coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0049: close T35/T36/T39 on founder ACME reissue disposition; narrow T33 blockers
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 696317@bnt-lap001
Assistant-Session: bab9e511-0915-45b3-926a-2fab552edff6
This commit is contained in:
tegwick 2026-10-23 00:03:51 +02:00
parent 68066346ef
commit 5695904b63
2 changed files with 29 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

6
WORK-RECORDS.md
View file

@ -283,11 +283,11 @@
| task | NK-WP-0049-T32 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T33 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T34 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T35 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T36 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T35 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T36 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T37 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T38 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T39 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T39 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T40 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0050-T01 | done | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
| task | NK-WP-0050-T02 | progress | — | workplans/NK-WP-0050-playwright-consumer-registration.md |

31
workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
View file

@ -962,7 +962,7 @@ status: wait
priority: high
assignee: codex
depends_on: [NK-WP-0049-T32, NK-WP-0049-T34, NK-WP-0049-T35, NK-WP-0049-T36, NK-WP-0049-T39]
blocking_reason: "Attempt order is assembled with the secrets-engine selector preflight --admission step required (2026-10-21). Still waiting on: T35 owner metadata (RCLUSTER-WP-0018-T02); founder TLS disposition T39; attempt-host admission anchor; fixed deadline/receipt location/verifier."
blocking_reason: "T35/T36/T39 done (2026-10-23; TLS = ACME letsencrypt-prod reissue). Still waiting on: attempt-host admission anchor install (SECRETS-WP-0015-T04, founder/root-owned); an LE staging rehearsal of the kc.coulomb.social reissue before the real attempt; fixed deadline/receipt location/verifier."
state_hub_task_id: "56c8d469-7a10-5d50-a30e-95cbf3cd4756"
```
@ -1042,7 +1042,7 @@ attempt readiness; actual recovery/consumer acceptance remains T18 and MFA T19.
```task
id: NK-WP-0049-T35
status: progress
status: done
priority: high
assignee: codex
depends_on: [NK-WP-0049-T34]
@ -1098,11 +1098,23 @@ unblocks when the owner records independent custody of the kc-tls key.
Owner message dae2e1bb requests T02 metadata. Founder disposition gate is T39.
T35 stays progress.
2026-10-23: done. The founder resolved decision 9f9d0d88 on 2026-10-21 with
option A (relayed by secrets-engine, message daa264e9). During recovery,
kc.coulomb.social's TLS identity is the hostname chained to ISRG Root X1,
reissued through letsencrypt-prod ACME HTTP-01. No self-signed substitute is
allowed. Owner: railiance-cluster. Verify: the reissued leaf has SAN
kc.coulomb.social and chains to ISRG Root X1 (trust sha256 22b557a2...43d1). The
original key is not required. Abort if HTTP-01 cannot complete or the chain does
not match. Rehearse against LE staging first to protect the 5/week duplicate
limit; T33 carries that rehearsal as a prerequisite. RCLUSTER-WP-0018-T05 stays
open for future archive coverage. This approves no production mutation and no
recovery attempt.
## Prepare selected original service registration and private admission bindings
```task
id: NK-WP-0049-T36
status: progress
status: done
priority: high
assignee: codex
depends_on: [NK-WP-0049-T34]
@ -1167,22 +1179,31 @@ custody, at attempt time. Evidence:
`docs/evidence/2026-10-21-nk49-t33-readiness/readiness-observation.json`.
T36 stays progress until the owner confirms.
2026-10-23: done. secrets-engine confirmed on 2026-10-21 (message 8d1ab5b7)
that the pins match HEAD `0f44fbe` with no relevant drift. Installing the
attempt-host anchor is now owned work under SECRETS-WP-0015-T04 (founder- and
root-owned). SECRETS-WP-0015-T04 consumes the T33 packet unchanged. With the
registration bindings, the 27 builder cases and T35's disposition in place, the
metadata is ready for T33. No value, grant or attempt is implied.
## Founder disposition of original KeyCape TLS recovery
```task
id: NK-WP-0049-T39
status: wait
status: done
priority: high
assignee: founder
needs_human: true
decision_id: "9f9d0d88-837a-433c-8a11-d30b633b0073"
depends_on: [NK-WP-0049-T35]
blocking_reason: "Founder decides: accept ACME letsencrypt-prod reissue as the kc.coulomb.social TLS disposition, or require original key custody via RCLUSTER-WP-0018."
state_hub_task_id: "90f473db-bda6-5fe2-a2e1-7ddfaca815b7"
```
Founder gate for T35. Approves no mutation and no attempt.
2026-10-23: resolved 2026-10-21 = A (ACME letsencrypt-prod reissue, LE staging
rehearsal first). Recorded under T35.
## Founder signs the exact KeyCape attempt admission
```task