[LIghtJUNction]

Task A, stacked on #112 — C is the only merger

Refs #64, #65, #68, #69, #70, #84, #85. This increment is intentionally not issue closure, production promotion or deployment.

Base: #112 512bb9b1e163151d66b94a5bc26f4b3cc6415070, already incorporating main@67401759a853c69fc5cb234982e1f7020b650542. Independent branch: fix/task-a-recovery-hardening-20260928. Published source 88c1da3e7d3a2055682c9cd3d9083f52ff5159a6, tree ff7c49364227b9d2a0e4fabdcdbe4208c811c094 exactly equals the locally tested tree. No original #112/C/B branch was pushed or force-pushed. C may serially integrate the narrow patches or merge #112 first and retarget this increment; do not concurrently merge either branch.

Actual fixes

• [P1] 托管历史密文恢复与在线/备份旧钥退役 #68: verify the original server-signed challenge and exact old/new signing/encryption key bindings even with an empty retained inventory. Retired/replaced active targets and revoked old signers fail closed. Preserve the actual v1 phase during the identity switch rather than assuming v2 already activated the target. Existing Fix custodial history migration, scoped decrypt ACKs and online key retirement #100 A/B history lifecycle, signed revision bytes and separate online/backup retirement remain.
• 存量 CA 权限差异、旧服务账号退役与本机操作验收 #70: serialize Root preparation/completion using a protected no-follow 0600 lock. Read bounded regular private envelopes with owner/mode/link-count checks. Validate existing historical files and trust consistency before committing authority changes; preserve fix: recovery evidence, persistent restore quarantine and root rotation integrity (#68–70) #112 v2 journal binding and crash re-entry. No new console bypass or grant expansion.
• [P1] 一致备份恢复后重放撤销与退役事实 #69 partial implementation: an independently pinned Ed25519 checkpoint contract and atomic, idempotent deny-only replay for token/credential/certificate/share/member/signing-key/encryption-key/vault retirement facts. Pin service/key/full digest/sequence must come from outside the restored database. Repeated calls reapply all facts, not trust a rolled-back cached receipt. Missing/mismatched/gapped/backward evidence rolls back and stays quarantined. Actual PostgreSQL backend termination verifies crash rollback/retry. Public Python entry enforces the existing physical-console boundary.
• 实际入口与日志收集链的秘密泄露核验 #64/确认旧 LedgerAccount/escrow 存量是否仍适用；适用时验证隔离迁移 #65/生产容量与适用快照、独立授权检查点及隔离恢复记录 #84: standalone read-only preflight, no Application/DDL initialization, no DSN/receipt leakage; reuse legacy reference/conservation validators, report public CA inventory digests and required field evidence. Empty installation and missing real evidence explicitly remain blocked; command exits 2.
• fix: recovery evidence, persistent restore quarantine and root rotation integrity (#68–70) #112 semantic intersection, narrow C-owned test handoff: keep the original exact live permission-denied and notification-clipping assertions; restore the actual PG/Git/CAS backup, prove the same inputs persisted, prove revoked and independently live share sources separately, and strictly deny all four external adapters/discovery/communication/worker while quarantine persists. No production Authorizer/worker bypass or deleted test.

Files / interfaces

Independent modules: src/msg/admin/recovery_replay.py, admin/preflight.py, security/root_files.py; small changes to security/custodial_migration.py, plugins/custodial_lifecycle.py, admin/rotation.py; strict packaged checkpoint schema/example; four tests/test_task_a_* modules. The only shared test patch is tests/test_authorization_recovery_boundaries.py, for C's serial review. No shared model/DDL/executor/application/config/bootstrap/CLI/Registry/worker/CI changes.

Details: docs/TASK_A_RECOVERY_20260928.md.

Verification so far — final target CI required

• TDD: empty-history binding regression 9 failed / 1 passed before fix; Root file/race regression 5 failed before fix; fix: recovery evidence, persistent restore quarantine and root rotation integrity (#68–70) #112 restore semantic test 1 failed before repair. New checkpoint/preflight tests failed on missing implementations first.
• Final focused combined run on the exact tree above: 58 passed, 0 failed/errors/skipped in Python 3.13.5 / actual PostgreSQL 17.11 / age 1.2.1 / Git, including crash/retry/concurrent replay and protected Root file races. This is NOT the required target-environment final gate.
• Entire current core collection: 1,399. Do not use the historical 1,244 count. Final head must pass the unchanged four-shard exact node-ID/JUnit gate, all conformance and wheel/sdist under Python 3.15 / PostgreSQL 16 / Valkey 9.
• Publication run 36400846976 only verified transport SHA-256 and exact tested tree before a normal fast-forward push. It is not test CI. Auxiliary asset/publication workflows and encoded transport are absent from this functional branch and PR diff.

Explicit remaining blockers

This replay slice does not implement a complete current ACL/TopicBan/policy authority snapshot or controlled production promotion; it never clears quarantine and always reports promotion blocked. Source/currentness of the independent pin is an operator evidence requirement, not self-certified by a database flag or hash chain. No external backup-retirement attestation means no complete server-key-retired claim.

Real #64 proxy/CDN/APM/log-chain materials, #65/#84 protected production snapshot/inventory/capacity evidence, and #70 physical-console/legacy-CA transition approvals are unavailable and remain open/blocked. #103 bank fund/market migration received source-only cross-review, not combined final-head or field acceptance. No production Root/PIN/keys, data restoration/deletion, real funds, mail or other outbound endpoints were used.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-28T09:07:07.059723Z	88c1da3	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[LIghtJUNction]

串行集成 #118 已创建，保留本PR与#112全部production blobs/提交历史；head905712a73f74d0a87956d781b717e757cf124d0b。另叠加#115/#117的独立缓存/邮件防护，并修复本head全量CI36401032045的两个精确失败，未动您的分支或削弱quarantine。

market_recovery保留live阶段原有签名证据/ACL断言；restore后比较原始业务行、实际blob字节/digest，外部读取精确recovery_quarantined，写入精确writes_paused，worker不领取且所有状态不变。nonconsole测试按真实uid断言OS-admin或console的第一个门槛，非“任意失败均过”。

#118必须另跑目标完整四分片/node-ID/conformance/build/recovery并复验actual main；本PR原CI failure不被改称成功。#69全面政策重放/promotion及全部现场证据继续blocked，本增量只refs。

[LIghtJUNction]

已通过串行组合 #118 实际进入 main，非放弃本PR：main=45fe2382c63d21eef2f76d4f59141111f7d5713c，保留 905712a... 的第二父 c97a5286...，所以本PR全部提交历史已包含。实际main tree=1a8a28f467183ccab029625b0524ae5c5b7f115f，与完整CI36404029543通过tree一致，1544 core+8 conformance、4份provider SHA/JUnit node-ID逐一核对、0失败/错误/跳过、wheel/sdist，Recovery safety36404029733成功。精确head Codex review完成、无线程。

本PR原全量CI的两项失败已在#118保留原证据/权限断言并修复，不把原失败运行改称通过。因本PR仍以旧#112分支为base，现手动关闭为“已纳入#118”，不再重复merge旧分支。所有现场前置、#69完整当前政策/promotion与#85其余范围继续open，未做生产操作。