coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record the MAS offsite restore rehearsal and close RPF-WP-0070-T04.
All checks were successful
CCR intake gate / gate (push) Successful in 2m14s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4541@bnt-lap001
Assistant-Session: 2099b3aa-d7d9-49a9-ab4e-fa8b7d0e39e8
This commit is contained in:
codex 2026-11-03 08:30:55 +01:00
parent 016c147976
commit 4277088e1c
3 changed files with 75 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
WORK-RECORDS.md
View file

@ -239,7 +239,7 @@
| task | RPF-WP-0070-T01 | done | — | workplans/RPF-WP-0070-mas-evidence-recovery.md |
| task | RPF-WP-0070-T02 | done | — | workplans/RPF-WP-0070-mas-evidence-recovery.md |
| task | RPF-WP-0070-T03 | done | — | workplans/RPF-WP-0070-mas-evidence-recovery.md |
| task | RPF-WP-0070-T04 | progress | — | workplans/RPF-WP-0070-mas-evidence-recovery.md |
| task | RPF-WP-0070-T04 | done | — | workplans/RPF-WP-0070-mas-evidence-recovery.md |
| task | RPF-WP-0070-T05 | todo | — | workplans/RPF-WP-0070-mas-evidence-recovery.md |
| intake | RPF-IN-0001 | closed | — | intakes/intakes.md |
| intake | RPF-IN-0002 | open | — | intakes/intakes.md |

60
docs/evidence/mas-evidence-offsite-rehearsal-2026-11-03.json Normal file
View file

@ -0,0 +1,60 @@
{
"ciphertext_bytes": 133352,
"ciphertext_sha256": "d2f287ed65114e618ab2e6605f551d362152ef9d8aa231d1ce9206588dcfdb91",
"credential": "supplier key on IAM application 25a4cbca (independent of the node workload pair)",
"elapsed_seconds": 0.39,
"fetch_seconds": 0.37,
"fetch_verified": true,
"identity_matches_recipient": true,
"identity_source": "platform/recovery/mas/age-identity",
"mail_sent": false,
"object_key": "platform-pg/application-archives/mas/2026/11/03/20261103T072838Z-59beea09bd26b811ffa169a4.tar.age",
"production_restored": false,
"provider_mutations": false,
"receiver_enabled": false,
"restored": {
"captured_at": "2026-11-03T07:28:38Z",
"files": {
"events.jsonl": {
"bytes": 51382,
"events": 36,
"present": true,
"sha256_matches_capture": true
},
"tickets-outbox.sqlite3": {
"bytes": 20480,
"fingerprint_matches_capture": true,
"integrity_check": "ok",
"present": true,
"sha256_matches_capture": true,
"tables": {
"mailer_meta": 1,
"mode_outbox": 9
}
},
"tickets.sqlite3": {
"bytes": 45056,
"fingerprint_matches_capture": true,
"integrity_check": "ok",
"present": true,
"sha256_matches_capture": true,
"tables": {
"messages": 34,
"outbox": 9,
"tickets": 10
}
}
},
"image": "docker.io/library/mas-live:v0.2-480e69a"
},
"rto_minutes_provisional": 60,
"runner": "attended: founder ran scripts/mas_evidence_restore_rehearsal.py (2bb8c37) inside warden openbao-platform-admin-login",
"schema": "platform.mas-evidence-offsite-rehearsal.v1",
"scratch_removed": true,
"started_at": "2026-11-03T07:30:28Z",
"status": "passed",
"timing_note": "elapsed_seconds covers fetch, decrypt, restore and checks after login; attended OIDC login time is not included",
"values_recorded": false,
"version_id": "1793690919900126",
"within_rto": true
}

15
workplans/RPF-WP-0070-mas-evidence-recovery.md
View file

@ -245,7 +245,7 @@ hourly freshness timer. T03 is done. Receipt:
```task
id: RPF-WP-0070-T04
status: progress
status: done
priority: medium
depends_on: [RPF-WP-0070-T03]
state_hub_task_id: "9e6987a5-9cbc-5d73-bd2e-9a4e1e63ecdc"
@ -303,6 +303,19 @@ sealed to the custody-held recipient, with the readback verified.
Receipt: `docs/evidence/mas-evidence-offsite-2026-11-03-custody-recipient.json`.
The T04 rehearsal runs against this object.
2026-11-03 07:30Z: the T04 rehearsal passed. It fetched version
`1793690919900126` with the supplier key, which is independent of the node
pair, and the hash matched. It decrypted with the identity from
`platform/recovery/mas/age-identity` and restored into private scratch.
All three files matched their capture hashes. Both SQLite databases passed
`integrity_check`, and their table fingerprints matched the capture:
`tickets.sqlite3` holds messages 34, outbox 9 and tickets 10;
`tickets-outbox.sqlite3` holds mailer_meta 1 and mode_outbox 9.
`events.jsonl` has 36 events, all of which parse. Fetch, decrypt, restore
and checks took 0.39 s after login, inside the provisional 60-minute RTO.
The scratch directory was removed. No facility restore, receiver or mail.
T04 is done. Receipt: `docs/evidence/mas-evidence-offsite-rehearsal-2026-11-03.json`.
## Escrow the age identity and get owner acceptance
```task