58 lines
2.6 KiB
TeX
58 lines
2.6 KiB
TeX
%% SCRAP: scratch/ci-cd/GOVERNANCE_INPUT_AUDIT
|
|
%% SOURCE: docs/working/scratch/ci-cd/GOVERNANCE_INPUT_AUDIT.adoc
|
|
%% STATUS: HISTORICAL
|
|
%% FITS: none
|
|
%% EDITORIAL: lifted — prose rewritten to press voice
|
|
|
|
\section{Governance Input Audit (Phase 1)}
|
|
|
|
This audit assessed all controlled governance inputs against the requirement that every
|
|
document bound for the Vault must pass through \texttt{in\_basket/} as the sole gating
|
|
point. The audit was conducted on 2025-11-03 and returned a \textbf{COMPLIANT} verdict
|
|
with implementation verified for five of eight input sources and documentation complete
|
|
for the remaining three.
|
|
|
|
\subsection{Compliance Matrix}
|
|
|
|
\begin{center}
|
|
\begin{tabular}{llll}
|
|
\toprule
|
|
Input source & Artifact type & Route & Status \\
|
|
\midrule
|
|
\texttt{test-stage.yml} & Test results & \texttt{in\_basket/Test\_Results/} & Implemented \\
|
|
\texttt{qual-stage.yml} & Benchmarks & \texttt{in\_basket/Performance\_Data/} & Implemented \\
|
|
\texttt{qual-stage.yml} & SBOM & \texttt{in\_basket/} & Implemented \\
|
|
\texttt{prod-stage.yml} & Build manifest & \texttt{in\_basket/Build\_Manifests/} & Implemented \\
|
|
Jenkins devl job & Build logs & \texttt{in\_basket/Test\_Results/} & Pending \\
|
|
Jenkins test job & Test results & \texttt{in\_basket/Test\_Results/} & Pending \\
|
|
Jenkins qual job & Benchmarks, SBOM, verification & \texttt{in\_basket/Performance\_Data/} & Pending \\
|
|
GitHub Issues & CAPA / ECR / ECO & Kanban (development) & Correct by design \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{center}
|
|
|
|
\subsection{Backdoor Analysis}
|
|
|
|
The audit identified four theoretical bypass vectors and the controls in place for each.
|
|
|
|
\begin{itemize}
|
|
\item \textbf{Direct Vault commit.} Mitigated by pull-request peer review and branch
|
|
protection on the governance repository.
|
|
\item \textbf{Workflow dynamic path injection.} Mitigated by code review of all
|
|
\texttt{.github/workflows/*.yml} files; paths are hardcoded, not constructed at
|
|
runtime.
|
|
\item \textbf{Jenkins SSH direct write.} Mitigated by scoping SSH credentials to the
|
|
governance repository and documenting required routing in
|
|
\texttt{JENKINS\_GOVERNANCE\_INTEGRATION.adoc}. Risk rated Medium.
|
|
\item \textbf{Manual operator bypass.} Mitigated by the \texttt{INTAKE\_LOG} requirement
|
|
and the gating rules in \texttt{INTAKE\_PROCEDURES.adoc}. Risk rated Medium.
|
|
\end{itemize}
|
|
|
|
\subsection{Pending Actions}
|
|
|
|
At audit close, three Jenkins jobs required Jenkinsfile updates to route outputs through
|
|
\texttt{in\_basket/} per the documented specification. The end-to-end flow for GitHub
|
|
Actions pipelines was verified working.
|
|
|
|
%% TODO(bob): verify whether Jenkins jobs were ever updated post-audit.
|