railiance-platform/docs/evidence/2026-10-03-platform-root-custody-delivery.md

# Platform-root custody delivery evidence — 2026-10-03

Owner: railiance-platform. Tracks RPF-WP-0049 / NK-WP-0045-T05.
Bounded operator execution is verified; full delivery/recovery acceptance is
still pending. This is a non-secret evidence summary, not a real custody grant.

## Verified attended admission and publication

The founder executed the reviewed attended commands under continued approval.
Fresh success receipts were independently read and checked locally:

- /tmp/platform-root-admission-20261003T181954Z-333977.json
- /tmp/platform-root-publish-20261003T181954Z-333977.json

Admission confirms namespace/SA user-engine/user-engine, role
user-engine-root-custody-reader on auth/kubernetes, audience openbao, active
OpenBao audit and per-key required CAS. Publication confirms whole-document
write and owner readback. Initial fact: nk-custody:platform-root, revision 1,
KV version 1, entries empty. It grants nobody root authority.

Content SHA256:
33a2ae086385028db1b654aa5646b7a98bcde1c5878c804e19315dadc3f87248.
Publisher receipt time: 2026-10-03T18:21:14.370633+00:00.
Publisher baseline mode: 0600. Immutable history receipt equals the baseline,
and both equal the publication receipt digest and current initial candidate.
The old oidc-role-platform-admin.20260828T112740.json is role configuration,
not a success receipt for these October 3 acts.

## Independent retained history and recovery requirement

Operator-owned publisher state is on the workstation:
/home/worsch/.local/state/net-kingdom-root-custody/baseline.json and history/.
It is already off-host and independent of OpenBao on railiance01 and OpenBao
snapshots. No additional runtime/service is required merely to duplicate it.
The human operator owns retaining and backing up this receipt holder. Preserve
baseline.json, history/ and any pending publication journal together; never
reset state to an older OpenBao snapshot or discard an ambiguous journal.
Retain publication history until an explicitly reviewed custody record
retirement; root custody entries are never removed to simulate revocation.

Remaining evidence, not a fresh generic approval:

1. Record the workstation receipt-holder backup destination/procedure and
   verify a copy/restore/readback of this non-secret state, retaining the exact
   latest revision and digest. A local process fsync proves durability, not
   workstation disaster recovery.
2. Run the attended restore-check against the current owner source with the
   retained baseline and fresh receipt. This proves today's independent state
   agrees with current owner readback; it is not proof of a snapshot exercise.
3. In the platform/OpenBao owner's isolated recovery procedure, restore a
   snapshot and compare with the independently retained latest history. Prove
   that an older/missing/mutated record is refused and source authority is not
   reopened until retained latest content is restored and readback matches.
   Do not roll back live OpenBao merely to manufacture a test receipt.
4. Complete reader identity success and wrong-identity/anonymous/list/sibling/
   write denial, outage/fail-closed and audit correlation receipts. The publisher
   success receipt and configured reader policy do not alone prove workload
   admission or workload denial behavior. Consumer rollout follows its owner.

No genuine root ceremony is known. A future real grant requires signed human
ceremony evidence and exact issuer/subject; IAM projections and a planned
custody roster cannot ground it. Algorithm grant/revoke/supersession testing
uses synthetic fixtures; no real grant is created or revoked for acceptance.

Security orientation reloaded: Emergent 0.2.4 root, verified-files,
orientation-only; digest
025aab4f38246219c924bc94954e70ea0e6e7f72bcaf8d4344cd599602d345c3.
No secret values, privileged role dump or token material are copied here.

## Completed isolated recovery proof

Actual disposable local Raft server: OpenBao v2.5.5. Evidence:
[isolated recovery receipt](2026-10-03-root-custody-isolated-raft-recovery.json).
The exact owner publisher and baseline guard ran against an ephemeral loopback
server and synthetic local credentials, with the real retained non-secret
empty document. Two native Raft snapshots were created. Restoring the snapshot
from before publication caused the missing source to be refused; restoring the
snapshot containing revision 1/KV1 matched the independent retained digest.
Workstation baseline/history copy and scratch restoration matched exactly,
including 0600 baseline permissions. Server, credentials and snapshots were
confined to temporary storage and cleaned up. Production was not accessed or
mutated and no production snapshot was read.

