Prepare immutable caller rollout and independent Scaleway recovery custody

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a11fd9-caf6-7a63-b578-9daaaa134ff2

scripts/backup-ledger.py

@@ -30,9 +30,32 @@ from ledger_archive import (
 NAME = re.compile(r"\d{8}T\d{6}Z-[a-f0-9]{24}\.tar\.age")
 PRIMARY_TOOL = Path("/opt/railiance-platform/scripts/primary_application_archive.py")
 PRIMARY_PYTHON = Path("/opt/railiance-platform/backup-venv/bin/python")
+MINIMUM_FREE_BYTES = 8 * 1024**3
+LOCAL_BUDGET_BYTES = 8 * 1024**3
 RECIPIENT = "age1zvryunvjhvpkmasskauga2heeg0ztnte9ymgppvjge36ekumk50syr3tsz"
 
 
+def capacity(state, minimum_free=MINIMUM_FREE_BYTES, budget=LOCAL_BUDGET_BYTES):
+    ancestor = state
+    while not ancestor.exists():
+        ancestor = ancestor.parent
+    if shutil.disk_usage(ancestor).free < minimum_free:
+        raise Refused("backup_disk_headroom_required")
+    used = 0
+    if state.exists():
+        private_directory(state)
+        for path in state.rglob("*"):
+            if path.is_symlink():
+                raise Refused("backup_state_symlink_requires_review")
+            if path.is_file():
+                used += path.stat().st_size
+        # Reserve room for capture, ciphertext, readback and a failure packet.
+        if used + 512 * 1024**2 > budget:
+            raise Refused("backup_local_retention_review_required")
+    return {"status": "headroom_verified", "local_bytes": used,
+            "minimum_free_bytes": minimum_free, "local_budget_bytes": budget}
+
+
 def publish(encrypted, fetched, receipt_path, captured, tool, python):
     command(
         [
@@ -209,6 +232,7 @@ def main():
             or not args.primary_python.is_file()
         ):
             raise Refused("invalid_backup_configuration")
+        capacity(args.state_dir)
         command(["age", "--version"])
         command(
             [