748fe6c7db
Driver baseline reports ready for accepted or duplicate and its cleanup owns no server-side object (railiance-platform round-8 review). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 680842@bnt-lap001 Assistant-Session: 54eb9e8e-7d6b-4f0c-b7a6-a6db62075883
155 lines
7.2 KiB
JSON
155 lines
7.2 KiB
JSON
{
|
|
"interface": "railiance.owner-review",
|
|
"version": 1,
|
|
"workplan_id": "RAILIANCE-WP-0024",
|
|
"workplan_uuid": "88c4ef7f-0af8-580e-90dc-a2bae2675a4d",
|
|
"base_revision": "3f9e453",
|
|
"receipt_destination": "railiance-platform",
|
|
"decisions": [
|
|
"approve",
|
|
"request-changes"
|
|
],
|
|
"task_owners": {
|
|
"RAILIANCE-WP-0024-T02": [
|
|
"audit-core",
|
|
"rapp-postgres",
|
|
"railiance-platform"
|
|
],
|
|
"RAILIANCE-WP-0024-T03": [
|
|
"audit-core",
|
|
"rapp-postgres",
|
|
"railiance-cluster",
|
|
"railiance-infra",
|
|
"railiance-platform"
|
|
]
|
|
},
|
|
"owners": {
|
|
"audit-core": {
|
|
"tasks": [
|
|
"RAILIANCE-WP-0024-T02",
|
|
"RAILIANCE-WP-0024-T03"
|
|
],
|
|
"artifacts": [
|
|
"docs/audit-core-database-lease-recovery.md",
|
|
"docs/railiance01-coordinated-reboot.md",
|
|
"scripts/audit-core-recovery-preflight.py",
|
|
"scripts/audit-core-database-lease-recovery.py",
|
|
"scripts/audit_core_synthetic_sender_lane.py",
|
|
"scripts/t02-attended-window.py"
|
|
],
|
|
"assertions": [
|
|
"The database-lease exercise uses only synthetic load and proves health 200, readiness and requests fail retryably with 503, then recover without changing the audit-core pod UID or restart count.",
|
|
"The approved load driver implements the exact start, probe, stop and summary contract and cannot expose credential values.",
|
|
"The reboot exercise proves audit-core health, readiness, database integrity and the approved synthetic E2 path after dependencies recover."
|
|
],
|
|
"checks": [
|
|
"focused-unit-tests",
|
|
"database-lease-preflight",
|
|
"node-reboot-preflight"
|
|
]
|
|
},
|
|
"rapp-postgres": {
|
|
"tasks": [
|
|
"RAILIANCE-WP-0024-T02",
|
|
"RAILIANCE-WP-0024-T03"
|
|
],
|
|
"artifacts": [
|
|
"docs/audit-core-database-lease-recovery.md",
|
|
"docs/railiance01-coordinated-reboot.md",
|
|
"scripts/audit-core-recovery-preflight.py",
|
|
"scripts/audit-core-database-lease-recovery.py",
|
|
"docs/audit-core-database-lease-approval.example.json",
|
|
"scripts/t02-attended-window.py"
|
|
],
|
|
"assertions": [
|
|
"Lease selection aborts unless exactly one live handle exists below database/creds/audit-core-runtime and its issue time coheres with the ExternalSecret refresh.",
|
|
"The action revokes only that exact lease handle; it never revokes the role prefix, an External Secrets parent lease, or another database consumer.",
|
|
"Recovery uses ordinary ExternalSecret refresh and mounted-file reread, with no pod restart, database restore or credential value in evidence.",
|
|
"After the coordinated reboot, the same platform-pg PVC and cluster identity return 1/1 Ready with ContinuousArchiving true and no re-bootstrap or in-place restore shortcut.",
|
|
"The reboot hold point requires a fresh completed Barman backup and healthy WAL archiving before the host action."
|
|
],
|
|
"checks": [
|
|
"focused-unit-tests",
|
|
"database-lease-preflight",
|
|
"node-reboot-preflight"
|
|
]
|
|
},
|
|
"railiance-cluster": {
|
|
"tasks": [
|
|
"RAILIANCE-WP-0024-T03"
|
|
],
|
|
"artifacts": [
|
|
"docs/railiance01-coordinated-reboot.md",
|
|
"scripts/audit-core-recovery-preflight.py",
|
|
"docs/openbao-reboot-snapshot-receipt.example.json"
|
|
],
|
|
"assertions": [
|
|
"Recovery is ordered host, node/k3s, CoreDNS and operators before application readiness; application lag is not treated as host failure.",
|
|
"The exercise does not reinstall k3s, replace PVCs or alter firewall policy as a recovery shortcut.",
|
|
"External Secrets stale-provider recovery is bounded to the documented controller reconciliation path and preserves value-safe evidence."
