Review blocked platform obligations and archive completed ESO recovery

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

SCOPE.md

@@ -65,7 +65,7 @@ records every reviewed plan and the consolidation mapping.
 | First | Reported credential exposures need final disposition and dependable operator custody | RPF-WP-0027: KeyCape/NetKingdom residual evidence and S3 custody; RPF-WP-0029: provider invalidation and replacement backup recovery |
 | First | Private attended OpenBao access remains unproven end to end | RPF-WP-0025-T03; keep its window separate from incident/recovery actions |
 | Next | Recovery procedures exist, but two cross-owner exercises still lack completion evidence | RPF-WP-0015-T02/T03: S3 contribution, with audit-core and S1/S2 executing their own parts |
-| Next | Three requested credential lanes have designs but no live acceptance | RPF-WP-0035: one queue with separate consumer/issuer/approval gates |
+| Next | Signing lane accepted; two requested credential lanes still await live acceptance | RPF-WP-0035: one queue with separate consumer/issuer/approval gates |
 | Next | Numeric availability/recovery promises, evidence freshness, recurring drills, emission and admission drift lack a complete S3 acceptance loop | RPF-WP-0036-T02–T05 |
 | Next | Compatibility ownership, stale Hub aliases, and undeployed capability demand need explicit disposition | RPF-WP-0036-T06/T07 |
 
@@ -120,6 +120,14 @@ legacy aliases are not additional authoritative obligations.
 disclosure drift. `make assurance-capture` pins the cluster and collects only
 status metadata; `make assurance-check` fails on incomplete/stale/failed evidence.
 The first live run found all three database cells Ready with same-day backups
-and archiving, but three failing ESO resources. Recurring restore acceptance,
+and archiving, and identified three failing ESO resources, since repaired under RPF-WP-0037.
+A fresh blocker-review capture confirms healthy database and ESO signals.
+Recurring restore acceptance,
 validated restore adapters and Q2 delivery remain open. See
 [service assurance](docs/service-assurance.md) and RPF-WP-0036.
+
+The dedicated Nextcloud Backup account is active with a 10 GiB provider quota
+and a create-only workload share. Encrypted fixture recovery and consumer
+refresh are verified; full application restore and predecessor invalidation
+remain RPF-WP-0029-T02. See the
+[latest blocked-workplan review](history/2026-09-05-blocked-workplan-closure-review.md).

WORK-RECORDS.md

@@ -14,7 +14,6 @@
 | workplan | RPF-WP-0029 | blocked | — | workplans/RPF-WP-0029-backup-credential-default-removal.md |
 | workplan | RPF-WP-0035 | blocked | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
 | workplan | RPF-WP-0036 | blocked | — | workplans/RPF-WP-0036-platform-service-assurance.md |
-| workplan | RPF-WP-0037 | finished | — | workplans/RPF-WP-0037-eso-static-token-recovery.md |
 | task | RPF-WP-0015-T01 | done | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
 | task | RPF-WP-0015-T02 | wait | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
 | task | RPF-WP-0015-T03 | wait | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
@@ -42,6 +41,3 @@
 | task | RPF-WP-0036-T05 | done | — | workplans/RPF-WP-0036-platform-service-assurance.md |
 | task | RPF-WP-0036-T06 | wait | — | workplans/RPF-WP-0036-platform-service-assurance.md |
 | task | RPF-WP-0036-T07 | done | — | workplans/RPF-WP-0036-platform-service-assurance.md |
-| task | RPF-WP-0037-T01 | done | — | workplans/RPF-WP-0037-eso-static-token-recovery.md |
-| task | RPF-WP-0037-T02 | done | — | workplans/RPF-WP-0037-eso-static-token-recovery.md |
-| task | RPF-WP-0037-T03 | done | — | workplans/RPF-WP-0037-eso-static-token-recovery.md |

assurance/ownership-handoffs.json

@@ -32,7 +32,7 @@
         },
         {
           "path": "docs/forgejo-backup.md",
-          "sha256": "69f6f38de902b80c6de161087b1d5738d1dea7ea35b3d49816d2ea67a1a5329b"
+          "sha256": "af99987e900c8d2322da11c361bac4f1b946a577eed4a93d995cefa31a8e35b5"
         },
         {
           "path": "docs/forgejo-package-prune.md",

docs/evidence/RPF-blocked-review-2026-09-05.json

@@ -0,0 +1,168 @@
+{
+  "observation": {
+    "schema": "railiance-platform.observation.v1",
+    "cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786",
+    "captured_at": "2026-09-05T19:13:48.284043+00:00",
+    "signals": {
+      "apps-pg.ready": {
+        "result": "pass",
+        "observed_at": "2026-09-05T19:13:40.747193+00:00"
+      },
+      "apps-pg.backup": {
+        "result": "pass",
+        "observed_at": "2026-09-05T02:15:07Z"
+      },
+      "apps-pg.wal": {
+        "result": "pass",
+        "observed_at": "2026-09-05T19:13:40.747225+00:00"
+      },
+      "apps-pg.headroom": {
+        "result": "pass",
+        "observed_at": "2026-09-05T19:13:33Z"
+      },
+      "platform-pg.ready": {
+        "result": "pass",
+        "observed_at": "2026-09-05T19:13:42.890660+00:00"
+      },
+      "platform-pg.backup": {
+        "result": "pass",
+        "observed_at": "2026-09-05T02:15:11Z"
+      },
+      "platform-pg.wal": {
+        "result": "pass",
+        "observed_at": "2026-09-05T19:13:42.890688+00:00"
+      },
+      "platform-pg.headroom": {
+        "result": "pass",
+        "observed_at": "2026-09-05T19:13:30Z"
+      },
+      "platform-pg-2.ready": {
+        "result": "pass",
+        "observed_at": "2026-09-05T19:13:45.027444+00:00"
+      },
+      "platform-pg-2.backup": {
+        "result": "pass",
+        "observed_at": "2026-09-05T02:15:08Z"
+      },
+      "platform-pg-2.wal": {
+        "result": "pass",
+        "observed_at": "2026-09-05T19:13:45.027474+00:00"
+      },
+      "platform-pg-2.headroom": {
+        "result": "pass",
+        "observed_at": "2026-09-05T19:13:26Z"
+      },
+      "openbao.seal": {
+        "result": "pass",
+        "observed_at": "2026-09-05T19:13:47.585545+00:00"
+      },
+      "eso.ready": {
+        "result": "pass",
+        "observed_at": "2026-09-05T19:13:48.284009+00:00"
+      },
+      "eso.refresh": {
+        "result": "pass",
+        "observed_at": "2026-09-05T18:37:39Z"
+      }
+    }
+  },
+  "evaluation_at_capture": {
+    "schema": "railiance-platform.assurance-signal.v1",
+    "cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786",
+    "evaluated_at": "2026-09-05T19:13:48.284043+00:00",
+    "signals": {
+      "apps-pg.ready": {
+        "state": "healthy",
+        "owner": "railiance-platform"
+      },
+      "apps-pg.backup": {
+        "state": "healthy",
+        "owner": "railiance-platform"
+      },
+      "apps-pg.wal": {
+        "state": "healthy",
+        "owner": "railiance-platform"
+      },
+      "apps-pg.restore": {
+        "state": "missing",
+        "owner": "railiance-platform"
+      },
+      "apps-pg.headroom": {
+        "state": "healthy",
+        "owner": "railiance-platform"
+      },
+      "platform-pg.ready": {
+        "state": "healthy",
+        "owner": "rapp-postgres"
+      },
+      "platform-pg.backup": {
+        "state": "healthy",
+        "owner": "rapp-postgres"
+      },
+      "platform-pg.wal": {
+        "state": "healthy",
+        "owner": "rapp-postgres"
+      },
+      "platform-pg.restore": {
+        "state": "missing",
+        "owner": "rapp-postgres"
+      },
+      "platform-pg.headroom": {
+        "state": "healthy",
+        "owner": "rapp-postgres"
+      },
+      "platform-pg-2.ready": {
+        "state": "healthy",
+        "owner": "rapp-postgres"
+      },
+      "platform-pg-2.backup": {
+        "state": "healthy",
+        "owner": "rapp-postgres"
+      },
+      "platform-pg-2.wal": {
+        "state": "healthy",
+        "owner": "rapp-postgres"
+      },
+      "platform-pg-2.restore": {
+        "state": "missing",
+        "owner": "rapp-postgres"
+      },
+      "platform-pg-2.headroom": {
+        "state": "healthy",
+        "owner": "rapp-postgres"
+      },
+      "openbao.seal": {
+        "state": "healthy",
+        "owner": "railiance-platform"
+      },
+      "openbao.snapshot": {
+        "state": "missing",
+        "owner": "railiance-platform"
+      },
+      "openbao.restore": {
+        "state": "missing",
+        "owner": "railiance-platform"
+      },
+      "offsite.upload": {
+        "state": "missing",
+        "owner": "railiance-platform"
+      },
+      "offsite.restore": {
+        "state": "missing",
+        "owner": "railiance-platform"
+      },
+      "eso.ready": {
+        "state": "healthy",
+        "owner": "railiance-platform"
+      },
+      "eso.refresh": {
+        "state": "healthy",
+        "owner": "railiance-platform"
+      }
+    },
+    "transport": "unmonitored",
+    "guarantees": "unsupported",
+    "threshold_status": "local-diagnostic-only",
+    "healthy": false
+  }
+}

docs/platform-ownership-handoffs.md

@@ -47,3 +47,9 @@ owners must first classify current versus obsolete resources, then review
 any exact lane repair or retirement. No Secret values were read and no failed
 resource was simply excluded to make the aggregate pass. These results do not
 by themselves identify a broken provider credential or authorize rotation.
+
+
+Resolved follow-up: RPF-WP-0037 repaired all three ESO authentication failures
+and is archived. The subsequent blocker-review capture verifies ESO readiness
+and freshness. No classification or repair request remains for those incidents;
+T06 still concerns compatibility ownership and derived-record cleanup.

history/2026-09-05-blocked-workplan-closure-review.md

@@ -0,0 +1,82 @@
+# Blocked workplan closure review — 2026-09-05
+
+Reviewed all current plans and every archived plan's task status against INTENT,
+SCOPE, local evidence, the repository-filtered Hub projection and adjacent owner
+records. Six source plans remain blocked, with 12 unfinished tasks. No terminal
+plan has unfinished task blocks. There is no evidence to finish another blocked
+plan today without additional owner/live acceptance. Reducing the count by
+cancelling necessary recovery or custody obligations would misstate completion.
+
+## Completed loose ends removed from the current view
+
+- Archived finished RPF-WP-0037 with all three tasks done; preserved its ID,
+  UUIDs and evidence. No repeat ESO rotation is needed.
+- Corrected signing-lane and Backup-account descriptions in the current index
+  and SCOPE: RPF-WP-0035-T04 and RPF-WP-0029-T03 are already live-complete.
+- Corrected RPF-WP-0015's current blocker: audit-core has implemented and
+  registered the load driver and proved a local accepted/duplicate round trip.
+  A new implementation request would duplicate existing work.
+- Refreshed the compatibility inventory's hashes after recent documentation
+  changes. Its retention decision remains valid through 2026-10-05; no owner
+  acceptance or source transfer is claimed.
+
+## Remaining closure requirements
+
+| Plan / task | Work already complete | Exact remaining result / responsible owner |
+| --- | --- | --- |
+| 0015 T02 | Reviewed procedure, contained harness, registered audit-core driver | Approved synthetic sender, fresh ≤15-minute window and abort operator; platform lease/ESO recovery plus audit-core retry/readiness proof, accepted by rapp-postgres |
+| 0015 T03 | Ordered owner-reviewed outage procedure and contained login repair | Fresh encrypted off-host snapshot, independent quorum/console access, named operators and outage window; S1/S2 execute reboot, S3 proves custody/readiness, audit-core proves application recovery |
+| 0025 T03 | Guarded callback/retraction/rollback tooling | Attended loopback callback/login proof, then guarded public-listener retraction and S1 DNS disposition; preserve package/issuer/tunnel boundaries |
+| 0027 T03/T05/T06 | KeyCape bundle rotation and provider procedure | NetKingdom's sanitized resolver receipt and incident-owner ruling on unavailable predecessor; confirmed operator custody coordinates and reader/writer handoff. Do not rotate the bundle again or reconstruct exposed values |
+| 0029 T02 | Backup-owned create-only share, encrypted fixture recovery, ESO/runtime refresh | Owner invalidation receipt for the old Bernd-owned share plus fetched real-backup application restore. Backup account credentials cannot revoke a different owner's share; existing retained data/key custody must survive |
+| 0035 T02 | JWT design and secrets-engine authentication implementation | KeyCape HTTPS issuer/JWKS, accepted exact claims/audience and consumer opt-in; reviewed scoped role, positive/negative/expiry/revocation proof |
+| 0035 T03 | Operator matrix design | Accepted tenant/path/fields/capability matrix and IAM assurance binding; then platform validator/executor implementation, consumer CAS/containment and live scoped acceptance |
+| 0036 T03 | Local freshness evaluator and recovery procedures | Owner-validated recurring restore/snapshot/offsite receipts and accepted cadence. Synthetic transport recovery does not establish full application recovery |
+| 0036 T04 | Metadata producer and repaired ESO delivery | Railiance-telemetry receiving contract, named recipient, controlled failure delivery and missing-emission detection |
+| 0036 T06 | Exact inventory and dated retention decision | Accepting compatibility owners/replacement caller proof or renewed retention decision; repo-manager/State Hub repair of retired-alias visibility and regenerated orientation |
+
+These retain six distinct boundaries: recovery exercises, private operator
+access, identity incident custody, backup incident recovery, new credential
+lanes and recurring service assurance. No further merger removes an underlying
+dependency. Application/identity/host execution remains with its existing owner;
+S3 retains its acceptance contribution. No coordination messages were sent.
+
+## Fresh read-only operating evidence
+
+`docs/evidence/RPF-blocked-review-2026-09-05.json` pins the railiance01 cluster
+and preserves capture-time evaluation. All 15 collected signals are healthy:
+readiness, backup, WAL and headroom for three database cells; OpenBao unsealed;
+ESO readiness and freshness. The seven absent signals are three database
+restores, OpenBao snapshot/restore and offsite upload/restore evidence adapters.
+The missing offsite signal is not a failed Backup cutover: its separate receipt
+proves a synthetic fixture only and has not been promoted to a real-backup
+assurance receipt. Overall assurance remains incomplete and Q2 unmonitored.
+
+## Derived records that inflate the apparent backlog
+
+The repository-filtered Hub read still returns these retired aliases as open:
+
+| Retired alias UUID | Canonical source UUID |
+| --- | --- |
+| 038bc3c0-4492-5b91-95eb-ae515ca205df | b2c25a01-4a80-55c1-90cf-8538000f7e0e (0027) |
+| 6f8a6cbc-c076-5f0a-ade2-281a7ec71360 | 6dda6039-295e-5cac-aef6-3183c3218649 (0025) |
+| 88c4ef7f-0af8-580e-90dc-a2bae2675a4d | f4640325-e89c-591d-b58e-ec6b087900ac (0015) |
+
+The installed brief generator queries open rows without filtering these retired
+aliases. Regenerating it alone would repeat the defect. Routine exact-commit
+reconciliation does not remove the historical rows from this read view. Keep
+this scoped owner defect in T06; do not edit managed IDs, blanket-acknowledge
+retirements or fabricate file-backed rows. The current workplan README is the
+accurate orientation until the owner repairs the read/generator contract.
+
+## Next execution order
+
+First obtain the old-share owner invalidation receipt and execute a real offsite
+restore to close 0029; the new account is already operational. Keep the private
+OpenBao cutover in its own attended window, especially while other credential
+work is active. Resolve the NetKingdom incident evidence disposition separately.
+For service assurance, accepted restore adapters/cadence and a Q2 receiver are
+the meaningful missing deliverables; another local health checker is unnecessary.
+
+Unrelated in-progress Glas/Anthropic credential files were present at review
+start and were excluded from this change.

