tegwick
9a2cf213d1
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a11fd9-caf6-7a63-b578-9daaaa134ff2
147 lines
6.1 KiB
JSON
147 lines
6.1 KiB
JSON
{
|
|
"schema": "email-connect.closure-plan.v1",
|
|
"status": "prepared",
|
|
"existing_backup_publisher": {
|
|
"application": "email-connect-backup-primary",
|
|
"application_id": "0eb0f958-77a4-4c70-9aa7-14ba46411415",
|
|
"bucket": "railiance-platform-pg-backup",
|
|
"prefix": "platform-pg/application-archives/email-connect/",
|
|
"retain_for_routine_backups": true,
|
|
"escrow_or_administration_grant_inferred": false
|
|
},
|
|
"receiver_image": "forgejo.coulomb.social/coulomb/email-connect@sha256:5d79fd1fec15d3a279383820f170d263de3a55f5308df01a0a34732ebaea6d3d",
|
|
"user_engine_image": "forgejo.coulomb.social/coulomb/user-engine@sha256:312dcb062b237c518148e1b4f09798a4e6ad08bc60d4add6834aab3f246f2002",
|
|
"user_engine_live_baseline": "0d0751d",
|
|
"user_engine_patch_sha256": "1fd705f1917f6c14cce69ae75b53ccbf1a2d9eee45561a72ae524a497d9f036e",
|
|
"caller_policy": {
|
|
"schema_version": 1,
|
|
"callers": [
|
|
{
|
|
"caller_id": "user-engine",
|
|
"source": "user-engine",
|
|
"token_file": "/var/run/secrets/email-connect-callers/user-engine",
|
|
"bindings": [
|
|
[
|
|
"tenant:coulomb",
|
|
"coulomb-social"
|
|
]
|
|
],
|
|
"binding_patterns": [
|
|
[
|
|
"tenant:*-family",
|
|
"coulomb-social"
|
|
],
|
|
[
|
|
"tenant:family-*",
|
|
"coulomb-social"
|
|
]
|
|
],
|
|
"operations": [
|
|
"send",
|
|
"delivery-status",
|
|
"status",
|
|
"verify",
|
|
"consume",
|
|
"cancel"
|
|
],
|
|
"templates": [
|
|
"family_member.invited",
|
|
"family_invitation.resent"
|
|
],
|
|
"rate_per_minute": 10,
|
|
"burst": 5,
|
|
"max_payload_bytes": 8192,
|
|
"adopt_legacy_verifications": true,
|
|
"adopt_legacy_invitations": true
|
|
}
|
|
]
|
|
},
|
|
"caller_custody": {
|
|
"kv_path": "platform/workloads/email-connect/callers/user-engine",
|
|
"field": "TOKEN",
|
|
"initial_cas": 0,
|
|
"writer_policy": "email-connect-scoped-caller-writer",
|
|
"reader_policy": "email-connect-scoped-caller-reader",
|
|
"readers": [
|
|
{
|
|
"namespace": "email-connect",
|
|
"service_account": "email-connect-scoped-caller-eso",
|
|
"role": "email-connect-scoped-caller-eso",
|
|
"store": "openbao-email-connect-scoped-caller",
|
|
"secret": "email-connect-caller-user-engine",
|
|
"secret_key": "token"
|
|
},
|
|
{
|
|
"namespace": "user-engine",
|
|
"service_account": "user-engine-scoped-mail-eso",
|
|
"role": "user-engine-scoped-mail-eso",
|
|
"store": "openbao-user-engine-scoped-mail",
|
|
"secret": "user-engine-scoped-mail",
|
|
"secret_key": "token"
|
|
}
|
|
]
|
|
},
|
|
"backup": {
|
|
"schedule_utc": "04:15",
|
|
"jitter_seconds": 300,
|
|
"rpo_target_hours": 24,
|
|
"stale_threshold_hours": 26,
|
|
"attended_rto_target_minutes": 60,
|
|
"minimum_node_free_bytes": 8589934592,
|
|
"local_budget_bytes": 8589934592,
|
|
"daily_generations": 14,
|
|
"weekly_generations": 4,
|
|
"provider_archive_retention_days": 30,
|
|
"retained_recovery_point_copied_to_escrow_kit": true,
|
|
"automatic_retained_object_deletion": false,
|
