From ee300bf1e27c927920d2a4d18f76dd8a82710d93 Mon Sep 17 00:00:00 2001 From: callumalpass Date: Mon, 3 Aug 2026 19:11:45 +1000 Subject: [PATCH] Complete the encrypted recovery release gate --- config/release-readiness.json | 12 +++++++++--- config/security-audit-package.json | 4 ---- docs/decisions/0003-managed-provider-key-wrapping.md | 6 ++++++ docs/encryption.md | 7 ++++--- docs/security-audit-package.md | 3 +-- scripts/lib/security-audit-package.test.mjs | 1 - 6 files changed, 20 insertions(+), 13 deletions(-) diff --git a/config/release-readiness.json b/config/release-readiness.json index 1478420e..8beaa8c6 100644 --- a/config/release-readiness.json +++ b/config/release-readiness.json @@ -30,9 +30,15 @@ "id": "backup-encryption-and-restore-drill", "title": "Encrypted backup and restore drill", "owner": "Service operations owner", - "status": "required", - "evidence": [], - "notes": "Verify encrypted database and volume backups, restoration, key recovery, recovery objectives, and deletion behavior in the managed environment." + "status": "complete", + "evidence": [ + "https://github.com/mdbase-dev/mdbase-cloud-ops/actions/runs/30795956568", + "https://github.com/mdbase-dev/mdbase-cloud-ops/pull/56", + "https://github.com/mdbase-dev/mdbase-cloud-ops/pull/75", + "https://github.com/mdbase-dev/mdbase-cloud-ops/pull/76", + "https://github.com/mdbase-dev/mdbase-cloud-ops/pull/77" + ], + "notes": "The beta26 staging drill independently verified the signed governance-retained archive, clean-restored all three PostgreSQL databases, restored and digest-checked non-empty provider-managed R2 data, decrypted every hosted collection key through the Sydney KMS replica, cold-started the exact archived provider image, exercised restored and synthetic record/file semantics, measured recovery-point age and elapsed recovery time, proved provider-driven deletion, and cleanup-verified both source and isolated targets." }, { "id": "platform-signing-and-notarization", diff --git a/config/security-audit-package.json b/config/security-audit-package.json index 8222b780..41fa8922 100644 --- a/config/security-audit-package.json +++ b/config/security-audit-package.json @@ -285,10 +285,6 @@ "id": "single-relay-broker", "description": "The relay broker is a single managed service; tested recovery is automatic reconnect after broker restoration, not uninterrupted high availability." }, - { - "id": "complete-recovery-drill-pending", - "description": "The isolated full database, object, KMS-replica, retained-key, and clean-environment recovery drill remains open." - }, { "id": "platform-signing-pending", "description": "Canonical platform signing and notarization are not yet configured." diff --git a/docs/decisions/0003-managed-provider-key-wrapping.md b/docs/decisions/0003-managed-provider-key-wrapping.md index d7a5e9e7..8e4f05ab 100644 --- a/docs/decisions/0003-managed-provider-key-wrapping.md +++ b/docs/decisions/0003-managed-provider-key-wrapping.md @@ -165,6 +165,12 @@ The implementation requires: - an isolated recovery using the Sydney replica and restored database/object set before the production key hierarchy is considered complete. +The final requirement passed in staging on 2026-08-03 against the exact beta26 +provider image and a non-empty retained object set. The private operations +evidence records the signed archive identity, all three PostgreSQL restores, +Sydney KMS decrypt coverage, semantic file/collection checks, measured recovery +objectives, failed attempts, corrective commits, and exact cleanup. + ## Consequences The provider gains an asynchronous dependency at DEK wrap/unwrap boundaries diff --git a/docs/encryption.md b/docs/encryption.md index 68ac826f..bb4fae4c 100644 --- a/docs/encryption.md +++ b/docs/encryption.md @@ -57,9 +57,10 @@ random per-collection data key. A versioned wrapping boundary supports the legacy local deployment key and AWS KMS envelopes carrying the immutable key ARN. Exact KMS encryption context binds each wrapped key to its environment, purpose, and collection. PostgreSQL retains only the wrapped key, ciphertext, -and the explicit metadata listed below. Live staging activation and a complete -V1-to-V2 rotation drill have passed; the isolated full recovery drill remains -release operations work. Private/zero-knowledge hosting is not implemented. +and the explicit metadata listed below. Live staging activation, a complete +V1-to-V2 rotation drill, and an isolated Sydney-replica recovery of the exact +beta26 database/object set have passed. Private/zero-knowledge hosting is not +implemented. Local Markdown files are also plaintext from mdbase's perspective. Operating system full-disk encryption, encrypted home directories, and device access diff --git a/docs/security-audit-package.md b/docs/security-audit-package.md index a0c1606e..23941746 100644 --- a/docs/security-audit-package.md +++ b/docs/security-audit-package.md @@ -137,8 +137,7 @@ items are: - future native SDK key storage still needs platform-keystore integration; - Render uses narrowly scoped, rotated static AWS credentials rather than workload identity federation; -- full isolated recovery and platform signing/notarization remain open release - gates; and +- platform signing/notarization remains an open release gate; and - recovery administration currently depends on one operator. An assessor should prioritize authorization-ceiling confusion, substituted-key diff --git a/scripts/lib/security-audit-package.test.mjs b/scripts/lib/security-audit-package.test.mjs index 7736cc6a..16cab92d 100644 --- a/scripts/lib/security-audit-package.test.mjs +++ b/scripts/lib/security-audit-package.test.mjs @@ -24,7 +24,6 @@ const requiredLimitationIds = [ "no-key-transparency", "render-static-aws-credentials", "single-relay-broker", - "complete-recovery-drill-pending", "platform-signing-pending", "single-operator-recovery" ];