coulomb/user-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Complete live empty custody consumer acceptance
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29
This commit is contained in:
tegwick 2026-10-03 20:39:15 +02:00
parent f85c9681a7
commit 608cbff477
4 changed files with 157 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

67
docs/evidence/2026-10-03-root-custody-consumer-live.json Normal file
View file

@ -0,0 +1,67 @@
{
"date": "2026-10-03",
"workplan": "USER-WP-0037-T02",
"source_commit": "0d0751d",
"image_digest": "sha256:030fe90232e20bb02b372e3d16b8ff659a5407d54f6405eb85754262b9ad7dc6",
"canon_commit": "db319335b27b61b855382ee5af5d690f06eeb010",
"approved_document_sha256": "33a2ae086385028db1b654aa5646b7a98bcde1c5878c804e19315dadc3f87248",
"initialization": {
"actual_grant": false,
"baseline_initially_absent": true,
"baseline_receipt_matched": true,
"empty_no_grant_document": true,
"empty_record_returns_no_grant": true,
"failure_preserves_baseline": true,
"fresh_authenticated_owner_read": true,
"initialized_from_authenticated_receipt": true,
"injected_read_failure_returns_no_grant": true,
"ok": true,
"other_tenant_returns_no_grant": true,
"owner_read_clock_aware": true,
"reconnect_preserves_baseline": true,
"record_id_matched": true,
"record_revision": 1,
"runtime_enabled": true,
"same_revision_mutation_preserves_baseline": true,
"wrong_audience_login_denied": true
},
"after_controlled_pod_restart": {
"actual_grant": false,
"baseline_initially_absent": false,
"baseline_receipt_matched": true,
"baseline_survives_actual_pod_restart": true,
"capability_probe_read_at": "2026-10-03T18:30:58.194568+00:00",
"capability_probe_read_digest_matched": true,
"custody_write_denied": true,
"custody_write_denied_http_status": 403,
"empty_no_grant_document": true,
"empty_record_returns_no_grant": true,
"existing_baseline_receipt_matched": true,
"failure_preserves_baseline": true,
"fixture_service_serializes_live_empty_root_grant_null": true,
"fresh_authenticated_owner_read": true,
"hub_private_route_acceptance_claimed": false,
"injected_read_failure_returns_no_grant": true,
"metadata_list_denied": true,
"metadata_list_denied_http_status": 403,
"ok": true,
"other_tenant_returns_no_grant": true,
"owner_read_clock_aware": true,
"read_request_id": "91cd7235-9cfe-06c3-57a6-64a013d1cfcb",
"reader_login_request_id": "29a2fac4-8108-7ca5-d0a6-682c4a31f48d",
"reconnect_preserves_baseline": true,
"record_id_matched": true,
"record_revision": 1,
"runtime_enabled": true,
"same_revision_mutation_preserves_baseline": true,
"sibling_read_denied": true,
"sibling_read_denied_http_status": 403,
"wrong_audience_login_denied": true
},
"limitations": [
"No actual root grant exists: approved entries[] record.",
"Read failure and same-revision mutation are injected consumer checks, not production OpenBao outage or mutation.",
"Service serialization uses in-memory synthetic accounts/authorization harness against live authenticated empty custody source; no private Hub caller admission claimed.",
"Producer recovery/restore/audit completeness remains with railiance-platform; request IDs are correlation references, not inspected audit-log receipts."
]
}

64
docs/evidence/2026-10-03-root-custody-consumer-live.md Normal file
View file

@ -0,0 +1,64 @@
# Live empty custody consumer acceptance
USER-WP-0037-T02 is complete for the approved empty/no-grant delivery. The
authenticated reader and persisted baseline work in the deployed consumer,
including an actual pod restart. This creates no root grant and does not close
USER-WP-0037-T03's independent private Hub caller admission.
Machine receipt: [consumer acceptance](2026-10-03-root-custody-consumer-live.json).
Source `0d0751d`; image
`sha256:030fe90232e20bb02b372e3d16b8ff659a5407d54f6405eb85754262b9ad7dc6`;
embedded NetKingdom canon `db319335b27b61b855382ee5af5d690f06eeb010`.
## Accepted source and initialization
Founder reported no known ceremony record. The reviewed initial entries[] document
contains no certified grants; record id nk-custody:platform-root, revision1, KV1.
Owner admission/publication receipts
platform-root-admission-20261003T181954Z-333977 and
platform-root-publish-20261003T181954Z-333977 both returned ok=true.
Document digest:
`33a2ae086385028db1b654aa5646b7a98bcde1c5878c804e19315dadc3f87248`.
The consumer's previously absent baseline was initialized once through the actual
dedicated projected OpenBao audience JWT, admitted Kubernetes role and bounded
read. The read matched the owner digest and exact configured source/record.
After the packaging owner's controlled pod restart the same database baseline
existed, matched the digest and was not reinitialized or reset. A separate
connection also verified persisted contents.
## Live boundaries
The fresh exact-path read matched the approved empty document. The adapter returns
no grant for platform and other tenants. A real login with the existing flex-auth
audience JWT was denied. With the real root-custody reader token, LIST on metadata,
GET of a sibling path and POST to the custody path each returned403. The POST used
an empty body with no required data, so even an unexpected write allowance could
not publish a valid KV document. No custody document was written by these probes.
The internal in-memory fixture service/serialization harness used the actual live
authenticated custody adapter and emitted optional AccountAuthority.root_grant
as null. Fixture authorization is not an admitted real Hub principal; this result
does not claim private HTTP route acceptance or real-user account verification.
Consumer-injected source failure and same-revision mutation produced no grant
and preserved the trusted baseline. These are consumer failure checks, not an
actual OpenBao outage or a changed producer document. Positive grants, revocation,
supersession and rollback were tested with synthetic offline canon fixtures; no
real grant exists to exercise those transitions live.
## Audit correlation and remaining ownership
Allowed read request_id: `91cd7235-9cfe-06c3-57a6-64a013d1cfcb`.
Reader login request_id: `29a2fac4-8108-7ca5-d0a6-682c4a31f48d`.
Read correlation time: `2026-10-03T18:30:58.194568+00:00`.
These references enable owner audit lookup; no raw token, document, rejected
response or private profile was printed. Audit-log retrieval was not performed.
Actual producer restore/recovery/read-audit receipts remain railiance-platform's
RPF-WP-0049/NK-WP-0045-T05 responsibility and do not reopen this consumer gate.
The owner observed one transient original database connection refusal at startup
on rollout and restart; Kubernetes retry recovered Ready1/1 and health/readiness
200. This occurred in the original runtime database connection before custody
assembly. It is recorded as a startup-reliability follow-up, not repaired or
expanded into unrelated work here.

10
docs/root-custody-runtime.md
View file

@ -73,9 +73,11 @@ old state cannot detect rollback by itself. Keep this feature disabled through
restore until owner audit/history establishes the latest revision and a reviewed restore until owner audit/history establishes the latest revision and a reviewed
reconciliation updates the baseline. Never delete the row to make a read pass. reconciliation updates the baseline. Never delete the row to make a read pass.
## Remaining live acceptance ## Live acceptance and remaining owner gates
The code and offline fixtures do not establish a real grant. Delivery requires Live empty-source consumer acceptance is now complete; see
[the receipt](evidence/2026-10-03-root-custody-consumer-live.md). The code and
offline fixtures do not establish a real grant. Full estate acceptance also needs
reviewed publisher provenance (the approved empty entries[] baseline establishes reviewed publisher provenance (the approved empty entries[] baseline establishes
no grant), role/policy receipts, projected-token packaging, no grant), role/policy receipts, projected-token packaging,
network trust, owner-reviewed baseline initialization, image digest promotion and network trust, owner-reviewed baseline initialization, image digest promotion and
@ -88,3 +90,7 @@ It comes from NetKingdom examples/custody-record/initial-empty-record.json and
the owner provenance packet, not from positive-grant fixtures. Publication and the owner provenance packet, not from positive-grant fixtures. Publication and
an actual authenticated read matching this receipt are still required before an actual authenticated read matching this receipt are still required before
baseline initialization. baseline initialization.
USER-WP-0037-T02 is done for the delivered no-grant source and actual restart
acceptance. USER-WP-0037-T03 real Hub admission/private integration and platform
producer recovery/audit gates remain independently owned.

23
workplans/USER-WP-0037-hub-authority-lookup.md
View file

@ -48,10 +48,8 @@ production deployment was added. T02/T03 retain those outstanding owner gates.
```task ```task
id: USER-WP-0037-T02 id: USER-WP-0037-T02
status: wait status: done
depends_on: [NK-WP-0045-T05] depends_on: [NK-WP-0045-T05]
blocked_on: repo:railiance-platform
blocking_reason: "Consumer transport, durable baseline, pinned canon and optional mapping implemented; awaits NK-WP-0045-T05 reviewed publisher provenance/admission plus owner image promotion, receipt-bound baseline initialization and live integration evidence."
priority: high priority: high
state_hub_task_id: "23a5c211-277b-561e-a4b3-0f8e99537cac" state_hub_task_id: "23a5c211-277b-561e-a4b3-0f8e99537cac"
``` ```
@ -160,6 +158,21 @@ publisher receipt (empty no-grant initialization is acceptable), platform reader
owner image promotion, reviewed baseline initialization and live acceptance. owner image promotion, reviewed baseline initialization and live acceptance.
USER-WP-0037 stays blocked; T03 retains its independent Hub admission dependency. USER-WP-0037 stays blocked; T03 retains its independent Hub admission dependency.
2026-10-03 LIVE acceptance complete: producer admission/publication returned
ok=true for the approved empty revision1/KV1 document; controlled authenticated
receipt-bound baseline initialization succeeded. Actual consumer pod restart kept
the existing baseline with no reset/reinitialization. Fresh owner read matched;
wrong-audience login and real reader metadata LIST/sibling GET/custody POST were
denied. The internal fixture service harness against the actual live empty source
serialized root_grant:null; this is not a real admitted Hub caller acceptance.
Consumer-injected read failure/same-revision mutation retained the baseline.
Evidence: `docs/evidence/2026-10-03-root-custody-consumer-live.{md,json}`.
T02 is now done for delivered no-grant integration. No certified custodian or
actual grant was invented. Producer recovery/read-audit acceptance remains the
separate RPF-WP-0049/NK-WP-0045-T05 gate; T03 remains wait for real Hub credentials
and private integration. Workplan remains blocked solely on T03.
## Authenticated workload transport and private acceptance ## Authenticated workload transport and private acceptance
```task ```task
@ -204,7 +217,7 @@ credential admission message `f3bcc516` to `state-hub`, still unanswered, so
the qualifier now names `state-hub`. the qualifier now names `state-hub`.
Source delivery receipt: implementation commit `0d0751d` pushed to main; image Source delivery receipt: implementation commit `0d0751d` pushed to main; image
CI is triggered by source changes, expected tag `main-0d0751d`; immutable digest CI is triggered by source changes, expected tag `main-0d0751d`; immutable digest030fe90232e20bb02b372e3d16b8ff659a5407d54f6405eb85754262b9ad7dc6
and owner promotion receipts remain pending. Empty owner candidate digest and owner rollout/restart receipts are now verified (see live consumer evidence). Empty owner candidate digest
`33a2ae086385028db1b654aa5646b7a98bcde1c5878c804e19315dadc3f87248` `33a2ae086385028db1b654aa5646b7a98bcde1c5878c804e19315dadc3f87248`
is approved no-grant initialization input, not notice of live publication. is approved no-grant initialization input, not notice of live publication.