Ting/Jostoph

Watch

Fork 2

S3: Declared horizons, guarded doors #55

New issue

Open

opened 2026-08-12 16:15:55 +00:00 by agent.teyla · 1 comment

agent.teyla commented

2026-08-12 16:15:55 +00:00

Contributor

M1 frontier

In scope

Vector ships the record stream to the remote VictoriaLogs; Victoria is the operational replay source, the local file a write-ahead and partition buffer.
caddy-oidc fronts Victoria's ingest and query paths — the estate's machine-endpoint pattern. Kanidm service accounts per role, groups as claims, routes by claim: the ingest SA may only insert, the replay SA may only select. Token lifecycle is the Bao agent's — the estate's existing pattern: the agent renders the credential, exchanges it for the token (Kanidm stays the sole issuer, one identity plane for humans and machines; ruling recorded here), and try-restarts the consumer on rotation. Restart is harmless by this milestone's own guarantees — WAL, acked shipping, and the chain make rotation cost seconds of delay and zero records. TTLs chosen so restarts are rare and staggered; expiry is the security property, not a nuisance to extend.
Three declared quantities, coupled at eval: replay_horizon ≤ retention, and local_buffer ≥ max_partition — nix flake check fails if any pair drifts. The merge-styles coupling, third verse.
Honest degradation: with Victoria unreachable or the replay token refused, gate rules still rule per-event, and jostoph curation answers "horizon unavailable since T" — never counsel from a truncated view that looks like a quiet repo.

Out of scope

Dashboards and alerting (O1, below).
Content signing (S1/S2) — OIDC guards the pipe; only the emitter's signature vouches for the record.

Boundary

The arrow turns around exactly once: verified restore and replay. Reads pass through chain verification (S2), so the remote stack is audited, never trusted — a gap in what Victoria returns is detected at read time whatever happened on the wire.

Acceptance

Halving declared retention below the horizon fails at eval, not in production six months later.
An ingest token cannot read; a replay token cannot write; both are refused after revocation in Kanidm.
A simulated partition shorter than max_partition loses no records once shipping resumes.

Source: JOSTOPH-BACKLOG.md, Epic 1.2.

`M1` `frontier` **In scope** - Vector ships the record stream to the remote VictoriaLogs; Victoria is the operational replay source, the local file a write-ahead and partition buffer. - caddy-oidc fronts Victoria's ingest and query paths — the estate's machine-endpoint pattern. Kanidm service accounts per role, groups as claims, routes by claim: the ingest SA may only insert, the replay SA may only select. Token lifecycle is the Bao agent's — the estate's existing pattern: the agent renders the credential, exchanges it for the token (Kanidm stays the sole issuer, one identity plane for humans and machines; ruling recorded here), and `try-restart`s the consumer on rotation. Restart is harmless by this milestone's own guarantees — WAL, acked shipping, and the chain make rotation cost seconds of delay and zero records. TTLs chosen so restarts are rare and staggered; expiry is the security property, not a nuisance to extend. - Three declared quantities, coupled at eval: `replay_horizon ≤ retention`, and `local_buffer ≥ max_partition` — `nix flake check` fails if any pair drifts. The merge-styles coupling, third verse. - Honest degradation: with Victoria unreachable *or* the replay token refused, gate rules still rule per-event, and `jostoph curation` answers "horizon unavailable since T" — never counsel from a truncated view that looks like a quiet repo. **Out of scope** - Dashboards and alerting (O1, below). - Content signing (S1/S2) — OIDC guards the pipe; only the emitter's signature vouches for the record. **Boundary** - The arrow turns around exactly once: verified restore and replay. Reads pass through chain verification (S2), so the remote stack is audited, never trusted — a gap in what Victoria returns is detected at read time whatever happened on the wire. **Acceptance** - Halving declared retention below the horizon fails at eval, not in production six months later. - An ingest token cannot read; a replay token cannot write; both are refused after revocation in Kanidm. - A simulated partition shorter than `max_partition` loses no records once shipping resumes. Source: JOSTOPH-BACKLOG.md, Epic 1.2.

larandar referenced this issue from a commit

2026-08-13 07:22:34 +00:00

forgejo: the label is the author's act, and flaky-mesh may squash again (#36)

codexo referenced this issue

2026-08-15 00:08:16 +00:00

Campaign: Trusted delivery and evidence chain #83

codexo added the

Status/Need Grooming

label

2026-08-16 12:52:30 +00:00

larandar added a new dependency

2026-08-22 09:09:51 +00:00

#44 Epic 1.2: The evidence chain

larandar referenced this issue

2026-09-20 03:49:53 +00:00

Probes: external-system facts for the frontier (#55, #71-#74) (audit G55) #127

larandar commented

2026-09-20 03:50:09 +00:00

Owner

Audit 2026-09-19/20, G55: external-system facts are bounded in umbrella probe Ting/Jostoph#127 (#127). This record probe section and result columns are named there; no implementation claim is made here.

Audit 2026-09-19/20, G55: external-system facts are bounded in umbrella probe Ting/Jostoph#127 (https://jo.et0.pw/Ting/Jostoph/issues/127). This record probe section and result columns are named there; no implementation claim is made here.

No milestone

No project

No assignees

2 participants

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Blocks

#44 Epic 1.2: The evidence chain

Ting/Jostoph

Reference

Ting/Jostoph#55

No description provided.

Rows
Columns