RCLUSTER-WP-0018-T06: staging rehearsal run green; receipt recorded, dry-run step corrected

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4101@bnt-lap001
Assistant-Session: bc7d2ce5-6f32-45f1-83e5-0dcbb8e610a7

docs/keycape-tls-le-staging-rehearsal.md

@@ -83,7 +83,10 @@ curl -sS -o /dev/null -w '%{http_code}\n' http://kc.coulomb.social/.well-known/a
 LIVE_BEFORE=$(openssl s_client -connect kc.coulomb.social:443 -servername kc.coulomb.social </dev/null 2>/dev/null \
   | openssl x509 -noout -fingerprint -sha256); echo "$LIVE_BEFORE"
 kubectl -n sso get secret kc-tls -o jsonpath='{.metadata.resourceVersion}{"\n"}'   # metadata only, no data
-kubectl apply --dry-run=server -f "$M"                          # expect exactly 3 objects, all in $NS
+# A server dry run does not persist the Namespace, so the namespaced Issuer and
+# Certificate would fail with NotFound. Create the empty namespace first.
+kubectl create namespace "$NS"
+kubectl apply --dry-run=server -f "$M"                          # expect the namespace configured + 2 created, all in $NS
 
 # 1. Apply
 kubectl apply -f "$M"
@@ -123,7 +126,7 @@ Stop and go to step 5 cleanup if any of these is true:
 
 - The static guard test fails, or the server dry-run shows an object outside
   `tls-rehearsal-kc` or a name other than the three expected.
-- `tls-rehearsal-kc` already exists before apply.
+- `tls-rehearsal-kc` already exists before the preflight creates it.
 - DNS for `kc.coulomb.social` does not resolve to the railiance01 ingress
   address, or port 80 does not answer.
 - The live fingerprint or the `sso/kc-tls` resourceVersion changes at any point.
@@ -140,3 +143,25 @@ cleanup done) is the entry condition for the production reissue in NK-WP-0049-T3
 That attempt runs through NetKingdom's `sso/keycape` ingress and
 `ClusterIssuer/letsencrypt-prod` under RCLUSTER-WP-0018-T04's owner-attended gate.
 It is not part of this runbook.
+
+## Rehearsal receipt (2026-10-23, attended by the founder)
+
+Run from railiance-cluster `d905a6f` with the operator `system:admin`
+kubeconfig. Certificate Ready and Order `valid` on the first order (no retry).
+
+| Check | Result |
+| --- | --- |
+| Issuer | `C = US, O = Let's Encrypt, CN = (STAGING) Ersatz Emmer YR2` |
+| Subject / SAN | `CN = kc.coulomb.social` / `DNS:kc.coulomb.social` |
+| Validity | 2026-10-23T05:56:44Z to 2026-12-26T05:56:43Z |
+| `openssl verify` against staging Root X1 | `OK` |
+| `tls_cert_sha256` (chain, public) | `11ad7ad35885d16577f46842d886cf50fa1bd2bd37966612db8b4fa86532d40e` |
+| `leaf_public_spki_sha256` | `sha256:f6504168524fdce4b3453449baac330f05739fec740a1f894bfa5bfc8035ff0d` |
+| `trust_sha256` (staging root) | `3a5e1171e5f5c2d41522d438f225602e4236a68fb29c32399a95921a4ae80e73` |
+| Chain certificates | 3 |
+| Live fingerprint before = after | `D5:DB:2B:55:5E:74:F7:FB:CD:56:DD:A3:28:5D:FF:FF:B8:6A:C1:64:BF:6C:28:88:1B:3E:FE:58:0F:C4:CE:5C` |
+| `sso/kc-tls` resourceVersion before = after | `66444692` |
+| Cleanup | namespace deleted; no ACME solver ingress left |
+
+No private key or account key was retained. Deviation: the server dry run
+needed the namespace created first (runbook corrected above).

workplans/RCLUSTER-WP-0018-keycape-original-tls-recovery.md

@@ -171,6 +171,14 @@ write happened, and no credential was read. Running the rehearsal is an
 operator-attended step. Its public receipt is the entry condition for the
 production reissue under T04.
 
+2026-10-23: rehearsal run, attended by the founder, and green. Certificate
+Ready and Order valid on the first order. The issuer is `(STAGING) Ersatz Emmer YR2`,
+the SAN is exactly kc.coulomb.social, and the chain verifies OK against staging
+Root X1. The live fingerprint (D5:DB:2B:55…) and the sso/kc-tls resourceVersion
+(66444692) were unchanged, and the namespace was deleted. The receipt is in the runbook. The runbook's
+server dry run now creates the namespace first (a server dry run does not persist
+it). This satisfies the entry condition for the T04 production reissue.
+
 ## Coordination and completion
 
 Beneficiary NK-WP-0049-T35/CUST-WP-0080 remains linked to this obligor record by