Accept live empty custody integration and isolated recovery evidence
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29
This commit is contained in:
parent
a1209ce7aa
commit
36f2afcb38
7 changed files with 146 additions and 21 deletions
|
|
@ -39,7 +39,7 @@
|
|||
| workplan | NK-WP-0042 | blocked | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
|
||||
| workplan | NK-WP-0043 | finished | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
|
||||
| workplan | NK-WP-0044 | finished | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
|
||||
| workplan | NK-WP-0045 | blocked | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| workplan | NK-WP-0045 | active | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md |
|
||||
| task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md |
|
||||
| task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md |
|
||||
|
|
@ -176,8 +176,8 @@
|
|||
| task | NK-WP-0045-T02 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T03 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T04 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T05 | wait | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T06 | wait | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T05 | progress | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| task | NK-WP-0045-T06 | progress | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
|
||||
| intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
|
||||
| intake | NET-IN-0001 | open | — | intakes/intakes.md |
|
||||
|
|
|
|||
|
|
@ -5,9 +5,11 @@ Tracks NK-WP-0045 and accepted [ADR-0017](../adr/ADR-0017-root-grant-custody-and
|
|||
Schema: [custody-record v0.1](../../canon/schemas/custody-record_v0.1.schema.json).
|
||||
Reference implementation and fixtures: [validator](../../tools/custody-record/README.md).
|
||||
|
||||
The founder accepted ADR-0017 and selected the OpenBao design below. Delivery
|
||||
and identity admission are pending; design acceptance does not assign a
|
||||
custodian or establish a real root grant. Fixtures are
|
||||
The founder accepted ADR-0017 and selected the OpenBao design below. Attended
|
||||
reader admission, empty-record publication and live consumer integration are
|
||||
verified in the [delivery evidence](../evidence/2026-10-03-root-grant-delivery-progress.md).
|
||||
Independent producer recovery closure remains pending. No custodian has been
|
||||
assigned and no real root grant established. Fixtures are
|
||||
synthetic and must never seed the authoritative record.
|
||||
|
||||
## Read-surface decision (T04)
|
||||
|
|
@ -33,8 +35,10 @@ has no default policy and only the exact document read. The flex-auth JWT and
|
|||
ESO credentials are separate and cannot substitute for this admission.
|
||||
|
||||
The founder subsequently approved going forward with implementation and the
|
||||
approved delivery design. Actual admission, attended custody publication,
|
||||
bootstrap provenance and live acceptance remain owner execution requirements.
|
||||
approved delivery design. Actual admission and attended empty custody publication
|
||||
succeeded, and controlled bootstrap/live empty-source acceptance succeeded.
|
||||
Independent retained-history backup and producer recovery/audit evidence remain
|
||||
owner execution requirements.
|
||||
The producer packet is `railiance-platform/openbao/root-grant/README.md`.
|
||||
|
||||
user-engine retains its source/revision baseline atomically in its existing
|
||||
|
|
|
|||
|
|
@ -0,0 +1 @@
|
|||
{"digest": "33a2ae086385028db1b654aa5646b7a98bcde1c5878c804e19315dadc3f87248", "entries_count": 0, "kv_version": 1, "latest_snapshot_matches_independent_baseline": true, "ok": true, "old_snapshot_missing_source_refused": true, "production_mutated": false, "production_snapshot_used": false, "receipt_holder_backup_provider_verified": false, "receipt_holder_scratch_restore_verified": true, "record_id": "nk-custody:platform-root", "revision": 1, "scope": "disposable-loopback-openbao-raft", "server_version": "OpenBao v2.5.5 (028992583c693c4de6350b8aa52ff85e30375a99), built 2026-06-17T11:18:48Z", "snapshot_count": 2, "temporary_artifacts_removed": true}
|
||||
|
|
@ -1,8 +1,8 @@
|
|||
# Root-grant delivery progress — 2026-10-03
|
||||
|
||||
Work: NK-WP-0045. Scope: approved OpenBao custody-record delivery. This receipt
|
||||
records source preparation and safe preflight; it is not live admission or
|
||||
custody-grant evidence.
|
||||
records source preparation, safe preflight and verified attended admission/
|
||||
publication receipts. It is not custody-grant or recovery-readiness evidence.
