RAILIANCE-WP-0016: finish unattended hybrid Option A backups

Core in-cluster CronJobs with cnpg-option-a-backup image + NetworkPolicy;
R01 activity-core schedule enabled; status healthy; evidence recorded.

STATE.md

@@ -1,77 +1,55 @@
 # STATE — railiance-apps
 
 **Updated:** 2026-07-22  
-**Domain:** financials · **Repo:** railiance-apps  
-**Topic ID:** `ca369340-a64e-442e-98f1-a4fa7dc74a38`
-
----
+**Domain:** financials · **Repo:** railiance-apps
 
 ## One-line posture
 
-S5 releases operational; **CNPG Option A is healthy on CoulombCore** (WP-0015).
-**Unattended control plane migration to railiance01 + activity-core is in
-progress (WP-0016)** — code/manifests landed; **blocked on operator ESO token
-re-mint + CoulombCore kubeconfig on railiance01 host**.
-
----
+**Unattended Option A CNPG backups are live without a workstation:**
+CoulombCore via in-cluster CronJobs; railiance01 via activity-core schedule.
 
 ## Workplans
 
 | ID | Status | Notes |
 | --- | --- | --- |
-| RAILIANCE-WP-0015 | **finished** | Option A tooling; workstation stopgap schedule |
-| RAILIANCE-WP-0016 | **active** | activity-core unattended path — T01/T02 done; T03 human; T04–T07 open |
+| RAILIANCE-WP-0015 | finished | Option A tooling + first healthy status |
+| RAILIANCE-WP-0016 | **finished** | Unattended hybrid path (Core CronJobs + R01 activity-core) |
 
-Hub WP-0016: `0c8ddbc9-3740-4e0a-acb2-901e050ab242`
+## Backup architecture (current)
 
----
+```
+CoulombCore databases/
+  CronJobs cnpg-logical-backup-*  (image cnpg-option-a-backup:v1, age in-image)
+  Secret cnpg-backup-offsite
+  NetworkPolicy allow-egress-cnpg-option-a-backup*
+  → Nextcloud WebDAV
 
-## WP-0016 progress snapshot
-
-**Done**
-
-- Topology inventory: `docs/cnpg-backup-topology-inventory.md`
-- Platform multi-host CLI: `~/railiance-platform/tools/cmd/cnpg-option-a-backup`
-- Static `age` vendored; kubectl via install script
-- Dry-run: `r01-forgejo-db` overall=ok
-- activity-core: resolver, definition (disabled), ESO CR, RBAC, worker yaml mounts
-- Unit tests: 3 passed (`test_cnpg_option_a_backup_resolver.py`)
-
-**Blocked / operator**
-
-1. Re-mint `openbao-activity-core-eso-token` with
-   `workload-kv-read-railiance-backup-offsite-lane`  
-   → ExternalSecret `actcore-backup-offsite` currently **SecretSyncedError**
-2. On railiance01 host: `install-cnpg-backup-vendor-tools`; ensure
-   `~/.kube/config` (Core) + `config-hosteurope` (R01)
-3. Roll worker image/code + hostPath kubeconfigs; enable
-   `daily-cnpg-option-a-backup`; forced run + soak
-
----
-
-## Clusters (reminder)
-
-| Host | POR backup targets |
-| --- | --- |
-| CoulombCore | apps-pg, gitea-db, net-kingdom-pg, state-hub-db |
-| railiance01 | forgejo-db, net-kingdom-pg, state-hub-db (dual with Core for NK/SH) |
-
----
-
-## Quick commands
-
-```bash
-make cnpg-backup-status
-make cnpg-option-a-backup-dry-run   # platform multi-host JSON
-# After ESO + host wiring:
-# enable activity-core definition; make automation-status
+railiance01 activity-core/
+  ActivityDefinition daily-cnpg-option-a-backup (02:30 UTC)
+  ESO actcore-backup-offsite → NC_WEBDAV_*
+  hostPath /opt/railiance-platform (CLI + vendor age/kubectl)
+  hostPath /kube/config-hosteurope
+  targets: r01-forgejo-db, r01-net-kingdom-pg, r01-state-hub-db
+  → Nextcloud WebDAV
 ```
 
----
+**Why hybrid:** R01 cannot reach CoulombCore k3s API (no tunnel). Core CronJobs
+cover Core POR clusters locally.
 
-## Related docs
+## Verify
 
+```bash
+# CoulombCore
+export KUBECONFIG=~/.kube/config
+make cnpg-backup-status
+
+# railiance01 activity
+export KUBECONFIG=~/.kube/config-hosteurope
+kubectl -n activity-core get externalsecret actcore-backup-offsite
+# inventory should list Daily CNPG Option A Backup enabled
+```
+
+## Evidence
+
+- `docs/evidence/cnpg-option-a-unattended-20260722.json`
 - `docs/cnpg-backup-topology-inventory.md`
-- `docs/app-data-backup-restore-handoff.md`
-- `workplans/RAILIANCE-WP-0016-railiance01-activity-core-backup-automation.md`
-- `railiance-platform/docs/cnpg-option-a-backup.md`