Prepare independent ledger backup and isolated no-send recovery

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a11538-05ea-7b63-b3c7-a2df5f38898d

workplans/EMAIL-WP-0007-ledger-backup-recovery.md

@@ -0,0 +1,109 @@
+---
+id: EMAIL-WP-0007
+type: workplan
+title: "Back up and recover the transactional delivery ledger"
+domain: infotech
+repo: email-connect
+status: active
+owner: codex
+topic_slug: email-connect
+created: "2026-10-07"
+updated: "2026-10-08"
+origin: residual
+origin_ref: EMAIL-WP-0006
+---
+
+CSOC-WP-0010-T04/T05 request durable recovery of the SQLite delivery/challenge
+ledger independently of Coulomb's metadata/content pair. EMAIL-WP-0006 completed
+the verification retry release; its temporary private pre-release copies are not
+a recurring backup. This work does not change SMTP/caller custody or send mail.
+
+## T01 — Implement coherent ledger capture and verified publication
+
+```task
+id: EMAIL-WP-0007-T01
+status: done
+priority: high
+```
+
+Prepare a default-dry-run node capture, pinned to the current cluster/image/PVC.
+Quiesce the single receiver, use SQLite's backup API against the read-only PVC,
+verify integrity/all five transactional tables and resume the unchanged receiver
+in finally. Lock overlap and preserve private failure evidence. Package SQLite
+and its capture receipt only, age-encrypt once, publish through platform's
+immutable email-connect archive profile, and require version/hash readback before
+advancing success. Reviewed retries reuse ciphertext without another pause.
+No SMTP password, ingest token, scanner mailbox or provider message body belongs
+in this archive. Tests use only synthetic records and no production endpoints.
+
+## T02 — Prove isolated recovery preserves delivery and challenge state
+
+```task
+id: EMAIL-WP-0007-T02
+status: done
+priority: high
+```
+
+Add attended guarded decrypt/unpack and all-table/schema/row fingerprint checks.
+Exercise current packaged service under UID10001/network-disabled conditions
+with synthetic recovered SQLite. Accepted sends/verifications replay without a
+provider call; unknown outcomes remain blocked; suppression and consumed/cancelled
+links remain effective. A historical snapshot can lose newer reservations or
+revive a handle consumed after capture: production recovery must freeze delivery,
+reconcile post-capture operations/issuer state and explicitly invalidate/reconcile
+challenges before releasing traffic. Never auto-restore into a running service.
+
+## T03 — Admit the independent primary caller and retention custody
+
+```task
+id: EMAIL-WP-0007-T03
+status: wait
+priority: high
+needs_human: true
+intervention_note: "Platform must admit the separate email-connect archive prefix, caller delivery, retention/capacity, independently retained receipts and recovery escrow; shared uploader support alone is not custody admission."
+```
+
+Platform profile: platform-pg/application-archives/email-connect/ in the current
+Scaleway primary bucket. Request a separately scoped caller; do not copy another
+workload's Secret or inherit its write/delete authority. Worker has only public
+age recipient, no escrow identity or retained-object deletion rights. Bind the
+platform hash-locked SDK runtime and separate recovery/retention owner. RPF-WP-0053-T05
+tracks admission; founder continuation authorizes source preparation, not an
+invented owner review or credential grant.
+
+## T04 — Complete the admitted first run, recovery and monitoring
+
+```task
+id: EMAIL-WP-0007-T04
+status: wait
+priority: high
+needs_human: true
+intervention_note: "Needs T03 admission and the exact first receiver pause/upload/schedule decision; real offsite retrieval, attended recovery and failure reception remain unproved."
+```
+
+Present pinned source hashes, dry-run evidence, coherent ledger scope, bounded
+pause and rollback/resume protocol before exact activation. First capture must
+resume current service before encryption/upload. Independently retrieve/decrypt
+with escrow and validate all rows/schema and no-send recovery behavior. Record
+RPO/RTO and retained recovery point, then admit schedule and monitored failure
+response. Temporary private release copies retain their existing custody until
+the owner explicitly disposes of them; no expiry is implied here.
+
+## Implementation evidence — 2026-10-08
+
+Standalone scripts/capture-ledger.py, ledger_archive.py, backup-ledger.py and
+rehearse-ledger.py plus four disabled unit candidates implement T01/T02. Full
+email suite 120 passed with the local GreenMail harness, zero skips, including 19
+new synthetic ledger cases. Actual age roundtrip and pinned receiver-image
+rehearsal under UID10001/network none preserve all five tables/schema/rows and
+verify accepted/unknown reservation and consumed/cancelled/suppression behavior
+without provider calls. Isolated rehearsal is not live recovery acceptance.
+
+Node server dry-run verifies current cluster/image/PVC, no-egress/no-secret helper
+and replica-only guarded pause projection; receiver remains unchanged, no helper
+created. All four units verify. Metadata-only check: email primary.env absent;
+no credentials fetched/copied, live pause/capture/provider upload, deploy or timer
+activation. Complete review: docs/ledger-backup-review-2026-10-08.md. Platform
+admission handoff RPF-WP-0053-T05 is a live record, not an owner approval. T03/T04
+remain wait for custody, retention/capacity, actual offsite/recovery and monitoring
+plus the incident post-capture reconciliation gate. The workplan remains active.