tegwick
31f483966c
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
47 lines
2.5 KiB
Markdown
47 lines
2.5 KiB
Markdown
# Published recovery guide and accepted independent retrieval
|
||
|
||
Accepted 2026-10-16. Owner work: NK-WP-0049-T23 and T26, both done.
|
||
|
||
At <https://nx4069.your-storageshare.de>, sign into the independently accessible
|
||
**Backup** account and navigate to `railiance-backups/net-kingdom-identity/`.
|
||
The following files sit beside the encrypted identity backups:
|
||
|
||
| File | Purpose |
|
||
| --- | --- |
|
||
| `net-kingdom-recovery-57d1940947aa25ff-START-HERE.md` | Disaster recovery instructions |
|
||
| `net-kingdom-recovery-57d1940947aa25ff.zip` | Standalone recovery tools, guides, trusted fallback receipt and per-file checksums |
|
||
| `net-kingdom-recovery-57d1940947aa25ff.zip.sha256` | ZIP checksum |
|
||
|
||
Trusted ZIP SHA256, independently recorded in this repository:
|
||
|
||
```text
|
||
57d1940947aa25ff83d0f25ddf30090eb40595cccaab64225de882a2fd59ea2f
|
||
```
|
||
|
||
All three published objects passed exact readback with strong ETag, length and
|
||
content checks. Their recorded hashes match the reproducible local build.
|
||
Keep an independent copy and the trusted digest outside the identity/provider
|
||
dependency; the checksum beside the ZIP alone is not an independent trust anchor.
|
||
|
||
The operator then retrieved the protected original identity generation using
|
||
independently held provider access, without OpenBao or SSO. The read-only
|
||
download's ETag, 109,738,344-byte size and ciphertext SHA256 matched the trusted
|
||
fallback. The human-held age key matched the registered recipient. Wrong-key
|
||
refusal, all 36 manifest hashes, SQLite integrity, original key-pair checks and
|
||
an isolated PostgreSQL 16.14 restore passed. Disposable database and temporary
|
||
plaintext cleanup passed. No private credentials were sent to the agent.
|
||
|
||
Evidence:
|
||
|
||
- [Publication receipt](evidence/2026-10-16-identity-outage-recovery/actual-offline-publication.json)
|
||
- [Independent transfer receipt](evidence/2026-10-16-identity-outage-recovery/actual-offline-transfer.json)
|
||
- [Archive recovery receipt](evidence/2026-10-16-identity-outage-recovery/actual-offline-recovery.json)
|
||
- [Reconciliation review](evidence/2026-10-16-identity-outage-recovery/actual-offline-review.json)
|
||
|
||
The published guide is the exact pre-drill revision. This dated acceptance note
|
||
records the subsequent successful drill; it does not claim a later republication.
|
||
Production services were not deliberately stopped. The recovery path avoided
|
||
OpenBao/SSO; restored-service authentication, existing-token MFA and historical
|
||
audit-signature continuity remain separate acceptance under T15–T20.
|
||
Use the [isolated service restore packet](identity-service-restore-packet.md)
|
||
for that next stage.
|