From 0f2e8734e5bf8a0232c3dab9b369df899de0cd3b Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 3 Oct 2026 21:59:22 +0200 Subject: [PATCH] Finish NK-WP-0045 with verified attended custody recovery Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29 --- ...-10-03-root-custody-recovery-verified.json | 36 ++++++++++++++++++ ...2026-10-03-root-grant-delivery-progress.md | 24 ++++++++++++ .../NK-WP-0045-root-grant-custody-record.md | 38 ++++++++++++++----- 3 files changed, 88 insertions(+), 10 deletions(-) create mode 100644 docs/evidence/2026-10-03-root-custody-recovery-verified.json diff --git a/docs/evidence/2026-10-03-root-custody-recovery-verified.json b/docs/evidence/2026-10-03-root-custody-recovery-verified.json new file mode 100644 index 0000000..7a76e0a --- /dev/null +++ b/docs/evidence/2026-10-03-root-custody-recovery-verified.json @@ -0,0 +1,36 @@ +{ + "artifact": "root-custody-history-20261003T195656Z-a52ec01b2a4a4c28ba21a52eb29e7cb7.json.age", + "ciphertext_sha256": "577498be3c6566e9622fe0d87ea3ad55063941acfab3aeb0accfc4a05dd21200", + "coordinates_only_updated": true, + "current_live_baseline_matches": true, + "decrypted_history_matches": true, + "digest": "33a2ae086385028db1b654aa5646b7a98bcde1c5878c804e19315dadc3f87248", + "escrow_and_unrelated_fields_preserved": true, + "finished_at": "2026-10-03T19:56:59.023904+00:00", + "historical_config_present": true, + "historical_credential_status": "historical-owner-and-revocation-unverified", + "historical_share_matches_current_lane": false, + "history_entries": 1, + "independent_escrow_decryption_verified": true, + "independent_escrow_recipient_matches_current_lane": true, + "kv_version": 1, + "lane_cas_noop": false, + "lane_kv_version": 3, + "local_historical_rclone_used": false, + "ok": true, + "provider": "existing-governed-nextcloud-backup", + "provider_roundtrip_verified_before_cas": true, + "published_lane_kv_version": 4, + "readback_http_status": 200, + "record_id": "nk-custody:platform-root", + "recorded_at": "2026-10-03T19:56:48.310198+00:00", + "replacement_share_created": true, + "replacement_share_id": 23, + "revision": 1, + "runtime_consumers_refreshed": false, + "scope": "current-owner-read-and-governed-history-provider-roundtrip", + "stage": "complete", + "status": "verified", + "unknown_shares_and_old_backups_preserved": true, + "upload_http_status": 201 +} diff --git a/docs/evidence/2026-10-03-root-grant-delivery-progress.md b/docs/evidence/2026-10-03-root-grant-delivery-progress.md index 3530a29..575f5dc 100644 --- a/docs/evidence/2026-10-03-root-grant-delivery-progress.md +++ b/docs/evidence/2026-10-03-root-grant-delivery-progress.md @@ -314,3 +314,27 @@ Its repo-manager remote projection preflight rejects grandfathered historical `custodian-WP-*` identifiers. Exact remote projection is therefore unproved; this compatibility blocker is separate from the provider repair and consumer refresh. Historical identifiers must not be renumbered to bypass the rejection. + +## Final attended recovery acceptance — 19:56 UTC + +Verified actual local receipt +`2026-10-03-root-custody-recovery-verified.json` against the acceptance fields. +Current custody record revision1/KV1 and digest match the independent baseline. +Encrypted history upload returned201 and owner download200; ciphertext digest +`577498be3c6566e9622fe0d87ea3ad55063941acfab3aeb0accfc4a05dd21200` matched, +and independent escrow decryption produced the exact retained history. +Provider proof preceded backup lane CAS3->4. Only upload coordinates changed; +escrow and unrelated fields, unknown shares and old backups were preserved. +Replacement share23 was created within the reviewed Backup scope. + +NK-WP-0045-T05 is done, plan finished (6/6). Actual live consumer, denial/restart, +audit and isolated Raft restore evidence recorded above remain applicable. +Runtime backup consumers were not refreshed; activity-core T08 continues to own +that requirement after its provider prerequisite was met. Historical credential +owner/revocation remains unverified in the separate