Record persistent provider rejection and tested read-only share diagnosis

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29

docs/evidence/2026-10-03-root-custody-finish-header-retry-rejected.json

@@ -0,0 +1,20 @@
+{
+  "artifact": "root-custody-history-20261003T192343Z-43e7c034d42442c69fc0129872325b70.json.age",
+  "current_live_baseline_matches": true,
+  "digest": "33a2ae086385028db1b654aa5646b7a98bcde1c5878c804e19315dadc3f87248",
+  "error_code": "new_artifact_upload_failed",
+  "finished_at": "2026-10-03T19:23:44.017989+00:00",
+  "historical_config_present": true,
+  "historical_credential_status": "historical-owner-and-revocation-unverified",
+  "historical_share_matches_current_lane": false,
+  "independent_escrow_recipient_matches_current_lane": true,
+  "kv_version": 1,
+  "lane_kv_version": 3,
+  "ok": false,
+  "record_id": "nk-custody:platform-root",
+  "recorded_at": "2026-10-03T19:23:42.394837+00:00",
+  "revision": 1,
+  "stage": "provider_upload",
+  "status": "failed",
+  "upload_http_status": 401
+}

docs/evidence/2026-10-03-root-grant-delivery-progress.md

@@ -245,3 +245,36 @@ key or account-fallback change was made. Source synchronization does not establi
 rollout of older vendored backup clients; owner records that refresh requirement
 separately. The corrected custody finish command needs a new attended run and
 fresh receipt to prove this live provider path.
+
+## Header-corrected live retry still rejected — 2026-10-03
+
+Founder ran the corrected helper with fresh receipt
+`/tmp/platform-root-finish-20261003T192330Z-290055.json`. The
+[retained retry receipt](2026-10-03-root-custody-finish-header-retry-rejected.json)
+again reports provider upload HTTP 401, now tied to backup lane KV version 3.
+Current custody baseline and independent escrow checks pass, and the historical
+share remains different from the current lane. The header correction does not
+resolve this live rejection; an invalid, protected, expired or mismapped share
+cannot be distinguished from client endpoint/auth semantics by 401 alone.
+
+Producer is preparing a bounded read-only attended provider/share inspection:
+compare the current protected token with the operator's exact reviewed share,
+report owner/path/create-only permissions, password/expiry indicators and safe
+endpoint probes. No upload, rotation, provider share mutation or IAM widening
+is authorized by diagnosis alone. Another unchanged finish retry is not requested.
+The remaining task stays blocked on diagnosed provider delivery and its live
+encrypted backup/readback proof; source/consumer/audit readiness is preserved.
+
+Read-only inspection implementation synced at producer
+`4dd9646ec21b63a7743dae0ad3273da2f73adefe`. The existing attended wrapper now
+accepts `--inspect-share`: current governed OCS share inventory is compared in
+protected memory, and fixed provider public routes receive depth-zero PROPFIND
+only. Output contains binding booleans and safe status classifications. Full-main
+inspection tests forbid entering the backup roundtrip. Twenty-three finish tests
+pass. Final review correction synced at
+`fee1d339f98d0fd7ec2336d946eea2340d557f8a`: aware expiry offsets are converted
+correctly, naive expiry and omitted password remain unknown, and clearly
+protected/expired shares skip public authentication probes. Twenty-five finish
+tests pass. Exact expected/derived remote projection applied, working tree clean.
+Inspection still requires the founder's own attended credential route;
+no provider conclusion or actual backup success is inferred from source tests.

workplans/NK-WP-0045-root-grant-custody-record.md

@@ -120,8 +120,8 @@ depends_on: [NK-WP-0045-T04, RPF-WP-0049-T05]
 wait_kind: both
 blocked_on: message-from:railiance-platform
 needs_human: true
-intervention_note: "Run the prepared root-custody-finish-attended.sh through the existing founder OIDC/MFA route, with a fresh receipt. This is current restore/backup readback execution; design/go-forward approval is already recorded."
-blocking_reason: "Live source/consumer/audit and current baseline/independent escrow checks pass. Provider upload rejected HTTP 401; producer is correcting the missing required public DAV request header. Closure requires a new attended encrypted history upload/readback/decryption receipt after the tested correction. No new design approval or real grant is required."
+intervention_note: "Use the tested bounded read-only provider/share inspection packet from railiance-platform in the founder OIDC/MFA terminal, with a fresh receipt. Do not repeat the unchanged finish command; approvals are already recorded."
+blocking_reason: "Source/consumer/audit and baseline/escrow checks pass. Header-corrected provider upload still rejects HTTP 401 at backup lane KV version 3. Requires bounded operator share/endpoint diagnosis before repair, then actual encrypted history upload/readback/decryption proof; no blind same-command retry or new generic approval."
 priority: medium
 state_hub_task_id: "628e8a3b-17a4-5f97-a484-c564a87d650d"
 ```
@@ -406,3 +406,20 @@ Forty-one relevant tests pass; no credentials/endpoints/policies or account
 fallback changed. Source-only refresh requirements for vendored backup workloads
 are tracked by the platform owner and are not represented as deployed. T05
 awaits a fresh attended live finish receipt from the corrected source.
+
+Header-corrected actual retry `20261003T192330Z-290055` still failed HTTP 401 at
+provider upload, lane KV version 3; current baseline and independent escrow match.
+Header correction did not prove the actual cause or resolve provider delivery.
+Owner is preparing bounded read-only provider share/endpoint inspection before
+any credential or transport repair. T05/plan remain blocked; unchanged repeated
+finish commands are not an actionable next step until diagnosis is available.
+
+Producer diagnostic `4dd9646ec21b63a7743dae0ad3273da2f73adefe` implements
+`--inspect-share` in the existing bounded wrapper. It reads owner-scoped OCS
+share bindings and compares current/documented public routes with depth-zero
+PROPFIND, emitting safe metadata/statuses. Full-main tests prevent uploads.
+Final review `fee1d339f98d0fd7ec2336d946eea2340d557f8a` preserves unknown
+password and expiry-clock information and skips redundant auth probes on clearly
+protected/expired shares; 25 finish tests pass, exact remote sync applied, clean.
+The next human execution is read-only inspection with
+a fresh receipt, not another unchanged backup attempt. Approval remains recorded.