coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare dedicated Backup account cutover with quota and recovery verification

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
This commit is contained in:
codex 2026-09-05 20:35:13 +02:00
parent 5ef016be01
commit 8fb4407832
3 changed files with 235 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

20
workplans/RPF-WP-0029-backup-credential-default-removal.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Remove backup credential default and verify governed replacement"
domain: financials
repo: railiance-platform
status: blocked
status: active
owner: codex
created: "2026-09-05"
updated: "2026-09-05"
@ -59,3 +59,21 @@ S1 backup scheduling belongs to RAIL-HO-WP-0012; forge backup orchestration and
artifact retention belong to railiance-forge. RPF-WP-0036-T06 will obtain an
accepted compatibility handoff, but this exposure obligation stays visible
here until its evidence is accepted. No rotation was executed in this review.
## Move future backups to the dedicated Backup account
```task
id: RPF-WP-0029-T03
status: progress
priority: high
```
User explicitly selected Nextcloud user `Backup` with 10 GB quota and operator
credentials at UI `secrets/operators/nextcloud/backup`. Live resolution is KVv2
`operators/nextcloud/backup`, fields BACKUP_USERNAME/BACKUP_PASSWORD. Native
WebDAV login verified; actual quota is 10737418240 bytes (10 GiB). Keep the
account password in operator custody, create a Backup-owned create-only share
for workload delivery, and preserve the existing age escrow and retained data.
Prove encrypted upload/download/decryption and workload delivery. No automatic
pruning or personal-account revocation is inferred from this account change.
The historical predecessor invalidation obligation in T02 remains separate.