d4d61b722e
source: repo-manager reason: deterministic projection registration Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a05e30-2884-71b0-98d7-7edd16ae737b
40 lines
1.2 KiB
Markdown
40 lines
1.2 KiB
Markdown
---
|
|
id: NK-WP-ADHOC-2026-06-14
|
|
type: workplan
|
|
title: "Ad hoc NetKingdom operator usability fixes"
|
|
domain: netkingdom
|
|
repo: net-kingdom
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: netkingdom
|
|
created: "2026-06-14"
|
|
updated: "2026-06-14"
|
|
state_hub_workstream_id: "3ad3848e-00be-55a7-99e2-bc31047ea847"
|
|
---
|
|
|
|
> **Terminology note:** Historical text in this archived workplan may use the legacy term "workstream". The fleet term is **workplan** (`canon/standards/workplan-terminology-fleet_v0.1.md`).
|
|
|
|
# Ad hoc NetKingdom operator usability fixes
|
|
|
|
## SOPS Custody Unlock Helper
|
|
|
|
```task
|
|
id: NK-WP-ADHOC-2026-06-14-T01
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "2f978bbe-b215-5fec-a372-aa9628671cf3"
|
|
```
|
|
|
|
Added a custody unlock helper for SOPS/age operations so drills and incident
|
|
commands can use the password-safe/offline custody age private key without
|
|
installing it permanently on a workstation.
|
|
|
|
The helper validates the supplied private key against the expected public age
|
|
recipient, writes a temporary `0600` `SOPS_AGE_KEY_FILE`, runs the requested
|
|
command or opens an incident shell, and removes the temporary key on exit.
|
|
|
|
Documented the inter-hub recovery-drill path:
|
|
|
|
```bash
|
|
make sops-custody-run COMMAND='make -C /home/worsch/inter-hub recovery-drill'
|
|
```
|