135 lines
6.7 KiB
Markdown
135 lines
6.7 KiB
Markdown
---
|
|
id: EMAIL-WP-0007
|
|
type: workplan
|
|
title: "Back up and recover the transactional delivery ledger"
|
|
domain: infotech
|
|
repo: email-connect
|
|
status: active
|
|
owner: codex
|
|
topic_slug: email-connect
|
|
created: "2026-10-07"
|
|
updated: "2026-10-08"
|
|
origin: residual
|
|
origin_ref: EMAIL-WP-0006
|
|
state_hub_workstream_id: "35be21a2-343b-52e1-ba5e-32fead7a7831"
|
|
---
|
|
|
|
CSOC-WP-0010-T04/T05 request durable recovery of the SQLite delivery/challenge
|
|
ledger independently of Coulomb's metadata/content pair. EMAIL-WP-0006 completed
|
|
the verification retry release; its temporary private pre-release copies are not
|
|
a recurring backup. This work does not change SMTP/caller custody or send mail.
|
|
|
|
## T01 — Implement coherent ledger capture and verified publication
|
|
|
|
```task
|
|
id: EMAIL-WP-0007-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "20b72599-da99-5d66-a0ab-8d946e837a2f"
|
|
```
|
|
|
|
Prepare a default-dry-run node capture, pinned to the current cluster/image/PVC.
|
|
Quiesce the single receiver, use SQLite's backup API against the read-only PVC,
|
|
verify integrity/all five transactional tables and resume the unchanged receiver
|
|
in finally. Lock overlap and preserve private failure evidence. Package SQLite
|
|
and its capture receipt only, age-encrypt once, publish through platform's
|
|
immutable email-connect archive profile, and require version/hash readback before
|
|
advancing success. Reviewed retries reuse ciphertext without another pause.
|
|
No SMTP password, ingest token, scanner mailbox or provider message body belongs
|
|
in this archive. Tests use only synthetic records and no production endpoints.
|
|
|
|
## T02 — Prove isolated recovery preserves delivery and challenge state
|
|
|
|
```task
|
|
id: EMAIL-WP-0007-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "c8acba6d-1087-5ffd-a7e6-59608c07c1ff"
|
|
```
|
|
|
|
Add attended guarded decrypt/unpack and all-table/schema/row fingerprint checks.
|
|
Exercise current packaged service under UID10001/network-disabled conditions
|
|
with synthetic recovered SQLite. Accepted sends/verifications replay without a
|
|
provider call; unknown outcomes remain blocked; suppression and consumed/cancelled
|
|
links remain effective. A historical snapshot can lose newer reservations or
|
|
revive a handle consumed after capture: production recovery must freeze delivery,
|
|
reconcile post-capture operations/issuer state and explicitly invalidate/reconcile
|
|
challenges before releasing traffic. Never auto-restore into a running service.
|
|
|
|
## T03 — Admit the independent primary caller and retention custody
|
|
|
|
```task
|
|
id: EMAIL-WP-0007-T03
|
|
status: wait
|
|
priority: high
|
|
needs_human: true
|
|
intervention_note: "Platform must admit the separate email-connect archive prefix, caller delivery, retention/capacity, independently retained receipts and recovery escrow; shared uploader support alone is not custody admission."
|
|
state_hub_task_id: "680fe4d6-12af-5296-acf9-15c9a01a0db3"
|
|
```
|
|
|
|
Platform profile: platform-pg/application-archives/email-connect/ in the current
|
|
Scaleway primary bucket. Request a separately scoped caller; do not copy another
|
|
workload's Secret or inherit its write/delete authority. Worker has only public
|
|
age recipient, no escrow identity or retained-object deletion rights. Bind the
|
|
platform hash-locked SDK runtime and separate recovery/retention owner. RPF-WP-0053-T05
|
|
tracks admission; founder continuation authorizes source preparation, not an
|
|
invented owner review or credential grant.
