coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
net-kingdom/docs/evidence/2026-10-15-bootstrap-recovery/caller-source-inventory.json
tegwick dca999222f
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Record off-host database recovery and prepare identity backup coverage 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
2026-10-16 00:32:50 +02:00

476 lines
25 KiB
JSON
Raw Blame History

{
"schema": "netkingdom.bootstrap-caller-inventory.v1",
"observed_at": "2026-10-15T22:29:09.131605+00:00",
"scope": "all current .sh/.py non-test files under sso-mfa/bootstrap and sso-mfa/k8s, Makefile, console, delivery copier and recovery transport tool plus two bounded provider metadata inventory helpers plus bounded fixed-object ciphertext fetch and isolated PostgreSQL recovery check plus proposed full identity backup profile and metadata-only preparer",
"entry_count": 93,
"entries": [
{
"path": "Makefile",
"sha256": "5d2114f6141bb8504c5c780044302126c07958a5732afdb0d0c0218a4f84210e",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/bootstrap/apply-service-secrets.py",
"sha256": "ea9c3418ed00527b9019ab9893f1f3c9fe29d0697f1f0c879e28fdbae373889b",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/bootstrap/creds-apply.sh",
"sha256": "a70dba396484b2a353a39349c3d3719f7b6695b9f0e35025ef79e3db0ec2ff53",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/bootstrap/creds-bootstrap-agent.sh",
"sha256": "cc27c4f3969c292a913a0ae325cd0d4ec2665f9fffbbd1eb1c5f73b08e398a32",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/bootstrap/creds-rotate.sh",
"sha256": "09b387d3555ce2beaeb8d7f000c2d52a1ffea274c793f30bce80a8f3ef5dc2f8",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/bootstrap/creds-status.sh",
"sha256": "f0fe0b885fd22f4789baa86cc2438272700aff8634cfa6b27d55c2c860c9f36d",
"classification": "diagnostic; structural observations do not prove recovery or revoke credentials"
},
{
"path": "sso-mfa/bootstrap/creds-verify.sh",
"sha256": "101b12948c862f21a668b49b3a82efae691ba885d5c8fd7a94a10e095c16a24a",
"classification": "diagnostic; structural observations do not prove recovery or revoke credentials"
},
{
"path": "sso-mfa/bootstrap/decrypt-secrets.sh",
"sha256": "1572c170ceb9eff9ff408409acb82650ac911edb02961cde48806c68fa80ce76",
"classification": "private custody/local operation; explicit input; owner procedure required"
},
{
"path": "sso-mfa/bootstrap/emergency-bundle.sh",
"sha256": "c1a0e9853dae6b71537ecb708b05ce967eacf797334192156485ca943dc8c71e",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/bootstrap/encrypt-secrets.sh",
"sha256": "5b4774488e09a22b409079021e7cd10632c7cf6cf9db6f98cd85e3878d34d435",
"classification": "private custody/local operation; explicit input; owner procedure required"
},
{
"path": "sso-mfa/bootstrap/gen-secrets.sh",
"sha256": "b4a910cca93427c0e70e1f4c7646fc94d9b885aeae65a10a01cf8e11548ce03d",
"classification": "private custody/local operation; explicit input; owner procedure required"
},
{
"path": "sso-mfa/bootstrap/openbao-init-unseal.sh",
"sha256": "49485948a8d44576e293b6f709f1bb444e36bed3310c843d47393c3c8d4c1d0b",
"classification": "lab-only custody adapter; explicit target; production forbidden"
},
{
"path": "sso-mfa/bootstrap/openbao-lab.py",
"sha256": "0c14e38f86e189f6123b99e036e4423ebb31266d90f4c4423d3619c2060c3bc7",
"classification": "lab-only custody adapter; explicit target; production forbidden"
},
{
"path": "sso-mfa/bootstrap/pack-bundle.sh",
"sha256": "53abc7af3dcda6cfa9f52e9c10d352b66defa2cbfa7cd71b07c483c6f4a60f66",
"classification": "private custody/local operation; explicit input; owner procedure required"
},
{
"path": "sso-mfa/bootstrap/rotation-env.py",
"sha256": "bab079a51b8e7ad0199676e76e473a13e70f46e0495d8c942502c952236ec893",
"classification": "private custody/local operation; explicit input; owner procedure required"
},
{
"path": "sso-mfa/bootstrap/sops-custody-unlock.sh",
"sha256": "8a6c02ace974b489d23869a9e99d3305896f4bdc4c430164df09bb4ce1710959",
"classification": "private custody/local operation; explicit input; owner procedure required"
},
{
"path": "sso-mfa/bootstrap/sops-private.py",
"sha256": "113d17ee4cd7ad405e73cc51e1823dc02bd2e618e7fa67c1b624f0226e334ec6",
"classification": "private custody/local operation; explicit input; owner procedure required"
},
{
"path": "sso-mfa/bootstrap/sops-write.py",
"sha256": "5a785e9c8e6a40ca9120a668d93992ea5c3115566ada21933536cc2d931f1ddf",
"classification": "private custody/local operation; explicit input; owner procedure required"
},
{
"path": "sso-mfa/k8s/authelia/create-secrets.sh",
"sha256": "137e137d973993e3938dbfe656b036e8d4d9643f84b5e8ca7ab30fbc5810ea1c",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/keycape/approval-clients-rollout.py",
"sha256": "488d5cc59e081993dd2b5fc6d9e46bbddcaec4f5170b8f7a5ad0aae3a211a790",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/keycape/authentication-policy-rollout.py",
"sha256": "2c1bd23fded4855bae1eb3a08dbc4510d7f60f2bc4d625d60e471ab78f6f0251",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/keycape/configure-openbao-oidc.sh",
"sha256": "bf214ac511fbd2269935f3270c6d4491c729d834e8138b9d7404aecf23c0825f",
"classification": "retired entry point; refuses before credential/cluster access"
},
{
"path": "sso-mfa/k8s/keycape/create-pi-token.sh",
"sha256": "2f750aea638c06eb11dfe7afcf7b3d6117ba9e964cbf2a48bb12590054178152",
"classification": "retired entry point; refuses before credential/cluster access"
},
{
"path": "sso-mfa/k8s/keycape/create-secrets.py",
"sha256": "5da672fff36eb94101741ad99e2a1a96ae81fea15ed1871304c40e63ce27c787",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/keycape/create-secrets.sh",
"sha256": "f5131160d91641a59c3163a17a8dd4f9b97d228eb8a5e0d8ad04cc2f7ff51644",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/keycape/exercise-approval-clients.py",
"sha256": "e2d3dd741ac52af28dce752344227a4443b78fedd4cfcc06ba902e679dfc9351",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/keycape/keycape-client.py",
"sha256": "e31ee2883fad4f93635700608ad98e05984c9e0453515dd7710c897ca856b8c8",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/keycape/openbao-client-config.py",
"sha256": "1b908b4c36134212d78f9fbe7a2a201eb3ced06d31bb1dcea4a59d80689d84b1",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/keycape/openbao-negative-node-wrapper.py",
"sha256": "76ac013d1a676a0dfa58aea1ce87b0c3e72483ccd21f586a22c5475e9132f6c1",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/keycape/openbao-negative-session.py",
"sha256": "24b7b803e4eb7e6e7c0700a069dad0ec315ee7eb5538a88b9e56147f8fab5cdd",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/keycape/openbao-signin-diagnosis-rollout.py",
"sha256": "a57b957d6eed9e8fb09d2a7aa7405a39deeafd9aaf57a9e6dc907afabd380371",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/keycape/patch-openbao-client.sh",
"sha256": "cfd0dbd0528e799ee59d8aa4cd1cefc2189227cbc92d251f2a67bb25212aecad",
"classification": "retired entry point; refuses before credential/cluster access"
},
{
"path": "sso-mfa/k8s/keycape/playwright-activation.py",
"sha256": "5ac683b3324b00e6253f6040f4c73057027b1f98f7071160a6153794ba522757",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/keycape/playwright-registration.py",
"sha256": "bf2d6b83d93629df8ddaf6c31d6c7408ae3866969d63895714df0e08a570da99",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/keycape/portal-client-rollout.py",
"sha256": "158e1d36eb881cdd0a2eda91b472adea5e8fde5061e00d26dda368580aeb871f",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/keycape/refresh-pi-token-live.sh",
"sha256": "2f750aea638c06eb11dfe7afcf7b3d6117ba9e964cbf2a48bb12590054178152",
"classification": "retired entry point; refuses before credential/cluster access"
},
{
"path": "sso-mfa/k8s/keycape/register-coulomb-social.py",
