net-kingdom/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	flavor	depends_on	state_hub_workstream_id
NK-WP-0049	workplan	Remove bootstrap secret output and verify separated recovery custody	infotech	net-kingdom	active	codex	netkingdom	2026-10-12	2026-10-15	implementation		17d315f0-829e-57c7-85cc-3a7914152804

Native owner work for CUST-WP-0080 G08. NK-WP-0045 proves recovery of the non-secret root-grant record, not custody of the bootstrap private key or secret-bearing emergency bundle. Existing founder-deferred exposure rotation remains CUST-WP-0073-T05; this work does not override it or rotate any root.

Remove secret-bearing output and ambient root discovery

id: NK-WP-0049-T01
status: done
priority: high
state_hub_task_id: "d7ca8d5f-c5ff-5cba-bd25-038cb53ffe4e"

2026-10-12: regression reproduced emergency/reprint root export, generation prefix disclosure, permissive file modes, dry-run side effects and unattended entry. Replaced emergency export with a non-secret guide (legacy secret-input arguments refused), suppressed generation prefixes/tracing and set private permissions. Bootstrap requires the registered public recipient and an attended terminal; never generates/discovers a permanent private key. Encrypted resume requires an explicit matching temporary custody key before cluster activity. Dry-run is a non-mutating plan. The live cluster/apply path was not executed.

A fresh uniquely named encrypted ops bundle follows apply; old delivery flags cannot skip current acknowledgment. New acknowledgment state binds its SHA256 and timestamp. Declining stops before cleanup/completion. This is an operator statement, not an independent restore receipt. Historical fields remain unchanged. Make/help/status/console and current credential guidance reflect that distinction. Evidence and exact source manifest: Custodian docs/evidence/2026-10-12-netkingdom-security/bootstrap-handoff.json.

Reconcile other legacy custody callers and root-output boundaries

id: NK-WP-0049-T02
status: progress
priority: high
state_hub_task_id: "479d6970-6516-50f5-9436-bb5b56d58aad"

Inspect remaining direct encrypt/decrypt defaults, permanent-key setup commands, custody helper tracing/error handling and delegated apply/init helpers against the accepted single-founder attended custody decision. Public-recipient-only encryption and explicit temporary unlock must hold at their actual call sites. Do not treat a tty check as identity, authority or agent isolation. Reuse CUST-WP-0073/GLAS-WP-0012 for runtime isolation and Platform for root custody; record any further exact source defects and repair them before native acceptance.

2026-10-12 caller audit: direct encrypt/decrypt helpers and custody unlock repaired. Eight initial regressions failed against prior source. Encryption defaults to the registered public file and refuses private-key inputs; decryption has no HOME fallback and publishes only complete private output from staging, preserving existing outputs and removing partial failures. Unlock suppresses xtrace before hidden input, rejects ambiguous modes, removes competing inline/key-command credentials and preserves signal failure status with EXIT cleanup. Disposable crypto and prompt/child tests cover these boundaries. Bash foreground-child signal deferral and arbitrary-child copy retention are explicitly not solved by this helper. Evidence: Custodian custody-entrypoints.json.

Concrete uncovered callers remain (T02 stays progress):

• The KeyCape personal-admin token mint/refresh paths are retired by the October 13 repair below. Historical token copies still need owner inventory/revocation; the old privacyidea/check-user-mfa-state.sh also consumes that legacy Secret with insecure curl/argv handling and still requires reconciliation.
• Legacy trigger account/Secret inventory and owner-approved revocation are still required; removing automatic creation does not revoke historical credentials.
• RSA and Authelia-to-KeyCape client-secret rotation need configuration-preserving updates, retained rollback custody and native multi-consumer acceptance. The legacy replacement paths now refuse before mutation; this is not rotation closure.
• PostgreSQL/privacyIDEA/LLDAP/Authelia generators and the batch apply caller and direct SOPS edit/encrypt/rotate are repaired below. Other diagnostic, bootstrap and key-export callers remain open; native effect/recovery evidence is mandatory.

2026-10-12 Make caller repair: sops-setup now validates only the public recipient; creds-init no longer requires or installs a permanent private key. sops-decrypt uses the new age-only SOPS recovery adapter: explicit matching private custody file, isolated HOME/XDG/environment, pinned file descriptor, sanitized diagnostics, private no-overwrite output outside Git, atomic publication and failure cleanup. FILE/OUTPUT are passed as environment data instead of interpolated shell code. The old targets failed all 11 initial real-SOPS regressions. Additional format, parser, environment-command and credential-mode tests cover the final adapter. Existing HOME copies were not deleted; native recovery and the remaining direct editor/rotate/delegated paths are unverified. Evidence is Custodian sops-make-entrypoints.json; T02 remains progress, not source-surface closure.

2026-10-12 rotation caller repair: 20 initial regressions failed against prior source. New values and delegated diagnostics are suppressed, xtrace disabled, private owned no-symlink/single-link service files validated and replaced atomically, and Make passes SECRET as data. Database discovery fails closed before local mutation; SQL travels on stdin with ON_ERROR_STOP. Unattended LDAP password rotation is refused while the server update remains manual. Break-glass uses file input/server-side apply rather than argv literals/client annotations. Additional refusal/failure/cancel regressions cover final source. Successful script timestamps are not native consumer/revocation evidence; partial updates retain the local candidate for recovery. No live rotation occurred. Evidence: Custodian rotation-output.json. T02 and the founder-deferred rotation stay open.

2026-10-12 admin-bootstrap reconciliation: current SCOPE marks Keycloak backlog; KeyCape uses the separate pi-admin token path. Removed automatic legacy trigger account/policy/Secret creation and corresponding current readiness expectations. Fourteen old-source tests failed (two passed). The new entry point parses owned private input without executing shell code, sends credentials only on kubectl stdin, sanitizes failures and requires one pod plus a strict value-free receipt.

Upstream 3.12.2 inspection corrects the earlier mismatch hypothesis: admin add uses an upsert and may reset an existing password. The new version-scoped in-pod adapter verifies existing credentials and refuses mismatches or conflicting policies; new rows use insert-only transactional writes and a policy scoped to pi-admin. Disposable actual privacyIDEA 3.12.2/SQLite tests verify repeat stability, wrong-password refusal, legacy-policy/other-admin refusal, rollback and conflict handling. These do not prove the deployed image/PostgreSQL or effective MFA. Existing objects are not deleted or rotated. Current callers and the native acceptance gate remain open. Evidence: Custodian admin-bootstrap.json.

2026-10-13 KeyCape caller reconciliation: RPF-WP-0040 is finished and its owner contract/deployment use the scoped renewable factor-reader credential with ESO and adminTokenFile. Retired create-pi-token.sh and refresh-pi-token-live.sh before input/credential/cluster access; neither personal admin JWT delivery nor automatic realm/MFA-policy replacement is a current consumer requirement. Existing provider identities/Secrets were not revoked.

The first-bootstrap config generator now uses that mounted-file source, private literal input parsing, captured child diagnostics, stdin-only Secret data and atomic private signing-key publication without replacement. It requires Ready factor delivery and refuses existing config; API creation cannot overwrite a concurrent creator and adds no client-side apply annotation. A failed API call leaves its remote outcome unverified and retains the private key for recovery. Existing installations require a scoped owner update preserving clients/policy.

Bootstrap callers and recovery guidance no longer invoke retired token helpers. Legacy RSA/client-secret replacement rotations refuse before local or remote mutation: the former destroyed rollback custody before attempting publication, and both would overwrite newer live configuration. The remaining coordinated rotation work stays here, not silently completed by refusal. Native recovery, current deployed consumer acceptance and other create/apply/SOPS callers remain open. Source verification and its limits: Custodian docs/evidence/2026-10-13-netkingdom-security/keycape-caller-reconciliation.json.

2026-10-13 delegated service caller repair: the PostgreSQL, privacyIDEA, LLDAP and Authelia generators now share private literal-input parsing, captured child diagnostics and stdin-only Secret transfer. Ordinary invocation creates an absent object or verifies matching fields; it cannot silently rotate an existing object. Named rotation updates only its allowed field. UID/resource version/data tests guard patches; unknown data and unrelated metadata survive, and last-applied copies are removed under the same guard. Owner references, ESO management labels, immutable objects and wrong target identity are refused. The returned API object is checked before success; write failure remains an unknown remote outcome requiring reconciliation, never blind retry.

