# Access-Authenticated Production Runtime Smoke Runbook

Issue: #256

Status: governed operation method and activation gate. This document does not enable production current retrieval.

## Purpose

This runbook defines the approved Access-authenticated Production runtime smoke method for the source-grounded proof.

The method exists because the Production NIST SSDF activation attempt recorded in PR #255 failed the required direct no-Origin API smoke when Cloudflare Access returned HTTP 302 before provider execution. That result proved the Access boundary was active, but it did not prove provider-backed `/api/source-grounded-chat` execution for the attempted activation.

Future Production current-source expansion is blocked unless an Access-authenticated smoke path exists and passes before activation continues.

## Scope

In scope:

- validating `https://ghostmesh.ai/api/source-grounded-chat` through the existing Cloudflare Access boundary
- validating provider-backed server-side execution through `/api/source-grounded-chat`
- validating that the browser makes zero direct provider calls
- validating that the browser makes zero direct current-source calls
- validating that the current Production source set remains AI RMF only before any later expansion task starts
- recording method class, result, and redacted evidence in a validation receipt

Out of scope:

- retrying SSDF Production activation
- changing the Production current-source registry
- changing Cloudflare Access or WAF
- changing provider or model configuration
- creating or changing Access service tokens
- enabling OWASP, CISA / NSA / NCSC, regulated-life-sciences sources, SSDF, or any other source
- adding arbitrary web search
- adding user-provided URL retrieval
- adding browser-side provider calls
- adding browser-side current-source calls
- promoting current/public sources into package authority

## Structural Boundary

Production keeps this posture unless a later owner-approved activation issue changes it with passing smoke and rollback evidence:

```text
Current/public Production source set: nist-ai-rmf-public-framework-candidate only
Package-only default: required
Package + current context: explicit opt-in and package-first
Provider execution route: /api/source-grounded-chat only
Browser direct provider calls: 0
Browser direct current-source calls: 0
Cloudflare Access/WAF changes in this smoke method: none
Provider/model changes in this smoke method: none
```

The method does not make current/public sources package authority. It only proves that the protected runtime path can execute through the server boundary while preserving the proof split.

## Approved Method Class

Primary method class:

```text
Access-authenticated browser network-observed API smoke
```

The operator uses an existing allowed Cloudflare Access browser session for `https://ghostmesh.ai/source-grounded-chat-proof`. The proof page assembles the request package and sends the protected API request. The operator records only sanitized observations from browser-visible run telemetry and network status.

This method is approved because it validates the same protected browser-to-API path that a real authenticated proof user exercises, without extracting Access cookies, service-token values, identity tokens, provider keys, or raw request material.

Conditional direct API method class:

```text
Access-authenticated direct API smoke with externally supplied credential material
```

This method is allowed only when the operator already has an approved credential-safe way to send existing Access authorization material without printing it. This repository does not define, store, generate, or require that credential material. The activation task must not create or change Access/WAF state to make this method work.

If no credential-safe direct API method exists, the primary browser network-observed method is the required method.

## Preconditions

Before any future Production current-source activation proceeds, confirm:

1. The activation issue explicitly authorizes the source set.
2. The current repo baseline and deployment baseline are recorded.
3. The Production Access boundary still returns a controlled unauthenticated denial for `/api/source-grounded-chat`.
4. The operator has an existing allowed Cloudflare Access browser session or an approved credential-safe direct API method.
5. The current Production source set is recorded as `nist-ai-rmf-public-framework-candidate` only.
6. Package-only is the default on fresh load.
7. No Access/WAF, provider/model, or registry mutation has happened in the smoke-method task.

## Primary Smoke Steps

1. Open `https://ghostmesh.ai/source-grounded-chat-proof` in an existing allowed Access-authenticated browser session.
2. Confirm the visible origin is `https://ghostmesh.ai`.
3. Confirm the default source context is `Package only`.
4. Select `Package + current context` only for the positive current-context smoke prompt.
5. Use a positive prompt that is supported by package material and should route only to NIST AI RMF current/public context in the current baseline.
6. Run the prompt once.
7. Observe the protected `/api/source-grounded-chat` request in browser network tooling or proof telemetry.
8. Record sanitized result fields only.
9. Run an unsupported prompt that selects zero refs and confirm it makes zero API calls.
10. Stop if any unexpected source ID, browser-side provider call, browser-side current-source call, secret exposure, Access failure, provider failure, or source-lane collapse is observed.

