railiance-platform/docs/credential-lane-designs/coulomb-recovery-api.md

Coulomb recovery API custody

Owner: railiance-platform / platform-root. Admission decisions 27bbc1ac-e275-42be-ba34-6cf16eae4e78 and 6139e02b-3fb7-4eff-be8a-efe127c45ce5. Non-secret coordinates: coulomb-recovery-api.json. Native evidence: ../evidence/2026-10-29-coulomb-recovery-api-bootstrap.json.

Routine access uses separate reader/custodian API pairs under an owner-private directory outside Git, normally ~/.config/railiance-platform/coulomb-social-recovery/. The worker holds only its original publisher pair and the dedicated public age recipient. Never deliver the custodian pair, reader pair or private age identity to that worker. No sibling credentials or private keys are reused.

Check independent retrieval without writing a private identity:

python3 scripts/application_recovery_access.py --execute --material age

For an isolated attended restore, add --output with a fresh absolute filename under an existing owner-private directory outside Git. The helper validates exact project/name/protection/revision/nonexpiry and public recipient before writing mode0600. Materials reader-pair and custodian-pair use the same front door; omit --output to verify retrieval without creating another secret copy. No value goes to stdout, Git, State Hub, shell arguments or environment.

The reader performs only prefix/version reads and listing in the isolated project. The custodian can also publish new kit versions and read the dedicated escrow; neither can delete retained versions or administer buckets/IAM. Scaleway's current 2023-04-17 bucket policies intersect IAM with an explicit allowlist. Deletion is absent while publisher multipart abort is included; native checks prove both. Negative PUT probes use separate transports because a denied upload can leave the provider connection unusable for its next request.

Both buckets are private and versioned; no automatic expiry has been enabled. The protected bucket never participates in rolling expiry. First coherent app capture, independent exact-version decryption and isolated application recovery are now verified below. Rolling retention, capacity, copy disposition, monitoring and timers remain WP-0053/CSOC-WP-0012 acceptance work. The earlier synthetic fixtures remain boundary evidence, distinct from this real application backup.

The routine pairs and age identity each have a separate protected, enabled, nonexpiring provider secret version. They survive node/workstation loss. If all local routine credentials are lost, platform-root uses its existing independent account/MFA recovery to retrieve only the custodian escrow coordinate in the public contract, then returns to the API front door. Emergency owner recovery is separate from routine drill access; preserve the platform-root recovery mechanism.

Routine API keys expire on 2027-10-28; exact timestamps are in the JSON contract. Platform-root owns renewal and independently read-back escrow before those deadlines, using a bounded attended construction window. No standing organization administration key or publisher IAM administration is admitted. The construction key was revoked, its temporary pair removed and the personal browser context closed without saving state. Routine drills do not rerun identity bootstrap.

The first provider-only kit recovery is now verified in30.232s monotonic. The public JSON contract records the complete protected kit, exact primary recovery point and separately protected recovery-proof coordinates. Native receipt: ../evidence/2026-10-29-coulomb-provider-kit-recovery.json. All2098kit members, 13tables/112rows/sequences,82files and39rendered pages/access denials pass. Images/tools/data came from the kit; the age identity came from separate escrow. Held API callers and the existing Docker daemon were used. Account-recovery latency, a fresh daemon and real-browser identity journeys are excluded.

application_recovery_drill.py previews without effects and executes only with --execute, --kit-reference and a fresh --destination under an owner-private directory outside Git. It never restores production. Retention/copy disposition, monitoring and scheduled activation remain open; this receipt closes only the consumer's first-paired-recovery task.