coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0015: record all-owner approval and founder window checklist
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 680842@bnt-lap001
Assistant-Session: 54eb9e8e-7d6b-4f0c-b7a6-a6db62075883
This commit is contained in:
codex 2026-10-14 12:56:52 +02:00
parent 8cfbf6410d
commit badb91c71a
2 changed files with 54 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

48
docs/rpf-wp-0015-attended-windows.md Normal file
View file

@ -0,0 +1,48 @@
# RPF-WP-0015 attended windows — founder checklist
Procedures approved by all owners on 2026-10-14 against review contract
`1c08ba7ae064eddde89cdc15d36f0e1c1c372e1ba5c00f09f4b665409aa337a7`
(railiance-platform `8cfbf64`). Approval covers the procedures only. Each window
below still needs its own explicit founder GO; D5 (`2fd5849c`) authorizes the
exercise class, not a specific window. The runbooks are authoritative; this page
only orders the human steps.
## Before either window
| # | Item | Owner | State 2026-10-14 |
|---|------|-------|------------------|
| 1 | Push ops-warden `6e14300` (login output fail-closed fix, accepted in `reviews/RPF-WP-0017-ops-warden-reacceptance-2026-10-14.json`), then `uv tool install --reinstall /home/worsch/ops-warden` from that clean checkout | founder go, then agent | committed locally, not pushed |
| 2 | Value-safe retrospective of WARDEN-WP-0036-T02 (2026-09-01 live op ran while the relaxed check was in source) | ops-warden / railiance-platform | open |
## T02 — database lease recovery (≤15 min window)
Runbook: `docs/audit-core-database-lease-recovery.md`.
1. Pick a window that is not within 20 min of 03:17 UTC (attest-chain CronJob).
2. Fill an approval receipt from `docs/audit-core-database-lease-approval.example.json`:
approval id, window start/end, named abort operator, owner acknowledgement
message ids (audit-core, rapp-postgres, railiance-platform), synthetic load
`RAILIANCE-WP-0024-T02-SYNTHETIC-01` with driver revision
`sha256:941ba251…` (audit-core `8c8bcf4`), and the `synthetic_sender` block.
3. Announce two short audit-core restart gaps (projection and cleanup).
4. In the window: attended ops-warden login → `make audit-synthetic-sender-project`
→ port-forward audit-core → `make audit-database-lease-recovery-exercise` →
record evidence → `make audit-synthetic-sender-cleanup`.
5. Abort: stop load, `cleanup --abort-reason`, never restart the pod by hand.
## T03 — coordinated railiance01 reboot
Runbook: `docs/railiance01-coordinated-reboot.md`. Additional gates before the window:
| # | Item | Owner |
|---|------|-------|
| 1 | Prove provider console / rescue / hard-reset access and file a `RAIL01-CONSOLE-<ts>` receipt (railiance-infra `docs/railiance01-console-access.md`, RAIL-HO-WP-0011-T09). Today no out-of-band console is established. | founder |
| 2 | Remove the stuck PVC `platform-pg-drill/platform-pg-drill-1` (pvc-protection finalizer) in a separately approved attended step, or keep it explicitly listed | rapp-postgres + founder go |
| 3 | Fresh backup or written waiver for `state-hub-db`, `user-engine-pg`, `net-kingdom-pg`, `target-revenue-pg` (no CNPG backup configured) | each DB owner |
| 4 | New scenario id and fresh human decision (08-23 decisions/scenario are consumed) | founder |
| 5 | Fresh encrypted off-host OpenBao snapshot receipt (≤24 h) | platform custody, attended |
| 6 | 2-of-3 Shamir unseal holders present; named abort operator; railiance-infra abort-owner ack | founder |
| 7 | Pre-reboot preflight run to capture the evidence file (boot id, failing-pod baseline, CNPG identities) | agent |
Stop immediately, self-revoke and never retry on any unexpected credential output
from the attended login.

6
workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md
View file

@ -416,3 +416,9 @@ Remaining before any window: second-round owner approvals; console access proven
net-kingdom-pg, target-revenue-pg; stuck PVC platform-pg-drill/platform-pg-drill-1;
ops-warden 6e14300 published and installed; then window ids, abort operator, snapshot
receipt and 2-of-3 unseal quorum.
Round 3 (2026-10-14): all five owners approved contract 1c08ba7a (railiance-platform
8cfbf64): audit-core e7c36b17, rapp-postgres b7c4939a, railiance-cluster c9435491,
railiance-infra 28d6a25a, railiance-platform 61b97f96. Procedure approval only.
Founder checklist and remaining window gates: docs/rpf-wp-0015-attended-windows.md.
T02 and T03 stay `wait` until their attended windows run.