# Loose-end review — September 27, 2026

Reviewed every unfinished source workplan, terminal/archived task states,
the empty unread inbox and human-needed Hub records, with current owner sources
and read-only cluster evidence. No new workplan or task was created. Historical
`cancelled` task statuses in the superseded baseline are terminal, not open work.
Retired Hub aliases are not additional source obligations.

## Completed work

- Closed RPF-WP-0027-T05 from the newer NK-WP-0033 operator ruling and attended
  September 23 receipt. KEY-WP-0011 already records the other credential classes.
  Predecessor denial remains NOT-PROVEN; the operator accepted the unavailable
  predecessor's disposition explicitly. Source commits and hashes are in
  `docs/evidence/2026-09-27-keycape-incident-owner-return.json`. No rotation was
  repeated. Historical custody routing still needs its complete accepted contract.
- Implemented the WP-0036-T03 full-primary archive assurance adapter. It requires
  an ordered, hash-bound transfer/decryption/recovery chain, verified versioned
  download, full profile, application/database/repository/package proof and cleanup.
  New primary receipts preserve the archive profile. Undated historical receipts,
  essentials-only restores, failures and mismatched chains cannot pass. No fresh
  live archive receipt or recurring cadence is claimed by these fixture tests.
- Completed WP-0044-T06 repository preparation: all 20 ESO CRDs receive
  `Prune=false,Delete=false` in the inactive draft. Chart 0.16.1 renders 39 objects;
  server-side diff contains exactly those 20 annotation additions and no spec
  changes. Evidence: `docs/evidence/2026-09-27-eso-adoption-preparation.json`.
- Prepared the concrete phase C retirement sequence under WP-0044-T08 at
  `docs/argocd-coulombcore-retirement.md`. Live inventory still cannot finish:
  coulombcore SSH succeeds but Kubernetes returns Unauthorized, including with
  the explicit host-local k3s kubeconfig. No credential rotation or restart was
  attempted as a workaround.
- Corrected the current index, custody incident status and stale assurance
  documentation. Platform accepts policy-nexus's proposed chart/values ownership
  split in principle; railiance-apps still must accept and publish its values
  path/revision. No cross-owner agreement is fabricated.

## Live observations and remaining gates

`docs/evidence/2026-09-27-argocd-loose-end-status.json` records six Applications.
Openbao-secretstore and target-revenue are Synced/Healthy, with September 21
healthy transition times; their original observation periods have elapsed.
Their remaining promotion/owner gates now show `wait` instead of `progress`.
All 25 ClusterSecretStores are Valid and issue-core-runtime is SecretSynced.
Activity-core is Synced/Healthy; its required observation cannot end before
September 28 at 16:06:22 Berlin. Its scoped broker/admission remains separate.
Bao-notice is Healthy but OutOfSync; this review did not sync unrelated apps.

`docs/evidence/2026-09-27-service-assurance.json` preserves the current observation
and evaluation: 18 healthy, five missing and one stale signal. The stale receipt
is the old OpenBao snapshot. Missing signals are platform-pg/platform-pg-2 restore,
OpenBao restore and offsite upload/restore. The archive adapter is ready for fresh
reviewed receipts; the existing undated September 6 evidence is not re-dated.
Transport remains unmonitored. Q2 has a local contract and selected rapp-telemetry
package; RTEL-WP-0002-T04 still owns actual mapping/delivery/absence acceptance.

All eight unfinished workplans now explicitly say `blocked`; their 23 remaining
tasks say `wait`. They retain the concrete unblocks in their September 27 entries.
The open work is dominated by native owner acceptance, protected attended actions,
fresh recovery evidence, inventory access and the time-bound observation gate.
No blanket approval request, duplicate task, new schedule, credential read,
backup expiration, production rollout or owner message was introduced.

## Validation

The repository suite passed 418 tests with one skip before the additional three
profile-propagation cases. The final focused archive suite passed all 70 tests,
including those three cases. Admission matches the reviewed baseline; live metadata capture succeeds.
The assurance evaluator correctly exits nonzero for the disclosed missing/stale
evidence. ESO render assertions and the exact metadata-only diff passed.

Commit and Repo Manager synchronization receipts are recorded in the session
close progress event. The generated legacy aliases remain WP-0036-T06's scoped
projection-owner dependency and are not silently repaired by changing UUIDs.