Research libraryFactories on a Weak Grid
Chapter 10 of 14 · Part III · Draft web edition
Local credentials, signed software, controlled access and recoverable evidence must keep working through communication loss.
The cloth is woven from this chapter's 4 exhibits: each weft is one exhibit's own data, normalised; each warp group is a section. The probe reads the exhibit's own value where it crosses. Procedural visualisation, not a measurement.
Read-out
Illustrative two-dimension placement of plant roles and zone transitions on local operational criticality (x-axis, 0 to 10) and offline verification strictness (y-axis, 0 to 10), derived from OT segmentation guidance in S03 and governance outcome categories in S26. Positions are analytical design allocations for GFT's proposed architecture, not measured plant security scores.
Unit: illustrative score (0 to 10). Status: illustrative. Sources: S03, S26. Illustrative figures are teaching examples, not measured factory results.
Overture · 1 min
Losing the external backhaul does not remove a factory's security dependencies. It removes online verification paths while local users, maintenance interfaces, software and records still require protection.[S03][S23][S27] Green Future Tech Limited (GFT) therefore designs the disconnected state as a distinct security mode: local Operational Technology (OT) zones retain controlled access, cached permissions expire, certificate recovery respects clock uncertainty, signed software remains verifiable, and audit evidence persists within explicit storage limits.[S03][S04][S22][S27][S1002]
This chapter extends GFT's Cameroon textile programme, whose feasibility, Performance Management System (PMS) design and digital strategy are design work rather than evidence of a commissioned facility. Earlier chapters established event identity, clock quality, local inspection and human fallback. The present task is to maintain cryptographic trust, access control, software integrity, auditability and safe incident containment when external services are absent. Enterprise data governance remains in paper wp14, regulatory analysis in wp17, and integration architecture in wp18.[S03][S25][S26] This is not legal, tax or investment advice. Referencing a security framework does not assert compliance or certification.[S26]
10.1
A flat factory network exposes machinery controllers and the production ledger to every maintenance laptop and compromised workstation, whether or not the internet router is reachable.[S03] NIST Special Publication (SP) 800-82 Revision 3 requires OT security to address performance, reliability and physical safety alongside information protection.[S03] A security control that delays a safety stop, disrupts a Programmable Logic Controller (PLC) loop or locks out a supervisor during a power transfer is therefore an operational hazard, not a harmless IT inconvenience.[S03][S05]
NIST Special Publication (SP) 800-82 Revision 3 requires OT security to address performance
S03
The NIST Cybersecurity Framework (CSF) 2.0 organises outcomes under GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND and RECOVER, but does not prescribe how to achieve them.[S26] GFT uses those categories to give each proposed control an online and disconnected behaviour, an accountable role and an acceptance observation. The organisation must still compare its Current and Target Profiles against its own mission and risk.[S26] An illustrative disconnection window of 8 to 72 hours is used only to test that thinking; it is neither a site forecast nor a compliance claim.[S05][S26]
The allocation of plant roles and zone transitions across local operational criticality and offline verification strictness is illustrated in Exhibit 39.[S03][S26]
In Exhibit 39, routine bundle scanning has an illustrative criticality score of 8.2 but a verification-strictness score of 4.2: access remains simple within a named station role. PLC modification and signed updates score higher on both axes and require dual-role authorisation. Supplier support receives strict verification and low direct line authority, with diagnostics held in the site quarantine.[S03][S04][S26] These positions are design choices, not measured security scores, and they cannot replace a site hazard study.[S03]
routine bundle scanning has an illustrative criticality score of 8.2 but a verification-strictness score of 4.2
illustrative
10.3
Related · chapter 084 paragraphs step it
Read-out
Illustrative event trace on a single sewing station across a 600-second window. At monotonic second 300, NTP recovery steps a fast holdover clock backward by 12 seconds; source_seq (101 to 105) and monotonic_ns preserve true local order while source_event_time_utc steps backward.
Unit: illustrative monotonic seconds from shift start. Status: illustrative. Sources: S10, S31, S32. Illustrative figures are teaching examples, not measured factory results.
