coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0049-T22: historical secrets verified unreferenced and deleted by the founder
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
This commit is contained in:
tegwick 2026-10-27 21:51:58 +01:00
parent 34b570a677
commit 7e9bcdd4b7
2 changed files with 13 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

2
WORK-RECORDS.md
View file

@ -272,7 +272,7 @@
| task | NK-WP-0049-T19 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T20 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T21 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T22 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T22 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T23 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T24 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T25 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |

17
workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
View file

@ -28,9 +28,9 @@ These are retrospective task records of evidenced work, not additional delivery
or newly granted authority. The earlier dated narrative remains in Git at
`cc2dd01`; its evidence references are carried into the tasks below.
**Current position, 2026-10-27:** 39 tasks done; 1 cancelled (T43, phase B paused); 0 in progress; 4 waiting (T21, T22, T44, T03). Builder mode (founder decision 2026-10-27, option A): T15 and T18 are accepted on the owner acceptances and isolated-restore evidence, and the joint live consumer login moves to the pre-production drill T44. Actual isolated recovery has passed for LLDAP (T16), Authelia (T17), privacyIDEA audit continuity (T20), existing-token MFA (T19), KeyCape issuer side (T18) and OpenBao (RPF-WP-0064).
**Current position, 2026-10-27:** 40 tasks done; 1 cancelled (T43, phase B paused); 0 in progress; 3 waiting (T21, T44, T03). Builder mode (founder decision 2026-10-27, option A): T15 and T18 are accepted on the owner acceptances and isolated-restore evidence, and the joint live consumer login moves to the pre-production drill T44. Actual isolated recovery has passed for LLDAP (T16), Authelia (T17), privacyIDEA audit continuity (T20), existing-token MFA (T19), KeyCape issuer side (T18) and OpenBao (RPF-WP-0064).
**Next actions:** close the T02 ledger's caller dispositions (T21) and the two historical credential objects (T22), then T03. T44 runs before production.
**Next actions:** close the T02 ledger's caller dispositions (T21), then T03. T22 is done (historical objects deleted 2026-10-27). T44 runs before production.
**Closure:** T03 assembles owner acceptance after its named dependencies pass.
Passing archive recovery does not prove existing-user authentication, retained
@ -718,11 +718,10 @@ before execution; record deferred actions separately rather than faking a pass.
```task
id: NK-WP-0049-T22
status: wait
status: done
priority: high
assignee: codex
depends_on: [NK-WP-0049-T02, NK-WP-0049-T21]
blocking_reason: "Caller ledger delivered by T02 (2026-10-23). Await current replacement-lane acceptance and explicit credential-owner dispositions; existing exposure-rotation deferral is unchanged."
state_hub_task_id: "3ea6bf00-a87f-58ea-bdce-328c13a03a55"
```
@ -741,6 +740,14 @@ rotation deferral and decision `1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa` remain in
record their exact applicability rather than automatically rotating or treating
source retirement as provider revocation.
2026-10-27, founder-run with the attended admin kubeconfig (route `kubernetes-railiance01-admin`), builder mode: T22 is **done**.
Both historical objects named by T02 still existed (`sso/keycape-pi-token`, Opaque, 1 key, 216d; `mfa/privacyidea-trigger-admin`,
Opaque, 2 keys, 216d). A read-only scan of all Deployments, StatefulSets, DaemonSets, CronJobs, Jobs and Pods found no reference to
either name. The founder deleted both; follow-up `get` returned `NotFound` for each. Neither is in the identity backup `secret_refs`.
This is NK-WP-0022's explicit deletion approval for these two objects. Disposition: Kubernetes copies deleted and verified absent;
revocation of the underlying privacyIDEA credentials is not claimed and stays under the founder's rotation deferral
CUST-WP-0073-T05 / decision `1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa`. No other historical credential copy is open in the T02 ledger.
## Provide retrieval that works when OpenBao and SSO are unavailable
```task
@ -1660,7 +1667,7 @@ status: wait
priority: high
assignee: codex
depends_on: [NK-WP-0049-T02, NK-WP-0049-T16, NK-WP-0049-T17, NK-WP-0049-T18, NK-WP-0049-T19, NK-WP-0049-T20, NK-WP-0049-T21, NK-WP-0049-T22, NK-WP-0049-T23, NK-WP-0049-T24, NK-WP-0049-T26]
blocking_reason: "T15 and T18 accepted 2026-10-27 (builder mode, residual in T44). Await T21 caller dispositions and T22 historical-credential dispositions."
blocking_reason: "T15, T18 and T22 done 2026-10-27 (builder mode; T18 residual in T44). Await T21 caller disposition acceptance."
state_hub_task_id: "d68cd4d3-1ba3-530e-88f9-26ebb8dd6eac"
```