Contain backup upload credentials and prepare provider recovery gates

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

history/2026-09-05-backup-provider-recovery-preparation.md

@@ -0,0 +1,24 @@
+# WP-0029 continuation: provider gate and transport containment
+
+The user authorized continuing with backup credential invalidation and recovery.
+Routing and CCR-2026-0004 identify a Nextcloud file-drop lane plus age recovery
+escrow. No provider share-management authority or replacement custody reference
+was supplied. Requested only owner/account and custody coordinates, not values.
+
+Found and fixed credential transport defects in the retained backup helper:
+curl argv previously contained the upload credential and credential-bearing URL;
+the Python fallback could print them through an exception traceback. Curl now
+receives escaped config on stdin with curlrc disabled, both paths require HTTPS,
+redirects/non-success responses fail, and backend diagnostics are contained.
+The Python fallback streams artifact bytes. Added tests using synthetic markers.
+
+Prepared `docs/backup-credential-recovery.md`: provider invalidation, CAS-safe
+replacement preserving age escrow, activity-core delivery, encrypted upload,
+separate owner download, and isolated offsite restore acceptance. The legacy
+infra drill's missing-file fallback makes a fresh production dump; a downloaded
+artifact must be proven present before it can qualify as offsite recovery.
+
+No provider change, credential read/provisioning, upload or restore was performed.
+The attempted metadata-only taint query lacked caller authentication. Historical
+CCR recovery-key exposure remains recorded; no current taint state or rotation
+is inferred. T02 remains waiting on the provider inputs and live proof.