Prepare Vergabe two-user acceptance and record recovery gaps

Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1abf1-7e95-7141-87c9-ee78332bf790
2026-11-05 14:54:54 +01:00 · 2026-11-05 14:54:54 +01:00 · 2d5be35c89
commit 2d5be35c89
parent de7d179a64
6 changed files with 274 additions and 1 deletions
--- a/.gitattributes
+++ b/.gitattributes
@ -0,0 +1 @@
+*.pdf binary
--- a/docs/evidence/2026-11-05-vergabe-pilot-preflight.json
+++ b/docs/evidence/2026-11-05-vergabe-pilot-preflight.json
@ -0,0 +1,134 @@
+{
+  "schema": "railiance.vergabe-pilot-readiness.v1",
+  "observed_at": "2026-11-05T13:51:41.461787+00:00",
+  "workplan": "RAPPS-WP-0014",
+  "task": "RAPPS-WP-0014-T03",
+  "runtime_mutations": false,
+  "status": "waiting_for_two_user_workflow_and_native_recovery",
+  "expected": {
+    "cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786",
+    "namespace": "vergabe-demo-company",
+    "release": "vergabe-teilnahme",
+    "database": "vergabe_demo_company",
+    "image_digest": "sha256:a26444f59c259698159c69ccb96f73dc648a261ece4c86bb2037a9d977870d91",
+    "claims": [
+      "vergabe-teilnahme-media",
+      "vergabe-teilnahme-app-state"
+    ]
+  },
+  "kubernetes_reads": [
+    {
+      "command": [
+        "kubectl",
+        "--request-timeout=10s",
+        "get",
+        "namespace",
+        "kube-system",
+        "-o",
+        "json"
+      ],
+      "status": "ok",
+      "uid": "a553c742-0115-43d4-99a4-a5ca56fe0786",
+      "expected_uid_matches": true
+    },
+    {
+      "command": [
+        "kubectl",
+        "--request-timeout=10s",
+        "get",
+        "nodes",
+        "-o",
+        "json"
+      ],
+      "status": "forbidden"
+    },
+    {
+      "command": [
+        "kubectl",
+        "--request-timeout=10s",
+        "get",
+        "deployment",
+        "vergabe-teilnahme",
+        "-n",
+        "vergabe-demo-company",
+        "-o",
+        "json"
+      ],
+      "status": "forbidden"
+    },
+    {
+      "command": [
+        "kubectl",
+        "--request-timeout=10s",
+        "get",
+        "pvc",
+        "-n",
+        "vergabe-demo-company",
+        "-o",
+        "json"
+      ],
+      "status": "forbidden"
+    }
+  ],
+  "http_reads": [
+    {
+      "path": "/demo-company/health/",
+      "method": "GET",
+      "cookies_supplied": false,
+      "status": 200,
+      "final_host": "vergabe-teilnahme.coulomb.social",
+      "final_path": "/demo-company/health/",
+      "health_ok": true
+    },
+    {
+      "path": "/demo-company/",
+      "method": "GET",
+      "cookies_supplied": false,
+      "status": 200,
+      "final_host": "vergabe-teilnahme.coulomb.social",
+      "final_path": "/demo-company/accounts/login/",
+      "netkingdom_welcome_present": true
+    },
+    {
+      "path": "/demo-company/accounts/welcome/",
+      "method": "GET",
+      "cookies_supplied": false,
+      "status": 200,
+      "final_host": "vergabe-teilnahme.coulomb.social",
+      "final_path": "/demo-company/accounts/welcome/",
+      "netkingdom_welcome_present": true
+    },
+    {
+      "path": "/demo-company/ausschreibungen/dashboard/",
+      "method": "GET",
+      "cookies_supplied": false,
+      "status": 200,
+      "final_host": "vergabe-teilnahme.coulomb.social",
+      "final_path": "/demo-company/accounts/login/",
+      "netkingdom_welcome_present": true
+    },
+    {
+      "path": "/demo-company/media/pilot-readiness-nonexistent.pdf",
+      "method": "GET",
+      "cookies_supplied": false,
+      "status": 200,
+      "final_host": "vergabe-teilnahme.coulomb.social",
+      "final_path": "/demo-company/accounts/login/",
+      "netkingdom_welcome_present": true
+    }
+  ],
+  "claims": {
+    "public_health_verified": true,
+    "cluster_uid_verified": true,
+    "live_release_and_claims_verified": false,
+    "two_user_acceptance_verified": false,
+    "three_store_offhost_recovery_verified": false
+  },
+  "credential_routing": {
+    "catalog_id": "railiance-backup-offsite-lane",
+    "owner": "railiance-platform",
+    "subsystem": "OpenBao + Nextcloud",
+    "route_resolvable": true,
+    "upload_or_custody_verified": false
+  }
+}
--- a/docs/fixtures/vergabe-pilot-acceptance.pdf
+++ b/docs/fixtures/vergabe-pilot-acceptance.pdf
@ -0,0 +1,32 @@
+%PDF-1.4
+1 0 obj
+<< /Type /Catalog /Pages 2 0 R >>
+endobj
+2 0 obj
+<< /Type /Pages /Kids [3 0 R] /Count 1 >>
+endobj
+3 0 obj
+<< /Type /Page /Parent 2 0 R /MediaBox [0 0 595 842] /Resources << /Font << /F1 4 0 R >> >> /Contents 5 0 R >>
+endobj
+4 0 obj
+<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>
+endobj
+5 0 obj
+<< /Length 259 >>
+stream
+BT /F1 18 Tf 50 780 Td (Vergabe demo-company pilot) Tj 0 -30 Td /F1 12 Tf (Synthetic acceptance document - no customer data.) Tj 0 -20 Td (Reference: RAPPS-WP-0014 / PILOT-2026-11-05) Tj 0 -20 Td (Keep these bytes for restart and restore verification.) Tj ET
+endstream
+endobj
+xref
+0 6
+0000000000 65535 f 
+0000000009 00000 n 
+0000000058 00000 n 
+0000000115 00000 n 
+0000000241 00000 n 
+0000000311 00000 n 
+trailer
+<< /Size 6 /Root 1 0 R >>
+startxref
+620
+%%EOF
--- a/docs/vergabe-demo-company-acceptance.md
+++ b/docs/vergabe-demo-company-acceptance.md
@ -0,0 +1,89 @@
+# Demo-company pilot walkthrough
+
+Prepared 2026-11-05 for RAPPS-WP-0014-T03 and VERGABE-WP-0019-T04/T06.
+The steps below are pending user execution; preparing them records no acceptance.
+
+## Sign in separately
+
