diff --git a/openbao/root-grant/README.md b/openbao/root-grant/README.md index 09aa553..b50d055 100644 --- a/openbao/root-grant/README.md +++ b/openbao/root-grant/README.md @@ -1,12 +1,14 @@ -# Conditional platform-root producer packet +# Approved platform-root producer design -Prepared for NK-WP-0045-T05 / RPF-WP-0049, 2026-10-03. This is source-only -preparation, not surface selection, identity admission, custody or live readiness. +Prepared for NK-WP-0045-T05 / RPF-WP-0049, 2026-10-03. Founder approved: +"Accept ADR-0017 and approve the proposed OpenBao delivery design." +This selects railiance-platform and the exact source below. Identity admission, +attended live provisioning, custody provenance and live readiness remain pending. NetKingdom canon remains authoritative; reviewed baseline is net-kingdom commit `0122db64fdfc8cc6ba9076e167652b084f1a3f04`. Deployments must pin the validator and its schema together, and reconcile amendments before publication. -## Proposed source and transport +## Approved source and transport - KV v2 mount: `platform` (existing owner convention; live suitability unverified). - Exact API path: `/v1/platform/data/custody/net-kingdom/platform-root`. @@ -34,16 +36,16 @@ refuses missing existing baselines, same-revision changes and rollback. CAS=0 is bootstrap-only, CAS=current-version updates; a CAS conflict requires a fresh owner read and revalidation, never blind retry. It never prints documents. -The attended executor still needs implementation after the source/identity -choice: suppress output, read document and KV version together, verify retained -high-water mark, call preparation helper, write one complete payload, read back +The attended executor still needs implementation after actual reader/writer +identity confirmation: suppress output, read document and KV version together, +verify retained high-water mark, call preparation helper, write one complete payload, read back and compare, and emit non-secret revision/digest receipts. An unvalidated direct writer bypass is not an accepted delivery path. Policies alone cannot enforce the human ceremony, validator or global revision monotonicity. ## Exact later live approval packet -After ADR/surface selection and real consumer identity confirmation, request +After real consumer identity confirmation and final source preparation, request one explicit attended approval naming the reviewed platform and NetKingdom commits, exact mount/path/record ID, real reader auth binding, separate writer binding, audit owner, abort operator, window and provenance reference. Its @@ -77,3 +79,7 @@ start was withheld/orientation-only (digest 60f8811c6b94b30d357a0d9e5022f2a8ea52e69b47138d3a536755f3295310b5); source review read the-custodian agent-environment-orientation section 0 and informed-decision README, plus the source NetKingdom contract/schema/validator. + +Producer delivery receipts complete RPF-WP-0049-T05 / NK-WP-0045-T05. +Consumer integration and runtime acceptance follow in USER-WP-0037-T02 / +NK-WP-0045-T06; they do not block initial producer delivery. diff --git a/workplans/RPF-WP-0049-platform-root-custody-record-delivery.md b/workplans/RPF-WP-0049-platform-root-custody-record-delivery.md index f9ea0c9..cc113e5 100644 --- a/workplans/RPF-WP-0049-platform-root-custody-record-delivery.md +++ b/workplans/RPF-WP-0049-platform-root-custody-record-delivery.md @@ -1,7 +1,7 @@ --- id: RPF-WP-0049 type: workplan -title: "Prepare conditional OpenBao delivery of the platform-root custody fact" +title: "Deliver the approved OpenBao platform-root custody fact design" domain: financials repo: railiance-platform status: blocked @@ -13,10 +13,13 @@ related: [NK-WP-0045, USER-WP-0037] state_hub_workstream_id: "7dc1b126-1ddd-550f-9e6a-1fc577d0f27b" --- -Conditional response to net-kingdom message bc0c620c. Owner source preparation -is feasible; OpenBao has not been selected and no production source exists. +Response to net-kingdom message bc0c620c. Founder approved on 2026-10-03: +"Accept ADR-0017 and approve the proposed OpenBao delivery design." +The selected delivery owner is railiance-platform, using the exact OpenBao KV v2 +path and trusted record ID below. No production source exists yet; this approval +accepts the