{
  "schema": "email-connect.closure-plan.v1",
  "status": "prepared",
  "existing_backup_publisher": {
    "application": "email-connect-backup-primary",
    "application_id": "0eb0f958-77a4-4c70-9aa7-14ba46411415",
    "bucket": "railiance-platform-pg-backup",
    "prefix": "platform-pg/application-archives/email-connect/",
    "retain_for_routine_backups": true,
    "escrow_or_administration_grant_inferred": false
  },
  "receiver_image": "forgejo.coulomb.social/coulomb/email-connect@sha256:5d79fd1fec15d3a279383820f170d263de3a55f5308df01a0a34732ebaea6d3d",
  "user_engine_image": "forgejo.coulomb.social/coulomb/user-engine@sha256:312dcb062b237c518148e1b4f09798a4e6ad08bc60d4add6834aab3f246f2002",
  "user_engine_live_baseline": "0d0751d",
  "user_engine_patch_sha256": "1fd705f1917f6c14cce69ae75b53ccbf1a2d9eee45561a72ae524a497d9f036e",
  "caller_policy": {
    "schema_version": 1,
    "callers": [
      {
        "caller_id": "user-engine",
        "source": "user-engine",
        "token_file": "/var/run/secrets/email-connect-callers/user-engine",
        "bindings": [
          [
            "tenant:coulomb",
            "coulomb-social"
          ]
        ],
        "binding_patterns": [
          [
            "tenant:*-family",
            "coulomb-social"
          ],
          [
            "tenant:family-*",
            "coulomb-social"
          ]
        ],
        "operations": [
          "send",
          "delivery-status",
          "status",
          "verify",
          "consume",
          "cancel"
        ],
        "templates": [
          "family_member.invited",
          "family_invitation.resent"
        ],
        "rate_per_minute": 10,
        "burst": 5,
        "max_payload_bytes": 8192,
        "adopt_legacy_verifications": true,
        "adopt_legacy_invitations": true
      }
    ]
  },
  "caller_custody": {
    "kv_path": "platform/workloads/email-connect/callers/user-engine",
    "field": "TOKEN",
    "initial_cas": 0,
    "writer_policy": "email-connect-scoped-caller-writer",
    "reader_policy": "email-connect-scoped-caller-reader",
    "readers": [
      {
        "namespace": "email-connect",
        "service_account": "email-connect-scoped-caller-eso",
        "role": "email-connect-scoped-caller-eso",
        "store": "openbao-email-connect-scoped-caller",
        "secret": "email-connect-caller-user-engine",
        "secret_key": "token"
      },
      {
        "namespace": "user-engine",
        "service_account": "user-engine-scoped-mail-eso",
        "role": "user-engine-scoped-mail-eso",
        "store": "openbao-user-engine-scoped-mail",
        "secret": "user-engine-scoped-mail",
        "secret_key": "token"
      }
    ]
  },
  "backup": {
    "recovery_mirror": {
      "project_id": "1d37ea63-8c8f-44e1-80e1-2de862579ba7",
      "bucket": "railiance-email-connect-archives",
      "prefix": "archives/",
      "verified_copy_required_before_success": true,
      "versioned_recovery_receipt_required": true,
      "retention_days": 30
    },
    "schedule_utc": "04:15",
    "jitter_seconds": 300,
    "rpo_target_hours": 24,
    "stale_threshold_hours": 26,
    "attended_rto_target_minutes": 60,
    "minimum_node_free_bytes": 8589934592,
    "local_budget_bytes": 8589934592,
    "daily_generations": 14,
    "weekly_generations": 4,
    "provider_archive_retention_days": 30,
    "retained_recovery_point_copied_to_escrow_kit": true,
    "automatic_retained_object_deletion": false,
    "failure_recipient": "platform-root",
    "retention_operator": "platform-root",
    "retention_review_interval": "weekly",
    "retention_execution": "Separate owner-operated expiry; publisher never deletes retained objects",
    "incident_restore_requires_fencing_and_post_capture_reconciliation": true
  },
  "scaleway_recovery": {
    "region": "nl-ams",
    "secret_manager_name": "email-connect-ledger-age-recovery",
    "secret_manager_protected": true,
    "secret_manager_ephemeral_policy": null,
    "kit_bucket": "railiance-email-connect-recovery",
    "kit_prefix": "kits/",
    "kit_lifecycle": null,
    "kit_versioning": "Enabled",
    "kit_contents": [
      "age-encrypted-ledger",
      "public-transfer-and-recovery-receipts",
      "pinned-receiver-image",
      "recovery-tools",
      "SHA256SUMS"
    ],
    "private_age_identity_in_kit": false,
    "scheduled_worker_escrow_access": false,
    "recovery_caller": "Separate read-only IAM application; effective prefix/bucket denial proofs required",
    "independent_entry": "platform-root Scaleway account; credentials held only on railiance01 do not qualify"
  },
  "activation_order": [
    "Approve exact plan and perform attended caller custody and Scaleway admission",
    "Deliver two bounded ESO projections and privately verify matching caller credentials",
    "Freeze user-engine dispatch, capture current ledger and resume receiver",
    "Apply coordinated immutable receiver/user-engine images and scoped policy",
    "Verify health, denial, limits, accepted/unknown continuity and original handles without mail",
    "Repin capture/rehearsal together; refresh and independently read back recovery kit",
    "Enable daily backup/hourly freshness after independent custody and retention proofs",
    "Finish workplans only after all admitted custody and operating proofs are present"
  ],
  "artifacts": {
    "deploy/closure/caller-reader.hcl": "cbc57e731c4fd9dbbaf98364de8ff87ed2966df18c2235cf298ffda963bf7553",
    "deploy/closure/caller-writer.hcl": "a56013092fa6f0dff9282676ba1e94d5bbf37c2dc481232188f68a1ce543510c",
    "deploy/closure/caller-delivery.json": "6fed12e204533ec679e80b3d9d0ba814cbf1d6f91a5a02211f0334617a92b0eb",
    "deploy/closure/receiver.patch.json": "449ce8456323347eca81190e2ccca334c90397c6699498466308bf8bfe63a9de",
    "deploy/closure/user-engine.patch.json": "2cae6ea6259ac1031fb7b8b11f011686baad8cb576cd72ee3f74461924daef46",
    "scripts/admit-scoped-caller.py": "17bf68f85f0bb08b3ca89eee34e62e794ee4754fbbb21646c28c85a1c1dd0e0e",
    "scripts/scaleway-recovery-custody.py": "85874f0620dc9353a9aaae1194db054de166296c4385743e4d541bbe42486c15",
    "scripts/publish-ledger-recovery-kit.py": "cd7c6e8e6a4e8417ba55f8170d763d7c5a9e6dd9b5878dc3459021a0b64ea732",
    "scripts/prepare-ledger-recovery-kit.py": "8cf74c9ea300c5ff6a03282293ba76ea0516fbd16f841259ca70f563c9e82d2b",
    "scripts/rehearse-ledger.py": "5c43b655149d8ae577fab80e76358be35f90cb0357df9b726ac7cb23346946a0",
    "scripts/backup-ledger.py": "0bbef692208bd6b1f6e06f3ae969c01fb86cc2078529e2eb598f370b0363e99f",
    "scripts/mirror-ledger.py": "abefb951dbdb4212f914a7701cfe0e7121e2c2643bf9f6892a0fc97fa6da760d",
    "scripts/capture-ledger.py": "7994fe7b4fbf72e28a4296212005a88d0ef9fcb626b066e6bcf2885500bc69d6"
  }
}