diff --git a/docs/evidence/2026-11-06-vergabe-attended-callback-timeout-return.json b/docs/evidence/2026-11-06-vergabe-attended-callback-timeout-return.json new file mode 100644 index 0000000..385bfd8 --- /dev/null +++ b/docs/evidence/2026-11-06-vergabe-attended-callback-timeout-return.json @@ -0,0 +1,87 @@ +{ + "schema": "railiance.vergabe-pilot-attended-backup-return.v1", + "evidence_kind": "user_reported_terminal_output", + "reported_on": "2026-11-06", + "workplan": "RAPPS-WP-0014", + "task": "RAPPS-WP-0014-T03", + "source_revision": "bf77e378a8498051c5dade23403e1e9f4d3974f2", + "preflight": { + "status": "ready_for_attended_capture", + "runtime_mutations": false, + "fixture_present": true, + "helm_revision": 4 + }, + "capture": { + "schema": "railiance.vergabe-pilot-three-store-capture.v1", + "run_id": "20261106T100825Z-acc2a468a535", + "status": "captured_and_resumed", + "database": "vergabe_demo_company", + "helm_revision": 4, + "app_resumed": true, + "off_host_verified": false, + "restore_verified": false, + "media_files": 1, + "media_bytes": 803, + "media_logical_sha256": "24fe90da88973ac03c8a475dff93c5866cebd797aeecdca2286989a1250779ed", + "fixture_document_sha256": "23a6850fa2391a58280c8515361ca29e9e92fa65fdadc36be7b44b552192e381", + "sqlite": { + "tables": 9, + "rows": 7, + "logical_sha256": "579dedb0e6a6b30f6cf3a5cec27ae423dbdaf0de959837cb9d697f6d5a789258", + "linked_issue_found": true, + "integrity_verified": true + }, + "stores_sha256": "669cff63a36c6d06bff67431ac736c513b46a90338e15d1c14351b0e66bd2ff0", + "stores_bytes": 3486, + "database_sha256": "48df7570a280a2682841ab536a343d5a1a8152bd1b093e3dedfda02206e9a90f", + "database_bytes": 169780, + "database_tables": 39, + "database_rows": 249, + "database_logical_sha256": "f17fdea4362920ee14bbbbd0f9f651d16f04059b646ef952a60d7424c9b4e45a", + "writers_quiesced": true, + "anonymous_document_http_status": 302, + "anonymous_document_denied": true, + "helper_cleanup_confirmed": true, + "restart_fixture_verified": true, + "elapsed_seconds": 83.11 + }, + "handoff": { + "status": "encrypted_handoff_ready", + "run_id": "20261106T100825Z-acc2a468a535", + "ciphertext_sha256": "ed27d370ba2a7b24830e41cf232b92ad6ca893430784fe14cad76d3e2b346575", + "ciphertext_bytes": 183066, + "application_changed": false + }, + "login_diagnostic": { + "category": "callback_timeout", + "client_exit": 2, + "helper_present": false, + "stdout_allowed": true, + "stderr_allowed": false, + "command_handoff_completed": false, + "possible_session_revocation_confirmed": false + }, + "provider_receipt": { + "status": "owner_login_or_child_not_completed", + "provider_outcome": "unconfirmed", + "warden_exit_code": 10, + "receipt_file": "/home/worsch/.local/state/vergabe-pilot-recovery/20261106T100825Z-acc2a468a535/provider-receipt-6b3f0400f006.json", + "session_cleanup_confirmed": null, + "session_revocation_confirmed": null, + "session_storage_cleanup_confirmed": null + }, + "final": { + "status": "attended_backup_failed", + "failure": "owner_operation_incomplete", + "details_suppressed": true + }, + "interpretation": { + "encrypted_workstation_pair_verified_before_login": true, + "provider_child_started_this_attempt": false, + "fresh_point_provider_publication_verified": false, + "fresh_point_restore_verified": false, + "recapture_required_for_retry": false, + "retry": "python3 tools/vergabe_pilot_backup.py --publish 20261106T100825Z-acc2a468a535 --verify-restore", + "inference_source": "Reviewed bf77e37 driver verifies local ciphertext/transfer before owner login; Warden reports callback_timeout before command handoff. No real private kit was inspected by the agent." + } +} diff --git a/docs/proposals/2026-11-06-vergabe-attended-backups/README.md b/docs/proposals/2026-11-06-vergabe-attended-backups/README.md index 9aa8279..f54e192 100644 --- a/docs/proposals/2026-11-06-vergabe-attended-backups/README.md +++ b/docs/proposals/2026-11-06-vergabe-attended-backups/README.md @@ -11,6 +11,23 @@ The [baseline restore](../../evidence/2026-11-06-vergabe-native-restore-return.j passes. This packet makes fresh points repeatable without changing the frozen acceptance tools. [Exact scope and code hashes](plan.json). +First operating attempt: the [founder return](../../evidence/2026-11-06-vergabe-attended-callback-timeout-return.json) +passes preflight, fresh three-store capture/resume (39 tables / 249 rows, +83.11 seconds) and encrypted handoff/fetch verification for +`20261106T100825Z-acc2a468a535`. OpenBao login then times out waiting for its +callback, before the provider child handoff (Warden 10). This attempt supplies +no fresh provider or restore proof; possible session revocation remains +unconfirmed. Retry only publication/restore of the existing frozen point: + +```bash +python3 tools/vergabe_pilot_backup.py --publish 20261106T100825Z-acc2a468a535 --verify-restore +``` + +Complete the browser login opened by the contained owner lane. This retry +verifies the private encrypted pair and uses a fresh contained login; it does +not pause or recapture the live application. The previous failure receipt remains +as historical evidence. No allowlist, token helper or login control is bypassed. + ## First operating run — founder terminal ```bash @@ -147,5 +164,6 @@ restore verification, embedded source compilation and founder boundary, failure sequencing, and