diff --git a/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/backup/workplans/archived/260624-WARDEN-WP-0011-routing-guide-cli.md b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/backup/workplans/archived/260624-WARDEN-WP-0011-routing-guide-cli.md new file mode 100644 index 00000000..3fe363e9 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/backup/workplans/archived/260624-WARDEN-WP-0011-routing-guide-cli.md @@ -0,0 +1,163 @@ +--- +id: WARDEN-WP-0011 +type: workplan +title: "Routing Lookup CLI" +domain: infotech +repo: ops-warden +status: archived +owner: codex +topic_slug: custodian +planning_priority: high +planning_order: 11 +created: "2026-06-18" +updated: "2026-06-24" +state_hub_workstream_id: "0a520f8e-01b4-48f1-9af3-2f3f69fd0672" +--- + +> **Terminology note:** Historical text in this archived workplan may use the legacy term "workstream". The fleet term is **workplan** (`canon/standards/workplan-terminology-fleet_v0.1.md`). + +# WARDEN-WP-0011 — Routing Lookup CLI + +**Scope:** A `warden route` command group that reads the pointer catalog and tells +a worker which subsystem owns a need, what the prerequisites are, and which +wiki/canon doc to follow **on that system**. ops-warden does not call OpenBao, +flex-auth, or key-cape on the worker's behalf. + +**Out of scope:** HTTP API; live probes against any subsystem; secret generation or +retrieval; a separate health/precondition command (see "Dropped" below); replacing +subsystem CLIs. + +**Depends on:** WARDEN-WP-0010 T3 (catalog schema + seed). + +**Unlocks:** Agents run `warden route show --json` instead of re-deriving +routing from wiki prose each session. + +--- + +## Target CLI + +```text +warden route list [--json] [--tag ] +warden route show [--json] +warden route find [--json] # keyword match against need_keywords +``` + +`list`/`find` show only `status: active` entries by default (`--all` includes draft). + +### Behaviour + +| Command | Does | Does not | +| --- | --- | --- | +| `list` / `show` | Return owner, wiki/canon pointers, `warden_executes`, anti-patterns | Return secret material | +| `find` | Rank scenarios by keyword overlap | Invoke any external API | + +When `warden_executes: true` (SSH), `show` appends the catalog's authored `steps` +and the `warden sign` / `cert_command` pattern, plus a local precondition hint +("actor in inventory? backend configured? run `warden status`"). For all other +scenarios `show` ends with **"next action on `` — see ``"** +and never implies warden performed anything. + +### Dropped: separate `check` command + +The earlier draft had `warden coach check`. Cut. For SSH, `warden status` already +covers local preconditions; duplicating it invites scope creep toward probing +foreign subsystems. SSH precondition hints live inside `show` instead. + +--- + +## Tasks + +### T1 — Catalog loader and models + +```task +id: WARDEN-WP-0011-T01 +status: done +priority: high +state_hub_task_id: "55b8422c-ad3c-4084-9e00-acaa4c360906" +``` + +- [x] Add `src/warden/routing/` package: `models.py`, `catalog.py`. +- [x] Load and validate `registry/routing/catalog.yaml`. +- [x] Enforce the no-double-source rule: non-SSH entries with a `steps` block are a + validation error. Clear errors for missing file, schema violations, dup `id`. + +### T2 — `warden route list` and `show` + +```task +id: WARDEN-WP-0011-T02 +status: done +priority: high +state_hub_task_id: "60b679c5-79bd-4186-b5a6-ac576931f06c" +``` + +- [x] Register `route` Typer sub-app on the main CLI. +- [x] `list` — Rich table + `--json` array of summaries; active-only unless `--all`. +- [x] `show` — owner, prerequisites, pointers (`wiki_ref`, `canon_ref`), + `warden_executes`, anti-patterns; SSH entries also append `steps` + cert pattern. +- [x] Exit 1 with a `find` hint when `show` id is unknown. + +### T3 — `warden route find` + +```task +id: WARDEN-WP-0011-T03 +status: done +priority: high +state_hub_task_id: "d307701f-0117-44f0-80fd-ca6f7ae06f42" +``` + +- [x] Tokenize query; match against `need_keywords`, `title`, `id`. +- [x] Rank, show top matches (default 5); `--json` for agents. +- [x] Fixtures: "issue core api key", "ssh tunnel", "openrouter key". + +### T4 — Tests + +```task +id: WARDEN-WP-0011-T04 +status: done +priority: high +state_hub_task_id: "00a76e0f-8ab6-4f9a-ac6a-00eae633342c" +``` + +- [x] `tests/test_routing.py` — catalog load, no-double-source validation rejects a + non-SSH `steps` block, find ranking, show JSON shape, SSH `show` includes cert + pattern. +- [x] No integration test requires a live subsystem. + +### T5 — Doc consistency + drift guard + +```task +id: WARDEN-WP-0011-T05 +status: done +priority: high +state_hub_task_id: "bf848375-eca7-4116-bb1d-fb7df6395c70" +``` + +- [x] CI/test: every `wiki_ref` anchor resolves to an existing in-repo wiki section; + every entry has a `reviewed` date. +- [x] `wiki/AccessRouting.md` — CLI section with agent-oriented examples. +- [x] README — `warden route --help` quick reference. +- [x] Bump SCOPE availability note A3 → A4 on ship. + +--- + +## Acceptance + +- `uv run warden route find "issue core api key"` returns the draft scenario only + with `--all`, and never a generated key. +- `uv run warden route show ssh-cert-host-access --json` includes + `warden_executes: true` and the cert_command pattern. +- A non-SSH catalog entry carrying a `steps` block fails `test_routing.py`. +- `uv run pytest tests/test_routing.py` passes with no live-subsystem dependency. + +--- + +## See also + +- `WARDEN-WP-0010` — charter and catalog schema +- `WARDEN-WP-0012` — expanded per-scenario playbooks +- `history/2026-06-17-intent-scope-assessment.md` — prior `warden guide` proposal (P4) +--- + +## Closeout (2026-06-24) + +Archived during WARDEN-WP-0013 T2. All tasks complete. diff --git a/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/backup/workplans/archived/260624-WARDEN-WP-0013-production-integration-and-stewardship-closeout.md b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/backup/workplans/archived/260624-WARDEN-WP-0013-production-integration-and-stewardship-closeout.md new file mode 100644 index 00000000..9812e11e --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/backup/workplans/archived/260624-WARDEN-WP-0013-production-integration-and-stewardship-closeout.md @@ -0,0 +1,204 @@ +--- +id: WARDEN-WP-0013 +type: workplan +title: "Production Integration & Stewardship Closeout" +domain: infotech +repo: ops-warden +status: archived +owner: codex +topic_slug: custodian +planning_priority: high +planning_order: 13 +depends_on_workplans: + - WARDEN-WP-0008 + - WARDEN-WP-0009 + - WARDEN-WP-0010 + - WARDEN-WP-0011 +related_workplans: + - WARDEN-WP-0012 + - FLEX-WP-0007 +created: "2026-06-24" +updated: "2026-06-24" +state_hub_workstream_id: "4678c41a-c1d0-48cd-9988-4ea0380e8258" +--- + +> **Terminology note:** Historical text in this archived workplan may use the legacy term "workstream". The fleet term is **workplan** (`canon/standards/workplan-terminology-fleet_v0.1.md`). + +# WARDEN-WP-0013 — Production Integration & Stewardship Closeout + +## Purpose + +Close the remaining **ops-warden-owned** gaps after policy gate and routing shipped: +refresh INTENT/SCOPE canon, archive finished workplans, document ops-bridge +`cert_command` migration, operator OpenBao token hygiene, principals drift checks, +and the policy-gate production flip checklist. + +This workplan addresses the deferred **Production SSH Integration Closeout** strand +from `history/2026-06-18-post-wp0008-intent-scope-reassessment.md` §6, updated for +post-WP-0009 state. + +**Gap analysis:** `history/2026-06-24-intent-scope-gap-analysis.md` + +## Scope + +- Post-WP-0009 reassessment and SCOPE alignment +- Archive hygiene for WP-0010 and WP-0011 +- ops-bridge `cert_command` migration documentation (pilot `agt-state-hub-bridge`) +- Operator runbook for scoped OpenBao tokens (no root in `VAULT_TOKEN`) +- Principals drift check between warden inventory and railiance-infra +- Policy gate production enablement checklist (coordinate FLEX-WP-0007) + +## Out of scope + +- flex-auth runtime deployment (flex-auth **FLEX-WP-0007**) +- ops-bridge tunnel config changes in the ops-bridge repo (coordinate only) +- Routing scenario playbook expansion (**WARDEN-WP-0012** — parallel track) +- OpenBao cluster deploy, flex-auth policy authoring, NK-WP-0009 tutorial +- Implementing secret vending or foreign API proxies + +## Ownership boundary + +| Concern | Owner | +| --- | --- | +| cert_command migration playbook | ops-warden (doc); ops-bridge (tunnel config) | +| OpenBao token hygiene runbook | ops-warden (doc); operator (execution) | +| Principals drift | ops-warden (check doc/script); railiance-infra (host deploy) | +| `policy.enabled: true` flip | operator (after FLEX-WP-0007) | + +--- + +## T1 — Post-gap reassessment and SCOPE refresh + +```task +id: WARDEN-WP-0013-T01 +status: done +priority: high +state_hub_task_id: "de46f9a2-bf11-4651-a23c-430c63f396c8" +``` + +- [x] Write `history/2026-06-24-intent-scope-gap-analysis.md` +- [x] Update `SCOPE.md` active workplan table (WP-0013, WP-0012 ready) +- [x] Note maturity vector and partial INTENT criterion (ops-bridge) in SCOPE + +**Acceptance:** Gap analysis on file; SCOPE reflects 2026-06-24 repo state. + +--- + +## T2 — Archive hygiene (WP-0010, WP-0011) + +```task +id: WARDEN-WP-0013-T02 +status: done +priority: medium +state_hub_task_id: "1b35321d-63ad-40da-a1aa-0b66190a0733" +``` + +- [x] Move `WARDEN-WP-0010-access-routing-charter.md` to + `workplans/archived/260624-WARDEN-WP-0010-access-routing-charter.md` +- [x] Move `WARDEN-WP-0011-routing-guide-cli.md` to + `workplans/archived/260624-WARDEN-WP-0011-routing-guide-cli.md` +- [x] Set frontmatter `status: archived` on both; add closeout notes +- [x] Operator runs `make fix-consistency REPO=ops-warden` from `~/state-hub` + +**Acceptance:** Only WP-0012 (ready) and WP-0013 (active when started) remain in +`workplans/` root; hub synced. + +--- + +## T3 — ops-bridge cert_command migration playbook + +```task +id: WARDEN-WP-0013-T03 +status: done +priority: high +state_hub_task_id: "ad8588b2-9ae9-4f94-bd77-8025851a38f5" +``` + +- [x] Write `wiki/playbooks/ops-bridge-tunnel-cert.md` — static-key → `cert_command` + migration checklist for tunnel configs +- [x] Document pilot tunnel `agt-state-hub-bridge`: actor, pubkey path, cert_command + string, inventory prerequisites +- [x] Upgrade catalog entry `ops-bridge-tunnel` `wiki_ref` to the new playbook +- [x] Coordinate with ops-bridge owner for pilot tunnel config change (State Hub message) +- [ ] Record non-secret smoke evidence when pilot completes (`history/` entry — pending ops-bridge) + +**Acceptance:** Playbook exists; catalog points at it; pilot steps documented even +if ops-bridge execution is pending. + +**Unlocks:** INTENT success criterion #3 moves from partial toward met. + +--- + +## T4 — Operator OpenBao token hygiene runbook + +```task +id: WARDEN-WP-0013-T04 +status: done +priority: medium +state_hub_task_id: "5cb35829-32eb-4d59-97a1-f4d92ce8e239" +``` + +- [x] Add `wiki/playbooks/operator-openbao-token-hygiene.md` covering scoped tokens, + `VAULT_TOKEN` session pattern, OIDC route, HTTP 403 recovery +- [x] Cross-link from `wiki/OpsWardenConfig.md` and production example yaml + +**Acceptance:** Operator can follow runbook without asking ops-warden for token values. + +--- + +## T5 — Principals inventory drift check + +```task +id: WARDEN-WP-0013-T05 +status: done +priority: medium +state_hub_task_id: "4025cd32-89f8-42c3-b1e8-eaf78497d91f" +``` + +- [x] `scripts/check_principals_drift.py` compares inventory `hosts` vs + `railiance-infra/ansible/inventory/ssh_principals.yaml` +- [x] Script notes flex-auth registry regeneration via `build_flex_auth_registry.py` +- [x] Tests in `tests/test_principals_drift.py` + +**Acceptance:** Drift check runnable or documented; no secret material in script output. + +--- + +## T6 — Policy gate production enablement checklist + +```task +id: WARDEN-WP-0013-T06 +status: done +priority: medium +state_hub_task_id: "51663f65-79cb-4108-87c8-9721f9476259" +``` + +- [x] Operator checklist in `wiki/PolicyGatedSigning.md` § Production rollout +- [x] Cross-link FLEX-WP-0007 and pickup brief +- [x] Explicit: keep `policy.enabled: false` until flex-auth reachable + +**Acceptance:** Operator checklist is sequential and references cross-repo owners; +no ops-warden code changes required for flex-auth deploy. + +--- + +## Exit criteria + +- Gap analysis and SCOPE current +- WP-0010 and WP-0011 archived +- ops-bridge cert_command playbook + catalog upgrade +- Operator token hygiene runbook +- Principals drift procedure +- Policy gate production flip checklist (coordinate FLEX-WP-0007) + +## Parallel track + +**WARDEN-WP-0012** (routing scenario playbooks) — promoted to `ready`; start when +P1 integration doc bandwidth allows or in parallel if staffed. + +## See also + +- `history/2026-06-24-intent-scope-gap-analysis.md` +- `history/2026-06-18-post-wp0008-intent-scope-reassessment.md` +- `wiki/CertCommandInterface.md` +- `~/flex-auth/workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md` \ No newline at end of file diff --git a/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/backup/workplans/archived/260627-WARDEN-WP-0012-routing-scenario-playbooks.md b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/backup/workplans/archived/260627-WARDEN-WP-0012-routing-scenario-playbooks.md new file mode 100644 index 00000000..acf9cce9 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/backup/workplans/archived/260627-WARDEN-WP-0012-routing-scenario-playbooks.md @@ -0,0 +1,147 @@ +--- +id: WARDEN-WP-0012 +type: workplan +title: "Routing Scenario Playbooks" +domain: infotech +repo: ops-warden +status: finished +owner: codex +topic_slug: custodian +planning_priority: medium +planning_order: 12 +created: "2026-06-18" +updated: "2026-06-24" +state_hub_workstream_id: "a7e712a0-02f8-4f83-944e-6b207e77bc4c" +--- + +> **Terminology note:** Historical text in this archived workplan may use the legacy term "workstream". The fleet term is **workplan** (`canon/standards/workplan-terminology-fleet_v0.1.md`). + +# WARDEN-WP-0012 — Routing Scenario Playbooks + +**Scope:** Grow the routing catalog and wiki playbooks for high-frequency NetKingdom +access scenarios. Each wiki playbook restates **what the worker does on the owning +system** and tracks an upstream canon doc; the catalog only points at it. ops-warden +authors procedure only for the SSH lane. + +**Out of scope:** Implementing custody in ops-warden; creating OpenBao paths in +railiance-platform (coordinate only); authoring flex-auth policy; restating an +owner's procedure inside the catalog. + +**Depends on:** WARDEN-WP-0010 (charter + catalog schema), WARDEN-WP-0011 (routing CLI). + +**Status:** `finished` — playbooks shipped; draft entries await owner path promotion. + +--- + +## Anti-stale rule + +A scenario is added to the catalog as `status: active` **only when its owning repo's +path actually exists** and a `wiki_ref` is written. Until then it stays `status: +draft` and is hidden from default `warden route find`/`list`. We do not seed +agent-visible entries for paths that owners have not shipped — a confident-looking +pointer to a non-existent path is worse than no entry. + +--- + +## Scenario backlog + +| Catalog id | Routing focus | Executing owner | Gate | +| --- | --- | --- | --- | +| `issue-core-ingestion-api-key` | OpenBao KV path, K8s injection, rotation | railiance-platform + issue-core | path exists | +| `activity-core-issue-sink` | `ISSUE_CORE_URL` + consumer key custody | activity-core + issue-core | path exists | +| `inter-hub-bootstrap-ssh` | SSH envelope + on-host wrapper reads OpenBao | ops-warden SSH + railiance-infra | ready (SSH lane) | +| `openrouter-llm-connect` | OpenBao → K8s Secret in activity-core | railiance-platform | path exists | +| `object-storage-sts` | NK-WP-0007 vending path | net-kingdom + flex-auth + OpenBao | canon exists | +| `ops-bridge-tunnel-cert` | cert_command vs static-key migration | ops-bridge | done (WP-0013) | +| `human-oidc-login` | key-cape / Keycloak IAM Profile | key-cape | canon exists | +| `flex-auth-resource-check` | Policy decision before sensitive action | flex-auth | canon exists | +| `host-principal-deploy` | auth_principals sync | railiance-infra | canon exists | + +--- + +## Tasks + +### T1 — issue-core ingestion key playbook + +```task +id: WARDEN-WP-0012-T01 +status: done +priority: high +state_hub_task_id: "830bb512-0288-4dba-9dd4-ccfd28a4921f" +``` + +- [x] Coordinate with railiance-platform to canonicalize the OpenBao path first. + (Documented expected path from `railiance-platform/docs/argocd-gitops.md`; + live KV path not yet shipped — promotion blocked per anti-stale rule.) +- [x] Then write `wiki/playbooks/issue-core-ingestion-api-key.md` (prerequisites, + ESO pattern, rotation, privileged-read policy) and promote the catalog entry + from `draft` to `active` with a `wiki_ref`. (Playbook + `wiki_ref` done; + stays `draft` until path ships.) + +### T2 — Inter-Hub and bootstrap lanes + +```task +id: WARDEN-WP-0012-T02 +status: done +priority: medium +state_hub_task_id: "7726a703-6e00-4e49-9380-ed3fb3268827" +``` + +- [x] Align `wiki/InterHubBootstrapAccessLane.md` with catalog id `inter-hub-bootstrap-ssh` +- [x] Document attended vs unattended bootstrap branches +- [x] Cross-link flex-auth and OpenBao expectations (pointers, not restated steps) +- [x] Promote catalog entry to `active` with `wiki_ref` + +### T3 — ops-bridge tunnel migration + +```task +id: WARDEN-WP-0012-T03 +status: done +priority: medium +state_hub_task_id: "9fb397f0-0abb-48f5-bb62-7e77edae93bb" +``` + +- [x] Playbook: `wiki/playbooks/ops-bridge-tunnel-cert.md` (WARDEN-WP-0013) +- [x] Pilot tunnel `agt-state-hub-bridge` documented; ops-bridge coordination sent + +### T4 — Platform secret scenarios (LLM, STS, DB) + +```task +id: WARDEN-WP-0012-T04 +status: done +priority: low +state_hub_task_id: "edcf4ed7-f18d-4a92-a42d-8cc7ca0ab792" +``` + +- [x] Playbooks for OpenRouter, object-storage STS, DB dynamic creds. +- [x] Each ends with an owner-repo action; no warden secret code; pointers to canon. + +### T5 — Drift review cadence + +```task +id: WARDEN-WP-0012-T05 +status: done +priority: low +state_hub_task_id: "db98d655-8551-487b-9413-41bf97fc06e1" +``` + +- [x] Document a review cadence against net-kingdom canon. +- [x] `warden route list --stale` keyed off the `reviewed:` date field. +- [x] Process note in `wiki/AccessRouting.md`. + +--- + +## Acceptance + +- Every active catalog entry has a `wiki_ref` to an existing section; no active entry + points at a path its owner has not shipped (those stay `draft`). +- `warden route find` resolves common agent queries without wiki grep. +- Playbooks and catalog contain no secret material — only owners, pointers, checklists. + +--- + +## See also + +- `WARDEN-WP-0010`, `WARDEN-WP-0011` +- `wiki/CredentialRouting.md` +- `history/2026-06-18-post-wp0008-intent-scope-reassessment.md` diff --git a/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/backup/workplans/archived/260627-WARDEN-WP-0014-operator-access-assist.md b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/backup/workplans/archived/260627-WARDEN-WP-0014-operator-access-assist.md new file mode 100644 index 00000000..01240484 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/backup/workplans/archived/260627-WARDEN-WP-0014-operator-access-assist.md @@ -0,0 +1,215 @@ +--- +id: WARDEN-WP-0014 +type: workplan +title: "Operator Access Assist — warden access front door" +domain: infotech +repo: ops-warden +status: finished +owner: codex +topic_slug: custodian +planning_priority: high +planning_order: 14 +created: "2026-06-27" +updated: "2026-06-27" +state_hub_workstream_id: "3c30b2ed-6ede-4b95-a438-fde6da6f6633" +--- + +> **Terminology note:** Historical text in this archived workplan may use the legacy term "workstream". The fleet term is **workplan** (`canon/standards/workplan-terminology-fleet_v0.1.md`). + +# WARDEN-WP-0014 — Operator Access Assist (`warden access`) + +**Scope:** Make ops-warden the consistent operator-facing front door for **every** +NetKingdom security/access need — not just the SSH lane. Add a `warden access` +command surface that (a) advises: emits the auth method, path, policy context, and +exact command skeleton for any credential need, and (b) **proxies**: transparently +fetches the value from the owning subsystem *as the caller* and streams it to the +operator's destination, **without ops-warden ever persisting, caching, or logging +the secret, and without ops-warden holding any standing privileged credential.** + +Centralize **knowledge and policy** in ops-warden; leave **custody and execution +detail** in the owning subsystems (OpenBao, key-cape, flex-auth). ops-warden becomes +a transparent, policy-gated, audited conduit — `vault exec` / `op run` shaped — never +a standing secret broker. + +**Charter note:** This extends the WP-0010 routing charter from a *pointer layer* +("who owns it") to an *assist layer* ("here is exactly how to get it, gated and +audited"). It does **not** move custody into ops-warden. See the three non-negotiable +guardrails below — they are the line between a transparent conduit (sanctioned) and a +standing broker/honeypot (forbidden). + +**Out of scope:** +- ops-warden holding a long-lived OpenBao/secret-read token of its own. +- Persisting, caching, or logging any secret **value** anywhere (disk, log, hub, git). +- Creating OpenBao paths or policies (coordinate with railiance-platform / flex-auth). +- Restating an owner's procedure as prose in the catalog (reference canon, don't copy). +- Identity/MFA implementation (key-cape owns it; we orchestrate its CLI only). + +**Depends on:** WP-0010 (charter + catalog schema), WP-0011 (`warden route` CLI), +WP-0007/0009 (flex-auth policy gate — reused as the fetch-path gate). + +**Status:** `proposed` — awaiting Bernd's review before implementation. + +--- + +## Three non-negotiable guardrails (acceptance-blocking) + +These are the design invariants that keep proxy mode safe. Any task that violates one +is rejected regardless of convenience. + +1. **Operator identity, never warden's.** `--fetch`/`--exec` authenticate as the + *caller* (their OIDC/OpenBao token, the agent's own auth). ops-warden carries **no** + standing secret-read credential. If the caller has no valid auth, the command fails + with a routing pointer to the auth step — it does not fall back to a warden token. + +2. **Transit only — no persistence, no logging of values.** The secret flows + subsystem → caller destination (env of a child process, or stdout) via a streamed + `exec`. ops-warden must not buffer it to disk, cache it, echo it to logs, or write + it to the State Hub. Audit records **metadata only** (who, need id, owner path, time, + policy decision id) — never the value. + +3. **Policy gate on the fetch path.** `--fetch`/`--exec` run the flex-auth check + **before** proxying (reusing the WP-0007 gate). When `policy.enabled: false`, fetch + is **advisory-only** by default and requires an explicit `--no-policy` acknowledgement + to proxy ungated — surfaced loudly in output and audit. + +--- + +## Phasing decision (default — adjust in review) + +OpenBao lane **first** (covers the immediate npm/API/DB need), key-cape/login lane in +a later task within the same WP. Rationale: OpenBao KV is the highest-frequency operator +need and the one this conversation surfaced; login flows are a thinner orchestration of +an interactive tool and lower risk to defer. + +--- + +## Tasks + +### T1 — Catalog schema: structured handoff fields + +```task +id: WARDEN-WP-0014-T01 +status: done +priority: high +state_hub_task_id: "abb0e722-6524-4224-8638-6ee1573ed3e0" +``` + +- [x] Extend `registry/routing/catalog.yaml` entry schema with optional structured + handoff fields for non-SSH lanes: `auth_method`, `path_template`, + `fetch_command`, `exec_capable` (bool), `policy_ref`. (`RouteEntry` + + `_parse_entry`; `has_handoff` helper.) +- [x] Fields are **structured pointers/templates**, not prose restatements — each + sits alongside the owner's `canon_ref` for the authoritative procedure (no drift). +- [x] Populate for `openbao-api-key` (covers the coulomb_social npm shape: keyword + `npm_auth_token` added) as the reference example; `draft` entries untouched. +- [x] Validation: `_assert_no_secret_material` rejects known token prefixes and + high-entropy runs in any handoff field; `exec_capable` requires `fetch_command`. + Tests in `tests/test_routing.py` (handoff parse, real-catalog, secret-leak + matrix, placeholder-accepted). + +### T2 — `warden access` advisory surface + +```task +id: WARDEN-WP-0014-T02 +status: done +priority: high +state_hub_task_id: "c1497263-7124-459f-b63a-d0c0c7005c86" +``` + +- [x] `warden access [--domain X] [--json]` — resolves via the same matcher as + `warden route find` and renders the **structured handoff**: owner, auth method, + path template, command skeleton, policy ref + gate status, proxy hint, and the + `<…>` owner-confirmed-name note. (`warden/access.py` pure module + `access` + command in `cli.py`.) +- [x] Advisory is the **default** behavior (no value fetched); SSH lane points at + `warden sign`; routed lanes end with "warden advises, the owner vends". +- [x] `--json` output for agentic operators — stable, secret-free shape + (`handoff` block + `next_action`); `--domain` substitutes `` only. +- [x] Tests: `tests/test_access.py` (expansion, gate status, advisory/SSH/JSON/no-match). + +### T3 — OpenBao proxy lane (`--fetch` / `--exec`) + +```task +id: WARDEN-WP-0014-T03 +status: done +priority: high +state_hub_task_id: "6d3eb0e4-309c-4065-893e-6c4053fb0db2" +``` + +- [x] `warden access --fetch` — policy-gate (G3) → run the owning tool + (`bao kv get ...`) **as the caller** with **inherited stdout** → value streams to + stdout and never enters warden's memory (`proxy_fetch`). No buffering, no log. +- [x] `warden access --exec -- ` — runs the child with the secret injected + into *its* env only (`proxy_exec`); value never lands in the caller's shell env; + `--field` names the env var (e.g. `NPM_AUTH_TOKEN`). +- [x] Guardrails G1–G3 in code (`warden/proxy.py`, `_access_proxy` in `cli.py`): + G1 caller token only (no warden credential; `caller_auth_present`); G2 transit-only + (inherit-stdout fetch; no disk/log write); G3 `check_fetch_policy` before any exec, + `--no-policy` required to proxy ungated. `tests/test_proxy.py` asserts all three, + plus `resolve_fetch_command` refuses unresolved `<…>` placeholders. Live smoke + against a fake `bao` confirmed gate-refusal, stream, exec-inject, and a + secret-free audit log. +- [x] Metadata-only audit per call (`write_audit` → `state_dir/access-audit.log`). + +### T4 — key-cape / login orchestration lane + +```task +id: WARDEN-WP-0014-T04 +status: done +priority: medium +state_hub_task_id: "481997e4-193d-4724-84a6-61cbc2940153" +``` + +- [x] Extend `warden access` to orchestrate the key-cape/Keycloak OIDC login flow + under the same advisory/proxy split. New `lane: secret|login` field on + `RouteEntry`; `key-cape-oidc-login` populated as a `login` lane entry. +- [x] Login lane semantics: no caller-auth precheck (you have no token yet) and no + secret-read gate (it bootstraps the identity the gate needs); runs interactively + as the caller via inherited stdio; `--exec` rejected. Token stays in the caller's + own store — warden never captures it (G2 holds). Audited as `action: login`. +- [x] Tests in `tests/test_proxy.py` (runs without token/ack, rejects --exec, real + catalog lane, invalid-lane rejection). Live fake-`bao login` smoke confirmed. + +### T5 — Docs, security model, and INTENT/SCOPE alignment + +```task +id: WARDEN-WP-0014-T05 +status: done +priority: medium +state_hub_task_id: "a5eb616e-4edf-42db-a4fb-bf296cdb92bc" +``` + +- [x] `wiki/OperatorAccessAssist.md` — the `warden access` contract, the conduit-vs-broker + boundary, and the three guardrails (+ the catalog secret-material guard) as a + security-model statement; lanes documented. +- [x] Updated `wiki/AccessRouting.md` (issue/route/**assist** roles + reconciled the + anti-patterns table so the conduit doesn't contradict it) and the + `.claude/rules/credential-routing.md` agent rule (added `warden access` + the + "standing broker forbidden, transparent `--fetch` sanctioned" anti-pattern). +- [x] SCOPE/INTENT: recorded the pointer→assist charter extension; SCOPE implemented + list + Getting Oriented updated; maturity vector A4 → **A5** on Availability. +- [x] `history/2026-06-27-operator-access-assist-charter.md` — decision record. + +--- + +## Acceptance + +- `warden access ` advises for any catalog need; `--fetch`/`--exec` proxy the + OpenBao lane end to end against a real KV path. +- All three guardrails hold under test: **no** secret value touches disk/log/hub/git; + ops-warden holds **no** standing secret-read credential; the policy gate runs **before** + every fetch. +- Catalog carries structured handoff fields that reference (never restate) owner canon. +- Docs state the conduit-vs-broker boundary explicitly; the agent rule forbids the + broker pattern. +- No secret material anywhere in code, catalog, docs, logs, or tests. + +--- + +## See also + +- `WARDEN-WP-0010` (routing charter), `WARDEN-WP-0011` (`warden route` CLI) +- `WARDEN-WP-0007` / `WARDEN-WP-0009` (flex-auth policy gate — reused as fetch gate) +- `wiki/AccessRouting.md`, `wiki/CredentialRouting.md`, `wiki/PolicyGatedSigning.md` +- `.claude/rules/credential-routing.md` +- `history/2026-06-24-intent-scope-gap-analysis.md` diff --git a/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/backup/workplans/archived/260627-WARDEN-WP-0015-secret-lifecycle-tiering.md b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/backup/workplans/archived/260627-WARDEN-WP-0015-secret-lifecycle-tiering.md new file mode 100644 index 00000000..c5920789 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/backup/workplans/archived/260627-WARDEN-WP-0015-secret-lifecycle-tiering.md @@ -0,0 +1,247 @@ +--- +id: WARDEN-WP-0015 +type: workplan +title: "Workload Security Posture — env posture × maturity + conformance" +domain: infotech +repo: ops-warden +status: finished +owner: codex +topic_slug: custodian +planning_priority: high +planning_order: 15 +created: "2026-06-27" +updated: "2026-06-27" +state_hub_workstream_id: "99f4a0e1-853c-456f-8aa7-8ff0f318ea65" +--- + +> **Terminology note:** Historical text in this archived workplan may use the legacy term "workstream". The fleet term is **workplan** (`canon/standards/workplan-terminology-fleet_v0.1.md`). + +# WARDEN-WP-0015 — Workload Security Posture (two-axis) + conformance + +**Scope:** Establish a NetKingdom standard for IT-security posture across **two +orthogonal axes**, and make ops-warden the **conformance steward** for it: + +- **Axis A — Environment posture** (`dev → test → prod`): how the *secret store* is + secured (mock / OpenBao `-dev` / sealed). Identical contracts, divergent posture. +- **Axis B — Workload maturity** (`M0 → M3`): how *trusted* a workload is to receive + secrets and handle classified data (PoC → alpha/early-access → beta/GA → critical). + +The axes combine in a **secret-flow lattice**: a secret may be delivered to a workload +only if the workload's posture *and* maturity meet the secret's requirements. ops-warden +authors the ops-security slice, ships machine-readable descriptors + a conformance +checker (incl. the lattice check), and the dev-tier **contract-double** fixture library +(the "fake bao" pattern generalized). + +**Decisions locked (2026-06-27):** +- Two-axis model folded into this WP (was "Secret Lifecycle Tiering", env posture only). +- Authoritative **NetKingdom requirements** (M0–M3 table, secret-flow gates, env-posture + ceremonies) live in **net-kingdom canon**; the **generic `WorkloadMaturityLevel` + concept + lattice** is contributed to **info-tech-canon** (DevSecOps/Landscape), + reusing its governed `DataClassification`. ops-warden authors the ops-security slice + + conformance tooling. +- ops-warden role = **author + conformance checks**, **not** runtime enforcement. + +**Reuse, don't reinvent (info-tech-canon already defines the primitives):** +`DataClassification` (`confidential`/`restricted`…) in the Data Model; promotion / +quality gates / policy gates / `DeploymentVerification` + progressive delivery in the +DevSecOps Model; asset/business **criticality** in the Security Model; access semantics +in the CARING Access Governance Standard. This WP **assembles** these into a named +maturity ladder + flow rule; it does not fork them. + +**Hard boundary (responsibility-map, ~line 154):** ops-warden "must not become a +universal secret broker — runtime secrets remain OpenBao; authorization remains +flex-auth." ops-warden = policy author + conformance verifier only. OpenBao holds the +secrets; flex-auth makes allow/deny decisions; CARING governs access semantics. + +**Cross-repo note:** T1/T5 author content destined for **net-kingdom** and +**info-tech-canon**. ops-warden drafts; landing it is coordinated through each repo's +own process (inbox/PR), not a unilateral write from here. + +**Depends on / relates to:** WARDEN-WP-0014 (the `warden access` proxy is the +posture-aware fetch surface; its caller-identity/transit guardrails are prod-compatible). + +**Status:** `finished` — all five tasks done. T1 authored the standard, T2 shipped the +descriptors + `warden policy`, T3 the read-only conformance checker, T4 the dev-double +library, T5 the INTENT/SCOPE alignment. Canon landing in net-kingdom / info-tech-canon +is owner-driven and tracked via the open coordination messages (not closed here). + +--- + +## The model (to be encoded by this WP) + +### Axis A — Environment posture (the secret store) + +**R1 — Contract parity, posture divergence.