|
||||
|
||||
## Human disposition and initial empty record
|
||||
|
||||
|
|
@ -18,7 +18,8 @@ for review and attended publication: stable record ID `nk-custody:platform-root`
|
|||
revision 1, owner `net-kingdom-custody`, 900-second maximum and `entries: []`.
|
||||
This is an intentionally empty authoritative candidate, not a synthetic grant
|
||||
fixture. It represents no certified root grants. Schema and semantic validation
|
||||
passed. It has not been published. Publication must use CAS=0 and fail if an
|
||||
passed. It was subsequently published through the attended lane, as recorded
|
||||
below. Initial publication must use CAS=0 and fail if an
|
||||
existing document or unresolved retained history is discovered; do not replace
|
||||
an existing record on the assumption that no ceremony was supplied.
|
||||
|
||||
|
|
@ -59,15 +60,15 @@ reader admission, document existence or positive live custody delivery.
|
|||
|
||||
## Remaining execution and acceptance
|
||||
|
||||
The founder runs OpenBao provisioning and publication in the attended OIDC/MFA
|
||||
lane. Existing approval is sufficient for the reviewed delivery work; this is
|
||||
an operator-session dependency. Follow the concrete producer packet in
|
||||
`railiance-platform/openbao/root-grant/README.md`, using fresh receipt files.
|
||||
The founder completed OpenBao provisioning and publication in the attended
|
||||
OIDC/MFA lane; fresh success receipts are recorded below. Existing approval was
|
||||
sufficient for the reviewed delivery work. The concrete producer packet is in
|
||||
`railiance-platform/openbao/root-grant/README.md`.
|
||||
Keep independently retained latest publication history through restore. Its
|
||||
location and backup receipt must be recorded before recovery readiness closes.
|
||||
|
||||
After the empty source is published, publish/pin the custody-capable application
|
||||
image, render/dry-run/diff/deploy through rapp-user-engine, and initialize the
|
||||
The custody-capable application image is published/pinned and its deployment
|
||||
passed preflight. Deploy through rapp-user-engine and initialize the
|
||||
baseline using the authenticated document plus publisher digest. Empty source
|
||||
acceptance proves no-grant delivery; it cannot prove a real positive grant or
|
||||
revocation. Positive grant/revocation exercises use isolated synthetic test
|
||||
|
|
@ -91,8 +92,8 @@ suppressed. Existing live factor-recovery URL, mounts, volumes and egress
|
|||
semantics are preserved. This final artifact supersedes the earlier preflight
|
||||
hash after preserving that live setting. No apply or workload mutation.
|
||||
|
||||
Image publication is resolved. Actual reader/source admission and publication,
|
||||
then reviewed runtime rollout, controlled baseline initialization and live
|
||||
Image publication and attended reader/source admission/publication are resolved.
|
||||
Reviewed runtime rollout, controlled baseline initialization and live
|
||||
no-grant/denial/outage/restart acceptance remain. Off-host publication history
|
||||
retention/recovery needs its real receipts before recovery readiness closes.
|
||||
|
||||
|
|
@ -109,3 +110,45 @@ persisted publisher baseline matches these fields. This supersedes the earlier
|
|||
pending-admission/publication state, without claiming runtime or recovery
|
||||
acceptance. The operator's older OIDC role configuration is not an execution
|
||||
receipt. Owner rollout and authenticated baseline/read acceptance resumed.
|
||||
|
||||
## Live runtime and consumer acceptance
|
||||
|
||||
rapp-user-engine applied only the reviewed Deployment and runtime NetworkPolicy.
|
||||
Bounded apply artifact SHA256
|
||||
`804400134a705651d12ada05a068543d2f1665a14eec5c3b65898c7560a63a8f`.
|
||||
Rollout succeeded; Ready/available 1, health/readiness HTTP 200. One initial
|
||||
restart was safely traced to a transient original runtime PostgreSQL connection
|
||||
refusal; subsequent restart count remained stable. This is distinct from the
|
||||
post-baseline restart acceptance exercise.
