Prepare empty custody baseline and record owner delivery handoff
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29
This commit is contained in:
parent
d1a895c06a
commit
d3a890e002
3 changed files with 143 additions and 6 deletions
76
docs/evidence/2026-10-03-root-grant-delivery-progress.md
Normal file
76
docs/evidence/2026-10-03-root-grant-delivery-progress.md
Normal file
|
|
@ -0,0 +1,76 @@
|
|||
# Root-grant delivery progress — 2026-10-03
|
||||
|
||||
Work: NK-WP-0045. Scope: approved OpenBao custody-record delivery. This receipt
|
||||
records source preparation and safe preflight; it is not live admission or
|
||||
custody-grant evidence.
|
||||
|
||||
## Human disposition and initial empty record
|
||||
|
||||
Bernd accepted ADR-0017 and the proposed OpenBao design (scoped made decision
|
||||
`c2cff929-91b9-4018-bfd6-fa04f7da8280`), then approved going forward.
|
||||
Asked which existing signed ceremony grounds the first grant, he replied:
|
||||
“i dont think there is one”. No current ceremony reference or exact custodian
|
||||
issuer/subject was supplied. Historical local bootstrap metadata and the
|
||||
planned signed escrow roster cannot substitute for a real grant.
|
||||
|
||||
Prepared [initial empty record](../../examples/custody-record/initial-empty-record.json)
|
||||
for review and attended publication: stable record ID `nk-custody:platform-root`,
|
||||
revision 1, owner `net-kingdom-custody`, 900-second maximum and `entries: []`.
|
||||
This is an intentionally empty authoritative candidate, not a synthetic grant
|
||||
fixture. It represents no certified root grants. Schema and semantic validation
|
||||
passed. It has not been published. Publication must use CAS=0 and fail if an
|
||||
existing document or unresolved retained history is discovered; do not replace
|
||||
an existing record on the assumption that no ceremony was supplied.
|
||||
|
||||
A future real grant requires a human-controlled ceremony naming exact issuer,
|
||||
subject, actor, action time/reason and evidence reference, introduced in a
|
||||
strictly newer revision. No identity is inferred from JWT roles or LLDAP groups.
|
||||
|
||||
## Source preparation and checks
|
||||
|
||||
- NetKingdom validator now emits `expires_at` so consumers can honor cache bounds
|
||||
tighter than 900 seconds. All 18 focused tests pass, including zero/60-second
|
||||
bounds. Canon source pin `db319335b27b61b855382ee5af5d690f06eeb010`.
|
||||
- railiance-platform implemented exact reader admission, whole-document CAS,
|
||||
independent receipt history, interrupted-publication recovery, replay and
|
||||
stale-receipt refusal, and restore checks; 14 tests passed. Source baseline
|
||||
`fa958cc`, attended empty-publication packet `35d326f`, exact-commit primary
|
||||
synchronization applied.
|
||||
- rapp-user-engine prepared dedicated openbao-audience JWT projection, scoped
|
||||
egress and explicit-image release rendering; 7 packaging tests passed. Source
|
||||
baseline `576f5e7`, pushed with clean working tree; empty-source rollout is
|
||||
explicitly supported. PostgreSQL baseline uses
|
||||
the existing DB; no new persistent volume is needed.
|
||||
- user-engine implements pinned canon, authenticated bounded reads, atomic
|
||||
PostgreSQL baseline, controlled receipt-bound bootstrap and optional
|
||||
AccountAuthority mapping. Isolated PostgreSQL checks verified competing CAS
|
||||
updates, cross-connection persistence and reconnect persistence. Final source
|
||||
`0d0751d`: suite ran 296 tests with eight skips; layer checks, wheel build and
|
||||
embedded-resource integrity passed. The deployment image digest is pending
|
||||
owner publication/verification.
|
||||
|
||||
## Safe live preflight
|
||||
|
||||
OpenBao workstation tunnel `http://127.0.0.1:18200`: initialized true, sealed
|
||||
false, standby false. Anonymous read of the exact custody data path returned
|
||||
403; response bodies were discarded. This proves only anonymous denial, not
|
||||
reader admission, document existence or positive live custody delivery.
