coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0015-T02: record aborted attended window (two live lease handles), clean cleanup

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 680842@bnt-lap001
Assistant-Session: 54eb9e8e-7d6b-4f0c-b7a6-a6db62075883
This commit is contained in:
codex 2026-10-14 18:18:31 +02:00
parent b8a5b80e33
commit c8d45d585f
3 changed files with 100 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

35
docs/evidence/2026-10-14-rpf-wp-0015-t02-window/approval.json Normal file
View file

@ -0,0 +1,35 @@
{
"procedure": "audit-core-database-lease-recovery",
"task_id": "RAILIANCE-WP-0024-T02",
"status": "approved",
"approval_id": "rpf-wp-0015-t02-20261014t1615z-founder-go",
"window": {
"start": "2026-10-14T16:15:00Z",
"end": "2026-10-14T16:30:00Z"
},
"abort_operator": "founder (platform-root), attended",
"owners": {
"audit-core": {
"acknowledged": true,
"message_id": "5fe769a7-d35b-4e37-a671-673d13cf8948"
},
"rapp-postgres": {
"acknowledged": true,
"message_id": "f13ec9dd-f525-4ed0-b291-be5dc26bed0e"
},
"railiance-platform": {
"acknowledged": true,
"message_id": "18e59587-2b78-478e-88e6-7487b8933743"
}
},
"synthetic_load": {
"contract_id": "RAILIANCE-WP-0024-T02-SYNTHETIC-01",
"driver_revision": "sha256:941ba251f638869626b06e9cbf430c70188c0bdf4715e3eff9c7610366f68662"
},
"synthetic_sender": {
"identity": "t02-synthetic-sender-20261014",
"source": "t02-synthetic-20261014",
"tenant": "tenant:trial:t02-synthetic-20261014",
"expires_at": "2026-10-14T16:30:00Z"
}
}

51
docs/evidence/2026-10-14-rpf-wp-0015-t02-window/window-summary.json Normal file
View file

@ -0,0 +1,51 @@
{
"abort_reason": "T02 exercise failed (exit 1): database lease recovery failed: exact runtime prefix must contain one live handle (observed 2)",
"approval_id": "rpf-wp-0015-t02-20261014t1615z-founder-go",
"cleanup": {
"approval_id": "rpf-wp-0015-t02-20261014t1615z-founder-go",
"audit_core_ready": "1/1",
"audit_core_restarted": true,
"bearer_file_removed": true,
"cleanup_completed_at": "2026-10-14T16:17:41Z",
"cleanup_gate": {
"mode": "abort",
"reason": "t02 window aborted: T02 exercise failed (exit 1): database lease recovery failed: exact runtime prefix must contain one live handle (observed 2)"
},
"identities_removed": 1,
"identity": "t02-synthetic-sender-20261014",
"lane": "audit-core-synthetic-sender",
"secret_values_observed": false
},
"finished_at": "2026-10-14T16:17:41Z",
"identity": {
"expires_at": "2026-10-14T16:30:00Z",
"name": "t02-synthetic-sender-20261014",
"source": "t02-synthetic-20261014",
"tenant": "tenant:trial:t02-synthetic-20261014"
},
"outcome": "aborted",
"procedure": "t02-attended-window",
"project": {
"approval_id": "rpf-wp-0015-t02-20261014t1615z-founder-go",
"audit_core_pod_uid_after_projection": "2f788f76-0e99-412f-b9af-d9e899a3c61a",
"audit_core_restarted": true,
"bearer_file_mode": "0600",
"identity": {
"expires_at": "2026-10-14T16:30:00Z",
"name": "t02-synthetic-sender-20261014",
"source": "t02-synthetic-20261014",
"tenant": "tenant:trial:t02-synthetic-20261014"
},
"lane": "audit-core-synthetic-sender",
"next_step": "run the T02 exercise; its baseline must capture this pod UID",
"projected_at": "2026-10-14T16:17:02Z",
"secret_values_observed": false
},
"secret_values_observed": false,
"started_at": "2026-10-14T16:16:34Z",
"steps": [
"project",
"port-forward",
"abort-cleanup"
]
}

14
workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md
View file

@ -434,3 +434,17 @@ catch-all in the window `main()` so it can never print; do not echo child stderr
`--abort-reason`; distinct remote port; runbook: check `abort_cleanup_failed` after any
non-zero exit; failing-pod diff by owning controller; namespaced SecretStores in the ESO
inventory.
T02 attended window 2026-10-14 (approval rpf-wp-0015-t02-20261014t1615z-founder-go,
founder GO in session, window 16:15–16:30Z, founder as abort operator): one contained
login; projection and port-forward succeeded (audit-core restart #1), then the exercise
refused before revocation because `database/creds/audit-core-runtime` had two live
handles (ESO refresh 15m vs lease TTL 15m/max 1h overlap). Abort cleanup removed the
one synthetic identity, restarted audit-core (1/1) and shredded the bearer; no lease was
revoked and no secret value observed. Two earlier same-day launches failed closed before
any action (a standing `OPENBAO_TOKEN` exported in the operator's shell profile, then a
start before the window). Evidence: docs/evidence/2026-10-14-rpf-wp-0015-t02-window/.
Next: select the handle coherent with the Secret refresh instead of requiring exactly
one (owner re-review), then a new window. Follow-ups: ops-warden must also strip
OPENBAO_TOKEN for attended children; the standing shell-profile token should be revoked
and removed (founder).