platform incident. No real +custodian was certified: authoritative entries remain empty. + +Root knowledge card reloaded for closure: package0.2.4, digest +`025aab4f38246219c924bc94954e70ea0e6e7f72bcaf8d4344cd599602d345c3`, +verified-files/orientation-only. Actual authority came from the approved design +and founder-attended execution, not the knowledge card. diff --git a/workplans/NK-WP-0045-root-grant-custody-record.md b/workplans/NK-WP-0045-root-grant-custody-record.md index 2776399..455c2fb 100644 --- a/workplans/NK-WP-0045-root-grant-custody-record.md +++ b/workplans/NK-WP-0045-root-grant-custody-record.md @@ -4,7 +4,7 @@ type: workplan title: "Make the platform-root custody record readable as a non-secret root-grant fact" domain: infotech repo: net-kingdom -status: blocked +status: finished flavor: implementation owner: claude-code topic_slug: netkingdom @@ -16,9 +16,9 @@ state_hub_workstream_id: "43fbb1aa-b711-5792-b72b-07cd93ca8f45" Accepted NK-ADR-0017 makes the platform-root custody record the authority for the root grant. The non-secret schema/validator and OpenBao delivery design are -complete and approved; owner implementation is progressing. Live delivery and -user-engine acceptance remain T05/T06. Until those receipts exist, consumers -return no root grant. This work does not assign a custodian from directory or +complete and approved; live delivery, consumer acceptance and independent +retained-history recovery are verified. The published empty record returns +no root grant. This work does not assign a custodian from directory or claim projections, and no secret material enters the record. ## Accept ADR-0017 @@ -115,13 +115,13 @@ answer fixes T05. ```task id: NK-WP-0045-T05 -status: wait +status: done depends_on: [NK-WP-0045-T04, RPF-WP-0049-T05] -wait_kind: both -blocked_on: message-from:railiance-platform -needs_human: true -intervention_note: "Use the tested bounded provider share repair packet from railiance-platform once prepared, in the founder OIDC/MFA terminal with a fresh receipt. Inspection is complete; existing approval covers bounded delivery." -blocking_reason: "Inspection completed: backup lane KV3 token and expected labelled share absent from reviewed owner folder inventory. Requires tested bounded create-only share repair, verified retained-history upload/readback/decryption and expected-version CAS of only upload coordinates; source/consumer/audit remain verified." +wait_kind: null +blocked_on: null +needs_human: false +intervention_note: null +blocking_reason: null priority: medium state_hub_task_id: "628e8a3b-17a4-5f97-a484-c564a87d650d" ``` @@ -451,3 +451,21 @@ fresh receipt; actual success remains unproved until that receipt is verified. Downstream requirement is owned by `ACTIVITY-WP-0042-T08` (`020d19be-0576-5052-ad35-14b1d5a48fe1`), waiting on repaired-lane proof then reviewed source/environment refresh. T07 supplies read-only stale-client evidence. + +## Completion — 2026-10-03 19:56 UTC + +Actual founder-attended repair succeeded; verified receipt retained at +`docs/evidence/2026-10-03-root-custody-recovery-verified.json`. Current source +KV1/revision1 and canonical digest match the independent baseline. Encrypted +retained history uploaded with HTTP201, downloaded with HTTP200 and decrypted +using the independent escrow key, matching the retained history. This proof +preceded the coordinates-only backup lane CAS from version3 to4; escrow and +unrelated fields, unknown shares and old backups were preserved. + +T05 is done and the plan is finished, six of six tasks complete. The empty +record certifies no root custodian. This completion covers custody-record source, +consumer, audit and recovery acceptance; it does not certify broader scheduled +backup readiness. `ACTIVITY-WP-0042-T08` retains the source/environment consumer +refresh requirement (receipt explicitly says runtime consumers not refreshed). +Historical credential ownership/revocation remains unverified in its existing +platform incident; no historical credential was used by this recovery.