diff --git a/docs/evidence/2026-10-03-root-grant-delivery-progress.md b/docs/evidence/2026-10-03-root-grant-delivery-progress.md new file mode 100644 index 0000000..ec34840 --- /dev/null +++ b/docs/evidence/2026-10-03-root-grant-delivery-progress.md @@ -0,0 +1,76 @@ +# Root-grant delivery progress — 2026-10-03 + +Work: NK-WP-0045. Scope: approved OpenBao custody-record delivery. This receipt +records source preparation and safe preflight; it is not live admission or +custody-grant evidence. + +## Human disposition and initial empty record + +Bernd accepted ADR-0017 and the proposed OpenBao design (scoped made decision +`c2cff929-91b9-4018-bfd6-fa04f7da8280`), then approved going forward. +Asked which existing signed ceremony grounds the first grant, he replied: +“i dont think there is one”. No current ceremony reference or exact custodian +issuer/subject was supplied. Historical local bootstrap metadata and the +planned signed escrow roster cannot substitute for a real grant. + +Prepared [initial empty record](../../examples/custody-record/initial-empty-record.json) +for review and attended publication: stable record ID `nk-custody:platform-root`, +revision 1, owner `net-kingdom-custody`, 900-second maximum and `entries: []`. +This is an intentionally empty authoritative candidate, not a synthetic grant +fixture. It represents no certified root grants. Schema and semantic validation +passed. It has not been published. Publication must use CAS=0 and fail if an +existing document or unresolved retained history is discovered; do not replace +an existing record on the assumption that no ceremony was supplied. + +A future real grant requires a human-controlled ceremony naming exact issuer, +subject, actor, action time/reason and evidence reference, introduced in a +strictly newer revision. No identity is inferred from JWT roles or LLDAP groups. + +## Source preparation and checks + +- NetKingdom validator now emits `expires_at` so consumers can honor cache bounds + tighter than 900 seconds. All 18 focused tests pass, including zero/60-second + bounds. Canon source pin `db319335b27b61b855382ee5af5d690f06eeb010`. +- railiance-platform implemented exact reader admission, whole-document CAS, + independent receipt history, interrupted-publication recovery, replay and + stale-receipt refusal, and restore checks; 14 tests passed. Source baseline + `fa958cc`, attended empty-publication packet `35d326f`, exact-commit primary + synchronization applied. +- rapp-user-engine prepared dedicated openbao-audience JWT projection, scoped + egress and explicit-image release rendering; 7 packaging tests passed. Source + baseline `576f5e7`, pushed with clean working tree; empty-source rollout is + explicitly supported. PostgreSQL baseline uses + the existing DB; no new persistent volume is needed. +- user-engine implements pinned canon, authenticated bounded reads, atomic + PostgreSQL baseline, controlled receipt-bound bootstrap and optional + AccountAuthority mapping. Isolated PostgreSQL checks verified competing CAS + updates, cross-connection persistence and reconnect persistence. Final source + `0d0751d`: suite ran 296 tests with eight skips; layer checks, wheel build and + embedded-resource integrity passed. The deployment image digest is pending + owner publication/verification. + +## Safe live preflight + +OpenBao workstation tunnel `http://127.0.0.1:18200`: initialized true, sealed +false, standby false. Anonymous read of the exact custody data path returned +403; response bodies were discarded. This proves only anonymous denial, not +reader admission, document existence or positive live custody delivery. + +## Remaining execution and acceptance + +The founder runs OpenBao provisioning and publication in the attended OIDC/MFA +lane. Existing approval is sufficient for the reviewed delivery work; this is +an operator-session dependency. Follow the concrete producer packet in +`railiance-platform/openbao/root-grant/README.md`, using fresh receipt files. +Keep independently retained latest publication history through restore. Its +location and backup receipt must be recorded before recovery readiness closes. + +After the empty source is published, publish/pin the custody-capable application +image, render/dry-run/diff/deploy through rapp-user-engine, and initialize the +baseline using the authenticated document plus publisher digest. Empty source +acceptance proves no-grant delivery; it cannot prove a real positive grant or +revocation. Positive grant/revocation exercises use isolated synthetic test +sources unless a real human ceremony explicitly introduces a live grant. + +No live admission, publication, workload rollout or actual root grant occurred +in this receipt. Source/fixture passes are distinct from live acceptance. diff --git a/examples/custody-record/initial-empty-record.json b/examples/custody-record/initial-empty-record.json new file mode 100644 index 0000000..e54efd5 --- /dev/null +++ b/examples/custody-record/initial-empty-record.json @@ -0,0 +1,13 @@ +{ + "schema_version": "0.1", + "kind": "netkingdom-custody-record", + "record_id": "nk-custody:platform-root", + "revision": 1, + "updated_at": "2026-10-03T17:47:04.035713Z", + "owner_system": "net-kingdom-custody", + "freshness": { + "max_cache_seconds": 900, + "on_unreadable": "no-grant" + }, + "entries": [] +} diff --git a/workplans/NK-WP-0045-root-grant-custody-record.md b/workplans/NK-WP-0045-root-grant-custody-record.md index bd4ccb1..d4dce9c 100644 --- a/workplans/NK-WP-0045-root-grant-custody-record.md +++ b/workplans/NK-WP-0045-root-grant-custody-record.md @@ -4,7 +4,7 @@ type: workplan title: "Make the platform-root custody record readable as a non-secret root-grant fact" domain: infotech repo: net-kingdom -status: active +status: blocked flavor: implementation owner: claude-code topic_slug: netkingdom @@ -115,11 +115,13 @@ answer fixes T05. ```task id: NK-WP-0045-T05 -status: progress +status: wait depends_on: [NK-WP-0045-T04, RPF-WP-0049-T05] -wait_kind: dependency +wait_kind: both blocked_on: message-from:railiance-platform -blocking_reason: "Approved OpenBao design; RPF-WP-0049-T05 must provide the real authenticated read path, custody provenance and producer receipts. Reader identity, executor/recovery and separate live provisioning approval remain pending." +needs_human: true +intervention_note: "Run the two attended commands in railiance-platform/openbao/root-grant/README.md with fresh receipts; OIDC/MFA requires founder terminal. Approvals are already recorded." +blocking_reason: "Source implementation and go-forward approval complete; attended OpenBao admission/empty publication and RPF-WP-0049-T05 live producer/recovery receipts remain. No new generic approval or actual custodian identity is needed for the empty baseline." priority: medium state_hub_task_id: "628e8a3b-17a4-5f97-a484-c564a87d650d" ``` @@ -132,10 +134,10 @@ the runtime. Include the fail-closed and staleness rules from ADR-0017. ```task id: NK-WP-0045-T06 status: wait -depends_on: [NK-WP-0045-T01, NK-WP-0045-T05, USER-WP-0037-T02] +depends_on: [NK-WP-0045-T01, NK-WP-0045-T05, USER-WP-0037-T02, RAPP-USER-ENGINE-WP-0003-T03] wait_kind: dependency blocked_on: message-from:user-engine -blocking_reason: "Needs T05 delivery and user-engine USER-WP-0037-T02 adapter/mapping acceptance against the delivered source, including revocation, freshness and rollback evidence." +blocking_reason: "Needs T05 delivery, the custody-capable image promotion and authenticated empty-source/baseline read-deny-outage-restart acceptance from USER-WP-0037-T02 and RAPP-USER-ENGINE-WP-0003-T03. Real grant exercises remain ceremony-dependent; empty source creates no grants." priority: medium state_hub_task_id: "eb71faf7-d6c7-5a3a-bdb6-17281cc5a01a" ``` @@ -240,3 +242,49 @@ roster is `planned`, with planned identity references. Neither binds a current exact OIDC issuer/subject as a real root-grant ceremony record. Asked the founder for only the non-secret ceremony reference and exact issuer/subject; no grant will be inferred from directory/JWT projections or these historical records. + + +## Source completion and operational handoff — 2026-10-03 + +Completed all presently implementable source work across three owner repos. +Current state returns to `blocked`, with T05/T06 `wait`: attended OpenBao +execution, image promotion and actual delivery/consumer acceptance remain. +Design/go-forward approvals are resolved; do not ask them again. The attended +session is required by the existing owner route and cannot be simulated by an +agent process. + +The founder answered the ceremony question: “i dont think there is one”. +Prepared and validated the [initial empty candidate](../examples/custody-record/initial-empty-record.json) +with `entries: []`, grounded by [non-secret disposition/evidence](../docs/evidence/2026-10-03-root-grant-delivery-progress.md). +It assigns no root custodian and introduces no synthetic identity. Publication +must refuse any existing unexpected record/baseline rather than overwrite it. +A later real grant needs a genuine ceremony and a strictly newer revision. + +- NetKingdom: emitted `expires_at` from the record's actual cache bound; + 18 focused tests pass. Canon pin `db319335b27b61b855382ee5af5d690f06eeb010`. +- railiance-platform: attended publisher/admission/recovery with crash-safe + receipts, replay refusal and source pinning; 14 tests pass, implementation + `fa958cc`, empty-publication handoff `35d326f`, exact-commit primary sync applied. +- user-engine: bounded authenticated transport, pinned policy/schema package, + atomic durable PostgreSQL baseline, receipt-bound initial bootstrap and + AccountAuthority mapping; source `0d0751d`. Final suite ran 296 tests with + eight skips; layer and packaged-resource checks passed. Isolated PostgreSQL + CAS/conflict/reconnect persistence verified. Image publication remains a + release dependency until its immutable digest is recorded. +- rapp-user-engine: separate projected openbao JWT and scoped egress, explicit + immutable-image renderer and release/rollback packet; 7 packaging tests pass, + `576f5e7`, pushed/clean. Owner plan RAPP-USER-ENGINE-WP-0003. + +Operator steps are concrete in +`railiance-platform/openbao/root-grant/README.md`: attended read-role/CAS +admission, then publication of the reviewed empty candidate, with independent +retained state and fresh non-secret receipts. After delivery and image +publication, follow `rapp-user-engine/docs/root-custody-release.md` to render, +dry-run/diff/deploy and initialize the PostgreSQL baseline using the publisher +canonical document digest. Retain authenticated no-grant/read-deny/outage and +restart evidence; positive grant/revocation remains isolated synthetic evidence +until a real ceremony introduces a grant. + +Safe live preflight only: OpenBao initialized/unsealed; anonymous exact-path +read denied 403, response body discarded. No live admission, publication, +consumer rollout or actual grant occurred in this session.