Authelia first creation retains a private signing key atomically; API failure keeps it for recovery. Existing issuer keys and matching bcrypt hashes survive repeat apply and session rotation. Explicit unsafe/differing keys are refused. The batch caller suppresses child output and records only successful components. Rotation callers pass exact field selectors; database rotation now updates the CNPG application Secret as well as the privacyIDEA URI. The attended LDAP path also depended on retired full KeyCape replacement, so now refuses before any change. SQL, Secrets and restarts remain non-atomic; coordinated recovery and native database/consumer acceptance are still required.

All 63 initial regression cases failed on the old helpers; the replacement and expanded caller tests pass, including real OpenSSL/bcrypt and actual kubectl local stdin patch/stale-version refusal with no cluster. Final source-bound suite results, dependency skips and test limitations are in Custodian docs/evidence/2026-10-13-netkingdom-security/service-secret-callers.json. No live Secret, signing key, credential or deployment was changed. T02 remains progress for the explicit callers/lifecycle work above; T03 remains waiting for its owner-scoped native recovery ceremony.

2026-10-13 SOPS write caller repair: Make passes paths and custody arguments literally, removing shell/Make execution before handoff. Public-only encryption refuses tracked plaintext. Edit consumes private replacement JSON/YAML outside Git and verifies the original MAC; rotate changes the data key only. Both require explicit matching custody and exactly the independently registered recipient, refusing metadata-injected recipients. Child diagnostics/plaintext output are suppressed, policy is preserved, and ciphertext publication checks source version before atomic replacement. Shared private-key validation rejects links/FIFOs. A stat/rename race against noncooperating same-UID writers remains; no OS isolation or live recipient migration is claimed. Validation and exact source binding: Custodian docs/evidence/2026-10-13-netkingdom-security/sops-write-callers.json.

Remaining closure checklist (source review, not proof of current live use):

• privacyidea/enckey-bootstrap.sh and its bootstrap/documentation callers are repaired below, including private no-overwrite export and a real PVC recovery transport. Actual off-host backup lineage, reviewed image/cluster execution and native service/database/token/audit recovery acceptance remain T03 requirements.
• privacyidea/check-user-mfa-state.sh and its guide/dry-run callers are repaired below: explicit private input, scoped counts and reader-visibility proof replace retired Secret retrieval. Live diagnostic delivery/execution still requires separate owner admission; KeyCape's workload lane is not silently shared.
• LDAP user-lifecycle shortcuts are retired and group callers are repaired below through the existing User Engine/service-group boundary. Inventory completeness and live provider admission still need owner evidence.
• General realm repair and both incident resolver helpers are repaired below. Full caller/root-output inventory and live owner-scoped acceptance remain open.
• Reconcile the complete docs/attended-procedure-inventory.md against current scripts and Make/bootstrap/root-output callers. The selected findings above are not an exhaustive closure audit. Retain historical revocation and configuration-preserving rotation requirements already recorded here.
• After source coverage, execute T03's exact owner-approved off-host recovery and current-consumer checks. Source regressions do not satisfy that gate.

2026-10-13 privacyIDEA key export/recovery source repair: key-custody.py and its captured in-pod adapter verify the Ready deployment-owned source pod and Bound PVC, validate the 96-byte encryption key and matching RSA audit pair, and retain private local copies without overwrite. DR Secrets are create-or-verify; existing extra fields/metadata survive and annotation removal uses conditional UID/version/data tests. The shared Secret publisher now accepts binary values. Missing encryption keys are never regenerated. Audit-pair creation is a separate explicit first-bootstrap flag, refused when any local/cluster recovery copy or partial pair already exists. The bootstrap caller forwards that flag only when explicitly selected, and script errors/key bytes are not forwarded to the terminal.

Restore now has an executable captured transport to the actual privacyidea-data PVC. A rendered helper uses an independently reviewed immutable image digest, no application entrypoint or service-account mount, and the real data volume. The wrapper requires a stopped Deployment, exact PVC UID and the sole Ready mounting helper pod, refuses differing files and retains partial writes for reconciliation. Files are published without replacement and checked afterward; this is not a multi-file transaction or UID-atomic Kubernetes exec. The admitted new-file ownership is root:999 with mode 0640 for private files, matching the source fsGroup. Current runtime ownership/consumer acceptance still needs proof.

