--- id: SECRETS-WP-0015 type: workplan title: "Prepare original KeyCape service selector and isolated consumer continuity" domain: infotech repo: secrets-engine status: active owner: codex topic_slug: custodian created: "2026-10-17" updated: "2026-10-21" flavor: implementation depends_on: [] related: [CUST-WP-0082, NK-WP-0049, SECRETS-WP-0012, SECRETS-WP-0008, SECRETS-WP-0013, SECRETS-WP-0014, GEXEC-WP-0001] state_hub_workstream_id: "68a0642e-4908-5260-89c9-3adce60e6a4d" --- Needed source-owner work for NK-WP-0049-T36/T18. Reviewed against current Lifecycle INTENT, explicit consumer constants/custody source and dated historical proof. Active records the delivered source plan and remaining native owner wait; it is not native assent. Finished0012 remains finished; functional adoption/backend entitlement stay0008T06/0013. No new grant, secret fetch, provider login, production redirect or external message occurred. 2026-10-21 review against gated-executor (GEXEC-WP-0001, accepted on railiance01 2026-10-20): the T03 plan requires "surviving offline founder authorization" bound to the exact source/issuer/case/deadline, with "no new auth or approval service". The gexec approval pattern (founder `ssh-keygen -Y` signature, runtime-unwritable `allowed_signers`) is that existing mechanism, and it verifies offline during an outage. T05 makes it a checkable precondition of the selector preflight, and T04 now requires it. CUST-WP-0080 finished; its remaining native gates live in CUST-WP-0082. ## Establish exact current intended source selector ```task id: SECRETS-WP-0015-T01 status: done priority: high assignee: codex state_hub_task_id: "a3e0e243-edac-5ade-a3d5-f58dac41633a" ``` Completed 2026-10-17 as source review. Current consumer constants and config guards agree with secrets-engine-openbao client/audience, service:secrets-engine, tenant:platform, role secrets-engine and only openbao:login. Producer env selector and historical denied openbao:admin case are independently referenced, without accepting the producer's native role. Prior native issuance7Oct and consumer probe10Oct predate reviewed archive16Oct; they neither prove exact archived bytes nor current native assent. Recorded docs/keycape-isolated-recovery-selector.md. Evidence: Custodian recovery-owner-handoffs-r1 and prior17-source review. ## Deliver bounded offline public source selector preflight ```task id: SECRETS-WP-0015-T02 status: done priority: high assignee: codex state_hub_task_id: "eab3b758-10ce-5464-b5f7-3a152ee1327a" ``` Completed 2026-10-17 as isolated source preparation. Prepared AST-only source-hash and all-eight-selector-field checker with bounded strict JSON, source drift, duplicate, oversize and symlink negatives. It imports no backend/credential client and never exchanges a token. Tests use public/synthetic metadata only. Canonical integration/publication/projection must be recorded separately; successful output is source correspondence, not native acceptance or a new secret source. ## Prepare outage-compatible original consumer proof without custody bypass ```task id: SECRETS-WP-0015-T03 status: done priority: high assignee: codex state_hub_task_id: "6262a915-7655-50be-b9f7-481f816d7335" ``` Completed 2026-10-17 as source-plan preparation only. The reviewed owner plan is [keycape-isolated-consumer-continuity-plan.md](../docs/keycape-isolated-consumer-continuity-plan.md), bound to the frozen Custodian `consumer-outage-r1` packet. It distinguishes the restored original issuer check, exact Secrets consumer claim compatibility and actual original OpenBao consumer continuity, preserving the no-file/no-fallback client-secret source contract. Offline founder authority, original TLS/private admission, exact source/runtime/receipt interfaces, positive/negative/equality oracles, timeout, abort and cleanup requirements are reviewable. The plan's done criterion is met; no native or private custody dependency is represented as done. The packet includes an unexecuted-on-real-input one-shot claim observer candidate; it is not wired into recovery or ordinary service authentication. Five synthetic tests pass, including seven explicitly noncryptographic claim-parser negatives and source/input refusal checks. The existing exact-source selector preflight passes. These source checks establish neither token signature/native provenance nor client-secret acquisition, OpenBao login, backend entitlement or downstream reconnect. No private archive, original token/key, OpenBao endpoint or native approval was accessed. Source integration/publication/projection are separate coordinator follow-through; the immutable packet retains source hashes and limits. Remaining actual owner dependencies are explicit in the plan and T04: NK49T33 complete original TLS/archive/private admission; an independently recovered original OpenBao and its custody/OIDC/MFA graph for full consumer continuity; exact native action approval and resource-server negative/revocation receipts. Protected backend operation entitlement stays in existing0008T06/0013. ## Require founder-signed exact attempt admission ```task id: SECRETS-WP-0015-T05 status: done priority: high assignee: claude depends_on: [SECRETS-WP-0015-T03] state_hub_task_id: "74fedf9e-3f7d-56b6-a031-64012d9b011a" ``` Completed 2026-10-21 as source. `tools/check-keycape-recovery-selector.py --admission` verifies a `secrets-engine.recovery-attempt-admission.v1` document. It binds the exact selector-file SHA-256, the consumer source hash, the issuer, the case id and a window of at most 24 hours. The founder signs it in namespace `secrets-engine-recovery-attempt` against the shared runtime-unwritable anchor (`src/secrets_engine/founder_admission.py`, `docs/founder-admission.md`; same anchor as SECRETS-WP-0014). A pass reports `founder_admitted_attempt_not_native_acceptance`. Synthetic tests cover every binding mismatch, the expired/early/overlong window, edits after signing, the trust/gexec namespaces, an empty signature, a changed selector and suppressed CLI diagnostics. No private archive, token, endpoint or real founder signature was touched. Single-use consumption and cleanup remain in the bounded NK49 execution. ## Verify the separately admitted actual isolated consumer result ```task id: SECRETS-WP-0015-T04 status: wait priority: high assignee: codex needs_human: true decision_id: "d1ab097d-cc79-4612-9c17-bb9b364081ac" depends_on: [SECRETS-WP-0015-T03, SECRETS-WP-0015-T05, NK-WP-0049-T33] blocking_reason: "Source plan (T03) and signed-admission check (T05) delivered. Await NK-WP-0049-T33 original TLS/archive/private admission, the founder's signed attempt admission for the exact case, and original OpenBao/custody recovery for actual consumer continuity." state_hub_task_id: "aeec6eb0-39e2-5f7c-8f5d-778133edfc73" ``` Before any key prompt, the selector preflight must pass with `--admission` on the founder-signed attempt document for this exact case (T05). 2026-10-21: decision d1ab097d resolved by the founder as approved in principle. The remaining gate is the actual signed attempt approval once NK-WP-0049-T33 is ready. T04 also owns the admission anchor on the attempt host. Install root-owned `/etc/secrets-engine/admission/allowed_signers` there, with the founder approver key, per `docs/founder-admission.md`. If the attempt host is the secrets-engine runtime host, one anchor serves both this task and SECRETS-WP-0014-T04. NK-WP-0049 pinned secrets-engine 0f44fbe and the selector and service_auth.py hashes from that commit, recorded in net-kingdom `docs/evidence/2026-10-21-nk49-t33-readiness/readiness-observation.json`. Those pins were confirmed 2026-10-21. T04 consumes the NK49 T33 packet unchanged. Only a separately admitted owner action can establish actual archived registration, issuer trust, native negative checks and consumer continuity. Source selector and historical provider proof do not fill this gate. No production consumer redirect, new grant, live OpenBao read, backend write or retained-factor MFA is authorized. Return exact bounded evidence to NK49T36/T18; MFA remains NK49T19. Human gate is never a worker wakeup. Cross-owner dependency is attached to derived case secrets15-nk49-readiness in the packet; do not strand the wait or invent a driver. 2026-10-21 upstream path (read-only survey). NK-WP-0049-T33 waits on: - T35 kc-tls owner metadata (railiance-cluster RCLUSTER-WP-0018-T02, todo). - Founder decision 9f9d0d88 on T39 (ACME reissue vs. the original key). - The attempt-host anchor (this task). - NK49 attempt-assembly metadata: deadline, receipt location, verifier. NK49-T40 carries the founder signature after T33. There is no pin drift: 0f44fbe..0aeb5a2 changed only this workplan, and the selector, service_auth.py and check tool hashes are unchanged. Do not edit those files before the attempt, because any edit forces an NK49 re-pin.