From 7fa6985f729d4d651405fb14dc9759fb3b6c288f Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 22 Aug 2026 22:12:52 +0200 Subject: [PATCH] docs: record recovery preparation boundaries Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0290b-3241-74c3-b868-6049545af836 --- ...WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/docs/evidence/WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md b/docs/evidence/WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md index 998ea02..99fb0ce 100644 --- a/docs/evidence/WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md +++ b/docs/evidence/WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md @@ -47,6 +47,20 @@ reported: This baseline is not reusable as the final hold-point result. The platform owner must rerun it against the current state and fresh snapshot receipt. +## Fail-closed preparation probes + +- The OpenBao pod token helper and the current workstation caller token both + receive `403 permission denied` for a capabilities check on + `sys/storage/raft/snapshot`. No snapshot command was attempted after that + denial. The platform driver must use its attended owner identity; the agent + will not widen a workload token or substitute root. +- Warden has no autonomous provider-console catalog lane. Independent console + access therefore remains an explicit `railiance-infra` owner attestation, + not an inferred result from SSH reachability. +- The live barrier reports three shares and threshold two, but state metadata + cannot prove two custodians are currently present. Availability must arrive + through the out-of-band custody authority without identities or values. + ## Pending receipts - [ ] `railiance-platform`: fresh encrypted, verified, off-host OpenBao Raft