From d8a05757277b6bdaf03c6e9b97610b236a2ec133 Mon Sep 17 00:00:00 2001 From: codex Date: Tue, 3 Nov 2026 08:38:39 +0100 Subject: [PATCH] Close RPF-WP-0070: owners accept the MAS evidence recovery terms with 30-day local pruning. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 4541@bnt-lap001 Assistant-Session: 2099b3aa-d7d9-49a9-ab4e-fa8b7d0e39e8 --- WORK-RECORDS.md | 4 +- .../RPF-WP-0070-mas-evidence-recovery.md | 37 +++++++++++++++++-- 2 files changed, 35 insertions(+), 6 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index f66b2da..18b042a 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -49,7 +49,7 @@ | workplan | RPF-WP-0067 | active | — | workplans/RPF-WP-0067-netkingdom-identity-receipt-and-metadata-answers.md | | workplan | RPF-WP-0068 | finished | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md | | workplan | RPF-WP-0069 | active | — | workplans/RPF-WP-0069-bounded-executor-lanes.md | -| workplan | RPF-WP-0070 | active | — | workplans/RPF-WP-0070-mas-evidence-recovery.md | +| workplan | RPF-WP-0070 | finished | — | workplans/RPF-WP-0070-mas-evidence-recovery.md | | task | RPF-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md | | task | RPF-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md | | task | RPF-WP-ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md | @@ -240,7 +240,7 @@ | task | RPF-WP-0070-T02 | done | — | workplans/RPF-WP-0070-mas-evidence-recovery.md | | task | RPF-WP-0070-T03 | done | — | workplans/RPF-WP-0070-mas-evidence-recovery.md | | task | RPF-WP-0070-T04 | done | — | workplans/RPF-WP-0070-mas-evidence-recovery.md | -| task | RPF-WP-0070-T05 | todo | — | workplans/RPF-WP-0070-mas-evidence-recovery.md | +| task | RPF-WP-0070-T05 | done | — | workplans/RPF-WP-0070-mas-evidence-recovery.md | | intake | RPF-IN-0001 | closed | — | intakes/intakes.md | | intake | RPF-IN-0002 | open | — | intakes/intakes.md | | intake | RPF-IN-0003 | open | — | intakes/intakes.md | diff --git a/workplans/RPF-WP-0070-mas-evidence-recovery.md b/workplans/RPF-WP-0070-mas-evidence-recovery.md index efedd61..717372c 100644 --- a/workplans/RPF-WP-0070-mas-evidence-recovery.md +++ b/workplans/RPF-WP-0070-mas-evidence-recovery.md @@ -4,7 +4,7 @@ type: workplan title: "Recover the MAS evidence volume the way the email-connect ledger is recovered" domain: financials repo: railiance-platform -status: active +status: finished owner: codex topic_slug: coulomb-social created: "2026-11-01" @@ -25,7 +25,7 @@ owned by RPF-WP-0053-T05. The MAS evidence volume is still only the node-local PVC `mas-evidence` in namespace `mas`: `events.jsonl`, `tickets.sqlite3`, and the outbox database. Give that volume the same kind of recovery. RPF-WP-0053-T05 accepted that path on 2026-11-02. This workplan -is in progress. A local quiesced capture and rehearsal are recorded. +is finished (2026-11-03). A local quiesced capture and rehearsal are recorded. The workload pair is written (T01) and delivered (T02). The first offsite copy is verified, with daily timers enabled (T03). @@ -320,11 +320,12 @@ T04 is done. Receipt: `docs/evidence/mas-evidence-offsite-rehearsal-2026-11-03.j ```task id: RPF-WP-0070-T05 -status: todo +status: done priority: medium needs_human: true depends_on: [RPF-WP-0070-T04] -intervention_note: "Founder: escrow the MAS age identity; mas-owner and platform-owner accept or amend RPO 24h, stale 26h, RTO 60min and retention." +intervention_note: "Done 2026-11-03: identity escrowed at platform/recovery/mas/age-identity v1; founder accepted RPO 24h, stale 26h, RTO 60min, 30-day provider and local retention (decision da8bf998)." +decision_id: da8bf998-735b-40dc-b83c-3e71f5dec81f state_hub_task_id: "039efcd5-9340-5cec-8c94-fa7359251c99" ``` @@ -333,3 +334,31 @@ must not hold the identity. The mas-owner and platform-owner accept or amend the provisional RPO 24h, stale 26h and RTO 60min, and the local and provider retention against the 30-day lifecycle. Close the workplan after that. + +2026-11-03: the founder accepted, as mas-owner and platform-owner, RPO 24h, +stale after 26h, RTO 60 min and 30-day provider retention. They amended +local retention: the node prunes run directories after 30 days. This is +decision `da8bf998-735b-40dc-b83c-3e71f5dec81f`. `prune_local` runs only +after a verified upload. It never removes the current run, symlinks or +undated entries, and never deletes anything at the provider. It is +installed on railiance01 (`efb17b4`, SHA256 `daad2766…e4d6`); the preview +and the freshness check passed. T05 is done and the workplan is finished. + +## Closing record + +- Custody: a separately minted workload key at + `platform/workloads/mas/backup-primary` v1. The supplier key was never + copied. It was delivered to `/etc/mas-backup/primary.env` through the + admitted reader. The age identity is at + `platform/recovery/mas/age-identity` v1, and the node cannot read it. +- Operation: a daily stop-and-continue capture at 04:15 UTC, an age seal, + an immutable upload with a version-pinned readback, an hourly freshness + check, and 30-day local pruning. +- Recovery: proven from the offsite copy with independent credentials and + the custody-held identity (`docs/evidence/mas-evidence-offsite-rehearsal-2026-11-03.json`). +- Residuals, not blocking: a deliberately powered-off facility makes the + daily run fail. Failure surfaces only as a failed systemd unit, with no + alert transport yet. ops-warden has the catalog request for the identity + path (message `ecdf0611`). The two copies sealed to the unregistered + `age17sxu…` identity are unreadable and expire under the lifecycle. The + live bucket lifecycle on the MAS prefix was not re-read in this session.