coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record failed custody finish diagnosis and tested recovery helper repair
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29
This commit is contained in:
tegwick 2026-10-03 21:09:39 +02:00
parent 842576b15e
commit c55e27762f
3 changed files with 78 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

28
docs/evidence/2026-10-03-root-custody-finish-failure-audit.json Normal file
View file

@ -0,0 +1,28 @@
{
"scope": "failed-attended-finish-stage-audit",
"raw_logs_emitted": false,
"lookup_succeeded": true,
"events": [
{
"time": "2026-10-03T18:54:37.880715204Z",
"request_id": "b29f3261-7fd3-84e9-7aa4-493205e469a4",
"stage": "custody_read",
"error_present": false,
"permission_denied": false
},
{
"time": "2026-10-03T18:54:38.14371374Z",
"request_id": "e474bc4b-9265-f3d9-d0f3-cdf6ec7eb038",
"stage": "backup_lane_read",
"error_present": false,
"permission_denied": false
},
{
"time": "2026-10-03T18:54:38.4374245Z",
"request_id": "d4c3df09-30e0-36f7-c66f-8d000e23dfe2",
"stage": "operator_backup_read",
"error_present": false,
"permission_denied": false
}
]
}

34
docs/evidence/2026-10-03-root-grant-delivery-progress.md
View file

@ -179,3 +179,37 @@ was retrieved through a fresh remote clone and matched byte-for-byte; the owner
retains its safe remote readback receipt. Provider archive generation is
explicitly unverified; the prepared attended direct encrypted history roundtrip
is still required. All authorized source work is implemented and synced.
## Failed recovery finish attempt — 2026-10-03
Founder ran the prepared helper with fresh receipt path
`/tmp/platform-root-finish-20261003T185421Z-333977.json`. Warden reported child
nonzero and session revoked; no receipt was created. Recovery/provider readiness
is not established. The helper's catch-all exit without a safe failure receipt
was an implementation gap and is being repaired before another attended retry.
Independent [bounded audit lookup](2026-10-03-root-custody-finish-failure-audit.json)
confirms successful custody, governed backup-lane and operator backup-bundle
reads at 18:54:37–38 UTC, with no errors. The failure is therefore after those
reads, within the backup roundtrip preparation/execution. Its exact stage cannot
be inferred from suppressed exceptions. No IAM widening is justified. Local
imports, validator/schema pins, retained-state validation and installed age
binaries pass offline preflight. Owner repair adds allowlisted stage/failure
receipts and full-command failure tests while keeping all raw diagnostics private.
Producer repair committed `33ff822`: stdlib entry reserves a fresh mode-0600
receipt before imports, with fixed stage/error codes for expected failures and
safe numeric HTTP/artifact metadata. Foreign exception text is never emitted.
The installed wrapper was independently smoke-checked outside the attended
envelope: it refused before owner reads and created the expected safe failure
receipt, with no raw output. Producer suite passed 32 tests, including full
private attended-HOME command execution with the real validator and age crypto
against disposable owner/provider fixtures, startup/dependency, stale receipt,
auth, quota, crypto, upload/download and incident/escrow failures.
Recovery decryption now verifies the existing independent local escrow recipient
against the governed lane and decrypts downloaded history with that escrow key;
no key is created, reset or printed. A mismatch is a specific recovery blocker.
Corrected attended retry with a new receipt is necessary to prove the actual
provider roundtrip or expose its precise safe failure stage. The original
failure's exact cause is still unknown, and provider readiness remains unproven.

16
workplans/NK-WP-0045-root-grant-custody-record.md
View file

@ -373,3 +373,19 @@ in owner source commit `a252447058105eed0931d34f1a906f39ce7c2e5e` and retrieved
through a fresh remote clone with exact byte matching. That proves remote source
retrieval, not a provider archive generation. The attended direct history backup
roundtrip is the remaining evidence gate.
Attended finish attempt `20261003T185421Z-333977` failed before receipt creation;
session was revoked. Audit verifies its custody and both backup bundle reads
were successful; exact subsequent roundtrip failure remains unproven. Producer
is repairing safe diagnostics and full-command test coverage before retry.
T05 remains wait and the plan blocked; no provider success is claimed and no
new credential admission or generic approval is inferred from this failure.
Producer repair `33ff822` now reserves a private fresh receipt before dependency
imports, emits only fixed stage/error codes and safe HTTP/artifact metadata, and
checks the existing independent escrow key for recovery. Thirty-two tests passed,
including full command startup/success/failure under private attended HOME with
real validator/age crypto and disposable backend/provider fixtures. Parent
installed-wrapper smoke confirmed non-attended execution is refused with safe
failure receipt. The same attended command is ready with a newly generated run
ID; actual provider failure/success is not inferable until that receipt exists.