coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish NK-WP-0045 with verified attended custody recovery
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29
This commit is contained in:
tegwick 2026-10-03 21:59:22 +02:00
parent 9c8655af30
commit 0f2e8734e5
3 changed files with 88 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

36
docs/evidence/2026-10-03-root-custody-recovery-verified.json Normal file
View file

@ -0,0 +1,36 @@
{
"artifact": "root-custody-history-20261003T195656Z-a52ec01b2a4a4c28ba21a52eb29e7cb7.json.age",
"ciphertext_sha256": "577498be3c6566e9622fe0d87ea3ad55063941acfab3aeb0accfc4a05dd21200",
"coordinates_only_updated": true,
"current_live_baseline_matches": true,
"decrypted_history_matches": true,
"digest": "33a2ae086385028db1b654aa5646b7a98bcde1c5878c804e19315dadc3f87248",
"escrow_and_unrelated_fields_preserved": true,
"finished_at": "2026-10-03T19:56:59.023904+00:00",
"historical_config_present": true,
"historical_credential_status": "historical-owner-and-revocation-unverified",
"historical_share_matches_current_lane": false,
"history_entries": 1,
"independent_escrow_decryption_verified": true,
"independent_escrow_recipient_matches_current_lane": true,
"kv_version": 1,
"lane_cas_noop": false,
"lane_kv_version": 3,
"local_historical_rclone_used": false,
"ok": true,
"provider": "existing-governed-nextcloud-backup",
"provider_roundtrip_verified_before_cas": true,
"published_lane_kv_version": 4,
"readback_http_status": 200,
"record_id": "nk-custody:platform-root",
"recorded_at": "2026-10-03T19:56:48.310198+00:00",
"replacement_share_created": true,
"replacement_share_id": 23,
"revision": 1,
"runtime_consumers_refreshed": false,
"scope": "current-owner-read-and-governed-history-provider-roundtrip",
"stage": "complete",
"status": "verified",
"unknown_shares_and_old_backups_preserved": true,
"upload_http_status": 201
}

24
docs/evidence/2026-10-03-root-grant-delivery-progress.md
View file

@ -314,3 +314,27 @@ Its repo-manager remote projection preflight rejects grandfathered historical
`custodian-WP-*` identifiers. Exact remote projection is therefore unproved;
this compatibility blocker is separate from the provider repair and consumer
refresh. Historical identifiers must not be renumbered to bypass the rejection.
## Final attended recovery acceptance — 19:56 UTC
Verified actual local receipt
`2026-10-03-root-custody-recovery-verified.json` against the acceptance fields.
Current custody record revision1/KV1 and digest match the independent baseline.
Encrypted history upload returned201 and owner download200; ciphertext digest
`577498be3c6566e9622fe0d87ea3ad55063941acfab3aeb0accfc4a05dd21200` matched,
and independent escrow decryption produced the exact retained history.
Provider proof preceded backup lane CAS3->4. Only upload coordinates changed;
escrow and unrelated fields, unknown shares and old backups were preserved.
Replacement share23 was created within the reviewed Backup scope.
NK-WP-0045-T05 is done, plan finished (6/6). Actual live consumer, denial/restart,
audit and isolated Raft restore evidence recorded above remain applicable.
Runtime backup consumers were not refreshed; activity-core T08 continues to own
that requirement after its provider prerequisite was met. Historical credential
owner/revocation remains unverified in the separate platform incident. No real
custodian was certified: authoritative entries remain empty.
Root knowledge card reloaded for closure: package0.2.4, digest
`025aab4f38246219c924bc94954e70ea0e6e7f72bcaf8d4344cd599602d345c3`,
verified-files/orientation-only. Actual authority came from the approved design
and founder-attended execution, not the knowledge card.

38
workplans/NK-WP-0045-root-grant-custody-record.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Make the platform-root custody record readable as a non-secret root-grant fact"
domain: infotech
repo: net-kingdom
status: blocked
status: finished
flavor: implementation
owner: claude-code
topic_slug: netkingdom
@ -16,9 +16,9 @@ state_hub_workstream_id: "43fbb1aa-b711-5792-b72b-07cd93ca8f45"
Accepted NK-ADR-0017 makes the platform-root custody record the authority for
the root grant. The non-secret schema/validator and OpenBao delivery design are
complete and approved; owner implementation is progressing. Live delivery and
user-engine acceptance remain T05/T06. Until those receipts exist, consumers
return no root grant. This work does not assign a custodian from directory or
complete and approved; live delivery, consumer acceptance and independent
retained-history recovery are verified. The published empty record returns
no root grant. This work does not assign a custodian from directory or
claim projections, and no secret material enters the record.
## Accept ADR-0017
@ -115,13 +115,13 @@ answer fixes T05.
```task
id: NK-WP-0045-T05
status: wait
status: done
depends_on: [NK-WP-0045-T04, RPF-WP-0049-T05]
wait_kind: both
blocked_on: message-from:railiance-platform
needs_human: true
intervention_note: "Use the tested bounded provider share repair packet from railiance-platform once prepared, in the founder OIDC/MFA terminal with a fresh receipt. Inspection is complete; existing approval covers bounded delivery."
blocking_reason: "Inspection completed: backup lane KV3 token and expected labelled share absent from reviewed owner folder inventory. Requires tested bounded create-only share repair, verified retained-history upload/readback/decryption and expected-version CAS of only upload coordinates; source/consumer/audit remain verified."
wait_kind: null
blocked_on: null
needs_human: false
intervention_note: null
blocking_reason: null
priority: medium
state_hub_task_id: "628e8a3b-17a4-5f97-a484-c564a87d650d"
```
@ -451,3 +451,21 @@ fresh receipt; actual success remains unproved until that receipt is verified.
Downstream requirement is owned by `ACTIVITY-WP-0042-T08`
(`020d19be-0576-5052-ad35-14b1d5a48fe1`), waiting on repaired-lane proof then
reviewed source/environment refresh. T07 supplies read-only stale-client evidence.
## Completion — 2026-10-03 19:56 UTC
Actual founder-attended repair succeeded; verified receipt retained at
`docs/evidence/2026-10-03-root-custody-recovery-verified.json`. Current source
KV1/revision1 and canonical digest match the independent baseline. Encrypted
retained history uploaded with HTTP201, downloaded with HTTP200 and decrypted
using the independent escrow key, matching the retained history. This proof
preceded the coordinates-only backup lane CAS from version3 to4; escrow and
unrelated fields, unknown shares and old backups were preserved.
T05 is done and the plan is finished, six of six tasks complete. The empty
record certifies no root custodian. This completion covers custody-record source,
consumer, audit and recovery acceptance; it does not certify broader scheduled
backup readiness. `ACTIVITY-WP-0042-T08` retains the source/environment consumer
refresh requirement (receipt explicitly says runtime consumers not refreshed).
Historical credential ownership/revocation remains unverified in its existing
platform incident; no historical credential was used by this recovery.