Accept live empty custody integration and isolated recovery evidence

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29

WORK-RECORDS.md

@@ -39,7 +39,7 @@
 | workplan | NK-WP-0042 | blocked | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
 | workplan | NK-WP-0043 | finished | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
 | workplan | NK-WP-0044 | finished | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
-| workplan | NK-WP-0045 | blocked | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| workplan | NK-WP-0045 | active | — | workplans/NK-WP-0045-root-grant-custody-record.md |
 | task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md |
 | task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md |
 | task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md |
@@ -176,8 +176,8 @@
 | task | NK-WP-0045-T02 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
 | task | NK-WP-0045-T03 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
 | task | NK-WP-0045-T04 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
-| task | NK-WP-0045-T05 | wait | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T05 | progress | — | workplans/NK-WP-0045-root-grant-custody-record.md |
-| task | NK-WP-0045-T06 | wait | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T06 | progress | — | workplans/NK-WP-0045-root-grant-custody-record.md |
 | intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
 | intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
 | intake | NET-IN-0001 | open | — | intakes/intakes.md |

docs/contracts/root-grant-read-contract_v0.1.md

@@ -5,9 +5,11 @@ Tracks NK-WP-0045 and accepted [ADR-0017](../adr/ADR-0017-root-grant-custody-and
 Schema: [custody-record v0.1](../../canon/schemas/custody-record_v0.1.schema.json).
 Reference implementation and fixtures: [validator](../../tools/custody-record/README.md).
 
-The founder accepted ADR-0017 and selected the OpenBao design below. Delivery
+The founder accepted ADR-0017 and selected the OpenBao design below. Attended
-and identity admission are pending; design acceptance does not assign a
+reader admission, empty-record publication and live consumer integration are
-custodian or establish a real root grant. Fixtures are
+verified in the [delivery evidence](../evidence/2026-10-03-root-grant-delivery-progress.md).
+Independent producer recovery closure remains pending. No custodian has been
+assigned and no real root grant established. Fixtures are
 synthetic and must never seed the authoritative record.
 
 ## Read-surface decision (T04)
@@ -33,8 +35,10 @@ has no default policy and only the exact document read. The flex-auth JWT and
 ESO credentials are separate and cannot substitute for this admission.
 
 The founder subsequently approved going forward with implementation and the
-approved delivery design. Actual admission, attended custody publication,
+approved delivery design. Actual admission and attended empty custody publication
-bootstrap provenance and live acceptance remain owner execution requirements.
+succeeded, and controlled bootstrap/live empty-source acceptance succeeded.
+Independent retained-history backup and producer recovery/audit evidence remain
+owner execution requirements.
 The producer packet is `railiance-platform/openbao/root-grant/README.md`.
 
 user-engine retains its source/revision baseline atomically in its existing

docs/evidence/2026-10-03-platform-root-isolated-raft.json

@@ -0,0 +1 @@
+{"digest": "33a2ae086385028db1b654aa5646b7a98bcde1c5878c804e19315dadc3f87248", "entries_count": 0, "kv_version": 1, "latest_snapshot_matches_independent_baseline": true, "ok": true, "old_snapshot_missing_source_refused": true, "production_mutated": false, "production_snapshot_used": false, "receipt_holder_backup_provider_verified": false, "receipt_holder_scratch_restore_verified": true, "record_id": "nk-custody:platform-root", "revision": 1, "scope": "disposable-loopback-openbao-raft", "server_version": "OpenBao v2.5.5 (028992583c693c4de6350b8aa52ff85e30375a99), built 2026-06-17T11:18:48Z", "snapshot_count": 2, "temporary_artifacts_removed": true}

docs/evidence/2026-10-03-root-grant-delivery-progress.md

@@ -1,8 +1,8 @@
 # Root-grant delivery progress — 2026-10-03
 
 Work: NK-WP-0045. Scope: approved OpenBao custody-record delivery. This receipt
-records source preparation and safe preflight; it is not live admission or
+records source preparation, safe preflight and verified attended admission/
-custody-grant evidence.
+publication receipts. It is not custody-grant or recovery-readiness evidence.
 
 ## Human disposition and initial empty record
 
@@ -18,7 +18,8 @@ for review and attended publication: stable record ID `nk-custody:platform-root`
 revision 1, owner `net-kingdom-custody`, 900-second maximum and `entries: []`.
 This is an intentionally empty authoritative candidate, not a synthetic grant
 fixture. It represents no certified root grants. Schema and semantic validation
-passed. It has not been published. Publication must use CAS=0 and fail if an
+passed. It was subsequently published through the attended lane, as recorded
+below. Initial publication must use CAS=0 and fail if an
 existing document or unresolved retained history is discovered; do not replace
 an existing record on the assumption that no ceremony was supplied.
 
@@ -59,15 +60,15 @@ reader admission, document existence or positive live custody delivery.
 
