Publish backup-daily workload declaration for atm-backup-daily (ACTIVITY-WP-0042-T03)

The founder confirmed on 2026-10-08, relayed by ops-warden, that the
daily-cnpg-option-a-backup worker is the atm-backup-daily unit. Declare
workload identity backup-daily with membership z2-protected
(confidential/high, M1, below floor: an honest gap). ops-warden consumes
it under WARDEN-WP-0040-T02.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 344895@bnt-lap001
Assistant-Session: 0e75091f-d556-49a1-a38a-0595555f2870

declarations/backup-daily/tenancy.yaml

@@ -0,0 +1,123 @@
+# backup-daily workload identity and security-zone declaration
+# Standard: net-kingdom/canon/standards/security-zones_v0.1.md §6
+#   (independently governed operational execution unit, declared directly in its
+#   responsible repo; not a managed rapp deployable)
+# Conformance rule: accuracy, not altitude. Nothing here is aspirational.
+#
+# Founder confirmed on 2026-10-08 (relayed by ops-warden, hub msg 49292aca) that
+# activity-core's daily-cnpg-option-a-backup worker is the unit the ops-warden
+# actor atm-backup-daily stands for; classification ordinary, not z2-continuity.
+# Consumer: ops-warden WARDEN-WP-0040-T02 (declaration_ref to this file).
+# Tenancy axes are graded conservatively for a scheduled batch unit with no
+# inbound callers and no datastore of its own.
+
+schema_version: "0.1"
+framework: netkingdom-tenancy-posture
+service: backup-daily
+role: scheduled-backup-execution
+
+workload_identity:
+  name: backup-daily
+  kind: maintenance-job
+  responsible_repo: activity-core
+  # The activity-core Temporal worker on railiance01 executing the daily-cnpg-
+  # option-a-backup ActivityDefinition: the code-registered bounded operation
+  # cnpg_option_a_backup (ACT-ADR-007), which calls railiance-platform's cnpg-
+  # option-a-backup tool to age-encrypt logical dumps of r01-forgejo-db,
+  # r01-net-kingdom-pg and r01-state-hub-db and upload them to the Nextcloud
+  # offsite lane. It never restores.
+  identity_bindings:
+    - scheme: ssh-certificate
+      authority: ops-warden
+      subject: atm-backup-daily
+      # atm-* is a non-human automation actor; the schema offers service|agent.
+      principal_type: service
+      environment: prod
+    - scheme: kubernetes-service-account
+      authority: railiance01
+      # The worker Deployment sets no serviceAccountName; it runs as the
+      # namespace default SA, which the databases-namespace RoleBinding names.
+      subject: system:serviceaccount:activity-core:default
+      principal_type: service
+      environment: prod
+
+tenancy:
+  current:
+    I: "n/a"
+    A: "n/a"
+    E: 0
+    P: "n/a"
+    R: "n/a"
+    V: 0
+  target:
+    I: "n/a"
+    A: "n/a"
+    E: 0
+    P: "n/a"
+    R: "n/a"
+    V: 0
+  reviewed: "2026-10-09"
+  review_due: "2027-04-09"
+  service_class: batch
+  permanent: [I, A, P, R]
+
+  gap:
+    I: >-
+      n/a. The unit has no inbound request surface: a Temporal Schedule fires
+      it. No caller presents an identity for it to verify.
+    A: >-
+      n/a, on the same ground as I. There is no request to bind to a tenant.
+      Execution authority is the code-registered operation (ACT-ADR-007) and
+      the databases-namespace RoleBinding, not a per-request decision.
+    E: >-
+      E0. One process dumps several owners' databases (Forgejo, net-kingdom,
+      State Hub) with no tenant partitioning between them. This is
+      accurate. A backup sweep has no tenant-scoped choke point to build.
+    P: >-
+      n/a. No primary datastore. Dumps are transient in the worker and are
+      uploaded encrypted to the railiance-platform-owned offsite lane.
+    R: >-
+      n/a. Nothing is held at rest here. Retention of the uploaded artifacts
+      belongs to the offsite lane's owner (railiance-platform).
+    V: >-
+      V0. One worker on the single-node railiance01 reef, misfire policy
+      skip, and no exercised recovery objective for the job itself.
+
+zones:
+  standard: security-zones_v0.1
+  membership: z2-protected
+  responsible_party: activity-core
+  justification: >-
+    The unit runs in prod and holds plaintext logical dumps of production
+    databases (Forgejo, net-kingdom, State Hub) before encryption, so its
+    context is confidential data at high criticality, which floors at M2.
+    It is ordinary, not z2-continuity: losing a nightly run delays an RPO
+    point but breaks no access or recovery path. Declared M1 is below the M2
+    floor, so admission is expected to resolve below-floor and the effective
+    zone stays unknown until M2 evidence (SLO history, on-call, incident
+    readiness) exists. This is a recorded gap, not a claim of admission.
+  context:
+    maturity: M1
+    criticality: high
+    data_classification: confidential
+  evidence:
+    - ref: activity-definitions/daily-cnpg-option-a-backup.md
+      supports: [prod-schedule, targets, non-secret-evidence-sink]
+    - ref: k8s/railiance/26-worker-cnpg-backup-rbac.yaml
+      supports: [service-account-binding, databases-exec-scope]
+    - ref: docs/adr/adr-007-bounded-operations.md
+      supports: [bounded-operation, no-general-executor]
+    - ref: docs/runbook.md
+      supports: [M1, production-runbook]
+  reviewed: "2026-10-09"
+  review_due: "2027-01-09"
+
+notes:
+  - >-
+    Data classification is activity-core's conservative reading in the absence
+    of an owner-declared class for the source databases. If their owners
+    declare a lower class, re-review membership here as a reviewed change.
+  - >-
+    Maturity M1 rests on production operation, the runbook and the
+    deterministic automation-status surface; no formal promotion record exists
+    yet.

workplans/ACTIVITY-WP-0042-platform-backup-restore-evidence-scheduling.md

@@ -100,10 +100,9 @@ acceptance and live proof remain incomplete; T02 is not done.
 
 ```task
 id: ACTIVITY-WP-0042-T03
-status: wait
-needs_human: true
-decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e
-blocking_reason: "Founder must confirm whether activity-core's backup worker is the atm-backup-daily unit before declaring to ops-warden."
+status: done
+needs_human: false
+blocking_reason: null
 priority: low
 state_hub_task_id: "e1c313dc-9a94-5b7c-b406-604b700bf3eb"
 ```
@@ -117,6 +116,18 @@ otherwise the declaring owner is whoever holds the actor's issuance
 
 2026-10-03: human gate routed to hub decision 89f1058f-33bc-47a8-8a49-0b44d426c67e (D2: ArgoCD owns production: go-ahead sequence for railiance-apps-root, issue-core, policy-nexus and activity-core automation) by CUST-WP-0075; resolving that decision raises C-40 here.
 
+2026-10-09: done. The founder confirmed on 2026-10-08, in an ops-warden session
+(hub msg 49292aca), that the `daily-cnpg-option-a-backup` worker is the
+`atm-backup-daily` unit. Classification: ordinary, not z2-continuity. The
+confirmation covers T03 only and does not resolve D2 (89f1058f). The decision
+link is removed here because D2 still gates other tasks. Published
+`declarations/backup-daily/tenancy.yaml` (workload `backup-daily`; bindings
+ssh-cert `atm-backup-daily` and SA `activity-core:default`). The founder chose
+membership `z2-protected` with context confidential/high/M1, so admission is
+expected to resolve below-floor (effective `unknown`) until M2 evidence exists.
+This is a recorded gap, not a claim of admission. Validated with the
+net-kingdom tenancy-posture validator. ops-warden compiles it under
+WARDEN-WP-0040-T02.
 
 ## Prepare the concrete scheduling and runner proposal