Accept independent outage recovery and Storage Share guide publication
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
This commit is contained in:
parent
fbdd62b7ed
commit
31f483966c
9 changed files with 213 additions and 46 deletions
|
|
@ -28,15 +28,16 @@ These are retrospective task records of evidenced work, not additional delivery
|
|||
or newly granted authority. The earlier dated narrative remains in Git at
|
||||
`cc2dd01`; its evidence references are carried into the tasks below.
|
||||
|
||||
**Current position:** 14 tasks done; 2 in progress; 1 ready to start (`todo`);
|
||||
10 waiting on explicit prerequisites. These are task counts, not an effort-based
|
||||
**Current position:** 16 tasks done; 2 in progress; 1 ready to start (`todo`);
|
||||
8 waiting on explicit prerequisites. These are task counts, not an effort-based
|
||||
completion percentage. Assignees are also written in task descriptions because
|
||||
the current Forge projector does not populate the dedicated Hub assignee field. The outage-retrieval tool and restore-packet draft are now prepared;
|
||||
owner execution/publication and service admission remain explicit gates.
|
||||
independent outage retrieval and Storage Share publication are accepted;
|
||||
service admission remains an explicit gate.
|
||||
|
||||
**Next actions:** finish the read-only caller ledger (T02); admit the drafted
|
||||
isolated restore packet (T15), execute independent offline retrieval (T23) and
|
||||
guide publication (T26), and record residual-scope handoffs (T24). After owner admission, execute the individual native service and
|
||||
isolated restore packet (T15) and record residual-scope handoffs (T24).
|
||||
Independent outage retrieval (T23) and guide publication (T26) are done. After owner admission, execute the individual native service and
|
||||
caller checks. A task's owner is accountable for the result; another repository's
|
||||
approval or credential grant still requires its own owner path.
|
||||
|
||||
|
|
@ -591,35 +592,32 @@ source retirement as provider revocation.
|
|||
|
||||
```task
|
||||
id: NK-WP-0049-T23
|
||||
status: wait
|
||||
status: done
|
||||
priority: high
|
||||
assignee: codex
|
||||
depends_on: [NK-WP-0049-T13, NK-WP-0049-T25]
|
||||
blocking_reason: "Await the operator-run private independent-provider download and hidden-key recovery drill; bounded tooling and self-contained kit are prepared in T25."
|
||||
state_hub_task_id: "1ec537ee-dfee-5576-be36-a81bdba417d1"
|
||||
```
|
||||
|
||||
**Accountable worker:** codex. Service/credential-owner acceptance remains with
|
||||
the named owner boundary.
|
||||
|
||||
The previous independent retrieval succeeded through a healthy attended OpenBao
|
||||
path. Source/fixture preparation of a separate offline adapter is now complete
|
||||
in T25. Actual independently held provider access has not yet been exercised
|
||||
for this outage path; no completed drill is claimed.
|
||||
Completed 2026-10-16 at 18:02 UTC. The operator used independently held Backup
|
||||
account access in the private prompt. The actual protected 109,738,344-byte
|
||||
ciphertext was downloaded with unchanged ETag/size/SHA256, with no OpenBao/SSO
|
||||
contact or provider writes by the retrieval path. The human-held age key matched
|
||||
the registered recipient; wrong-key refusal, all 36 manifest hashes, SQLite
|
||||
integrity, original key pairs and native isolated PostgreSQL 16.14 restore passed.
|
||||
The database retained five token, two resolver and two realm rows. Disposable
|
||||
container and temporary plaintext cleanup passed. The agent received no secret.
|
||||
|
||||
**Unblock action:** operator runs the prepared private terminal handoff
|
||||
`bash tools/bootstrap-recovery/run-offline-recovery.sh` (combined guide
|
||||
publication and known-generation retrieval) or the standalone read-only
|
||||
`retrieve-identity-offline.py` command in the guide. Independently held provider
|
||||
access and age key go only into the respective hidden prompts; inspect safe
|
||||
receipts and perform the real archive recovery check. Never use a captured agent
|
||||
PTY for secret entry. T26 separately tracks actual guide publication.
|
||||
|
||||
**Done when:** the owner can retrieve the exact off-host bundle without relying
|
||||
on the failed OpenBao/SSO instance, run the existing hidden-key checker, and
|
||||
verify refusal/cleanup. Use the credential-owner route before obtaining inputs;
|
||||
a new provider grant or broader scope needs its own approval. Source fixtures
|
||||
alone do not close the actual outage-path proof.
