secrets-engine/docs/keycape-isolated-consumer-continuity-plan.md

Original KeyCape isolated consumer continuity plan

Owner: secrets-engine. Source outcome: SECRETS-WP-0015-T03, 2026-10-17. This is a reviewed source plan, not native assent, a custody grant or an executed recovery. T04 remains a human wait on the complete NK49T33 attempt.

The frozen owner packet contains the exact custody/command/negative/equality/timeout/abort plan and source references. Its owner-plan SHA-256 is sha256:d358aaeedc18c42c591d3301ec34f493e63bf579bf5a17b6ccc7e32ec88ea8ed. The packet remains immutable; this source note does not revise its authority.

Exact original selector and source

Use the existing public selector: issuer https://kc.coulomb.social, client/audience secrets-engine-openbao, env name KEYCAPE_SECRETS_ENGINE_OPENBAO_CLIENT_SECRET, subject service:secrets-engine, tenant tenant:platform, exactly role secrets-engine, scope openbao:login, denied scope openbao:admin. The current consumer service_auth.py source SHA-256 is sha256:c0ade429edf452ad17f05d690b7ebef091db7f1a42b5ac350f1e40955c8586c0. Its existing AST-only selector preflight passes at that exact hash. Historical issuer/consumer successes predate the archive and retain their historical scope.

The packet's one-shot observer candidate is sha256:23467730be61625d53b34c09e62f737a35e3def10d22a3a64664835961d3f4bd. Its frozen four-file consumer-source manifest is sha256:5b0409d7141514295e7d0f636ff6fa5dbe9d1f0d4d23b2f9ebce84a174d69499. The observer remains a source candidate: it was tested with synthetic unsigned tokens only and is not installed, invoked on real material, or wired into either NK49 recovery or ordinary consumer authentication. Five synthetic tests pass; seven parser-negative variants and source/input refusal checks are within those tests, not extra native successes.

Claims and custody boundaries

1. Original issuer: the existing frozen NK49 native checker binds the original archived registration/env, original TLS/trust/JWKS, wrong-secret and excess-scope refusal, and exact original config/registry/policy/receipt equality. Its receipt keeps downstream consumer reconnect false.
2. Consumer claim compatibility: after a newly reviewed NK49 source/admission closure, the existing issuer service-token command may mint a short-lived original-identity token in the issuer's private tmpfs. A reviewed same-session wrapper would hand only that bounded token object over private stdin to the exact Secrets claim observer, then prove transient-token/resource cleanup. The original client secret stays in the restored issuer environment. Native issuer/JWKS verification precedes consumer parsing; the observer verifies no signature or native provenance. This proposed callback is not implemented.
3. Full original OpenBao consumer continuity: requires Platform/rapp-openbao's independently recovered original backend/custody, original KV registration, narrow OIDC source role and actual operator authentication/MFA dependencies, plus exact isolated routing/trust. NK49's identity archive does not supply OpenBao Raft recovery. A fresh backend, production login or injected secret cannot substitute for this return. Then use the unchanged ordinary attended OpenBao in-memory secret source, KeyCape exchange, actual OpenBao JWT login and definite operator/engine session revocation.

The current no-file/no-fallback direction remains. Do not inject the recovered issuer secret into ordinary login_service_jwt, create a persistent consumer copy, use ambient/bootstrap credentials, or redirect production. An exceptional source would need a separate explicit owner/founder custody decision; none is proposed or implemented here. Service identity/login-only policy is not protected backend execution authority. SECRETS-WP-0008-T06/0013 retain those scopes; finished SECRETS-WP-0012 remains finished.

Actual acceptance and next owner action

The next action is to assemble NK49T33's exact owner-held original TLS/archive/ private-admission packet and surviving offline founder authorization before any key prompt. Matching hashes, possession of an archive key, this workplan and historical CCRs are not that authorization. Bind exact source/image/executor, original issuer/case/target, deadline and permitted isolated effects in the existing supervised recovery process. No new auth or approval service is needed.

Keep original ciphertext/transfer/source/binary/trust and manifest-binding-mode interfaces. Private manifests and equality hashes stay inside custody. Freeze any new observer callback/dependency closure, native command count and phase-specific negative parsing; its source/synthetic lifecycle review must precede real input. Use the existing bounded NK49 execution, exact pidfd/session quiescence and registered tmpfs/container cleanup. Abort on unknown provenance, changed original bytes, ambiguous daemon action or incomplete cleanup; preserve failed receipts and uncertainty rather than retrying or reinitializing state.

Require an actual positive original-issuer token and exact consumer claims, including no extra roles. Native wrong-expected-audience/required-role refusals are verifier checks, not OpenBao authorization. The observer's seven deliberately modified payloads prove parser refusal only; unsigned mutations prove no signed claim denial. Full backend acceptance separately requires real resource-server wrong-audience/scope/role refusal, restored policy/role/KV equality and session revocation through the existing owner path. Missing original signed negative cases stay missing; do not create grants or claim signature failure isolates a particular claim. A fresh attempt token is not a preserved pre-outage token.

T04 remains wait/needs_human, depends on T03 and NK-WP-0049-T33, and retains actual native acceptance. T18 owns actual selected-consumer recovery; T19 owns retained-factor MFA. Return separate closed issuer/consumer-contract/backend receipts tied to one attempt. Export source/public signing/TLS hashes, allowed identifiers, booleans and cleanup facts only; never secret/token/private manifest or raw provider output. A human wait is not an automatic worker wakeup.