Record the MAS workload pair and close RPF-WP-0070-T01.
The attended gate minted a second key on the MAS application, proved the prefix (HTTP 200) and three AccessDenied boundaries, and wrote the pair CAS=0 at version 1. The supplier key was not copied. Delivery admission stays false. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 4541@bnt-lap001 Assistant-Session: 2099b3aa-d7d9-49a9-ab4e-fa8b7d0e39e8
This commit is contained in:
codex
parent
28d5d1875c
commit
c02c3977f9
4 changed files with 99 additions and 5 deletions
|
|
@ -236,7 +236,7 @@
|
|||
| task | RPF-WP-0069-T07 | todo | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
|
||||
| task | RPF-WP-0069-T08 | done | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
|
||||
| task | RPF-WP-0069-T09 | wait | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
|
||||
| task | RPF-WP-0070-T01 | progress | — | workplans/RPF-WP-0070-mas-evidence-recovery.md |
|
||||
| task | RPF-WP-0070-T01 | done | — | workplans/RPF-WP-0070-mas-evidence-recovery.md |
|
||||
| task | RPF-WP-0070-T02 | todo | — | workplans/RPF-WP-0070-mas-evidence-recovery.md |
|
||||
| task | RPF-WP-0070-T03 | todo | — | workplans/RPF-WP-0070-mas-evidence-recovery.md |
|
||||
| task | RPF-WP-0070-T04 | todo | — | workplans/RPF-WP-0070-mas-evidence-recovery.md |
|
||||
|
|
|
|||
|
|
@ -58,6 +58,9 @@ and is not created here.
|
|||
inside the attended gate (`mas_evidence_publisher_gate.py
|
||||
--mint-workload`). It is never a copy of the supplier key. The gate
|
||||
deletes the minted key if the proof or the write fails.
|
||||
Done 2026-11-03: version 1 written CAS=0, with prefix HTTP 200 and three
|
||||
`AccessDenied` denials
|
||||
(`docs/evidence/mas-evidence-workload-pair-2026-11-03.json`).
|
||||
6. Record positive reader proof and negative denials, then set delivery
|
||||
admission. Export the admitted CCR and pin its SHA256 before creating
|
||||
`/etc/mas-backup/primary.env`.
|
||||
|
|
|
|||
79
docs/evidence/mas-evidence-workload-pair-2026-11-03.json
Normal file
79
docs/evidence/mas-evidence-workload-pair-2026-11-03.json
Normal file
|
|
@ -0,0 +1,79 @@
|
|||
{
|
||||
"boundary_proof": {
|
||||
"application_id": "25a4cbca-220e-40c0-9af5-6c7713000174",
|
||||
"denied": {
|
||||
"administration": true,
|
||||
"retained_delete": true,
|
||||
"sibling_prefix": true
|
||||
},
|
||||
"error_code": {
|
||||
"administration": "AccessDenied",
|
||||
"own_prefix": null,
|
||||
"retained_delete": "AccessDenied",
|
||||
"sibling_prefix": "AccessDenied"
|
||||
},
|
||||
"http_status": {
|
||||
"administration": 403,
|
||||
"own_prefix": 200,
|
||||
"retained_delete": 403,
|
||||
"sibling_prefix": 403
|
||||
},
|
||||
"own_prefix_allowed": true,
|
||||
"passed": true,
|
||||
"preferred_project": "reef-storage",
|
||||
"project_id_present": true,
|
||||
"project_scope_applied": true
|
||||
},
|
||||
"ccr": "CCR-2026-0062",
|
||||
"delivery_admission": false,
|
||||
"gate": {
|
||||
"status": "passed",
|
||||
"values_recorded": false
|
||||
},
|
||||
"gate_source_commit": "28d5d18",
|
||||
"mint": {
|
||||
"application_id": "25a4cbca-220e-40c0-9af5-6c7713000174",
|
||||
"keys_after": {
|
||||
"count": 2,
|
||||
"default_project_ids": [
|
||||
"e1a0dd0e-04b8-4ea9-8b30-d53f8c35c688"
|
||||
],
|
||||
"descriptions": [
|
||||
"Backup",
|
||||
"MAS evidence workload pair; RPF-WP-0070; node delivery"
|
||||
]
|
||||
},
|
||||
"keys_before": {
|
||||
"count": 1,
|
||||
"default_project_ids": [
|
||||
"e1a0dd0e-04b8-4ea9-8b30-d53f8c35c688"
|
||||
],
|
||||
"descriptions": [
|
||||
"Backup"
|
||||
]
|
||||
},
|
||||
"minted_at": "2026-11-03T04:45:02.906067Z",
|
||||
"pair": {
|
||||
"cas": 0,
|
||||
"current_version": 1,
|
||||
"field_names": [
|
||||
"AWS_ACCESS_KEY_ID",
|
||||
"AWS_SECRET_ACCESS_KEY"
|
||||
],
|
||||
"kv_version": 1,
|
||||
"path": "platform/workloads/mas/backup-primary",
|
||||
"values_recorded": false
|
||||
},
|
||||
"proof_attempts": 1,
|
||||
"status": "passed",
|
||||
"values_recorded": false
|