 ## Remaining execution and acceptance
 
-The founder runs OpenBao provisioning and publication in the attended OIDC/MFA
+The founder completed OpenBao provisioning and publication in the attended
-lane. Existing approval is sufficient for the reviewed delivery work; this is
+OIDC/MFA lane; fresh success receipts are recorded below. Existing approval was
-an operator-session dependency. Follow the concrete producer packet in
+sufficient for the reviewed delivery work. The concrete producer packet is in
-`railiance-platform/openbao/root-grant/README.md`, using fresh receipt files.
+`railiance-platform/openbao/root-grant/README.md`.
 Keep independently retained latest publication history through restore. Its
 location and backup receipt must be recorded before recovery readiness closes.
 
-After the empty source is published, publish/pin the custody-capable application
+The custody-capable application image is published/pinned and its deployment
-image, render/dry-run/diff/deploy through rapp-user-engine, and initialize the
+passed preflight. Deploy through rapp-user-engine and initialize the
 baseline using the authenticated document plus publisher digest. Empty source
 acceptance proves no-grant delivery; it cannot prove a real positive grant or
 revocation. Positive grant/revocation exercises use isolated synthetic test
@@ -91,8 +92,8 @@ suppressed. Existing live factor-recovery URL, mounts, volumes and egress
 semantics are preserved. This final artifact supersedes the earlier preflight
 hash after preserving that live setting. No apply or workload mutation.
 
-Image publication is resolved. Actual reader/source admission and publication,
+Image publication and attended reader/source admission/publication are resolved.
-then reviewed runtime rollout, controlled baseline initialization and live
+Reviewed runtime rollout, controlled baseline initialization and live
 no-grant/denial/outage/restart acceptance remain. Off-host publication history
 retention/recovery needs its real receipts before recovery readiness closes.
 
@@ -109,3 +110,45 @@ persisted publisher baseline matches these fields. This supersedes the earlier
 pending-admission/publication state, without claiming runtime or recovery
 acceptance. The operator's older OIDC role configuration is not an execution
 receipt. Owner rollout and authenticated baseline/read acceptance resumed.
+
+## Live runtime and consumer acceptance
+
+rapp-user-engine applied only the reviewed Deployment and runtime NetworkPolicy.
+Bounded apply artifact SHA256
+`804400134a705651d12ada05a068543d2f1665a14eec5c3b65898c7560a63a8f`.
+Rollout succeeded; Ready/available 1, health/readiness HTTP 200. One initial
+restart was safely traced to a transient original runtime PostgreSQL connection
+refusal; subsequent restart count remained stable. This is distinct from the
+post-baseline restart acceptance exercise.
+
+The consumer's [live acceptance receipt](2026-10-03-user-custody-live-acceptance.json)
+reports `ok: true`: baseline initially absent, controlled initialization from a
+fresh authenticated owner read matched the publisher digest, empty-source
+mapping returns no root grant, wrong tenant returns no grant, and a real
+wrong-audience JWT login is denied. Database reconnect preserves baseline.
+Injected read failure and same-revision mutation preserve the trusted baseline;
+these are injection checks, not claims of an actual OpenBao backend outage.
+Post-initialization pod restart, exact-reader negative capabilities/audit and
+independent backup/recovery evidence are still being collected. No actual grant
+was introduced.
+
+The [final consumer receipt](2026-10-03-user-custody-live-final-acceptance.json)
+subsequently verified baseline persistence after an actual controlled pod
+restart, a fresh matching owner read and HTTP 403 for the actual reader's
+metadata LIST, sibling GET and exact-path POST. The internal fixture service
+serialized `root_grant: null` against the actual live empty source; it does not
+claim acceptance of the separate external Hub authenticated route. Safe read
+and login request IDs were retained for owner audit correlation. USER-WP-0037-T02
+is accepted for this delivered no-grant integration; the separate Hub route
+task is outside this acceptance. The restarted workload is Ready; its initial
+DB connection refusal also occurred on the controlled restart, recovered, and
+remained stable. No ongoing CrashLoop or zero-restart claim is made.
+
+The [isolated Raft recovery receipt](2026-10-03-platform-root-isolated-raft.json)
+reports actual disposable OpenBao v2.5.5 snapshot/restore checks: an older
+snapshot missing the custody source was refused against the independent
+baseline, and the latest snapshot restored the matching revision/digest.
+Scratch copy/restore of baseline and immutable history verified content and
+permissions. Temporary daemon/storage were removed. No production snapshot
+or rollback was used. This proves the isolated recovery guard, not current
+provider backup coverage or the attended live-source restore check.

