coulomb/email-connect
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare glob-scoped callers and prove offsite ledger recovery
Some checks failed
Transactional mail acceptance / mail (push) Failing after 32s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 57s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a11fd9-caf6-7a63-b578-9daaaa134ff2
This commit is contained in:
tegwick 2026-10-09 11:43:11 +02:00
parent 6fb206b359
commit 93b6ba2aae
21 changed files with 1080 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

40
workplans/EMAIL-WP-0007-ledger-backup-recovery.md
View file

@ -8,7 +8,7 @@ status: active
owner: codex
topic_slug: email-connect
created: "2026-10-07"
updated: "2026-10-08"
updated: "2026-10-09"
origin: residual
origin_ref: EMAIL-WP-0006
state_hub_workstream_id: "35be21a2-343b-52e1-ba5e-32fead7a7831"
@ -63,7 +63,7 @@ id: EMAIL-WP-0007-T03
status: progress
priority: high
needs_human: true
intervention_note: "The email-connect reader is accepted and primary.env is delivered. Retention, capacity, independent receipt custody and recovery escrow remain open."
intervention_note: "First provider capture/retrieval and workstation recovery are proved. Retention/capacity, independent receipt/key/image escrow and separate recovery caller admission remain open."
state_hub_task_id: "680fe4d6-12af-5296-acf9-15c9a01a0db3"
```
@ -79,10 +79,10 @@ invented owner review or credential grant.
```task
id: EMAIL-WP-0007-T04
status: wait
status: progress
priority: high
needs_human: true
intervention_note: "Needs T03 admission and the exact first receiver pause/upload/schedule decision; real offsite retrieval, attended recovery and failure reception remain unproved."
intervention_note: "First admitted backup/recovery and platform-root State Hub inbox failure delivery pass. Recurring schedule, retention/capacity, independent recovery custody and operator response acceptance remain open; timers stay disabled."
state_hub_task_id: "66401e5c-a5cf-5e67-beab-e503ae079964"
```
@ -142,3 +142,35 @@ policies and Kubernetes roles are installed. email-connect
directory, KV version 2, token revoked before publication, readback equal.
Coulomb's reader is applied and its node file was not created. No receiver
pause, upload, escrow, retention decision or timer. T04 stays wait.
## First admitted offsite recovery and failure delivery — 2026-10-09
User authorized one guarded capture, encrypted primary upload, separate provider
retrieval and isolated workstation recovery; schedules explicitly remain disabled.
Decision: 0dfcdd94-50ee-4219-9659-5c4c445721f0. Runtime scripts and the platform
hash-locked SDK are installed under /opt; actual credential presence/model check
and capture preview pass under the service filesystem restrictions. File hashes:
deploy/backup/runtime-manifest-2026-10-09.json.
Capture/resume took 56.41 seconds. Provider version 1791537739370570 and
ciphertext size/hash readback pass. A separate GET retrieves that version with
the admitted node publisher credential, then ciphertext and the public receipt
move to the workstation; no credential or private identity moves to the node.
The existing private workstation identity matches the configured public recipient.
Attended decrypt plus UID10001/network-none application rehearsal preserve all six
tables/schema/rows, two accepted deliveries and one suppression without sending.
Other transactional state and quota tables are empty in this live snapshot;
their recovery behavior remains supported by the earlier synthetic tests, not a
claim of populated live recovery coverage. Production restore/RTO are not measured.
Public proof: docs/ledger-first-backup-2026-10-09.json. Private recovery artifacts
remain mode 0700/0600 under /tmp/email-connect-first-recovery-20261009.
Both units now have OnFailure hooks to the platform-root State Hub inbox, selected
by the user. Notification failures retain private pending records with stable
event ids; freshness runs replay them. A synthetic systemd failure delivered
message adcebf95-26c4-4adb-99b0-4446c8505a42, independently found in that inbox.
Human acknowledgement/response is not claimed. Installed freshness passes and
both timers are disabled. T04 is progress, with first-run/recovery/delivery proved.
T03 retains generation retention/capacity, independently retained receipt/key/image
escrow and a separate recovery caller. Schedule/RPO admission and incident
post-capture reconciliation remain required before workplan completion.