net-kingdom/workplans/NK-WP-0045-root-grant-custody-record.md

id	type	title	domain	repo	status	flavor	owner	topic_slug	created	updated	related	state_hub_workstream_id
NK-WP-0045	workplan	Make the platform-root custody record readable as a non-secret root-grant fact	infotech	net-kingdom	active	implementation	claude-code	netkingdom	2026-09-29	2026-10-03	NK-ADR-0017 NK-WP-0042	43fbb1aa-b711-5792-b72b-07cd93ca8f45

Accepted NK-ADR-0017 makes the platform-root custody record the authority for the root grant. The non-secret schema/validator and OpenBao delivery design are complete and approved; owner implementation is progressing. Live delivery and user-engine acceptance remain T05/T06. Until those receipts exist, consumers return no root grant. This work does not assign a custodian from directory or claim projections, and no secret material enters the record.

Accept ADR-0017

id: NK-WP-0045-T01
status: done
needs_human: false
decision_id: c2cff929-91b9-4018-bfd6-fa04f7da8280
priority: high
state_hub_task_id: "25489680-c611-59f9-a0c4-291c4e2a7356"

Resolve the open points (15-minute cache bound, envelope mapping) and move the ADR to accepted.

2026-10-03: human gate routed to hub decision cef97ccd-4ee7-40fe-859e-1df9c9360ecb (D10: Identity record and MFA: accept NK-ADR-0017, choose the record read surface, agree the MFA user experience) by CUST-WP-0075; resolving that decision raises C-40 here.

Define the custody-record schema

id: NK-WP-0045-T02
status: done
depends_on: [NK-WP-0045-T01]
priority: high
state_hub_task_id: "49d8dd25-b555-55e9-a481-037d2b98fcc5"

Add canon/schemas/custody-record_v0.1.schema.json: record id and revision, (issuer, subject), relation platform-root-custodian, tenant:platform, granted-at, superseded-by, revoked-at with actor and reason. Non-secret only; the schema rejects token, key, share and recovery-code fields.

Done 2026-10-03 (CUST-WP-0075, build mode; ADR-0017 stays proposed, acceptance remains T01 under decision cef97ccd). Added canon/schemas/custody-record_v0.1.schema.json: record_id + monotonic per-record revision, owner_system: net-kingdom-custody, and entries keyed by exact (issuer, subject) (no username/email/group key), each with the fixed grant {scope_type: tenant, scope_id: platform, relation: platform-root-custodian, owner_system: net-kingdom-custody}, ceremony evidence (basis: custody-ceremony only, so projections cannot ground an entry), granted, optional superseded_by (entry id + revision) or revoked (at, actor, reason, revision), never both. A freshness block caps consumer cache at 900 s with on_unreadable: no-grant. Field names matching token, key, secret, share, recovery, password, reset, seed, private, otp or credential are rejected at every level. Incorporates user-engine's 2026-10-03 confirmation (message 60acf176): exact (issuer, subject) keying, monotonic revision, 15-minute cache bound, fail closed. If T01 amends the ADR, revise this schema to match.

Add a validator and fixtures

id: NK-WP-0045-T03
status: done
depends_on: [NK-WP-0045-T02]
priority: medium
state_hub_task_id: "6372f282-a12b-54b4-b2ea-327b20e58c8f"

Validator with grant, revocation and supersession fixtures, plus negative cases: projection-only grants, tenant-admin implication, secret-bearing fields. Follow the existing tool layout under tools/.

Done 2026-10-03 (CUST-WP-0075). tools/custody-record/validate.py (schema plus semantics: one active grant per (issuer, subject), revision ordering, supersession links, secret-looking values; successor_errors for append-only, strictly newer revisions so a stale read is distinguishable from a revocation; observe_root_grant for the ADR-0017 section 3 fail-closed read rule). Fixtures under tools/custody-record/fixtures/: valid grant, revocation, supersession; invalid projection-only grant, tenant-admin implication, other tenant, root-token / recovery-code / unseal-share fields, secret-looking value, username key, cache over 900 s, duplicate active grant, revoked-and-superseded. Tests tools/custody-record/tests/test_custody_record.py (13 passed; make custody-record-test); full pytest tests tools: 131 passed.

Decide the read surface

id: NK-WP-0045-T04
status: done
depends_on: [NK-WP-0045-T02]
needs_human: false
decision_id: c2cff929-91b9-4018-bfd6-fa04f7da8280
priority: high
state_hub_task_id: "472e191f-8b7a-5d0e-84ef-2717f92bc83c"

Options and the owner (net-kingdom versus railiance-platform) go to Bernd; the answer fixes T05.

2026-10-03: human gate routed to hub decision cef97ccd-4ee7-40fe-859e-1df9c9360ecb (D10: Identity record and MFA: accept NK-ADR-0017, choose the record read surface, agree the MFA user experience) by CUST-WP-0075; resolving that decision raises C-40 here.

Deliver the read path with the owner

id: NK-WP-0045-T05
status: progress
depends_on: [NK-WP-0045-T04, RPF-WP-0049-T05]
wait_kind: dependency
blocked_on: message-from:railiance-platform
blocking_reason: "Approved OpenBao design; RPF-WP-0049-T05 must provide the real authenticated read path, custody provenance and producer receipts. Reader identity, executor/recovery and separate live provisioning approval remain pending."
priority: medium
state_hub_task_id: "628e8a3b-17a4-5f97-a484-c564a87d650d"

Hand off the schema and read contract to the owner; NetKingdom does not absorb the runtime. Include the fail-closed and staleness rules from ADR-0017.

Close the loop with user-engine

id: NK-WP-0045-T06
status: wait
depends_on: [NK-WP-0045-T01, NK-WP-0045-T05, USER-WP-0037-T02]
wait_kind: dependency
blocked_on: message-from:user-engine
blocking_reason: "Needs T05 delivery and user-engine USER-WP-0037-T02 adapter/mapping acceptance against the delivered source, including revocation, freshness and rollback evidence."
priority: medium
state_hub_task_id: "eb71faf7-d6c7-5a3a-bdb6-17281cc5a01a"

Tell user-engine the read path is live so USER-WP-0037-T02 can derive AccountAuthority.root-grant from it, and record the evidence.

Acceptance Criteria

• The custody-record schema and validator exist and reject secret-bearing and projection-only inputs.
• A workload can read the root-grant fact from an owner-delivered surface.
• user-engine derives the root grant without inferring it from claims.

Initial implementation review, before founder approval — 2026-10-03

Local implementation is complete for the current draft. Workplan moved to blocked: T01/T04 require the founder's open decision; T05 needs the selected runtime owner; T06 needs user-engine integration. Task status wait expresses these blockers under the repository convention. No live source, custody entry, ADR acceptance or runtime delivery is claimed.

• Added read contract with three concrete surface options, a review recommendation, producer and consumer requirements, and owner-specific acceptance receipts. T04's choice remains human-owned. T05's delivery repo cannot be bound until that choice.
• Hardened T03 implementation: reject retroactive actions in revision transitions, invalid comparison documents and backwards update times; observations can check a previous document and fail closed on rollback, future timestamps and timezone-naive clocks. CLI diagnostics suppress raw validation errors and malformed input so rejected secrets cannot be echoed.
• Required external work: selected delivery owner creates its implementation workplan and supplies the T05 receipts; user-engine implements its adapter in USER-WP-0037-T02 and supplies T06 receipts. The contract is the handoff artifact; runtime work remains in owner repos. Handoffs sent via State Hub: railiance-platform bc0c620c-6520-4d42-b5d1-df082042ed03 (conditional delivery requirements) and user-engine d6efcf93-9f51-4763-b7d7-a2f43ea4fbf9 (adapter/acceptance requirements).
• Validation: make custody-record-test — 18 passed, including regression tests for the newly found transition, clock and diagnostic gaps. Full regression python3 -m pytest tests tools — 136 passed.
• Security knowledge: Emergent package 0.2.3, start and root, source status verified-files, orientation-only; digest 60f8811c6b94b30d357a0d9e5022f2a8ea52e69b47138d3a536755f3295310b5. Local source/test/contract work only; no control relaxation or live mutation.

Resume when decision cef97ccd-4ee7-40fe-859e-1df9c9360ecb is answered: reconcile any amendments, name the delivering repo/task on T05, verify its receipts, then obtain user-engine acceptance before closing T06 and the plan.

Founder approval and owner progress — 2026-10-03

Bernd explicitly accepted ADR-0017 and approved the proposed OpenBao delivery design. Scoped made decision c2cff929-91b9-4018-bfd6-fa04f7da8280; T01/T04 are done. ADR is accepted and the read contract names railiance-platform's KV v2 source platform/data/custody/net-kingdom/platform-root, record nk-custody:platform-root, read-only user-engine consumer and separate attended human custody writer. The bundled D10 stays open for separate MFA work.

Owner preparation progressed: railiance-platform RPF-WP-0049 has a CAS payload helper, exact-path policy drafts and five passing offline tests (source baseline 663135c, pushed and exact-commit primary sync applied). user-engine has prepared a transport-neutral observation adapter and seven fixture checks; full suite 284 tests passed with eight optional skips. Neither source packet is a live read path or real custody grant.

Plan stays blocked on T05 producer delivery (RPF-WP-0049-T05), then T06 consumer integration (USER-WP-0037-T02). Remaining concrete gates are actual runtime reader identity/auth route, reviewed executor and durable recovery/audit baseline, separate bounded live provisioning/custody bootstrap approval and real positive/negative acceptance receipts. Source choice/ADR acceptance are resolved and must not be requested again.

Knowledge reload: package 0.2.3 digest 60f8811c6b94b30d357a0d9e5022f2a8ea52e69b47138d3a536755f3295310b5; start/decisions cards withheld due to changed informed-decision source. Reviewed current informed-decision README and owner guidance directly. This approval is recorded from the human instruction, not inferred from situational knowledge.

Go-forward implementation — 2026-10-03

Bernd subsequently approved: “Good, i approve go forward please.” Continuing implementation and the bounded approved delivery design is authorized; do not request ADR, surface or generic go-forward approval again. Plan temporarily active while owner implementation progresses; T05 in progress. Missing facts and an attended OIDC/MFA handoff remain execution conditions, not a request to repeat the approval.

Delegated source ownership: railiance-platform producer/executor and admission; user-engine authenticated transport, durable baseline and runtime mapping; rapp-user-engine deployment packaging and dedicated projected JWT. Confirmed consumer owner declarations in rapp-user-engine/manifests/runtime.yaml name namespace/Deployment/ServiceAccount user-engine, automount disabled and an existing flex-auth-only projection. OpenBao requires its separate audience.

Custody evidence review: local bootstrap metadata records a temporary-single- king approval in May 2026 and a directory reference. The signed local escrow roster is planned, with planned identity references. Neither binds a current exact OIDC issuer/subject as a real root-grant ceremony record. Asked the founder for only the non-secret ceremony reference and exact issuer/subject; no grant will be inferred from directory/JWT projections or these historical records.