Activate scoped user-engine mail and finish EMAIL-WP-0008

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a11fd9-caf6-7a63-b578-9daaaa134ff2

docs/caller-policy-draft-2026-10-08.md

@@ -132,3 +132,56 @@ denials/quotas and legacy handle continuity without sending mail. Repin backup
 capture/rehearsal together only after actual receiver activation and refresh the
 recovery kit. No new credential, image rollout or policy activation has occurred.
 T03 remains progress. Full email regression: 193 passed, zero skips.
+
+## Scoped activation complete — 2026-10-09
+
+EMAIL-WP-0008 now runs the published scoped receiver and compatible user-engine
+images, with one Ready replica each. Decision
+8edbff8c-f62d-4357-8465-8eb37300f311 admitted continuation of the reviewed package.
+The attended child installed both exact policies/roles and created/read back
+caller KV version 1, then failed because its writer self-revocation CLI command
+was invalid. User confirmed parent login revocation. Corrected to `bao token
+revoke -self`; a real CLI test against a synthetic local HTTP endpoint verifies
+that call. Failure receipts now retain only allow-listed diagnostic codes.
+No second administrator session was used.
+
+Both approved ESO readers deliver equal credentials. Exact policy/900-second
+bounds and own-leaf read pass; sibling data, metadata, parent list, administrative
+policy read and a non-mutating CAS0 write to the existing leaf deny. Wrong bound
+identity, account and audience logins deny. Both proof tokens self-revoke and
+subsequent lookup denies. User-engine's invitation/registration credentials match
+its own projection and its binding JSON matches the reviewed exact/glob pairs.
+
+Quiesced pre-release offsite capture version 1791569299633609 precedes coordinated
+activation. A probe initially rejected a newline in the retired legacy bearer;
+Python rendered that bearer in its error. Automatic rollback restored baseline,
+then dispatch was fenced and scoped mode restored immediately. The corrected
+contained probe strips/rejects invalid header characters. The live receiver now
+returns 401 for the exposed legacy bearer. New caller/provider credentials were
+not exposed. Platform-root notice: b78dfaf0-953e-410c-b9fb-0309af4c42ae. Never restore
+the retired bearer or the old single-caller rollback spec. Its custody record was
+not deleted; retirement is enforced by the active scoped policy and canonical
+receiver manifests. Productive provider traffic remains separately owned.
+
+Live no-send probes verify forbidden suppression, foreign tenant, 8192-byte cap,
+burst five and preservation of both existing accepted deliveries. Non-quota
+ledger tables remain unchanged; SMTP authentication/database diagnostics pass.
+The synthetic recovery/package tests retain unknown-outcome, consumed/cancelled
+handle and legacy adoption coverage; those live state tables were empty.
+
+Canonical receiver kustomization now retains the scoped image, immutable policy
+and exact receiver-side ESO projection and passes server dry-run. The user-engine
+activation patch remains deploy/closure/user-engine.patch.json. Capture/rehearsal
+pins are changed together in source and installed runtime to the actual scoped
+image. Fresh offsite version 1791569930973785 and isolated UID10001/network-none
+recovery preserve all six tables, including the populated caller quota bucket.
+A refreshed private kit bundles the image/tools/age ciphertext/public receipts
+and excludes the private age identity. It remains local, not independent escrow.
+
+Public proofs: docs/scoped-caller-live-2026-10-09.json and
+ docs/ledger-scoped-image-recovery-2026-10-09.json. Focused backup/notification/
+custody regressions: 41 passed; focused syntax checks pass. Earlier full email
+regression remains 193 passed, zero skips. EMAIL-WP-0008-T03 is done. Independent
+Scaleway custody, generation retention and recurring backup activation remain
+EMAIL-WP-0007; backup timers stay disabled. Productive/browser sender/reply/bounce
+acceptance remains CSOC-WP-0015.

docs/ledger-backup-review-2026-10-08.md

@@ -247,3 +247,24 @@ Actual pre-capture capacity check passes: retained local files 148,994 bytes,
 Receiver image/pins remain eb3e7b68 and both timers remain disabled. Receipt:
 deploy/backup/runtime-update-2026-10-09.json. Earlier preparation evidence retains
 its historical statement that node helpers had not yet changed.
+
+## Scoped receiver recovery point — 2026-10-09
+
+Capture/rehearsal source and installed runtime now bind the live scoped receiver
+5d79fd1f. Actual new offsite version 1791569930973785 has ciphertext SHA256
+1a7ae09129d8252053ea210cfe37d8a27d25bc4ee615bfe85f65c207b3e5f38e.
+Capture/resume took 57.47 seconds. Private retrieval to the workstation, existing
+age identity decrypt and UID10001/network-none application rehearsal preserve all
+six tables, including one caller quota bucket, two accepted deliveries and one
+suppression. Other transactional tables remain empty in this live point.
+Proof: docs/ledger-scoped-image-recovery-2026-10-09.json.
+
+Refreshed private recovery kit: 47,624,219 bytes, SHA256
+3ce8788375640398cd464996ea371a3d3d61a9252b2fb06a2f4192ad70f3811b,
+with the current receiver image/tools and ciphertext, excluding the private age
+identity. It has not been uploaded into independent durable custody. Existing
+publisher readback is not a separate recovery IAM caller. Both deployments resume
+Ready. EMAIL-WP-0008 is finished; T03/T04 here remain progress for independent
+Scaleway custody/grants, retention/schedule and recurring operation. Timers remain
+disabled. The user was asked for an existing Scaleway operator lane or Console
+custody setup, since the existing publisher cannot administer escrow resources.

