docs(custody): close producer delivery with verified provider recovery

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29

docs/evidence/2026-10-03-root-custody-provider-recovery.json

@@ -0,0 +1,37 @@
+{
+  "artifact": "root-custody-history-20261003T195656Z-a52ec01b2a4a4c28ba21a52eb29e7cb7.json.age",
+  "ciphertext_sha256": "577498be3c6566e9622fe0d87ea3ad55063941acfab3aeb0accfc4a05dd21200",
+  "coordinates_only_updated": true,
+  "current_live_baseline_matches": true,
+  "decrypted_history_matches": true,
+  "digest": "33a2ae086385028db1b654aa5646b7a98bcde1c5878c804e19315dadc3f87248",
+  "escrow_and_unrelated_fields_preserved": true,
+  "executed_source_commit": "f1a780d830a118eecdc0ada1885e7b8f95b51072",
+  "finished_at": "2026-10-03T19:56:59.023904+00:00",
+  "historical_config_present": true,
+  "historical_credential_status": "historical-owner-and-revocation-unverified",
+  "historical_share_matches_current_lane": false,
+  "history_entries": 1,
+  "independent_escrow_decryption_verified": true,
+  "independent_escrow_recipient_matches_current_lane": true,
+  "kv_version": 1,
+  "lane_cas_noop": false,
+  "lane_kv_version": 3,
+  "local_historical_rclone_used": false,
+  "ok": true,
+  "provider": "existing-governed-nextcloud-backup",
+  "provider_roundtrip_verified_before_cas": true,
+  "published_lane_kv_version": 4,
+  "readback_http_status": 200,
+  "record_id": "nk-custody:platform-root",
+  "recorded_at": "2026-10-03T19:56:48.310198+00:00",
+  "replacement_share_created": true,
+  "replacement_share_id": 23,
+  "revision": 1,
+  "runtime_consumers_refreshed": false,
+  "scope": "current-owner-read-and-governed-history-provider-roundtrip",
+  "stage": "complete",
+  "status": "verified",
+  "unknown_shares_and_old_backups_preserved": true,
+  "upload_http_status": 201
+}

openbao/root-grant/README.md

@@ -254,3 +254,11 @@ On retry matching reviewed candidate is reused; stale expected version refuses.
 PROPFIND denial alone does not prove grant invalid: create-only policy can deny
 read properties. Backup consumers need normal governed credential refresh after
 cutover; this is separate from custody history proof and no live rollout occurs.
+
+Producer recovery completed2026-10-03: fresh founder repair receipt proves
+current empty revision1/KV1 matches retained baseline, actual encrypted upload201,
+Backup readback200, independently escrow-decrypted history match before CAS3->4.
+See [safe provider receipt](../../docs/evidence/2026-10-03-root-custody-provider-recovery.json).
+Producer plan RPF-WP-0049 finished. Backup runtime consumer refresh remains
+activity-core-owned; historical share revocation is separately unverified.
+No real custody grant was added.

workplans/RPF-WP-0049-platform-root-custody-record-delivery.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Deliver the approved OpenBao platform-root custody fact design"
 domain: financials
 repo: railiance-platform
-status: blocked
+status: finished
 owner: codex
 topic_slug: railiance-platform
 created: "2026-10-03"
@@ -16,8 +16,9 @@ state_hub_workstream_id: "7dc1b126-1ddd-550f-9e6a-1fc577d0f27b"
 Response to net-kingdom message bc0c620c. Founder approved on 2026-10-03:
 "Accept ADR-0017 and approve the proposed OpenBao delivery design."
 The selected delivery owner is railiance-platform, using the exact OpenBao KV v2
-path and trusted record ID below. No production source exists yet; this approval
-accepts the design and does not authorize a live change or a custody entry.
+path and trusted record ID below. Subsequent founder go-forward and attended
+execution delivered the initial empty production source; no real custody grant
+is inferred. All producer delivery and independent recovery gates are complete.
 Contract: ../net-kingdom/docs/contracts/root-grant-read-contract_v0.1.md.
 Packet: [approved producer design](../openbao/root-grant/README.md).
 
@@ -100,11 +101,10 @@ receipt-holder backup/readback and isolated recovery proof remain T05 requiremen
 
 ```task
 id: RPF-WP-0049-T05
-status: wait
+status: done
 priority: high
 depends_on: [RPF-WP-0049-T04]
-needs_human: true
-blocking_reason: "Admission, empty publication, live reader/denials/restart, audit correlation, native isolated Raft restore and remote Git history readback are verified. Only attended finish helper current owner baseline check plus governed encrypted history provider roundtrip receipt remains; existing approval persists."
+needs_human: false
 state_hub_task_id: "871e3236-61c0-58a1-a307-399cd662be6b"
 ```
 
@@ -241,3 +241,20 @@ roundtrip and independent escrow proof precede exact CAS3 coordinates-only
 cutover; unknown shares/old backups preserved. Provider proof and partial CAS
 receipt retained. T05 waits bounded attended repair/recovery receipt; consumer
 refresh after lane rotation remains separately owned backup requirement.
+
+## Producer delivery completed — 2026-10-03
+
+Verified fresh founder-executed repair receipt at19:56 UTC against retained
+revision1/KV1 empty baseline digest33a2ae086385028db1b654aa5646b7a98bcde1c5878c804e19315dadc3f87248.
+Reviewed Backup share23 created; actual public upload201 and owner readback200,
+ciphertext match and independent workstation escrow decrypt/history comparison
+passed BEFORE exact CAS3 -> KV4 token/URL cutover. Unrelated lane fields, escrow,
+unknown shares and old backups preserved. Evidence:
+[governed provider recovery](../docs/evidence/2026-10-03-root-custody-provider-recovery.json).
+Together with admitted source, consumer read/denial/restart, audit correlation,
+native isolated Raft rollback/current restore and independent Git holder
+retrieval, all producer gates are complete. T05 done; workplan finished.
+No real root grant exists. Runtime backup consumers were not refreshed by this
+procedure: activity-core owns ACTIVITY-WP-0020-T08, separate from this delivered
+custody history proof. Historical exposed share differs current lane; its
+owner/revocation remains unverified and is not closed by this plan.