coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0049-T18: attended original KeyCape attempt verified in isolation; receipt retained outside Git by hash
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4384@bnt-lap001
Assistant-Session: 80d1f3da-7a91-4519-9737-9ba128b4da64
This commit is contained in:
tegwick 2026-10-23 20:01:28 +02:00
parent a20dcfe162
commit a09bf20120
2 changed files with 46 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

27
docs/evidence/2026-10-23-nk49-t18-keycape-attempt/verifier-output.json Normal file
View file

@ -0,0 +1,27 @@
{
"schema": "netkingdom.keycape-attempt-receipt-verification.v1",
"receipt_sha256": "16d72f7cb25700ab5e57b7e7536f1085239c402ad99a128def941ac06e311651",
"verdict": "verified",
"findings": [],
"claims_not_made": [
"consumer continuity (T18)",
"retained-factor MFA (T19)",
"owner acceptance"
],
"invocation": {
"observed_at": "2026-10-23T17:35Z",
"verifier": "tools/bootstrap-recovery/verify-keycape-attempt-receipt.py",
"source_root": "clean git archive of net-kingdom a20dcfe tools/bootstrap-recovery",
"transfer_receipt": "fresh independent retrieval 2026-10-23 19:31 Berlin (private, outside Git), ciphertext 7117b3fe1e4840c86b301c94c85e6b16709e5626bb0884bd0580bde630e30e30",
"not_after": "2026-10-24T05:00:00+00:00",
"exit": 0
},
"attempt_inputs_public": {
"founder_admission_sha256": "f829795442a74c04de81032ebae84279f4c621891dc8e061aea461e58d26c157",
"launcher_admission_sha256": "a57c4c642d5abdbaac552deae0c3079062d3c8ed71544056380841a90e53a6ba",
"tls_cert_sha256": "0dd5d58264b552cfdffac6c003dddb789762ea6ba1013e0965c7979588135add",
"leaf_public_spki_sha256": "sha256:044daa6b300e8dc2a83bdac90e3a6df5d96c40a430c52043b69e2b9c4f188b0b",
"trust_sha256": "22b557a27055b33606b6559f37703928d3e4ad79f110b407d04986e1843543d1",
"tls_reissue": "railiance-cluster 88b360b, RCLUSTER-WP-0018-T04, Let's Encrypt YR2, 2026-10-23T16:23:09Z to 2027-01-21T16:23:08Z"
}
}

19
workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
View file

@ -615,6 +615,25 @@ positive/negative authentication using the restored dependencies; and isolation
and cleanup hold. Confirm the actual dependency graph in T15. Do not route a
production consumer to the isolated issuer or mint new client grants implicitly.
2026-10-23 evening, attended by the founder (ceremony steps 3 to 5, inside the T40 window):
step 3 production reissue through railiance-cluster `88b360b` (isolated namespace `tls-attempt-kc`,
own Issuer; live `sso/kc-tls` resourceVersion 66444692 and fingerprint D5:DB:2B:55… unchanged; cleanup done),
chain `0dd5d582…5add` to ISRG Root X1 `22b557a2…43d1`, key/cert public keys equal. Step 4: fresh
independent Storage Share retrieval of ciphertext `7117b3fe…0e30`, then the six-argument launcher with
launcher admission `a57c4c64…a6ba` (R1 template completed; `isolated-keycape.py` pin = reviewed T38
`86f37add…`): `OK: isolated KeyCape native checks and cleanup passed`. The first launcher run was refused
pre-key because two inputs were mode 0444; fixed to 0400 without changing bytes. Step 5: independent verifier
from a clean export of `a20dcfe`, `--not-after 2026-10-24T05:00:00+00:00`: `verified`, no findings.
Receipt `16d72f7c…1651` reports original JWKS signing key, original config/registry/policy receipts, native
service registration, denied scopes and wrong-secret refusal, original HTTPS issuer/trust, plaintext/container
cleanup, `production_contacted: false`. Evidence: `docs/evidence/2026-10-23-nk49-t18-keycape-attempt/verifier-output.json`.
The receipt itself is not in Git: the local and Forgejo secret scanners flag its public source-file digests
(`generic-api-key`, file names containing "keycape"), and the founder chose not to re-encode or exempt it. The exact
original is retained outside Git on the founder workstation (mode 0400), bound by sha256 `16d72f7c…1651` in the
verifier output. This deviates from the ceremony step 5 retention path by founder decision 2026-10-23.
Still open for T18: selected current consumer acceptance against restored dependencies (the receipt claims
no consumer continuity), and owner acceptance; MFA stays T19.
## Verify current caller and provider admission at their actual boundaries
```task