net-kingdom/docs/evidence/2026-10-27-production-readiness-ledger.md

Production readiness ledger — 2026-10-27

Task: NK-WP-0055-T01. This is a read-only assessment. Sources:

• the net-kingdom repository and State Hub;
• read-only owner assessments from railiance-platform, access-engine and audit-core, each made from its own repository files and git history the same day;
• founder-run admin checks recorded in NK-WP-0049.

A check is met only if it was observed on the estate that serves production traffic. Builder-mode acceptances count as partial. The definition is in NK-WP-0055.

Summary

#	Area	Status	Gap carried by
1	Platform root custody	partial (single-holder custody: accepted exception)	T13, NK-WP-0054-T07
2	MFA and identity	partial (SI-X4 closed 2026-10-27)	NK-WP-0054-T04/T05/T06, T12
3	Bootstrap and recovery	partial	T02–T04, T07 (NK-WP-0053), T08
4	OpenBao runtime secrets	partial (manual Shamir unseal approved)	T07 (RPF-WP-0036-T03), T12
5	Secret rotation	partial	T06, T15, RPF-WP-0035, RPF-WP-0055-T01
6	flex-auth (access-engine) policy state	partial	T14, FLEX-WP-0031, FLEX-WP-0024
7	Topaz runtime	accepted exception (ADR-0018: the core is the production PDP)	T12 (core checks), T14
8	Tenant onboarding	partial	T11, T12
9	Audit sink	open	T11, AUDIT-WP-0013-T02, AUDIT-WP-0015-T01
10	Break-glass	partial (king path drilled 2026-10-28)	NK-WP-0053 recurring drill; T16 at production entry

None of the ten areas is met. One is an accepted exception (7), and one is open (9). Area 10 moved from open to partial on 2026-10-28.

Founder decisions, 2026-10-27 (hub decision 37464824, NK-WP-0055-T10)

Decision	Effect on the ledger
(a) Manual Shamir unseal is the approved production mechanism for now.	Area 4's unseal gap is closed. Its other gaps remain.
(b) Topaz is not required. The access-engine Go core is the production PDP (ADR-0018).	Area 7 is an accepted exception. Its health, freshness, load and fail-closed checks move to the core under T12, and Topaz leaves the T11 audit sources.
(c) The founder, as platform-root, holds all OpenBao unseal shares. This is an accepted exception to two-of-three custody.	Area 1's escrow gap becomes an exception. Item 4 (the offline king path with SSO down) stays open under T13.
(d) HA is out of scope for now.	No area changes.

Each exception is reviewed at the production declaration (T09).

Per area

1. Platform root custody: partial

Evidence.

• The custody model and records are in docs/platform-root-custody.md and ADR-0017.
• The non-secret root-grant record is NK-WP-0045, and railiance-platform keeps its own custody record in RPF-WP-0049.
• The crisis custody list is docs/crisis-custody-list.md.

Missing.

• The two-of-three escrow holders are not named. The custody doc's stage S6 is not reached, so custody is still single-operator, which the architecture allows only before production.
• The OpenBao unseal share holders are TO CONFIRM (crisis list item 3).
• The offline king path that works with SSO down is TO CONFIRM (item 4).

2. MFA and identity: partial

Evidence.

• KeyCape issues tokens on the IAM Profile v0.3 contract.
• Privileged-action MFA guards are delivered for the portal and Vergabe clients (NK-WP-0042).
• The retained-MFA restore is proven (NK-WP-0049-T19).

Missing.

• The aal2 binding on OpenBao platform-admin is not applied. Applied and verified by the founder on 2026-10-27 (RPF-WP-0065-T04); SI-X4 is closed and the account checks conformant.
• No recorded tools/iam-profile-conformance/ run against the live issuer (NK-WP-0054-T04 is waiting).
• The bind account is still the human admin (NK-WP-0054-T05/T06).
• Validation runs still lean on platform-root.

3. Bootstrap and recovery: partial

Evidence. NK-WP-0049 is finished:

• secret-free bootstrap output;
• daily off-host encrypted backup;
• retrieval that works with OpenBao and SSO down;
• isolated owner restores of all four identity services and of OpenBao.

Missing.

• The joint live consumer drill (T02–T04).
• A recurring drill: NK-WP-0053-T02 waits on its first run, and T04 for an admin-operated drill.
• Undrilled crisis items: pi-admin (item 7), the ops bundle location (item 8) and operator access with SSO down (item 9).
• Receipt custody (T08).

