railiance-platform/docs/credential-lane-designs/coulomb-recovery-api.md

Coulomb recovery API custody

Owner: railiance-platform / platform-root. Admission decisions 27bbc1ac-e275-42be-ba34-6cf16eae4e78 and 6139e02b-3fb7-4eff-be8a-efe127c45ce5. Non-secret coordinates: coulomb-recovery-api.json. Native evidence: ../evidence/2026-10-29-coulomb-recovery-api-bootstrap.json.

Routine access uses separate reader/custodian API pairs under an owner-private directory outside Git, normally ~/.config/railiance-platform/coulomb-social-recovery/. The worker holds only its original publisher pair and the dedicated public age recipient. Never deliver the custodian pair, reader pair or private age identity to that worker. No sibling credentials or private keys are reused.

Check independent retrieval without writing a private identity:

python3 scripts/application_recovery_access.py --execute --material age

For an isolated attended restore, add --output with a fresh absolute filename under an existing owner-private directory outside Git. The helper validates exact project/name/protection/revision/nonexpiry and public recipient before writing mode0600. Materials reader-pair and custodian-pair use the same front door; omit --output to verify retrieval without creating another secret copy. No value goes to stdout, Git, State Hub, shell arguments or environment.

The reader performs only prefix/version reads and listing in the isolated project. The custodian can also publish new kit versions and read the dedicated escrow; neither can delete retained versions or administer buckets/IAM. Scaleway's current 2023-04-17 bucket policies intersect IAM with an explicit allowlist. Deletion is absent while publisher multipart abort is included; native checks prove both. Negative PUT probes use separate transports because a denied upload can leave the provider connection unusable for its next request.

Both buckets are private and versioned; no automatic expiry has been enabled. The protected bucket never participates in rolling expiry. First coherent app capture, independent exact-version decryption and isolated application recovery are now verified below. Rolling retention, capacity, copy disposition, monitoring and timers remain WP-0053/CSOC-WP-0012 acceptance work. The earlier synthetic fixtures remain boundary evidence, distinct from this real application backup.

The routine pairs and age identity each have a separate protected, enabled, nonexpiring provider secret version. They survive node/workstation loss. If all local routine credentials are lost, platform-root uses its existing independent account/MFA recovery to retrieve only the custodian escrow coordinate in the public contract, then returns to the API front door. Emergency owner recovery is separate from routine drill access; preserve the platform-root recovery mechanism.

Routine API keys expire on 2027-10-28; exact timestamps are in the JSON contract. Platform-root owns renewal and independently read-back escrow before those deadlines, using a bounded attended construction window. No standing organization administration key or publisher IAM administration is admitted. The construction key was revoked, its temporary pair removed and the personal browser context closed without saving state. Routine drills do not rerun identity bootstrap.

The first provider-only kit recovery is now verified in30.232s monotonic. The public JSON contract records the complete protected kit, exact primary recovery point and separately protected recovery-proof coordinates. Native receipt: ../evidence/2026-10-29-coulomb-provider-kit-recovery.json. All2098kit members, 13tables/112rows/sequences,82files and39rendered pages/access denials pass. Images/tools/data came from the kit; the age identity came from separate escrow. Held API callers and the existing Docker daemon were used. Account-recovery latency, a fresh daemon and real-browser identity journeys are excluded.

application_recovery_drill.py previews without effects and executes only with --execute, --kit-reference and a fresh --destination under an owner-private directory outside Git. It never restores production. Retention/copy disposition, monitoring and scheduled activation remain open; this receipt closes only the consumer's first-paired-recovery task.

2026-10-31 corrected-date protected recovery refresh: the 07:13:52Z point is now independently retained in kit4166eb8b/version1793432303941465 (276,019,200bytes) and recovered using only the provider kit plus separate age escrow. All2098members, 13tables/114rows/sequences,86files and40owner renders/40outsider denials pass in 46.692s. The matching captured image is51281946; this point predates the revision19 image update but includes the verified source-date correction. Current image522bcd7f has separate same-store export/view proof. The successful recovery proof is itself protected and independently read back at version1793432409572654. The fresh drill's temporary identity file was removed; pre-existing custody and historical copies remain untouched. No production restore, new grants, expiry or timer activation. Public API coordinates now identify this verified point; the former pointer still named October29 and was stale. Historical kits/proofs remain retained. Receipt: docs/evidence/2026-10-31-coulomb-provider-kit-post-date-recovery.json. Existing retention/capacity/monitoring/copy-disposition obligations remain open.