** Identical interface at every tier; only +the backend's security posture changes. Automation written once runs at all tiers +unchanged (this is why contract doubles work). +**R2 — Promote topology, regenerate material.** Secret *values* are never promoted up +the ladder; only *structure* (paths, policy shape, names). Values are generated fresh +per tier. Test conveniences (reuse, single-unseal) are quarantined in test. +**R3 — Dev touches no real data, ever.** Insecure personal mock store is sanctioned +*iff* dev uses only synthetic data. Absolute. +**R4 — Phase-changes are ceremonies, not copies.** test→prod is a gated checklist +referencing net-kingdom `security-bootstrap-*` / unseal-custody docs. + +| | dev | test | prod | +| --- | --- | --- | --- | +| backend | mock / contract double | OpenBao `-dev` (single-unseal) | OpenBao sealed (Shamir 3-of-5) | +| real values | forbidden (synthetic) | generated, reuse allowed | generated fresh, reuse forbidden | +| unseal | n/a | single key / auto | 3-of-5 + break-glass | +| real user/business data | never | never | allowed | +| audit | optional | on | full, tamper-evident | + +### Axis B — Workload maturity (the trust to receive secrets/data) + +**Production is a posture, not a maturity.** A workload can be prod-posture yet low +maturity (alpha with friendly customers). Maturity gates *which secrets and data +classes* a prod workload may touch. + +| Level | Phase | Max DataClassification | Promotion gate (reuses DevSecOps gates) | +| --- | --- | --- | --- | +| **M0** | Experimental / PoC | synthetic only | — | +| **M1** | Alpha / early-access | low-criticality, loss-acceptable; no confidential/restricted | friendly-customer scope, basic SLO, data-handling note | +| **M2** | Beta / GA | up to `confidential`; SLOs; audited | security review, SLO history, on-call, incident runbooks | +| **M3** | Critical / regulated | `restricted`; break-glass; compliance | pen-test, 3-of-5 custody, human-in-loop, compliance audit | + +### The combined rule (secret-flow lattice) + +``` +deliver(secret → workload) permitted only if + workload.env_posture == prod # Axis A +AND workload.maturity >= secret.required_maturity # Axis B (no-write-down) +AND workload.maturity >= required_maturity(dataclass(secret)) +``` + +"Critical secrets must not be transferred to workloads below maturity M" is exactly +this no-write-down constraint. Checkable by ops-warden; enforceable by flex-auth. + +--- + +## Tasks + +### T1 — Author the two-axis Workload Security Posture standard (canon-bound) + +```task +id: WARDEN-WP-0015-T01 +status: done +priority: high +state_hub_task_id: "85aeb676-a593-4056-986a-db14d4c5209f" +``` + +- [x] Drafted the standard: Axis A (R1–R4 + env-posture matrix + phase-change ceremonies) + and Axis B (M0–M3 ladder + promotion gates) unified by the secret-flow lattice — + `wiki/WorkloadSecurityPosture.md`. +- [x] Layered it: doc marks the generic `WorkloadMaturityLevel` + lattice → **info-tech-canon** + (reusing `DataClassification`) and the NetKingdom M0–M3 requirements + env-posture + ceremonies → **net-kingdom canon**, with a canon-layering table. +- [x] Cross-linked the unseal/bootstrap/responsibility canon + info-tech-canon + Security/DevSecOps/Data/CARING models. Staged in ops-warden; **coordination + opened** to net-kingdom (msg 8d6f8d83) and info-tech-canon (msg ca07b085). +- [x] Encoded ops-warden's role: author + conformance, not enforcement/custody. +- Note: canon **landing** in the two repos is owner-driven; tracked to closure in T5. + +### T2 — Machine-readable posture descriptors (both axes) + +```task +id: WARDEN-WP-0015-T02 +status: done +priority: high +state_hub_task_id: "011fb0af-154d-40f4-a03e-3172c325321a" +``` + +- [x] `registry/policy/security-posture.yaml` — env-posture tiers (backend, value-policy, + unseal, data-class, audit) **and** maturity levels (M0–M3, max DataClassification, + promotion gates), `dataclass_floor` mapping, and the lattice rule. No secret material. +- [x] Loader + validation in `src/warden/posture.py` (mirrors `routing/catalog.py`): + unique/contiguous ranks, dataclass_floor references known levels, lattice env + posture exists. Includes the pure `can_deliver` lattice helper (reused by T3). +- [x] `warden policy list|show` lookup (mirrors `warden route`; `--json`). +- [x] Tests: `tests/test_posture.py` (load, lattice allow/deny matrix, validation + rejections, CLI). 184 pass, lint clean. + +### T3 — Conformance checker (incl. secret-flow lattice) + +```task +id: WARDEN-WP-0015-T03 +status: done +priority: high +state_hub_task_id: "c1a0e987-19d0-478e-ac08-2dbe98e64e09" +``` + +- [x] `scripts/check_secret_posture_conformance.py` — asserts env-posture matches the + standard (`backend`/`unseal`/`real_values` per tier) **and** evaluates the lattice + via `posture.can_deliver`: flags any secret whose `required_maturity` or data-class + floor exceeds a target workload's maturity, or that targets a non-prod workload. + Drift-style report, like `check_principals_drift.py`. Read-only; exit 0/1/2. +- [x] Surfaces conformance + lattice violations; never reads or prints a secret value + (manifest is metadata-only). Example: `examples/posture-conformance.example.yaml`. +- [x] Tests: `tests/test_posture_conformance.py` (env mismatch, unknown env, lattice + deny/allow, missing workload, exit codes). 8 cases, lint clean. + +### T4 — Dev-tier contract-double fixture library + +```task +id: WARDEN-WP-0015-T04 +status: done +priority: medium +state_hub_task_id: "e556fd2e-4e39-4c7d-bd94-b4330e4bef45" +``` + +- [x] Generalized "fake bao" into `src/warden/doubles.py`: `materialize_doubles()` + writes hermetic dev-tier doubles for routed subsystems (`bao`, `key-cape`) + honoring each contract (argv/stdout/exit), emitting **synthetic values only** + (`synthetic-` prefix, asserted in tests). `doubles_path_prepended()` puts them + ahead on PATH for fully offline dev/test of access flows. +- [x] Documented the pattern in the standard (R1) as the sanctioned `dev` backend. +- [x] Tests: `tests/test_doubles.py` (contract honoring, synthetic-only, unknown + contract → exit 2, end-to-end proxy fetch offline against the double). 9 cases. + +### T5 — INTENT/SCOPE alignment + canon contributions + +```task +id: WARDEN-WP-0015-T05 +status: done +priority: medium +state_hub_task_id: "298c9b09-4a5a-41bf-a3bd-6c572385236b" +``` + +- [x] `INTENT.md`: ops-warden stewards **security-policy conformance** of the + infrastructure (authoring the two-axis posture standard + conformance checks + dev + doubles), scoped to author+check — **not** enforcement or custody. +- [x] SCOPE: add the posture policy + conformance surface; note the net-kingdom / + info-tech-canon homes; bump the maturity vector where warranted. +- [x] Canon landing tracked to a documented hand-off. The contributions are **drafted + and offered**: info-tech-canon (generic `WorkloadMaturityLevel` + lattice, msg + `ca07b085`) and net-kingdom (M0–M3 requirements + env-posture ceremonies, msg + `8d6f8d83`). **Landing is owner-driven and out of ops-warden's control** — it is + tracked through each repo's own inbox/PR process, not closed unilaterally here. + ops-warden's authored slice + conformance tooling are complete. +- [x] `history/2026-06-27-workload-security-posture-charter.md` — decision record. + +2026-06-27 progress: shipped the T3 conformance checker and T4 dev-double library +with tests (200 passing, lint clean); updated `INTENT.md` / `SCOPE.md` / +`wiki/WorkloadSecurityPosture.md` for the author+conformance role. Canon landing in +net-kingdom / info-tech-canon remains owner-driven via the open coordination messages. + +--- + +## Acceptance + +- A coherent two-axis standard exists: generic concept in info-tech-canon, NetKingdom + M0–M3 + env-posture requirements in net-kingdom canon, authored by ops-warden. +- ops-warden ships posture descriptors + a read-only conformance checker (incl. the + secret-flow lattice) + dev-tier doubles. +- No secret material in any descriptor, checker, fixture, doc, or log. +- ops-warden's role is documented as author+conformance; OpenBao custody, flex-auth + authorization, and CARING access boundaries are explicitly preserved. +- INTENT/SCOPE reflect the conformance-steward role without overclaiming enforcement. + +--- + +## See also + +- `WARDEN-WP-0014` (operator access assist; the posture-aware fetch surface) +- `net-kingdom/docs/openbao-unseal-custody-models.md`, `responsibility-map.md`, + `platform-root-custody.md`, `security-bootstrap-*` +- `info-tech-canon` Security / DevSecOps / Data Models + CARING Access Governance +- `flex-auth` (runtime enforcement of the lattice, as a follow-up) diff --git a/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/backup/workplans/archived/260707-ADHOC-2026-07-07.md b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/backup/workplans/archived/260707-ADHOC-2026-07-07.md new file mode 100644 index 00000000..31e9d27f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/backup/workplans/archived/260707-ADHOC-2026-07-07.md @@ -0,0 +1,52 @@ +--- +id: WARDEN-WP-ADHOC-2026-07-07 +type: workplan +title: "Ad Hoc Tasks — 2026-07-07" +domain: infotech +repo: ops-warden +status: finished +owner: grok +topic_slug: custodian +created: "2026-07-07" +updated: "2026-07-07" +state_hub_workstream_id: "90568b1e-8395-5c67-9c69-851ed08ff3d3" +--- + +> **Terminology note:** Historical text in this archived workplan may use the legacy term "workstream". The fleet term is **workplan** (`canon/standards/workplan-terminology-fleet_v0.1.md`). + +# Ad Hoc Tasks — 2026-07-07 + +### T01 — Roll out proxy pipe fix (be3b4a2) + +```task +id: WARDEN-WP-ADHOC-2026-07-07-T01 +status: done +priority: high +state_hub_task_id: "bf985c95-bea6-5057-94f9-9cfa7e1c9dd8" +``` + +`warden access` failed on `reuse-surface-hub-write-token` because `shlex.split` +treated `kubectl … | base64 -d` as literal argv. Fixed in `be3b4a2`; rollout +requires refreshing the installed CLI (cached `0.1.0` wheel does not pick up +source changes). + +- [x] Code fix merged and pushed (`be3b4a2`) +- [x] Version bumped `0.1.0` → `0.1.1` so `uv tool install` invalidates stale wheels +- [x] Workstation rollout: `git pull && make install-all` (after cache clean if needed) +- [x] Smoke: `warden access reuse-surface-hub-write-token --no-policy --fetch` — no + `unknown shorthand flag: 'd'`; token fetched via shell pipeline + +**Operator upgrade on any machine using `warden access`:** + +```bash +cd ~/ops-warden && git pull --ff-only +make install-all +warden route show reuse-surface-hub-write-token --json +``` + +If `warden` still lacks `ResolvedFetch` / pipe handling after install: + +```bash +uv cache clean ops-warden +uv tool install . --with-editable ../phase-memory --reinstall --force +``` \ No newline at end of file diff --git a/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/health-before.json b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/health-before.json new file mode 100644 index 00000000..7cfe7ec0 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/health-before.json @@ -0,0 +1,11 @@ +{ + "status": "ok", + "db": "connected", + "instance_role": "primary", + "instance_label": "railiance01", + "schema": { + "status": "ok", + "applied": "c4d5e6f7a8b9", + "expected": "c4d5e6f7a8b9" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/legacy-consistency.json b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/legacy-consistency.json new file mode 100644 index 00000000..72f8d942 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/legacy-consistency.json @@ -0,0 +1,151 @@ +{ + "repo_slug": "ops-warden", + "repo_path": "/home/worsch/ops-warden", + "source_revision": "117fec9241e7b985dfb187b992e173d0a5dc3700", + "source_revision_reason": null, + "issues": [ + { + "severity": "WARN", + "check_id": "C-24", + "message": "Repo classification advisory: capability_tag 'security' is not a recommended family tag (allowed, check for synonym)", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-42", + "message": "Blocked workplan 'warden-wp-0027' has no task in status wait \u2014 nothing states what it waits for; qualify a wait task or re-status the workplan", + "file_path": "workplans/WARDEN-WP-0027-credential-governance-lockdown.md", + "db_id": "21528e8d-a049-523d-9ae1-da7a27cb8bbf", + "file_value": "blocked", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-37", + "message": "Residual workplan 'warden-wp-0034' has no origin/origin_ref provenance (not invented)", + "file_path": "workplans/WARDEN-WP-0034-layer-model-v07-conformance.md", + "db_id": "ae3ff76f-883d-5e2f-b6aa-144d61e8fdef", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-40", + "message": "blocker satisfied, task still wait: 'WARDEN-WP-0037-T03' in workplan 'WARDEN-WP-0037' \u2014 decision 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa is resolved", + "file_path": "workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md#WARDEN-WP-0037-T03", + "db_id": "", + "file_value": "1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Task 'WARDEN-WP-0038-T01' has no state_hub_task_id", + "file_path": "workplans/WARDEN-WP-0038-plan-mutation-intent.md#WARDEN-WP-0038-T01", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-37", + "message": "Residual workplan 'warden-wp-0040' has no origin/origin_ref provenance (not invented)", + "file_path": "workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md", + "db_id": "c8ee441e-1be1-5219-910c-e79ff23cc9ec", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'adhoc-2026-06-29@retired-20260828' (id=1c0460b7\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "1c0460b7-bc8a-48db-96d4-681bce18ac91", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'adhoc-2026-08-17@retired-20260827' (id=8376eb89\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "8376eb89-36f2-52b0-a59a-2954b2e49349", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'adhoc-2026-08-11@retired-20260827' (id=bc6dd3e3\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "bc6dd3e3-ab2b-567a-9574-30d2650f20a2", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'ops-warden-adhoc-2026-06-27@retired-20260827' (id=142b171b\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "142b171b-c34b-4a45-91a5-c77e6d07ec6f", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'adhoc-2026-07-07@retired-20260827' (id=2e8bc783\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "2e8bc783-2e37-4b86-a691-177b18329783", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-28", + "message": "2 unread inbox message(s) older than 3 day(s): the-custodian:23172cb2, the-custodian:51e9eace", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-28", + "message": "3 unread message(s) lack thread_id for supersession tracking: the-custodian:d422aecb, the-custodian:23172cb2, the-custodian:51e9eace", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 51/51", + "C-17 cleared: pushed 1 backlogged commit(s)", + "C-11 skipped: task 'WARDEN-WP-0038-T01' in finished workstream \u2014 not created", + "push: pushed" + ], + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 8, + "info": 5 + }, + "result": "warn" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/legacy-consistency.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/legacy-consistency.stderr.txt new file mode 100644 index 00000000..e69de29b diff --git a/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/manifest.json b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/manifest.json new file mode 100644 index 00000000..3ecf3f9e --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/manifest.json @@ -0,0 +1,256 @@ +{ + "files": [ + { + "path": "backup/.custodian-brief.md", + "sha256": "4ff4bb94315149e07d36b8f4ecbbfc63b61d72e9d81f0f43a9c2f02bc13ada85" + }, + { + "path": "backup/WORK-RECORDS.md", + "sha256": "b6af9b1cb21e3a64b2ef8a5e732bc35c39cdeaef6af7a18f24824e8ec9fb5a76" + }, + { + "path": "backup/workplans/ADHOC-2026-06-27.md", + "sha256": "f0a89c1809e23b436767a73b70636c283e79216fb19678f08bef2b9e62e42ddb" + }, + { + "path": "backup/workplans/ADHOC-2026-06-29.md", + "sha256": "9869f07cdfe79d37314d36db74a434a55b50c0b965ae53f29d76ca9a9a73151f" + }, + { + "path": "backup/workplans/ADHOC-2026-08-11.md", + "sha256": "6bba4f5dab9fc64f7b65df7c2ab7e4b9d4dbb69ba1c4a41c8440dbd23555aea4" + }, + { + "path": "backup/workplans/ADHOC-2026-08-17.md", + "sha256": "39ec882551bf5643fabb3ebc9f47300b4e6f6caf6d67a0a26bc100b68d4e313e" + }, + { + "path": "backup/workplans/ADHOC-2026-09-08.md", + "sha256": "27c64084fdd16b926b138584d96688061a18a58d4d8152d9688b4486b9687c05" + }, + { + "path": "backup/workplans/ADHOC-2026-10-03.md", + "sha256": "8de5e5ba28ce2cd94c5864e316d54fe32e6cdfdb0e75551fe92ed25b81eeafa6" + }, + { + "path": "backup/workplans/WARDEN-WP-0016-ops-bridge-tunnel-cert-pilot.md", + "sha256": "ad904837aa2d83d888d46c482fe381eba328c96a4617209ea8a9ae2d7d64c467" + }, + { + "path": "backup/workplans/WARDEN-WP-0017-access-front-door-discoverability.md", + "sha256": "a35f65a40c98d35e86f352c1430837b8bc9f269bddaddfe4a71c6414f678d85c" + }, + { + "path": "backup/workplans/WARDEN-WP-0018-whynot-design-npm-lane-activation.md", + "sha256": "6d9145534f7fa80cec9f185751d3796fdaab4a2d88b289a5451ba04e24822855" + }, + { + "path": "backup/workplans/WARDEN-WP-0019-route-to-secrets-engine.md", + "sha256": "8fa2d79c85a821f7bc51044f37001bad613afb75d143181e2e0a01b213e06df8" + }, + { + "path": "backup/workplans/WARDEN-WP-0020-ops-warden-worker.md", + "sha256": "d565f65413a2698160caf33ab30d7513a03d06ddcee7d624b198bb8841abdcc3" + }, + { + "path": "backup/workplans/WARDEN-WP-0021-enable-scheduled-worker-tick.md", + "sha256": "4f7afe5bdd147705e68d31d02f39251543c6c120ce22d893b98af063e303c361" + }, + { + "path": "backup/workplans/WARDEN-WP-0022-audit-trail-and-activity.md", + "sha256": "f733fb0d7cfcc7b44aba49a730e7f51381d6478a87c394161e77c90577c26505" + }, + { + "path": "backup/workplans/WARDEN-WP-0023-intent-scope-alignment-closeout.md", + "sha256": "97d25825ba626a3979e8d6217aebd27f58d27fe9f92e8b94eb2f63e2bb843cb9" + }, + { + "path": "backup/workplans/WARDEN-WP-0024-experiential-memory-and-agent-sessions.md", + "sha256": "22bde2d1398a4260e337768c6cf71cf80cd61d466371b6cfd0c0f0c18fc72378" + }, + { + "path": "backup/workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md", + "sha256": "ded5bdfdbe897f3376c71c7a169caca51a9d75453ba66cf216ec8dfcab91c708" + }, + { + "path": "backup/workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md", + "sha256": "f65ccdf9c920e9138353018e2ed5a7fbbd590246eb730fc6f57c75b6d2e09eea" + }, + { + "path": "backup/workplans/WARDEN-WP-0027-credential-governance-lockdown.md", + "sha256": "0d0c08458718ec88883c4b257ea80011123a6d5aa2eea36fe28db331ff6d438f" + }, + { + "path": "backup/workplans/WARDEN-WP-0028-tenant-secret-custody.md", + "sha256": "92cc0ad8d42209d5d7e45122e8ddd67e1970de1d200df373885ba5fb75e0d22a" + }, + { + "path": "backup/workplans/WARDEN-WP-0029-policy-front-door-and-founder-surface.md", + "sha256": "2b21f06c062edd96943a1d26fd86c6a27b341b1db4532e528edbaebd4ced7e66" + }, + { + "path": "backup/workplans/WARDEN-WP-0030-delegation-register.md", + "sha256": "59bf962b355cd9734315108f9868508739ddcb4855591bff53aea3634aed47f7" + }, + { + "path": "backup/workplans/WARDEN-WP-0031-policy-caller-identity.md", + "sha256": "0fa890ba81833180feb727ba35dcf01ead7d7dedf55a285a49a2585049b4bffb" + }, + { + "path": "backup/workplans/WARDEN-WP-0032-security-zones.md", + "sha256": "4497947e57fb86e883090d07c8bef031fd5fe4a7f3eb065d530ebe327d97b1cc" + }, + { + "path": "backup/workplans/WARDEN-WP-0033-native-lane-handoff.md", + "sha256": "74747ebf7c628b1a5336c63aa3924212068a6015f370e647cf9127949c181998" + }, + { + "path": "backup/workplans/WARDEN-WP-0034-layer-model-v07-conformance.md", + "sha256": "57e10b9efff02d7437231424ebc4d48864a2019939c2cda2fa10629a4ede2a3b" + }, + { + "path": "backup/workplans/WARDEN-WP-0035-policy-nexus-forgejo-source-read-route.md", + "sha256": "d40987b48a8416de386972d214ce01dba138a9f294cc948de36085c794c76418" + }, + { + "path": "backup/workplans/WARDEN-WP-0036-attended-login-openbao-output.md", + "sha256": "e0584491b5a6a7d4db0cf61a689f733b4a6597778ca79a3f8f2207fe7ecfb8cc" + }, + { + "path": "backup/workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md", + "sha256": "7c64a631eb70d9ff42826ea5966cac571786ff86bac5393f88c328aeb14aa9ba" + }, + { + "path": "backup/workplans/WARDEN-WP-0038-plan-mutation-intent.md", + "sha256": "09b0ed8c6315255796a2da0d64dfd001b1f6de2e903ac2ea79bc5667b499fb83" + }, + { + "path": "backup/workplans/WARDEN-WP-0039-explicit-policy-refusal.md", + "sha256": "e8773a7b4196cf77a48ab4ed0804a5f826a0a0b5e7972f968681746ebbc6e3e9" + }, + { + "path": "backup/workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md", + "sha256": "a4b8e768eaacd5ab5a90f69a1abcb3bd48ce821fcdea208b0ee75d9326f0d512" + }, + { + "path": "backup/workplans/WARDEN-WP-0041-catalog-lane-scaffolding.md", + "sha256": "c16993301f29e7f5ea005cccdbe360ac9c4c3949e6988e2b7a1f1e5df6235bc1" + }, + { + "path": "backup/workplans/WARDEN-WP-0042-openbao-structure-survey-route.md", + "sha256": "1e48399d6ef8a509898e8ea0b334a378c51ec467aaa704b6dbf8485aed29fa8b" + }, + { + "path": "backup/workplans/WARDEN-WP-0043-platform-supplier-credentials.md", + "sha256": "c059b7f80ad4c0e5faa8ad15532ab6c2577d0c383ba91cde7293534b6e4683e2" + }, + { + "path": "backup/workplans/WARDEN-WP-0044-security-case-follow-through.md", + "sha256": "721a90b2ed8c896257c34a1451eb642cb8824c8263e37c483fb61b36adc54088" + }, + { + "path": "backup/workplans/archived/260515-WARDEN-WP-0001-initial-implementation.md", + "sha256": "359456ecd25525d95748ca611e7c6c118eee2b914dae447c84c59442a6520458" + }, + { + "path": "backup/workplans/archived/260515-WARDEN-WP-0002-correctness-and-completeness.md", + "sha256": "43ba78e9c6e9914360edc88a6f8f5af0f981b3078ef41808a784ce7388559fb7" + }, + { + "path": "backup/workplans/archived/260515-WARDEN-WP-0003-test-coverage-and-quality.md", + "sha256": "4fb4ac0cb72cf14dd72c6e5f313a068d90ead203460ad3ac68f0d5dd12b6a755" + }, + { + "path": "backup/workplans/archived/260617-WARDEN-WP-0004-repo-hygiene-and-hub-sync.md", + "sha256": "fbb36a3d9c4ab0ac829bba713160d919b3c12c19f5f5826fb4e8483edeec3ac1" + }, + { + "path": "backup/workplans/archived/260617-WARDEN-WP-0005-openbao-doc-alignment.md", + "sha256": "3c930a395d518f9b287855632c21fe99a3d5c78a758ece06498fb9e35f5ea8b9" + }, + { + "path": "backup/workplans/archived/260617-WARDEN-WP-0006-netkingdom-alignment-and-access-stewardship.md", + "sha256": "fbc90ca4c18f8180a7fbcd2b43f21d7f99a44c914eb17c78f823228f8e3cc64f" + }, + { + "path": "backup/workplans/archived/260617-WARDEN-WP-0007-policy-gate-and-production-verify.md", + "sha256": "613b73c79bad0929f621feb136b3141f9c60e23bf6e23650881a47c762101214" + }, + { + "path": "backup/workplans/archived/260618-WARDEN-WP-0008-production-ssh-path-and-stewardship-closeout.md", + "sha256": "8362d4cdb933b52c9be968d5410c8548c7554cc4cd44ab0389b913674795a10a" + }, + { + "path": "backup/workplans/archived/260623-WARDEN-WP-0009-flex-auth-policy-gate-production.md", + "sha256": "fa611c1a2e5c5a214e38f0673ebcda17e3f30e10556b268fb126ded9af2bdbbb" + }, + { + "path": "backup/workplans/archived/260624-WARDEN-WP-0010-access-routing-charter.md", + "sha256": "62bc994e3efbb124004f98992ded6842ff2748568b2e405c61b335385a35b9d7" + }, + { + "path": "backup/workplans/archived/260624-WARDEN-WP-0011-routing-guide-cli.md", + "sha256": "767cd3c53cfe64beab93f19475be823d0637a40140877db6dfcc60e2693652ce" + }, + { + "path": "backup/workplans/archived/260624-WARDEN-WP-0013-production-integration-and-stewardship-closeout.md", + "sha256": "ecc38b4998796e20d734105df81ef6e2eb05c8e830b6d0dbe344d6336b9f668b" + }, + { + "path": "backup/workplans/archived/260627-WARDEN-WP-0012-routing-scenario-playbooks.md", + "sha256": "7a7a1d25cd1d015c0a28f0d443de0512fc48cb1fda4317760051251988aa96f0" + }, + { + "path": "backup/workplans/archived/260627-WARDEN-WP-0014-operator-access-assist.md", + "sha256": "c1b84e750b2580fa1deae7dd56fd29abe5d9924a3ccd47ce9fc5f99c26aa4924" + }, + { + "path": "backup/workplans/archived/260627-WARDEN-WP-0015-secret-lifecycle-tiering.md", + "sha256": "300b8b6cfdd7306fbb81ab30d4f59551976eed1de0012fd655e4b6fc096ccf10" + }, + { + "path": "backup/workplans/archived/260707-ADHOC-2026-07-07.md", + "sha256": "e169418f6d83f954de1907ae8fa26a5f5cf4fe011be01dba9363e69befa05cfa" + }, + { + "path": "health-before.json", + "sha256": "f3f03424c7cbebf5d526a7daf1a8aaaa7b22f23e95b975b6cbc4a544ce164941" + }, + { + "path": "legacy-consistency.json", + "sha256": "5a8f8ef18d778b635194fff676f0a1ea0b79cf2364099990b1e3b3609553b3b0" + }, + { + "path": "legacy-consistency.stderr.txt", + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + }, + { + "path": "normal-sync-refusal.json", + "sha256": "c8907b0f1d724a6d8e613e41c050c49b59ff750beb7cfa84b2c683918e528137" + }, + { + "path": "preimage.json", + "sha256": "b1456512a772c306a326e9683fee6d279849adb305dccb9934e709650fceebb5" + }, + { + "path": "receiver-receipt.json", + "sha256": "c6269bb22c86c0ccddd91e256b0032fe92f7fb47fb5304e1fcca47f05c3a68bf" + }, + { + "path": "receiver-request.json", + "sha256": "eb65eb418da2b106218b06756a910d5b25983119953c812b588b3653049e0a3a" + }, + { + "path": "tasks-after.json", + "sha256": "67ee9d1079cceee374e1b957149cbf1f55828af3a4344ba1a04b0fb305e3feb2" + }, + { + "path": "tasks-before.json", + "sha256": "67ee9d1079cceee374e1b957149cbf1f55828af3a4344ba1a04b0fb305e3feb2" + }, + { + "path": "verification.json", + "sha256": "0729755f050ca43c1fe4270f59b321b31f4edf377ff7240aec6da0d1959a3b7e" + } + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/normal-sync-refusal.json b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/normal-sync-refusal.json new file mode 100644 index 00000000..f9556940 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/normal-sync-refusal.json @@ -0,0 +1,24 @@ +{ + "status": "refused-before-sync", + "reason": "Unrelated UUID assignment requires review; original normal publisher assertion retained", + "preview": { + "schema": "repo-manager.identifier-assignment.v1", + "ok": true, + "executed": false, + "repo": "ops-warden", + "namespace": "helixforge", + "assignments": [ + { + "kind": "task", + "record_id": "WARDEN-WP-0038-T01", + "uuid": "ef28df7c-2c72-56be-ad90-4e079f37639f", + "path": "workplans/WARDEN-WP-0038-plan-mutation-intent.md" + } + ], + "historical_invalid_identifiers": [], + "historical_identity_collisions": [], + "files_changed": [ + "workplans/WARDEN-WP-0038-plan-mutation-intent.md" + ] + } +} diff --git a/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/preimage.json b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/preimage.json new file mode 100644 index 00000000..e26af24c --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/preimage.json @@ -0,0 +1,272 @@ +{ + "head": "117fec9241e7b985dfb187b992e173d0a5dc3700", + "origin_main": "a45cf475bc4dbc929e0eecbc1f806a9229d934e2", + "status": "M WORK-RECORDS.md", + "files": [ + { + "path": ".custodian-brief.md", + "sha256": "4ff4bb94315149e07d36b8f4ecbbfc63b61d72e9d81f0f43a9c2f02bc13ada85", + "index": "100644 34573d262327057c11628ce8a7ca78292968545b 0\t.custodian-brief.md" + }, + { + "path": "WORK-RECORDS.md", + "sha256": "b6af9b1cb21e3a64b2ef8a5e732bc35c39cdeaef6af7a18f24824e8ec9fb5a76", + "index": "100644 34cf268862326a5832a7d0be9e84eb296e5601bb 