railiance-platform/workplans/README.md

# Current platform work

Reviewed 2026-09-06. Seven open workplans: WP-0038 active, six blocked on explicit owner/live
gates; RPF-WP-0036 now has its repository implementation. Completed designs and implementations are
under `archived/`; their IDs and UUIDs are preserved. The number of blocked
plans is not a count of missing implementations or independent incidents.

| Workplan | Purpose and next gate | S3 boundary |
| --- | --- | --- |
| [RPF-WP-0027](RPF-WP-0027-keycape-live-secret-exposure-recovery.md) | Incident custody and final evidence; accept NetKingdom's residual disposition and publish exact custody handoff | The bundle was already rotated. Provider/MFA reconciliation belongs to NetKingdom. |
| [RPF-WP-0029](RPF-WP-0029-backup-credential-default-removal.md) | Backup cutover and full offsite application recovery complete; old share invalidation receipt remains | S3 retains custody acceptance; S1 and forge own their backup execution. |
| [RPF-WP-0025](RPF-WP-0025-openbao-operator-only-access.md) | Private OpenBao access; fresh attended callback/login then guarded retraction | Coordinate package, issuer, tunnel and DNS owners; keep the window separate. |
| [RPF-WP-0015](RPF-WP-0015-audit-core-custody-and-recovery-coordination.md) | Two prepared recovery exercises; registered load driver exists; fresh sender/window/abort approvals and custody readiness remain | S3 contributes lease/ESO and snapshot/unseal proof; S1/S2 and audit-core execute their parts. |
| [RPF-WP-0035](RPF-WP-0035-credential-lane-implementation.md) | Two remaining lanes: secrets-engine JWT and Fluid operator KV | Signing T04 is complete; JWT and Fluid retain separate issuer/consumer gates. |
| [RPF-WP-0036](RPF-WP-0036-platform-service-assurance.md) | Implemented local assurance/admission; waits for recurring restore evidence, Q2 reception and owner handoff | Run the assurance commands; live acceptance and external ownership remain gated. |
| [RPF-WP-0038](RPF-WP-0038-forgejo-scaleway-primary-coverage.md) | Native backup, full Scaleway archive recovery and 273 MiB Nextcloud essentials recovery verified; scheduled tier cutover remains | Bind recurring caller/dependencies, verified inventory, quota checks and separate owner retention. |

RPF-WP-0036-T02/T05/T07 are complete; T03/T04/T06 retain the remaining
acceptance gates. Treat credential exposure closure as the highest-priority attended
work; task order does not combine or waive approvals.

[Assessment and disposition of every plan](../history/2026-09-05-platform-intent-workplan-assessment.md)
and [generated current record index](../WORK-RECORDS.md).

Do not recreate completed workplans because an old Hub alias or generated brief
still shows them active. Use source IDs, and follow AGENTS.md for verified sync.

## Latest closure review

[2026-09-05 blocker review](../history/2026-09-05-blocked-workplan-closure-review.md):
At that review: 12 unfinished tasks across six genuine blocked plans.
The September 6 follow-up adds WP-0038 with one remaining full-archive task. All terminal plans have
only done/cancel tasks. Completed ESO recovery RPF-WP-0037 is archived.
Three retired Hub aliases still appear open; they are a derived-view defect,
not three more workplans. Use this file before the dated generated brief.