From c8d45d585fe91f6a23d300b6255f7a3b1d2efab6 Mon Sep 17 00:00:00 2001 From: codex Date: Wed, 14 Oct 2026 18:18:31 +0200 Subject: [PATCH] RPF-WP-0015-T02: record aborted attended window (two live lease handles), clean cleanup Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 680842@bnt-lap001 Assistant-Session: 54eb9e8e-7d6b-4f0c-b7a6-a6db62075883 --- .../approval.json | 35 +++++++++++++ .../window-summary.json | 51 +++++++++++++++++++ ...-core-custody-and-recovery-coordination.md | 14 +++++ 3 files changed, 100 insertions(+) create mode 100644 docs/evidence/2026-10-14-rpf-wp-0015-t02-window/approval.json create mode 100644 docs/evidence/2026-10-14-rpf-wp-0015-t02-window/window-summary.json diff --git a/docs/evidence/2026-10-14-rpf-wp-0015-t02-window/approval.json b/docs/evidence/2026-10-14-rpf-wp-0015-t02-window/approval.json new file mode 100644 index 0000000..d938635 --- /dev/null +++ b/docs/evidence/2026-10-14-rpf-wp-0015-t02-window/approval.json @@ -0,0 +1,35 @@ +{ + "procedure": "audit-core-database-lease-recovery", + "task_id": "RAILIANCE-WP-0024-T02", + "status": "approved", + "approval_id": "rpf-wp-0015-t02-20261014t1615z-founder-go", + "window": { + "start": "2026-10-14T16:15:00Z", + "end": "2026-10-14T16:30:00Z" + }, + "abort_operator": "founder (platform-root), attended", + "owners": { + "audit-core": { + "acknowledged": true, + "message_id": "5fe769a7-d35b-4e37-a671-673d13cf8948" + }, + "rapp-postgres": { + "acknowledged": true, + "message_id": "f13ec9dd-f525-4ed0-b291-be5dc26bed0e" + }, + "railiance-platform": { + "acknowledged": true, + "message_id": "18e59587-2b78-478e-88e6-7487b8933743" + } + }, + "synthetic_load": { + "contract_id": "RAILIANCE-WP-0024-T02-SYNTHETIC-01", + "driver_revision": "sha256:941ba251f638869626b06e9cbf430c70188c0bdf4715e3eff9c7610366f68662" + }, + "synthetic_sender": { + "identity": "t02-synthetic-sender-20261014", + "source": "t02-synthetic-20261014", + "tenant": "tenant:trial:t02-synthetic-20261014", + "expires_at": "2026-10-14T16:30:00Z" + } +} \ No newline at end of file diff --git a/docs/evidence/2026-10-14-rpf-wp-0015-t02-window/window-summary.json b/docs/evidence/2026-10-14-rpf-wp-0015-t02-window/window-summary.json new file mode 100644 index 0000000..8aad474 --- /dev/null +++ b/docs/evidence/2026-10-14-rpf-wp-0015-t02-window/window-summary.json @@ -0,0 +1,51 @@ +{ + "abort_reason": "T02 exercise failed (exit 1): database lease recovery failed: exact runtime prefix must contain one live handle (observed 2)", + "approval_id": "rpf-wp-0015-t02-20261014t1615z-founder-go", + "cleanup": { + "approval_id": "rpf-wp-0015-t02-20261014t1615z-founder-go", + "audit_core_ready": "1/1", + "audit_core_restarted": true, + "bearer_file_removed": true, + "cleanup_completed_at": "2026-10-14T16:17:41Z", + "cleanup_gate": { + "mode": "abort", + "reason": "t02 window aborted: T02 exercise failed (exit 1): database lease recovery failed: exact runtime prefix must contain one live handle (observed 2)" + }, + "identities_removed": 1, + "identity": "t02-synthetic-sender-20261014", + "lane": "audit-core-synthetic-sender", + "secret_values_observed": false + }, + "finished_at": "2026-10-14T16:17:41Z", + "identity": { + "expires_at": "2026-10-14T16:30:00Z", + "name": "t02-synthetic-sender-20261014", + "source": "t02-synthetic-20261014", + "tenant": "tenant:trial:t02-synthetic-20261014" + }, + "outcome": "aborted", + "procedure": "t02-attended-window", + "project": { + "approval_id": "rpf-wp-0015-t02-20261014t1615z-founder-go", + "audit_core_pod_uid_after_projection": "2f788f76-0e99-412f-b9af-d9e899a3c61a", + "audit_core_restarted": true, + "bearer_file_mode": "0600", + "identity": { + "expires_at": "2026-10-14T16:30:00Z", + "name": "t02-synthetic-sender-20261014", + "source": "t02-synthetic-20261014", + "tenant": "tenant:trial:t02-synthetic-20261014" + }, + "lane": "audit-core-synthetic-sender", + "next_step": "run the T02 exercise; its baseline must capture this pod UID", + "projected_at": "2026-10-14T16:17:02Z", + "secret_values_observed": false + }, + "secret_values_observed": false, + "started_at": "2026-10-14T16:16:34Z", + "steps": [ + "project", + "port-forward", + "abort-cleanup" + ] +} \ No newline at end of file diff --git a/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md b/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md index 711668c..fbb9edb 100644 --- a/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md +++ b/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md @@ -434,3 +434,17 @@ catch-all in the window `main()` so it can never print; do not echo child stderr `--abort-reason`; distinct remote port; runbook: check `abort_cleanup_failed` after any non-zero exit; failing-pod diff by owning controller; namespaced SecretStores in the ESO inventory. + +T02 attended window 2026-10-14 (approval rpf-wp-0015-t02-20261014t1615z-founder-go, +founder GO in session, window 16:15–16:30Z, founder as abort operator): one contained +login; projection and port-forward succeeded (audit-core restart #1), then the exercise +refused before revocation because `database/creds/audit-core-runtime` had two live +handles (ESO refresh 15m vs lease TTL 15m/max 1h overlap). Abort cleanup removed the +one synthetic identity, restarted audit-core (1/1) and shredded the bearer; no lease was +revoked and no secret value observed. Two earlier same-day launches failed closed before +any action (a standing `OPENBAO_TOKEN` exported in the operator's shell profile, then a +start before the window). Evidence: docs/evidence/2026-10-14-rpf-wp-0015-t02-window/. +Next: select the handle coherent with the Secret refresh instead of requiring exactly +one (owner re-review), then a new window. Follow-ups: ops-warden must also strip +OPENBAO_TOKEN for attended children; the standing shell-profile token should be revoked +and removed (founder).