plan: make task accountability visible in projected descriptions

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2

workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md

@@ -30,7 +30,8 @@ or newly granted authority. The earlier dated narrative remains in Git at
 
 **Current position:** 12 tasks done; 1 in progress; 3 ready to start (`todo`);
 8 waiting on explicit prerequisites. These are task counts, not an effort-based
-completion percentage. No remaining task is being executed by this replan.
+completion percentage. Assignees are also written in task descriptions because
+the current Forge projector does not populate the dedicated Hub assignee field. No remaining task is being executed by this replan.
 
 **Next actions:** finish the read-only caller ledger (T02); prepare the isolated
 restore packet (T15), independent offline retrieval (T23), and residual-scope
@@ -53,6 +54,9 @@ assignee: codex
 state_hub_task_id: "d7ca8d5f-c5ff-5cba-bd25-038cb53ffe4e"
 ```
 
+**Accountable worker:** codex. Service/credential-owner acceptance remains with
+the named owner boundary.
+
 2026-10-12: regression reproduced emergency/reprint root export, generation
 prefix disclosure, permissive file modes, dry-run side effects and unattended
 entry. Replaced emergency export with a non-secret guide (legacy secret-input
@@ -81,6 +85,9 @@ depends_on: [NK-WP-0049-T01]
 state_hub_task_id: "04c4e8be-5bd8-5d5c-99b1-79d8ae758462"
 ```
 
+**Accountable worker:** codex. Service/credential-owner acceptance remains with
+the named owner boundary.
+
 Completed 2026-10-12–13. Public-recipient-only encryption, explicit temporary
 custody, private no-overwrite output, sanitized diagnostics, stdin-only secret
 transport and failed-operation cleanup replace ambient-key and output paths.
@@ -103,6 +110,9 @@ depends_on: [NK-WP-0049-T04]
 state_hub_task_id: "e8e38f42-609e-5c07-a8e6-e73c8eb4ae95"
 ```
 
+**Accountable worker:** codex. Service/credential-owner acceptance remains with
+the named owner boundary.
+
 Completed 2026-10-13–14. Repaired KeyCape configuration and component Secret
 publication, original privacyIDEA key export/restore transport, scoped MFA
 counts, LDAP group maintenance and configuration-preserving resolver cutover.
@@ -128,6 +138,9 @@ depends_on: [NK-WP-0049-T04, NK-WP-0049-T05]
 state_hub_task_id: "a5f50891-c5b2-513b-8670-e1915ee52015"
 ```
 
+**Accountable worker:** codex. Service/credential-owner acceptance remains with
+the named owner boundary.
+
 Completed 2026-10-15. Enumerated all 87 current non-test shell/Python callers
 in the declared bootstrap/k8s scope plus Make/console/delivery adapters. Repaired
 streamed encrypted bundle publication and fail-closed bootstrap/lab paths;
@@ -150,6 +163,9 @@ assignee: codex
 state_hub_task_id: "2d7302a2-319a-5633-bf58-d51ccd25ebf6"
 ```
 
+**Accountable worker:** codex. Service/credential-owner acceptance remains with
+the named owner boundary.
+
 Completed 2026-10-15–16. Bounded Storage Share/Scaleway inventories identified
 existing database coverage and the missing full identity bundle. The operator
 independently matched the backup recipient, then recovered the exact existing
@@ -171,6 +187,9 @@ depends_on: [NK-WP-0049-T06, NK-WP-0049-T07]
 state_hub_task_id: "317ca173-c784-5329-9810-5e3d300604b8"
 ```
 
+**Accountable worker:** codex. Service/credential-owner acceptance remains with
+the named owner boundary.
+
 Completed 2026-10-16. Defined exact LLDAP/Authelia/KeyCape/privacyIDEA assets,
 Deployment/PVC/reference bindings, original keys and snapshot consistency limits.
 Implemented native SQLite/PG capture, streamed age sealing, strict data-bearing
@@ -194,6 +213,9 @@ depends_on: [NK-WP-0049-T08]
 state_hub_task_id: "4a47eb2a-7e42-5ae7-9df1-f5ede746eca1"
 ```
 
+**Accountable worker:** codex. Service/credential-owner acceptance remains with
+the named owner boundary.
+
 Completed 2026-10-16. Platform CCR-2026-0048/0049 are verified. The operator
 approved folder-only provider-normalized publisher21/retention25 rights, including
 re-sharing, in addition to the original rollout. Coding-agent denials precede KV
@@ -218,6 +240,9 @@ depends_on: [NK-WP-0049-T08, NK-WP-0049-T09]
 state_hub_task_id: "0519444c-d559-5455-aa27-8c5dc8b832b0"
 ```
 
