---
id: capability.security.bootstrap-recovery
owner: net-kingdom
status: draft
domain: infotech
maturity:
  discovery:
    current: D3
    target: D5
    confidence: medium
    rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations
      are documented; no exhaustive or generalized maturity claim.
  availability:
    current: A2
    target: A2
    confidence: medium
    rationale: 'Source interface assessed 2026-10-14: Local identity, bootstrap console,
      encrypted custody handoff and caller tools. Availability describes the delivery
      form, not production acceptance. Source repairs and disposable native fixtures
      do not prove estate root isolation or recovery.'
external_evidence:
  completeness:
    level: C1
    confidence: low
    basis: Source artifacts establish a bounded capability; no independent consumer-completeness
      assessment in this review.
  reliability:
    level: R0
    confidence: low
    basis: No longitudinal consumer reliability measurement established by this review.
name: Guarded bootstrap and recovery preparation
summary: Guarded bootstrap custody, encrypted identity backup capture, independent
  retrieval and isolated recovery verification.
tags:
- security
- netkingdom
- framework-reuse
- backup
- restore
- disaster-recovery
- age
- privacyidea
- lldap
- authelia
- keycape
discovery:
  intent: Find and verify off-host identity recovery material before rebuilding Railiance
    authentication.
  includes:
  - Local identity, bootstrap console, encrypted custody handoff and caller tools
  - Bounded LLDAP/Authelia SQLite snapshots, KeyCape signing/config/policy and original
    privacyIDEA keys plus linked PostgreSQL dump
  - Public-recipient age sealing, Storage Share create/readback, separate retention
    and attended independent-key archive verification
  - Railiance bootstrap handoff without requiring recovered SSO for off-host retrieval
  excludes:
  - Source repairs and disposable native fixtures do not prove estate root isolation
    or recovery
  use_cases:
  - 'U10: Operator recovers identity, custody or data with independently held recovery
    material'
availability:
  current_level: A2
  target_level: A2
  current_artifacts:
  - tools/security-bootstrap-console/README.md
  - tools/custody-record/README.md
  - docs/bootstrap-recovery-ceremony.md
  - tools/bootstrap-recovery/identity-backup-profile.json
  - tools/bootstrap-recovery/capture-identity.py
  - tools/bootstrap-recovery/retrieve-identity.py
  - tools/bootstrap-recovery/verify-identity.py
  consumption_modes:
  - CLI
  - source
relations:
  related_to:
  - capability.security.practice-canon
  - capability.security.doctrine-review
  - capability.iam.key-cape
  - capability.authorization.policy-evaluate
  - capability.registry.register
  - capability.railiance.bootstrap-sequencing
  specializes:
  - capability.security.iam-tooling-suite
evidence:
  documentation:
  - tools/security-bootstrap-console/README.md
  - tools/custody-record/README.md
  - docs/bootstrap-recovery-ceremony.md
  - workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
  tests:
  - tests/test_identity_bundle.py
  - tests/test_identity_offsite.py
  - tests/test_identity_backup_preparation.py
consumer_guidance:
  recommended_for:
  - Operator recovers identity, custody or data with independently held recovery material
  not_recommended_for:
  - Source repairs and disposable native fixtures do not prove estate root isolation
    or recovery
  known_limitations:
  - Source repairs and disposable native fixtures do not prove estate root isolation
    or recovery
  - 2026-10-14 architecture review estimates operational maturity separately; a registry
    entry does not authorize execution or establish deployment.
  - Identity backup implementation passed 49 focused checks including synthetic age/native
    PostgreSQL recovery; new CCR-2026-0048/0049 grants and first actual full bundle
    remain pending owner admission.
  - Actual old privacyIDEA database recovery passed; full token decryption, audit
    continuity and directory/issuer authentication remain open.
  - Storage Share initial destination only; no second-provider full identity copy
    or autonomous bare-VM restore is established.
---

# Guarded bootstrap and recovery preparation

Local identity, bootstrap console, encrypted custody handoff and caller tools.

## Reuse boundary

Source repairs and disposable native fixtures do not prove estate root isolation or recovery.

## Supported use cases

- U10: Operator recovers identity, custody or data with independently held recovery material

## Evidence and integration

- [tools/security-bootstrap-console/README.md](../../tools/security-bootstrap-console/README.md)
- [tools/custody-record/README.md](../../tools/custody-record/README.md)

Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.

## Identity recovery and bootstrap handoff

Start with [the recovery ceremony](../../docs/bootstrap-recovery-ceremony.md). It names the exact capture, retrieval, hidden-key verification, activation gates and remaining full-service proof. Railiance bootstrap sequences the isolated recovery and layer handoff; NetKingdom owns identity assets and native acceptance. Discovery does not authorize grants or live restore.