From 461f58081323d34f77e980fa4c54ba752b2fe228 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 22 Aug 2026 23:50:46 +0200 Subject: [PATCH] docs: project remaining WP0027 owner gates Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0290b-3241-74c3-b868-6049545af836 --- ...-drill-preparation-checklist-2026-08-22.md | 73 +++++++++++++++++ ...02-DRILL-20260822-01-railiance-master.json | 74 ++++++++++++++++++ ...-DRILL-20260822-01-railiance-platform.json | 78 +++++++++++++++++++ ...-WP-0027-credential-governance-lockdown.md | 12 +++ 4 files changed, 237 insertions(+) create mode 100644 docs/evidence/WARDEN-WP-0027-T02-drill-preparation-checklist-2026-08-22.md create mode 100644 interfaces/reviews/WARDEN-WP-0027-T02-DRILL-20260822-01-railiance-master.json create mode 100644 interfaces/reviews/WARDEN-WP-0027-T02-DRILL-20260822-01-railiance-platform.json diff --git a/docs/evidence/WARDEN-WP-0027-T02-drill-preparation-checklist-2026-08-22.md b/docs/evidence/WARDEN-WP-0027-T02-drill-preparation-checklist-2026-08-22.md new file mode 100644 index 0000000..801442f --- /dev/null +++ b/docs/evidence/WARDEN-WP-0027-T02-drill-preparation-checklist-2026-08-22.md @@ -0,0 +1,73 @@ +# WARDEN-WP-0027-T02 attended drill preparation checklist + +Status: `preparing` — `authorizes_execution: false`. + +## Immutable scenario basis + +- Scenario: `WARDEN-WP-0027-T02-DRILL-20260822-01` +- Scenario artifact: + `docs/evidence/WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md` +- Scenario SHA-256: + `ffa69764ad391db633f57ac70444e5781eee698bf9e362dfef31614fa43152dc` +- Preparation approval decision: + `9da57559-712a-4521-b46e-a4c69729f9d2` +- Preparation approved at: `2026-08-22T21:43:11Z` +- Scenario expires: `2026-08-23T20:00:00Z` +- Maximum live duration after a later exact GO: 45 minutes + +The scenario artifact is intentionally unchanged after railiance-infra approved +its pinned digest. This checklist records later preparation evidence without +invalidating that receipt. + +## Exact prepared live scope + +The only prepared live sequence is one intentional OpenBao seal followed by the +existing attended 2-of-3 Shamir unseal ceremony and value-safe post-unseal +verification. + +Preparation and owner receipts authorize no live action. The scope excludes a +host reboot, re-key, snapshot restore, policy change, PVC mutation, credential +disclosure, general workload restart, and every action not named above. + +## Owner review gates + +| Gate | Contract | State | +| --- | --- | --- | +| Independent provider console and distinct abort authority | `WARDEN-WP-0027-T02-DRILL-20260822-01-INFRA` | satisfied; receipt `01a02b4b-7295-7836-b288-f29407008524` | +| Fresh encrypted, verified, off-host Raft snapshot and platform driver acceptance | `WARDEN-WP-0027-T02-DRILL-20260822-01-PLATFORM` | pending | +| Two distinct custodians available for the current 2-of-3 barrier | `WARDEN-WP-0027-T02-DRILL-20260822-01-QUORUM` | pending | + +Every receipt is metadata-only. No receipt may include a provider credential, +OpenBao token, unseal share, recovery value, decrypted snapshot, custody +location, custodian identity, or value-derived fingerprint. + +## Final read-only preflight + +After both pending contracts are satisfied, ops-warden runs the platform-owned +`scripts/audit-core-recovery-preflight.py node-reboot` interface with: + +- approved window id `WARDEN-WP-0027-T02-DRILL-20260822-01`; +- the platform owner's current snapshot evidence file; +- the railiance-master quorum attestation; +- the accepted railiance-infra provider-console and abort role; +- the existing RAILIANCE-WP-0024 procedure-owner acknowledgements. + +The interface name reflects its superset recovery checklist; it does not add a +reboot to this scenario. Its result must report all of: + +- `preflight_only: true`; +- `automated_checks_passed: true`; +- `ready_for_live_execution: true`; +- `secret_values_observed: false`. + +Any changed cluster identity, invalid/stale snapshot receipt, missing owner +receipt, overlapping mutation, failed automated check, observed secret value, +or expired scenario is a NO-GO. + +## Final human hold point + +Only after the green preflight may ops-warden ask: + +`GO WARDEN-WP-0027-T02-DRILL-20260822-01?