fix: recover expired AWS initial publication

cmd/relay/coordinator_credentials.go

@@ -20,6 +20,10 @@ func sameProfileExceptCredentials(a, b guidedProfile) bool {
 // Rotate only credential references, never images, release pins, identities or
 // ceremony bindings. Preserve the previous profile and all operation attempts.
 func (w *coordinatorWizard) refreshWorkflowCredentials(dir string, p guidedProfile) error {
+	return w.refreshWorkflowCredentialsExcept(dir, p, "")
+}
+
+func (w *coordinatorWizard) refreshWorkflowCredentialsExcept(dir string, p guidedProfile, allowedAttemptID string) error {
 	next := p
 	next.Credentials, next.R2Parent, next.R2Control = w.d.Credentials, w.d.R2Parent, w.d.R2Control
 	needsRefresh := !reflect.DeepEqual(next, p)
@@ -58,6 +62,9 @@ func (w *coordinatorWizard) refreshWorkflowCredentials(dir string, p guidedProfi
 		}
 		for _, a := range latest {
 			if a.Status == "running" || a.Status == "failed" {
+				if allowedAttemptID != "" && a.ID == allowedAttemptID && a.RecoveryClass == recoveryPublication {
+					continue
+				}
 				return errCredentialsNeedRecovery
 			}
 		}

cmd/relay/docker_roles.go

@@ -18,6 +18,7 @@ import (
 type dockerRoleOptions struct {
 	role, image, platform, work, trust, keys, credentials, config, docker string
 	r2Parent, r2Control                                                   string
+	recoveryContext                                                       string
 }
 
 var roleImagePattern = regexp.MustCompile(`^(sha256:[0-9a-f]{64}|[^\s@]+@sha256:[0-9a-f]{64})$`)
@@ -161,7 +162,7 @@ func dockerRoleArgs(o dockerRoleOptions, command []string, uid, gid int) ([]stri
 		return nil, errors.New("upload stations must not receive signing keys")
 	}
 	var sources []string
-	for _, source := range []string{o.work, o.trust, o.keys, o.credentials, o.r2Parent, o.r2Control} {
+	for _, source := range []string{o.work, o.trust, o.keys, o.credentials, o.r2Parent, o.r2Control, o.recoveryContext} {
 		if source == "" {
 			continue
 		}
@@ -188,6 +189,7 @@ func dockerRoleArgs(o dockerRoleOptions, command []string, uid, gid int) ([]stri
 	}{
 		{o.work, "/work", false, false}, {o.trust, "/trust", true, false}, {o.keys, "/keys", true, false}, {o.credentials, "/credentials/aws", true, true},
 		{o.r2Parent, "/credentials/r2-parent", true, true}, {o.r2Control, "/credentials/r2-control", true, true},
+		{o.recoveryContext, "/recovery", true, false},
 	} {
 		if mount.source == "" && mount.target != "/work" {
 			continue

cmd/relay/main.go

@@ -88,6 +88,7 @@ func usage() {
   relay ceremony open NAME --role ROLE [--grant FILE] [--resume-candidate DIR]
   relay ceremony open NAME --role ROLE --action ACTION [-- TOOL ARGS...]
   relay ceremony guide NAME --role ROLE
+  relay ceremony recover-publication NAME [--settings-root DIR]
   relay ceremony prepare --name NAME --role ROLE --release RELEASE --work DIR --trust DIR --keys DIR
   relay role --role ROLE --image DIGEST --work DIR [mount flags] -- TOOL ARGS...
   relay coordinator configure-storage [provider and ceremony flags] --out FILE
@@ -176,6 +177,8 @@ func runCoordinator(args []string) error {
 		return runEvidenceInbox(args[1:])
 	case "publish":
 		return runPublish(args[1:])
+	case "recover-initial-1828":
+		return runRecoverInitial1828(args[1:])
 	default:
 		return fmt.Errorf("unknown coordinator command %q", args[0])
 	}
@@ -253,6 +256,8 @@ func runCeremony(args []string) error {
 		return runRolePrepare(args[1:])
 	case "guide":
 		return runRoleFlow(args[1:])
+	case "recover-publication":
+		return runLegacyPublicationRecovery(args[1:])
 	case "setup":
 		return runGuidedSetup(args[1:])
 	case "open":