railiance-cluster/workplans/RCLUSTER-WP-0018-keycape-original-tls-recovery.md

---
id: RCLUSTER-WP-0018
type: workplan
title: "Establish original KeyCape TLS recovery and future archive boundary"
domain: financials
repo: railiance-cluster
status: active
owner: codex
topic_slug: railiance
created: "2026-10-17"
updated: "2026-10-23"
flavor: implementation
depends_on: []
related: [CUST-WP-0080, NK-WP-0049, RCLUSTER-WP-0007, RCLUSTER-WP-0017]
state_hub_workstream_id: "e0a7813d-c916-5e49-84b2-5e5b30441891"
---

Required owner source work for NK-WP-0049-T35 and CUST-WP-0080 G08. Reviewed
against current INTENT/SCOPE, backup sources and existing work records; ready
means work can proceed, not privileged execute authority. This does not promote
HA/backlog work, reopen archived local backup delivery or duplicate signer0017.
Source-owner scope is certificate plumbing/backup posture; NetKingdom owns
namespace ingress, while exact original independent TLS custody remains to be
established. No secret read, reissue, live change or native assent occurred.

## Record source boundary and public-only metadata preparation

```task
id: RCLUSTER-WP-0018-T01
status: done
priority: high
assignee: codex
state_hub_task_id: "7280193d-0d59-5b78-a2d3-96ebd127127f"
```

Completed 2026-10-17 as isolated source preparation. Independently reviewed the
17 public source references against current owner bytes, checked current owner
instructions/environment/supervision and existing plans, and recorded the exact
boundary in docs/keycape-tls-recovery-boundary.md. Prepared bounded public-only
certificate/trust metadata projection with generated-certificate tests; no actual
certificate/key read. Source integration/publication and task projection remain
separate receipts, not claimed by this completed preparation task.

Evidence: the-custodian docs/changes/netkingdom-target-2026-10-16/
recovery-owner-handoffs-r1/ and prior recovery-attempt-r1/t35-t36-source-next/.

Publication return, 2026-10-17: normal owner source publication at
c562d7134c38679952a8ffd17a8a893a900aef0d was applied on primary/railiance01
with expected and derived commits equal. Read-only source/remote/Hub proof
verified this workplan's five exact task ID/UUID/status bindings and three
internal dependency edges. Receipts are retained in the Custodian packet
docs/changes/netkingdom-target-2026-10-17/railiance-cluster-projection.json and
cluster-publication-readback.json. The later legitimate C23 lifecycle repair
at 26671d33600e218316d29c9cd020f115ebfb35b2 changed ready to active; active
is retained. This return records publication separately from the completed
source preparation above. Original TLS artifact/provider custody, extraction
and native admission remain T02–T05 obligations; publication proves no TLS
recovery, private-key custody or native acceptance.

The whole maintenance pipeline's historical-row guard failed for three parent
rows while 15 task full-row hashes remained unchanged. STATE-WP-0095-T07 and
RMGR-WP-0019-T06 remain wait; neither publication nor this memo asserts full
historical-row preservation or restoration. The subsequent forward correction
restores the brief's committed content to its pre-accident version while restoring
the original staged/worktree change for its owner; history is not rewound. No legacy deep consistency fix is run by the correction.

## Establish exact independent original TLS artifact and provider custody metadata

```task
id: RCLUSTER-WP-0018-T02
status: todo
priority: high
assignee: codex
state_hub_task_id: "90836435-917f-504c-a711-3f29ece348e3"
```

Next: identify the actual original sso/kc-tls custody owner and independent public
provenance through existing owner processes. Record artifact/provider, timestamp,
public certificate/trust hashes, private custody entry point and outage dependencies
without values. Source review cannot infer a fresh backup, original key coverage
or independent decryption custody from a local backup script. Use credential
routing before any later credential need; missing route is not proof of absence.
Done when exact independent recovery or an explicitly owned unavailable capability
is evidenced as metadata and a reviewed next action, with no guessed assent.

## Prepare safe isolated original extraction or explicit reissue alternative

```task
id: RCLUSTER-WP-0018-T03
status: wait
priority: high
assignee: codex
depends_on: [RCLUSTER-WP-0018-T02]
blocking_reason: "Exact original artifact/provider/custody disposition is required before selecting extraction or reissue source."
state_hub_task_id: "5dfa9a3a-2639-5cf6-b0a4-13eef417d47a"
```

From T02, reuse the actual owner path to prepare an exact attended private-only
recovery command and full dependency/cleanup proof. Do not run whole-state restore
or expose raw state/Secret output. If existing backup staging is required, correct
only the needed path with bounded memory-only staging and early exact cleanup,
including error/parent-loss tests before use. Original recovery and accepted
reissue are distinct claims; no self-signed trust substitute, new broker or
implicit production action. Done when the exact source proposal, public metadata
preflight, negatives, timeout, abort and custody obligations are reviewed.

