net-kingdom/registry/capabilities/capability.security.bootstrap-recovery.md

id	owner	status	domain	maturity	external_evidence	name	summary	tags	discovery	availability	relations	evidence	consumer_guidance
capability.security.bootstrap-recovery	net-kingdom	draft	infotech	discovery availability current target confidence rationale D3 D5 medium Owner scope, neighboring responsibilities, concrete use cases and limitations are documented; no exhaustive or generalized maturity claim. current target confidence rationale A2 A2 medium Source interface assessed 2026-10-14: Local identity, bootstrap console, encrypted custody handoff and caller tools. Availability describes the delivery form, not production acceptance. Source repairs and disposable native fixtures do not prove estate root isolation or recovery.	completeness reliability level confidence basis C1 low Source artifacts establish a bounded capability; no independent consumer-completeness assessment in this review. level confidence basis R0 low No longitudinal consumer reliability measurement established by this review.	Guarded bootstrap and recovery preparation	Guarded bootstrap custody, encrypted identity backup capture, independent retrieval and isolated recovery verification.	security netkingdom framework-reuse backup restore disaster-recovery age privacyidea lldap authelia keycape	intent includes excludes use_cases Find and verify off-host identity recovery material before rebuilding Railiance authentication. Local identity, bootstrap console, encrypted custody handoff and caller tools Bounded LLDAP/Authelia SQLite snapshots, KeyCape signing/config/policy and original privacyIDEA keys plus linked PostgreSQL dump Public-recipient age sealing, Storage Share create/readback, separate retention and attended independent-key archive verification Railiance bootstrap handoff and actual independent-provider retrieval requiring neither OpenBao nor SSO; operator archive recovery passed on 2026-10-16 Source repairs and disposable native fixtures do not prove estate root isolation or recovery U10: Operator recovers identity, custody or data with independently held recovery material	current_level target_level current_artifacts consumption_modes A2 A2 tools/security-bootstrap-console/README.md tools/custody-record/README.md docs/bootstrap-recovery-ceremony.md tools/bootstrap-recovery/identity-backup-profile.json tools/bootstrap-recovery/capture-identity.py tools/bootstrap-recovery/retrieve-identity.py tools/bootstrap-recovery/retrieve-identity-offline.py tools/bootstrap-recovery/recovery-kit.py tools/bootstrap-recovery/run-offline-recovery.sh tools/bootstrap-recovery/isolated-lldap.py tools/bootstrap-recovery/run-isolated-lldap.sh tools/bootstrap-recovery/isolated-privacyidea.py tools/bootstrap-recovery/run-isolated-privacyidea.sh docs/disaster-recovery-storage-share.md docs/identity-service-restore-packet.md docs/storage-share-recovery-publication.md tools/bootstrap-recovery/verify-identity.py CLI source	related_to specializes capability.security.practice-canon capability.security.doctrine-review capability.iam.key-cape capability.authorization.policy-evaluate capability.registry.register capability.railiance.bootstrap-sequencing capability.security.iam-tooling-suite	documentation tests tools/security-bootstrap-console/README.md tools/custody-record/README.md docs/bootstrap-recovery-ceremony.md workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md docs/evidence/2026-10-16-identity-backup-live/actual-full-recovery-review.json docs/evidence/2026-10-16-identity-backup-live/activation-review.json tests/test_identity_bundle.py tests/test_identity_offsite.py tests/test_identity_backup_preparation.py tests/test_identity_offline_recovery.py tests/test_isolated_lldap_recovery.py tests/test_isolated_privacyidea_recovery.py	recommended_for not_recommended_for known_limitations Operator recovers identity, custody or data with independently held recovery material Source repairs and disposable native fixtures do not prove estate root isolation or recovery Source repairs and disposable native fixtures do not prove estate root isolation or recovery 2026-10-14 architecture review estimates operational maturity separately; a registry entry does not authorize execution or establish deployment. Actual privacyIDEA internal token-material readback and stored audit continuity passed; existing-token MFA, Authelia and KeyCape authentication remain open. Storage Share initial destination only; no second-provider full identity copy or autonomous bare-VM restore is established. Actual first full identity bundle captured, sealed and Storage Share readback verified on2026-10-16; both scoped readers passed native identity/namespace/audience/ESO checks. Independent human-key full archive recovery passed and daily backup/hourly health are active. Full service authentication, existing-token MFA and an unattended full-estate rebuild remain unproven. 56 focused implementation checks pass.

Guarded bootstrap and recovery preparation

Local identity, bootstrap console, encrypted custody handoff and caller tools.

Reuse boundary

Source repairs and disposable native fixtures do not prove estate root isolation or recovery.

Supported use cases

• U10: Operator recovers identity, custody or data with independently held recovery material

Evidence and integration

• tools/security-bootstrap-console/README.md
• tools/custody-record/README.md

Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.

Identity recovery and bootstrap handoff

Start with the recovery ceremony. It names the exact capture, retrieval, hidden-key verification, activation gates and remaining full-service proof. Railiance bootstrap sequences the isolated recovery and layer handoff; NetKingdom owns identity assets and native acceptance. Discovery does not authorize grants or live restore.

For an outage, use the Storage Share recovery guide and the self-contained kit built by tools/bootstrap-recovery/recovery-kit.py. The private operator handoff publishes the versioned guide/kit with readback, retrieves the protected generation using independently held provider access, and prompts separately for the human-held age key. Actual publication/readback and independent outage-path archive recovery passed on 2026-10-16; T23/T26 are done. See the published location and trusted kit digest. The isolated service packet records the remaining service-owner admission and native tests.

The local LLDAP stage now has a fixed-target executor with no external network, ports or host mounts, Linux-tmpfs plaintext, original directory/key preservation, native existing-user/wrong-password checks and cleanup. Six actual-image tests with synthetic credentials passed, including an encrypted-bundle restore. All five pinned service images were saved/reloaded locally. T28/T29 record that preparation. Actual private real-backup LLDAP recovery passed on 2026-10-16; T16 is done, with original identity rows, positive/negative native bind, isolation and cleanup accepted. Authelia, KeyCape and existing-token MFA remain open.

The token-material/audit stage is run-isolated-privacyidea.sh TRANSFER_RECEIPT, with only a hidden backup-key prompt. Its pinned native routines check internal token-material readback and stored audit signatures, preserve original keys, report history exceptions and remove the isolated database/worker/tmpfs. Native synthetic tests cover valid, tampered and unsigned history, malformed keys and encrypted-bundle recovery. Actual owner recovery passed on 2026-10-16: five token materials read internally, 279,209 stored signatures verified, new-entry/negative checks and cleanup passed. T20/T31 are done; existing-token MFA remains T19 and is not implied by readback.