From 2a3800e7f1c55509e5f114582c0c0ae2abb47f78 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 16 Oct 2026 16:29:34 +0200 Subject: [PATCH] plan: make task accountability visible in projected descriptions Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2 --- ...-bootstrap-secret-free-recovery-handoff.md | 75 ++++++++++++++++++- 1 file changed, 74 insertions(+), 1 deletion(-) diff --git a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md index ba9ca3e..989a408 100644 --- a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md +++ b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md @@ -30,7 +30,8 @@ or newly granted authority. The earlier dated narrative remains in Git at **Current position:** 12 tasks done; 1 in progress; 3 ready to start (`todo`); 8 waiting on explicit prerequisites. These are task counts, not an effort-based -completion percentage. No remaining task is being executed by this replan. +completion percentage. Assignees are also written in task descriptions because +the current Forge projector does not populate the dedicated Hub assignee field. No remaining task is being executed by this replan. **Next actions:** finish the read-only caller ledger (T02); prepare the isolated restore packet (T15), independent offline retrieval (T23), and residual-scope @@ -53,6 +54,9 @@ assignee: codex state_hub_task_id: "d7ca8d5f-c5ff-5cba-bd25-038cb53ffe4e" ``` +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + 2026-10-12: regression reproduced emergency/reprint root export, generation prefix disclosure, permissive file modes, dry-run side effects and unattended entry. Replaced emergency export with a non-secret guide (legacy secret-input @@ -81,6 +85,9 @@ depends_on: [NK-WP-0049-T01] state_hub_task_id: "04c4e8be-5bd8-5d5c-99b1-79d8ae758462" ``` +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + Completed 2026-10-12–13. Public-recipient-only encryption, explicit temporary custody, private no-overwrite output, sanitized diagnostics, stdin-only secret transport and failed-operation cleanup replace ambient-key and output paths. @@ -103,6 +110,9 @@ depends_on: [NK-WP-0049-T04] state_hub_task_id: "e8e38f42-609e-5c07-a8e6-e73c8eb4ae95" ``` +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + Completed 2026-10-13–14. Repaired KeyCape configuration and component Secret publication, original privacyIDEA key export/restore transport, scoped MFA counts, LDAP group maintenance and configuration-preserving resolver cutover. @@ -128,6 +138,9 @@ depends_on: [NK-WP-0049-T04, NK-WP-0049-T05] state_hub_task_id: "a5f50891-c5b2-513b-8670-e1915ee52015" ``` +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + Completed 2026-10-15. Enumerated all 87 current non-test shell/Python callers in the declared bootstrap/k8s scope plus Make/console/delivery adapters. Repaired streamed encrypted bundle publication and fail-closed bootstrap/lab paths; @@ -150,6 +163,9 @@ assignee: codex state_hub_task_id: "2d7302a2-319a-5633-bf58-d51ccd25ebf6" ``` +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + Completed 2026-10-15–16. Bounded Storage Share/Scaleway inventories identified existing database coverage and the missing full identity bundle. The operator independently matched the backup recipient, then recovered the exact existing @@ -171,6 +187,9 @@ depends_on: [NK-WP-0049-T06, NK-WP-0049-T07] state_hub_task_id: "317ca173-c784-5329-9810-5e3d300604b8" ``` +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + Completed 2026-10-16. Defined exact LLDAP/Authelia/KeyCape/privacyIDEA assets, Deployment/PVC/reference bindings, original keys and snapshot consistency limits. Implemented native SQLite/PG capture, streamed age sealing, strict data-bearing @@ -194,6 +213,9 @@ depends_on: [NK-WP-0049-T08] state_hub_task_id: "4a47eb2a-7e42-5ae7-9df1-f5ede746eca1" ``` +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + Completed 2026-10-16. Platform CCR-2026-0048/0049 are verified. The operator approved folder-only provider-normalized publisher21/retention25 rights, including re-sharing, in addition to the original rollout. Coding-agent denials precede KV @@ -218,6 +240,9 @@ depends_on: [NK-WP-0049-T08, NK-WP-0049-T09] state_hub_task_id: "0519444c-d559-5455-aa27-8c5dc8b832b0" ``` +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + Completed 2026-10-16. Applied exact UID/resource-version/spec-guarded DNS selector exclusions, preserving ordinary service matches. Capture refuses any remaining helper allow policy. Installed immutable runtime sources bound to the @@ -240,6 +265,9 @@ depends_on: [NK-WP-0049-T08] state_hub_task_id: "d69af493-4026-56a8-a526-c267d90dce18" ``` +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + Completed 2026-10-16. Added the Railiance bootstrap `identity-recovery` dispatcher and independent-custody → isolated verification → layer/service-owner handoff. Updated `capability.security.bootstrap-recovery`, linked bootstrap @@ -262,6 +290,9 @@ depends_on: [NK-WP-0049-T09, NK-WP-0049-T10] state_hub_task_id: "decb415a-8012-521c-9dbe-d73c6ff0bbfb" ``` +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + Completed 2026-10-16. Captured original service keys/current data plus the linked native PI database dump, sealed and published a unique Storage Share artifact, then downloaded it and verified size/digest before publishing its index. @@ -283,6 +314,9 @@ depends_on: [NK-WP-0049-T11, NK-WP-0049-T12] state_hub_task_id: "602d4921-cfac-5e5b-9993-4fbf67195c7d" ``` +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + Completed 2026-10-16. Independently downloaded the exact first generation through attended Backup-account custody, rehashed it locally and revoked the session. The operator used the independently held age key through the bootstrap @@ -305,6 +339,9 @@ depends_on: [NK-WP-0049-T10, NK-WP-0049-T13] state_hub_task_id: "eaf0708f-b3b7-5531-8172-95edf30c3a19" ``` +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + Completed 2026-10-16 after T13. Both daily backup/retention and hourly health timers are enabled/active. The actual hardened systemd service passed retention before/after a second capture/upload/download (Result=success, ExecMainStatus=0). @@ -328,6 +365,9 @@ depends_on: [NK-WP-0049-T06] state_hub_task_id: "479d6970-6516-50f5-9436-bb5b56d58aad" ``` +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + The source inventory and known legacy objects exist; a complete current-use ledger is not yet accepted. Next action is read-only reconciliation of the 87 source entries against active Make/bootstrap/operator routes and owner evidence. @@ -352,6 +392,9 @@ depends_on: [NK-WP-0049-T08, NK-WP-0049-T13] state_hub_task_id: "1d1eb903-a4b0-5bc4-a421-0b842d7f68ae" ``` +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + **Next action:** turn the recovered manifest and current caller gaps into a reviewable procedure with selected immutable images, restore order, isolated endpoints/network, data/key ownership, cleanup and per-service positive/negative @@ -377,6 +420,9 @@ blocking_reason: "Await the accepted isolated restore packet and independently s state_hub_task_id: "b64d4d6a-e851-58d1-9929-f03343147de0" ``` +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + Owner boundary: NetKingdom directory/User Engine owners. Restore the captured original directory/configuration in the admitted isolated environment. @@ -398,6 +444,9 @@ blocking_reason: "Await the accepted isolated packet and restored-directory auth state_hub_task_id: "b47f9975-d6d7-5bb8-93ce-886deb1dfa70" ``` +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + Owner boundary: SSO/Authelia and directory owners. Restore the original storage, encryption/session/signing material and configuration in isolation. @@ -419,6 +468,9 @@ blocking_reason: "Await the accepted isolated packet, restored directory and own state_hub_task_id: "6f8af1a7-2a3f-5fa8-8202-83103ebd55b2" ``` +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + Owner boundary: MFA/privacyIDEA and directory owners. Use the exact linked dump and original enckey from the independently recovered generation. @@ -440,6 +492,9 @@ blocking_reason: "Await the accepted isolated target/procedure and owner-admitte state_hub_task_id: "375fa8f9-b8a5-5048-97a7-ec141aa7c45d" ``` +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + Owner boundary: MFA/privacyIDEA audit owner. Use the original recovered audit pair and linked database in the admitted isolated target. @@ -461,6 +516,9 @@ blocking_reason: "Await the accepted isolated packet, restored-directory proof a state_hub_task_id: "141dd773-c1fa-56c1-a852-bbe2372e5125" ``` +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + Owner boundary: KeyCape and the selected current consumer owners. Restore the original signing/configuration, registry, authentication policies and receipts. @@ -482,6 +540,9 @@ blocking_reason: "Await the current-caller ledger and exact per-caller owner adm state_hub_task_id: "77aa42be-7a39-5d93-8042-03d78b4094b4" ``` +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + Owner boundary: each current caller's service/provider and credential owner. Use T02's ledger to select the exact current procedures and required owner lanes. @@ -505,6 +566,9 @@ blocking_reason: "Await the caller/consumer ledger, current replacement-lane acc state_hub_task_id: "3ea6bf00-a87f-58ea-bdce-328c13a03a55" ``` +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + Owner boundary: Platform/custody and affected consumer owners. Review historical personal-admin/trigger credential copies and unsafe predecessor paths against known current consumers and rollback custody. @@ -528,6 +592,9 @@ depends_on: [NK-WP-0049-T13] state_hub_task_id: "1ec537ee-dfee-5576-be36-a81bdba417d1" ``` +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + The existing independent retrieval succeeded through a healthy attended OpenBao path. A full custody outage still lacks a reviewed offline provider adapter. @@ -552,6 +619,9 @@ depends_on: [NK-WP-0049-T14] state_hub_task_id: "474f5a78-a643-59c6-bcf9-fc4a908dfcb0" ``` +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + **Next action:** record the current single-provider and host-local-health limits, then obtain explicit owner scope decisions for a second encrypted provider copy, external host-loss/freshness detection and recurring recovery-drill cadence. @@ -575,6 +645,9 @@ blocking_reason: "Await the separately tracked native service proofs, current/le state_hub_task_id: "d68cd4d3-1ba3-530e-88f9-26ebb8dd6eac" ``` +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + Owner boundary: NetKingdom, Platform and affected service owners, with Custodian G08 receiving the final evidence. The completed archive/job milestones remain accepted independently of this final gate.