From a14fbc0a03f9a653fdf6e7c10c1fd0b711b4ca04 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 23 Oct 2026 09:25:00 +0200 Subject: [PATCH] SECRETS-WP-0015-T04: attempt-host admission anchor installed and self-tested Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 4101@bnt-lap001 Assistant-Session: bc7d2ce5-6f32-45f1-83e5-0dcbb8e610a7 --- .../SECRETS-WP-0015-original-keycape-recovery-selector.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md b/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md index fd98809..2fe43b1 100644 --- a/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md +++ b/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md @@ -136,7 +136,7 @@ assignee: codex needs_human: true decision_id: "d1ab097d-cc79-4612-9c17-bb9b364081ac" depends_on: [SECRETS-WP-0015-T03, SECRETS-WP-0015-T05, NK-WP-0049-T33] -blocking_reason: "Source plan (T03) and signed-admission check (T05) delivered. Await NK-WP-0049-T33 original TLS/archive/private admission, the founder's signed attempt admission for the exact case, and original OpenBao/custody recovery for actual consumer continuity." +blocking_reason: "Anchor installed on the attempt host 2026-10-23 and NK-WP-0049-T33 done. Await the founder's signed attempt admission for the exact case (NK-WP-0049-T40) and original OpenBao/custody recovery for actual consumer continuity." state_hub_task_id: "aeec6eb0-39e2-5f7c-8f5d-778133edfc73" ``` @@ -175,3 +175,9 @@ NK49 should rehearse on LE staging first. T33 no longer needs original kc-tls ke custody. net-kingdom and railiance-cluster were notified; railiance-cluster was asked to re-scope RCLUSTER-WP-0018-T02 to the outage prerequisites. Remaining for T33: the T35 metadata and the NK49 attempt assembly (deadline, receipt location, verifier). + +2026-10-23: the founder installed the anchor on the attempt host, the workstation. `/etc/secrets-engine/admission/allowed_signers` +is root:root 0644 with a single entry: principal `bernd`, namespaces=`secrets-engine-recovery-attempt`, key +`SHA256:NekDABfw8K8IBYznjREg7jPpcK/BzCgO1pH1ebT/FXM`. A self-test signature verified Good. This is not +the runtime host anchor for SECRETS-WP-0014-T04 (different namespace and host). No selector, service_auth.py or +check-tool file was edited, so the NK49 pins stand.