net-kingdom/workplans/archived/260702-ADHOC-2026-06-14.md

---
id: NK-WP-ADHOC-2026-06-14
type: workplan
title: "Ad hoc NetKingdom operator usability fixes"
domain: netkingdom
repo: net-kingdom
status: finished
owner: codex
topic_slug: netkingdom
created: "2026-06-14"
updated: "2026-06-14"
state_hub_workstream_id: "3ad3848e-00be-55a7-99e2-bc31047ea847"
---

> **Terminology note:** Historical text in this archived workplan may use the legacy term "workstream". The fleet term is **workplan** (`canon/standards/workplan-terminology-fleet_v0.1.md`).

# Ad hoc NetKingdom operator usability fixes

## SOPS Custody Unlock Helper

```task
id: NK-WP-ADHOC-2026-06-14-T01
status: done
priority: medium
```

Added a custody unlock helper for SOPS/age operations so drills and incident
commands can use the password-safe/offline custody age private key without
installing it permanently on a workstation.

The helper validates the supplied private key against the expected public age
recipient, writes a temporary `0600` `SOPS_AGE_KEY_FILE`, runs the requested
command or opens an incident shell, and removes the temporary key on exit.

Documented the inter-hub recovery-drill path:

```bash
make sops-custody-run COMMAND='make -C /home/worsch/inter-hub recovery-drill'
```
Clarifications on sops 2026-06-14 19:51:05 +02:00			`---`
fix(workplans): qualify archived ad-hoc identifiers The live-file pass missed these: archived ad-hocs carry a YYMMDD- filename prefix, so the ADHOC-* glob did not match them. They still derive from the forge, so they are live records rather than dead files. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006 2026-08-28 00:34:01 +02:00			`id: NK-WP-ADHOC-2026-06-14`
Clarifications on sops 2026-06-14 19:51:05 +02:00			`type: workplan`
			`title: "Ad hoc NetKingdom operator usability fixes"`
			`domain: netkingdom`
			`repo: net-kingdom`
			`status: finished`
			`owner: codex`
			`topic_slug: netkingdom`
			`created: "2026-06-14"`
			`updated: "2026-06-14"`
chore(registrar): assign State Hub identifiers Assistant: claude-code Assistant-Model: opus Assistant-Process: 3377672@bnt-lap001 Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166 2026-08-28 11:56:08 +02:00			`state_hub_workstream_id: "3ad3848e-00be-55a7-99e2-bc31047ea847"`
Clarifications on sops 2026-06-14 19:51:05 +02:00			`---`

CUST-WP-0055 T07: add archive workplan terminology grandfather note 2026-07-08 20:26:36 +02:00			> Terminology note: Historical text in this archived workplan may use the legacy term "workstream". The fleet term is workplan (`canon/standards/workplan-terminology-fleet_v0.1.md`).

Clarifications on sops 2026-06-14 19:51:05 +02:00			`# Ad hoc NetKingdom operator usability fixes`

			`## SOPS Custody Unlock Helper`

			```task
fix(workplans): qualify archived ad-hoc identifiers The live-file pass missed these: archived ad-hocs carry a YYMMDD- filename prefix, so the ADHOC-* glob did not match them. They still derive from the forge, so they are live records rather than dead files. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006 2026-08-28 00:34:01 +02:00			`id: NK-WP-ADHOC-2026-06-14-T01`
Clarifications on sops 2026-06-14 19:51:05 +02:00			`status: done`
			`priority: medium`
			```

			`Added a custody unlock helper for SOPS/age operations so drills and incident`
			`commands can use the password-safe/offline custody age private key without`
			`installing it permanently on a workstation.`

			`The helper validates the supplied private key against the expected public age`
			recipient, writes a temporary `0600` `SOPS_AGE_KEY_FILE`, runs the requested
			`command or opens an incident shell, and removes the temporary key on exit.`

			`Documented the inter-hub recovery-drill path:`

			```bash
			`make sops-custody-run COMMAND='make -C /home/worsch/inter-hub recovery-drill'`
			```