0\tWORK-RECORDS.md" + }, + { + "path": "workplans/ADHOC-2026-06-27.md", + "sha256": "f0a89c1809e23b436767a73b70636c283e79216fb19678f08bef2b9e62e42ddb", + "index": "100644 d75908fb225c1f964b5b697032a6f98c4a13c1db 0\tworkplans/ADHOC-2026-06-27.md" + }, + { + "path": "workplans/ADHOC-2026-06-29.md", + "sha256": "9869f07cdfe79d37314d36db74a434a55b50c0b965ae53f29d76ca9a9a73151f", + "index": "100644 b46be0fd6ee2eeea9ffeff695b887b61aab8a7a2 0\tworkplans/ADHOC-2026-06-29.md" + }, + { + "path": "workplans/ADHOC-2026-08-11.md", + "sha256": "6bba4f5dab9fc64f7b65df7c2ab7e4b9d4dbb69ba1c4a41c8440dbd23555aea4", + "index": "100644 3d858fe808bd7a9d8318cdcd38ee012a8d907ca4 0\tworkplans/ADHOC-2026-08-11.md" + }, + { + "path": "workplans/ADHOC-2026-08-17.md", + "sha256": "39ec882551bf5643fabb3ebc9f47300b4e6f6caf6d67a0a26bc100b68d4e313e", + "index": "100644 65d75959a0fd23dd861e24321b1b46057d6fea5f 0\tworkplans/ADHOC-2026-08-17.md" + }, + { + "path": "workplans/ADHOC-2026-09-08.md", + "sha256": "27c64084fdd16b926b138584d96688061a18a58d4d8152d9688b4486b9687c05", + "index": "100644 c1ae7c3ea0d8e722d7073ae920780a5e56611294 0\tworkplans/ADHOC-2026-09-08.md" + }, + { + "path": "workplans/ADHOC-2026-10-03.md", + "sha256": "8de5e5ba28ce2cd94c5864e316d54fe32e6cdfdb0e75551fe92ed25b81eeafa6", + "index": "100644 e76cd016eab0dfd9eceac7d8033b40f92c9ada32 0\tworkplans/ADHOC-2026-10-03.md" + }, + { + "path": "workplans/WARDEN-WP-0016-ops-bridge-tunnel-cert-pilot.md", + "sha256": "ad904837aa2d83d888d46c482fe381eba328c96a4617209ea8a9ae2d7d64c467", + "index": "100644 a787f1da8347fdd2219ef67a569d21a192563343 0\tworkplans/WARDEN-WP-0016-ops-bridge-tunnel-cert-pilot.md" + }, + { + "path": "workplans/WARDEN-WP-0017-access-front-door-discoverability.md", + "sha256": "a35f65a40c98d35e86f352c1430837b8bc9f269bddaddfe4a71c6414f678d85c", + "index": "100644 fe9c5b15a464aa3ae104576bfc0a04510d944f89 0\tworkplans/WARDEN-WP-0017-access-front-door-discoverability.md" + }, + { + "path": "workplans/WARDEN-WP-0018-whynot-design-npm-lane-activation.md", + "sha256": "6d9145534f7fa80cec9f185751d3796fdaab4a2d88b289a5451ba04e24822855", + "index": "100644 f923be5351582a2bab38afc1aca3b4e5da0fe008 0\tworkplans/WARDEN-WP-0018-whynot-design-npm-lane-activation.md" + }, + { + "path": "workplans/WARDEN-WP-0019-route-to-secrets-engine.md", + "sha256": "8fa2d79c85a821f7bc51044f37001bad613afb75d143181e2e0a01b213e06df8", + "index": "100644 602fad1b4e56fc69de85aa2e0843676f50186340 0\tworkplans/WARDEN-WP-0019-route-to-secrets-engine.md" + }, + { + "path": "workplans/WARDEN-WP-0020-ops-warden-worker.md", + "sha256": "d565f65413a2698160caf33ab30d7513a03d06ddcee7d624b198bb8841abdcc3", + "index": "100644 1230ed3175d3f5f175fc0146e8006ebd8be5a369 0\tworkplans/WARDEN-WP-0020-ops-warden-worker.md" + }, + { + "path": "workplans/WARDEN-WP-0021-enable-scheduled-worker-tick.md", + "sha256": "4f7afe5bdd147705e68d31d02f39251543c6c120ce22d893b98af063e303c361", + "index": "100644 2500d4b346dffbe6d5f9848c5440bfa8d85d5d14 0\tworkplans/WARDEN-WP-0021-enable-scheduled-worker-tick.md" + }, + { + "path": "workplans/WARDEN-WP-0022-audit-trail-and-activity.md", + "sha256": "f733fb0d7cfcc7b44aba49a730e7f51381d6478a87c394161e77c90577c26505", + "index": "100644 63171f58096efb8d4bc07c69db250fff7038f4e1 0\tworkplans/WARDEN-WP-0022-audit-trail-and-activity.md" + }, + { + "path": "workplans/WARDEN-WP-0023-intent-scope-alignment-closeout.md", + "sha256": "97d25825ba626a3979e8d6217aebd27f58d27fe9f92e8b94eb2f63e2bb843cb9", + "index": "100644 99278d609aa5324c625364b2e0ac636ad9219ddf 0\tworkplans/WARDEN-WP-0023-intent-scope-alignment-closeout.md" + }, + { + "path": "workplans/WARDEN-WP-0024-experiential-memory-and-agent-sessions.md", + "sha256": "22bde2d1398a4260e337768c6cf71cf80cd61d466371b6cfd0c0f0c18fc72378", + "index": "100644 3ebac662f6c96f69a5fa6cbb5917999a4e24455a 0\tworkplans/WARDEN-WP-0024-experiential-memory-and-agent-sessions.md" + }, + { + "path": "workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md", + "sha256": "ded5bdfdbe897f3376c71c7a169caca51a9d75453ba66cf216ec8dfcab91c708", + "index": "100644 5c4e77249b01fd8cb9300a237c917d95363cf2d7 0\tworkplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md" + }, + { + "path": "workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md", + "sha256": "f65ccdf9c920e9138353018e2ed5a7fbbd590246eb730fc6f57c75b6d2e09eea", + "index": "100644 309f77187b31c1287b085affefc9d271ea40858c 0\tworkplans/WARDEN-WP-0026-credential-disclosure-hygiene.md" + }, + { + "path": "workplans/WARDEN-WP-0027-credential-governance-lockdown.md", + "sha256": "0d0c08458718ec88883c4b257ea80011123a6d5aa2eea36fe28db331ff6d438f", + "index": "100644 c14e9c303a1f1a096fdf710ee48112f68205435e 0\tworkplans/WARDEN-WP-0027-credential-governance-lockdown.md" + }, + { + "path": "workplans/WARDEN-WP-0028-tenant-secret-custody.md", + "sha256": "92cc0ad8d42209d5d7e45122e8ddd67e1970de1d200df373885ba5fb75e0d22a", + "index": "100644 fe81983444e5127bb8a0fdf94f42c3817758c67e 0\tworkplans/WARDEN-WP-0028-tenant-secret-custody.md" + }, + { + "path": "workplans/WARDEN-WP-0029-policy-front-door-and-founder-surface.md", + "sha256": "2b21f06c062edd96943a1d26fd86c6a27b341b1db4532e528edbaebd4ced7e66", + "index": "100644 4008d825b4c39d3f0e4a80f6d290af9b551fd812 0\tworkplans/WARDEN-WP-0029-policy-front-door-and-founder-surface.md" + }, + { + "path": "workplans/WARDEN-WP-0030-delegation-register.md", + "sha256": "59bf962b355cd9734315108f9868508739ddcb4855591bff53aea3634aed47f7", + "index": "100644 49612d072663af831f7b7314c4b77e4b9596097b 0\tworkplans/WARDEN-WP-0030-delegation-register.md" + }, + { + "path": "workplans/WARDEN-WP-0031-policy-caller-identity.md", + "sha256": "0fa890ba81833180feb727ba35dcf01ead7d7dedf55a285a49a2585049b4bffb", + "index": "100644 c4c600c47a6e4a65951b1adf324cc33f13cb1be6 0\tworkplans/WARDEN-WP-0031-policy-caller-identity.md" + }, + { + "path": "workplans/WARDEN-WP-0032-security-zones.md", + "sha256": "4497947e57fb86e883090d07c8bef031fd5fe4a7f3eb065d530ebe327d97b1cc", + "index": "100644 6c8000ade056b82e019826d01a7e9e8cf0f4de98 0\tworkplans/WARDEN-WP-0032-security-zones.md" + }, + { + "path": "workplans/WARDEN-WP-0033-native-lane-handoff.md", + "sha256": "74747ebf7c628b1a5336c63aa3924212068a6015f370e647cf9127949c181998", + "index": "100644 55cd015061bb610fe43c8f2ee821bb71b092d77c 0\tworkplans/WARDEN-WP-0033-native-lane-handoff.md" + }, + { + "path": "workplans/WARDEN-WP-0034-layer-model-v07-conformance.md", + "sha256": "57e10b9efff02d7437231424ebc4d48864a2019939c2cda2fa10629a4ede2a3b", + "index": "100644 d6ebfdce0e2901b42c98e38e9eaaac0f1d817e79 0\tworkplans/WARDEN-WP-0034-layer-model-v07-conformance.md" + }, + { + "path": "workplans/WARDEN-WP-0035-policy-nexus-forgejo-source-read-route.md", + "sha256": "d40987b48a8416de386972d214ce01dba138a9f294cc948de36085c794c76418", + "index": "100644 1210b158a3836d2b4df934f50fb538c5241b09d5 0\tworkplans/WARDEN-WP-0035-policy-nexus-forgejo-source-read-route.md" + }, + { + "path": "workplans/WARDEN-WP-0036-attended-login-openbao-output.md", + "sha256": "e0584491b5a6a7d4db0cf61a689f733b4a6597778ca79a3f8f2207fe7ecfb8cc", + "index": "100644 452eb41267ea99cc83104fcb2a782c0b244b87d1 0\tworkplans/WARDEN-WP-0036-attended-login-openbao-output.md" + }, + { + "path": "workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md", + "sha256": "7c64a631eb70d9ff42826ea5966cac571786ff86bac5393f88c328aeb14aa9ba", + "index": "100644 a3eba2dff6517a64b2c5d3d9b9a9c14ca4570ec6 0\tworkplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md" + }, + { + "path": "workplans/WARDEN-WP-0038-plan-mutation-intent.md", + "sha256": "09b0ed8c6315255796a2da0d64dfd001b1f6de2e903ac2ea79bc5667b499fb83", + "index": "100644 8c9c5b6df7d1f48b48f8c2056c2a8186935184ee 0\tworkplans/WARDEN-WP-0038-plan-mutation-intent.md" + }, + { + "path": "workplans/WARDEN-WP-0039-explicit-policy-refusal.md", + "sha256": "e8773a7b4196cf77a48ab4ed0804a5f826a0a0b5e7972f968681746ebbc6e3e9", + "index": "100644 ca0828d2679eda031fb86d66eb886ccb38ee1843 0\tworkplans/WARDEN-WP-0039-explicit-policy-refusal.md" + }, + { + "path": "workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md", + "sha256": "a4b8e768eaacd5ab5a90f69a1abcb3bd48ce821fcdea208b0ee75d9326f0d512", + "index": "100644 f07fb535d5ad00f5330f16a5a6e927da6960fe52 0\tworkplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md" + }, + { + "path": "workplans/WARDEN-WP-0041-catalog-lane-scaffolding.md", + "sha256": "c16993301f29e7f5ea005cccdbe360ac9c4c3949e6988e2b7a1f1e5df6235bc1", + "index": "100644 8a1ca341e9fcc041dcf99be8706f0db2a39408a6 0\tworkplans/WARDEN-WP-0041-catalog-lane-scaffolding.md" + }, + { + "path": "workplans/WARDEN-WP-0042-openbao-structure-survey-route.md", + "sha256": "1e48399d6ef8a509898e8ea0b334a378c51ec467aaa704b6dbf8485aed29fa8b", + "index": "100644 097d64791e79e782640514c7324e2ff8a5dc435c 0\tworkplans/WARDEN-WP-0042-openbao-structure-survey-route.md" + }, + { + "path": "workplans/WARDEN-WP-0043-platform-supplier-credentials.md", + "sha256": "c059b7f80ad4c0e5faa8ad15532ab6c2577d0c383ba91cde7293534b6e4683e2", + "index": "100644 d359328239b0b897ccffbf037a12b06d1f0d126a 0\tworkplans/WARDEN-WP-0043-platform-supplier-credentials.md" + }, + { + "path": "workplans/WARDEN-WP-0044-security-case-follow-through.md", + "sha256": "721a90b2ed8c896257c34a1451eb642cb8824c8263e37c483fb61b36adc54088", + "index": "100644 f6413241cdc2d8bdc0103bf541032a2b229ce5ee 0\tworkplans/WARDEN-WP-0044-security-case-follow-through.md" + }, + { + "path": "workplans/archived/260515-WARDEN-WP-0001-initial-implementation.md", + "sha256": "359456ecd25525d95748ca611e7c6c118eee2b914dae447c84c59442a6520458", + "index": "100644 5425cbd886ff77afc9be7c8b62b97d03278e0a8e 0\tworkplans/archived/260515-WARDEN-WP-0001-initial-implementation.md" + }, + { + "path": "workplans/archived/260515-WARDEN-WP-0002-correctness-and-completeness.md", + "sha256": "43ba78e9c6e9914360edc88a6f8f5af0f981b3078ef41808a784ce7388559fb7", + "index": "100644 0b6044f99391e81a439f2782ee697434319df05b 0\tworkplans/archived/260515-WARDEN-WP-0002-correctness-and-completeness.md" + }, + { + "path": "workplans/archived/260515-WARDEN-WP-0003-test-coverage-and-quality.md", + "sha256": "4fb4ac0cb72cf14dd72c6e5f313a068d90ead203460ad3ac68f0d5dd12b6a755", + "index": "100644 d544f950037cb705d5f7195ee559f91ca9f6a4f4 0\tworkplans/archived/260515-WARDEN-WP-0003-test-coverage-and-quality.md" + }, + { + "path": "workplans/archived/260617-WARDEN-WP-0004-repo-hygiene-and-hub-sync.md", + "sha256": "fbb36a3d9c4ab0ac829bba713160d919b3c12c19f5f5826fb4e8483edeec3ac1", + "index": "100644 31330938708c5ae9b6412c5715549f2d69192589 0\tworkplans/archived/260617-WARDEN-WP-0004-repo-hygiene-and-hub-sync.md" + }, + { + "path": "workplans/archived/260617-WARDEN-WP-0005-openbao-doc-alignment.md", + "sha256": "3c930a395d518f9b287855632c21fe99a3d5c78a758ece06498fb9e35f5ea8b9", + "index": "100644 9969260deee2960143102edecadb9fd7c9736832 0\tworkplans/archived/260617-WARDEN-WP-0005-openbao-doc-alignment.md" + }, + { + "path": "workplans/archived/260617-WARDEN-WP-0006-netkingdom-alignment-and-access-stewardship.md", + "sha256": "fbc90ca4c18f8180a7fbcd2b43f21d7f99a44c914eb17c78f823228f8e3cc64f", + "index": "100644 8a7cc2f69821ac8cbf0de744073b7a938fa6b51d 0\tworkplans/archived/260617-WARDEN-WP-0006-netkingdom-alignment-and-access-stewardship.md" + }, + { + "path": "workplans/archived/260617-WARDEN-WP-0007-policy-gate-and-production-verify.md", + "sha256": "613b73c79bad0929f621feb136b3141f9c60e23bf6e23650881a47c762101214", + "index": "100644 f49eea27ea7c15f4f3d608669ddd60e3a13803b5 0\tworkplans/archived/260617-WARDEN-WP-0007-policy-gate-and-production-verify.md" + }, + { + "path": "workplans/archived/260618-WARDEN-WP-0008-production-ssh-path-and-stewardship-closeout.md", + "sha256": "8362d4cdb933b52c9be968d5410c8548c7554cc4cd44ab0389b913674795a10a", + "index": "100644 f3827285c4e279f36ac63c14ad166ff90544659a 0\tworkplans/archived/260618-WARDEN-WP-0008-production-ssh-path-and-stewardship-closeout.md" + }, + { + "path": "workplans/archived/260623-WARDEN-WP-0009-flex-auth-policy-gate-production.md", + "sha256": "fa611c1a2e5c5a214e38f0673ebcda17e3f30e10556b268fb126ded9af2bdbbb", + "index": "100644 7f87d0ed26b7f19438f164a10a10a46808824776 0\tworkplans/archived/260623-WARDEN-WP-0009-flex-auth-policy-gate-production.md" + }, + { + "path": "workplans/archived/260624-WARDEN-WP-0010-access-routing-charter.md", + "sha256": "62bc994e3efbb124004f98992ded6842ff2748568b2e405c61b335385a35b9d7", + "index": "100644 12357da7a3d1d5f994e70d0f06dcc80ea1faf848 0\tworkplans/archived/260624-WARDEN-WP-0010-access-routing-charter.md" + }, + { + "path": "workplans/archived/260624-WARDEN-WP-0011-routing-guide-cli.md", + "sha256": "767cd3c53cfe64beab93f19475be823d0637a40140877db6dfcc60e2693652ce", + "index": "100644 3fe363e93d7e7d38db58deeec0ef3023bb35f8fa 0\tworkplans/archived/260624-WARDEN-WP-0011-routing-guide-cli.md" + }, + { + "path": "workplans/archived/260624-WARDEN-WP-0013-production-integration-and-stewardship-closeout.md", + "sha256": "ecc38b4998796e20d734105df81ef6e2eb05c8e830b6d0dbe344d6336b9f668b", + "index": "100644 9812e11e5e3499a22d0d4dde01fccd26b7d0ee03 0\tworkplans/archived/260624-WARDEN-WP-0013-production-integration-and-stewardship-closeout.md" + }, + { + "path": "workplans/archived/260627-WARDEN-WP-0012-routing-scenario-playbooks.md", + "sha256": "7a7a1d25cd1d015c0a28f0d443de0512fc48cb1fda4317760051251988aa96f0", + "index": "100644 acf9cce9f55395827479d4963e2d257be182f507 0\tworkplans/archived/260627-WARDEN-WP-0012-routing-scenario-playbooks.md" + }, + { + "path": "workplans/archived/260627-WARDEN-WP-0014-operator-access-assist.md", + "sha256": "c1b84e750b2580fa1deae7dd56fd29abe5d9924a3ccd47ce9fc5f99c26aa4924", + "index": "100644 01240484d955b0af77443d6dd49948c96f9fb032 0\tworkplans/archived/260627-WARDEN-WP-0014-operator-access-assist.md" + }, + { + "path": "workplans/archived/260627-WARDEN-WP-0015-secret-lifecycle-tiering.md", + "sha256": "300b8b6cfdd7306fbb81ab30d4f59551976eed1de0012fd655e4b6fc096ccf10", + "index": "100644 c59207892dcf723ce7b4ca0908635fb32407176e 0\tworkplans/archived/260627-WARDEN-WP-0015-secret-lifecycle-tiering.md" + }, + { + "path": "workplans/archived/260707-ADHOC-2026-07-07.md", + "sha256": "e169418f6d83f954de1907ae8fa26a5f5cf4fe011be01dba9363e69befa05cfa", + "index": "100644 31e9d27f2aa37f8eac17cb5500873a60b9ee8833 0\tworkplans/archived/260707-ADHOC-2026-07-07.md" + } + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/receiver-receipt.json b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/receiver-receipt.json new file mode 100644 index 00000000..1760aedc --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/receiver-receipt.json @@ -0,0 +1,268 @@ +{ + "http_status": 200, + "receipt": { + "schema": "state-hub.repository-projection-reconcile.v1", + "instance_role": "primary", + "instance_label": "railiance01", + "expected_commit": "117fec9241e7b985dfb187b992e173d0a5dc3700", + "derived_commit": "117fec9241e7b985dfb187b992e173d0a5dc3700", + "outcome": { + "schema": "state-hub.projection-reset.v1", + "repo_slug": "ops-warden", + "commit": "117fec9241e7b985dfb187b992e173d0a5dc3700", + "status": "applied", + "counts": { + "created": 0, + "updated": 51, + "retired": 0, + "refused": 0, + "released": 0, + "created_tasks": 1, + "updated_tasks": 0, + "cancelled_tasks": 0, + "created_edges": 0, + "removed_edges": 0, + "unresolved_edges": 0, + "external_edges": 17 + }, + "created": [], + "updated": [ + "WARDEN-WP-0001", + "WARDEN-WP-0002", + "WARDEN-WP-0003", + "WARDEN-WP-0004", + "WARDEN-WP-0005", + "WARDEN-WP-0006", + "WARDEN-WP-0007", + "WARDEN-WP-0008", + "WARDEN-WP-0009", + "WARDEN-WP-0010", + "WARDEN-WP-0011", + "WARDEN-WP-0012", + "WARDEN-WP-0013", + "WARDEN-WP-0014", + "WARDEN-WP-0015", + "WARDEN-WP-0016", + "WARDEN-WP-0017", + "WARDEN-WP-0018", + "WARDEN-WP-0019", + "WARDEN-WP-0020", + "WARDEN-WP-0021", + "WARDEN-WP-0022", + "WARDEN-WP-0023", + "WARDEN-WP-0024", + "WARDEN-WP-0025", + "WARDEN-WP-0026", + "WARDEN-WP-0027", + "WARDEN-WP-0028", + "WARDEN-WP-0029", + "WARDEN-WP-0030", + "WARDEN-WP-0031", + "WARDEN-WP-0032", + "WARDEN-WP-0033", + "WARDEN-WP-0034", + "WARDEN-WP-0035", + "WARDEN-WP-0036", + "WARDEN-WP-0037", + "WARDEN-WP-0038", + "WARDEN-WP-0039", + "WARDEN-WP-0040", + "WARDEN-WP-0041", + "WARDEN-WP-0042", + "WARDEN-WP-0043", + "WARDEN-WP-0044", + "WARDEN-WP-ADHOC-2026-06-27", + "WARDEN-WP-ADHOC-2026-06-29", + "WARDEN-WP-ADHOC-2026-07-07", + "WARDEN-WP-ADHOC-2026-08-11", + "WARDEN-WP-ADHOC-2026-08-17", + "WARDEN-WP-ADHOC-2026-09-08", + "WARDEN-WP-ADHOC-2026-10-03" + ], + "retired": [], + "released": [], + "created_tasks": [ + "WARDEN-WP-0038-T01" + ], + "updated_tasks": [], + "cancelled_tasks": [], + "created_edges": [], + "removed_edges": [], + "unresolved_edges": [], + "external_edges": [ + { + "workplan": "WARDEN-WP-0032", + "from": "WARDEN-WP-0032", + "target": "WARDEN-WP-0031", + "relationship_type": "blocks", + "from_workplan_id": "38c6a5f3-fb0d-5230-be85-f9e3ffc850f6", + "from_task_id": null, + "to_workplan_id": "739bad25-2345-5f4f-aaa3-cc4cd8c71f6c", + "to_task_id": null + }, + { + "workplan": "WARDEN-WP-0037", + "from": "WARDEN-WP-0037-T03", + "target": "SECRETS-WP-0006-T06", + "relationship_type": "starts_after", + "from_workplan_id": "42a097db-1c24-558e-a724-030bb2b4443e", + "from_task_id": "a8b1b855-ab34-5835-b9fd-5f48bc0b6817", + "to_workplan_id": null, + "to_task_id": "1431edae-5791-5892-8c4b-829419b537d2" + }, + { + "workplan": "WARDEN-WP-0033", + "from": "WARDEN-WP-0033", + "target": "WARDEN-WP-0030", + "relationship_type": "blocks", + "from_workplan_id": "4627d89b-4b00-562a-81e9-76e96f90fa7e", + "from_task_id": null, + "to_workplan_id": "da3367d5-890c-52c6-aa54-1bdd0f277342", + "to_task_id": null + }, + { + "workplan": "WARDEN-WP-0013", + "from": "WARDEN-WP-0013", + "target": "WARDEN-WP-0011", + "relationship_type": "blocks", + "from_workplan_id": "4678c41a-c1d0-48cd-9988-4ea0380e8258", + "from_task_id": null, + "to_workplan_id": "0a520f8e-01b4-48f1-9af3-2f3f69fd0672", + "to_task_id": null + }, + { + "workplan": "WARDEN-WP-0013", + "from": "WARDEN-WP-0013", + "target": "WARDEN-WP-0009", + "relationship_type": "blocks", + "from_workplan_id": "4678c41a-c1d0-48cd-9988-4ea0380e8258", + "from_task_id": null, + "to_workplan_id": "9213b262-e2f5-480e-a5bc-56635d5eb4c9", + "to_task_id": null + }, + { + "workplan": "WARDEN-WP-0013", + "from": "WARDEN-WP-0013", + "target": "WARDEN-WP-0008", + "relationship_type": "blocks", + "from_workplan_id": "4678c41a-c1d0-48cd-9988-4ea0380e8258", + "from_task_id": null, + "to_workplan_id": "a174963a-4ff1-4565-b19f-896cd4ff14a0", + "to_task_id": null + }, + { + "workplan": "WARDEN-WP-0013", + "from": "WARDEN-WP-0013", + "target": "WARDEN-WP-0010", + "relationship_type": "blocks", + "from_workplan_id": "4678c41a-c1d0-48cd-9988-4ea0380e8258", + "from_task_id": null, + "to_workplan_id": "e93de9fd-0192-4d02-bb7c-5e859fb76b9b", + "to_task_id": null + }, + { + "workplan": "WARDEN-WP-0031", + "from": "WARDEN-WP-0031", + "target": "WARDEN-WP-0007", + "relationship_type": "blocks", + "from_workplan_id": "739bad25-2345-5f4f-aaa3-cc4cd8c71f6c", + "from_task_id": null, + "to_workplan_id": "3718ac07-2fa2-47d0-a02a-c9a7b83a5ba9", + "to_task_id": null + }, + { + "workplan": "WARDEN-WP-0038", + "from": "WARDEN-WP-0038", + "target": "WARDEN-WP-0029", + "relationship_type": "blocks", + "from_workplan_id": "751ad530-e44b-52c4-b70e-cb47568a0179", + "from_task_id": null, + "to_workplan_id": "bbb3d9ec-d88d-5088-b4c0-55bfba0a10cf", + "to_task_id": null + }, + { + "workplan": "WARDEN-WP-0023", + "from": "WARDEN-WP-0023", + "target": "WARDEN-WP-0022", + "relationship_type": "blocks", + "from_workplan_id": "7bad1ec4-a7c2-4980-b8f9-49a7f5408574", + "from_task_id": null, + "to_workplan_id": "fc8afa28-68a7-4250-a19e-9754829f0cd5", + "to_task_id": null + }, + { + "workplan": "WARDEN-WP-0034", + "from": "WARDEN-WP-0034", + "target": "WARDEN-WP-0030", + "relationship_type": "blocks", + "from_workplan_id": "ae3ff76f-883d-5e2f-b6aa-144d61e8fdef", + "from_task_id": null, + "to_workplan_id": "da3367d5-890c-52c6-aa54-1bdd0f277342", + "to_task_id": null + }, + { + "workplan": "WARDEN-WP-0040", + "from": "WARDEN-WP-0040", + "target": "WARDEN-WP-0032", + "relationship_type": "blocks", + "from_workplan_id": "c8ee441e-1be1-5219-910c-e79ff23cc9ec", + "from_task_id": null, + "to_workplan_id": "38c6a5f3-fb0d-5230-be85-f9e3ffc850f6", + "to_task_id": null + }, + { + "workplan": "WARDEN-WP-0040", + "from": "WARDEN-WP-0040", + "target": "WARDEN-WP-0034", + "relationship_type": "blocks", + "from_workplan_id": "c8ee441e-1be1-5219-910c-e79ff23cc9ec", + "from_task_id": null, + "to_workplan_id": "ae3ff76f-883d-5e2f-b6aa-144d61e8fdef", + "to_task_id": null + }, + { + "workplan": "WARDEN-WP-0040", + "from": "WARDEN-WP-0040-T03", + "target": "WARDEN-WP-0040-T01", + "relationship_type": "starts_after", + "from_workplan_id": "c8ee441e-1be1-5219-910c-e79ff23cc9ec", + "from_task_id": "93eaf1f2-daaa-5e22-8804-85ca9433571c", + "to_workplan_id": null, + "to_task_id": "611f0901-9fb5-5954-8dd0-a860c5f0cbec" + }, + { + "workplan": "WARDEN-WP-0044", + "from": "WARDEN-WP-0044-T04", + "target": "WARDEN-WP-0044-T03", + "relationship_type": "starts_after", + "from_workplan_id": "f7e81013-6868-5d99-8528-ba75a442eca9", + "from_task_id": "4a0fa4a7-5ca9-518a-ab92-a79a5e2cf93e", + "to_workplan_id": null, + "to_task_id": "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89" + }, + { + "workplan": "WARDEN-WP-0044", + "from": "WARDEN-WP-0044-T03", + "target": "MASON-WP-0010-T03", + "relationship_type": "starts_after", + "from_workplan_id": "f7e81013-6868-5d99-8528-ba75a442eca9", + "from_task_id": "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89", + "to_workplan_id": null, + "to_task_id": "56cea6be-c613-586c-80cd-125340b374da" + }, + { + "workplan": "WARDEN-WP-0044", + "from": "WARDEN-WP-0044-T03", + "target": "WARDEN-WP-0044-T02", + "relationship_type": "starts_after", + "from_workplan_id": "f7e81013-6868-5d99-8528-ba75a442eca9", + "from_task_id": "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89", + "to_workplan_id": null, + "to_task_id": "5f68c991-f490-58f8-a121-92f74073d272" + } + ], + "refused": [], + "notes": [] + } + } +} diff --git a/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/receiver-request.json b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/receiver-request.json new file mode 100644 index 00000000..af492cb7 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/receiver-request.json @@ -0,0 +1,24 @@ +{ + "path": "/repos/ops-warden/work-record-projection/reconcile", + "body": { + "expected_commit": "117fec9241e7b985dfb187b992e173d0a5dc3700", + "acknowledge_retirements": false + }, + "headers": { + "Content-Type": "application/json", + "Idempotency-Key": "rmgr-projection:v2:9c183d83370c522a5f9e8622e5e9b203c07ce01753fc033b44d80b36d4c0168f", + "X-StateHub-Source-Agent": "repo-manager" + }, + "health": { + "status": "ok", + "db": "connected", + "instance_role": "primary", + "instance_label": "railiance01", + "schema": { + "status": "ok", + "applied": "c4d5e6f7a8b9", + "expected": "c4d5e6f7a8b9" + } + }, + "normal_publication": "legacy-consistency C-17 pushed 1 backlogged commit; remote exact verified" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/tasks-after.json b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/tasks-after.json new file mode 100644 index 00000000..034e501a --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/tasks-after.json @@ -0,0 +1,94 @@ +[ + { + "workplan_id": "f7e81013-6868-5d99-8528-ba75a442eca9", + "id": "ef0920fc-418e-52cb-acff-9a5c0c728bf5", + "record_id": "WARDEN-WP-0044-T01", + "flavor": null, + "title": "Tasks", + "description": "### T01 \u2014 Define the type's follow-through section\n\nPropose the `follow_through` part of the SecurityCaseType schema together with\nnet-kingdom. For each step it names the owner entry point, `warden_executes`,\nthe auth method and lane, whether an attended human login is unavoidable (with\nthe type's justification), and the verification command. Write it for the first\ntype, `oidc-browser-relying-party`, covering key-cape client registration,\ncustody minting and LLDAP group membership.\n\n2026-10-08: NK-WP-0048-T03/T04 landed with a drafted section. Review is in\n`history/2026-10-08-oidc-rp-follow-through-review.md`. It requires three\nchanges before T02: a per-step `lane`, a narrow `warden_executes`, and\n`value_handling`. It also lists four refinements. This task is done when\nnet-kingdom acknowledges the review (NK-WP-0048-T05).\n\n2026-10-09: R4 was withdrawn in favour of ops-mason's per-case\n`{consuming_service}-keycape-client`, with the entry body templated in the type\n(R4\u2032, see the addendum in the review).\n\n2026-10-09: the revised 1.0 type and canon now carry R1\u2013R3, R4\u2032, R5\u2013R7.\n`warden case check-type ` (`src/warden/case_type.py`, tests in\n`tests/test_case_type.py`) checks a type's follow-through mechanically: the\nlive type is schema-conformant, with one attended session\n(`key-cape-oidc-login`). It is not yet plannable, because two lanes are not\nin the catalog: `identity-provisioner-groups` (net-kingdom) and\n`keycape-client-secret-generate` (railiance-platform). These gate T02, not\nT01. T01 still closes on net-kingdom's acknowledgement (NK-WP-0048-T05).\n\n2026-10-09: ops-warden cannot add `identity-provisioner-groups` as the type\ndeclares it. The provisioner accepts only user-engine's runtime token and\nadmits only user-engine pods, so no caller-identity path exists. R8 (review\naddendum) asks net-kingdom either to move `ensure-groups` into the existing\nattended session (recommended) or to give the provisioner an operator\ncredential. `keycape-client-secret-generate` needs a generate-in-custody entry\npoint from railiance-platform, and the broker does not have one yet. Both were\nsent to their owners.\n\n2026-10-09: done. net-kingdom took R8 option 1, so `ensure-groups` runs attended\nin the `register-client` session and `identity-provisioner-groups` is dropped\n(net-kingdom `0e86f95`). The founder acknowledged the type with memo r4 (hub\ndecision `e418263e`, NK-WP-0048-T05 done).", + "status": "done", + "priority": "high", + "assignee": null, + "due_date": null, + "blocking_reason": null, + "needs_human": false, + "intervention_note": null, + "decision_id": null, + "blocked_on": null, + "wait_until": null, + "parent_task_id": null, + "wait_kind": null, + "created_at": "2026-10-08T20:18:57.487362Z", + "updated_at": "2026-10-15T02:25:32.031044Z", + "workstream_id": "f7e81013-6868-5d99-8528-ba75a442eca9" + }, + { + "workplan_id": "f7e81013-6868-5d99-8528-ba75a442eca9", + "id": "5f68c991-f490-58f8-a121-92f74073d272", + "record_id": "WARDEN-WP-0044-T02", + "flavor": null, + "title": "T01 \u2014 Define the type's follow-through section", + "description": null, + "status": "done", + "priority": "high", + "assignee": null, + "due_date": null, + "blocking_reason": null, + "needs_human": false, + "intervention_note": null, + "decision_id": null, + "blocked_on": null, + "wait_until": null, + "parent_task_id": null, + "wait_kind": null, + "created_at": "2026-10-08T20:18:57.597629Z", + "updated_at": "2026-10-15T02:25:32.031044Z", + "workstream_id": "f7e81013-6868-5d99-8528-ba75a442eca9" + }, + { + "workplan_id": "f7e81013-6868-5d99-8528-ba75a442eca9", + "id": "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89", + "record_id": "WARDEN-WP-0044-T03", + "flavor": null, + "title": "T02 \u2014 Plan a case run", + "description": null, + "status": "progress", + "priority": "high", + "assignee": null, + "due_date": null, + "blocking_reason": "Local durable execution kernel and injected failure harness implemented. Native acceptance still requires authenticated owner machine descriptors/adapters, actual Forgejo materialization receipt, contained session integration, ordered verification and first native run.", + "needs_human": false, + "intervention_note": null, + "decision_id": null, + "blocked_on": null, + "wait_until": null, + "parent_task_id": null, + "wait_kind": null, + "created_at": "2026-10-08T20:18:57.716842Z", + "updated_at": "2026-10-15T02:25:32.031044Z", + "workstream_id": "f7e81013-6868-5d99-8528-ba75a442eca9" + }, + { + "workplan_id": "f7e81013-6868-5d99-8528-ba75a442eca9", + "id": "4a0fa4a7-5ca9-518a-ab92-a79a5e2cf93e", + "record_id": "WARDEN-WP-0044-T04", + "flavor": null, + "title": "T03 \u2014 Run and verify a case", + "description": null, + "status": "wait", + "priority": "medium", + "assignee": null, + "due_date": null, + "blocking_reason": "Catalog integration follows a proven run.", + "needs_human": false, + "intervention_note": null, + "decision_id": null, + "blocked_on": null, + "wait_until": null, + "parent_task_id": null, + "wait_kind": "external", + "created_at": "2026-10-08T20:18:57.836839Z", + "updated_at": "2026-10-15T02:25:32.031044Z", + "workstream_id": "f7e81013-6868-5d99-8528-ba75a442eca9" + } +] diff --git a/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/tasks-before.json b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/tasks-before.json new file mode 100644 index 00000000..034e501a --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/tasks-before.json @@ -0,0 +1,94 @@ +[ + { + "workplan_id": "f7e81013-6868-5d99-8528-ba75a442eca9", + "id": "ef0920fc-418e-52cb-acff-9a5c0c728bf5", + "record_id": "WARDEN-WP-0044-T01", + "flavor": null, + "title": "Tasks", + "description": "### T01 \u2014 Define the type's follow-through section\n\nPropose the `follow_through` part of the SecurityCaseType schema together with\nnet-kingdom. For each step it names the owner entry point, `warden_executes`,\nthe auth method and lane, whether an attended human login is unavoidable (with\nthe type's justification), and the verification command. Write it for the first\ntype, `oidc-browser-relying-party`, covering key-cape client registration,\ncustody minting and LLDAP group membership.\n\n2026-10-08: NK-WP-0048-T03/T04 landed with a drafted section. Review is in\n`history/2026-10-08-oidc-rp-follow-through-review.md`. It requires three\nchanges before T02: a per-step `lane`, a narrow `warden_executes`, and\n`value_handling`. It also lists four refinements. This task is done when\nnet-kingdom acknowledges the review (NK-WP-0048-T05).\n\n2026-10-09: R4 was withdrawn in favour of ops-mason's per-case\n`{consuming_service}-keycape-client`, with the entry body templated in the type\n(R4\u2032, see the addendum in the review).\n\n2026-10-09: the revised 1.0 type and canon now carry R1\u2013R3, R4\u2032, R5\u2013R7.\n`warden case check-type ` (`src/warden/case_type.py`, tests in\n`tests/test_case_type.py`) checks a type's follow-through mechanically: the\nlive type is schema-conformant, with one attended session\n(`key-cape-oidc-login`). It is not yet plannable, because two lanes are not\nin the catalog: `identity-provisioner-groups` (net-kingdom) and\n`keycape-client-secret-generate` (railiance-platform). These gate T02, not\nT01. T01 still closes on net-kingdom's acknowledgement (NK-WP-0048-T05).\n\n2026-10-09: ops-warden cannot add `identity-provisioner-groups` as the type\ndeclares it. The provisioner accepts only user-engine's runtime token and\nadmits only user-engine pods, so no caller-identity path exists. R8 (review\naddendum) asks net-kingdom either to move `ensure-groups` into the existing\nattended session (recommended) or to give the provisioner an operator\ncredential. `keycape-client-secret-generate` needs a generate-in-custody entry\npoint from railiance-platform, and the broker does not have one yet. Both were\nsent to their owners.\n\n2026-10-09: done. net-kingdom took R8 option 1, so `ensure-groups` runs attended\nin the `register-client` session and `identity-provisioner-groups` is dropped\n(net-kingdom `0e86f95`). The founder acknowledged the type with memo r4 (hub\ndecision `e418263e`, NK-WP-0048-T05 done).", + "status": "done", + "priority": "high", + "assignee": null, + "due_date": null, + "blocking_reason": null, + "needs_human": false, + "intervention_note": null, + "decision_id": null, + "blocked_on": null, + "wait_until": null, + "parent_task_id": null, + "wait_kind": null, + "created_at": "2026-10-08T20:18:57.487362Z", + "updated_at": "2026-10-15T02:25:32.031044Z", + "workstream_id": "f7e81013-6868-5d99-8528-ba75a442eca9" + }, + { + "workplan_id": "f7e81013-6868-5d99-8528-ba75a442eca9", + "id": "5f68c991-f490-58f8-a121-92f74073d272", + "record_id": "WARDEN-WP-0044-T02", + "flavor": null, + "title": "T01 \u2014 Define the type's follow-through section", + "description": null, + "status": "done", + "priority": "high", + "assignee": null, + "due_date": null, + "blocking_reason": null, + "needs_human": false, + "intervention_note": null, + "decision_id": null, + "blocked_on": null, + "wait_until": null, + "parent_task_id": null, + "wait_kind": null, + "created_at": "2026-10-08T20:18:57.597629Z", + "updated_at": "2026-10-15T02:25:32.031044Z", + "workstream_id": "f7e81013-6868-5d99-8528-ba75a442eca9" + }, + { + "workplan_id": "f7e81013-6868-5d99-8528-ba75a442eca9", + "id": "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89", + "record_id": "WARDEN-WP-0044-T03", + "flavor": null, + "title": "T02 \u2014 Plan a case run", + "description": null, + "status": "progress", + "priority": "high", + "assignee": null, + "due_date": null, + "blocking_reason": "Local durable execution kernel and injected failure harness implemented. Native acceptance still requires authenticated owner machine descriptors/adapters, actual Forgejo materialization receipt, contained session integration, ordered verification and first native run.", + "needs_human": false, + "intervention_note": null, + "decision_id": null, + "blocked_on": null, + "wait_until": null, + "parent_task_id": null, + "wait_kind": null, + "created_at": "2026-10-08T20:18:57.716842Z", + "updated_at": "2026-10-15T02:25:32.031044Z", + "workstream_id": "f7e81013-6868-5d99-8528-ba75a442eca9" + }, + { + "workplan_id": "f7e81013-6868-5d99-8528-ba75a442eca9", + "id": "4a0fa4a7-5ca9-518a-ab92-a79a5e2cf93e", + "record_id": "WARDEN-WP-0044-T04", + "flavor": null, + "title": "T03 \u2014 Run and verify a case", + "description": null, + "status": "wait", + "priority": "medium", + "assignee": null, + "due_date": null, + "blocking_reason": "Catalog integration follows a proven run.", + "needs_human": false, + "intervention_note": null, + "decision_id": null, + "blocked_on": null, + "wait_until": null, + "parent_task_id": null, + "wait_kind": "external", + "created_at": "2026-10-08T20:18:57.836839Z", + "updated_at": "2026-10-15T02:25:32.031044Z", + "workstream_id": "f7e81013-6868-5d99-8528-ba75a442eca9" + } +] diff --git a/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/verification.json b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/verification.json new file mode 100644 index 00000000..f1eb1c88 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/warden-source-projection-r4/verification.json @@ -0,0 +1,47 @@ +{ + "status": "published-and-projected", + "commit": "117fec9241e7b985dfb187b992e173d0a5dc3700", + "instance_role": "primary", + "instance_label": "railiance01", + "consistency": { + "exit_code": 0, + "fail": 0, + "warn": 8, + "no_writeback": true + }, + "unrelated_files_and_index_preserved": 53, + "restore_needed": false, + "four_original_tasks_preserved": [ + { + "task": "WARDEN-WP-0044-T01", + "uuid": "ef0920fc-418e-52cb-acff-9a5c0c728bf5", + "status": "done" + }, + { + "task": "WARDEN-WP-0044-T02", + "uuid": "5f68c991-f490-58f8-a121-92f74073d272", + "status": "done" + }, + { + "task": "WARDEN-WP-0044-T03", + "uuid": "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89", + "status": "progress" + }, + { + "task": "WARDEN-WP-0044-T04", + "uuid": "4a0fa4a7-5ca9-518a-ab92-a79a5e2cf93e", + "status": "wait" + } + ], + "projection_side_effects": { + "retired": 0, + "cancelled_tasks": 0, + "created_tasks": [ + "WARDEN-WP-0038-T01" + ], + "note": "Canonical forge-derived receiver created existing source WP38-T01 projection deterministically; no source UUID writeback or unrelated source commit." + }, + "native_actions": false, + "root_supervision_or_R3_modified": false, + "remaining_blocker": "Normal rmgr allocator still proposes unrelated missing source UUID on finished WP38-T01; refusal retained, no manual UUID assignment." +} diff --git a/docs/changes/netkingdom-target-2026-10-17/wp49-sops-successor-r1/NK-WP-0049.preimage.md b/docs/changes/netkingdom-target-2026-10-17/wp49-sops-successor-r1/NK-WP-0049.preimage.md new file mode 100644 index 00000000..0b2f4dae --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/wp49-sops-successor-r1/NK-WP-0049.preimage.md @@ -0,0 +1,1186 @@ +--- +id: NK-WP-0049 +type: workplan +title: "Remove bootstrap secret output and verify separated recovery custody" +domain: infotech +repo: net-kingdom +status: active +owner: codex +topic_slug: netkingdom +created: "2026-10-12" +updated: "2026-10-17" +flavor: implementation +depends_on: [] +state_hub_workstream_id: "17d315f0-829e-57c7-85cc-3a7914152804" +--- + +Native owner work for CUST-WP-0080 G08. This workplan remains active until the +remaining caller, service-recovery and custody acceptance gates are satisfied. +NK-WP-0045 covers the non-secret root-grant record. Founder-deferred exposure +rotation remains in CUST-WP-0073-T05; this plan does not silently reopen it. + +**Replanned 2026-10-16 at the operator's request:** substantial completed work is +now represented by completed tasks, and remaining work has separate deliverables, +dependencies and acceptance criteria. T01–T03 retain their historical IDs and Hub +UUIDs. Completed parts of the old T02/T03 umbrellas are extracted into T04–T14; +T02 now covers the current-caller ledger and T03 retains final owner acceptance. +These are retrospective task records of evidenced work, not additional delivery +or newly granted authority. The earlier dated narrative remains in Git at +`cc2dd01`; its evidence references are carried into the tasks below. + +**Current position, source refinement 2026-10-17:** 24 tasks done; 4 in +progress; 1 ready to start (`todo`); 7 waiting on explicit prerequisites. These are task counts, not an effort-based +completion percentage. Assignees are also written in task descriptions because +the current Forge projector does not populate the dedicated Hub assignee field. The outage-retrieval tool and restore-packet draft are now prepared; +independent outage retrieval and Storage Share publication are accepted; +service admission remains an explicit gate. + +**Next actions:** finish the read-only caller ledger (T02); admit the drafted +isolated restore packet (T15) and record residual-scope handoffs (T24). +Independent outage retrieval (T23) and guide publication (T26) are done. After owner admission, execute the individual native service and +caller checks. A task's owner is accountable for the result; another repository's +approval or credential grant still requires its own owner path. + +**Closure:** T03 assembles owner acceptance after its named dependencies pass. +Passing archive recovery does not prove existing-user authentication, retained +MFA-token decryption, historical audit signatures or current caller admission. +The verified backup job stays active while those separate tasks are completed. + +## Remove secret-bearing output and ambient root discovery + +```task +id: NK-WP-0049-T01 +status: done +priority: high +assignee: codex +state_hub_task_id: "d7ca8d5f-c5ff-5cba-bd25-038cb53ffe4e" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +2026-10-12: regression reproduced emergency/reprint root export, generation +prefix disclosure, permissive file modes, dry-run side effects and unattended +entry. Replaced emergency export with a non-secret guide (legacy secret-input +arguments refused), suppressed generation prefixes/tracing and set private +permissions. Bootstrap requires the registered public recipient and an attended +terminal; never generates/discovers a permanent private key. Encrypted resume +requires an explicit matching temporary custody key before cluster activity. +Dry-run is a non-mutating plan. The live cluster/apply path was not executed. + +A fresh uniquely named encrypted ops bundle follows apply; old delivery flags +cannot skip current acknowledgment. New acknowledgment state binds its SHA256 +and timestamp. Declining stops before cleanup/completion. This is an operator +statement, not an independent restore receipt. Historical fields remain unchanged. +Make/help/status/console and current credential guidance reflect that distinction. +Evidence and exact source manifest: Custodian +`docs/evidence/2026-10-12-netkingdom-security/bootstrap-handoff.json`. + +## Harden custody, SOPS and rotation source entry points + +```task +id: NK-WP-0049-T04 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T01] +state_hub_task_id: "04c4e8be-5bd8-5d5c-99b1-79d8ae758462" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Completed 2026-10-12–13. Public-recipient-only encryption, explicit temporary +custody, private no-overwrite output, sanitized diagnostics, stdin-only secret +transport and failed-operation cleanup replace ambient-key and output paths. +SOPS read/edit/data-key rotation preserve recipient/MAC/source-version guards; +component rotations preserve unrelated fields and retain recovery candidates. +This records source and disposable-native proof, not live rotation or revocation. + +Evidence: Custodian `docs/evidence/2026-10-12-netkingdom-security/` receipts +`custody-entrypoints.json`, `sops-make-entrypoints.json`, `rotation-output.json`, +and `admin-bootstrap.json`; October13 `sops-write-callers.json`. + +## Repair component, diagnostic, LDAP and resolver callers + +```task +id: NK-WP-0049-T05 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T04] +state_hub_task_id: "e8e38f42-609e-5c07-a8e6-e73c8eb4ae95" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Completed 2026-10-13–14. Repaired KeyCape configuration and component Secret +publication, original privacyIDEA key export/restore transport, scoped MFA +counts, LDAP group maintenance and configuration-preserving resolver cutover. +Retired unsafe personal-token mint/refresh and direct LDAP lifecycle shortcuts. +Disposable native PI/LLDAP tests and source regressions passed; estate provider +admission, historical credential validity and service authentication remain T21/T22. + +Evidence: Custodian October13 `keycape-caller-reconciliation.json`, +`service-secret-callers.json`, `privacyidea-key-custody.json`, +`mfa-state-diagnostic.json`, `realm-bootstrap-repair.json`; October14 +`legacy-lldap-retirement.json`, `platform-group-boundary.json`, +`lldap-group-maintenance.json`, `resolver-cutover.json` under the corresponding +`docs/evidence/YYYY-MM-DD-netkingdom-security/` directories. + +## Inventory source callers and retire remaining unsafe delivery paths + +```task +id: NK-WP-0049-T06 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T04, NK-WP-0049-T05] +state_hub_task_id: "a5f50891-c5b2-513b-8670-e1915ee52015" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Completed 2026-10-15. Enumerated all 87 current non-test shell/Python callers +in the declared bootstrap/k8s scope plus Make/console/delivery adapters. Repaired +streamed encrypted bundle publication and fail-closed bootstrap/lab paths; +retired unsafe delivery copiers, root prompts, registry patchers and stale +rollback recipes. The attended inventory records source dispositions and their +native-proof limits. T02 separately maps these to current live users/owners. + +Evidence: [caller inventory](../docs/evidence/2026-10-15-bootstrap-recovery/caller-source-inventory.json), +[attended procedures](../docs/attended-procedure-inventory.md) and the October15 +recovery evidence directory. No live production bootstrap or lab-init acceptance +is claimed. + +## Discover off-host coverage and recover the existing PI database + +```task +id: NK-WP-0049-T07 +status: done +priority: high +assignee: codex +state_hub_task_id: "2d7302a2-319a-5633-bf58-d51ccd25ebf6" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Completed 2026-10-15–16. Bounded Storage Share/Scaleway inventories identified +existing database coverage and the missing full identity bundle. The operator +independently matched the backup recipient, then recovered the exact existing +PI dump: correct-key decryption, wrong-key refusal, isolated native PostgreSQL +restore/readback and cleanup passed (5 tokens, 2 resolvers, 2 realms). + +Evidence: October15 recovery `offsite-discovery-summary.json`, +`privacyidea-transfer-r1.json`, `privacyidea-database-drill-r1.json`, +`database-drill-review.json`. This database-only proof led to T08–T14. + +## Implement the full identity capture and archive recovery toolchain + +```task +id: NK-WP-0049-T08 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T06, NK-WP-0049-T07] +state_hub_task_id: "317ca173-c784-5329-9810-5e3d300604b8" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Completed 2026-10-16. Defined exact LLDAP/Authelia/KeyCape/privacyIDEA assets, +Deployment/PVC/reference bindings, original keys and snapshot consistency limits. +Implemented native SQLite/PG capture, streamed age sealing, strict data-bearing +manifest checks, provider readback, independent retrieval, bounded retention, +root runtime and attended archive verifier. All 56 focused checks passed, +including actual synthetic encrypted/native PostgreSQL recovery. + +Evidence: [profile](../tools/bootstrap-recovery/identity-backup-profile.json), +[implementation review](../docs/evidence/2026-10-16-identity-backup-implementation/review.json), +and the live evidence's tested ESO-default/host-binding corrections. Production +archive recovery is separately evidenced in T13. + +## Admit and verify the two scoped backup credential deliveries + +```task +id: NK-WP-0049-T09 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T08] +state_hub_task_id: "4a47eb2a-7e42-5ae7-9df1-f5ede746eca1" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Completed 2026-10-16. Platform CCR-2026-0048/0049 are verified. The operator +approved folder-only provider-normalized publisher21/retention25 rights, including +re-sharing, in addition to the original rollout. Coding-agent denials precede KV +publication. Exact 900-second single-policy readers, wrong-SA/namespace/audience +rejection, metadata/sibling/old-escrow/token-create denials, ESO equality and +reader/session revocation passed. Operator passwords and age private keys are +not job credentials. + +Evidence: live `publisher-setup-verified.json`, `retention-setup-verified.json`, +`publisher-native-delivery-verified.json`, `retention-native-delivery-verified.json`; +approval decisions `40bfae40-6108-4e51-8613-073339f5345f` and +`5edd5203-fae7-461b-8775-5d22b7873971`; Platform CCR files. + +## Apply capture isolation and install the guarded node runtime + +```task +id: NK-WP-0049-T10 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T08, NK-WP-0049-T09] +state_hub_task_id: "0519444c-d559-5455-aa27-8c5dc8b832b0" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Completed 2026-10-16. Applied exact UID/resource-version/spec-guarded DNS +selector exclusions, preserving ordinary service matches. Capture refuses any +remaining helper allow policy. Installed immutable runtime sources bound to the +actual hostname, machine identity and cluster UID. Disabled-unit replacement +checked previous contents and retained rollback bytes. Health unit validation +passed. Activation remained gated until T13. + +Evidence: live `isolation-applied.json`, `capture-ready-plan.json`, +`installed-runtime-packet-r2.json`, `upgrade-disabled-runtime.py`. Actual complete +hardened-job execution is recorded in T14. + +## Connect recovery to Railiance bootstrap and reuse discovery + +```task +id: NK-WP-0049-T11 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T08] +state_hub_task_id: "d69af493-4026-56a8-a526-c267d90dce18" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Completed 2026-10-16. Added the Railiance bootstrap `identity-recovery` +dispatcher and independent-custody → isolated verification → layer/service-owner +handoff. Updated `capability.security.bootstrap-recovery`, linked bootstrap +sequencing and composed reuse-surface federation. Keyword discovery for identity +backup, restore, privacyIDEA and disaster recovery was verified. The operator +actually used this handoff in T13. No unattended production importer is claimed. + +Evidence: [ceremony](../docs/bootstrap-recovery-ceremony.md), owning capability +entry, `railiance-bootstrap/docs/identity-recovery.md`, bootstrap commit `d1dcfde` +and reuse-surface federation commit `662782e`. + +## Create and verify the first full off-host identity bundle + +```task +id: NK-WP-0049-T12 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T09, NK-WP-0049-T10] +state_hub_task_id: "decb415a-8012-521c-9dbe-d73c6ff0bbfb" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Completed 2026-10-16. Captured original service keys/current data plus the +linked native PI database dump, sealed and published a unique Storage Share +artifact, then downloaded it and verified size/digest before publishing its index. +Helper and plaintext cleanup passed. Artifact: +`net-kingdom-identity-20261016T063159Z-5882771aa2ce.tar.age` (109738344 bytes). + +Evidence: live `actual-capture.json`, `actual-offsite.json`; ciphertext SHA256 +`7117b3fe1e4840c86b301c94c85e6b16709e5626bb0884bd0580bde630e30e30`. +No age private key was needed by the capture job. + +## Independently retrieve and recover the complete actual archive + +```task +id: NK-WP-0049-T13 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T11, NK-WP-0049-T12] +state_hub_task_id: "602d4921-cfac-5e5b-9993-4fbf67195c7d" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Completed 2026-10-16. Independently downloaded the exact first generation +through attended Backup-account custody, rehashed it locally and revoked the +session. The operator used the independently held age key through the bootstrap +handoff. Correct/wrong-key cases, all 36 manifest files/hashes, original RSA pairs, +SQLite integrity and isolated native PG16.14 restore/readback passed; plaintext +and containers were removed. No key or restored secret values reached the agent. + +Evidence: live `independent-owner-transfer.json`, `actual-full-archive-recovery.json`, +`actual-full-recovery-review.json`. Existing-user/MFA authentication and old audit +signatures are deliberately separate T16–T20 outcomes. + +## Activate and prove the complete recurring backup and retention job + +```task +id: NK-WP-0049-T14 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T10, NK-WP-0049-T13] +state_hub_task_id: "eaf0708f-b3b7-5531-8172-95edf30c3a19" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Completed 2026-10-16 after T13. Both daily backup/retention and hourly health +timers are enabled/active. The actual hardened systemd service passed retention +before/after a second capture/upload/download (Result=success, ExecMainStatus=0). +Both verified generations are retained, the independently recovered point is +pinned, and nothing was deleted. Helpers/plaintext were cleaned; failure markers +and reporting outbox are empty. Health check succeeded. + +Evidence: live `activation-result.json`, `activation-review.json`, +`recurring-job-review.json`. Cadence: daily 03:45 UTC plus up to 5 minutes jitter, +hourly health, 25-hour freshness bound. Second-provider/host-loss gaps go to T24; +this completed task is not a full-estate recovery claim. + +## Map current callers, owners and native acceptance gaps + +```task +id: NK-WP-0049-T02 +status: progress +priority: high +assignee: codex +depends_on: [NK-WP-0049-T06] +state_hub_task_id: "479d6970-6516-50f5-9436-bb5b56d58aad" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +The source inventory and known legacy objects exist; a complete current-use +ledger is not yet accepted. Next action is read-only reconciliation of the 93 +entries in the latest October15 source inventory (the earlier snapshot had 87) against active Make/bootstrap/operator routes and owner evidence. + +**Done when:** each entry is identified as current, retired or owner-deferred, +with its owner, credential route, current consumer(s), native evidence or exact +missing proof, and next responsible task. Explicitly cover the historical +`sso/keycape-pi-token` and `mfa/privacyidea-trigger-admin` objects, lab init, +factor diagnostic delivery, LDAP group/provider boundary, resolver cutover and +root-output/isolation boundaries. Secret presence is not credential validity. +Send current native checks to T21 and historical revocation/rotation decisions to +T22. Do not reopen completed source repairs without a new finding. + +## Prepare the isolated full-service restore and acceptance packet + +```task +id: NK-WP-0049-T15 +status: progress +priority: high +assignee: codex +depends_on: [NK-WP-0049-T08, NK-WP-0049-T13, NK-WP-0049-T27, NK-WP-0049-T28, NK-WP-0049-T29, NK-WP-0049-T30] +state_hub_task_id: "1d1eb903-a4b0-5bc4-a421-0b842d7f68ae" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +**Prepared draft scope moved to T27.** See +`docs/identity-service-restore-packet.md`: restore order, containment, safe evidence +and per-service positive/negative checks are drafted. Read-only current runtime +image digests were observed for all four services; correspondence to the selected +archive and independent image availability are not yet proved. + +**Next action:** admit a named disposable target/private route, verify and stage +matching images independently, obtain private existing-user/MFA test inputs and +review version-specific native commands with service owners. Incorporate T02's +ledger before submitting current-caller acceptance. + +2026-10-16 checkpoint: T28 completed the exact local image save/load/inspect +and T29 prepared and natively tested the bounded LLDAP stage. Its actual owner +run is T16 and can proceed independently of the remaining multi-service packet. +The other service adapters, matching archive/runtime lineage and private +existing-user/MFA inputs are still required; no blanket T15 completion is claimed. + +**Done when:** service owners accept the exact targets/procedure, existing-user +and MFA test identities/input custody are available without posting secrets, +outbound notification/provider writes are disabled, and every required new +credential or production effect has its own owner decision. The verifier deletes +its plaintext; it is not a production importer. This task prepares authority and +inputs for T16–T20, not an automatic production restore. + +## Prove restored LLDAP directory and existing-user authentication + +```task +id: NK-WP-0049-T16 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T13, NK-WP-0049-T29] +state_hub_task_id: "b64d4d6a-e851-58d1-9929-f03343147de0" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Owner boundary: NetKingdom directory/User Engine owners. Restore the captured +original directory/configuration in the admitted isolated environment. + +**Done when:** user, group and membership identities are preserved; an independently +supplied existing-user credential authenticates; a wrong credential is refused; +provider writes/outbound effects stay confined; cleanup is verified. Native +fixtures from T05 and SQLite integrity from T13 do not satisfy this current-data +acceptance. Record only safe counts, identities and outcomes. + + +Completed 2026-10-16 at 18:37 UTC. The operator privately supplied the +independent age key and an existing backup-era account credential to the exact +local executor. All 36 archive hashes and the known ciphertext/source/target +bindings matched. Native existing-user LDAP bind passed; explicit invalid +credentials were rejected. The original seven users, 17 groups, 13 memberships +and the available attribute/schema rows were preserved across service startup, +authentication and graceful shutdown. The container had only loopback/no +external routes; pre-import isolation and container/tmpfs cleanup passed. +No production endpoint was contacted or secret exported to the agent. + +Evidence: `actual-isolated-lldap-recovery.json` and +`actual-isolated-lldap-review.json` in +`docs/evidence/2026-10-16-identity-outage-recovery/`. This closes the actual +LLDAP stage independently of the remaining T15 packet. It does not prove +Authelia/KeyCape authentication, retained-token MFA or audit continuity. T17, +T18 and T19 retain their remaining adapter/input prerequisites. + +## Prove restored Authelia storage and OIDC continuity + +```task +id: NK-WP-0049-T17 +status: wait +priority: high +assignee: codex +depends_on: [NK-WP-0049-T15, NK-WP-0049-T16] +blocking_reason: "LLDAP recovery T16 passed; await the exact isolated Authelia adapter/procedure and private authentication-flow inputs from T15." +state_hub_task_id: "b47f9975-d6d7-5bb8-93ce-886deb1dfa70" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Owner boundary: SSO/Authelia and directory owners. Restore the original storage, +encryption/session/signing material and configuration in isolation. + +**Done when:** native storage decryption succeeds, issuer/signing identity and +client configuration are preserved, and an isolated authentication flow has +positive/negative results using the restored directory. Disable outbound +notifications and verify cleanup. Archive integrity/RSA parsing alone are not +native Authelia acceptance. + +## Prove retained privacyIDEA token decryption and existing-token MFA + +```task +id: NK-WP-0049-T19 +status: wait +priority: high +assignee: codex +depends_on: [NK-WP-0049-T15, NK-WP-0049-T16, NK-WP-0049-T31] +blocking_reason: "LLDAP T16, token-material T31 and audit T20 passed; await the exact isolated MFA adapter and owner-selected retained-token/factor inputs." +state_hub_task_id: "6f8af1a7-2a3f-5fa8-8202-83103ebd55b2" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Owner boundary: MFA/privacyIDEA and directory owners. Use the exact linked dump +and original enckey from the independently recovered generation. + +**Done when:** retained token material decrypts inside the isolated process, +a selected existing token completes a native MFA check, a wrong key/code is +refused, and cleanup is verified. Obtain any token/user input through attended +private custody; never emit token plaintext, seeds or credentials. Native database +row counts and disposable synthetic-token fixtures do not prove this outcome. + + +2026-10-16 refinement: native token-material readback is separately tracked in +T31 using the prepared T30 executor. T19 retains actual existing-token MFA and +wrong-code/wrong-key authentication refusal. Internal decryption or padding +success does not authenticate a user. No MFA code is needed for T20/T31; the +selected user's private factor input and exact isolated MFA adapter remain T19. + +## Prove historical and new privacyIDEA audit-signature continuity + +```task +id: NK-WP-0049-T20 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T13, NK-WP-0049-T30] +state_hub_task_id: "375fa8f9-b8a5-5048-97a7-ec141aa7c45d" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Owner boundary: MFA/privacyIDEA audit owner. Use the original recovered audit +pair and linked database in the admitted isolated target. + +**Done when:** existing pre-backup audit signatures are verified natively, a new +isolated audit entry is signed and verified with the preserved identity, a wrong +key fails, and cleanup is recorded. Report any historical verification failure +for explicit owner disposition; do not regenerate keys to hide it. Matching RSA +pairs from T13 are a prerequisite, not audit-history verification. + + +Completed 2026-10-16 at 19:10 UTC using the actual independently retrieved +bundle and original audit identity on the fixed isolated local engine. All +279,209 stored rows were signed and verified; zero unsigned, invalid or legacy +signatures. A new isolated entry verified, and tampering/unrelated-public-key +checks were refused. Container/plaintext cleanup passed. Receipt and reviewed +source/ciphertext/target bindings: `actual-isolated-privacyidea-recovery.json` +and `actual-isolated-privacyidea-review.json` in +`docs/evidence/2026-10-16-identity-outage-recovery/`. +Stored-row continuity is accepted; event completeness and existing-token MFA +are separate and are not claimed. + +## Prove restored KeyCape issuer, policy and consumer continuity + +```task +id: NK-WP-0049-T18 +status: wait +priority: high +assignee: codex +depends_on: [NK-WP-0049-T15, NK-WP-0049-T16, NK-WP-0049-T19, NK-WP-0049-T32, NK-WP-0049-T33] +blocking_reason: "Source and synthetic KeyCape lifecycle proof are delivered in T32; await exact owner-held recovery attempt preparation T33, selected consumer acceptance and retained-token MFA for the selected flow." +state_hub_task_id: "141dd773-c1fa-56c1-a852-bbe2372e5125" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Owner boundary: KeyCape and the selected current consumer owners. Restore the +original signing/configuration, registry, authentication policies and receipts. + +**Done when:** issuer/JWKS signing identity, registry/client configuration and +policy/receipt