coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(recovery): prepare full identity backup and bootstrap handoff
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
This commit is contained in:
tegwick 2026-10-16 01:37:11 +02:00
parent dca999222f
commit 994d11c869
29 changed files with 3277 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

32
workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
View file

@ -500,6 +500,36 @@ necessary. No capture/upload/grant/schedule/rotation occurred in preparation.
T02 remains progress and T03 wait. Evidence: actual database drill/review and
`identity-backup-preparation-r1.json` under the October15 recovery evidence.
2026-10-16 implementation and bootstrap/discovery checkpoint: implemented the
complete new-profile capture/seal, unique Storage Share publication/readback,
independent owner retrieval, attended archive/native database verifier, separate
retention and source-bound node installer. Prepared exact CCR-2026-0048/0049
for folder-only publisher(read/create) and retention(read/delete), exact ESO
readers and native positive/negative admission checks. Both CCRs validate with
no errors; claim confirmation and all owner approvals remain pending. Decision
`40bfae40-6108-4e51-8613-073339f5345f` is pending exact live-packet admission.
51 focused checks passed including actual synthetic age/full archive and native
PostgreSQL restoration, SQLite WAL snapshots, hostile archive/helper boundaries,
provider permission/retention gates and bootstrap dispatch. Live cluster
server-dry-run accepted ten new helper/delivery manifests plus both guarded DNS
selector patches, and systemd unit validation passed. No live secret capture,
new grant, upload, policy change, node installation or timer enable occurred.
Initial provider is Storage Share; the earlier proposed Scaleway identity prefix
is deferred. Runtime quota/headroom is checked; host-local health cannot detect
host loss. Full native identity/token/audit/caller recovery remains open.
At the operator's request reviewed railiance-bootstrap scope and added its
`identity-recovery` dispatcher and documented independent-custody → isolated
verification → S1/S2/S3 replacement → native identity acceptance handoff. This is
not an automated production importer; total-loss offline provider retrieval is
still an explicit gap. Updated the existing owner capability
`capability.security.bootstrap-recovery`, related it to bootstrap sequencing and
validated both registries; reuse-surface federation already includes both owner
indexes. No maturity promotion implies live acceptance. Reviewable rollout and
hidden-key steps: `docs/bootstrap-recovery-ceremony.md`; evidence in
`docs/evidence/2026-10-16-identity-backup-implementation/`. T02 progress/T03 wait.
## Verify owner-approved recovery and current native callers
```task
@ -507,7 +537,7 @@ id: NK-WP-0049-T03
status: wait
priority: high
depends_on: [NK-WP-0049-T02]
blocking_reason: "The actual off-host PI database decrypted and restored with the independently held key; wrong-key refusal and cleanup passed. Operator reports no known full identity bundle and requested missing coverage preparation. Exact current workload/PVC/reference profile is prepared, but full data/key/config capture, new provider profile/publisher admission and native token/audit/directory/issuer recovery remain open, along with T02 current-owner and legacy-credential disposition. No live bootstrap/root retrieval or deferred exposure rotation is authorized."
blocking_reason: "The actual off-host PI database decrypted and restored with the independently held key; wrong-key refusal and cleanup passed. Operator reports no known full identity bundle and requested missing coverage preparation. Full-profile source adapters, bootstrap handoff and discovery are implemented/tested, but CCR-2026-0048/0049 owner admission, first actual full capture/off-site proof and native token/audit/directory/issuer recovery remain open, along with T02 current-owner and legacy-credential disposition. No live bootstrap/root retrieval or deferred exposure rotation is authorized."
state_hub_task_id: "d68cd4d3-1ba3-530e-88f9-26ebb8dd6eac"
```