NK-WP-0055: production readiness workplan; NK-WP-0049 finished with residuals moved

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 4515@bnt-lap001 Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
2026-10-27 22:06:58 +01:00 · 2026-10-27 22:06:58 +01:00 · 65b9d3f729
commit 65b9d3f729
parent ac6dc720e6
3 changed files with 253 additions and 8 deletions
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@ -46,12 +46,13 @@
 | workplan | NK-WP-0046 | finished | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
 | workplan | NK-WP-0047 | finished | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
 | workplan | NK-WP-0048 | active | — | workplans/NK-WP-0048-security-case-types.md |
-| workplan | NK-WP-0049 | active | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| workplan | NK-WP-0049 | finished | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
 | workplan | NK-WP-0050 | active | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
 | workplan | NK-WP-0051 | finished | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
 | workplan | NK-WP-0052 | finished | — | workplans/NK-WP-0052-wave2-resource-right-sizing.md |
 | workplan | NK-WP-0053 | active | — | workplans/NK-WP-0053-identity-restore-drill-cadence.md |
 | workplan | NK-WP-0054 | active | — | workplans/NK-WP-0054-service-identity-policy.md |
+| workplan | NK-WP-0055 | proposed | — | workplans/NK-WP-0055-security-platform-production-readiness.md |
 | task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md |
 | task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md |
 | task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md |
@ -294,7 +295,7 @@
 | task | NK-WP-0049-T41 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
 | task | NK-WP-0049-T42 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
 | task | NK-WP-0049-T43 | cancel | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
-| task | NK-WP-0049-T44 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T44 | cancel | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
 | task | NK-WP-0050-T01 | done | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
 | task | NK-WP-0050-T02 | progress | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
 | task | NK-WP-0050-T03 | wait | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
@ -317,6 +318,15 @@
 | task | NK-WP-0054-T06 | wait | — | workplans/NK-WP-0054-service-identity-policy.md |
 | task | NK-WP-0054-T07 | todo | — | workplans/NK-WP-0054-service-identity-policy.md |
 | task | NK-WP-0054-T08 | done | — | workplans/NK-WP-0054-service-identity-policy.md |
+| task | NK-WP-0055-T01 | todo | — | workplans/NK-WP-0055-security-platform-production-readiness.md |
+| task | NK-WP-0055-T02 | wait | — | workplans/NK-WP-0055-security-platform-production-readiness.md |
+| task | NK-WP-0055-T03 | wait | — | workplans/NK-WP-0055-security-platform-production-readiness.md |
+| task | NK-WP-0055-T04 | wait | — | workplans/NK-WP-0055-security-platform-production-readiness.md |
+| task | NK-WP-0055-T05 | todo | — | workplans/NK-WP-0055-security-platform-production-readiness.md |
+| task | NK-WP-0055-T06 | wait | — | workplans/NK-WP-0055-security-platform-production-readiness.md |
+| task | NK-WP-0055-T07 | todo | — | workplans/NK-WP-0055-security-platform-production-readiness.md |
+| task | NK-WP-0055-T08 | todo | — | workplans/NK-WP-0055-security-platform-production-readiness.md |
+| task | NK-WP-0055-T09 | wait | — | workplans/NK-WP-0055-security-platform-production-readiness.md |
 | intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
 | intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
 | intake | NET-IN-0001 | open | — | intakes/intakes.md |
--- a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
+++ b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
@ -4,7 +4,7 @@ type: workplan
 title: "Remove bootstrap secret output and verify separated recovery custody"
 domain: infotech
 repo: net-kingdom
-status: active
+status: finished
 owner: codex
 topic_slug: netkingdom
 created: "2026-10-12"
@ -28,9 +28,9 @@ These are retrospective task records of evidenced work, not additional delivery
 or newly granted authority. The earlier dated narrative remains in Git at
 `cc2dd01`; its evidence references are carried into the tasks below.

-**Current position, 2026-10-27:** 42 tasks done; 1 cancelled (T43, phase B paused); 1 waiting (T44, pre-production joint drill). T03 closed the G08 handoff in builder mode (founder decision, option A). The workplan stays `active` only for T44.
+**Closed 2026-10-27 (finished, builder mode):** 42 tasks done; 2 cancelled (T43 phase B paused, T44 moved). All production-readiness residuals live in [NK-WP-0055](NK-WP-0055-security-platform-production-readiness.md).

-**Next actions:** run T44 before the estate is declared production.
+**Next actions:** none here; continue in NK-WP-0055.

 **Closure:** T03 assembles owner acceptance after its named dependencies pass.
 Passing archive recovery does not prove existing-user authentication, retained
@ -1648,11 +1648,10 @@ task does not run phase B and does not replace T18's live consumer login or owne

 ```task
 id: NK-WP-0049-T44
-status: wait
+status: cancel
 priority: medium
 assignee: claude-code
 depends_on: [NK-WP-0049-T18, NK-WP-0049-T21]
-blocking_reason: "Builder-mode residual of T18. Run before the estate is declared production: build the phase B module from the retained T43 design, rehearse it, then a founder-signed window."
 state_hub_task_id: "0cde15c4-9918-574f-b522-34e620168bc9"
 ```

@ -1662,6 +1661,8 @@ state_hub_task_id: "0cde15c4-9918-574f-b522-34e620168bc9"
 (secrets-engine-openbao) passes native positive/negative login, plus one browser/PKCE client; this closes key-cape K1 and
 railiance-platform R1/R2. Start from the T43 design notes; do not edit the pinned T38/T40 sources. Also re-prove reserved-LDAP-group denial and the resolver cutover functionally (from T21).

+
+2026-10-27: moved, not dropped. The founder closed NK-WP-0049 in builder mode, and this drill now lives in [NK-WP-0055](NK-WP-0055-security-platform-production-readiness.md): T02 (build and rehearse), T03 (live consumer and PKCE login) and T04 (reserved-group denial and resolver re-proof).
 ## Accept remaining recovery and caller evidence and close the G08 handoff

 ```task
@ -1690,7 +1691,7 @@ not call a deferred rotation or an untested full-estate restore complete.

 2026-10-27 closure (founder-accepted, builder mode): T03 is **done**. Dependencies T02 and T15–T38 are done except T43 (cancelled: phase B paused, design retained in T44).
 G08 handoff evidence: archive recovery and backup activation (T04–T14, T23–T26); isolated owner recoveries of LLDAP (T16), Authelia (T17), existing-token MFA (T19), privacyIDEA audit continuity (T20), KeyCape issuer side (T18, receipt `16d72f7c…1651`, key-cape acceptance `fc9f09a`) and OpenBao (RPF-WP-0064, receipt `4e048dee…579d`, railiance-platform acceptance `5658150`); caller ledger (T02) and accepted dispositions (T21); historical objects deleted and verified absent (T22).
-Live residuals (not claimed complete): T44 pre-production joint drill (restored KeyCape plus OpenBao live consumer login, browser/PKCE client, reserved-group denial, resolver re-proof); attended factor-diagnostic credential lane (owner-deferred); privacyIDEA credential revocation and exposure rotation under CUST-WP-0073-T05 / decision `1591daa1`. NK-WP-0049 stays `active` only for T44.
+Live residuals (not claimed complete): T44 pre-production joint drill (restored KeyCape plus OpenBao live consumer login, browser/PKCE client, reserved-group denial, resolver re-proof); attended factor-diagnostic credential lane (owner-deferred); privacyIDEA credential revocation and exposure rotation under CUST-WP-0073-T05 / decision `1591daa1`. NK-WP-0049 closed 2026-10-27; residuals moved to NK-WP-0055.
 ## Evidence locations and refinement history

 “Live” above means `docs/evidence/2026-10-16-identity-backup-live/` in NetKingdom.
--- a/workplans/NK-WP-0055-security-platform-production-readiness.md
+++ b/workplans/NK-WP-0055-security-platform-production-readiness.md
@ -0,0 +1,234 @@
+---
+id: NK-WP-0055
+type: workplan
+title: "Reach and prove security platform production readiness"
+domain: infotech
+repo: net-kingdom
+status: proposed
+owner: claude-code
+topic_slug: netkingdom
+created: "2026-10-27"
+updated: "2026-10-27"
+flavor: implementation
+depends_on: []
+related:
+  - NK-WP-0049
+  - CUST-WP-0073
+  - RPF-WP-0064
+  - RPF-WP-0036
+---
+
+The estate is in **builder mode**. This workplan holds the work that has to pass before
+NetKingdom's security platform is declared production-ready. Builder-mode workplans can
+close with named residuals, and those residuals land here instead of keeping their source
+plans open. Nothing in this plan needs to run before the founder decides to move toward
+production.
+
+## Definition of production readiness
+
+The security platform is production-ready when every area of the
+[Production Readiness Checks](../docs/platform-identity-security-architecture.md#production-readiness-checks)
+table has its check recorded as **met**, with evidence, or as an **accepted exception**
+with an owner and a review date. A check counts only if it was observed on the estate
+that serves production traffic. Fixtures, rehearsals and builder-mode acceptances do not
+count. The areas are:
+
+1. Platform root custody
+2. MFA and identity
+3. Bootstrap and recovery
+4. OpenBao runtime secrets
+5. Secret rotation
+6. flex-auth policy state
+7. Topaz runtime
+8. Tenant onboarding
+9. Audit sink
+10. Break-glass
+
+For **Bootstrap and recovery**, this plan adds three requirements, drawn from NK-WP-0049:
+
+- **Joint restore:** the restored identity services and OpenBao work together for a real
+  login.
+- **Recurring drill:** restores are re-proved on a schedule, not just once.
+- **Credential cleanup:** the remaining bootstrap-era credentials are rotated or revoked.
+
+Readiness does not mean HA. HA is a separate decision, and the current estate runs on one
+node.
+
+## Assess every readiness area against current evidence
+
+```task
+id: NK-WP-0055-T01
+status: todo
+priority: medium
+assignee: claude-code
+```
+
+**Done when:** a readiness ledger
+(`docs/evidence/<date>-production-readiness-ledger.md`) lists all ten areas, each with:
+
+- a status: met, partial, open, or accepted exception;
+- the evidence or the exact missing proof;
+- the owner repository;
+- the task that carries the gap.
+
+Gaps that the tasks below don't cover get new tasks in this plan, or a pointer to an
+existing owner workplan. The assessment is read-only.
+
+## Build and rehearse the joint-restore drill (from NK-WP-0049-T43/T44)
+
+```task
+id: NK-WP-0055-T02
+status: wait
+priority: medium
+assignee: claude-code
+blocking_reason: "Starts when the founder schedules the move toward production."
+```
+
+Start from the design retained in NK-WP-0049-T43:
+
+- the secrets-engine inherited-pipe runner (`65a3dbe`), with the founder's optimizations
+  1, 3, 4 and 5;
+- the railiance-platform phase B network (`5658150`: `rpf64-nk49-pb`, `10.249.64.0/28`;
+  the rehearsal variant uses `-rh-`);
+- the client secret `keycape-secrets-engine-openbao-client` (key `client-secret`), read
+  from archive member `resources/sso/secret/keycape-secrets-engine-openbao-client.json`.
+
+The work:
+
+- a new reviewed phase B module, with its verifier and tests;
+- a single-member, non-echoing decrypt wrapper;
+- the owners' adapter and runner changes;
+- a synthetic-client rehearsal on the throwaway network;
+- the value-free OpenBao `/jwks` trust probe.
+
+Do not edit the pinned NK-WP-0049 T38/T40 sources.
+
+**Done when:** the module, wrapper, adapter and runner are reviewed to T38 depth and the
+synthetic rehearsal passes.
+
+## Run the joint restore with a live consumer and a PKCE client
+
+```task
+id: NK-WP-0055-T03
+status: wait
+priority: medium
+assignee: claude-code
+depends_on: [NK-WP-0055-T02]
+blocking_reason: "Needs T02 and a founder-signed window. The letsencrypt-prod reissue for kc.coulomb.social needs a fresh duplicate-certificate check, or at least 7 days since the last issuance."
+```
+
+**Done when:**
+
+- restored KeyCape and restored OpenBao are joined on the isolated network;
+- `secrets-engine-openbao` passes the native positive and negative login checks;
+- one browser authorization-code/PKCE client passes as well;
+- the verifier has independently checked the receipt.
+
+This closes NK-WP-0049 residuals key-cape K1 and railiance-platform R1/R2. The founder
+explicitly accepts the unseal window length when signing.
+
+## Re-prove the reserved-group denial and the resolver cutover (from NK-WP-0049-T21)
+
+```task
+id: NK-WP-0055-T04
+status: wait
+priority: medium
+assignee: claude-code
+depends_on: [NK-WP-0055-T02]
+blocking_reason: "Runs in the joint-restore drill environment or as its own owner-admitted live check."
+```
+
+**Done when:**
+
+- the deployed reserved LDAP group is natively denied, both in a positive and a negative
+  case;
+- the privacyIDEA LLDAP resolver/cutover inputs have provenance and a functional proof on
+  the target estate.
+
+## Admit a credential lane for the attended factor diagnostic
+
+```task
+id: NK-WP-0055-T05
+status: todo
+priority: low
+assignee: claude-code
+```
+
+The diagnostic (`mfa_state.py`, `check-user-mfa-state.sh`) has no admitted credential. It
+must not borrow KeyCape's `keycape-factor-read`. Live, only `sso/keycape` mounts that
+secret, verified 2026-10-27.
+
+**Done when:** the owner has an admitted delivery and execution arrangement, found through
+`warden route`, and one attended diagnostic run passes. The alternative is an accepted
+decision that the diagnostic is not needed for production.
+
+## Rotate or revoke the bootstrap-era and exposed credentials
+
+```task
+id: NK-WP-0055-T06
+status: wait
+priority: high
+assignee: claude-code
+blocking_reason: "Founder rotation deferral CUST-WP-0073-T05 / decision 1591daa1 is in force until the founder lifts it."
+```
+
+This includes the privacyIDEA credentials behind the deleted `sso/keycape-pi-token` and
+`mfa/privacyidea-trigger-admin`. The architecture requires rotating bootstrap-era
+credentials before live workloads rely on the platform.
+
+**Done when:** each affected credential has verified revocation or rotation, with
+signing and client-secret preservation proven, or an accepted exception. Execution belongs
+to the credential owners. This task tracks it and does not duplicate CUST-WP-0073.
+
+## Make restore assurance recurring
+
+```task
+id: NK-WP-0055-T07
+status: todo
+priority: medium
+assignee: claude-code
+```
+
+Carries NK-WP-0049-T24 G3 and railiance-platform R6 (RPF-WP-0036-T03).
+
+**Done when:** a scheduled drill re-proves the isolated identity and OpenBao restores on
+the current backup generation. It must include:
+
+- image-lineage proof (R5);
+- the audit-device mount (R8);
+- a reconciliation procedure for changes made after the archive was taken (K2).
+
+Drill results land in the readiness ledger.
+
+## Decide durable custody for receipts kept outside Git
+
+```task
+id: NK-WP-0055-T08
+status: todo
+priority: low
+assignee: claude-code
+```
+
+The T18 KeyCape receipt (`16d72f7c…1651`) and the OpenBao restore receipt
+(`4e048dee…579d`) exist only on the founder workstation, because the secret scanners flag
+their public digests.
+
+**Done when:** an accepted custody location with a second copy holds them, still bound by
+their recorded hashes, or the founder accepts single-copy custody as an exception.
+
+## Close readiness and declare production
+
+```task
+id: NK-WP-0055-T09
+status: wait
+priority: high
+assignee: claude-code
+depends_on: [NK-WP-0055-T01, NK-WP-0055-T03, NK-WP-0055-T04, NK-WP-0055-T05, NK-WP-0055-T06, NK-WP-0055-T07, NK-WP-0055-T08]
+blocking_reason: "Every readiness area must be met or an accepted exception."
+```
+
+**Done when:**
+
+- the readiness ledger shows every area as met or as an accepted exception;
+- the founder records the production declaration as a decision;
+- SCOPE.md's capability table is updated to match.