RPF-WP-0015-T02: attended database lease recovery passed restart-free; T02 done
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 680842@bnt-lap001 Assistant-Session: 54eb9e8e-7d6b-4f0c-b7a6-a6db62075883
This commit is contained in:
codex
parent
88b4aed83e
commit
02101df7d1
4 changed files with 128 additions and 4 deletions
|
|
@ -0,0 +1,35 @@
|
|||
{
|
||||
"procedure": "audit-core-database-lease-recovery",
|
||||
"task_id": "RAILIANCE-WP-0024-T02",
|
||||
"status": "approved",
|
||||
"approval_id": "rpf-wp-0015-t02-20261014t1631z-founder-go",
|
||||
"window": {
|
||||
"start": "2026-10-14T16:31:00Z",
|
||||
"end": "2026-10-14T16:46:00Z"
|
||||
},
|
||||
"abort_operator": "founder (platform-root), attended",
|
||||
"owners": {
|
||||
"audit-core": {
|
||||
"acknowledged": true,
|
||||
"message_id": "b3c564a6-93f9-4c07-872b-7feb22cccb73"
|
||||
},
|
||||
"rapp-postgres": {
|
||||
"acknowledged": true,
|
||||
"message_id": "08a84caf-5cf9-4f90-8dba-98f9f43677e2"
|
||||
},
|
||||
"railiance-platform": {
|
||||
"acknowledged": true,
|
||||
"message_id": "0f8f0692-1549-4070-8428-0d9284e4d8d5"
|
||||
}
|
||||
},
|
||||
"synthetic_load": {
|
||||
"contract_id": "RAILIANCE-WP-0024-T02-SYNTHETIC-01",
|
||||
"driver_revision": "sha256:941ba251f638869626b06e9cbf430c70188c0bdf4715e3eff9c7610366f68662"
|
||||
},
|
||||
"synthetic_sender": {
|
||||
"identity": "t02-synthetic-sender-20261014",
|
||||
"source": "t02-synthetic-20261014",
|
||||
"tenant": "tenant:trial:t02-synthetic-20261014",
|
||||
"expires_at": "2026-10-14T16:46:00Z"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
{
|
||||
"approval_id": "rpf-wp-0015-t02-20261014t1631z-founder-go",
|
||||
"completed_at": "2026-10-14T16:34:10Z",
|
||||
"health_during_failure": 200,
|
||||
"lease_handle_fingerprint": "9dd61a51945e",
|
||||
"lease_revoked": true,
|
||||
"load_cleanup_status": "clean",
|
||||
"mount_generation_changed": true,
|
||||
"procedure": "audit-core-database-lease-recovery",
|
||||
"readiness_during_failure": 503,
|
||||
"readiness_recovered": true,
|
||||
"restart_count_unchanged": true,
|
||||
"same_pod_uid": true,
|
||||
"secret_resource_version_changed": true,
|
||||
"secret_values_observed": false,
|
||||
"synthetic_load_contract": "RAILIANCE-WP-0024-T02-SYNTHETIC-01",
|
||||
"synthetic_load_driver_revision": "sha256:941ba251f638869626b06e9cbf430c70188c0bdf4715e3eff9c7610366f68662",
|
||||
"synthetic_recovery_status": "duplicate",
|
||||
"synthetic_unavailable_attempts": 1,
|
||||
"task_id": "RAILIANCE-WP-0024-T02"
|
||||
}
|
||||
|
|
@ -0,0 +1,53 @@
|
|||
{
|
||||
"approval_id": "rpf-wp-0015-t02-20261014t1631z-founder-go",
|
||||
"cleanup": {
|
||||
"approval_id": "rpf-wp-0015-t02-20261014t1631z-founder-go",
|
||||
"audit_core_ready": "1/1",
|
||||
"audit_core_restarted": true,
|
||||
"bearer_file_removed": true,
|
||||
"cleanup_completed_at": "2026-10-14T16:34:31Z",
|
||||
"cleanup_gate": {
|
||||
"completed_at": "2026-10-14T16:34:10Z",
|
||||
"mode": "evidence-recorded"
|
||||
},
|
||||
"identities_removed": 1,
|
||||
"identity": "t02-synthetic-sender-20261014",
|
||||
"lane": "audit-core-synthetic-sender",
|
||||
"secret_values_observed": false
|
||||
},
|
||||
"exercise_evidence": "rpf-wp-0015-t02-20261014t1631z-founder-go-exercise.json",
|
||||
"finished_at": "2026-10-14T16:34:31Z",
|
||||
"identity": {
|
||||
"expires_at": "2026-10-14T16:46:00Z",
|
||||
"name": "t02-synthetic-sender-20261014",
|
||||
"source": "t02-synthetic-20261014",
|
||||
"tenant": "tenant:trial:t02-synthetic-20261014"
|
||||
},
|
||||
"outcome": "completed",
|
||||
"procedure": "t02-attended-window",
