6.7 KiB
| id | type | title | domain | repo | status | owner | topic_slug | created | updated | origin | origin_ref | state_hub_workstream_id |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EMAIL-WP-0007 | workplan | Back up and recover the transactional delivery ledger | infotech | email-connect | active | codex | email-connect | 2026-10-07 | 2026-10-08 | residual | EMAIL-WP-0006 | 35be21a2-343b-52e1-ba5e-32fead7a7831 |
CSOC-WP-0010-T04/T05 request durable recovery of the SQLite delivery/challenge ledger independently of Coulomb's metadata/content pair. EMAIL-WP-0006 completed the verification retry release; its temporary private pre-release copies are not a recurring backup. This work does not change SMTP/caller custody or send mail.
T01 — Implement coherent ledger capture and verified publication
id: EMAIL-WP-0007-T01
status: done
priority: high
state_hub_task_id: "20b72599-da99-5d66-a0ab-8d946e837a2f"
Prepare a default-dry-run node capture, pinned to the current cluster/image/PVC. Quiesce the single receiver, use SQLite's backup API against the read-only PVC, verify integrity/all five transactional tables and resume the unchanged receiver in finally. Lock overlap and preserve private failure evidence. Package SQLite and its capture receipt only, age-encrypt once, publish through platform's immutable email-connect archive profile, and require version/hash readback before advancing success. Reviewed retries reuse ciphertext without another pause. No SMTP password, ingest token, scanner mailbox or provider message body belongs in this archive. Tests use only synthetic records and no production endpoints.
T02 — Prove isolated recovery preserves delivery and challenge state
id: EMAIL-WP-0007-T02
status: done
priority: high
state_hub_task_id: "c8acba6d-1087-5ffd-a7e6-59608c07c1ff"
Add attended guarded decrypt/unpack and all-table/schema/row fingerprint checks. Exercise current packaged service under UID10001/network-disabled conditions with synthetic recovered SQLite. Accepted sends/verifications replay without a provider call; unknown outcomes remain blocked; suppression and consumed/cancelled links remain effective. A historical snapshot can lose newer reservations or revive a handle consumed after capture: production recovery must freeze delivery, reconcile post-capture operations/issuer state and explicitly invalidate/reconcile challenges before releasing traffic. Never auto-restore into a running service.
T03 — Admit the independent primary caller and retention custody
id: EMAIL-WP-0007-T03
status: wait
priority: high
needs_human: true
intervention_note: "Platform must admit the separate email-connect archive prefix, caller delivery, retention/capacity, independently retained receipts and recovery escrow; shared uploader support alone is not custody admission."
state_hub_task_id: "680fe4d6-12af-5296-acf9-15c9a01a0db3"
Platform profile: platform-pg/application-archives/email-connect/ in the current Scaleway primary bucket. Request a separately scoped caller; do not copy another workload's Secret or inherit its write/delete authority. Worker has only public age recipient, no escrow identity or retained-object deletion rights. Bind the platform hash-locked SDK runtime and separate recovery/retention owner. RPF-WP-0053-T05 tracks admission; founder continuation authorizes source preparation, not an invented owner review or credential grant.
T04 — Complete the admitted first run, recovery and monitoring
id: EMAIL-WP-0007-T04
status: wait
priority: high
needs_human: true
intervention_note: "Needs T03 admission and the exact first receiver pause/upload/schedule decision; real offsite retrieval, attended recovery and failure reception remain unproved."
state_hub_task_id: "66401e5c-a5cf-5e67-beab-e503ae079964"
Present pinned source hashes, dry-run evidence, coherent ledger scope, bounded pause and rollback/resume protocol before exact activation. First capture must resume current service before encryption/upload. Independently retrieve/decrypt with escrow and validate all rows/schema and no-send recovery behavior. Record RPO/RTO and retained recovery point, then admit schedule and monitored failure response. Temporary private release copies retain their existing custody until the owner explicitly disposes of them; no expiry is implied here.
Implementation evidence — 2026-10-08
Standalone scripts/capture-ledger.py, ledger_archive.py, backup-ledger.py and rehearse-ledger.py plus four disabled unit candidates implement T01/T02. Full email suite 120 passed with the local GreenMail harness, zero skips, including 19 new synthetic ledger cases. Actual age roundtrip and pinned receiver-image rehearsal under UID10001/network none preserve all five tables/schema/rows and verify accepted/unknown reservation and consumed/cancelled/suppression behavior without provider calls. Isolated rehearsal is not live recovery acceptance.
Node server dry-run verifies current cluster/image/PVC, no-egress/no-secret helper and replica-only guarded pause projection; receiver remains unchanged, no helper created. All four units verify. Metadata-only check: email primary.env absent; no credentials fetched/copied, live pause/capture/provider upload, deploy or timer activation. Complete review: docs/ledger-backup-review-2026-10-08.md. Platform admission handoff RPF-WP-0053-T05 is a live record, not an owner approval. T03/T04 remain wait for custody, retention/capacity, actual offsite/recovery and monitoring plus the incident post-capture reconciliation gate. The workplan remains active.
Receiver image/schema alignment — 2026-10-08
EMAIL-WP-0008-T04 deploys receiver eb3e7b68 (sourcec9756b0) in the admitted single-caller mode. The ledger has caller_id/send-failure fields and caller_buckets. Capture/rehearsal source helpers are repinned together to this digest; fingerprints cover all six tables. Actual pre-release five-table backup migrates privately with every existing row preserved, UID10001/network-none and no send. See docs/caller-deployment-2026-10-08.md. This is image/schema alignment only: T03/T04 archive custody, first admitted offsite run/retrieval/application recovery and monitoring stay waiting. CSOC-WP-0015-T03 is the product acceptance follow-up.
Pair-custody preview — 2026-10-08
Founder admitted backup-pair-writer on 2026-10-08. The OpenBao policy is
installed and matches its source file. Version 1 of both backup-primary KV paths now exists, with both field names
set to a non-credential placeholder. The founder will enter the real pairs
as a new OpenBao UI version. The live bucket policy still allows only the
existing resource-control application under platform-pg/*. No real Scaleway
key, primary.env, receiver pause, upload or timer. T03/T04 stay wait. Review:
railiance-platform/docs/credential-lane-designs/application-backup-pair-custody-2026-10-08.md.