design and does not authorize a live change or a custody entry. Contract: ../net-kingdom/docs/contracts/root-grant-read-contract_v0.1.md. -Packet: [conditional producer](../openbao/root-grant/README.md). +Packet: [approved producer design](../openbao/root-grant/README.md). ## Prepare reviewed producer interface and exact-path drafts @@ -34,33 +37,31 @@ bootstrap/current version, concurrent-write CAS binding, rollback, mutation, entry removal, wrong identity, secret diagnostics and invalid previous record. These are preparation artifacts, not an admitted or operational source. -## Obtain source selection and exact real reader identity +## Obtain exact real reader identity for the approved source ```task id: RPF-WP-0049-T02 status: wait priority: high -needs_human: true -decision_id: cef97ccd-4ee7-40fe-859e-1df9c9360ecb depends_on: [NK-WP-0045-T01, NK-WP-0045-T04] blocked_on: message-from:user-engine -blocking_reason: "Founder ADR acceptance/OpenBao owner selection and user-engine real runtime reader identity/auth route are required; no deployed ServiceAccount is known." +blocking_reason: "Design selection is approved; user-engine must still supply its actual runtime reader identity and supported authentication route. No deployed ServiceAccount is known." state_hub_task_id: "16096f84-6232-5d97-8fe3-b4683c79f4fb" ``` -Propose platform/data/custody/net-kingdom/platform-root, record ID +Approved source: platform/data/custody/net-kingdom/platform-root, record ID nk-custody:platform-root and exact-path read using the existing owner-routed workload admission. user-engine confirmed nested document compatibility; its adapter is transport-neutral and runtime identity remains unconfirmed. -## Implement attended executor, recovery and audit after selection +## Implement attended executor, recovery and audit for the approved source ```task id: RPF-WP-0049-T03 status: wait priority: high depends_on: [RPF-WP-0049-T02] -blocking_reason: "Surface and actual reader/writer custody bindings must be selected before final executor/admission/restore configuration can be implemented." +blocking_reason: "Surface is approved; actual reader identity and separate attended writer custody bindings remain required for final executor/admission/restore configuration." state_hub_task_id: "0bc4bc1f-e279-5c92-97bb-cf76d2e33749" ``` @@ -85,16 +86,29 @@ Assemble exact later approval packet from producer README. Source-only draft policies are not approval to apply or create entries. Bootstrap ceremony facts are supplied by human custodian, never inferred from IAM or test fixtures. -## Return delivery and consumer acceptance receipts +## Return producer delivery receipts ```task id: RPF-WP-0049-T05 status: wait priority: high -depends_on: [RPF-WP-0049-T04, USER-WP-0037-T02] -blocking_reason: "Live authenticated/denial/outage/revocation/restore/audit receipts and user-engine integration against delivered source remain absent." +depends_on: [RPF-WP-0049-T04] +blocking_reason: "Live authenticated/denial/outage/revocation/restore/audit producer delivery receipts remain absent." state_hub_task_id: "871e3236-61c0-58a1-a307-399cd662be6b" ``` -Return non-secret revision/provenance/digest receipts to NK-WP-0045-T05/T06. -No live readiness claim until all producer and consumer contract checks pass. +Return non-secret revision/provenance/digest producer receipts to NK-WP-0045-T05. +No producer readiness claim until all producer contract checks pass. Consumer +integration acceptance belongs to NK-WP-0045-T06 and USER-WP-0037-T02 after +the source is delivered; it is not a prerequisite for this producer task. +This ordering avoids a producer/consumer dependency cycle. + +## Approval receipt — 2026-10-03 + +Founder statement: "Accept ADR-0017 and approve the proposed OpenBao delivery +design." This clears the source-selection part of T02 and binds the approved +owner/path/record ID. T02 remains wait on user-engine identity, T03 on concrete +bindings/final executor/recovery preparation, T04 on separate attended live +approval and ceremony provenance, and T05 on actual producer delivery receipts. +The workplan remains blocked on those residual dependencies. No live mutation +or real custody entry is authorized by this design acceptance.