Advance blocked assurance and operator callback work

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

workplans/RPF-WP-0025-openbao-operator-only-access.md

@@ -8,7 +8,7 @@ status: blocked
 owner: codex
 topic_slug: railiance
 created: "2026-08-23"
-updated: "2026-09-05"
+updated: "2026-09-06"
 related:
   - RMASTER-WP-0020-T09
   - RAPP-OPENBAO-WP-0002
@@ -96,3 +96,14 @@ issuer callback, ops-bridge the tunnel, and S1/S2 DNS/network primitives.
 Unblock with a fresh attended OIDC/MFA callback update and loopback login,
 then the guarded retraction and owner-specific DNS handoff. Existing source
 readiness is not evidence of a completed live cutover.
+
+## Callback preservation repair — 2026-09-06
+
+T03 advanced locally: the attended callback helper now reads and preserves the
+existing platform-admin role, appends only the exact loopback callback, skips
+writes when already present, detects observed drift before writing, and verifies
+all settings on readback. `--check-only` is silent and returns 3 if absent.
+The role endpoint has no CAS; exclusive attended administration is still needed.
+Tests cover settings preservation, idempotence, drift, readback failure and
+unexpected roles. No live role update or ingress retraction was performed in
+this follow-up; attended loopback UI login remains the cutover gate.

workplans/RPF-WP-0035-credential-lane-implementation.md

@@ -7,7 +7,7 @@ repo: railiance-platform
 status: blocked
 owner: codex
 created: "2026-09-05"
-updated: "2026-09-05"
+updated: "2026-09-06"
 related:
   - RPF-WP-0032
   - RPF-WP-0033
@@ -140,3 +140,12 @@ signature, with healthy primary identity and no preflight blockers. State Hub
 chart commit `49e3182`, Helm revision 59. No repository rename executed.
 Evidence: `docs/evidence/RPF-WP-0035-T04-signing-activation-2026-09-05.json`;
 closure: `history/2026-09-05-preflight-signing-activation-complete.md`.
+
+## Dependency review — 2026-09-06
+
+SECRETS-WP-0008-T02 now records the local PIP claim/validation join implemented
+and tested. Its remaining gate is the unreachable approval-engine claim endpoint
+and access-engine Check (SECRETS-WP-0007-T04). Do not carry forward the old local
+stub as a blocker. T02 still needs the accepted service issuer/JWKS, claims,
+audience and consumer binding. T03 still needs confirmed operator group/tenant
+and consumer semantics; T04 is already complete. No new owner acceptance inferred.

workplans/RPF-WP-0036-platform-service-assurance.md

@@ -7,7 +7,7 @@ repo: railiance-platform
 status: blocked
 owner: codex
 created: "2026-09-05"
-updated: "2026-09-05"
+updated: "2026-09-06"
 state_hub_workstream_id: "ca639c3d-3a87-5fa4-ad13-6f2e014b0c84"
 ---
 
@@ -249,11 +249,32 @@ Scaleway is the selected primary; Nextcloud is the independent secondary.
 Fresh apps-pg recovery from Scaleway passed in 42.64 seconds with expected
 consumer databases and limits, production Ready and scratch cleanup complete.
 Evidence: `docs/evidence/scaleway-primary-restore-2026-09-06.json`.
-T03 now has this fresh physical recovery receipt but still lacks recurring
-cadence, the other recovery surfaces and validated evidence adapters.
+T03 now has this fresh physical recovery receipt; recurring assurance cadence
+and the remaining recovery surfaces are still incomplete.
 
 The source/live coverage inventory `docs/backup-provider-coverage.md` exposes
-missing native primary configuration on forgejo-db/net-kingdom-pg/state-hub-db
-and no reviewed Scaleway Forgejo archive destination. Track primary coverage
+remaining native primary configuration gaps on net-kingdom-pg/state-hub-db.
+Forgejo native database recovery and full Scaleway archive recovery have since
+passed; independent Nextcloud essentials recovery also passed (WP-0038). Track primary coverage
 here with forge/package/storage owners; do not silently claim the Nextcloud
 account cutover filled it or weaken WP-0029's separate incident closure.
+
+## Recovery evidence adapter follow-up — 2026-09-06
+
+T03 advanced: capture now consumes hash-pinned apps-pg and forgejo-db native
+Scaleway restore receipts through `scripts/recovery_evidence.py`. Completion
+timestamps survive every capture; wrong destination, drift, missing/naive/future
+times and unsuccessful cleanup cannot become passing samples. Forgejo database
+restore is its own signal. Older application archive receipts lack completion
+timestamps and remain outside the automatic adapter; essentials evidence never
+substitutes for full recovery. Six previous recovery signals still lack adapters
+or accepted evidence. Cadence, independent custody and Q2 transport gates remain.
+
+The Forgejo service record now reflects the completed native/full/essentials
+proofs while retaining unsupported guarantees and the pending scheduled cutover.
+
+Live adapter verification: `docs/evidence/RPF-WP-0036-assurance-2026-09-06.json`
+reports 16 healthy, six missing and one stale ESO refresh signal. The aggregate
+crossed the one-hour diagnostic boundary; subsequent metadata inspection found
+all 27 ExternalSecrets Ready with newer refreshes. Cadence/grace acceptance is
+still needed; no outage or successful alert transport is inferred.