Record WP0027 platform snapshot receipt

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa

reviews/WARDEN-WP-0027-T02-DRILL-20260822-01-openbao-snapshot-receipt.json

@@ -0,0 +1,22 @@
+{
+  "receipt_version": 1,
+  "receipt_id": "WARDEN-WP-0027-T02-DRILL-20260822-01-SNAPSHOT-20260822T222921Z",
+  "created_at": "2026-08-22T22:29:21Z",
+  "operator": "railiance-platform",
+  "source_cluster": "railiance01",
+  "source_namespace": "openbao",
+  "source_pod": "openbao-0",
+  "cluster_id": "fd28df5d-98ec-57dd-42ec-9b3e4f4e53bf",
+  "raft_applied_index": 677310,
+  "snapshot_created": true,
+  "source_initialized": true,
+  "source_unsealed": true,
+  "snapshot_sha256": "sha256:5c54919dd76fed730f7285172c898f9407bfefd20debc00f795ba263230eb7f9",
+  "snapshot_encrypted": true,
+  "encrypted_snapshot_sha256": "sha256:9ddf6e2c3c0e68c15c70540d1beb9d2d0360098af4c3b27ee1dba65c9323831f",
+  "encrypted_location_ref": "offhost-custody:WARDEN-WP-0027-T02-DRILL-20260822-01:20260822T222951Z",
+  "encrypted_copy_off_host": true,
+  "encryption_verified": true,
+  "hash_verified": true,
+  "no_secret_material_recorded": true
+}

reviews/WARDEN-WP-0027-T02-DRILL-20260822-01-railiance-platform-approval.json

@@ -0,0 +1,46 @@
+{
+  "owner_id": "railiance-platform",
+  "actor": "railiance-platform",
+  "disposition": "approve",
+  "contract_digest": "58d367462bb757457588eefa3f53e72b94987814d7a936297f9b371ebedb9c38",
+  "artifact_hashes": {
+    "docs/evidence/WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md": "ffa69764ad391db633f57ac70444e5781eee698bf9e362dfef31614fa43152dc",
+    "docs/evidence/WARDEN-WP-0027-T02-drill-preparation-checklist-2026-08-22.md": "5462b69104d31849cd73c308bb092c16e1a38b7d7e0a48c492a87e8207fdd3fa"
+  },
+  "assertion_ids": [
+    "scenario-decision-and-expiry-bound",
+    "current-snapshot-receipt-valid",
+    "platform-driver-role-accepted",
+    "exact-live-scope-reviewed",
+    "metadata-only-evidence",
+    "execution-not-authorized"
+  ],
+  "checks": [
+    {
+      "id": "scenario-artifact-sha256",
+      "passed": true,
+      "read_only": true
+    },
+    {
+      "id": "preparation-checklist-sha256",
+      "passed": true,
+      "read_only": true
+    },
+    {
+      "id": "openbao-snapshot-receipt-validator",
+      "passed": true,
+      "read_only": true
+    },
+    {
+      "id": "platform-driver-scope-review",
+      "passed": true,
+      "read_only": true
+    },
+    {
+      "id": "metadata-only-boundary",
+      "passed": true,
+      "read_only": true
+    }
+  ],
+  "note": "Fresh age-encrypted OpenBao Raft snapshot receipt reviews/WARDEN-WP-0027-T02-DRILL-20260822-01-openbao-snapshot-receipt.json passed the platform validator against the live cluster identity and applied index. The encrypted copy is off-host and local snapshot files were securely deleted after verification. railiance-platform accepts the attended snapshot, exact one-seal/2-of-3-unseal driver, and value-safe post-unseal verification role. This preparation receipt authorizes no seal, unseal, restore, reboot, policy change, or other live execution."
+}

workplans/RAILIANCE-WP-0024-audit-core-custody-and-recovery-coordination.md

@@ -231,6 +231,20 @@ waits on procedure review. Its remaining gates are the approved outage window,
 fresh encrypted off-host OpenBao snapshot receipt, provider-console access,
 2-of-3 Shamir quorum, and named abort operator.
 
+**WP0027 preparation gate (2026-08-23):** under preparation-only scenario
+`WARDEN-WP-0027-T02-DRILL-20260822-01`, platform-admin OIDC/MFA created a
+fresh Raft snapshot, encrypted it to the established age recovery recipient,
+verified a decrypt stream against the plaintext digest, and uploaded only the
+ciphertext through the approved write-only off-host lane. The platform
+validator accepted metadata receipt
+`reviews/WARDEN-WP-0027-T02-DRILL-20260822-01-openbao-snapshot-receipt.json`
+against the live cluster id and a possible applied index; automated recovery
+checks remained green and no secret value was observed. Both local snapshot
+files were securely deleted. The platform accepts the exact attended driver
+role, but this receipt authorizes no seal, unseal, restore, reboot, or other
+live execution; the final scenario still requires the independent quorum gate,
+fully parameterized green preflight, and an exact human GO.
+
 ## T04 — Route the contracts and approval gates
 
 ```task