Prove credential recovery from an independent backup #5407

🤖 Generated by the Agentic Engineer

User Story

As a company Email operator,
I want an independent backup to be restored and its required credential records verified,
So that moving credential custody does not rely on an upload acknowledgement or a healthy storage claim alone.

Acceptance Criteria

• Provide a reviewed, dispatch-only verification workflow that refuses non-main execution before checkout or credential access, uses the protected production environment and shared deployment lock, and has only read repository permission.
• Read only the fixed backup and recovery inputs. Download an independently stored snapshot, enforce bounded private scratch storage, and require freshness from the repaired snapshot job for final recovery acceptance.
• Restore into an isolated, non-root, network-disabled instance matching the actual server version. Never restore to or modify the production service, its workloads, credentials or backup objects.
• Verify initialized and unsealed state and compare all required company Email credential records with their current originals. Missing, incomplete, mismatched, corrupted or stale evidence must refuse success.
• Exercise the actual pinned server in CI with synthetic snapshots, including successful restoration and meaningful failed-restore/record-mismatch cases. Keep all private content, recovery keys, raw responses and logs out of public output and artifacts; clean up owned runtime resources on every path.
• Pass exact-head validation and review, merge through protected delivery, then record the main-only production verification result before credential migration.

Part of #5376. The snapshot-job repair is #5406; neither a prepared replacement claim nor matching downloaded bytes closes the restore obligation.

Verified delivery — 28 October 2026

PR #5493 merged as 7c59ce2b6254082c6bf3d0d1da9f765b292b8d0a after current-head CI and review. Its protected deployment and default-branch validation passed.

The main-only recovery run completed successfully at that revision and printed exactly OPENBAO_BACKUP_RESTORE=PASS records=3 version=2.6.3. It downloaded the independent snapshot, restored the matching isolated server, compared all three current Email records, and verified sealing and unsealing with the matching recovery key. Production remained unchanged; private inputs and owned sandbox resources were cleaned up.

This completes the snapshot restore and record-comparison obligation. Retrieval of recovery credentials from their independent custody, credential migration, encrypted Email storage and service acceptance retain their own gates under #5376 and #5387.