|
||||
"project": {
|
||||
"approval_id": "rpf-wp-0015-t02-20261014t1631z-founder-go",
|
||||
"audit_core_pod_uid_after_projection": "7618cf45-d801-487a-9b3d-51559fd14ec3",
|
||||
"audit_core_restarted": true,
|
||||
"bearer_file_mode": "0600",
|
||||
"identity": {
|
||||
"expires_at": "2026-10-14T16:46:00Z",
|
||||
"name": "t02-synthetic-sender-20261014",
|
||||
"source": "t02-synthetic-20261014",
|
||||
"tenant": "tenant:trial:t02-synthetic-20261014"
|
||||
},
|
||||
"lane": "audit-core-synthetic-sender",
|
||||
"next_step": "run the T02 exercise; its baseline must capture this pod UID",
|
||||
"projected_at": "2026-10-14T16:33:08Z",
|
||||
"secret_values_observed": false
|
||||
},
|
||||
"secret_values_observed": false,
|
||||
"started_at": "2026-10-14T16:32:36Z",
|
||||
"steps": [
|
||||
"project",
|
||||
"port-forward",
|
||||
"exercise",
|
||||
"evidence",
|
||||
"cleanup"
|
||||
]
|
||||
}
|
||||
|
|
@ -120,9 +120,7 @@ copied for another engagement.
|
|||
|
||||
```task
|
||||
id: RPF-WP-0015-T02
|
||||
status: wait
|
||||
blocked_on: message-from:audit-core
|
||||
blocking_reason: "Value-safe lease revoke/expire exercise must be coordinated with rapp-postgres and audit-core."
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "fda4262a-56f6-5f06-a070-8fe7e1297209"
|
||||
```
|
||||
|
|
@ -319,7 +317,7 @@ each task.
|
|||
## Acceptance
|
||||
|
||||
- [x] E2 cannot proceed without enforced sender expiry and exact-path projection.
|
||||
- [ ] Database recovery is restart-free and evidenced without credential values.
|
||||
- [x] Database recovery is restart-free and evidenced without credential values.
|
||||
- [ ] Reboot recovery has an ordered, owner-signed checklist and abort path.
|
||||
- [x] No live action is implied by completing this design workplan.
|
||||
|
||||
|
|
@ -456,3 +454,20 @@ approved: audit-core `b3c564a6`, rapp-postgres `08a84caf`, railiance-cluster
|
|||
`4bb0d7af`, railiance-infra `0300d069`, railiance-platform `0f8f0692`. This is
|
||||
procedure approval only. T02 stays `wait` until a new attended window. The T03
|
||||
checklist bytes in that contract are the round-4 bytes.
|
||||
|
||||
**T02 done (2026-10-14).** Attended window rpf-wp-0015-t02-20261014t1631z-founder-go
|
||||
(16:31–16:46Z, founder GO and abort operator, one contained ops-warden login; started
|
||||
~2 min after an ESO refresh so the pod mounted only the selected lease). Owner contract
|
||||
ea3f53d6 approved by all five (audit-core b3c564a6, rapp-postgres 08a84caf,
|
||||
railiance-platform 0f8f0692, railiance-cluster 4bb0d7af, railiance-infra 0300d069).
|
||||
Result: the handle issued for the mounted refresh (fingerprint 9dd61a51945e) was revoked;
|
||||
/healthz 200 and /readyz 503 during failure; synthetic sender saw retryable 503; forced
|
||||
ESO refresh changed the Secret resource version and mount generation; readiness
|
||||
recovered; the retried synthetic event returned duplicate; same pod UID and unchanged
|
||||
restart count. Cleanup removed the one synthetic identity, audit-core 1/1, bearer
|
||||
shredded, no secret value observed. Independent post-window preflight green.
|
||||
Evidence: docs/evidence/2026-10-14-rpf-wp-0015-t02-window/accepted-1631/.
|
||||
Follow-ups (owners, not blocking T02): guard revocation on Secret refreshTime + ~120s <
|
||||
container startedAt (audit-core/rapp-postgres); ESO refresh interval equals role TTL
|
||||
(audit-core/ESO); ops-warden strip OPENBAO_TOKEN; founder: revoke/remove the standing
|
||||
shell-profile OPENBAO_TOKEN.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue