feat(recovery): prepare owner-bound offline continuity preflight

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa

workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md

@@ -0,0 +1,100 @@
+---
+id: SECRETS-WP-0015
+type: workplan
+title: "Prepare original KeyCape service selector and isolated consumer continuity"
+domain: infotech
+repo: secrets-engine
+status: ready
+owner: codex
+topic_slug: custodian
+created: "2026-10-17"
+updated: "2026-10-17"
+flavor: implementation
+depends_on: []
+related: [CUST-WP-0080, NK-WP-0049, SECRETS-WP-0012, SECRETS-WP-0008, SECRETS-WP-0013]
+state_hub_workstream_id: "68a0642e-4908-5260-89c9-3adce60e6a4d"
+---
+
+Needed source-owner work for NK-WP-0049-T36/T18. Reviewed against current
+Lifecycle INTENT, explicit consumer constants/custody source and dated historical
+proof. Ready means work can proceed, not native assent. Finished0012 remains
+finished; functional adoption/backend entitlement stay0008T06/0013. No new grant,
+secret fetch, provider login, production redirect or external message occurred.
+
+## Establish exact current intended source selector
+
+```task
+id: SECRETS-WP-0015-T01
+status: done
+priority: high
+assignee: codex
+state_hub_task_id: "a3e0e243-edac-5ade-a3d5-f58dac41633a"
+```
+
+Completed 2026-10-17 as source review. Current consumer constants and config guards
+agree with secrets-engine-openbao client/audience, service:secrets-engine,
+tenant:platform, role secrets-engine and only openbao:login. Producer env selector
+and historical denied openbao:admin case are independently referenced, without
+accepting the producer's native role. Prior native issuance7Oct and consumer
+probe10Oct predate reviewed archive16Oct; they neither prove exact archived bytes
+nor current native assent. Recorded docs/keycape-isolated-recovery-selector.md.
+Evidence: Custodian recovery-owner-handoffs-r1 and prior17-source review.
+
+## Deliver bounded offline public source selector preflight
+
+```task
+id: SECRETS-WP-0015-T02
+status: done
+priority: high
+assignee: codex
+state_hub_task_id: "eab3b758-10ce-5464-b5f7-3a152ee1327a"
+```
+
+Completed 2026-10-17 as isolated source preparation. Prepared AST-only source-hash
+and all-eight-selector-field checker with bounded strict JSON, source drift,
+duplicate, oversize and symlink negatives. It imports no backend/credential client
+and never exchanges a token. Tests use public/synthetic metadata only. Canonical
+integration/publication/projection must be recorded separately; successful output
+is source correspondence, not native acceptance or a new secret source.
+
+## Prepare outage-compatible original consumer proof without custody bypass
+
+```task
+id: SECRETS-WP-0015-T03
+status: todo
+priority: high
+assignee: codex
+state_hub_task_id: "6262a915-7655-50be-b9f7-481f816d7335"
+```
+
+Next: map the exact original archive-delivered registration and producer-native
+checker result to the intended consumer, then prepare a source-reviewed isolated
+proof/custody plan. Current consumer source requires attended OpenBao memory read
+and refuses files; ordinary OpenBao/KeyCape outage is therefore a real dependency.
+Do not add a fallback, persistent consumer copy or unreviewed injection source.
+Clarify which continuity claim can be proved offline and which requires an exact
+accepted owner custody/provider path. Bind current original selectors, image/
+source/TLS metadata, negative cases, timeout/abort and cleanup; retain protected
+backend operation entitlement in existing0008/0013. Done when that exact plan and
+remaining owner dependencies are reviewable, without retrieving any value.
+
+## Verify the separately admitted actual isolated consumer result
+
+```task
+id: SECRETS-WP-0015-T04
+status: wait
+priority: high
+assignee: codex
+needs_human: true
+depends_on: [SECRETS-WP-0015-T03, NK-WP-0049-T33]
+blocking_reason: "Await exact consumer proof/custody plan plus original TLS/private admission readiness; actual attended owner path/authority remains required."
+state_hub_task_id: "aeec6eb0-39e2-5f7c-8f5d-778133edfc73"
+```
+
+Only a separately admitted owner action can establish actual archived registration,
+issuer trust, native negative checks and consumer continuity. Source selector and
+historical provider proof do not fill this gate. No production consumer redirect,
+new grant, live OpenBao read, backend write or retained-factor MFA is authorized.
+Return exact bounded evidence to NK49T36/T18; MFA remains NK49T19. Human gate is
+never a worker wakeup. Cross-owner dependency is attached to derived case
+secrets15-nk49-readiness in the packet; do not strand the wait or invent a driver.