net-kingdom/workplans/NK-WP-0055-security-platform-production-readiness.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	flavor	depends_on	related	state_hub_workstream_id
NK-WP-0055	workplan	Reach and prove security platform production readiness	infotech	net-kingdom	active	claude-code	netkingdom	2026-10-27	2026-10-27	implementation		NK-WP-0049 CUST-WP-0073 RPF-WP-0064 RPF-WP-0036	55438344-f67c-53f5-ac70-31cac1405e83

The estate is in builder mode. This workplan holds the work that has to pass before NetKingdom's security platform is declared production-ready. Builder-mode workplans can close with named residuals, and those residuals land here instead of keeping their source plans open. Nothing in this plan needs to run before the founder decides to move toward production.

Definition of production readiness

The security platform is production-ready when every area of the Production Readiness Checks table has its check recorded as met, with evidence, or as an accepted exception with an owner and a review date. A check counts only if it was observed on the estate that serves production traffic. Fixtures, rehearsals and builder-mode acceptances do not count. The areas are:

1. Platform root custody
2. MFA and identity
3. Bootstrap and recovery
4. OpenBao runtime secrets
5. Secret rotation
6. flex-auth policy state
7. Topaz runtime
8. Tenant onboarding
9. Audit sink
10. Break-glass

For Bootstrap and recovery, this plan adds three requirements, drawn from NK-WP-0049:

• Joint restore: the restored identity services and OpenBao work together for a real login.
• Recurring drill: restores are re-proved on a schedule, not just once.
• Credential cleanup: the remaining bootstrap-era credentials are rotated or revoked.

Readiness does not mean HA. HA is a separate decision, and the current estate runs on one node.

Assess every readiness area against current evidence

id: NK-WP-0055-T01
status: done
priority: medium
assignee: claude-code
state_hub_task_id: "8c91597e-4d3e-5811-ae0d-96ff6b7d9017"

Done when: a readiness ledger (docs/evidence/<date>-production-readiness-ledger.md) lists all ten areas, each with:

• a status: met, partial, open, or accepted exception;
• the evidence or the exact missing proof;
• the owner repository;
• the task that carries the gap.

Gaps that the tasks below don't cover get new tasks in this plan, or a pointer to an existing owner workplan. The assessment is read-only.

2026-10-27: done. Readiness ledger: 0 areas met, 7 partial, 3 open (Topaz, audit sink, break-glass). Uncovered gaps became T10–T15 below.

Build and rehearse the joint-restore drill (from NK-WP-0049-T43/T44)

id: NK-WP-0055-T02
status: wait
priority: medium
assignee: claude-code
blocking_reason: "Starts when the founder schedules the move toward production."
state_hub_task_id: "057ed64a-6f63-516a-b13c-65e7f1fd01f9"

Start from the design retained in NK-WP-0049-T43:

• the secrets-engine inherited-pipe runner (65a3dbe), with the founder's optimizations 1, 3, 4 and 5;
• the railiance-platform phase B network (5658150: rpf64-nk49-pb, 10.249.64.0/28; the rehearsal variant uses -rh-);
• the client secret keycape-secrets-engine-openbao-client (key client-secret), read from archive member resources/sso/secret/keycape-secrets-engine-openbao-client.json.

The work:

• a new reviewed phase B module, with its verifier and tests;
• a single-member, non-echoing decrypt wrapper;
• the owners' adapter and runner changes;
• a synthetic-client rehearsal on the throwaway network;
• the value-free OpenBao /jwks trust probe.

Do not edit the pinned NK-WP-0049 T38/T40 sources.

Done when: the module, wrapper, adapter and runner are reviewed to T38 depth and the synthetic rehearsal passes.

Run the joint restore with a live consumer and a PKCE client

id: NK-WP-0055-T03
status: wait
priority: medium
assignee: claude-code
depends_on: [NK-WP-0055-T02]
blocking_reason: "Needs T02 and a founder-signed window. The letsencrypt-prod reissue for kc.coulomb.social needs a fresh duplicate-certificate check, or at least 7 days since the last issuance."
state_hub_task_id: "4037afe7-9dfa-5454-9373-f9d47f81e040"

Done when:

• restored KeyCape and restored OpenBao are joined on the isolated network;
• secrets-engine-openbao passes the native positive and negative login checks;
• one browser authorization-code/PKCE client passes as well;
• the verifier has independently checked the receipt.