+**Accountable worker:** codex. Service/credential-owner acceptance remains with
+the named owner boundary.
+
 Completed 2026-10-16. Applied exact UID/resource-version/spec-guarded DNS
 selector exclusions, preserving ordinary service matches. Capture refuses any
 remaining helper allow policy. Installed immutable runtime sources bound to the
@@ -240,6 +265,9 @@ depends_on: [NK-WP-0049-T08]
 state_hub_task_id: "d69af493-4026-56a8-a526-c267d90dce18"
 ```
 
+**Accountable worker:** codex. Service/credential-owner acceptance remains with
+the named owner boundary.
+
 Completed 2026-10-16. Added the Railiance bootstrap `identity-recovery`
 dispatcher and independent-custody → isolated verification → layer/service-owner
 handoff. Updated `capability.security.bootstrap-recovery`, linked bootstrap
@@ -262,6 +290,9 @@ depends_on: [NK-WP-0049-T09, NK-WP-0049-T10]
 state_hub_task_id: "decb415a-8012-521c-9dbe-d73c6ff0bbfb"
 ```
 
+**Accountable worker:** codex. Service/credential-owner acceptance remains with
+the named owner boundary.
+
 Completed 2026-10-16. Captured original service keys/current data plus the
 linked native PI database dump, sealed and published a unique Storage Share
 artifact, then downloaded it and verified size/digest before publishing its index.
@@ -283,6 +314,9 @@ depends_on: [NK-WP-0049-T11, NK-WP-0049-T12]
 state_hub_task_id: "602d4921-cfac-5e5b-9993-4fbf67195c7d"
 ```
 
+**Accountable worker:** codex. Service/credential-owner acceptance remains with
+the named owner boundary.
+
 Completed 2026-10-16. Independently downloaded the exact first generation
 through attended Backup-account custody, rehashed it locally and revoked the
 session. The operator used the independently held age key through the bootstrap
@@ -305,6 +339,9 @@ depends_on: [NK-WP-0049-T10, NK-WP-0049-T13]
 state_hub_task_id: "eaf0708f-b3b7-5531-8172-95edf30c3a19"
 ```
 
+**Accountable worker:** codex. Service/credential-owner acceptance remains with
+the named owner boundary.
+
 Completed 2026-10-16 after T13. Both daily backup/retention and hourly health
 timers are enabled/active. The actual hardened systemd service passed retention
 before/after a second capture/upload/download (Result=success, ExecMainStatus=0).
@@ -328,6 +365,9 @@ depends_on: [NK-WP-0049-T06]
 state_hub_task_id: "479d6970-6516-50f5-9436-bb5b56d58aad"
 ```
 
+**Accountable worker:** codex. Service/credential-owner acceptance remains with
+the named owner boundary.
+
 The source inventory and known legacy objects exist; a complete current-use
 ledger is not yet accepted. Next action is read-only reconciliation of the 87
 source entries against active Make/bootstrap/operator routes and owner evidence.
@@ -352,6 +392,9 @@ depends_on: [NK-WP-0049-T08, NK-WP-0049-T13]
 state_hub_task_id: "1d1eb903-a4b0-5bc4-a421-0b842d7f68ae"
 ```
 
+**Accountable worker:** codex. Service/credential-owner acceptance remains with
+the named owner boundary.
+
 **Next action:** turn the recovered manifest and current caller gaps into a
 reviewable procedure with selected immutable images, restore order, isolated
 endpoints/network, data/key ownership, cleanup and per-service positive/negative
@@ -377,6 +420,9 @@ blocking_reason: "Await the accepted isolated restore packet and independently s
 state_hub_task_id: "b64d4d6a-e851-58d1-9929-f03343147de0"
 ```
 
+**Accountable worker:** codex. Service/credential-owner acceptance remains with
+the named owner boundary.
+
 Owner boundary: NetKingdom directory/User Engine owners. Restore the captured
 original directory/configuration in the admitted isolated environment.
 
@@ -398,6 +444,9 @@ blocking_reason: "Await the accepted isolated packet and restored-directory auth
 state_hub_task_id: "b47f9975-d6d7-5bb8-93ce-886deb1dfa70"
 ```
 
+**Accountable worker:** codex. Service/credential-owner acceptance remains with
+the named owner boundary.
+
 Owner boundary: SSO/Authelia and directory owners. Restore the original storage,
 encryption/session/signing material and configuration in isolation.
 
