Define scoped Forgejo native backup on the Scaleway primary

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md

@@ -0,0 +1,72 @@
+---
+id: RPF-WP-0038
+type: workplan
+title: "Close Forgejo primary backup coverage on Scaleway"
+domain: financials
+repo: railiance-platform
+status: active
+owner: codex
+created: "2026-09-06"
+updated: "2026-09-06"
+---
+
+Scaleway is the user-confirmed primary; Nextcloud is independent secondary.
+Follow-up to the live coverage gap in RPF-WP-0036-T03. WP-0029 retains the
+secondary incident and old-share invalidation. No old backups are deleted.
+
+## Verify ownership and scoped primary destination
+
+```task
+id: RPF-WP-0038-T01
+status: done
+priority: high
+```
+
+This repository owns helm/forgejo-db-cluster.yaml and its deploy target.
+Reuse CCR-2026-0012's backup runtime identity and existing databases Secret.
+The reviewed bucket policy permits platform-pg/*; choose the separate native
+Barman destination platform-pg/forgejo-db/. No bootstrap key, IAM mutation or
+namespace expansion is required. Never write full archives into a Barman
+server directory. Retention follows the existing 30-day primary contract.
+
+## Activate native database backup and prove fresh completion
+
+```task
+id: RPF-WP-0038-T02
+status: progress
+priority: high
+```
+
+Add exact Scaleway destination, HTTPS/DNS egress, continuous WAL and daily
+base backup. Apply only the reviewed backup field with a resource-version
+guard, preserving unrelated live settings. Require a completed fresh Backup,
+continuous archiving and source readiness; record metadata only.
+
+## Prove isolated primary database recovery
+
+```task
+id: RPF-WP-0038-T03
+status: todo
+priority: high
+```
+
+Recover a new scratch cluster from the native Scaleway base backup/WAL.
+Verify expected Forgejo database and nonempty repository/user/package metadata,
+source readiness and scratch cleanup. This is database recovery, not combined
+Forgejo blob/application recovery.
+
+## Establish primary full-archive delivery and application recovery
+
+```task
+id: RPF-WP-0038-T04
+status: wait
+priority: high
+```
+
+Choose an independent archive prefix and confirm storage retention/caller
+contract, bounded worker credential delivery and multipart transfer/abort.
+Then retrieve a primary full archive and execute isolated application recovery.
+The existing 5.35 GB encrypted verified archive is available in private staging.
+Keep Nextcloud's 10 GiB secondary budget separate. The current helper still
+uploads only to Nextcloud until this task's full delivery is implemented and
+verified; native database backup alone cannot close the workplan.