This closes NK-WP-0049 residuals key-cape K1 and railiance-platform R1/R2. The founder explicitly accepts the unseal window length when signing.

Re-prove the reserved-group denial and the resolver cutover (from NK-WP-0049-T21)

id: NK-WP-0055-T04
status: wait
priority: medium
assignee: claude-code
depends_on: [NK-WP-0055-T02]
blocking_reason: "Runs in the joint-restore drill environment or as its own owner-admitted live check."
state_hub_task_id: "4338365e-cdaa-5c62-880d-db3536f39fa8"

Done when:

• the deployed reserved LDAP group is natively denied, both in a positive and a negative case;
• the privacyIDEA LLDAP resolver/cutover inputs have provenance and a functional proof on the target estate.

Admit a credential lane for the attended factor diagnostic

id: NK-WP-0055-T05
status: todo
priority: low
assignee: claude-code
state_hub_task_id: "9adbc2b8-3680-5d91-8a80-670f712bf9d9"

The diagnostic (mfa_state.py, check-user-mfa-state.sh) has no admitted credential. It must not borrow KeyCape's keycape-factor-read. Live, only sso/keycape mounts that secret, verified 2026-10-27.

Done when: the owner has an admitted delivery and execution arrangement, found through warden route, and one attended diagnostic run passes. The alternative is an accepted decision that the diagnostic is not needed for production.

Rotate or revoke the bootstrap-era and exposed credentials

id: NK-WP-0055-T06
status: wait
priority: high
assignee: claude-code
blocking_reason: "Founder rotation deferral CUST-WP-0073-T05 / decision 1591daa1 is in force until the founder lifts it."
state_hub_task_id: "a7731db5-8569-52df-99ea-c4524777d25b"

This includes the privacyIDEA credentials behind the deleted sso/keycape-pi-token and mfa/privacyidea-trigger-admin. The architecture requires rotating bootstrap-era credentials before live workloads rely on the platform.

Done when: each affected credential has verified revocation or rotation, with signing and client-secret preservation proven, or an accepted exception. Execution belongs to the credential owners. This task tracks it and does not duplicate CUST-WP-0073.

Make restore assurance recurring

id: NK-WP-0055-T07
status: todo
priority: medium
assignee: claude-code
state_hub_task_id: "15ae6653-898c-593c-8ba9-35b7bd5a50a0"

Carries NK-WP-0049-T24 G3 and railiance-platform R6 (RPF-WP-0036-T03).

Done when: a scheduled drill re-proves the isolated identity and OpenBao restores on the current backup generation. It must include:

• image-lineage proof (R5);
• the audit-device mount (R8);
• a reconciliation procedure for changes made after the archive was taken (K2).

Drill results land in the readiness ledger.

2026-10-27: the identity drill already lives in NK-WP-0053 (quarterly isolated identity restore drill; T02 first run, T04 admin-operated). This task tracks NK-WP-0053 and RPF-WP-0036-T03 (scheduled OpenBao snapshot) rather than building a second drill; it adds only image lineage, the audit-device mount and the post-archive reconciliation procedure.

Decide durable custody for receipts kept outside Git

id: NK-WP-0055-T08
status: todo
priority: low
assignee: claude-code
state_hub_task_id: "4533872f-ccfa-5538-96ed-a3bad0ea550e"

The T18 KeyCape receipt (16d72f7c…1651) and the OpenBao restore receipt (4e048dee…579d) exist only on the founder workstation, because the secret scanners flag their public digests.

Done when: an accepted custody location with a second copy holds them, still bound by their recorded hashes, or the founder accepts single-copy custody as an exception.

Founder production-scope decisions

id: NK-WP-0055-T10
status: done
priority: high
assignee: claude-code
needs_human: true
decision_id: "37464824-a939-415f-8a7a-5f81cbf498c8"

Decide what production requires: (a) whether manual Shamir unseal is the approved production mechanism, or auto-unseal is required; (b) whether a delegated Topaz PDP is required, or the access-engine Go core satisfies the PDP area; (c) who the two-of-three escrow holders and the OpenBao unseal share holders are (names and places, never values); (d) that HA stays out of scope.