||||
},
|
||||
"node_file_present": false,
|
||||
"recorded_at": "2026-11-03T04:45:02Z",
|
||||
"runner": "attended: node scripts/mas_evidence_iam_session.mjs --mint-workload (warden openbao-platform-admin-login --exec)",
|
||||
"schema": "railiance.mas-evidence-workload-pair.v1",
|
||||
"supplier_key_copied": false,
|
||||
"task": "RPF-WP-0070-T01",
|
||||
"values_recorded": false,
|
||||
"workplan": "RPF-WP-0070"
|
||||
}
|
||||
|
|
@ -8,7 +8,7 @@ status: active
|
|||
owner: codex
|
||||
topic_slug: coulomb-social
|
||||
created: "2026-11-01"
|
||||
updated: "2026-11-02"
|
||||
updated: "2026-11-03"
|
||||
origin: residual
|
||||
origin_ref: MAS-WP-0007
|
||||
related:
|
||||
|
|
@ -26,7 +26,7 @@ node-local PVC `mas-evidence` in namespace `mas`: `events.jsonl`,
|
|||
`tickets.sqlite3`, and the outbox database. Give that volume the same kind
|
||||
of recovery. RPF-WP-0053-T05 accepted that path on 2026-11-02. This workplan
|
||||
is in progress. A local quiesced capture and rehearsal are recorded.
|
||||
Offsite publication has not started.
|
||||
The workload pair is written (T01). Offsite publication has not started.
|
||||
|
||||
The MAS facility can be powered off without touching platform mail. This
|
||||
backup must not scale it, roll its image, or delete the namespace. SMTP and
|
||||
|
|
@ -36,11 +36,11 @@ TEM credentials stay out of the backup worker.
|
|||
|
||||
```task
|
||||
id: RPF-WP-0070-T01
|
||||
status: progress
|
||||
status: done
|
||||
priority: medium
|
||||
needs_human: true
|
||||
depends_on: [RPF-WP-0053-T05]
|
||||
intervention_note: "Next: one attended run of `node scripts/mas_evidence_iam_session.mjs --mint-workload --playwright-module <playwright index.mjs>`: sign in to the Scaleway Console, press Enter, then complete the OpenBao platform-admin login. Done when ~/.local/state/railiance/receipts/mas-evidence-workload-mint.json says passed: a second key on the MAS application, its prefix HTTP 200 and three AccessDenied denials, and the CAS=0 pair. CCR-2026-0062 is applied. IAM application mas-evidence-backup-primary is 25a4cbca-220e-40c0-9af5-6c7713000174. The founder stored its API key at platform/suppliers/scaleway/mas-evidence-backup-primary, preferred project mail-address-semantics. The source bucket policy names that id under platform-pg/application-archives/mas/ with no object delete. The workload pair is still empty. Delivery admission stays false. Age-identity escrow remains separate."
|
||||
intervention_note: "Done 2026-11-03: workload pair written CAS=0 (version 1) from a separately minted key; prefix HTTP 200 and three AccessDenied denials recorded in docs/evidence/mas-evidence-workload-pair-2026-11-03.json."
|
||||
state_hub_task_id: "4f6484fb-8303-5dd5-94cb-b2622e1322c8"
|
||||
```
|
||||
|
||||
|
|
@ -124,6 +124,18 @@ only the environment. Fix: the gate checks the environment first, then an
|
|||
owner-only `$HOME/.vault-token`. A token-request failure now records a
|
||||
value-free reason. The next attended run is the same command.
|
||||
|
||||
2026-11-03 05:45 CET: the third attended run passed. The application went
|
||||
from one key (the founder's supplier key, description `Backup`) to two. The
|
||||
new key `MAS evidence workload pair; RPF-WP-0070; node delivery` has
|
||||
preferred project `reef-storage`. It passed on the first proof attempt:
|
||||
MAS prefix HTTP 200, and `AccessDenied` (403) for the sibling prefix, the
|
||||
retained delete and administration. The pair is at
|
||||
`platform/workloads/mas/backup-primary`, version 1, written CAS=0, with
|
||||
fields `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`. The supplier key
|
||||
was not read or copied. Delivery admission stays false, and
|
||||
`/etc/mas-backup/primary.env` does not exist. T01 is done. Receipt:
|
||||
`docs/evidence/mas-evidence-workload-pair-2026-11-03.json`.
|
||||
|
||||
## Admit delivery and place the node file
|
||||
|
||||
```task
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue