Close verified incident task and finish local workplan loose ends

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e3c3-621b-7350-9f77-50a8d3ee7657

history/2026-09-27-loose-end-review.md

@@ -0,0 +1,73 @@
+# Loose-end review — September 27, 2026
+
+Reviewed every unfinished source workplan, terminal/archived task states,
+the empty unread inbox and human-needed Hub records, with current owner sources
+and read-only cluster evidence. No new workplan or task was created. Historical
+`cancelled` task statuses in the superseded baseline are terminal, not open work.
+Retired Hub aliases are not additional source obligations.
+
+## Completed work
+
+- Closed RPF-WP-0027-T05 from the newer NK-WP-0033 operator ruling and attended
+  September 23 receipt. KEY-WP-0011 already records the other credential classes.
+  Predecessor denial remains NOT-PROVEN; the operator accepted the unavailable
+  predecessor's disposition explicitly. Source commits and hashes are in
+  `docs/evidence/2026-09-27-keycape-incident-owner-return.json`. No rotation was
+  repeated. Historical custody routing still needs its complete accepted contract.
+- Implemented the WP-0036-T03 full-primary archive assurance adapter. It requires
+  an ordered, hash-bound transfer/decryption/recovery chain, verified versioned
+  download, full profile, application/database/repository/package proof and cleanup.
+  New primary receipts preserve the archive profile. Undated historical receipts,
+  essentials-only restores, failures and mismatched chains cannot pass. No fresh
+  live archive receipt or recurring cadence is claimed by these fixture tests.
+- Completed WP-0044-T06 repository preparation: all 20 ESO CRDs receive
+  `Prune=false,Delete=false` in the inactive draft. Chart 0.16.1 renders 39 objects;
+  server-side diff contains exactly those 20 annotation additions and no spec
+  changes. Evidence: `docs/evidence/2026-09-27-eso-adoption-preparation.json`.
+- Prepared the concrete phase C retirement sequence under WP-0044-T08 at
+  `docs/argocd-coulombcore-retirement.md`. Live inventory still cannot finish:
+  coulombcore SSH succeeds but Kubernetes returns Unauthorized, including with
+  the explicit host-local k3s kubeconfig. No credential rotation or restart was
+  attempted as a workaround.
+- Corrected the current index, custody incident status and stale assurance
+  documentation. Platform accepts policy-nexus's proposed chart/values ownership
+  split in principle; railiance-apps still must accept and publish its values
+  path/revision. No cross-owner agreement is fabricated.
+
+## Live observations and remaining gates
+
+`docs/evidence/2026-09-27-argocd-loose-end-status.json` records six Applications.
+Openbao-secretstore and target-revenue are Synced/Healthy, with September 21
+healthy transition times; their original observation periods have elapsed.
+Their remaining promotion/owner gates now show `wait` instead of `progress`.
+All 25 ClusterSecretStores are Valid and issue-core-runtime is SecretSynced.
+Activity-core is Synced/Healthy; its required observation cannot end before
+September 28 at 16:06:22 Berlin. Its scoped broker/admission remains separate.
+Bao-notice is Healthy but OutOfSync; this review did not sync unrelated apps.
+
+`docs/evidence/2026-09-27-service-assurance.json` preserves the current observation
+and evaluation: 18 healthy, five missing and one stale signal. The stale receipt
+is the old OpenBao snapshot. Missing signals are platform-pg/platform-pg-2 restore,
+OpenBao restore and offsite upload/restore. The archive adapter is ready for fresh
+reviewed receipts; the existing undated September 6 evidence is not re-dated.
+Transport remains unmonitored. Q2 has a local contract and selected rapp-telemetry
+package; RTEL-WP-0002-T04 still owns actual mapping/delivery/absence acceptance.
+
+All eight unfinished workplans now explicitly say `blocked`; their 23 remaining
+tasks say `wait`. They retain the concrete unblocks in their September 27 entries.
+The open work is dominated by native owner acceptance, protected attended actions,
+fresh recovery evidence, inventory access and the time-bound observation gate.
+No blanket approval request, duplicate task, new schedule, credential read,
+backup expiration, production rollout or owner message was introduced.
+
+## Validation
+
+The repository suite passed 418 tests with one skip before the additional three
+profile-propagation cases. The final focused archive suite passed all 70 tests,
+including those three cases. Admission matches the reviewed baseline; live metadata capture succeeds.
+The assurance evaluator correctly exits nonzero for the disclosed missing/stale
+evidence. ESO render assertions and the exact metadata-only diff passed.
+
+Commit and Repo Manager synchronization receipts are recorded in the session
+close progress event. The generated legacy aliases remain WP-0036-T06's scoped
+projection-owner dependency and are not silently repaired by changing UUIDs.