diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 48c66ad..876c325 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -236,7 +236,7 @@ | task | RPF-WP-0069-T07 | todo | — | workplans/RPF-WP-0069-bounded-executor-lanes.md | | task | RPF-WP-0069-T08 | done | — | workplans/RPF-WP-0069-bounded-executor-lanes.md | | task | RPF-WP-0069-T09 | wait | — | workplans/RPF-WP-0069-bounded-executor-lanes.md | -| task | RPF-WP-0070-T01 | progress | — | workplans/RPF-WP-0070-mas-evidence-recovery.md | +| task | RPF-WP-0070-T01 | done | — | workplans/RPF-WP-0070-mas-evidence-recovery.md | | task | RPF-WP-0070-T02 | todo | — | workplans/RPF-WP-0070-mas-evidence-recovery.md | | task | RPF-WP-0070-T03 | todo | — | workplans/RPF-WP-0070-mas-evidence-recovery.md | | task | RPF-WP-0070-T04 | todo | — | workplans/RPF-WP-0070-mas-evidence-recovery.md | diff --git a/docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md b/docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md index ceb5258..6a978ec 100644 --- a/docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md +++ b/docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md @@ -58,6 +58,9 @@ and is not created here. inside the attended gate (`mas_evidence_publisher_gate.py --mint-workload`). It is never a copy of the supplier key. The gate deletes the minted key if the proof or the write fails. + Done 2026-11-03: version 1 written CAS=0, with prefix HTTP 200 and three + `AccessDenied` denials + (`docs/evidence/mas-evidence-workload-pair-2026-11-03.json`). 6. Record positive reader proof and negative denials, then set delivery admission. Export the admitted CCR and pin its SHA256 before creating `/etc/mas-backup/primary.env`. diff --git a/docs/evidence/mas-evidence-workload-pair-2026-11-03.json b/docs/evidence/mas-evidence-workload-pair-2026-11-03.json new file mode 100644 index 0000000..57920ad --- /dev/null +++ b/docs/evidence/mas-evidence-workload-pair-2026-11-03.json @@ -0,0 +1,79 @@ +{ + "boundary_proof": { + "application_id": "25a4cbca-220e-40c0-9af5-6c7713000174", + "denied": { + "administration": true, + "retained_delete": true, + "sibling_prefix": true + }, + "error_code": { + "administration": "AccessDenied", + "own_prefix": null, + "retained_delete": "AccessDenied", + "sibling_prefix": "AccessDenied" + }, + "http_status": { + "administration": 403, + "own_prefix": 200, + "retained_delete": 403, + "sibling_prefix": 403 + }, + "own_prefix_allowed": true, + "passed": true, + "preferred_project": "reef-storage", + "project_id_present": true, + "project_scope_applied": true + }, + "ccr": "CCR-2026-0062", + "delivery_admission": false, + "gate": { + "status": "passed", + "values_recorded": false + }, + "gate_source_commit": "28d5d18", + "mint": { + "application_id": "25a4cbca-220e-40c0-9af5-6c7713000174", + "keys_after": { + "count": 2, + "default_project_ids": [ + "e1a0dd0e-04b8-4ea9-8b30-d53f8c35c688" + ], + "descriptions": [ + "Backup", + "MAS evidence workload pair; RPF-WP-0070; node delivery" + ] + }, + "keys_before": { + "count": 1, + "default_project_ids": [ + "e1a0dd0e-04b8-4ea9-8b30-d53f8c35c688" + ], + "descriptions": [ + "Backup" + ] + }, + "minted_at": "2026-11-03T04:45:02.906067Z", + "pair": { + "cas": 0, + "current_version": 1, + "field_names": [ + "AWS_ACCESS_KEY_ID", + "AWS_SECRET_ACCESS_KEY" + ], + "kv_version": 1, + "path": "platform/workloads/mas/backup-primary", + "values_recorded": false + }, + "proof_attempts": 1, + "status": "passed", + "values_recorded": false + }, + "node_file_present": false, + "recorded_at": "2026-11-03T04:45:02Z", + "runner": "attended: node scripts/mas_evidence_iam_session.mjs --mint-workload (warden openbao-platform-admin-login --exec)", + "schema": "railiance.mas-evidence-workload-pair.v1", + "supplier_key_copied": false, + "task": "RPF-WP-0070-T01", + "values_recorded": false, + "workplan": "RPF-WP-0070" +} diff --git a/workplans/RPF-WP-0070-mas-evidence-recovery.md b/workplans/RPF-WP-0070-mas-evidence-recovery.md index 9d7cfa2..bbc7b2a 100644 --- a/workplans/RPF-WP-0070-mas-evidence-recovery.md +++ b/workplans/RPF-WP-0070-mas-evidence-recovery.md @@ -8,7 +8,7 @@ status: active owner: codex topic_slug: coulomb-social created: "2026-11-01" -updated: "2026-11-02" +updated: "2026-11-03" origin: residual origin_ref: MAS-WP-0007 related: @@ -26,7 +26,7 @@ node-local PVC `mas-evidence` in namespace `mas`: `events.jsonl`, `tickets.sqlite3`, and the outbox database. Give that volume the same kind of recovery. RPF-WP-0053-T05 accepted that path on 2026-11-02. This workplan is in progress. A local quiesced capture and rehearsal are recorded. -Offsite publication has not started. +The workload pair is written (T01). Offsite publication has not started. The MAS facility can be powered off without touching platform mail. This backup must not scale it, roll its image, or delete the namespace. SMTP and @@ -36,11 +36,11 @@ TEM credentials stay out of the backup worker. ```task id: RPF-WP-0070-T01 -status: progress +status: done priority: medium needs_human: true depends_on: [RPF-WP-0053-T05] -intervention_note: "Next: one attended run of `node scripts/mas_evidence_iam_session.mjs --mint-workload --playwright-module `: sign in to the Scaleway Console, press Enter, then complete the OpenBao platform-admin login. Done when ~/.local/state/railiance/receipts/mas-evidence-workload-mint.json says passed: a second key on the MAS application, its prefix HTTP 200 and three AccessDenied denials, and the CAS=0 pair. CCR-2026-0062 is applied. IAM application mas-evidence-backup-primary is 25a4cbca-220e-40c0-9af5-6c7713000174. The founder stored its API key at platform/suppliers/scaleway/mas-evidence-backup-primary, preferred project mail-address-semantics. The source bucket policy names that id under platform-pg/application-archives/mas/ with no object delete. The workload pair is still empty. Delivery admission stays false. Age-identity escrow remains separate." +intervention_note: "Done 2026-11-03: workload pair written CAS=0 (version 1) from a separately minted key; prefix HTTP 200 and three AccessDenied denials recorded in docs/evidence/mas-evidence-workload-pair-2026-11-03.json." state_hub_task_id: "4f6484fb-8303-5dd5-94cb-b2622e1322c8" ``` @@ -124,6 +124,18 @@ only the environment. Fix: the gate checks the environment first, then an owner-only `$HOME/.vault-token`. A token-request failure now records a value-free reason. The next attended run is the same command. +2026-11-03 05:45 CET: the third attended run passed. The application went +from one key (the founder's supplier key, description `Backup`) to two. The +new key `MAS evidence workload pair; RPF-WP-0070; node delivery` has +preferred project `reef-storage`. It passed on the first proof attempt: +MAS prefix HTTP 200, and `AccessDenied` (403) for the sibling prefix, the +retained delete and administration. The pair is at +`platform/workloads/mas/backup-primary`, version 1, written CAS=0, with +fields `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`. The supplier key +was not read or copied. Delivery admission stays false, and +`/etc/mas-backup/primary.env` does not exist. T01 is done. Receipt: +`docs/evidence/mas-evidence-workload-pair-2026-11-03.json`. + ## Admit delivery and place the node file ```task