diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 004d068..27b9cde 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -39,7 +39,7 @@ | workplan | NK-WP-0042 | blocked | — | workplans/NK-WP-0042-workload-mfa-step-up.md | | workplan | NK-WP-0043 | finished | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md | | workplan | NK-WP-0044 | finished | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | -| workplan | NK-WP-0045 | blocked | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| workplan | NK-WP-0045 | active | — | workplans/NK-WP-0045-root-grant-custody-record.md | | task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md | | task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md | | task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md | @@ -176,8 +176,8 @@ | task | NK-WP-0045-T02 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | | task | NK-WP-0045-T03 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | | task | NK-WP-0045-T04 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | -| task | NK-WP-0045-T05 | wait | — | workplans/NK-WP-0045-root-grant-custody-record.md | -| task | NK-WP-0045-T06 | wait | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| task | NK-WP-0045-T05 | progress | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| task | NK-WP-0045-T06 | progress | — | workplans/NK-WP-0045-root-grant-custody-record.md | | intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | | intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | | intake | NET-IN-0001 | open | — | intakes/intakes.md | diff --git a/docs/contracts/root-grant-read-contract_v0.1.md b/docs/contracts/root-grant-read-contract_v0.1.md index 5862dd9..5719439 100644 --- a/docs/contracts/root-grant-read-contract_v0.1.md +++ b/docs/contracts/root-grant-read-contract_v0.1.md @@ -5,9 +5,11 @@ Tracks NK-WP-0045 and accepted [ADR-0017](../adr/ADR-0017-root-grant-custody-and Schema: [custody-record v0.1](../../canon/schemas/custody-record_v0.1.schema.json). Reference implementation and fixtures: [validator](../../tools/custody-record/README.md). -The founder accepted ADR-0017 and selected the OpenBao design below. Delivery -and identity admission are pending; design acceptance does not assign a -custodian or establish a real root grant. Fixtures are +The founder accepted ADR-0017 and selected the OpenBao design below. Attended +reader admission, empty-record publication and live consumer integration are +verified in the [delivery evidence](../evidence/2026-10-03-root-grant-delivery-progress.md). +Independent producer recovery closure remains pending. No custodian has been +assigned and no real root grant established. Fixtures are synthetic and must never seed the authoritative record. ## Read-surface decision (T04) @@ -33,8 +35,10 @@ has no default policy and only the exact document read. The flex-auth JWT and ESO credentials are separate and cannot substitute for this admission. The founder subsequently approved going forward with implementation and the -approved delivery design. Actual admission, attended custody publication, -bootstrap provenance and live acceptance remain owner execution requirements. +approved delivery design. Actual admission and attended empty custody publication +succeeded, and controlled bootstrap/live empty-source acceptance succeeded. +Independent retained-history backup and producer recovery/audit evidence remain +owner execution requirements. The producer packet is `railiance-platform/openbao/root-grant/README.md`. user-engine retains its source/revision baseline atomically in its existing diff --git a/docs/evidence/2026-10-03-platform-root-isolated-raft.json b/docs/evidence/2026-10-03-platform-root-isolated-raft.json new file mode 100644 index 0000000..a2fdac8 --- /dev/null +++ b/docs/evidence/2026-10-03-platform-root-isolated-raft.json @@ -0,0 +1 @@ +{"digest": "33a2ae086385028db1b654aa5646b7a98bcde1c5878c804e19315dadc3f87248", "entries_count": 0, "kv_version": 1, "latest_snapshot_matches_independent_baseline": true, "ok": true, "old_snapshot_missing_source_refused": true, "production_mutated": false, "production_snapshot_used": false, "receipt_holder_backup_provider_verified": false, "receipt_holder_scratch_restore_verified": true, "record_id": "nk-custody:platform-root", "revision": 1, "scope": "disposable-loopback-openbao-raft", "server_version": "OpenBao v2.5.5 (028992583c693c4de6350b8aa52ff85e30375a99), built 2026-06-17T11:18:48Z", "snapshot_count": 2, "temporary_artifacts_removed": true} \ No newline at end of file diff --git a/docs/evidence/2026-10-03-root-grant-delivery-progress.md b/docs/evidence/2026-10-03-root-grant-delivery-progress.md index 308309a..b3e81d6 100644 --- a/docs/evidence/2026-10-03-root-grant-delivery-progress.md +++ b/docs/evidence/2026-10-03-root-grant-delivery-progress.md @@ -1,8 +1,8 @@ # Root-grant delivery progress — 2026-10-03 Work: NK-WP-0045. Scope: approved OpenBao custody-record delivery. This receipt -records source preparation and safe preflight; it is not live admission or -custody-grant evidence. +records source preparation, safe preflight and verified attended admission/ +publication receipts. It is not custody-grant or recovery-readiness evidence. ## Human disposition and initial empty record @@ -18,7 +18,8 @@ for review and attended publication: stable record ID `nk-custody:platform-root` revision 1, owner `net-kingdom-custody`, 900-second maximum and `entries: []`. This is an intentionally empty authoritative candidate, not a synthetic grant fixture. It represents no certified root grants. Schema and semantic validation -passed. It has not been published. Publication must use CAS=0 and fail if an +passed. It was subsequently published through the attended lane, as recorded +below. Initial publication must use CAS=0 and fail if an existing document or unresolved retained history is discovered; do not replace an existing record on the assumption that no ceremony was supplied. @@ -59,15 +60,15 @@ reader admission, document existence or positive live custody delivery. ## Remaining execution and acceptance -The founder runs OpenBao provisioning and publication in the attended OIDC/MFA -lane. Existing approval is sufficient for the reviewed delivery work; this is -an operator-session dependency. Follow the concrete producer packet in -`railiance-platform/openbao/root-grant/README.md`, using fresh receipt files. +The founder completed OpenBao provisioning and publication in the attended +OIDC/MFA lane; fresh success receipts are recorded below. Existing approval was +sufficient for the reviewed delivery work. The concrete producer packet is in +`railiance-platform/openbao/root-grant/README.md`. Keep independently retained latest publication history through restore. Its location and backup receipt must be recorded before recovery readiness closes. -After the empty source is published, publish/pin the custody-capable application -image, render/dry-run/diff/deploy through rapp-user-engine, and initialize the +The custody-capable application image is published/pinned and its deployment +passed preflight. Deploy through rapp-user-engine and initialize the baseline using the authenticated document plus publisher digest. Empty source acceptance proves no-grant delivery; it cannot prove a real positive grant or revocation. Positive grant/revocation exercises use isolated synthetic test @@ -91,8 +92,8 @@ suppressed. Existing live factor-recovery URL, mounts, volumes and egress semantics are preserved. This final artifact supersedes the earlier preflight hash after preserving that live setting. No apply or workload mutation. -Image publication is resolved. Actual reader/source admission and publication, -then reviewed runtime rollout, controlled baseline initialization and live +Image publication and attended reader/source admission/publication are resolved. +Reviewed runtime rollout, controlled baseline initialization and live no-grant/denial/outage/restart acceptance remain. Off-host publication history retention/recovery needs its real receipts before recovery readiness closes. @@ -109,3 +110,45 @@ persisted publisher baseline matches these fields. This supersedes the earlier pending-admission/publication state, without claiming runtime or recovery acceptance. The