Record verified Backup account activation and consumer refresh

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

docs/backup-credential-recovery.md

@@ -65,3 +65,36 @@ requires HTTPS and rejects non-success responses. The Python backend streams
 the artifact, refuses redirects and suppresses credential-bearing exception
 text. These source changes are preparation; no provider rotation, upload or
 restore is claimed by their tests.
+
+## Dedicated Backup account (2026-09-05)
+
+The operator-provisioned account is `Backup` on `nx4069.your-storageshare.de`.
+Its credentials remain in OpenBao KVv2 `operators/nextcloud/backup`, fields
+`BACKUP_USERNAME` and `BACKUP_PASSWORD` (API `operators/data/nextcloud/backup`).
+The UI's `secrets/` prefix is not a separate KV mount.
+
+Future uploads use the account's `/railiance-backups` folder through a dedicated
+create-only share. Only its derived `NC_WEBDAV_TOKEN` and `NC_WEBDAV_URL` enter
+the existing workload lane and activity-core ExternalSecret; the account password
+is not a production credential. Recovery download and cleanup use operator
+account authority. Preserve `AGE_PRIVATE_KEY` and all unrelated KV fields with CAS.
+
+The server-reported quota is **10 GiB (10,737,418,240 bytes)**. This is a hard
+capacity limit shared by the account's files. Retention counts such as 14 daily
+and four weekly backups do not guarantee they fit. Check quota before large
+uploads; a quota rejection is a failed backup. Pruning retained backups requires
+an explicit retention decision and operator authority; upload jobs cannot delete.
+Existing Bernd-owned backups remain in their original location and require their
+existing recovery access. This cutover neither migrates them nor revokes Bernd's
+personal account or old share.
+
+`scripts/migrate_nextcloud_backup_account.py` performs the attended account,
+quota, create-only share, encrypted fixture recovery and CAS checks. Run it only
+through `warden access openbao-platform-admin-login --exec -- ...`, with a fresh
+private receipt path and `--confirm 'MIGRATE TO Backup'`. The helper is silent;
+receipts contain only status and metadata. Review a failed receipt before retrying:
+a failure can leave the dedicated folder/share or an identified test fixture, and
+a cleanup failure after CAS can occur after credentials have already changed.
+Refresh `actcore-backup-offsite`, verify delivery by contained comparison, and
+restart its three environment consumers (`actcore-api`, `actcore-event-router`,
+`actcore-worker`). Record their readiness and loaded-value comparisons.

docs/evidence/RPF-WP-0029-backup-account-2026-09-05.json

@@ -0,0 +1,60 @@
+{
+  "date": "2026-09-05",
+  "cutover": {
+    "schema": "platform.nextcloud-backup-account-cutover.v1",
+    "status": "account_cutover_verified_pending_consumer_refresh",
+    "quota_before": {
+      "quota_bytes": 10737418240,
+      "used_bytes": 2506112,
+      "available_bytes": 10734912128
+    },
+    "previous_kv_version": 2,
+    "share_id": "19",
+    "observed_permissions": 4,
+    "owner_matches": true,
+    "path_matches": true,
+    "share_owner": "Backup",
+    "share_permissions": 4,
+    "fixture_name": "account-acceptance-ee8a5e360afd26b7dc7b9b4c.age",
+    "upload_http_status": 201,
+    "runtime_get_http_status": 405,
+    "runtime_delete_http_status": 405,
+    "encrypted_upload": true,
+    "owner_download": true,
+    "escrow_decryption": true,
+    "runtime_read_denied": true,
+    "runtime_delete_denied": true,
+    "kv_version": 3,
+    "escrow_preserved": true,
+    "fixture_removed": true,
+    "quota_after": {
+      "quota_bytes": 10737418240,
+      "used_bytes": 2506112,
+      "available_bytes": 10734912128
+    }
+  },
+  "consumers": {
+    "status": "verified",
+    "kv_version": 3,
+    "eso_delivery_matches": true,
+    "deployments": {
+      "actcore-api": {
+        "ready": true,
+        "environment_matches": true
+      },
+      "actcore-event-router": {
+        "ready": true,
+        "environment_matches": true
+      },
+      "actcore-worker": {
+        "ready": true,
+        "environment_matches": true
+      }
+    },
+    "previous_test_fixtures_removed": [
+      "account-acceptance-e820d52ac48dc28766c39eef.age",
+      "account-acceptance-f88f8dcc3bea4ea199aeeebd.age"
+    ]
+  },
+  "status": "verified"
+}

docs/forgejo-backup.md

@@ -40,6 +40,12 @@ Decrypt: `~/.config/age/railiance-backup.key` (same key as other Railiance backu
 
 ## Nextcloud layout
 
+Since 2026-09-05, uploads go to user `Backup`, folder `/railiance-backups`,
+through a create-only share delivered from OpenBao. The account has **10 GiB**
+total capacity; the retention target below is subject to available space.
+Operator credentials stay in `operators/nextcloud/backup`; workload jobs receive
+only the derived upload grant. See [account and recovery procedure](backup-credential-recovery.md).
+
 ```
 forgejo/forgejo-dump-<timestamp>.zip.age
 forgejo/forgejo-db-<timestamp>.sql.age