@@ -419,6 +468,9 @@ blocking_reason: "Await the accepted isolated packet, restored directory and own
 state_hub_task_id: "6f8af1a7-2a3f-5fa8-8202-83103ebd55b2"
 ```
 
+**Accountable worker:** codex. Service/credential-owner acceptance remains with
+the named owner boundary.
+
 Owner boundary: MFA/privacyIDEA and directory owners. Use the exact linked dump
 and original enckey from the independently recovered generation.
 
@@ -440,6 +492,9 @@ blocking_reason: "Await the accepted isolated target/procedure and owner-admitte
 state_hub_task_id: "375fa8f9-b8a5-5048-97a7-ec141aa7c45d"
 ```
 
+**Accountable worker:** codex. Service/credential-owner acceptance remains with
+the named owner boundary.
+
 Owner boundary: MFA/privacyIDEA audit owner. Use the original recovered audit
 pair and linked database in the admitted isolated target.
 
@@ -461,6 +516,9 @@ blocking_reason: "Await the accepted isolated packet, restored-directory proof a
 state_hub_task_id: "141dd773-c1fa-56c1-a852-bbe2372e5125"
 ```
 
+**Accountable worker:** codex. Service/credential-owner acceptance remains with
+the named owner boundary.
+
 Owner boundary: KeyCape and the selected current consumer owners. Restore the
 original signing/configuration, registry, authentication policies and receipts.
 
@@ -482,6 +540,9 @@ blocking_reason: "Await the current-caller ledger and exact per-caller owner adm
 state_hub_task_id: "77aa42be-7a39-5d93-8042-03d78b4094b4"
 ```
 
+**Accountable worker:** codex. Service/credential-owner acceptance remains with
+the named owner boundary.
+
 Owner boundary: each current caller's service/provider and credential owner.
 Use T02's ledger to select the exact current procedures and required owner lanes.
 
@@ -505,6 +566,9 @@ blocking_reason: "Await the caller/consumer ledger, current replacement-lane acc
 state_hub_task_id: "3ea6bf00-a87f-58ea-bdce-328c13a03a55"
 ```
 
+**Accountable worker:** codex. Service/credential-owner acceptance remains with
+the named owner boundary.
+
 Owner boundary: Platform/custody and affected consumer owners. Review historical
 personal-admin/trigger credential copies and unsafe predecessor paths against
 known current consumers and rollback custody.
@@ -528,6 +592,9 @@ depends_on: [NK-WP-0049-T13]
 state_hub_task_id: "1ec537ee-dfee-5576-be36-a81bdba417d1"
 ```
 
+**Accountable worker:** codex. Service/credential-owner acceptance remains with
+the named owner boundary.
+
 The existing independent retrieval succeeded through a healthy attended OpenBao
 path. A full custody outage still lacks a reviewed offline provider adapter.
 
@@ -552,6 +619,9 @@ depends_on: [NK-WP-0049-T14]
 state_hub_task_id: "474f5a78-a643-59c6-bcf9-fc4a908dfcb0"
 ```
 
+**Accountable worker:** codex. Service/credential-owner acceptance remains with
+the named owner boundary.
+
 **Next action:** record the current single-provider and host-local-health limits,
 then obtain explicit owner scope decisions for a second encrypted provider copy,
 external host-loss/freshness detection and recurring recovery-drill cadence.
@@ -575,6 +645,9 @@ blocking_reason: "Await the separately tracked native service proofs, current/le
 state_hub_task_id: "d68cd4d3-1ba3-530e-88f9-26ebb8dd6eac"
 ```
 
+**Accountable worker:** codex. Service/credential-owner acceptance remains with
+the named owner boundary.
+
 Owner boundary: NetKingdom, Platform and affected service owners, with Custodian
 G08 receiving the final evidence. The completed archive/job milestones remain
 accepted independently of this final gate.