diff --git a/docs/evidence/2026-10-03-root-custody-finish-header-retry-rejected.json b/docs/evidence/2026-10-03-root-custody-finish-header-retry-rejected.json new file mode 100644 index 0000000..7392d7e --- /dev/null +++ b/docs/evidence/2026-10-03-root-custody-finish-header-retry-rejected.json @@ -0,0 +1,20 @@ +{ + "artifact": "root-custody-history-20261003T192343Z-43e7c034d42442c69fc0129872325b70.json.age", + "current_live_baseline_matches": true, + "digest": "33a2ae086385028db1b654aa5646b7a98bcde1c5878c804e19315dadc3f87248", + "error_code": "new_artifact_upload_failed", + "finished_at": "2026-10-03T19:23:44.017989+00:00", + "historical_config_present": true, + "historical_credential_status": "historical-owner-and-revocation-unverified", + "historical_share_matches_current_lane": false, + "independent_escrow_recipient_matches_current_lane": true, + "kv_version": 1, + "lane_kv_version": 3, + "ok": false, + "record_id": "nk-custody:platform-root", + "recorded_at": "2026-10-03T19:23:42.394837+00:00", + "revision": 1, + "stage": "provider_upload", + "status": "failed", + "upload_http_status": 401 +} diff --git a/docs/evidence/2026-10-03-root-grant-delivery-progress.md b/docs/evidence/2026-10-03-root-grant-delivery-progress.md index db21964..9580efa 100644 --- a/docs/evidence/2026-10-03-root-grant-delivery-progress.md +++ b/docs/evidence/2026-10-03-root-grant-delivery-progress.md @@ -245,3 +245,36 @@ key or account-fallback change was made. Source synchronization does not establi rollout of older vendored backup clients; owner records that refresh requirement separately. The corrected custody finish command needs a new attended run and fresh receipt to prove this live provider path. + +## Header-corrected live retry still rejected — 2026-10-03 + +Founder ran the corrected helper with fresh receipt +`/tmp/platform-root-finish-20261003T192330Z-290055.json`. The +[retained retry receipt](2026-10-03-root-custody-finish-header-retry-rejected.json) +again reports provider upload HTTP 401, now tied to backup lane KV version 3. +Current custody baseline and independent escrow checks pass, and the historical +share remains different from the current lane. The header correction does not +resolve this live rejection; an invalid, protected, expired or mismapped share +cannot be distinguished from client endpoint/auth semantics by 401 alone. + +Producer is preparing a bounded read-only attended provider/share inspection: +compare the current protected token with the operator's exact reviewed share, +report owner/path/create-only permissions, password/expiry indicators and safe +endpoint probes. No upload, rotation, provider share mutation or IAM widening +is authorized by diagnosis alone. Another unchanged finish retry is not requested. +The remaining task stays blocked on diagnosed provider delivery and its live +encrypted backup/readback proof; source/consumer/audit readiness is preserved. + +Read-only inspection implementation synced at producer +`4dd9646ec21b63a7743dae0ad3273da2f73adefe`. The existing attended wrapper now +accepts `--inspect-share`: current governed OCS share inventory is compared in +protected memory, and fixed provider public routes receive depth-zero PROPFIND +only. Output contains binding booleans and safe status classifications. Full-main +inspection tests forbid entering the backup roundtrip. Twenty-three finish tests +pass. Final review correction synced at +`fee1d339f98d0fd7ec2336d946eea2340d557f8a`: aware expiry offsets are converted +correctly, naive expiry and omitted password remain unknown, and clearly +protected/expired shares skip public authentication probes. Twenty-five finish +tests pass. Exact expected/derived remote projection applied, working tree clean. +Inspection still requires the founder's own attended credential route; +no provider conclusion or actual backup success is inferred from source tests. diff --git a/workplans/NK-WP-0045-root-grant-custody-record.md b/workplans/NK-WP-0045-root-grant-custody-record.md index 6fb1afe..f559e26 100644 --- a/workplans/NK-WP-0045-root-grant-custody-record.md +++ b/workplans/NK-WP-0045-root-grant-custody-record.md @@ -120,8 +120,8 @@ depends_on: [NK-WP-0045-T04, RPF-WP-0049-T05] wait_kind: both blocked_on: message-from:railiance-platform needs_human: true -intervention_note: "Run the prepared root-custody-finish-attended.sh through the existing founder OIDC/MFA route, with a fresh receipt. This is current restore/backup readback execution; design/go-forward approval is already recorded." -blocking_reason: "Live source/consumer/audit and current baseline/independent escrow checks pass. Provider upload rejected HTTP 401; producer is correcting the missing required public DAV request header. Closure requires a new attended encrypted history upload/readback/decryption receipt after the tested correction. No new design approval or real grant is required." +intervention_note: "Use the tested bounded read-only provider/share inspection packet from railiance-platform in the founder OIDC/MFA terminal, with a fresh receipt. Do not repeat the unchanged finish command; approvals are already recorded." +blocking_reason: "Source/consumer/audit and baseline/escrow checks pass. Header-corrected provider upload still rejects HTTP 401 at backup lane KV version 3. Requires bounded operator share/endpoint diagnosis before repair, then actual encrypted history upload/readback/decryption proof; no blind same-command retry or new generic approval." priority: medium state_hub_task_id: "628e8a3b-17a4-5f97-a484-c564a87d650d" ``` @@ -406,3 +406,20 @@ Forty-one relevant tests pass; no credentials/endpoints/policies or account fallback changed. Source-only refresh requirements for vendored backup workloads are tracked by the platform owner and are not represented as deployed. T05 awaits a fresh attended live finish receipt from the corrected source. + +Header-corrected actual retry `20261003T192330Z-290055` still failed HTTP 401 at +provider upload, lane KV version 3; current baseline and independent escrow match. +Header correction did not prove the actual cause or resolve provider delivery. +Owner is preparing bounded read-only provider share/endpoint inspection before +any credential or transport repair. T05/plan remain blocked; unchanged repeated +finish commands are not an actionable next step until diagnosis is available. + +Producer diagnostic `4dd9646ec21b63a7743dae0ad3273da2f73adefe` implements +`--inspect-share` in the existing bounded wrapper. It reads owner-scoped OCS +share bindings and compares current/documented public routes with depth-zero +PROPFIND, emitting safe metadata/statuses. Full-main tests prevent uploads. +Final review `fee1d339f98d0fd7ec2336d946eea2340d557f8a` preserves unknown +password and expiry-clock information and skips redundant auth probes on clearly +protected/expired shares; 25 finish tests pass, exact remote sync applied, clean. +The next human execution is read-only inspection with +a fresh receipt, not another unchanged backup attempt. Approval remains recorded.