docs/evidence/2026-10-03-user-custody-live-acceptance.json

@@ -0,0 +1,20 @@
+{
+  "actual_grant": false,
+  "baseline_initially_absent": true,
+  "baseline_receipt_matched": true,
+  "empty_no_grant_document": true,
+  "empty_record_returns_no_grant": true,
+  "failure_preserves_baseline": true,
+  "fresh_authenticated_owner_read": true,
+  "initialized_from_authenticated_receipt": true,
+  "injected_read_failure_returns_no_grant": true,
+  "ok": true,
+  "other_tenant_returns_no_grant": true,
+  "owner_read_clock_aware": true,
+  "reconnect_preserves_baseline": true,
+  "record_id_matched": true,
+  "record_revision": 1,
+  "runtime_enabled": true,
+  "same_revision_mutation_preserves_baseline": true,
+  "wrong_audience_login_denied": true
+}

docs/evidence/2026-10-03-user-custody-live-final-acceptance.json

@@ -0,0 +1,33 @@
+{
+  "actual_grant": false,
+  "baseline_initially_absent": false,
+  "baseline_receipt_matched": true,
+  "baseline_survives_actual_pod_restart": true,
+  "capability_probe_read_at": "2026-10-03T18:30:58.194568+00:00",
+  "capability_probe_read_digest_matched": true,
+  "custody_write_denied": true,
+  "custody_write_denied_http_status": 403,
+  "empty_no_grant_document": true,
+  "empty_record_returns_no_grant": true,
+  "existing_baseline_receipt_matched": true,
+  "failure_preserves_baseline": true,
+  "fixture_service_serializes_live_empty_root_grant_null": true,
+  "fresh_authenticated_owner_read": true,
+  "hub_private_route_acceptance_claimed": false,
+  "injected_read_failure_returns_no_grant": true,
+  "metadata_list_denied": true,
+  "metadata_list_denied_http_status": 403,
+  "ok": true,
+  "other_tenant_returns_no_grant": true,
+  "owner_read_clock_aware": true,
+  "read_request_id": "91cd7235-9cfe-06c3-57a6-64a013d1cfcb",
+  "reader_login_request_id": "29a2fac4-8108-7ca5-d0a6-682c4a31f48d",
+  "reconnect_preserves_baseline": true,
+  "record_id_matched": true,
+  "record_revision": 1,
+  "runtime_enabled": true,
+  "same_revision_mutation_preserves_baseline": true,
+  "sibling_read_denied": true,
+  "sibling_read_denied_http_status": 403,
+  "wrong_audience_login_denied": true
+}

workplans/NK-WP-0045-root-grant-custody-record.md

@@ -129,8 +129,8 @@ the runtime. Include the fail-closed and staleness rules from ADR-0017.
 
 ```task
 id: NK-WP-0045-T06
-status: progress
+status: done
-depends_on: [NK-WP-0045-T01, NK-WP-0045-T05, USER-WP-0037-T02, RAPP-USER-ENGINE-WP-0003-T03]
+depends_on: [NK-WP-0045-T01, RPF-WP-0049-T04, USER-WP-0037-T02, RAPP-USER-ENGINE-WP-0003-T03]
 priority: medium
 state_hub_task_id: "eb71faf7-d6c7-5a3a-bdb6-17281cc5a01a"
 ```
@@ -138,6 +138,15 @@ state_hub_task_id: "eb71faf7-d6c7-5a3a-bdb6-17281cc5a01a"
 Tell user-engine the read path is live so USER-WP-0037-T02 can derive
 `AccountAuthority.root-grant` from it, and record the evidence.
 
+2026-10-03: live admitted reader and empty source accepted; controlled baseline
+initialization, fresh read and real post-initialization pod restart persistence
+verified. Reader LIST/sibling GET/exact-path write denied HTTP 403; wrong-audience
+JWT denied; no-grant mapping verified. Internal fixture service serialization
+uses the actual live source but does not claim external Hub-route acceptance.
+Consumer milestone depends on the completed producer admission/publication
+milestone RPF-WP-0049-T04; the broader T05 producer recovery gate remains separate.
+No actual root grant or ceremony is needed for this empty-source acceptance.
+
 ## Acceptance Criteria
 
 - The custody-record schema and validator exist and reject secret-bearing and
@@ -314,3 +323,18 @@ durable baseline through the authenticated reader and exercise live acceptance.
 The attended-login intervention is resolved; do not request it again.
 Knowledge reloaded: Emergent 0.2.4, start/root `verified-files`, orientation-only,
 digest `025aab4f38246219c924bc94954e70ea0e6e7f72bcaf8d4344cd599602d345c3`.
+
+## Live consumer delivery accepted — 2026-10-03
+
+Runtime owner completed RAPP-USER-ENGINE-WP-0003 (synced HEAD `f108c65`);
+reviewed Deployment/NetworkPolicy applied, verified custody image running,
+Ready 1/1 and HTTP 200 health/readiness. USER-WP-0037-T02 accepted the delivered
+empty source, with fresh authenticated receipt-bound baseline initialization and
+actual pod restart persistence. Exact reader denied list/sibling/write, and
+wrong-audience login denied. Evidence is retained in the final consumer receipt.
+T06 is done; T05 remains in progress for independent recovery/provider/audit
+evidence. Isolated actual OpenBao Raft snapshot restore refused an older missing
+record and accepted the latest matching record; no production rollback occurred.
+Startup limitation: each newly created pod initially hit one PostgreSQL
+connection-refused exit, then recovered to stable Ready. Source owner records
+this separately; it is not concealed as a zero-restart acceptance.