diff --git a/docs/release/backup-public-recipient-delivery-2026-10-29.json b/docs/release/backup-public-recipient-delivery-2026-10-29.json new file mode 100644 index 0000000..ce196e2 --- /dev/null +++ b/docs/release/backup-public-recipient-delivery-2026-10-29.json @@ -0,0 +1,13 @@ +{ + "status": "public_recipient_delivered", + "outcome": "created", + "cluster_uid_verified": true, + "source_guard_verified": true, + "root_owned": true, + "mode": "0600", + "public_recipient": "age1qm30jk8q0cezey652dk2dhcr3d9vs528v6lg8mavl6d4q3e3vgnqmrmyy3", + "readback_equal": true, + "private_identity_installed": false, + "capture_performed": false, + "timers_activated": false +} diff --git a/docs/release/recovery-api-bootstrap-2026-10-29.json b/docs/release/recovery-api-bootstrap-2026-10-29.json new file mode 100644 index 0000000..16fe786 --- /dev/null +++ b/docs/release/recovery-api-bootstrap-2026-10-29.json @@ -0,0 +1,445 @@ +{ + "programmatic_direction_reference": "6139e02b-3fb7-4eff-be8a-efe127c45ce5", + "applications": { + "bootstrap": "2a355842-e03b-42a3-8af7-6cd8f8b98bcd", + "custodian": "f80037a2-87c9-44d2-9163-3e6907af3ced", + "reader": "7a4055fc-a3f5-40bf-8013-cd0eec9028de" + }, + "automatic_expiry_enabled": false, + "bootstrap_key_revoked_verified": true, + "buckets": { + "railiance-coulomb-social-archives": { + "created": true, + "lifecycle_rules": [], + "policy": { + "Id": "coulomb-independent-recovery", + "Statement": [ + { + "Action": "s3:*", + "Effect": "Allow", + "Principal": { + "SCW": "user_id:3d029efb-4f70-4f82-a3bb-cefbe255232b" + }, + "Resource": [ + "railiance-coulomb-social-archives", + "railiance-coulomb-social-archives/*" + ], + "Sid": "PlatformOwner" + }, + { + "Action": "s3:*", + "Effect": "Allow", + "Principal": { + "SCW": "application_id:2a355842-e03b-42a3-8af7-6cd8f8b98bcd" + }, + "Resource": [ + "railiance-coulomb-social-archives", + "railiance-coulomb-social-archives/*" + ], + "Sid": "TemporaryConstruction" + }, + { + "Action": [ + "s3:GetObject", + "s3:GetObjectVersion" + ], + "Effect": "Allow", + "Principal": { + "SCW": "application_id:7a4055fc-a3f5-40bf-8013-cd0eec9028de" + }, + "Resource": "railiance-coulomb-social-archives/archives/*", + "Sid": "readerObjects" + }, + { + "Action": [ + "s3:ListBucket", + "s3:ListBucketVersions" + ], + "Condition": { + "StringLike": { + "s3:prefix": [ + "archives/", + "archives/*" + ] + } + }, + "Effect": "Allow", + "Principal": { + "SCW": "application_id:7a4055fc-a3f5-40bf-8013-cd0eec9028de" + }, + "Resource": "railiance-coulomb-social-archives", + "Sid": "readerList" + }, + { + "Action": [ + "s3:GetObject", + "s3:GetObjectVersion", + "s3:PutObject" + ], + "Effect": "Allow", + "Principal": { + "SCW": "application_id:f80037a2-87c9-44d2-9163-3e6907af3ced" + }, + "Resource": "railiance-coulomb-social-archives/archives/*", + "Sid": "custodianObjects" + }, + { + "Action": [ + "s3:ListBucket", + "s3:ListBucketVersions" + ], + "Condition": { + "StringLike": { + "s3:prefix": [ + "archives/", + "archives/*" + ] + } + }, + "Effect": "Allow", + "Principal": { + "SCW": "application_id:f80037a2-87c9-44d2-9163-3e6907af3ced" + }, + "Resource": "railiance-coulomb-social-archives", + "Sid": "custodianList" + }, + { + "Action": [ + "s3:GetObject", + "s3:GetObjectVersion", + "s3:PutObject", + "s3:AbortMultipartUpload", + "s3:ListMultipartUploadParts" + ], + "Effect": "Allow", + "Principal": { + "SCW": "application_id:681d00bf-b965-4323-b657-97bfde423511" + }, + "Resource": "railiance-coulomb-social-archives/archives/*", + "Sid": "publisherObjects" + }, + { + "Action": [ + "s3:ListBucket", + "s3:ListBucketVersions" + ], + "Condition": { + "StringLike": { + "s3:prefix": [ + "archives/", + "archives/*" + ] + } + }, + "Effect": "Allow", + "Principal": { + "SCW": "application_id:681d00bf-b965-4323-b657-97bfde423511" + }, + "Resource": "railiance-coulomb-social-archives", + "Sid": "publisherList" + }, + { + "Action": [ + "s3:GetBucketLocation", + "s3:GetBucketVersioning", + "s3:GetLifecycleConfiguration" + ], + "Effect": "Allow", + "Principal": { + "SCW": [ + "application_id:7a4055fc-a3f5-40bf-8013-cd0eec9028de", + "application_id:f80037a2-87c9-44d2-9163-3e6907af3ced", + "application_id:681d00bf-b965-4323-b657-97bfde423511" + ] + }, + "Resource": "railiance-coulomb-social-archives", + "Sid": "ArchiveMetadata" + } + ], + "Version": "2023-04-17" + }, + "public_acl_absent": true, + "versioning": "Enabled" + }, + "railiance-coulomb-social-recovery": { + "created": true, + "lifecycle_rules": [], + "policy": { + "Id": "coulomb-independent-recovery", + "Statement": [ + { + "Action": "s3:*", + "Effect": "Allow", + "Principal": { + "SCW": "user_id:3d029efb-4f70-4f82-a3bb-cefbe255232b" + }, + "Resource": [ + "railiance-coulomb-social-recovery", + "railiance-coulomb-social-recovery/*" + ], + "Sid": "PlatformOwner" + }, + { + "Action": "s3:*", + "Effect": "Allow", + "Principal": { + "SCW": "application_id:2a355842-e03b-42a3-8af7-6cd8f8b98bcd" + }, + "Resource": [ + "railiance-coulomb-social-recovery", + "railiance-coulomb-social-recovery/*" + ], + "Sid": "TemporaryConstruction" + }, + { + "Action": [ + "s3:GetObject", + "s3:GetObjectVersion" + ], + "Effect": "Allow", + "Principal": { + "SCW": "application_id:7a4055fc-a3f5-40bf-8013-cd0eec9028de" + }, + "Resource": "railiance-coulomb-social-recovery/kits/*", + "Sid": "readerObjects" + }, + { + "Action": [ + "s3:ListBucket", + "s3:ListBucketVersions" + ], + "Condition": { + "StringLike": { + "s3:prefix": [ + "kits/", + "kits/*" + ] + } + }, + "Effect": "Allow", + "Principal": { + "SCW": "application_id:7a4055fc-a3f5-40bf-8013-cd0eec9028de" + }, + "Resource": "railiance-coulomb-social-recovery", + "Sid": "readerList" + }, + { + "Action": [ + "s3:GetBucketLocation", + "s3:GetBucketVersioning", + "s3:GetLifecycleConfiguration" + ], + "Effect": "Allow", + "Principal": { + "SCW": "application_id:7a4055fc-a3f5-40bf-8013-cd0eec9028de" + }, + "Resource": "railiance-coulomb-social-recovery", + "Sid": "readerMetadata" + }, + { + "Action": [ + "s3:GetObject", + "s3:GetObjectVersion", + "s3:PutObject" + ], + "Effect": "Allow", + "Principal": { + "SCW": "application_id:f80037a2-87c9-44d2-9163-3e6907af3ced" + }, + "Resource": "railiance-coulomb-social-recovery/kits/*", + "Sid": "custodianObjects" + }, + { + "Action": [ + "s3:ListBucket", + "s3:ListBucketVersions" + ], + "Condition": { + "StringLike": { + "s3:prefix": [ + "kits/", + "kits/*" + ] + } + }, + "Effect": "Allow", + "Principal": { + "SCW": "application_id:f80037a2-87c9-44d2-9163-3e6907af3ced" + }, + "Resource": "railiance-coulomb-social-recovery", + "Sid": "custodianList" + }, + { + "Action": [ + "s3:GetBucketLocation", + "s3:GetBucketVersioning", + "s3:GetLifecycleConfiguration" + ], + "Effect": "Allow", + "Principal": { + "SCW": "application_id:f80037a2-87c9-44d2-9163-3e6907af3ced" + }, + "Resource": "railiance-coulomb-social-recovery", + "Sid": "custodianMetadata" + } + ], + "Version": "2023-04-17" + }, + "public_acl_absent": true, + "versioning": "Enabled" + } + }, + "completed_at": "2026-10-29T20:59:12.852425+00:00", + "decision": "27bbc1ac-e275-42be-ba34-6cf16eae4e78", + "native_application_recovery_verified": false, + "native_checks": { + "archives_custodian_delete": { + "denied": true, + "http_status": 403 + }, + "archives_custodian_outside_prefix": { + "denied": true, + "http_status": 403 + }, + "archives_custodian_policy_write": { + "denied": true, + "http_status": 403 + }, + "archives_publisher_delete": { + "denied": true, + "http_status": 403 + }, + "archives_publisher_outside_prefix": { + "denied": true, + "http_status": 403 + }, + "archives_publisher_policy_write": { + "denied": true, + "http_status": 