diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 3be3c9f..5508883 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -14,6 +14,7 @@ | workplan | EMAIL-WP-0004 | finished | — | workplans/EMAIL-WP-0004-transactional-mail-delivery-service.md | | workplan | EMAIL-WP-0005 | finished | — | workplans/EMAIL-WP-0005-test-mailbox-harness.md | | workplan | EMAIL-WP-0006 | finished | — | workplans/EMAIL-WP-0006-verification-retry-safety.md | +| workplan | EMAIL-WP-0007 | active | — | workplans/EMAIL-WP-0007-ledger-backup-recovery.md | | task | EMAIL-WP-0001-T01 | done | — | workplans/EMAIL-WP-0001-repo-onboarding.md | | task | EMAIL-WP-0001-T02 | done | — | workplans/EMAIL-WP-0001-repo-onboarding.md | | task | EMAIL-WP-0001-T03 | done | — | workplans/EMAIL-WP-0001-repo-onboarding.md | @@ -51,3 +52,7 @@ | task | EMAIL-WP-0006-T02 | done | — | workplans/EMAIL-WP-0006-verification-retry-safety.md | | task | EMAIL-WP-0006-T03 | done | — | workplans/EMAIL-WP-0006-verification-retry-safety.md | | task | EMAIL-WP-0006-T04 | done | — | workplans/EMAIL-WP-0006-verification-retry-safety.md | +| task | EMAIL-WP-0007-T01 | done | — | workplans/EMAIL-WP-0007-ledger-backup-recovery.md | +| task | EMAIL-WP-0007-T02 | done | — | workplans/EMAIL-WP-0007-ledger-backup-recovery.md | +| task | EMAIL-WP-0007-T03 | wait | — | workplans/EMAIL-WP-0007-ledger-backup-recovery.md | +| task | EMAIL-WP-0007-T04 | wait | — | workplans/EMAIL-WP-0007-ledger-backup-recovery.md | diff --git a/docs/ledger-backup-rehearsal-2026-10-08.json b/docs/ledger-backup-rehearsal-2026-10-08.json new file mode 100644 index 0000000..54ff0cd --- /dev/null +++ b/docs/ledger-backup-rehearsal-2026-10-08.json @@ -0,0 +1,43 @@ +{ + "scope": "synthetic_local_archive", + "provider_contacted": false, + "production_data": false, + "status": "application_restored_verified", + "network": "disabled", + "uid": 10001, + "checks": { + "accepted_verifications": 3, + "unknown_verifications": 1, + "invalidated_handles": 2, + "suppressions": 1, + "accepted_deliveries": 1, + "unknown_sends": 1 + }, + "table_count": 5, + "rows_unchanged": true, + "schema_unchanged": true, + "mail_sent": false, + "elapsed_seconds": 0.86, + "evidence_boundary": "synthetic_local_archive", + "full_repository_tests": { + "passed": 120, + "skipped": 0, + "local_greenmail_harness": true + }, + "node_preflight": { + "server_dry_run": true, + "live_changes": false, + "receiver_spec_changed": false, + "image_pinned": true, + "pvc_read_only": true, + "helper_egress_denied": true + }, + "backup_caller_custody_file_present": false, + "live_backup_activated": false, + "source_sha256": { + "capture-ledger.py": "0d643b2fc031279e414b856ed4a29c293603aeedf142035e7cab739ed3e8061d", + "ledger_archive.py": "81e66bd0ca94a4d5a800d9f0f23989d3060877d2f30de867f69baebab773a3a9", + "backup-ledger.py": "8a89aa01c0c22e46352f1ad7a6f30b9b5db792639c1acc9a60579f50b7c8c369", + "rehearse-ledger.py": "e1063705233175d02703a4d117bee6d2d69dc5bb19edbda446cc160d3188ad9f" + } +} diff --git a/docs/ledger-backup-review-2026-10-08.md b/docs/ledger-backup-review-2026-10-08.md index f98c7a4..3732f00 100644 --- a/docs/ledger-backup-review-2026-10-08.md +++ b/docs/ledger-backup-review-2026-10-08.md @@ -136,6 +136,13 @@ loss. Production restore and private-copy expiration are separate owner actions. is already hash-locked and offline-verified by RPF-WP-0053; actual email caller admission remains missing. +Machine-readable evidence: ledger-backup-rehearsal-2026-10-08.json. The actual +synthetic packaged drill checked 3 accepted verification operations, 1 unknown +verification, 2 invalidated handles, 1 suppression, 1 accepted invitation and 1 +unknown invitation reservation; isolated startup/checks took 0.86s. This excludes +capture/upload/retrieval/decryption and is not full RTO. Private fixture paths and +all row contents are omitted from the evidence file. + T01/T02 implementation/rehearsal can close on this evidence; T03/T04 remain open for actual custody, offsite capture/recovery, post-capture reconciliation contract, monitored operation and founder activation. CSOC-WP-0010 remains active for those diff --git a/workplans/EMAIL-WP-0007-ledger-backup-recovery.md b/workplans/EMAIL-WP-0007-ledger-backup-recovery.md index 653c917..c0c660f 100644 --- a/workplans/EMAIL-WP-0007-ledger-backup-recovery.md +++ b/workplans/EMAIL-WP-0007-ledger-backup-recovery.md @@ -11,6 +11,7 @@ created: "2026-10-07" updated: "2026-10-08" origin: residual origin_ref: EMAIL-WP-0006 +state_hub_workstream_id: "35be21a2-343b-52e1-ba5e-32fead7a7831" --- CSOC-WP-0010-T04/T05 request durable recovery of the SQLite delivery/challenge @@ -24,6 +25,7 @@ a recurring backup. This work does not change SMTP/caller custody or send mail. id: EMAIL-WP-0007-T01 status: done priority: high +state_hub_task_id: "20b72599-da99-5d66-a0ab-8d946e837a2f" ``` Prepare a default-dry-run node capture, pinned to the current cluster/image/PVC. @@ -42,6 +44,7 @@ in this archive. Tests use only synthetic records and no production endpoints. id: EMAIL-WP-0007-T02 status: done priority: high +state_hub_task_id: "c8acba6d-1087-5ffd-a7e6-59608c07c1ff" ``` Add attended guarded decrypt/unpack and all-table/schema/row fingerprint checks. @@ -61,6 +64,7 @@ status: wait priority: high needs_human: true intervention_note: "Platform must admit the separate email-connect archive prefix, caller delivery, retention/capacity, independently retained receipts and recovery escrow; shared uploader support alone is not custody admission." +state_hub_task_id: "680fe4d6-12af-5296-acf9-15c9a01a0db3" ``` Platform profile: platform-pg/application-archives/email-connect/ in the current @@ -79,6 +83,7 @@ status: wait priority: high needs_human: true intervention_note: "Needs T03 admission and the exact first receiver pause/upload/schedule decision; real offsite retrieval, attended recovery and failure reception remain unproved." +state_hub_task_id: "66401e5c-a5cf-5e67-beab-e503ae079964" ``` Present pinned source hashes, dry-run evidence, coherent ledger scope, bounded