diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 8e2936e..cab1e40 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -11,7 +11,7 @@ | workplan | RAPPS-WP-0001 | finished | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md | | workplan | RAPPS-WP-0002 | finished | — | workplans/RAPPS-WP-0002-railiance01-activity-core-backup-automation.md | | workplan | RAPPS-WP-0003 | finished | — | workplans/RAPPS-WP-0003-policy-nexus-production-binding.md | -| workplan | RAPPS-WP-0014 | active | — | workplans/RAPPS-WP-0014-vergabe-invited-pilot.md | +| workplan | RAPPS-WP-0014 | finished | — | workplans/RAPPS-WP-0014-vergabe-invited-pilot.md | | workplan | RAPPS-WP-0015 | finished | — | workplans/RAPPS-WP-0015-coulomb-personal-content-release.md | | workplan | RAPPS-WP-0016 | active | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md | | workplan | RAPPS-WP-0017 | finished | — | workplans/RAPPS-WP-0017-reuse-private-reader-release.md | @@ -35,7 +35,7 @@ | task | RAPPS-WP-0003-T04 | done | — | workplans/RAPPS-WP-0003-policy-nexus-production-binding.md | | task | RAPPS-WP-0014-T01 | done | — | workplans/RAPPS-WP-0014-vergabe-invited-pilot.md | | task | RAPPS-WP-0014-T02 | done | — | workplans/RAPPS-WP-0014-vergabe-invited-pilot.md | -| task | RAPPS-WP-0014-T03 | wait | — | workplans/RAPPS-WP-0014-vergabe-invited-pilot.md | +| task | RAPPS-WP-0014-T03 | done | — | workplans/RAPPS-WP-0014-vergabe-invited-pilot.md | | task | RAPPS-WP-0014-T04 | done | — | workplans/RAPPS-WP-0014-vergabe-invited-pilot.md | | task | RAPPS-WP-0015-T01 | done | — | workplans/RAPPS-WP-0015-coulomb-personal-content-release.md | | task | RAPPS-WP-0015-T02 | done | — | workplans/RAPPS-WP-0015-coulomb-personal-content-release.md | diff --git a/docs/evidence/2026-11-06-vergabe-attended-backup-complete-return.json b/docs/evidence/2026-11-06-vergabe-attended-backup-complete-return.json new file mode 100644 index 0000000..c88c060 --- /dev/null +++ b/docs/evidence/2026-11-06-vergabe-attended-backup-complete-return.json @@ -0,0 +1,19 @@ +{ + "schema": "railiance.vergabe-pilot-attended-backup.v1", + "status": "complete", + "run_id": "20261106T100825Z-acc2a468a535", + "provider_publication_verified": true, + "independent_readback_verified": true, + "decryption_verified": true, + "session_cleanup_confirmed": true, + "restore_verified": true, + "provider_receipt": "/home/worsch/.local/state/vergabe-pilot-recovery/20261106T100825Z-acc2a468a535/provider-receipt-0b4d8f320081.json", + "capture_requested": false, + "retention_execution_pending": false, + "evidence_kind": "user_reported_terminal_output", + "reported_on": "2026-11-06", + "workplan": "RAPPS-WP-0014", + "task": "RAPPS-WP-0014-T03", + "apps_source_revision": "f6eec13f7c5d36300c54d9caaec546f435f382b5", + "platform_browser_revision": "8519459e6fedd1bfb25dc2cdee6372d7252f5d0a" +} diff --git a/docs/evidence/2026-11-06-vergabe-attended-provider-success-return.json b/docs/evidence/2026-11-06-vergabe-attended-provider-success-return.json new file mode 100644 index 0000000..8b85ffa --- /dev/null +++ b/docs/evidence/2026-11-06-vergabe-attended-provider-success-return.json @@ -0,0 +1,56 @@ +{ + "schema": "railiance.vergabe-pilot-provider-recovery.v1", + "run_id": "20261106T100825Z-acc2a468a535", + "status": "published_read_back_and_decrypted", + "provider_publication_verified": true, + "decryption_verified": true, + "restore_verified": false, + "application_changed": false, + "stage": "complete", + "owner_handoff_checks": { + "routing_marker_present": true, + "operator_tunnel_matches": true, + "no_ambient_token_variables": true, + "isolated_home_shape": true, + "isolated_home_private": true + }, + "lane_kv_version": 4, + "upload_route_kind": "files", + "escrow_recipient_verified": true, + "provider": "Nextcloud Backup", + "object_path": "r01-platform-pg/vergabe-pilot-20261106T100825Z-acc2a468a535.zip.age", + "ciphertext_sha256": "ed27d370ba2a7b24830e41cf232b92ad6ca893430784fe14cad76d3e2b346575", + "ciphertext_bytes": 183066, + "quota_before": { + "quota_bytes": 10737418240, + "used_bytes": 6092433503, + "available_bytes": 4644984737 + }, + "reused_existing_object": true, + "independent_readback_verified": true, + "readback_http_status": 200, + "plaintext_packet_sha256": "f5d8d6251ddfaeb54eeeadf397bbb0494330d5aafe227406b6b09f443c554575", + "packet_file_hashes_verified": true, + "media_files": 1, + "fixture_document_sha256": "23a6850fa2391a58280c8515361ca29e9e92fa65fdadc36be7b44b552192e381", + "sqlite_integrity_verified": true, + "sqlite_link_verified": true, + "sqlite_tables": 9, + "sqlite_rows": 7, + "database_manifest_verified": true, + "database_restored": false, + "recovery_directory": "/home/worsch/.local/state/vergabe-pilot-recovery/20261106T100825Z-acc2a468a535/provider-recovery-4aanz7ec", + "elapsed_seconds": 1.43, + "warden_exit_code": 0, + "receipt_file": "/home/worsch/.local/state/vergabe-pilot-recovery/20261106T100825Z-acc2a468a535/provider-receipt-0b4d8f320081.json", + "session_cleanup_confirmed": true, + "session_revocation_confirmed": true, + "session_storage_cleanup_confirmed": true, + "evidence_kind": "user_reported_terminal_output", + "reported_on": "2026-11-06", + "workplan": "RAPPS-WP-0014", + "task": "RAPPS-WP-0014-T03", + "apps_source_revision": "f6eec13f7c5d36300c54d9caaec546f435f382b5", + "platform_browser_revision": "8519459e6fedd1bfb25dc2cdee6372d7252f5d0a", + "user_login_verdict": "The login worked like a charm" +} diff --git a/docs/evidence/2026-11-06-vergabe-attended-restore-transport-return.json b/docs/evidence/2026-11-06-vergabe-attended-restore-transport-return.json new file mode 100644 index 0000000..13373be --- /dev/null +++ b/docs/evidence/2026-11-06-vergabe-attended-restore-transport-return.json @@ -0,0 +1,16 @@ +{ + "schema": "railiance.vergabe-pilot-native-restore-transport.v1", + "run_id": "20261106T100825Z-acc2a468a535", + "nonce": "12e606a35014", + "worker_exit_code": 0, + "node_stage_removed": true, + "status": "complete", + "evidence_kind": "user_reported_terminal_output", + "reported_on": "2026-11-06", + "workplan": "RAPPS-WP-0014", + "task": "RAPPS-WP-0014-T03", + "apps_source_revision": "f6eec13f7c5d36300c54d9caaec546f435f382b5", + "detailed_worker_json_supplied": false, + "worker_timing_reported": false, + "interpretation": "Reviewed source returns worker exit 0 only for restored_and_verified with data/workflow/configuration-inverse checks, namespace/PV cleanup and production readback passing. This is source-bound inference from the returned exit code, not a fabricated detailed worker receipt." +} diff --git a/docs/evidence/2026-11-06-vergabe-pilot-closeout.md b/docs/evidence/2026-11-06-vergabe-pilot-closeout.md new file mode 100644 index 0000000..858b8fb --- /dev/null +++ b/docs/evidence/2026-11-06-vergabe-pilot-closeout.md @@ -0,0 +1,67 @@ +# RAPPS-WP-0014 closeout — 2026-11-06 + +The selected demo-company deployment and attended data-recovery milestone is +complete. All four tasks are done. The founder's two-account functional and +restart returns, populated three-store baseline drill, accepted operating model +and first repeatable attended operating run supply the evidence. + +| Requirement | Evidence | +| --- | --- | +| Exact release and claims | [Native inventory](2026-11-05-vergabe-native-inventory-return.json), Helm 4 / chart 0.2.1 / image `a26444f5…`; [binding](../vergabe-demo-company-binding.md) | +| Two ordinary accounts and populated workflow | November 5 sign-in, shared workflow/document/local-issue and task-edit/functional-flow receipts, linked in the [walkthrough](../vergabe-demo-company-acceptance.md) | +| Restart durability | [Capture/resume](2026-11-06-vergabe-three-store-capture-return.json) and [human restart return](2026-11-06-vergabe-post-restart-user-return.json) | +| Baseline recovery and configuration inverse | [Detailed isolated worker return](2026-11-06-vergabe-native-restore-return.json), all PostgreSQL/media/SQLite fingerprints, two restored sessions/workflow, anonymous/inactive/CSRF denial, committed clone write retained through two Pod replacements, cleanup and production readback | +| Operating ownership and objectives | [Founder operating choice](2026-11-06-vergabe-operating-choice.json) and [accepted arrangement](../vergabe-demo-company-operating-acceptance.proposed.md) | +| Fresh repeatable capture | [First operating capture](2026-11-06-vergabe-attended-callback-timeout-return.json), run `20261106T100825Z-acc2a468a535`, 39 tables / 249 rows, one PDF, SQLite nine tables / seven rows, coherent capture and verified app resume | +| Fresh offsite retrieval and decryption | [Successful provider return](2026-11-06-vergabe-attended-provider-success-return.json), exact 183066-byte ciphertext read back independently, packet/store checks pass, Warden exit 0 and all session cleanup/revocation checks true | +| Fresh restore and cleanup | [Transport return](2026-11-06-vergabe-attended-restore-transport-return.json), nonce `12e606a35014`, worker exit 0 / complete, private staging removed; [final attended receipt](2026-11-06-vergabe-attended-backup-complete-return.json), restore verified and no retention execution pending | + +The provider reused an existing identical object; this successful attempt does +not report a new upload or HTTP 201. Ciphertext SHA256 is +`ed27d370ba2a7b24830e41cf232b92ad6ca893430784fe14cad76d3e2b346575`; +decrypted packet SHA256 is +`f5d8d6251ddfaeb54eeeadf397bbb0494330d5aafe227406b6b09f443c554575`. +The original PDF remains SHA256 +`23a6850fa2391a58280c8515361ca29e9e92fa65fdadc36be7b44b552192e381`. + +The fresh detailed worker JSON was not included in the return. Its reviewed +source returns exit 0 only after all-store/workflow/configuration-inverse checks, +owned namespace/PV cleanup and production specification/readiness readback pass. +Those fresh worker checks are therefore inferred from the source-bound exit code +and final success receipt, with the supplied baseline worker's detailed proof +kept separately. No fresh worker duration or end-to-end RTO is invented. +The baseline recorded 55.41 seconds restore/checks, 55.24 seconds configuration +inverse/recheck and 215 seconds total worker time; authentication/transfer were +outside that timing. These are observations, not the accepted recovery target. + +The founder confirms the real login works normally with the isolated native +Windows opener, platform commit `8519459`. It preserves the issuer/callback and +credential controls; it bypasses the unreliable WSLg/Chrome window combination +without claiming to repair its exact underlying defect. Earlier failed login +receipts retain their unconfirmed outcomes; current successful revocation does +not retrospectively change them. + +## Ongoing operation and explicit limits + +Bernd Worsch owns attended backup execution and first incident/support contact, +using the existing railiance-platform storage/custody lane. Run a fresh coherent +backup after every active pilot day and before changes. Keep seven daily/two +weekly verified provider points, protecting baseline/newest. Accepted targets +are at most one active day's data loss and attended recovery within one working +day. The [operating packet](../proposals/2026-11-06-vergabe-attended-backups/README.md) +provides execution, retry, restore, preview and bounded owner-retention commands. +No retention deletion is required when no excess verified point is eligible; +the final receipt reports none pending. This is an attended arrangement, with +no scheduled service, automated notifications or SLA inferred. + +The clone verifies restored ordinary member sessions, not a restored native +SSO/MFA/callback/ingress login. Its inverse uses the same admitted image/schema; +an older-image/schema downgrade, Helm rollback, node rebuild, HA or autonomous +factory delivery is not established. Review migrations and make a fresh point +before each later upgrade. No live data is overwritten by the rehearsal. + +Broader invited-recipient/company-contact acceptance, UX/session refinements +and any native restored-SSO requirement remain with VERGABE-WP-0019 and the +existing product owners. Factory-produced delivery remains VERGABE-WP-0018 / +HFACT-WP-0001. Decision `d06307e5-2737-461a-a2f4-a12c3b492a9a` is not resolved by +this infrastructure closeout, and no new customer admission is inferred. diff --git a/docs/proposals/2026-11-06-vergabe-attended-backups/README.md b/docs/proposals/2026-11-06-vergabe-attended-backups/README.md index d125315..b55b36a 100644 --- a/docs/proposals/2026-11-06-vergabe-attended-backups/README.md +++ b/docs/proposals/2026-11-06-vergabe-attended-backups/README.md @@ -1,5 +1,16 @@ # Attended demo-company backups +**Operating run complete — 2026-11-06.