coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0064-T10: break-glass drill mode for the isolated restore adapter

Browse source 
Adds --mode break-glass-drill with its own signed admission (drill:
"break-glass", attempt id RPF-WP-0064-T10-*, snapshot_label). After the
phase A restore and unseal it checks the held root token with lookup-self
only, runs a fresh generate-root ceremony with re-entered shares, does one
read-only sys/auth action, revokes the generated token (204 then 403) and
drills a cancelled attempt. Phase A is unchanged. The verifier types the
receipt extension and rejects token, accessor, OTP, nonce, encoded-token
and share shapes. Offline 34 and native 16 pass. Founder runbooks for the
drill and the read-only production SSO-down walk are in the T10 section.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
This commit is contained in:
codex 2026-10-28 00:02:10 +01:00
parent 05ff9f8678
commit a2da4085e0
11 changed files with 867 additions and 49 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/openbao.md
View file

@ -197,7 +197,9 @@ break-glass material with the same handling as unseal shares.
Use this when KeyCape or Authelia is down and an OpenBao action can't wait. It
belongs to NetKingdom NK-WP-0055-T13 and is drilled against an isolated restored
OpenBao only (RPF-WP-0064-T10). Never drill it on production.
OpenBao only (RPF-WP-0064-T10). Never drill it on production. The drill runs as
`scripts/openbao-isolated-restore/run-isolated-restore.sh --break-glass-drill` with its own signed
admission; the founder runbook is in the RPF-WP-0064 workplan, T10.
**What fails with SSO down.** Operator OIDC logins through `auth/netkingdom`
fail, and so does the warden lane. ops-warden SSH certificates fail too,