Activate scoped user-engine mail and finish EMAIL-WP-0008

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a11fd9-caf6-7a63-b578-9daaaa134ff2

workplans/EMAIL-WP-0007-ledger-backup-recovery.md

@@ -236,3 +236,24 @@ Actual pre-capture capacity check passes: retained local files 148,994 bytes,
 Receiver image/pins remain eb3e7b68 and both timers remain disabled. Receipt:
 deploy/backup/runtime-update-2026-10-09.json. Earlier preparation evidence retains
 its historical statement that node helpers had not yet changed.
+
+## Scoped receiver recovery point — 2026-10-09
+
+Capture/rehearsal source and installed runtime now bind the live scoped receiver
+5d79fd1f. Actual new offsite version 1791569930973785 has ciphertext SHA256
+1a7ae09129d8252053ea210cfe37d8a27d25bc4ee615bfe85f65c207b3e5f38e.
+Capture/resume took 57.47 seconds. Private retrieval to the workstation, existing
+age identity decrypt and UID10001/network-none application rehearsal preserve all
+six tables, including one caller quota bucket, two accepted deliveries and one
+suppression. Other transactional tables remain empty in this live point.
+Proof: docs/ledger-scoped-image-recovery-2026-10-09.json.
+
+Refreshed private recovery kit: 47,624,219 bytes, SHA256
+3ce8788375640398cd464996ea371a3d3d61a9252b2fb06a2f4192ad70f3811b,
+with the current receiver image/tools and ciphertext, excluding the private age
+identity. It has not been uploaded into independent durable custody. Existing
+publisher readback is not a separate recovery IAM caller. Both deployments resume
+Ready. EMAIL-WP-0008 is finished; T03/T04 here remain progress for independent
+Scaleway custody/grants, retention/schedule and recurring operation. Timers remain
+disabled. The user was asked for an existing Scaleway operator lane or Console
+custody setup, since the existing publisher cannot administer escrow resources.

workplans/EMAIL-WP-0008-scoped-transactional-callers.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Isolate explicitly admitted transactional mail callers"
 domain: infotech
 repo: email-connect
-status: active
+status: finished
 owner: codex
 topic_slug: netkingdom
 created: "2026-10-08"
@@ -16,7 +16,8 @@ state_hub_workstream_id: "3a0f264d-e441-5b12-964e-dab8fe5b3828"
 
 CSOC-WP-0010-T04 needs independent caller credentials, bounded template/tenant
 permissions, durable limits and scoped diagnostics. This record owns receiver
-source and its admission; current live single-caller SMTP remains unchanged.
+source and its admission. Scoped original-caller activation is complete;
+productive journey acceptance remains in CSOC-WP-0015.
 
 ## T01 — Implement explicit caller policies and durable isolation
 
@@ -57,10 +58,9 @@ receiver and caller module/tests. T03 remains waiting for runtime admission.
 
 ```task
 id: EMAIL-WP-0008-T03
-status: progress
+status: done
 priority: high
-needs_human: true
-intervention_note: "User approved compatible rollout preparation, proposed limits and pattern support. Glob allow-list, legacy invitation adoption, user-engine transport, candidate image and manifests are prepared. Separate token custody and coordinated runtime activation remain open; productive sender/reply/bounce acceptance stays in CSOC-WP-0015."
+needs_human: false
 state_hub_task_id: "9b4c7260-a6bf-54f9-82f8-2e98c368d294"
 ```
 
@@ -180,3 +180,56 @@ OpenBao edge is initialized/unsealed. The private receipt directory exists and
 the exact silent attended command was supplied to the user. No completed login,
 credential issue or native reader proof is claimed; awaiting the actual receipt.
 Current receiver/user-engine deployments remain Ready at their baseline images.
+
+## Scoped activation complete — 2026-10-09
+
+EMAIL-WP-0008 now runs the published scoped receiver and compatible user-engine
+images, with one Ready replica each. Decision
+8edbff8c-f62d-4357-8465-8eb37300f311 admitted continuation of the reviewed package.
+The attended child installed both exact policies/roles and created/read back
+caller KV version 1, then failed because its writer self-revocation CLI command
+was invalid. User confirmed parent login revocation. Corrected to `bao token
+revoke -self`; a real CLI test against a synthetic local HTTP endpoint verifies
+that call. Failure receipts now retain only allow-listed diagnostic codes.
+No second administrator session was used.
+
+Both approved ESO readers deliver equal credentials. Exact policy/900-second
+bounds and own-leaf read pass; sibling data, metadata, parent list, administrative
+policy read and a non-mutating CAS0 write to the existing leaf deny. Wrong bound
+identity, account and audience logins deny. Both proof tokens self-revoke and
+subsequent lookup denies. User-engine's invitation/registration credentials match
+its own projection and its binding JSON matches the reviewed exact/glob pairs.
+
+Quiesced pre-release offsite capture version 1791569299633609 precedes coordinated
+activation. A probe initially rejected a newline in the retired legacy bearer;
+Python rendered that bearer in its error. Automatic rollback restored baseline,
+then dispatch was fenced and scoped mode restored immediately. The corrected
+contained probe strips/rejects invalid header characters. The live receiver now
+returns 401 for the exposed legacy bearer. New caller/provider credentials were
+not exposed. Platform-root notice: b78dfaf0-953e-410c-b9fb-0309af4c42ae. Never restore
+the retired bearer or the old single-caller rollback spec. Its custody record was
+not deleted; retirement is enforced by the active scoped policy and canonical
+receiver manifests. Productive provider traffic remains separately owned.
+
+Live no-send probes verify forbidden suppression, foreign tenant, 8192-byte cap,
+burst five and preservation of both existing accepted deliveries. Non-quota
+ledger tables remain unchanged; SMTP authentication/database diagnostics pass.
+The synthetic recovery/package tests retain unknown-outcome, consumed/cancelled
+handle and legacy adoption coverage; those live state tables were empty.
+
+Canonical receiver kustomization now retains the scoped image, immutable policy
+and exact receiver-side ESO projection and passes server dry-run. The user-engine
+activation patch remains deploy/closure/user-engine.patch.json. Capture/rehearsal
+pins are changed together in source and installed runtime to the actual scoped
+image. Fresh offsite version 1791569930973785 and isolated UID10001/network-none
+recovery preserve all six tables, including the populated caller quota bucket.
+A refreshed private kit bundles the image/tools/age ciphertext/public receipts
+and excludes the private age identity. It remains local, not independent escrow.
+
+Public proofs: docs/scoped-caller-live-2026-10-09.json and
+ docs/ledger-scoped-image-recovery-2026-10-09.json. Focused backup/notification/
+custody regressions: 41 passed; focused syntax checks pass. Earlier full email
+regression remains 193 passed, zero skips. EMAIL-WP-0008-T03 is done. Independent
+Scaleway custody, generation retention and recurring backup activation remain
+EMAIL-WP-0007; backup timers stay disabled. Productive/browser sender/reply/bounce
+acceptance remains CSOC-WP-0015.