railiance-platform/workplans/RPF-WP-0049-platform-root-custody-record-delivery.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related	state_hub_workstream_id
RPF-WP-0049	workplan	Deliver the approved OpenBao platform-root custody fact design	financials	railiance-platform	finished	codex	railiance-platform	2026-10-03	2026-10-03	NK-WP-0045 USER-WP-0037	7dc1b126-1ddd-550f-9e6a-1fc577d0f27b

Response to net-kingdom message bc0c620c. Founder approved on 2026-10-03: "Accept ADR-0017 and approve the proposed OpenBao delivery design." The selected delivery owner is railiance-platform, using the exact OpenBao KV v2 path and trusted record ID below. Subsequent founder go-forward and attended execution delivered the initial empty production source; no real custody grant is inferred. All producer delivery and independent recovery gates are complete. Contract: ../net-kingdom/docs/contracts/root-grant-read-contract_v0.1.md. Packet: approved producer design.

Prepare reviewed producer interface and exact-path drafts

id: RPF-WP-0049-T01
status: done
priority: high
state_hub_task_id: "6bacc6b4-6a0f-5382-9f17-1e20ebb1b246"

Prepared whole-document CAS payload builder with real NetKingdom schema and transition validation, strict trusted ID binding, sanitized exceptions and exact-path reader/separate attended writer policies. Offline tests cover bootstrap/current version, concurrent-write CAS binding, rollback, mutation, entry removal, wrong identity, secret diagnostics and invalid previous record. These are preparation artifacts, not an admitted or operational source.

Obtain exact real reader identity for the approved source

id: RPF-WP-0049-T02
status: done
priority: high
depends_on: [NK-WP-0045-T01, NK-WP-0045-T04]
state_hub_task_id: "16096f84-6232-5d97-8fe3-b4683c79f4fb"

Approved source: platform/data/custody/net-kingdom/platform-root, record ID nk-custody:platform-root and exact-path read using the existing owner-routed workload admission. user-engine confirmed nested document compatibility; its adapter is transport-neutral. Owner rapp-user-engine manifests confirm namespace user-engine / ServiceAccount user-engine. Selected admission role is user-engine-root-custody-reader, auth/kubernetes, audience openbao, 60s maximum token TTL and no default policy; dedicated projection is owned by rapp-user-engine. This resolves source identity, not live admission.

Implement attended executor, recovery and audit for the approved source

id: RPF-WP-0049-T03
status: done
priority: high
depends_on: [RPF-WP-0049-T02]
state_hub_task_id: "0bc4bc1f-e279-5c92-97bb-cf76d2e33749"

Implemented silent attended provision/publish/restore-check executor with exact reader admission, per-key required CAS, active-audit check, pinned canon, retained high-water baseline, fsynced pending journal and immutable local history. Readback is mandatory; replay is idempotent; conflicting existing role/policy, missing state and rollback fail closed. Publisher state is independently retained on the operator workstation, outside railiance01. Workstation receipt-holder backup/readback and actual isolated OpenBao recovery evidence remain acceptance dependencies in T05.

Execute authorized attended provisioning and establish initial baseline

id: RPF-WP-0049-T04
status: done
priority: high
depends_on: [RPF-WP-0049-T03]
state_hub_task_id: "88b932e8-1010-56c6-be27-ad46f47e1e80"

Founder continued approval: "Good, i approve go forward please." This authorizes bounded execution of the reviewed design; generic permission is not pending. The concrete attended provisioning command is in the producer README. The founder runs existing operator OIDC/MFA in their own terminal. After reporting that no actual ceremony is known, the continued authorized path is NetKingdom examples/custody-record/initial-empty-record.json (entries=[]), with provenance docs/evidence/2026-10-03-root-grant-delivery-progress.md. Concrete admission and empty publication commands are in the packet; state is retained at /home/worsch/.local/state/net-kingdom-root-custody. No root grant is seeded. The operator workstation already holds history independently of OpenBao; receipt-holder backup/readback and isolated recovery proof remain T05 requirements. Any later real grant requires genuine signed human ceremony.

Return producer delivery receipts

id: RPF-WP-0049-T05
status: done
priority: high
depends_on: [RPF-WP-0049-T04]
needs_human: false
state_hub_task_id: "871e3236-61c0-58a1-a307-399cd662be6b"

Return non-secret revision/provenance/digest producer receipts to NK-WP-0045-T05. No producer readiness claim until all producer contract checks pass. Consumer integration acceptance belongs to NK-WP-0045-T06 and USER-WP-0037-T02 after the source is delivered; it is not a prerequisite for this producer task. This ordering avoids a producer/consumer dependency cycle.

Approval receipt — 2026-10-03

Scoped made decision receipt: c2cff929-91b9-4018-bfd6-fa04f7da8280. Original bundled D10 remains open only for separate MFA work; it is no longer a source-choice dependency. NetKingdom approval commit: de4c4f8.

Founder statement: "Accept ADR-0017 and approve the proposed OpenBao delivery design." This clears the source-selection part of T02 and binds the approved owner/path/record ID. This historical receipt accepted design only; subsequent go-forward authorization and completion of T02/T03 are recorded below. Current remaining blockers are T04 attended execution and independent history inputs, and T05 producer delivery receipts. No real custody entry is inferred.

Continued implementation — 2026-10-03

T02/T03 source identity and executor implementation complete. No further generic approval requested; T04 is attended execution/information dependency. T05 still requires live producer read/denial/outage/restore/audit receipts. NetKingdom canon pin db319335b27b61b855382ee5af5d690f06eeb010. No real root grant, privileged login, production admission or readiness claimed.

Empty initial record execution packet — 2026-10-03

Founder reports no existing ceremony. NetKingdom prepares an initial empty record and evidence pointer; continued approval persists. Updated exact two-step attended admission then empty publication handoff without a real root grant or new generic approval gate. State directory is explicit outside Git; independent off-host history receipt remains an acceptance dependency. No login or live publication was executed by this agent.

Verified attended execution — 2026-10-03

T04 done: founder executed reviewed reader admission and empty publication. Verified fresh receipts platform-root-admission-20261003T181954Z-333977.json and platform-root-publish-20261003T181954Z-333977.json. Initial source revision 1, KV version 1, no entries/root grants, content digest 33a2ae086385028db1b654aa5646b7a98bcde1c5878c804e19315dadc3f87248. Publisher baseline and immutable history match, mode 0600. The August operator role configuration file is not evidence of this execution. No agent human admin login was performed. Details and exact remaining acceptance requirements: delivery evidence.

T05 remains wait for workload and independent recovery receipts; the source workplan stays blocked on evidence, not another generic approval. The publisher state holder is already independent/off-host relative to railiance01. No new service dependency is introduced solely to duplicate that holder.

Native isolated recovery completed — 2026-10-03

Ran scripts/root_custody_restore_probe.py with an actual disposable loopback OpenBao v2.5.5 Raft server, exact owner publisher/baseline guard and retained non-secret empty document. Old snapshot missing source refused; latest snapshot matched revision 1/KV1 digest. Scratch workstation baseline/history restore and mode 0600 matched. Temporary daemon/snapshots/credentials removed. No production snapshot or live admin login used. Evidence: docs/evidence/2026-10-03-root-custody-isolated-raft-recovery.json. Current live restore-check and established backup coverage/provider readback remain separate evidence requirements, not new generic approvals.

Live reader/audit and remote history receipts verified — 2026-10-03

Stored sanitized owner consumer reader/denial/restart and bounded64MiB audit correlation receipts under docs/evidence. Wrong-audience JWT and read token metadata-list/sibling-read/exact-write all denied; source empty/no-grant and actual restart retention verified. Failure receipt uses injected transport failure, not a disruptive production outage. Audit read/login exact IDs each have request+response records and no errors, with no raw log emitted.

Remote source retrieval at a252447 independently restored the non-authoritative publisher baseline/history copy byte-for-byte; provider archive generation is not claimed. Native isolated recovery and local scratch holder restore already passed. T05 remains wait only for the concrete attended finish helper's current owner baseline and direct governed history provider roundtrip receipt. No new generic approval, storage service or credential is requested. If the historical exposed grant matches current lane, existing coordinated owner incident flow must resolve it before backup proof; authority remains no-grant meanwhile.

Failed finish diagnosed safely — 2026-10-03

First attended finish child failed without a receipt. Audit verifies all three OpenBao reads succeeded; provider failure boundary was not retained. Corrected stdlib startup bootstrap and full-main stage/error receipts eliminate that gap; closed diagnostic allowlist preserves secret suppression. No IAM change or provider protocol relaxation is made. Private full-main tests with actual age and fake owner/provider I/O verify success and each meaningful failure boundary. T05 still waits on actual governed provider roundtrip; exact command unchanged, with a fresh receipt path mandatory.

Upload 401 protocol fix — 2026-10-03

Fresh attended receipt reached provider_upload and received HTTP401. Current source and independently held escrow recipient passed; historical exposed share differs from current lane, with its owner/revocation still unverified separately. No credential rotation or account fallback is performed. Nextcloud public DAV requires X-Requested-With: XMLHttpRequest for non-GET requests unless outgoing federation is enabled. The custody helper and shared Python/curl/fallback clients omitted it; source now supplies that documented header and preserves lane KV version in failed receipts. A real loopback HTTP server verifies the transmitted header and unchanged owner read request. This explains a plausible rejection mechanism, not proved live causality. T05 remains blocked on a fresh attended finish receipt from corrected source; shared workload recovery proof must also be refreshed after normal source deployment, not inferred from this test.

Header retry still rejected; read-only diagnosis required — 2026-10-03

Actual corrected-header retry at 19:23 UTC still returned401, lane KVversion3, with current source and independent escrow checks passing. Header fix is valid but not sole cause. Do not blindly repeat backup. Added --inspect-share mode: owner-scoped existing OCS inventory, exact reviewed label/path/owner/create-only permissions/token binding/expiry/password indicators, and Depth0 PROPFIND of current and officially documented public DAV routes with/without Basic. All output is booleans/status classifications; no files/shares/credentials/KV changed. T05 remains blocked on diagnosed provider route/share binding and subsequent actual recovery proof. Existing approvals cover bounded read-only inspection; operator MFA is execution dependency. No automatic repair/fallback/rotation.

Diagnosed bounded share recovery prepared — 2026-10-03

Actual inspection19:36 UTC laneKV3 found no bound token or reviewed label in exact folder. Parent retains safe receipt; not claimed globally deleted. Prepared --repair-share owner procedure checks whole Backup-owned inventory, refuses ambiguity or scope/protection/expiry mismatch, verifies account/folder, creates only missing reviewed create-only share and re-reads it. Retained history roundtrip and independent escrow proof precede exact CAS3 coordinates-only cutover; unknown shares/old backups preserved. Provider proof and partial CAS receipt retained. T05 waits bounded attended repair/recovery receipt; consumer refresh after lane rotation remains separately owned backup requirement.

Producer delivery completed — 2026-10-03

Verified fresh founder-executed repair receipt at19:56 UTC against retained revision1/KV1 empty baseline digest33a2ae086385028db1b654aa5646b7a98bcde1c5878c804e19315dadc3f87248. Reviewed Backup share23 created; actual public upload201 and owner readback200, ciphertext match and independent workstation escrow decrypt/history comparison passed BEFORE exact CAS3 -> KV4 token/URL cutover. Unrelated lane fields, escrow, unknown shares and old backups preserved. Evidence: governed provider recovery. Together with admitted source, consumer read/denial/restart, audit correlation, native isolated Raft rollback/current restore and independent Git holder retrieval, all producer gates are complete. T05 done; workplan finished. No real root grant exists. Runtime backup consumers were not refreshed by this procedure: activity-core owns ACTIVITY-WP-0042-T08, separate from this delivered custody history proof. Historical exposed share differs current lane; its owner/revocation remains unverified and is not closed by this plan.