|
|
|
|
## T04 — Complete the admitted first run, recovery and monitoring
|
|
|
|
```task
|
|
id: EMAIL-WP-0007-T04
|
|
status: wait
|
|
priority: high
|
|
needs_human: true
|
|
intervention_note: "Needs T03 admission and the exact first receiver pause/upload/schedule decision; real offsite retrieval, attended recovery and failure reception remain unproved."
|
|
state_hub_task_id: "66401e5c-a5cf-5e67-beab-e503ae079964"
|
|
```
|
|
|
|
Present pinned source hashes, dry-run evidence, coherent ledger scope, bounded
|
|
pause and rollback/resume protocol before exact activation. First capture must
|
|
resume current service before encryption/upload. Independently retrieve/decrypt
|
|
with escrow and validate all rows/schema and no-send recovery behavior. Record
|
|
RPO/RTO and retained recovery point, then admit schedule and monitored failure
|
|
response. Temporary private release copies retain their existing custody until
|
|
the owner explicitly disposes of them; no expiry is implied here.
|
|
|
|
## Implementation evidence — 2026-10-08
|
|
|
|
Standalone scripts/capture-ledger.py, ledger_archive.py, backup-ledger.py and
|
|
rehearse-ledger.py plus four disabled unit candidates implement T01/T02. Full
|
|
email suite 120 passed with the local GreenMail harness, zero skips, including 19
|
|
new synthetic ledger cases. Actual age roundtrip and pinned receiver-image
|
|
rehearsal under UID10001/network none preserve all five tables/schema/rows and
|
|
verify accepted/unknown reservation and consumed/cancelled/suppression behavior
|
|
without provider calls. Isolated rehearsal is not live recovery acceptance.
|
|
|
|
Node server dry-run verifies current cluster/image/PVC, no-egress/no-secret helper
|
|
and replica-only guarded pause projection; receiver remains unchanged, no helper
|
|
created. All four units verify. Metadata-only check: email primary.env absent;
|
|
no credentials fetched/copied, live pause/capture/provider upload, deploy or timer
|
|
activation. Complete review: docs/ledger-backup-review-2026-10-08.md. Platform
|
|
admission handoff RPF-WP-0053-T05 is a live record, not an owner approval. T03/T04
|
|
remain wait for custody, retention/capacity, actual offsite/recovery and monitoring
|
|
plus the incident post-capture reconciliation gate. The workplan remains active.
|
|
|
|
## Receiver image/schema alignment — 2026-10-08
|
|
|
|
EMAIL-WP-0008-T04 deploys receiver eb3e7b68 (sourcec9756b0) in the admitted
|
|
single-caller mode. The ledger has caller_id/send-failure fields and caller_buckets.
|
|
Capture/rehearsal source helpers are repinned together to this digest; fingerprints
|
|
cover all six tables. Actual pre-release five-table backup migrates privately
|
|
with every existing row preserved, UID10001/network-none and no send. See
|
|
docs/caller-deployment-2026-10-08.md. This is image/schema alignment only: T03/T04
|
|
archive custody, first admitted offsite run/retrieval/application recovery and
|
|
monitoring stay waiting. CSOC-WP-0015-T03 is the product acceptance follow-up.
|
|
|
|
## Pair-custody preview — 2026-10-08
|
|
|
|
Founder admitted `backup-pair-writer` on 2026-10-08. The OpenBao policy is
|
|
installed and matches its source file. Version 1 of both backup-primary KV paths now exists, with both field names
|
|
set to a non-credential placeholder. The founder will enter the real pairs
|
|
as a new OpenBao UI version. The live bucket policy still allows only the
|
|
existing resource-control application under `platform-pg/*`. No real Scaleway
|
|
key, primary.env, receiver pause, upload or timer. T03/T04 stay wait. Review:
|
|
railiance-platform/docs/credential-lane-designs/application-backup-pair-custody-2026-10-08.md.
|