diff --git a/SCOPE.md b/SCOPE.md index 08e377a..fb0b9ae 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -56,7 +56,7 @@ replacement entry points; source files are not deleted merely to tidy scope. ## Work that closes the intent gaps -The [current work index](workplans/README.md) groups six open workplans. +The [current work index](workplans/README.md) groups seven open workplans. The [full assessment](history/2026-09-05-platform-intent-workplan-assessment.md) records every reviewed plan and the consolidation mapping. @@ -137,12 +137,15 @@ remain RPF-WP-0029-T02. See the Scaleway Standard Multi-AZ (`nl-ams`) is the primary backup destination under RESOURCE-WP-0002. Nextcloud is the independent secondary-copy lane. The live -Scaleway paths cover apps-pg, platform-pg and platform-pg-2. An isolated apps-pg +Scaleway paths cover apps-pg, platform-pg, platform-pg-2 and forgejo-db. An isolated apps-pg restore from that primary succeeded in 42.64 seconds; production remained ready and scratch resources were removed. See [primary recovery evidence](docs/evidence/scaleway-primary-restore-2026-09-06.json). -Coverage is per asset: live forgejo-db, net-kingdom-pg and state-hub-db have no +Forgejo native primary backup and isolated recovery now pass (45.08 seconds; +142 repository records, six users, 2,040 package blob records). See +[Forgejo primary evidence](docs/evidence/forgejo-scaleway-restore-2026-09-06.json). +Coverage is per asset: net-kingdom-pg and state-hub-db still have no observed native Barman destination. The Forgejo full-archive helper still targets Nextcloud; no Forgejo blob/archive destination on Scaleway was evidenced. The account cutover and archive-integrity fix do not establish that coverage. diff --git a/docs/backup-credential-recovery.md b/docs/backup-credential-recovery.md index ed1ac94..8b08fc3 100644 --- a/docs/backup-credential-recovery.md +++ b/docs/backup-credential-recovery.md @@ -127,3 +127,21 @@ prove that every restored package can be installed or every image pulled. Package-consumer acceptance and broader disaster-recovery guarantees remain with their owning assurance tasks. Full backups share the account's 10 GiB quota; a newly measured archive size must inform the separate retention decision. + +## WSL attended-login browser repair + +If this host has no `xdg-open`, `x-www-browser` or `www-browser`, the installed +Bao browser launcher cannot open its login page. Warden contains that output, +so this presents as a failed callback before the owner command starts. Use: + +```bash +python3 scripts/openbao-attended-exec.py -- /absolute/path/to/reviewed-silent-command +``` + +The wrapper keeps Warden's `openbao-platform-admin-login --exec` envelope and +adds a repository-scoped launcher only when all native providers are absent. +The launcher allows only the Keycloak HTTPS host and exact local OIDC callback; +it sends the URL to Windows PowerShell through stdin without recording it. +No token helper or captured Warden output may be inspected. A receipt written +by the owner command proves handoff; session cleanup is assessed separately +from the final Warden exit status. diff --git a/docs/backup-provider-coverage.md b/docs/backup-provider-coverage.md index 0e29a66..ce49202 100644 --- a/docs/backup-provider-coverage.md +++ b/docs/backup-provider-coverage.md @@ -9,7 +9,7 @@ Backup, 10 GiB quota. Provider selection does not establish asset coverage. | apps-pg | Scaleway Barman base backups + WAL, `platform-pg/apps-pg/` | Fresh isolated physical restore passed in 42.64 seconds; Nextcloud logical copy is separate | | platform-pg | Scaleway Barman base backups + WAL, `platform-pg/` | Earlier package restore evidence; independent logical Nextcloud copy | | platform-pg-2 | Scaleway Barman base backups + WAL, `platform-pg/platform-pg-2/` | Earlier package restore evidence; independent logical Nextcloud copy | -| forgejo-db | No native Barman destination observed | Logical SQL/full archive helper targets Nextcloud; primary coverage needs implementation | +| forgejo-db | Scaleway Barman base backups + WAL, `platform-pg/forgejo-db/`; daily 02:35 UTC, 30-day retention | Fresh isolated physical restore passed in 45.08 seconds; full archive coverage remains separate | | Forgejo repositories/packages/blobs | No reviewed Scaleway archive destination found | Corrected full-archive capture; 5.35 GB verified encrypted artifact staged; secondary download/application restore still pending | | net-kingdom-pg / state-hub-db | No native Barman destination observed | Do not infer protection from the shared cells' healthy backup status | | OpenBao / S1 host configuration | Not evaluated by this database restore | Their own encrypted snapshot/host backup and recovery contracts still apply | @@ -37,11 +37,15 @@ or assume a top-level `forgejo/` prefix is permitted. Before extending coverage: 3. Use a streaming multipart S3 uploader for growing archives, with abort/cleanup and immutable object naming. Verify completion and content, then recover by GET from Scaleway into the isolated Forgejo procedure. -4. Set native forgejo-db Barman coverage through its owning package/source, - with a separate tested recovery and no production in-place restore. +4. Native forgejo-db Barman coverage and isolated recovery are complete in + RPF-WP-0038-T02/T03. See `docs/evidence/forgejo-scaleway-restore-2026-09-06.json`. 