From 742b8a24e583e4bfcc81515d134c1bf1eec70c40 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 3 Oct 2026 21:49:24 +0200 Subject: [PATCH] Record custody share diagnosis and owned repair blockers Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29 --- ...6-10-03-root-custody-share-inspection.json | 31 +++++++++++++++++++ ...2026-10-03-root-grant-delivery-progress.md | 22 +++++++++++++ .../NK-WP-0045-root-grant-custody-record.md | 22 +++++++++++-- 3 files changed, 73 insertions(+), 2 deletions(-) create mode 100644 docs/evidence/2026-10-03-root-custody-share-inspection.json diff --git a/docs/evidence/2026-10-03-root-custody-share-inspection.json b/docs/evidence/2026-10-03-root-custody-share-inspection.json new file mode 100644 index 0000000..cceed38 --- /dev/null +++ b/docs/evidence/2026-10-03-root-custody-share-inspection.json @@ -0,0 +1,31 @@ +{ + "backup_roundtrip_proved": false, + "current_live_baseline_matches": true, + "current_route_classification": "authentication_rejected", + "current_route_http_status": 401, + "current_token_found_in_reviewed_folder": false, + "current_token_unique": false, + "digest": "33a2ae086385028db1b654aa5646b7a98bcde1c5878c804e19315dadc3f87248", + "documented_route_classification": "authentication_rejected", + "documented_route_http_status": 401, + "documented_route_no_basic_classification": "other_status", + "documented_route_no_basic_http_status": 503, + "finished_at": "2026-10-03T19:36:10.731742+00:00", + "historical_config_present": true, + "historical_credential_status": "historical-owner-and-revocation-unverified", + "historical_share_matches_current_lane": false, + "kv_version": 1, + "labelled_share_present": false, + "labelled_share_unique": false, + "lane_kv_version": 3, + "ok": true, + "provider_mutations_performed": false, + "public_route_probes_skipped": false, + "read_only_diagnostic": true, + "record_id": "nk-custody:platform-root", + "recorded_at": "2026-10-03T19:36:07.682938+00:00", + "revision": 1, + "scope": "read-only-current-governed-share-inspection", + "stage": "complete", + "status": "diagnostic-complete" +} diff --git a/docs/evidence/2026-10-03-root-grant-delivery-progress.md b/docs/evidence/2026-10-03-root-grant-delivery-progress.md index 9580efa..4cbdb9d 100644 --- a/docs/evidence/2026-10-03-root-grant-delivery-progress.md +++ b/docs/evidence/2026-10-03-root-grant-delivery-progress.md @@ -278,3 +278,25 @@ protected/expired shares skip public authentication probes. Twenty-five finish tests pass. Exact expected/derived remote projection applied, working tree clean. Inspection still requires the founder's own attended credential route; no provider conclusion or actual backup success is inferred from source tests. + +## Successful share inspection; recovery remains blocked + +The attended read-only receipt at 19:36 UTC is retained in +`2026-10-03-root-custody-share-inspection.json`. The baseline matches live KV1; +backup lane KV3 has neither its token nor the expected labelled share in the +reviewed owner folder inventory. Both authenticated route probes returned 401; +the unauthenticated documented route returned 503. No provider mutation or +encrypted-history roundtrip was performed. Inventory absence is scoped to that +folder; these results do not prove global deletion or successful recovery. + +The platform owner is preparing a tested attended repair that proves replacement +share upload/download/decryption before CAS of only the lane's upload coordinates, +preserving all other fields, keys, backups and unknown shares. Activity-core owns +the subsequent consumer refresh: worker environment snapshots and the frozen +Forgejo backup ConfigMap require explicit loaded-client evidence. + +Security orientation reloaded after compaction: package 0.2.4, digest +`025aab4f38246219c924bc94954e70ea0e6e7f72bcaf8d4344cd599602d345c3`, +start card withheld/orientation-only because a source changed. Reviewed the local +start card and operative NetKingdom SECURITY-COMPANION directly; this retrieval +does not grant authority or establish live readiness. diff --git a/workplans/NK-WP-0045-root-grant-custody-record.md b/workplans/NK-WP-0045-root-grant-custody-record.md index f559e26..ff9f478 100644 --- a/workplans/NK-WP-0045-root-grant-custody-record.md +++ b/workplans/NK-WP-0045-root-grant-custody-record.md @@ -120,8 +120,8 @@ depends_on: [NK-WP-0045-T04, RPF-WP-0049-T05] wait_kind: both blocked_on: message-from:railiance-platform needs_human: true -intervention_note: "Use the tested bounded read-only provider/share inspection packet from railiance-platform in the founder OIDC/MFA terminal, with a fresh receipt. Do not repeat the unchanged finish command; approvals are already recorded." -blocking_reason: "Source/consumer/audit and baseline/escrow checks pass. Header-corrected provider upload still rejects HTTP 401 at backup lane KV version 3. Requires bounded operator share/endpoint diagnosis before repair, then actual encrypted history upload/readback/decryption proof; no blind same-command retry or new generic approval." +intervention_note: "Use the tested bounded provider share repair packet from railiance-platform once prepared, in the founder OIDC/MFA terminal with a fresh receipt. Inspection is complete; existing approval covers bounded delivery." +blocking_reason: "Inspection completed: backup lane KV3 token and expected labelled share absent from reviewed owner folder inventory. Requires tested bounded create-only share repair, verified retained-history upload/readback/decryption and expected-version CAS of only upload coordinates; source/consumer/audit remain verified." priority: medium state_hub_task_id: "628e8a3b-17a4-5f97-a484-c564a87d650d" ``` @@ -423,3 +423,21 @@ password and expiry-clock information and skips redundant auth probes on clearly protected/expired shares; 25 finish tests pass, exact remote sync applied, clean. The next human execution is read-only inspection with a fresh receipt, not another unchanged backup attempt. Approval remains recorded. + +The actual read-only inspection completed at 19:36 UTC; receipt is +`docs/evidence/2026-10-03-root-custody-share-inspection.json`. The current KV3 +token and expected labelled share were absent from the Backup owner's reviewed +folder inventory. This does not establish global deletion. No provider mutations +or backup roundtrip occurred; diagnostic `ok: true` is not recovery acceptance. + +Railiance-platform is preparing a bounded attended repair: verify the replacement +create-only share against the exact owner/folder, prove encrypted retained-history +upload/download/decryption, then CAS only the upload token and URL at the expected +lane version. Preserve the recovery key, other lane fields, existing backups and +unknown shares, and return safe receipts for partial operations. + +Activity-core owns the downstream delivery dependency: ExternalSecret refresh +does not refresh environment values in running workers; Forgejo's backup client +uses a frozen ConfigMap, and CNPG uses the projected platform checkout. Those +consumers need reviewed refresh and loaded-client evidence after a repaired lane +receipt. They do not substitute for NK's independent retained-history proof.