railiance-platform/docs/evidence/2026-10-03-platform-root-custody-delivery.md

Platform-root custody delivery evidence — 2026-10-03

Owner: railiance-platform. Tracks RPF-WP-0049 / NK-WP-0045-T05. Bounded operator execution is verified; full delivery/recovery acceptance is still pending. This is a non-secret evidence summary, not a real custody grant.

Verified attended admission and publication

The founder executed the reviewed attended commands under continued approval. Fresh success receipts were independently read and checked locally:

• /tmp/platform-root-admission-20261003T181954Z-333977.json
• /tmp/platform-root-publish-20261003T181954Z-333977.json

Admission confirms namespace/SA user-engine/user-engine, role user-engine-root-custody-reader on auth/kubernetes, audience openbao, active OpenBao audit and per-key required CAS. Publication confirms whole-document write and owner readback. Initial fact: nk-custody:platform-root, revision 1, KV version 1, entries empty. It grants nobody root authority.

Content SHA256: 33a2ae086385028db1b654aa5646b7a98bcde1c5878c804e19315dadc3f87248. Publisher receipt time: 2026-10-03T18:21:14.370633+00:00. Publisher baseline mode: 0600. Immutable history receipt equals the baseline, and both equal the publication receipt digest and current initial candidate. The old oidc-role-platform-admin.20260828T112740.json is role configuration, not a success receipt for these October 3 acts.

Independent retained history and recovery requirement

Operator-owned publisher state is on the workstation: /home/worsch/.local/state/net-kingdom-root-custody/baseline.json and history/. It is already off-host and independent of OpenBao on railiance01 and OpenBao snapshots. No additional runtime/service is required merely to duplicate it. The human operator owns retaining and backing up this receipt holder. Preserve baseline.json, history/ and any pending publication journal together; never reset state to an older OpenBao snapshot or discard an ambiguous journal. Retain publication history until an explicitly reviewed custody record retirement; root custody entries are never removed to simulate revocation.

Remaining evidence, not a fresh generic approval:

1. Record the workstation receipt-holder backup destination/procedure and verify a copy/restore/readback of this non-secret state, retaining the exact latest revision and digest. A local process fsync proves durability, not workstation disaster recovery.
2. Run the attended restore-check against the current owner source with the retained baseline and fresh receipt. This proves today's independent state agrees with current owner readback; it is not proof of a snapshot exercise.
3. In the platform/OpenBao owner's isolated recovery procedure, restore a snapshot and compare with the independently retained latest history. Prove that an older/missing/mutated record is refused and source authority is not reopened until retained latest content is restored and readback matches. Do not roll back live OpenBao merely to manufacture a test receipt.
4. Complete reader identity success and wrong-identity/anonymous/list/sibling/ write denial, outage/fail-closed and audit correlation receipts. The publisher success receipt and configured reader policy do not alone prove workload admission or workload denial behavior. Consumer rollout follows its owner.

No genuine root ceremony is known. A future real grant requires signed human ceremony evidence and exact issuer/subject; IAM projections and a planned custody roster cannot ground it. Algorithm grant/revoke/supersession testing uses synthetic fixtures; no real grant is created or revoked for acceptance.

Security orientation reloaded: Emergent 0.2.4 root, verified-files, orientation-only; digest 025aab4f38246219c924bc94954e70ea0e6e7f72bcaf8d4344cd599602d345c3. No secret values, privileged role dump or token material are copied here.

Completed isolated recovery proof

Actual disposable local Raft server: OpenBao v2.5.5. Evidence: isolated recovery receipt. The exact owner publisher and baseline guard ran against an ephemeral loopback server and synthetic local credentials, with the real retained non-secret empty document. Two native Raft snapshots were created. Restoring the snapshot from before publication caused the missing source to be refused; restoring the snapshot containing revision 1/KV1 matched the independent retained digest. Workstation baseline/history copy and scratch restoration matched exactly, including 0600 baseline permissions. Server, credentials and snapshots were confined to temporary storage and cleaned up. Production was not accessed or mutated and no production snapshot was read.

This completes the bounded algorithm/native-backend isolated rollback/restore exercise and local receipt-holder copy/restore proof. It does not claim a production snapshot recovery or actual workstation backup-provider readback. The current live retained-baseline restore-check, provider retention coverage and workload/audit receipts remain separately tracked.

Established retention path and attended finish

No configured workstation backup job covering the new publisher directory was found in the inspected owner backup contracts/local backup configuration. A validated non-secret recovery copy now lives in root-custody-history/ in this owner repository. This enters the established Forgejo Git source backup scope; new provider archive coverage is not implied until an actual archive includes the commit. Source retrieval/readback is tracked separately from provider proof.

The one-command attended finish packet is in openbao/root-grant/README.md. It performs current owner baseline readback and an age-encrypted history upload/download/decrypt equality proof through the current governed OpenBao Nextcloud backup account/lane only. It uses existing forgejo/ storage, no new credential, no policy widening and no local historical rclone grant. A local historical configuration's credential-bearing coordinates may have appeared in backup-discovery tool output. No values are retained here. The finish helper compares that grant with the current lane in memory; if current, it reports a safe incident status and stops before upload for coordinated existing owner credential cutover, preserving consumers. No uninformed rotation is performed.

Completed live reader/audit and remote source retention proof

Consumer owner confirmed fresh authenticated revision-1 empty read/no grant, actual pod restart retains baseline, wrong audience JWT denied, metadata LIST, sibling GET and exact-path POST all denied403. Injected transport failure and same-revision mutation preserve the trusted baseline and return no grant. These failure tests do not claim a disruptive live OpenBao outage. Receipt: 2026-10-03-root-custody-reader-acceptance.json.

Safe bounded-tail lookup of the current audit PVC correlated exact consumer read and login request IDs with both request and response events, no errors. No raw audit records were emitted. Receipt: 2026-10-03-root-custody-audit-correlation.json. Whole-file grep was abandoned because the audit file is about6.68GB; the successful query bounded its tail to 64MiB. This proves event correlation, not an audit archival/rotation policy.

A fresh remote Forgejo clone retrieved source commit a252447058105eed0931d34f1a906f39ce7c2e5e and both independent publisher baseline/history recovery files matched byte-for-byte. The clone was removed. Receipt: 2026-10-03-root-custody-source-backup-readback.json. Source retrieval proves remote retention independent of workstation state, but does not prove that a new Nextcloud/Scaleway Forgejo archive generation contains that commit.

The only remaining bounded execution for RPF-WP-0049-T05 is the attended finish helper: current authenticated owner baseline check plus encrypted retained history upload/download/decryption through the current governed provider lane. This directly establishes the small custody-history provider recovery artifact without generating a multi-gigabyte full Forgejo dump. Existing go-forward approval applies; operator OIDC/MFA remains execution-only. Fresh receipt must show success. If the exposed historical local grant matches the current lane, coordinated existing credential recovery is required before provider proof; there is no automatic credential rotation or root authority change.

Failed attended finish and diagnostic correction

Attempt185421Z333977 completed and revoked its operator login, but the finish child failed without a receipt. Owner audit proves custody, backup-lane and operator-backup reads all succeeded. The exact external-provider failure is unknown because the previous catch-all discarded diagnostics; no IAM widening or speculative protocol/status relaxation is warranted. Safe audit receipt: 2026-10-03-root-custody-failed-finish-audit.json.

The corrected silent wrapper runs a stdlib bootstrap that reserves a fresh private receipt before importing helper dependencies. Full main emits fixed allowlisted stage/error codes and safe HTTP/artifact metadata on failure, including partial owner-baseline success and any attempted created artifact. It never emits exception text, raw response, credential or provider coordinates. Private clean-environment full-main tests use the actual attended envelope predicate, real validator/system age and fake owner/provider boundaries; they cover success, denied owner read, quota, missing binary, upload, download, ciphertext/decrypt failure, startup imports, stale receipt and incident stop. A new fresh-path attended attempt can now identify the actual provider boundary without guessing or repeating opaque failure. Actual provider acceptance remains pending; simulated successful provider tests do not establish it.