|
"failure_recipient": "platform-root",
|
|
"retention_operator": "platform-root",
|
|
"retention_review_interval": "weekly",
|
|
"retention_execution": "Separate owner-operated expiry; publisher never deletes retained objects",
|
|
"incident_restore_requires_fencing_and_post_capture_reconciliation": true
|
|
},
|
|
"scaleway_recovery": {
|
|
"region": "nl-ams",
|
|
"secret_manager_name": "email-connect-ledger-age-recovery",
|
|
"secret_manager_protected": true,
|
|
"secret_manager_ephemeral_policy": null,
|
|
"kit_bucket": "railiance-email-connect-recovery",
|
|
"kit_prefix": "kits/",
|
|
"kit_lifecycle": null,
|
|
"kit_versioning": "Enabled",
|
|
"kit_contents": [
|
|
"age-encrypted-ledger",
|
|
"public-transfer-and-recovery-receipts",
|
|
"pinned-receiver-image",
|
|
"recovery-tools",
|
|
"SHA256SUMS"
|
|
],
|
|
"private_age_identity_in_kit": false,
|
|
"scheduled_worker_escrow_access": false,
|
|
"recovery_caller": "Separate read-only IAM application; effective prefix/bucket denial proofs required",
|
|
"independent_entry": "platform-root Scaleway account; credentials held only on railiance01 do not qualify"
|
|
},
|
|
"activation_order": [
|
|
"Approve exact plan and perform attended caller custody and Scaleway admission",
|
|
"Deliver two bounded ESO projections and privately verify matching caller credentials",
|
|
"Freeze user-engine dispatch, capture current ledger and resume receiver",
|
|
"Apply coordinated immutable receiver/user-engine images and scoped policy",
|
|
"Verify health, denial, limits, accepted/unknown continuity and original handles without mail",
|
|
"Repin capture/rehearsal together; refresh and independently read back recovery kit",
|
|
"Enable daily backup/hourly freshness after independent custody and retention proofs",
|
|
"Finish workplans only after all admitted custody and operating proofs are present"
|
|
],
|
|
"artifacts": {
|
|
"deploy/closure/caller-reader.hcl": "cbc57e731c4fd9dbbaf98364de8ff87ed2966df18c2235cf298ffda963bf7553",
|
|
"deploy/closure/caller-writer.hcl": "a56013092fa6f0dff9282676ba1e94d5bbf37c2dc481232188f68a1ce543510c",
|
|
"deploy/closure/caller-delivery.json": "6fed12e204533ec679e80b3d9d0ba814cbf1d6f91a5a02211f0334617a92b0eb",
|
|
"deploy/closure/receiver.patch.json": "449ce8456323347eca81190e2ccca334c90397c6699498466308bf8bfe63a9de",
|
|
"deploy/closure/user-engine.patch.json": "2cae6ea6259ac1031fb7b8b11f011686baad8cb576cd72ee3f74461924daef46",
|
|
"scripts/admit-scoped-caller.py": "592bd46740f9eea4ad1ae78aa674f6c381ce05ab6044cedf0af968a1c340adf2",
|
|
"scripts/scaleway-recovery-custody.py": "85874f0620dc9353a9aaae1194db054de166296c4385743e4d541bbe42486c15",
|
|
"scripts/publish-ledger-recovery-kit.py": "cd7c6e8e6a4e8417ba55f8170d763d7c5a9e6dd9b5878dc3459021a0b64ea732",
|
|
"scripts/prepare-ledger-recovery-kit.py": "db92a29eb68e1b555cf18b17229d1e479b3147da7600ffa0616ac8b4d011ff55",
|
|
"scripts/rehearse-ledger.py": "d3da88972e44dac3800afb48d21e525dc1476ca58de3e7702f7751aea33eda53",
|
|
"scripts/backup-ledger.py": "e74c41948ca01dae09578e2abfba14b96fb1f158af0ec91a0fb1aa9ecaf01680"
|
|
}
|
|
}
|