coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-platform/docs/credential-lane-designs/application-backup-pair-custody-2026-10-08.md
codex 9b658e3f19
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Admit and install the backup pair writer. 
The OpenBao policy matches the reviewed file. Both publisher KV paths are still empty because the bootstrap key cannot create IAM applications.

Assistant: grok
Assistant-Session: 01a11cdb-f9fe-7011-947c-936e72007e54
2026-10-08 22:41:20 +02:00

2.5 KiB
Raw Blame History

Backup publisher pair custody — preview, 2026-10-08

RPF-WP-0053-T06. The node reader in scripts/application_backup_credentials.py can deliver an already stored pair. It cannot create one. Warden's paste-once desk writes one field per PUT and would drop the other half of AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY.

scripts/application_backup_pair_custody.py is the prepared front door for both draft records:

Application CCR KV path
coulomb-social CCR-2026-0036 platform/workloads/coulomb-social/backup-primary
email-connect CCR-2026-0037 platform/workloads/email-connect/backup-primary

Default command:

python3 scripts/application_backup_pair_custody.py --application email-connect

The preview reads the draft CCR and prints field names, CAS 0 and one intended write. writer_admitted is false. There is no stdin, provider call, OpenBao call, key generation, file write or timer change.

provision() is the future attended shape, covered by synthetic tests only:

  • writer token policies must be exactly backup-pair-writer, with no default policy and no workload-kv-read-*-backup-primary reader policy
  • TTL at most 5 minutes and at most 2 uses, then revoke
  • metadata absence is required; an existing version is not overwritten
  • one HTTP-style body carries cas: 0 and both fields
  • the receipt keeps version and request id, never the values

The founder admitted this identity on 2026-10-08. The words used were "bucket-pair-writer"; the OpenBao policy name is backup-pair-writer. No implemented SecurityCaseType covers the pair: workload-kv-read is still only an inventory candidate, and ops-mason can survey structure but cannot write it. The attended install is scripts/install-backup-pair-writer.sh. The installed policy matches the file (86e435900bc6912fada10c526bfa865127a0e28acd328cf5f5f69e8d62bda310), so WRITER_ADMITTED is true. The command-line preview still does not write.

Both KV paths are absent. The bootstrap key is denied IAM application and policy list (HTTP 403), so it cannot create the two publisher applications. The live bucket policy resource-control-scoped-backup allows one principal, application_id:ee80333e-5bab-4a04-85a9-5bdb46b7b3c1, under platform-pg/*, including object delete. No second application was added and no key was stored. CCR-2026-0036 and CCR-2026-0037 stay draft. The next founder act is creating the two IAM applications in the console, then one CAS=0 write each.