feat(recovery): prepare full identity backup and bootstrap handoff

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2

registry/capabilities/capability.security.bootstrap-recovery.md

@@ -29,16 +29,30 @@ external_evidence:
     confidence: low
     basis: No longitudinal consumer reliability measurement established by this review.
 name: Guarded bootstrap and recovery preparation
-summary: Local identity, bootstrap console, encrypted custody handoff and caller tools.
+summary: Guarded bootstrap custody, encrypted identity backup capture, independent
+  retrieval and isolated recovery verification.
 tags:
 - security
 - netkingdom
 - framework-reuse
+- backup
+- restore
+- disaster-recovery
+- age
+- privacyidea
+- lldap
+- authelia
+- keycape
 discovery:
-  intent: Local identity, bootstrap console, encrypted custody handoff and caller
-    tools
+  intent: Find and verify off-host identity recovery material before rebuilding Railiance
+    authentication.
   includes:
   - Local identity, bootstrap console, encrypted custody handoff and caller tools
+  - Bounded LLDAP/Authelia SQLite snapshots, KeyCape signing/config/policy and original
+    privacyIDEA keys plus linked PostgreSQL dump
+  - Public-recipient age sealing, Storage Share create/readback, separate retention
+    and attended independent-key archive verification
+  - Railiance bootstrap handoff without requiring recovered SSO for off-host retrieval
   excludes:
   - Source repairs and disposable native fixtures do not prove estate root isolation
     or recovery
@@ -51,6 +65,11 @@ availability:
   current_artifacts:
   - tools/security-bootstrap-console/README.md
   - tools/custody-record/README.md
+  - docs/bootstrap-recovery-ceremony.md
+  - tools/bootstrap-recovery/identity-backup-profile.json
+  - tools/bootstrap-recovery/capture-identity.py
+  - tools/bootstrap-recovery/retrieve-identity.py
+  - tools/bootstrap-recovery/verify-identity.py
   consumption_modes:
   - CLI
   - source
@@ -61,12 +80,19 @@ relations:
   - capability.iam.key-cape
   - capability.authorization.policy-evaluate
   - capability.registry.register
+  - capability.railiance.bootstrap-sequencing
   specializes:
   - capability.security.iam-tooling-suite
 evidence:
   documentation:
   - tools/security-bootstrap-console/README.md
   - tools/custody-record/README.md
+  - docs/bootstrap-recovery-ceremony.md
+  - workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
+  tests:
+  - tests/test_identity_bundle.py
+  - tests/test_identity_offsite.py
+  - tests/test_identity_backup_preparation.py
 consumer_guidance:
   recommended_for:
   - Operator recovers identity, custody or data with independently held recovery material
@@ -78,6 +104,13 @@ consumer_guidance:
     or recovery
   - 2026-10-14 architecture review estimates operational maturity separately; a registry
     entry does not authorize execution or establish deployment.
+  - Identity backup implementation passed 49 focused checks including synthetic age/native
+    PostgreSQL recovery; new CCR-2026-0048/0049 grants and first actual full bundle
+    remain pending owner admission.
+  - Actual old privacyIDEA database recovery passed; full token decryption, audit
+    continuity and directory/issuer authentication remain open.
+  - Storage Share initial destination only; no second-provider full identity copy
+    or autonomous bare-VM restore is established.
 ---
 
 # Guarded bootstrap and recovery preparation
@@ -98,3 +131,7 @@ Source repairs and disposable native fixtures do not prove estate root isolation
 - [tools/custody-record/README.md](../../tools/custody-record/README.md)
 
 Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.
+
+## Identity recovery and bootstrap handoff
+
+Start with [the recovery ceremony](../../docs/bootstrap-recovery-ceremony.md). It names the exact capture, retrieval, hidden-key verification, activation gates and remaining full-service proof. Railiance bootstrap sequences the isolated recovery and layer handoff; NetKingdom owns identity assets and native acceptance. Discovery does not authorize grants or live restore.