diff --git a/docs/evidence/2026-10-03-root-custody-consumer-live.json b/docs/evidence/2026-10-03-root-custody-consumer-live.json new file mode 100644 index 0000000..2d35f7c --- /dev/null +++ b/docs/evidence/2026-10-03-root-custody-consumer-live.json @@ -0,0 +1,67 @@ +{ + "date": "2026-10-03", + "workplan": "USER-WP-0037-T02", + "source_commit": "0d0751d", + "image_digest": "sha256:030fe90232e20bb02b372e3d16b8ff659a5407d54f6405eb85754262b9ad7dc6", + "canon_commit": "db319335b27b61b855382ee5af5d690f06eeb010", + "approved_document_sha256": "33a2ae086385028db1b654aa5646b7a98bcde1c5878c804e19315dadc3f87248", + "initialization": { + "actual_grant": false, + "baseline_initially_absent": true, + "baseline_receipt_matched": true, + "empty_no_grant_document": true, + "empty_record_returns_no_grant": true, + "failure_preserves_baseline": true, + "fresh_authenticated_owner_read": true, + "initialized_from_authenticated_receipt": true, + "injected_read_failure_returns_no_grant": true, + "ok": true, + "other_tenant_returns_no_grant": true, + "owner_read_clock_aware": true, + "reconnect_preserves_baseline": true, + "record_id_matched": true, + "record_revision": 1, + "runtime_enabled": true, + "same_revision_mutation_preserves_baseline": true, + "wrong_audience_login_denied": true + }, + "after_controlled_pod_restart": { + "actual_grant": false, + "baseline_initially_absent": false, + "baseline_receipt_matched": true, + "baseline_survives_actual_pod_restart": true, + "capability_probe_read_at": "2026-10-03T18:30:58.194568+00:00", + "capability_probe_read_digest_matched": true, + "custody_write_denied": true, + "custody_write_denied_http_status": 403, + "empty_no_grant_document": true, + "empty_record_returns_no_grant": true, + "existing_baseline_receipt_matched": true, + "failure_preserves_baseline": true, + "fixture_service_serializes_live_empty_root_grant_null": true, + "fresh_authenticated_owner_read": true, + "hub_private_route_acceptance_claimed": false, + "injected_read_failure_returns_no_grant": true, + "metadata_list_denied": true, + "metadata_list_denied_http_status": 403, + "ok": true, + "other_tenant_returns_no_grant": true, + "owner_read_clock_aware": true, + "read_request_id": "91cd7235-9cfe-06c3-57a6-64a013d1cfcb", + "reader_login_request_id": "29a2fac4-8108-7ca5-d0a6-682c4a31f48d", + "reconnect_preserves_baseline": true, + "record_id_matched": true, + "record_revision": 1, + "runtime_enabled": true, + "same_revision_mutation_preserves_baseline": true, + "sibling_read_denied": true, + "sibling_read_denied_http_status": 403, + "wrong_audience_login_denied": true + }, + "limitations": [ + "No actual root grant exists: approved entries[] record.", + "Read failure and same-revision mutation are injected consumer checks, not production OpenBao outage or mutation.", + "Service serialization uses in-memory synthetic accounts/authorization harness against live authenticated empty custody source; no private Hub caller admission claimed.", + "Producer recovery/restore/audit completeness remains with railiance-platform; request IDs are correlation references, not inspected audit-log receipts." + ] +} diff --git a/docs/evidence/2026-10-03-root-custody-consumer-live.md b/docs/evidence/2026-10-03-root-custody-consumer-live.md new file mode 100644 index 0000000..b48699d --- /dev/null +++ b/docs/evidence/2026-10-03-root-custody-consumer-live.md @@ -0,0 +1,64 @@ +# Live empty custody consumer acceptance + +USER-WP-0037-T02 is complete for the approved empty/no-grant delivery. The +authenticated reader and persisted baseline work in the deployed consumer, +including an actual pod restart. This creates no root grant and does not close +USER-WP-0037-T03's independent private Hub caller admission. + +Machine receipt: [consumer acceptance](2026-10-03-root-custody-consumer-live.json). +Source `0d0751d`; image +`sha256:030fe90232e20bb02b372e3d16b8ff659a5407d54f6405eb85754262b9ad7dc6`; +embedded NetKingdom canon `db319335b27b61b855382ee5af5d690f06eeb010`. + +## Accepted source and initialization + +Founder reported no known ceremony record. The reviewed initial entries[] document +contains no certified grants; record id nk-custody:platform-root, revision1, KV1. +Owner admission/publication receipts +platform-root-admission-20261003T181954Z-333977 and +platform-root-publish-20261003T181954Z-333977 both returned ok=true. +Document digest: +`33a2ae086385028db1b654aa5646b7a98bcde1c5878c804e19315dadc3f87248`. + +The consumer's previously absent baseline was initialized once through the actual +dedicated projected OpenBao audience JWT, admitted Kubernetes role and bounded +read. The read matched the owner digest and exact configured source/record. +After the packaging owner's controlled pod restart the same database baseline +existed, matched the digest and was not reinitialized or reset. A separate +connection also verified persisted contents. + +## Live boundaries + +The fresh exact-path read matched the approved empty document. The adapter returns +no grant for platform and other tenants. A real login with the existing flex-auth +audience JWT was denied. With the real root-custody reader token, LIST on metadata, +GET of a sibling path and POST to the custody path each returned403. The POST used +an empty body with no required data, so even an unexpected write allowance could +not publish a valid KV document. No custody document was written by these probes. + +The internal in-memory fixture service/serialization harness used the actual live +authenticated custody adapter and emitted optional AccountAuthority.root_grant +as null. Fixture authorization is not an admitted real Hub principal; this result +does not claim private HTTP route acceptance or real-user account verification. + +Consumer-injected source failure and same-revision mutation produced no grant +and preserved the trusted baseline. These are consumer failure checks, not an +actual OpenBao outage or a changed producer document. Positive grants, revocation, +supersession and rollback were tested with synthetic offline canon fixtures; no +real grant exists to exercise those transitions live. + +## Audit correlation and remaining ownership + +Allowed read request_id: `91cd7235-9cfe-06c3-57a6-64a013d1cfcb`. +Reader login request_id: `29a2fac4-8108-7ca5-d0a6-682c4a31f48d`. +Read correlation time: `2026-10-03T18:30:58.194568+00:00`. +These references enable owner audit lookup; no raw token, document, rejected +response or private profile was printed. Audit-log retrieval was not performed. +Actual producer restore/recovery/read-audit receipts remain railiance-platform's +RPF-WP-0049/NK-WP-0045-T05 responsibility and do not reopen this consumer gate. + +The owner observed one transient original database connection refusal at startup +on rollout and restart; Kubernetes retry recovered Ready1/1 and health/readiness +200. This occurred in the original runtime database connection before custody +assembly. It is recorded as a startup-reliability follow-up, not repaired or +expanded into unrelated work here. diff --git a/docs/root-custody-runtime.md b/docs/root-custody-runtime.md index d6eb2ce..7254525 100644 --- a/docs/root-custody-runtime.md +++ b/docs/root-custody-runtime.md @@ -73,9 +73,11 @@ old state cannot detect rollback by itself. Keep this feature disabled through restore until owner audit/history establishes the latest revision and a reviewed reconciliation updates the baseline. Never delete the row to make a read pass. -## Remaining live acceptance +## Live acceptance and remaining owner gates -The code and offline fixtures do not establish a real grant. Delivery requires +Live empty-source consumer acceptance is now complete; see +[the receipt](evidence/2026-10-03-root-custody-consumer-live.md). The code and +offline fixtures do not establish a real grant. Full estate acceptance also needs reviewed publisher provenance (the approved empty entries[] baseline establishes no grant), role/policy receipts, projected-token packaging, network trust, owner-reviewed baseline initialization, image digest promotion and @@ -88,3 +90,7 @@ It comes from NetKingdom examples/custody-record/initial-empty-record.json and the owner provenance packet, not from positive-grant fixtures. Publication and an actual authenticated read matching this receipt are still required before baseline initialization. + +USER-WP-0037-T02 is done for the delivered no-grant source and actual restart +acceptance. USER-WP-0037-T03 real Hub admission/private integration and platform +producer recovery/audit gates remain independently owned. diff --git a/workplans/USER-WP-0037-hub-authority-lookup.md b/workplans/USER-WP-0037-hub-authority-lookup.md index b7cf136..d0c4605 100644 --- a/workplans/USER-WP-0037-hub-authority-lookup.md +++ b/workplans/USER-WP-0037-hub-authority-lookup.md @@ -48,10 +48,8 @@ production deployment was added. T02/T03 retain those outstanding owner gates. ```task id: USER-WP-0037-T02 -status: wait +status: done depends_on: [NK-WP-0045-T05] -blocked_on: repo:railiance-platform -blocking_reason: "Consumer transport, durable baseline, pinned canon and optional mapping implemented; awaits NK-WP-0045-T05 reviewed publisher provenance/admission plus owner image promotion, receipt-bound baseline initialization and live integration evidence." priority: high state_hub_task_id: "23a5c211-277b-561e-a4b3-0f8e99537cac" ``` @@ -160,6 +158,21 @@ publisher receipt (empty no-grant initialization is acceptable), platform reader owner image promotion, reviewed baseline initialization and live acceptance. USER-WP-0037 stays blocked; T03 retains its independent Hub admission dependency. +2026-10-03 LIVE acceptance complete: producer admission/publication returned +ok=true for the approved empty revision1/KV1 document; controlled authenticated +receipt-bound baseline initialization succeeded. Actual consumer pod restart kept +the existing baseline with no reset/reinitialization. Fresh owner read matched; +wrong-audience login and real reader metadata LIST/sibling GET/custody POST were +denied. The internal fixture service harness against the actual live empty source +serialized root_grant:null; this is not a real admitted Hub caller acceptance. +Consumer-injected read failure/same-revision mutation retained the baseline. +Evidence: `docs/evidence/2026-10-03-root-custody-consumer-live.{md,json}`. + +T02 is now done for delivered no-grant integration. No certified custodian or +actual grant was invented. Producer recovery/read-audit acceptance remains the +separate RPF-WP-0049/NK-WP-0045-T05 gate; T03 remains wait for real Hub credentials +and private integration. Workplan remains blocked solely on T03. + ## Authenticated workload transport and private acceptance ```task @@ -204,7 +217,7 @@ credential admission message `f3bcc516` to `state-hub`, still unanswered, so the qualifier now names `state-hub`. Source delivery receipt: implementation commit `0d0751d` pushed to main; image -CI is triggered by source changes, expected tag `main-0d0751d`; immutable digest -and owner promotion receipts remain pending. Empty owner candidate digest +CI is triggered by source changes, expected tag `main-0d0751d`; immutable digest030fe90232e20bb02b372e3d16b8ff659a5407d54f6405eb85754262b9ad7dc6 +and owner rollout/restart receipts are now verified (see live consumer evidence). Empty owner candidate digest `33a2ae086385028db1b654aa5646b7a98bcde1c5878c804e19315dadc3f87248` is approved no-grant initialization input, not notice of live publication.