403 + }, + "archives_reader_delete": { + "denied": true, + "http_status": 403 + }, + "archives_reader_outside_prefix": { + "denied": true, + "http_status": 403 + }, + "archives_reader_policy_write": { + "denied": true, + "http_status": 403 + }, + "archives_reader_put": { + "denied": true, + "http_status": 403 + }, + "archives_reader_version_get_hash": { + "verified": true, + "version_id": "1793307392673579" + }, + "custodian_iam_admin": { + "denied": true, + "http_status": 403 + }, + "kits_custodian_delete": { + "denied": true, + "http_status": 403 + }, + "kits_custodian_outside_prefix": { + "denied": true, + "http_status": 403 + }, + "kits_custodian_policy_write": { + "denied": true, + "http_status": 403 + }, + "kits_publisher_delete": { + "denied": true, + "http_status": 403 + }, + "kits_publisher_outside_prefix": { + "denied": true, + "http_status": 403 + }, + "kits_publisher_policy_write": { + "denied": true, + "http_status": 403 + }, + "kits_reader_delete": { + "denied": true, + "http_status": 403 + }, + "kits_reader_outside_prefix": { + "denied": true, + "http_status": 403 + }, + "kits_reader_policy_write": { + "denied": true, + "http_status": 403 + }, + "kits_reader_put": { + "denied": true, + "http_status": 403 + }, + "kits_reader_version_get_hash": { + "verified": true, + "version_id": "1793307384956710" + }, + "publisher_create_readback": { + "verified": true + }, + "publisher_escrow": { + "denied": true, + "http_status": 403 + }, + "publisher_iam_admin": { + "denied": true, + "http_status": 403 + }, + "publisher_own_multipart_abort": { + "verified": true + }, + "publisher_protected_kit_get": { + "denied": true, + "http_status": 403 + }, + "reader_escrow": { + "denied": true, + "http_status": 403 + }, + "reader_iam_admin": { + "denied": true, + "http_status": 403 + } + }, + "organization_wide_grants": false, + "personal_browser_context_closed": true, + "personal_state_saved": false, + "private_values_printed": false, + "project_id": "06d107bc-9d84-4672-b2a0-95701cc0c07f", + "project_only_policies_verified": 4, + "protected_secret_references": { + "coulomb-social-age-recovery": { + "id": "634e4b9f-0b61-4329-a83c-1ed0e76c4636", + "revision": 1 + }, + "coulomb-social-recovery-access-canary": { + "id": "db825503-cf12-4bfd-8cc5-f16d09edd8b5", + "revision": 1 + }, + "coulomb-social-recovery-custodian-api": { + "id": "cf44e9bd-9edc-450b-9f10-564ee3008305", + "revision": 1 + }, + "coulomb-social-recovery-reader-api": { + "id": "241742f7-d3b5-4163-8d87-3a3d9585778d", + "revision": 1 + } + }, + "public_recipient": "age1qm30jk8q0cezey652dk2dhcr3d9vs528v6lg8mavl6d4q3e3vgnqmrmyy3", + "publisher_pair_replaced": false, + "routine_age_and_both_pairs_retrieved_without_personal_session": true, + "schema": "platform.coulomb-recovery-bootstrap.v1", + "temporary_pair_removed": true, + "timers_activated": false +} diff --git a/docs/release/recovery-custody-review-2026-10-28.md b/docs/release/recovery-custody-review-2026-10-28.md index b2386e5..bcb984c 100644 --- a/docs/release/recovery-custody-review-2026-10-28.md +++ b/docs/release/recovery-custody-review-2026-10-28.md @@ -13,8 +13,13 @@ personal Console state is never a worker/runtime credential or the regular drill access method. Preserve node/workstation-loss independence for those credentials. Retire the temporary personal session after native programmatic access and custody are verified. This does not admit a standing organization-wide operator key or IAM -administration on the publisher. The first login attempt was aborted without -saving state; a fresh attended bootstrap browser is awaiting login confirmation. +administration on the publisher. Scoped API custody and thirty native boundary +checks are now verified (2026-10-29); the construction key was revoked and the +personal browser context closed without saved