Checkpoint 2026-10-23: founder decision 9f9d0d88 (A, 2026-10-21) selected the
reissue alternative for recovery TLS: letsencrypt-prod ACME HTTP-01 through
Traefik, chained to ISRG Root X1, no self-signed substitute, staging rehearsal
first. The staging rehearsal source is prepared under T06. This task's status is
left for owner review against T02.

## Verify admitted original TLS recovery through the actual owner boundary

```task
id: RCLUSTER-WP-0018-T04
status: wait
priority: high
assignee: codex
needs_human: true
depends_on: [RCLUSTER-WP-0018-T02, RCLUSTER-WP-0018-T03]
blocking_reason: "Await exact reviewed attended owner custody path and its existing scoped authority; no private input or native attempt requested yet."
state_hub_task_id: "021b07bb-65bc-5743-bac5-4294b4be74f6"
```

Only the actual admitted owner action can prove recovered certificate/key pairing,
original hostname/trust and independent outage operation, or the expressly accepted
reissue result. Retain exact source/artifact/target/identity/negative/cleanup receipts.
Human custody/authority gates are not worker wakeups. Source and historical local
backup proof never fill native assent. Return bounded public proof to NK49T35;
no production mutation, credential retrieval or approval is granted by this task.

## Disposition original TLS coverage in the future identity archive contract

```task
id: RCLUSTER-WP-0018-T05
status: todo
priority: high
assignee: codex
state_hub_task_id: "5bc67a22-0991-5625-86a6-f749560d8a0e"
```

Next: deliver the source-owned requirement in docs/keycape-tls-recovery-boundary.md
to NetKingdom's existing contract process: original TLS custody or accepted reissue,
independent provider/key recovery, public identity hashes, scoped capture/read
permissions and verification/retention. Record named owner dependencies as live
work before closure. Do not append kc-tls to secret_refs, expand capture credentials
or rewrite a historical archive without those owner reviews/authority. Done when
the future contract requirement has an exact tracked disposition/handoff; it is
not proof of current archive coverage or actual future capture.

## Prepare the Let's Encrypt staging rehearsal for the kc.coulomb.social reissue

```task
id: RCLUSTER-WP-0018-T06
status: done
priority: high
assignee: claude
state_hub_task_id: "11708860-d1e4-5d12-80ab-bc3bc06f7f83"
```

Source preparation for NK-WP-0049-T33 (request 6d5e748b, decision 9f9d0d88 = A).
Delivered install/cert-manager/rehearsal/kc-le-staging.yaml (throwaway namespace
tls-rehearsal-kc, a namespaced staging Issuer, and a Certificate whose target
name differs from the live one, so it cannot write sso/kc-tls), the runbook
docs/keycape-tls-le-staging-rehearsal.md (preflight, apply, bounded wait,
"(STAGING)" chain verification with openssl and tools/public-tls-metadata.py, a
check that the live certificate is unchanged, cleanup, abort conditions), and
static guards in tests/test_kc_le_staging_rehearsal.py. No kubectl or cluster
write happened, and no credential was read. Running the rehearsal is an
operator-attended step. Its public receipt is the entry condition for the
production reissue under T04.

2026-10-23: rehearsal run, attended by the founder, and green. Certificate
Ready and Order valid on the first order. The issuer is `(STAGING) Ersatz Emmer YR2`,
the SAN is exactly kc.coulomb.social, and the chain verifies OK against staging
Root X1. The live fingerprint (D5:DB:2B:55…) and the sso/kc-tls resourceVersion
(66444692) were unchanged, and the namespace was deleted. The receipt is in the runbook. The runbook's
server dry run now creates the namespace first (a server dry run does not persist
it). This satisfies the entry condition for the T04 production reissue.

## Coordination and completion

Beneficiary NK-WP-0049-T35/CUST-WP-0080 remains linked to this obligor record by
derived cross_owner_wait case nk49-t35-rcluster18 in the packet. No new project
driver, live worker injection or message was created. Own T03 wait has an explicit
local prerequisite; T04 is a human gate. Close only after source/native obligations
are proved or an explicit bounded scope disposition hands off remaining live work.