** The +[provider return](../../evidence/2026-11-06-vergabe-attended-provider-success-return.json), +[restore transport](../../evidence/2026-11-06-vergabe-attended-restore-transport-return.json) +and [final receipt](../../evidence/2026-11-06-vergabe-attended-backup-complete-return.json) +verify run `20261106T100825Z-acc2a468a535`: independent readback/decryption, +Warden cleanup/revocation, restore worker exit 0, private staging removed and +no retention execution pending. The founder confirms the real native Windows +login works normally. No further retry is needed for this point; daily/pre-change +operation uses the routine commands below. [Closeout and limits](../../evidence/2026-11-06-vergabe-pilot-closeout.md). +The dated failure/preparation notes are retained as history. + The founder selected attended end-of-active-day and pre-change backups, with himself as backup execution and first incident/support contact. The accepted [operating targets](../../vergabe-demo-company-operating-acceptance.proposed.md) @@ -43,7 +54,7 @@ No setting, callback registration, output allowlist or authentication requiremen was changed. The completed capture remains available; native retry/restore proof and possible session revocation remain unconfirmed. -## Current retry after the browser workaround +## Completed retry after the browser workaround The founder subsequently observed a pre-OTP stall on Authelia, unresponsive titlebar/tab controls, and random control activation in a credential-free Linux @@ -71,8 +82,8 @@ lifecycle fixture verifies protected profile creation, startup, redirect from issuer guard refuses the synthetic URL; the separate fixture copy admits only its exact local listener. A final native guard check refuses synthetic credential query data before browser creation. These checks perform no identity request. -The actual owner login and this fresh point's provider/restore proof remain -pending. No issuer/role, factor, callback-registration, output-allowlist or token- +The subsequent founder login, provider readback/decryption and restore now pass, +as recorded above. No issuer/role, factor, callback-registration, output-allowlist or token- helper control changed. From the Apps checkout, update the owner helper and retry the captured point: @@ -223,6 +234,7 @@ restore verification, embedded source compilation and founder boundary, failure sequencing, and retention protection/hash/conditional-delete races. No agent reads the founder's real private kit or executes this native credential -path. RAPPS-WP-0014-T03 remains waiting for the successful publication/restore -retry of the first operating point above; the -existing baseline's technical proof and accepted targets are already recorded. +path. RAPPS-WP-0014-T03 is done: the first operating point above passed its +publication/restore retry, supplementing the baseline detailed proof and the +accepted targets. Preparation `validation.json` retains its pre-execution scope; +the linked native returns supply the actual operating acceptance. diff --git a/docs/vergabe-demo-company-acceptance.md b/docs/vergabe-demo-company-acceptance.md index 9c4c27e..091f3bc 100644 --- a/docs/vergabe-demo-company-acceptance.md +++ b/docs/vergabe-demo-company-acceptance.md @@ -1,6 +1,17 @@ # Demo-company pilot walkthrough Prepared 2026-11-05 for RAPPS-WP-0014-T03 and VERGABE-WP-0019-T04/T06. + +2026-11-06 closure: the Apps deployment/attended data-recovery milestone is +complete. The [first repeatable operating run](evidence/2026-11-06-vergabe-attended-backup-complete-return.json) +passes provider/readback/decryption, current Warden cleanup/revocation, restore +worker exit 0, transport/stage cleanup and no pending retention execution. +The [closeout record](evidence/2026-11-06-vergabe-pilot-closeout.md) binds that +source-inferred fresh worker proof to the supplied detailed baseline and accepted +operating targets. RAPPS-WP-0014 is finished. Broader recipient/company-contact +acceptance, restored interactive SSO/ingress and product UX/session refinements +remain their existing product-owner scope. The walkthrough and earlier dated +progress statements below retain their historical/reproduction purpose. The user confirmed both demo-company accounts can sign in with username/password and OTP on 2026-11-05; see the [sign-in receipt](evidence/2026-11-05-vergabe-two-user-signin.json). The user also confirmed Ausschreibung/Anforderung creation and visibility from diff --git a/docs/vergabe-demo-company-binding.md b/docs/vergabe-demo-company-binding.md index 99cc28f..da2a36c 100644 --- a/docs/vergabe-demo-company-binding.md +++ b/docs/vergabe-demo-company-binding.md @@ -1,7 +1,17 @@ # Vergabe demo-company deployment binding Updated 2026-11-06 under RAPPS-WP-0014 and VERGABE-WP-0019. -Release binding is complete (RAPPS-WP-0014-T02). Recovery and invited-recipient acceptance remain open. +Release binding and attended data recovery are complete (RAPPS-WP-0014 finished). +Broader invited-recipient/product acceptance remains with VERGABE-WP-0019. + +Final operating run `20261106T100825Z-acc2a468a535` passes provider independent +readback/decryption and Warden session cleanup/revocation, then isolated restore +worker exit 0 / transport complete and private staging removal. No retention +action is pending. See the [closeout](evidence/2026-11-06-vergabe-pilot-closeout.md), +[final receipt](evidence/2026-11-06-vergabe-attended-backup-complete-return.json) +and [accepted attended arrangement](vergabe-demo-company-operating-acceptance.proposed.md). +The prior recovery updates below retain their dated history; this completion +supersedes their pending operating-run statements. November 6 recovery update: matched PostgreSQL/media/SQLite capture and app resume pass at revision 4 (98.61 seconds total). Both accounts work after diff --git a/docs/vergabe-demo-company-operating-acceptance.proposed.md b/docs/vergabe-demo-company-operating-acceptance.proposed.md index 909a054..8474020 100644 --- a/docs/vergabe-demo-company-operating-acceptance.proposed.md +++ b/docs/vergabe-demo-company-operating-acceptance.proposed.md @@ -1,8 +1,8 @@ -# Demo-company operating acceptance — attended model selected +# Demo-company operating acceptance — accepted Prepared 2026-11-06 for RAPPS-WP-0014-T03. The founder selected the attended model with the contacts, cadence, retention and recovery targets below. The repeatable -operating path is prepared and tested; its first native run remains open. +operating path is prepared, tested and verified by its first native run. No scheduled service or SLA is inferred. The populated three-store recovery drill now passes from the independently @@ -33,8 +33,8 @@ before changes. It reuses the frozen capture/encryption/provider algorithms, selects a new run with validated metadata/hashes, and requires complete provider readback/decryption/session cleanup. `--verify-restore` adds the already-proved isolated worker for that new point. Seventeen new synthetic cases pass; all -76 pilot helper tests pass. The first attended operating run must still pass -before the cadence is recorded active. The baseline's exact-point helpers remain +76 pilot helper tests pass. The first attended operating run now passes; +the accepted cadence is an active operator responsibility. The baseline's exact-point helpers remain unchanged for reproducibility. Provider retention has a bounded private-inventory preview and a separate @@ -45,7 +45,22 @@ been executed/installed. Local private recovery copies and node journals remain; provider retention does not remove them. Use only the reviewed founder command as the go for a deletion batch, as specified in the packet. -## Work still to finish +## Operating execution complete + +The [provider return](evidence/2026-11-06-vergabe-attended-provider-success-return.json), +[restore