Use-case regression gate / usecase-regressions (push) Failing after 6m44s

Details

Record verified historical backup custody repair and operator handoff

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a18e2d-f513-7742-b8e7-12af0b744ff3

2026-10-31 17:43:38 +01:00

6.7 KiB

Raw Blame History

Completed backup evidence custody repair

This is the exact proposed repair for the eight historical metadata exceptions recorded in CSOC-WP-0012-T04. Founder execution and independent postflight are complete, under T15. Do not rerun the seal command.

Proposal: sha256:fa2763d1dcbe92fe638a29c9a7a7d51c03d30849c4232f2d43f81ef705bae611.

State Hub decision 3ec2f98e-9db3-47d9-bc1a-0387f980b81c is resolved from the founder's actual execution at16:36:38Z. Independent read-only verification at 16:37:46Z confirms all eight intended deltas and unchanged hashes, paths, inodes and mtimes. The whole-state custody guard passes at11,259,904bytes. Evidence: backup-completed-evidence-custody-return-2026-10-31.json. operator-handoff-check-2026-10-31.json retains the earlier pre-execution check.

Exact change

Within /var/lib/coulomb-social-backup/, change:

Entries	Before	After
`releases` and the three enumerated historical capsule directories	root:root0755	root:root0700
Completed date operation's `private` directory	10001:10001,0700	root:root0700
Its `result.json`, `journal.json`, `execute.lock`	10001:10001,0600	root:root0600

The complete eight-path list, inode/device/mtime, modes/owners and content or directory-entry hashes are in backup-completed-evidence-custody-preflight-2026-10-31.json. The date operation is47829c7a; the historical releases are5fd7ccd8 and9f1daf6c. No path is moved, file body rewritten, backup removed, application paused or timer activated.

The UID10001 entries were the temporary helper's execution journal. Its source requires that owner while operating. This proposal transfers the completed records to root custody only after exact terminal receipt, absent process/helper, unmounted state and operation-lock checks. It does not generalize the change to other helper directories. The original ownership remains in the repair journal for explicit restoration if an authorized later review requires it.

The strict backup capacity guard is unchanged. Successful execution also runs its existing state-usage/custody check over the entire state tree. This is neither a blanket chmod/chown nor an exception that omits historical data from accounting.

Historical founder terminal command — completed

Retained for provenance; do not run again:

python3 /home/worsch/coulomb-social/scripts/seal-backup-evidence.py \
  --execute --expect-digest sha256:fa2763d1dcbe92fe638a29c9a7a7d51c03d30849c4232f2d43f81ef705bae611

At the prompt, enter:

SEAL sha256:fa2763d1dcbe92fe638a29c9a7a7d51c03d30849c4232f2d43f81ef705bae611

Recorded status: completed_evidence_private_root_custody_verified, eight entries verified and postflight.whole_state_custody_guard_passed: true. Independent readback is complete. The private durable receipt is:

/var/lib/coulomb-social-backup-custody/fa2763d1dcbe92fe638a29c9a7a7d51c03d30849c4232f2d43f81ef705bae611/receipt.json.

The supervision decision requires: “The supervisor approves that proposal or performs it through the privileged execution path.” This is a new, exact historical ownership/mode change; it is not covered by approval of an SMTP recipient or recurring schedule. The entry point requires the founder terminal and exact digest. No new credential grant is requested.

Offline review uses the same command without flags. Read-only native preflight uses --preflight. Any source, capacity-guard, metadata or receipt change changes the proposal or refuses the preflight; do not bypass a changed digest.

Verification, interruption and rollback

The operation takes the date supervisor, backup, snapshot and helper execute locks without replacing/truncating them. It verifies the pinned cluster, inactive timers, three unchanged terminal receipts and absent historical PIDs. It refuses the original helper by name/UID or any pod hostPath overlapping the state tree. All eight fingerprints are checked before mutation. Each metadata change is journaled and fsynced before descriptor-based chown/chmod. Symlink ancestors, hardlinks, changed bytes/children, replaced inodes and unknown paths refuse.

Afterward, all eight complete fingerprints must match the expected ownership/ mode changes with unchanged hashes, sizes, paths, device/inodes and mtimes. Native process/helper/timer checks repeat and the unchanged whole-state custody guard must pass before success is recorded. Receipts contain metadata/hashes, not historical journal bodies. The new repair journal is private and outside the backup state tree so it cannot alter the reviewed historical directory listings.

On lost connection or failure, inspect the retained receipt and native process state first. A partially completed seal is not replayed: the attempt directory refuses another installation. The explicit rollback entry point is the same command with --rollback instead of --execute, and confirmation ROLLBACK <same-full-digest>. It restores only the recorded original metadata, after the same terminal/inactive/lock checks, and refuses content or inode drift. Earlier receipts remain nested in the rollback journal. Returning the old metadata also restores the original capacity-guard refusal; rollback is not backup readiness.

Cost: no new service, storage purchase, provider request or runtime allocation; existing-node execution and operator time are unpriced. Risk is loss of the retired helper UID's access if its supposedly completed operation were still needed. Terminal/helper/lock checks and explicit metadata rollback bound that risk; production file content and database writes are not part of this operation.

Evidence and remaining scope

Native metadata/fence observation and the final read-only preflight pass. The validation companion backup-completed-evidence-custody-validation-2026-10-31.json records509 passing full-gate tests, zero failures/errors/skips and source hashes. Nineteen dedicated cases exercise real metadata/lock IO, preserved bytes/paths, explicit/partial rollback, interference refusal, source/digest boundaries, nonterminal refusal, and native receipt/process/helper/mount/cluster/timer guards.

The verified attended execution resolves the historical custody mismatch. T04 still owns retention/capacity admission and historical-copy disposition. Preventing future release/date producers from reintroducing these metadata mismatches is also required before recurring service acceptance. That source correction is now completed under T13/RAPPS-WP-0015-T06; it does not repair the historical entries listed here or change frozen capsules. T07 still needs the existing route execution; T08 then needs inactive installation and independent readback. No native backup-operation or migration acceptance is inferred from this repair.

6.7 KiB Raw Blame History