Prepare governed S1 offsite upload

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018

workplans/RAIL-HO-WP-0012-s1-backup-recovery-loop.md

@@ -126,7 +126,7 @@ no timer is installed merely by running a verification command.
 
 ```task
 id: RAIL-HO-WP-0012-T05
-status: wait
+status: progress
 priority: high
 ```
 
@@ -142,6 +142,25 @@ dry-run proves object naming and collision behavior, a controlled upload is
 visible through owner-provided metadata, and local/off-host retention cannot
 delete the only recoverable copy.
 
+**Source preparation (2026-08-23):** `spec/s1-offsite.yaml` and
+`scripts/s1_offsite.py` define a pending-owner contract that wraps the complete
+encrypted bundle and metadata into one deterministic immutable object. The
+upload uses `If-None-Match: *`, accepts only a freshly rendered exact envelope
+approval, suppresses endpoint/response data, and emits a local metadata-only
+receipt. Production pruning now refuses candidates without a receipt bound to
+the current manifest. A disposable WebDAV fixture proves successful upload,
+collision and redirect refusal, pending-owner refusal, and absence of the
+injected token from retained evidence.
+
+Owner review remains mandatory. The exact review digest is rendered by
+`make s1-offsite-review`; `spec/s1-offsite-owner-acceptance.yaml` remains
+`pending`, so no live upload can execute. Review of the owner implementation
+also found a tracked secret-shaped default in its Forgejo backup script. Its
+value was not copied or recorded; `railiance-platform` must confirm it is
+retired or rotated before accepting this contract. The route's missing
+authoritative workload identity keeps this interface attended rather than
+scheduled.
+
 ## T06 — Perform an attended isolated restore drill
 
 ```task
@@ -178,13 +197,14 @@ decrypted configuration.
 
 ## Source delivery record — 2026-08-23
 
-- `make validate-s1-backup` passes the declaration and 16 fixture recovery
+- `make validate-s1-backup` passes the declaration and 21 fixture recovery
   tests using disposable age identities and storage.
-- The full repository suite passes 46 tests. The timer calendar is accepted by
+- The full repository suite passes 51 tests. The timer calendar is accepted by
   `systemd-analyze`; deployment YAML and separation from bootstrap are checked
   as source contracts.
 - Native `ansible-playbook --syntax-check` was unavailable on the development
   workstation. The deployment remains unexecuted and gated by
   `DEPLOY-RAIL-HO-WP-0012-S1-BACKUP-TIMER` plus a clean committed revision.
-- T05 and T06 remain `wait`; no off-host write, retained-artifact deletion,
-  private-key access, or live-host restore occurred.
+- T05 is source-prepared and pending owner acceptance; T06 remains `wait`. No
+  off-host write, retained-artifact deletion, private-key access, or live-host
+  restore occurred.