Register OpenBao retention reactivation

k8s/railiance/20-runtime.yaml

@@ -42,6 +42,38 @@ metadata:
     app.kubernetes.io/name: activity-core
     app.kubernetes.io/part-of: activity-core
 data:
+  openbao-retention-closeout.md: |
+    ---
+    id: "e274defb-28f2-571e-abcb-c17b57eab473"
+    name: "RAILIANCE-WP-0020 OpenBao Retention Closeout"
+    type: activity-definition
+    version: "1.0"
+    enabled: true
+    owner: railiance-master
+    governance: custodian
+    status: active
+    created: "2026-08-04"
+    trigger:
+      type: scheduled
+      at: "2026-08-17T08:00:00+02:00"
+      timezone: Europe/Berlin
+    ---
+
+    # RAILIANCE-WP-0020 OpenBao retention closeout
+
+    Emits a claimable ops run after the 14-day retention window. It never
+    deletes retained CoulombCore resources automatically.
+
+    ```rule
+    id: reactivate-openbao-retention-closeout
+    condition: ""
+    action:
+      task_template: "Reactivate RAILIANCE-WP-0020 for OpenBao retention closeout"
+      description: "Move RAILIANCE-WP-0020 from backlog to active, run the railiance01 disaster-recovery drill, verify retained rollback requirements, and request fresh explicit approval before destructive CoulombCore cleanup. Remaining task: RAILIANCE-WP-0020-T08."
+      target_repo: railiance-master
+      priority: medium
+      labels: ["railiance", "openbao", "retention", "reactivation", "RAILIANCE-WP-0020-T08"]
+    ```
   daily-statehub-wsjf-triage.md: |
     ---
     id: "6fca51fa-387a-4fd0-bc4e-d62c29eb859a"
@@ -1384,4 +1416,3 @@ spec:
                 name: actcore-runtime-config
             - secretRef:
                 name: actcore-runtime-secret
-