Record custody share diagnosis and owned repair blockers

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29

docs/evidence/2026-10-03-root-custody-share-inspection.json

@@ -0,0 +1,31 @@
+{
+  "backup_roundtrip_proved": false,
+  "current_live_baseline_matches": true,
+  "current_route_classification": "authentication_rejected",
+  "current_route_http_status": 401,
+  "current_token_found_in_reviewed_folder": false,
+  "current_token_unique": false,
+  "digest": "33a2ae086385028db1b654aa5646b7a98bcde1c5878c804e19315dadc3f87248",
+  "documented_route_classification": "authentication_rejected",
+  "documented_route_http_status": 401,
+  "documented_route_no_basic_classification": "other_status",
+  "documented_route_no_basic_http_status": 503,
+  "finished_at": "2026-10-03T19:36:10.731742+00:00",
+  "historical_config_present": true,
+  "historical_credential_status": "historical-owner-and-revocation-unverified",
+  "historical_share_matches_current_lane": false,
+  "kv_version": 1,
+  "labelled_share_present": false,
+  "labelled_share_unique": false,
+  "lane_kv_version": 3,
+  "ok": true,
+  "provider_mutations_performed": false,
+  "public_route_probes_skipped": false,
+  "read_only_diagnostic": true,
+  "record_id": "nk-custody:platform-root",
+  "recorded_at": "2026-10-03T19:36:07.682938+00:00",
+  "revision": 1,
+  "scope": "read-only-current-governed-share-inspection",
+  "stage": "complete",
+  "status": "diagnostic-complete"
+}

docs/evidence/2026-10-03-root-grant-delivery-progress.md

@@ -278,3 +278,25 @@ protected/expired shares skip public authentication probes. Twenty-five finish
 tests pass. Exact expected/derived remote projection applied, working tree clean.
 Inspection still requires the founder's own attended credential route;
 no provider conclusion or actual backup success is inferred from source tests.
+
+## Successful share inspection; recovery remains blocked
+
+The attended read-only receipt at 19:36 UTC is retained in
+`2026-10-03-root-custody-share-inspection.json`. The baseline matches live KV1;
+backup lane KV3 has neither its token nor the expected labelled share in the
+reviewed owner folder inventory. Both authenticated route probes returned 401;
+the unauthenticated documented route returned 503. No provider mutation or
+encrypted-history roundtrip was performed. Inventory absence is scoped to that
+folder; these results do not prove global deletion or successful recovery.
+
+The platform owner is preparing a tested attended repair that proves replacement
+share upload/download/decryption before CAS of only the lane's upload coordinates,
+preserving all other fields, keys, backups and unknown shares. Activity-core owns
+the subsequent consumer refresh: worker environment snapshots and the frozen
+Forgejo backup ConfigMap require explicit loaded-client evidence.
+
+Security orientation reloaded after compaction: package 0.2.4, digest
+`025aab4f38246219c924bc94954e70ea0e6e7f72bcaf8d4344cd599602d345c3`,
+start card withheld/orientation-only because a source changed. Reviewed the local
+start card and operative NetKingdom SECURITY-COMPANION directly; this retrieval
+does not grant authority or establish live readiness.

workplans/NK-WP-0045-root-grant-custody-record.md

@@ -120,8 +120,8 @@ depends_on: [NK-WP-0045-T04, RPF-WP-0049-T05]
 wait_kind: both
 blocked_on: message-from:railiance-platform
 needs_human: true
-intervention_note: "Use the tested bounded read-only provider/share inspection packet from railiance-platform in the founder OIDC/MFA terminal, with a fresh receipt. Do not repeat the unchanged finish command; approvals are already recorded."
-blocking_reason: "Source/consumer/audit and baseline/escrow checks pass. Header-corrected provider upload still rejects HTTP 401 at backup lane KV version 3. Requires bounded operator share/endpoint diagnosis before repair, then actual encrypted history upload/readback/decryption proof; no blind same-command retry or new generic approval."
+intervention_note: "Use the tested bounded provider share repair packet from railiance-platform once prepared, in the founder OIDC/MFA terminal with a fresh receipt. Inspection is complete; existing approval covers bounded delivery."
+blocking_reason: "Inspection completed: backup lane KV3 token and expected labelled share absent from reviewed owner folder inventory. Requires tested bounded create-only share repair, verified retained-history upload/readback/decryption and expected-version CAS of only upload coordinates; source/consumer/audit remain verified."
 priority: medium
 state_hub_task_id: "628e8a3b-17a4-5f97-a484-c564a87d650d"
 ```
@@ -423,3 +423,21 @@ password and expiry-clock information and skips redundant auth probes on clearly
 protected/expired shares; 25 finish tests pass, exact remote sync applied, clean.
 The next human execution is read-only inspection with
 a fresh receipt, not another unchanged backup attempt. Approval remains recorded.
+
+The actual read-only inspection completed at 19:36 UTC; receipt is
+`docs/evidence/2026-10-03-root-custody-share-inspection.json`. The current KV3
+token and expected labelled share were absent from the Backup owner's reviewed
+folder inventory. This does not establish global deletion. No provider mutations
+or backup roundtrip occurred; diagnostic `ok: true` is not recovery acceptance.
+
+Railiance-platform is preparing a bounded attended repair: verify the replacement
+create-only share against the exact owner/folder, prove encrypted retained-history
+upload/download/decryption, then CAS only the upload token and URL at the expected
+lane version. Preserve the recovery key, other lane fields, existing backups and
+unknown shares, and return safe receipts for partial operations.
+
+Activity-core owns the downstream delivery dependency: ExternalSecret refresh
+does not refresh environment values in running workers; Forgejo's backup client
+uses a frozen ConfigMap, and CNPG uses the projected platform checkout. Those
+consumers need reviewed refresh and loaded-client evidence after a repaired lane
+receipt. They do not substitute for NK's independent retained-history proof.