Record live audit proof and bounded custody recovery handoff

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29

WORK-RECORDS.md

@@ -177,7 +177,7 @@
 | task | NK-WP-0045-T03 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
 | task | NK-WP-0045-T04 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
 | task | NK-WP-0045-T05 | progress | — | workplans/NK-WP-0045-root-grant-custody-record.md |
-| task | NK-WP-0045-T06 | progress | — | workplans/NK-WP-0045-root-grant-custody-record.md |
+| task | NK-WP-0045-T06 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md |
 | intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
 | intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
 | intake | NET-IN-0001 | open | — | intakes/intakes.md |

docs/evidence/2026-10-03-root-custody-audit-correlation.json

@@ -0,0 +1,19 @@
+{
+  "scope": "read-only-current-owner-audit-correlation",
+  "raw_logs_emitted": false,
+  "audit_tail_max_bytes": 67108864,
+  "transport_succeeded": true,
+  "read": {
+    "request_id": "91cd7235-9cfe-06c3-57a6-64a013d1cfcb",
+    "request_event_found": true,
+    "response_event_found": true,
+    "error_absent": true
+  },
+  "login": {
+    "request_id": "29a2fac4-8108-7ca5-d0a6-682c4a31f48d",
+    "request_event_found": true,
+    "response_event_found": true,
+    "error_absent": true
+  },
+  "ok": true
+}

docs/evidence/2026-10-03-root-grant-delivery-progress.md

@@ -152,3 +152,21 @@ Scratch copy/restore of baseline and immutable history verified content and
 permissions. Temporary daemon/storage were removed. No production snapshot
 or rollback was used. This proves the isolated recovery guard, not current
 provider backup coverage or the attended live-source restore check.
+
+## Final audit and recovery handoff
+
+The [safe audit receipt](2026-10-03-root-custody-audit-correlation.json)
+independently correlates both consumer read/login request IDs with request and
+response audit events and no errors. The bounded lookup inspected only the
+latest 64 MiB of the owner audit file; raw audit records were never emitted.
+This resolves audit correlation.
+
+USER-WP-0037-T02 is done, synced HEAD `d955cd7`; runtime workplan is finished,
+synced HEAD `f108c65`. The remaining T05 gate is the attended producer recovery
+finish helper: current retained-baseline/source match plus encrypted history
+provider upload/download/decryption through the existing governed Nextcloud
+Backup lane. Eighteen producer/finish tests passed. It preserves all backups and
+uses a unique receipt/object. The surfaced historical backup-share URL is not
+repeated or stored here; the helper compares it with the current lane only as a
+boolean and stops for owner incident handling if they match. This unresolved
+comparison is not represented as a harmless or rotated credential.

workplans/NK-WP-0045-root-grant-custody-record.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Make the platform-root custody record readable as a non-secret root-grant fact"
 domain: infotech
 repo: net-kingdom
-status: active
+status: blocked
 flavor: implementation
 owner: claude-code
 topic_slug: netkingdom
@@ -115,9 +115,13 @@ answer fixes T05.
 
 ```task
 id: NK-WP-0045-T05
-status: progress
+status: wait
 depends_on: [NK-WP-0045-T04, RPF-WP-0049-T05]
-needs_human: false
+wait_kind: both
+blocked_on: message-from:railiance-platform
+needs_human: true
+intervention_note: "Run the prepared root-custody-finish-attended.sh through the existing founder OIDC/MFA route, with a fresh receipt. This is current restore/backup readback execution; design/go-forward approval is already recorded."
+blocking_reason: "Live empty source, consumer rollout/restart/denial and audit correlation are verified. Remaining producer closure is attended current owner restore-check and governed encrypted retained-history provider upload/download/decryption evidence; no new design approval or real grant is required."
 priority: medium
 state_hub_task_id: "628e8a3b-17a4-5f97-a484-c564a87d650d"
 ```
@@ -338,3 +342,25 @@ record and accepted the latest matching record; no production rollback occurred.
 Startup limitation: each newly created pod initially hit one PostgreSQL
 connection-refused exit, then recovered to stable Ready. Source owner records
 this separately; it is not concealed as a zero-restart acceptance.
+
+## Final recovery execution handoff — 2026-10-03
+
+Live read/login audit correlation independently verified: matching request and
+response events for both exact consumer IDs, with no errors. Only the final
+64 MiB of the 6.68 GB owner audit file was searched; raw records were captured
+and suppressed. Sanitized receipt retained in delivery evidence.
+
+Producer prepared `scripts/root-custody-finish-attended.sh`: it checks the
+current live source against retained high-water state, uses the current governed
+Nextcloud Backup account/lane, enforces quota, encrypts baseline/history with
+age, creates one uniquely named object and verifies provider readback/decryption.
+It does not overwrite/delete backups or rotate credentials. Eighteen producer/
+finish tests passed. It also checks whether the historical local backup-share
+URL inadvertently surfaced during inspection matches the current lane, using
+booleans only; a current match stops before upload for the owner incident flow.
+No raw credentials are retained in evidence.
+
+T06 is complete, with user-engine synced `d955cd7` and runtime owner `f108c65`.
+T05 and the workplan return to blocked solely on the prepared attended recovery
+execution and its owner receipt. The founder's own OIDC/MFA terminal is required
+by the owner execution contract; no approval decision is reopened.