# RPF-WP-0015 attended windows — founder checklist

Procedures approved by all owners on 2026-10-14 against review contract
`1c08ba7ae064eddde89cdc15d36f0e1c1c372e1ba5c00f09f4b665409aa337a7`
(railiance-platform `8cfbf64`). Approval covers the procedures only. Each window
below still needs its own explicit founder GO; D5 (`2fd5849c`) authorizes the
exercise class, not a specific window. The runbooks are authoritative; this page
only orders the human steps.

## Before either window

| # | Item | Owner | State 2026-10-14 |
|---|------|-------|------------------|
| 1 | Push ops-warden `6e14300` (login output fail-closed fix, accepted in `reviews/RPF-WP-0017-ops-warden-reacceptance-2026-10-14.json`), then `uv tool install --reinstall /home/worsch/ops-warden` from that clean checkout | founder go, then agent | committed locally, not pushed |
| 2 | Value-safe retrospective of WARDEN-WP-0036-T02 (2026-09-01 live op ran while the relaxed check was in source) | ops-warden / railiance-platform | open |

## T02 — database lease recovery (≤15 min window)

Runbook: `docs/audit-core-database-lease-recovery.md`.

1. Pick a window that is not within 20 min of 03:17 UTC (attest-chain CronJob).
2. Fill an approval receipt from `docs/audit-core-database-lease-approval.example.json`:
   approval id, window start/end, named abort operator, owner acknowledgement
   message ids (audit-core, rapp-postgres, railiance-platform), synthetic load
   `RAILIANCE-WP-0024-T02-SYNTHETIC-01` with driver revision
   `sha256:941ba251…` (audit-core `8c8bcf4`), and the `synthetic_sender` block.
3. Announce two short audit-core restart gaps (projection and cleanup).
4. In the window: one contained ops-warden login runs the whole sequence —
   `make audit-t02-attended-window` (approval receipt, driver path, confirm
   string, bearer file and evidence dir outside Git). Through
   `scripts/openbao-attended-exec.py` it runs lane project (restart #1) →
   ssh-bounded port-forward → contained T02 exercise → 0600 evidence JSON →
   lane cleanup with that evidence (restart #2). No token file is used.
5. Abort: the window script stops the port-forward and runs `cleanup --abort-reason`
   itself; if it could not, run `make audit-synthetic-sender-cleanup
   AUDIT_SYNTHETIC_SENDER_ABORT_REASON=...` (one more login). Never restart the pod by hand.

## T03 — coordinated railiance01 reboot

Runbook: `docs/railiance01-coordinated-reboot.md`. Additional gates before the window:

| # | Item | Owner |
|---|------|-------|
| 1 | Prove provider console / rescue / hard-reset access and file a `RAIL01-CONSOLE-<ts>` receipt (railiance-infra `docs/railiance01-console-access.md`, RAIL-HO-WP-0011-T09). Today no out-of-band console is established. | founder |
| 2 | Remove the stuck PVC `platform-pg-drill/platform-pg-drill-1` (pvc-protection finalizer) in a separately approved attended step, or keep it explicitly listed | rapp-postgres + founder go |
| 3 | Fresh backup or written waiver for `state-hub-db`, `user-engine-pg`, `net-kingdom-pg`, `target-revenue-pg` (no CNPG backup configured) | each DB owner |
| 4 | New scenario id and fresh human decision (08-23 decisions/scenario are consumed) | founder |
| 5 | Fresh encrypted off-host OpenBao snapshot receipt (≤24 h) | platform custody, attended |
| 6 | 2-of-3 Shamir unseal holders present; named abort operator; railiance-infra abort-owner ack | founder |
| 7 | Pre-reboot preflight run to capture the evidence file (boot id, failing-pod baseline, CNPG identities) | agent |

Stop immediately, self-revoke and never retry on any unexpected credential output
from the attended login.