coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix custody recovery handoff for required public DAV upload header
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29
This commit is contained in:
tegwick 2026-10-03 21:21:20 +02:00
parent c55e27762f
commit d9f890c58a
3 changed files with 51 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

19
workplans/NK-WP-0045-root-grant-custody-record.md
View file

@ -121,7 +121,7 @@ wait_kind: both
blocked_on: message-from:railiance-platform
needs_human: true
intervention_note: "Run the prepared root-custody-finish-attended.sh through the existing founder OIDC/MFA route, with a fresh receipt. This is current restore/backup readback execution; design/go-forward approval is already recorded."
blocking_reason: "Live empty source, consumer rollout/restart/denial and audit correlation are verified. Remaining producer closure is attended current owner restore-check and governed encrypted retained-history provider upload/download/decryption evidence; no new design approval or real grant is required."
blocking_reason: "Live source/consumer/audit and current baseline/independent escrow checks pass. Provider upload rejected HTTP 401; producer is correcting the missing required public DAV request header. Closure requires a new attended encrypted history upload/readback/decryption receipt after the tested correction. No new design approval or real grant is required."
priority: medium
state_hub_task_id: "628e8a3b-17a4-5f97-a484-c564a87d650d"
```
@ -389,3 +389,20 @@ real validator/age crypto and disposable backend/provider fixtures. Parent
installed-wrapper smoke confirmed non-attended execution is refused with safe
failure receipt. The same attended command is ready with a newly generated run
ID; actual provider failure/success is not inferable until that receipt exists.
Second actual finish attempt `20261003T191229Z-333977` produced a safe failure
receipt: current baseline and independent escrow checks pass; historical share
differs from current lane; provider upload returned HTTP 401. Review identified
a missing required public DAV `X-Requested-With: XMLHttpRequest` request header,
whose omission Nextcloud documents as a cause of 401. Producer is fixing the
client request without rotating credentials or expanding authority. T05 remains
blocked pending authenticated upload/readback/decryption after that correction;
the client defect alone does not establish an invalid provider credential.
Protocol repair `50da37c` is implemented: exact public-DAV header added to custody
upload and shared platform clients, real HTTP wire test verifies the emitted
header and conditional-create request, failure receipt retains lane KV version.
Forty-one relevant tests pass; no credentials/endpoints/policies or account
fallback changed. Source-only refresh requirements for vendored backup workloads
are tracked by the platform owner and are not represented as deployed. T05
awaits a fresh attended live finish receipt from the corrected source.