From 02101df7d11e9d6b4b08a427e784d92f5e0990ed Mon Sep 17 00:00:00 2001 From: codex Date: Wed, 14 Oct 2026 18:35:11 +0200 Subject: [PATCH] RPF-WP-0015-T02: attended database lease recovery passed restart-free; T02 done Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 680842@bnt-lap001 Assistant-Session: 54eb9e8e-7d6b-4f0c-b7a6-a6db62075883 --- .../accepted-1631/approval.json | 35 ++++++++++++ .../accepted-1631/exercise.json | 21 ++++++++ .../accepted-1631/window-summary.json | 53 +++++++++++++++++++ ...-core-custody-and-recovery-coordination.md | 23 ++++++-- 4 files changed, 128 insertions(+), 4 deletions(-) create mode 100644 docs/evidence/2026-10-14-rpf-wp-0015-t02-window/accepted-1631/approval.json create mode 100644 docs/evidence/2026-10-14-rpf-wp-0015-t02-window/accepted-1631/exercise.json create mode 100644 docs/evidence/2026-10-14-rpf-wp-0015-t02-window/accepted-1631/window-summary.json diff --git a/docs/evidence/2026-10-14-rpf-wp-0015-t02-window/accepted-1631/approval.json b/docs/evidence/2026-10-14-rpf-wp-0015-t02-window/accepted-1631/approval.json new file mode 100644 index 0000000..05106ef --- /dev/null +++ b/docs/evidence/2026-10-14-rpf-wp-0015-t02-window/accepted-1631/approval.json @@ -0,0 +1,35 @@ +{ + "procedure": "audit-core-database-lease-recovery", + "task_id": "RAILIANCE-WP-0024-T02", + "status": "approved", + "approval_id": "rpf-wp-0015-t02-20261014t1631z-founder-go", + "window": { + "start": "2026-10-14T16:31:00Z", + "end": "2026-10-14T16:46:00Z" + }, + "abort_operator": "founder (platform-root), attended", + "owners": { + "audit-core": { + "acknowledged": true, + "message_id": "b3c564a6-93f9-4c07-872b-7feb22cccb73" + }, + "rapp-postgres": { + "acknowledged": true, + "message_id": "08a84caf-5cf9-4f90-8dba-98f9f43677e2" + }, + "railiance-platform": { + "acknowledged": true, + "message_id": "0f8f0692-1549-4070-8428-0d9284e4d8d5" + } + }, + "synthetic_load": { + "contract_id": "RAILIANCE-WP-0024-T02-SYNTHETIC-01", + "driver_revision": "sha256:941ba251f638869626b06e9cbf430c70188c0bdf4715e3eff9c7610366f68662" + }, + "synthetic_sender": { + "identity": "t02-synthetic-sender-20261014", + "source": "t02-synthetic-20261014", + "tenant": "tenant:trial:t02-synthetic-20261014", + "expires_at": "2026-10-14T16:46:00Z" + } +} diff --git a/docs/evidence/2026-10-14-rpf-wp-0015-t02-window/accepted-1631/exercise.json b/docs/evidence/2026-10-14-rpf-wp-0015-t02-window/accepted-1631/exercise.json new file mode 100644 index 0000000..740d485 --- /dev/null +++ b/docs/evidence/2026-10-14-rpf-wp-0015-t02-window/accepted-1631/exercise.json @@ -0,0 +1,21 @@ +{ + "approval_id": "rpf-wp-0015-t02-20261014t1631z-founder-go", + "completed_at": "2026-10-14T16:34:10Z", + "health_during_failure": 200, + "lease_handle_fingerprint": "9dd61a51945e", + "lease_revoked": true, + "load_cleanup_status": "clean", + "mount_generation_changed": true, + "procedure": "audit-core-database-lease-recovery", + "readiness_during_failure": 503, + "readiness_recovered": true, + "restart_count_unchanged": true, + "same_pod_uid": true, + "secret_resource_version_changed": true, + "secret_values_observed": false, + "synthetic_load_contract": "RAILIANCE-WP-0024-T02-SYNTHETIC-01", + "synthetic_load_driver_revision": "sha256:941ba251f638869626b06e9cbf430c70188c0bdf4715e3eff9c7610366f68662", + "synthetic_recovery_status": "duplicate", + "synthetic_unavailable_attempts": 1, + "task_id": "RAILIANCE-WP-0024-T02" +} diff --git a/docs/evidence/2026-10-14-rpf-wp-0015-t02-window/accepted-1631/window-summary.json b/docs/evidence/2026-10-14-rpf-wp-0015-t02-window/accepted-1631/window-summary.json new file mode 100644 index 0000000..73391a1 --- /dev/null +++ b/docs/evidence/2026-10-14-rpf-wp-0015-t02-window/accepted-1631/window-summary.json @@ -0,0 +1,53 @@ +{ + "approval_id": "rpf-wp-0015-t02-20261014t1631z-founder-go", + "cleanup": { + "approval_id": "rpf-wp-0015-t02-20261014t1631z-founder-go", + "audit_core_ready": "1/1", + "audit_core_restarted": true, + "bearer_file_removed": true, + "cleanup_completed_at": "2026-10-14T16:34:31Z", + "cleanup_gate": { + "completed_at": "2026-10-14T16:34:10Z", + "mode": "evidence-recorded" + }, + "identities_removed": 