Harden backup credentials and add durable image inventory publication

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

docs/evidence/repo-review-2026-09-05.md

@@ -0,0 +1,44 @@
+# Repository review — 2026-09-05
+
+Reviewed the working tree, fetched origin, scanned all local workplan statuses,
+and read/acknowledged the State Hub inbox. Existing WORK-RECORDS.md changes
+correct renumbered plans 0025–0027 and are retained.
+
+Open plans 0015, 0025 and 0027 retain their attended gates: approved exercise
+windows/abort operators, operator listener cutover, and exact recovery/custody
+receipts. No new qualifying receipts were in the unread inbox.
+
+New actionable source work is tracked by RPF-WP-0028 (durable image inventory)
+and RPF-WP-0029 (backup credential fallback). Their live completion gates remain
+explicit. No prune, reboot, lease revocation, or provider rotation was run.
+
+Other inbox demands requiring scoped design or owner inputs remain pending:
+
+- ops-mason fluid-telegram: tenant prefix and actual OIDC group claim remain
+  unconfirmed. Read/write policy requires reviewed CCR schema/validator support;
+  current read-only request shape must not be bypassed.
+- secrets-engine: native AppRole apply still requires serving canonical action
+  authorization, exact targets, attended authority and consumer health proof.
+  Its separate service JWT mount/role contract is not yet established here.
+- State Hub rename preflight: dedicated signing-secret lane remains to be
+  designed and approved; the rename is outside this session's scope.
+- Policy Nexus CCR-2026-0014 request is superseded by the repository's existing
+  activation commit 62423fd; no duplicate provisioning performed.
+- Activity-core OpenRouter recovery was reported complete and its intentional
+  reuse decision retained in RPF-WP-0004.
+
+No coordination messages were sent. Incoming requests are recorded here for
+follow-up rather than treated as permission to invent identities or credentials.
+
+Validation: unittest discovery passed 158 tests; full pytest discovery passed
+164 tests, including the function-based tests omitted by unittest. Bash syntax
+and git diff whitespace checks passed. The inventory and credential tests use synthetic
+inputs and mocked custody only.
+
+State Hub synchronization remains pending: `statehub fix-consistency` was
+attempted in the sandbox and once outside it. Both were interrupted after
+prolonged HTTP reads during the check phase, before a repair report was
+returned. No registrar skip was reported, so registrar authority was not
+assumed. Re-run `statehub fix-consistency` when these reads complete reliably
+to index the new workplans and refresh the generated records/brief. Progress
+was logged successfully as `7e317a96-eb7e-4b36-9d81-4efe49efa22c`.

docs/forgejo-backup.md

@@ -26,6 +26,13 @@ Preflight: `forgejo-db` pod must be Ready (`make forgejo-db-status`). A full dum
 with 13 org repos is ~670MiB — allow 10–20 minutes for stream + age on a typical
 workstation link.
 
+Uploads require the governed `CCR-2026-0004` OpenBao offsite lane or explicitly
+provided `RAILIANCE_BACKUP_NC_TOKEN` / `RAILIANCE_BACKUP_NC_WEBDAV_URL` inputs.
+There is no built-in credential fallback. Missing credentials stop execution
+before any cluster dump. Local encryption dry-runs skip upload authentication.
+Provider rotation and replacement upload/restore proof are tracked separately
+in `RPF-WP-0029`; removing the source default does not prove revocation.
+
 Decrypt: `~/.config/age/railiance-backup.key` (same key as other Railiance backups).
 
 ## Nextcloud layout
@@ -62,4 +69,4 @@ See `railiance-infra`:
 - `docs/forgejo-restore-drill-evidence.md`
 
 Download and decrypt a dump from Nextcloud, set `BACKUP_LOCAL` to the zip path,
-then run the drill script.
+then run the drill script.

docs/forgejo-package-prune.md

@@ -73,7 +73,38 @@ make forgejo-package-prune-dry-run   # list would-delete candidates
 make forgejo-package-prune           # delete beyond retention depth
 ```
 
-## Rollback
+## Durable multi-cluster image inventory
+
+The inventory belongs outside the platform checkout. On the production worker
+host, use `/home/tegwick/.local/state/railiance-platform/live-images/all.txt`.
+`make live-images-refresh LIVE_IMAGES_SOURCES="/path/railiance01.txt /path/coulombcore.txt"`
+merges complete, nonempty exports with the prior inventory under a writer lock,
+then atomically publishes sorted image references and a count/hash receipt.
+Set `LIVE_IMAGES_OUTPUT` when publishing for a different host user.
+Missing, empty, or malformed input fails without replacing the previous file.
+Refresh only adds protection: removal of obsolete tags requires a separate
+review of every production cluster and rollback requirement.
+
+Migration and rollout sequence:
+
+1. Seed from the restored `docs/evidence/live-images-all.txt` plus fresh exports
+   from railiance01 and coulombcore; retain the restored multi-cluster entries.
+2. Project the durable **directory** read-only into the activity-core worker
+   and configure its inventory argument to `all.txt` in that directory. Do not
+   mount the single file: atomic replacement must be visible to the worker.
+3. Verify the worker reads a nonempty inventory and retains the existing hard
+   refusal of apply when that file is missing or empty. Use only its dry-run
+   verification; do not manually trigger prune.
+4. After each cluster image rollout, export pod regular, init, and ephemeral
+   container images to a temporary file. Require successful kubectl exit and
+   nonempty output, then invoke this refresh target with that export. Keep
+   other clusters' prior entries during outages. Run the hook on the durable
+   host, or transfer the complete export there before invoking it.
+
+The publisher is implemented here; host migration and the activity-core mount
+and rollout-hook adoption are tracked in `RPF-WP-0028` until verified live.
+
+## Rollback procedure
 
 If a needed tag was removed, restore from the latest Nextcloud `forgejo-dump-*.zip.age`
 (`make forgejo-backup` evidence) using `railiance-infra/tools/forgejo-restore-drill.sh`,