From c1533fe30babedb8620058d534d5decbc14bfc65 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 9 Oct 2026 00:01:51 +0200 Subject: [PATCH] Publish backup-daily workload declaration for atm-backup-daily (ACTIVITY-WP-0042-T03) The founder confirmed on 2026-10-08, relayed by ops-warden, that the daily-cnpg-option-a-backup worker is the atm-backup-daily unit. Declare workload identity backup-daily with membership z2-protected (confidential/high, M1, below floor: an honest gap). ops-warden consumes it under WARDEN-WP-0040-T02. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 344895@bnt-lap001 Assistant-Session: 0e75091f-d556-49a1-a38a-0595555f2870 --- declarations/backup-daily/tenancy.yaml | 123 ++++++++++++++++++ ...form-backup-restore-evidence-scheduling.md | 19 ++- 2 files changed, 138 insertions(+), 4 deletions(-) create mode 100644 declarations/backup-daily/tenancy.yaml diff --git a/declarations/backup-daily/tenancy.yaml b/declarations/backup-daily/tenancy.yaml new file mode 100644 index 0000000..718f42f --- /dev/null +++ b/declarations/backup-daily/tenancy.yaml @@ -0,0 +1,123 @@ +# backup-daily workload identity and security-zone declaration +# Standard: net-kingdom/canon/standards/security-zones_v0.1.md ยง6 +# (independently governed operational execution unit, declared directly in its +# responsible repo; not a managed rapp deployable) +# Conformance rule: accuracy, not altitude. Nothing here is aspirational. +# +# Founder confirmed on 2026-10-08 (relayed by ops-warden, hub msg 49292aca) that +# activity-core's daily-cnpg-option-a-backup worker is the unit the ops-warden +# actor atm-backup-daily stands for; classification ordinary, not z2-continuity. +# Consumer: ops-warden WARDEN-WP-0040-T02 (declaration_ref to this file). +# Tenancy axes are graded conservatively for a scheduled batch unit with no +# inbound callers and no datastore of its own. + +schema_version: "0.1" +framework: netkingdom-tenancy-posture +service: backup-daily +role: scheduled-backup-execution + +workload_identity: + name: backup-daily + kind: maintenance-job + responsible_repo: activity-core + # The activity-core Temporal worker on railiance01 executing the daily-cnpg- + # option-a-backup ActivityDefinition: the code-registered bounded operation + # cnpg_option_a_backup (ACT-ADR-007), which calls railiance-platform's cnpg- + # option-a-backup tool to age-encrypt logical dumps of r01-forgejo-db, + # r01-net-kingdom-pg and r01-state-hub-db and upload them to the Nextcloud + # offsite lane. It never restores. + identity_bindings: + - scheme: ssh-certificate + authority: ops-warden + subject: atm-backup-daily + # atm-* is a non-human automation actor; the schema offers service|agent. + principal_type: service + environment: prod + - scheme: kubernetes-service-account + authority: railiance01 + # The worker Deployment sets no serviceAccountName; it runs as the + # namespace default SA, which the databases-namespace RoleBinding names. + subject: system:serviceaccount:activity-core:default + principal_type: service + environment: prod + +tenancy: + current: + I: "n/a" + A: "n/a" + E: 0 + P: "n/a" + R: "n/a" + V: 0 + target: + I: "n/a" + A: "n/a" + E: 0 + P: "n/a" + R: "n/a" + V: 0 + reviewed: "2026-10-09" + review_due: "2027-04-09" + service_class: batch + permanent: [I, A, P, R] + + gap: + I: >- + n/a. The unit has no inbound request surface: a Temporal Schedule fires + it. No caller presents an identity for it to verify. + A: >- + n/a, on the same ground as I. There is no request to bind to a tenant. + Execution authority is the code-registered operation (ACT-ADR-007) and + the databases-namespace RoleBinding, not a per-request decision. + E: >- + E0. One process dumps several owners' databases (Forgejo, net-kingdom, + State Hub) with no tenant partitioning between them. This is + accurate. A backup sweep has no tenant-scoped choke point to build. + P: >- + n/a. No primary datastore. Dumps are transient in the worker and are + uploaded encrypted to the railiance-platform-owned offsite lane. + R: >- + n/a. Nothing is held at rest here. Retention of the uploaded artifacts + belongs to the offsite lane's owner (railiance-platform). + V: >- + V0. One worker on the single-node railiance01 reef, misfire policy + skip, and no exercised recovery objective for the job itself. + +zones: + standard: security-zones_v0.1 + membership: z2-protected + responsible_party: activity-core + justification: >- + The unit runs in prod and holds plaintext logical dumps of production + databases (Forgejo, net-kingdom, State Hub) before encryption, so its + context is confidential data at high criticality, which floors at M2. + It is ordinary, not z2-continuity: losing a nightly run delays an RPO + point but breaks no access or recovery path. Declared M1 is below the M2 + floor, so admission is expected to resolve below-floor and the effective + zone stays unknown until M2 evidence (SLO history, on-call, incident + readiness) exists. This is a recorded gap, not a claim of admission. + context: + maturity: M1 + criticality: high + data_classification: confidential + evidence: + - ref: activity-definitions/daily-cnpg-option-a-backup.md + supports: [prod-schedule, targets, non-secret-evidence-sink] + - ref: k8s/railiance/26-worker-cnpg-backup-rbac.yaml + supports: [service-account-binding, databases-exec-scope] + - ref: docs/adr/adr-007-bounded-operations.md + supports: [bounded-operation, no-general-executor] + - ref: docs/runbook.md + supports: [M1, production-runbook] + reviewed: "2026-10-09" + review_due: "2027-01-09" + +notes: + - >- + Data classification is activity-core's conservative reading in the absence + of an owner-declared class for the source databases. If their owners + declare a lower class, re-review membership here as a reviewed change. + - >- + Maturity M1 rests on production operation, the runbook and the + deterministic automation-status surface; no formal promotion record exists + yet. diff --git a/workplans/ACTIVITY-WP-0042-platform-backup-restore-evidence-scheduling.md b/workplans/ACTIVITY-WP-0042-platform-backup-restore-evidence-scheduling.md index 8ec48de..d7c2e50 100644 --- a/workplans/ACTIVITY-WP-0042-platform-backup-restore-evidence-scheduling.md +++ b/workplans/ACTIVITY-WP-0042-platform-backup-restore-evidence-scheduling.md @@ -100,10 +100,9 @@ acceptance and live proof remain incomplete; T02 is not done. ```task id: ACTIVITY-WP-0042-T03 -status: wait -needs_human: true -decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e -blocking_reason: "Founder must confirm whether activity-core's backup worker is the atm-backup-daily unit before declaring to ops-warden." +status: done +needs_human: false +blocking_reason: null priority: low state_hub_task_id: "e1c313dc-9a94-5b7c-b406-604b700bf3eb" ``` @@ -117,6 +116,18 @@ otherwise the declaring owner is whoever holds the actor's issuance 2026-10-03: human gate routed to hub decision 89f1058f-33bc-47a8-8a49-0b44d426c67e (D2: ArgoCD owns production: go-ahead sequence for railiance-apps-root, issue-core, policy-nexus and activity-core automation) by CUST-WP-0075; resolving that decision raises C-40 here. +2026-10-09: done. The founder confirmed on 2026-10-08, in an ops-warden session +(hub msg 49292aca), that the `daily-cnpg-option-a-backup` worker is the +`atm-backup-daily` unit. Classification: ordinary, not z2-continuity. The +confirmation covers T03 only and does not resolve D2 (89f1058f). The decision +link is removed here because D2 still gates other tasks. Published +`declarations/backup-daily/tenancy.yaml` (workload `backup-daily`; bindings +ssh-cert `atm-backup-daily` and SA `activity-core:default`). The founder chose +membership `z2-protected` with context confidential/high/M1, so admission is +expected to resolve below-floor (effective `unknown`) until M2 evidence exists. +This is a recorded gap, not a claim of admission. Validated with the +net-kingdom tenancy-posture validator. ops-warden compiles it under +WARDEN-WP-0040-T02. ## Prepare the concrete scheduling and runner proposal