311aa86eef
Harness used the retracted public OpenBao URL and a token file; lane used a standing token file. Both now run only inside the contained ops-warden login (tunnel, helper token), and t02-attended-window.py runs project, exercise and cleanup under one login without printing (warden fails closed on child output). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 680842@bnt-lap001 Assistant-Session: 54eb9e8e-7d6b-4f0c-b7a6-a6db62075883
53 lines
3.6 KiB
Markdown
53 lines
3.6 KiB
Markdown
# RPF-WP-0015 attended windows — founder checklist
|
|
|
|
Procedures approved by all owners on 2026-10-14 against review contract
|
|
`1c08ba7ae064eddde89cdc15d36f0e1c1c372e1ba5c00f09f4b665409aa337a7`
|
|
(railiance-platform `8cfbf64`). Approval covers the procedures only. Each window
|
|
below still needs its own explicit founder GO; D5 (`2fd5849c`) authorizes the
|
|
exercise class, not a specific window. The runbooks are authoritative; this page
|
|
only orders the human steps.
|
|
|
|
## Before either window
|
|
|
|
| # | Item | Owner | State 2026-10-14 |
|
|
|---|------|-------|------------------|
|
|
| 1 | Push ops-warden `6e14300` (login output fail-closed fix, accepted in `reviews/RPF-WP-0017-ops-warden-reacceptance-2026-10-14.json`), then `uv tool install --reinstall /home/worsch/ops-warden` from that clean checkout | founder go, then agent | committed locally, not pushed |
|
|
| 2 | Value-safe retrospective of WARDEN-WP-0036-T02 (2026-09-01 live op ran while the relaxed check was in source) | ops-warden / railiance-platform | open |
|
|
|
|
## T02 — database lease recovery (≤15 min window)
|
|
|
|
Runbook: `docs/audit-core-database-lease-recovery.md`.
|
|
|
|
1. Pick a window that is not within 20 min of 03:17 UTC (attest-chain CronJob).
|
|
2. Fill an approval receipt from `docs/audit-core-database-lease-approval.example.json`:
|
|
approval id, window start/end, named abort operator, owner acknowledgement
|
|
message ids (audit-core, rapp-postgres, railiance-platform), synthetic load
|
|
`RAILIANCE-WP-0024-T02-SYNTHETIC-01` with driver revision
|
|
`sha256:941ba251…` (audit-core `8c8bcf4`), and the `synthetic_sender` block.
|
|
3. Announce two short audit-core restart gaps (projection and cleanup).
|
|
4. In the window: one contained ops-warden login runs the whole sequence —
|
|
`make audit-t02-attended-window` (approval receipt, driver path, confirm
|
|
string, bearer file and evidence dir outside Git). Through
|
|
`scripts/openbao-attended-exec.py` it runs lane project (restart #1) →
|
|
ssh-bounded port-forward → contained T02 exercise → 0600 evidence JSON →
|
|
lane cleanup with that evidence (restart #2). No token file is used.
|
|
5. Abort: the window script stops the port-forward and runs `cleanup --abort-reason`
|
|
itself; if it could not, run `make audit-synthetic-sender-cleanup
|
|
AUDIT_SYNTHETIC_SENDER_ABORT_REASON=...` (one more login). Never restart the pod by hand.
|
|
|
|
## T03 — coordinated railiance01 reboot
|
|
|
|
Runbook: `docs/railiance01-coordinated-reboot.md`. Additional gates before the window:
|
|
|
|
| # | Item | Owner |
|
|
|---|------|-------|
|
|
| 1 | Prove provider console / rescue / hard-reset access and file a `RAIL01-CONSOLE-<ts>` receipt (railiance-infra `docs/railiance01-console-access.md`, RAIL-HO-WP-0011-T09). Today no out-of-band console is established. | founder |
|
|
| 2 | Remove the stuck PVC `platform-pg-drill/platform-pg-drill-1` (pvc-protection finalizer) in a separately approved attended step, or keep it explicitly listed | rapp-postgres + founder go |
|
|
| 3 | Fresh backup or written waiver for `state-hub-db`, `user-engine-pg`, `net-kingdom-pg`, `target-revenue-pg` (no CNPG backup configured) | each DB owner |
|
|
| 4 | New scenario id and fresh human decision (08-23 decisions/scenario are consumed) | founder |
|
|
| 5 | Fresh encrypted off-host OpenBao snapshot receipt (≤24 h) | platform custody, attended |
|
|
| 6 | 2-of-3 Shamir unseal holders present; named abort operator; railiance-infra abort-owner ack | founder |
|
|
| 7 | Pre-reboot preflight run to capture the evidence file (boot id, failing-pod baseline, CNPG identities) | agent |
|
|
|
|
Stop immediately, self-revoke and never retry on any unexpected credential output
|
|
from the attended login.
|