coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0064-T03: v2 restore receipt and independent verifier

Browse source 
Receipt schema railiance-openbao-restore-receipt/v2 extending the drill
template, with typed sha256 digests only. The verifier does not import the
adapter: exact schema, result consistency, required teardown, claims_not_made,
deadline and --not-after, secret-shape/placeholder/data refusal, and source
hash comparison against a clean checkout at adapter_commit. 17 offline tests
including 28 adversarial receipt fixtures.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4384@bnt-lap001
Assistant-Session: 80d1f3da-7a91-4519-9737-9ba128b4da64
This commit is contained in:
codex 2026-10-23 20:49:35 +02:00
parent 0cc3281ab3
commit 7f67c9c244
4 changed files with 983 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

159
docs/openbao-restore-receipt-v2.example.json Normal file
View file

@ -0,0 +1,159 @@
{
"schema": "railiance-openbao-restore-receipt/v2",
"extends": "docs/openbao-restore-drill-evidence.example.json",
"attempt_id": "RPF-WP-0064-T07-YYYYMMDD-01",
"material": "original",
"phase": "A",
"admission_sha256": "sha256:5555555555555555555555555555555555555555555555555555555555555555",
"admission_namespace": "railiance-openbao-restore-attempt",
"signer_principal": "founder",
"signer_fingerprint": "replace-with-ssh-signer-fingerprint",
"anchor_protected": true,
"abort_operator": "founder",
"adapter_commit": "replace-with-40-hex-adapter-commit",
"source_sha256": {
"docs/contracts/secrets-engine-openbao-jwt-login.yaml": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
"openbao/auth/keycape-services-config.json": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
"openbao/auth/netkingdom-oidc-config.json": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
"openbao/auth/netkingdom-platform-admin-role.json": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
"openbao/auth/secrets-engine-jwt-role.json": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
"openbao/policies/secrets-engine-login-self.hcl": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
"scripts/openbao-isolated-restore/preflight.py": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
"scripts/openbao-isolated-restore/restore_adapter.py": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
"scripts/openbao-isolated-restore/run-isolated-restore.sh": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
"scripts/openbao-isolated-restore/verify-restore-receipt.py": "sha256:0000000000000000000000000000000000000000000000000000000000000000"
},
"started_at": "YYYY-MM-DDTHH:MM:SSZ",
"finished_at": "YYYY-MM-DDTHH:MM:SSZ",
"not_after": "YYYY-MM-DDTHH:MM:SSZ",
"deadline_seconds": 2700,
"elapsed_seconds": 0,
"image": "quay.io/openbao/openbao@sha256:0000000000000000000000000000000000000000000000000000000000000000",
"image_id": "sha256:6666666666666666666666666666666666666666666666666666666666666666",
"snapshot": {
"ciphertext_sha256": "sha256:1111111111111111111111111111111111111111111111111111111111111111",
"ciphertext_bytes": 0,
"plaintext_sha256": "sha256:2222222222222222222222222222222222222222222222222222222222222222",
"source_cluster_id": "replace-with-source-cluster-id",
"source_applied_index": 0,
"source_receipt_sha256": "sha256:3333333333333333333333333333333333333333333333333333333333333333",
"ciphertext_verified": true,
"plaintext_verified": true
},
"restored": {
"cluster_id": "replace-with-restored-cluster-id",
"applied_index": 0,
"sealed_after_restore": true,
"unsealed_with_original_shares": true,
"cluster_id_match": true,
"applied_index_not_behind": true,
"throwaway_init_invalidated": true
},
"network": {
"network_mode": "none",
"docker_networks": [
"none"
],
"interfaces": [
"lo"
],
"published_ports": [],
"mounts": [],
"egress_refused": true
},
"objects": [
{
"object": "auth_mount_keycape_services",
"path": "sys/auth",
"present": true,
"source_match": true,
"source_path": null,
"observed_sha256": "sha256:4444444444444444444444444444444444444444444444444444444444444444"
},
{
"object": "auth_mount_netkingdom",
"path": "sys/auth",
"present": true,
"source_match": true,
"source_path": null,
"observed_sha256": "sha256:4444444444444444444444444444444444444444444444444444444444444444"
},
{
"object": "kv_mount_platform",
"path": "sys/mounts",
"present": true,
"source_match": true,
"source_path": null,
"observed_sha256": "sha256:4444444444444444444444444444444444444444444444444444444444444444"
},
{
"object": "keycape_services_config",
"path": "auth/keycape-services/config",
"present": true,
"source_match": true,
"source_path": "openbao/auth/keycape-services-config.json",
"observed_sha256": "sha256:4444444444444444444444444444444444444444444444444444444444444444"
},
{
"object": "secrets_engine_jwt_role",
"path": "auth/keycape-services/role/secrets-engine-openbao",
"present": true,
"source_match": true,
"source_path": "openbao/auth/secrets-engine-jwt-role.json",
"observed_sha256": "sha256:4444444444444444444444444444444444444444444444444444444444444444"
},
{
"object": "netkingdom_oidc_config",
"path": "auth/netkingdom/config",
"present": true,
"source_match": true,
"source_path": "openbao/auth/netkingdom-oidc-config.json",
"observed_sha256": "sha256:4444444444444444444444444444444444444444444444444444444444444444"
},
{
"object": "platform_admin_role",
"path": "auth/netkingdom/role/platform-admin",
"present": true,
"source_match": true,
"source_path": "openbao/auth/netkingdom-platform-admin-role.json",
"observed_sha256": "sha256:4444444444444444444444444444444444444444444444444444444444444444"
},
{
"object": "policy_secrets_engine_login_self",
"path": "sys/policies/acl/secrets-engine-login-self",
"present": true,
"source_match": true,
"source_path": "openbao/policies/secrets-engine-login-self.hcl",
"observed_sha256": "sha256:4444444444444444444444444444444444444444444444444444444444444444"
},
{
"object": "kv_registration_metadata",
"path": "platform/metadata/workloads/keycape/secrets-engine-openbao",
"present": true,
"source_match": true,
"source_path": null,
"observed_sha256": "sha256:4444444444444444444444444444444444444444444444444444444444444444"
}
],
"result": "restored",
"reason": "all_required_objects_match",
"teardown": {
"container_removed": true,
"container_absent_verified": true,
"plaintext_memfd_closed": true,
"custody_memfd_closed": true,
"readback_credential_revoked": true,
"docker_volumes_created": 0,
"performed_by": "session"
},
"kv_data_read": false,
"no_secret_material_recorded": true,
"claims_not_made": [
"consumer_continuity",
"live_jwt_login",
"phase_b_network",
"owner_acceptance",
"recurring_restore_assurance",
"production_redirect"
]
}