---
id: capability.security.bootstrap-recovery
owner: net-kingdom
status: draft
domain: infotech
maturity:
  discovery:
    current: D3
    target: D5
    confidence: medium
    rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations
      are documented; no exhaustive or generalized maturity claim.
  availability:
    current: A2
    target: A2
    confidence: medium
    rationale: 'Source interface assessed 2026-10-14: Local identity, bootstrap console,
      encrypted custody handoff and caller tools. Availability describes the delivery
      form, not production acceptance. Source repairs and disposable native fixtures
      do not prove estate root isolation or recovery.'
external_evidence:
  completeness:
    level: C1
    confidence: low
    basis: Source artifacts establish a bounded capability; no independent consumer-completeness
      assessment in this review.
  reliability:
    level: R0
    confidence: low
    basis: No longitudinal consumer reliability measurement established by this review.
name: Guarded bootstrap and recovery preparation
summary: Guarded bootstrap custody, encrypted identity backup capture, independent
  retrieval and isolated recovery verification.
tags:
- security
- netkingdom
- framework-reuse
- backup
- restore
- disaster-recovery
- age
- privacyidea
- lldap
- authelia
- keycape
discovery:
  intent: Find and verify off-host identity recovery material before rebuilding Railiance
    authentication.
  includes:
  - Local identity, bootstrap console, encrypted custody handoff and caller tools
  - Bounded LLDAP/Authelia SQLite snapshots, KeyCape signing/config/policy and original
    privacyIDEA keys plus linked PostgreSQL dump
  - Public-recipient age sealing, Storage Share create/readback, separate retention
    and attended independent-key archive verification
  - Railiance bootstrap handoff and a prepared independent-provider download path
    requiring neither OpenBao nor SSO; actual outage-path owner drill remains pending
  excludes:
  - Source repairs and disposable native fixtures do not prove estate root isolation
    or recovery
  use_cases:
  - 'U10: Operator recovers identity, custody or data with independently held recovery
    material'
availability:
  current_level: A2
  target_level: A2
  current_artifacts:
  - tools/security-bootstrap-console/README.md
  - tools/custody-record/README.md
  - docs/bootstrap-recovery-ceremony.md
  - tools/bootstrap-recovery/identity-backup-profile.json
  - tools/bootstrap-recovery/capture-identity.py
  - tools/bootstrap-recovery/retrieve-identity.py
  - tools/bootstrap-recovery/retrieve-identity-offline.py
  - tools/bootstrap-recovery/recovery-kit.py
  - tools/bootstrap-recovery/run-offline-recovery.sh
  - docs/disaster-recovery-storage-share.md
  - docs/identity-service-restore-packet.md
  - tools/bootstrap-recovery/verify-identity.py
  consumption_modes:
  - CLI
  - source
relations:
  related_to:
  - capability.security.practice-canon
  - capability.security.doctrine-review
  - capability.iam.key-cape
  - capability.authorization.policy-evaluate
  - capability.registry.register
  - capability.railiance.bootstrap-sequencing
  specializes:
  - capability.security.iam-tooling-suite
evidence:
  documentation:
  - tools/security-bootstrap-console/README.md
  - tools/custody-record/README.md
  - docs/bootstrap-recovery-ceremony.md
  - workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
  - docs/evidence/2026-10-16-identity-backup-live/actual-full-recovery-review.json
  - docs/evidence/2026-10-16-identity-backup-live/activation-review.json
  tests:
  - tests/test_identity_bundle.py
  - tests/test_identity_offsite.py
  - tests/test_identity_backup_preparation.py
  - tests/test_identity_offline_recovery.py
consumer_guidance:
  recommended_for:
  - Operator recovers identity, custody or data with independently held recovery material
  not_recommended_for:
  - Source repairs and disposable native fixtures do not prove estate root isolation
    or recovery
  known_limitations:
  - Source repairs and disposable native fixtures do not prove estate root isolation
    or recovery
  - 2026-10-14 architecture review estimates operational maturity separately; a registry
    entry does not authorize execution or establish deployment.
  - Actual old privacyIDEA database recovery passed; full token decryption, audit
    continuity and directory/issuer authentication remain open.
  - Storage Share initial destination only; no second-provider full identity copy
    or autonomous bare-VM restore is established.
  - Actual first full identity bundle captured, sealed and Storage Share readback
    verified on2026-10-16; both scoped readers passed native identity/namespace/audience/ESO
    checks. Independent human-key full archive recovery passed and daily backup/hourly
    health are active. Complete service authentication/token decryption/audit continuity
    and an unattended full-estate rebuild remain unproven. 56 focused implementation
    checks pass.
---

# Guarded bootstrap and recovery preparation

Local identity, bootstrap console, encrypted custody handoff and caller tools.

## Reuse boundary

Source repairs and disposable native fixtures do not prove estate root isolation or recovery.

## Supported use cases

- U10: Operator recovers identity, custody or data with independently held recovery material

## Evidence and integration

- [tools/security-bootstrap-console/README.md](../../tools/security-bootstrap-console/README.md)
- [tools/custody-record/README.md](../../tools/custody-record/README.md)

Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.

## Identity recovery and bootstrap handoff

Start with [the recovery ceremony](../../docs/bootstrap-recovery-ceremony.md). It names the exact capture, retrieval, hidden-key verification, activation gates and remaining full-service proof. Railiance bootstrap sequences the isolated recovery and layer handoff; NetKingdom owns identity assets and native acceptance. Discovery does not authorize grants or live restore.

For an outage, use [the Storage Share recovery guide](../../docs/disaster-recovery-storage-share.md)
and the self-contained kit built by `tools/bootstrap-recovery/recovery-kit.py`.
The private operator handoff publishes the versioned guide/kit with readback,
retrieves the protected generation using independently held provider access,
and prompts separately for the human-held age key. Source/fixture preparation
passed; consult NK-WP-0049-T23/T26 for actual outage drill/publication acceptance.
The [isolated service packet](../../docs/identity-service-restore-packet.md)
records the remaining service-owner admission and native tests.