Inspect backup client delivery and record gated refresh requirements
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29
This commit is contained in:
parent
af03b466c4
commit
a55b05bf7d
2 changed files with 227 additions and 0 deletions
|
|
@ -228,3 +228,146 @@ T05 still requires platform acceptance, not another local candidate implementati
|
|||
No new workplan/task, identity claim, credential fetch, scheduled restore or owner
|
||||
acceptance was invented. The source-only backup hardening remains committed;
|
||||
this review does not claim it was rolled out to production.
|
||||
|
||||
|
||||
## Inspect downstream shared backup-lane delivery
|
||||
|
||||
```task
|
||||
id: ACTIVITY-WP-0042-T07
|
||||
status: done
|
||||
priority: high
|
||||
```
|
||||
|
||||
2026-10-03 NK-WP-0045 recovery follow-up: inspect actual backup consumer delivery
|
||||
without reading Secret objects. `scripts/inspect_backup_delivery.py` checks the
|
||||
railiance01 node, ESO readiness/refresh metadata, fixed source/library digests
|
||||
and mounted Forgejo/CNPG library digests. Captures and discards raw command
|
||||
failures; receipts contain only safe metadata, digests and booleans.
|
||||
|
||||
Forgejo uses immutable ConfigMap `backup-verified-0220ca56520c`; CNPG uses the
|
||||
railiance01 `/home/tegwick/railiance-platform` hostPath. They are separate source
|
||||
delivery paths. ExternalSecret `actcore-backup-offsite` refreshes each hour into
|
||||
`actcore-runtime-secret` with Merge/Retain; worker envFrom credentials remain
|
||||
in existing processes after a Secret refresh. Ready/SecretSynced is delivery
|
||||
health, not valid provider credentials or backup proof. Platform common source
|
||||
`50da37cf50016b03a7e6a537e87772a72979aba1` now includes public DAV
|
||||
`X-Requested-With: XMLHttpRequest`; vendored/mounted versions need verification.
|
||||
|
||||
Knowledge orientation: package 0.2.4 digest
|
||||
`025aab4f38246219c924bc94954e70ea0e6e7f72bcaf8d4344cd599602d345c3`,
|
||||
start withheld because informed-decision source changed; reviewed that README
|
||||
and current custodian environment orientation directly. No orientation claim
|
||||
establishes runtime authority.
|
||||
|
||||
## Refresh the existing backup consumer after the owner repairs the lane
|
||||
|
||||
```task
|
||||
id: ACTIVITY-WP-0042-T08
|
||||
status: wait
|
||||
priority: high
|
||||
blocking_reason: "Platform must supply an authenticated replacement-lane/CAS and encrypted history upload/readback receipt; then a reviewed scoped worker bundle/hostPath and env refresh is required."
|
||||
```
|
||||
|
||||
The reviewed-folder inspection for NK-WP-0045 found the current token and
|
||||
expected labelled share absent; upload and authenticated route probes return
|
||||
401. Lane KV v3 being synced does not resolve this provider mismatch.
|
||||
|
||||
Owner handoff: railiance-platform must first publish its non-secret receipt
|
||||
identifying the replacement lane KV version, exact two updated field names
|
||||
(`NC_WEBDAV_TOKEN`, `NC_WEBDAV_URL`), preserved AGE recipient, owner-reviewed
|
||||
share binding, and encrypted retained-history upload/readback proof. No token
|
||||
or URL goes into this repo or receipts. Root custody recovery can finish
|
||||
independently of this larger recurring backup consumer acceptance.
|
||||
|
||||
Prepare the bounded worker change only after that owner receipt: refresh ESO
|
||||
and verify status/resource metadata; replace the Forgejo immutable bundle
|
||||
using the platform-owned reviewed bundle builder; synchronize the CNPG hostPath
|
||||
source separately through repo-manager; reconcile the new bundle reference in
|
||||
`k8s/gitops/runtime.yaml` before ArgoCD synchronization. Preserve unrelated
|
||||
live mounts/environment. Do not use the old direct deployment patch helper
|
||||
against this adopted ArgoCD application. Perform one reviewed worker rollout
|
||||
to refresh envFrom only after source and ESO prerequisites; compare new pod
|
||||
start to ESO refresh and run this inspector again. Secret object bodies are
|
||||
never diagnostic output.
|
||||
|
||||
Require safe non-secret post-rollout source digests and readiness plus an
|
||||
owner-approved existing bounded backup run/provider receipt before claiming
|
||||
activity delivery acceptance. No automatic scheduled backup invocation, new
|
||||
operation admission, restore capability or customer recovery readiness is
|
||||
claimed. T02/T03/T05 keep their separate existing dependencies.
