d9baa06f7e
Assistant: claude-code Assistant-Model: opus Assistant-Process: 3377672@bnt-lap001 Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166
39 lines
1.2 KiB
Markdown
39 lines
1.2 KiB
Markdown
---
|
|
id: NK-WP-ADHOC-2026-06-14
|
|
type: workplan
|
|
title: "Ad hoc NetKingdom operator usability fixes"
|
|
domain: netkingdom
|
|
repo: net-kingdom
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: netkingdom
|
|
created: "2026-06-14"
|
|
updated: "2026-06-14"
|
|
state_hub_workstream_id: "3ad3848e-00be-55a7-99e2-bc31047ea847"
|
|
---
|
|
|
|
> **Terminology note:** Historical text in this archived workplan may use the legacy term "workstream". The fleet term is **workplan** (`canon/standards/workplan-terminology-fleet_v0.1.md`).
|
|
|
|
# Ad hoc NetKingdom operator usability fixes
|
|
|
|
## SOPS Custody Unlock Helper
|
|
|
|
```task
|
|
id: NK-WP-ADHOC-2026-06-14-T01
|
|
status: done
|
|
priority: medium
|
|
```
|
|
|
|
Added a custody unlock helper for SOPS/age operations so drills and incident
|
|
commands can use the password-safe/offline custody age private key without
|
|
installing it permanently on a workstation.
|
|
|
|
The helper validates the supplied private key against the expected public age
|
|
recipient, writes a temporary `0600` `SOPS_AGE_KEY_FILE`, runs the requested
|
|
command or opens an incident shell, and removes the temporary key on exit.
|
|
|
|
Documented the inter-hub recovery-drill path:
|
|
|
|
```bash
|
|
make sops-custody-run COMMAND='make -C /home/worsch/inter-hub recovery-drill'
|
|
```
|