state. See +[execution evidence](recovery-api-bootstrap-2026-10-29.json). Routine access uses +the platform's application_recovery_access.py front door and public +coulomb-recovery-api.json contract. First application recovery, complete protected +kit, retention/capacity and monitored scheduling remain unproved. WP-0012 cannot accept the first offsite recovery point until its key, version receipt, image/tools and recovery read authority survive loss of both the primary diff --git a/workplans/CSOC-WP-0012-durable-recovery-service-readiness.md b/workplans/CSOC-WP-0012-durable-recovery-service-readiness.md index 881d388..89839b4 100644 --- a/workplans/CSOC-WP-0012-durable-recovery-service-readiness.md +++ b/workplans/CSOC-WP-0012-durable-recovery-service-readiness.md @@ -8,7 +8,7 @@ status: active owner: codex topic_slug: coulomb-social created: "2026-10-08" -updated: "2026-10-28" +updated: "2026-10-29" origin: residual origin_ref: CSOC-WP-0008 state_hub_workstream_id: "0cd1f513-f26e-5707-b646-8b4bbe6369fc" @@ -23,7 +23,7 @@ id: CSOC-WP-0012-T01 status: progress priority: high needs_human: true -intervention_note: "Independent recovery custody is approved (27bbc1ac-e275-42be-ba34-6cf16eae4e78); native provisioning needs an attended platform-owned Scaleway operator entry point. No repeat scope or schedule approval is needed." +intervention_note: "Scoped API custody is native-verified; no repeat scope/schedule approval or routine personal login is needed. Historical local production-pair copies still need explicit owner disposition. First app recovery, complete protected kit, retention/capacity and monitored scheduling remain open." state_hub_task_id: "dc470337-585f-517d-b2a5-92e89a7dbec8" ``` @@ -92,6 +92,32 @@ Stopped the aborted capture (terminal exit1, no state saved), then opened a fres attended browser and requested login confirmation. Routine operations must not depend on retaining that personal session. No provider resources created yet. +2026-10-29: Scoped API bootstrap is now native-verified. Isolated recovery project, +three dedicated applications, four project-only policies, two private/versioned +buckets and four protected nonexpiring secret versions are present. Independent +custodian API readback validates the dedicated age identity and both routine API +pairs without personal login. Thirty native checks prove version reads/listing, +publisher create/readback/own abort and denials on deletion, policy/IAM admin, +outside-prefix reads, publisher kit access, reader writes and escrow access by +publisher/reader (synthetic canary). Publisher pair unchanged; no org-wide grant. +The temporary construction key was revoked with GET404 verification, its pair +removed and the personal context closed without saved state. Routine front door +and public provider coordinates live in railiance-platform's +docs/credential-lane-designs/coulomb-recovery-api.{json,md}. Routine pair expiry is +2027-10-28; platform-root owns renewal before the recorded deadlines. + +Evidence: docs/release/recovery-api-bootstrap-2026-10-29.json. Synthetic objects +are boundary fixtures, not application recovery points. No automatic expiry, +capture, restore or timers activated. Full protected app kit/last recovered point, +retention/headroom, historical-pair disposition and first app recovery remain +open. Native bootstrap no longer requires the personal Console session. + +Delivered only the independently verified public recipient to the node's +root:root0600 recipient.env after cluster UID and installed guard hash checks; +equal readback and real age recipient validation pass. No private identity or +recovery API pair was installed there. Receipt: +docs/release/backup-public-recipient-delivery-2026-10-29.json. + ## T02 — Activate and prove the first encrypted paired recovery point ```task