Record approved OpenBao custody design and separate producer delivery gate
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29
This commit is contained in:
codex
parent
663135c0f9
commit
4b3a0e13a7
2 changed files with 44 additions and 24 deletions
|
|
@ -1,12 +1,14 @@
|
|||
# Conditional platform-root producer packet
|
||||
# Approved platform-root producer design
|
||||
|
||||
Prepared for NK-WP-0045-T05 / RPF-WP-0049, 2026-10-03. This is source-only
|
||||
preparation, not surface selection, identity admission, custody or live readiness.
|
||||
Prepared for NK-WP-0045-T05 / RPF-WP-0049, 2026-10-03. Founder approved:
|
||||
"Accept ADR-0017 and approve the proposed OpenBao delivery design."
|
||||
This selects railiance-platform and the exact source below. Identity admission,
|
||||
attended live provisioning, custody provenance and live readiness remain pending.
|
||||
NetKingdom canon remains authoritative; reviewed baseline is net-kingdom commit
|
||||
`0122db64fdfc8cc6ba9076e167652b084f1a3f04`. Deployments must pin the validator
|
||||
and its schema together, and reconcile amendments before publication.
|
||||
|
||||
## Proposed source and transport
|
||||
## Approved source and transport
|
||||
|
||||
- KV v2 mount: `platform` (existing owner convention; live suitability unverified).
|
||||
- Exact API path: `/v1/platform/data/custody/net-kingdom/platform-root`.
|
||||
|
|
@ -34,16 +36,16 @@ refuses missing existing baselines, same-revision changes and rollback. CAS=0
|
|||
is bootstrap-only, CAS=current-version updates; a CAS conflict requires a fresh
|
||||
owner read and revalidation, never blind retry. It never prints documents.
|
||||
|
||||
The attended executor still needs implementation after the source/identity
|
||||
choice: suppress output, read document and KV version together, verify retained
|
||||
high-water mark, call preparation helper, write one complete payload, read back
|
||||
The attended executor still needs implementation after actual reader/writer
|
||||
identity confirmation: suppress output, read document and KV version together,
|
||||
verify retained high-water mark, call preparation helper, write one complete payload, read back
|
||||
and compare, and emit non-secret revision/digest receipts. An unvalidated direct
|
||||
writer bypass is not an accepted delivery path. Policies alone cannot enforce
|
||||
the human ceremony, validator or global revision monotonicity.
|
||||
|
||||
## Exact later live approval packet
|
||||
|
||||
After ADR/surface selection and real consumer identity confirmation, request
|
||||
After real consumer identity confirmation and final source preparation, request
|
||||
one explicit attended approval naming the reviewed platform and NetKingdom
|
||||
commits, exact mount/path/record ID, real reader auth binding, separate writer
|
||||
binding, audit owner, abort operator, window and provenance reference. Its
|
||||
|
|
@ -77,3 +79,7 @@ start was withheld/orientation-only (digest
|
|||
60f8811c6b94b30d357a0d9e5022f2a8ea52e69b47138d3a536755f3295310b5);
|
||||
source review read the-custodian agent-environment-orientation section 0 and
|
||||
informed-decision README, plus the source NetKingdom contract/schema/validator.
|
||||
|
||||
Producer delivery receipts complete RPF-WP-0049-T05 / NK-WP-0045-T05.
|
||||
Consumer integration and runtime acceptance follow in USER-WP-0037-T02 /
|
||||
NK-WP-0045-T06; they do not block initial producer delivery.
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
---
|
||||
id: RPF-WP-0049
|
||||
type: workplan
|
||||
title: "Prepare conditional OpenBao delivery of the platform-root custody fact"
|
||||
title: "Deliver the approved OpenBao platform-root custody fact design"
|
||||
domain: financials
|
||||
repo: railiance-platform
|
||||
status: blocked
|
||||
|
|
@ -13,10 +13,13 @@ related: [NK-WP-0045, USER-WP-0037]
|
|||
state_hub_workstream_id: "7dc1b126-1ddd-550f-9e6a-1fc577d0f27b"
|
||||
---
|
||||
|
||||
Conditional response to net-kingdom message bc0c620c. Owner source preparation
|
||||
is feasible; OpenBao has not been selected and no production source exists.
|
||||
Response to net-kingdom message bc0c620c. Founder approved on 2026-10-03:
|
||||
"Accept ADR-0017 and approve the proposed OpenBao delivery design."
|
||||
The selected delivery owner is railiance-platform, using the exact OpenBao KV v2
|
||||
path and trusted record ID below. No production source exists yet; this approval
|
||||
accepts the design and does not authorize a live change or a custody entry.
|
||||
Contract: ../net-kingdom/docs/contracts/root-grant-read-contract_v0.1.md.
|
||||
Packet: [conditional producer](../openbao/root-grant/README.md).
|
||||
Packet: [approved producer design](../openbao/root-grant/README.md).
|
||||
|
||||
## Prepare reviewed producer interface and exact-path drafts
|
||||
|
||||
|
|
@ -34,33 +37,31 @@ bootstrap/current version, concurrent-write CAS binding, rollback, mutation,
|
|||
entry removal, wrong identity, secret diagnostics and invalid previous record.
|
||||
These are preparation artifacts, not an admitted or operational source.
|
||||
|
||||
## Obtain source selection and exact real reader identity
|
||||
## Obtain exact real reader identity for the approved source
|
||||
|
||||
```task
|
||||
id: RPF-WP-0049-T02
|
||||
status: wait
|
||||
priority: high
|
||||
needs_human: true
|
||||
decision_id: cef97ccd-4ee7-40fe-859e-1df9c9360ecb
|
||||
depends_on: [NK-WP-0045-T01, NK-WP-0045-T04]
|
||||
blocked_on: message-from:user-engine
|
||||
blocking_reason: "Founder ADR acceptance/OpenBao owner selection and user-engine real runtime reader identity/auth route are required; no deployed ServiceAccount is known."
|
||||
blocking_reason: "Design selection is approved; user-engine must still supply its actual runtime reader identity and supported authentication route. No deployed ServiceAccount is known."
|
||||
state_hub_task_id: "16096f84-6232-5d97-8fe3-b4683c79f4fb"
|
||||
```
|
||||
|
||||
Propose platform/data/custody/net-kingdom/platform-root, record ID
|
||||
Approved source: platform/data/custody/net-kingdom/platform-root, record ID
|
||||
nk-custody:platform-root and exact-path read using the existing owner-routed
|
||||
workload admission. user-engine confirmed nested document compatibility;
|
||||
its adapter is transport-neutral and runtime identity remains unconfirmed.
|
||||
|
||||
## Implement attended executor, recovery and audit after selection
|
||||
## Implement attended executor, recovery and audit for the approved source
|
||||
|
||||
```task
|
||||
id: RPF-WP-0049-T03
|
||||
status: wait
|
||||
priority: high
|
||||
depends_on: [RPF-WP-0049-T02]
|
||||
blocking_reason: "Surface and actual reader/writer custody bindings must be selected before final executor/admission/restore configuration can be implemented."
|
||||
blocking_reason: "Surface is approved; actual reader identity and separate attended writer custody bindings remain required for final executor/admission/restore configuration."
|
||||
state_hub_task_id: "0bc4bc1f-e279-5c92-97bb-cf76d2e33749"
|
||||
```
|
||||
|
||||
|
|
@ -85,16 +86,29 @@ Assemble exact later approval packet from producer README. Source-only draft
|
|||
policies are not approval to apply or create entries. Bootstrap ceremony facts
|
||||
are supplied by human custodian, never inferred from IAM or test fixtures.
|
||||
|
||||
## Return delivery and consumer acceptance receipts
|
||||
## Return producer delivery receipts
|
||||
|
||||
```task
|
||||
id: RPF-WP-0049-T05
|
||||
status: wait
|
||||
priority: high
|
||||
depends_on: [RPF-WP-0049-T04, USER-WP-0037-T02]
|
||||
blocking_reason: "Live authenticated/denial/outage/revocation/restore/audit receipts and user-engine integration against delivered source remain absent."
|
||||
depends_on: [RPF-WP-0049-T04]
|
||||
blocking_reason: "Live authenticated/denial/outage/revocation/restore/audit producer delivery receipts remain absent."
|
||||
state_hub_task_id: "871e3236-61c0-58a1-a307-399cd662be6b"
|
||||
```
|
||||
|
||||
Return non-secret revision/provenance/digest receipts to NK-WP-0045-T05/T06.
|
||||
No live readiness claim until all producer and consumer contract checks pass.
|
||||
Return non-secret revision/provenance/digest producer receipts to NK-WP-0045-T05.
|
||||
No producer readiness claim until all producer contract checks pass. Consumer
|
||||
integration acceptance belongs to NK-WP-0045-T06 and USER-WP-0037-T02 after
|
||||
the source is delivered; it is not a prerequisite for this producer task.
|
||||
This ordering avoids a producer/consumer dependency cycle.
|
||||
|
||||
## Approval receipt — 2026-10-03
|
||||
|
||||
Founder statement: "Accept ADR-0017 and approve the proposed OpenBao delivery
|
||||
design." This clears the source-selection part of T02 and binds the approved
|
||||
owner/path/record ID. T02 remains wait on user-engine identity, T03 on concrete
|
||||
bindings/final executor/recovery preparation, T04 on separate attended live
|
||||
approval and ceremony provenance, and T05 on actual producer delivery receipts.
|
||||
The workplan remains blocked on those residual dependencies. No live mutation
|
||||
or real custody entry is authorized by this design acceptance.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue