Implement S3 service assurance and admission checks

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

docs/platform-ownership-handoffs.md

@@ -0,0 +1,49 @@
+# Platform compatibility handoffs — 2026-09-05
+
+RPF-WP-0036-T06 inventory: `assurance/ownership-handoffs.json` contains exact
+paths/hashes, accepting owner candidates, callers, review dates and acceptance
+criteria. S3 custody/CCR policies and shared backup mechanisms stay here.
+
+Retain each operational entry point until the proposed owner accepts its
+canonical replacement, callers pass dry-run/smoke checks, and rollback is
+recorded. Review by 2026-10-05 or on owner acceptance. No files were removed,
+no ownership acceptance was invented, and no coordination messages were sent.
+This is the dated platform retention decision; T06 remains waiting for accepted
+handoffs and the separate derived-state repair.
+
+The forge contract already distinguishes forge requirements/verification from
+shared backup mechanisms. Split those concerns; do not move all backup code
+just because its filename mentions Forgejo. The platform OpenBao package
+handoff is likewise already documented: preserve custody/governance here and
+only adopt the package owner's authoritative replacement for its wrapper.
+ArgoCD files need artifact-level ownership: runtime bootstrap to S2, generic
+paved paths to S4, app releases to S5. ESO credential stores retain S3 custody
+review even when another repo packages their deployment.
+
+## Prepared owner requests
+
+These are reviewable request content, not sent messages:
+
+- Forge/package/app owners: accept or amend the exact source inventory, name
+  canonical entry points and callers, and return revision-pinned dry-run,
+  smoke and rollback evidence before retirement.
+- Repo-manager/State Hub: reconcile only the legacy UUID-to-canonical map in
+  the assessment's derived-state caveat; keep file-backed identities intact.
+  The installed brief generator reads open Hub workplans without excluding
+  legacy retired aliases, so rerunning it alone would reproduce duplicates.
+- Railiance-telemetry: supply versioned receiving schema, transport and
+  retention contract, intended recipient, and a controlled stale-event/absence
+  acceptance path for the local S3 producer. It is currently unmonitored.
+- Railiance-master: determine the accountable fleet Q3 recovery owner and
+  boundary. S3 continues its own service recovery work meanwhile.
+
+## Live ESO findings requiring scope confirmation
+
+The 2026-09-05 metadata capture found `SecretSyncedError` for
+`forgejo/forgejo-mailer`, `reuse/reuse-surface-runtime`, and
+`target-revenue/target-revenue-runtime`. Their last refreshes were August 6,
+August 6 and September 4 respectively. Package/consumer and platform custody
+owners must first classify current versus obsolete resources, then review
+any exact lane repair or retirement. No Secret values were read and no failed
+resource was simply excluded to make the aggregate pass. These results do not
+by themselves identify a broken provider credential or authorize rotation.