net-kingdom/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	flavor	depends_on	state_hub_workstream_id
NK-WP-0049	workplan	Remove bootstrap secret output and verify separated recovery custody	infotech	net-kingdom	active	codex	netkingdom	2026-10-12	2026-10-12	implementation		17d315f0-829e-57c7-85cc-3a7914152804

Native owner work for CUST-WP-0080 G08. NK-WP-0045 proves recovery of the non-secret root-grant record, not custody of the bootstrap private key or secret-bearing emergency bundle. Existing founder-deferred exposure rotation remains CUST-WP-0073-T05; this work does not override it or rotate any root.

Remove secret-bearing output and ambient root discovery

id: NK-WP-0049-T01
status: done
priority: high
state_hub_task_id: "d7ca8d5f-c5ff-5cba-bd25-038cb53ffe4e"

2026-10-12: regression reproduced emergency/reprint root export, generation prefix disclosure, permissive file modes, dry-run side effects and unattended entry. Replaced emergency export with a non-secret guide (legacy secret-input arguments refused), suppressed generation prefixes/tracing and set private permissions. Bootstrap requires the registered public recipient and an attended terminal; never generates/discovers a permanent private key. Encrypted resume requires an explicit matching temporary custody key before cluster activity. Dry-run is a non-mutating plan. The live cluster/apply path was not executed.

A fresh uniquely named encrypted ops bundle follows apply; old delivery flags cannot skip current acknowledgment. New acknowledgment state binds its SHA256 and timestamp. Declining stops before cleanup/completion. This is an operator statement, not an independent restore receipt. Historical fields remain unchanged. Make/help/status/console and current credential guidance reflect that distinction. Evidence and exact source manifest: Custodian docs/evidence/2026-10-12-netkingdom-security/bootstrap-handoff.json.

Reconcile other legacy custody callers and root-output boundaries

id: NK-WP-0049-T02
status: progress
priority: high
state_hub_task_id: "479d6970-6516-50f5-9436-bb5b56d58aad"

Inspect remaining direct encrypt/decrypt defaults, permanent-key setup commands, custody helper tracing/error handling and delegated apply/init helpers against the accepted single-founder attended custody decision. Public-recipient-only encryption and explicit temporary unlock must hold at their actual call sites. Do not treat a tty check as identity, authority or agent isolation. Reuse CUST-WP-0073/GLAS-WP-0012 for runtime isolation and Platform for root custody; record any further exact source defects and repair them before native acceptance.

2026-10-12 caller audit: direct encrypt/decrypt helpers and custody unlock repaired. Eight initial regressions failed against prior source. Encryption defaults to the registered public file and refuses private-key inputs; decryption has no HOME fallback and publishes only complete private output from staging, preserving existing outputs and removing partial failures. Unlock suppresses xtrace before hidden input, rejects ambiguous modes, removes competing inline/key-command credentials and preserves signal failure status with EXIT cleanup. Disposable crypto and prompt/child tests cover these boundaries. Bash foreground-child signal deferral and arbitrary-child copy retention are explicitly not solved by this helper. Evidence: Custodian custody-entrypoints.json.

Concrete uncovered callers remain (T02 stays progress):

• Makefile sops-setup/creds-init copy or require permanent HOME private keys.
• Makefile sops-decrypt sends plaintext to stdout.
• sso-mfa/bootstrap/creds-rotate.sh logs newly generated values and embeds a password in a printed SQL command. Its source can be repaired without executing founder-deferred rotations; no such rotation has been run.
• sso-mfa/k8s/privacyidea/bootstrap-admin.sh prints the trigger-admin password.
• Delegated create/apply helpers still need full tracing/error/Secret-annotation output review; transport capture and native effect evidence remain mandatory.

Verify owner-approved recovery and current native callers

id: NK-WP-0049-T03
status: wait
priority: high
depends_on: [NK-WP-0049-T02]
blocking_reason: "Source caller reconciliation and exact owner-scoped isolated recovery ceremony are required; no live bootstrap or root retrieval is authorized by this source receipt."
state_hub_task_id: "d68cd4d3-1ba3-530e-88f9-26ebb8dd6eac"

Review the final scoped procedure, current consumer/caller usage and independent key/snapshot availability. Under an exact approved ceremony, verify off-host ciphertext retrieval, matching independently held key, isolated decryption and required current service-file coverage, failed-key refusal and cleanup. Record only safe identities/digests/statuses. Do not run the whole live bootstrap merely to test this patch, or infer current credential validity from a historical bundle. Historical disclosure is separate incident/rotation work; terminal clearing and source repair do not revoke any earlier exposed value. G08 stays open until caller coverage, owner review and native recovery evidence are adequate.