diff --git a/workplans/RPF-WP-0053-coulomb-paired-backup-admission.md b/workplans/RPF-WP-0053-coulomb-paired-backup-admission.md index e5e5539..6b5024f 100644 --- a/workplans/RPF-WP-0053-coulomb-paired-backup-admission.md +++ b/workplans/RPF-WP-0053-coulomb-paired-backup-admission.md @@ -1,14 +1,14 @@ --- id: RPF-WP-0053 type: workplan -title: "Admit coherent coulomb-social offsite backup and recovery" +title: "Admit Coulomb paired archives and independent email-ledger recovery" domain: financials repo: railiance-platform status: proposed owner: codex topic_slug: coulomb-social created: "2026-10-07" -updated: "2026-10-07" +updated: "2026-10-08" state_hub_workstream_id: "cb55e474-c7a5-5c6f-bd72-ce65f853e3e3" --- @@ -97,7 +97,7 @@ state_hub_task_id: "871c14da-2940-5be6-8ce8-953973422064" Founder ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED, plus explicit primary archive creation/version-read authority. Proposed UTC daily03:15 -(+up to5min jitter), RPO target24h, hourly stale threshold26h, provisional +(+up to 5min jitter), RPO target24h, hourly stale threshold 26h, provisional RTO target60min for an admitted attended restore. These are proposal targets, not measured promises. First capture/upload is bounded and app resumes before encryption/upload. Retrieve using the independently retained public receipt, @@ -135,3 +135,40 @@ prepared execution package; owner identity acceptance remains open. T02/T03 rema wait for custody/admission and exact activation; no timer installed/enabled and no productive ciphertext uploaded. Email-connect's separate transport profile is not ledger capture/recovery coverage; CSOC-WP-0010-T04/T05 own that residual. + +## T05 — Admit the independent email-connect ledger archive caller + +```task +id: RPF-WP-0053-T05 +status: wait +priority: high +needs_human: true +intervention_note: "EMAIL-WP-0007 has tested capture/recovery tools; platform must admit its separate email-connect primary prefix/caller, retention/capacity, independent receipts and escrow before first live capture/upload or timer activation." +``` + +Consumer EMAIL-WP-0007 implements default-preview quiesced SQLite backup, stable +age sealing, verified primary publication and attended isolated recovery. Its +email-connect profile is separate from Coulomb/Barman: +platform-pg/application-archives/email-connect/. Review packet: +email-connect/docs/ledger-backup-review-2026-10-08.md. No SMTP or ingest credential +belongs to the backup worker. Candidate delivery: root-owned mode 0600 +/etc/email-connect-backup/primary.env (parent mode 0700), only owner-delivered +AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY. Metadata-only node check: file absent. +Do not copy the databases backup Secret or Coulomb caller, widen ESO admission, +or give publisher retained-object/version-delete or age escrow authority. + +Bind appropriately prefix-scoped provider authority and current custody front +door; existing CCR-2026-0012 is a coordinate, not this consumer's grant. Use the +reviewed hash-locked platform backup runtime. Admit independent receipt/key/image +recovery and ledger growth/headroom, local/provider generation retention and +compatibility with existing 30-day lifecycle. Provisional daily 04:15 UTC, RPO 24h, +stale 26h, RTO 60min need owner acceptance; they are not measured promises. + +The SQLite snapshot preserves state only at capture. A later provider submission +or challenge consume/cancel can be lost by restoring an older point. Production +incident recovery must fence caller/outbox/challenge traffic and reconcile the +post-capture window with user-engine/identity/provider owners before release; +never auto-enable a recovered receiver or resend an unknown outcome. Exact +first pause/upload/schedule, actual offsite/recovery proof and failure reception +remain EMAIL-WP-0007-T04/CSOC-WP-0010-T04/T05 obligations. Current receiver image +and SMTP/sender/caller admission remain unchanged by source preparation.