coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0049-T33: done; attempt-host admission anchor installed and self-tested, T40 signature next
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4101@bnt-lap001
Assistant-Session: bc7d2ce5-6f32-45f1-83e5-0dcbb8e610a7
This commit is contained in:
tegwick 2026-10-23 09:24:53 +02:00
parent 1eded6a356
commit 7e1c073c72
2 changed files with 11 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
WORK-RECORDS.md
View file

@ -282,7 +282,7 @@
| task | NK-WP-0049-T30 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T31 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T32 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T33 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T33 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T34 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T35 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T36 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |

13
workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
View file

@ -1023,11 +1023,10 @@ retained, and scanner policy/exemptions are unchanged.
```task
id: NK-WP-0049-T33
status: wait
status: done
priority: high
assignee: codex
depends_on: [NK-WP-0049-T32, NK-WP-0049-T34, NK-WP-0049-T35, NK-WP-0049-T36, NK-WP-0049-T39]
blocking_reason: "Packet complete in source 2026-10-23 (ceremony steps 1-5: admission, selector preflight, ACME reissue TLS, launcher, verify-keycape-attempt-receipt.py + retained location; deadline = signed admission window). LE staging rehearsal run green 2026-10-23 (railiance-cluster aad0e70, receipt in docs/keycape-tls-le-staging-rehearsal.md). Waiting only on: attempt-host admission anchor install (SECRETS-WP-0015-T04, founder/root-owned)."
state_hub_task_id: "56c8d469-7a10-5d50-a30e-95cbf3cd4756"
```
@ -1073,6 +1072,14 @@ fingerprint `D5:DB:2B:55…` and the `sso/kc-tls` resourceVersion 66444692 were
and cleanup was done. The receipt is in railiance-cluster aad0e70. Only the anchor install
(SECRETS-WP-0015-T04) remains before the attended attempt.
2026-10-23: the attempt-host anchor was installed by the founder on the workstation, which is the attempt host.
`/etc/secrets-engine/admission/allowed_signers` is root:root 0644 under a root:root 0755
directory. It holds one entry: principal `bernd`, namespaces=`secrets-engine-recovery-attempt`,
ED25519 `SHA256:NekDABfw8K8IBYznjREg7jPpcK/BzCgO1pH1ebT/FXM` (approver key), file sha256
`1964e942…c489`. A throwaway self-test signature in that namespace resolved to `bernd`
and verified Good, and was then deleted. A placeholder line left at 07:12 was replaced. Packet
prerequisites are complete, so T33 is done. Next: the founder signs the attempt admission (T40).
## Deliver attended custody, metadata preflight and private manifest preparation source
```task
@ -1298,7 +1305,7 @@ assignee: founder
needs_human: true
decision_id: "d1ab097d-cc79-4612-9c17-bb9b364081ac"
depends_on: [NK-WP-0049-T33]
blocking_reason: "Approved in principle (d1ab097d); founder signs the <=24h secrets-engine-recovery-attempt admission only once T33's packet is ready."
blocking_reason: "Approved in principle (d1ab097d); founder signs the <=24h secrets-engine-recovery-attempt admission now: T33 packet done 2026-10-23, anchor installed and self-tested."
state_hub_task_id: "90865f76-0573-5840-b1b5-937f0820ea82"
```