4. OpenBao runtime secrets: partial

Evidence.

• Per-workload scoped Kubernetes and JWT auth and policies (railiance-platform/openbao/policies/).
• A file audit device, checked by make openbao-verify-post-unseal.
• Operator-only access (RPF-WP-0025).
• The isolated original restore (RPF-WP-0064-T07/T08).

Missing.

• Manual Shamir unseal is in use, but it is not recorded as the approved production mechanism. Auto-unseal was never verified.
• No scheduled snapshot job. RPF-WP-0064-T08 says that one restore is not recurring assurance (RPF-WP-0036-T03).
• No dated live check of the auth methods and mounts against the committed policies.

5. Secret rotation: partial

Evidence.

• Dynamic database credentials exist for core-hub.
• The rotation lanes are designed in RPF-WP-0035 (blocked; T12 in progress).
• The backup credential default was removed (RPF-WP-0029).

Missing.

• Rotation of the exposed material, held by founder decision 1591daa1 and CUST-WP-0073-T05.
• KeyCape client-secret rotation (RPF-WP-0055-T01, backlog).
• No per-lane register of blast radius and verification steps.

6. flex-auth (access-engine) policy state: partial

Evidence.

• Policy-as-code with check, list-allowed and explain.
• Versioned packages: a fail-open fix ships as a new version (FLEX-DEC-2026-008).
• Tenant-scope coverage (FLEX-WP-0022).
• Nine declared release units.

Missing.

• Policies are not imported through a pipeline: a change needs a new image plus a helm upgrade.
• No platform/tenant package split for tenant:coulomb.
• No production explain receipt.
• Decision-record emission is declared but not delivered (FLEX-WP-0031).
• The decision envelope is unsigned (FLEX-WP-0024-T07 waits on a founder gate).

7. Topaz runtime: open

Evidence. Topaz exists only as an adapter shape (internal/adapters/topaz/, FLEX-WP-0004). Nothing deploys it, and every live decision comes from the Go core.

Correction to the table. Fail-closed is declared per consumer (pep-stance.yaml), not in the PDP.

Decision needed (T10). Is a delegated Topaz PDP required for production, or does the Go core satisfy this area?

8. Tenant onboarding: partial

Evidence.

• The onboarding portal, self-registration and first-login provisioning (NK-WP-0023, 0025, 0036).
• Tenant-scoped identity lifecycle (NK-WP-0038).
• Tenant-scoped authorization (FLEX-WP-0022).

Missing.

• The architecture's completion test has not been run end to end for tenant:coulomb: a workload authenticates, gets a scoped decision, obtains only its secret, enforces locally and produces an auditable record.
• Its audit and correlation leg depends on area 9.

9. Audit sink: open

Evidence.

• audit-core runs on durable PostgreSQL (AUDIT-WP-0005), with a hash chain (AUDIT-WP-0007).
• A single restore walk on 2026-08-13.
• Registered senders: user-engine, tenant-engine, approval-engine and informed-decision. The Qonto collector is the only workload source.

Missing.

Source	Status	Owner
Identity providers (KeyCape, Authelia, LLDAP, privacyIDEA)	not senders	—
access-engine	not a sender	AUDIT-WP-0013-T02 waits on access-engine
Topaz	not a sender	—
OpenBao	audit only on a PVC; the docs say "not a durable audit sink"	—
Kubernetes API audit	absent	—

• No cross-stream correlation id.
• No recurring restore drill.
• No offsite chain head (AUDIT-WP-0015-T01).

Side finding. The NK-WP-0031 prerequisite (owner and E2 freshness metadata) has been met since audit-core commit ca9708e, so NK-WP-0031 can be unblocked.

10. Break-glass: open

Evidence. The crisis custody list exists, and the king OTP was validated against a restored privacyIDEA (isolated, 2026-10-24).

Missing.

• No recorded or drilled path that works when normal identity (SSO) is down: crisis list items 4 and 9 are TO CONFIRM.
• No post-event review record format.

Stale statements found

These are for their owners to fix. Nothing was changed here.

• access-engine SCOPE.md:125 says secrets-engine uses callerAuth.mode: warn, but values/secrets-engine.yaml says enforce.
• The readiness table row "MFA and identity" names IAM Profile v0.2. The accepted contract is v0.3.