the-custodian/docs/changes/netkingdom-target-2026-10-17/native-identity-r1

Original identity recovery preparation — 17 October 2026

This packet advances NK-WP-0049-T33/T35/T36, RCLUSTER-WP-0018-T02 and SECRETS-WP-0015-T03 through source preparation. No owner or founder assent is created. No native recovery, private archive read, credential retrieval, token exchange, OpenBao login, rotation or production action occurred.

The existing consumer's eight-field public selector passes its offline AST-only checker against the reviewed service_auth.py hash. See selector-preflight.json. The TLS source still names kc.coulomb.social, sso/kc-tls, ClusterIssuer/letsencrypt-prod and Traefik. The identity archive excludes kc-tls; same-host encrypted cluster backups do not establish independent original certificate/key/trust recovery. Fetching today's public endpoint certificate would not establish the archive-time original or independent private custody.

Exact next deliverables

1. RCLUSTER-WP-0018-T02: the actual custody/provider owner supplies the fields in owner-declaration.template.json: independently recoverable original artifact, public certificate/chain/trust provenance and hashes, private custody entry point reference and outage prerequisites. Alternatively, the existing owners and founder explicitly accept a concrete reissue disposition naming the changed continuity claim, dependencies and outage limitations. Neither path is decided by this packet. Original TLS and accepted reissue are distinct.
2. SECRETS-WP-0015-T03: review consumer-proof-plan.md and disposition its outage dependency with the actual service/custody owners. Public source correspondence is established; exact archive presence/uniqueness and current recovery assent remain absent. Existing consumer custody depends on attended OpenBao OIDC and forbids a client-secret file. Do not silently replace that source with an archive value or injected callback.
3. NetKingdom reviews the narrow adapter change in selector-uniqueness.patch. It requires exactly one matching registration in the already-restored payload before further runtime/private inputs. Current KeyCape Go configuration also rejects duplicate IDs; this change makes the adapter's own check explicit, and is not evidence of a native duplicate-registration exploit. Original behavior and focused regression receipts are retained separately.
4. T33 assembles the complete admission and exact six-argument command only when those prerequisites are reviewed. See next-attempt-proposal.json. Missing TLS/custody/assent fields remain null and the proposal is non-executable.

Changes to the adapter require a fresh dependency/admission binding. Frozen historical fixture/attempt receipts are not rewritten as results of this change. Only the normal owner publication and projection process may publish canonical source; root coordinates that process. No task is marked done by this packet.

Foreign waits and authority

Read-only Hub observations are retained in hub-readback.json. The latest cases observed are nk49-t35-rcluster18 receipt a2e5ed16-0da0-4ab9-bc0a-d82bd0a393f1, nk49-t36-secrets15 receipt 8a73a503-7479-426b-b2ad-e88f32e4c7e8, and secrets15-nk49-readiness receipt 3f905339-a4c9-428e-9cbd-fa490c144c7a. All remain waiting. Cluster publication is already evidenced; the older unpublished-Cluster reason is historical and superseded. No worker wake, message or Hub write was performed.

Custodian supervision is supervised and grants no authority. The Emergent Security start retrieval returned package 0.2.6, digest 8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02, withheld because upstream sources changed. Current owner instructions, environment orientation, Security Companion and identity/start card source were read directly; package guidance is orientation only. Routing discovery is recorded in routing-discovery.json and supplies no credential authority.