From fa186baaffc6868778d28a28717b2ce41f4d6cfc Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 3 Oct 2026 20:51:21 +0200 Subject: [PATCH] Record completed owner recovery preparation and final sync receipts Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29 --- WORK-RECORDS.md | 4 ++-- .../2026-10-03-root-grant-delivery-progress.md | 11 ++++++++++- workplans/NK-WP-0045-root-grant-custody-record.md | 13 +++++++++++-- 3 files changed, 23 insertions(+), 5 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 33a89f7..401bfec 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -39,7 +39,7 @@ | workplan | NK-WP-0042 | blocked | — | workplans/NK-WP-0042-workload-mfa-step-up.md | | workplan | NK-WP-0043 | finished | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md | | workplan | NK-WP-0044 | finished | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | -| workplan | NK-WP-0045 | active | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| workplan | NK-WP-0045 | blocked | — | workplans/NK-WP-0045-root-grant-custody-record.md | | task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md | | task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md | | task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md | @@ -176,7 +176,7 @@ | task | NK-WP-0045-T02 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | | task | NK-WP-0045-T03 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | | task | NK-WP-0045-T04 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | -| task | NK-WP-0045-T05 | progress | — | workplans/NK-WP-0045-root-grant-custody-record.md | +| task | NK-WP-0045-T05 | wait | — | workplans/NK-WP-0045-root-grant-custody-record.md | | task | NK-WP-0045-T06 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | | intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | | intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | diff --git a/docs/evidence/2026-10-03-root-grant-delivery-progress.md b/docs/evidence/2026-10-03-root-grant-delivery-progress.md index 3275f7f..5e87fd6 100644 --- a/docs/evidence/2026-10-03-root-grant-delivery-progress.md +++ b/docs/evidence/2026-10-03-root-grant-delivery-progress.md @@ -165,8 +165,17 @@ USER-WP-0037-T02 is done, synced HEAD `d955cd7`; runtime workplan is finished, synced HEAD `f108c65`. The remaining T05 gate is the attended producer recovery finish helper: current retained-baseline/source match plus encrypted history provider upload/download/decryption through the existing governed Nextcloud -Backup lane. Eighteen producer/finish tests passed. It preserves all backups and +Backup lane. Final producer/finish suite: 19 passed, including actual age crypto +roundtrip against an in-memory disposable provider. It preserves all backups and uses a unique receipt/object. The surfaced historical backup-share URL is not repeated or stored here; the helper compares it with the current lane only as a boolean and stops for owner incident handling if they match. This unresolved comparison is not represented as a harmless or rotated credential. + +Producer synced `b8f8a7ada65f0a86b90a54812365757838102991`, exact commit +applied on primary/railiance01, clean with ahead/behind 0. Non-authoritative +baseline/history recovery copy in owner source `a252447058105eed0931d34f1a906f39ce7c2e5e` +was retrieved through a fresh remote clone and matched byte-for-byte; the owner +retains its safe remote readback receipt. Provider archive generation is +explicitly unverified; the prepared attended direct encrypted history roundtrip +is still required. All authorized source work is implemented and synced. diff --git a/workplans/NK-WP-0045-root-grant-custody-record.md b/workplans/NK-WP-0045-root-grant-custody-record.md index a3bb7a4..301e022 100644 --- a/workplans/NK-WP-0045-root-grant-custody-record.md +++ b/workplans/NK-WP-0045-root-grant-custody-record.md @@ -354,8 +354,9 @@ Producer prepared `scripts/root-custody-finish-attended.sh`: it checks the current live source against retained high-water state, uses the current governed Nextcloud Backup account/lane, enforces quota, encrypts baseline/history with age, creates one uniquely named object and verifies provider readback/decryption. -It does not overwrite/delete backups or rotate credentials. Eighteen producer/ -finish tests passed. It also checks whether the historical local backup-share +It does not overwrite/delete backups or rotate credentials. Nineteen producer/ +finish tests passed, including real age crypto with a disposable in-memory +provider. It also checks whether the historical local backup-share URL inadvertently surfaced during inspection matches the current lane, using booleans only; a current match stops before upload for the owner incident flow. No raw credentials are retained in evidence. @@ -364,3 +365,11 @@ T06 is complete, with user-engine synced `d955cd7` and runtime owner `f108c65`. T05 and the workplan return to blocked solely on the prepared attended recovery execution and its owner receipt. The founder's own OIDC/MFA terminal is required by the owner execution contract; no approval decision is reopened. + +Producer final owner sync: `b8f8a7ada65f0a86b90a54812365757838102991`, exact +expected/derived commit applied on primary/railiance01, clean and ahead/behind 0. +Non-authoritative recovery copy of the non-secret baseline/history was retained +in owner source commit `a252447058105eed0931d34f1a906f39ce7c2e5e` and retrieved +through a fresh remote clone with exact byte matching. That proves remote source +retrieval, not a provider archive generation. The attended direct history backup +roundtrip is the remaining evidence gate.