5. Record provider-native retention and primary failure reporting separately from the 10 GiB secondary budget. No retained backup deletion is implicit. WP-0029 remains the secondary credential incident: old Bernd-share invalidation and replacement recovery. The full primary coverage gap belongs to S3 assurance (RPF-WP-0036-T03), with forge requirements and package/storage-owner inputs. + +RPF-WP-0038-T04 tracks the remaining primary full-archive delivery and application +recovery contract. Native database recovery verified 142 repository records, +six users and 2,040 package blob records; it did not recover the blob files. diff --git a/docs/evidence/forgejo-scaleway-activation-2026-09-06.json b/docs/evidence/forgejo-scaleway-activation-2026-09-06.json new file mode 100644 index 0000000..56c8127 --- /dev/null +++ b/docs/evidence/forgejo-scaleway-activation-2026-09-06.json @@ -0,0 +1,13 @@ +{ + "schema": "platform.forgejo-primary-backup.v1", + "status": "verified", + "backup_contract_applied": true, + "started_at": "2026-09-05T22:50:09.663787+00:00", + "backup_name": "forgejo-db-daily-20260905225013", + "backup_id": "20260905T225115", + "backup_phase": "completed", + "production_ready": true, + "continuous_archiving": true, + "destination": "s3://railiance-platform-pg-backup/platform-pg/forgejo-db/", + "retention": "30d" +} diff --git a/docs/evidence/forgejo-scaleway-restore-2026-09-06.json b/docs/evidence/forgejo-scaleway-restore-2026-09-06.json new file mode 100644 index 0000000..a5e138a --- /dev/null +++ b/docs/evidence/forgejo-scaleway-restore-2026-09-06.json @@ -0,0 +1,22 @@ +{ + "schema": "platform.scaleway-primary-restore.v1", + "status": "verified", + "namespace": "forgejo-db-recovery-ad1aff99", + "primary_destination": "s3://railiance-platform-pg-backup/platform-pg/forgejo-db/", + "last_successful_backup": "2026-09-05T22:51:32Z", + "source": "Scaleway Barman base backup and WAL", + "started_at": "2026-09-05T22:54:35.917727+00:00", + "stage": "database_acceptance", + "restore_seconds": 45.08, + "databases": [ + "app", + "forgejo", + "postgres" + ], + "repository_count": 142, + "user_count": 6, + "package_blob_count": 2040, + "production_ready": true, + "cleanup": true, + "finished_at": "2026-09-05T22:55:54.893587+00:00" +} diff --git a/history/2026-09-06-backup-problem-followup.md b/history/2026-09-06-backup-problem-followup.md new file mode 100644 index 0000000..112ae62 --- /dev/null +++ b/history/2026-09-06-backup-problem-followup.md @@ -0,0 +1,33 @@ +# Backup problem follow-up — 2026-09-06 + +The attended-login failures were caused by missing Linux browser launchers on +this WSL host. The installed Bao browser dependency tries `xdg-open`, +`x-www-browser` and `www-browser`; none was installed. The unauthenticated OIDC +routing probe returned the expected Keycloak host and localhost callback. +Implemented a narrowly validated, repository-scoped Windows browser bridge +and retained Warden's contained credential session. The replacement login +reached the silent owner command and began the real secondary archive transfer. +Transfer and revocation results are recorded separately when complete. + +Forgejo's native PostgreSQL backup is now active on the primary Scaleway bucket +at `platform-pg/forgejo-db/`, using the existing CCR-2026-0012 backup identity. +No IAM expansion or new credential delivery was needed. A resource-version +guarded patch changed only the live backup field; source manifests include +HTTPS/DNS egress, daily 02:35 UTC base backup, WAL archiving and 30-day retention. +The fresh backup completed with production Ready and continuous archiving. + +An isolated Scaleway recovery became ready in 45.08 seconds and preserved +142 repository records, six users and 2,040 package blob records. Production +remained Ready and the scratch namespace was removed. These are database +records, not recovered repository/package files. WP-0038-T01/T02/T03 are done. +T04 retains the separate full-archive primary delivery and application recovery +contract; WP-0029 retains the secondary incident and predecessor invalidation. + +Evidence: + +- `docs/evidence/forgejo-scaleway-activation-2026-09-06.json` +- `docs/evidence/forgejo-scaleway-restore-2026-09-06.json` + +All 204 repository tests passed after the browser fix and generalized primary +restore helper. The live primary recovery additionally verified that helper +against the new Forgejo Barman destination. diff --git a/workplans/README.md b/workplans/README.md index 5333bfa..98b1603 100644 --- a/workplans/README.md +++ b/workplans/README.md @@ -1,6 +1,6 @@ # Current platform work -Reviewed 2026-09-05. Six open workplans: six blocked on explicit owner/live +Reviewed 2026-09-06. Seven open workplans: seven blocked on explicit owner/live gates; RPF-WP-0036 now has its repository implementation. Completed designs and implementations are under `archived/`; their IDs and UUIDs are preserved. The number of blocked plans is not a count of missing implementations or independent incidents. @@ -13,6 +13,7 @@ plans is not a count of missing implementations or independent incidents. | [RPF-WP-0015](RPF-WP-0015-audit-core-custody-and-recovery-coordination.md) | Two prepared recovery exercises; registered load driver exists; fresh sender/window/abort approvals and custody readiness remain | S3 contributes lease/ESO and snapshot/unseal proof; S1/S2 and audit-core execute their parts. | | [RPF-WP-0035](RPF-WP-0035-credential-lane-implementation.md) | Two remaining lanes: secrets-engine JWT and Fluid operator KV | Signing T04 is complete; JWT and Fluid retain separate issuer/consumer gates. | | [RPF-WP-0036](RPF-WP-0036-platform-service-assurance.md) | Implemented local assurance/admission; waits for recurring restore evidence, Q2 reception and owner handoff | Run the assurance commands; live acceptance and external ownership remain gated. | +| [RPF-WP-0038](RPF-WP-0038-forgejo-scaleway-primary-coverage.md) | Forgejo native Scaleway backup and isolated database recovery complete; full archive delivery remains | Separate archive prefix, runtime delivery and application recovery contract required. | RPF-WP-0036-T02/T05/T07 are complete; T03/T04/T06 retain the remaining acceptance gates. Treat credential exposure closure as the highest-priority attended @@ -27,7 +28,8 @@ still shows them active. Use source IDs, and follow AGENTS.md for verified sync. ## Latest closure review [2026-09-05 blocker review](../history/2026-09-05-blocked-workplan-closure-review.md): -12 unfinished tasks across six genuine blocked plans. All terminal plans have +At that review: 12 unfinished tasks across six genuine blocked plans. +The September 6 follow-up adds WP-0038 with one remaining full-archive task. All terminal plans have only done/cancel tasks. Completed ESO recovery RPF-WP-0037 is archived. Three retired Hub aliases still appear open; they are a derived-view defect, not three more workplans. Use this file before the dated generated brief. diff --git a/workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md b/workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md index c81e212..a96c83f 100644 --- a/workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md +++ b/workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md @@ -4,7 +4,7 @@ type: workplan title: "Close Forgejo primary backup coverage on Scaleway" domain: financials repo: railiance-platform -status: active +status: blocked owner: codex created: "2026-09-06" updated: "2026-09-06" @@ -35,7 +35,7 @@ server directory. Retention follows the existing 30-day primary contract. ```task id: RPF-WP-0038-T02 -status: progress +status: done priority: high state_hub_task_id: "b6960c2e-1ad3-5c23-bfb6-9f1f16d0f0c2" ``` @@ -45,11 +45,15 @@ base backup. Apply only the reviewed backup field with a resource-version guard, preserving unrelated live settings. Require a completed fresh Backup, continuous archiving and source readiness; record metadata only. +Completed: fresh backup `forgejo-db-daily-20260905225013`, backup ID +`20260905T225115`, source Ready and continuous archiving healthy. Evidence: +`docs/evidence/forgejo-scaleway-activation-2026-09-06.json`. + ## Prove isolated primary database recovery ```task id: RPF-WP-0038-T03 -status: todo +status: done priority: high state_hub_task_id: "b47b5905-83c8-5da8-9951-e8cb7b7459f9" ``` @@ -59,6 +63,10 @@ Verify expected Forgejo database and nonempty repository/user/package metadata, source readiness and scratch cleanup. This is database recovery, not combined Forgejo blob/application recovery. +Completed: restored in 45.08 seconds, 142 repository records, six users and +2,040 package blob records. Production remained Ready; scratch namespace +removed. Evidence: `docs/evidence/forgejo-scaleway-restore-2026-09-06.json`. + ## Establish primary full-archive delivery and application recovery ```task