This completes the bounded algorithm/native-backend isolated rollback/restore
exercise and local receipt-holder copy/restore proof. It does not claim a
production snapshot recovery or actual workstation backup-provider readback.
The current live retained-baseline restore-check, provider retention coverage
and workload/audit receipts remain separately tracked.

## Established retention path and attended finish

No configured workstation backup job covering the new publisher directory was
found in the inspected owner backup contracts/local backup configuration. A
validated non-secret recovery copy now lives in root-custody-history/ in this
owner repository. This enters the established Forgejo Git source backup scope;
new provider archive coverage is not implied until an actual archive includes
the commit. Source retrieval/readback is tracked separately from provider proof.

The one-command attended finish packet is in openbao/root-grant/README.md.
It performs current owner baseline readback and an age-encrypted history
upload/download/decrypt equality proof through the current governed OpenBao
Nextcloud backup account/lane only. It uses existing forgejo/ storage, no new
credential, no policy widening and no local historical rclone grant. A local
historical configuration's credential-bearing coordinates may have appeared in
backup-discovery tool output. No values are retained here. The finish helper
compares that grant with the current lane in memory; if current, it reports a
safe incident status and stops before upload for coordinated existing owner
credential cutover, preserving consumers. No uninformed rotation is performed.

## Completed live reader/audit and remote source retention proof

Consumer owner confirmed fresh authenticated revision-1 empty read/no grant,
actual pod restart retains baseline, wrong audience JWT denied, metadata LIST,
sibling GET and exact-path POST all denied403. Injected transport failure and
same-revision mutation preserve the trusted baseline and return no grant. These
failure tests do not claim a disruptive live OpenBao outage. Receipt:
2026-10-03-root-custody-reader-acceptance.json.

Safe bounded-tail lookup of the current audit PVC correlated exact consumer
read and login request IDs with both request and response events, no errors.
No raw audit records were emitted. Receipt:
2026-10-03-root-custody-audit-correlation.json. Whole-file grep was abandoned
because the audit file is about6.68GB; the successful query bounded its tail to
64MiB. This proves event correlation, not an audit archival/rotation policy.

A fresh remote Forgejo clone retrieved source commit
`a252447058105eed0931d34f1a906f39ce7c2e5e` and both independent publisher
baseline/history recovery files matched byte-for-byte. The clone was removed.
Receipt: 2026-10-03-root-custody-source-backup-readback.json. Source retrieval
proves remote retention independent of workstation state, but does not prove
that a new Nextcloud/Scaleway Forgejo archive generation contains that commit.

The only remaining bounded execution for RPF-WP-0049-T05 is the attended finish
helper: current authenticated owner baseline check plus encrypted retained
history upload/download/decryption through the current governed provider lane.
This directly establishes the small custody-history provider recovery artifact
without generating a multi-gigabyte full Forgejo dump. Existing go-forward
approval applies; operator OIDC/MFA remains execution-only. Fresh receipt must
show success. If the exposed historical local grant matches the current lane,
coordinated existing credential recovery is required before provider proof;
there is no automatic credential rotation or root authority change.

## Failed attended finish and diagnostic correction

Attempt185421Z333977 completed and revoked its operator login, but the finish
child failed without a receipt. Owner audit proves custody, backup-lane and
operator-backup reads all succeeded. The exact external-provider failure is
unknown because the previous catch-all discarded diagnostics; no IAM widening
or speculative protocol/status relaxation is warranted. Safe audit receipt:
2026-10-03-root-custody-failed-finish-audit.json.

The corrected silent wrapper runs a stdlib bootstrap that reserves a fresh
private receipt before importing helper dependencies. Full main emits fixed
allowlisted stage/error codes and safe HTTP/artifact metadata on failure,
including partial owner-baseline success and any attempted created artifact.
It never emits exception text, raw response, credential or provider coordinates.
Private clean-environment full-main tests use the actual attended envelope
predicate, real validator/system age and fake owner/provider boundaries; they
cover success, denied owner read, quota, missing binary, upload, download,
ciphertext/decrypt failure, startup imports, stale receipt and incident stop.
A new fresh-path attended attempt can now identify the actual provider boundary
without guessing or repeating opaque failure. Actual provider acceptance remains
pending; simulated successful provider tests do not establish it.