Prepare bounded custody repair for completed backup evidence
Some checks failed
Use-case regression gate / usecase-regressions (push) Has been cancelled
Some checks failed
Use-case regression gate / usecase-regressions (push) Has been cancelled
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a18e2d-f513-7742-b8e7-12af0b744ff3
This commit is contained in:
parent
7077ca9db0
commit
08906da7d0
7 changed files with 1149 additions and 3 deletions
|
|
@ -0,0 +1,146 @@
|
|||
{
|
||||
"schema": "coulomb.completed-backup-evidence-custody-preflight.v1",
|
||||
"observed_at": "2026-10-31T11:20:38.284348+00:00",
|
||||
"targets": [
|
||||
{
|
||||
"relative_path": "releases",
|
||||
"kind": "directory",
|
||||
"mode": "0o755",
|
||||
"uid": 0,
|
||||
"gid": 0,
|
||||
"nlink": 4,
|
||||
"bytes": 4096,
|
||||
"inode": 543834,
|
||||
"device": 2049,
|
||||
"mtime_ns": 1793430825511133103,
|
||||
"sha256": "3190439b978096a16c28aa0dd6b372735594808217b59a01dadbbe744d4110c8",
|
||||
"hash_kind": "directory-entry-names"
|
||||
},
|
||||
{
|
||||
"relative_path": "releases/9f1daf6c5fb56b2b4fc9817f28f5ad090c884b0295f7d6f4469e42d48fa8d59f/capsule/charts",
|
||||
"kind": "directory",
|
||||
"mode": "0o755",
|
||||
"uid": 0,
|
||||
"gid": 0,
|
||||
"nlink": 3,
|
||||
"bytes": 4096,
|
||||
"inode": 549330,
|
||||
"device": 2049,
|
||||
"mtime_ns": 1793430825511133103,
|
||||
"sha256": "6b8295661773cb5820c305091679383b09fb0d7dcdde4412eeae48bfabab28b5",
|
||||
"hash_kind": "directory-entry-names"
|
||||
},
|
||||
{
|
||||
"relative_path": "releases/9f1daf6c5fb56b2b4fc9817f28f5ad090c884b0295f7d6f4469e42d48fa8d59f/capsule/release",
|
||||
"kind": "directory",
|
||||
"mode": "0o755",
|
||||
"uid": 0,
|
||||
"gid": 0,
|
||||
"nlink": 3,
|
||||
"bytes": 4096,
|
||||
"inode": 549341,
|
||||
"device": 2049,
|
||||
"mtime_ns": 1793430825512133101,
|
||||
"sha256": "25a35515bc386a0c0a1a91b5fa3c966fffad64e2ce1d8bde35959bc164b11d79",
|
||||
"hash_kind": "directory-entry-names"
|
||||
},
|
||||
{
|
||||
"relative_path": "releases/5fd7ccd8f68057346367d81efb82b48280a16dd31d87683a5bd83e60e3d1837e/capsule/charts",
|
||||
"kind": "directory",
|
||||
"mode": "0o755",
|
||||
"uid": 0,
|
||||
"gid": 0,
|
||||
"nlink": 3,
|
||||
"bytes": 4096,
|
||||
"inode": 549219,
|
||||
"device": 2049,
|
||||
"mtime_ns": 1793406468579820277,
|
||||
"sha256": "6b8295661773cb5820c305091679383b09fb0d7dcdde4412eeae48bfabab28b5",
|
||||
"hash_kind": "directory-entry-names"
|
||||
},
|
||||
{
|
||||
"relative_path": "date-operations/47829c7ac2e6fd2c81fde1c914aec7c6e433098fa66985db6cfb9b34069942dc/private",
|
||||
"kind": "directory",
|
||||
"mode": "0o700",
|
||||
"uid": 10001,
|
||||
"gid": 10001,
|
||||
"nlink": 2,
|
||||
"bytes": 4096,
|
||||
"inode": 549263,
|
||||
"device": 2049,
|
||||
"mtime_ns": 1793412565567095985,
|
||||
"sha256": "384eaf76c1a05ea25236c7a0d7bee390638b68fc89186604def37028364992fb",
|
||||
"hash_kind": "directory-entry-names"
|
||||
},
|
||||
{
|
||||
"relative_path": "date-operations/47829c7ac2e6fd2c81fde1c914aec7c6e433098fa66985db6cfb9b34069942dc/private/result.json",
|
||||
"kind": "regular",
|
||||
"mode": "0o600",
|
||||
"uid": 10001,
|
||||
"gid": 10001,
|
||||
"nlink": 1,
|
||||
"bytes": 455,
|
||||
"inode": 549311,
|
||||
"device": 2049,
|
||||
"mtime_ns": 1793412565564096058,
|
||||
"sha256": "859e5a80442ad77b5eff61b68e5062a167d51f5db1b6c2d1ee064db977beb022",
|
||||