transport](evidence/2026-11-06-vergabe-attended-restore-transport-return.json) +and [attended receipt](evidence/2026-11-06-vergabe-attended-backup-complete-return.json) +close run `20261106T100825Z-acc2a468a535`: publication/independent readback, +decryption, Warden session cleanup/revocation and restore all pass. The private +node stage is removed, worker exit is 0 and no retention execution is pending. +The provider reuses an identical object; this return claims no new upload. +Fresh detailed worker JSON/timing is not supplied. Data/workflow/inverse/owned +namespace/PV cleanup and production readback are inferred from its reviewed +success-exit contract, with the detailed baseline proof kept separately. +See the [closeout](evidence/2026-11-06-vergabe-pilot-closeout.md) for that evidence +and the source-bound limits. T03 is done and RAPPS-WP-0014 is finished. + +### Earlier attempts The first fresh capture/resume and encrypted transfer pass for `20261106T100825Z-acc2a468a535`; the contained owner login then reports callback @@ -58,10 +73,10 @@ handoff. The founder identifies a pre-OTP Authelia stall and unresponsive browse tabs/titlebar; the real-launcher X11/software test remains unreliable. The native Windows Edge private-profile test works normally. The [window-repair receipt](evidence/2026-11-06-vergabe-browser-window-repair.json) -and [updated operating packet](proposals/2026-11-06-vergabe-attended-backups/README.md#current-retry-after-the-browser-workaround) +and [updated operating packet](proposals/2026-11-06-vergabe-attended-backups/README.md#completed-retry-after-the-browser-workaround) record platform commit `8519459` selecting the isolated native Windows opener on WSL, its 32 passing operator tests and credential-free lifecycle/cleanup proof. -Actual owner login and publication/restore of the completed point remain pending; +Actual owner login and publication/restore subsequently pass as recorded above; no issuer, factor, callback-registration or token-helper control changed. Review provider retention previews and execute only when eligible excess points exist; no artificial deletion is diff --git a/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md b/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md index 97b0fb4..f66785c 100644 --- a/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md +++ b/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md @@ -4,7 +4,7 @@ type: workplan title: "Deploy and recover the first invited Vergabe company pilot" domain: financials repo: railiance-apps -status: active +status: finished flavor: implementation owner: the-custodian topic_slug: railiance @@ -16,6 +16,27 @@ state_hub_workstream_id: "c7fdaa7e-cab8-5d1d-86c2-f1aad7927c57" # Invited Vergabe pilot on Railiance +## Completion — 2026-11-06 + +All four tasks are done for the selected two-account demo-company deployment +and attended data-recovery milestone. The founder's first repeatable operating +run `20261106T100825Z-acc2a468a535` now completes provider publication/readback, +decryption, isolated restore and cleanup, with no retention action pending. +Native Windows browser login works normally after the platform opener repair. +The [closeout record](../docs/evidence/2026-11-06-vergabe-pilot-closeout.md) +binds the functional/restart, baseline detailed restore, fresh capture/provider/ +transport receipts and accepted owner/cadence/retention/recovery objectives. + +The fresh worker's detailed JSON/timing was not included; worker exit 0 and the +final success receipt are accepted against the reviewed source's complete data, +workflow, configuration-inverse, cleanup and production-readback gates. No fresh +timing is fabricated. The prior detailed baseline worker proof remains separate. +Broader company-contact/recipient acceptance and decision +`d06307e5-2737-461a-a2f4-a12c3b492a9a` remain with VERGABE-WP-0019; factory-produced +delivery remains VERGABE-WP-0018/HFACT-WP-0001. Restored native SSO/ingress, +older-image/schema/Helm rollback, node rebuild and HA are not claimed. The dated +pending notes below are historical and superseded for this Apps milestone. + ## Prepare a durable and immutable single-company chart ```task @@ -193,13 +214,11 @@ remain VERGABE-WP-0019-T04/T06, and recovery remains T03. See ```task id: RAPPS-WP-0014-T03 -status: wait -needs_human: true -decision_id: d06307e5-2737-461a-a2f4-a12c3b492a9a -intervention_note: "Baseline recovery and fresh capture/transfer pass. WSL Chrome titlebar/tabs/control input unreliable even in X11/software probe; native Windows Edge private-profile probe is founder-confirmed responsive. Platform fix 8519459 selects isolated native Windows opener on WSL; 32 operator tests plus lifecycle/localhost/cleanup checks pass. Pull railiance-platform then retry tools/vergabe_pilot_backup.py --publish 20261106T100825Z-acc2a468a535 --verify-restore. Actual owner login and this point's provider/restore receipts remain pending; no recapture/pause needed." +status: done +needs_human: false +intervention_note: "Attended operating run 20261106T100825Z-acc2a468a535 is complete: provider readback/decryption, Warden cleanup/revocation, isolated restore worker exit 0, private stage removed and no retention action pending. Operating ownership/cadence/retention and recovery targets accepted. Native Windows opener works normally. Broader VERGABE recipient/SSO and version-rollback claims remain separate." priority: high assignee: the-custodian -blocking_reason: "Baseline recovery and accepted attended model pass; repeatable capture/transfer now pass. Native Windows browser workaround validated and published; await actual contained owner login, provider/readback/decryption and restore for the same fresh point. Restored native SSO/ingress and broader version rollback remain explicit limits." state_hub_task_id: "dd069c6d-fcc1-5bac-b233-976f2f0d5cd1" ``` @@ -629,6 +648,33 @@ After pulling railiance-platform, retry the same `--publish ... --verify-restore command in the founder terminal. Actual owner login, publication and restore for this fresh point remain pending; T03 stays wait. No recapture/pause is needed. +2026-11-06 completion return: the founder confirms native Windows login works +normally. Provider status `published_read_back_and_decrypted`, same 183066-byte +ciphertext SHA256 `ed27d370…6575`, independent readback 200, plaintext SHA256 +`f5d8d625…4575`, all packet/media/SQLite/database-manifest checks pass. The object +is reused, so no new upload/201 is asserted. Warden exit 0 and all session +cleanup/revocation/storage-cleanup checks are true. Provider phase 1.43 seconds. +Restore nonce `12e606a35014` returns worker exit 0 / transport complete, private +stage removed. The final attended receipt reports complete, publication, +independent readback, decryption, session cleanup and restore verified, with +`retention_execution_pending: false`. This closes the first repeatable attended +run; capture was already completed/resumed and was not repeated in this retry. + +Receipts: `docs/evidence/2026-11-06-vergabe-attended-provider-success-return.json`, +`docs/evidence/2026-11-06-vergabe-attended-restore-transport-return.json`, and +`docs/evidence/2026-11-06-vergabe-attended-backup-complete-return.json`. +The detailed fresh worker JSON/timing was not supplied. Its source returns 0 +only after all-store/workflow/configuration-inverse checks, namespace/PV cleanup +and production readback pass; these fresh checks are source-bound inferences, +not fabricated terminal fields. Existing baseline timing/detail remains the +separate receipt. Accepted attended responsibilities and objectives now have a +successful operating run; routine future execution remains the named operator's +work. No artificial retention deletion is required when no verified excess is +eligible. T03 is done and this Apps workplan is finished. The broader D7 +recipient/company-contact decision remains open for VERGABE-WP-0019; it is no +longer an intervention on this completed data-recovery task. See the closeout +record for the explicit SSO/ingress/version/factory limits and product handoff. + ## Validate synthetic sizing against the exact release and shared contention