From 0aeb5a29a9ebf1cc4935938e2a9bca8269d3b774 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 21 Oct 2026 01:26:40 +0200 Subject: [PATCH] chore(workplans): WP15 T04 owns attempt-host admission anchor; confirm NK49 pins Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 809600@bnt-lap001 Assistant-Session: 40ba228f-c8a0-4ec9-bb29-3129951afdc4 --- .../SECRETS-WP-0015-original-keycape-recovery-selector.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md b/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md index f08d281..85fbf72 100644 --- a/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md +++ b/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md @@ -144,6 +144,14 @@ Before any key prompt, the selector preflight must pass with `--admission` on th founder-signed attempt document for this exact case (T05). 2026-10-21: decision d1ab097d resolved by the founder as approved in principle. The remaining gate is the actual signed attempt approval once NK-WP-0049-T33 is ready. +T04 also owns the admission anchor on the attempt host. Install root-owned +`/etc/secrets-engine/admission/allowed_signers` there, with the founder approver +key, per `docs/founder-admission.md`. If the attempt host is the secrets-engine +runtime host, one anchor serves both this task and SECRETS-WP-0014-T04. NK-WP-0049 +pinned secrets-engine 0f44fbe and the selector and service_auth.py hashes from that +commit, recorded in net-kingdom +`docs/evidence/2026-10-21-nk49-t33-readiness/readiness-observation.json`. Those pins +were confirmed 2026-10-21. T04 consumes the NK49 T33 packet unchanged. Only a separately admitted owner action can establish actual archived registration, issuer trust, native negative checks and consumer continuity. Source selector and historical provider proof do not fill this gate. No production consumer redirect,