|
||||
|
||||
|
||||
## Inspect downstream shared backup-lane delivery
|
||||
|
||||
```task
|
||||
id: ACTIVITY-WP-0042-T07
|
||||
status: done
|
||||
priority: high
|
||||
```
|
||||
|
||||
2026-10-03 NK-WP-0045 recovery follow-up: inspect actual backup consumer delivery
|
||||
without reading Secret objects. `scripts/inspect_backup_delivery.py` checks the
|
||||
railiance01 node, ESO readiness/refresh metadata, fixed source/library digests
|
||||
and mounted Forgejo/CNPG library digests. Captures and discards raw command
|
||||
failures; receipts contain only safe metadata, digests and booleans.
|
||||
|
||||
Forgejo uses immutable ConfigMap `backup-verified-0220ca56520c`; CNPG uses the
|
||||
railiance01 `/home/tegwick/railiance-platform` hostPath. They are separate source
|
||||
delivery paths. ExternalSecret `actcore-backup-offsite` refreshes each hour into
|
||||
`actcore-runtime-secret` with Merge/Retain; worker envFrom credentials remain
|
||||
in existing processes after a Secret refresh. Ready/SecretSynced is delivery
|
||||
health, not valid provider credentials or backup proof. Platform common source
|
||||
`50da37cf50016b03a7e6a537e87772a72979aba1` now includes public DAV
|
||||
`X-Requested-With: XMLHttpRequest`; vendored/mounted versions need verification.
|
||||
|
||||
Knowledge orientation: package 0.2.4 digest
|
||||
`025aab4f38246219c924bc94954e70ea0e6e7f72bcaf8d4344cd599602d345c3`,
|
||||
start withheld because informed-decision source changed; reviewed that README
|
||||
and current custodian environment orientation directly. No orientation claim
|
||||
establishes runtime authority.
|
||||
|
||||
## Refresh the existing backup consumer after the owner repairs the lane
|
||||
|
||||
```task
|
||||
id: ACTIVITY-WP-0042-T08
|
||||
status: wait
|
||||
priority: high
|
||||
blocking_reason: "Platform must supply an authenticated replacement-lane/CAS and encrypted history upload/readback receipt; then a reviewed scoped worker bundle/hostPath and env refresh is required."
|
||||
```
|
||||
|
||||
The reviewed-folder inspection for NK-WP-0045 found the current token and
|
||||
expected labelled share absent; upload and authenticated route probes return
|
||||
401. Lane KV v3 being synced does not resolve this provider mismatch.
|
||||
|
||||
Owner handoff: railiance-platform must first publish its non-secret receipt
|
||||
identifying the replacement lane KV version, exact two updated field names
|
||||
(`NC_WEBDAV_TOKEN`, `NC_WEBDAV_URL`), preserved AGE recipient, owner-reviewed
|
||||
share binding, and encrypted retained-history upload/readback proof. No token
|
||||
or URL goes into this repo or receipts. Root custody recovery can finish
|
||||
independently of this larger recurring backup consumer acceptance.
|
||||
|
||||
Prepare the bounded worker change only after that owner receipt: refresh ESO
|
||||
and verify status/resource metadata; replace the Forgejo immutable bundle
|
||||
using the platform-owned reviewed bundle builder; synchronize the CNPG hostPath
|
||||
source separately through repo-manager; reconcile the new bundle reference in
|
||||
`k8s/gitops/runtime.yaml` before ArgoCD synchronization. Preserve unrelated
|
||||
live mounts/environment. Do not use the old direct deployment patch helper
|
||||
against this adopted ArgoCD application. Perform one reviewed worker rollout
|
||||
to refresh envFrom only after source and ESO prerequisites; compare new pod
|
||||
start to ESO refresh and run this inspector again. Secret object bodies are
|
||||
never diagnostic output.
|
||||
|
||||
Require safe non-secret post-rollout source digests and readiness plus an
|
||||
owner-approved existing bounded backup run/provider receipt before claiming
|
||||
activity delivery acceptance. No automatic scheduled backup invocation, new
|
||||
operation admission, restore capability or customer recovery readiness is
|
||||
claimed. T02/T03/T05 keep their separate existing dependencies.
|
||||
|
||||
|
||||
Read-only inspection receipt (2026-10-03T19:47:12Z): ESO Ready, last refresh
|
||||
19:29:02Z. Source common SHA256
|
||||
`09f349ae815339732db505d6896fb1ca384be7c66b40574750a3ba30d4d922e0`;
|
||||
immutable bundle common and both mounted Forgejo/CNPG libraries differ. No
|
||||
secret object read, provider probe or live mutation performed. Three injected
|
||||
inspection checks passed: current/stale source, delivery versus credential
|
||||
proof, and wrong-cluster refusal. `git diff --check` passed.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue