coulomb/railiance-cluster
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RCLUSTER-WP-0018: LE duplicate-cert allowance check for kc.coulomb.social (answers NK-WP-0049-T43)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details

Browse source 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
This commit is contained in:
codex 2026-10-27 21:15:09 +01:00
parent 0f650b45bc
commit 8fad4effee
1 changed files with 21 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

21
docs/keycape-tls-le-prod-nk49-attempt.md
View file

@ -117,3 +117,24 @@ The exported key was used only as NK49 launcher input (NK-WP-0049-T18, verified
receipt `16d72f7c…1651`) and is then destroyed by the founder. This reissue used
one of the 5-per-week duplicate-certificate allowance. It is not original-key
recovery and not a change to live TLS.
## Duplicate-certificate allowance check (2026-10-27, read-only, answers NK-WP-0049-T43)
Limit: 5 certificates per exact identifier set (`kc.coulomb.social`) per rolling 7 days.
| Item | Status |
| --- | --- |
| 2026-10-23T16:23:09Z production issuance (commit `88b360b`, receipt above) | proven: repo receipt, Order `valid`, first order, no retry |
| Staging rehearsal 2026-10-23 | not counted (staging directory) |
| Live `sso/kc-tls` issued 2026-09-25T17:57Z (served cert, YR1) | proven by live TLS; outside the window |
| Other issuances 2026-10-20..27 | not disproven: `kubectl get certificate -A` is Forbidden for `ops-mason-builder`, and crt.sh returned no entries after 2026-07-27 (it lacks even the 09-25 cert, so it lags and is no evidence of absence) |
Count: at least 1 proven; expected exactly 1 (estimate: cert-manager renewal of the
live cert is not due until about 2026-11-24, and the isolated attempt was the only
documented order). Remaining allowance: 4 expected, 0 in the worst case of an
undocumented 4 extra issuances.
Earliest safe date: a single further issuance is within the limit today (2026-10-27)
on the estimate. Guaranteed-safe regardless of unknown issuances: 2026-10-30T16:23:09Z
(the proven issuance leaves the window). Not authorization to issue. Verification by
the admin kubeconfig: `kubectl get certificate,certificaterequest,order -A | grep kc`.