Platform Deployment / Recovery Current Source Refresh — 2026-08-10¶
- Status:
CURRENT SOURCE-RECONCILED / DOCUMENTATION ONLY - Task:
CTC-CDOC-006 - Current source baseline reviewed:
master@8981a02f7b2a2fa256a7365d6921f3d7636f1fe2 - Queue creation baseline:
qa/master@44a8866954075787c3d3a696460a4b7c26484325 - Prior platform packet baseline:
qa/master@8e6614514b6e330f7efca60da68a162bb1de50db - Phase implementation:
USER HOLD - Environment/runtime/provider/backup/restore effects:
NOT AUTHORIZED / NOT RUN
1. Scope and authority¶
This refresh reconciles repository source and current documentation only. It does not establish installed service state, deployed SHA, current DB identity, provider connectivity, backup existence, restore success, or field acceptance.
Current-source precedence follows Appendix O and the Cloud queue:
current source
> accepted current business policy
> current source-reconciled packet
> historical packet/candidate
2. Current deployment units and repository owners¶
| Unit | Current repository owners / evidence | Source-grounded statement | Environment evidence still required |
|---|---|---|---|
| PHP Web/API | index.php, api/index.php, config/config.php, Apache/PHP production runbooks |
server-rendered PHP and /api/* are the current Web/API runtime; getReleaseSha() exposes bounded source identity |
active worktree SHA, PHP-FPM process generation, effective env/config, route reachability |
| MySQL | current KJDatabase consumers and DB rules |
current business persistence is MySQL; source does not prove backup/PITR/failover settings | exact endpoint/database, schema compatibility, snapshot/PITR state, restore target |
| File/Object Storage | current file metadata/storage helpers and T_FILE-based business links documented by source authority |
recoverability requires metadata plus the corresponding EFS-compatible/S3 object generation and readability | storage backend, inventory/checksum, version/snapshot state, object-to-metadata reconciliation |
| AI Voice Gateway | voice-gateway/src/*, voice-gateway/deploy/ctc-ai-voice-gateway.service, voice-gateway/deploy/ctc-ai-voice-gateway.conf, voice-gateway/deploy/ctc-ai-voice-gateway-php.conf |
separate Node service; public WebSocket path /voice/twilio-media; service source includes bounded /healthz |
installed unit/config, process identity, public proxy path, provider/tool connectivity, state-dir writability |
| Gateway retention scheduler | voice-gateway/deploy/ctc-ai-voice-retention.timer, paired service/script |
repository defines a 03:15 UTC persistent systemd timer | installed/enabled state, last run, failure backlog, release/env identity |
| Other schedulers | cron.php, HTTP cron/provider callback entrypoints, provider-specific scripts |
scheduler forms are mixed; repository presence is not execution proof | complete installed scheduler inventory, schedules/timezones, last success, overlap/disable/drain semantics |
| Public callbacks/webhooks | PHP callback/OAuth/webhook routes plus Voice Gateway proxy | callbacks share PHP deployment except Voice Gateway WebSocket proxy | external route reachability, signature/auth validation, last accepted callback, reconciliation state |
| Provider config/credential references | app/platform/tenant/config_helper.php and provider-specific consumers |
tenant provider secrets may be stored as SECRET.<KEY> encrypted envelopes and resolved at runtime |
key availability, credential-owner recovery route, provider reauthorization/reconciliation |
3. Release identity is multi-dimensional¶
These states MUST remain separate:
Git ref promoted
!= runtime applied
!= service live
!= service ready
!= business accepted
backup exists
!= restore verified
!= provider reconciled
Repository master movement proves only repository release state. window.CTC_RELEASE_SHA or service-local source identity can help identify runtime source, but neither proves config, schema, storage, scheduler, provider, or target-role readiness.
4. Tenant credential recovery contract¶
Current source in app/platform/tenant/config_helper.php establishes:
CTC_TENANT_SECRET_KEY
= base64-encoded 32-byte key material
tenant secret envelope
= enc:v1:<base64(nonce + tag + ciphertext)>
cipher
= AES-256-GCM
tenant_secret_decrypt() throws when compatible key material is unavailable and decryption fails when the key is incompatible.
