Finish NK-WP-0045 with verified attended custody recovery

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29

docs/evidence/2026-10-03-root-custody-recovery-verified.json

@@ -0,0 +1,36 @@
+{
+  "artifact": "root-custody-history-20261003T195656Z-a52ec01b2a4a4c28ba21a52eb29e7cb7.json.age",
+  "ciphertext_sha256": "577498be3c6566e9622fe0d87ea3ad55063941acfab3aeb0accfc4a05dd21200",
+  "coordinates_only_updated": true,
+  "current_live_baseline_matches": true,
+  "decrypted_history_matches": true,
+  "digest": "33a2ae086385028db1b654aa5646b7a98bcde1c5878c804e19315dadc3f87248",
+  "escrow_and_unrelated_fields_preserved": true,
+  "finished_at": "2026-10-03T19:56:59.023904+00:00",
+  "historical_config_present": true,
+  "historical_credential_status": "historical-owner-and-revocation-unverified",
+  "historical_share_matches_current_lane": false,
+  "history_entries": 1,
+  "independent_escrow_decryption_verified": true,
+  "independent_escrow_recipient_matches_current_lane": true,
+  "kv_version": 1,
+  "lane_cas_noop": false,
+  "lane_kv_version": 3,
+  "local_historical_rclone_used": false,
+  "ok": true,
+  "provider": "existing-governed-nextcloud-backup",
+  "provider_roundtrip_verified_before_cas": true,
+  "published_lane_kv_version": 4,
+  "readback_http_status": 200,
+  "record_id": "nk-custody:platform-root",
+  "recorded_at": "2026-10-03T19:56:48.310198+00:00",
+  "replacement_share_created": true,
+  "replacement_share_id": 23,
+  "revision": 1,
+  "runtime_consumers_refreshed": false,
+  "scope": "current-owner-read-and-governed-history-provider-roundtrip",
+  "stage": "complete",
+  "status": "verified",
+  "unknown_shares_and_old_backups_preserved": true,
+  "upload_http_status": 201
+}

docs/evidence/2026-10-03-root-grant-delivery-progress.md

@@ -314,3 +314,27 @@ Its repo-manager remote projection preflight rejects grandfathered historical
 `custodian-WP-*` identifiers. Exact remote projection is therefore unproved;
 this compatibility blocker is separate from the provider repair and consumer
 refresh. Historical identifiers must not be renumbered to bypass the rejection.
+
+## Final attended recovery acceptance — 19:56 UTC
+
+Verified actual local receipt
+`2026-10-03-root-custody-recovery-verified.json` against the acceptance fields.
+Current custody record revision1/KV1 and digest match the independent baseline.
+Encrypted history upload returned201 and owner download200; ciphertext digest
+`577498be3c6566e9622fe0d87ea3ad55063941acfab3aeb0accfc4a05dd21200` matched,
+and independent escrow decryption produced the exact retained history.
+Provider proof preceded backup lane CAS3->4. Only upload coordinates changed;
+escrow and unrelated fields, unknown shares and old backups were preserved.
+Replacement share23 was created within the reviewed Backup scope.
+
+NK-WP-0045-T05 is done, plan finished (6/6). Actual live consumer, denial/restart,
+audit and isolated Raft restore evidence recorded above remain applicable.
+Runtime backup consumers were not refreshed; activity-core T08 continues to own
+that requirement after its provider prerequisite was met. Historical credential
+owner/revocation remains unverified in the separate platform incident. No real
+custodian was certified: authoritative entries remain empty.
+
+Root knowledge card reloaded for closure: package0.2.4, digest
+`025aab4f38246219c924bc94954e70ea0e6e7f72bcaf8d4344cd599602d345c3`,
+verified-files/orientation-only. Actual authority came from the approved design
+and founder-attended execution, not the knowledge card.

workplans/NK-WP-0045-root-grant-custody-record.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Make the platform-root custody record readable as a non-secret root-grant fact"
 domain: infotech
 repo: net-kingdom
-status: blocked
+status: finished
 flavor: implementation
 owner: claude-code
 topic_slug: netkingdom
@@ -16,9 +16,9 @@ state_hub_workstream_id: "43fbb1aa-b711-5792-b72b-07cd93ca8f45"
 
 Accepted NK-ADR-0017 makes the platform-root custody record the authority for
 the root grant. The non-secret schema/validator and OpenBao delivery design are
-complete and approved; owner implementation is progressing. Live delivery and
+complete and approved; live delivery, consumer acceptance and independent
-user-engine acceptance remain T05/T06. Until those receipts exist, consumers
+retained-history recovery are verified. The published empty record returns
-return no root grant. This work does not assign a custodian from directory or
+no root grant. This work does not assign a custodian from directory or
 claim projections, and no secret material enters the record.
 
 ## Accept ADR-0017
@@ -115,13 +115,13 @@ answer fixes T05.
 
 ```task
 id: NK-WP-0045-T05
-status: wait
+status: done
 depends_on: [NK-WP-0045-T04, RPF-WP-0049-T05]
-wait_kind: both
+wait_kind: null
-blocked_on: message-from:railiance-platform
+blocked_on: null
-needs_human: true
+needs_human: false
-intervention_note: "Use the tested bounded provider share repair packet from railiance-platform once prepared, in the founder OIDC/MFA terminal with a fresh receipt. Inspection is complete; existing approval covers bounded delivery."
+intervention_note: null
-blocking_reason: "Inspection completed: backup lane KV3 token and expected labelled share absent from reviewed owner folder inventory. Requires tested bounded create-only share repair, verified retained-history upload/readback/decryption and expected-version CAS of only upload coordinates; source/consumer/audit remain verified."
+blocking_reason: null
 priority: medium
 state_hub_task_id: "628e8a3b-17a4-5f97-a484-c564a87d650d"
 ```
@@ -451,3 +451,21 @@ fresh receipt; actual success remains unproved until that receipt is verified.
 Downstream requirement is owned by `ACTIVITY-WP-0042-T08`
 (`020d19be-0576-5052-ad35-14b1d5a48fe1`), waiting on repaired-lane proof then
 reviewed source/environment refresh. T07 supplies read-only stale-client evidence.
+
+## Completion — 2026-10-03 19:56 UTC
+
+Actual founder-attended repair succeeded; verified receipt retained at
+`docs/evidence/2026-10-03-root-custody-recovery-verified.json`. Current source
+KV1/revision1 and canonical digest match the independent baseline. Encrypted
+retained history uploaded with HTTP201, downloaded with HTTP200 and decrypted
+using the independent escrow key, matching the retained history. This proof
+preceded the coordinates-only backup lane CAS from version3 to4; escrow and
+unrelated fields, unknown shares and old backups were preserved.
+
+T05 is done and the plan is finished, six of six tasks complete. The empty
+record certifies no root custodian. This completion covers custody-record source,
+consumer, audit and recovery acceptance; it does not certify broader scheduled
+backup readiness. `ACTIVITY-WP-0042-T08` retains the source/environment consumer
+refresh requirement (receipt explicitly says runtime consumers not refreshed).
+Historical credential ownership/revocation remains unverified in its existing
+platform incident; no historical credential was used by this recovery.