|
||||
|
||||
## Remaining execution and acceptance
|
||||
|
||||
The founder runs OpenBao provisioning and publication in the attended OIDC/MFA
|
||||
lane. Existing approval is sufficient for the reviewed delivery work; this is
|
||||
an operator-session dependency. Follow the concrete producer packet in
|
||||
`railiance-platform/openbao/root-grant/README.md`, using fresh receipt files.
|
||||
Keep independently retained latest publication history through restore. Its
|
||||
location and backup receipt must be recorded before recovery readiness closes.
|
||||
|
||||
After the empty source is published, publish/pin the custody-capable application
|
||||
image, render/dry-run/diff/deploy through rapp-user-engine, and initialize the
|
||||
baseline using the authenticated document plus publisher digest. Empty source
|
||||
acceptance proves no-grant delivery; it cannot prove a real positive grant or
|
||||
revocation. Positive grant/revocation exercises use isolated synthetic test
|
||||
sources unless a real human ceremony explicitly introduces a live grant.
|
||||
|
||||
No live admission, publication, workload rollout or actual root grant occurred
|
||||
in this receipt. Source/fixture passes are distinct from live acceptance.
|
||||
13
examples/custody-record/initial-empty-record.json
Normal file
13
examples/custody-record/initial-empty-record.json
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
{
|
||||
"schema_version": "0.1",
|
||||
"kind": "netkingdom-custody-record",
|
||||
"record_id": "nk-custody:platform-root",
|
||||
"revision": 1,
|
||||
"updated_at": "2026-10-03T17:47:04.035713Z",
|
||||
"owner_system": "net-kingdom-custody",
|
||||
"freshness": {
|
||||
"max_cache_seconds": 900,
|
||||
"on_unreadable": "no-grant"
|
||||
},
|
||||
"entries": []
|
||||
}
|
||||
|
|
@ -4,7 +4,7 @@ type: workplan
|
|||
title: "Make the platform-root custody record readable as a non-secret root-grant fact"
|
||||
domain: infotech
|
||||
repo: net-kingdom
|
||||
status: active
|
||||
status: blocked
|
||||
flavor: implementation
|
||||
owner: claude-code
|
||||
topic_slug: netkingdom
|
||||
|
|
@ -115,11 +115,13 @@ answer fixes T05.
|
|||
|
||||
```task
|
||||
id: NK-WP-0045-T05
|
||||
status: progress
|
||||
status: wait
|
||||
depends_on: [NK-WP-0045-T04, RPF-WP-0049-T05]
|
||||
wait_kind: dependency
|
||||
wait_kind: both
|
||||
blocked_on: message-from:railiance-platform
|
||||
blocking_reason: "Approved OpenBao design; RPF-WP-0049-T05 must provide the real authenticated read path, custody provenance and producer receipts. Reader identity, executor/recovery and separate live provisioning approval remain pending."
|
||||
needs_human: true
|
||||
intervention_note: "Run the two attended commands in railiance-platform/openbao/root-grant/README.md with fresh receipts; OIDC/MFA requires founder terminal. Approvals are already recorded."
|
||||
blocking_reason: "Source implementation and go-forward approval complete; attended OpenBao admission/empty publication and RPF-WP-0049-T05 live producer/recovery receipts remain. No new generic approval or actual custodian identity is needed for the empty baseline."
|
||||
priority: medium
|
||||
state_hub_task_id: "628e8a3b-17a4-5f97-a484-c564a87d650d"
|
||||
```
|
||||
|
|
@ -132,10 +134,10 @@ the runtime. Include the fail-closed and staleness rules from ADR-0017.
|
|||
```task
|
||||
id: NK-WP-0045-T06
|
||||
status: wait
|
||||
depends_on: [NK-WP-0045-T01, NK-WP-0045-T05, USER-WP-0037-T02]
|
||||
depends_on: [NK-WP-0045-T01, NK-WP-0045-T05, USER-WP-0037-T02, RAPP-USER-ENGINE-WP-0003-T03]
|
||||
wait_kind: dependency
|
||||
blocked_on: message-from:user-engine
|
||||
blocking_reason: "Needs T05 delivery and user-engine USER-WP-0037-T02 adapter/mapping acceptance against the delivered source, including revocation, freshness and rollback evidence."
