From a20dcfe1626aa7d31629da5f7b4c0c7b726d529a Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 23 Oct 2026 19:06:52 +0200 Subject: [PATCH] NK-WP-0049-T40: done; founder signed the attempt admission, selector preflight admitted Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 4384@bnt-lap001 Assistant-Session: 80d1f3da-7a91-4519-9737-9ba128b4da64 --- WORK-RECORDS.md | 2 +- ...P-0049-bootstrap-secret-free-recovery-handoff.md | 13 +++++++++++-- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 9133a10..e623a14 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -289,7 +289,7 @@ | task | NK-WP-0049-T37 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | | task | NK-WP-0049-T38 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | | task | NK-WP-0049-T39 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | -| task | NK-WP-0049-T40 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T40 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | | task | NK-WP-0050-T01 | done | — | workplans/NK-WP-0050-playwright-consumer-registration.md | | task | NK-WP-0050-T02 | progress | — | workplans/NK-WP-0050-playwright-consumer-registration.md | | task | NK-WP-0050-T03 | wait | — | workplans/NK-WP-0050-playwright-consumer-registration.md | diff --git a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md index 6f3517a..664bac7 100644 --- a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md +++ b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md @@ -1299,13 +1299,12 @@ rehearsal first). Recorded under T35. ```task id: NK-WP-0049-T40 -status: wait +status: done priority: high assignee: founder needs_human: true decision_id: "d1ab097d-cc79-4612-9c17-bb9b364081ac" depends_on: [NK-WP-0049-T33] -blocking_reason: "Approved in principle (d1ab097d); founder signs the <=24h secrets-engine-recovery-attempt admission now: T33 packet done 2026-10-23, anchor installed and self-tested." state_hub_task_id: "90865f76-0573-5840-b1b5-937f0820ea82" ``` @@ -1326,6 +1325,16 @@ Evening order: (4) ceremony steps 3 to 5 (production ACME reissue under RCLUSTER-WP-0018-T04, launcher, independent receipt verifier with `--not-after 2026-10-24T05:00:00+00:00`) under T18. If the window lapses, write a new file and sign again. Never edit the signed bytes. +2026-10-23 19:04 Berlin: signed by the founder. `attempt.json` is unchanged (sha256 `f8297954…c157`); +`attempt.json.sig` lies beside it, outside Git. Selector preflight from secrets-engine `a14fbc0` with +`--admission` exited 0: `founder_admitted_attempt_not_native_acceptance`, principal `bernd`, key +`SHA256:NekDABfw8K8IBYznjREg7jPpcK/BzCgO1pH1ebT/FXM`, namespace `secrets-engine-recovery-attempt`, the +eight consumer fields equal to the selector, `credential_source_exercised: false`, `network_contacted: false`. +This is founder authority for this one attempt, not native acceptance. T18 continues with ceremony steps 3 to 5 +before 2026-10-24T05:00Z. Launcher private-admission note: the R1 template pin for +`tools/bootstrap-recovery/isolated-keycape.py` is superseded by the reviewed T38 publication +`sha256:86f37add…b718`; the other 16 pins match HEAD. + ## Verify actual SOPS compatibility and sealed-descriptor read/write custody ```task