tegwick
034eacab9b
The founder's three-identity model and the finding that the human admin is also the directory bind account lead to a proposed workplan: svc-<service> bind accounts, per-service admin accounts, a governing standard and a conformance health check. docs/crisis-custody-list.md is the first concrete list of what unlocks recovery, with unknowns marked TO CONFIRM. NK-WP-0053-T04 extends the quarterly drill to the Authelia and by-user MFA stages with admin as operator. Hub decision routes the three founder gates. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 328925@bnt-lap001 Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
5.4 KiB
5.4 KiB
Crisis custody list
NK-WP-0054-T07. Drafted 2026-10-24 from repository documents and the founder's statements
that day. This list holds no secret value, ever. It names what unlocks recovery, who
holds it, where, and whether using it needs the very services being recovered. Anything
the repository cannot establish is marked TO CONFIRM; the founder confirms each one.
It belongs with the backup documentation: disaster recovery guide, identity restore drill and Credential Management Standard §4. That standard names the custody categories. This list makes them concrete.
The one rule
For every row, answer: does using this item work when SSO and OpenBao are down? A recovery path that is satisfied only by logging in to something being restored is a circular dependency and is recorded as a gap, not as custody.
Roles used below
| Role | Identity | Used for |
|---|---|---|
| Crisis operator | admin |
Runs recovery and routine validation (founder intent, 2026-10-24) |
| Authorizer | platform-root / king credential |
Break-glass authority from offline custody; nothing routine |
| Developer | tegwick |
Builds and tests tooling; holds no recovery keys |
Items
| # | Item | Unlocks | Holder and location | Works with SSO and OpenBao down? | Last proven use | Gap or action |
|---|---|---|---|---|---|---|
| 1 | Custodian/backup age private key (recipient age1zvry…50syr3tsz, labelled railiance-backup) |
Decrypts the identity backup bundle and the SOPS custody files | Founder, independently held password safe or offline packet (Standard §4) | Yes, offline | Entered by the founder at hidden prompts 2026-10-24 (LLDAP, Authelia, privacyIDEA stages) | TO CONFIRM: number of copies, who else could recover if the founder cannot |
| 2 | Storage Share Backup account app password |
Downloads the protected ciphertext without OpenBao or SSO | Founder, independent custody TO CONFIRM |
Yes, provider is outside the platform | Fresh retrieval 2026-10-24 | One provider copy only; residual risk accepted until 2027-01-31 (G1, NK-WP-0053) |
| 3 | OpenBao unseal shares (2 of 3 required in the restore drill) | Unseals a restored or production OpenBao | Holders TO CONFIRM (custody doc: escrow holders "to be named") |
Yes, offline | Original shares used in the isolated restore RPF-WP-0064-T07, 2026-10-24 | Name the three holders and where each share is kept; confirm none depends on SSO |
| 4 | platform-root / king account and factors |
Final authority; break-glass | Independently held password safe or offline packet (Standard §4; custody doc) | No if used through KeyCape: its login and OTP are validated by the services being recovered | OTP validated against restored privacyIDEA 2026-10-24 (isolated) | TO CONFIRM the offline path that works with SSO down (OpenBao shares, item 3) and record it |
| 5 | Founder admission signing key (SSH, principal bernd) |
Signs attempt and restore admissions | Founder, workstation key; verifier anchor /etc/secrets-engine/admission/allowed_signers |
Yes | Signed the T40 admission 2026-10-23 | TO CONFIRM which identity this key belongs to; the anchor is workstation-bound, so a backup of key and anchor is needed |
| 6 | admin password and OTP token |
Day-to-day platform administration and, per intent, recovery operation | Founder; OTP enrolled 2026-10-24 | No: login and token checks need KeyCape, LLDAP and privacyIDEA | Token not yet in any restored backup; first restore proof after the 2026-10-25 03:45 UTC capture | Same account as the directory bind used by Authelia and privacyIDEA until the split in NK-WP-0054-T05 |
| 7 | pi-admin credentials (privacyIDEA internal admin) |
Token repair and re-enrolment | Founder's personal password safe (stated 2026-10-24) | Custody yes if the safe opens offline; use needs a running privacyIDEA | Not yet drilled | Confirm the safe is reachable offline and mirrored; add a pi-admin check to the drill |
| 8 | Ops bundle (age-encrypted tar of service secrets, make creds-bundle) |
Point-in-time service secrets | Offsite location TO CONFIRM (Standard §7) |
Yes, needs item 1 | Not drilled | Confirm location and age; decide whether it duplicates the identity bundle |
| 9 | Operator access to the production host or cluster for a real restore (SSH certificate or kubeconfig) | Applying a restore to production | TO CONFIRM |
TO CONFIRM: ops-warden issues SSH certificates; whether that works with SSO down is unknown |
Not drilled | Establish the crisis path and record it |
Non-secret recovery assets
These need no custody but must be reachable: the published recovery kit on Storage Share
(guide, tools ZIP, checksum; verify the checksum against a trusted copy), the pinned
container images, and a trusted checkout of this repository. TLS for kc.coulomb.social
has no custody: it is reissued through ACME and needs working public DNS and HTTP-01.
Maintenance
- Review at every restore drill (NK-WP-0053), and record the date each item was last proven. An item never proven stays marked as such.
- Loss or suspected exposure of any item goes to its owner's rotation and revocation process (Standard §6); this list rotates nothing.
- A machine-readable, non-secret record with a freshness check, modelled on
tools/custody-record, is proposed in NK-WP-0054-T07. Until then this document is the list.