coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0049-T40: unsigned attempt admission prepared for the 19:00 session; evening order recorded
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4101@bnt-lap001
Assistant-Session: bc7d2ce5-6f32-45f1-83e5-0dcbb8e610a7
This commit is contained in:
tegwick 2026-10-23 13:27:46 +02:00
parent 5a8958bf08
commit 8314cefa71
1 changed files with 14 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

14
workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
View file

@ -1312,6 +1312,20 @@ state_hub_task_id: "90865f76-0573-5840-b1b5-937f0820ea82"
The signed document is T33's required `--admission` input and T18's surviving
offline authorization. The signature does not run the attempt.
2026-10-23 handoff: the session is scheduled for 19:00 Berlin (17:00Z) today. The unsigned admission is prepared
at `~/nk49-attempt-20261023/attempt.json` (outside Git, dir 0700, file 0444, sha256
`f8297954…c157`). It binds case `secrets15-nk49-readiness`, issuer `https://kc.coulomb.social`,
selector `sha256:02077af3…7012`, service_auth `sha256:c0ade429…86c0`, and window
2026-10-23T17:00:00Z to 2026-10-24T05:00:00Z (12 h, ending 07:00 Berlin). Pins were rechecked against secrets-engine
HEAD `a14fbc0`, with no change to the selector, service_auth.py, the checker or founder_admission.py
since `0f44fbe`. A dry check passed every field and window rule, and refused only the missing signature.
Evening order:
(1) confirm that sha256 is unchanged;
(2) founder signs: `ssh-keygen -Y sign -f ~/.ssh/gexec_approver_ed25519 -n secrets-engine-recovery-attempt ~/nk49-attempt-20261023/attempt.json`;
(3) ceremony step 2, selector preflight with `--admission`, must report `founder_admitted_attempt_not_native_acceptance`;
(4) ceremony steps 3 to 5 (production ACME reissue under RCLUSTER-WP-0018-T04, launcher, independent receipt verifier with `--not-after 2026-10-24T05:00:00+00:00`) under T18.
If the window lapses, write a new file and sign again. Never edit the signed bytes.
## Verify actual SOPS compatibility and sealed-descriptor read/write custody
```task