diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 27b9cde..33a89f7 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -177,7 +177,7 @@ | task | NK-WP-0045-T03 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | | task | NK-WP-0045-T04 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | | task | NK-WP-0045-T05 | progress | — | workplans/NK-WP-0045-root-grant-custody-record.md | -| task | NK-WP-0045-T06 | progress | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| task | NK-WP-0045-T06 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | | intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | | intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | | intake | NET-IN-0001 | open | — | intakes/intakes.md | diff --git a/docs/evidence/2026-10-03-root-custody-audit-correlation.json b/docs/evidence/2026-10-03-root-custody-audit-correlation.json new file mode 100644 index 0000000..b33d803 --- /dev/null +++ b/docs/evidence/2026-10-03-root-custody-audit-correlation.json @@ -0,0 +1,19 @@ +{ + "scope": "read-only-current-owner-audit-correlation", + "raw_logs_emitted": false, + "audit_tail_max_bytes": 67108864, + "transport_succeeded": true, + "read": { + "request_id": "91cd7235-9cfe-06c3-57a6-64a013d1cfcb", + "request_event_found": true, + "response_event_found": true, + "error_absent": true + }, + "login": { + "request_id": "29a2fac4-8108-7ca5-d0a6-682c4a31f48d", + "request_event_found": true, + "response_event_found": true, + "error_absent": true + }, + "ok": true +} diff --git a/docs/evidence/2026-10-03-root-grant-delivery-progress.md b/docs/evidence/2026-10-03-root-grant-delivery-progress.md index b3e81d6..3275f7f 100644 --- a/docs/evidence/2026-10-03-root-grant-delivery-progress.md +++ b/docs/evidence/2026-10-03-root-grant-delivery-progress.md @@ -152,3 +152,21 @@ Scratch copy/restore of baseline and immutable history verified content and permissions. Temporary daemon/storage were removed. No production snapshot or rollback was used. This proves the isolated recovery guard, not current provider backup coverage or the attended live-source restore check. + +## Final audit and recovery handoff + +The [safe audit receipt](2026-10-03-root-custody-audit-correlation.json) +independently correlates both consumer read/login request IDs with request and +response audit events and no errors. The bounded lookup inspected only the +latest 64 MiB of the owner audit file; raw audit records were never emitted. +This resolves audit correlation. + +USER-WP-0037-T02 is done, synced HEAD `d955cd7`; runtime workplan is finished, +synced HEAD `f108c65`. The remaining T05 gate is the attended producer recovery +finish helper: current retained-baseline/source match plus encrypted history +provider upload/download/decryption through the existing governed Nextcloud +Backup lane. Eighteen producer/finish tests passed. It preserves all backups and +uses a unique receipt/object. The surfaced historical backup-share URL is not +repeated or stored here; the helper compares it with the current lane only as a +boolean and stops for owner incident handling if they match. This unresolved +comparison is not represented as a harmless or rotated credential. diff --git a/workplans/NK-WP-0045-root-grant-custody-record.md b/workplans/NK-WP-0045-root-grant-custody-record.md index 99c8901..a3bb7a4 100644 --- a/workplans/NK-WP-0045-root-grant-custody-record.md +++ b/workplans/NK-WP-0045-root-grant-custody-record.md @@ -4,7 +4,7 @@ type: workplan title: "Make the platform-root custody record readable as a non-secret root-grant fact" domain: infotech repo: net-kingdom -status: active +status: blocked flavor: implementation owner: claude-code topic_slug: netkingdom @@ -115,9 +115,13 @@ answer fixes T05. ```task id: NK-WP-0045-T05 -status: progress +status: wait depends_on: [NK-WP-0045-T04, RPF-WP-0049-T05] -needs_human: false +wait_kind: both +blocked_on: message-from:railiance-platform +needs_human: true +intervention_note: "Run the prepared root-custody-finish-attended.sh through the existing founder OIDC/MFA route, with a fresh receipt. This is current restore/backup readback execution; design/go-forward approval is already recorded." +blocking_reason: "Live empty source, consumer rollout/restart/denial and audit correlation are verified. Remaining producer closure is attended current owner restore-check and governed encrypted retained-history provider upload/download/decryption evidence; no new design approval or real grant is required." priority: medium state_hub_task_id: "628e8a3b-17a4-5f97-a484-c564a87d650d" ``` @@ -338,3 +342,25 @@ record and accepted the latest matching record; no production rollback occurred. Startup limitation: each newly created pod initially hit one PostgreSQL connection-refused exit, then recovered to stable Ready. Source owner records this separately; it is not concealed as a zero-restart acceptance. + +## Final recovery execution handoff — 2026-10-03 + +Live read/login audit correlation independently verified: matching request and +response events for both exact consumer IDs, with no errors. Only the final +64 MiB of the 6.68 GB owner audit file was searched; raw records were captured +and suppressed. Sanitized receipt retained in delivery evidence. + +Producer prepared `scripts/root-custody-finish-attended.sh`: it checks the +current live source against retained high-water state, uses the current governed +Nextcloud Backup account/lane, enforces quota, encrypts baseline/history with +age, creates one uniquely named object and verifies provider readback/decryption. +It does not overwrite/delete backups or rotate credentials. Eighteen producer/ +finish tests passed. It also checks whether the historical local backup-share +URL inadvertently surfaced during inspection matches the current lane, using +booleans only; a current match stops before upload for the owner incident flow. +No raw credentials are retained in evidence. + +T06 is complete, with user-engine synced `d955cd7` and runtime owner `f108c65`. +T05 and the workplan return to blocked solely on the prepared attended recovery +execution and its owner receipt. The founder's own OIDC/MFA terminal is required +by the owner execution contract; no approval decision is reopened.