coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record rejected historical backup, verified fresh capture and worker activation
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
This commit is contained in:
codex 2026-09-05 22:35:20 +02:00
parent 34b9385bee
commit 195a51a62c
7 changed files with 166 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

31
workplans/RPF-WP-0029-backup-credential-default-removal.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Remove backup credential default and verify governed replacement"
domain: financials
repo: railiance-platform
status: active
status: blocked
owner: codex
created: "2026-09-05"
updated: "2026-09-05"
@ -36,7 +36,7 @@ redirects/non-success status. Added transport containment and failure tests.
```task
id: RPF-WP-0029-T02
status: progress
status: wait
priority: high
state_hub_task_id: "b3f3402f-890b-5781-9b3e-1c9c0d28cea8"
```
@ -86,3 +86,30 @@ Workload KV CAS 2→3 preserved age escrow. ExternalSecret delivery and all thre
activity-core deployments verified ready with new credentials loaded. All test
fixtures removed. Account quota is enforced by Nextcloud; no automatic pruning.
Evidence: `docs/evidence/RPF-WP-0029-backup-account-2026-09-05.json`.
## Real recovery attempt — 2026-09-05
The September 4 encrypted backup passed new-account upload/download/decryption
but failed ZIP integrity, so no application restore was claimed. Fixed the
capture path to require exact producer success, transferred-byte identity and
ZIP CRC validation before encryption. A fresh 5,351,717,533-byte production
archive passed all three gates; it is encrypted in private local staging.
200 tests passed. The isolated restore implementation now requires a hash-bound
receipt for fetched bytes and uses disposable local credentials/network.
A later attended OpenBao login failed before command handoff, with revocation
not confirmed; the read-only predecessor probe did not execute. Do not reuse
that attempt or infer provider invalidation. T02 waits for a fresh attended
login to upload/fetch the validated archive and execute isolated recovery,
plus the old Bernd-owned share's invalidation receipt or protected owner path.
The failed candidate's newly created offsite copy also needs exact owner cleanup.
History: `history/2026-09-05-wp0029-real-offsite-recovery.md`.
Worker follow-through: its mounted source was still old. Deployed the immutable
`backup-verified-0220ca56520c` ConfigMap via the scoped platform helper, rolled
actcore-worker and verified all four source hashes. Future worker entry-point
invocations use the integrity checks without editing the host checkout.
Fresh encrypted archive: 5,353,024,293 bytes; 142 repository HEAD entries.
Local drill plaintext and producer temporary files were removed. Owner login
and the two remaining acceptance results above are still required.