coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Correct WP-0024 lease selection contract
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa
This commit is contained in:
codex 2026-08-22 14:46:12 +02:00
parent 0d9cebedea
commit defb2a556d
3 changed files with 14 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/audit-core-database-lease-recovery.md
View file

@ -11,7 +11,7 @@ pod. It does not authorize a live revocation.
| Boundary | Exact scope | Responsible owner |
| --- | --- | --- |
| Consumer | Deployment `audit-core/audit-core`; Secret `audit-core/audit-core-database`; ExternalSecret `audit-core/audit-core-database` | `audit-core` |
| Lease | `database/creds/audit-core-runtime`; only the lease matching the current mounted username | `railiance-platform` custody operator |
| Lease | `database/creds/audit-core-runtime`; exactly one live handle whose issue time coheres with the current ExternalSecret refresh | `railiance-platform` custody operator |
| Database | CNPG `databases/platform-pg`, database `audit_core`, runtime group `audit_core_app` | `rapp-postgres` |
| Load | One separately approved synthetic sender/tenant contract; no production event or identity | `audit-core` + load owner |
| Coordination and evidence | `RAILIANCE-WP-0024-T02` | `railiance-platform` |

2
interfaces/RAILIANCE-WP-0024-owner-reviews.json
View file

@ -93,7 +93,7 @@
},
"artifact_sha256": {
"docs/audit-core-database-lease-approval.example.json": "360d49d0bea7ca376405974403036bff080533728f133d237f30f4ee3bb943e0",
"docs/audit-core-database-lease-recovery.md": "921b701efa14b1d59434d175f9f2df57e4e6f462ab4fbdf06d6d17c15a02fb0a",
"docs/audit-core-database-lease-recovery.md": "5aa8f2723d7216d775990e0b2cd770290284b62d185526a9dffe7d6a4f925d95",
"docs/openbao-reboot-snapshot-receipt.example.json": "b95903a3e1aacb607eecc3f0440f08e62480d09da47bd7ab96c3eb8814f2eaee",
"docs/railiance01-coordinated-reboot.md": "9969c2f498587710154e8d9a650fb8a13159e9e7b99918291dbdf577b131b7e7",
"scripts/audit-core-database-lease-recovery.py": "c87fb026c527fc17116067c5742d324340707ce4aecf440d0d4e618db9b872a1",

12
workplans/RAILIANCE-WP-0024-audit-core-custody-and-recovery-coordination.md
View file

@ -126,6 +126,9 @@ therefore aborts unless the exact runtime prefix has one live handle whose
issue time coheres with the ExternalSecret refresh. A live read-only check
observed exactly one handle, 0.073 seconds of issue/refresh skew, and no secret
values. It was not revoked.
The procedure's responsibility table now uses the same metadata-only selection
rule; it no longer claims lease metadata exposes or matches a mounted database
username.
## T03 — Define the coordinated railiance01 reboot exercise
@ -168,6 +171,15 @@ pending example intentionally fails. Creating the secret-bearing snapshot and
its off-host copy remains an attended platform-custody action near the future
reboot window; no snapshot was created in this implementation step.
**Prior-evidence audit (2026-08-22):** rapp-postgres evidence from the
2026-08-16 reboot proves the same PVC returned without re-bootstrap, original
audit triples and the isolation fixture survived, platform-pg recovered, and
audit-core readiness lagged by roughly 40 seconds. It remains a baseline, not
T03 completion: that reboot was not driven by continuous synthetic accepts and
did not measure the complete post-unseal ESO, audit-chain, and accepted-event
recovery path required here. T03 therefore still needs one deliberate run, but
does not need to rediscover the expected boot order.
## T04 — Route the contracts and approval gates
```task