From e52c47ff395b703e4f3078353ecc513aa159d2da Mon Sep 17 00:00:00 2001 From: codex Date: Tue, 8 Sep 2026 22:52:56 +0200 Subject: [PATCH] docs(factory): record installed runtime and attended custody preflight --- ...-09-08-helixforge-factory-critical-path.md | 50 +- .../2026-09-08-helixforge-factory/README.md | 2 + .../runtime-custody-continuation.json | 468 ++++++++++++++++++ 3 files changed, 519 insertions(+), 1 deletion(-) create mode 100644 docs/assessments/2026-09-08-helixforge-factory/runtime-custody-continuation.json diff --git a/docs/assessments/2026-09-08-helixforge-factory-critical-path.md b/docs/assessments/2026-09-08-helixforge-factory-critical-path.md index 60a3983..e1969d7 100644 --- a/docs/assessments/2026-09-08-helixforge-factory-critical-path.md +++ b/docs/assessments/2026-09-08-helixforge-factory-critical-path.md @@ -1,7 +1,8 @@ # Factory critical-path execution — 2026-09-08 Implemented and published prerequisite corrections in ops-warden, key-cape, -approval-engine and audit-core. The canonical integration workplan and next +approval-engine and audit-core, followed by local runtime installation and an +attended OpenBao capability preflight. The canonical integration workplan and next admission sequence remain in [prj-helixforge-factory](/home/worsch/prj-helixforge-factory/operations/identity-admission.md). @@ -44,3 +45,50 @@ handoffs and unreliable checks. Time saved and autonomous throughput are not measured. No secrets were provisioned, no new policy binding granted and no paid model run admitted; G0–G5 remain open and the fourteen-day window has not started. + +## Runtime installation and custody authority follow-through + +SAND-WP-0015-T06 is done. The existing pinned runtime is installed on +`bnt-lap001` in its owner's mode-0700 content-addressed store. The installer +checks the expected digest before writing, verifies the copied artifact, +rejects unsafe ownership/permissions and changed destinations, and publishes +atomically. Reusing an intact installation is idempotent. It is protected by +the local owner boundary; it is not root-owned or a Railiance installation. + +Sand-boxer source `df5e941` passed the complete check: **188 tests and Ruff**. +The installed-path namespace smoke started Claude 2.1.263, rein and the adapter; +proved read-only runtime, private persistent HOME, isolated networking, clean +worktree and teardown. It used no model credentials or provider request. +Sand-boxer published main `3e49a98` and Glas `4499160` carry the receipt. T04 and +GLAS-WP-0012-T02 still own execution configuration, real-model acceptance and +Railiance placement. No repeat of the unchanged candidate build is needed. + +RPF-WP-0035-T05 now has a successful first-provision **capability** proof. +Through the native founder-attended `openbao-platform-admin-login` envelope, +the platform diagnostic checked create/update capability on all six exact +policy, Kubernetes-role and KV data paths for CCR-2026-0017/0018. The successful +session self-revoked and removed its helper. Source `a94d06d` preserves the +metadata-only diagnostic and receipt. No secret value was read, custody seeded, +policy/role changed or production workload deployed. + +The receipt preserves all attempts: the first direct launcher failed before +the child command and left revocation unconfirmed; the second native-wrapper +session revoked successfully but its query used unsupported multi-path syntax; +the final six single-path queries passed and that session revoked successfully. +The later success does not establish revocation for the first failed attempt. + +The project consumes both returns in its thirteen-record dependency view. +Factory T03 and T04 remain waiting for their outstanding acceptance evidence; +installation and authority discovery no longer appear as unresolved inputs. +Source, Forgejo and the primary State Hub are reconciled at published revisions. + +This removes two concrete setup uncertainties and makes installation and the +custody preflight reproducible. Throughput, hours saved and autonomous delivery +remain unmeasured. The next sequence is actual upstream signed-token issuer +proof, named CCR reviews, attended custody activation