"hash_kind": "file-bytes"
|
||||
},
|
||||
{
|
||||
"relative_path": "date-operations/47829c7ac2e6fd2c81fde1c914aec7c6e433098fa66985db6cfb9b34069942dc/private/journal.json",
|
||||
"kind": "regular",
|
||||
"mode": "0o600",
|
||||
"uid": 10001,
|
||||
"gid": 10001,
|
||||
"nlink": 1,
|
||||
"bytes": 12930,
|
||||
"inode": 549315,
|
||||
"device": 2049,
|
||||
"mtime_ns": 1793412565062108322,
|
||||
"sha256": "fef62ad9317066d5d82eccbea0317eceb2f883e07f50935104e47113855fe0dd",
|
||||
"hash_kind": "file-bytes"
|
||||
},
|
||||
{
|
||||
"relative_path": "date-operations/47829c7ac2e6fd2c81fde1c914aec7c6e433098fa66985db6cfb9b34069942dc/private/execute.lock",
|
||||
"kind": "regular",
|
||||
"mode": "0o600",
|
||||
"uid": 10001,
|
||||
"gid": 10001,
|
||||
"nlink": 1,
|
||||
"bytes": 0,
|
||||
"inode": 549310,
|
||||
"device": 2049,
|
||||
"mtime_ns": 1793412563167160722,
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
|
||||
"hash_kind": "file-bytes"
|
||||
}
|
||||
],
|
||||
"receipts": [
|
||||
{
|
||||
"relative_path": "releases/5fd7ccd8f68057346367d81efb82b48280a16dd31d87683a5bd83e60e3d1837e/receipt.json",
|
||||
"sha256": "cc3de724f8bcd6b19b5d9fd7a3ea93ab342c9865da0f0cb29a011f8d80358534",
|
||||
"terminal_status": "storage_candidate_deployed_verified",
|
||||
"pid": 2724118,
|
||||
"pid_absent": true
|
||||
},
|
||||
{
|
||||
"relative_path": "releases/9f1daf6c5fb56b2b4fc9817f28f5ad090c884b0295f7d6f4469e42d48fa8d59f/receipt.json",
|
||||
"sha256": "7c8a953f55b38ee86266d279cb571b5d6795e8afb7dd6780ce1d052d435fbcca",
|
||||
"terminal_status": "image_candidate_deployed_verified",
|
||||
"pid": 3639216,
|
||||
"pid_absent": true
|
||||
},
|
||||
{
|
||||
"relative_path": "date-operations/47829c7ac2e6fd2c81fde1c914aec7c6e433098fa66985db6cfb9b34069942dc/receipt.json",
|
||||
"sha256": "851b0d39ec26804882703ba4792a3439f2821c5ce5c5fbe945934f6575ddb00e",
|
||||
"terminal_status": "completed",
|
||||
"pid": 2951460,
|
||||
"pid_absent": true
|
||||
}
|
||||
],
|
||||
"historical_helper_absent": true,
|
||||
"state_hostpath_mounts": [],
|
||||
"locks_acquired_and_released": true,
|
||||
"modified": false,
|
||||
"private_bytes_printed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,117 @@
|
|||
# Completed backup evidence custody repair
|
||||
|
||||
This is the exact proposed repair for the eight historical metadata exceptions
|
||||
recorded in CSOC-WP-0012-T04. Native preflight passes. **Nothing has been changed.**
|
||||
|
||||
Proposal:
|
||||
`sha256:fa2763d1dcbe92fe638a29c9a7a7d51c03d30849c4232f2d43f81ef705bae611`.
|
||||
|
||||
## Exact change
|
||||
|
||||
Within `/var/lib/coulomb-social-backup/`, change:
|
||||
|
||||
| Entries | Before | After |
|
||||
| --- | --- | --- |
|
||||
| `releases` and the three enumerated historical capsule directories | root:root0755 | root:root0700 |
|
||||
| Completed date operation's `private` directory |10001:10001,0700 | root:root0700 |
|
||||
| Its `result.json`, `journal.json`, `execute.lock` |10001:10001,0600 | root:root0600 |
|
||||
|
||||
The complete eight-path list, inode/device/mtime, modes/owners and content or
|
||||
directory-entry hashes are in
|
||||
`backup-completed-evidence-custody-preflight-2026-10-31.json`. The date operation
|
||||
is47829c7a; the historical releases are5fd7ccd8 and9f1daf6c. No path is moved,
|
||||
file body rewritten, backup removed, application paused or timer activated.
