From 7e9bcdd4b7d5b6aa756a06f5e9877fdd3ff19369 Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 27 Oct 2026 21:51:58 +0100 Subject: [PATCH] NK-WP-0049-T22: historical secrets verified unreferenced and deleted by the founder Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 4515@bnt-lap001 Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354 --- WORK-RECORDS.md | 2 +- ...49-bootstrap-secret-free-recovery-handoff.md | 17 ++++++++++++----- 2 files changed, 13 insertions(+), 6 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 60c3d88..522bc3f 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -272,7 +272,7 @@ | task | NK-WP-0049-T19 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | | task | NK-WP-0049-T20 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | | task | NK-WP-0049-T21 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | -| task | NK-WP-0049-T22 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T22 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | | task | NK-WP-0049-T23 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | | task | NK-WP-0049-T24 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | | task | NK-WP-0049-T25 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | diff --git a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md index 9415a60..0e4e7ea 100644 --- a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md +++ b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md @@ -28,9 +28,9 @@ These are retrospective task records of evidenced work, not additional delivery or newly granted authority. The earlier dated narrative remains in Git at `cc2dd01`; its evidence references are carried into the tasks below. -**Current position, 2026-10-27:** 39 tasks done; 1 cancelled (T43, phase B paused); 0 in progress; 4 waiting (T21, T22, T44, T03). Builder mode (founder decision 2026-10-27, option A): T15 and T18 are accepted on the owner acceptances and isolated-restore evidence, and the joint live consumer login moves to the pre-production drill T44. Actual isolated recovery has passed for LLDAP (T16), Authelia (T17), privacyIDEA audit continuity (T20), existing-token MFA (T19), KeyCape issuer side (T18) and OpenBao (RPF-WP-0064). +**Current position, 2026-10-27:** 40 tasks done; 1 cancelled (T43, phase B paused); 0 in progress; 3 waiting (T21, T44, T03). Builder mode (founder decision 2026-10-27, option A): T15 and T18 are accepted on the owner acceptances and isolated-restore evidence, and the joint live consumer login moves to the pre-production drill T44. Actual isolated recovery has passed for LLDAP (T16), Authelia (T17), privacyIDEA audit continuity (T20), existing-token MFA (T19), KeyCape issuer side (T18) and OpenBao (RPF-WP-0064). -**Next actions:** close the T02 ledger's caller dispositions (T21) and the two historical credential objects (T22), then T03. T44 runs before production. +**Next actions:** close the T02 ledger's caller dispositions (T21), then T03. T22 is done (historical objects deleted 2026-10-27). T44 runs before production. **Closure:** T03 assembles owner acceptance after its named dependencies pass. Passing archive recovery does not prove existing-user authentication, retained @@ -718,11 +718,10 @@ before execution; record deferred actions separately rather than faking a pass. ```task id: NK-WP-0049-T22 -status: wait +status: done priority: high assignee: codex depends_on: [NK-WP-0049-T02, NK-WP-0049-T21] -blocking_reason: "Caller ledger delivered by T02 (2026-10-23). Await current replacement-lane acceptance and explicit credential-owner dispositions; existing exposure-rotation deferral is unchanged." state_hub_task_id: "3ea6bf00-a87f-58ea-bdce-328c13a03a55" ``` @@ -741,6 +740,14 @@ rotation deferral and decision `1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa` remain in record their exact applicability rather than automatically rotating or treating source retirement as provider revocation. + +2026-10-27, founder-run with the attended admin kubeconfig (route `kubernetes-railiance01-admin`), builder mode: T22 is **done**. +Both historical objects named by T02 still existed (`sso/keycape-pi-token`, Opaque, 1 key, 216d; `mfa/privacyidea-trigger-admin`, +Opaque, 2 keys, 216d). A read-only scan of all Deployments, StatefulSets, DaemonSets, CronJobs, Jobs and Pods found no reference to +either name. The founder deleted both; follow-up `get` returned `NotFound` for each. Neither is in the identity backup `secret_refs`. +This is NK-WP-0022's explicit deletion approval for these two objects. Disposition: Kubernetes copies deleted and verified absent; +revocation of the underlying privacyIDEA credentials is not claimed and stays under the founder's rotation deferral +CUST-WP-0073-T05 / decision `1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa`. No other historical credential copy is open in the T02 ledger. ## Provide retrieval that works when OpenBao and SSO are unavailable ```task @@ -1660,7 +1667,7 @@ status: wait priority: high assignee: codex depends_on: [NK-WP-0049-T02, NK-WP-0049-T16, NK-WP-0049-T17, NK-WP-0049-T18, NK-WP-0049-T19, NK-WP-0049-T20, NK-WP-0049-T21, NK-WP-0049-T22, NK-WP-0049-T23, NK-WP-0049-T24, NK-WP-0049-T26] -blocking_reason: "T15 and T18 accepted 2026-10-27 (builder mode, residual in T44). Await T21 caller dispositions and T22 historical-credential dispositions." +blocking_reason: "T15, T18 and T22 done 2026-10-27 (builder mode; T18 residual in T44). Await T21 caller disposition acceptance." state_hub_task_id: "d68cd4d3-1ba3-530e-88f9-26ebb8dd6eac" ```