# Original KeyCape isolated consumer continuity plan

Owner: secrets-engine. Source outcome: SECRETS-WP-0015-T03, 2026-10-17.
This is a reviewed source plan, not native assent, a custody grant or an
executed recovery. T04 remains a human wait on the complete NK49T33 attempt.

The [frozen owner packet](../../the-custodian/docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/OWNER-PLAN.md)
contains the exact custody/command/negative/equality/timeout/abort plan and source
references. Its owner-plan SHA-256 is
`sha256:d358aaeedc18c42c591d3301ec34f493e63bf579bf5a17b6ccc7e32ec88ea8ed`.
The packet remains immutable; this source note does not revise its authority.

## Exact original selector and source

Use the existing [public selector](keycape-recovery-selector.json): issuer
`https://kc.coulomb.social`, client/audience `secrets-engine-openbao`, env name
`KEYCAPE_SECRETS_ENGINE_OPENBAO_CLIENT_SECRET`, subject
`service:secrets-engine`, tenant `tenant:platform`, exactly role
`secrets-engine`, scope `openbao:login`, denied scope `openbao:admin`.
The current consumer `service_auth.py` source SHA-256 is
`sha256:c0ade429edf452ad17f05d690b7ebef091db7f1a42b5ac350f1e40955c8586c0`.
Its existing AST-only selector preflight passes at that exact hash. Historical
issuer/consumer successes predate the archive and retain their historical scope.

The packet's [one-shot observer candidate](../../the-custodian/docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/consumer_contract_observer.py)
is `sha256:23467730be61625d53b34c09e62f737a35e3def10d22a3a64664835961d3f4bd`.
Its frozen four-file consumer-source manifest is
`sha256:5b0409d7141514295e7d0f636ff6fa5dbe9d1f0d4d23b2f9ebce84a174d69499`.
The observer remains a source candidate: it was tested with synthetic unsigned
tokens only and is not installed, invoked on real material, or wired into either
NK49 recovery or ordinary consumer authentication. Five synthetic tests pass;
seven parser-negative variants and source/input refusal checks are within those
tests, not extra native successes.

## Claims and custody boundaries

1. **Original issuer:** the existing frozen NK49 native checker binds the
   original archived registration/env, original TLS/trust/JWKS, wrong-secret and
   excess-scope refusal, and exact original config/registry/policy/receipt
   equality. Its receipt keeps downstream consumer reconnect false.
2. **Consumer claim compatibility:** after a newly reviewed NK49 source/admission
   closure, the existing issuer `service-token` command may mint a short-lived
   original-identity token in the issuer's private tmpfs. A reviewed same-session
   wrapper would hand only that bounded token object over private stdin to the
   exact Secrets claim observer, then prove transient-token/resource cleanup.
   The original client secret stays in the restored issuer environment. Native
   issuer/JWKS verification precedes consumer parsing; the observer verifies no
   signature or native provenance. This proposed callback is not implemented.
3. **Full original OpenBao consumer continuity:** requires Platform/rapp-openbao's
   independently recovered original backend/custody, original KV registration,
   narrow OIDC source role and actual operator authentication/MFA dependencies,
   plus exact isolated routing/trust. NK49's identity archive does not supply
   OpenBao Raft recovery. A fresh backend, production login or injected secret
   cannot substitute for this return. Then use the unchanged ordinary attended
   OpenBao in-memory secret source, KeyCape exchange, actual OpenBao JWT login
   and definite operator/engine session revocation.

The current no-file/no-fallback direction remains. Do not inject the recovered
issuer secret into ordinary `login_service_jwt`, create a persistent consumer
copy, use ambient/bootstrap credentials, or redirect production. An exceptional
source would need a separate explicit owner/founder custody decision; none is
proposed or implemented here. Service identity/login-only policy is not protected
backend execution authority. SECRETS-WP-0008-T06/0013 retain those scopes;
finished SECRETS-WP-0012 remains finished.

## Actual acceptance and next owner action

The next action is to assemble NK49T33's exact owner-held original TLS/archive/
private-admission packet and surviving offline founder authorization before any
key prompt. Matching hashes, possession of an archive key, this workplan and
historical CCRs are not that authorization. Bind exact source/image/executor,
original issuer/case/target, deadline and permitted isolated effects in the
existing supervised recovery process. No new auth or approval service is needed.

Keep original ciphertext/transfer/source/binary/trust and manifest-binding-mode
interfaces. Private manifests and equality hashes stay inside custody. Freeze any
new observer callback/dependency closure, native command count and phase-specific
negative parsing; its source/synthetic lifecycle review must precede real input.
Use the existing bounded NK49 execution, exact pidfd/session quiescence and
registered tmpfs/container cleanup. Abort on unknown provenance, changed original
bytes, ambiguous daemon action or incomplete cleanup; preserve failed receipts
and uncertainty rather than retrying or reinitializing state.

Require an actual positive original-issuer token and exact consumer claims,
including no extra roles. Native wrong-expected-audience/required-role refusals
are verifier checks, not OpenBao authorization. The observer's seven deliberately
modified payloads prove parser refusal only; unsigned mutations prove no signed
claim denial. Full backend acceptance separately requires real resource-server
wrong-audience/scope/role refusal, restored policy/role/KV equality and session
revocation through the existing owner path. Missing original signed negative
cases stay missing; do not create grants or claim signature failure isolates a
particular claim. A fresh attempt token is not a preserved pre-outage token.

T04 remains wait/needs_human, depends on T03 and NK-WP-0049-T33, and retains
actual native acceptance. T18 owns actual selected-consumer recovery; T19 owns
retained-factor MFA. Return separate closed issuer/consumer-contract/backend
receipts tied to one attempt. Export source/public signing/TLS hashes, allowed
identifiers, booleans and cleanup facts only; never secret/token/private manifest
or raw provider output. A human wait is not an automatic worker wakeup.