|
||||
blocking_reason: "Needs T05 delivery, the custody-capable image promotion and authenticated empty-source/baseline read-deny-outage-restart acceptance from USER-WP-0037-T02 and RAPP-USER-ENGINE-WP-0003-T03. Real grant exercises remain ceremony-dependent; empty source creates no grants."
|
||||
priority: medium
|
||||
state_hub_task_id: "eb71faf7-d6c7-5a3a-bdb6-17281cc5a01a"
|
||||
```
|
||||
|
|
@ -240,3 +242,49 @@ roster is `planned`, with planned identity references. Neither binds a current
|
|||
exact OIDC issuer/subject as a real root-grant ceremony record. Asked the founder
|
||||
for only the non-secret ceremony reference and exact issuer/subject; no grant
|
||||
will be inferred from directory/JWT projections or these historical records.
|
||||
|
||||
|
||||
## Source completion and operational handoff — 2026-10-03
|
||||
|
||||
Completed all presently implementable source work across three owner repos.
|
||||
Current state returns to `blocked`, with T05/T06 `wait`: attended OpenBao
|
||||
execution, image promotion and actual delivery/consumer acceptance remain.
|
||||
Design/go-forward approvals are resolved; do not ask them again. The attended
|
||||
session is required by the existing owner route and cannot be simulated by an
|
||||
agent process.
|
||||
|
||||
The founder answered the ceremony question: “i dont think there is one”.
|
||||
Prepared and validated the [initial empty candidate](../examples/custody-record/initial-empty-record.json)
|
||||
with `entries: []`, grounded by [non-secret disposition/evidence](../docs/evidence/2026-10-03-root-grant-delivery-progress.md).
|
||||
It assigns no root custodian and introduces no synthetic identity. Publication
|
||||
must refuse any existing unexpected record/baseline rather than overwrite it.
|
||||
A later real grant needs a genuine ceremony and a strictly newer revision.
|
||||
|
||||
- NetKingdom: emitted `expires_at` from the record's actual cache bound;
|
||||
18 focused tests pass. Canon pin `db319335b27b61b855382ee5af5d690f06eeb010`.
|
||||
- railiance-platform: attended publisher/admission/recovery with crash-safe
|
||||
receipts, replay refusal and source pinning; 14 tests pass, implementation
|
||||
`fa958cc`, empty-publication handoff `35d326f`, exact-commit primary sync applied.
|
||||
- user-engine: bounded authenticated transport, pinned policy/schema package,
|
||||
atomic durable PostgreSQL baseline, receipt-bound initial bootstrap and
|
||||
AccountAuthority mapping; source `0d0751d`. Final suite ran 296 tests with
|
||||
eight skips; layer and packaged-resource checks passed. Isolated PostgreSQL
|
||||
CAS/conflict/reconnect persistence verified. Image publication remains a
|
||||
release dependency until its immutable digest is recorded.
|
||||
- rapp-user-engine: separate projected openbao JWT and scoped egress, explicit
|
||||
immutable-image renderer and release/rollback packet; 7 packaging tests pass,
|
||||
`576f5e7`, pushed/clean. Owner plan RAPP-USER-ENGINE-WP-0003.
|
||||
|
||||
Operator steps are concrete in
|
||||
`railiance-platform/openbao/root-grant/README.md`: attended read-role/CAS
|
||||
admission, then publication of the reviewed empty candidate, with independent
|
||||
retained state and fresh non-secret receipts. After delivery and image
|
||||
publication, follow `rapp-user-engine/docs/root-custody-release.md` to render,
|
||||
dry-run/diff/deploy and initialize the PostgreSQL baseline using the publisher
|
||||
canonical document digest. Retain authenticated no-grant/read-deny/outage and
|
||||
restart evidence; positive grant/revocation remains isolated synthetic evidence
|
||||
until a real ceremony introduces a grant.
|
||||
|
||||
Safe live preflight only: OpenBao initialized/unsealed; anonymous exact-path
|
||||
read denied 403, response body discarded. No live admission, publication,
|
||||
consumer rollout or actual grant occurred in this session.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue