abf8855ae1
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa
146 lines
6.5 KiB
JSON
146 lines
6.5 KiB
JSON
{
|
|
"interface": "railiance.owner-review",
|
|
"version": 1,
|
|
"workplan_id": "RAILIANCE-WP-0024",
|
|
"workplan_uuid": "88c4ef7f-0af8-580e-90dc-a2bae2675a4d",
|
|
"base_revision": "3f9e453",
|
|
"receipt_destination": "railiance-platform",
|
|
"decisions": [
|
|
"approve",
|
|
"request-changes"
|
|
],
|
|
"task_owners": {
|
|
"RAILIANCE-WP-0024-T02": [
|
|
"audit-core",
|
|
"rapp-postgres",
|
|
"railiance-platform"
|
|
],
|
|
"RAILIANCE-WP-0024-T03": [
|
|
"audit-core",
|
|
"rapp-postgres",
|
|
"railiance-cluster",
|
|
"railiance-infra",
|
|
"railiance-platform"
|
|
]
|
|
},
|
|
"owners": {
|
|
"audit-core": {
|
|
"tasks": [
|
|
"RAILIANCE-WP-0024-T02",
|
|
"RAILIANCE-WP-0024-T03"
|
|
],
|
|
"artifacts": [
|
|
"docs/audit-core-database-lease-recovery.md",
|
|
"docs/railiance01-coordinated-reboot.md",
|
|
"scripts/audit-core-recovery-preflight.py",
|
|
"scripts/audit-core-database-lease-recovery.py"
|
|
],
|
|
"assertions": [
|
|
"The database-lease exercise uses only synthetic load and proves health 200, readiness and requests fail retryably with 503, then recover without changing the audit-core pod UID or restart count.",
|
|
"The approved load driver implements the exact start, probe, stop and summary contract and cannot expose credential values.",
|
|
"The reboot exercise proves audit-core health, readiness, database integrity and the approved synthetic E2 path after dependencies recover."
|
|
],
|
|
"checks": [
|
|
"focused-unit-tests",
|
|
"database-lease-preflight",
|
|
"node-reboot-preflight"
|
|
]
|
|
},
|
|
"rapp-postgres": {
|
|
"tasks": [
|
|
"RAILIANCE-WP-0024-T02",
|
|
"RAILIANCE-WP-0024-T03"
|
|
],
|
|
"artifacts": [
|
|
"docs/audit-core-database-lease-recovery.md",
|
|
"docs/railiance01-coordinated-reboot.md",
|
|
"scripts/audit-core-recovery-preflight.py",
|
|
"scripts/audit-core-database-lease-recovery.py",
|
|
"docs/audit-core-database-lease-approval.example.json"
|
|
],
|
|
"assertions": [
|
|
"Lease selection aborts unless exactly one live handle exists below database/creds/audit-core-runtime and its issue time coheres with the ExternalSecret refresh.",
|
|
"The action revokes only that exact lease handle; it never revokes the role prefix, an External Secrets parent lease, or another database consumer.",
|
|
"Recovery uses ordinary ExternalSecret refresh and mounted-file reread, with no pod restart, database restore or credential value in evidence.",
|
|
"After the coordinated reboot, the same platform-pg PVC and cluster identity return 1/1 Ready with ContinuousArchiving true and no re-bootstrap or in-place restore shortcut.",
|
|
"The reboot hold point requires a fresh completed Barman backup and healthy WAL archiving before the host action."
|
|
],
|
|
"checks": [
|
|
"focused-unit-tests",
|
|
"database-lease-preflight",
|
|
"node-reboot-preflight"
|
|
]
|
|
},
|
|
"railiance-cluster": {
|
|
"tasks": [
|
|
"RAILIANCE-WP-0024-T03"
|
|
],
|
|
"artifacts": [
|
|
"docs/railiance01-coordinated-reboot.md",
|
|
"scripts/audit-core-recovery-preflight.py",
|
|
"docs/openbao-reboot-snapshot-receipt.example.json"
|
|
],
|
|
"assertions": [
|
|
"Recovery is ordered host, node/k3s, CoreDNS and operators before application readiness; application lag is not treated as host failure.",
|
|
"The exercise does not reinstall k3s, replace PVCs or alter firewall policy as a recovery shortcut.",
|
|
"External Secrets stale-provider recovery is bounded to the documented controller reconciliation path and preserves value-safe evidence."