and compatible KeyCape +rollout. Separate client/audit/native credential admission, the exact factory +grant and enforceable spend limits still precede a real model run. G0–G5 and the +fourteen-day observation window remain open. + +[Runtime and custody continuation receipt](2026-09-08-helixforge-factory/runtime-custody-continuation.json) +retains source revisions, validations, projection readbacks and progress IDs. diff --git a/docs/assessments/2026-09-08-helixforge-factory/README.md b/docs/assessments/2026-09-08-helixforge-factory/README.md index ee2e902..0fef09d 100644 --- a/docs/assessments/2026-09-08-helixforge-factory/README.md +++ b/docs/assessments/2026-09-08-helixforge-factory/README.md @@ -17,6 +17,8 @@ Files: - `dependency-coverage.json`: all 94 dependency responses, including empty ones. - `human-flags.csv`: the nineteen flagged tasks' lifecycle metadata. - `checkout-provenance.json`: principal source revisions and pre-existing dirty state. +- `runtime-custody-continuation.json`: later runtime installation and attended + capability proof, with published source/projection and progress receipts. - `consistency-check.json`: session-close consistency result, including thirteen existing-record assessment failures; this check did not pass. diff --git a/docs/assessments/2026-09-08-helixforge-factory/runtime-custody-continuation.json b/docs/assessments/2026-09-08-helixforge-factory/runtime-custody-continuation.json new file mode 100644 index 0000000..60affc6 --- /dev/null +++ b/docs/assessments/2026-09-08-helixforge-factory/runtime-custody-continuation.json @@ -0,0 +1,468 @@ +{ + "observed_at": "2026-09-08T20:52:36.518131+00:00", + "scope": "Published local runtime installation and attended custody capability preflight; factory admission remains open", + "runtime": { + "date": "2026-09-08", + "scope": "local owner artifact installation; not Railiance admission", + "host": "bnt-lap001", + "owner_uid": 1000, + "store_mode": "0700", + "runtime_path": "/home/worsch/.local/share/sandboxer/runtimes/5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922", + "runtime_sha256": "5cf9a16c5d77a16bdb2cb5b3df06ea655356bc2d44741791e3fedfee20d7e922", + "binary_version": "2.1.263", + "binary_sha256": "26d020351e8112f4006790f3cfce43b4c9df0c1bb1d0e542364d64151b81d5ba", + "candidate_rebuilt": false, + "installed_entries": 358, + "installed_regular_bytes": 245176062, + "root_owned": false, + "smoke": { + "ok": true, + "sandbox_id": "51b59587", + "rein_cli_started": true, + "adapter_imported": true, + "claude_version": "2.1.263 (Claude Code)", + "runtime_readonly": true, + "source_absent": true, + "home_outside_workspace": true, + "home_mode": "0700", + "worktree_clean": true, + "interfaces": [ + "lo" + ], + "python_prefix": "/opt/sandboxer/runtime", + "https_proxy_present": true, + "credential_refs": [], + "private_state_persisted": true, + "workspace_removed": true, + "proxy_removed": true, + "exit_code": 0 + }, + "model_run_proven": false, + "profile_activated": false, + "credential_delivery_configured": false + }, + "runtime_validation": { + "source_commit": "df5e941", + "make_check": { + "tests_passed": 188, + "ruff": "passed" + }, + "installed_path_smoke": "passed" + }, + "custody_preflight": { + "observed_at": "2026-09-08T20:36:47.042499+00:00", + "requests": [ + "CCR-2026-0017", + "CCR-2026-0018" + ], + "operation": "capabilities-self only", + "credential_data_read": false, + "metadata_applied": false, + "custody_activated": false, + "upstream_issuer_proven": false, + "status": "observed", + "capabilities": { + "sys/policies/acl/workload-kv-read-keycape-secrets-engine-approval": [ + "create", + "delete", + "list", + "read", + "sudo", + "update" + ], + "sys/policies/acl/workload-kv-read-keycape-approval-engine-operator": [ + "create", + "delete", + "list", + "read", + "sudo", + "update" + ], + "auth/kubernetes/role/external-secrets-keycape-secrets-engine-approval": [ + "create", + "delete", + "list", + "read", + "sudo", + "update" + ], + "auth/kubernetes/role/external-secrets-keycape-approval-engine-operator": [ + "create", + "delete", + "list", + "read", + "sudo", + "update" + ], + "platform/data/workloads/secrets-engine/approval-client": [ + "create", + "delete", + "list", + "read", + "update" + ], + "platform/data/workloads/approval-engine/operator-client": [ + "create", + "delete", + "list", + "read", + "update" + ] + }, + "required_metadata_capabilities_present": true, + "paths_verified": 6, + "login_lane": "openbao-platform-admin-login", + "launcher": "scripts/openbao-attended-exec.py", + "command": "scripts/keycape-approval-custody-preflight.py --receipt ", + "wrapper_exit": 0, + "session_self_revoked": true, + "helper_root_removed": true, + "attempt_notes": [ + { + "attempt": 1, + "result": "direct launcher unavailable; no child handoff; revocation unconfirmed", + "credential_data_read": false + }, + { + "attempt": 2, + "result": "owner wrapper login/self-revocation succeeded; capability command rejected unsupported multiple-path syntax", + "credential_data_read": false + }, + { + "attempt": 3, + "result": "six single-path capability queries succeeded; session self-revoked and helper removed", + "credential_data_read": false + } + ] + }, + "projection_receipts": [ + { + "repo": "sand-boxer", + "commit": "3e49a98a0e2c4a64539a5ccd674be8cd67ac9845", + "status": "applied", + "instance_role": "primary", + "instance_label": "railiance01", + "derived_commit": "3e49a98a0e2c4a64539a5ccd674be8cd67ac9845", + "outcome": "applied", + "refused": [] + }, + { + "repo": "glas-harness", + "commit": "44991600f377fa7b2bb380d4f4f255c33c480369", + "status": "applied", + "instance_role": "primary", + "instance_label": "railiance01", + "derived_commit": "44991600f377fa7b2bb380d4f4f255c33c480369", + "outcome": "applied", + "refused": [] + }, + { + "repo": "prj-helixforge-factory", + "commit": "044c52075c360adaef8327d7a1d8639c7435526e", + "status": "applied", + "instance_role": "primary", + "instance_label": "railiance01", + "derived_commit": "044c52075c360adaef8327d7a1d8639c7435526e", + "outcome": "applied", + "refused": [] + }, + { + "repo": "railiance-platform", + "commit": "a94d06dbcf0c4991d07eb69523c05a713acd59c2", + "status": "applied", + "instance_role": "primary", + "instance_label": "railiance01", + "derived_commit": "a94d06dbcf0c4991d07eb69523c05a713acd59c2", + "outcome": "applied", + "refused": [] + } + ], + "final_source_projection": { + "task_readbacks": [ + { + "source_id": "HFACT-WP-0001-T01", + "uuid": "5cee3251-faf9-5925-8ffd-7a8bf378b0a4", + "source_fields": { + "status": "wait", + "assignee": "the-custodian", + "blocking_reason": "Project published and registered; both product PR receipts finalized. Exact unattended actor/project/profile, grants, operating owners and enforceable spend contract still require the G0 admission packet.", + "needs_human": false + }, + "repaired_fields": [], + "verified": true + }, + { + "source_id": "HFACT-WP-0001-T02", + "uuid": "3a3a967d-5bec-52ee-be20-dc94524b8e85", + "source_fields": { + "status": "progress", + "assignee": "the-custodian" + }, + "repaired_fields": [], + "verified": true + }, + { + "source_id": "HFACT-WP-0001-T03", + "uuid": "67c80db1-01ba-54f1-80ff-76398f9e7823", + "source_fields": { + "status": "wait", + "assignee": "the-custodian", + "blocking_reason": "Corrected verifier image and exact audit scope published; attended first-provision capabilities proved on six paths. Await actual upstream issuer proof, RPF-WP-0035-T05/CCR-2026-0017/0018 activation, separate client-side/audit custody and live approval/native delivery; WARDEN-WP-0039-T03 retains explicit credential-policy binding refusal." + }, + "repaired_fields": [], + "verified": true + }, + { + "source_id": "HFACT-WP-0001-T04", + "uuid": "1054b135-f367-57b1-9308-72a1fbb38f62", + "source_fields": { + "status": "wait", + "assignee": "the-custodian", + "blocking_reason": "Local protected artifact installation and installed-path startup proved by SAND-WP-0015-T06. Await trusted owner configuration, T03 native credentials, real-model acceptance and Railiance-specific placement." + }, + "repaired_fields": [], + "verified": true + }, + { + "source_id": "HFACT-WP-0001-T05", + "uuid": "2b171ebd-75f3-5ce2-85a9-98e8ab77fd19", + "source_fields": { + "status": "wait", + "assignee": "the-custodian", + "blocking_reason": "Await actionable admission records, owner credential chain and