|
|
],
|
|
"checks": [
|
|
"focused-unit-tests",
|
|
"node-reboot-preflight"
|
|
]
|
|
},
|
|
"railiance-infra": {
|
|
"tasks": [
|
|
"RAILIANCE-WP-0024-T03"
|
|
],
|
|
"artifacts": [
|
|
"docs/railiance01-coordinated-reboot.md",
|
|
"scripts/audit-core-recovery-preflight.py",
|
|
"docs/openbao-reboot-snapshot-receipt.example.json"
|
|
],
|
|
"assertions": [
|
|
"An attended operator has independently verified provider-console access before the window and performs an ordinary reboot only.",
|
|
"Host-return, access-recovery and abort/escalation ownership are explicit; no ad hoc firewall, operating-system or k3s reinstall is authorized.",
|
|
"The reboot is gated on a current verified encrypted off-host OpenBao snapshot receipt and named recovery owners."
|
|
],
|
|
"checks": [
|
|
"focused-unit-tests",
|
|
"node-reboot-preflight"
|
|
]
|
|
},
|
|
"railiance-platform": {
|
|
"tasks": [
|
|
"RAILIANCE-WP-0024-T02",
|
|
"RAILIANCE-WP-0024-T03"
|
|
],
|
|
"artifacts": [
|
|
"docs/audit-core-database-lease-recovery.md",
|
|
"docs/railiance01-coordinated-reboot.md",
|
|
"scripts/audit-core-recovery-preflight.py",
|
|
"scripts/audit-core-database-lease-recovery.py",
|
|
"docs/audit-core-database-lease-approval.example.json",
|
|
"docs/openbao-reboot-snapshot-receipt.example.json",
|
|
"scripts/audit_core_synthetic_sender_lane.py",
|
|
"scripts/t02-attended-window.py",
|
|
"scripts/openbao-reboot-snapshot.py"
|
|
],
|
|
"assertions": [
|
|
"T02 remains gated on a named window, abort operator, exact owner receipts and a revision-pinned synthetic-load driver; repository access alone cannot revoke a lease.",
|
|
"T02 revokes only the selected runtime handle, forces only the database ExternalSecret and records no credential values or OpenBao response bodies.",
|
|
"T03 remains gated on a verified encrypted off-host OpenBao snapshot receipt, 2-of-3 Shamir quorum, provider-console access, all owner receipts and a final attended go/no-go.",
|
|
"The platform owner preserves the mutation freeze and ordered OpenBao/ESO recovery boundary and does not initialize OpenBao, restore in place or restart audit-core as a shortcut."
|
|
],
|
|
"checks": [
|
|
"focused-unit-tests",
|
|
"database-lease-preflight",
|
|
"node-reboot-preflight"
|
|
]
|
|
}
|
|
},
|
|
"artifact_sha256": {
|
|
"docs/audit-core-database-lease-approval.example.json": "87e57e3290074508c6517938acf8c7fc1a75d977b8ff630f247a4ff5d2ee45c6",
|
|
"docs/audit-core-database-lease-recovery.md": "8dfd3fb59c551df0346d2569674227bb2f4e763c3bf058453035591073e20794",
|
|
"docs/openbao-reboot-snapshot-receipt.example.json": "b95903a3e1aacb607eecc3f0440f08e62480d09da47bd7ab96c3eb8814f2eaee",
|
|
"docs/railiance01-coordinated-reboot.md": "975bd3167cd1c3da152fafc8bcf882fb15dade92a89f60e82495cf34201fc81b",
|
|
"scripts/audit-core-database-lease-recovery.py": "332405cd6fce36d3df5588e7622065e3655eea0e4256766eb07c743349f29b17",
|
|
"scripts/audit-core-recovery-preflight.py": "d870d7763fabb9d01f72c157f82419257fd1bf9c2705e1661a98022b1caa29ba",
|
|
"scripts/audit_core_synthetic_sender_lane.py": "8a9c40cfdfd5cfe276bbf3ab79ecdf8e5f18cb85a2811423f54fa3808a4c57a4",
|
|
"scripts/t02-attended-window.py": "c4531d2daf6b2658cf8e94c9761d9cfe6333cca646b1d1692103945144fd775d",
|
|
"scripts/openbao-reboot-snapshot.py": "1370a40b75cfd89fe9cc60a9ba064414e6baa57349738fbb8bb26bc8804d96d8"
|
|
}
|
|
}
|