continuity are preserved; selected current consumers pass native +positive/negative authentication using the restored dependencies; and isolation +and cleanup hold. Confirm the actual dependency graph in T15. Do not route a +production consumer to the isolated issuer or mint new client grants implicitly. + +## Verify current caller and provider admission at their actual boundaries + +```task +id: NK-WP-0049-T21 +status: wait +priority: high +assignee: codex +depends_on: [NK-WP-0049-T02] +blocking_reason: "Await the current-caller ledger and exact per-caller owner admission/test inputs; the backup credential grants do not admit unrelated callers." +state_hub_task_id: "77aa42be-7a39-5d93-8042-03d78b4094b4" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Owner boundary: each current caller's service/provider and credential owner. +Use T02's ledger to select the exact current procedures and required owner lanes. + +**Done when:** each current caller has scoped delivery and native positive/negative +acceptance or an explicit accepted retirement/disposition. Include dedicated +factor-diagnostic admission (do not borrow KeyCape's reader), deployed reserved +LDAP group denial, resolver/cutover input provenance and functional proof, and +bootstrap/root-output/isolation callers. Fixtures, an existing tty and historical +bootstrap receipts are not current authority. Propose exact write/cutover actions +before execution; record deferred actions separately rather than faking a pass. + +## Resolve historical credential and configuration-preserving rotation dispositions + +```task +id: NK-WP-0049-T22 +status: wait +priority: high +assignee: codex +depends_on: [NK-WP-0049-T02, NK-WP-0049-T21] +blocking_reason: "Await the caller/consumer ledger, current replacement-lane acceptance and explicit credential-owner dispositions; existing exposure-rotation deferral is unchanged." +state_hub_task_id: "3ea6bf00-a87f-58ea-bdce-328c13a03a55" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Owner boundary: Platform/custody and affected consumer owners. Review historical +personal-admin/trigger credential copies and unsafe predecessor paths against +known current consumers and rollback custody. + +**Done when:** every affected credential has an owner-accepted disposition: +verified revocation/replacement, continued bounded use with acceptance, or an +explicit linked deferral. Signing/client-secret changes require preservation and +native multi-consumer proof if actually approved. CUST-WP-0073-T05's founder +rotation deferral and decision `1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa` remain in force; +record their exact applicability rather than automatically rotating or treating +source retirement as provider revocation. + +## Provide retrieval that works when OpenBao and SSO are unavailable + +```task +id: NK-WP-0049-T23 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T13, NK-WP-0049-T25] +state_hub_task_id: "1ec537ee-dfee-5576-be36-a81bdba417d1" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Completed 2026-10-16 at 18:02 UTC. The operator used independently held Backup +account access in the private prompt. The actual protected 109,738,344-byte +ciphertext was downloaded with unchanged ETag/size/SHA256, with no OpenBao/SSO +contact or provider writes by the retrieval path. The human-held age key matched +the registered recipient; wrong-key refusal, all 36 manifest hashes, SQLite +integrity, original key pairs and native isolated PostgreSQL 16.14 restore passed. +The database retained five token, two resolver and two realm rows. Disposable +container and temporary plaintext cleanup passed. The agent received no secret. + +Evidence: `actual-offline-transfer.json`, `actual-offline-recovery.json` and +`actual-offline-review.json` under +`docs/evidence/2026-10-16-identity-outage-recovery/`. The review rechecked the +local ciphertext digest and verifier source. This proves the independent path +without requiring a deliberate production outage. Service authentication, +retained-token decryption and historical audit verification remain T16–T20. +T26 separately records accepted guide publication. + +## Record owner disposition for second-provider and external monitoring gaps + +```task +id: NK-WP-0049-T24 +status: todo +priority: medium +assignee: codex +depends_on: [NK-WP-0049-T14] +state_hub_task_id: "474f5a78-a643-59c6-bcf9-fc4a908dfcb0" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +**Next action:** record the current single-provider and host-local-health limits, +then obtain explicit owner scope decisions for a second encrypted provider copy, +external host-loss/freshness detection and recurring recovery-drill cadence. + +**Done when:** each gap has either an accepted bounded residual risk or a linked +live intake/workplan with owner and trigger. Existing daily RPO/25-hour health +settings remain the approved baseline. Scaleway full-identity publication and +an external watchdog are not implemented; do not add their grants/jobs implicitly. +This task triages the new insights instead of silently expanding NK49's required +implementation to an entire disaster-recovery programme. + +## Deliver and verify the offline retrieval adapter and recovery tools kit + +```task +id: NK-WP-0049-T25 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T13] +state_hub_task_id: "1c5ea7a1-edf7-5072-b36b-8be7f827957a" +``` + +**Accountable worker:** codex. + +Completed 2026-10-16. `retrieve-identity-offline.py` uses privately entered +independent Backup-account access or an exact read-capable identity-folder share. +It performs only fixed-provider HEAD/GET, binds the reviewed generation by strong +ETag/length/SHA256, refuses redirects/proxies/unreviewed scope and removes failed +downloads. No OpenBao/SSO, age key or standing agent credential is required. +`recovery-kit.py` builds a reproducible allowlisted ZIP containing the tools, +public profile, known-good ciphertext receipt and recovery guides, with file +checksums. Its publication path creates only three versioned guide/ZIP/checksum +objects and verifies readback without overwriting existing conflicting objects. +`run-offline-recovery.sh` provides the owner's two-hidden-prompt handoff. + +Evidence: `tests/test_identity_offline_recovery.py` and the bounded test/build +receipt in `docs/evidence/2026-10-16-identity-outage-recovery/`. The focused run +passed 65 tests including real disposable age/PostgreSQL fixtures. ZIP-contained +entry points import without sibling repositories. This is source/fixture proof, +not actual independent-provider retrieval (T23) or publication (T26). + +2026-10-16 correction: the first owner handoff stopped before its credential +prompt because Python text `r+` requires a seekable stream. Reproduced against a +real controlling PTY; replaced both prompts with the shared hidden-input helper, +refusing redirected input and echo fallback. Added real-terminal and both-CLI +regressions plus closed stage/HTTP-code diagnostics (no raw responses). The +focused rerun passed 36 tests. Evidence: `terminal-prompt-fix.json` in the outage +evidence directory. This source correction does not complete T23/T26. + +## Publish and verify the disaster recovery guide on Storage Share + +```task +id: NK-WP-0049-T26 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T25, NK-WP-0049-T27] +state_hub_task_id: "94d054fe-e5d8-5ddf-8e48-80714123d184" +``` + +**Accountable worker:** codex; operator holds provider access privately. + +Requested by the operator on 2026-10-16; decision +`fc3ef8db-0a33-41d5-a0ba-d13169c5f884` records the bounded scope. Guide source: +`docs/disaster-recovery-storage-share.md`. Document scope, independently held +provider/key requirements, exact known-good fallback, copy/download verification, +archive-check commands, service restore order, recurring schedule and remaining +coverage limits. Include the offline tools so failed Forgejo does not prevent +access to the recovery scripts; retain an independent copy and trusted digest. + +Completed 2026-10-16 at 18:01 UTC through the private independent-provider +owner handoff. All three objects were conditionally created and read back with +matching strong ETag, length and content; the recorded digests match a fresh +reproducible local build. No existing object or provider permission was changed. +The failed first attempt and terminal correction remain documented in T25. + +**Published location:** Storage Share account Backup, +`railiance-backups/net-kingdom-identity/`: + +- `net-kingdom-recovery-57d1940947aa25ff-START-HERE.md` +- `net-kingdom-recovery-57d1940947aa25ff.zip` +- `net-kingdom-recovery-57d1940947aa25ff.zip.sha256` + +**Trusted ZIP SHA256:** +`57d1940947aa25ff83d0f25ddf30090eb40595cccaab64225de882a2fd59ea2f`. +Evidence: `actual-offline-publication.json` and `actual-offline-review.json` in +`docs/evidence/2026-10-16-identity-outage-recovery/`. The published guide is the +exact pre-drill revision; this acceptance record records the later successful +drill without implying an unperformed republication. Keep an independent copy +and trusted digest outside the failed service/provider dependency. + +## Draft the isolated service restore packet and observe candidate images + +```task +id: NK-WP-0049-T27 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T08, NK-WP-0049-T13] +state_hub_task_id: "e273e803-bee7-5d90-bc51-ecc08c0c8eff" +``` + +**Accountable worker:** codex. + +Completed 2026-10-16. Draft in `docs/identity-service-restore-packet.md` names the +known recovered input, restore order, original key/data ownership, default-deny +containment, blocked production/provider/notification effects, cleanup and five +native acceptance lanes with positive/negative checks. Read-only metadata from +the pinned primary cluster resolved all four current service image digests, +including the separately observed privacyIDEA main container and LLDAP's mutable +source tag. Evidence: `docs/evidence/2026-10-16-identity-outage-recovery/image-observation.json`. + +This task extracts completed preparation from T15. Named target admission, +archive/runtime image-lineage matching and independent image availability, +private existing-user/MFA inputs and owner-reviewed native commands remain T15; +no service restore, production change or owner acceptance is claimed. + +## Stage and verify the five exact service images for local offline recovery + +```task +id: NK-WP-0049-T28 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T27] +state_hub_task_id: "4829b091-76d2-5b10-bdfc-032800190c0a" +``` + +**Accountable worker:** codex. + +Completed 2026-10-16. All five pinned references (PostgreSQL, LLDAP, Authelia, +KeyCape, privacyIDEA) were inspected on the fixed local Linux Docker engine +`bnt-lap001`, ID `74f93783-6cef-43a8-a3c4-f62586cd3bc1`. Missing LLDAP and +privacyIDEA images were pulled only by their observed immutable digests. Saved a +private 347,521,536-byte image archive, loaded it and re-inspected every exact +reference. Evidence and archive SHA256/location: +`docs/evidence/2026-10-16-identity-outage-recovery/offline-service-images.json`. + +The local drill no longer requires the production registry. This is not off-host +image escrow or proof of historical mutable-tag/backup lineage; those limits +remain in T15. No service custody or age key was supplied to image caching. + +## Prepare and verify the bounded native LLDAP recovery executor + +```task +id: NK-WP-0049-T29 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T13, NK-WP-0049-T27, NK-WP-0049-T28] +state_hub_task_id: "2f8c73b0-1cdd-5b22-99b6-017ccde4454b" +``` + +**Accountable worker:** codex; operator retains actual private recovery inputs. + +Completed 2026-10-16. `isolated-lldap.py` and `run-isolated-lldap.sh` provide the +exact owner-run stage in `docs/identity-service-restore-packet.md`: fixed local +engine/images, no remote Docker endpoint, original key/seed/JWT/directory data, +Linux-tmpfs decryption, memory/stdin-only private inputs, network-none/read-only +containers, isolation inspection before import, actual existing-user bind, +explicit invalid-credential denial, stable directory rows and cleanup checks. +Missing original server keys are refused; reset/replacement/notification paths +are disabled. No live Kubernetes/OpenBao/SSO path or provider grant is used. + +Evidence: `tests/test_isolated_lldap_recovery.py` exercises the actual pinned +image, disposable retained-account directory and a full synthetic encrypted +bundle through the same native executor. The private real-bundle run and its +acceptance remain T16; fixture success is not actual user/MFA/audit recovery. +See `isolated-lldap-preparation.json` in the October16 outage evidence directory +for exact test/source/target provenance and limitations. + +## Prepare the bounded native privacyIDEA token-material and audit executor + +```task +id: NK-WP-0049-T30 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T13, NK-WP-0049-T28] +state_hub_task_id: "6e4a43db-9be2-5662-bdbf-1595fce03052" +``` + +**Accountable worker:** codex; operator retains private recovery inputs. + +Completed 2026-10-16. `isolated-privacyidea.py` and its owner launcher use the +fixed local Docker target and exact cached PostgreSQL/privacyIDEA3.12.2 images. +The linked dump, original enckey/audit pair and required secret fields are +restored only into a loopback-only, nonroot, read-only, capability-free, +no-host-mount/port, tmpfs-backed environment with inspected pre-import isolation. +Decrypted host staging is tmpfs; normal cleanup removes all private data and +owned containers, with a bounded holding lifetime if the parent is interrupted. + +The native provider decrypts token-key material internally, checks every stored +audit row, adds one isolated signed entry and checks wrong-public-key/tampering +negatives. Original policy for legacy signature verification is retained only +from literal archived configuration; archived Python is never executed. Invalid +or unsigned history remains reported, not repaired or sampled away. Native +material readback is not existing-token MFA or proof of event completeness. + +Evidence: `tests/test_isolated_privacyidea_recovery.py` and +`isolated-privacyidea-preparation.json` in the October16 outage evidence folder. +Synthetic pinned-image tests exercise valid/tampered/unsigned history, malformed +keys, encrypted archive to native restore, isolation and cleanup. Real original +material/audit acceptance remains T31/T20; actual MFA remains T19. + +## Verify retained privacyIDEA token material inside the isolated provider + +```task +id: NK-WP-0049-T31 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T13, NK-WP-0049-T30] +state_hub_task_id: "26383841-8076-5c53-bbd1-9db64e32544a" +``` + +**Accountable worker:** codex; operator supplies only the independently held age +key in the hidden helper. This task extracts actual material-readback scope from +T19, preserving T19's existing-token MFA acceptance gate and historical identity. + +Completed 2026-10-16 at 19:10 UTC in the same actual run as T20. All five +retained token materials were decrypted internally with the original enckey; +an unrelated key could not reproduce any of the five. All 36 manifest hashes, +exact executor/ciphertext/target bindings, isolation and cleanup passed. Safe +receipts are the `actual-isolated-privacyidea-{recovery,review}.json` files +referenced under T20. No retained-factor authentication is claimed. +**Done when:** exact ciphertext/source/target/manifest bindings pass; the native +provider reads every nonempty encrypted token-key field using the original +enckey without exporting material; an unrelated key cannot reproduce that +material; aggregate counts and container/plaintext cleanup are recorded. + +Only bounded internal readback is accepted here. Padding/readback success does +not prove the recovered secret authenticates a retained factor; actual positive +MFA and wrong-key/wrong-code authentication refusal remain T19. No token seed, +plaintext, serial or user record belongs in the receipt, Git, State Hub or chat. + +## Deliver isolated KeyCape restore source and synthetic lifecycle proof + +```task +id: NK-WP-0049-T32 +status: done +priority: high +assignee: codex +state_hub_task_id: "cd78dbb7-a8f2-5754-8788-6eb1b7d97741" +``` + +Completed 2026-10-16. This extracts bounded source/fixture delivery from T18; +T18 retains actual original archive, issuer and selected consumer acceptance. +The adapter reuses the existing transfer/archive/custody contracts, binds the +fixed local daemon and cached images, restores private state only to temporary +memory, verifies original issuer/TLS/signing/configuration/policy bytes and runs +the original native service-client checker with wrong-secret/excess-scope denial. +Durable pre-import obligations and exact parent pidfd/session quiescence precede +loss/deadline cleanup. Daemon response uncertainty remains uncertainty after +resource absence; it never authorizes recovery success or replay. + +Frozen R6 fixes a demonstrated image-declared anonymous-volume incompatibility +using bounded helper-only tmpfs, preserving anonymous disk-volume refusal. Safe +phase markers carry no private diagnostics. Independently passed 72 focused +checks, then actual pinned-image synthetic positive, hard-parent-loss, deadline +and nonzero-after-accept cases. Independent fixed-daemon inventories and host +mount-namespace checks prove all exact resources and plaintext absent. Reaper +outcomes are retained; initial sandbox receipt lookup failure is preserved and +superseded by device-bound host verification. R1–R5 failures remain retained. + +Evidence: Custodian docs/changes/netkingdom-target-2026-10-16/ +identity-restore-adapter-next/revisions/r6/, actual-fixture-r6-all.json and +coordinator-r6-all-review.json. Exact source/dependency hashes and candidate +manifest bind the proof. This uses generated test keys only; it proves neither +actual owner-held recovery, human MFA, downstream reconnect nor native authority. + +Publication preparation R7 preserves every R6 recovery adapter byte and digest. +The normal scanner flagged eight public source-file SHA-256 values in the R6 +manifest. Explicit sha256-qualified checksums resolve those false positives; +the fixture reader strictly validates their type/shape before checking the same +bytes. R7 passes 73 focused checks including malformed/untyped digest refusal. +The frozen R6 actual four-case proof remains the runtime evidence; no repeated +native outcome is claimed for publication encoding. Original scanner refusal is +retained, and scanner policy/exemptions are unchanged. + +## Prepare the exact owner-held KeyCape recovery attempt + +```task +id: NK-WP-0049-T33 +status: wait +priority: high +assignee: codex +depends_on: [NK-WP-0049-T32, NK-WP-0049-T34, NK-WP-0049-T35, NK-WP-0049-T36] +blocking_reason: "Source custody/preflight preparation is evidenced in T34; await original TLS/trust recovery disposition T35 and selected original registration/private-admission metadata T36 before final reviewed command and existing owner process." +state_hub_task_id: "56c8d469-7a10-5d50-a30e-95cbf3cd4756" +``` + +**Accountable worker:** NetKingdom codex with KeyCape and selected consumer owners. +This umbrella retains final attempt readiness. Completed custody/preflight source +preparation is extracted into T34; T35 resolves original TLS/trust recovery and +T36 prepares the selected original registration and private admission. This split +records distinct outcomes without counting source preparation as recovery. + +After those deliverables, assemble the exact existing six-argument attended +command and admission digest, bind the integrated source/dependency revision and +fixed local target, and record execution deadline, safe receipt location, abort, +rollback and independent receipt verification through the existing owner process. +Keep private manifest derivation inside custody and original TLS/client/key inputs +in the owner's own terminal; the current null fields must refuse execution. +Existing session authorization is retained within scope; this record does not +supply missing owner assent or approve any actual recovery attempt. + +**Done when:** reviewed executable command and complete metadata-only/private +admission packet are ready for the existing attended custody path; prerequisites +and independent receipt verification are explicit. T18 still owns actual +execution, original consumer continuity and acceptance. T19 retains retained-factor +MFA. This task neither authorizes a production consumer redirect nor creates a +new client grant. + +## Deliver attended custody, metadata preflight and private manifest preparation source + +```task +id: NK-WP-0049-T34 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T32] +state_hub_task_id: "821b3a56-6f36-5812-abc9-5a00e37cb2e7" +``` + +**Accountable worker:** NetKingdom codex; independent Custodian source review. +Completed 2026-10-17 as source preparation. Existing attended custody entry points +now have a reviewed candidate sealed anonymous descriptor mode: hidden prompt, +actual public-recipient verification, strict owned/private/full-seal descriptor +admission, non-inheritable returned duplicate and explicit descriptor passing. +The existing file mode stays compatible, with its original hard-loss limitation; +no improved file-mode cleanup is claimed. Exact parent-loss tests prove descriptor +lifetime without signalling inherited user shell groups. An admitted child retains +its descriptor until it exits; parent loss is not child revocation. + +The candidate checks bounded, duplicate-free public JSON, exact admission digest, +transfer/archive and selected service bindings, typed hashes for all 17 invoked +local source/config dependencies and required Python imports before requesting a +key. TLS and ciphertext preparation uses file metadata only. Legacy explicit +manifest digests remain supported; versioned ciphertext-derived binding computes +the canonical digest privately only after exact reviewed ciphertext, authenticated +age decryption and full existing archive validation. The derived private digest +never enters safe receipts/checkpoints and grants no new consumer authority. + +The coordinator independently passed 111 focused checks. The existing custody +regression suite passed 94 checks; 61 real-SOPS tests skipped because that trusted +runtime is unavailable, so that compatibility coverage remains unverified. Tests +use generated keys/archive material only, including actual age cryptography, +synthetic hidden-prompt and exact parent-loss processes. Manifest-builder tests +mock Docker/issuer behavior and confer no new native proof. Frozen R6/R7 proof, +intermediate test failures and scanner history remain retained. + +Bounded public image readback separately establishes the cached original image's +13670142-byte `/keycape` executable as +`sha256:cd89121393e1465aa76009763602a5b8c75f9dddb5679aea6242623f135b51b4`. +This is executable identity metadata, not recovery or custody acceptance. + +Evidence: Custodian `docs/changes/netkingdom-target-2026-10-16/recovery-attempt-r1/` +(`candidate.patch`, `review.json`, source closure, attempt/admission metadata and +`public-verifier-image-readback.json`). Canonical integration/publication and +projection receipts must be recorded separately when performed; this completed +source-preparation record does not invent them. T33 remains open for complete +attempt readiness; actual recovery/consumer acceptance remains T18 and MFA T19. + +## Establish original KeyCape TLS and trust recovery ownership for outage use + +```task +id: NK-WP-0049-T35 +status: progress +priority: high +assignee: codex +depends_on: [NK-WP-0049-T34] +state_hub_task_id: "1bfd1703-589f-5511-bad5-812d860e4a71" +``` + +**Accountable worker:** NetKingdom codex, coordinating with the source owner of +Ingress/cert-manager/Traefik and the original TLS custody/provider boundary. +**Next action:** identify and record that actual owner's existing recovery path, +then obtain its metadata/disposition through the ordinary owner process. A missing +exact credential-routing catalog match is not evidence that no owner exists. + +Current source declares `kc.coulomb.social`, `sso/kc-tls`, cert-manager +`ClusterIssuer/letsencrypt-prod` and Traefik TLS termination before KeyCape 8080. +The identity backup profile excludes `kc-tls`; the verified archive therefore +establishes no independent recovery of that TLS identity/trust. Determine whether +the exact original certificate/key/trust is independently recoverable during an +issuer/cluster outage, or whether a documented reissue path is acceptable for the +selected continuity claim. Do not read or place the TLS key in work records, use +a fresh self-signed trust substitute, mutate production or claim owner assent. + +**Done when:** named owner/provider, independent outage prerequisites, original +public identity/certificate/trust hashes or accepted reissue disposition, private +custody entry point and verification/abort limits are explicit and reviewed. +Record any unavailable recovery capability as a live owner work record and bind +its dependency/unblock condition; a prose-only gap or untested archive is not +completion. This delivers preparation/disposition, not actual TLS recovery. + +## Prepare selected original service registration and private admission bindings + +```task +id: NK-WP-0049-T36 +status: progress +priority: high +assignee: codex +depends_on: [NK-WP-0049-T34] +state_hub_task_id: "8b72334b-fc27-5707-a189-bad345eaf3bc" +``` + +**Accountable worker:** NetKingdom codex with KeyCape and the selected existing +service consumer's owner. **Next action:** identify that owner and the exact +original registration's non-secret selector metadata using existing source/owner +evidence; preserve independent private custody and never retrieve a client secret. + +Bind reviewed ciphertext `7117b3fe1e4840c86b301c94c85e6b16709e5626bb0884bd0580bde630e30e30`, +its independently verified transfer, source/image/executable closure and an +explicit versioned manifest-binding mode. For the original service registration, +record client identifier, secret environment name, audience, granted scope, +subject, tenant, required roles and denied scope without values or new grants. +Describe the native service-client dependency graph and distinguish unexercised +LLDAP/Authelia/privacyIDEA/downstream flows. Keep private manifest material inside +the existing custody process, never in Git, safe receipts, State Hub or chat. + +**Done when:** the selected existing service owner and exact non-secret registration +bindings are independently established, the private admission builder validates +positive/negative source/archive/selector cases, and its metadata is ready to +combine with T35's original TLS/trust disposition under T33. This task may prepare +registration metadata while T35 proceeds independently; it does not finalize the +whole admission, perform actual recovery, redirect a consumer or confer assent. + +## Accept remaining recovery and caller evidence and close the G08 handoff + +```task +id: NK-WP-0049-T03 +status: wait +priority: high +assignee: codex +depends_on: [NK-WP-0049-T02, NK-WP-0049-T16, NK-WP-0049-T17, NK-WP-0049-T18, NK-WP-0049-T19, NK-WP-0049-T20, NK-WP-0049-T21, NK-WP-0049-T22, NK-WP-0049-T23, NK-WP-0049-T24, NK-WP-0049-T26] +blocking_reason: "Await the separately tracked native service proofs, current/legacy caller dispositions and residual-scope decisions; archive recovery, backup activation, independent outage retrieval and guide publication are complete." +state_hub_task_id: "d68cd4d3-1ba3-530e-88f9-26ebb8dd6eac" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Owner boundary: NetKingdom, Platform and affected service owners, with Custodian +G08 receiving the final evidence. The completed archive/job milestones remain +accepted independently of this final gate. + +**Done when:** T02 and T15–T36 have their stated completed or explicitly accepted +handoff outcomes; service authentication/token/audit proof and current/legacy +caller dispositions are accepted; the source workplan and projected tasks agree; +and G08 has an exact evidence/handoff record. Record actionable residuals as live +work records before workplan closure. Preserve historical IDs and receipts; do +not call a deferred rotation or an untested full-estate restore complete. + +## Evidence locations and refinement history + +“Live” above means `docs/evidence/2026-10-16-identity-backup-live/` in NetKingdom. +Implementation preparation is in the October16 implementation directory; earlier +backup discovery/database recovery is in `docs/evidence/2026-10-15-bootstrap-recovery/`. +The source-repair receipts explicitly labelled Custodian belong to that owning +repository. Use the [recovery ceremony](../docs/bootstrap-recovery-ceremony.md) +for exact procedure and approval history. No secret values belong in task evidence. + +Refinement rule: substantial work and newly understood remaining scope must be +visible in task blocks at a checkpoint, not only in progress prose. This replan +preserves T01–T03 identity and original evidence while making the completed +milestones and each remaining acceptance gate separately manageable. + +Managed identifier assignment also consumed a preexisting staged generated brief; +the follow-up commit restores its prior published baseline while preserving the +operator's working brief and original staged version. This is a projection-tool +side effect, not new recovery evidence. + + +R7 source publication and task bindings verified: +`5fcd5952add1c0167116094298a1d5feaa60cf30` is the observed published source. +All eight canonical additions match the reviewed bytes; all 33 task statuses +match the actual hub projection, including T32 done and T33 todo. Original +staged/working brief content is preserved. Normal synchronization has zero +failures/automation errors; existing warnings and scanner false-positive history +remain retained. Custodian identity-restore-adapter-next/canonical-r7-integration.json +binds source/projection/native-fixture evidence separately. T18 remains waiting +for the actual owner-held attempt and selected consumer acceptance. + + +2026-10-17 source/attempt refinement: T34 records completed attended custody, +preflight/private-manifest source preparation and its bounded tests; T35 and T36 +make original TLS recovery ownership and selected original admission metadata live +work. T33 retains final attempt readiness and its original Hub UUID. This