` + +No prior approval or conversational “go” crosses this hold point. diff --git a/interfaces/reviews/WARDEN-WP-0027-T02-DRILL-20260822-01-railiance-master.json b/interfaces/reviews/WARDEN-WP-0027-T02-DRILL-20260822-01-railiance-master.json new file mode 100644 index 0000000..ca5457d --- /dev/null +++ b/interfaces/reviews/WARDEN-WP-0027-T02-DRILL-20260822-01-railiance-master.json @@ -0,0 +1,74 @@ +{ + "schema_version": "review-contract/v1", + "contract_key": "WARDEN-WP-0027-T02-DRILL-20260822-01-QUORUM", + "subject": { + "kind": "task", + "id": "WARDEN-WP-0027-T02" + }, + "scenario_id": "WARDEN-WP-0027-T02-DRILL-20260822-01", + "preparation_decision_id": "9da57559-712a-4521-b46e-a4c69729f9d2", + "expires_at": "2026-08-23T20:00:00Z", + "authorizes_execution": false, + "evidence_boundary": "metadata_only", + "allowed_dispositions": [ + "approve", + "request_changes" + ], + "artifacts": { + "docs/evidence/WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md": { + "algorithm": "sha256", + "digest": "ffa69764ad391db633f57ac70444e5781eee698bf9e362dfef31614fa43152dc" + }, + "docs/evidence/WARDEN-WP-0027-T02-drill-preparation-checklist-2026-08-22.md": { + "algorithm": "sha256", + "digest": "5462b69104d31849cd73c308bb092c16e1a38b7d7e0a48c492a87e8207fdd3fa" + } + }, + "owners": [ + { + "id": "railiance-master", + "artifact_ids": [ + "docs/evidence/WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md", + "docs/evidence/WARDEN-WP-0027-T02-drill-preparation-checklist-2026-08-22.md" + ], + "assertions": [ + { + "id": "scenario-decision-and-expiry-bound", + "statement": "This receipt applies only to scenario WARDEN-WP-0027-T02-DRILL-20260822-01 under preparation decision 9da57559-712a-4521-b46e-a4c69729f9d2 and expires at 2026-08-23T20:00:00Z." + }, + { + "id": "two-distinct-custodians-available", + "statement": "The custody authority confirms that two distinct custodians for the current 2-of-3 OpenBao Shamir barrier are available for this attended scenario through approved out-of-band custody paths." + }, + { + "id": "custody-values-remain-out-of-band", + "statement": "Custodian identities, share values, custody locations, and all value-derived fingerprints remain outside Git, State Hub, logs, shell history, and chat." + }, + { + "id": "exact-live-scope-reviewed", + "statement": "The possible live scope is exactly one intentional OpenBao seal followed by the existing 2-of-3 unseal ceremony; it excludes host reboot, re-key, restore, policy change, PVC mutation, credential disclosure, and general workload restart." + }, + { + "id": "execution-not-authorized", + "statement": "Approval is quorum-availability evidence only and authorizes no OpenBao seal or unseal, reboot, or other live execution." + } + ], + "check_ids": [ + "scenario-artifact-sha256", + "preparation-checklist-sha256", + "two-distinct-custodians-availability-attestation", + "out-of-band-custody-boundary", + "metadata-only-boundary" + ] + } + ], + "gates": [ + { + "id": "WARDEN-WP-0027-T02-DRILL-20260822-01-QUORUM", + "policy": "all_required", + "owners": [ + "railiance-master" + ] + } + ] +} diff --git a/interfaces/reviews/WARDEN-WP-0027-T02-DRILL-20260822-01-railiance-platform.json b/interfaces/reviews/WARDEN-WP-0027-T02-DRILL-20260822-01-railiance-platform.json new file mode 100644 index 0000000..587a7c2 --- /dev/null +++ b/interfaces/reviews/WARDEN-WP-0027-T02-DRILL-20260822-01-railiance-platform.json @@ -0,0 +1,78 @@ +{ + "schema_version": "review-contract/v1", + "contract_key": "WARDEN-WP-0027-T02-DRILL-20260822-01-PLATFORM", + "subject": { + "kind": "task", + "id": "WARDEN-WP-0027-T02" + }, + "scenario_id": "WARDEN-WP-0027-T02-DRILL-20260822-01", + "preparation_decision_id": "9da57559-712a-4521-b46e-a4c69729f9d2", + "expires_at": "2026-08-23T20:00:00Z", + "authorizes_execution": false, + "evidence_boundary": "metadata_only", + "allowed_dispositions": [ + "approve", + "request_changes" + ], + "artifacts": { + "docs/evidence/WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md": { + "algorithm": "sha256", + "digest": "ffa69764ad391db633f57ac70444e5781eee698bf9e362dfef31614fa43152dc" + }, + "docs/evidence/WARDEN-WP-0027-T02-drill-preparation-checklist-2026-08-22.md": { + "algorithm": "sha256", + "digest": "5462b69104d31849cd73c308bb092c16e1a38b7d7e0a48c492a87e8207fdd3fa" + } + }, + "owners": [ + { + "id": "railiance-platform", + "artifact_ids": [ + "docs/evidence/WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md", + "docs/evidence/WARDEN-WP-0027-T02-drill-preparation-checklist-2026-08-22.md" + ], + "assertions": [ + { + "id": "scenario-decision-and-expiry-bound", + "statement": "This receipt applies only to scenario WARDEN-WP-0027-T02-DRILL-20260822-01 under preparation decision 9da57559-712a-4521-b46e-a4c69729f9d2 and expires at 2026-08-23T20:00:00Z." + }, + { + "id": "current-snapshot-receipt-valid", + "statement": "railiance-platform has created a fresh encrypted, verified, off-host OpenBao Raft snapshot through its approved custody path, and its metadata-only receipt passes the platform validator against the live railiance01 cluster id and a possible applied index." + }, + { + "id": "platform-driver-role-accepted", + "statement": "railiance-platform accepts the attended snapshot, seal/unseal driver, and value-safe post-unseal verification role for this scenario." + }, + { + "id": "exact-live-scope-reviewed", + "statement": "The possible live scope is exactly one intentional OpenBao seal followed by the existing 2-of-3 unseal ceremony; it excludes host reboot, re-key, restore, policy change, PVC mutation, credential disclosure, and general workload restart." + }, + { + "id": "metadata-only-evidence", + "statement": "The receipt and its checks disclose no snapshot data, decryption material, credential, token, recovery share, secret value, custody location, or value-derived fingerprint." + }, + { + "id": "execution-not-authorized", + "statement": "Approval is preparation evidence only and authorizes no OpenBao seal or unseal, snapshot restore, reboot, or other live execution." + } + ], + "check_ids": [ + "scenario-artifact-sha256", + "preparation-checklist-sha256", + "openbao-snapshot-receipt-validator", + "platform-driver-scope-review", + "metadata-only-boundary" + ] + } + ], + "gates": [ + { + "id": "WARDEN-WP-0027-T02-DRILL-20260822-01-PLATFORM", + "policy": "all_required", + "owners": [ + "railiance-platform" + ] + } + ] +} diff --git a/workplans/WARDEN-WP-0027-credential-governance-lockdown.md b/workplans/WARDEN-WP-0027-credential-governance-lockdown.md index 785a954..717ed37 100644 --- a/workplans/WARDEN-WP-0027-credential-governance-lockdown.md +++ b/workplans/WARDEN-WP-0027-credential-governance-lockdown.md @@ -177,6 +177,18 @@ It binds the exact scenario artifact and expiry, requires explicit independent provider-console and distinct-abort attestations, permits metadata-only evidence, and states `authorizes_execution: false`. +**Preparation approved 2026-08-22.** Decision +`9da57559-712a-4521-b46e-a4c69729f9d2` authorizes preparation only and narrows +the possible live scope to one intentional OpenBao seal followed by the existing +2-of-3 unseal ceremony. It excludes a host reboot, re-key, restore, policy +change, PVC mutation, credential disclosure, and general workload restart. +Railiance-infra satisfied its direct contract with receipt +`01a02b4b-7295-7836-b288-f29407008524`. The revisioned, non-authorizing gate +matrix is in +`docs/evidence/WARDEN-WP-0027-T02-drill-preparation-checklist-2026-08-22.md`; +platform snapshot/driver and master quorum contracts remain required before the +fully parameterized read-only preflight. + ## Task: Tamper-evident policy governance + reconcile ```task