From 8e26afc6a6c30be6cd912ffe18f471ee34940207 Mon Sep 17 00:00:00 2001 From: codex Date: Sat, 22 Aug 2026 12:34:25 +0200 Subject: [PATCH] Add audit custody and recovery coordination workplan Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa --- WORK-RECORDS.md | 5 + ...-core-custody-and-recovery-coordination.md | 120 ++++++++++++++++++ 2 files changed, 125 insertions(+) create mode 100644 workplans/RAILIANCE-WP-0024-audit-core-custody-and-recovery-coordination.md diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index a5ed4db..7421a95 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -22,6 +22,7 @@ | workplan | RAILIANCE-WP-0017 | finished | — | workplans/RAILIANCE-WP-0017-consumption-mode-enforcement.md | | workplan | RAILIANCE-WP-0022 | finished | — | workplans/RAILIANCE-WP-0022-agent-high-risk-boundary-coverage.md | | workplan | RAILIANCE-WP-0023 | finished | — | workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md | +| workplan | RAILIANCE-WP-0024 | ready | — | workplans/RAILIANCE-WP-0024-audit-core-custody-and-recovery-coordination.md | | workplan | RPF-WP-0018 | finished | — | workplans/RPF-WP-0018-policy-surface-alignment.md | | workplan | RPF-WP-0019 | finished | — | workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md | | workplan | RPF-WP-0020 | finished | — | workplans/RPF-WP-0020-ccr-schema-drift.md | @@ -96,6 +97,10 @@ | task | RAILIANCE-WP-0023-T01 | done | — | workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md | | task | RAILIANCE-WP-0023-T02 | done | — | workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md | | task | RAILIANCE-WP-0023-T03 | done | — | workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md | +| task | RAILIANCE-WP-0024-T01 | todo | — | workplans/RAILIANCE-WP-0024-audit-core-custody-and-recovery-coordination.md | +| task | RAILIANCE-WP-0024-T02 | todo | — | workplans/RAILIANCE-WP-0024-audit-core-custody-and-recovery-coordination.md | +| task | RAILIANCE-WP-0024-T03 | todo | — | workplans/RAILIANCE-WP-0024-audit-core-custody-and-recovery-coordination.md | +| task | RAILIANCE-WP-0024-T04 | todo | — | workplans/RAILIANCE-WP-0024-audit-core-custody-and-recovery-coordination.md | | task | RPF-WP-0018-T01 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md | | task | RPF-WP-0018-T02 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md | | task | RPF-WP-0018-T03 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md | diff --git a/workplans/RAILIANCE-WP-0024-audit-core-custody-and-recovery-coordination.md b/workplans/RAILIANCE-WP-0024-audit-core-custody-and-recovery-coordination.md new file mode 100644 index 0000000..f3f7c2b --- /dev/null +++ b/workplans/RAILIANCE-WP-0024-audit-core-custody-and-recovery-coordination.md @@ -0,0 +1,120 @@ +--- +id: RAILIANCE-WP-0024 +type: workplan +title: "Coordinate audit-core temporary custody and recovery exercises" +domain: financials +repo: railiance-platform +status: ready +owner: codex +topic_slug: railiance +created: "2026-08-22" +updated: "2026-08-22" +related: + - AUDIT-WP-0008 + - WH-ENG-20260822-AUDIT-E2-01 +origin: routed +origin_ref: "State Hub messages 10f80080-4c83-42ba-8590-f23c582d9f05 and a93fa88f-a9c5-4539-93ae-0c8f8490f53d" +--- + +# RAILIANCE-WP-0024 — audit-core custody and recovery coordination + +## Goal + +Define value-safe, approval-gated execution paths for audit-core's proposed +Whitehat E2 sender exercise, runtime database-lease recovery exercise, and +coordinated `railiance01` reboot. This workplan produces preflight contracts; +it does not authorize a live token mint, OpenBao mutation, workload restart, +lease revocation, firewall change, or host reboot. + +## Boundaries + +- Never put bearer values, database credentials, Secret payloads, or OpenBao + response bodies in Git, State Hub, command output, evidence, or chat. +- Use exact paths and non-secret handles only. Temporary files, if later + approved, must be outside Git, mode `0600`, and securely removed. +- A sender token stored in the current audit-core registry has no intrinsic + OpenBao lease. Expiring its projection credential does not expire the copy + accepted by audit-core. E2 live execution therefore remains blocked until + audit-core enforces an `expires_at` value for each temporary identity. +- All live exercises require a separate engagement acknowledgement, attended + operators, a named window, and explicit abort authority. + +## T01 — Define the Whitehat E2 temporary sender lane + +```task +id: RAILIANCE-WP-0024-T01 +status: todo +priority: high +``` + +Define the reviewed path for exactly two distinct bearer values with an +effective lifetime of at most 900 seconds. Each identity is bound to +`source=whitehat-security`, one exact synthetic tenant, `may_write=true`, and +`may_read=true`; neither reuses a production sender identity. + +The design must keep the full sender registry out of namespace `whitehat`. +Use exact per-engagement KV paths and exact-key ExternalSecrets that project +only mounted token files. Define the readiness-gated audit-core rolling reload, +the audit-core `expires_at` prerequisite, the scheduled and attended cleanup, +and value-safe positive/negative evidence. + +Done when audit-core and the engagement owner can review a complete path whose +failure mode is expiry or denial, not a long-lived accepted bearer. + +## T02 — Define the runtime database lease recovery exercise + +```task +id: RAILIANCE-WP-0024-T02 +status: todo +priority: high +``` + +Coordinate with `rapp-postgres` and audit-core on a value-safe exercise for +`database/creds/audit-core-runtime`: identify the lease only by handle, revoke +or expire it under synthetic load, observe `/readyz` and 503 retry behavior, +and prove ESO refresh plus mounted-file reread restores service without a pod +restart. Record preconditions, time bounds, abort conditions, and rollback. + +Done when the procedure proves the property claimed by audit-core's credential +reader without exposing a username/password or affecting non-synthetic data. + +## T03 — Define the coordinated railiance01 reboot exercise + +```task +id: RAILIANCE-WP-0024-T03 +status: todo +priority: high +``` + +Coordinate the single-node outage with `railiance-infra`, +`railiance-cluster`, audit-core, and the OpenBao package owner. Require current +backup evidence, operator access, a declared restart order, OpenBao +seal/readiness handling, ESO reconciliation, audit-core database and sender +readiness, synthetic end-to-end verification, notifications, and explicit +abort/rollback conditions. + +Done when an operator-approved window can execute from one checklist without +guessing or relying on credential values in the record. + +## T04 — Route the contracts and approval gates + +```task +id: RAILIANCE-WP-0024-T04 +status: todo +priority: medium +``` + +Route the reviewed procedures to audit-core, `rapp-postgres`, +`railiance-cluster`, and `railiance-infra`. Identify each live mutation and its +owner, record outstanding approvals, and keep live tasks waiting until the +engagement or recovery window is explicitly acknowledged. + +Done when every participant has the same value-safe procedure, responsibility +map, and stop conditions. + +## Acceptance + +- [ ] E2 cannot proceed without enforced sender expiry and exact-path projection. +- [ ] Database recovery is restart-free and evidenced without credential values. +- [ ] Reboot recovery has an ordered, owner-signed checklist and abort path. +- [ ] No live action is implied by completing this design workplan.