Done when: each answer is recorded as a hub decision and reflected in the ledger.

2026-10-27 founder answers: (a) manual Shamir unseal is the approved mechanism for now; (c) the founder, as platform-root, holds the OpenBao unseal shares (single holder; two-of-three escrow holders not named); (d) HA stays out of scope for now. (b) Topaz is pending an explanation of the accepted-exception consequences.

2026-10-27: done. (b) accepted as an exception: the access-engine core is the production PDP, Topaz is deferred (ADR-0018); (c) single-holder custody accepted as an exception. All answers are in hub decision 37464824 and the ledger. Exceptions are reviewed at T09.

Get every audit source into the durable sink with one correlation id

id: NK-WP-0055-T11
status: todo
priority: high
assignee: claude-code
state_hub_task_id: "93caa9e0-3d28-58ac-808a-47e15fe6d6ab"

Owners are audit-core (receiving), railiance-platform (OpenBao audit forwarding), railiance-cluster (Kubernetes API audit), access-engine (AUDIT-WP-0013-T02 registration) and NetKingdom (identity-provider events and the correlation-id contract). Topaz is not a source (ADR-0018).

Done when: each owner has a task in its own workplan; identity, authorization, OpenBao, Kubernetes and workload records land durably; one correlation id is defined and tested across the onboarding chain; audit-core has a recurring restore drill and AUDIT-WP-0015-T01's offsite chain head.

Record live conformance receipts

id: NK-WP-0055-T12
status: todo
priority: medium
assignee: claude-code
state_hub_task_id: "c93fa290-663a-582c-a5b2-beb876fcff1e"

Done when: dated receipts exist for the live IAM issuer conformance run (NK-WP-0054-T04), caller-auth enforcement on every access-engine release unit (only ops-warden is proven today), the access-engine core's health, data freshness, policy load status and per-consumer fail-closed stance (ADR-0018), the live OpenBao auth methods and mounts against the committed policies, and the tenant onboarding completion test for tenant:coulomb.

Record and drill break-glass with SSO down

id: NK-WP-0055-T13
status: todo
priority: high
assignee: claude-code
state_hub_task_id: "6dfdf2be-e87a-5368-b2b6-45dcb92fe6e4"

Done when: the crisis custody list items 4, 7, 8 and 9 are confirmed (kept current by NK-WP-0054-T07); a path that works with KeyCape/Authelia down is recorded and drilled by the founder; and use produces a post-event review record.

Policy import pipeline and platform/tenant package split

id: NK-WP-0055-T14
status: todo
priority: medium
assignee: claude-code
state_hub_task_id: "bd28a970-9616-5323-9f97-d5b260a144f1"

Owner: access-engine. Done when: policy changes are imported without rebuilding the image, tenant:coulomb has platform and tenant packages split, one production explain receipt exists, and FLEX-WP-0031 (decision records) and FLEX-WP-0024 (signed envelope) are delivered or accepted as exceptions.

Register rotation lanes with blast radius and verification

id: NK-WP-0055-T15
status: todo
priority: medium
assignee: claude-code
state_hub_task_id: "d9c0584e-10a1-5edf-a1f9-cec5738f94a8"

Done when: every service, database, OpenBao-issued, client-secret and break-glass credential lane is listed with its blast radius and verification step, linked to its owner lane (RPF-WP-0035, RPF-WP-0055-T01, T06).

Close readiness and declare production

id: NK-WP-0055-T09
status: wait
priority: high
assignee: claude-code
depends_on: [NK-WP-0055-T01, NK-WP-0055-T03, NK-WP-0055-T04, NK-WP-0055-T05, NK-WP-0055-T06, NK-WP-0055-T07, NK-WP-0055-T08, NK-WP-0055-T10, NK-WP-0055-T11, NK-WP-0055-T12, NK-WP-0055-T13, NK-WP-0055-T14, NK-WP-0055-T15]
blocking_reason: "Every readiness area must be met or an accepted exception."
state_hub_task_id: "0630b0ea-dec1-5355-8b08-0d317d4a3c9b"

Done when:

• the readiness ledger shows every area as met or as an accepted exception;
• the founder records the production declaration as a decision;
• SCOPE.md's capability table is updated to match.