Fix private recovery prompts on nonseekable terminals

Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
2026-10-16 19:56:06 +02:00 · 2026-10-16 19:56:06 +02:00 · fbdd62b7ed
commit fbdd62b7ed
parent b35e81f48f
5 changed files with 229 additions and 15 deletions
--- a/docs/evidence/2026-10-16-identity-outage-recovery/terminal-prompt-fix.json
+++ b/docs/evidence/2026-10-16-identity-outage-recovery/terminal-prompt-fix.json
@ -0,0 +1,85 @@
+{
+  "schema": "netkingdom.identity-offline-terminal-fix.v1",
+  "date": "2026-10-16",
+  "original_attempt_receipt": {
+    "schema": "netkingdom.recovery-kit.v1",
+    "status": "failed",
+    "secret_values_exported": false,
+    "new_grants_created": false,
+    "files": [
+      {
+        "name": "net-kingdom-recovery-62b9464609b8e0fd-START-HERE.md",
+        "bytes": 8381,
+        "sha256": "1531675f2e7d3713a3a7fc28a5143fb24f201b19cd05d14c59ee485a0bc11e61"
+      },
+      {
+        "name": "net-kingdom-recovery-62b9464609b8e0fd.zip",
+        "bytes": 34527,
+        "sha256": "62b9464609b8e0fde2c05527fc79eff742ee3f626262d847df8fb579548a9470"
+      },
+      {
+        "name": "net-kingdom-recovery-62b9464609b8e0fd.zip.sha256",
+        "bytes": 108,
+        "sha256": "55e375291b27c2977049b89a5deddaed5e39c7ee9179013ce73d2ad43f2fb308"
+      }
+    ],
+    "error": "kit_operation_failed_private_diagnostics_suppressed"
+  },
+  "reproduced_failure": "UnsupportedOperation: File or stream is not seekable opening a controlling terminal with Python text r+ before getpass",
+  "fix": "Shared getpass prompt with interactive stdin/stderr checks and GetPassWarning raised before echo fallback; no seek-requiring terminal open",
+  "tests": {
+    "command": "python3 -m pytest -q tests/test_identity_offline_recovery.py tests/test_identity_offsite.py",
+    "passed": 36,
+    "failed": 0,
+    "real_controlling_terminal_hidden_input_verified": true,
+    "redirected_input_refused": true,
+    "echo_fallback_refused": true,
+    "both_cli_failed_stage_receipts_verified": true
+  },
+  "sources": [
+    {
+      "path": "tools/bootstrap-recovery/retrieve-identity-offline.py",
+      "sha256": "3421dbb3f3280a001d33ea2deb12ab609404a0b4254cd43c21518d77d166f972"
+    },
+    {
+      "path": "tools/bootstrap-recovery/recovery-kit.py",
+      "sha256": "6fa0f1494dccaf003b6c6396c5de8b36faa2b276eeb16badd04383f5efb71e66"
+    },
+    {
+      "path": "tests/test_identity_offline_recovery.py",
+      "sha256": "827b4e135d6be7a54f3f56cfc9340828462a70866ffe3513b544256bf2dafa31"
+    }
+  ],
+  "rebuilt_kit": {
+    "schema": "netkingdom.recovery-kit.v1",
+    "status": "built",
+    "secret_values_exported": false,
+    "new_grants_created": false,
+    "files": [
+      {
+        "name": "net-kingdom-recovery-57d1940947aa25ff-START-HERE.md",
+        "bytes": 8381,
+        "sha256": "1531675f2e7d3713a3a7fc28a5143fb24f201b19cd05d14c59ee485a0bc11e61"
+      },
+      {
+        "name": "net-kingdom-recovery-57d1940947aa25ff.zip",
+        "bytes": 34930,
+        "sha256": "57d1940947aa25ff83d0f25ddf30090eb40595cccaab64225de882a2fd59ea2f"
+      },
+      {
+        "name": "net-kingdom-recovery-57d1940947aa25ff.zip.sha256",
+        "bytes": 108,
+        "sha256": "102d1cd25662650a7a181039f6646883d72a9d976551a8950279d8936ca22171"
+      }
+    ],
+    "finished_at": "2026-10-16T17:55:59.729885+00:00"
+  },
+  "actual_provider_publication_verified": false,
+  "actual_outage_retrieval_verified": false,
+  "private_credential_values_read_by_agent": false,
+  "knowledge": {
+    "version": "0.2.6",
+    "digest": "8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02",
+    "status": "runbooks withheld; existing directly reviewed local owner contract governs scoped code repair"
+  }
+}