Recommended positive prompt for the baseline smoke:

```text
Using the approved package first, compare the playbook's package-first source-grounded assistant posture with NIST AI Risk Management Framework governance expectations. Keep package and current/public source lanes separate.
```

Recommended unsupported prompt:

```text
lunar cheese
```

## Required Pass Evidence

A passing Access-authenticated Production runtime smoke receipt must record these fields:

Controlled unauthenticated Cloudflare Access denial for `/api/source-grounded-chat`.

Access-authenticated provider-backed `/api/source-grounded-chat` execution before activation continues.

| Field | Required result |
|---|---|
| Method class | `Access-authenticated browser network-observed API smoke`, unless an approved direct method is used |
| Production origin | `https://ghostmesh.ai` |
| Unauthenticated API behavior | controlled Cloudflare Access denial, such as HTTP 302 |
| Authenticated API behavior | HTTP 200 or equivalent successful protected API response |
| Provider execution | provider executed through server boundary |
| Provider route | `/api/source-grounded-chat` |
| Package-only default | pass |
| Package + current context | explicit opt-in |
| Current-source IDs before expansion | `nist-ai-rmf-public-framework-candidate` only |
| Current/public citation count before expansion | 1 for the AI RMF baseline prompt |
| External retrieval count before expansion | 1 for the AI RMF baseline prompt |
| Unsupported prompt | zero selected refs and zero API calls |
| Direct browser provider calls | 0 |
| Direct browser current-source calls | 0 |
| Secrets printed or committed | none |
| Access/WAF changes | none |
| Provider/model changes | none |
| Registry changes | none |

When the smoke is run during a future activation, the receipt must also record the post-activation source IDs and rollback status. A failed Access-authenticated smoke is a stop condition and requires rollback if activation mutation already occurred.

## Redaction Rules

Do not record:

- cookie values
- Access token values
- service token values
- provider keys
- runtime secret values
- raw request headers
- raw response headers
- secret-bearing redirect URLs
- complete request bodies when they contain full prompt text or source snippets
- screenshots or console output that expose any credential material

Record only method class, high-level status, source IDs, counts, route names, and non-secret telemetry.

## Activation Gate

Future Production current-source activation is blocked unless all of these are true:

1. This runbook exists in the repository.
2. `validation/scripts/check_current_source_registry_governance.py` passes.
3. A validation receipt records a passing Access-authenticated Production runtime smoke for the current baseline immediately before activation.
4. The receipt records controlled unauthenticated Access denial for `/api/source-grounded-chat`.
5. The receipt records authenticated provider-backed `/api/source-grounded-chat` execution.
6. The receipt records `0` direct browser provider calls and `0` direct browser current-source calls.
7. The receipt records no Access/WAF, provider/model, or registry change made by the smoke-method task.
8. The activation issue explicitly authorizes any later source-set mutation and keeps rollback criteria separate from this smoke-method gate.

If any item fails, do not activate additional Production current/public sources.

## Relationship To PR #255

PR #255 remains the rollback record for the failed SSDF Production activation attempt. This runbook does not change that receipt and does not retry SSDF.

The PR #255 receipt is used here only to identify the gap:

- authenticated browser baseline proved provider execution for the AI RMF-only Production posture
- direct no-Origin API smoke without credential-safe Access material hit HTTP 302 before provider execution
- rollback restored the AI RMF-only Production posture

## Validation

Run from repo root:

```bash
python3 validation/scripts/check_current_source_registry_governance.py
python3 validation/scripts/check_minimal_external_chat_proof.py
python3 scripts/build_context_pack.py
python3 validation/scripts/check_context_pack.py
python3 validation/scripts/check_artifact_manifest.py
python3 validation/scripts/run_all.py
git diff --check
```