Record that both backup publisher slots are at version 2.

The placeholders are gone. The bucket policy still names only the original backup application.

Assistant: grok
Assistant-Session: 01a11cdb-f9fe-7011-947c-936e72007e54

scripts/verify-backup-pair-versions.py

@@ -0,0 +1,59 @@
+#!/usr/bin/env python3
+"""Confirm backup-primary version 2 replaced the placeholder. No key material."""
+
+from __future__ import annotations
+
+import json
+import subprocess
+from pathlib import Path
+
+RECEIPT = Path("/home/worsch/.local/state/railiance/receipts/backup-pair-version2.json")
+PATHS = {
+    "coulomb-social": "platform/workloads/coulomb-social/backup-primary",
+    "email-connect": "platform/workloads/email-connect/backup-primary",
+}
+FIELDS = ("AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY")
+
+
+def kv(path):
+    proc = subprocess.run(["bao", "kv", "get", "-format=json", path], capture_output=True)
+    if proc.returncode:
+        raise SystemExit(61)
+    return json.loads(proc.stdout)["data"]["data"]
+
+
+def main():
+    loaded = {name: kv(path) for name, path in PATHS.items()}
+    rows = []
+    access_keys = []
+    for name, values in loaded.items():
+        row = {"application": name, "fields": sorted(values)}
+        for field in FIELDS:
+            value = values.get(field)
+            row[field] = {
+                "present": isinstance(value, str) and bool(value),
+                "pending": value == "PENDING",
+                "length": len(value) if isinstance(value, str) else 0,
+            }
+        access_keys.append(values.get("AWS_ACCESS_KEY_ID"))
+        rows.append(row)
+    receipt = {
+        "applications": rows,
+        "access_keys_differ": access_keys[0] != access_keys[1],
+        "secrets_differ": (
+            loaded["coulomb-social"].get("AWS_SECRET_ACCESS_KEY")
+            != loaded["email-connect"].get("AWS_SECRET_ACCESS_KEY")
+        ),
+    }
+    RECEIPT.parent.mkdir(mode=0o700, exist_ok=True)
+    RECEIPT.write_text(json.dumps(receipt, indent=2) + "\n")
+    RECEIPT.chmod(0o600)
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except SystemExit:
+        raise
+    except Exception:
+        raise SystemExit(62) from None

workplans/RPF-WP-0053-coulomb-paired-backup-admission.md

@@ -230,9 +230,9 @@ remain open; no credentials delivered, productive capture/upload or timer enable
 intended writer policy is `backup-pair-writer` and The founder admitted this writer on 2026-10-08, using the words
 "bucket-pair-writer". The policy name remains `backup-pair-writer`
 (`openbao/policies/backup-pair-writer.hcl`). The installed policy matches
-that file, and `WRITER_ADMITTED` is true. Both backup-primary KV paths were absent. Version 1 now exists on each
+that file, and `WRITER_ADMITTED` is true. Both backup-primary KV paths were absent. Version 2 is current on each path. Both pairs replaced the placeholder and
-path, with both field names set to a non-credential placeholder. The founder
+differ from each other. The values were not read out. The bucket policy still
-will write the real pairs as a new UI version. The bootstrap key cannot list
+has only the original three statements, so these keys cannot publish yet. The bootstrap key cannot list
 IAM applications (403). The live bucket
 policy still names only application ee80333e-5bab-4a04-85a9-5bdb46b7b3c1 on
 `platform-pg/*`. No publisher key was created. T05 stays wait for the two