coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare bounded Coulomb API identity bootstrap with private restartable custody

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a17f16-d99c-7ea3-95f0-8212897fba6b
This commit is contained in:
codex 2026-10-28 12:43:05 +01:00
parent bd8ca57dc9
commit 7aa38fcacd
4 changed files with 741 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

35
workplans/RPF-WP-0053-coulomb-paired-backup-admission.md
View file

@ -319,3 +319,38 @@ regular recovery/drill credential. Retire the temporary session after native API
verification. No standing organization-wide operator key or publisher IAM admin
right follows from this instruction. First aborted attempt saved no state; fresh
attended browser is waiting for user confirmation, with no provider mutation.
## Prepared deterministic API identity bootstrap — 2026-10-28
The first saved Console session could read the exact publisher metadata but
expired before provisioning; API access now401 and renewal400. No project, policy
or API key was created. The consumer records responsibility for the delay and
will prepare the complete bootstrap before another login.
New scripts/application_recovery_identities.py previews without effects and
executes only through temporary auth on stdin. It binds the organization to the
exact existing Coulomb publisher, creates an isolated recovery project, three
separate applications (temporary construction, read-only archive reader,
custodian), and four project-only policies including the publisher's mirror
policy. No IAM/org-wide grants or replacement of the existing publisher pair/
primary-bucket policy. The construction key has verified expiry at most two hours.
The custodian gets explicit SecretManagerSecretAccess plus metadata read and
limited object publication/read; archive reader has no secret access. Native
bucket policy/escrow denials and protected custody remain mandatory after this
identity stage; no archive, timer or operating acceptance follows automatically.
Atomic owner-private output outside Git, fsync, effective-rule readback, explicit
uncertain-issuance refusal, and own newly issued key revocation on persistence
failure prevent silent duplicate/relabelled credentials. Retirement deletes only
the exact verified construction key and its private temporary pair, retaining
routine pairs and all backup material. Twelve synthetic cases pass; targeted
platform Ruff and Node syntax checks pass. Native provisioning remains unperformed.
The committed bootstrap_coulomb_recovery_session.mjs validates source/private
output/locked Playwright before opening a browser, then executes the factory
immediately after confirmation, reading current in-memory auth. It keeps the
browser open for reviewed correction and API resource/boundary checks, then
retires construction authority and logs out on finish. It saves no personal
browser state. Run --preflight-only first; routine access uses the scoped API
pairs, never that personal session. The expired earlier capture is not a
credential lane. Existing independent recovery and service gates stay open.