coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0049-T43: founder accepts the inherited-pipe custody design with four optimizations

Browse source 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
This commit is contained in:
tegwick 2026-10-27 21:27:39 +01:00
parent 737b1b071b
commit 5c2432698d
1 changed files with 3 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
View file

@ -1597,7 +1597,7 @@ assignee: claude-code
needs_human: true
decision_id: "e4db6c9f-d464-4185-b5a1-ea71e21d1b42"
depends_on: [NK-WP-0049-T18]
blocking_reason: "All three owner replies received 2026-10-27. Open: founder reviews the secrets-engine custody proposal (inherited-pipe runner, secrets-engine 65a3dbe) and names the exact backup field and decrypt command; railiance-cluster count is only estimated (1 used, safe date 2026-10-30T16:23Z) pending an admin-side cert check; OpenBao trust of the ISRG chain for /jwks is unproven (railiance-platform to show jwks_ca_pem and oidc_discovery_ca_pem presence and probe on the phase B network); subnet and container names to agree with railiance-platform. Then build and review the phase B module; a new founder-signed window is needed.""
blocking_reason: "Founder accepted the inherited-pipe custody design 2026-10-27 with four optimizations (random negative-test token; non-echoing unlogged decrypt wrapper; value-free /jwks trust probe before the ceremony; synthetic-secret rehearsal on a throwaway network). Open: NetKingdom names the exact backup field and decrypt command; railiance-platform shows jwks_ca_pem and oidc_discovery_ca_pem presence and runs the probe; subnet and container names to agree; longer unseal window acceptance is still the founder's decision at window signing; railiance-cluster count needs an admin-side cert check. Then build and review the phase B module; a new founder-signed window is needed.""
state_hub_task_id: "485468fd-d56e-54d1-9bc7-97220c0c4a38"
```
@ -1619,6 +1619,8 @@ railiance-cluster (`8fad4ef`, reply 65ab47ff): one proven production issuance on
railiance-platform (`2bbf1ff`, task RPF-WP-0064-T09): can own the single `--internal` network and keep restored OpenBao up as `bao-restored`; needs a new adapter pin, internal listener without generate-root, network check, receipt schema and verifier; objects to longer unsealed exposure than 45 minutes unless the founder accepts it in the window.
secrets-engine (`65a3dbe`, reply 5aeaadc9): new reviewed runner taking the client secret from an inherited pipe fd, founder-piped from the backup; NetKingdom must name the field and decrypt command; /jwks trust of the ISRG chain by restored OpenBao is unproven.
2026-10-27 founder decision: accept the secrets-engine inherited-pipe custody design (`65a3dbe`) with optimizations 1, 3, 4 and 5: the wrong-secret negative test uses a generated random token, so only the one real secret passes the founder terminal; the decrypt step runs through a fixed non-echoing, unlogged wrapper that refuses to run under `script` or tmux logging; railiance-platform runs a value-free OpenBao-side `/jwks` trust probe on the phase B network before the ceremony; and the full path is rehearsed with a synthetic client on a throwaway network. Not adopted now: namespace/ptrace hardening (2) and an agent-free source (7). This accepts a design only and authorizes no run.
**Done when:** the decision is answered, the owners confirm their steps in their own
workplans, and the NK49 phase B module, verifier and tests are reviewed to T38 depth. This
task does not run phase B and does not replace T18's live consumer login or owner acceptance.