Declare the binjovi-candidates-read key and candidate expiry #284

Merged

binjovi-bot merged 1 commit from feat/candidates-read-identity into trunk

2026-09-13 13:59:26 +00:00

sean commented

2026-09-13 13:44:52 +00:00

Owner

Second of three changes that let the dashboard offer a Build's candidate package set for download before it is released.

Identity binjovi-candidates-read: s3:GetObject on workflows/<project>/candidates/* for the seven package_set projects (zdns, zelnet, zerotea, rpg-demo, rpg-hello, rpg-lemonade, rpg-munchers), plus GetBucketLocation on workflows. Explicit prefixes, as binjovi-rpg-read declares them, so the converge proves each grant at its own prefix. The credential is delivered to namespace binjovi as binjovi-candidates-read-s3-credentials (seanfarm #709 generates and freezes the key, and lists it for the converge reader).
Bucket workflows: one 30-day expiry rule per candidates/ prefix. A candidate older than the current base cannot be released anyway (candidate_catalogs_diverged needs a rebuild), so the rule removes nothing the release train could still use.
README: the reader, the route it serves, and the retention.

tests/object-store-test passes (20 identities, 10 buckets, 26 negative controls). The catalog contract cannot state "a read identity must not gain PutObject", because a trailing wildcard makes PutObject legal on any prefix, so no new negative control was added.

Release order: after seanfarm #709 is deployed (the converge needs the frozen key), then the binjovi route.

https://claude.ai/code/session_01XdBRc9CHgFhAxCyHbdVtt6

Second of three changes that let the dashboard offer a Build's candidate package set for download before it is released. - Identity `binjovi-candidates-read`: `s3:GetObject` on `workflows/<project>/candidates/*` for the seven `package_set` projects (zdns, zelnet, zerotea, rpg-demo, rpg-hello, rpg-lemonade, rpg-munchers), plus `GetBucketLocation` on `workflows`. Explicit prefixes, as `binjovi-rpg-read` declares them, so the converge proves each grant at its own prefix. The credential is delivered to namespace `binjovi` as `binjovi-candidates-read-s3-credentials` (seanfarm #709 generates and freezes the key, and lists it for the converge reader). - Bucket `workflows`: one 30-day expiry rule per `candidates/` prefix. A candidate older than the current base cannot be released anyway (`candidate_catalogs_diverged` needs a rebuild), so the rule removes nothing the release train could still use. - README: the reader, the route it serves, and the retention. `tests/object-store-test` passes (20 identities, 10 buckets, 26 negative controls). The catalog contract cannot state "a read identity must not gain PutObject", because a trailing wildcard makes PutObject legal on any prefix, so no new negative control was added. Release order: after seanfarm #709 is deployed (the converge needs the frozen key), then the binjovi route. https://claude.ai/code/session_01XdBRc9CHgFhAxCyHbdVtt6

sean added 1 commit

2026-09-13 13:44:52 +00:00

Declare the binjovi-candidates-read key and candidate expiry

binjovi/ci Binjovi completed the frozen plan

Details

c4490c7c77

The dashboard will serve a Build's candidate package set to a signed-in
user through the control plane. This declares the read-only identity
for workflows/<project>/candidates/ on every package_set project, with
its credential delivered to namespace binjovi, and a 30-day lifecycle
rule on each candidates prefix of the workflows bucket.

Claude-Session: https://claude.ai/code/session_01XdBRc9CHgFhAxCyHbdVtt6

sean changed target branch from main to trunk

2026-09-13 13:51:56 +00:00