privacyidea/KEY-RECOVERY.md replaces the broken unmounted-helper and Secret-only restart examples, resolves enckey versus PI_ENCFILE, and keeps stopping, creating/removing the reviewed helper and resuming the service explicit in the owner ceremony. Disposable native privacyIDEA 3.12.2 checks prove decryption of pre-recovery values and audit signature continuity after the local restore. Failure, partial-publication, wrong-target and mismatch tests plus broader results are retained in Custodian docs/evidence/2026-10-13-netkingdom-security/privacyidea-key-custody.json. No production key, PVC, workload or Secret was read or changed for these tests. T02 remains progress for the remaining diagnostic/LDAP/realm callers and full inventory/lifecycle reconciliation. T03 remains the native recovery gate.

2026-10-13 scoped factor diagnostic repair: replaced retired admin-token Secret retrieval with mfa_state.py and explicit private JWT input. The read-only helper uses only /token/ in coulomb, checks the existing disabled/unassigned realm probe before and after lookup, refuses incomplete pages, and distinguishes active-confirmed, active-pending and inactive counts. Empty results are not proof of user existence or login. TLS verification, origin restriction, redirect/proxy refusal, bounded responses and fixed errors prevent the original credential argv/provider-error output paths. No automatic retrieval, issuance or permission expansion is introduced. Guide and non-root dry-run now require explicit admitted input; the latter checks its selected user rather than hard-coded platform-root. Source/native disposable verification and limits are recorded in Custodian docs/evidence/2026-10-13-netkingdom-security/mfa-state-diagnostic.json. KeyCape-only RPF-WP-0040 delivery is not treated as authorization for this helper. LDAP/realm callers, full inventory and T03 native recovery remain open.

2026-10-13 realm/bootstrap source repair: replaced shell-sourced/%q credential transport with literal private files or attended in-memory prompts. Preview is read-only after authentication; --apply executes missing-object/tuning repair. Existing bind credentials, valid custom tuning, realm bindings/priorities and defaults are preserved; target/profile drift refuses before mutation. Existing policies are never replayed. The unsafe broad self-service/passthrough bootstrap writes are withdrawn in favor of the established onboarding-policy owner flow. The attended wrapper retains functional lookup/fresh-MFA verification and fails on partial/unknown outcomes without retry. Shared pi_api.py now pins allowed origins, verifies TLS, refuses redirects/proxies, bounds responses and sanitizes errors. The console and guides reflect these boundaries. Actual privacyIDEA 3.12.2 proves minimal resolver POST preserves omitted fields; this corrects the historical general replacement claim without rewriting its incident receipts. Disposable and broader test outcomes are in Custodian docs/evidence/2026-10-13-netkingdom-security/realm-bootstrap-repair.json. No live credential, resolver, realm, policy or token was touched. LDAP callers, incident-specific rotation/cutover review, full inventory and native recovery acceptance remain open; T02 stays progress and T03 wait.

2026-10-14 legacy lifecycle retirement: create-user.sh, dry-run-nonroot-user.sh (including pattern cleanup), and break-glass.sh now refuse with exit 2 before arguments, credential discovery or external calls. The Make targets no longer interpolate user inputs. Console execution/claims commands refuse before metadata loading or delegation; the inferred-claims helper cannot report success. Lifecycle worksheets start blank with false assurances, and their validators reject them until populated. Existing historical records remain unchanged. Current guidance routes ordinary onboarding/lifecycle through User Engine and the existing identity-provisioner; platform-root and independent recovery retain their separate IAM owner boundaries.

Eleven corrected-baseline regressions failed against the old source; the first draft also contained a wrong guide-function name, corrected before that baseline. Final focused console/retirement tests cover refusal under tracing, no credential file execution/external calls, Make shell-expansion refusal, no metadata reads, blank-template rejection and no inferred claims. Active callers and operator instructions no longer recommend the retired scripts; old architecture and assessment snapshots carry explicit superseding notices. New reference: docs/legacy-lldap-lifecycle-retirement.md. Evidence is retained by Custodian in docs/evidence/2026-10-14-netkingdom-security/legacy-lldap-retirement.json.

No account/password/token or deployed workload changed; retirement is not revocation or proof of independent recovery. bootstrap-users.sh, manage-group-members.sh, and verify-t07.sh still need credential-path/native verification repair (only stale lifecycle guidance changed in two of them). Incident cutover helpers, the full caller/root-output inventory and T03 remain open. T02 stays progress; no workplan closure is claimed.

