coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

SECRETS-WP-0015-T04: record isolated original OpenBao restore (RPF-WP-0064); consumer run awaits phase B
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4384@bnt-lap001
Assistant-Session: 80d1f3da-7a91-4519-9737-9ba128b4da64
This commit is contained in:
tegwick 2026-10-24 11:42:57 +02:00
parent bfa1b3b3d5
commit 9d3de49000
1 changed files with 10 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md
View file

@ -136,10 +136,19 @@ assignee: codex
needs_human: true
decision_id: "d1ab097d-cc79-4612-9c17-bb9b364081ac"
depends_on: [SECRETS-WP-0015-T03, SECRETS-WP-0015-T05, NK-WP-0049-T33]
blocking_reason: "Issuer half filled 2026-10-23 (NK49 T40 admission, T18 isolated attempt verified). Still open: consumer claim compatibility (unimplemented NK49 callback) and actual consumer continuity, which waits on an independently recovered original OpenBao/custody graph owned by railiance-platform/rapp-openbao; no isolated OpenBao restore is prepared."
blocking_reason: "Original OpenBao restored in isolation 2026-10-24 (RPF-WP-0064-T07, receipt 4e048dee). Await RPF-WP-0064 phase B (internal-only network with the isolated NK49 KeyCape) and a separately founder-admitted consumer run: KeyCape exchange, OpenBao JWT login, openbao:admin refusal, session revocation."
state_hub_task_id: "aeec6eb0-39e2-5f7c-8f5d-778133edfc73"
```
2026-10-24 (RPF-WP-0064-T08 handoff): the original OpenBao was restored from the 2026-10-14 off-host snapshot in a
networkless disposable target, founder attended, and independently verified (railiance-platform `7084b57`,
receipt `sha256:4e048dee…579d`, kept outside Git). Cluster id `fd28df5d…` matched; this consumer's objects were
present and equal to source: `keycape-services` JWT config, role `secrets-engine-openbao`, policy
`secrets-engine-login-self`, and KV metadata `platform/workloads/keycape/secrets-engine-openbao` (no data read).
This fills the "original OpenBao/custody recovery" dependency at configuration level. Consumer continuity is still
open: a live JWT login needs RPF-WP-0064 phase B (internal network with the isolated NK49 KeyCape) and its own
founder admission.
Before any key prompt, the selector preflight must pass with `--admission` on the
founder-signed attempt document for this exact case (T05).
2026-10-21: decision d1ab097d resolved by the founder as approved in principle.