Harden backup credentials and add durable image inventory publication

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md

@@ -404,3 +404,14 @@ consumers, restart requirements, provider-side revocation for the OpenRouter
 key) plus the post-rotate verification contract. Front-door disable comes
 first in every action; audit evidence is never deleted; values stay in
 OpenBao/operator custody.
+
+
+## Recovery evidence reported 2026-09-04
+
+Activity-core message `dcc0d7cc-0046-4c47-ba1c-fb1e0046e18e` supersedes
+`c32901ff-2072-4b93-81cd-db93dddfa5f3`. Owner decision
+`914e0e04-fd17-4fba-b2d5-be38f7aca185` approved intentional reuse from the
+reins provider lane into the canonical activity-core lane. Activity-core reports
+KV version 2, ESO synchronization, rollout, health and completion HTTP 200.
+This is owner-reported evidence, not an independent platform live verification;
+no further replacement was requested.

workplans/RPF-WP-0028-durable-live-image-inventory.md

@@ -0,0 +1,36 @@
+---
+id: RPF-WP-0028
+type: workplan
+title: "Make Forgejo image protection survive checkout replacement"
+domain: financials
+repo: railiance-platform
+status: blocked
+owner: codex
+created: "2026-09-05"
+updated: "2026-09-05"
+---
+
+# Make Forgejo image protection survive checkout replacement
+
+Source: State Hub message `868a2326-cdad-4256-be4c-7cd6c8ec4b5b`. Reviewed against current repository state
+on 2026-09-05. Repository implementation is complete; live closure remains pending.
+
+## Implement and verify durable publication
+
+```task
+id: RPF-WP-0028-T01
+status: done
+priority: high
+```
+
+Implemented scripts/refresh_live_images.py and make live-images-refresh. Publication validates exports before mutation, locks concurrent writers, retains all previous cluster entries, and fsyncs an atomic replacement. Offline tests prove repeatability, multi-cluster retention, and preservation on missing, empty, or malformed input.
+
+## Install production projection and rollout refresh
+
+```task
+id: RPF-WP-0028-T02
+status: wait
+priority: high
+```
+
+Requires the production host inventory, activity-core directory mount/configuration update, and cluster rollout hook adoption. Follow docs/forgejo-package-prune.md. Preserve the restored union and worker refusal on missing/empty inventory; do not manually trigger prune. No production migration or live verification occurred in this session.

workplans/RPF-WP-0029-backup-credential-default-removal.md

@@ -0,0 +1,36 @@
+---
+id: RPF-WP-0029
+type: workplan
+title: "Remove backup credential default and verify governed replacement"
+domain: financials
+repo: railiance-platform
+status: blocked
+owner: codex
+created: "2026-09-05"
+updated: "2026-09-05"
+---
+
+# Remove backup credential default and verify governed replacement
+
+Source: State Hub message `ee702ac9-9118-4b9b-963a-01943052b65a`. Reviewed against current repository state
+on 2026-09-05. Repository implementation is complete; live closure remains pending.
+
+## Remove source fallback and verify fail-closed behavior
+
+```task
+id: RPF-WP-0029-T01
+status: done
+priority: high
+```
+
+Removed the literal upload credential default from tools/cmd/forgejo-backup. Missing governed input now fails before cluster operations with a value-free diagnostic; encryption dry-runs skip upload authentication. Offline tests prove missing-input denial, explicit input, and mocked OpenBao resolution.
+
+## Invalidate predecessor and prove replacement recovery
+
+```task
+id: RPF-WP-0029-T02
+status: wait
+priority: high
+```
+
+Provider-side invalidation and replacement custody need the attended provider owner and CCR-2026-0004 lifecycle procedure. Record only non-secret invalidation, encrypted upload and restore receipts. No provider authority or replacement receipt was available; source removal alone does not close the reported exposure. Never record the predecessor value, fingerprint, length, or shape.