accepted profile/placement from T02-T04." + }, + "repaired_fields": [], + "verified": true + }, + { + "source_id": "HFACT-WP-0001-T06", + "uuid": "4d72717a-d5c9-571d-987b-9373f01253fa", + "source_fields": { + "status": "wait", + "assignee": "the-custodian", + "blocking_reason": "Await the current governed Railiance worker proof in T05." + }, + "repaired_fields": [], + "verified": true + }, + { + "source_id": "HFACT-WP-0001-T07", + "uuid": "a815d9b3-b03e-5764-95c2-fa1a2940611a", + "source_fields": { + "status": "wait", + "assignee": "the-custodian", + "blocking_reason": "Recovery matrix and measurement ledger are prepared; final live recovery proof requires the deployed T05/T06 configuration." + }, + "repaired_fields": [], + "verified": true + }, + { + "source_id": "HFACT-WP-0001-T08", + "uuid": "59cfddfb-7cd6-5103-9444-8764e9d51678", + "source_fields": { + "status": "wait", + "assignee": "the-custodian", + "blocking_reason": "Await useful delivery and operational controls from T06/T07, then the complete fourteen-day observation window." + }, + "repaired_fields": [], + "verified": true + }, + { + "source_id": "SAND-WP-0015-T06", + "uuid": "f85f54c9-1081-5d0c-95ad-aca20ede8d66", + "status": "done", + "verified": true + }, + { + "source_id": "RPF-WP-0035-T05", + "uuid": "e15d62c9-e5da-5721-a135-87c050f7851c", + "status": "wait", + "verified": true + } + ], + "project_topic_verified": true, + "repositories": [ + { + "repo": "sand-boxer", + "commit": "3e49a98a0e2c4a64539a5ccd674be8cd67ac9845", + "remote_main": "3e49a98a0e2c4a64539a5ccd674be8cd67ac9845", + "published": true, + "clean": true, + "dirty_paths": [] + }, + { + "repo": "glas-harness", + "commit": "44991600f377fa7b2bb380d4f4f255c33c480369", + "remote_main": "44991600f377fa7b2bb380d4f4f255c33c480369", + "published": true, + "clean": true, + "dirty_paths": [] + }, + { + "repo": "railiance-platform", + "commit": "a94d06dbcf0c4991d07eb69523c05a713acd59c2", + "remote_main": "a94d06dbcf0c4991d07eb69523c05a713acd59c2", + "published": true, + "clean": true, + "dirty_paths": [] + }, + { + "repo": "prj-helixforge-factory", + "commit": "044c52075c360adaef8327d7a1d8639c7435526e", + "remote_main": "044c52075c360adaef8327d7a1d8639c7435526e", + "published": true, + "clean": true, + "dirty_paths": [] + }, + { + "repo": "ops-warden", + "commit": "3a01b8f1b50d5f20cbbbfca1aaec619f95cacf2c", + "remote_main": "3a01b8f1b50d5f20cbbbfca1aaec619f95cacf2c", + "published": true, + "clean": true, + "dirty_paths": [] + }, + { + "repo": "key-cape", + "commit": "5c7db26b7cb128141b4d6cd8de020a44036dba05", + "remote_main": "5c7db26b7cb128141b4d6cd8de020a44036dba05", + "published": true, + "clean": true, + "dirty_paths": [] + }, + { + "repo": "approval-engine", + "commit": "b46b0f26669dc83c944ee5145426bad03d5ef720", + "remote_main": "b46b0f26669dc83c944ee5145426bad03d5ef720", + "published": true, + "clean": true, + "dirty_paths": [] + }, + { + "repo": "audit-core", + "commit": "565e7e38d486ca2fe2fc15f93e32617c2fb89992", + "remote_main": "565e7e38d486ca2fe2fc15f93e32617c2fb89992", + "published": true, + "clean": true, + "dirty_paths": [] + }, + { + "repo": "net-kingdom", + "commit": "46455439cfbb24fc5d187403c8f9f4465fccc274", + "remote_main": "46455439cfbb24fc5d187403c8f9f4465fccc274", + "published": true, + "clean": true, + "dirty_paths": [] + } + ] + }, + "consistency_checks": { + "sand-boxer": { + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 13, + "info": 0 + }, + "result": "warn", + "fixes_applied": [ + "bindings: synced 15/15", + "C-33 fixed: regenerated WORK-RECORDS.md", + "C-22 fixed: task a95755fb\u2026 description updated", + "C-22 fixed: task 3a1bb3e1\u2026 description updated", + "C-22 fixed: task 435a3993\u2026 description updated", + "C-22 fixed: task 0683b09a\u2026 description updated", + "C-22 fixed: task 3aebb3be\u2026 description updated", + "C-22 fixed: task 849e0701\u2026 description updated", + "C-22 fixed: task 2378cd6a\u2026 description updated", + "C-11 fixed: task 'SAND-WP-0015-T06' \u2192 f85f54c9\u2026", + "brief: .custodian-brief.md updated", + "push: pushed" + ] + }, + "glas-harness": { + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 1, + "info": 0 + }, + "result": "warn", + "fixes_applied": [ + "bindings: synced 16/16", + "brief: .custodian-brief.md updated", + "push: pushed" + ] + }, + "prj-helixforge-factory": { + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 2, + "info": 0 + }, + "result": "warn", + "fixes_applied": [ + "bindings: synced 1/1", + "C-22 fixed: task 67c80db1\u2026 description updated", + "brief: .custodian-brief.md updated", + "push: pushed" + ] + } + }, + "progress_receipts": [ + { + "id": "41e32b8e-2166-487e-b043-542ab6e3b30d", + "workplan_id": "975db491-5412-5e27-8e34-14a2417bb039", + "task_id": "e15d62c9-e5da-5721-a135-87c050f7851c", + "summary": "Published railiance-platform a94d06d: native attended OpenBao capability-only preflight confirms create/update on all six CCR-2026-0017/0018 policy/role/data paths. Successful session self-revoked and helper removed. First failed direct-launcher attempt retains unconfirmed revocation. No credential data read or custody/production mutation. RPF-WP-0035-T05 remains wait for actual upstream issuer proof and named CCR reviews before activation.", + "http_status": 201 + }, + { + "id": "f51deb9d-91d3-4fbb-99f8-be1ca431bfb8", + "workplan_id": "ed4fe524-036f-5221-8deb-00e24e944de1", + "task_id": "1054b135-f367-57b1-9308-72a1fbb38f62", + "summary": "Accepted SAND-WP-0015-T06 local protected installation return: sand-boxer 3e49a98, 188 tests and Ruff passed, installed-path startup/isolation/private-state/teardown smoke succeeded on bnt-lap001; Glas 4499160 consumes receipt. HFACT-WP-0001-T04 remains wait for trusted execution configuration, native credential/model acceptance and Railiance placement. No profile or model run activated.", + "http_status": 201 + }, + { + "id": "e6acc585-d4dd-4b87-b945-83918af7b350", + "workplan_id": "ed4fe524-036f-5221-8deb-00e24e944de1", + "task_id": "67c80db1-01ba-54f1-80ff-76398f9e7823", + "summary": "Accepted RPF-WP-0035-T05 capability preflight return from platform a94d06d. Updated the thirteen-source dependency view and admission sequence: native first-provision authority availability is proved; actual upstream issuer proof and named CCR-2026-0017/0018 reviews remain before custody activation. Separate client-side/audit custody and live approval/native delivery remain open; G0-G5 not passed, no paid execution.", + "http_status": 201 + }, + { + "id": "a08406b1-2a84-4242-a212-9bfebe7600db", + "workplan_id": null, + "task_id": null, + "summary": "Custodian factory critical-path continuation: published protected local runtime installation (SAND-WP-0015-T06 done), 188 checks plus installed-path smoke; proved native attended OpenBao capabilities for CCR-2026-0017/0018 without secret data or custody mutation. Returned evidence through GLAS-WP-0012-T02, RPF-WP-0035-T05 and HFACT-WP-0001-T03/T04; existing owner records retain all residuals. Two concrete setup uncertainties resolved, throughput/time saved unmeasured; first failed launcher attempt retains unconfirmed revocation. Next: actual upstream issuer proof and named custody reviews, then activation/rollout.", + "http_status": 201 + } + ], + "earlier_owner_progress_ids": [ + "5cc0a533-ecb8-49af-8007-f3d5f4d502b7", + "9048f258-269e-439a-b632-c47a97faba4d" + ], + "platform_generated_changes_preserved": { + "files": [ + "WORK-RECORDS.md", + "workplans/RPF-WP-0035-credential-lane-implementation.md" + ], + "published_commit": "a94d06dbcf0c4991d07eb69523c05a713acd59c2", + "recovery_stash_retained": true + }, + "remaining_gates": [ + "Actual signed upstream ID-token issuer proof", + "Named CCR-2026-0017/0018 reviews before custody activation and compatible KeyCape rollout", + "Separate client-side and audit credential admission; live approval/native delivery", + "Trusted execution configuration, real-model acceptance and Railiance placement", + "Exact unattended factory actor/project/profile/grants and enforceable currency/time limits", + "Natural worker trace, useful governed delivery, recovery and fourteen-day observation" + ], + "factory_gates_passed": [], + "paid_model_execution_performed": false, + "custody_activated": false, + "production_deployed": false, + "efficiency_claim": "Two concrete setup uncertainties resolved; no measured throughput or time saving claimed" +}