|
||||
Evidence: `actual-offline-transfer.json`, `actual-offline-recovery.json` and
|
||||
`actual-offline-review.json` under
|
||||
`docs/evidence/2026-10-16-identity-outage-recovery/`. The review rechecked the
|
||||
local ciphertext digest and verifier source. This proves the independent path
|
||||
without requiring a deliberate production outage. Service authentication,
|
||||
retained-token decryption and historical audit verification remain T16–T20.
|
||||
T26 separately records accepted guide publication.
|
||||
|
||||
## Record owner disposition for second-provider and external monitoring gaps
|
||||
|
||||
|
|
@ -688,11 +686,10 @@ evidence directory. This source correction does not complete T23/T26.
|
|||
|
||||
```task
|
||||
id: NK-WP-0049-T26
|
||||
status: wait
|
||||
status: done
|
||||
priority: high
|
||||
assignee: codex
|
||||
depends_on: [NK-WP-0049-T25, NK-WP-0049-T27]
|
||||
blocking_reason: "Await private operator provider-access execution of the prepared publication command and actual three-object readback receipts; guide and kit are built."
|
||||
state_hub_task_id: "94d054fe-e5d8-5ddf-8e48-80714123d184"
|
||||
```
|
||||
|
||||
|
|
@ -706,18 +703,26 @@ archive-check commands, service restore order, recurring schedule and remaining
|
|||
coverage limits. Include the offline tools so failed Forgejo does not prevent
|
||||
access to the recovery scripts; retain an independent copy and trusted digest.
|
||||
|
||||
**Unblock action:** operator runs `run-offline-recovery.sh`, or the reviewed
|
||||
`recovery-kit.py --publish` command through the existing attended Backup-account
|
||||
owner conduit. Existing publisher/retention workload grants are not repurposed.
|
||||
The user authorized this documentation upload; no new grant is required by the
|
||||
prepared command. The first owner run (`/tmp/nk49-offline-handoff-VKv337zo`)
|
||||
failed before private input/publication; the terminal bug is fixed in T25 and
|
||||
the rebuilt kit is ready for a fresh owner run. Credentials remain private; no provider permissions are widened.
|
||||
Completed 2026-10-16 at 18:01 UTC through the private independent-provider
|
||||
owner handoff. All three objects were conditionally created and read back with
|
||||
matching strong ETag, length and content; the recorded digests match a fresh
|
||||
reproducible local build. No existing object or provider permission was changed.
|
||||
The failed first attempt and terminal correction remain documented in T25.
|
||||
|
||||
**Done when:** the versioned START-HERE guide, self-contained ZIP and ZIP SHA256
|
||||
file are present beside the identity backups with exact conditional-create and
|
||||
ETag/length/content readback proof, and their folder/name/digests are recorded for
|
||||
future discovery. Local build or attempted upload alone does not close this task.
|
||||
**Published location:** Storage Share account Backup,
|
||||
`railiance-backups/net-kingdom-identity/`:
|
||||
|
||||
- `net-kingdom-recovery-57d1940947aa25ff-START-HERE.md`
|
||||
- `net-kingdom-recovery-57d1940947aa25ff.zip`
|
||||
- `net-kingdom-recovery-57d1940947aa25ff.zip.sha256`
|
||||
|
||||
**Trusted ZIP SHA256:**
|
||||
`57d1940947aa25ff83d0f25ddf30090eb40595cccaab64225de882a2fd59ea2f`.
|
||||
Evidence: `actual-offline-publication.json` and `actual-offline-review.json` in
|
||||
`docs/evidence/2026-10-16-identity-outage-recovery/`. The published guide is the
|
||||
exact pre-drill revision; this acceptance record records the later successful
|
||||
drill without implying an unperformed republication. Keep an independent copy
|
||||
and trusted digest outside the failed service/provider dependency.
|
||||
|
||||
## Draft the isolated service restore packet and observe candidate images
|
||||
|
||||
|
|
@ -753,7 +758,7 @@ status: wait
|
|||
priority: high
|
||||
assignee: codex
|
||||
depends_on: [NK-WP-0049-T02, NK-WP-0049-T16, NK-WP-0049-T17, NK-WP-0049-T18, NK-WP-0049-T19, NK-WP-0049-T20, NK-WP-0049-T21, NK-WP-0049-T22, NK-WP-0049-T23, NK-WP-0049-T24, NK-WP-0049-T26]
|
||||
blocking_reason: "Await the separately tracked native service proofs, current/legacy caller acceptance and independent outage retrieval; full archive recovery and backup activation are already complete."
|
||||
blocking_reason: "Await the separately tracked native service proofs, current/legacy caller dispositions and residual-scope decisions; archive recovery, backup activation, independent outage retrieval and guide publication are complete."
|
||||
state_hub_task_id: "d68cd4d3-1ba3-530e-88f9-26ebb8dd6eac"
|
||||
```
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue