coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0049-T40: done; founder signed the attempt admission, selector preflight admitted
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4384@bnt-lap001
Assistant-Session: 80d1f3da-7a91-4519-9737-9ba128b4da64
This commit is contained in:
tegwick 2026-10-23 19:06:52 +02:00
parent 8314cefa71
commit a20dcfe162
2 changed files with 12 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
WORK-RECORDS.md
View file

@ -289,7 +289,7 @@
| task | NK-WP-0049-T37 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T38 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T39 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T40 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T40 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0050-T01 | done | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
| task | NK-WP-0050-T02 | progress | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
| task | NK-WP-0050-T03 | wait | — | workplans/NK-WP-0050-playwright-consumer-registration.md |

13
workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
View file

@ -1299,13 +1299,12 @@ rehearsal first). Recorded under T35.
```task
id: NK-WP-0049-T40
status: wait
status: done
priority: high
assignee: founder
needs_human: true
decision_id: "d1ab097d-cc79-4612-9c17-bb9b364081ac"
depends_on: [NK-WP-0049-T33]
blocking_reason: "Approved in principle (d1ab097d); founder signs the <=24h secrets-engine-recovery-attempt admission now: T33 packet done 2026-10-23, anchor installed and self-tested."
state_hub_task_id: "90865f76-0573-5840-b1b5-937f0820ea82"
```
@ -1326,6 +1325,16 @@ Evening order:
(4) ceremony steps 3 to 5 (production ACME reissue under RCLUSTER-WP-0018-T04, launcher, independent receipt verifier with `--not-after 2026-10-24T05:00:00+00:00`) under T18.
If the window lapses, write a new file and sign again. Never edit the signed bytes.
2026-10-23 19:04 Berlin: signed by the founder. `attempt.json` is unchanged (sha256 `f8297954…c157`);
`attempt.json.sig` lies beside it, outside Git. Selector preflight from secrets-engine `a14fbc0` with
`--admission` exited 0: `founder_admitted_attempt_not_native_acceptance`, principal `bernd`, key
`SHA256:NekDABfw8K8IBYznjREg7jPpcK/BzCgO1pH1ebT/FXM`, namespace `secrets-engine-recovery-attempt`, the
eight consumer fields equal to the selector, `credential_source_exercised: false`, `network_contacted: false`.
This is founder authority for this one attempt, not native acceptance. T18 continues with ceremony steps 3 to 5
before 2026-10-24T05:00Z. Launcher private-admission note: the R1 template pin for
`tools/bootstrap-recovery/isolated-keycape.py` is superseded by the reviewed T38 publication
`sha256:86f37add…b718`; the other 16 pins match HEAD.
## Verify actual SOPS compatibility and sealed-descriptor read/write custody
```task