workplans/README.md

@@ -8,10 +8,10 @@ plans is not a count of missing implementations or independent incidents.
 | Workplan | Purpose and next gate | S3 boundary |
 | --- | --- | --- |
 | [RPF-WP-0027](RPF-WP-0027-keycape-live-secret-exposure-recovery.md) | Incident custody and final evidence; accept NetKingdom's residual disposition and publish exact custody handoff | The bundle was already rotated. Provider/MFA reconciliation belongs to NetKingdom. |
-| [RPF-WP-0029](RPF-WP-0029-backup-credential-default-removal.md) | Backup credential exposure; attended provider invalidation and replacement recovery receipts | S3 retains custody acceptance; S1 and forge own their backup execution. |
+| [RPF-WP-0029](RPF-WP-0029-backup-credential-default-removal.md) | Backup account cutover complete; old share invalidation and full offsite application restore remain | S3 retains custody acceptance; S1 and forge own their backup execution. |
 | [RPF-WP-0025](RPF-WP-0025-openbao-operator-only-access.md) | Private OpenBao access; fresh attended callback/login then guarded retraction | Coordinate package, issuer, tunnel and DNS owners; keep the window separate. |
-| [RPF-WP-0015](RPF-WP-0015-audit-core-custody-and-recovery-coordination.md) | Two prepared recovery exercises; fresh synthetic-load/outage approvals and custody readiness | S3 contributes lease/ESO and snapshot/unseal proof; S1/S2 and audit-core execute their parts. |
-| [RPF-WP-0035](RPF-WP-0035-credential-lane-implementation.md) | One implementation queue for secrets-engine JWT, Fluid operator KV and preflight signing | Three independent task gates; no new approval inherited from the completed designs. |
+| [RPF-WP-0015](RPF-WP-0015-audit-core-custody-and-recovery-coordination.md) | Two prepared recovery exercises; registered load driver exists; fresh sender/window/abort approvals and custody readiness remain | S3 contributes lease/ESO and snapshot/unseal proof; S1/S2 and audit-core execute their parts. |
+| [RPF-WP-0035](RPF-WP-0035-credential-lane-implementation.md) | Two remaining lanes: secrets-engine JWT and Fluid operator KV | Signing T04 is complete; JWT and Fluid retain separate issuer/consumer gates. |
 | [RPF-WP-0036](RPF-WP-0036-platform-service-assurance.md) | Implemented local assurance/admission; waits for recurring restore evidence, Q2 reception and owner handoff | Run the assurance commands; live acceptance and external ownership remain gated. |
 
 RPF-WP-0036-T02/T05/T07 are complete; T03/T04/T06 retain the remaining
@@ -23,3 +23,11 @@ and [generated current record index](../WORK-RECORDS.md).
 
 Do not recreate completed workplans because an old Hub alias or generated brief
 still shows them active. Use source IDs, and follow AGENTS.md for verified sync.
+
+## Latest closure review
+
+[2026-09-05 blocker review](../history/2026-09-05-blocked-workplan-closure-review.md):
+12 unfinished tasks across six genuine blocked plans. All terminal plans have
+only done/cancel tasks. Completed ESO recovery RPF-WP-0037 is archived.
+Three retired Hub aliases still appear open; they are a derived-view defect,
+not three more workplans. Use this file before the dated generated brief.

workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md

@@ -336,3 +336,14 @@ containment defect; the next attempt still needs current acceptance evidence.
 
 Do not create another platform-owned whole-host drill or duplicate these live
 tasks in RPF-WP-0036; that plan owns recurring service assurance.
+
+## Blocker recheck — 2026-09-05
+
+AUDIT-WP-0008-T07 already records the synthetic-load driver at `8c8bcf4`,
+candidate receipt `7879bf65-06b7-4d0c-bbd1-873b6d20b7fc` and SHA-256
+`941ba251f638869626b06e9cbf430c70188c0bdf4715e3eff9c7610366f68662`.
+It also records a local accepted/duplicate HTTP round trip. Driver construction
+is no longer missing. T02 waits on its separately approved sender identity,
+fresh bounded window, abort operator and live recovery receipt. Local driver
+success does not prove lease revocation/ESO recovery. T03 remains a separate
+outage exercise; no historical window or terminal NO-GO may be reused.

workplans/RPF-WP-0036-platform-service-assurance.md

@@ -229,3 +229,16 @@ negative checks and repeated refresh passed, obsolete invalid delivery tokens
 were removed, and all 27 ExternalSecrets now report Ready. The earlier dated
 assurance snapshot is retained as historical evidence. T04 still waits on the
 accepted Q2 receiver and controlled failure/absence transport proof.
+
+## Blocker closure review — 2026-09-05
+
+Fresh metadata capture verified all 15 collected signals healthy; seven recovery
+signals remain absent from the evaluator. RPF-WP-0037 is archived. The completed
+Backup account fixture proof remains separate from a full backup/restore receipt.
+T03/T04 remain waiting on recovery evidence/cadence and Q2 delivery respectively.
+T06's source inventory hashes were refreshed; its dated retention decision is
+unchanged. A repo-filtered Hub read confirms three retired aliases still appear
+open. The installed generator would reproduce them; exact UUID mapping and
+remaining owner requirements are persisted in
+`history/2026-09-05-blocked-workplan-closure-review.md`. No duplicate recovery,
+monitoring or owner-transfer workplan was created.