diff --git a/openbao/root-grant/README.md b/openbao/root-grant/README.md index 08bb590..943ae6b 100644 --- a/openbao/root-grant/README.md +++ b/openbao/root-grant/README.md @@ -78,25 +78,49 @@ this packet does not create another privileged identity or reuse its token in user-engine. Deployment/network policy/consumer activation belongs to rapp-user-engine and follows source image publication and admission receipts. -Publication requires an owner state directory outside the checkout, off-host -history backup, a bounded non-secret initial document and ceremony reference. -Do not infer a custodian from the legacy planned roster or LLDAP account. Real -bootstrap requires the human's exact issuer/subject and signed ceremony; an -empty initial record can be used only if chosen by the founder. Example child -arguments after those inputs exist: +The founder reported that no actual custody ceremony is known. NetKingdom has +therefore prepared `examples/custody-record/initial-empty-record.json`, a +schema-valid first publication candidate with `entries: []`. It establishes no +root grant. The non-secret provenance is +`net-kingdom/docs/evidence/2026-10-03-root-grant-delivery-progress.md`. +Continued go-forward approval covers preparing and publishing this no-grant +baseline through the attended owner lane; no new generic approval is needed. +A future real grant still requires a genuine signed human ceremony with exact +issuer and subject; planned roster/LLDAP membership cannot supply it. -```text -publish --candidate /owner/candidate.json --state /owner/history/baseline.json ---provenance-ref ---net-kingdom /home/worsch/net-kingdom ---validator-digest 9156e399c8d92a45b817bfc3738c89843487ce57e1718ed747f804f95cc719bb ---schema-digest bb6cd6da5dc48eddcf118ae78c2cacfafd5f860098fd8a8368fe6bc845776d07 ---receipt /tmp/platform-root-publish-UNIQUE-RUN.json +After successful admission, run this second attended step in the founder's +terminal. Create the operator-owned state directory first; it must persist +outside the checkout and outside warden's temporary attended-login home. + +```bash +install -d -m 700 /home/worsch/.local/state/net-kingdom-root-custody +BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 \ + warden access openbao-platform-admin-login --exec -- \ + /home/worsch/railiance-platform/scripts/root-grant-attended.sh publish \ + --candidate /home/worsch/net-kingdom/examples/custody-record/initial-empty-record.json \ + --state /home/worsch/.local/state/net-kingdom-root-custody/baseline.json \ + --provenance-ref net-kingdom/docs/evidence/2026-10-03-root-grant-delivery-progress.md \ + --net-kingdom /home/worsch/net-kingdom \ + --validator-digest 9156e399c8d92a45b817bfc3738c89843487ce57e1718ed747f804f95cc719bb \ + --schema-digest bb6cd6da5dc48eddcf118ae78c2cacfafd5f860098fd8a8368fe6bc845776d07 \ + --receipt /tmp/platform-root-publish-UNIQUE-RUN.json ``` -Run via the same attended wrapper. `restore-check` takes the same source pins -and state but no candidate or provenance argument. Source digests enforce the -reviewed NetKingdom validator and schema without importing an unreviewed path. +Inspect the new receipt. Existing source without independently retained state +is refused rather than overwritten; a failed/ambiguous write requires owner +readback and journal recovery. Bootstrap uses CAS=0. The publisher retains +baseline.json and immutable history/ receipts. Restore `baseline.json`, history/ +and any pending journal from independently retained latest evidence before a +recovery check; restoring only an older OpenBao snapshot cannot establish +current authority. Off-host history backup destination, owner and readback +receipt remain an explicit acceptance dependency. Local state enables safe +publication but does not satisfy that independent recovery proof. + +`restore-check` takes the same source pins and state but no candidate or +provenance argument, plus a fresh receipt path, via the same attended wrapper. +Source digests enforce the reviewed NetKingdom validator and schema without +importing an unreviewed path. Neither command should print document contents, +privileged tokens or raw backend errors. Acceptance also needs revocation/supersession exercise and rollback/restore receipts. Exercise real grant changes only under their own custody ceremony diff --git a/workplans/RPF-WP-0049-platform-root-custody-record-delivery.md b/workplans/RPF-WP-0049-platform-root-custody-record-delivery.md index 0e8f59b..e3ae022 100644 --- a/workplans/RPF-WP-0049-platform-root-custody-record-delivery.md +++ b/workplans/RPF-WP-0049-platform-root-custody-record-delivery.md @@ -81,16 +81,21 @@ status: wait priority: high depends_on: [RPF-WP-0049-T03] needs_human: true -blocking_reason: "Founder go-forward is recorded; execution needs founder terminal OIDC/MFA, owner state/history location and real ceremony inputs or founder choice of an empty baseline. No real custodian can be inferred." +blocking_reason: "Go-forward covers the prepared no-grant empty baseline; founder terminal OIDC/MFA must execute reader admission and empty publication. Independent history backup owner/destination/readback receipt remain unresolved; no real ceremony or root grant is claimed." state_hub_task_id: "88b932e8-1010-56c6-be27-ad46f47e1e80" ``` Founder continued approval: "Good, i approve go forward please." This authorizes bounded execution of the reviewed design; generic permission is not pending. The concrete attended provisioning command is in the producer README. The -founder runs existing operator OIDC/MFA in their own terminal. Human supplies -real ceremony issuer/subject/reference or chooses a no-grant empty baseline; -legacy planned roster and bootstrap setup operator are not grant evidence. +founder runs existing operator OIDC/MFA in their own terminal. After reporting +that no actual ceremony is known, the continued authorized path is NetKingdom +examples/custody-record/initial-empty-record.json (entries=[]), with provenance +docs/evidence/2026-10-03-root-grant-delivery-progress.md. Concrete admission +and empty publication commands are in the packet; state is retained at +/home/worsch/.local/state/net-kingdom-root-custody. No root grant is seeded. +Independent history backup destination/owner/readback proof is still required +for T05 acceptance. Any later real grant requires genuine signed human ceremony. ## Return producer delivery receipts @@ -117,11 +122,10 @@ a source-choice dependency. NetKingdom approval commit: `de4c4f8`. Founder statement: "Accept ADR-0017 and approve the proposed OpenBao delivery design." This clears the source-selection part of T02 and binds the approved -owner/path/record ID. T02 remains wait on user-engine identity, T03 on concrete -bindings/final executor/recovery preparation, T04 on separate attended live -approval and ceremony provenance, and T05 on actual producer delivery receipts. -The workplan remains blocked on those residual dependencies. No live mutation -or real custody entry is authorized by this design acceptance. +owner/path/record ID. This historical receipt accepted design only; subsequent +go-forward authorization and completion of T02/T03 are recorded below. Current +remaining blockers are T04 attended execution and independent history inputs, +and T05 producer delivery receipts. No real custody entry is inferred. ## Continued implementation — 2026-10-03 @@ -130,3 +134,12 @@ generic approval requested; T04 is attended execution/information dependency. T05 still requires live producer read/denial/outage/restore/audit receipts. NetKingdom canon pin db319335b27b61b855382ee5af5d690f06eeb010. No real root grant, privileged login, production admission or readiness claimed. + +## Empty initial record execution packet — 2026-10-03 + +Founder reports no existing ceremony. NetKingdom prepares an initial empty +record and evidence pointer; continued approval persists. Updated exact two-step +attended admission then empty publication handoff without a real root grant or +new generic approval gate. State directory is explicit outside Git; independent +off-host history receipt remains an acceptance dependency. No login or live +publication was executed by this agent.