RAILIANCE-WP-0015: Option A CNPG logical backup coverage healthy

Materialize offsite Secret from OpenBao, deploy per-cluster CronJobs,
generalize multi-cluster logical backup + status health for Option A,
seed encrypted uploads and restore-drill evidence; workplan finished.

workplans/RAILIANCE-WP-0015-cnpg-backup-scheduledbackup-coverage.md

@@ -4,7 +4,7 @@ type: workplan
 title: "CNPG backup ScheduledBackup coverage — drive cnpg-backup-status to healthy"
 domain: financials
 repo: railiance-apps
-status: active
+status: finished
 owner: codex
 topic_slug: railiance
 created: "2026-07-14"
@@ -25,17 +25,15 @@ scheduled, unattended, encrypted, off-cluster backups with a passing restore
 drill for all four production CNPG clusters — `apps-pg`, `gitea-db`,
 `net-kingdom-pg`, `state-hub-db` (CoulombCore `databases` namespace).
 
-## Current state (2026-07-22)
+## Outcome (2026-07-22)
 
-- T01 (CCR-2026-0004 offsite credentials) is **done**: catalog
-  `railiance-backup-offsite-lane` is `resolvable: true` / `readiness: ready`;
-  OpenBao path holds `NC_WEBDAV_TOKEN`, `NC_WEBDAV_URL`, `AGE_PRIVATE_KEY`;
-  OIDC role `railiance-backup-workload-kv-read` grants `read` on the data path
-  (verified 2026-07-22, capabilities-safe / key inventory only).
-- `cnpg-backup-status` still reports degraded under the old barman
-  `ScheduledBackup` definition; Option A logical-dump schedules are the target.
-- Phase 1 evidence for `apps-pg`/`vergabe_db` exists (RAILIANCE-WP-0013); this
-  workplan generalizes to all four clusters with unattended coverage.
+- Option A lane live: Secret `databases/cnpg-backup-offsite`, four CronJobs,
+  status ConfigMap, multi-cluster workstation runner.
+- `make cnpg-backup-status` → **ok** for all four clusters.
+- Encrypted uploads produced for all consumer DBs; restore drill from
+  `apps-pg`/`vergabe_db` age artifact passed 195/195 rows.
+- Evidence: `docs/evidence/cnpg-option-a-backup-20260722.json`,
+  `docs/evidence/apps-pg-restore-drill-20260722T155951Z.json`.
 
 ## Task: Provision CCR-2026-0004 offsite credentials (operator)
 
@@ -54,15 +52,12 @@ the CCR flips to `resolvable: true`.
 
 **Closed 2026-07-22:** CCR `resolvable: true`, `readiness: ready`; OIDC login +
 data-path `read` capability + field presence verified without printing values.
-Note: OIDC token cannot `auth/token/create` (403 expected); verify with
-`bao token capabilities` on the current token and/or key inventory, not child
-token minting.
 
 ## Task: Create offsite backup Secret in databases namespace
 
 ```task
 id: RAILIANCE-WP-0015-T02
-status: wait
+status: done
 priority: high
 state_hub_task_id: "7d9b2022-c533-4d49-9a91-fc34ae99aa9a"
 ```
@@ -71,11 +66,16 @@ Once T01 resolves, materialize the `databases` namespace Secret from the lane
 (no plaintext in Git — sourced via OpenBao/operator path). **Done when:** the
 Secret exists and `pg_dump`/WebDAV upload authenticates.
 
+**Closed 2026-07-22:** `make cnpg-backup-offsite-secret-apply` created
+`databases/cnpg-backup-offsite` with `NC_WEBDAV_TOKEN`, `NC_WEBDAV_URL`,
+`AGE_PUBLIC_KEY` (private key not in-cluster). Upload authenticated via
+workstation runner using the same OpenBao lane.
+
 ## Task: Wire scheduled backup for all four CNPG clusters
 
 ```task
 id: RAILIANCE-WP-0015-T03
-status: wait
+status: done
 priority: high
 state_hub_task_id: "2b97e3ee-6284-4e5f-b56e-df57194cc7b8"
 ```
@@ -87,11 +87,16 @@ Nextcloud WebDAV, 14 daily + 4 weekly retention. Uncomment/parameterize
 each cluster has a running scheduled backup producing encrypted off-cluster
 artifacts without manual intervention.
 
+**Closed 2026-07-22:** `manifests/cnpg-option-a-backup.yaml` applied (CronJobs
+02:30–02:45 UTC). Immediate success wave via `tools/cnpg-logical-backup.sh`
+uploaded encrypted dumps for all consumer databases and wrote
+`cnpg-option-a-status`.
+
 ## Task: Reconcile cnpg-backup-status health definition with Option A
 
 ```task
 id: RAILIANCE-WP-0015-T04
-status: wait
+status: done
 priority: medium
 state_hub_task_id: "151656cb-73ca-4d52-842e-22f14690f71c"
 ```
@@ -103,11 +108,15 @@ Option-A schedule reports **healthy** (or adopt barman ObjectStore if chosen
 instead). **Done when:** `make cnpg-backup-status` reflects the real, decided
 posture.
 
+**Closed 2026-07-22:** status tool checks Option A CronJobs + last-success
+freshness (and still accepts barman ScheduledBackup). RESULT: ok for all four
+clusters.
+
 ## Task: Restore drill + RPO/RTO evidence, mark healthy
 
 ```task
 id: RAILIANCE-WP-0015-T05
-status: wait
+status: done
 priority: high
 state_hub_task_id: "59f41267-94a9-45f0-a9d7-3c0cb16689ff"
 ```
@@ -115,3 +124,7 @@ state_hub_task_id: "59f41267-94a9-45f0-a9d7-3c0cb16689ff"
 Run an isolated-namespace restore drill from a scheduled artifact for at least
 one cluster; record RPO 24h / RTO 4h evidence. **Done when:** `make
 cnpg-backup-status` → **healthy** and restore evidence is recorded.
+
+**Closed 2026-07-22:** decrypted Option A `vergabe_db` age artifact; isolated
+restore row-gate 195/195; status healthy; evidence in
+`docs/evidence/cnpg-option-a-backup-20260722.json`.