net-kingdom/registry/capabilities/capability.security.bootstrap-recovery.md

id	owner	status	domain	maturity	external_evidence	name	summary	tags	discovery	availability	relations	evidence	consumer_guidance
capability.security.bootstrap-recovery	net-kingdom	draft	infotech	discovery availability current target confidence rationale D3 D5 medium Owner scope, neighboring responsibilities, concrete use cases and limitations are documented; no exhaustive or generalized maturity claim. current target confidence rationale A2 A2 medium Source interface assessed 2026-10-14: Local identity, bootstrap console, encrypted custody handoff and caller tools. Availability describes the delivery form, not production acceptance. Source repairs and disposable native fixtures do not prove estate root isolation or recovery.	completeness reliability level confidence basis C1 low Source artifacts establish a bounded capability; no independent consumer-completeness assessment in this review. level confidence basis R0 low No longitudinal consumer reliability measurement established by this review.	Guarded bootstrap and recovery preparation	Guarded bootstrap custody, encrypted identity backup capture, independent retrieval and isolated recovery verification.	security netkingdom framework-reuse backup restore disaster-recovery age privacyidea lldap authelia keycape	intent includes excludes use_cases Find and verify off-host identity recovery material before rebuilding Railiance authentication. Local identity, bootstrap console, encrypted custody handoff and caller tools Bounded LLDAP/Authelia SQLite snapshots, KeyCape signing/config/policy and original privacyIDEA keys plus linked PostgreSQL dump Public-recipient age sealing, Storage Share create/readback, separate retention and attended independent-key archive verification Railiance bootstrap handoff without requiring recovered SSO for off-host retrieval Source repairs and disposable native fixtures do not prove estate root isolation or recovery U10: Operator recovers identity, custody or data with independently held recovery material	current_level target_level current_artifacts consumption_modes A2 A2 tools/security-bootstrap-console/README.md tools/custody-record/README.md docs/bootstrap-recovery-ceremony.md tools/bootstrap-recovery/identity-backup-profile.json tools/bootstrap-recovery/capture-identity.py tools/bootstrap-recovery/retrieve-identity.py tools/bootstrap-recovery/verify-identity.py CLI source	related_to specializes capability.security.practice-canon capability.security.doctrine-review capability.iam.key-cape capability.authorization.policy-evaluate capability.registry.register capability.railiance.bootstrap-sequencing capability.security.iam-tooling-suite	documentation tests tools/security-bootstrap-console/README.md tools/custody-record/README.md docs/bootstrap-recovery-ceremony.md workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md tests/test_identity_bundle.py tests/test_identity_offsite.py tests/test_identity_backup_preparation.py	recommended_for not_recommended_for known_limitations Operator recovers identity, custody or data with independently held recovery material Source repairs and disposable native fixtures do not prove estate root isolation or recovery Source repairs and disposable native fixtures do not prove estate root isolation or recovery 2026-10-14 architecture review estimates operational maturity separately; a registry entry does not authorize execution or establish deployment. Identity backup implementation passed 49 focused checks including synthetic age/native PostgreSQL recovery; new CCR-2026-0048/0049 grants and first actual full bundle remain pending owner admission. Actual old privacyIDEA database recovery passed; full token decryption, audit continuity and directory/issuer authentication remain open. Storage Share initial destination only; no second-provider full identity copy or autonomous bare-VM restore is established.

Guarded bootstrap and recovery preparation

Local identity, bootstrap console, encrypted custody handoff and caller tools.

Reuse boundary

Source repairs and disposable native fixtures do not prove estate root isolation or recovery.

Supported use cases

• U10: Operator recovers identity, custody or data with independently held recovery material

Evidence and integration

• tools/security-bootstrap-console/README.md
• tools/custody-record/README.md

Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.

Identity recovery and bootstrap handoff

Start with the recovery ceremony. It names the exact capture, retrieval, hidden-key verification, activation gates and remaining full-service proof. Railiance bootstrap sequences the isolated recovery and layer handoff; NetKingdom owns identity assets and native acceptance. Discovery does not authorize grants or live restore.