5ef016be01
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
1.5 KiB
WP-0029 continuation: provider gate and transport containment
The user authorized continuing with backup credential invalidation and recovery. Routing and CCR-2026-0004 identify a Nextcloud file-drop lane plus age recovery escrow. No provider share-management authority or replacement custody reference was supplied. Requested only owner/account and custody coordinates, not values.
Found and fixed credential transport defects in the retained backup helper: curl argv previously contained the upload credential and credential-bearing URL; the Python fallback could print them through an exception traceback. Curl now receives escaped config on stdin with curlrc disabled, both paths require HTTPS, redirects/non-success responses fail, and backend diagnostics are contained. The Python fallback streams artifact bytes. Added tests using synthetic markers.
Prepared docs/backup-credential-recovery.md: provider invalidation, CAS-safe
replacement preserving age escrow, activity-core delivery, encrypted upload,
separate owner download, and isolated offsite restore acceptance. The legacy
infra drill's missing-file fallback makes a fresh production dump; a downloaded
artifact must be proven present before it can qualify as offsite recovery.
No provider change, credential read/provisioning, upload or restore was performed. The attempted metadata-only taint query lacked caller authentication. Historical CCR recovery-key exposure remains recorded; no current taint state or rotation is inferred. T02 remains waiting on the provider inputs and live proof.