Bind essentials recovery to explicit manifest and verified offsite provenance

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

scripts/scaleway_forgejo_archive.py

@@ -74,16 +74,20 @@ def main():
     fd=os.open(a.receipt,os.O_CREAT|os.O_EXCL|os.O_WRONLY,0o600);os.close(fd)
     def checkpoint(): a.receipt.write_text(json.dumps(receipt,indent=2)+'\n')
     try:
+        receipt['stage']='source_validation';checkpoint()
         source=json.loads(a.source_receipt.read_text())
         if (source.get('status')!='offsite_fetched_pending_isolated_restore'
                 or not a.source.name.endswith('.zip.age') or a.output.exists()
                 or not 0<a.source.stat().st_size<=20*1024**3
                 or source.get('ciphertext_sha256')!=digest(a.source)):
             raise ValueError('verified_source_required')
+        receipt['stage']='cluster_identity';checkpoint()
         k=['kubectl','--kubeconfig',a.kubeconfig];assert_cluster(k)
         # Existing governed databases delivery, captured only in process memory.
+        receipt['stage']='existing_credential_delivery';checkpoint()
         r=subprocess.run(k+['-n','databases','get','secret','platform-pg-backup-s3','-o','json'],capture_output=True,timeout=30,check=True)
         values=json.loads(r.stdout)['data']
+        receipt['stage']='client_setup';checkpoint()
         import boto3
         from botocore.config import Config
         client=boto3.client('s3',endpoint_url=ENDPOINT,region_name='nl-ams',
@@ -91,7 +95,8 @@ def main():
             aws_secret_access_key=base64.b64decode(values['ACCESS_SECRET_KEY']).decode(),
             config=Config(request_checksum_calculation='when_required',response_checksum_validation='when_required',signature_version='s3v4',connect_timeout=15,read_timeout=180,retries={'max_attempts':3},s3={'addressing_style':'path'}))
         transfer(client,a.source,a.output,receipt,checkpoint)
-    except Exception:
+    except Exception as error:
+        receipt['exception_type']=type(error).__name__
         receipt.update(status='failed',error='bounded_primary_archive_transfer_failed');checkpoint()
         return 1
     return 0