From 3694d6284aa85b8f6d8fd34fda4d03eee356762b Mon Sep 17 00:00:00 2001 From: codex Date: Sun, 11 Oct 2026 21:06:38 +0200 Subject: [PATCH] Record round-3 attended-window choices (backup prefixes, coulomb-social backup, drill owner) Co-Authored-By: Claude Opus 5.5 --- .../2026-10-11-security-unblock-decisions.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/docs/decisions/2026-10-11-security-unblock-decisions.md b/docs/decisions/2026-10-11-security-unblock-decisions.md index 36bfd736..e4f6cf03 100644 --- a/docs/decisions/2026-10-11-security-unblock-decisions.md +++ b/docs/decisions/2026-10-11-security-unblock-decisions.md @@ -87,3 +87,22 @@ not decisions. restore/restart drill receipt and expired retention windows.** - The State Hub primary stop and the core-hub cutover follow the standing change rule. - Hall of Helix publication is not covered. It stays with consent decision `8a095daa`. + +## Round 3 — attended-window choices (2026-10-11) + +- **C1, RPF-WP-0038-T04, Forgejo primary backup:** prefix + `s3://railiance-platform-pg-backup/platform-pg/application-archives/forgejo/` (same bucket contract + as coulomb-social, Standard Multi-AZ nl-ams). Retention is 7 daily + 4 weekly + 3 monthly full + archives through bucket lifecycle, never deleting the newest good archive. Nextcloud becomes the + essentials-only secondary (about 273 MiB) within the 10 GiB budget. The worker gets a prefix-scoped + credential. +- **C2, RPF-WP-0053-T02/T03, coulomb-social paired backup:** approved as proposed. A new + prefix-scoped Scaleway IAM credential (write and version-read under + `application-archives/coulomb-social/` only) is delivered to `/etc/coulomb-social-backup/primary.env` + (0600, parent 0700). Schedule: daily 03:15 UTC (+5 min jitter), RPO 24 h, stale alarm 26 h, + provisional RTO 60 min. Acceptance needs the independent retrieve + restore comparison. +- **C4, NK-WP-0022-T08 drill:** the railiance01 restore/restart drill is blue-lane. Sol prepares and + runs it. The approved D4 deletion batch goes into the attended window only once a passing drill + receipt exists. +- **USER-WP-0035-T02** was not a founder choice. The mail lane exists (EMAIL-WP-0004). The remaining + work is user-engine's setup-link delivery handoff, so it was returned to the owner.