---
id: RBT-WP-0005
type: workplan
title: "Legacy adapter and console migration"
domain: infotech
repo: runbook-tutorials
status: finished
flavor: implementation
owner: claude
topic_slug: stack
created: "2026-09-29"
updated: "2026-09-29"
depends_on: [RBT-WP-0002]
state_hub_workstream_id: "253d0512-46e2-51b2-8e26-12da2c1534ca"
---

## Goal

Carry the NetKingdom security bootstrap console into this ecosystem without
breaking it: first as an unchanged legacy pack, then, only where worthwhile, by
moving its generic parts into the engine.

## Wrap the console as a legacy pack

```task
id: RBT-WP-0005-T01
status: done
priority: high
state_hub_task_id: "0e459512-a5b4-539e-9603-79a2cfa4f27e"
```

`net-kingdom/runbooks/security-bootstrap-console/pack.yaml`
(`engine: legacy-command`) validates and lists it, with no change to
`tools/security-bootstrap-console/`.

## Implement launch and health for legacy packs

```task
id: RBT-WP-0005-T02
status: done
priority: high
state_hub_task_id: "8ff275f5-c70f-5a12-a69e-44f8922a32f0"
```

`rtut launch <pack>` runs `legacy.command` from the owning repo root, waits for
`legacy.url` to answer, and reports it. It stops the process it started. Test
with a stub server.

## Inventory the console

```task
id: RBT-WP-0005-T03
status: done
priority: high
state_hub_task_id: "dbb5553d-fb0c-5298-85c8-cebc9dd63312"
```

Done 2026-09-29 (RBT-WP-0009-T05): `docs/console-mapping.md`. Classify the 5,300-line `security_bootstrap_console.py` into generic engine
concerns (record and state model, gates, stage derivation, copyable blocks,
approval phrase, localhost server) and NetKingdom-specific content (custody,
OpenBao ceremony, KeyCape, privacyIDEA checks). Output: a migration map with
the tests that pin current behaviour.

## Extract the generic engine parts

```task
id: RBT-WP-0005-T04
status: cancel
priority: medium
state_hub_task_id: "14261c00-65d0-55be-8ab2-bd81e579e20d"
```

Cancelled 2026-09-29: extracting the console's engine now would freeze its workarounds into the engine, because v0.2 lacks conditional applicability, gate
recheck and outputs that feed later members (`docs/console-mapping.md` G1, G3, G7). It may return as part of a v0.3 design. Original scope: move the generic parts into `rtut` behind the run record. The console in
`net-kingdom` then imports them. Gate: the existing
`tools/security-bootstrap-console/tests` pass unchanged before and after, and
`make security-bootstrap-ui` behaves the same.

## Decide the console's final form

```task
id: RBT-WP-0005-T05
status: done
priority: low
state_hub_task_id: "c54cfa35-1a34-5d5a-b85b-86ae8771dcfb"
```

Decided 2026-09-29 (Bernd, with RBT-WP-0009): the console stays a permanent legacy pack, launched unchanged. Its seven runbooks can become native v0.2
packs as separate content work (they need none of G1 to G7). Original question: keep the console as a permanent legacy pack, migrate its runbooks
to native packs, or a mix.

## Acceptance Criteria

- The console works unchanged throughout.
- No secret handling is moved into the engine.