79 lines
3.2 KiB
JSON
79 lines
3.2 KiB
JSON
|
{
|
||
|
|
"schema_version": "review-contract/v1",
|
||
|
|
"contract_key": "WARDEN-WP-0027-T02-DRILL-20260822-01-PLATFORM",
|
||
|
|
"subject": {
|
||
|
|
"kind": "task",
|
||
|
|
"id": "WARDEN-WP-0027-T02"
|
||
|
|
},
|
||
|
|
"scenario_id": "WARDEN-WP-0027-T02-DRILL-20260822-01",
|
||
|
|
"preparation_decision_id": "9da57559-712a-4521-b46e-a4c69729f9d2",
|
||
|
|
"expires_at": "2026-08-23T20:00:00Z",
|
||
|
|
"authorizes_execution": false,
|
||
|
|
"evidence_boundary": "metadata_only",
|
||
|
|
"allowed_dispositions": [
|
||
|
|
"approve",
|
||
|
|
"request_changes"
|
||
|
|
],
|
||
|
|
"artifacts": {
|
||
|
|
"docs/evidence/WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md": {
|
||
|
|
"algorithm": "sha256",
|
||
|
|
"digest": "ffa69764ad391db633f57ac70444e5781eee698bf9e362dfef31614fa43152dc"
|
||
|
|
},
|
||
|
|
"docs/evidence/WARDEN-WP-0027-T02-drill-preparation-checklist-2026-08-22.md": {
|
||
|
|
"algorithm": "sha256",
|
||
|
|
"digest": "5462b69104d31849cd73c308bb092c16e1a38b7d7e0a48c492a87e8207fdd3fa"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"owners": [
|
||
|
|
{
|
||
|
|
"id": "railiance-platform",
|
||
|
|
"artifact_ids": [
|
||
|
|
"docs/evidence/WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md",
|
||
|
|
"docs/evidence/WARDEN-WP-0027-T02-drill-preparation-checklist-2026-08-22.md"
|
||
|
|
],
|
||
|
|
"assertions": [
|
||
|
|
{
|
||
|
|
"id": "scenario-decision-and-expiry-bound",
|
||
|
|
"statement": "This receipt applies only to scenario WARDEN-WP-0027-T02-DRILL-20260822-01 under preparation decision 9da57559-712a-4521-b46e-a4c69729f9d2 and expires at 2026-08-23T20:00:00Z."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "current-snapshot-receipt-valid",
|
||
|
|
"statement": "railiance-platform has created a fresh encrypted, verified, off-host OpenBao Raft snapshot through its approved custody path, and its metadata-only receipt passes the platform validator against the live railiance01 cluster id and a possible applied index."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "platform-driver-role-accepted",
|
||
|
|
"statement": "railiance-platform accepts the attended snapshot, seal/unseal driver, and value-safe post-unseal verification role for this scenario."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "exact-live-scope-reviewed",
|
||
|
|
"statement": "The possible live scope is exactly one intentional OpenBao seal followed by the existing 2-of-3 unseal ceremony; it excludes host reboot, re-key, restore, policy change, PVC mutation, credential disclosure, and general workload restart."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "metadata-only-evidence",
|
||
|
|
"statement": "The receipt and its checks disclose no snapshot data, decryption material, credential, token, recovery share, secret value, custody location, or value-derived fingerprint."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "execution-not-authorized",
|
||
|
|
"statement": "Approval is preparation evidence only and authorizes no OpenBao seal or unseal, snapshot restore, reboot, or other live execution."
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"check_ids": [
|
||
|
|
"scenario-artifact-sha256",
|
||
|
|
"preparation-checklist-sha256",
|
||
|
|
"openbao-snapshot-receipt-validator",
|
||
|
|
"platform-driver-scope-review",
|
||
|
|
"metadata-only-boundary"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"gates": [
|
||
|
|
{
|
||
|
|
"id": "WARDEN-WP-0027-T02-DRILL-20260822-01-PLATFORM",
|
||
|
|
"policy": "all_required",
|
||
|
|
"owners": [
|
||
|
|
"railiance-platform"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|