coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Separate producer checks from attended audit readback
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
codex 2026-09-11 12:16:49 +02:00
parent 1770a60675
commit 426a0d5829
3 changed files with 99 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

24
docs/credential-lane-designs/factory-native-acceptance.md
View file

@ -27,7 +27,7 @@ bearer refusal, one own-source reconciliation count and sibling-count refusal.
No domain approval/disposition API is called, and no production heartbeat is
emitted. Domain-transaction atomicity is not retested by synthetic outbox seeding.
The attended parent reads the authoritative registry only in memory, verifies
The optional attended readback parent reads the authoritative registry only in memory, verifies
the two exact sender scopes, selects an unambiguous existing independent
read-only full-tenant operator, and retrieves only the two named synthetic
events and chain-integrity metadata through a private loopback port-forward.
@ -51,7 +51,7 @@ python3 scripts/native_factory_acceptance.py run \
--confirm 'VERIFY CCR-2026-0021 CCR-2026-0022 PRODUCERS'
```
Four preparation/guard/integration tests pass. The integration test runs both
Five preparation/guard/integration tests pass. The integration test runs both
real source outboxes in the pinned image against actual local Audit Core and
preserves exactly two events with an intact chain. All six native objects pass
server dry-run. Neither rehearsal result is claimed as native evidence.
@ -62,3 +62,23 @@ bearer. CCRs stay applied until their remaining lifecycle acceptance exists;
rotation/revocation must use its separately reviewed owner procedure. Service
startup, human binding, native policy/caller admission, attestation/offsite
operation and factory execution remain in their existing owner records.
## Consume existing producer credentials without an operator login
The first combined attempt failed at OIDC before command handoff; no native
job ran. Split normal producer consumption from privileged operator readback.
`jobs` uses only Kubernetes metadata and the existing approved Secret references;
it never reads OpenBao or obtains an operator token. The audit credential is
read solely inside its own source-pinned producer Job. The same packet, exact
confirmation, native receiver check and bounded resource/cleanup gates apply.
Run `jobs` with the same options as `run`. A successful receipt has status
`native_sender_checks_passed_pending_independent_readback`. Use a fresh receipt
path, and preserve it. After successful jobs, do not use `run` again: repeat
sends must not be mistaken for a new first acceptance.
For independent readback, use `readback` inside a fresh attended envelope with
`--producer-receipt <successful-jobs-receipt>` and a new `--receipt`. It verifies
the exact packet/run/event identities and reads only those already stored
probe records and chain metadata. It creates no Job and emits no new event.
The operator login remains required for that separate registry-backed reader.