adds no +actual recovery, MFA, native authority or owner assent. Source task counts above +refer to this file; projection has not been claimed for this proposed refinement. + +2026-10-17 verified source follow-through: source commit `4f65e41` passed normal +local scanning and 111 canonical focused checks. The initial T34 source-only +preparation now has an exact integrated source revision; existing real-SOPS +compatibility remains partly skipped and actual owner-held execution remains T18. + +T35/T36 source preparation is underway, with 17 pinned public-source references. +railiance-cluster owns the ingress/cert-manager/cluster-backup substrate; the +inspected same-host encrypted backup source establishes no independent original +kc-tls/trust recovery or accepted reissue. Draft owner questions remain unsent; +no private TLS input was requested. The historically deployed +secrets-engine-openbao registration is a defensible proposed consumer: its +7 October issuer and 10 October consumer proofs predate the reviewed archive. +The exact selector proposal is retained without current assent or private archive +validation. No token exchange, OpenBao login, client secret retrieval, new grant +or production redirect occurred. Keep incomplete admission refused before custody. +Custodian evidence: recovery-attempt-r1/t35-t36-source-next; final source/projection +review: resume-integration-r1/publication-verification.json. diff --git a/docs/changes/netkingdom-target-2026-10-17/wp49-sops-successor-r1/NK-WP-0049.proposed.md b/docs/changes/netkingdom-target-2026-10-17/wp49-sops-successor-r1/NK-WP-0049.proposed.md new file mode 100644 index 00000000..7d2562e2 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/wp49-sops-successor-r1/NK-WP-0049.proposed.md @@ -0,0 +1,1252 @@ +--- +id: NK-WP-0049 +type: workplan +title: "Remove bootstrap secret output and verify separated recovery custody" +domain: infotech +repo: net-kingdom +status: active +owner: codex +topic_slug: netkingdom +created: "2026-10-12" +updated: "2026-10-17" +flavor: implementation +depends_on: [] +state_hub_workstream_id: "17d315f0-829e-57c7-85cc-3a7914152804" +--- + +Native owner work for CUST-WP-0080 G08. This workplan remains active until the +remaining caller, service-recovery and custody acceptance gates are satisfied. +NK-WP-0045 covers the non-secret root-grant record. Founder-deferred exposure +rotation remains in CUST-WP-0073-T05; this plan does not silently reopen it. + +**Replanned 2026-10-16 at the operator's request:** substantial completed work is +now represented by completed tasks, and remaining work has separate deliverables, +dependencies and acceptance criteria. T01–T03 retain their historical IDs and Hub +UUIDs. Completed parts of the old T02/T03 umbrellas are extracted into T04–T14; +T02 now covers the current-caller ledger and T03 retains final owner acceptance. +These are retrospective task records of evidenced work, not additional delivery +or newly granted authority. The earlier dated narrative remains in Git at +`cc2dd01`; its evidence references are carried into the tasks below. + +**Current position, source refinement 2026-10-17:** 25 tasks done; 4 in +progress; 1 ready to start (`todo`); 7 waiting on explicit prerequisites. These are task counts, not an effort-based +completion percentage. Assignees are also written in task descriptions because +the current Forge projector does not populate the dedicated Hub assignee field. The outage-retrieval tool and restore-packet draft are now prepared; +independent outage retrieval and Storage Share publication are accepted; +service admission remains an explicit gate. + +**Next actions:** finish the read-only caller ledger (T02); admit the drafted +isolated restore packet (T15) and record residual-scope handoffs (T24). +Independent outage retrieval (T23) and guide publication (T26) are done. After owner admission, execute the individual native service and +caller checks. A task's owner is accountable for the result; another repository's +approval or credential grant still requires its own owner path. + +**Closure:** T03 assembles owner acceptance after its named dependencies pass. +Passing archive recovery does not prove existing-user authentication, retained +MFA-token decryption, historical audit signatures or current caller admission. +The verified backup job stays active while those separate tasks are completed. + +## Remove secret-bearing output and ambient root discovery + +```task +id: NK-WP-0049-T01 +status: done +priority: high +assignee: codex +state_hub_task_id: "d7ca8d5f-c5ff-5cba-bd25-038cb53ffe4e" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +2026-10-12: regression reproduced emergency/reprint root export, generation +prefix disclosure, permissive file modes, dry-run side effects and unattended +entry. Replaced emergency export with a non-secret guide (legacy secret-input +arguments refused), suppressed generation prefixes/tracing and set private +permissions. Bootstrap requires the registered public recipient and an attended +terminal; never generates/discovers a permanent private key. Encrypted resume +requires an explicit matching temporary custody key before cluster activity. +Dry-run is a non-mutating plan. The live cluster/apply path was not executed. + +A fresh uniquely named encrypted ops bundle follows apply; old delivery flags +cannot skip current acknowledgment. New acknowledgment state binds its SHA256 +and timestamp. Declining stops before cleanup/completion. This is an operator +statement, not an independent restore receipt. Historical fields remain unchanged. +Make/help/status/console and current credential guidance reflect that distinction. +Evidence and exact source manifest: Custodian +`docs/evidence/2026-10-12-netkingdom-security/bootstrap-handoff.json`. + +## Harden custody, SOPS and rotation source entry points + +```task +id: NK-WP-0049-T04 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T01] +state_hub_task_id: "04c4e8be-5bd8-5d5c-99b1-79d8ae758462" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Completed 2026-10-12–13. Public-recipient-only encryption, explicit temporary +custody, private no-overwrite output, sanitized diagnostics, stdin-only secret +transport and failed-operation cleanup replace ambient-key and output paths. +SOPS read/edit/data-key rotation preserve recipient/MAC/source-version guards; +component rotations preserve unrelated fields and retain recovery candidates. +This records source and disposable-native proof, not live rotation or revocation. + +Evidence: Custodian `docs/evidence/2026-10-12-netkingdom-security/` receipts +`custody-entrypoints.json`, `sops-make-entrypoints.json`, `rotation-output.json`, +and `admin-bootstrap.json`; October13 `sops-write-callers.json`. + +## Repair component, diagnostic, LDAP and resolver callers + +```task +id: NK-WP-0049-T05 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T04] +state_hub_task_id: "e8e38f42-609e-5c07-a8e6-e73c8eb4ae95" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Completed 2026-10-13–14. Repaired KeyCape configuration and component Secret +publication, original privacyIDEA key export/restore transport, scoped MFA +counts, LDAP group maintenance and configuration-preserving resolver cutover. +Retired unsafe personal-token mint/refresh and direct LDAP lifecycle shortcuts. +Disposable native PI/LLDAP tests and source regressions passed; estate provider +admission, historical credential validity and service authentication remain T21/T22. + +Evidence: Custodian October13 `keycape-caller-reconciliation.json`, +`service-secret-callers.json`, `privacyidea-key-custody.json`, +`mfa-state-diagnostic.json`, `realm-bootstrap-repair.json`; October14 +`legacy-lldap-retirement.json`, `platform-group-boundary.json`, +`lldap-group-maintenance.json`, `resolver-cutover.json` under the corresponding +`docs/evidence/YYYY-MM-DD-netkingdom-security/` directories. + +## Inventory source callers and retire remaining unsafe delivery paths + +```task +id: NK-WP-0049-T06 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T04, NK-WP-0049-T05] +state_hub_task_id: "a5f50891-c5b2-513b-8670-e1915ee52015" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Completed 2026-10-15. Enumerated all 87 current non-test shell/Python callers +in the declared bootstrap/k8s scope plus Make/console/delivery adapters. Repaired +streamed encrypted bundle publication and fail-closed bootstrap/lab paths; +retired unsafe delivery copiers, root prompts, registry patchers and stale +rollback recipes. The attended inventory records source dispositions and their +native-proof limits. T02 separately maps these to current live users/owners. + +Evidence: [caller inventory](../docs/evidence/2026-10-15-bootstrap-recovery/caller-source-inventory.json), +[attended procedures](../docs/attended-procedure-inventory.md) and the October15 +recovery evidence directory. No live production bootstrap or lab-init acceptance +is claimed. + +## Discover off-host coverage and recover the existing PI database + +```task +id: NK-WP-0049-T07 +status: done +priority: high +assignee: codex +state_hub_task_id: "2d7302a2-319a-5633-bf58-d51ccd25ebf6" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Completed 2026-10-15–16. Bounded Storage Share/Scaleway inventories identified +existing database coverage and the missing full identity bundle. The operator +independently matched the backup recipient, then recovered the exact existing +PI dump: correct-key decryption, wrong-key refusal, isolated native PostgreSQL +restore/readback and cleanup passed (5 tokens, 2 resolvers, 2 realms). + +Evidence: October15 recovery `offsite-discovery-summary.json`, +`privacyidea-transfer-r1.json`, `privacyidea-database-drill-r1.json`, +`database-drill-review.json`. This database-only proof led to T08–T14. + +## Implement the full identity capture and archive recovery toolchain + +```task +id: NK-WP-0049-T08 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T06, NK-WP-0049-T07] +state_hub_task_id: "317ca173-c784-5329-9810-5e3d300604b8" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Completed 2026-10-16. Defined exact LLDAP/Authelia/KeyCape/privacyIDEA assets, +Deployment/PVC/reference bindings, original keys and snapshot consistency limits. +Implemented native SQLite/PG capture, streamed age sealing, strict data-bearing +manifest checks, provider readback, independent retrieval, bounded retention, +root runtime and attended archive verifier. All 56 focused checks passed, +including actual synthetic encrypted/native PostgreSQL recovery. + +Evidence: [profile](../tools/bootstrap-recovery/identity-backup-profile.json), +[implementation review](../docs/evidence/2026-10-16-identity-backup-implementation/review.json), +and the live evidence's tested ESO-default/host-binding corrections. Production +archive recovery is separately evidenced in T13. + +## Admit and verify the two scoped backup credential deliveries + +```task +id: NK-WP-0049-T09 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T08] +state_hub_task_id: "4a47eb2a-7e42-5ae7-9df1-f5ede746eca1" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Completed 2026-10-16. Platform CCR-2026-0048/0049 are verified. The operator +approved folder-only provider-normalized publisher21/retention25 rights, including +re-sharing, in addition to the original rollout. Coding-agent denials precede KV +publication. Exact 900-second single-policy readers, wrong-SA/namespace/audience +rejection, metadata/sibling/old-escrow/token-create denials, ESO equality and +reader/session revocation passed. Operator passwords and age private keys are +not job credentials. + +Evidence: live `publisher-setup-verified.json`, `retention-setup-verified.json`, +`publisher-native-delivery-verified.json`, `retention-native-delivery-verified.json`; +approval decisions `40bfae40-6108-4e51-8613-073339f5345f` and +`5edd5203-fae7-461b-8775-5d22b7873971`; Platform CCR files. + +## Apply capture isolation and install the guarded node runtime + +```task +id: NK-WP-0049-T10 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T08, NK-WP-0049-T09] +state_hub_task_id: "0519444c-d559-5455-aa27-8c5dc8b832b0" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Completed 2026-10-16. Applied exact UID/resource-version/spec-guarded DNS +selector exclusions, preserving ordinary service matches. Capture refuses any +remaining helper allow policy. Installed immutable runtime sources bound to the +actual hostname, machine identity and cluster UID. Disabled-unit replacement +checked previous contents and retained rollback bytes. Health unit validation +passed. Activation remained gated until T13. + +Evidence: live `isolation-applied.json`, `capture-ready-plan.json`, +`installed-runtime-packet-r2.json`, `upgrade-disabled-runtime.py`. Actual complete +hardened-job execution is recorded in T14. + +## Connect recovery to Railiance bootstrap and reuse discovery + +```task +id: NK-WP-0049-T11 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T08] +state_hub_task_id: "d69af493-4026-56a8-a526-c267d90dce18" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Completed 2026-10-16. Added the Railiance bootstrap `identity-recovery` +dispatcher and independent-custody → isolated verification → layer/service-owner +handoff. Updated `capability.security.bootstrap-recovery`, linked bootstrap +sequencing and composed reuse-surface federation. Keyword discovery for identity +backup, restore, privacyIDEA and disaster recovery was verified. The operator +actually used this handoff in T13. No unattended production importer is claimed. + +Evidence: [ceremony](../docs/bootstrap-recovery-ceremony.md), owning capability +entry, `railiance-bootstrap/docs/identity-recovery.md`, bootstrap commit `d1dcfde` +and reuse-surface federation commit `662782e`. + +## Create and verify the first full off-host identity bundle + +```task +id: NK-WP-0049-T12 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T09, NK-WP-0049-T10] +state_hub_task_id: "decb415a-8012-521c-9dbe-d73c6ff0bbfb" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Completed 2026-10-16. Captured original service keys/current data plus the +linked native PI database dump, sealed and published a unique Storage Share +artifact, then downloaded it and verified size/digest before publishing its index. +Helper and plaintext cleanup passed. Artifact: +`net-kingdom-identity-20261016T063159Z-5882771aa2ce.tar.age` (109738344 bytes). + +Evidence: live `actual-capture.json`, `actual-offsite.json`; ciphertext SHA256 +`7117b3fe1e4840c86b301c94c85e6b16709e5626bb0884bd0580bde630e30e30`. +No age private key was needed by the capture job. + +## Independently retrieve and recover the complete actual archive + +```task +id: NK-WP-0049-T13 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T11, NK-WP-0049-T12] +state_hub_task_id: "602d4921-cfac-5e5b-9993-4fbf67195c7d" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Completed 2026-10-16. Independently downloaded the exact first generation +through attended Backup-account custody, rehashed it locally and revoked the +session. The operator used the independently held age key through the bootstrap +handoff. Correct/wrong-key cases, all 36 manifest files/hashes, original RSA pairs, +SQLite integrity and isolated native PG16.14 restore/readback passed; plaintext +and containers were removed. No key or restored secret values reached the agent. + +Evidence: live `independent-owner-transfer.json`, `actual-full-archive-recovery.json`, +`actual-full-recovery-review.json`. Existing-user/MFA authentication and old audit +signatures are deliberately separate T16–T20 outcomes. + +## Activate and prove the complete recurring backup and retention job + +```task +id: NK-WP-0049-T14 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T10, NK-WP-0049-T13] +state_hub_task_id: "eaf0708f-b3b7-5531-8172-95edf30c3a19" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Completed 2026-10-16 after T13. Both daily backup/retention and hourly health +timers are enabled/active. The actual hardened systemd service passed retention +before/after a second capture/upload/download (Result=success, ExecMainStatus=0). +Both verified generations are retained, the independently recovered point is +pinned, and nothing was deleted. Helpers/plaintext were cleaned; failure markers +and reporting outbox are empty. Health check succeeded. + +Evidence: live `activation-result.json`, `activation-review.json`, +`recurring-job-review.json`. Cadence: daily 03:45 UTC plus up to 5 minutes jitter, +hourly health, 25-hour freshness bound. Second-provider/host-loss gaps go to T24; +this completed task is not a full-estate recovery claim. + +## Map current callers, owners and native acceptance gaps + +```task +id: NK-WP-0049-T02 +status: progress +priority: high +assignee: codex +depends_on: [NK-WP-0049-T06] +state_hub_task_id: "479d6970-6516-50f5-9436-bb5b56d58aad" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +The source inventory and known legacy objects exist; a complete current-use +ledger is not yet accepted. Next action is read-only reconciliation of the 93 +entries in the latest October15 source inventory (the earlier snapshot had 87) against active Make/bootstrap/operator routes and owner evidence. + +**Done when:** each entry is identified as current, retired or owner-deferred, +with its owner, credential route, current consumer(s), native evidence or exact +missing proof, and next responsible task. Explicitly cover the historical +`sso/keycape-pi-token` and `mfa/privacyidea-trigger-admin` objects, lab init, +factor diagnostic delivery, LDAP group/provider boundary, resolver cutover and +root-output/isolation boundaries. Secret presence is not credential validity. +Send current native checks to T21 and historical revocation/rotation decisions to +T22. Do not reopen completed source repairs without a new finding. + +## Prepare the isolated full-service restore and acceptance packet + +```task +id: NK-WP-0049-T15 +status: progress +priority: high +assignee: codex +depends_on: [NK-WP-0049-T08, NK-WP-0049-T13, NK-WP-0049-T27, NK-WP-0049-T28, NK-WP-0049-T29, NK-WP-0049-T30] +state_hub_task_id: "1d1eb903-a4b0-5bc4-a421-0b842d7f68ae" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +**Prepared draft scope moved to T27.** See +`docs/identity-service-restore-packet.md`: restore order, containment, safe evidence +and per-service positive/negative checks are drafted. Read-only current runtime +image digests were observed for all four services; correspondence to the selected +archive and independent image availability are not yet proved. + +**Next action:** admit a named disposable target/private route, verify and stage +matching images independently, obtain private existing-user/MFA test inputs and +review version-specific native commands with service owners. Incorporate T02's +ledger before submitting current-caller acceptance. + +2026-10-16 checkpoint: T28 completed the exact local image save/load/inspect +and T29 prepared and natively tested the bounded LLDAP stage. Its actual owner +run is T16 and can proceed independently of the remaining multi-service packet. +The other service adapters, matching archive/runtime lineage and private +existing-user/MFA inputs are still required; no blanket T15 completion is claimed. + +**Done when:** service owners accept the exact targets/procedure, existing-user +and MFA test identities/input custody are available without posting secrets, +outbound notification/provider writes are disabled, and every required new +credential or production effect has its own owner decision. The verifier deletes +its plaintext; it is not a production importer. This task prepares authority and +inputs for T16–T20, not an automatic production restore. + +## Prove restored LLDAP directory and existing-user authentication + +```task +id: NK-WP-0049-T16 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T13, NK-WP-0049-T29] +state_hub_task_id: "b64d4d6a-e851-58d1-9929-f03343147de0" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Owner boundary: NetKingdom directory/User Engine owners. Restore the captured +original directory/configuration in the admitted isolated environment. + +**Done when:** user, group and membership identities are preserved; an independently +supplied existing-user credential authenticates; a wrong credential is refused; +provider writes/outbound effects stay confined; cleanup is verified. Native +fixtures from T05 and SQLite integrity from T13 do not satisfy this current-data +acceptance. Record only safe counts, identities and outcomes. + + +Completed 2026-10-16 at 18:37 UTC. The operator privately supplied the +independent age key and an existing backup-era account credential to the exact +local executor. All 36 archive hashes and the known ciphertext/source/target +bindings matched. Native existing-user LDAP bind passed; explicit invalid +credentials were rejected. The original seven users, 17 groups, 13 memberships +and the available attribute/schema rows were preserved across service startup, +authentication and graceful shutdown. The container had only loopback/no +external routes; pre-import isolation and container/tmpfs cleanup passed. +No production endpoint was contacted or secret exported to the agent. + +Evidence: `actual-isolated-lldap-recovery.json` and +`actual-isolated-lldap-review.json` in +`docs/evidence/2026-10-16-identity-outage-recovery/`. This closes the actual +LLDAP stage independently of the remaining T15 packet. It does not prove +Authelia/KeyCape authentication, retained-token MFA or audit continuity. T17, +T18 and T19 retain their remaining adapter/input prerequisites. + +## Prove restored Authelia storage and OIDC continuity + +```task +id: NK-WP-0049-T17 +status: wait +priority: high +assignee: codex +depends_on: [NK-WP-0049-T15, NK-WP-0049-T16] +blocking_reason: "LLDAP recovery T16 passed; await the exact isolated Authelia adapter/procedure and private authentication-flow inputs from T15." +state_hub_task_id: "b47f9975-d6d7-5bb8-93ce-886deb1dfa70" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Owner boundary: SSO/Authelia and directory owners. Restore the original storage, +encryption/session/signing material and configuration in isolation. + +**Done when:** native storage decryption succeeds, issuer/signing identity and +client configuration are preserved, and an isolated authentication flow has +positive/negative results using the restored directory. Disable outbound +notifications and verify cleanup. Archive integrity/RSA parsing alone are not +native Authelia acceptance. + +## Prove retained privacyIDEA token decryption and existing-token MFA + +```task +id: NK-WP-0049-T19 +status: wait +priority: high +assignee: codex +depends_on: [NK-WP-0049-T15, NK-WP-0049-T16, NK-WP-0049-T31] +blocking_reason: "LLDAP T16, token-material T31 and audit T20 passed; await the exact isolated MFA adapter and owner-selected retained-token/factor inputs." +state_hub_task_id: "6f8af1a7-2a3f-5fa8-8202-83103ebd55b2" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Owner boundary: MFA/privacyIDEA and directory owners. Use the exact linked dump +and original enckey from the independently recovered generation. + +**Done when:** retained token material decrypts inside the isolated process, +a selected existing token completes a native MFA check, a wrong key/code is +refused, and cleanup is verified. Obtain any token/user input through attended +private custody; never emit token plaintext, seeds or credentials. Native database +row counts and disposable synthetic-token fixtures do not prove this outcome. + + +2026-10-16 refinement: native token-material readback is separately tracked in +T31 using the prepared T30 executor. T19 retains actual existing-token MFA and +wrong-code/wrong-key authentication refusal. Internal decryption or padding +success does not authenticate a user. No MFA code is needed for T20/T31; the +selected user's private factor input and exact isolated MFA adapter remain T19. + +## Prove historical and new privacyIDEA audit-signature continuity + +```task +id: NK-WP-0049-T20 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T13, NK-WP-0049-T30] +state_hub_task_id: "375fa8f9-b8a5-5048-97a7-ec141aa7c45d" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Owner boundary: MFA/privacyIDEA audit owner. Use the original recovered audit +pair and linked database in the admitted isolated target. + +**Done when:** existing pre-backup audit signatures are verified natively, a new +isolated audit entry is signed and verified with the preserved identity, a wrong +key fails, and cleanup is recorded. Report any historical verification failure +for explicit owner disposition; do not regenerate keys to hide it. Matching RSA +pairs from T13 are a prerequisite, not audit-history verification. + + +Completed 2026-10-16 at 19:10 UTC using the actual independently retrieved +bundle and original audit identity on the fixed isolated local engine. All +279,209 stored rows were signed and verified; zero unsigned, invalid or legacy +signatures. A new isolated entry verified, and tampering/unrelated-public-key +checks were refused. Container/plaintext cleanup passed. Receipt and reviewed +source/ciphertext/target bindings: `actual-isolated-privacyidea-recovery.json` +and `actual-isolated-privacyidea-review.json` in +`docs/evidence/2026-10-16-identity-outage-recovery/`. +Stored-row continuity is accepted; event completeness and existing-token MFA +are separate and are not claimed. + +## Prove restored KeyCape issuer, policy and consumer continuity + +```task +id: NK-WP-0049-T18 +status: wait +priority: high +assignee: codex +depends_on: [NK-WP-0049-T15, NK-WP-0049-T16, NK-WP-0049-T19, NK-WP-0049-T32, NK-WP-0049-T33] +blocking_reason: "Source and synthetic KeyCape lifecycle proof are delivered in T32; await exact owner-held recovery attempt preparation T33, selected consumer acceptance and retained-token MFA for the selected flow." +state_hub_task_id: "141dd773-c1fa-56c1-a852-bbe2372e5125" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Owner boundary: KeyCape and the selected current consumer owners. Restore the +original signing/configuration, registry, authentication policies and receipts. + +**Done when:** issuer/JWKS signing identity, registry/client configuration and +policy/receipt continuity are preserved; selected current consumers pass native +positive/negative authentication using the restored dependencies; and isolation +and cleanup hold. Confirm the actual dependency graph in T15. Do not route a +production consumer to the isolated issuer or mint new client grants implicitly. + +## Verify current caller and provider admission at their actual boundaries + +```task +id: NK-WP-0049-T21 +status: wait +priority: high +assignee: codex +depends_on: [NK-WP-0049-T02] +blocking_reason: "Await the current-caller ledger and exact per-caller owner admission/test inputs; the backup credential grants do not admit unrelated callers." +state_hub_task_id: "77aa42be-7a39-5d93-8042-03d78b4094b4" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Owner boundary: each current caller's service/provider and credential owner. +Use T02's ledger to select the exact current procedures and required owner lanes. + +**Done when:** each current caller has scoped delivery and native positive/negative +acceptance or an explicit accepted retirement/disposition. Include dedicated +factor-diagnostic admission (do not borrow KeyCape's reader), deployed reserved +LDAP group denial, resolver/cutover input provenance and functional proof, and +bootstrap/root-output/isolation callers. Fixtures, an existing tty and historical +bootstrap receipts are not current authority. Propose exact write/cutover actions +before execution; record deferred actions separately rather than faking a pass. + +## Resolve historical credential and configuration-preserving rotation dispositions + +```task +id: NK-WP-0049-T22 +status: wait +priority: high +assignee: codex +depends_on: [NK-WP-0049-T02, NK-WP-0049-T21] +blocking_reason: "Await the caller/consumer ledger, current replacement-lane acceptance and explicit credential-owner dispositions; existing exposure-rotation deferral is unchanged." +state_hub_task_id: "3ea6bf00-a87f-58ea-bdce-328c13a03a55" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Owner boundary: Platform/custody and affected consumer owners. Review historical +personal-admin/trigger credential copies and unsafe predecessor paths against +known current consumers and rollback custody. + +**Done when:** every affected credential has an owner-accepted disposition: +verified revocation/replacement, continued bounded use with acceptance, or an +explicit linked deferral. Signing/client-secret changes require preservation and +native multi-consumer proof if actually approved. CUST-WP-0073-T05's founder +rotation deferral and decision `1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa` remain in force; +record their exact applicability rather than automatically rotating or treating +source retirement as provider revocation. + +## Provide retrieval that works when OpenBao and SSO are unavailable + +```task +id: NK-WP-0049-T23 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T13, NK-WP-0049-T25] +state_hub_task_id: "1ec537ee-dfee-5576-be36-a81bdba417d1" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Completed 2026-10-16 at 18:02 UTC. The operator used independently held Backup +account access in the private prompt. The actual protected 109,738,344-byte +ciphertext was downloaded with unchanged ETag/size/SHA256, with no OpenBao/SSO +contact or provider writes by the retrieval path. The human-held age key matched +the registered recipient; wrong-key refusal, all 36 manifest hashes, SQLite +integrity, original key pairs and native isolated PostgreSQL 16.14 restore passed. +The database retained five token, two resolver and two realm rows. Disposable +container and temporary plaintext cleanup passed. The agent received no secret. + +Evidence: `actual-offline-transfer.json`, `actual-offline-recovery.json` and +`actual-offline-review.json` under +`docs/evidence/2026-10-16-identity-outage-recovery/`. The review rechecked the +local ciphertext digest and verifier source. This proves the independent path +without requiring a deliberate production outage. Service authentication, +retained-token decryption and historical audit verification remain T16–T20. +T26 separately records accepted guide publication. + +## Record owner disposition for second-provider and external monitoring gaps + +```task +id: NK-WP-0049-T24 +status: todo +priority: medium +assignee: codex +depends_on: [NK-WP-0049-T14] +state_hub_task_id: "474f5a78-a643-59c6-bcf9-fc4a908dfcb0" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +**Next action:** record the current single-provider and host-local-health limits, +then obtain explicit owner scope decisions for a second encrypted provider copy, +external host-loss/freshness detection and recurring recovery-drill cadence. + +**Done when:** each gap has either an accepted bounded residual risk or a linked +live intake/workplan with owner and trigger. Existing daily RPO/25-hour health +settings remain the approved baseline. Scaleway full-identity publication and +an external watchdog are not implemented; do not add their grants/jobs implicitly. +This task triages the new insights instead of silently expanding NK49's required +implementation to an entire disaster-recovery programme. + +## Deliver and verify the offline retrieval adapter and recovery tools kit + +```task +id: NK-WP-0049-T25 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T13] +state_hub_task_id: "1c5ea7a1-edf7-5072-b36b-8be7f827957a" +``` + +**Accountable worker:** codex. + +Completed 2026-10-16. `retrieve-identity-offline.py` uses privately entered +independent Backup-account access or an exact read-capable identity-folder share. +It performs only fixed-provider HEAD/GET, binds the reviewed generation by strong +ETag/length/SHA256, refuses redirects/proxies/unreviewed scope and removes failed +downloads. No OpenBao/SSO, age key or standing agent credential is required. +`recovery-kit.py` builds a reproducible allowlisted ZIP containing the tools, +public profile, known-good ciphertext receipt and recovery guides, with file +checksums. Its publication path creates only three versioned guide/ZIP/checksum +objects and verifies readback without overwriting existing conflicting objects. +`run-offline-recovery.sh` provides the owner's two-hidden-prompt handoff. + +Evidence: `tests/test_identity_offline_recovery.py` and the bounded test/build +receipt in `docs/evidence/2026-10-16-identity-outage-recovery/`. The focused run +passed 65 tests including real disposable age/PostgreSQL fixtures. ZIP-contained +entry points import without sibling repositories. This is source/fixture proof, +not actual independent-provider retrieval (T23) or publication (T26). + +2026-10-16 correction: the first owner handoff stopped before its credential +prompt because Python text `r+` requires a seekable stream. Reproduced against a +real controlling PTY; replaced both prompts with the shared hidden-input helper, +refusing redirected input and echo fallback. Added real-terminal and both-CLI +regressions plus closed stage/HTTP-code diagnostics (no raw responses). The +focused rerun passed 36 tests. Evidence: `terminal-prompt-fix.json` in the outage +evidence directory. This source correction does not complete T23/T26. + +## Publish and verify the disaster recovery guide on Storage Share + +```task +id: NK-WP-0049-T26 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T25, NK-WP-0049-T27] +state_hub_task_id: "94d054fe-e5d8-5ddf-8e48-80714123d184" +``` + +**Accountable worker:** codex; operator holds provider access privately. + +Requested by the operator on 2026-10-16; decision +`fc3ef8db-0a33-41d5-a0ba-d13169c5f884` records the bounded scope. Guide source: +`docs/disaster-recovery-storage-share.md`. Document scope, independently held +provider/key requirements, exact known-good fallback, copy/download verification, +archive-check commands, service restore order, recurring schedule and remaining +coverage limits. Include the offline tools so failed Forgejo does not prevent +access to the recovery scripts; retain an independent copy and trusted digest. + +Completed 2026-10-16 at 18:01 UTC through the private independent-provider +owner handoff. All three objects were conditionally created and read back with +matching strong ETag, length and content; the recorded digests match a fresh +reproducible local build. No existing object or provider permission was changed. +The failed first attempt and terminal correction remain documented in T25. + +**Published location:** Storage Share account Backup, +`railiance-backups/net-kingdom-identity/`: + +- `net-kingdom-recovery-57d1940947aa25ff-START-HERE.md` +- `net-kingdom-recovery-57d1940947aa25ff.zip` +- `net-kingdom-recovery-57d1940947aa25ff.zip.sha256` + +**Trusted ZIP SHA256:** +`57d1940947aa25ff83d0f25ddf30090eb40595cccaab64225de882a2fd59ea2f`. +Evidence: `actual-offline-publication.json` and `actual-offline-review.json` in +`docs/evidence/2026-10-16-identity-outage-recovery/`. The published guide is the +exact pre-drill revision; this acceptance record records the later successful +drill without implying an unperformed republication. Keep an independent copy +and trusted digest outside the failed service/provider dependency. + +## Draft the isolated service restore packet and observe candidate images + +```task +id: NK-WP-0049-T27 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T08, NK-WP-0049-T13] +state_hub_task_id: "e273e803-bee7-5d90-bc51-ecc08c0c8eff" +``` + +**Accountable worker:** codex. + +Completed 2026-10-16. Draft in `docs/identity-service-restore-packet.md` names the +known recovered input, restore order, original key/data ownership, default-deny +containment, blocked production/provider/notification effects, cleanup and five +native acceptance lanes with positive/negative checks. Read-only metadata from +the pinned primary cluster resolved all four current service image digests, +including the separately observed privacyIDEA main container and LLDAP's mutable +source tag. Evidence: `docs/evidence/2026-10-16-identity-outage-recovery/image-observation.json`. + +This task extracts completed preparation from T15. Named target admission, +archive/runtime image-lineage matching and independent image availability, +private existing-user/MFA inputs and owner-reviewed native commands remain T15; +no service restore, production change or owner acceptance is claimed. + +## Stage and verify the five exact service images for local offline recovery + +```task +id: NK-WP-0049-T28 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T27] +state_hub_task_id: "4829b091-76d2-5b10-bdfc-032800190c0a" +``` + +**Accountable worker:** codex. + +Completed 2026-10-16. All five pinned references (PostgreSQL, LLDAP, Authelia, +KeyCape, privacyIDEA) were inspected on the fixed local Linux Docker engine +`bnt-lap001`, ID `74f93783-6cef-43a8-a3c4-f62586cd3bc1`. Missing LLDAP and +privacyIDEA images were pulled only by their observed immutable digests. Saved a +private 347,521,536-byte image archive, loaded it and re-inspected every exact +reference. Evidence and archive SHA256/location: +`docs/evidence/2026-10-16-identity-outage-recovery/offline-service-images.json`. + +The local drill no longer requires the production registry. This is not off-host +image escrow or proof of historical mutable-tag/backup lineage; those limits +remain in T15. No service custody or age key was supplied to image caching. + +## Prepare and verify the bounded native LLDAP recovery executor + +```task +id: NK-WP-0049-T29 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T13, NK-WP-0049-T27, NK-WP-0049-T28] +state_hub_task_id: "2f8c73b0-1cdd-5b22-99b6-017ccde4454b" +``` + +**Accountable worker:** codex; operator retains actual private recovery inputs. + +Completed 2026-10-16. `isolated-lldap.py` and `run-isolated-lldap.sh` provide the +exact owner-run stage in `docs/identity-service-restore-packet.md`: fixed local +engine/images, no remote Docker endpoint, original key/seed/JWT/directory data, +Linux-tmpfs decryption, memory/stdin-only private inputs, network-none/read-only +containers, isolation inspection before import, actual existing-user bind, +explicit invalid-credential denial, stable directory rows and cleanup checks. +Missing original server keys are refused; reset/replacement/notification paths +are disabled. No live Kubernetes/OpenBao/SSO path or provider grant is used. + +Evidence: `tests/test_isolated_lldap_recovery.py` exercises the actual pinned +image, disposable retained-account directory and a full synthetic encrypted +bundle through the same native executor. The private real-bundle run and its +acceptance remain T16; fixture success is not actual user/MFA/audit recovery. +See `isolated-lldap-preparation.json` in the October16 outage evidence directory +for exact test/source/target provenance and limitations. + +## Prepare the bounded native privacyIDEA token-material and audit executor + +```task +id: NK-WP-0049-T30 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T13, NK-WP-0049-T28] +state_hub_task_id: "6e4a43db-9be2-5662-bdbf-1595fce03052" +``` + +**Accountable worker:** codex; operator retains private recovery inputs. + +Completed 2026-10-16. `isolated-privacyidea.py` and its owner launcher use the +fixed local Docker target and exact cached PostgreSQL/privacyIDEA3.12.2 images. +The linked dump, original enckey/audit pair and required secret fields are +restored only into a loopback-only, nonroot, read-only, capability-free, +no-host-mount/port, tmpfs-backed environment with inspected pre-import isolation. +Decrypted host staging is tmpfs; normal cleanup removes all private data and +owned containers, with a bounded holding lifetime if the parent is interrupted. + +The native provider decrypts token-key material internally, checks every stored +audit row, adds one isolated signed entry and checks wrong-public-key/tampering +negatives. Original policy for legacy signature verification is retained only +from literal archived configuration; archived Python is never executed. Invalid +or unsigned history remains reported, not repaired or sampled away. Native +material readback is not existing-token MFA or proof of event completeness. + +Evidence: `tests/test_isolated_privacyidea_recovery.py` and +`isolated-privacyidea-preparation.json` in the October16 outage evidence folder. +Synthetic pinned-image tests exercise valid/tampered/unsigned history, malformed +keys, encrypted archive to native restore, isolation and cleanup. Real original +material/audit acceptance remains T31/T20; actual MFA remains T19. + +## Verify retained privacyIDEA token material inside the isolated provider + +```task +id: NK-WP-0049-T31 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T13, NK-WP-0049-T30] +state_hub_task_id: "26383841-8076-5c53-bbd1-9db64e32544a" +``` + +**Accountable worker:** codex; operator supplies only the independently held age +key in the hidden helper. This task extracts actual material-readback scope from +T19, preserving T19's existing-token MFA acceptance gate and historical identity. + +Completed 2026-10-16 at 19:10 UTC in the same actual run as T20. All five +retained token materials were decrypted internally with the original enckey; +an unrelated key could not reproduce any of the five. All 36 manifest hashes, +exact executor/ciphertext/target bindings, isolation and cleanup passed. Safe +receipts are the `actual-isolated-privacyidea-{recovery,review}.json` files +referenced under T20. No retained-factor authentication is claimed. +**Done when:** exact ciphertext/source/target/manifest bindings pass; the native +provider reads every nonempty encrypted token-key field using the original +enckey without exporting material; an unrelated key cannot reproduce that +material; aggregate counts and container/plaintext cleanup are recorded. + +Only bounded internal readback is accepted here. Padding/readback success does +not prove the recovered secret authenticates a retained factor; actual positive +MFA and wrong-key/wrong-code authentication refusal remain T19. No token seed, +plaintext, serial or user record belongs in the receipt, Git, State Hub or chat. + +## Deliver isolated KeyCape restore source and synthetic lifecycle proof + +```task +id: NK-WP-0049-T32 +status: done +priority: high +assignee: codex +state_hub_task_id: "cd78dbb7-a8f2-5754-8788-6eb1b7d97741" +``` + +Completed 2026-10-16. This extracts bounded source/fixture delivery from T18; +T18 retains actual original archive, issuer and selected consumer acceptance. +The adapter reuses the existing transfer/archive/custody contracts, binds the +fixed local daemon and cached images, restores private state only to temporary +memory, verifies original issuer/TLS/signing/configuration/policy bytes and runs +the original native service-client checker with wrong-secret/excess-scope denial. +Durable pre-import obligations and exact parent pidfd/session quiescence precede +loss/deadline cleanup. Daemon response uncertainty remains uncertainty after +resource absence; it never authorizes recovery success or replay. + +Frozen R6 fixes a demonstrated image-declared anonymous-volume incompatibility +using bounded helper-only tmpfs, preserving anonymous disk-volume refusal. Safe +phase markers carry no private diagnostics. Independently passed 72 focused +checks, then actual pinned-image synthetic positive, hard-parent-loss, deadline +and nonzero-after-accept cases. Independent fixed-daemon inventories and host +mount-namespace checks prove all exact resources and plaintext absent. Reaper +outcomes are retained; initial sandbox receipt lookup failure is preserved and +superseded by device-bound host verification. R1–R5 failures remain retained. + +Evidence: Custodian docs/changes/netkingdom-target-2026-10-16/ +identity-restore-adapter-next/revisions/r6/, actual-fixture-r6-all.json and +coordinator-r6-all-review.json. Exact source/dependency hashes and candidate +manifest bind the proof. This uses generated test keys only; it proves neither +actual owner-held recovery, human MFA, downstream reconnect nor native authority. + +Publication preparation R7 preserves every R6 recovery adapter byte and digest. +The normal scanner flagged eight public source-file SHA-256 values in the R6 +manifest. Explicit sha256-qualified checksums resolve those false positives; +the fixture reader strictly validates their type/shape before checking the same +bytes. R7 passes 73 focused checks including malformed/untyped digest refusal. +The frozen R6 actual four-case proof remains the runtime evidence; no repeated +native outcome is claimed for publication encoding. Original scanner refusal is +retained, and scanner policy/exemptions are unchanged. + +## Prepare the exact owner-held KeyCape recovery attempt + +```task +id: NK-WP-0049-T33 +status: wait +priority: high +assignee: codex +depends_on: [NK-WP-0049-T32, NK-WP-0049-T34, NK-WP-0049-T35, NK-WP-0049-T36] +blocking_reason: "Source custody/preflight preparation is evidenced in T34; await original TLS/trust recovery disposition T35 and selected original registration/private-admission metadata T36 before final reviewed command and existing owner process." +state_hub_task_id: "56c8d469-7a10-5d50-a30e-95cbf3cd4756" +``` + +**Accountable worker:** NetKingdom codex with KeyCape and selected consumer owners. +This umbrella retains final attempt readiness. Completed custody/preflight source +preparation is extracted into T34; T35 resolves original TLS/trust recovery and +T36 prepares the selected original registration and private admission. This split +records distinct outcomes without counting source preparation as recovery. + +After those deliverables, assemble the exact existing six-argument attended +command and admission digest, bind the integrated source/dependency revision and +fixed local target, and record execution deadline, safe receipt location, abort, +rollback and independent receipt verification through the existing owner process. +Keep private manifest derivation inside custody and original TLS/client/key inputs +in the owner's own terminal; the current null fields must refuse execution. +Existing session authorization is retained within scope; this record does not +supply missing owner assent or approve any actual recovery attempt. + +**Done when:** reviewed executable command and complete metadata-only/private +admission packet are ready for the existing attended custody path; prerequisites +and independent receipt verification are explicit. T18 still owns actual +execution, original consumer continuity and acceptance. T19 retains retained-factor +MFA. This task neither authorizes a production consumer redirect nor creates a +new client grant. + +## Deliver attended custody, metadata preflight and private manifest preparation source + +```task +id: NK-WP-0049-T34 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T32] +state_hub_task_id: "821b3a56-6f36-5812-abc9-5a00e37cb2e7" +``` + +**Accountable worker:** NetKingdom codex; independent Custodian source review. +Completed 2026-10-17 as source preparation. Existing attended custody entry points +now have a reviewed candidate sealed anonymous descriptor mode: hidden prompt, +actual public-recipient verification, strict owned/private/full-seal descriptor +admission, non-inheritable returned duplicate and explicit descriptor passing. +The existing file mode stays compatible, with its original hard-loss limitation; +no improved file-mode cleanup is claimed. Exact parent-loss tests prove descriptor +lifetime without signalling inherited user shell groups. An admitted child retains +its descriptor until it exits; parent loss is not child revocation. + +The candidate checks bounded, duplicate-free public JSON, exact admission digest, +transfer/archive and selected service bindings, typed hashes for all 17 invoked +local source/config dependencies and required Python imports before requesting a +key. TLS and ciphertext preparation uses file metadata only. Legacy explicit +manifest digests remain supported; versioned ciphertext-derived binding computes +the canonical digest privately only after exact reviewed ciphertext, authenticated +age decryption and full existing archive validation. The derived private digest +never enters safe receipts/checkpoints and grants no new consumer authority. + +The coordinator independently passed 111 focused checks. The existing custody +regression suite passed 94 checks; 61 real-SOPS tests skipped because that trusted +runtime is unavailable, so that compatibility coverage remains unverified. Tests +use generated keys/archive material only, including actual age cryptography, +synthetic hidden-prompt and exact parent-loss processes. Manifest-builder tests +mock Docker/issuer behavior and confer no new native proof. Frozen R6/R7 proof, +intermediate test failures and scanner history remain retained. + +Bounded public image readback separately establishes the cached original image's +13670142-byte `/keycape` executable as +`sha256:cd89121393e1465aa76009763602a5b8c75f9dddb5679aea6242623f135b51b4`. +This is executable identity metadata, not recovery or custody acceptance. + +Evidence: Custodian `docs/changes/netkingdom-target-2026-10-16/recovery-attempt-r1/` +(`candidate.patch`, `review.json`, source closure, attempt/admission metadata and +`public-verifier-image-readback.json`). Canonical integration/publication and +projection receipts must be recorded separately when performed; this completed +source-preparation record does not invent them. T33 remains open for complete +attempt readiness; actual recovery/consumer acceptance remains T18 and MFA T19. + +## Establish original KeyCape TLS and trust recovery ownership for outage use + +```task +id: NK-WP-0049-T35 +status: progress +priority: high +assignee: codex +depends_on: [NK-WP-0049-T34] +state_hub_task_id: "1bfd1703-589f-5511-bad5-812d860e4a71" +``` + +**Accountable worker:** NetKingdom codex, coordinating with the source owner of +Ingress/cert-manager/Traefik and the original TLS custody/provider boundary. +**Next action:** identify and record that actual owner's existing recovery path, +then obtain its metadata/disposition through the ordinary owner process. A missing +exact credential-routing catalog match is not evidence that no owner exists. + +Current source declares `kc.coulomb.social`, `sso/kc-tls`, cert-manager +`ClusterIssuer/letsencrypt-prod` and Traefik TLS termination before KeyCape 8080. +The identity backup profile excludes `kc-tls`; the verified archive therefore +establishes no independent recovery of that TLS identity/trust. Determine whether +the exact original certificate/key/trust is independently recoverable during an +issuer/cluster outage, or whether a documented reissue path is acceptable for the +selected continuity claim. Do not read or place the TLS key in work records, use +a fresh self-signed trust substitute, mutate production or claim owner assent. + +**Done when:** named owner/provider, independent outage prerequisites, original +public identity/certificate/trust hashes or accepted reissue disposition, private +custody entry point and verification/abort limits are explicit and reviewed. +Record any unavailable recovery capability as a live owner work record and bind +its dependency/unblock condition; a prose-only gap or untested archive is not +completion. This delivers preparation/disposition, not actual TLS recovery. + +2026-10-17 owner handoff progress: the four reviewed Railiance Cluster source +additions are present, including `RCLUSTER-WP-0018` and public-only TLS metadata +preparation. They are not published. The normal publication path stopped at the +existing historical identifier guard (`ensure_missing_work_record_identifiers`, +execute=False): 15 bare task-label findings and five collisions. A separately +retained read-only allocator preview records those findings; the original failed +publication stderr was not retained and is not reconstructed. No Cluster Hub +workplan/task existence or projection, actual certificate/key custody, reissue +assent or native TLS acceptance is claimed. The source record and next owner +publication action remain live; do not bypass the historical identity guard. +Evidence: Custodian October17 `cluster-integration.json`, `coordinator-checkpoint.json` +and October16 `cluster-historical-publication-r1/actual-source-allocator-preview.json`. + +## Prepare selected original service registration and private admission bindings + +```task +id: NK-WP-0049-T36 +status: progress +priority: high +assignee: codex +depends_on: [NK-WP-0049-T34] +state_hub_task_id: "8b72334b-fc27-5707-a189-bad345eaf3bc" +``` + +**Accountable worker:** NetKingdom codex with KeyCape and the selected existing +service consumer's owner. **Next action:** identify that owner and the exact +original registration's non-secret selector metadata using existing source/owner +evidence; preserve independent private custody and never retrieve a client secret. + +Bind reviewed ciphertext `7117b3fe1e4840c86b301c94c85e6b16709e5626bb0884bd0580bde630e30e30`, +its independently verified transfer, source/image/executable closure and an +explicit versioned manifest-binding mode. For the original service registration, +record client identifier, secret environment name, audience, granted scope, +subject, tenant, required roles and denied scope without values or new grants. +Describe the native service-client dependency graph and distinguish unexercised +LLDAP/Authelia/privacyIDEA/downstream flows. Keep private manifest material inside +the existing custody process, never in Git, safe receipts, State Hub or chat. + +**Done when:** the selected existing service owner and exact non-secret registration +bindings are independently established, the private admission builder validates +positive/negative source/archive/selector cases, and its metadata is ready to +combine with T35's original TLS/trust disposition under T33. This task may prepare +registration metadata while T35 proceeds independently; it does not finalize the +whole admission, perform actual recovery, redirect a consumer or confer assent. + +2026-10-17 owner handoff progress: Secrets Engine source workplan +`SECRETS-WP-0015` and bounded public selector/preflight source were published as +`c59bbf568c0be8a72ac593508f48c9b1f61ec4c1`; the central primary/railiance01 +reconciliation receipt reports the same expected/derived commit, four owner task +bindings and two T04 dependency edges, with no unresolved edges. T01/T02 source +preparation is done, T03 exact outage-compatible consumer proof/custody planning +is todo, and T04 actual admitted consumer result waits on T03 and NK-WP-0049-T33. +This publishes an owner handoff, not exact archived registration validation, +current native assent, an OpenBao read, a new grant or consumer continuity. +T36 therefore remains progress; T18/T19 and final native gates remain open. +Evidence: Custodian October17 `secrets-engine-projection.json` and October16 +`recovery-owner-handoffs-r1` source review; independent ID/UUID/status/remote +readback is recorded separately when performed. + +## Verify actual SOPS compatibility and sealed-descriptor read/write custody + +```task +id: NK-WP-0049-T37 +status: done +priority: high +assignee: codex +depends_on: [NK-WP-0049-T34] +``` + +**Accountable worker:** NetKingdom codex; independent Custodian fixture review. +Completed 2026-10-17 as generated-fixture compatibility proof. The coordinator +ran the actual reviewed SOPS 3.13.3 binary in a network/host-custody-isolated +namespace: all 65 tests passed in 14.85 seconds, including the 61 real-SOPS cases +previously skipped in T34 and four new actual sealed-FD cases. The latter cover +correct-key descriptor-only decryption, wrong-recipient refusal and descriptor-only +edit/rotation through the real Make entry points. Generated custody key files +were removed before these FD-only invocations; explicit descriptor passing, +private output modes, declared encryption-policy preservation, suppressed synthetic plaintext +and operation cleanup were checked. + +This is a dated successor to T34's historical 94-pass/61-skip record, which stays +unchanged. The prior skip is not rewritten as an earlier pass. Binary digest +`sha256:e5bec3346a873ae91d871550f3e698c1aad962aff462a080e40f25fde17fef6b` +matched the official release asset/checksum; Sigstore signature verification was +not performed. SOPS was not installed systemwide or admitted for production +runtime. Host custody was not mounted, network routes were absent, diagnostics +were suppressed and namespace teardown completed. All material was generated; +no original owner key/archive, private manifest, production credential, native +service continuity or owner assent was exercised. + +Evidence: Custodian +`docs/changes/netkingdom-target-2026-10-17/sops-real-regressions.json`, +`sops-source-tool.json` and `sops-fd-r2/` (exact test patch/manifest). The focused +custody/source checks and frozen R6/R7 native fixture evidence remain separate. +T33 attempt readiness, T18 actual recovery/consumer acceptance, T19 retained MFA, +T35 TLS/trust disposition and T36 original registration/private admission remain +open under their existing owner boundaries. + +## Accept remaining recovery and caller evidence and close the G08 handoff + +```task +id: NK-WP-0049-T03 +status: wait +priority: high +assignee: codex +depends_on: [NK-WP-0049-T02, NK-WP-0049-T16, NK-WP-0049-T17, NK-WP-0049-T18, NK-WP-0049-T19, NK-WP-0049-T20, NK-WP-0049-T21, NK-WP-0049-T22, NK-WP-0049-T23, NK-WP-0049-T24, NK-WP-0049-T26] +blocking_reason: "Await the separately tracked native service proofs, current/legacy caller dispositions and residual-scope decisions; archive recovery, backup activation, independent outage retrieval and guide publication are complete." +state_hub_task_id: "d68cd4d3-1ba3-530e-88f9-26ebb8dd6eac" +``` + +**Accountable worker:** codex. Service/credential-owner acceptance remains with +the named owner boundary. + +Owner boundary: NetKingdom, Platform and affected service owners, with Custodian +G08 receiving the final evidence. The completed archive/job milestones remain +accepted independently of this final gate. + +**Done when:** T02 and T15–T37 have their stated completed or explicitly accepted +handoff outcomes; service authentication/token/audit proof and current/legacy +caller dispositions are accepted; the source workplan and projected tasks agree; +and G08 has an exact evidence/handoff record. Record actionable residuals as live +work records before workplan closure. Preserve historical IDs and receipts; do +not call a deferred rotation or an untested full-estate restore complete. + +## Evidence locations and refinement history + +“Live” above means `docs/evidence/2026-10-16-identity-backup-live/` in NetKingdom. +Implementation preparation is in the October16 implementation directory; earlier +backup discovery/database recovery is in `docs/evidence/2026-10-15-bootstrap-recovery/`. +The source-repair receipts explicitly labelled Custodian belong to that owning +repository. Use the [recovery ceremony](../docs/bootstrap-recovery-ceremony.md) +for exact procedure and approval history. No secret values belong in task evidence. + +Refinement rule: substantial work and newly understood remaining scope must be +visible in task blocks at a checkpoint, not only in progress prose. This replan +preserves T01–T03 identity and original evidence while making the completed +milestones and each remaining acceptance gate separately manageable. + +Managed identifier assignment also consumed a preexisting staged generated brief; +the follow-up commit restores its prior published baseline while preserving the +operator's working brief and original staged version. This is a projection-tool +side effect, not new recovery evidence. + + +R7 source publication and task bindings verified: +`5fcd5952add1c0167116094298a1d5feaa60cf30` is the observed published source. +All eight canonical additions match the reviewed bytes; all 33 task statuses +match the actual hub projection, including T32 done and T33 todo. Original +staged/working brief content is preserved. Normal synchronization has zero +failures/automation errors; existing warnings and scanner false-positive history +remain retained. Custodian identity-restore-adapter-next/canonical-r7-integration.json +binds source/projection/native-fixture evidence separately. T18 remains waiting +for the actual owner-held attempt and selected consumer acceptance. + + +2026-10-17 source/attempt refinement: T34 records completed attended custody, +preflight/private-manifest source preparation and its bounded tests; T35 and T36 +make original TLS recovery ownership and selected original admission metadata live +work. T33 retains final attempt readiness and its original Hub UUID. This adds no +actual recovery, MFA, native authority or owner assent. Source task counts above +refer to this file; projection has not been claimed for this proposed refinement. + +2026-10-17 verified source follow-through: source commit `4f65e41` passed normal +local scanning and 111 canonical focused checks. The initial T34 source-only +preparation now has an exact integrated source revision; existing real-SOPS +compatibility remains partly skipped and actual owner-held execution remains T18. + +T35/T36 source preparation is underway, with 17 pinned public-source references. +railiance-cluster owns the ingress/cert-manager/cluster-backup substrate; the +inspected same-host encrypted backup source establishes no independent original +kc-tls/trust recovery or accepted reissue. Draft owner questions remain unsent; +no private TLS input was requested. The historically deployed +secrets-engine-openbao registration is a defensible proposed consumer: its +7 October issuer and 10 October consumer proofs predate the reviewed archive. +The exact selector proposal is retained without current assent or private archive +validation. No token exchange, OpenBao login, client secret retrieval, new grant +or production redirect occurred. Keep incomplete admission refused before custody. +Custodian evidence: recovery-attempt-r1/t35-t36-source-next; final source/projection +review: resume-integration-r1/publication-verification.json. diff --git a/docs/changes/netkingdom-target-2026-10-17/wp49-sops-successor-r1/README.md b/docs/changes/netkingdom-target-2026-10-17/wp49-sops-successor-r1/README.md new file mode 100644 index 00000000..f19293eb --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/wp49-sops-successor-r1/README.md @@ -0,0 +1,46 @@ +# NK49 actual-SOPS successor and owner publication readback + +`owner-refinement.patch` is an isolated exact-preimage proposal for +`NK-WP-0049-bootstrap-secret-free-recovery-handoff.md` at NetKingdom commit +`6cb43c0cc55212363a5406b02db046e2384a7c40`. It adds completed T37 for 65 actual +SOPS generated-fixture tests: 61 previously skipped cases and four actual +sealed-descriptor cases. T34's historical section stays byte-identical. Counts +become 25 done, four progress, one todo and seven wait; final closure references +T15–T37. Existing native gates remain open. + +T35 records four Railiance Cluster source additions and the unpublished owner +handoff. Publication stopped at the historical identifier guard; the read-only +preview records 15 bare-label findings and five collisions. The original failed +publication stderr was not retained. No Cluster Hub existence, projection, +private TLS recovery or native acceptance is claimed. T36 records Secrets +WP15 publication at c59bbf568c0be8a72ac593508f48c9b1f61ec4c1 and its remaining +consumer/custody/native dependencies. No current assent is inferred. + +`NK-WP-0049.preimage.md`, `NK-WP-0049.proposed.md` and `manifest.json` bind exact +bytes. This agent performed no canonical mutations, staging, synchronization or +publication, and preserved dirty sources. + +`verify_owner_publications.py` is read only: allowed Hub GET endpoints and Git +rev-parse/show/remote-get-url/ls-remote only. It checks primary/railiance01 identity, +RepoManager WP21's five and Secrets WP15's four exact source task IDs, UUIDs, +statuses and denominators, both Secrets T04 dependency edges and external NK33 +binding, published commits and remote HEAD/main. Workplan source IDs remain +uppercase; API slugs are compared to their exact canonical lowercase form. +Ownership UUIDs and statuses are never relaxed. Real index stat identities and +the authoritative workplan bytes are checked unchanged; no dirty source is +staged/reset/restored or modified. Only the requested fixed-metadata receipt is +written. Missing evidence refuses; no GET result grants authority. + +The initial verifier failed `workplan-binding-mismatch` before accepting either +owner because it compared uppercase source ID directly with lowercase API slug. +Its raw source and receipt are retained in `failed-verifier-r1/`. Independent +public snapshot readback confirmed the two exact UUID/lowercase-slug/status +bindings and nine uppercase task record IDs. R2 corrects only that distinction; +`verifier-r2.patch` records the change. R2 execution/readback remains the +coordinator's next step; no remote verification is claimed here yet. + +The knowledge pilot returned version 0.2.6, digest +8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02, +with start guidance withheld for changed sources. Current start/evidence cards +and NetKingdom SECURITY-COMPANION source were read for orientation only; the +pilot supplies no additional authority. diff --git a/docs/changes/netkingdom-target-2026-10-17/wp49-sops-successor-r1/failed-verifier-r1/owner-publication-readback.json b/docs/changes/netkingdom-target-2026-10-17/wp49-sops-successor-r1/failed-verifier-r1/owner-publication-readback.json new file mode 100644 index 00000000..ccd373d8 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/wp49-sops-successor-r1/failed-verifier-r1/owner-publication-readback.json @@ -0,0 +1,13 @@ +{ + "status": "unverified", + "scope": "two exact published workplans; read-only Git ls-remote and Hub GET snapshots", + "writes_to_source_index_refs_or_Hub": false, + "rows": [], + "hub_instance": { + "status": "ok", + "instance_role": "primary", + "instance_label": "railiance01" + }, + "reason": "workplan-binding-mismatch", + "verifier_sha256": "25311d73fbb04fad5fb5a8722b25075c00a0c41fb08dfd075c36a0e70b3351bd" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/wp49-sops-successor-r1/failed-verifier-r1/verify_owner_publications.py b/docs/changes/netkingdom-target-2026-10-17/wp49-sops-successor-r1/failed-verifier-r1/verify_owner_publications.py new file mode 100644 index 00000000..34c11873 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/wp49-sops-successor-r1/failed-verifier-r1/verify_owner_publications.py @@ -0,0 +1,140 @@ +#!/usr/bin/env python3 +"""Read-only Git+Hub task binding verifier; never syncs or changes source/index.""" +import hashlib +import json +import os +from pathlib import Path +import re +import subprocess +import urllib.request + +HERE=Path(__file__).resolve().parent +OWNERS=[ + {'repo':'repo-manager','commit':'9ebde0a9bd60d5c82910494fbe6bd1b891455cee','path':'workplans/RMGR-WP-0021-secret-detection-controls.md','id':'RMGR-WP-0021','tasks':5}, + {'repo':'secrets-engine','commit':'c59bbf568c0be8a72ac593508f48c9b1f61ec4c1','path':'workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md','id':'SECRETS-WP-0015','tasks':4}, +] +API=os.environ.get('API_BASE','http://127.0.0.1:8000').rstrip('/') +EXTERNAL={'NK-WP-0049-T33':'56c8d469-7a10-5d50-a30e-95cbf3cd4756'} + + +class Refused(Exception):pass + + +def git(root,*args): + result=subprocess.run(['git','--no-optional-locks','-C',str(root),*args], + capture_output=True,timeout=30,check=False) + if result.returncode:raise Refused('read-only-git-failed') + return result.stdout + + +def field(text,key): + values=re.findall(r'^'+re.escape(key)+r':\s*(.*?)\s*$',text,re.M) + if len(values)!=1:raise Refused('source-field-ambiguous') + return values[0].strip('"\'') + + +def source(text): + header=text.split('---',2)[1] + tasks=[] + for block in re.findall(r'```task\n(.*?)\n```',text,re.S): + deps=re.findall(r'^depends_on:\s*\[(.*?)\]',block,re.M) + tasks.append({'record_id':field(block,'id'),'id':field(block,'state_hub_task_id'), + 'status':field(block,'status'),'dependencies':[x.strip() for x in deps[0].split(',') if x.strip()] if deps else []}) + return {'id':field(header,'state_hub_workstream_id'),'slug':field(header,'id'), + 'status':field(header,'status'),'tasks':tasks} + + +def get(path): + class NoRedirect(urllib.request.HTTPRedirectHandler): + def redirect_request(self,*args,**kwargs):raise Refused('hub-redirect-refused') + opener=urllib.request.build_opener(urllib.request.ProxyHandler({}),NoRedirect) + with opener.open(urllib.request.Request(API+path,method='GET'),timeout=20) as response: + data=response.read(8*1024**2+1) + if len(data)>8*1024**2:raise Refused('hub-read-limit') + return json.loads(data) + + +def index_stat(root): + raw=git(root,'rev-parse','--git-path','index').decode().strip();path=Path(raw) + if not path.is_absolute():path=root/path + try:item=path.lstat() + except FileNotFoundError:return None + return [item.st_dev,item.st_ino,item.st_size,item.st_mtime_ns,item.st_mode] + + +def remote(root,expected,repo): + if git(root,'remote','get-url','origin').decode().strip()!='forgejo-remote:coulomb/'+repo+'.git': + raise Refused('remote-route-drift') + lines=git(root,'ls-remote','--symref','origin','HEAD','refs/heads/main').decode().splitlines() + if set(lines)!={'ref: refs/heads/main\tHEAD',expected+'\tHEAD',expected+'\trefs/heads/main'}: + raise Refused('remote-head-mismatch') + return {'HEAD':expected,'refs/heads/main':expected,'symbolic_HEAD':'refs/heads/main'} + + +def verify(): + result={'status':'unverified','scope':'two exact published workplans; read-only Git ls-remote and Hub GET snapshots', + 'writes_to_source_index_refs_or_Hub':False,'rows':[]} + try: + if API not in {'http://127.0.0.1:8000','http://127.0.0.1:18080','http://10.43.68.154:8000'}: + raise Refused('unrecognized-hub-endpoint') + health=get('/state/health') + result['hub_instance']={key:health.get(key) for key in ('status','instance_role','instance_label')} + if result['hub_instance']!={'status':'ok','instance_role':'primary','instance_label':'railiance01'}: + raise Refused('hub-identity-mismatch') + for owner in OWNERS: + root=Path('/home/worsch')/owner['repo'];before_index=index_stat(root) + if git(root,'rev-parse','HEAD').decode().strip()!=owner['commit']: + raise Refused('local-head-drift') + committed=git(root,'show',owner['commit']+':'+owner['path']) + local=(root/owner['path']).read_bytes() + if local!=committed:raise Refused('published-workplan-local-drift') + expected=source(committed.decode()) + if expected['slug']!=owner['id'] or len(expected['tasks'])!=owner['tasks']: + raise Refused('source-task-denominator-mismatch') + snapshot=get('/repos/'+owner['repo']+'/work-record-projection/snapshot') + plans=[row for row in snapshot['workplans'] if row['id']==expected['id']] + if len(plans)!=1 or any(plans[0].get(key)!=expected[key] for key in ('id','slug','status')): + raise Refused('workplan-binding-mismatch') + projected=[row for row in snapshot['tasks'] + if row.get('workplan_id',row.get('workstream_id'))==expected['id']] + if len(projected)!=len(expected['tasks']):raise Refused('projected-task-denominator-mismatch') + byid={row['id']:row for row in projected} + if len(byid)!=len(projected):raise Refused('duplicate-projected-uuid') + observed=[] + for task in expected['tasks']: + row=byid.get(task['id'],{}) + if any(row.get(key)!=task[key] for key in ('id','record_id','status')): + raise Refused('task-id-uuid-status-mismatch') + observed.append({key:row[key] for key in ('id','record_id','status')}) + identifiers={task['record_id']:task['id'] for task in expected['tasks']}|EXTERNAL + edges={(task['id'],identifiers[dep],'starts_after') for task in expected['tasks'] for dep in task['dependencies']} + actual=[edge for edge in snapshot['dependencies'] if edge['from_workplan_id']==expected['id']] + projected_edges={(edge.get('from_task_id'),edge.get('to_task_id'),edge['relationship_type']) for edge in actual} + if len(actual)!=len(edges) or projected_edges!=edges: + raise Refused('dependency-binding-mismatch') + if any(edge.get('source_commit') not in (None,owner['commit']) for edge in actual): + raise Refused('dependency-source-commit-mismatch') + for task in expected['tasks']: + for dep in task['dependencies']: + if dep in EXTERNAL: + target=get('/tasks/'+EXTERNAL[dep]) + if target.get('id')!=EXTERNAL[dep] or target.get('record_id')!=dep: + raise Refused('external-dependency-target-mismatch') + remote_readback=remote(root,owner['commit'],owner['repo']) + if index_stat(root)!=before_index or (root/owner['path']).read_bytes()!=local: + raise Refused('source-or-index-stat-changed') + result['rows'].append({'repo':owner['repo'],'published_commit':owner['commit'], + 'remote':remote_readback,'workplan':{key:plans[0][key] for key in ('id','slug','status')}, + 'tasks':observed,'dependencies':[{'from_task_id':a,'to_task_id':b,'relationship_type':c} for a,b,c in sorted(edges)], + 'source_file_sha256':hashlib.sha256(local).hexdigest(),'source_file_unchanged':True, + 'index_stat_unchanged':True}) + result['status']='verified' + except Exception as error: + result['reason']=error.args[0] if isinstance(error,Refused) else 'readback-unavailable' + result['verifier_sha256']=hashlib.sha256(Path(__file__).read_bytes()).hexdigest() + (HERE/'owner-publication-readback.json').write_text(json.dumps(result,indent=2)+'\n') + print(json.dumps({'status':result['status'],'owners':len(result['rows'])})) + return 0 if result['status']=='verified' else 2 + + +if __name__=='__main__':raise SystemExit(verify()) diff --git a/docs/changes/netkingdom-target-2026-10-17/wp49-sops-successor-r1/manifest.json b/docs/changes/netkingdom-target-2026-10-17/wp49-sops-successor-r1/manifest.json new file mode 100644 index 00000000..7c3fd510 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/wp49-sops-successor-r1/manifest.json @@ -0,0 +1,31 @@ +{ + "state": "prepared for root review; no canonical mutation", + "owner_head": "6cb43c0cc55212363a5406b02db046e2384a7c40", + "path": "workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md", + "preimage_sha256": "fc095a8bebae12a5025e911f8626e0b538e560f64433533665322ada1913dbef", + "result_sha256": "95dfb5a264ba179aba4aeddb602039a098af5c33c893a509d31f3631d39b7046", + "patch_sha256": "5364b1966334869c71a58ff2d90194db45c7ea6f3e60d57327a231f558437641", + "task_counts": { + "done": 25, + "progress": 4, + "wait": 7, + "todo": 1 + }, + "T34_historical_section_byte_identical": true, + "closure": "T15\u2013T37", + "T37": "done;65actualSOPSgeneratedtests; no productionruntimeadmission", + "knowledge_orientation": { + "package": "0.2.6", + "digest": "8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02", + "start_status": "withheld; currentcard+NetKingdomSECURITY-COMPANION+evidencecardread asorientationonly", + "authority_granted": false + }, + "verifier_sha256": "ab18c1e934ca66b78d21fc7268b9b989569e2249e434d6688cb9de0083d2fda2", + "verifier_R1": { + "state": "failed workplan-binding-mismatch; owners0", + "retained": "failed-verifier-r1/", + "cause": "source uppercase recordID compared literally with canonical lower-case API slug", + "UUID_or_status_relaxed": false + }, + "verifier_R2": "source_record_id remains exact uppercase; expectedAPI slug derived lower-case and compared exactly; UUID/status/taskIDs/edges unchanged" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/wp49-sops-successor-r1/owner-refinement.patch b/docs/changes/netkingdom-target-2026-10-17/wp49-sops-successor-r1/owner-refinement.patch new file mode 100644 index 00000000..748cb04a --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/wp49-sops-successor-r1/owner-refinement.patch @@ -0,0 +1,100 @@ +--- a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md ++++ b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md +@@ -28,7 +28,7 @@ + or newly granted authority. The earlier dated narrative remains in Git at + `cc2dd01`; its evidence references are carried into the tasks below. + +-**Current position, source refinement 2026-10-17:** 24 tasks done; 4 in ++**Current position, source refinement 2026-10-17:** 25 tasks done; 4 in + progress; 1 ready to start (`todo`); 7 waiting on explicit prerequisites. These are task counts, not an effort-based + completion percentage. Assignees are also written in task descriptions because + the current Forge projector does not populate the dedicated Hub assignee field. The outage-retrieval tool and restore-packet draft are now prepared; +@@ -1071,6 +1071,19 @@ + its dependency/unblock condition; a prose-only gap or untested archive is not + completion. This delivers preparation/disposition, not actual TLS recovery. + ++2026-10-17 owner handoff progress: the four reviewed Railiance Cluster source ++additions are present, including `RCLUSTER-WP-0018` and public-only TLS metadata ++preparation. They are not published. The normal publication path stopped at the ++existing historical identifier guard (`ensure_missing_work_record_identifiers`, ++execute=False): 15 bare task-label findings and five collisions. A separately ++retained read-only allocator preview records those findings; the original failed ++publication stderr was not retained and is not reconstructed. No Cluster Hub ++workplan/task existence or projection, actual certificate/key custody, reissue ++assent or native TLS acceptance is claimed. The source record and next owner ++publication action remain live; do not bypass the historical identity guard. ++Evidence: Custodian October17 `cluster-integration.json`, `coordinator-checkpoint.json` ++and October16 `cluster-historical-publication-r1/actual-source-allocator-preview.json`. ++ + ## Prepare selected original service registration and private admission bindings + + ```task +@@ -1103,6 +1116,59 @@ + registration metadata while T35 proceeds independently; it does not finalize the + whole admission, perform actual recovery, redirect a consumer or confer assent. + ++2026-10-17 owner handoff progress: Secrets Engine source workplan ++`SECRETS-WP-0015` and bounded public selector/preflight source were published as ++`c59bbf568c0be8a72ac593508f48c9b1f61ec4c1`; the central primary/railiance01 ++reconciliation receipt reports the same expected/derived commit, four owner task ++bindings and two T04 dependency edges, with no unresolved edges. T01/T02 source ++preparation is done, T03 exact outage-compatible consumer proof/custody planning ++is todo, and T04 actual admitted consumer result waits on T03 and NK-WP-0049-T33. ++This publishes an owner handoff, not exact archived registration validation, ++current native assent, an OpenBao read, a new grant or consumer continuity. ++T36 therefore remains progress; T18/T19 and final native gates remain open. ++Evidence: Custodian October17 `secrets-engine-projection.json` and October16 ++`recovery-owner-handoffs-r1` source review; independent ID/UUID/status/remote ++readback is recorded separately when performed. ++ ++## Verify actual SOPS compatibility and sealed-descriptor read/write custody ++ ++```task ++id: NK-WP-0049-T37 ++status: done ++priority: high ++assignee: codex ++depends_on: [NK-WP-0049-T34] ++``` ++ ++**Accountable worker:** NetKingdom codex; independent Custodian fixture review. ++Completed 2026-10-17 as generated-fixture compatibility proof. The coordinator ++ran the actual reviewed SOPS 3.13.3 binary in a network/host-custody-isolated ++namespace: all 65 tests passed in 14.85 seconds, including the 61 real-SOPS cases ++previously skipped in T34 and four new actual sealed-FD cases. The latter cover ++correct-key descriptor-only decryption, wrong-recipient refusal and descriptor-only ++edit/rotation through the real Make entry points. Generated custody key files ++were removed before these FD-only invocations; explicit descriptor passing, ++private output modes, declared encryption-policy preservation, suppressed synthetic plaintext ++and operation cleanup were checked. ++ ++This is a dated successor to T34's historical 94-pass/61-skip record, which stays ++unchanged. The prior skip is not rewritten as an earlier pass. Binary digest ++`sha256:e5bec3346a873ae91d871550f3e698c1aad962aff462a080e40f25fde17fef6b` ++matched the official release asset/checksum; Sigstore signature verification was ++not performed. SOPS was not installed systemwide or admitted for production ++runtime. Host custody was not mounted, network routes were absent, diagnostics ++were suppressed and namespace teardown completed. All material was generated; ++no original owner key/archive, private manifest, production credential, native ++service continuity or owner assent was exercised. ++ ++Evidence: Custodian ++`docs/changes/netkingdom-target-2026-10-17/sops-real-regressions.json`, ++`sops-source-tool.json` and `sops-fd-r2/` (exact test patch/manifest). The focused ++custody/source checks and frozen R6/R7 native fixture evidence remain separate. ++T33 attempt readiness, T18 actual recovery/consumer acceptance, T19 retained MFA, ++T35 TLS/trust disposition and T36 original registration/private admission remain ++open under their existing owner boundaries. ++ + ## Accept remaining recovery and caller evidence and close the G08 handoff + + ```task +@@ -1122,7 +1188,7 @@ + G08 receiving the final evidence. The completed archive/job milestones remain + accepted independently of this final gate. + +-**Done when:** T02 and T15–T36 have their stated completed or explicitly accepted ++**Done when:** T02 and T15–T37 have their stated completed or explicitly accepted + handoff outcomes; service authentication/token/audit proof and current/legacy + caller dispositions are accepted; the source workplan and projected tasks agree; + and G08 has an exact evidence/handoff record. Record actionable residuals as live diff --git a/docs/changes/netkingdom-target-2026-10-17/wp49-sops-successor-r1/verifier-r2.patch b/docs/changes/netkingdom-target-2026-10-17/wp49-sops-successor-r1/verifier-r2.patch new file mode 100644 index 00000000..e2637661 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/wp49-sops-successor-r1/verifier-r2.patch @@ -0,0 +1,29 @@ +--- a/verify_owner_publications.py ++++ b/verify_owner_publications.py +@@ -40,7 +40,8 @@ + deps=re.findall(r'^depends_on:\s*\[(.*?)\]',block,re.M) + tasks.append({'record_id':field(block,'id'),'id':field(block,'state_hub_task_id'), + 'status':field(block,'status'),'dependencies':[x.strip() for x in deps[0].split(',') if x.strip()] if deps else []}) +- return {'id':field(header,'state_hub_workstream_id'),'slug':field(header,'id'), ++ return {'id':field(header,'state_hub_workstream_id'),'source_record_id':field(header,'id'), ++ 'slug':field(header,'id').lower(), + 'status':field(header,'status'),'tasks':tasks} + + +@@ -89,7 +90,7 @@ + local=(root/owner['path']).read_bytes() + if local!=committed:raise Refused('published-workplan-local-drift') + expected=source(committed.decode()) +- if expected['slug']!=owner['id'] or len(expected['tasks'])!=owner['tasks']: ++ if expected['source_record_id']!=owner['id'] or len(expected['tasks'])!=owner['tasks']: + raise Refused('source-task-denominator-mismatch') + snapshot=get('/repos/'+owner['repo']+'/work-record-projection/snapshot') + plans=[row for row in snapshot['workplans'] if row['id']==expected['id']] +@@ -125,6 +126,7 @@ + raise Refused('source-or-index-stat-changed') + result['rows'].append({'repo':owner['repo'],'published_commit':owner['commit'], + 'remote':remote_readback,'workplan':{key:plans[0][key] for key in ('id','slug','status')}, ++ 'source_record_id':expected['source_record_id'], + 'tasks':observed,'dependencies':[{'from_task_id':a,'to_task_id':b,'relationship_type':c} for a,b,c in sorted(edges)], + 'source_file_sha256':hashlib.sha256(local).hexdigest(),'source_file_unchanged':True, + 'index_stat_unchanged':True}) diff --git a/docs/changes/netkingdom-target-2026-10-17/wp49-sops-successor-r1/verify_owner_publications.py b/docs/changes/netkingdom-target-2026-10-17/wp49-sops-successor-r1/verify_owner_publications.py new file mode 100644 index 00000000..5fcd95e7 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/wp49-sops-successor-r1/verify_owner_publications.py @@ -0,0 +1,142 @@ +#!/usr/bin/env python3 +"""Read-only Git+Hub task binding verifier; never syncs or changes source/index.""" +import hashlib +import json +import os +from pathlib import Path +import re +import subprocess +import urllib.request + +HERE=Path(__file__).resolve().parent +OWNERS=[ + {'repo':'repo-manager','commit':'9ebde0a9bd60d5c82910494fbe6bd1b891455cee','path':'workplans/RMGR-WP-0021-secret-detection-controls.md','id':'RMGR-WP-0021','tasks':5}, + {'repo':'secrets-engine','commit':'c59bbf568c0be8a72ac593508f48c9b1f61ec4c1','path':'workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md','id':'SECRETS-WP-0015','tasks':4}, +] +API=os.environ.get('API_BASE','http://127.0.0.1:8000').rstrip('/') +EXTERNAL={'NK-WP-0049-T33':'56c8d469-7a10-5d50-a30e-95cbf3cd4756'} + + +class Refused(Exception):pass + + +def git(root,*args): + result=subprocess.run(['git','--no-optional-locks','-C',str(root),*args], + capture_output=True,timeout=30,check=False) + if result.returncode:raise Refused('read-only-git-failed') + return result.stdout + + +def field(text,key): + values=re.findall(r'^'+re.escape(key)+r':\s*(.*?)\s*$',text,re.M) + if len(values)!=1:raise Refused('source-field-ambiguous') + return values[0].strip('"\'') + + +def source(text): + header=text.split('---',2)[1] + tasks=[] + for block in re.findall(r'```task\n(.*?)\n```',text,re.S): + deps=re.findall(r'^depends_on:\s*\[(.*?)\]',block,re.M) + tasks.append({'record_id':field(block,'id'),'id':field(block,'state_hub_task_id'), + 'status':field(block,'status'),'dependencies':[x.strip() for x in deps[0].split(',') if x.strip()] if deps else []}) + return {'id':field(header,'state_hub_workstream_id'),'source_record_id':field(header,'id'), + 'slug':field(header,'id').lower(), + 'status':field(header,'status'),'tasks':tasks} + + +def get(path): + class NoRedirect(urllib.request.HTTPRedirectHandler): + def redirect_request(self,*args,**kwargs):raise Refused('hub-redirect-refused') + opener=urllib.request.build_opener(urllib.request.ProxyHandler({}),NoRedirect) + with opener.open(urllib.request.Request(API+path,method='GET'),timeout=20) as response: + data=response.read(8*1024**2+1) + if len(data)>8*1024**2:raise Refused('hub-read-limit') + return json.loads(data) + + +def index_stat(root): + raw=git(root,'rev-parse','--git-path','index').decode().strip();path=Path(raw) + if not path.is_absolute():path=root/path + try:item=path.lstat() + except FileNotFoundError:return None + return [item.st_dev,item.st_ino,item.st_size,item.st_mtime_ns,item.st_mode] + + +def remote(root,expected,repo): + if git(root,'remote','get-url','origin').decode().strip()!='forgejo-remote:coulomb/'+repo+'.git': + raise Refused('remote-route-drift') + lines=git(root,'ls-remote','--symref','origin','HEAD','refs/heads/main').decode().splitlines() + if set(lines)!={'ref: refs/heads/main\tHEAD',expected+'\tHEAD',expected+'\trefs/heads/main'}: + raise Refused('remote-head-mismatch') + return {'HEAD':expected,'refs/heads/main':expected,'symbolic_HEAD':'refs/heads/main'} + + +def verify(): + result={'status':'unverified','scope':'two exact published workplans; read-only Git ls-remote and Hub GET snapshots', + 'writes_to_source_index_refs_or_Hub':False,'rows':[]} + try: + if API not in {'http://127.0.0.1:8000','http://127.0.0.1:18080','http://10.43.68.154:8000'}: + raise Refused('unrecognized-hub-endpoint') + health=get('/state/health') + result['hub_instance']={key:health.get(key) for key in ('status','instance_role','instance_label')} + if result['hub_instance']!={'status':'ok','instance_role':'primary','instance_label':'railiance01'}: + raise Refused('hub-identity-mismatch') + for owner in OWNERS: + root=Path('/home/worsch')/owner['repo'];before_index=index_stat(root) + if git(root,'rev-parse','HEAD').decode().strip()!=owner['commit']: + raise Refused('local-head-drift') + committed=git(root,'show',owner['commit']+':'+owner['path']) + local=(root/owner['path']).read_bytes() + if local!=committed:raise Refused('published-workplan-local-drift') + expected=source(committed.decode()) + if expected['source_record_id']!=owner['id'] or len(expected['tasks'])!=owner['tasks']: + raise Refused('source-task-denominator-mismatch') + snapshot=get('/repos/'+owner['repo']+'/work-record-projection/snapshot') + plans=[row for row in snapshot['workplans'] if row['id']==expected['id']] + if len(plans)!=1 or any(plans[0].get(key)!=expected[key] for key in ('id','slug','status')): + raise Refused('workplan-binding-mismatch') + projected=[row for row in snapshot['tasks'] + if row.get('workplan_id',row.get('workstream_id'))==expected['id']] + if len(projected)!=len(expected['tasks']):raise Refused('projected-task-denominator-mismatch') + byid={row['id']:row for row in projected} + if len(byid)!=len(projected):raise Refused('duplicate-projected-uuid') + observed=[] + for task in expected['tasks']: + row=byid.get(task['id'],{}) + if any(row.get(key)!=task[key] for key in ('id','record_id','status')): + raise Refused('task-id-uuid-status-mismatch') + observed.append({key:row[key] for key in ('id','record_id','status')}) + identifiers={task['record_id']:task['id'] for task in expected['tasks']}|EXTERNAL + edges={(task['id'],identifiers[dep],'starts_after') for task in expected['tasks'] for dep in task['dependencies']} + actual=[edge for edge in snapshot['dependencies'] if edge['from_workplan_id']==expected['id']] + projected_edges={(edge.get('from_task_id'),edge.get('to_task_id'),edge['relationship_type']) for edge in actual} + if len(actual)!=len(edges) or projected_edges!=edges: + raise Refused('dependency-binding-mismatch') + if any(edge.get('source_commit') not in (None,owner['commit']) for edge in actual): + raise Refused('dependency-source-commit-mismatch') + for task in expected['tasks']: + for dep in task['dependencies']: + if dep in EXTERNAL: + target=get('/tasks/'+EXTERNAL[dep]) + if target.get('id')!=EXTERNAL[dep] or target.get('record_id')!=dep: + raise Refused('external-dependency-target-mismatch') + remote_readback=remote(root,owner['commit'],owner['repo']) + if index_stat(root)!=before_index or (root/owner['path']).read_bytes()!=local: + raise Refused('source-or-index-stat-changed') + result['rows'].append({'repo':owner['repo'],'published_commit':owner['commit'], + 'remote':remote_readback,'workplan':{key:plans[0][key] for key in ('id','slug','status')}, + 'source_record_id':expected['source_record_id'], + 'tasks':observed,'dependencies':[{'from_task_id':a,'to_task_id':b,'relationship_type':c} for a,b,c in sorted(edges)], + 'source_file_sha256':hashlib.sha256(local).hexdigest(),'source_file_unchanged':True, + 'index_stat_unchanged':True}) + result['status']='verified' + except Exception as error: + result['reason']=error.args[0] if isinstance(error,Refused) else 'readback-unavailable' + result['verifier_sha256']=hashlib.sha256(Path(__file__).read_bytes()).hexdigest() + (HERE/'owner-publication-readback.json').write_text(json.dumps(result,indent=2)+'\n') + print(json.dumps({'status':result['status'],'owners':len(result['rows'])})) + return 0 if result['status']=='verified' else 2 + + +if __name__=='__main__':raise SystemExit(verify())