docs: project remaining WP0027 owner gates
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0290b-3241-74c3-b868-6049545af836
This commit is contained in:
parent
cdb44a8f23
commit
461f580813
4 changed files with 237 additions and 0 deletions
|
|
@ -0,0 +1,73 @@
|
|||
# WARDEN-WP-0027-T02 attended drill preparation checklist
|
||||
|
||||
Status: `preparing` — `authorizes_execution: false`.
|
||||
|
||||
## Immutable scenario basis
|
||||
|
||||
- Scenario: `WARDEN-WP-0027-T02-DRILL-20260822-01`
|
||||
- Scenario artifact:
|
||||
`docs/evidence/WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md`
|
||||
- Scenario SHA-256:
|
||||
`ffa69764ad391db633f57ac70444e5781eee698bf9e362dfef31614fa43152dc`
|
||||
- Preparation approval decision:
|
||||
`9da57559-712a-4521-b46e-a4c69729f9d2`
|
||||
- Preparation approved at: `2026-08-22T21:43:11Z`
|
||||
- Scenario expires: `2026-08-23T20:00:00Z`
|
||||
- Maximum live duration after a later exact GO: 45 minutes
|
||||
|
||||
The scenario artifact is intentionally unchanged after railiance-infra approved
|
||||
its pinned digest. This checklist records later preparation evidence without
|
||||
invalidating that receipt.
|
||||
|
||||
## Exact prepared live scope
|
||||
|
||||
The only prepared live sequence is one intentional OpenBao seal followed by the
|
||||
existing attended 2-of-3 Shamir unseal ceremony and value-safe post-unseal
|
||||
verification.
|
||||
|
||||
Preparation and owner receipts authorize no live action. The scope excludes a
|
||||
host reboot, re-key, snapshot restore, policy change, PVC mutation, credential
|
||||
disclosure, general workload restart, and every action not named above.
|
||||
|
||||
## Owner review gates
|
||||
|
||||
| Gate | Contract | State |
|
||||
| --- | --- | --- |
|
||||
| Independent provider console and distinct abort authority | `WARDEN-WP-0027-T02-DRILL-20260822-01-INFRA` | satisfied; receipt `01a02b4b-7295-7836-b288-f29407008524` |
|
||||
| Fresh encrypted, verified, off-host Raft snapshot and platform driver acceptance | `WARDEN-WP-0027-T02-DRILL-20260822-01-PLATFORM` | pending |
|
||||
| Two distinct custodians available for the current 2-of-3 barrier | `WARDEN-WP-0027-T02-DRILL-20260822-01-QUORUM` | pending |
|
||||
|
||||
Every receipt is metadata-only. No receipt may include a provider credential,
|
||||
OpenBao token, unseal share, recovery value, decrypted snapshot, custody
|
||||
location, custodian identity, or value-derived fingerprint.
|
||||
|
||||
## Final read-only preflight
|
||||
|
||||
After both pending contracts are satisfied, ops-warden runs the platform-owned
|
||||
`scripts/audit-core-recovery-preflight.py node-reboot` interface with:
|
||||
|
||||
- approved window id `WARDEN-WP-0027-T02-DRILL-20260822-01`;
|
||||
- the platform owner's current snapshot evidence file;
|
||||
- the railiance-master quorum attestation;
|
||||
- the accepted railiance-infra provider-console and abort role;
|
||||
- the existing RAILIANCE-WP-0024 procedure-owner acknowledgements.
|
||||
|
||||
The interface name reflects its superset recovery checklist; it does not add a
|
||||
reboot to this scenario. Its result must report all of:
|
||||
|
||||
- `preflight_only: true`;
|
||||
- `automated_checks_passed: true`;
|
||||
- `ready_for_live_execution: true`;
|
||||
- `secret_values_observed: false`.
|
||||
|
||||
Any changed cluster identity, invalid/stale snapshot receipt, missing owner
|
||||
receipt, overlapping mutation, failed automated check, observed secret value,
|
||||
or expired scenario is a NO-GO.
|
||||
|
||||
## Final human hold point
|
||||
|
||||
Only after the green preflight may ops-warden ask:
|
||||
|
||||
`GO WARDEN-WP-0027-T02-DRILL-20260822-01?`
|
||||
|
||||
No prior approval or conversational “go” crosses this hold point.
|
||||
|
|
@ -0,0 +1,74 @@
|
|||
{
|
||||
"schema_version": "review-contract/v1",
|
||||
"contract_key": "WARDEN-WP-0027-T02-DRILL-20260822-01-QUORUM",
|
||||
"subject": {
|
||||
"kind": "task",
|
||||
"id": "WARDEN-WP-0027-T02"
|
||||
},
|
||||
"scenario_id": "WARDEN-WP-0027-T02-DRILL-20260822-01",
|
||||
"preparation_decision_id": "9da57559-712a-4521-b46e-a4c69729f9d2",
|
||||
"expires_at": "2026-08-23T20:00:00Z",
|
||||
"authorizes_execution": false,
|
||||
"evidence_boundary": "metadata_only",
|
||||
"allowed_dispositions": [
|
||||
"approve",
|
||||
"request_changes"
|
||||
],
|
||||
"artifacts": {
|
||||
"docs/evidence/WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md": {
|
||||
"algorithm": "sha256",
|
||||
"digest": "ffa69764ad391db633f57ac70444e5781eee698bf9e362dfef31614fa43152dc"
|
||||
},
|
||||
"docs/evidence/WARDEN-WP-0027-T02-drill-preparation-checklist-2026-08-22.md": {
|
||||
"algorithm": "sha256",
|
||||
"digest": "5462b69104d31849cd73c308bb092c16e1a38b7d7e0a48c492a87e8207fdd3fa"
|
||||
}
|
||||
},
|
||||
"owners": [
|
||||
{
|
||||
"id": "railiance-master",
|
||||
"artifact_ids": [
|
||||
"docs/evidence/WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md",
|
||||
"docs/evidence/WARDEN-WP-0027-T02-drill-preparation-checklist-2026-08-22.md"
|
||||
],
|
||||
"assertions": [
|
||||
{
|
||||
"id": "scenario-decision-and-expiry-bound",
|
||||
"statement": "This receipt applies only to scenario WARDEN-WP-0027-T02-DRILL-20260822-01 under preparation decision 9da57559-712a-4521-b46e-a4c69729f9d2 and expires at 2026-08-23T20:00:00Z."
|
||||
},
|
||||
{
|
||||
"id": "two-distinct-custodians-available",
|
||||
"statement": "The custody authority confirms that two distinct custodians for the current 2-of-3 OpenBao Shamir barrier are available for this attended scenario through approved out-of-band custody paths."
|
||||
},
|
||||
{
|
||||
"id": "custody-values-remain-out-of-band",
|
||||
"statement": "Custodian identities, share values, custody locations, and all value-derived fingerprints remain outside Git, State Hub, logs, shell history, and chat."
|
||||
},
|
||||
{
|
||||
"id": "exact-live-scope-reviewed",
|
||||
"statement": "The possible live scope is exactly one intentional OpenBao seal followed by the existing 2-of-3 unseal ceremony; it excludes host reboot, re-key, restore, policy change, PVC mutation, credential disclosure, and general workload restart."
|
||||
},
|
||||
{
|
||||
"id": "execution-not-authorized",
|
||||
"statement": "Approval is quorum-availability evidence only and authorizes no OpenBao seal or unseal, reboot, or other live execution."
|
||||
}
|
||||
],
|
||||
"check_ids": [
|
||||
"scenario-artifact-sha256",
|
||||
"preparation-checklist-sha256",
|
||||
"two-distinct-custodians-availability-attestation",
|
||||
"out-of-band-custody-boundary",
|
||||
"metadata-only-boundary"
|
||||
]
|
||||
}
|
||||
],
|
||||
"gates": [
|
||||
{
|
||||
"id": "WARDEN-WP-0027-T02-DRILL-20260822-01-QUORUM",
|
||||
"policy": "all_required",
|
||||
"owners": [
|
||||
"railiance-master"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,78 @@
|
|||
{
|
||||
"schema_version": "review-contract/v1",
|
||||
"contract_key": "WARDEN-WP-0027-T02-DRILL-20260822-01-PLATFORM",
|
||||
"subject": {
|
||||
"kind": "task",
|
||||
"id": "WARDEN-WP-0027-T02"
|
||||
},
|
||||
"scenario_id": "WARDEN-WP-0027-T02-DRILL-20260822-01",
|
||||
"preparation_decision_id": "9da57559-712a-4521-b46e-a4c69729f9d2",
|
||||
"expires_at": "2026-08-23T20:00:00Z",
|
||||
"authorizes_execution": false,
|
||||
"evidence_boundary": "metadata_only",
|
||||
"allowed_dispositions": [
|
||||
"approve",
|
||||
"request_changes"
|
||||
],
|
||||
"artifacts": {
|
||||
"docs/evidence/WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md": {
|
||||
"algorithm": "sha256",
|
||||
"digest": "ffa69764ad391db633f57ac70444e5781eee698bf9e362dfef31614fa43152dc"
|
||||
},
|
||||
"docs/evidence/WARDEN-WP-0027-T02-drill-preparation-checklist-2026-08-22.md": {
|
||||
"algorithm": "sha256",
|
||||
"digest": "5462b69104d31849cd73c308bb092c16e1a38b7d7e0a48c492a87e8207fdd3fa"
|
||||
}
|
||||
},
|
||||
"owners": [
|
||||
{
|
||||
"id": "railiance-platform",
|
||||
"artifact_ids": [
|
||||
"docs/evidence/WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md",
|
||||
"docs/evidence/WARDEN-WP-0027-T02-drill-preparation-checklist-2026-08-22.md"
|
||||
],
|
||||
"assertions": [
|
||||
{
|
||||
"id": "scenario-decision-and-expiry-bound",
|
||||
"statement": "This receipt applies only to scenario WARDEN-WP-0027-T02-DRILL-20260822-01 under preparation decision 9da57559-712a-4521-b46e-a4c69729f9d2 and expires at 2026-08-23T20:00:00Z."
|
||||
},
|
||||
{
|
||||
"id": "current-snapshot-receipt-valid",
|
||||
"statement": "railiance-platform has created a fresh encrypted, verified, off-host OpenBao Raft snapshot through its approved custody path, and its metadata-only receipt passes the platform validator against the live railiance01 cluster id and a possible applied index."
|
||||
},
|
||||
{
|
||||
"id": "platform-driver-role-accepted",
|
||||
"statement": "railiance-platform accepts the attended snapshot, seal/unseal driver, and value-safe post-unseal verification role for this scenario."
|
||||
},
|
||||
{
|
||||
"id": "exact-live-scope-reviewed",
|
||||
"statement": "The possible live scope is exactly one intentional OpenBao seal followed by the existing 2-of-3 unseal ceremony; it excludes host reboot, re-key, restore, policy change, PVC mutation, credential disclosure, and general workload restart."
|
||||
},
|
||||
{
|
||||
"id": "metadata-only-evidence",
|
||||
"statement": "The receipt and its checks disclose no snapshot data, decryption material, credential, token, recovery share, secret value, custody location, or value-derived fingerprint."
|
||||
},
|
||||
{
|
||||
"id": "execution-not-authorized",
|
||||
"statement": "Approval is preparation evidence only and authorizes no OpenBao seal or unseal, snapshot restore, reboot, or other live execution."
|
||||
}
|
||||
],
|
||||
"check_ids": [
|
||||
"scenario-artifact-sha256",
|
||||
"preparation-checklist-sha256",
|
||||
"openbao-snapshot-receipt-validator",
|
||||
"platform-driver-scope-review",
|
||||
"metadata-only-boundary"
|
||||
]
|
||||
}
|
||||
],
|
||||
"gates": [
|
||||
{
|
||||
"id": "WARDEN-WP-0027-T02-DRILL-20260822-01-PLATFORM",
|
||||
"policy": "all_required",
|
||||
"owners": [
|
||||
"railiance-platform"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -177,6 +177,18 @@ It binds the exact scenario artifact and expiry, requires explicit independent
|
|||
provider-console and distinct-abort attestations, permits metadata-only evidence,
|
||||
and states `authorizes_execution: false`.
|
||||
|
||||
**Preparation approved 2026-08-22.** Decision
|
||||
`9da57559-712a-4521-b46e-a4c69729f9d2` authorizes preparation only and narrows
|
||||
the possible live scope to one intentional OpenBao seal followed by the existing
|
||||
2-of-3 unseal ceremony. It excludes a host reboot, re-key, restore, policy
|
||||
change, PVC mutation, credential disclosure, and general workload restart.
|
||||
Railiance-infra satisfied its direct contract with receipt
|
||||
`01a02b4b-7295-7836-b288-f29407008524`. The revisioned, non-authorizing gate
|
||||
matrix is in
|
||||
`docs/evidence/WARDEN-WP-0027-T02-drill-preparation-checklist-2026-08-22.md`;
|
||||
platform snapshot/driver and master quorum contracts remain required before the
|
||||
fully parameterized read-only preflight.
|
||||
|
||||
## Task: Tamper-evident policy governance + reconcile
|
||||
|
||||
```task
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue