NK-WP-0049-T02: mechanical first-pass caller ledger over the 93-entry inventory

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 696317@bnt-lap001
Assistant-Session: bab9e511-0915-45b3-926a-2fab552edff6

workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md

@@ -383,6 +383,24 @@ root-output/isolation boundaries. Secret presence is not credential validity.
 Send current native checks to T21 and historical revocation/rotation decisions to
 T22. Do not reopen completed source repairs without a new finding.
 
+2026-10-23 first slice (read-only, mechanical):
+[ledger draft](../docs/evidence/2026-10-23-nk49-t02-caller-ledger/ledger-draft.json).
+For all 93 inventory entries it records presence, sha256 drift against the
+October15 inventory, the last commit, and references from Make, bootstrap or
+console routes and from runbook/doc markdown. Candidate statuses:
+- 28 have an active Make/bootstrap route.
+- 26 have a documented operator route.
+- 11 are retired, refusing entry points.
+- 11 are unrouted diagnostics.
+- 17 are unrouted and need an owner disposition: privacyIDEA bootstrap/policy
+  helpers, four KeyCape rollout helpers and the four bootstrap-recovery tools.
+5 entries have drifted since the inventory (Makefile, sops-custody-unlock,
+sops-private, keycape-client, identity-backup-profile). These are candidates
+only, not owner dispositions. Next slices: (2) fill in owner, credential route
+and consumers for the 17 unrouted and 5 drifted entries, plus the explicitly
+named historical objects; (3) add native evidence or the exact missing proof and
+the next task for all entries, and route checks to T21 and T22.
+
 ## Prepare the isolated full-service restore and acceptance packet
 
 ```task