Therefore:
Encrypted tenant provider credentials are not recoverable from the database backup alone. A recovery set that retains
SECRET.<KEY>ciphertext but loses the compatibleCTC_TENANT_SECRET_KEYcannot reconstruct those plaintext credentials.
Recovery must use exactly one approved path:
- restore compatible protected key material through the approved secret-recovery mechanism; or
- execute an owner-approved credential rotation/re-encryption procedure that replaces affected tenant secrets and reauthorizes/reconciles providers.
No document in this task treats raw secret values, ciphertext, or key material as ordinary evidence payload.
5. Recovery-set requirements¶
A recovery-capable inventory must account for all applicable components together:
| Recovery component | Required inventory | Why isolated backup is insufficient |
|---|---|---|
| MySQL | snapshot/PITR identity, timestamp, encryption reference, schema compatibility | DB alone cannot restore object bytes, service-local state, external config, keys, provider-side state |
| File/Object Storage | backend, object generation/version or snapshot, checksum/inventory, link/readability rules | object-only restore can create orphans; DB-only restore can create missing objects |
| Non-secret config | applied environment/config references, Apache/systemd installed config, deployment identity | source tree alone does not prove effective runtime values |
| Tenant encryption key recovery | protected key-material recovery reference or approved rotation/re-encryption procedure | encrypted SECRET.<KEY> rows are otherwise unreadable |
| Provider OAuth/credential recovery | credential owner, re-provision/reauthorize procedure, revocation/rotation path | provider authorization is external state |
| AI Voice Gateway local state | /var/lib/ctc-ai-voice-gateway inventory including transcript outbox where applicable |
host-local pending state can be lost on host replacement |
| Schedulers/timers | installed definitions, enabled/drained state, last run, re-enable order | restoring data while schedulers run can duplicate external effects |
| Logs/audit evidence | retention source and recovery expectations by evidence class | diagnostic logs, business transition evidence, and provider evidence have different authority |
| Provider reconciliation | provider identifiers, local references, pending/unknown outcomes, reconciliation owner | local restore does not recreate or undo external provider effects |
6. Safe restore sequence contract¶
identify isolated restore target
-> pin source/config/schema/recovery-set identities
-> restore DB and file/object generations
-> restore/re-provision non-secret config
-> restore compatible tenant secret key material OR execute approved rotation/re-encryption
-> restore/reconcile service-local durable state
-> keep schedulers/provider effects disabled
-> verify local referential/readability consistency
-> verify service liveness
-> verify service readiness
-> reconcile provider-side state and unknown outcomes
-> enable schedulers/providers in explicit owner-approved order
-> run selected target-role business canary
-> record restore verification and residual gaps
A restore is not verified merely because a process starts or a DB connection succeeds.
7. Observability and scheduler gaps retained as open¶
Current source supports diagnostics but does not prove a unified production observability contract, centralized service inventory, backup-age alerts, restore-rehearsal age, or universal readiness endpoint. Likewise, repository scheduler files do not prove installed/enabled/healthy state.
These remain OPEN / ENVIRONMENT EVIDENCE REQUIRED.
8. Current-source versus stale/historical findings¶
Current source facts¶
- PHP Web/API remains the current primary application runtime.
- the AI Voice Gateway is a separate Node service with repository-owned systemd/proxy configuration.
- the Voice Gateway has host-local persistent state/outbox semantics documented by current source authority.
- tenant provider credentials can use encrypted
SECRET.<KEY>storage. - compatible
CTC_TENANT_SECRET_KEYkey material is mandatory for decryption of encrypted tenant secrets.
Historical or non-authoritative as current environment proof¶
- prior packet/source-authority baselines remain useful reconstruction evidence but do not prove current deployed runtime.
- repository examples of production paths or auto-pull commands do not prove those definitions are installed or active.
- an archive copy or soft-delete state is not disaster backup.
- a source-controlled service/timer file is not proof that the service/timer is installed, enabled, or healthy.
9. No effects performed¶
No environment files were read. No DB/provider/storage/service/scheduler/backup/restore endpoints were accessed. No Runtime or infrastructure source was modified.
---¶
Source:
docs/reconstruction/PLATFORM_DEPLOYMENT_RECOVERY_CURRENT_SOURCE_REFRESH_2026-08-10.md— ctc repository · This page is an English translation of the source document. Identifiers, file paths and code symbols are unchanged.