|
||||
|
||||
The consumer's [live acceptance receipt](2026-10-03-user-custody-live-acceptance.json)
|
||||
reports `ok: true`: baseline initially absent, controlled initialization from a
|
||||
fresh authenticated owner read matched the publisher digest, empty-source
|
||||
mapping returns no root grant, wrong tenant returns no grant, and a real
|
||||
wrong-audience JWT login is denied. Database reconnect preserves baseline.
|
||||
Injected read failure and same-revision mutation preserve the trusted baseline;
|
||||
these are injection checks, not claims of an actual OpenBao backend outage.
|
||||
Post-initialization pod restart, exact-reader negative capabilities/audit and
|
||||
independent backup/recovery evidence are still being collected. No actual grant
|
||||
was introduced.
|
||||
|
||||
The [final consumer receipt](2026-10-03-user-custody-live-final-acceptance.json)
|
||||
subsequently verified baseline persistence after an actual controlled pod
|
||||
restart, a fresh matching owner read and HTTP 403 for the actual reader's
|
||||
metadata LIST, sibling GET and exact-path POST. The internal fixture service
|
||||
serialized `root_grant: null` against the actual live empty source; it does not
|
||||
claim acceptance of the separate external Hub authenticated route. Safe read
|
||||
and login request IDs were retained for owner audit correlation. USER-WP-0037-T02
|
||||
is accepted for this delivered no-grant integration; the separate Hub route
|
||||
task is outside this acceptance. The restarted workload is Ready; its initial
|
||||
DB connection refusal also occurred on the controlled restart, recovered, and
|
||||
remained stable. No ongoing CrashLoop or zero-restart claim is made.
|
||||
|
||||
The [isolated Raft recovery receipt](2026-10-03-platform-root-isolated-raft.json)
|
||||
reports actual disposable OpenBao v2.5.5 snapshot/restore checks: an older
|
||||
snapshot missing the custody source was refused against the independent
|
||||
baseline, and the latest snapshot restored the matching revision/digest.
|
||||
Scratch copy/restore of baseline and immutable history verified content and
|
||||
permissions. Temporary daemon/storage were removed. No production snapshot
|
||||
or rollback was used. This proves the isolated recovery guard, not current
|
||||
provider backup coverage or the attended live-source restore check.
|
||||
|
|
|
|||
20
docs/evidence/2026-10-03-user-custody-live-acceptance.json
Normal file
20
docs/evidence/2026-10-03-user-custody-live-acceptance.json
Normal file
|
|
@ -0,0 +1,20 @@
|
|||
{
|
||||
"actual_grant": false,
|
||||
"baseline_initially_absent": true,
|
||||
"baseline_receipt_matched": true,
|
||||
"empty_no_grant_document": true,
|
||||
"empty_record_returns_no_grant": true,
|
||||
"failure_preserves_baseline": true,
|
||||
"fresh_authenticated_owner_read": true,
|
||||
"initialized_from_authenticated_receipt": true,
|
||||
"injected_read_failure_returns_no_grant": true,
|
||||
"ok": true,
|
||||
"other_tenant_returns_no_grant": true,
|
||||
"owner_read_clock_aware": true,
|
||||
"reconnect_preserves_baseline": true,
|
||||
"record_id_matched": true,
|
||||
"record_revision": 1,
|
||||
"runtime_enabled": true,
|
||||
"same_revision_mutation_preserves_baseline": true,
|
||||
"wrong_audience_login_denied": true
|
||||
}
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
{
|
||||
"actual_grant": false,
|
||||
"baseline_initially_absent": false,
|
||||
"baseline_receipt_matched": true,
|
||||
"baseline_survives_actual_pod_restart": true,
|
||||
"capability_probe_read_at": "2026-10-03T18:30:58.194568+00:00",
|
||||
"capability_probe_read_digest_matched": true,
|
||||
"custody_write_denied": true,
|
||||
"custody_write_denied_http_status": 403,
|
||||
"empty_no_grant_document": true,
|
||||
"empty_record_returns_no_grant": true,
|
||||
"existing_baseline_receipt_matched": true,
|
||||
"failure_preserves_baseline": true,
|
||||
"fixture_service_serializes_live_empty_root_grant_null": true,
|
||||
"fresh_authenticated_owner_read": true,
|
||||
"hub_private_route_acceptance_claimed": false,
|
||||
"injected_read_failure_returns_no_grant": true,
|
||||
"metadata_list_denied": true,
|
||||
"metadata_list_denied_http_status": 403,
|
||||
"ok": true,
|
||||
"other_tenant_returns_no_grant": true,
|
||||
"owner_read_clock_aware": true,
|
||||
"read_request_id": "91cd7235-9cfe-06c3-57a6-64a013d1cfcb",
|
||||
"reader_login_request_id": "29a2fac4-8108-7ca5-d0a6-682c4a31f48d",
|
||||
"reconnect_preserves_baseline": true,
|
||||
"record_id_matched": true,
|
||||
"record_revision": 1,
|
||||
"runtime_enabled": true,
|
||||
"same_revision_mutation_preserves_baseline": true,
|
||||
"sibling_read_denied": true,
|
||||
"sibling_read_denied_http_status": 403,
|
||||
"wrong_audience_login_denied": true
|
||||
}
|
||||
|
|
@ -129,8 +129,8 @@ the runtime. Include the fail-closed and staleness rules from ADR-0017.
