Add audit custody and recovery coordination workplan

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa

WORK-RECORDS.md

@@ -22,6 +22,7 @@
 | workplan | RAILIANCE-WP-0017 | finished | — | workplans/RAILIANCE-WP-0017-consumption-mode-enforcement.md |
 | workplan | RAILIANCE-WP-0022 | finished | — | workplans/RAILIANCE-WP-0022-agent-high-risk-boundary-coverage.md |
 | workplan | RAILIANCE-WP-0023 | finished | — | workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md |
+| workplan | RAILIANCE-WP-0024 | ready | — | workplans/RAILIANCE-WP-0024-audit-core-custody-and-recovery-coordination.md |
 | workplan | RPF-WP-0018 | finished | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
 | workplan | RPF-WP-0019 | finished | — | workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md |
 | workplan | RPF-WP-0020 | finished | — | workplans/RPF-WP-0020-ccr-schema-drift.md |
@@ -96,6 +97,10 @@
 | task | RAILIANCE-WP-0023-T01 | done | — | workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md |
 | task | RAILIANCE-WP-0023-T02 | done | — | workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md |
 | task | RAILIANCE-WP-0023-T03 | done | — | workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md |
+| task | RAILIANCE-WP-0024-T01 | todo | — | workplans/RAILIANCE-WP-0024-audit-core-custody-and-recovery-coordination.md |
+| task | RAILIANCE-WP-0024-T02 | todo | — | workplans/RAILIANCE-WP-0024-audit-core-custody-and-recovery-coordination.md |
+| task | RAILIANCE-WP-0024-T03 | todo | — | workplans/RAILIANCE-WP-0024-audit-core-custody-and-recovery-coordination.md |
+| task | RAILIANCE-WP-0024-T04 | todo | — | workplans/RAILIANCE-WP-0024-audit-core-custody-and-recovery-coordination.md |
 | task | RPF-WP-0018-T01 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
 | task | RPF-WP-0018-T02 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
 | task | RPF-WP-0018-T03 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md |

workplans/RAILIANCE-WP-0024-audit-core-custody-and-recovery-coordination.md

@@ -0,0 +1,120 @@
+---
+id: RAILIANCE-WP-0024
+type: workplan
+title: "Coordinate audit-core temporary custody and recovery exercises"
+domain: financials
+repo: railiance-platform
+status: ready
+owner: codex
+topic_slug: railiance
+created: "2026-08-22"
+updated: "2026-08-22"
+related:
+  - AUDIT-WP-0008
+  - WH-ENG-20260822-AUDIT-E2-01
+origin: routed
+origin_ref: "State Hub messages 10f80080-4c83-42ba-8590-f23c582d9f05 and a93fa88f-a9c5-4539-93ae-0c8f8490f53d"
+---
+
+# RAILIANCE-WP-0024 — audit-core custody and recovery coordination
+
+## Goal
+
+Define value-safe, approval-gated execution paths for audit-core's proposed
+Whitehat E2 sender exercise, runtime database-lease recovery exercise, and
+coordinated `railiance01` reboot. This workplan produces preflight contracts;
+it does not authorize a live token mint, OpenBao mutation, workload restart,
+lease revocation, firewall change, or host reboot.
+
+## Boundaries
+
+- Never put bearer values, database credentials, Secret payloads, or OpenBao
+  response bodies in Git, State Hub, command output, evidence, or chat.
+- Use exact paths and non-secret handles only. Temporary files, if later
+  approved, must be outside Git, mode `0600`, and securely removed.
+- A sender token stored in the current audit-core registry has no intrinsic
+  OpenBao lease. Expiring its projection credential does not expire the copy
+  accepted by audit-core. E2 live execution therefore remains blocked until
+  audit-core enforces an `expires_at` value for each temporary identity.
+- All live exercises require a separate engagement acknowledgement, attended
+  operators, a named window, and explicit abort authority.
+
+## T01 — Define the Whitehat E2 temporary sender lane
+
+```task
+id: RAILIANCE-WP-0024-T01
+status: todo
+priority: high
+```
+
+Define the reviewed path for exactly two distinct bearer values with an
+effective lifetime of at most 900 seconds. Each identity is bound to
+`source=whitehat-security`, one exact synthetic tenant, `may_write=true`, and
+`may_read=true`; neither reuses a production sender identity.
+
+The design must keep the full sender registry out of namespace `whitehat`.
+Use exact per-engagement KV paths and exact-key ExternalSecrets that project
+only mounted token files. Define the readiness-gated audit-core rolling reload,
+the audit-core `expires_at` prerequisite, the scheduled and attended cleanup,
+and value-safe positive/negative evidence.
+
+Done when audit-core and the engagement owner can review a complete path whose
+failure mode is expiry or denial, not a long-lived accepted bearer.
+
+## T02 — Define the runtime database lease recovery exercise
+
+```task
+id: RAILIANCE-WP-0024-T02
+status: todo
+priority: high
+```
+
+Coordinate with `rapp-postgres` and audit-core on a value-safe exercise for
+`database/creds/audit-core-runtime`: identify the lease only by handle, revoke
+or expire it under synthetic load, observe `/readyz` and 503 retry behavior,
+and prove ESO refresh plus mounted-file reread restores service without a pod
+restart. Record preconditions, time bounds, abort conditions, and rollback.
+
+Done when the procedure proves the property claimed by audit-core's credential
+reader without exposing a username/password or affecting non-synthetic data.
+
+## T03 — Define the coordinated railiance01 reboot exercise
+
+```task
+id: RAILIANCE-WP-0024-T03
+status: todo
+priority: high
+```
+
+Coordinate the single-node outage with `railiance-infra`,
+`railiance-cluster`, audit-core, and the OpenBao package owner. Require current
+backup evidence, operator access, a declared restart order, OpenBao
+seal/readiness handling, ESO reconciliation, audit-core database and sender
+readiness, synthetic end-to-end verification, notifications, and explicit
+abort/rollback conditions.
+
+Done when an operator-approved window can execute from one checklist without
+guessing or relying on credential values in the record.
+
+## T04 — Route the contracts and approval gates
+
+```task
+id: RAILIANCE-WP-0024-T04
+status: todo
+priority: medium
+```
+
+Route the reviewed procedures to audit-core, `rapp-postgres`,
+`railiance-cluster`, and `railiance-infra`. Identify each live mutation and its
+owner, record outstanding approvals, and keep live tasks waiting until the
+engagement or recovery window is explicitly acknowledged.
+
+Done when every participant has the same value-safe procedure, responsibility
+map, and stop conditions.
+
+## Acceptance
+
+- [ ] E2 cannot proceed without enforced sender expiry and exact-path projection.
+- [ ] Database recovery is restart-free and evidenced without credential values.
+- [ ] Reboot recovery has an ordered, owner-signed checklist and abort path.
+- [ ] No live action is implied by completing this design workplan.