coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record off-host database recovery and prepare identity backup coverage
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
This commit is contained in:
tegwick 2026-10-16 00:32:50 +02:00
parent a1939a7d06
commit dca999222f
13 changed files with 596 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

26
workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
View file

@ -476,6 +476,30 @@ recovery preparation; full matching identity key/config coverage, service
continuity, T02 owner acceptance and legacy credential disposition remain open.
Evidence: `privacyidea-transfer-r1.json`, `database-drill-preparation.json`.
2026-10-16 actual recovery and next coverage: the operator ran the prepared
hidden-key command successfully. Reviewed the actual receipt against exact
source/image/transfer digest and rehashed retained ciphertext. Original off-host
PI ciphertext decrypted, unrelated wrong key refused, native PostgreSQL restore
and aggregate readback passed (5 tokens, 2 resolvers, 2 realms), container and
plaintext cleanup passed; no NK49 Docker containers remain. The agent received
no private key or restored values. Full identity/token decryption/audit continuity
remain unproven; this is actual database recovery, not full service recovery.
The operator confirmed no known full identity bundle and requested preparation
of missing coverage (decision `ed20023f-0168-421d-be86-460391339876`). Prepared
`identity-backup-profile.json` and a metadata-only preparer. Current exact four
Deployment and five Bound PVC identities and all Secret/ConfigMap references
were checked on the primary cluster without Secret-value reads or pod exec.
Fourteen source tests pass for drift/unreviewed dependencies/private-data scope.
The profile specifies consistent data snapshots, original key/config capture,
credential recovery/reissue disposition, proposed primary/secondary archive
paths, per-generation lineage, immutable readback, measured size/quota, eventual
schedule/retention and native service acceptance. It is `prepared_not_admitted`:
new capture/sealing/transfer adapters and scoped publisher owner admission remain
necessary. No capture/upload/grant/schedule/rotation occurred in preparation.
T02 remains progress and T03 wait. Evidence: actual database drill/review and
`identity-backup-preparation-r1.json` under the October15 recovery evidence.
## Verify owner-approved recovery and current native callers
```task
@ -483,7 +507,7 @@ id: NK-WP-0049-T03
status: wait
priority: high
depends_on: [NK-WP-0049-T02]
blocking_reason: "A recent off-host PI database ciphertext is identified, but matching full identity data/key/config coverage and actual independent-key decryption remain unverified after bounded Storage Share/Scaleway inventory. Requires completed T02 owner/runtime and legacy-credential disposition, then the exact reviewed isolated recovery ceremony and native consumer acceptance. No live bootstrap/root retrieval or deferred exposure rotation is authorized by source tests."
blocking_reason: "The actual off-host PI database decrypted and restored with the independently held key; wrong-key refusal and cleanup passed. Operator reports no known full identity bundle and requested missing coverage preparation. Exact current workload/PVC/reference profile is prepared, but full data/key/config capture, new provider profile/publisher admission and native token/audit/directory/issuer recovery remain open, along with T02 current-owner and legacy-credential disposition. No live bootstrap/root retrieval or deferred exposure rotation is authorized."
state_hub_task_id: "d68cd4d3-1ba3-530e-88f9-26ebb8dd6eac"
```