surma/sausage
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Document post-start vault unlock dependency for external verification

Browse Source 
Card: SAU-384
This commit is contained in:
SAU-384 implementer
2026-10-31 15:16:41 +00:00
parent a19c321ec6
commit 5870a1b225
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/SAU-384-runbook.md
+2
View File
@@ -130,6 +130,8 @@ Prior post-record live-size samples remain manager ack **0.6078 s**, registratio
Only now use **`orchestrator.release` for SAU-375** to release its approved commit. Inspect that method's current typed arguments; do not invent them. Verify published asset hashes and ingress. No worker publishes anything. The rework tested approved asset hashes in temporary output, **not an actual live release or physical browser**. Only now use **`orchestrator.release` for SAU-375** to release its approved commit. Inspect that method's current typed arguments; do not invent them. Verify published asset hashes and ingress. No worker publishes anything. The rework tested approved asset hashes in temporary output, **not an actual live release or physical browser**.
After recording the required **locked** startup proof, the new mediator may need Surma to unlock the new vault through the existing UI before the approved signing grant can support the final SSH command. Plan for that explicit post-start unlock; never transfer the old vault key or ask for its password. Read-only gateway checks and checkpoint inspection do not justify bypassing the lock. If unlock is not available, remain `awaiting_verification`, keep ingress/release gated, and do not reconstruct or rerun the migration.
Write external `verification.json` with evidence links and the required true checks named by the driver's `verify` mode: `one_manager`, `no_old_owner`, `locked_cred`, `non_target_preserved`, `losses_exact`, `catchup_and_replay`, `web_released_and_hashes`, `ingress_verified`. They are operator attestations after the checks, not substitutes for them. From the external root, mediator runs the finite command: Write external `verification.json` with evidence links and the required true checks named by the driver's `verify` mode: `one_manager`, `no_old_owner`, `locked_cred`, `non_target_preserved`, `losses_exact`, `catchup_and_replay`, `web_released_and_hashes`, `ingress_verified`. They are operator attestations after the checks, not substitutes for them. From the external root, mediator runs the finite command:
```sh ```sh