Record verified Backup account activation and consumer refresh

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

credential-change-requests/CCR-2026-0004-railiance-backup-offsite-lane.yaml

@@ -5,7 +5,7 @@ request_type: workload-kv-read
 title: Railiance offsite backup lane (Nextcloud WebDAV + age recovery)
 status: active
 created: '2026-07-07'
-updated: '2026-07-16'
+updated: '2026-09-05'
 requester:
   agent: grok
   reason: Move railiance-backup / forgejo-backup credentials from hardcoded script
@@ -72,6 +72,12 @@ risk:
   classification: high
   notes:
   - NC_WEBDAV_TOKEN grants upload to the offsite backup file drop.
+  - Since 2026-09-05 the file drop belongs to Backup, folder /railiance-backups,
+    with create-only permissions and a server-enforced 10 GiB account quota.
+  - Operator credentials remain in KVv2 operators/nextcloud/backup, fields
+    BACKUP_USERNAME and BACKUP_PASSWORD; never deliver them to production.
+  - Existing Bernd-owned retained backups and recovery access remain separate;
+    historical predecessor invalidation and age-key exposure are still open.
   - "AGE_PRIVATE_KEY decrypts all age-encrypted backup artifacts \u2014 recovery escrow\
     \ only."
   - Credentials must not be stored on production hosts with delete permission.
@@ -117,6 +123,17 @@ verification:
     - 'Field presence via JSON key inventory only (NC_WEBDAV_TOKEN, NC_WEBDAV_URL, AGE_PRIVATE_KEY); lengths recorded, values not printed.'
     - 'EXPOSED taint set: custom_metadata exposed_at=2026-07-16T00:00:00Z exposed_version=2 (WP-0026 T05).'
     - 'ops-warden catalog promoted draft→active; fetch_command pinned to NC_WEBDAV_TOKEN; resolvable=true; risk=high.'
+  - at: '2026-09-05'
+    actor: codex
+    kind: dedicated_backup_account_cutover
+    result: passed
+    details:
+    - User authorized dedicated Backup account and operator custody coordinates.
+    - Verified 10737418240-byte quota and Backup-owned create-only share.
+    - Encrypted fixture PUT 201, owner download and escrow decryption passed;
+      runtime GET and DELETE returned 405 on the actual upload endpoint.
+    - CAS advanced workload KV version 2 to 3, preserving age escrow and other fields.
+    - Evidence docs/evidence/RPF-WP-0029-backup-account-2026-09-05.json.
 
 lifecycle:
   deactivate: Disable ops-warden catalog entry and detach OIDC role policy; rotate