diff --git a/docs/evidence/2026-09-11-factory-audit-delivery-login.json b/docs/evidence/2026-09-11-factory-audit-delivery-login.json new file mode 100644 index 0000000..1237b75 --- /dev/null +++ b/docs/evidence/2026-09-11-factory-audit-delivery-login.json @@ -0,0 +1,20 @@ +{ + "schema": "platform.factory-audit-delivery-attempt.v1", + "observed_at": "2026-09-11T08:06:20.638931+00:00", + "status": "login_failed_before_delivery_handoff", + "wrapper_exit": 5, + "delivery_receipt_created": false, + "delivery_command_executed": false, + "credential_values_emitted": false, + "remote_session_revocation": "unconfirmed_for_this_failed_login", + "permanent_custody": "preserved_version_1_registry_version_8", + "next_step": "Fresh attended delivery after browser/login feedback; do not seed or rotate again", + "validation": { + "delivery_contract_tests": 7, + "custody_tests": 18, + "custody_tests_using_real_local_openbao": 11 + }, + "platform_delivery_source": "44314cad3704bda40683383f898b55b1f41491bc", + "factory_attempts": 0, + "paid_calls": 0 +} diff --git a/docs/evidence/2026-09-11-factory-audit-sender-seed.json b/docs/evidence/2026-09-11-factory-audit-sender-seed.json new file mode 100644 index 0000000..70f28ee --- /dev/null +++ b/docs/evidence/2026-09-11-factory-audit-sender-seed.json @@ -0,0 +1,63 @@ +{ + "schema": "platform.factory-audit-custody.v1", + "status": "custody_seeded_pending_delivery_and_receiver_reload", + "credential_values_emitted": false, + "started_at": "2026-09-11T05:37:49.432171+00:00", + "lanes": [ + { + "ccr": "CCR-2026-0021", + "name": "approval-engine", + "kv": "platform/data/workloads/approval-engine/audit-sender", + "store": "openbao-approval-engine-audit", + "secret": "approval-engine-audit", + "secret_key": "audit-token", + "source_sha256": "ba69ecc8227c5bf887c2cd0ac4c50518c019bebfdfb6d49628edee1ce570da7d" + }, + { + "ccr": "CCR-2026-0022", + "name": "informed-decision", + "kv": "platform/data/workloads/informed-decision/audit-sender", + "store": "openbao-informed-decision-audit", + "secret": "informed-decision-audit", + "secret_key": "token", + "source_sha256": "2f7f7f214d1e21fd79275197edd03ee7e154ef451d62a182017926250515a6aa" + } + ], + "receiver": { + "image": "forgejo.coulomb.social/coulomb/audit-core@sha256:c82e0442de0fd181342916ae9cd5d6de41d859e1efda637bd93936c67873afa5", + "deployment_uid": "b85fe3d0-75c9-4e0d-8c34-c6f1df0881bb", + "deployment_resource_version": "59751057", + "pod_uid": "6642c414-a942-4b11-b048-267423e12da8", + "capabilities": { + "load_bearing": true, + "redact": true, + "write_only": true, + "source_exact": true, + "tenant_exact": true + }, + "synthetic_probe_only": true, + "credential_reads": 0 + }, + "phase": "registry_cas", + "registry_version_before": 7, + "seeded": [ + { + "ccr": "CCR-2026-0021", + "version": 1, + "request_id": "cf6dd167-9d37-fbcf-cc3d-6d54c0f988b9" + }, + { + "ccr": "CCR-2026-0022", + "version": 1, + "request_id": "2f373e63-058b-7a6e-07c4-365317dffa73" + } + ], + "registry_write_request_id": "91fdb393-80ba-4e06-2dde-3982763d0ae5", + "registry_version_after": 8, + "unchanged_other_senders": true, + "unchanged_other_registry_fields": true, + "credentials_reused": false, + "attended_wrapper_exit": 0, + "attended_session_self_revocation": "confirmed_by_successful_wrapper", + "prior_failed_login": "not asserted resolved by this new session" +} diff --git a/workplans/AUDIT-WP-0009-evidence-role-conformance.md b/workplans/AUDIT-WP-0009-evidence-role-conformance.md index 0a46e3c..390cb16 100644 --- a/workplans/AUDIT-WP-0009-evidence-role-conformance.md +++ b/workplans/AUDIT-WP-0009-evidence-role-conformance.md @@ -508,6 +508,26 @@ No sender custody receipt exists. T09/T11 remain progress for the attended retry, delivery and owner acceptance. [Native release receipt](../docs/evidence/2026-09-11-factory-receiver-live.json). +### Sender custody retry succeeded; delivery login remains — 2026-09-11 + +The successful attended platform retry created both independent version-1 +audit senders and updated the authoritative registry with CAS 7→8 while +preserving existing senders/fields. CCR-2026-0021/0022 are applied. The seed +session exited 0 and self-revoked. A separate attended delivery login exited 5 +before command handoff, with remote-session revocation unconfirmed; no ESO +delivery or receiver reload occurred. Receiver c82e0442 remains 1/1 Ready. +The old no-custody state above is superseded by the +[seed receipt](../docs/evidence/2026-09-11-factory-audit-sender-seed.json) and +[delivery return](../docs/evidence/2026-09-11-factory-audit-delivery-login.json). + +RPF-WP-0035-T08 owns fresh attended delivery and native reader/namespace +checks. T09/T11 retain real producer ingestion, duplicates, source/tenant/read +refusals, independent readback and bearer-revocation/operating acceptance. +Stored registry changes have not been claimed as a loaded receiver identity. +The reviewed Informed Decision cadence return declares the three classes at +86400 seconds and first heartbeat on activation; no native heartbeat is +claimed before activation. This does not close T12's independent attestation. + ## Operate the scheduled attestation and independent offsite return ```task