"sha256": "b40ff4bdba71b797f8f393e79cb3c9d73b790045a0f7df6ecea35803369793c7",
"classification": "retired entry point; refuses before credential/cluster access"
},
{
"path": "sso-mfa/k8s/keycape/register-coulomb-social.sh",
"sha256": "cfd0dbd0528e799ee59d8aa4cd1cefc2189227cbc92d251f2a67bb25212aecad",
"classification": "retired entry point; refuses before credential/cluster access"
},
{
"path": "sso-mfa/k8s/keycape/register-user-engine-portal.py",
"sha256": "67173edc44f5457e7b6a3e0fb2321b398159cfce5dea8ead01eabf835fb38d76",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/keycape/secrets-engine-openbao-client-rollout.py",
"sha256": "8b834e5f0353a5e11797637420609e06e7bf7de47777c7e78b774f74d4a6afbd",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/keycape/vergabe-client-rollout.py",
"sha256": "8cee6cc5ff3e3e8617304055263d04b393d0e005c34d9af12cb7e8bc685bac1a",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/keycape/verify-openbao-client.sh",
"sha256": "6f8e75ad16f0d35f776d1a8da85842dc1174085a730f0189a7f5a36a0d7db83f",
"classification": "diagnostic; structural observations do not prove recovery or revoke credentials"
},
{
"path": "sso-mfa/k8s/keycape/verify-user-engine-portal.py",
"sha256": "ccd5106395bd5d7b4f3dbbcbad449e3793aff217d4429b5d5af9e52ab9a58103",
"classification": "diagnostic; structural observations do not prove recovery or revoke credentials"
},
{
"path": "sso-mfa/k8s/lldap/bootstrap-users.sh",
"sha256": "309da1de430638e4ed0b9bfe11b7bbb472a6bfe364cdfb6c69499c6fb78b66d6",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/lldap/break-glass.sh",
"sha256": "a30cc22a990d368b9066e2e8b7aaef1c993c1c8a86e191ad2afb0e5c4d4f3294",
"classification": "retired entry point; refuses before credential/cluster access"
},
{
"path": "sso-mfa/k8s/lldap/create-secrets.sh",
"sha256": "fb2ee3b5af858297d20f8bc8821ee13a86d6ebc9235756b9ed9a8e85a54d84a1",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/lldap/create-user.sh",
"sha256": "a30cc22a990d368b9066e2e8b7aaef1c993c1c8a86e191ad2afb0e5c4d4f3294",
"classification": "retired entry point; refuses before credential/cluster access"
},
{
"path": "sso-mfa/k8s/lldap/dry-run-nonroot-user.sh",
"sha256": "a30cc22a990d368b9066e2e8b7aaef1c993c1c8a86e191ad2afb0e5c4d4f3294",
"classification": "retired entry point; refuses before credential/cluster access"
},
{
"path": "sso-mfa/k8s/lldap/identity-provisioner-reconcile.py",
"sha256": "e124b94c3a5749d4e3fdfc5fd054acfb295594beac24cd399a7b24a8617683d6",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/lldap/lldap_admin.py",
"sha256": "5e39e2eac53846a97cd25151c0a4af1ffc0230db881a6325efb66de6a51bfc36",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/lldap/manage-group-members.sh",
"sha256": "3c85e4e882ad003a4dc513d9085d136531511273db8adf27e1fcf5e749ae04d1",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/postgresql/create-secrets.sh",
"sha256": "801ae8a404f0a8fd2bb349003091ab6a509df2533bc1a0f456dd7d5940d917e9",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/privacyidea/activate-onboarding-policy.py",
"sha256": "edd6d3d4507e11e1632002e56f948bb2e81465132500627b5ddc7fa0f06203d1",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/privacyidea/bootstrap-admin-remote.py",
"sha256": "c83c3a5c9a753a8afec90c35ce5ddbfc15f7b8aff437065f428109d9c5774b89",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/privacyidea/bootstrap-admin.py",
"sha256": "b81b5c3806dbdf03ea7cac37884cc368de0f0ef7880ac326b67af3a291c35890",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/privacyidea/bootstrap-admin.sh",
"sha256": "1a11738c1790cc6b5f23ed40f02971591eb76afa486be89d5535b0027aca6989",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/privacyidea/bootstrap-realm.sh",
"sha256": "d3dc530d378ce826f4875c4cf066a6f7f916c3abd5492eb5ee237a8c98b7957b",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/privacyidea/check-user-mfa-state.sh",
"sha256": "18901decfdc974ba5a6e871b7a4fe8022be59c73123774a31c57303fd5f657be",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/privacyidea/create-secrets.sh",
"sha256": "6644b37f2a0ba09b67e135516204950474bd8fa28a243f62e29b898d00c08d91",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/privacyidea/deploy-factor-recovery.py",
"sha256": "9a46aa7a1fdf7c202981f2529bc138dcdd952fbefab1d18a88ac65176936a389",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/privacyidea/deploy-onboarding-guard.py",
"sha256": "95a3195d01775ea1d800aaa37131d440acc92f2a50215a108c0b63a3441cce94",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/privacyidea/enable-factor-confirmation.py",
"sha256": "f71e22d6a7a99f4293fb688567ec11c6826a543223b27168e0577e8a6070581e",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/privacyidea/enckey-bootstrap.sh",
"sha256": "e47b86ae422f043145525b3deaa4c57ce6ee92974db090695be7fafbe7b61a2e",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/privacyidea/enckey-restore.sh",
"sha256": "fb31831c1492006ad5f32e16f2ce47baf6e20d0cb56a592432da0698052bf362",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/privacyidea/key-custody-remote.py",
"sha256": "27b2b885c81923d85054e3999c5613e104fe627779b2b50398ed9bed5088f47e",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/privacyidea/key-custody.py",
"sha256": "e43d21694cb9c99bd02257a4f225973e992c9af4b0e71788929f949b9752f08a",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/privacyidea/keycape-scope-probe.py",
"sha256": "847b8d7c72c11deab15b3d16964e2619011e21d219b1d82c25f0346493abbbef",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/privacyidea/mfa_state.py",
"sha256": "3f0c2e404d7df41af7f8e1fe66a4a6d392338391456ef298c7dd0219ad3d58dc",
"classification": "diagnostic; structural observations do not prove recovery or revoke credentials"
},
{
"path": "sso-mfa/k8s/privacyidea/pi_api.py",
"sha256": "01bbf3a2c1f8c423f864dc4bd2145c5c89f938fa9e8b0ffbbecf6d674484896b",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/privacyidea/realm_bootstrap.py",
"sha256": "2885086fdc4fd64b58496f90e82c75eefc7171017004e0804defaaabf791b3a9",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/privacyidea/reconcile-lldap-resolver-live.sh",
"sha256": "89f5b279cde441ef8a7c63436e63c6242527d36949aba4bad2134c890a9e0b04",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/privacyidea/repair-realm-live.sh",
"sha256": "2684a6caca848f5d9e74191af4ca2864adba92fe3ee410a4236045d1743b99e6",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/privacyidea/resolver_cutover.py",
"sha256": "6ed2df95671897f073a3dc8fee62b780cdff87b08d617d5a337e1fbba206e10a",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/privacyidea/update-lldap-resolver-live.sh",
"sha256": "ffa7c551dbcc6ab74d2cfc0853fd0647dd026259b1541f99e4a84dcbac16588c",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "sso-mfa/k8s/privacyidea/verify_mfa.py",
"sha256": "118d0052433edb85dd53e3c988943392f59d0aa00641d45f8ff3676a15f8af19",
"classification": "diagnostic; structural observations do not prove recovery or revoke credentials"
},
{
"path": "sso-mfa/k8s/user-engine/verify-operability.sh",
"sha256": "2e1cbde1d2aa2ce9f27685baf93137d5f13d33a77421a2fba1649f874f2b7f48",
"classification": "retired entry point; refuses before credential/cluster access"
},
{
"path": "sso-mfa/k8s/verify-identity-cutover-dependencies.sh",
"sha256": "96da30c4eca28615685ff384bbc7d00d81c7562e8e572a3ad54c3cc6fdd297ca",
"classification": "diagnostic; structural observations do not prove recovery or revoke credentials"
},
{
"path": "sso-mfa/k8s/verify-t02.sh",
"sha256": "7a9fe613fc83841397f2e3b0b4c26c5464d7b903d5e56a83ec786e2289719b24",
"classification": "diagnostic; structural observations do not prove recovery or revoke credentials"
},
{
"path": "sso-mfa/k8s/verify-t03.sh",
"sha256": "7b3a888ae20394b761d7cd9cf1bc81f273813794a3002202951b061bd6c27963",
"classification": "diagnostic; structural observations do not prove recovery or revoke credentials"
},
{
"path": "sso-mfa/k8s/verify-t04.sh",
"sha256": "74128536919f79f17bffc107678718848c4ca095de06140cdc453e68953aabd1",
"classification": "diagnostic; structural observations do not prove recovery or revoke credentials"
},
{
"path": "sso-mfa/k8s/verify-t05.sh",
"sha256": "bb226bad1e5fb60a5d6f87fa67ecee2d6af84d6d6a84fa02d9839d8bca58a197",
"classification": "diagnostic; structural observations do not prove recovery or revoke credentials"
},
{
"path": "sso-mfa/k8s/verify-t06.sh",
"sha256": "717317c1d51f7c3361f3b711d79cae52019c36cd6c397e5fa61f07eaad3632e2",
"classification": "diagnostic; structural observations do not prove recovery or revoke credentials"
},
{
"path": "sso-mfa/k8s/verify-t07.sh",
"sha256": "026406ff1fec9e4bf542741c08002c45ea8a94a4ce5a50980665b601485882df",
"classification": "diagnostic; structural observations do not prove recovery or revoke credentials"
},
{
"path": "sso-mfa/k8s/verify-t08.sh",
"sha256": "7efe14c0d71f2c846434d19f8d05702d69d3c40a617a700b08fe13b3764d0650",
"classification": "diagnostic; structural observations do not prove recovery or revoke credentials"
},
{
"path": "tools/bootstrap-recovery/inventory-scaleway.py",
"sha256": "a219df205708fa4ed44b763a418585d63c820c25434bc0fd14e805eb5c2f79d3",
"classification": "read-only bounded owner backup metadata; existing caller/custody only; no age key or backup content read"
},
{
"path": "tools/bootstrap-recovery/inventory-storage-share.py",
"sha256": "673f9b17fb2f3fef6fcdb5c50a2bcca69e3df3157a9e5582a2d995c6b87640b5",
"classification": "read-only bounded owner backup metadata; existing caller/custody only; no age key or backup content read"
},
{
"path": "tools/bootstrap-recovery/verify-bundle.py",
"sha256": "885b05a2011e711228e42e316bda70bbe0d97d481383d61aa8469d0f10452370",
"classification": "diagnostic; structural observations do not prove recovery or revoke credentials"
},
{
"path": "tools/security-bootstrap-console/security_bootstrap_console.py",
"sha256": "e9419ab1de0725b12b06fc29098c49584cb8acf47ec0ca09d552915f964a2c48",
"classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance"
},
{
"path": "tools/sync-user-engine-delivery-secret.sh",
"sha256": "7c0fb6b066e4ad8b103e75551beecd5de65a4bbb22570d95b42e5da6395e2dfc",
"classification": "retired entry point; refuses before credential/cluster access"
},
{
"path": "tools/bootstrap-recovery/fetch-privacyidea-backup.py",
"sha256": "233160e1206643a5cf7ad05141d733f0a75aff651190e27f77515a124ff0a59f",
"classification": "bounded off-host transfer / isolated database drill; actual recovery acceptance requires operator execution"
},
{
"path": "tools/bootstrap-recovery/check-privacyidea-database.py",
"sha256": "90f454c87998d7f5d625e3c6656c3418f8f56275dc1879a9d19ed605431b94a4",
"classification": "bounded off-host transfer / isolated database drill; actual recovery acceptance requires operator execution"
},
{
"path": "tools/bootstrap-recovery/prepare-identity-coverage.py",
"sha256": "cd5f3067d28b4c7cc93ed08b8cf3869218bdecf7c54b5dffed22d697de71dbb1",
"classification": "missing identity backup coverage proposal and metadata-only preparation; no live capture/grant/delivery capability"
},
{
"path": "tools/bootstrap-recovery/identity-backup-profile.json",
"sha256": "176c1f2f9111c2c51503212deb162274609d5e53bfe03d7319e19e44c5e09500",
"classification": "missing identity backup coverage proposal and metadata-only preparation; no live capture/grant/delivery capability"
}
],
"source_inventory_complete_for_declared_scope": true,
"native_exercise_or_full_security_acceptance_claimed": false,
"remaining": "T02 legacy identity/credential disposition, provider enforcement and owner acceptance; T03 exact off-host asset/key lineage and native recovery. Historical exposure rotation stays founder-deferred."
}
Reference in a new issue View git blame Copy permalink