coulomb-social/workplans/CSOC-WP-0012-durable-recovery-service-readiness.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	origin	origin_ref	state_hub_workstream_id
CSOC-WP-0012	workplan	Durable app recovery and service readiness	communication	coulomb-social	active	codex	coulomb-social	2026-10-08	2026-10-28	residual	CSOC-WP-0008	0cd1f513-f26e-5707-b646-8b4bbe6369fc

Residual acceptance from CSOC-WP-0008, split at the user's request. Existing implementation/release/acceptance evidence remains in the originating workplan; these tasks own the remaining concrete outputs. Source checks never grant runtime or productive acceptance.

T01 — Admit independent offsite custody and retention

id: CSOC-WP-0012-T01
status: progress
priority: high
needs_human: false
state_hub_task_id: "dc470337-585f-517d-b2a5-92e89a7dbec8"

Use existing RPF-WP-0053-T02/T03/T06 credential-pair/prefix/escrow admission. Own the coulomb-social consumer acceptance, not another credential provisioning lane. Record capacity, retained independent retrieval receipts, RPO/RTO and expiry of temporary production-pair copies; no secrets in records.

2026-10-27: User approved the scoped node executor/delivery (decision 9557e2b8-2b37-5b94-a5e6-e5fe08d0351e). Native own-reader/version/revocation, five reader denials, wrong-account/audience denials, own multipart create/abort, and sibling/native-prefix/delete/bucket-policy/IAM denials pass. The exact hash-pinned helper delivered only this application's version-2 pair to root:root 0600 under a 0700 parent, with equal readback and revoked token. No completed object or timer created. Proofs: docs/release/backup-boundaries-2026-10-27.json and backup-delivery-2026-10-27.json. Independent recovery/receipt custody, retention/capacity and first paired recovery remain open.

2026-10-27 supplement: native DeleteObjectVersion also denies403 on a unique never-published probe key; no retained object touched. Wrong-namespace login with the same ServiceAccount name also denies403, no data or sibling credential read. Receipts: docs/release/backup-version-delete-boundary-2026-10-27.json and backup-wrong-namespace-boundary-2026-10-27.json.

2026-10-28: Prepared docs/release/recovery-custody-review-2026-10-28.md for the additional independent custody boundary: dedicated Coulomb age identity, separate prefix-read-only recovery caller, platform-root recovery/failure owner, protected off-node/workstation kit and last recovered point, and explicit rolling retention/headroom compatibility. Requested that additional admission, without reopening the existing publisher/executor or schedule approval. No recovery key, grant, kit location, capture, timer or lifecycle created while it is pending.

T02 — Activate and prove the first encrypted paired recovery point

id: CSOC-WP-0012-T02
status: todo
priority: high
state_hub_task_id: "25ae6330-d26f-54ee-a599-2eca3a2e274d"

After admission, run scripts/paired-backup.py consumer, retrieve the exact immutable version independently, decrypt privately and rehearse application recovery with content/hash/membership/denied-read checks. Reconcile post-capture writes before any production restore. Do not call local temporary copies offsite coverage.

T03 — Establish scheduled backup, monitoring and service evidence

id: CSOC-WP-0012-T03
status: todo
priority: high
state_hub_task_id: "ded6fc1d-0819-57c5-9213-e64db76bc6ed"

Enable reviewed backup/freshness units only after the exact first-run return. Verify failed-run/pending retry, stale alert, recovery runbook, observed restore time, cost attribution, SLO and business-app service-contract evidence. Reconcile the existing CSOC-IN-0004 stage-1 live-smoke and deployment receipts with docs/identity/smoke.md before closing that intake. Current revision16 and persistent CONTENT_ROOT are already deployed. Keep apex/Bubble retirement in WP-0014.

2026-10-27: Read-only node check confirms the Coulomb primary credential file is absent; current reader CCR retains false node/provider/boundary admission flags. No backup activation performed. Added requirement-by-requirement service contract §§1–6 assessment in docs/release/service-contract-conformance-2026-10-27.md; conformance remains unproven, including full-client offboarding versus personal export, current finance join and ops registration. The older August recovery assumptions are historical; founder-approved paired schedule already exists in RPF-WP-0053 and does not need repeat schedule approval. Current findings and next returns: docs/release/acceptance-audit-2026-10-27.md.

Completion

Finish when every task above has its stated evidence and acceptance, or hand off any newly discovered residual to a live work record first. Cross-owner dependencies remain their existing canonical records.