coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-platform/docs/credential-lane-designs/application-backup-pair-custody-2026-10-08.md
codex 715b0064ce Preview unadmitted backup pair custody. 
The helper checks both draft archive CCRs and refuses a CAS write until the writer identity is admitted. No provider key is created.

Assistant: grok
Assistant-Session: 01a11cdb-f9fe-7011-947c-936e72007e54
2026-10-08 21:28:07 +02:00

1.6 KiB
Raw Blame History

Backup publisher pair custody — preview, 2026-10-08

RPF-WP-0053-T06. The node reader in scripts/application_backup_credentials.py can deliver an already stored pair. It cannot create one. Warden's paste-once desk writes one field per PUT and would drop the other half of AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY.

scripts/application_backup_pair_custody.py is the prepared front door for both draft records:

Application CCR KV path
coulomb-social CCR-2026-0036 platform/workloads/coulomb-social/backup-primary
email-connect CCR-2026-0037 platform/workloads/email-connect/backup-primary

Default command:

python3 scripts/application_backup_pair_custody.py --application email-connect

The preview reads the draft CCR and prints field names, CAS 0 and one intended write. writer_admitted is false. There is no stdin, provider call, OpenBao call, key generation, file write or timer change.

provision() is the future attended shape, covered by synthetic tests only:

  • writer token policies must be exactly backup-pair-writer, with no default policy and no workload-kv-read-*-backup-primary reader policy
  • TTL at most 5 minutes and at most 2 uses, then revoke
  • metadata absence is required; an existing version is not overwritten
  • one HTTP-style body carries cas: 0 and both fields
  • the receipt keeps version and request id, never the values

WRITER_ADMITTED stays false, so that function refuses before any transport call. No Scaleway IAM application or key was created. CCR-2026-0036 and CCR-2026-0037 stay draft. EMAIL-WP-0007-T03/T04 stay waiting on this admission.