coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare bounded independent cadence observer custody readback

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
This commit is contained in:
codex 2026-10-15 21:29:36 +02:00
parent 7ec54d59e0
commit 4f054046dc
3 changed files with 511 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

41
docs/cadence-receiver-custody.md
View file

@ -93,3 +93,44 @@ refusal and per-instance observer matrix. The runner's wrong-service-identity
probes do not separately isolate wrong namespace while preserving the correct
service account name. Record that check honestly rather than treating the
combined refusal as the complete namespace test.
## Independent hour-end custody readback
Use a fresh attended platform-admin envelope after the observation hour; the
initial session must not be held open. `scripts/cadence_observer_readback.py`
reuses the existing uniquely selected independent read-only full-tenant
operator credential in process memory. It changes no credential or workload
and never grants the collector archive read permission. Its only transport
is a temporary primary-cluster localhost port-forward that is terminated on
exit, with redirects and environment HTTP proxies disabled.
```bash
python3 scripts/cadence_observer_readback.py \
--source qonto-assistant --tenant tenant:friendly:binky \
--instance '<exact-source-snapshot-instance>' \
--since '<acceptance-window-start-with-timezone>' \
--until '<acceptance-window-end-with-timezone>' \
--event-id '<exact-collector-event-id-1>' \
--event-id '<exact-collector-event-id-2>' \
--kubeconfig '<owner-selected-kubeconfig>' --server '<verified-primary-server>' \
--expected-receiver-image 'forgejo.coulomb.social/coulomb/audit-core@sha256:<reviewed-digest>' \
--receipt '<new-private-readback-receipt-path>'
```
Provide all capture event IDs (maximum256, unique). The reader only opens
those IDs, the exact source/tenant/instance reconciliation query, and the
protected global stream-findings surface. It outputs only findings for the
selected source; no unrelated findings or request payload is persisted.
Every event must match exact ID/source/tenant/instance and acceptance window.
The sanitized event projection includes instance/sequence, action, observed
and accepted timestamps, and exact heartbeat coverage. Actual custody
accepted_at can distinguish a duplicate delivery receipt from original custody
time; a collector duplicate200 is not itself first-acceptance timing proof.
Approval Engine source/tenant is also allowed, but this helper requires an
instance-bearing source record and therefore cannot substitute for its
historical instance-free lifecycle acceptance path.
Exit0 reports `independent_custody_readback_complete`, which proves only the
bounded supplied custody reads. The source snapshot, contiguous startup/
periodic capture, process inventory and negative observation matrix remain
independent inputs to Kings Guard's assessment.