railiance-cluster/workplans/RCLUSTER-WP-0018-keycape-original-tls-recovery.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	flavor	depends_on	related	state_hub_workstream_id
RCLUSTER-WP-0018	workplan	Establish original KeyCape TLS recovery and future archive boundary	financials	railiance-cluster	active	codex	railiance	2026-10-17	2026-10-23	implementation		CUST-WP-0080 NK-WP-0049 RCLUSTER-WP-0007 RCLUSTER-WP-0017	e0a7813d-c916-5e49-84b2-5e5b30441891

Required owner source work for NK-WP-0049-T35 and CUST-WP-0080 G08. Reviewed against current INTENT/SCOPE, backup sources and existing work records; ready means work can proceed, not privileged execute authority. This does not promote HA/backlog work, reopen archived local backup delivery or duplicate signer0017. Source-owner scope is certificate plumbing/backup posture; NetKingdom owns namespace ingress, while exact original independent TLS custody remains to be established. No secret read, reissue, live change or native assent occurred.

Record source boundary and public-only metadata preparation

id: RCLUSTER-WP-0018-T01
status: done
priority: high
assignee: codex
state_hub_task_id: "7280193d-0d59-5b78-a2d3-96ebd127127f"

Completed 2026-10-17 as isolated source preparation. Independently reviewed the 17 public source references against current owner bytes, checked current owner instructions/environment/supervision and existing plans, and recorded the exact boundary in docs/keycape-tls-recovery-boundary.md. Prepared bounded public-only certificate/trust metadata projection with generated-certificate tests; no actual certificate/key read. Source integration/publication and task projection remain separate receipts, not claimed by this completed preparation task.

Evidence: the-custodian docs/changes/netkingdom-target-2026-10-16/ recovery-owner-handoffs-r1/ and prior recovery-attempt-r1/t35-t36-source-next/.

Publication return, 2026-10-17: normal owner source publication at c562d7134c was applied on primary/railiance01 with expected and derived commits equal. Read-only source/remote/Hub proof verified this workplan's five exact task ID/UUID/status bindings and three internal dependency edges. Receipts are retained in the Custodian packet docs/changes/netkingdom-target-2026-10-17/railiance-cluster-projection.json and cluster-publication-readback.json. The later legitimate C23 lifecycle repair at 26671d3360 changed ready to active; active is retained. This return records publication separately from the completed source preparation above. Original TLS artifact/provider custody, extraction and native admission remain T02–T05 obligations; publication proves no TLS recovery, private-key custody or native acceptance.

The whole maintenance pipeline's historical-row guard failed for three parent rows while 15 task full-row hashes remained unchanged. STATE-WP-0095-T07 and RMGR-WP-0019-T06 remain wait; neither publication nor this memo asserts full historical-row preservation or restoration. The subsequent forward correction restores the brief's committed content to its pre-accident version while restoring the original staged/worktree change for its owner; history is not rewound. No legacy deep consistency fix is run by the correction.

Establish exact independent original TLS artifact and provider custody metadata

id: RCLUSTER-WP-0018-T02
status: todo
priority: high
assignee: codex
state_hub_task_id: "90836435-917f-504c-a711-3f29ece348e3"

Next: identify the actual original sso/kc-tls custody owner and independent public provenance through existing owner processes. Record artifact/provider, timestamp, public certificate/trust hashes, private custody entry point and outage dependencies without values. Source review cannot infer a fresh backup, original key coverage or independent decryption custody from a local backup script. Use credential routing before any later credential need; missing route is not proof of absence. Done when exact independent recovery or an explicitly owned unavailable capability is evidenced as metadata and a reviewed next action, with no guessed assent.

Prepare safe isolated original extraction or explicit reissue alternative

id: RCLUSTER-WP-0018-T03
status: wait
priority: high
assignee: codex
depends_on: [RCLUSTER-WP-0018-T02]
blocking_reason: "Exact original artifact/provider/custody disposition is required before selecting extraction or reissue source."
state_hub_task_id: "5dfa9a3a-2639-5cf6-b0a4-13eef417d47a"

From T02, reuse the actual owner path to prepare an exact attended private-only recovery command and full dependency/cleanup proof. Do not run whole-state restore or expose raw state/Secret output. If existing backup staging is required, correct only the needed path with bounded memory-only staging and early exact cleanup, including error/parent-loss tests before use. Original recovery and accepted reissue are distinct claims; no self-signed trust substitute, new broker or implicit production action. Done when the exact source proposal, public metadata preflight, negatives, timeout, abort and custody obligations are reviewed.

Checkpoint 2026-10-23: founder decision 9f9d0d88 (A, 2026-10-21) selected the reissue alternative for recovery TLS: letsencrypt-prod ACME HTTP-01 through Traefik, chained to ISRG Root X1, no self-signed substitute, staging rehearsal first. The staging rehearsal source is prepared under T06. This task's status is left for owner review against T02.

Verify admitted original TLS recovery through the actual owner boundary

id: RCLUSTER-WP-0018-T04
status: wait
priority: high
assignee: codex
needs_human: true
depends_on: [RCLUSTER-WP-0018-T02, RCLUSTER-WP-0018-T03]
blocking_reason: "Await exact reviewed attended owner custody path and its existing scoped authority; no private input or native attempt requested yet."
state_hub_task_id: "021b07bb-65bc-5743-bac5-4294b4be74f6"

Only the actual admitted owner action can prove recovered certificate/key pairing, original hostname/trust and independent outage operation, or the expressly accepted reissue result. Retain exact source/artifact/target/identity/negative/cleanup receipts. Human custody/authority gates are not worker wakeups. Source and historical local backup proof never fill native assent. Return bounded public proof to NK49T35; no production mutation, credential retrieval or approval is granted by this task.

Disposition original TLS coverage in the future identity archive contract

id: RCLUSTER-WP-0018-T05
status: todo
priority: high
assignee: codex
state_hub_task_id: "5bc67a22-0991-5625-86a6-f749560d8a0e"

Next: deliver the source-owned requirement in docs/keycape-tls-recovery-boundary.md to NetKingdom's existing contract process: original TLS custody or accepted reissue, independent provider/key recovery, public identity hashes, scoped capture/read permissions and verification/retention. Record named owner dependencies as live work before closure. Do not append kc-tls to secret_refs, expand capture credentials or rewrite a historical archive without those owner reviews/authority. Done when the future contract requirement has an exact tracked disposition/handoff; it is not proof of current archive coverage or actual future capture.

Prepare the Let's Encrypt staging rehearsal for the kc.coulomb.social reissue

id: RCLUSTER-WP-0018-T06
status: done
priority: high
assignee: claude
state_hub_task_id: "11708860-d1e4-5d12-80ab-bc3bc06f7f83"

Source preparation for NK-WP-0049-T33 (request 6d5e748b, decision 9f9d0d88 = A). Delivered install/cert-manager/rehearsal/kc-le-staging.yaml (throwaway namespace tls-rehearsal-kc, a namespaced staging Issuer, and a Certificate whose target name differs from the live one, so it cannot write sso/kc-tls), the runbook docs/keycape-tls-le-staging-rehearsal.md (preflight, apply, bounded wait, "(STAGING)" chain verification with openssl and tools/public-tls-metadata.py, a check that the live certificate is unchanged, cleanup, abort conditions), and static guards in tests/test_kc_le_staging_rehearsal.py. No kubectl or cluster write happened, and no credential was read. Running the rehearsal is an operator-attended step. Its public receipt is the entry condition for the production reissue under T04.

2026-10-23: rehearsal run, attended by the founder, and green. Certificate Ready and Order valid on the first order. The issuer is (STAGING) Ersatz Emmer YR2, the SAN is exactly kc.coulomb.social, and the chain verifies OK against staging Root X1. The live fingerprint (D5:DB:2B:55…) and the sso/kc-tls resourceVersion (66444692) were unchanged, and the namespace was deleted. The receipt is in the runbook. The runbook's server dry run now creates the namespace first (a server dry run does not persist it). This satisfies the entry condition for the T04 production reissue.

Coordination and completion

Beneficiary NK-WP-0049-T35/CUST-WP-0080 remains linked to this obligor record by derived cross_owner_wait case nk49-t35-rcluster18 in the packet. No new project driver, live worker injection or message was created. Own T03 wait has an explicit local prerequisite; T04 is a human gate. Close only after source/native obligations are proved or an explicit bounded scope disposition hands off remaining live work.