coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: retain successful custody and exact delivery login wait
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
codex 2026-09-11 10:07:47 +02:00
parent 44314cad37
commit df5980a873
3 changed files with 42 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/credential-lane-designs/factory-audit-senders-review.md
View file

@ -59,7 +59,9 @@ attended retry seeded both independent version-1 credentials and advanced the
registry with CAS 7→8, preserving existing senders and fields. Both CCRs are
**applied**; Warden exited 0 and confirmed revocation for that session. See the
[seed receipt](../evidence/2026-09-11-factory-audit-sender-seed.json). Delivery,
receiver reload and producer acceptance remain distinct checks.
receiver reload and producer acceptance remain distinct checks. The next attended
delivery login failed before handoff (exit 5); no delivery mutation occurred.
[Delivery return](../evidence/2026-09-11-factory-audit-delivery-login.json).
## Executable sequence

20
docs/evidence/2026-09-11-factory-audit-delivery-login.json Normal file
View file

@ -0,0 +1,20 @@
{
"schema": "platform.factory-audit-delivery-attempt.v1",
"observed_at": "2026-09-11T08:06:20.638931+00:00",
"status": "login_failed_before_delivery_handoff",
"wrapper_exit": 5,
"delivery_receipt_created": false,
"delivery_command_executed": false,
"credential_values_emitted": false,
"remote_session_revocation": "unconfirmed_for_this_failed_login",
"permanent_custody": "preserved_version_1_registry_version_8",
"next_step": "Fresh attended delivery after browser/login feedback; do not seed or rotate again",
"validation": {
"delivery_contract_tests": 7,
"custody_tests": 18,
"custody_tests_using_real_local_openbao": 11
},
"platform_delivery_source": "44314cad3704bda40683383f898b55b1f41491bc",
"factory_attempts": 0,
"paid_calls": 0
}

22
workplans/RPF-WP-0035-credential-lane-implementation.md
View file

@ -397,11 +397,11 @@ into this client-identity grant.
```task
id: RPF-WP-0035-T08
status: progress
status: wait
priority: high
assignee: railiance-platform
needs_human: false
intervention_note: null
needs_human: true
intervention_note: "Custody succeeded; fresh attended login for delivery failed before handoff. Need browser/MFA feedback and delivery login; do not reseed or reapprove CCR21/22."
state_hub_task_id: "0ef52c26-2669-5cd1-8149-b1f6fcdda6cb"
```
@ -509,3 +509,19 @@ login's remote session state. The old login wait is cleared; T08 is progress
for ESO delivery, exact native reader/namespace refusals, receiver reload and
producer acceptance. No token is reseeded or rotated on continuation.
[Seed receipt](../docs/evidence/2026-09-11-factory-audit-sender-seed.json).
### Delivery prepared; fresh login did not hand off — 2026-09-11
The delivery helper and custody receipt are committed at `44314ca` and exactly
projected on primary/railiance01. Seven delivery tests and 18 custody tests
(including 11 actual disposable OpenBao cases) pass. The fresh attended
delivery invocation exited 5 before command handoff; no native delivery
receipt exists, no ESO application or receiver restart ran. The receiver
remains 1/1 Ready on c82e0442de0f. Warden could not confirm revocation for this
failed login; that is separate from the successful seed session. T08 now waits
for this delivery identity act. Neither CCR review nor first provision reopens.
[Delivery return](../docs/evidence/2026-09-11-factory-audit-delivery-login.json).
Use the reviewed delivery command with a new receipt after login feedback.
Actual producer ingestion/duplicate/refusal and bearer revocation acceptance
remain open under AUDIT-WP-0009-T09/T11.