Record rejected historical backup, verified fresh capture and worker activation

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

docs/evidence/RPF-WP-0029-fresh-archive-2026-09-05.json

@@ -0,0 +1,15 @@
+{
+  "schema": "platform.forgejo-capture-integrity.v1",
+  "status": "verified",
+  "archive_bytes": 5351717533,
+  "producer_exit_zero": true,
+  "transfer_hash_matches": true,
+  "zip_crc_passed": true,
+  "production_temporary_files_removed": true,
+  "members": 89197,
+  "uncompressed_bytes": 5432944912,
+  "repository_heads": 142,
+  "archive_sha256": "fe53d156461387ea487cddc5d6a01f0b5e3debda6fa494c8b87afc8bc62b55b2",
+  "encrypted_bytes": 5353024293,
+  "encrypted_stage": "/tmp/rpf-wp0029-restore/forgejo-dump-20260905-verified.zip.age"
+}

docs/evidence/RPF-WP-0029-rejected-backup-2026-09-05.json

@@ -0,0 +1,24 @@
+{
+  "schema": "platform.real-offsite-recovery.v1",
+  "status": "restore_rejected",
+  "quota_before": {
+    "quota_bytes": 10737418240,
+    "used_bytes": 2505506,
+    "available_bytes": 10734912734
+  },
+  "artifact": "wp0029-recovery-forgejo-dump-20260904T001507Z.zip.age",
+  "source_backup": "forgejo-dump-20260904T001507Z.zip.age",
+  "kv_version": 3,
+  "upload_http_status": 201,
+  "download_http_status": 200,
+  "ciphertext_bytes": 147171923,
+  "ciphertext_sha256": "475687367d7e1736b169a22732293c534d7a04d4f6315d235f0d649218f7d4cb",
+  "decrypted": true,
+  "quota_after": {
+    "quota_bytes": 10737418240,
+    "used_bytes": 2505506,
+    "available_bytes": 10734912734
+  },
+  "archive_validation": "failed_truncated_zip",
+  "application_restore": false
+}

docs/evidence/RPF-WP-0029-worker-bundle-2026-09-05.json

@@ -0,0 +1,8 @@
+{
+  "status": "verified",
+  "configmap": "backup-verified-0220ca56520c",
+  "worker_ready": true,
+  "bundle_files_match": true,
+  "host_checkout_edited": false,
+  "rollback": "Restore deployment from its prior ReplicaSet with kubectl rollout undo; retain immutable ConfigMap until no revision references it."
+}

docs/evidence/RPF-WP-0029-worker-source-2026-09-05.json

@@ -0,0 +1,4 @@
+{
+  "worker_backup_entrypoint_matches": false,
+  "worker_capture_helper_present": false
+}

docs/forgejo-backup.md

@@ -7,7 +7,7 @@ Workplan: `RAIL-HO-WP-0005` T04/T09 · Decision: Option A (Nextcloud + age)
 | Artifact | Source | Format |
 | --- | --- | --- |
 | Blob state | `forgejo dump` in production pod | zip → age |
-| PostgreSQL | `pg_dump -Fc` from CNPG `forgejo-db` | custom dump → age |
+| PostgreSQL | `pg_dump --no-owner --no-acl` from CNPG `forgejo-db` | SQL → age |
 
 Covers git repos, packages (OCI/npm/generic), attachments, LFS, avatars, and DB metadata.
 
@@ -20,11 +20,12 @@ make forgejo-backup            # encrypt + upload to Nextcloud forgejo/
 make forgejo-backup-status     # last success + 7-day gate hint
 ```
 
-Requires: `kubectl`, `age`, `curl`, `KUBECONFIG=~/.kube/config-hosteurope`.
+Requires: `kubectl`, `age`, Python 3, and curl or the Python upload backend.
+Set `KUBECONFIG` to the currently verified railiance01 access path.
 
-Preflight: `forgejo-db` pod must be Ready (`make forgejo-db-status`). A full dump
-with 13 org repos is ~670MiB — allow 10–20 minutes for stream + age on a typical
-workstation link.
+Preflight: `forgejo-db` pod must be Ready (`make forgejo-db-status`). The validated 2026-09-05 full archive is 5,351,717,533 bytes before age encryption.
+Allow for substantial transfer time and check the account quota before upload.
+This size supersedes the historical ~670 MiB estimate.
 
 Uploads require the governed `CCR-2026-0004` OpenBao offsite lane or explicitly
 provided `RAILIANCE_BACKUP_NC_TOKEN` / `RAILIANCE_BACKUP_NC_WEBDAV_URL` inputs.
@@ -79,3 +80,21 @@ See `railiance-infra`:
 
 Download and decrypt a dump from Nextcloud, set `BACKUP_LOCAL` to the zip path,
 then run the drill script.
+
+## Archive-integrity incident — 2026-09-05
+
+The September 4 encrypted cache sample decrypted but failed ZIP validation.
+The backup command now waits for the exact dump process to succeed, checks
+transfer size/hash and validates ZIP CRCs before encryption/upload. A fresh
+5.35 GB archive passed these checks. This does not certify the other historical
+backups or establish a completed offsite application restore. See WP-0029 and
+its dated evidence; never report a nonempty file as a successful backup.
+
+
+Activity-core currently receives the validated entry point through the immutable
+`backup-verified-0220ca56520c` bundle, applied by
+`scripts/deploy_verified_backup_bundle.py`. The wrapper mounts over the existing
+backup entry point; helpers/libraries live at `/opt/railiance-backup-verified`.
+Reapply the source-owned delivery helper after reviewed backup changes and verify
+its hash/rollout receipt. Roll back through the previous worker ReplicaSet; do
+not edit another machine's host checkout or remove referenced ConfigMaps.