docs(recovery): accept retained token material and audit continuity

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2

docs/bootstrap-recovery-ceremony.md

@@ -520,3 +520,18 @@ plaintext were cleaned; failure markers and event outbox remain empty. This
 validates the actual hardened recurring-job path, beyond a direct CLI capture.
 Evidence: `recurring-job-review.json`. No further validation captures are needed
 before the next scheduled run absent a new failure or source change.
+
+
+## Native token-material and audit acceptance — 2026-10-16
+
+The independently retrieved identity generation passed native privacyIDEA checks
+on the fixed isolated local engine: all five retained token materials were read
+internally using the original enckey; unrelated-key results differed for all five.
+All 279,209 stored historical signatures verified, with zero unsigned/invalid
+rows. A new isolated entry verified with the preserved identity; tampering and
+an unrelated public key were refused. Container/plaintext cleanup passed.
+T20/T31 are done. Safe evidence and source/ciphertext/target bindings are in
+`evidence/2026-10-16-identity-outage-recovery/actual-isolated-privacyidea-review.json`.
+This accepts internal readback and stored-row signature continuity. Existing-token
+MFA, Authelia and KeyCape authentication remain separate; event completeness is
+not claimed. The published Storage Share kit remains its recorded version.

docs/evidence/2026-10-16-identity-outage-recovery/actual-isolated-privacyidea-recovery.json

@@ -0,0 +1,54 @@
+{
+  "schema": "netkingdom.isolated-privacyidea-recovery.v1",
+  "status": "isolated_privacyidea_checked",
+  "production_contacted": false,
+  "secret_values_exported": false,
+  "existing_token_mfa_proven": false,
+  "audit_signature_continuity_proven": true,
+  "container_cleanup_verified": true,
+  "temporary_plaintext_cleanup_verified": true,
+  "source_sha256": "4df7196678aac1ad594f32abf45c68dc21a9d2760d9e8a536a215a4a3c5d277f",
+  "target": {
+    "engine_id": "74f93783-6cef-43a8-a3c4-f62586cd3bc1",
+    "engine_name": "bnt-lap001",
+    "images": [
+      {
+        "reference": "docker.io/lldap/lldap@sha256:9e605a66c02514bfcffd1b67cafb1e98d50992216bb2871d7ae44622047dd09d",
+        "image_id": "sha256:9e605a66c02514bfcffd1b67cafb1e98d50992216bb2871d7ae44622047dd09d"
+      },
+      {
+        "reference": "ghcr.io/gpappsoft/privacyidea-docker@sha256:af7841adad262f129e0c1d4f553af13f21cb2f4dc713533f316cfe43ed0b4473",
+        "image_id": "sha256:af7841adad262f129e0c1d4f553af13f21cb2f4dc713533f316cfe43ed0b4473"
+      },
+      {
+        "reference": "postgres@sha256:ff23cdce56cac62ada6f66013e1a50864c0abbe79d132d40b6e05bd80f378a70",
+        "image_id": "sha256:ff23cdce56cac62ada6f66013e1a50864c0abbe79d132d40b6e05bd80f378a70"
+      }
+    ],
+    "production_contacted": false,
+    "network_mode": "none",
+    "host_ports_published": false
+  },
+  "ciphertext_sha256": "7117b3fe1e4840c86b301c94c85e6b16709e5626bb0884bd0580bde630e30e30",
+  "manifest_file_count": 36,
+  "all_manifest_hashes_verified": true,
+  "container_isolation_verified_before_private_import": true,
+  "retained_tokens_total": 5,
+  "retained_tokens_with_native_decryption": 5,
+  "different_key_cannot_reproduce_material_count": 5,
+  "retained_token_material_decrypted_inside_process": true,
+  "historical_audit_rows": 279209,
+  "historical_signed_rows": 279209,
+  "historical_unsigned_rows": 0,
+  "historical_invalid_signatures": 0,
+  "historical_legacy_signatures": 0,
+  "all_stored_audit_rows_checked": true,
+  "legacy_signature_verification_enabled": false,
+  "event_completeness_claimed": false,
+  "new_audit_entry_signed_verified": true,
+  "tampered_entry_refused": true,
+  "wrong_audit_public_key_refused": true,
+  "only_loopback_interface_verified": true,
+  "external_routes_absent": true,
+  "finished_at": "2026-10-16T19:10:46.010387+00:00"
+}

docs/evidence/2026-10-16-identity-outage-recovery/actual-isolated-privacyidea-review.json

@@ -0,0 +1,29 @@
+{
+  "schema": "netkingdom.actual-isolated-privacyidea-review.v1",
+  "status": "verified",
+  "accepted_at": "2026-10-16T19:10:46.010387+00:00",
+  "receipt": "actual-isolated-privacyidea-recovery.json",
+  "source_commit": "3223039446dc92c692dafb587127e93701a3c230",
+  "source_sha256_matches": true,
+  "known_recovered_ciphertext_matches": true,
+  "exact_local_target_matches": true,
+  "manifest_files_verified": 36,
+  "retained_token_materials_read_internally": 5,
+  "wrong_key_material_refusals": 5,
+  "historical_signatures_verified": 279209,
+  "historical_unsigned_or_invalid_rows": 0,
+  "new_signature_and_negative_checks_verified": true,
+  "container_and_plaintext_cleanup_verified": true,
+  "existing_token_mfa_proven": false,
+  "event_completeness_claimed": false,
+  "agent_received_private_credentials": false,
+  "accepted_tasks": [
+    "NK-WP-0049-T20",
+    "NK-WP-0049-T31"
+  ],
+  "knowledge_orientation": {
+    "version": "0.2.6",
+    "digest": "8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02",
+    "source_status": "withheld; current repository security companion reviewed directly"
+  }
+}

docs/identity-service-restore-packet.md

@@ -1,8 +1,8 @@
 # Isolated identity service restore packet
 
 NK-WP-0049-T15. Prepared 2026-10-16. **Actual LLDAP recovery accepted at
-18:37 UTC. Native privacyIDEA token-material/audit stage is prepared for an
-owner run; MFA, Authelia and KeyCape stages remain unexecuted.**
+18:37 UTC; native privacyIDEA token-material/audit recovery accepted at
+19:10 UTC. Existing-token MFA, Authelia and KeyCape remain unexecuted.**
 Accountable preparer: codex. Execution/acceptance: Railiance Platform and the
 LLDAP, Authelia, KeyCape and privacyIDEA service owners.
 
@@ -143,7 +143,7 @@ current production password validity, MFA or audit continuity.
 Do not silently reset credentials or re-enroll tokens to pass. Historical audit
 verification failures must be reported, not hidden with replacement keys.
 
-## Ready owner step: privacyIDEA token material and stored audit history
+## Accepted privacyIDEA token-material and stored-audit stage
 
 ```bash
 bash tools/bootstrap-recovery/run-isolated-privacyidea.sh \
@@ -193,8 +193,12 @@ scan. Counts/signatures/keys are never replaced with a sample to claim success.
 Exit0 means these bounded checks and cleanup passed. Exit2 means checks completed
 but historical audit exceptions need owner disposition; T20 must stay open.
 Exit1 indicates another failure. All outcomes have a safe receipt in the printed
-private evidence directory. Return only that directory and the outcome. Actual
-owner results are still pending; native synthetic fixtures do not close T20/T31.
+private evidence directory. Return only that directory and the outcome. Actual owner recovery passed at 19:10 UTC on 2026-10-16: five retained token
+materials read internally, 279,209 historical signatures verified, no unsigned or
+invalid rows, new-entry verification, both negative checks and cleanup passed.
+T20/T31 are done. Source/ciphertext/target bindings and the safe receipt are in
+`evidence/2026-10-16-identity-outage-recovery/actual-isolated-privacyidea-review.json`.
+Existing-token MFA remains T19; event completeness is not claimed.
 
 ## Unresolved inputs before execution
 
@@ -209,6 +213,6 @@ owner results are still pending; native synthetic fixtures do not close T20/T31.
 - Service-owner acceptance of network/config translations and all required
   grants. New grants or production effects require their own owner decisions.
 
-Until resolved, T15 stays in progress and T17–T20 remain waiting; T16 is done. Production
+Until resolved, T15 stays in progress and T17–T19 remain waiting; T16, T20 and T31 are done. Production
 cutover, full-host/OpenBao restoration and application database recovery are
 separate owner procedures.