diff --git a/docs/evidence/2026-10-03-root-custody-provider-recovery.json b/docs/evidence/2026-10-03-root-custody-provider-recovery.json new file mode 100644 index 0000000..a1ce507 --- /dev/null +++ b/docs/evidence/2026-10-03-root-custody-provider-recovery.json @@ -0,0 +1,37 @@ +{ + "artifact": "root-custody-history-20261003T195656Z-a52ec01b2a4a4c28ba21a52eb29e7cb7.json.age", + "ciphertext_sha256": "577498be3c6566e9622fe0d87ea3ad55063941acfab3aeb0accfc4a05dd21200", + "coordinates_only_updated": true, + "current_live_baseline_matches": true, + "decrypted_history_matches": true, + "digest": "33a2ae086385028db1b654aa5646b7a98bcde1c5878c804e19315dadc3f87248", + "escrow_and_unrelated_fields_preserved": true, + "executed_source_commit": "f1a780d830a118eecdc0ada1885e7b8f95b51072", + "finished_at": "2026-10-03T19:56:59.023904+00:00", + "historical_config_present": true, + "historical_credential_status": "historical-owner-and-revocation-unverified", + "historical_share_matches_current_lane": false, + "history_entries": 1, + "independent_escrow_decryption_verified": true, + "independent_escrow_recipient_matches_current_lane": true, + "kv_version": 1, + "lane_cas_noop": false, + "lane_kv_version": 3, + "local_historical_rclone_used": false, + "ok": true, + "provider": "existing-governed-nextcloud-backup", + "provider_roundtrip_verified_before_cas": true, + "published_lane_kv_version": 4, + "readback_http_status": 200, + "record_id": "nk-custody:platform-root", + "recorded_at": "2026-10-03T19:56:48.310198+00:00", + "replacement_share_created": true, + "replacement_share_id": 23, + "revision": 1, + "runtime_consumers_refreshed": false, + "scope": "current-owner-read-and-governed-history-provider-roundtrip", + "stage": "complete", + "status": "verified", + "unknown_shares_and_old_backups_preserved": true, + "upload_http_status": 201 +} diff --git a/openbao/root-grant/README.md b/openbao/root-grant/README.md index 5cc6aae..61d19d2 100644 --- a/openbao/root-grant/README.md +++ b/openbao/root-grant/README.md @@ -254,3 +254,11 @@ On retry matching reviewed candidate is reused; stale expected version refuses. PROPFIND denial alone does not prove grant invalid: create-only policy can deny read properties. Backup consumers need normal governed credential refresh after cutover; this is separate from custody history proof and no live rollout occurs. + +Producer recovery completed2026-10-03: fresh founder repair receipt proves +current empty revision1/KV1 matches retained baseline, actual encrypted upload201, +Backup readback200, independently escrow-decrypted history match before CAS3->4. +See [safe provider receipt](../../docs/evidence/2026-10-03-root-custody-provider-recovery.json). +Producer plan RPF-WP-0049 finished. Backup runtime consumer refresh remains +activity-core-owned; historical share revocation is separately unverified. +No real custody grant was added. diff --git a/workplans/RPF-WP-0049-platform-root-custody-record-delivery.md b/workplans/RPF-WP-0049-platform-root-custody-record-delivery.md index 16616fd..636a9ef 100644 --- a/workplans/RPF-WP-0049-platform-root-custody-record-delivery.md +++ b/workplans/RPF-WP-0049-platform-root-custody-record-delivery.md @@ -4,7 +4,7 @@ type: workplan title: "Deliver the approved OpenBao platform-root custody fact design" domain: financials repo: railiance-platform -status: blocked +status: finished owner: codex topic_slug: railiance-platform created: "2026-10-03" @@ -16,8 +16,9 @@ state_hub_workstream_id: "7dc1b126-1ddd-550f-9e6a-1fc577d0f27b" Response to net-kingdom message bc0c620c. Founder approved on 2026-10-03: "Accept ADR-0017 and approve the proposed OpenBao delivery design." The selected delivery owner is railiance-platform, using the exact OpenBao KV v2 -path and trusted record ID below. No production source exists yet; this approval -accepts the design and does not authorize a live change or a custody entry. +path and trusted record ID below. Subsequent founder go-forward and attended +execution delivered the initial empty production source; no real custody grant +is inferred. All producer delivery and independent recovery gates are complete. Contract: ../net-kingdom/docs/contracts/root-grant-read-contract_v0.1.md. Packet: [approved producer design](../openbao/root-grant/README.md). @@ -100,11 +101,10 @@ receipt-holder backup/readback and isolated recovery proof remain T05 requiremen ```task id: RPF-WP-0049-T05 -status: wait +status: done priority: high depends_on: [RPF-WP-0049-T04] -needs_human: true -blocking_reason: "Admission, empty publication, live reader/denials/restart, audit correlation, native isolated Raft restore and remote Git history readback are verified. Only attended finish helper current owner baseline check plus governed encrypted history provider roundtrip receipt remains; existing approval persists." +needs_human: false state_hub_task_id: "871e3236-61c0-58a1-a307-399cd662be6b" ``` @@ -241,3 +241,20 @@ roundtrip and independent escrow proof precede exact CAS3 coordinates-only cutover; unknown shares/old backups preserved. Provider proof and partial CAS receipt retained. T05 waits bounded attended repair/recovery receipt; consumer refresh after lane rotation remains separately owned backup requirement. + +## Producer delivery completed — 2026-10-03 + +Verified fresh founder-executed repair receipt at19:56 UTC against retained +revision1/KV1 empty baseline digest33a2ae086385028db1b654aa5646b7a98bcde1c5878c804e19315dadc3f87248. +Reviewed Backup share23 created; actual public upload201 and owner readback200, +ciphertext match and independent workstation escrow decrypt/history comparison +passed BEFORE exact CAS3 -> KV4 token/URL cutover. Unrelated lane fields, escrow, +unknown shares and old backups preserved. Evidence: +[governed provider recovery](../docs/evidence/2026-10-03-root-custody-provider-recovery.json). +Together with admitted source, consumer read/denial/restart, audit correlation, +native isolated Raft rollback/current restore and independent Git holder +retrieval, all producer gates are complete. T05 done; workplan finished. +No real root grant exists. Runtime backup consumers were not refreshed by this +procedure: activity-core owns ACTIVITY-WP-0020-T08, separate from this delivered +custody history proof. Historical exposed share differs current lane; its +owner/revocation remains unverified and is not closed by this plan.