|
|||
|
||||
```task
|
||||
id: NK-WP-0045-T06
|
||||
status: progress
|
||||
depends_on: [NK-WP-0045-T01, NK-WP-0045-T05, USER-WP-0037-T02, RAPP-USER-ENGINE-WP-0003-T03]
|
||||
status: done
|
||||
depends_on: [NK-WP-0045-T01, RPF-WP-0049-T04, USER-WP-0037-T02, RAPP-USER-ENGINE-WP-0003-T03]
|
||||
priority: medium
|
||||
state_hub_task_id: "eb71faf7-d6c7-5a3a-bdb6-17281cc5a01a"
|
||||
```
|
||||
|
|
@ -138,6 +138,15 @@ state_hub_task_id: "eb71faf7-d6c7-5a3a-bdb6-17281cc5a01a"
|
|||
Tell user-engine the read path is live so USER-WP-0037-T02 can derive
|
||||
`AccountAuthority.root-grant` from it, and record the evidence.
|
||||
|
||||
2026-10-03: live admitted reader and empty source accepted; controlled baseline
|
||||
initialization, fresh read and real post-initialization pod restart persistence
|
||||
verified. Reader LIST/sibling GET/exact-path write denied HTTP 403; wrong-audience
|
||||
JWT denied; no-grant mapping verified. Internal fixture service serialization
|
||||
uses the actual live source but does not claim external Hub-route acceptance.
|
||||
Consumer milestone depends on the completed producer admission/publication
|
||||
milestone RPF-WP-0049-T04; the broader T05 producer recovery gate remains separate.
|
||||
No actual root grant or ceremony is needed for this empty-source acceptance.
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- The custody-record schema and validator exist and reject secret-bearing and
|
||||
|
|
@ -314,3 +323,18 @@ durable baseline through the authenticated reader and exercise live acceptance.
|
|||
The attended-login intervention is resolved; do not request it again.
|
||||
Knowledge reloaded: Emergent 0.2.4, start/root `verified-files`, orientation-only,
|
||||
digest `025aab4f38246219c924bc94954e70ea0e6e7f72bcaf8d4344cd599602d345c3`.
|
||||
|
||||
## Live consumer delivery accepted — 2026-10-03
|
||||
|
||||
Runtime owner completed RAPP-USER-ENGINE-WP-0003 (synced HEAD `f108c65`);
|
||||
reviewed Deployment/NetworkPolicy applied, verified custody image running,
|
||||
Ready 1/1 and HTTP 200 health/readiness. USER-WP-0037-T02 accepted the delivered
|
||||
empty source, with fresh authenticated receipt-bound baseline initialization and
|
||||
actual pod restart persistence. Exact reader denied list/sibling/write, and
|
||||
wrong-audience login denied. Evidence is retained in the final consumer receipt.
|
||||
T06 is done; T05 remains in progress for independent recovery/provider/audit
|
||||
evidence. Isolated actual OpenBao Raft snapshot restore refused an older missing
|
||||
record and accepted the latest matching record; no production rollback occurred.
|
||||
Startup limitation: each newly created pod initially hit one PostgreSQL
|
||||
connection-refused exit, then recovered to stable Ready. Source owner records
|
||||
this separately; it is not concealed as a zero-restart acceptance.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue