coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix custody recovery handoff for required public DAV upload header
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29
This commit is contained in:
tegwick 2026-10-03 21:21:20 +02:00
parent c55e27762f
commit d9f890c58a
3 changed files with 51 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
docs/evidence/2026-10-03-root-custody-finish-upload-rejected.json Normal file
View file

@ -0,0 +1 @@
{"artifact": "root-custody-history-20261003T191242Z-7b4d49ff72344564adf69b498832ee20.json.age", "current_live_baseline_matches": true, "digest": "33a2ae086385028db1b654aa5646b7a98bcde1c5878c804e19315dadc3f87248", "error_code": "new_artifact_upload_failed", "finished_at": "2026-10-03T19:12:42.979494+00:00", "historical_config_present": true, "historical_credential_status": "historical-owner-and-revocation-unverified", "historical_share_matches_current_lane": false, "independent_escrow_recipient_matches_current_lane": true, "kv_version": 1, "ok": false, "record_id": "nk-custody:platform-root", "recorded_at": "2026-10-03T19:12:40.936033+00:00", "revision": 1, "stage": "provider_upload", "status": "failed", "upload_http_status": 401}

32
docs/evidence/2026-10-03-root-grant-delivery-progress.md
View file

@ -213,3 +213,35 @@ no key is created, reset or printed. A mismatch is a specific recovery blocker.
Corrected attended retry with a new receipt is necessary to prove the actual
provider roundtrip or expose its precise safe failure stage. The original
failure's exact cause is still unknown, and provider readiness remains unproven.
## Provider upload rejection diagnosed — 2026-10-03
Founder retried with fresh receipt
`/tmp/platform-root-finish-20261003T191229Z-333977.json`; the
[safe failure receipt](2026-10-03-root-custody-finish-upload-rejected.json)
reports `stage: provider_upload`, `error_code: new_artifact_upload_failed` and
HTTP 401. Current retained baseline matches revision 1/KV1/digest; existing
independent escrow recipient matches the governed lane. Historical local share
does not match the current lane; its revocation remains separately unverified.
No provider backup success is claimed.
Source review found the custody upload omits `X-Requested-With: XMLHttpRequest`.
[Official Nextcloud WebDAV documentation](https://docs.nextcloud.com/server/stable/developer_manual/client_apis/WebDAV/basic.html)
requires this header on public DAV non-GET requests unless outgoing federation
is enabled; without it, the documented response is 401 Not Authenticated.
This is a concrete client defect and a likely explanation of the observed 401,
not proof that the current share credential is invalid or that header correction
already resolves this live instance. Producer is fixing/testing the protocol
request while retaining existing endpoint, credentials and permissions. A new
attended live result is still required.
Producer protocol repair committed `50da37c`: custody public-DAV upload now sends
the required header, with a real local HTTP wire test verifying its presence and
conditional-create semantics. Shared migration request helper and common upload
client have the same scoped source correction. Forty-one tests passed (19 finish,
14 producer, eight backup credential checks); shell syntax and diff checks pass.
Failure receipts retain the backup lane's KV version. No token, endpoint, policy,
key or account-fallback change was made. Source synchronization does not establish
rollout of older vendored backup clients; owner records that refresh requirement
separately. The corrected custody finish command needs a new attended run and
fresh receipt to prove this live provider path.