Read this exhibit in its chapter ↗When an enterprise relies on cloud single sign-on or a headquarters directory, a backhaul failure severs the path between shop-floor terminals and the identity provider.[S03][S05] If terminals require a live online token exchange before login, an outage locks supervisors out of disposition screens and blocks technicians from acknowledging alarms; conversely, shared non-expiring accounts (such as a generic admin login taped to the cabinet) or anonymous broker writes destroy audit accountability.[S03][S13][S26]
GFT specifies a four-part offline access contract under the PROTECT (PR.AA) and GOVERN (GV.RR) categories of CSF 2.0 and NIST SP 800-82 Rev. 3:[S03][S26]
role:shift-operator (records bundle events in Zone 2), role:quality-lead (releases or rejects held bundles and authorises restricted manual inspection fallback), role:shift-supervisor (annotates anomalies, initiates manual fallback and co-signs emergency windows), role:ot-maintenance (views diagnostics, swaps spares and applies signed updates in Zones 2 and 3), and role:edge-admin (manages trust stores, journal budgets and backups in Zone 3), while traffic between capture processes, the MQTT broker and SQLite uses distinct machine credentials.[S03][S23][S26]thisUpdate and nextUpdate timestamps bounding revocation currency.[S1001] Because disconnected nodes cannot reach external Online Certificate Status Protocol (OCSP) responders or remote CRL distribution points, GFT places a local revocation list and a monotonically increasing credential_policy_seq counter on the Zone 3 controller; when a badge is lost offline, the administrator increments credential_policy_seq on Zone 3 and broadcasts the signed delta across the Local Area Network (LAN) so Zone 2 stations invalidate the cached token within the operator-approved propagation deadline.[S03][S23][S1001]role:shift-supervisor and a holder of role:ot-maintenance present their local tokens together to open a time-boxed window (an illustrative 4-hour lease), appending an EMERGENCY_ACCESS_GRANTED audit event to SQLite and the persistent system journal with both role IDs, the kernel boot_id (sd_id128_get_boot()), a 128-bit UUIDv4 or UUIDv7 identifier, the monotonic clock reading and the reason code.[S03][S05][S06][S13][S22][S31][S1005]10.4
Cold boot or backhaul return
Cold boot or backhaul return. Starting point. Leads to Check persisted NTS state (Start time recovery). · illustrative
Certificate validation needs a trustworthy wall clock, while authenticated time synchronisation uses certificate-based Transport Layer Security (TLS).
Check persisted NTS state
Check persisted NTS state. From Cold boot or backhaul return (Start time recovery). Leads to Poll NTPv4 with NTS extension fields (Valid cookie present), Load RTC and persisted disk timestamp floor (State absent or rejected). · illustrative
Poll NTPv4 with NTS extension fields
Poll NTPv4 with NTS extension fields. From Check persisted NTS state (Valid cookie present). Leads to Restore full checks and open replay (AEAD tag valid), Load RTC and persisted disk timestamp floor (Refresh required). · illustrative
Run bounded NTS-KE with pinned CA
Run bounded NTS-KE with pinned CA. From Load RTC and persisted disk timestamp floor (Apply floor). Leads to Verify chain, identity and time window (Chain signed by pinned CA), Enter CLOCK_TRUST_HOLD and block bypass (Untrusted CA or before floor). · illustrative
Verify chain, identity and time window
Verify chain, identity and time window. From Run bounded NTS-KE with pinned CA (Chain signed by pinned CA). Leads to Restore full checks and open replay (Consistent), Enter CLOCK_TRUST_HOLD and block bypass (Window mismatch). · illustrative
Restore full checks and open replay
Restore full checks and open replay. From Poll NTPv4 with NTS extension fields (AEAD tag valid), Verify chain, identity and time window (Consistent). End point. · illustrative
Enter CLOCK_TRUST_HOLD and block bypass
Enter CLOCK_TRUST_HOLD and block bypass. From Run bounded NTS-KE with pinned CA (Untrusted CA or before floor), Verify chain, identity and time window (Window mismatch). End point. · illustrative
Illustrative bootstrap sequence after cold boot or WAN restoration, based on TLS 1.3 (S23), X.509 validity rules (S1001) and NTS state persistence and certificate recovery rules (S27). A one-attempt certificate-time exception, where supported, retains chain and hostname checks and ends after authenticated time recovery. Unverified time never triggers plain NTP or unverified TLS.
Unit: . Status: illustrative. Sources: S23, S27, S1001. Illustrative figures are teaching examples, not measured factory results.
10.4 · the bodyExhibit 40 above; its figures are illustrative where marked.
Certificate validation needs a trustworthy wall clock, while authenticated time synchronisation uses certificate-based Transport Layer Security (TLS).[S23][S27][S1001] After a cold boot with a failed or uninitialised real-time clock (RTC), an edge device can therefore reject a valid server certificate as expired or not yet valid, and authenticated time recovery stalls just when the plant needs to reconnect.[S27][S30][S1001]
For restored site and remote connections, GFT specifies TLS 1.3 as defined by RFC 9846, published in July 2026, subject to qualification of the actual device library.[S23] The implementation must retain strict service identity verification and must not silently negotiate an obsolete protocol version when authentication fails.[S23][S1003]
Two TLS 1.3 features need explicit policy. Session resumption can use pre-shared keys with an ephemeral key share for forward secrecy, while externally provisioned keys require cryptographic entropy rather than passwords.[S23] Zero round-trip time (0-RTT) early data lacks the same replay protection as a full handshake.[S23] Idempotent event replay still needs application deduplication, but a repeated configuration or state-reset command could cause a second business action. GFT therefore disables 0-RTT on control, configuration and security channels.[S12][S23][S31]
RFC 8915 separates Network Time Security (NTS) into TLS-based NTS Key Establishment (NTS-KE) and authenticated NTP extension fields. The server remains stateless by giving the client opaque cookies, while the client retains the keys and cookies needed for later authenticated NTP exchanges.[S10][S27]
X.509 certificates carry notBefore and notAfter limits, so ordinary validation cannot complete when the client clock is outside the certificate window.[S1001] RFC 8915 permits a carefully bounded approach to this initialisation problem, but also warns against NTS stripping: an attacker can obstruct key establishment or induce a client to abandon authenticated time.[S27] A permanent certificate-time bypass or automatic return to plain NTP is therefore unacceptable.[S27][S30]
NTS-KE exchange.[S27][S30] Because state may be written on orderly shutdown or on an explicit dump, commissioning must prove that the chosen atomic-write and dump schedule survives abrupt power loss. Absent, exhausted or rejected state returns the device to key establishment, not to plain NTP.[S27][S30]NTS-KE, the stack may exempt certificate-time checking for one key-establishment attempt while retaining certificate-chain and hostname verification. It confirms that notAfter is later than the disk floor, then accepts an authenticated NTP reply only when that reply lies inside the certificate validity window.[S27][S1001] A stack without such a bounded control enters recovery hold.notBefore and notAfter checks for later TLS connections.[S27][S1001]CLOCK_TRUST_HOLD. Local capture continues with sequence and clock-quality flags, while remote replay waits for authorised review.[S03][S27][S30]The decision sequence coupling TLS 1.3 certificate validation and NTS time recovery after cold boot is shown in Exhibit 40.[S23][S27][S1001]
The decision sequence coupling TLS 1.3 certificate validation and NTS time recovery after cold…
S23, S27, S1001
As Exhibit 40 shows, valid persisted NTS state can avoid a fresh key-establishment exchange after a routine restart.[S27][S30] Missing or rejected state invokes the bounded recovery path. Firmware verification protects the approved boot chain, but it does not prove that the RTC and storage were not physically replaced; that stronger claim would need separate hardware attestation and tamper evidence.[S04][S27]
10.7
On an intermittent grid, an abrupt power cut can force an edge gateway through an unscheduled reboot unless its protected supply rides through.[S03][S05] If an operator assumes every reboot is benign, an adversary or corrupted update can modify the boot loader, kernel, container image or configuration while offline and rely on the next power cycle to execute the altered code, while a brownout during an unprotected write can leave a boot partition unbootable.[S04][S15][S25]
NIST SP 800-193 ("Platform Firmware Resiliency Guidelines", May 2018) organises resiliency around three properties that GFT extends across platform boot firmware and the local software stack:[S04]
Protect). Preserves firmware and boot configuration integrity through hardware roots of trust, write-protected memory regions and signature verification before flash writes.[S04]Detect). Detects corruption or unauthorised modification through a Root of Trust for Detection (RTD), or a chain anchored in one, using trusted comparison against authorised reference values. Measurements from a verified boot chain can support that decision but do not replace it.[S04][S1002]Recover). Restores firmware and critical data to a known-good state when tampering or corruption is detected, so recovery does not depend on executing the previously running image.[S04]Recovering from an electrical outage differs fundamentally from recovering from a security compromise or integrity failure.[S04][S06][S25] After an ordinary mains failure where verified boot measurements confirm that firmware, OS image and signed binaries match approved digests, the node executes power-loss recovery: it checks the filesystem journal, replays or rolls back the SQLite write-ahead log (WAL) as analysed in Chapter 6, verifies the last committed source_seq and resumes capture.[S04][S13][S16][S29]
When a boot measurement, file-integrity check or journal seal verification fails, or an intrusion indicator triggers under NIST SP 800-61 Rev. 3, treating the event as a normal power-cut restart is unsafe: re-executing the mutable snapshot reloads the tampered state, and copying or replaying a SQLite database written by a compromised process via SQLite Backup API (S17) pollutes the central ledger.[S04][S13][S17][S25][S1004] GFT therefore enforces two architectural controls:[S04][S06][S25]
noexec, nosuid and nodev.[S04][S21][S22][S1002]Interlude · the cloth half-woven
Woven: sections 10.0 to 10.7Still to weave: 10.9 to 10.15
10.9
When an illustrative fleet of 30 edge stations pulls large OS or vision-model updates over constrained backhaul, downloads can compete with event replay and truncate on power loss.[S03][S18] The proposed design therefore uses a local staging server in Zone 3 or controlled removable media. Because removable media and maintenance laptops can bypass OT defences under NIST SP 800-82 Rev. 3, GFT adopts the transport-agnostic signed manifest architecture in RFC 9019 ("A Firmware Update Architecture for Internet of Things", April 2021) alongside NIST SP 800-193 and SP 800-184.[S03][S04][S06][S1002]
manifest_seq that may not be lower than the device's protected security watermark. A same-version reinstall is permitted only by explicit policy; otherwise the new sequence must be strictly greater. The watermark advances only after the trial boot passes its health checks, so recovery to the previous slot remains possible.[S04][S1002]TRIAL_BOOT under readiness checks and a hardware watchdog. The software must verify its SQLite schema, open capture and pass self-test within an illustrative 120-second deadline. Only then does it commit the slot and security watermark; otherwise it reverts to Slot A and logs UPDATE_ROLLBACK_EXECUTED.[S04][S06][S13][S21]Before activating a staged package offline, the station writes a signed maintenance event into its SQLite audit outbox and flushes its journal (journalctl --sync), recording technician role ID, old and new manifest_seq and SHA-256 digests, pre-update source_seq, kernel boot_id and timestamp with clock-quality state.[S13][S22][S1004][S1005] When backhaul returns, the Zone 4 worker replays these records over the outbound TLS 1.3 channel alongside production events, never requiring inbound WAN ports.[S03][S23]
10.12
Security partition
Security partition: total 4,000. Running total 4,000 decimal megabytes (MB) · derived
Volatile logs can erase the evidence of events preceding a power cut.
Sealed journals
Sealed journals: removes 1,000. Running total 3,000 decimal megabytes (MB) · derived
Update staging
Update staging: removes 1,200. Running total 1,800 decimal megabytes (MB) · derived
Forensic snapshot
Forensic snapshot: removes 600. Running total 1,200 decimal megabytes (MB) · derived
KeepFree floor
KeepFree floor: removes 400. Running total 800 decimal megabytes (MB) · derived
Contingency reserve
Contingency reserve: total 800. Running total 800 decimal megabytes (MB) · derived
The method behind it: Method.
Derived from an illustrative 4,000 MB local security and maintenance partition budget using the journal sizing and sealing mechanisms in S22 and S1004 and the staged update manifest architecture in S1002. Allocations subtract 1,000 MB for persistent sealed journals (SystemMaxUse), 1,200 MB for signed update staging, 600 MB for incident forensic snapshots and 400 MB for the filesystem keep-free floor, leaving an 800 MB contingency reserve.
Unit: decimal megabytes (MB). Status: derived. Sources: S22, S1002, S1004.
10.12 · the bodyExhibit 42 above; its figures are illustrative where marked.
journald.conf persistence and limitsOn Linux edge gateways, GFT configures systemd-journald through drop-in files and reads back the effective settings during commissioning.[S22]
Storage=persistent selects /var/log/journal on disk, with early-boot data flushed from volatile storage when the persistent location becomes available. GFT places that directory on a non-volatile partition separate from SQLite.[S13][S22]SystemMaxUse=, SystemKeepFree=, SystemMaxFileSize= and SystemMaxFiles= govern rotation and disk use. These are not absolute caps or retention guarantees: vacuuming removes archived files, while active files can remain above the configured limit. The dedicated partition, not SystemMaxUse= alone, protects the production ledger from log growth.[S14][S22]RateLimitIntervalSec= and RateLimitBurst= bound messages accepted from each service, and dropped-message counts must remain visible. Commissioning injects a noisy-service fault rather than assuming defaults fit the site.[S22]SyncIntervalSec= controls periodic disk synchronisation, while CRIT, ALERT and EMERG events trigger immediate synchronisation. GFT also writes security events to its transactional audit outbox and disables console forwarding where a stalled console could obstruct logging.[S13][S22]Persistence alone does not prevent a local administrator from altering or deleting records before reconnection.[S22][S1004] Forward Secure Sealing (FSS), enabled with Seal=yes and initialised through journalctl --setup-keys, adds verifiable sealing epochs. The sealing key remains on the host and ratchets forward, while the verification key is held separately.[S22][S1004]
journalctl --verify --verify-key=KEY can detect alterations within the sealed journal files presented to it. It cannot prove that a complete log was received, detect the absence of a deleted directory on its own, or recover deleted bytes.[S1004] GFT therefore keeps an independent file-and-epoch inventory and replicates critical security records to the site collector when the LAN is available. Entries since the latest sealing epoch still require that continuity check.[S22][S1004][S1005]
The source-based controls governing firmware resiliency, persistent sealed logging and incident recovery, together with GFT's proposed commissioning evidence, are compiled in Exhibit 41.[S04][S22][S25][S1004]
As summarised in Exhibit 41, every security control that matters during an outage has both a concrete configuration mechanism in primary technical documentation (S04, S22, S25, S1004) and an observable commissioning test, whereas relying on OS defaults leaves a plant discovering after an incident that logs were held only in volatile /run/log/journal.[S04][S22][S25][S1004]
Exhibit 42 reconciles the illustrative 4,000 MB allocation to its closing 800 MB reserve.[S22][S1002][S1004]
Exhibit 42 reconciles the illustrative 4,000 MB allocation to its closing 800 MB reserve
S22, S1002, S1004 · illustrative
The waterfall shows capacity allocation, not observed behaviour. Separating P_sec from the SQLite ledger contains the direct disk-space effect of a journal flood, while the illustrative 1,000 MB journal budget, 1,200 MB update reserve, 600 MB forensic reserve and 400 MB keep-free floor make trade-offs reviewable.[S13][S22] Commissioning must still measure arrival rates, active-file behaviour and record survival under fault injection; no retention or availability claim follows from the arithmetic alone.[S22][S28]
10.15
Related · chapter 118 paragraphs step it
Read-out
Illustrative recovery order proposed by GFT. Equal numeric positions show precedence only and carry no measured or promised durations. Remote replay may transmit after local capture is ready, but its closure remains subject to reconciliation and release evidence.
Unit: illustrative dependency position, not elapsed time. Status: illustrative. Sources: S03, S05, S21. Illustrative figures are teaching examples, not measured factory results.
Read this exhibit in its chapter ↗When a security alert, unexpected configuration change or failed integrity seal occurs on a factory node, the response playbook cannot copy an office Information Technology (IT) procedure.[S03][S25] On a textile shop floor, where gateways interface with spinning frames, dye vats, stenters and conveyors, an uncoordinated digital isolation or forced shutdown by an automated tool can strand heated or tensioned fabric, blind operators to alarms or cause an unsafe mechanical stop.[S03][S25]
NIST SP 800-61 Revision 3 ("Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile", April 2025, superseding Revision 2 from August 2012) integrates incident response across the six CSF 2.0 Functions (GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND and RECOVER); combined with NIST SP 800-184 (December 2016) and NIST SP 800-82 Rev. 3, any incident response on a weak-grid factory floor must preserve safe physical control and capture local evidence before eradication overwrites the device.[S03][S06][S25][S26]
To contain a suspected compromise or corrupted update while disconnected without endangering personnel or machinery, GFT specifies a four-step outward-in sequence:[S03][S06][S25]
/var/lib/gft-forensics or approved quarantine media: flush and verify sealed journals (journalctl --sync and journalctl --verify --verify-key=KEY), capture an online SQLite snapshot via the SQLite Backup API (S17) alongside WAL state (S14, S16) and active kernel boot_id (S1005), and record running firmware digests (S04) and chrony status (S30).[S04][S06][S14][S16][S17][S22][S25][S30][S1004][S1005]S04) or replaced with a pre-commissioned spare, re-provisioned with credentials and NTS keys from Zone 3 (S23, S27), and its quarantined events are reconciled against adjacent station ledgers before release into the central PMS.[S04][S06][S13][S25]NIST SP 800-184 and NIST SP 800-61 Rev. 3 stress that recovery playbooks work only when tested under realistic conditions; GFT requires three disconnected security drills prior to pilot expansion (linked to Chapter 13):[S06][S25][S26]
S27, S30), refuses NTS stripping to plain NTP (S27), and either completes authenticated NTS-KE over TLS 1.3 (S23) or enters CLOCK_TRUST_HOLD without halting capture.[S23][S27][S30]role:shift-supervisor plus role:ot-maintenance), verify that SQLite and the sealed journal record the elevation at CRIT priority (S13, S22), stage a signed RFC 9019 update to Slot B (S1002), cut power during trial activation, and prove automatic rollback to Slot A (S04) without losing any committed record.[S04][S13][S22][S1002]journalctl --verify check on one Zone 2 station while disconnected (S25, S1004), execute Zone 3 broker quarantine and manual capture handover without disturbing Zone 1 PLCs (S03), capture the SQLite Backup API snapshot (S17) and sealed journal archive (S1004), and verify that the PMS console holds the bay unreconciled until supervisor and quality sign-off completes.[S03][S17][S25][S1004]Trust boundaries, cached credentials, coupled time-and-certificate recovery, verified boot slots, signed offline manifests, sealed partition-bounded journals and OT-safe containment give operators a controlled alternative to halting production or abandoning security when the cloud is unavailable.[S03][S04][S22][S25][S27]
Check the record
Every knot is a source this chapter cites; select one to read its record, or filter the register by grade. Publication dates and inherited-source limits stay explicit. Read the paper's full evidence summary.
28 sources · 302 citation marks on this pageMost cited: S03, 40 times
Grade AGrade BGrade CKnot size: citations on this page
All 28 records shown
c10-S03 · Grade A
SP 800-82 Rev. 3: Guide to Operational Technology (OT) Security
This document provides guidance on how to secure operational technology (OT) while addressing their unique performance, reliability, and safety requirements.
2023. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c10-S04 · Grade A
SP 800-193: Platform Firmware Resiliency Guidelines
This document provides technical guidelines and recommendations supporting resiliency of platform firmware and data against potentially destructive attacks.
2018. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c10-S05 · Grade A
SP 800-34 Rev. 1: Contingency Planning Guide for Federal Information Systems
This document provides guidance to help personnel evaluate information systems and operations to determine contingency planning requirements and priorities.
2010. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c10-S06 · Grade A
SP 800-184: Guide for Cybersecurity Event Recovery
This publication provides tactical and strategic guidance regarding the planning, playbook developing, testing, and improvement of recovery planning.
2016. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c10-S10 · Grade A
RFC 5905: Network Time Protocol Version 4: Protocol and Algorithms Specification
A client synchronizes to one or more upstream servers, but does not provide synchronization to dependent clients.
2010. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c10-S12 · Grade A
RFC 9110: HTTP Semantics
Of the request methods defined by this specification, PUT, DELETE, and safe request methods are idempotent.
2022. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c10-S13 · Grade A
Atomic Commit In SQLite
Atomic commit means that either all database changes within a single transaction occur or none of them occur.
2026-10-30. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c10-S14 · Grade A
Write-Ahead Logging
All processes using a database must be on the same host computer; WAL does not work over a network filesystem.
2026-10-30. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c10-S15 · Grade A
How To Corrupt An SQLite Database File
Though SQLite is resistant to database corruption, it is not immune.
2026-10-30. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c10-S16 · Grade A
PRAGMA Statements
A transaction committed in WAL mode with synchronous=NORMAL might roll back following a power loss or system crash.
2026-10-30. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c10-S17 · Grade A
SQLite Backup API
This allows other database users to continue without excessive delays while a backup of an online database is made.
2026-10-30. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c10-S18 · Grade A
RFC 7228: Terminology for Constrained-Node Networks
Such a network may itself exhibit constraints, e.g., with unreliable or lossy channels, limited and unpredictable bandwidth, and a highly dynamic topology.
2014. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c10-S20 · Grade A
mosquitto.conf man page
If enabled, connection, subscription and message data will be written to disk in mosquitto.db at the location dictated by persistence_location.
2026-10-30. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c10-S21 · Grade A
systemd.service
The service specific configuration options are configured in the [Service] section.
2026-10-30. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c10-S22 · Grade A
journald.conf
Controls where to store journal data.
2026-10-30. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c10-S23 · Grade A
RFC 9846: The Transport Layer Security (TLS) Protocol Version 1.3
This document specifies version 1.3 of the Transport Layer Security (TLS) protocol.
2026. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c10-S25 · Grade A
SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management
Readers are encouraged to utilize online resources in conjunction with this document to access additional information on implementing these recommendations and considerations.
2025. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c10-S26 · Grade A
The NIST Cybersecurity Framework (CSF) 2.0
The CSF does not prescribe how outcomes should be achieved.
2024-02-26. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c10-S27 · Grade A
RFC 8915: Network Time Security for the Network Time Protocol
This memo specifies Network Time Security (NTS), a cryptographic security mechanism for network time synchronization.
2020. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c10-S28 · Grade A
How SQLite Is Tested
It is impractical to do crash testing using real power failures, of course, and so crash testing is done in simulation.
2026-10-30. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c10-S29 · Grade A
ext4 General Information
Write barriers enforce proper on-disk ordering of journal commits, making volatile disk write caches safe to use, at some performance penalty.
2026-10-30. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c10-S30 · Grade A
Frequently Asked Questions
The rtcfile directive with the -s option can be used to compensate for the RTC drift.
2026-10-30. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c10-S31 · Grade A
RFC 9562: Universally Unique IDentifiers (UUIDs)
A UUID is 128 bits long and requires no central registration process.
2024. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c10-S1001 · Grade A
RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
The field is represented as a SEQUENCE of two dates: the date on which the certificate validity period begins (notBefore) and the date on which the certificate validity period ends (notAfter).
2008-05. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c10-S1002 · Grade A
RFC 9019: A Firmware Update Architecture for Internet of Things
In addition to the definition of terminology and an architecture, this document provides the motivation for the standardization of a manifest format as a transport-agnostic means for describing and protecting firmware updates.
2021-04. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c10-S1003 · Grade A
RFC 9325: Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS)
This document provides the latest recommendations for ensuring the security of deployed services that use TLS and DTLS.
2022-11. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c10-S1004 · Grade A
journalctl
If the file has been generated with FSS enabled and the FSS verification key has been specified with --verify-key=, authenticity of the journal file is verified.
2026-10-30. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c10-S1005 · Grade A
sd_id128_get_machine
It is randomly generated early at boot and is unique for every running kernel instance.
2026-10-30. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗S03 NIST. 2023.
S23 IETF / RFC Editor. 2026.
S27 IETF / RFC Editor. 2020.
S04 NIST. 2018.
S22 systemd project. 2026-10-30.
S1002 IETF / RFC Editor. 2021-04.
S25 NIST. 2025.
S26 NIST. 2024-02-26.
S05 NIST. 2010.
S13 SQLite. 2026-10-30.
S30 chrony project. 2026-10-30.
S1001 IETF / RFC Editor. 2008-05.
S06 NIST. 2016.
S31 IETF / RFC Editor. 2024.
S1005 systemd project. 2026-10-30.
S1003 IETF / RFC Editor. 2022-11.
S12 IETF / RFC Editor. 2022.
S10 IETF / RFC Editor. 2010.
S15 SQLite. 2026-10-30.
S16 SQLite. 2026-10-30.
S29 Linux kernel project. 2026-10-30.
S17 SQLite. 2026-10-30.
S1004 systemd project. 2026-10-30.
S21 systemd project. 2026-10-30.
S18 IETF / RFC Editor. 2014.
S14 SQLite. 2026-10-30.
S28 SQLite. 2026-10-30.
S20 Eclipse Mosquitto. 2026-10-30.
Keep the thread · chapter 10 of 14
Move the shuttle along the rack to preview any chapter: its sections, exhibits and reading time. Draft web edition. This research is not investment, legal or tax advice; illustrative models are not measured factory results.
The paper's rack · 14 boltsBolt length: reading time
01Part I: Specify the interruption
GFT argues that continuity means retaining a safe operating state and an accountable record through interruption and recovery.
02Part I: Specify the interruption
A useful design envelope records the duration, coincidence and recovery of power and network failures at the intended site.
03Part I: Specify the interruption
Criticality, allowable staleness and restart dependencies should be assigned before choosing equipment or a cloud platform.
04Part II: Keep the local record alive
Protecting a selected record-keeping load can be practical even when the production machinery must stop.
05Part II: Keep the local record alive
Local name resolution, switching, identity and observability need their own continuity plan when external connectivity disappears.
06Part II: Keep the local record alive
The transaction boundary, storage path and acknowledgement semantics decide whether a production record survives abrupt loss.
07Part II: Keep the local record alive
Offline retention and recovery capacity must be designed together so a restored connection can clear its accumulated work.
08Part III: Recover a trustworthy operation
A trustworthy record separates identifiers, source sequence and clock quality so reconciliation can explain what happened during disconnection.
09Part III: Recover a trustworthy operation
An edge model supports continuity only when its inputs, licence, operator interface and fallback remain usable without the cloud.
10Part III: Recover a trustworthy operation
Local credentials, signed software, controlled access and recoverable evidence must keep working through communication loss.
11Part III: Recover a trustworthy operation
Boot order, consistent backups, authorised process release and ledger reconciliation decide whether restoration is complete.
12Part IV: Prove and govern continuity
Compare service classes using transparent operating assumptions and procurement obligations rather than promised resilience percentages.
13Part IV: Prove and govern continuity
A repeatable fault programme should verify declared losses, restart behaviour and reconciled records before a pilot is expanded.
14Part IV: Prove and govern continuity
GFT recommends a staged programme that measures site conditions, proves a local record and expands only when recovery evidence supports it.