|
||||
|
||||
The UID10001 entries were the temporary helper's execution journal. Its source
|
||||
requires that owner while operating. This proposal transfers the **completed**
|
||||
records to root custody only after exact terminal receipt, absent process/helper,
|
||||
unmounted state and operation-lock checks. It does not generalize the change to
|
||||
other helper directories. The original ownership remains in the repair journal
|
||||
for explicit restoration if an authorized later review requires it.
|
||||
|
||||
The strict backup capacity guard is unchanged. Successful execution also runs its
|
||||
existing state-usage/custody check over the entire state tree. This is neither a
|
||||
blanket chmod/chown nor an exception that omits historical data from accounting.
|
||||
|
||||
## Founder terminal command
|
||||
|
||||
Run this from the workstation after reviewing the scope above:
|
||||
|
||||
```bash
|
||||
python3 /home/worsch/coulomb-social/scripts/seal-backup-evidence.py \
|
||||
--execute --expect-digest sha256:fa2763d1dcbe92fe638a29c9a7a7d51c03d30849c4232f2d43f81ef705bae611
|
||||
```
|
||||
|
||||
At the prompt, enter:
|
||||
|
||||
```text
|
||||
SEAL sha256:fa2763d1dcbe92fe638a29c9a7a7d51c03d30849c4232f2d43f81ef705bae611
|
||||
```
|
||||
|
||||
Expected status: `completed_evidence_private_root_custody_verified`, eight entries
|
||||
verified and `postflight.whole_state_custody_guard_passed: true`. Paste the result
|
||||
back for independent readback. The private durable receipt is:
|
||||
|
||||
`/var/lib/coulomb-social-backup-custody/fa2763d1dcbe92fe638a29c9a7a7d51c03d30849c4232f2d43f81ef705bae611/receipt.json`.
|
||||
|
||||
The [supervision decision](/home/worsch/the-custodian/docs/agent-autonomy-decision.md)
|
||||
requires: “The supervisor approves that proposal or performs it through the
|
||||
privileged execution path.” This is a new, exact historical ownership/mode change;
|
||||
it is not covered by approval of an SMTP recipient or recurring schedule. The
|
||||
entry point requires the founder terminal and exact digest. No new credential
|
||||
grant is requested.
|
||||
|
||||
Offline review uses the same command without flags. Read-only native preflight
|
||||
uses `--preflight`. Any source, capacity-guard, metadata or receipt change changes
|
||||
the proposal or refuses the preflight; do not bypass a changed digest.
|
||||
|
||||
## Verification, interruption and rollback
|
||||
|
||||
The operation takes the date supervisor, backup, snapshot and helper execute
|
||||
locks without replacing/truncating them. It verifies the pinned cluster, inactive
|
||||
timers, three unchanged terminal receipts and absent historical PIDs. It refuses
|
||||
the original helper by name/UID or any pod hostPath overlapping the state tree.
|
||||
All eight fingerprints are checked before mutation. Each metadata change is
|
||||
journaled and fsynced before descriptor-based chown/chmod. Symlink ancestors,
|
||||
hardlinks, changed bytes/children, replaced inodes and unknown paths refuse.
|
||||
|
||||
Afterward, all eight complete fingerprints must match the expected ownership/
|
||||
mode changes with unchanged hashes, sizes, paths, device/inodes and mtimes.
|
||||
Native process/helper/timer checks repeat and the unchanged whole-state custody
|
||||
guard must pass before success is recorded. Receipts contain metadata/hashes,
|
||||
not historical journal bodies. The new repair journal is private and outside the
|
||||
backup state tree so it cannot alter the reviewed historical directory listings.
|
||||
|
||||
On lost connection or failure, inspect the retained receipt and native process
|
||||
state first. A partially completed seal is not replayed: the attempt directory
|
||||
refuses another installation. The explicit rollback entry point is the same
|
||||
command with `--rollback` instead of `--execute`, and confirmation
|
||||
`ROLLBACK <same-full-digest>`. It restores only the recorded original metadata,
|
||||
after the same terminal/inactive/lock checks, and refuses content or inode drift.
|
||||
Earlier receipts remain nested in the rollback journal. Returning the old metadata
|
||||
also restores the original capacity-guard refusal; rollback is not backup readiness.