2026-10-14 group-provider boundary follow-up: source review before reusing service-group APIs reproduced acceptance of net-kingdom-admins and net-kingdom-users. The reserved prefix covered netkingdom- (suspension) but omitted the actual hyphenated platform namespace. Both ensure and revoke now reject net-kingdom- before directory login, including mixed service/platform requests and delete-if-empty. Six new regressions fail on prior source; provider suite and source hash evidence: Custodian docs/evidence/2026-10-14-netkingdom-security/platform-group-boundary.json. This is a provider source repair, not deployed enforcement or evidence of past exploitation. The existing service-group behavior and tenant lifecycle remain covered by their tests. Deploy/admit this source through the existing owner path before treating the live boundary as fixed; native enforcement remains in T03.

2026-10-14 LDAP group callers reconciled: bootstrap-users.sh, manage-group-members.sh and verify-t07.sh now delegate to lldap_admin.py. The adapter reuses identity-provisioner operations/service-group validation and the existing literal private-custody reader. No shell sourcing, automatic credential discovery, curl/kubectl invocation, credential argv or KeyCape config Secret read remains in these entry points. Fixed-origin/system-trust transport refuses redirects/ambient proxies, duplicate/oversized/malformed responses and raw diagnostics. Bootstrap creates only the three missing empty baseline groups; service membership uses an existing exact subject/group and excludes reserved namespaces. No new account/password lifecycle or credential broker is introduced.

Default preview binds the origin/operation/target and observed directory state. Apply needs that exact digest, a fresh prewrite observation and exact final readback preserving unrelated state. LLDAP has no atomic cross-query CAS here: owner-controlled exclusive maintenance remains required, and partial writes need reconciliation rather than automatic rollback. A digest grants no authority. T07 emits structural observations with native acceptance unverified and exit 2; authentication/protocol/input failure exits 1. Object presence cannot close lifecycle/login/MFA/revocation/recovery requirements.

Three regressions reproduced executable credential sourcing in the old callers. All 200 affected tests pass with no skips. An actual local immutable LLDAP image passed preview, fixed bootstrap/preservation/idempotence, exact add/remove, reserved-group and stale-preview refusal, and T07's incomplete exit without tracing disclosure. Its synthetic credentials/storage/container were removed. Current procedure: sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md; evidence: Custodian docs/evidence/2026-10-14-netkingdom-security/lldap-group-maintenance.json. No live estate credentials or directory state were read or changed. Incident cutover helpers, full caller/root-output inventory and owner-approved native recovery/estate acceptance keep T02 progress and T03 wait.

2026-10-14 incident resolver helpers reconciled: both legacy shell bodies now invoke resolver_cutover.py with tracing disabled and attended memory-only inputs. The shared JSON transport has separate destination/route profiles for LLDAP authentication and KeyCape discovery; no privacyIDEA token crosses those profiles. Existing resolver/realm configuration is mandatory. Preview binds the observed public state and exact targets; apply rechecks it, performs one minimal BINDPW/type write, and verifies all other fields and realms are preserved. Native candidate and stored LDAP bind tests prevent cached-lookup false proof.

Full reconcile pins kubeconfig/context/server/cluster UID, checks current single replica generations, validates discovery issuer/endpoints, requires one exact user and token-backed MFA, and tests supplied predecessor HTTP denial. Missing predecessor returns incomplete/exit 2; an ambiguous write remains unverified and is never retried. Owner input provenance and actual KeyCape flow acceptance stay external. No secret files, ambient endpoint overrides or raw --note receipts. The runbook, historical merge-semantics correction and inventory are updated.

Validation: 171 affected tests pass (including terminal tracing tests), plus actual disposable privacyIDEA 3.12.2 and LLDAP prove old-bind refusal, candidate and stored-bind success, exact password-only update with custom settings/realms/ policies preserved, and real user/HOTP validation. Cluster/KeyCape gates are substituted only in that native fixture; production acceptance is unverified. The initial run had one test-fixture error (missing-resolver digest before the refusal call), corrected and retained in the evidence receipt. No live change or credential retrieval. Custodian evidence: docs/evidence/2026-10-14-netkingdom-security/resolver-cutover.json. This completes the bounded two-helper source repair; the full caller/root-output inventory and owner-native recovery/consumer acceptance still keep T02 progress and T03 wait. Founder-deferred exposure rotation remains deferred.

2026-10-15 continuation: expanded the source inventory to all 87 current non-test shell/Python callers under bootstrap/k8s plus Make, console, delivery copier and the recovery transport checker. Reconciled the attended inventory; source enumeration is not native acceptance. Six new regressions failed against the old bundle/delivery/preview paths, then passed after repair. Bundle packing now streams directly to age, refuses links/private age keys/non-private inputs, publishes a private new output without overwriting an existing artifact, and creates no plaintext tar intermediate. Bootstrap no longer erases retained service custody to regenerate or continues through failed OpenBao verification.

The lab OpenBao adapter now requires an explicit lab profile, admitted kubeconfig and exact cluster UID, contains child diagnostics, retains private no-overwrite init output and sends shares only on stdin. Production and automatic post-init root configuration are refused. Existing model selection is not authorization; new transport tests use only a fake cluster. The historical greenfield receipt does not prove this revised adapter was exercised natively.

Retired the unsafe User Engine shared-token copier, root-token pod prompt, unguarded legacy registry patchers/raw Python registry output and stale managed workload rollback. Current package/provider procedures remain authoritative. Presence diagnostics now check the scoped factor reader and preserve historical applied/native state. Dependency/client diagnostics suppress decoded-config tracing and provider response dumps. Withdrew old runbook recipes that generated replacement PI keys, wrote predictable plaintext backups, used a HOME private key for public metadata, encrypted only one export, or piped a pod dump into local SQLite. No existing credential/Secret/workload was rotated, deleted or reapplied.

Read-only primary metadata: all six identity-related Deployments are Ready; local backup jobs ran October 15. Personal-token Secret sso/keycape-pi-token and mfa/privacyidea-trigger-admin still exist; this is not proof of validity or provider revocation. Current job commands target PVCs, and the PI job does not mention the audit pair; off-host coverage must be established from actual artifacts. Founder identified Scaleway and Storage Share as backup destinations; exact artifact/manifest and independently held matching-key availability remain pending. No recovery key or backup content was retrieved for this review.

Prepared tools/bootstrap-recovery/verify-bundle.py and docs/bootstrap-recovery-ceremony.md: digest-bound ciphertext, explicit private key/registered recipient, strict file coverage and archive checks, unrelated wrong-key refusal, isolated file restore/readback and cleanup, with a closed non-secret receipt. Nine actual age/archive tests use disposable material. A successful transport check explicitly does not prove independent custody, current credential validity or native service recovery. This is preparation for the owner ceremony, not a completed production restore.

T02 remains progress for current owner/runtime acceptance, legacy provider credential disposition and retained coordinated-rotation requirements. The founder-deferred exposure rotation stays CUST-WP-0073-T05; this request does not silently reopen it. T03 remains wait for the exact off-host artifact/key lineage, reviewed isolated target/procedure and actual owner/native acceptance. Evidence: docs/evidence/2026-10-15-bootstrap-recovery/; full verification results are recorded there. No workplan completion is asserted.

Verify owner-approved recovery and current native callers

id: NK-WP-0049-T03
status: wait
priority: high
depends_on: [NK-WP-0049-T02]
blocking_reason: "Exact off-host artifact/coverage and independently held matching key remain unconfirmed after Scaleway/Storage Share destination identification. Requires completed T02 owner/runtime and legacy-credential disposition, then the exact reviewed isolated recovery ceremony and native consumer acceptance. No live bootstrap/root retrieval or deferred exposure rotation is authorized by source tests."
state_hub_task_id: "d68cd4d3-1ba3-530e-88f9-26ebb8dd6eac"

Review the final scoped procedure, current consumer/caller usage and independent key/snapshot availability. Under an exact approved ceremony, verify off-host ciphertext retrieval, matching independently held key, isolated decryption and required current service-file coverage, failed-key refusal and cleanup. Record only safe identities/digests/statuses. Do not run the whole live bootstrap merely to test this patch, or infer current credential validity from a historical bundle. Historical disclosure is separate incident/rotation work; terminal clearing and source repair do not revoke any earlier exposed value. G08 stays open until caller coverage, owner review and native recovery evidence are adequate.