---
id: capability.security.bootstrap-recovery
owner: net-kingdom
status: draft
domain: infotech
maturity:
  discovery:
    current: D3
    target: D5
    confidence: medium
    rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations
      are documented; no exhaustive or generalized maturity claim.
  availability:
    current: A2
    target: A2
    confidence: medium
    rationale: 'Source interface assessed 2026-10-14: Local identity, bootstrap console,
      encrypted custody handoff and caller tools. Availability describes the delivery
      form, not production acceptance. Source repairs and disposable native fixtures
      do not prove estate root isolation or recovery.'
external_evidence:
  completeness:
    level: C1
    confidence: low
    basis: Source artifacts establish a bounded capability; no independent consumer-completeness
      assessment in this review.
  reliability:
    level: R0
    confidence: low
    basis: No longitudinal consumer reliability measurement established by this review.
name: Guarded bootstrap and recovery preparation
summary: Guarded bootstrap custody, encrypted identity backup capture, independent
  retrieval and isolated recovery verification.
tags:
- security
- netkingdom
- framework-reuse
- backup
- restore
- disaster-recovery
- age
- privacyidea
- lldap
- authelia
- keycape
discovery:
  intent: Find and verify off-host identity recovery material before rebuilding Railiance
    authentication.
  includes:
  - Local identity, bootstrap console, encrypted custody handoff and caller tools
  - Bounded LLDAP/Authelia SQLite snapshots, KeyCape signing/config/policy and original
    privacyIDEA keys plus linked PostgreSQL dump
  - Public-recipient age sealing, Storage Share create/readback, separate retention
    and attended independent-key archive verification
  - Railiance bootstrap handoff and actual independent-provider retrieval requiring
    neither OpenBao nor SSO; operator archive recovery passed on 2026-10-16
  excludes:
  - Source repairs and disposable native fixtures do not prove estate root isolation
    or recovery
  use_cases:
  - 'U10: Operator recovers identity, custody or data with independently held recovery
    material'
availability:
  current_level: A2
  target_level: A2
  current_artifacts:
  - tools/security-bootstrap-console/README.md
  - tools/custody-record/README.md
  - docs/bootstrap-recovery-ceremony.md
  - tools/bootstrap-recovery/identity-backup-profile.json
  - tools/bootstrap-recovery/capture-identity.py
  - tools/bootstrap-recovery/retrieve-identity.py
  - tools/bootstrap-recovery/retrieve-identity-offline.py
  - tools/bootstrap-recovery/recovery-kit.py
  - tools/bootstrap-recovery/run-offline-recovery.sh
  - tools/bootstrap-recovery/isolated-lldap.py
  - tools/bootstrap-recovery/run-isolated-lldap.sh
  - tools/bootstrap-recovery/isolated-privacyidea.py
  - tools/bootstrap-recovery/run-isolated-privacyidea.sh
  - docs/disaster-recovery-storage-share.md
  - docs/identity-service-restore-packet.md
  - docs/storage-share-recovery-publication.md
  - tools/bootstrap-recovery/verify-identity.py
  consumption_modes:
  - CLI
  - source
relations:
  related_to:
  - capability.security.practice-canon
  - capability.security.doctrine-review
  - capability.iam.key-cape
  - capability.authorization.policy-evaluate
  - capability.registry.register
  - capability.railiance.bootstrap-sequencing
  specializes:
  - capability.security.iam-tooling-suite
evidence:
  documentation:
  - tools/security-bootstrap-console/README.md
  - tools/custody-record/README.md
  - docs/bootstrap-recovery-ceremony.md
  - workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
  - docs/evidence/2026-10-16-identity-backup-live/actual-full-recovery-review.json
  - docs/evidence/2026-10-16-identity-backup-live/activation-review.json
  tests:
  - tests/test_identity_bundle.py
  - tests/test_identity_offsite.py
  - tests/test_identity_backup_preparation.py
  - tests/test_identity_offline_recovery.py
  - tests/test_isolated_lldap_recovery.py
  - tests/test_isolated_privacyidea_recovery.py
consumer_guidance:
  recommended_for:
  - Operator recovers identity, custody or data with independently held recovery material
  not_recommended_for:
  - Source repairs and disposable native fixtures do not prove estate root isolation
    or recovery
  known_limitations:
  - Source repairs and disposable native fixtures do not prove estate root isolation
    or recovery
  - 2026-10-14 architecture review estimates operational maturity separately; a registry
    entry does not authorize execution or establish deployment.
  - Actual privacyIDEA internal token-material readback and stored audit continuity
    passed; existing-token MFA, Authelia and KeyCape authentication remain open.
  - Storage Share initial destination only; no second-provider full identity copy
    or autonomous bare-VM restore is established.
  - Actual first full identity bundle captured, sealed and Storage Share readback
    verified on2026-10-16; both scoped readers passed native identity/namespace/audience/ESO
    checks. Independent human-key full archive recovery passed and daily backup/hourly
    health are active. Full service authentication, existing-token MFA
    and an unattended full-estate rebuild remain unproven. 56 focused implementation
    checks pass.
---