+Open <https://vergabe-teilnahme.coulomb.social/demo-company/> in two separate
+browser profiles, one for each ordinary demo-company member. Each person selects
+**Mit NetKingdom anmelden**, completes their own sign-in/MFA and any first-use
+company confirmation, then reaches the company workspace. Record pass/fail for
+each person. If the second account needs setup, use the existing native User
+Engine invitation/password-setup path through <https://users.coulomb.social/login>.
+The recipient completes their own setup. Keep credentials and setup links private.
+
+## Work together on one synthetic tender
+
+Use only synthetic content. Keep the resulting records until the recovery drill
+has verified them.
+
+1. User A creates an Ausschreibung named **PILOT-2026-11-05**, with the synthetic
+   issuer **Demo Auftraggeber**. Complete the required fields with demo values.
+   Add a Los named **Pilot-Los** and a task named **Pilot-Dokument pruefen**.
+2. User B opens that same tender and task, makes a small change to the task
+   description, and saves. User A reloads and confirms the change is visible.
+   If assigning the task is available, select User B; report any missing member
+   separately from sign-in success.
+3. User A uploads [the supplied synthetic PDF](fixtures/vergabe-pilot-acceptance.pdf)
+   under the tender's Dokumente, with version **1.0**. User B downloads it;
+   User A downloads it again after reload. Both files must match the original.
+4. On the task, open **Externes Issue → + Verknüpfen**, enter **Pilot recovery
+   check**, and save. Confirm the **LOKAL** badge and issue key, then reload
+   from both sessions. Use the local issue; leave **Nach Gitea** unused.
+5. Complete the tender's participation decision, required **Freigaben**, and
+   **Abgabe dokumentieren** with synthetic details. This records a demo workflow
+   in the app; no real procurement submission is part of this session. Record
+   any missing control, validation failure or required role.
+6. Open the uploaded document's actual download address in a signed-out browser.
+   It must require sign-in or deny access. Report whether the file bytes are
+   refused, rather than treating a login page's HTTP 200 as a document download.
+
+The original PDF is 803 bytes. Its SHA256 is
+`23a6850fa2391a58280c8515361ca29e9e92fa65fdadc36be7b44b552192e381`.
+On Linux/WSL use `sha256sum path/to/downloaded.pdf`; on Windows PowerShell use
+`Get-FileHash -Algorithm SHA256 path/to/downloaded.pdf`.
+
+Return only pass/fail or the failing step, synthetic tender/task/document IDs,
+the local issue key, and download hash equality. No passwords, tokens, setup
+links or private customer files belong in the receipt. First-use sign-in and
+the collaborative workflow are distinct verdicts.
+
+## Recovery follow-through
+
+The [read-only preflight](evidence/2026-11-05-vergabe-pilot-preflight.json)
+confirms the recorded cluster UID, public health and the NetKingdom welcome
+gate. Node, Deployment and PVC reads are forbidden to the current agent identity;
+fresh image/release/claim status remains unverified. The binding's expected image
+and claims are historical reference values until a permitted native readback.
+
+After the populated workflow, prepare the exact attended recovery action from
+the existing [pilot recovery contract](vergabe-teilnahme-pilot.md#persistence-and-recovery)
+and [deployment binding](vergabe-demo-company-binding.md). Its receipt must cover:
+
+- A fresh release/schema/claim readback and recovery-point manifest for
+  `vergabe_demo_company`, `/app/media` and `/app/.issue-facade/issues.db`.
+  Include the synthetic identifiers above and document SHA256. Capture all
+  stores during one quiesced write window; use a consistent SQLite backup,
+  including any required journal state.
+- Pod replacement with the same claims, followed by both users reopening the
+  tender, task, document and local issue. Record interruption and readiness time.
+- Encrypted off-host publication and independent readback of that exact matched
+  point through railiance-platform's admitted custody/storage lane. The route
+  lookup alone is not custody or upload evidence.
+- Restore into a separate database and separate claims with isolated routing
+  and outgoing writes disabled. Repeat the two-user/document/issue checks,
+  verify bytes and database/file consistency, and record elapsed recovery time.
+  Product login callbacks need an owner-admitted isolated route before claiming
+  restored interactive sign-in; do not repoint the live callback to a scratch app.
+- A demonstrated image/schema-compatible rollback with current writes retained,
+  named backup and incident/support owners, cadence, retention, destination and
+  accepted recovery objectives. Historical Helm revisions are not automatically
+  safe rollback targets.
+
+Existing database-only backup/restore targets default to historical `vergabe_db`
+and omit both file stores. They cannot establish this three-store recovery claim.
+The human sign-in/workflow response is pending; the attended restart, off-host
+capture, isolated restore and rollback action has not been prepared or executed.
+Logged-in account deactivation remains a separate owner-run access-control check
+from the pilot contract. No account is disabled as part of these walkthrough steps.
--- a/docs/vergabe-teilnahme-pilot.md
+++ b/docs/vergabe-teilnahme-pilot.md
@ -73,6 +73,10 @@ HA is not claimed.