operator's older OIDC role configuration is not an execution receipt. Owner rollout and authenticated baseline/read acceptance resumed. + +## Live runtime and consumer acceptance + +rapp-user-engine applied only the reviewed Deployment and runtime NetworkPolicy. +Bounded apply artifact SHA256 +`804400134a705651d12ada05a068543d2f1665a14eec5c3b65898c7560a63a8f`. +Rollout succeeded; Ready/available 1, health/readiness HTTP 200. One initial +restart was safely traced to a transient original runtime PostgreSQL connection +refusal; subsequent restart count remained stable. This is distinct from the +post-baseline restart acceptance exercise. + +The consumer's [live acceptance receipt](2026-10-03-user-custody-live-acceptance.json) +reports `ok: true`: baseline initially absent, controlled initialization from a +fresh authenticated owner read matched the publisher digest, empty-source +mapping returns no root grant, wrong tenant returns no grant, and a real +wrong-audience JWT login is denied. Database reconnect preserves baseline. +Injected read failure and same-revision mutation preserve the trusted baseline; +these are injection checks, not claims of an actual OpenBao backend outage. +Post-initialization pod restart, exact-reader negative capabilities/audit and +independent backup/recovery evidence are still being collected. No actual grant +was introduced. + +The [final consumer receipt](2026-10-03-user-custody-live-final-acceptance.json) +subsequently verified baseline persistence after an actual controlled pod +restart, a fresh matching owner read and HTTP 403 for the actual reader's +metadata LIST, sibling GET and exact-path POST. The internal fixture service +serialized `root_grant: null` against the actual live empty source; it does not +claim acceptance of the separate external Hub authenticated route. Safe read +and login request IDs were retained for owner audit correlation. USER-WP-0037-T02 +is accepted for this delivered no-grant integration; the separate Hub route +task is outside this acceptance. The restarted workload is Ready; its initial +DB connection refusal also occurred on the controlled restart, recovered, and +remained stable. No ongoing CrashLoop or zero-restart claim is made. + +The [isolated Raft recovery receipt](2026-10-03-platform-root-isolated-raft.json) +reports actual disposable OpenBao v2.5.5 snapshot/restore checks: an older +snapshot missing the custody source was refused against the independent +baseline, and the latest snapshot restored the matching revision/digest. +Scratch copy/restore of baseline and immutable history verified content and +permissions. Temporary daemon/storage were removed. No production snapshot +or rollback was used. This proves the isolated recovery guard, not current +provider backup coverage or the attended live-source restore check. diff --git a/docs/evidence/2026-10-03-user-custody-live-acceptance.json b/docs/evidence/2026-10-03-user-custody-live-acceptance.json new file mode 100644 index 0000000..4158e63 --- /dev/null +++ b/docs/evidence/2026-10-03-user-custody-live-acceptance.json @@ -0,0 +1,20 @@ +{ + "actual_grant": false, + "baseline_initially_absent": true, + "baseline_receipt_matched": true, + "empty_no_grant_document": true, + "empty_record_returns_no_grant": true, + "failure_preserves_baseline": true, + "fresh_authenticated_owner_read": true, + "initialized_from_authenticated_receipt": true, + "injected_read_failure_returns_no_grant": true, + "ok": true, + "other_tenant_returns_no_grant": true, + "owner_read_clock_aware": true, + "reconnect_preserves_baseline": true, + "record_id_matched": true, + "record_revision": 1, + "runtime_enabled": true, + "same_revision_mutation_preserves_baseline": true, + "wrong_audience_login_denied": true +} diff --git a/docs/evidence/2026-10-03-user-custody-live-final-acceptance.json b/docs/evidence/2026-10-03-user-custody-live-final-acceptance.json new file mode 100644 index 0000000..6caad37 --- /dev/null +++ b/docs/evidence/2026-10-03-user-custody-live-final-acceptance.json @@ -0,0 +1,33 @@ +{ + "actual_grant": false, + "baseline_initially_absent": false, + "baseline_receipt_matched": true, + "baseline_survives_actual_pod_restart": true, + "capability_probe_read_at": "2026-10-03T18:30:58.194568+00:00", + "capability_probe_read_digest_matched": true, + "custody_write_denied": true, + "custody_write_denied_http_status": 403, + "empty_no_grant_document": true, + "empty_record_returns_no_grant": true, + "existing_baseline_receipt_matched": true, + "failure_preserves_baseline": true, + "fixture_service_serializes_live_empty_root_grant_null": true, + "fresh_authenticated_owner_read": true, + "hub_private_route_acceptance_claimed": false, + "injected_read_failure_returns_no_grant": true, + "metadata_list_denied": true, + "metadata_list_denied_http_status": 403, + "ok": true, + "other_tenant_returns_no_grant": true, + "owner_read_clock_aware": true, + "read_request_id": "91cd7235-9cfe-06c3-57a6-64a013d1cfcb", + "reader_login_request_id": "29a2fac4-8108-7ca5-d0a6-682c4a31f48d", + "reconnect_preserves_baseline": true, + "record_id_matched": true, + "record_revision": 1, + "runtime_enabled": true, + "same_revision_mutation_preserves_baseline": true, + "sibling_read_denied": true, + "sibling_read_denied_http_status": 403, + "wrong_audience_login_denied": true +} diff --git a/workplans/NK-WP-0045-root-grant-custody-record.md b/workplans/NK-WP-0045-root-grant-custody-record.md index 98050ce..99c8901 100644 --- a/workplans/NK-WP-0045-root-grant-custody-record.md +++ b/workplans/NK-WP-0045-root-grant-custody-record.md @@ -129,8 +129,8 @@ the runtime. Include the fail-closed and staleness rules from ADR-0017. ```task id: NK-WP-0045-T06 -status: progress -depends_on: [NK-WP-0045-T01, NK-WP-0045-T05, USER-WP-0037-T02, RAPP-USER-ENGINE-WP-0003-T03] +status: done +depends_on: [NK-WP-0045-T01, RPF-WP-0049-T04, USER-WP-0037-T02, RAPP-USER-ENGINE-WP-0003-T03] priority: medium state_hub_task_id: "eb71faf7-d6c7-5a3a-bdb6-17281cc5a01a" ``` @@ -138,6 +138,15 @@ state_hub_task_id: "eb71faf7-d6c7-5a3a-bdb6-17281cc5a01a" Tell user-engine the read path is live so USER-WP-0037-T02 can derive `AccountAuthority.root-grant` from it, and record the evidence. +2026-10-03: live admitted reader and empty source accepted; controlled baseline +initialization, fresh read and real post-initialization pod restart persistence +verified. Reader LIST/sibling GET/exact-path write denied HTTP 403; wrong-audience +JWT denied; no-grant mapping verified. Internal fixture service serialization +uses the actual live source but does not claim external Hub-route acceptance. +Consumer milestone depends on the completed producer admission/publication +milestone RPF-WP-0049-T04; the broader T05 producer recovery gate remains separate. +No actual root grant or ceremony is needed for this empty-source acceptance. + ## Acceptance Criteria - The custody-record schema and validator exist and reject secret-bearing and @@ -314,3 +323,18 @@ durable baseline through the authenticated reader and exercise live acceptance. The attended-login intervention is resolved; do not request it again. Knowledge reloaded: Emergent 0.2.4, start/root `verified-files`, orientation-only, digest `025aab4f38246219c924bc94954e70ea0e6e7f72bcaf8d4344cd599602d345c3`. + +## Live consumer delivery accepted — 2026-10-03 + +Runtime owner completed RAPP-USER-ENGINE-WP-0003 (synced HEAD `f108c65`); +reviewed Deployment/NetworkPolicy applied, verified custody image running, +Ready 1/1 and HTTP 200 health/readiness. USER-WP-0037-T02 accepted the delivered +empty source, with fresh authenticated receipt-bound baseline initialization and +actual pod restart persistence. Exact reader denied list/sibling/write, and +wrong-audience login denied. Evidence is retained in the final consumer receipt. +T06 is done; T05 remains in progress for independent recovery/provider/audit +evidence. Isolated actual OpenBao Raft snapshot restore refused an older missing +record and accepted the latest matching record; no production rollback occurred. +Startup limitation: each newly created pod initially hit one PostgreSQL +connection-refused exit, then recovered to stable Ready. Source owner records +this separately; it is not concealed as a zero-restart acceptance.