docs/ledger-scoped-image-recovery-2026-10-09.json

@@ -0,0 +1,179 @@
+{
+  "schema": "email-connect.scoped-image-backup-recovery.v1",
+  "publication": {
+    "schema": "platform.application-primary-archive.v1",
+    "status": "offsite_fetched_verified",
+    "application": "email-connect",
+    "captured_at": "2026-10-09T18:17:51Z",
+    "object_key": "platform-pg/application-archives/email-connect/2026/10/09/20261009T181751Z-7e1211057348f51569d8b9e4.tar.age",
+    "destination": "s3://railiance-platform-pg-backup/platform-pg/application-archives/email-connect/2026/10/09/20261009T181751Z-7e1211057348f51569d8b9e4.tar.age",
+    "ciphertext_sha256": "1a7ae09129d8252053ea210cfe37d8a27d25bc4ee615bfe85f65c207b3e5f38e",
+    "ciphertext_bytes": 71896,
+    "remote_retrieval_verified": true,
+    "stage": "transfer_verified",
+    "multipart_completed": true,
+    "version_id": "1791569930973785",
+    "immutable_create": true,
+    "image": "forgejo.coulomb.social/coulomb/email-connect@sha256:5d79fd1fec15d3a279383820f170d263de3a55f5308df01a0a34732ebaea6d3d",
+    "database_sha256": "6694bddc3b57b5918852fbdd79d569d5bf1393831ed55aca25bb19a59e601feb",
+    "database_bytes": 57344,
+    "ledger_fingerprint": {
+      "schema_sha256": "13148e5a9c6e01cc593bb07278a8649b13e43b26c30b0ed1a6e15995f7b00732",
+      "user_version": 0,
+      "tables": {
+        "caller_buckets": {
+          "rows": 1,
+          "sha256": "0ce5a0b678fdcf55de7a4b2314a02d12f168e0f08b2a0d42d82c3e1dc514778c"
+        },
+        "deliveries": {
+          "rows": 2,
+          "sha256": "a0387716815b2ec191187cb34bb3252b9cf51f5fb15a2019918a9cf1737c061e"
+        },
+        "send_attempts": {
+          "rows": 0,
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        },
+        "suppressions": {
+          "rows": 1,
+          "sha256": "ae26d10dfec16f1b626292b342a5e86afd1858fcaed7c29d4e68e7cf821183d7"
+        },
+        "verification_attempts": {
+          "rows": 0,
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        },
+        "verifications": {
+          "rows": 0,
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        }
+      }
+    },
+    "pause_and_capture_seconds": 57.47,
+    "local_archive": "20261009T181751Z-7e1211057348f51569d8b9e4.tar.age",
+    "application_restore_verified": false,
+    "completed_at": "2026-10-09T18:18:51.557894+00:00"
+  },
+  "application_recovery": {
+    "status": "application_restored_verified",
+    "application": "email-connect",
+    "object_key": "platform-pg/application-archives/email-connect/2026/10/09/20261009T181751Z-7e1211057348f51569d8b9e4.tar.age",
+    "version_id": "1791569930973785",
+    "ciphertext_sha256": "1a7ae09129d8252053ea210cfe37d8a27d25bc4ee615bfe85f65c207b3e5f38e",
+    "database_sha256": "6694bddc3b57b5918852fbdd79d569d5bf1393831ed55aca25bb19a59e601feb",
+    "ledger_fingerprint": {
+      "schema_sha256": "13148e5a9c6e01cc593bb07278a8649b13e43b26c30b0ed1a6e15995f7b00732",
+      "user_version": 0,
+      "tables": {
+        "caller_buckets": {
+          "rows": 1,
+          "sha256": "0ce5a0b678fdcf55de7a4b2314a02d12f168e0f08b2a0d42d82c3e1dc514778c"
+        },
+        "deliveries": {
+          "rows": 2,
+          "sha256": "a0387716815b2ec191187cb34bb3252b9cf51f5fb15a2019918a9cf1737c061e"
+        },
+        "send_attempts": {
+          "rows": 0,
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        },
+        "suppressions": {
+          "rows": 1,
+          "sha256": "ae26d10dfec16f1b626292b342a5e86afd1858fcaed7c29d4e68e7cf821183d7"
+        },
+        "verification_attempts": {
+          "rows": 0,
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        },
+        "verifications": {
+          "rows": 0,
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        }
+      }
+    },
+    "mail_sent": false,
+    "production_restored": false,
+    "application_restore_verified": true,
+    "recovery_image": "forgejo.coulomb.social/coulomb/email-connect@sha256:5d79fd1fec15d3a279383820f170d263de3a55f5308df01a0a34732ebaea6d3d",
+    "network": "disabled",
+    "checks": {
+      "accepted_verifications": 0,
+      "unknown_verifications": 0,
+      "invalidated_handles": 0,
+      "suppressions": 1,
+      "accepted_deliveries": 2,
+      "unknown_sends": 0
+    },
+    "uid": 10001,
+    "evidence_ceiling": "isolated_ledger_rehearsal",
+    "offline_image_binding_verified": false,
+    "elapsed_seconds": 1.61
+  },
+  "independent_identity_escrow_admitted": false,
+  "separately_scoped_recovery_caller": false,
+  "schedules_enabled": false,
+  "production_rto_measured": false,
+  "offline_kit_rehearsal": {
+    "status": "application_restored_verified",
+    "application": "email-connect",
+    "object_key": "platform-pg/application-archives/email-connect/2026/10/09/20261009T181751Z-7e1211057348f51569d8b9e4.tar.age",
+    "version_id": "1791569930973785",
+    "ciphertext_sha256": "1a7ae09129d8252053ea210cfe37d8a27d25bc4ee615bfe85f65c207b3e5f38e",
+    "database_sha256": "6694bddc3b57b5918852fbdd79d569d5bf1393831ed55aca25bb19a59e601feb",
+    "ledger_fingerprint": {
+      "schema_sha256": "13148e5a9c6e01cc593bb07278a8649b13e43b26c30b0ed1a6e15995f7b00732",
+      "user_version": 0,
+      "tables": {
+        "caller_buckets": {
+          "rows": 1,
+          "sha256": "0ce5a0b678fdcf55de7a4b2314a02d12f168e0f08b2a0d42d82c3e1dc514778c"
+        },
+        "deliveries": {
+          "rows": 2,
+          "sha256": "a0387716815b2ec191187cb34bb3252b9cf51f5fb15a2019918a9cf1737c061e"
+        },
+        "send_attempts": {
+          "rows": 0,
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        },
+        "suppressions": {
+          "rows": 1,
+          "sha256": "ae26d10dfec16f1b626292b342a5e86afd1858fcaed7c29d4e68e7cf821183d7"
+        },
+        "verification_attempts": {
+          "rows": 0,
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        },
+        "verifications": {
+          "rows": 0,
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        }
+      }
+    },
+    "mail_sent": false,
+    "production_restored": false,
+    "application_restore_verified": true,
+    "recovery_image": "forgejo.coulomb.social/coulomb/email-connect@sha256:5d79fd1fec15d3a279383820f170d263de3a55f5308df01a0a34732ebaea6d3d",
+    "network": "disabled",
+    "checks": {
+      "accepted_verifications": 0,
+      "unknown_verifications": 0,
+      "invalidated_handles": 0,
+      "suppressions": 1,
+      "accepted_deliveries": 2,
+      "unknown_sends": 0
+    },
+    "uid": 10001,
+    "evidence_ceiling": "isolated_ledger_rehearsal",
+    "offline_image_binding_verified": true,
+    "elapsed_seconds": 0.91
+  },
+  "recovery_kit": {
+    "status": "recovery_kit_prepared",
+    "kit_sha256": "3ce8788375640398cd464996ea371a3d3d61a9252b2fb06a2f4192ad70f3811b",
+    "kit_bytes": 47624219,
+    "image": "forgejo.coulomb.social/coulomb/email-connect@sha256:5d79fd1fec15d3a279383820f170d263de3a55f5308df01a0a34732ebaea6d3d",
+    "image_id": "sha256:5d79fd1fec15d3a279383820f170d263de3a55f5308df01a0a34732ebaea6d3d",
+    "private_identity_included": false,
+    "provider_upload_verified": false,
+    "protected_version": "1791569930973785"
+  }
+}

docs/scoped-caller-live-2026-10-09.json

@@ -0,0 +1,85 @@
+{
+  "schema": "email-connect.scoped-caller-live.v1",
+  "date": "2026-10-09",
+  "status": "activated_verified",
+  "activation_decision_id": "8edbff8c-f62d-4357-8465-8eb37300f311",
+  "activation_plan_sha256": "8e529e2ffdb6ee3d53a768d65b2d025b95e788734c48a29f2f8b975825dbaed7",
+  "receiver_image": "forgejo.coulomb.social/coulomb/email-connect@sha256:5d79fd1fec15d3a279383820f170d263de3a55f5308df01a0a34732ebaea6d3d",
+  "user_engine_image": "forgejo.coulomb.social/coulomb/user-engine@sha256:312dcb062b237c518148e1b4f09798a4e6ad08bc60d4add6834aab3f246f2002",
+  "caller_delivery": {
+    "status": "reader_delivery_verified",
+    "projection_equal": true,
+    "credential_values_printed": false,
+    "kv_version": 1,
+    "reader_lease_seconds": 900,
+    "exact_reader_policy": "email-connect-scoped-caller-reader",
+    "readers": [
+      "email-connect/email-connect-scoped-caller-eso",
+      "user-engine/user-engine-scoped-mail-eso"
+    ],
+    "each_reader_boundary_denials": 5,
+    "negative_login_denials": [
+      "wrong_bound_identity",
+      "wrong_account",
+      "wrong_audience"
+    ],
+    "all_reader_self_revocations_verified": true,
+    "initial_writer_self_revoke_cli_failed": true,
+    "parent_login_session_revocation_confirmed_by_user": true
+  },
+  "release": {
+    "status": "coordinated_scoped_rollout_ready",
+    "ledger_rows_preserved": true,
+    "accepted_live_deliveries_checked": 2,
+    "legacy_token_denied": true,
+    "suppression_denied": true,
+    "foreign_tenant_denied": true,
+    "payload_cap_denied": true,
+    "burst_denied": true,
+    "durable_nonquota_tables_unchanged": true,
+    "probe_mail_sent": false,
+    "pre_release_version": "1791569299633609",
+    "user_engine_ready": true,
+    "elapsed_probe_and_release_seconds": 39.58
+  },
+  "user_engine_environment": {
+    "both_transport_credentials_match_projection": true,
+    "binding_configuration_matches": true
+  },
+  "canonical_receiver_server_dry_run": "passed",
+  "backup_source_and_runtime_pins_match_receiver": true,
+  "backup_timers_enabled": false,
+  "security_incident": {
+    "legacy_ingest_bearer_rendered_in_probe_error": true,
+    "new_caller_credential_exposed": false,
+    "legacy_bearer_live_denial_verified": true,
+    "platform_root_notice_id": "b78dfaf0-953e-410c-b9fb-0309af4c42ae",
+    "rollback_to_legacy_bearer_forbidden": true,
+    "provider_credentials_exposed": false
+  },
+  "corrected_revocation_test": {
+    "actual_cli_against_local_synthetic_endpoint": "passed",
+    "focused_backup_notification_custody_tests_passed": 41
+  },
+  "diagnostics": {
+    "http_status": 200,
+    "database": "ok",
+    "smtp_authentication": "ok",
+    "provider_mail_submission": false
+  },
+  "current_image_offsite_backup_version": "1791569930973785",
+  "current_image_recovery_evidence": "docs/ledger-scoped-image-recovery-2026-10-09.json",
+  "recovery_kit": {
+    "status": "recovery_kit_prepared",
+    "kit_sha256": "3ce8788375640398cd464996ea371a3d3d61a9252b2fb06a2f4192ad70f3811b",
+    "kit_bytes": 47624219,
+    "image": "forgejo.coulomb.social/coulomb/email-connect@sha256:5d79fd1fec15d3a279383820f170d263de3a55f5308df01a0a34732ebaea6d3d",
+    "image_id": "sha256:5d79fd1fec15d3a279383820f170d263de3a55f5308df01a0a34732ebaea6d3d",
+    "private_identity_included": false,
+    "provider_upload_verified": false,
+    "protected_version": "1791569930973785"
+  },
+  "current_plan_sha256": "5a847f4e5f05557d6740f8c62d3891b13854540eb6835d9cd9cca3897a2abcda",
+  "offline_kit_rehearsal_verified": true,
+  "offline_kit_application_rehearsal_seconds": 0.91
+}