|
|
],
|
|
"checks": [
|
|
"focused-unit-tests",
|
|
"node-reboot-preflight"
|
|
]
|
|
},
|
|
"railiance-infra": {
|
|
"tasks": [
|
|
"RAILIANCE-WP-0024-T03"
|
|
],
|
|
"artifacts": [
|
|
"docs/railiance01-coordinated-reboot.md",
|
|
"scripts/audit-core-recovery-preflight.py",
|
|
"docs/openbao-reboot-snapshot-receipt.example.json"
|
|
],
|
|
"assertions": [
|
|
"An attended operator has independently verified provider-console access before the window and performs an ordinary reboot only.",
|
|
"Host-return, access-recovery and abort/escalation ownership are explicit; no ad hoc firewall, operating-system or k3s reinstall is authorized.",
|
|
"The reboot is gated on a current verified encrypted off-host OpenBao snapshot receipt and named recovery owners."
|
|
],
|
|
"checks": [
|
|
"focused-unit-tests",
|
|
"node-reboot-preflight"
|
|
]
|
|
},
|
|
"railiance-platform": {
|
|
"tasks": [
|
|
"RAILIANCE-WP-0024-T02",
|
|
"RAILIANCE-WP-0024-T03"
|
|
],
|
|
"artifacts": [
|
|
"docs/audit-core-database-lease-recovery.md",
|
|
"docs/railiance01-coordinated-reboot.md",
|
|
"scripts/audit-core-recovery-preflight.py",
|
|
"scripts/audit-core-database-lease-recovery.py",
|
|
"docs/audit-core-database-lease-approval.example.json",
|
|
"docs/openbao-reboot-snapshot-receipt.example.json"
|
|
],
|
|
"assertions": [
|
|
"T02 remains gated on a named window, abort operator, exact owner receipts and a revision-pinned synthetic-load driver; repository access alone cannot revoke a lease.",
|
|
"T02 revokes only the selected runtime handle, forces only the database ExternalSecret and records no credential values or OpenBao response bodies.",
|
|
"T03 remains gated on a verified encrypted off-host OpenBao snapshot receipt, 2-of-3 Shamir quorum, provider-console access, all owner receipts and a final attended go/no-go.",
|
|
"The platform owner preserves the mutation freeze and ordered OpenBao/ESO recovery boundary and does not initialize OpenBao, restore in place or restart audit-core as a shortcut."
|
|
],
|
|
"checks": [
|
|
"focused-unit-tests",
|
|
"database-lease-preflight",
|
|
"node-reboot-preflight"
|
|
]
|
|
}
|
|
},
|
|
"artifact_sha256": {
|
|
"docs/audit-core-database-lease-approval.example.json": "360d49d0bea7ca376405974403036bff080533728f133d237f30f4ee3bb943e0",
|
|
"docs/audit-core-database-lease-recovery.md": "5aa8f2723d7216d775990e0b2cd770290284b62d185526a9dffe7d6a4f925d95",
|
|
"docs/openbao-reboot-snapshot-receipt.example.json": "b95903a3e1aacb607eecc3f0440f08e62480d09da47bd7ab96c3eb8814f2eaee",
|
|
"docs/railiance01-coordinated-reboot.md": "9969c2f498587710154e8d9a650fb8a13159e9e7b99918291dbdf577b131b7e7",
|
|
"scripts/audit-core-database-lease-recovery.py": "c87fb026c527fc17116067c5742d324340707ce4aecf440d0d4e618db9b872a1",
|
|
"scripts/audit-core-recovery-preflight.py": "802f73fa4352f64bc0972d813e3dd874f3ec2f428e162b23158c9d8d6fd8e710"
|
|
}
|
|
}
|