# Guarded bootstrap and recovery preparation

Local identity, bootstrap console, encrypted custody handoff and caller tools.

## Reuse boundary

Source repairs and disposable native fixtures do not prove estate root isolation or recovery.

## Supported use cases

- U10: Operator recovers identity, custody or data with independently held recovery material

## Evidence and integration

- [tools/security-bootstrap-console/README.md](../../tools/security-bootstrap-console/README.md)
- [tools/custody-record/README.md](../../tools/custody-record/README.md)

Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.

## Identity recovery and bootstrap handoff

Start with [the recovery ceremony](../../docs/bootstrap-recovery-ceremony.md). It names the exact capture, retrieval, hidden-key verification, activation gates and remaining full-service proof. Railiance bootstrap sequences the isolated recovery and layer handoff; NetKingdom owns identity assets and native acceptance. Discovery does not authorize grants or live restore.

For an outage, use [the Storage Share recovery guide](../../docs/disaster-recovery-storage-share.md)
and the self-contained kit built by `tools/bootstrap-recovery/recovery-kit.py`.
The private operator handoff publishes the versioned guide/kit with readback,
retrieves the protected generation using independently held provider access,
and prompts separately for the human-held age key. Actual publication/readback
and independent outage-path archive recovery passed on 2026-10-16; T23/T26 are
done. See [the published location and trusted kit digest](../../docs/storage-share-recovery-publication.md).
The [isolated service packet](../../docs/identity-service-restore-packet.md)
records the remaining service-owner admission and native tests.

The local LLDAP stage now has a fixed-target executor with no external network,
ports or host mounts, Linux-tmpfs plaintext, original directory/key preservation,
native existing-user/wrong-password checks and cleanup. Six actual-image tests
with synthetic credentials passed, including an encrypted-bundle restore. All
five pinned service images were saved/reloaded locally. T28/T29 record that
preparation. Actual private real-backup LLDAP recovery passed on 2026-10-16;
T16 is done, with original identity rows, positive/negative native bind,
isolation and cleanup accepted. Authelia, KeyCape and existing-token MFA remain open.

The token-material/audit stage is `run-isolated-privacyidea.sh TRANSFER_RECEIPT`, with
only a hidden backup-key prompt. Its pinned native routines check internal
token-material readback and stored audit signatures, preserve original keys,
report history exceptions and remove the isolated database/worker/tmpfs. Native
synthetic tests cover valid, tampered and unsigned history, malformed keys and
encrypted-bundle recovery. Actual owner recovery passed on 2026-10-16: five token materials read internally,
279,209 stored signatures verified, new-entry/negative checks and cleanup passed.
T20/T31 are done; existing-token MFA remains T19 and is not implied by readback.