coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Admit MAS backup node delivery for CCR-2026-0062 after the live reader boundary proof.

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4541@bnt-lap001
Assistant-Session: 2099b3aa-d7d9-49a9-ab4e-fa8b7d0e39e8
This commit is contained in:
codex 2026-11-03 05:52:28 +01:00
parent d41c5ace0a
commit 98e2cad1cc
3 changed files with 107 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

43
credential-change-requests/CCR-2026-0062-mas-backup-primary.yaml
View file

@ -6,7 +6,7 @@
"title": "MAS evidence archive node-delivery reader",
"status": "applied",
"created": "2026-11-02",
"updated": "2026-11-02",
"updated": "2026-11-03",
"requester": {
"agent": "grok",
"reason": "Founder asked to prepare the MAS prefix publisher under RPF-WP-0070. Preparation is not a live grant."
@ -93,17 +93,17 @@
"directory_mode": "0700",
"procedure": "scripts/application_backup_credentials.py",
"admission": {
"node_executor_approved": false,
"provider_scope_verified": false,
"reader_boundary_verified": false,
"source_ref": ""
"node_executor_approved": true,
"provider_scope_verified": true,
"reader_boundary_verified": true,
"source_ref": "founder-node-admission-2026-11-03"
}
},
"provider": {
"endpoint": "https://s3.nl-ams.scw.cloud",
"bucket": "railiance-platform-pg-backup",
"prefix": "platform-pg/application-archives/mas/",
"identity": "IAM application mas-evidence-backup-primary 25a4cbca-220e-40c0-9af5-6c7713000174; founder stored the API key at platform/suppliers/scaleway/mas-evidence-backup-primary, preferred project mail-address-semantics; this workload path has no pair; bucket policy source allows only platform-pg/application-archives/mas/ and withholds object delete",
"identity": "IAM application mas-evidence-backup-primary 25a4cbca-220e-40c0-9af5-6c7713000174. The founder holds the supplier key at platform/suppliers/scaleway/mas-evidence-backup-primary. The workload pair is a separately minted second key, preferred project reef-storage, stored CAS=0 at version 1. The bucket policy allows only platform-pg/application-archives/mas/ and withholds object delete.",
"retained_delete": false
},
"risk": {
@ -149,6 +149,35 @@
"ops-mason custody row and ops-warden catalog id scaleway-mas-evidence-backup-primary record that path. The value was not read. The workload pair remains empty and delivery admission stays false.",
"Metadata read of that path with the local token returned HTTP 403, so the version was not confirmed from this workstation."
]
},
{
"at": "2026-11-03T04:45:02Z",
"actor": "claude-code",
"kind": "pair_provision_and_provider_scope",
"result": "passed",
"details": [
"The attended gate minted a second key on the MAS application, without reading or copying the supplier key, and wrote it CAS=0 at platform/workloads/mas/backup-primary version 1.",
"Provider proof with that key: MAS prefix list HTTP 200; sibling prefix, retained delete, and bucket administration HTTP 403 AccessDenied. Receipt docs/evidence/mas-evidence-workload-pair-2026-11-03.json."
]
},
{
"at": "2026-11-03T04:51:03Z",
"actor": "claude-code",
"kind": "reader_boundary",
"result": "passed",
"details": [
"Live mas/backup-primary-delivery login with audience openbao held only workload-kv-read-mas-backup-primary, lease 300, explicit max 300, period 0, no identity policy, and read KV version 1 with exactly the two fields.",
"A wrong audience and a foreign role could not log in. Sibling data (two applications), metadata GET, parent LIST, KV write, and sys/policies/acl returned 403. All tokens were revoked. Receipt docs/evidence/mas-backup-reader-boundary-2026-11-03.json."
]
},
{
"at": "2026-11-03T04:55:00Z",
"actor": "User (platform-owner)",
"kind": "node_execution_admission",
"result": "approved",
"details": [
"Founder approved node execution for this delivery in an attended session. source_ref founder-node-admission-2026-11-03."
]
}
],
"activation_conditions": [
@ -166,7 +195,7 @@
},
"state_hub": {
"workplan_id": "RPF-WP-0070",
"task_id": "RPF-WP-0070-T01"
"task_id": "RPF-WP-0070-T02"
},
"related": {
"workplan": "RPF-WP-0070",

56
docs/evidence/mas-backup-reader-boundary-2026-11-03.json Normal file
View file

@ -0,0 +1,56 @@
{
"application": "mas",
"checked_at": "2026-11-03T04:51:03.273085+00:00",
"cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786",
"expected_kv_version": 1,
"jwt_binding": true,
"kv_path": "platform/data/workloads/mas/backup-primary",
"negative": {
"admin_policy_list": 403,
"foreign_role_login": 403,
"kv_write": 403,
"metadata_read": 403,
"parent_list": 403,
"passed": true,
"second_sibling_data_read": 403,
"sibling_data_read": 403,
"tokens_revoked": true,
"wrong_audience_login": 403
},
"passed": true,
"policy": "workload-kv-read-mas-backup-primary",
"positive": {
"encoding_ok": true,
"field_names": [
"AWS_ACCESS_KEY_ID",
"AWS_SECRET_ACCESS_KEY"
],
"fields_distinct": true,
"kv_deleted": false,
"kv_destroyed": false,
"kv_version": 1,
"lease_duration": 300,
"login_policies": [
"workload-kv-read-mas-backup-primary"
],
"login_status": 200,
"passed": true,
"read_status": 200,
"token": {
"explicit_max_ttl": 300,
"identity_policies": [],
"num_uses": 3,
"period": 0,
"policies": [
"workload-kv-read-mas-backup-primary"
],
"ttl": 300
},
"token_revoked": true
},
"role": "mas-backup-primary-workload-kv-read",
"runner": "attended: founder ran scripts/backup_reader_boundary_probe.py (d41c5ac) as root on railiance01",
"schema": "platform.backup-reader-boundary.v1",
"service_account": "mas/backup-primary-delivery",
"values_recorded": false
}

16
workplans/RPF-WP-0070-mas-evidence-recovery.md
View file

@ -144,7 +144,7 @@ status: progress
priority: medium
needs_human: true
depends_on: [RPF-WP-0070-T01]
intervention_note: "Founder approved node execution for CCR-2026-0062 on 2026-11-03. Next: run scripts/backup_reader_boundary_probe.py --application mas --expected-kv-version 1 as root on railiance01 and record the receipt. Then set the admission flags, export the CCR and pin its SHA256, and run the node delivery."
intervention_note: "Admission set 2026-11-03; admitted CCR export SHA256 16dbfe197b6f42e24bcd7d23e81e5d699ec7d3eb17e7a5177415e5d757a1a372. Next: attended root run of scripts/application_backup_credentials.py --application mas --expected-kv-version 1 --execute on railiance01, then record the metadata receipt."
state_hub_task_id: "c8a9ba31-9fb6-5412-90b7-dea658943053"
```
@ -168,6 +168,20 @@ parent LIST, a KV write, and `sys/policies/acl`. The write probe uses CAS=0
on the existing path, so it cannot replace the pair. Every token is revoked,
and the receipt holds statuses and names only.
2026-11-03 04:51Z: the founder ran the probe on railiance01, and it
passed. KV version 1 was readable with exactly the two fields under the
single reader policy (lease 300, explicit max 300, period 0, no identity
policy). All eight denials returned 403, and every token was revoked.
Receipt: `docs/evidence/mas-backup-reader-boundary-2026-11-03.json`.
CCR-2026-0062 delivery admission is now `node_executor_approved`,
`provider_scope_verified` and `reader_boundary_verified`, with source_ref
`founder-node-admission-2026-11-03`. The admitted export from
`scripts/render_backup_credential_contract.py` has SHA256
`16dbfe197b6f42e24bcd7d23e81e5d699ec7d3eb17e7a5177415e5d757a1a372`. It
passes the delivery helper's execute-mode contract check. The delivery
helper source is `b4a9622f2afe122b3aadbb7d2a818b8b7a92d248f2c9d6a9105460f452b2872e`.
`/etc/mas-backup` does not exist on the node yet.
## Install the worker and publish the first offsite copy
```task