Close Vergabe binding and record remaining recovery blockers

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e3b3-11fe-7ba0-a4a3-92331aab0ba1

docs/evidence/2026-09-27-vergabe-binding-review.md

@@ -0,0 +1,58 @@
+# Vergabe binding and loose-end review — 2026-09-27
+
+Reviewed every workplan, including archived files. RAPPS-WP-0014 is the only
+unfinished workplan; all other task blocks are done. No ready or proposed
+workplan remains. No new workplan or task was created.
+
+## Binding verification (read-only)
+
+| Check | Result |
+| --- | --- |
+| Node / cluster | Ready, 92.205.62.239; kube-system UID a553c742-0115-43d4-99a4-a5ca56fe0786 |
+| Helm | vergabe-demo-company / vergabe-teilnahme, deployed revision 3, chart 0.2.1 |
+| Deployment | Ready 1/1; image sha256:a26444f59c259698159c69ccb96f73dc648a261ece4c86bb2037a9d977870d91 |
+| Requests / custody reference | 60m CPU, 256Mi memory; envFrom Secret reference vergabe-demo-env |
+| Media / issue state | vergabe-teilnahme-media 5Gi and vergabe-teilnahme-app-state 1Gi, both Bound, local-path |
+| TLS / health | vergabe-demo-tls Ready; HTTPS /demo-company/health/ returned 200 |
+| Chart regression suite | 8 tests passed |
+| Helm lint | Passed with admitted values plus SSO overlay |
+
+Commands: `kubectl get nodes -o wide`, explicit namespace/deployment field
+queries, `kubectl -n vergabe-demo-company get deployment,pvc,certificate`,
+`helm list -n vergabe-demo-company -o json`, HTTPS health request,
+`python3 -m unittest discover -s tests -p 'test_vergabe_pilot_chart.py'`, and
+`helm lint charts/vergabe-teilnahme -f helm/vergabe-demo-company-values.proposed.yaml
+-f helm/vergabe-demo-company-sso.proposed.yaml`.
+
+The image/source/CI receipt is
+[the revision 3 rollout](2026-09-12-account-recovery-live.md).
+Database/role isolation and initial membership counts retain their dated
+receipts in [the binding](../vergabe-demo-company-binding.md); no current user
+list, database contents or Secret values were read for this review.
+VERGABE-WP-0019 records the September 24 founder sign-in and still waits for
+the fresh recipient journey and two-user acceptance. T02 can close on its
+release-binding scope without claiming those separate gates passed.
+
+## Remaining recovery gate
+
+[September 25](2026-09-25-vergabe-demo-company-restore.md) proves a database
+restore and pod restart only. File claims were empty and the encrypted database
+artifact remained on the workstation. It does not prove populated media/issue
+state recovery, off-host delivery, restored user workflow or safe rollback.
+
+`warden route find` and `warden route show railiance-backup-offsite-lane`
+identify railiance-platform's OpenBao/Nextcloud lane. With the documented local
+OpenBao tunnel explicitly selected, `tools/check-backup-lane-auth.sh` confirmed
+OpenBao is unsealed but returned **no valid caller token**. Bernd Worsch's
+attended authentication is required for this workstation upload path; no secret
+was fetched. This does not establish the health of separate unattended jobs.
+
+RAPPS-WP-0014-T03 waits for the company workflow, a coherent off-host recovery
+point for all three stores, isolated restored workflow, rollback evidence and
+named support/incident ownership. The workplan is blocked. Existing product
+owner tasks VERGABE-WP-0019-T04/T06 retain human acceptance. No runtime mutation,
+substitute user login, backup upload or new recovery claim was made.
+
+The policy-nexus ArgoCD inbox proposal was read. It belongs to the existing
+rApp/platform onboarding plans and supplies no unfinished task in this repo;
+this review does not approve its live adoption or open another plan.