railiance-infra/docs/railiance01-console-access.md

railiance01 provider console and rescue access

Status: partly established, console path untested. Do not treat provider console access as proven for a maintenance window until an attestation receipt exists (see below). Follow-up task: RAIL-HO-WP-0011-T09.

Consumer: railiance-platform/docs/railiance01-coordinated-reboot.md (RPF-WP-0015-T03), which requires "independent provider-console access, not SSH alone" before a reboot.

This document holds no credentials, customer numbers, session URLs, or console tokens, and must never hold them.

Established from records

Fact	Value	Source
Host	railiance01, 92.205.62.239, 239.62.205.92.host.secureserver.net	docs/evidence/resource-hosteurope-railiance01/identity-lifecycle.yaml
Provider	Host Europe GmbH (AS21499), parent GoDaddy. secureserver.net is the GoDaddy hosting domain	same
Product	Virtual server, family vps4, instance type oh.hosting.c2.r4.d100	same (measured from cloud-init)
Platform	KVM guest on OpenStack Nova, site sxb1 (Strasbourg, FR)	same; railiance-clock/docs/evidence/2026-09-14-host-time-inventory.md
Non-secret instance identity	Nova UUID c0e697d1-4c71-40f5-9746-0b4c4b9e5c17, instance name 1fxw7h4zug	identity-lifecycle.yaml
Management surface	Host Europe / GoDaddy VPS control panel. There is no provider API for this product class	labor-and-exit.yaml (panel, provider_api: none)
Provider agent	Nydus (nydus-ex-api) on 2224/tcp, in-guest (see note)	railiance-hosts/hosteurope/260308-dependency-nydus.md
Account holder	The founder/operator. The billing customer number is classified restricted, owner operator	identity-lifecycle.yaml; resource-control/docs/evidence/RESOURCE-WP-0002-host-europe-resolution-2026-08-15.md

Nydus note: the provider's onboarding text (railiance-hosts/hosteurope/260308-dependency-nydus.md) describes Nydus as an in-guest agent on 2224/tcp that connects the server to the provider platform for server access, root-password reset, and backups. UFW allows 2224 deliberately (docs/evidence/RAIL-HO-WP-0009-T03-declared-vs-live-audit.md). Nydus runs inside the guest and needs guest networking, so it is not an independent console. It fails in the same cases where SSH fails.

Not established

No record in railiance-*, resource-control, or the-custodian/docs says any of the following. Do not assume them:

1. Whether the panel offers an out-of-band console for this vps4 product (browser VNC/noVNC, serial, or similar), and whether it works while guest networking or SSH is down. OpenStack Nova can expose a VNC console, but that the provider exposes one here is unverified.
2. Whether a rescue boot mode or rescue image exists, and what it does to the root disk.
3. Whether the panel can force a hard reboot or power cycle independently of the guest.
4. Which login identity can reach the panel, whether it uses MFA, and whether anyone other than the founder has delegated access. As far as the records show, there is one access holder: the founder.
5. Whether console access has ever been exercised. No receipt exists.

Until items 1, 3 and 5 are confirmed, the coordinated-reboot gate "independent provider-console access" cannot be satisfied. SSH plus Nydus is not independent.

Roles

Role	Holds	Duty
Host Europe account holder (founder)	Panel login and any MFA factor, outside every repo	Confirms the mechanism once (T09) and attests before each window
railiance-infra host operator	No provider credential, unless the founder delegates	Records the receipt and runs reboot/recovery using the attested path

If the founder is the only access holder, the founder must be present for the whole reboot window, or must name a delegate in the panel beforehand. The receipt records only the role, never the identity.

Pre-window attestation

On the same day as the window, and before the preflight step "Prove provider-console access and SSH access", the access holder:

1. Logs in to the Host Europe / GoDaddy VPS panel.
2. Selects the server whose instance identity matches the non-secret values above.
3. Opens the console and confirms that it shows the railiance01 login prompt or the boot output. Do not log in through the console unless that is required.
4. Notes whether rescue mode and hard reboot are offered. Do not trigger either.
5. Closes the console session.

The host operator records a receipt at docs/evidence/railiance01-console-access/<receipt_id>.yaml. The receipt id format is RAIL01-CONSOLE-<YYYYMMDDTHHMMSSZ>:

receipt_id: RAIL01-CONSOLE-20261015T080000Z
host: railiance01
provider_resource_id: c0e697d1-4c71-40f5-9746-0b4c4b9e5c17
attested_by_role: host-europe-account-holder   # role, never a name or login
attested_at: "2026-10-15T08:00:00Z"
panel_login: ok
mfa_used: true | false | unknown
console_mechanism: <as named in the panel, e.g. "VNC console">
console_shows_host: true
independent_of_guest_network: true | false | unknown
rescue_mode_offered: true | false | unknown
hard_reboot_offered: true | false | unknown
reboot_window_id: <approved window id>

Forbidden in the receipt, the hub, or any prompt: passwords, MFA codes, customer or contract numbers, console URLs (they often embed session tokens), screenshots that show account data, and the root password.

The reboot preflight should accept only a receipt that is from the same day as the window, names the window id, and has console_shows_host: true and independent_of_guest_network: true.