From c55e27762f4cae8d094ea9e6c2f91e9eb49a6f8e Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 3 Oct 2026 21:09:39 +0200 Subject: [PATCH] Record failed custody finish diagnosis and tested recovery helper repair Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29 --- ...-03-root-custody-finish-failure-audit.json | 28 +++++++++++++++ ...2026-10-03-root-grant-delivery-progress.md | 34 +++++++++++++++++++ .../NK-WP-0045-root-grant-custody-record.md | 16 +++++++++ 3 files changed, 78 insertions(+) create mode 100644 docs/evidence/2026-10-03-root-custody-finish-failure-audit.json diff --git a/docs/evidence/2026-10-03-root-custody-finish-failure-audit.json b/docs/evidence/2026-10-03-root-custody-finish-failure-audit.json new file mode 100644 index 0000000..f529035 --- /dev/null +++ b/docs/evidence/2026-10-03-root-custody-finish-failure-audit.json @@ -0,0 +1,28 @@ +{ + "scope": "failed-attended-finish-stage-audit", + "raw_logs_emitted": false, + "lookup_succeeded": true, + "events": [ + { + "time": "2026-10-03T18:54:37.880715204Z", + "request_id": "b29f3261-7fd3-84e9-7aa4-493205e469a4", + "stage": "custody_read", + "error_present": false, + "permission_denied": false + }, + { + "time": "2026-10-03T18:54:38.14371374Z", + "request_id": "e474bc4b-9265-f3d9-d0f3-cdf6ec7eb038", + "stage": "backup_lane_read", + "error_present": false, + "permission_denied": false + }, + { + "time": "2026-10-03T18:54:38.4374245Z", + "request_id": "d4c3df09-30e0-36f7-c66f-8d000e23dfe2", + "stage": "operator_backup_read", + "error_present": false, + "permission_denied": false + } + ] +} diff --git a/docs/evidence/2026-10-03-root-grant-delivery-progress.md b/docs/evidence/2026-10-03-root-grant-delivery-progress.md index 5e87fd6..1e7bf1f 100644 --- a/docs/evidence/2026-10-03-root-grant-delivery-progress.md +++ b/docs/evidence/2026-10-03-root-grant-delivery-progress.md @@ -179,3 +179,37 @@ was retrieved through a fresh remote clone and matched byte-for-byte; the owner retains its safe remote readback receipt. Provider archive generation is explicitly unverified; the prepared attended direct encrypted history roundtrip is still required. All authorized source work is implemented and synced. + +## Failed recovery finish attempt — 2026-10-03 + +Founder ran the prepared helper with fresh receipt path +`/tmp/platform-root-finish-20261003T185421Z-333977.json`. Warden reported child +nonzero and session revoked; no receipt was created. Recovery/provider readiness +is not established. The helper's catch-all exit without a safe failure receipt +was an implementation gap and is being repaired before another attended retry. + +Independent [bounded audit lookup](2026-10-03-root-custody-finish-failure-audit.json) +confirms successful custody, governed backup-lane and operator backup-bundle +reads at 18:54:37–38 UTC, with no errors. The failure is therefore after those +reads, within the backup roundtrip preparation/execution. Its exact stage cannot +be inferred from suppressed exceptions. No IAM widening is justified. Local +imports, validator/schema pins, retained-state validation and installed age +binaries pass offline preflight. Owner repair adds allowlisted stage/failure +receipts and full-command failure tests while keeping all raw diagnostics private. + +Producer repair committed `33ff822`: stdlib entry reserves a fresh mode-0600 +receipt before imports, with fixed stage/error codes for expected failures and +safe numeric HTTP/artifact metadata. Foreign exception text is never emitted. +The installed wrapper was independently smoke-checked outside the attended +envelope: it refused before owner reads and created the expected safe failure +receipt, with no raw output. Producer suite passed 32 tests, including full +private attended-HOME command execution with the real validator and age crypto +against disposable owner/provider fixtures, startup/dependency, stale receipt, +auth, quota, crypto, upload/download and incident/escrow failures. + +Recovery decryption now verifies the existing independent local escrow recipient +against the governed lane and decrypts downloaded history with that escrow key; +no key is created, reset or printed. A mismatch is a specific recovery blocker. +Corrected attended retry with a new receipt is necessary to prove the actual +provider roundtrip or expose its precise safe failure stage. The original +failure's exact cause is still unknown, and provider readiness remains unproven. diff --git a/workplans/NK-WP-0045-root-grant-custody-record.md b/workplans/NK-WP-0045-root-grant-custody-record.md index 301e022..2e68384 100644 --- a/workplans/NK-WP-0045-root-grant-custody-record.md +++ b/workplans/NK-WP-0045-root-grant-custody-record.md @@ -373,3 +373,19 @@ in owner source commit `a252447058105eed0931d34f1a906f39ce7c2e5e` and retrieved through a fresh remote clone with exact byte matching. That proves remote source retrieval, not a provider archive generation. The attended direct history backup roundtrip is the remaining evidence gate. + +Attended finish attempt `20261003T185421Z-333977` failed before receipt creation; +session was revoked. Audit verifies its custody and both backup bundle reads +were successful; exact subsequent roundtrip failure remains unproven. Producer +is repairing safe diagnostics and full-command test coverage before retry. +T05 remains wait and the plan blocked; no provider success is claimed and no +new credential admission or generic approval is inferred from this failure. + +Producer repair `33ff822` now reserves a private fresh receipt before dependency +imports, emits only fixed stage/error codes and safe HTTP/artifact metadata, and +checks the existing independent escrow key for recovery. Thirty-two tests passed, +including full command startup/success/failure under private attended HOME with +real validator/age crypto and disposable backend/provider fixtures. Parent +installed-wrapper smoke confirmed non-attended execution is refused with safe +failure receipt. The same attended command is ready with a newly generated run +ID; actual provider failure/success is not inferable until that receipt exists.