coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Contain backup upload credentials and prepare provider recovery gates
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
This commit is contained in:
codex 2026-09-05 19:21:06 +02:00
parent 08a406f2f8
commit 5ef016be01
6 changed files with 219 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

12
workplans/RPF-WP-0029-backup-credential-default-removal.md
View file

@ -27,6 +27,11 @@ state_hub_task_id: "4b5aefdb-a746-54f9-ba29-ebb840e7848d"
Removed the literal upload credential default from tools/cmd/forgejo-backup. Missing governed input now fails before cluster operations with a value-free diagnostic; encryption dry-runs skip upload authentication. Offline tests prove missing-input denial, explicit input, and mocked OpenBao resolution.
2026-09-05 continuation: removed credentials and credential-bearing URLs from
curl argv; curl config travels through stdin with curlrc disabled. Both upload
backends suppress credential-bearing diagnostics, require HTTPS and reject
redirects/non-success status. Added transport containment and failure tests.
## Invalidate predecessor and prove replacement recovery
```task
@ -38,6 +43,13 @@ state_hub_task_id: "b3f3402f-890b-5781-9b3e-1c9c0d28cea8"
Provider-side invalidation and replacement custody need the attended provider owner and CCR-2026-0004 lifecycle procedure. Record only non-secret invalidation, encrypted upload and restore receipts. No provider authority or replacement receipt was available; source removal alone does not close the reported exposure. Never record the predecessor value, fingerprint, length, or shape.
Prepared owner execution procedure: `docs/backup-credential-recovery.md`.
Awaiting the Nextcloud share owner/account and replacement custody coordinates;
OpenBao authority is not provider share-management authority. Activity-core is
also a consumer of this upload lane. Preserve AGE_PRIVATE_KEY and historical
exposure evidence; upload-token rotation cannot clear recovery-key taint.
No provider mutation, backup upload or restore has been run in this continuation.
## Portfolio review — 2026-09-05
INTENT binding: dependable backup custody and recovery. Retain T02 until the