Prepare glob-scoped callers and prove offsite ledger recovery

Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a11fd9-caf6-7a63-b578-9daaaa134ff2
2026-10-09 11:43:11 +02:00 · 2026-10-09 11:43:11 +02:00 · 93b6ba2aae
commit 93b6ba2aae
parent 6fb206b359
21 changed files with 1080 additions and 19 deletions
--- a/deploy/caller-rollout/receiver-policy.patch.json
+++ b/deploy/caller-rollout/receiver-policy.patch.json
@ -0,0 +1,53 @@
+{
+  "spec": {
+    "template": {
+      "spec": {
+        "containers": [
+          {
+            "name": "email-connect",
+            "env": [
+              {
+                "name": "EMAIL_CONNECT_CALLERS_FILE",
+                "value": "/etc/email-connect-callers/callers.json"
+              }
+            ],
+            "volumeMounts": [
+              {
+                "name": "caller-policy",
+                "mountPath": "/etc/email-connect-callers",
+                "readOnly": true
+              },
+              {
+                "name": "caller-credentials",
+                "mountPath": "/var/run/secrets/email-connect-callers",
+                "readOnly": true
+              }
+            ]
+          }
+        ],
+        "volumes": [
+          {
+            "name": "caller-policy",
+            "configMap": {
+              "name": "email-connect-callers-user-engine-276257849bf2",
+              "defaultMode": 292
+            }
+          },
+          {
+            "name": "caller-credentials",
+            "secret": {
+              "secretName": "email-connect-caller-user-engine",
+              "defaultMode": 288,
+              "items": [
+                {
+                  "key": "token",
+                  "path": "user-engine"
+                }
+              ]
+            }
+          }
+        ]
+      }
+    }
+  }
+}