From ac206fa2e8c2dad0345abffeb0eb32bd6bed2465 Mon Sep 17 00:00:00 2001 From: codex Date: Tue, 3 Nov 2026 21:11:19 +0100 Subject: [PATCH] Close RPF-WP-0015: the post-reboot synthetic E2 passed and the audit chain is intact. Accepted (202) then duplicate, same pod and restart count, clean cleanup; verify-chain intact at 2454 events with the 2026-10-14 head matched. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 236506@bnt-lap001 Assistant-Session: 09087018-91e1-48c5-ab2f-acfbb62c92e4 --- WORK-RECORDS.md | 4 +- .../approval.json | 35 ++++++++++++ .../exercise.json | 19 +++++++ .../post-e2-chain-check.json | 11 ++++ .../window-summary.json | 54 +++++++++++++++++++ ...-core-custody-and-recovery-coordination.md | 42 +++++++++++++-- 6 files changed, 158 insertions(+), 7 deletions(-) create mode 100644 docs/evidence/2026-11-03-rpf-wp-0015-t03-e2/approval.json create mode 100644 docs/evidence/2026-11-03-rpf-wp-0015-t03-e2/exercise.json create mode 100644 docs/evidence/2026-11-03-rpf-wp-0015-t03-e2/post-e2-chain-check.json create mode 100644 docs/evidence/2026-11-03-rpf-wp-0015-t03-e2/window-summary.json diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 4200368..dc1721e 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -12,7 +12,7 @@ | workplan | RPF-WP-ADHOC-2026-10-11 | finished | — | workplans/ADHOC-2026-10-11.md | | workplan | RPF-WP-ADHOC-2026-10-19 | finished | — | workplans/ADHOC-2026-10-19.md | | workplan | RPF-WP-ADHOC-2026-11-03 | finished | — | workplans/ADHOC-2026-11-03.md | -| workplan | RPF-WP-0015 | active | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md | +| workplan | RPF-WP-0015 | finished | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md | | workplan | RPF-WP-0025 | finished | — | workplans/RPF-WP-0025-openbao-operator-only-access.md | | workplan | RPF-WP-0027 | blocked | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md | | workplan | RPF-WP-0029 | finished | — | workplans/RPF-WP-0029-backup-credential-default-removal.md | @@ -64,7 +64,7 @@ | task | RPF-WP-ADHOC-2026-11-03-T03 | done | — | workplans/ADHOC-2026-11-03.md | | task | RPF-WP-0015-T01 | done | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md | | task | RPF-WP-0015-T02 | done | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md | -| task | RPF-WP-0015-T03 | wait | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md | +| task | RPF-WP-0015-T03 | done | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md | | task | RPF-WP-0015-T04 | done | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md | | task | RPF-WP-0025-T01 | done | — | workplans/RPF-WP-0025-openbao-operator-only-access.md | | task | RPF-WP-0025-T02 | done | — | workplans/RPF-WP-0025-openbao-operator-only-access.md | diff --git a/docs/evidence/2026-11-03-rpf-wp-0015-t03-e2/approval.json b/docs/evidence/2026-11-03-rpf-wp-0015-t03-e2/approval.json new file mode 100644 index 0000000..07a3901 --- /dev/null +++ b/docs/evidence/2026-11-03-rpf-wp-0015-t03-e2/approval.json @@ -0,0 +1,35 @@ +{ + "procedure": "audit-core-database-lease-recovery", + "task_id": "RAILIANCE-WP-0024-T03", + "status": "approved", + "approval_id": "rpf-wp-0015-t03-e2-20261103t2006z-founder-go", + "window": { + "start": "2026-11-03T20:06:00Z", + "end": "2026-11-03T20:21:00Z" + }, + "abort_operator": "founder (platform-root), attended", + "owners": { + "audit-core": { + "acknowledged": true, + "message_id": "f0def1dc-e589-4970-b17a-bad12c8ee8b2" + }, + "rapp-postgres": { + "acknowledged": true, + "message_id": "fad65811-acfd-43b1-9cd5-635241bad163" + }, + "railiance-platform": { + "acknowledged": true, + "message_id": "bd01bfa5-d637-4f23-84f1-e80acaa631a6" + } + }, + "synthetic_load": { + "contract_id": "RAILIANCE-WP-0024-T02-SYNTHETIC-01", + "driver_revision": "sha256:941ba251f638869626b06e9cbf430c70188c0bdf4715e3eff9c7610366f68662" + }, + "synthetic_sender": { + "identity": "t03-e2-synthetic-sender-20261103", + "source": "t03-e2-synthetic-20261103", + "tenant": "tenant:trial:t03-e2-synthetic-20261103", + "expires_at": "2026-11-03T20:21:00Z" + } +} diff --git a/docs/evidence/2026-11-03-rpf-wp-0015-t03-e2/exercise.json b/docs/evidence/2026-11-03-rpf-wp-0015-t03-e2/exercise.json new file mode 100644 index 0000000..3d568cb --- /dev/null +++ b/docs/evidence/2026-11-03-rpf-wp-0015-t03-e2/exercise.json @@ -0,0 +1,19 @@ +{ + "accepted_exactly_once": true, + "approval_id": "rpf-wp-0015-t03-e2-20261103t2006z-founder-go", + "completed_at": "2026-11-03T20:07:48Z", + "driver_cleanup_status": "clean", + "first_send_http_status": 202, + "first_send_status": "accepted", + "mode": "post-reboot-synthetic-e2", + "procedure": "audit-core-database-lease-recovery", + "replay_status": "duplicate", + "restart_count_unchanged": true, + "same_pod_uid": true, + "secret_values_observed": false, + "synthetic_event_accepted": true, + "synthetic_event_retained": "append-only chain, trial tenant (driver owns no server-side object)", + "synthetic_load_contract": "RAILIANCE-WP-0024-T02-SYNTHETIC-01", + "synthetic_load_driver_revision": "sha256:941ba251f638869626b06e9cbf430c70188c0bdf4715e3eff9c7610366f68662", + "task_id": "RAILIANCE-WP-0024-T03" +} diff --git a/docs/evidence/2026-11-03-rpf-wp-0015-t03-e2/post-e2-chain-check.json b/docs/evidence/2026-11-03-rpf-wp-0015-t03-e2/post-e2-chain-check.json new file mode 100644 index 0000000..4c35e74 --- /dev/null +++ b/docs/evidence/2026-11-03-rpf-wp-0015-t03-e2/post-e2-chain-check.json @@ -0,0 +1,11 @@ +{ + "run_by_role": "founder", + "command": "kubectl -n audit-core exec deploy/audit-core -- python -m audit_core verify-chain [--against <2026-10-14 post-reboot attestation>]", + "verify_chain": {"intact": true, "events": 2454, "first_break": null, "exit": 0, + "head": "49cf8ba42426823d33b3afbe88e2ca9e023527aae8f85d69f5736d6d54381098", + "head_event_id": "t02-rpf-wp-0015-t03-e2-20261103t2006z-founder-go", + "head_accepted_at": "2026-11-03T20:07:48+00:00"}, + "against_2026_10_14_post_reboot_head": {"attestation_match": true, "exit": 0, + "cited_head": "c99426d8fb53454c2da6217330c2cde62e440deb3d5ca2ebb04155c0a3108c4d"}, + "secret_values_observed": false +} diff --git a/docs/evidence/2026-11-03-rpf-wp-0015-t03-e2/window-summary.json b/docs/evidence/2026-11-03-rpf-wp-0015-t03-e2/window-summary.json new file mode 100644 index 0000000..ee61c92 --- /dev/null +++ b/docs/evidence/2026-11-03-rpf-wp-0015-t03-e2/window-summary.json @@ -0,0 +1,54 @@ +{ + "approval_id": "rpf-wp-0015-t03-e2-20261103t2006z-founder-go", + "cleanup": { + "approval_id": "rpf-wp-0015-t03-e2-20261103t2006z-founder-go", + "audit_core_ready": "1/1", + "audit_core_restarted": true, + "bearer_file_removed": true, + "cleanup_completed_at": "2026-11-03T20:08:00Z", + "cleanup_gate": { + "completed_at": "2026-11-03T20:07:48Z", + "mode": "evidence-recorded" + }, + "identities_removed": 1, + "identity": "t03-e2-synthetic-sender-20261103", + "lane": "audit-core-synthetic-sender", + "secret_values_observed": false + }, + "exercise_evidence": "rpf-wp-0015-t03-e2-20261103t2006z-founder-go-exercise.json", + "finished_at": "2026-11-03T20:08:00Z", + "identity": { + "expires_at": "2026-11-03T20:21:00Z", + "name": "t03-e2-synthetic-sender-20261103", + "source": "t03-e2-synthetic-20261103", + "tenant": "tenant:trial:t03-e2-synthetic-20261103" + }, + "outcome": "completed", + "procedure": "t02-attended-window", + "project": { + "approval_id": "rpf-wp-0015-t03-e2-20261103t2006z-founder-go", + "audit_core_pod_uid_after_projection": "230253ef-3554-4779-88a0-beba8394b639", + "audit_core_restarted": true, + "bearer_file": "/home/worsch/rpf-e2/bearer", + "bearer_file_mode": "0600", + "identity": { + "expires_at": "2026-11-03T20:21:00Z", + "name": "t03-e2-synthetic-sender-20261103", + "source": "t03-e2-synthetic-20261103", + "tenant": "tenant:trial:t03-e2-synthetic-20261103" + }, + "lane": "audit-core-synthetic-sender", + "next_step": "run