|
||||
|
||||
Cost: no new service, storage purchase, provider request or runtime allocation;
|
||||
existing-node execution and operator time are unpriced. Risk is loss of the retired
|
||||
helper UID's access if its supposedly completed operation were still needed.
|
||||
Terminal/helper/lock checks and explicit metadata rollback bound that risk;
|
||||
production file content and database writes are not part of this operation.
|
||||
|
||||
## Evidence and remaining scope
|
||||
|
||||
Native metadata/fence observation and the final read-only preflight pass. The
|
||||
validation companion `backup-completed-evidence-custody-validation-2026-10-31.json`
|
||||
records509 passing full-gate tests, zero failures/errors/skips and source hashes.
|
||||
Nineteen dedicated cases exercise real metadata/lock IO, preserved bytes/paths,
|
||||
explicit/partial rollback, interference refusal, source/digest boundaries,
|
||||
nonterminal refusal, and native receipt/process/helper/mount/cluster/timer guards.
|
||||
|
||||
This resolves only the current custody mismatch after attended success. T04 still
|
||||
owns retention/capacity admission and historical-copy disposition. Preventing
|
||||
future release/date producers from reintroducing these metadata mismatches is also
|
||||
live T04 work before recurring service acceptance: nested release directory
|
||||
creation currently uses default intermediate modes, and date helper journals
|
||||
retain the execution UID after completion. Do not silently change frozen capsules.
|
||||
T07 still needs the existing route execution; T08 then needs inactive installation
|
||||
and independent readback. No native backup-operation or migration acceptance is
|
||||
inferred from this repair.
|
||||
|
|
@ -0,0 +1,55 @@
|
|||
{
|
||||
"schema": "coulomb.completed-evidence-custody-validation.v1",
|
||||
"completed_at": "2026-10-31T11:31:08.384781+00:00",
|
||||
"proposal": {
|
||||
"status": "prepared",
|
||||
"proposal_digest": "sha256:fa2763d1dcbe92fe638a29c9a7a7d51c03d30849c4232f2d43f81ef705bae611",
|
||||
"entries": 8,
|
||||
"permission_or_ownership_changed": false
|
||||
},
|
||||
"native_preflight": {
|
||||
"status": "completed_evidence_seal_preflight_verified",
|
||||
"proposal_digest": "sha256:fa2763d1dcbe92fe638a29c9a7a7d51c03d30849c4232f2d43f81ef705bae611",
|
||||
"entries": 8,
|
||||
"modified": false,
|
||||
"historical_operations_terminal": true
|
||||
},
|
||||
"files": [
|
||||
{
|
||||
"path": "scripts/backup_custody.py",
|
||||
"sha256": "4fcb3a347b2d0029866d077a2554776d2a86e32d95d22d5b7a6296481c8b2b80"
|
||||
},
|
||||
{
|
||||
"path": "scripts/seal-backup-evidence.py",
|
||||
"sha256": "c2c33f90ae5736f1a5b96f6298330fa82cfdf8cfab48e7bdd197da693b2e645d"
|
||||
},
|
||||
{
|
||||
"path": "scripts/backup_capacity.py",
|
||||
"sha256": "cb699a79e67b129239b5aa5d6f3b0d4ffaa9773a8b073227ad17fdecb5b9d893"
|
||||
},
|
||||
{
|
||||
"path": "tests/test_backup_custody.py",
|
||||
"sha256": "9dcde8abf077eaafa08028e0a6017c4309115444f2f5d1c8c4dbabd841517f73"
|
||||
},
|
||||
{
|
||||
"path": "docs/release/backup-completed-evidence-custody-preflight-2026-10-31.json",
|
||||
"sha256": "96a5ab46fea2bbc00b574e66ee416665e3b619282f1b72f42b5387b8bf8f46f3"
|
||||
}
|
||||
],
|
||||
"full_gate": {
|
||||
"command": "make check",
|
||||
"tests": 509,
|
||||
"failures": 0,
|
||||
"errors": 0,
|
||||
"skipped": 0,
|
||||
"warnings": 69,
|
||||
"junit_sha256": "6355aed63340b021b9f4163d6a1572e15d7d8a18d6614bcffc8896e9c94354ef",
|
||||
"log_sha256": "93603f9df00147a2cdc8138e03dc629f2a7ef877ac2ef1281b06bab5825064bc"
|
||||
},
|
||||
"dedicated_custody_tests": 19,
|
||||
"ownership_changed": false,
|
||||
"permissions_changed": false,
|
||||
"private_journal_bodies_printed": false,
|
||||
"historical_data_deleted": false,
|
||||
"timers_activated": false
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue