Implement governed S1 backup recovery loop

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018

workplans/RAIL-HO-WP-0012-s1-backup-recovery-loop.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Close the encrypted S1 backup and recovery loop"
 domain: financials
 repo: railiance-infra
-status: proposed
+status: active
 owner: codex
 topic_slug: railiance
 created: "2026-08-23"
@@ -30,13 +30,12 @@ operator approval.
 
 ## Current State and Risks
 
-`tools/cmd/railiance-backup-s1` currently creates age-encrypted OS-configuration
-and package-selection files under `/opt/backup/railiance/infra` and retains the
-latest seven of each. It is not scheduled, has no off-host transfer, produces
-no manifest or receipt, has no restoration tool or drill, duplicates an age
-recipient in executable source, suppresses individual copy failures, and can
-leave ambiguous partial output. The output is therefore a useful local helper,
-not current proof of recoverability.
+The source-side local loop now has a declaration, atomic encrypted bundle,
+metadata-only evidence, integrity/freshness status, exact-approval retention,
+isolated restore, and separately approved timer deployment interface. No timer
+has been deployed and no retained artifact has been deleted by this workplan.
+Off-host transfer and an attended drill remain open, so the repository still
+cannot claim operational recoverability from local source tests alone.
 
 ## Delivery Order
 
@@ -48,7 +47,7 @@ tasks and an attended isolated drill.
 
 ```task
 id: RAIL-HO-WP-0012-T01
-status: todo
+status: done
 priority: high
 ```
 
@@ -66,7 +65,7 @@ requires neither root nor a decryption key.
 
 ```task
 id: RAIL-HO-WP-0012-T02
-status: todo
+status: done
 priority: high
 ```
 
@@ -89,7 +88,7 @@ tests leave no ambiguous success state.
 
 ```task
 id: RAIL-HO-WP-0012-T03
-status: todo
+status: done
 priority: high
 ```
 
@@ -110,7 +109,7 @@ and no default invocation can overwrite a host file.
 
 ```task
 id: RAIL-HO-WP-0012-T04
-status: todo
+status: done
 priority: medium
 ```
 
@@ -164,15 +163,28 @@ decrypted configuration.
 
 ## Acceptance
 
-- [ ] S1 backup membership, exclusions, recipients, and retention are declared
+- [x] S1 backup membership, exclusions, recipients, and retention are declared
       and validated from source.
-- [ ] Backup publication is atomic, encrypted, and accompanied by a safe
+- [x] Backup publication is atomic, encrypted, and accompanied by a safe
       manifest and receipt.
-- [ ] Restore defaults to isolated inspection and rejects tampering, traversal,
+- [x] Restore defaults to isolated inspection and rejects tampering, traversal,
       and accidental live overwrite.
-- [ ] Scheduling and freshness checks are source-controlled but deployed only
+- [x] Scheduling and freshness checks are source-controlled but deployed only
       through an explicit host-change approval.
 - [ ] A governed off-host copy and an attended isolated restore drill prove the
       selected S1 state is recoverable.
-- [ ] No cluster, platform, tenant, secret-issuance, or private-key custody
+- [x] No cluster, platform, tenant, secret-issuance, or private-key custody
       responsibility is absorbed into this repository.
+
+## Source delivery record — 2026-08-23
+
+- `make validate-s1-backup` passes the declaration and 15 fixture recovery
+  tests using disposable age identities and storage.
+- The full repository suite passes 45 tests. The timer calendar is accepted by
+  `systemd-analyze`; deployment YAML and separation from bootstrap are checked
+  as source contracts.
+- Native `ansible-playbook --syntax-check` was unavailable on the development
+  workstation. The deployment remains unexecuted and gated by
+  `DEPLOY-RAIL-HO-WP-0012-S1-BACKUP-TIMER` plus a clean committed revision.
+- T05 and T06 remain `wait`; no off-host write, retained-artifact deletion,
+  private-key access, or live-host restore occurred.