From d1dcfde527afde15a6fbe7ae65a2d94b70c3c263 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 16 Oct 2026 09:38:31 +0200 Subject: [PATCH] docs(recovery): verify actual identity archive recovery and active backups Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2 --- docs/identity-recovery.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/identity-recovery.md b/docs/identity-recovery.md index 3bb9fd0..45b13dc 100644 --- a/docs/identity-recovery.md +++ b/docs/identity-recovery.md @@ -3,7 +3,7 @@ Use this handoff when recovering an existing Railiance identity, before introducing new issuer or MFA keys. `railiance-bootstrap` sequences recovery; NetKingdom owns identity capture and acceptance, S1/S2 own the replacement host/cluster and S3 owns database/custody service recovery. There is no automatic bare-VM production restore. 1. Independently obtain the reviewed repositories/toolchain and the `railiance-backup` age key from offline/password-safe custody. Do not depend on the failed SSO or OpenBao instance to obtain these. The key stays in the operator's hidden terminal. -2. Retrieve the exact encrypted `net-kingdom-identity-*.tar.age` generation and safe transfer receipt from Storage Share `Backup/railiance-backups/net-kingdom-identity/`. The first full bundle was captured and Storage Share readback verified on2026-10-16; independent human-key full archive and full-service recovery remain pending. Existing privacyIDEA database-only dumps do not include service keys. Runtime publisher/retention shares are not recovery authority. During a healthy attended drill, NetKingdom `retrieve-identity.py` binds an independent Backup-account download by strong ETag/size/SHA256. That helper currently uses a healthy OpenBao custody path: during total custody loss, use independently held provider access to download and obtain an owner-reviewed transfer receipt before verification. That offline provider adapter is not implemented here. +2. Retrieve the exact encrypted `net-kingdom-identity-*.tar.age` generation and safe transfer receipt from Storage Share `Backup/railiance-backups/net-kingdom-identity/`. The first full bundle was captured and Storage Share readback verified on2026-10-16; independent human-key full archive recovery also passed and daily backup/hourly health are active. Full native service authentication/audit continuity and production import remain separate acceptance. Existing privacyIDEA database-only dumps do not include service keys. Runtime publisher/retention shares are not recovery authority. During a healthy attended drill, NetKingdom `retrieve-identity.py` binds an independent Backup-account download by strong ETag/size/SHA256. That helper currently uses a healthy OpenBao custody path: during total custody loss, use independently held provider access to download and obtain an owner-reviewed transfer receipt before verification. That offline provider adapter is not implemented here. 3. Follow the exact NetKingdom [recovery ceremony](../../net-kingdom/docs/bootstrap-recovery-ceremony.md). On a healthy workstation with age and Docker, invoke the bootstrap handoff through the hidden-key wrapper: ```bash