net-kingdom/docs/crisis-custody-list.md

Crisis custody list

NK-WP-0054-T07. Drafted 2026-10-24 from repository documents and the founder's statements that day. This list holds no secret value, ever. It names what unlocks recovery, who holds it, where, and whether using it needs the very services being recovered. Anything the repository cannot establish is marked TO CONFIRM; the founder confirms each one.

It belongs with the backup documentation: disaster recovery guide, identity restore drill and Credential Management Standard §4. That standard names the custody categories. This list makes them concrete.

The one rule

For every row, answer: does using this item work when SSO and OpenBao are down? A recovery path that is satisfied only by logging in to something being restored is a circular dependency and is recorded as a gap, not as custody.

Roles used below

Role	Identity	Used for
Crisis operator	admin	Runs recovery and routine validation (founder intent, 2026-10-24)
Authorizer	platform-root / king credential	Break-glass authority from offline custody; nothing routine
Developer	tegwick	Builds and tests tooling; holds no recovery keys

Items

#	Item	Unlocks	Holder and location	Works with SSO and OpenBao down?	Last proven use	Gap or action
1	Custodian/backup age private key (recipient age1zvry…50syr3tsz, labelled railiance-backup)	Decrypts the identity backup bundle and the SOPS custody files	Founder, independently held password safe or offline packet (Standard §4)	Yes, offline	Entered by the founder at hidden prompts 2026-10-24 (LLDAP, Authelia, privacyIDEA stages)	TO CONFIRM: number of copies, who else could recover if the founder cannot
2	Storage Share Backup account app password	Downloads the protected ciphertext without OpenBao or SSO	Founder, independent custody TO CONFIRM	Yes, provider is outside the platform	Fresh retrieval 2026-10-24	One provider copy only; residual risk accepted until 2027-01-31 (G1, NK-WP-0053)
3	OpenBao unseal shares (2 of 3 required in the restore drill)	Unseals a restored or production OpenBao; with the shares, generate-root can mint a root token for break-glass (ceremony not yet documented)	Founder as platform-root holds all three shares (single-holder custody: accepted exception, hub decision 37464824, 2026-10-27)	Yes, offline	Original shares used in the isolated restore RPF-WP-0064-T07, 2026-10-24	TO CONFIRM where the shares are kept and that the place opens with SSO down; single holder = single point of loss (reviewed at NK-WP-0055-T09)
4	platform-root / king account and factors	Final authority; break-glass	Independently held password safe or offline packet (Standard §4; custody doc)	No if used through KeyCape: its login and OTP are validated by the services being recovered	OTP validated against restored privacyIDEA 2026-10-24 (isolated)	TO CONFIRM the offline path that works with SSO down (OpenBao shares, item 3) and record it
5	Founder admission signing key (SSH, principal bernd)	Signs attempt and restore admissions	Founder, workstation key; verifier anchor /etc/secrets-engine/admission/allowed_signers	Yes	Signed the T40 admission 2026-10-23	TO CONFIRM which identity this key belongs to; the anchor is workstation-bound, so a backup of key and anchor is needed
6	admin password and OTP token	Day-to-day platform administration and, per intent, recovery operation	Founder; OTP enrolled 2026-10-24	No: login and token checks need KeyCape, LLDAP and privacyIDEA	Token not yet in any restored backup; first restore proof after the 2026-10-25 03:45 UTC capture	Same account as the directory bind used by Authelia and privacyIDEA until the split in NK-WP-0054-T05
7	pi-admin credentials (privacyIDEA internal admin)	Token repair and re-enrolment	Founder's personal password safe (confirmed 2026-10-27)	Custody yes if the safe opens offline; use needs a running privacyIDEA	Not yet drilled	TO CONFIRM the safe opens offline and has a second copy; add a pi-admin check to the drill (NK-WP-0053-T04)
8	Ops bundle (age-encrypted tar of service secrets, make creds-bundle)	Point-in-time service secrets	Offsite location TO CONFIRM (Standard §7)	Yes, needs item 1	Not drilled	Confirm location and age; decide whether it duplicates the identity bundle
9	Operator access to the production host or cluster for a real restore	Applying a restore to production	Today (observed 2026-10-27): ops-bridge tunnel k3s-api-railiance01 (SSH as tegwick to 92.205.62.239 with a static key file, local port 16444) plus the attended admin kubeconfig ~/.kube/config-railiance01 (route kubernetes-railiance01-admin, client-certificate user). Both live only on the founder workstation	Yes for this path: neither the static SSH key nor the kubeconfig client certificate needs KeyCape or OpenBao. No for ops-warden SSH certificates: warden's production backend is OpenBao (backend: vault)	Used 2026-10-27 (founder deleted two historical Secrets)	Gaps: workstation-only, no second copy; the path runs as the developer identity tegwick under an agent-labelled tunnel actor; provider console/rescue access TO CONFIRM. Decide the crisis-operator path (NK-WP-0055-T13)

Non-secret recovery assets

These need no custody but must be reachable: the published recovery kit on Storage Share (guide, tools ZIP, checksum; verify the checksum against a trusted copy), the pinned container images, and a trusted checkout of this repository. TLS for kc.coulomb.social has no custody: it is reissued through ACME and needs working public DNS and HTTP-01.

Maintenance

• Review at every restore drill (NK-WP-0053), and record the date each item was last proven. An item never proven stays marked as such.
• Loss or suspected exposure of any item goes to its owner's rotation and revocation process (Standard §6); this list rotates nothing.
• A machine-readable, non-secret record with a freshness check, modelled on tools/custody-record, is proposed in NK-WP-0054-T07. Until then this document is the list.