase 42 — stub-implementation (REQ-107..111, D-084): route_halt_artifact (REQ-107): - core/separation_of_duties.py: real SNS publish (ACDL_SOD_HALT_TOPIC_ARN) + outbox fallback (SEPARATION_OF_DUTIES_VIOLATION event via outbox_writer) + stderr emission. No silent print-only stub. - terraform/platform/main.tf: aws_sns_topic.acdl-sod-halt + output. HITL attestation gates (REQ-108): - core/hitl_gates.py: attest(contract_id, env, approver, evidence, outbox_client) records approver_qa/approver_prod/approver_dr to outbox, runs SoD check on prod, invokes attestation matrix, returns (ok, reason). Dev skips (autonomous). approver_from_env() reads GITHUB_ACTOR/GITEA_ACTOR. - scripts/run_platform.sh: Step 7b HITL gate before apply for qa/prod/dr. 8-concern attestation matrix (REQ-109, D-084): - core/attestation_matrix.py: check(env, evidence) runs the 8 concerns from hitl_matrix_design.md §10.4. Offline-testable (contract_nfrs, schema_validity, policy_pass) run for real. Operator-supplied accept signed artifacts validated for freshness (FRESHNESS_DAYS table) + schema. Signature skip when ACDL_ATTESTATION_SIGNING_KEY_ID unset (D-089). Fail loud if missing/expired for prod/dr. Wiz real client (REQ-110): - adapters/wiz/wiz_adapter.py: WizClient (GraphQL API, Bearer auth, pagination via pageInfo.hasNextPage + endCursor). fetch_and_adapt translates issues → PolicyCheckResult; graceful degrade when WIZ_API_TOKEN/WIZ_API_URL unset. Kyverno fleshed out (REQ-111): - adapters/kyverno/kyverno_adapter.py: full PolicyReport → PolicyCheckResult mapping (pass/fail/skip/warn + severity + skip-with- reason + resource ref construction from kind/name/namespace). adapt_inactive() emits KYVERNO_INACTIVE_TF_STACK guard. --kube-version stub parsed for future GitOps. Tests: +47 (test_route_halt_artifact.py, test_hitl_gates.py, test_attestation_matrix.py, test_wiz_adapter_real_client.py, expanded test_kyverno_adapter.py). Existing wiz_adapter tests updated for the real client's control.name ruleId. 493 passed; run_ci.sh green; run_platform.sh --check-only green.
95 lines
3.6 KiB
Python
95 lines
3.6 KiB
Python
"""Check that qaApprover != prodApprover for a contract (ARCHITECTURE.md
|
|
§10.3, D-042). Reads `approver_qa` from the DynamoDB outbox for the
|
|
contractId, compares to the prod-dispatch `gitea.actor` / `github.actor`.
|
|
Blocks on equality, emits `SEPARATION_OF_DUTIES_VIOLATION`, routes a halt
|
|
artifact to SRE on-call.
|
|
|
|
v1.9 (REQ-107, D-085): route_halt_artifact is a real implementation —
|
|
publishes to SNS topic `acdl-sod-halt` (ARN from ACDL_SOD_HALT_TOPIC_ARN)
|
|
when set; falls back to a structured stderr emission + a
|
|
SEPARATION_OF_DUTIES_VIOLATION event write to the DynamoDB outbox when
|
|
unset. No silent print-only stub.
|
|
"""
|
|
|
|
import os
|
|
import sys
|
|
from typing import Optional, Tuple
|
|
|
|
|
|
def check(outbox_client, contract_id: str,
|
|
current_prod_approver: Optional[str]) -> Tuple[bool, str]:
|
|
"""Return (ok, reason). ok=False means block the prod promotion."""
|
|
if outbox_client is None:
|
|
return (True, "no outbox client (dev-only spike)")
|
|
item = outbox_client.get(contract_id)
|
|
if item is None:
|
|
return (True, "no prior approver (first promotion)")
|
|
qa_approver = item.get("approver_qa")
|
|
if not qa_approver:
|
|
return (True, "no QA approver recorded (dev-only spike)")
|
|
if current_prod_approver is None:
|
|
return (True, "no prod approver supplied (dev-only spike)")
|
|
if qa_approver == current_prod_approver:
|
|
return (False,
|
|
f"SEPARATION_OF_DUTIES_VIOLATION: "
|
|
f"qaApprover==prodApprover=={qa_approver}")
|
|
return (True, "distinct")
|
|
|
|
|
|
def route_halt_artifact(contract_id: str, violation_reason: str,
|
|
oncall_client=None) -> None:
|
|
"""Route a halt artifact to SRE on-call (REQ-107, D-085).
|
|
|
|
When ACDL_SOD_HALT_TOPIC_ARN is set, publish to the SNS topic via
|
|
boto3. When unset (dev/CI), fall back to a structured stderr emission
|
|
+ a SEPARATION_OF_DUTIES_VIOLATION event write to the DynamoDB outbox
|
|
via outbox_writer.write_event (so the halt is in the audit chain).
|
|
The oncall_client, when provided, is the SNS client (test injection).
|
|
"""
|
|
topic_arn = os.environ.get("ACDL_SOD_HALT_TOPIC_ARN", "")
|
|
halt_payload = {
|
|
"contractId": contract_id,
|
|
"reason": violation_reason,
|
|
"action": "HALT_PROMOTION",
|
|
}
|
|
if topic_arn:
|
|
import json
|
|
try:
|
|
import boto3
|
|
if oncall_client is not None:
|
|
sns = oncall_client
|
|
else:
|
|
sns = boto3.client("sns")
|
|
sns.publish(
|
|
TopicArn=topic_arn,
|
|
Message=json.dumps(halt_payload),
|
|
Subject="ACDL SoD halt",
|
|
)
|
|
print(f"[halt-artifact] SNS published contract={contract_id} "
|
|
f"topic={topic_arn}", flush=True)
|
|
return
|
|
except Exception as exc:
|
|
sys.stderr.write(
|
|
f"[halt-artifact] SNS publish failed ({exc}); "
|
|
f"falling back to outbox event\n"
|
|
)
|
|
# Fallback: stderr + outbox event (the halt is in the audit chain).
|
|
sys.stderr.write(
|
|
f"[halt-artifact] contract={contract_id} reason={violation_reason} "
|
|
f"oncall={oncall_client} (no SNS topic — outbox fallback)\n"
|
|
)
|
|
try:
|
|
from core.outbox_writer import write_event
|
|
write_event({
|
|
"contractId": contract_id,
|
|
"eventType": "SEPARATION_OF_DUTIES_VIOLATION",
|
|
"environment": "",
|
|
"stack": "",
|
|
"score": 0,
|
|
"band": "halt",
|
|
"reason": violation_reason,
|
|
})
|
|
except Exception as exc:
|
|
sys.stderr.write(
|
|
f"[halt-artifact] outbox fallback write failed ({exc})\n"
|
|
) |