1, + "identity": "t02-synthetic-sender-20261014", + "lane": "audit-core-synthetic-sender", + "secret_values_observed": false + }, + "exercise_evidence": "rpf-wp-0015-t02-20261014t1631z-founder-go-exercise.json", + "finished_at": "2026-10-14T16:34:31Z", + "identity": { + "expires_at": "2026-10-14T16:46:00Z", + "name": "t02-synthetic-sender-20261014", + "source": "t02-synthetic-20261014", + "tenant": "tenant:trial:t02-synthetic-20261014" + }, + "outcome": "completed", + "procedure": "t02-attended-window", + "project": { + "approval_id": "rpf-wp-0015-t02-20261014t1631z-founder-go", + "audit_core_pod_uid_after_projection": "7618cf45-d801-487a-9b3d-51559fd14ec3", + "audit_core_restarted": true, + "bearer_file_mode": "0600", + "identity": { + "expires_at": "2026-10-14T16:46:00Z", + "name": "t02-synthetic-sender-20261014", + "source": "t02-synthetic-20261014", + "tenant": "tenant:trial:t02-synthetic-20261014" + }, + "lane": "audit-core-synthetic-sender", + "next_step": "run the T02 exercise; its baseline must capture this pod UID", + "projected_at": "2026-10-14T16:33:08Z", + "secret_values_observed": false + }, + "secret_values_observed": false, + "started_at": "2026-10-14T16:32:36Z", + "steps": [ + "project", + "port-forward", + "exercise", + "evidence", + "cleanup" + ] +} \ No newline at end of file diff --git a/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md b/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md index 342417e..6f50245 100644 --- a/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md +++ b/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md @@ -120,9 +120,7 @@ copied for another engagement. ```task id: RPF-WP-0015-T02 -status: wait -blocked_on: message-from:audit-core -blocking_reason: "Value-safe lease revoke/expire exercise must be coordinated with rapp-postgres and audit-core." +status: done priority: high state_hub_task_id: "fda4262a-56f6-5f06-a070-8fe7e1297209" ``` @@ -319,7 +317,7 @@ each task. ## Acceptance - [x] E2 cannot proceed without enforced sender expiry and exact-path projection. -- [ ] Database recovery is restart-free and evidenced without credential values. +- [x] Database recovery is restart-free and evidenced without credential values. - [ ] Reboot recovery has an ordered, owner-signed checklist and abort path. - [x] No live action is implied by completing this design workplan. @@ -456,3 +454,20 @@ approved: audit-core `b3c564a6`, rapp-postgres `08a84caf`, railiance-cluster `4bb0d7af`, railiance-infra `0300d069`, railiance-platform `0f8f0692`. This is procedure approval only. T02 stays `wait` until a new attended window. The T03 checklist bytes in that contract are the round-4 bytes. + +**T02 done (2026-10-14).** Attended window rpf-wp-0015-t02-20261014t1631z-founder-go +(16:31–16:46Z, founder GO and abort operator, one contained ops-warden login; started +~2 min after an ESO refresh so the pod mounted only the selected lease). Owner contract +ea3f53d6 approved by all five (audit-core b3c564a6, rapp-postgres 08a84caf, +railiance-platform 0f8f0692, railiance-cluster 4bb0d7af, railiance-infra 0300d069). +Result: the handle issued for the mounted refresh (fingerprint 9dd61a51945e) was revoked; +/healthz 200 and /readyz 503 during failure; synthetic sender saw retryable 503; forced +ESO refresh changed the Secret resource version and mount generation; readiness +recovered; the retried synthetic event returned duplicate; same pod UID and unchanged +restart count. Cleanup removed the one synthetic identity, audit-core 1/1, bearer +shredded, no secret value observed. Independent post-window preflight green. +Evidence: docs/evidence/2026-10-14-rpf-wp-0015-t02-window/accepted-1631/. +Follow-ups (owners, not blocking T02): guard revocation on Secret refreshTime + ~120s < +container startedAt (audit-core/rapp-postgres); ESO refresh interval equals role TTL +(audit-core/ESO); ops-warden strip OPENBAO_TOKEN; founder: revoke/remove the standing +shell-profile OPENBAO_TOKEN.