retention protection/hash/conditional-delete races. No agent reads the founder's real private kit or executes this native credential -path. RAPPS-WP-0014-T03 remains waiting for the first operating run above; the +path. RAPPS-WP-0014-T03 remains waiting for the successful publication/restore +retry of the first operating point above; the existing baseline's technical proof and accepted targets are already recorded. diff --git a/docs/vergabe-demo-company-operating-acceptance.proposed.md b/docs/vergabe-demo-company-operating-acceptance.proposed.md index 64864cc..9ee6338 100644 --- a/docs/vergabe-demo-company-operating-acceptance.proposed.md +++ b/docs/vergabe-demo-company-operating-acceptance.proposed.md @@ -47,8 +47,13 @@ as the go for a deletion batch, as specified in the packet. ## Work still to finish -Execute the first fresh attended backup with `--verify-restore` and return the -sanitized backup/worker/transport receipts. Review provider retention previews +The first fresh capture/resume and encrypted transfer pass for +`20261106T100825Z-acc2a468a535`; the contained owner login then reports callback +timeout before provider command handoff. Retry `--publish` for that same run with +`--verify-restore` and return the sanitized backup/worker/transport receipts. +The [return](evidence/2026-11-06-vergabe-attended-callback-timeout-return.json) +does not establish fresh provider publication, restore or session revocation. +Review provider retention previews and execute only when eligible excess points exist; no artificial deletion is needed to accept an empty retention plan. Restored interactive SSO/callback/ingress remains untested; the isolated drill diff --git a/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md b/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md index 43d79d8..f6c4662 100644 --- a/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md +++ b/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md @@ -196,10 +196,10 @@ id: RAPPS-WP-0014-T03 status: wait needs_human: true decision_id: d06307e5-2737-461a-a2f4-a12c3b492a9a -intervention_note: "Native three-store restore/configuration inverse and cleanup pass (215 seconds). Founder selected attended backups with himself as backup/incident contact, daily active-day/pre-change cadence, seven daily/two weekly points, one active day data-loss and one working day recovery targets. Repeatable fresh-point backup/retention/isolated-restore path prepared; 76 tests pass. Next founder command: tools/vergabe_pilot_backup.py --execute --verify-restore after --check. Native SSO/ingress and older-image/Helm rollback remain outside the proof." +intervention_note: "Baseline native recovery passes; attended model selected. First operating capture/resume and encrypted transfer pass for 20261106T100825Z-acc2a468a535 (39 tables/249 rows, 83.11s). Contained login callback times out before provider child (Warden 10); possible session revocation unconfirmed. Retry python3 tools/vergabe_pilot_backup.py --publish 20261106T100825Z-acc2a468a535 --verify-restore with fresh browser login. No recapture/pause needed. T03 waits for this point's provider/restore receipts." priority: high assignee: the-custodian -blocking_reason: "Recovery and clone configuration-inverse proof pass; attended operating model selected. Finish and verify repeatable fresh-point capture/publication and bounded retention procedure before claiming the accepted cadence active. Restored native SSO/ingress and broader version rollback remain explicit limits." +blocking_reason: "Baseline recovery and accepted attended model pass; repeatable capture/transfer now pass. First fresh operating point still awaits contained owner login, provider publication/readback/decryption and restore after callback timeout. Restored native SSO/ingress and broader version rollback remain explicit limits." state_hub_task_id: "dd069c6d-fcc1-5bac-b233-976f2f0d5cd1" ``` @@ -558,6 +558,22 @@ capture, provider object or retention deletion has been performed by the agent. T03 waits for the first attended operating run: `python3 tools/vergabe_pilot_backup.py --execute --verify-restore`, after `--check`. +2026-11-06 first operating attempt: read-only check passes; run +`20261106T100825Z-acc2a468a535` captures and resumes successfully in 83.11 seconds, +39 PostgreSQL tables / 249 rows (logical SHA256 `f17fdea4…e45a`), matching original +PDF and SQLite nine tables / seven rows. New dump SHA256 `48df7570…a90f` and stores +SHA256 `669cff63…2ff0` are sealed as 183066 encrypted bytes, SHA256 +`ed27d370…6575`. The driver verifies the workstation pair before login. The +contained OpenBao login then fails with callback_timeout, client exit 2, +helper absent, Warden 10, before provider child handoff. Provider state and +possible session revocation remain unconfirmed; no fresh provider/restore +acceptance is claimed. Receipt: +`docs/evidence/2026-11-06-vergabe-attended-callback-timeout-return.json`. +No code/control change is indicated by this timeout. Retry only +`python3 tools/vergabe_pilot_backup.py --publish 20261106T100825Z-acc2a468a535 --verify-restore` +and complete its fresh contained browser login. The app is already resumed; +the completed capture does not need repeating. T03 remains wait. + ## Validate synthetic sizing against the exact release and shared contention