Repository navigation
Preserve Talos rule IDs in verifier observations #5506
Description
🤖 Generated by the Agentic Engineer
The image-verifier observer consumes Talos JSON output, which reinterprets zero-prefixed resource IDs as numbers. For example, the YAML ID 0010 becomes JSON number 8, so a correctly ordered rule set can appear duplicated and out of order.
Read the resource stream without losing the original IDs and retain the full comparison of ordered patterns, signer identities, actions, controller ownership, lifecycle, and trust roots. Cover at least eleven rules and rejection controls for reordered, duplicate, missing, and changed decisions, then repeat the read-only fleet observation. Do not change node policy or weaken the verifier to make the observation pass.
The upstream JSON writer round-trips resource YAML through an untyped map: Talos v1.13.11 JSON writer. The YAML resource output preserves the source ID spelling.
Part of #2043
Metadata
Metadata
Assignees
Labels
Type
Fields
Priority
Effort
Projects
- Status
Activity
chore: agent-claim #5506 nonce=5453bae4440debcfbb86e8560caf4479
chore: agent-claim #5506 nonce=8b7988bab856798ae9203177a8faa9e0
devantler commentedon Oct 28, 2026
Post-merge verification passed at main
cea063374b8c1a87b0a2be436234800b14fc2d5a, the protected merge of #5507 from reviewed head2cb6e1bd591a63da92787d2ba48619db8ec35673.The merged read-only observer exited 0 against the discovered production fleet. Every inspected member matched the complete declared, ordered verification decisions and running controller ownership, with a running trust root. The observer re-read the fleet inventory and accepted a stable membership result. No node policy or production resource was changed.
This verifies the observation repair in #5506. It establishes rule and trust-root liveness; it does not substitute for the separate unsigned-image refusal proof in #3336. Exact runtime evidence remains in the private operator record.