the T02 exercise; its baseline must capture this pod UID", + "projected_at": "2026-11-03T20:07:41Z", + "secret_values_observed": false + }, + "secret_values_observed": false, + "started_at": "2026-11-03T20:07:24Z", + "steps": [ + "project", + "port-forward", + "exercise", + "evidence", + "cleanup" + ] +} diff --git a/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md b/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md index b708622..358d800 100644 --- a/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md +++ b/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md @@ -4,7 +4,7 @@ type: workplan title: "Coordinate audit-core temporary custody and recovery exercises" domain: financials repo: railiance-platform -status: active +status: finished flavor: residual owner: codex topic_slug: railiance @@ -176,11 +176,8 @@ live window after the Whitehat engagement cleanup. ```task id: RPF-WP-0015-T03 -status: wait -needs_human: true +status: done decision_id: 2fd5849c-240e-4d0a-bf07-5ebf8dfce3fd -blocked_on: message-from:railiance-infra -blocking_reason: "Single-node outage exercise needs operator access and a declared restart order coordinated with railiance-infra, railiance-cluster, audit-core and the OpenBao package owner." priority: high state_hub_task_id: "ba729d18-f053-539f-86ef-5cb8ad4cce45" ``` @@ -581,3 +578,38 @@ accepted→duplicate still holds: the only change is the chain-head selection, which is the same on a healthy chain. The `senders.json` registry is compatible (optional `emission_cadence`), and lease/readiness behaviour is unchanged. + +**T03 synthetic E2 completed 2026-11-03.** The founder ran window +`rpf-wp-0015-t03-e2-20261103t2006z-founder-go` (20:07:24–20:08:00Z) under +round-12 owner approvals. The hub shows `all_approved` for contract +`a5e2b55d`; receipts audit-core `f0def1dc`, rapp-postgres `fad65811`, +railiance-cluster `33ad480b`, railiance-infra `50121aef`, railiance-platform +`bd01bfa5`. It used the contained `aal2` login and `AUDIT_KUBECONFIG`. +- The first send was a fresh `accepted` (HTTP 202) and the replay was + `duplicate`, so the event was accepted exactly once. +- The pod UID and restart count did not change during the exercise. The + driver cleanup was clean, and the projected sender identity and bearer file + were removed. audit-core is back at 1/1. +- `verify-chain` afterwards: intact, 2454 events, no break. The head is the + E2 event, and `--against` the 2026-10-14 post-reboot attestation + (`c99426d8…`) matched. +No secret values were observed. +Evidence: `docs/evidence/2026-11-03-rpf-wp-0015-t03-e2/`. + +Three earlier attempts in this window stopped before any projection: +- a placeholder `--confirm`; +- a missing `0700` evidence directory, which the window must find already + created; +- a standing `OPENBAO_TOKEN` exported from the founder's shell profile, which + the contained login refuses. + +T03 is done, and RPF-WP-0015 is finished. + +Follow-ups, not part of this plan: +- The founder removes the standing `OPENBAO_TOKEN` from the shell profile + and revokes it. This is still open from 2026-10-14. +- The legacy hub alias for RAILIANCE-WP-0024 (`88c4ef7f`) still shows + T02/T03 as `wait`. That is RPF-WP-0036-T07 alias disposition. +- The window could create its evidence directory, or record an early + failure somewhere else. That needs a pinned-artifact change and a new + owner round.