coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Retain verified recovery proof independently and bind the protected point
All checks were successful
CCR intake gate / gate (push) Successful in 12s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a17f16-d99c-7ea3-95f0-8212897fba6b
This commit is contained in:
codex 2026-10-29 22:49:33 +01:00
parent e1918b3f88
commit 09f4fd33cb
7 changed files with 257 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

34
workplans/RPF-WP-0053-coulomb-paired-backup-admission.md
View file

@ -47,7 +47,7 @@ Do not mark the warden offsite workload identity resolved without a declaration.
id: RPF-WP-0053-T02
status: progress
priority: high
intervention_note: "Publisher delivery and independent scoped API custody are approved and native-verified. Retention/capacity, protected app kit/last recovered point and historical-copy disposition remain open; no repeat credential or schedule approval is needed."
intervention_note: "Publisher delivery, independent scoped API custody and protected app kit/last recovered point are native-verified. Retention/capacity and historical-copy disposition remain open; no repeat credential or schedule approval is needed."
state_hub_task_id: "b06f1a44-1a55-588c-9c6c-3c1e290544df"
```
@ -401,3 +401,35 @@ as generic-api-key because of its metadata field name. The exact finding was
line2, containing only the already public approval reference. Renamed that field
to programmatic_direction_reference; no scanner rule, ignore or bypass changed.
Only unpublished commits are amended; published history is preserved.
## First paired and protected provider-only recovery — 2026-10-29
Admitted worker capture resumed the app before encryption/upload;54.3s pause/capture,
2,120,392byte ciphertext, immutable primary exact-version/hash readback. The new
application_recovery_mirror.py reuses the existing multipart/conditional-completion
engine through an exact Coulomb-only bucket/key adapter. Its independent reader
fetched the mirror; custodian escrow supplied only the dedicated age identity.
SQL restore matches13tables/112rows/sequences and82files. Actual packaged app views
render39pages; restored owner, viewer read/edit403 and ungranted404 checks pass.
application_recovery_kit.py publishes only new hash-addressed kits and checks live
versioning/no lifecycle before publication. The full277,585,920byte kit includes
encrypted data, exact images/tools/SDK/receipts and no private identity/API pair.
application_recovery_drill.py independently downloads/verifies all2098members,
retrieves the separate key, loads the retained images without registry pulls,
decrypts/restores and repeats all actual app checks in30.232s monotonic. Original
node/plaintext not used. Existing Docker daemon and held API callers were used;
operator account recovery time/fresh-daemon proof and real-browser identity
journeys are excluded. No production restore/expiry/timer activation.
The successful proof is itself hash-addressed/conditionally created under the
protected kits/receipts/ prefix and independently version/hash read back. The
API contract records that proof coordinate as well as the kit and recovered
primary point. Later automated drills retain the same independent proof.
Exact protected point and kit coordinates are in the public API contract; receipt:
docs/evidence/2026-10-29-coulomb-provider-kit-recovery.json. Consumer CSOC-WP-0012-T02
is done. Owner T02 retention/capacity/copy disposition and T03/T04 scheduled and
monitored operation remain open. Preserve isolated recovery fixtures for the
pending actual-data storage-migration rehearsal; do not treat their copies as
another independent offsite location or delete historical plaintext pairs.