 ## Manual onboarding and acceptance

+The [demo-company walkthrough](vergabe-demo-company-acceptance.md) provides the
+two-user tender/task/document/local-issue sequence and a synthetic PDF for the
+remaining pilot gate. Its preparation is not a user verdict or recovery proof.
+
 The current demo-company release uses NetKingdom OIDC and the company welcome
 flow. Provision ordinary members through the native User Engine journey and
 have each invited recipient complete their own login/MFA and confirmation.
--- a/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md
+++ b/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md
@ -9,7 +9,7 @@ flavor: implementation
 owner: the-custodian
 topic_slug: railiance
 created: "2026-09-11"
-updated: "2026-10-21"
+updated: "2026-11-05"
 related: [VERGABE-WP-0019, VERGABE-WP-0018, HFACT-WP-0001, CUST-WP-0071]
 state_hub_workstream_id: "c7fdaa7e-cab8-5d1d-86c2-f1aad7927c57"
 ---
@ -247,6 +247,19 @@ all remaining work; no task or workplan was opened.

 2026-10-03: human gate routed to hub decision d06307e5-2737-461a-a2f4-a12c3b492a9a (D7: Vergabe pilot: two real users run the invited setup-to-workflow acceptance) by CUST-WP-0075; resolving that decision raises C-40 here.

+2026-11-05 continuation: read-only preflight confirms the recorded Railiance01
+cluster UID, public health and NetKingdom welcome gating. Node, Deployment and
+PVC reads are forbidden to the current agent identity; no fresh native release
+or claim readiness is asserted. Receipt:
+`docs/evidence/2026-11-05-vergabe-pilot-preflight.json`. Prepared
+`docs/vergabe-demo-company-acceptance.md` with the two-user tender/lot/task,
+PDF round-trip, local issue and domain approval/submission-recording walkthrough,
+plus the remaining recovery/rollback evidence contract. A synthetic 803-byte PDF
+and its SHA256 are supplied. Requested the users' separate sign-in results;
+no response, workflow acceptance, account change or runtime mutation is inferred.
+The offsite route still names railiance-platform; resolving that route is not
+an authenticated upload. T03 remains wait for the existing human/recovery gate.
+

 ## Validate synthetic sizing against the exact release and shared contention