coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

SECRETS-WP-0015-T04: attempt-host admission anchor installed and self-tested
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4101@bnt-lap001
Assistant-Session: bc7d2ce5-6f32-45f1-83e5-0dcbb8e610a7
This commit is contained in:
tegwick 2026-10-23 09:25:00 +02:00
parent f211525f00
commit a14fbc0a03
1 changed files with 7 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md
View file

@ -136,7 +136,7 @@ assignee: codex
needs_human: true
decision_id: "d1ab097d-cc79-4612-9c17-bb9b364081ac"
depends_on: [SECRETS-WP-0015-T03, SECRETS-WP-0015-T05, NK-WP-0049-T33]
blocking_reason: "Source plan (T03) and signed-admission check (T05) delivered. Await NK-WP-0049-T33 original TLS/archive/private admission, the founder's signed attempt admission for the exact case, and original OpenBao/custody recovery for actual consumer continuity."
blocking_reason: "Anchor installed on the attempt host 2026-10-23 and NK-WP-0049-T33 done. Await the founder's signed attempt admission for the exact case (NK-WP-0049-T40) and original OpenBao/custody recovery for actual consumer continuity."
state_hub_task_id: "aeec6eb0-39e2-5f7c-8f5d-778133edfc73"
```
@ -175,3 +175,9 @@ NK49 should rehearse on LE staging first. T33 no longer needs original kc-tls ke
custody. net-kingdom and railiance-cluster were notified; railiance-cluster was asked
to re-scope RCLUSTER-WP-0018-T02 to the outage prerequisites. Remaining for T33:
the T35 metadata and the NK49 attempt assembly (deadline, receipt location, verifier).
2026-10-23: the founder installed the anchor on the attempt host, the workstation. `/etc/secrets-engine/admission/allowed_signers`
is root:root 0644 with a single entry: principal `bernd`, namespaces=`secrets-engine-recovery-attempt`, key
`SHA256:NekDABfw8K8IBYznjREg7jPpcK/BzCgO1pH1ebT/FXM`. A self-test signature verified Good. This is not
the runtime host anchor for SECRETS-WP-0014-T04 (different namespace and host). No selector, service_auth.py or
check-tool file was edited, so the NK49 pins stand.