coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare governed S1 offsite upload
All checks were successful
CI Smoke / source-contract (push) Successful in 11s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018
This commit is contained in:
codex 2026-08-23 14:11:00 +02:00
parent 2c92b97f37
commit d0a5a27926
11 changed files with 844 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

51
docs/s1-backup-recovery.md
View file

@ -46,7 +46,50 @@ make s1-backup-prune APPROVE_S1_BACKUP_PRUNE=PRUNE-S1-BACKUPS-...
If the set changes between those commands, pruning fails closed. Candidates
are atomically moved beneath a quarantine directory inside the declared backup
root before removal; paths outside that root are never accepted.
root before removal; paths outside that root are never accepted. Production
pruning also refuses every candidate that lacks a passing off-site receipt
bound to the current local manifest.
## Governed off-site owner interface
The upload contract is source-controlled in `spec/s1-offsite.yaml`. It packages
the two encrypted artifacts and their metadata into one deterministic tar
envelope, avoiding a remotely visible partial multi-object backup. Upload uses
an immutable object name and `If-None-Match: *`; a collision fails without a
success receipt. Neither the endpoint, response body, nor credential is placed
in the receipt.
The contract is intentionally pending `railiance-platform` acceptance. Render
the exact review phrase without credentials:
```bash
make s1-offsite-review
```
After the owner records acceptance of that exact digest, a fresh bundle can be
planned without access to the lane:
```bash
make s1-offsite-plan BUNDLE=/opt/backup/railiance/infra/s1-backup-...
```
Only the exact resulting envelope approval can enter the contained upload
path. `warden access` injects the primary token into the child environment; it
is never accepted in argv, files, State Hub, or command output:
```bash
make s1-offsite-upload \
BUNDLE=/opt/backup/railiance/infra/s1-backup-... \
APPROVE_S1_OFFSITE_UPLOAD=UPLOAD-S1-OFFSITE-...
```
This command remains disabled while
`spec/s1-offsite-owner-acceptance.yaml` is pending. Owner acceptance must also
confirm that the secret-shaped default discovered in the owner repository is
retired or rotated; its value must never be copied into this repository or an
approval message. The current route still lacks an authoritative workload
identity, so the reviewed interface is attended and is not attached to the
systemd timer.
## Inspection and isolated restore
@ -90,6 +133,6 @@ checks the approval and pins the deployed wrapper to the reviewed 40-character
source revision. This approval installs and enables the timer only; it does
not authorize pruning, off-host upload, private-key access, or a restore.
Off-host transfer remains `RAIL-HO-WP-0012-T05` and belongs to the governed
`railiance-backup-offsite-lane`. An attended off-host isolated drill remains
`RAIL-HO-WP-0012-T06`; neither action is implemented or implied here.
Off-host execution remains pending under `RAIL-HO-WP-0012-T05` and belongs to
the governed `railiance-backup-offsite-lane`. An attended off-host isolated
drill remains `RAIL-HO-WP-0012-T06`; neither live action is implied here.