risk-nexus/docs/rulings/2026-09-22-f0010-closure.md

# Ruling RISK-RULING-2026-09-22-A — RISK-F-0010 closure

Date: 2026-09-22. Graded by risk-nexus. Supersedes the 2026-09-15 silence
default, which does not apply: railiance-platform answered (message
`2caae2ef`, 2026-09-09) and closed RPF-WP-0029-T02 on 2026-09-15 (commit
`6dfb751`).

## Evidence against the closure condition

| Leg | Evidence (railiance-platform) | Class |
|-----|-------------------------------|-------|
| Literal source default removed | `tools/cmd/forgejo-backup` names the variable only in a comment; `lib/railiance-backup-common.sh` returns 1 when the governed token is absent, before the URL template is built. Re-read 2026-09-22 without displaying any value. | Observed source |
| Governed ciphertext upload | `docs/evidence/RPF-WP-0029-secondary-transfer-2026-09-06.json`: upload 201, download 200, matching ciphertext hash, decrypted | Receipt |
| Restore | `docs/evidence/RPF-WP-0029-secondary-restore-2026-09-06.json`: isolated restore, database import, application health, 2040 package blobs verified, cleanup | Receipt |
| Predecessor invalidated | `docs/evidence/2026-09-15-rpf-wp-0029-predecessor-share-invalidated.json`: railiance-platform records the founder's attestation that the personal file-drop share was unshared; no HTTP probe | Owner attestation |

## Decision

**Fixed, `low` retained for the record, embargo lifted, no escalation.**

The invalidation leg rests on attestation rather than a receipt. This register
accepts that: the only independent probe would mean reconstructing the
predecessor credential, which every record here forbids, and the attesting
party is the provider owner with authority over the share. An unshared
file-drop token cannot authorize a write, so the embargo condition
("revoked or invalidated and the literal source default is removed") is met.
The evidence class is stated in the finding. If the share is ever found live,
the finding reopens at its original grade.

## Kept outside this finding

- **Age recovery-key taint.** RPF-WP-0029 says the age-key exposure is still
  open and that rotating the upload token cannot clear it. RISK-F-0010 covered
  only the WebDAV credential, and its report found the age key separate from
  the script. Any age-key exposure is a separate matter. I asked
  railiance-platform whether it should be filed as its own finding; it is not
  folded in here.
- **Secondary-lane quota (10 GiB, about two archives).** This is a retention
  and capacity question for RPF, not an exposure.
- **Discoverability.** RPF asked why its tracking was not found. RISK-WP-0007
  had already reconciled `fix_tracking: RPF-WP-0029-T02`. The 2026-09-01 gap
  came before that task was linked.