[zibi-pplx]

Allow a managing-organization administrator to approve publication of an already sealed, validated retained full suspend when ordinary historical publisher authority is unavailable. Bind approval to artifact/generation, capture evidence, exact logical manifest, stable metadata, uploader incarnation, and current sandbox state, for at most 24 hours.

Begin permits one active attempt. Ready validates uploaded logical/object evidence and consumes the approval atomically. Expiry, revocation, changed state, or supersession prevents Ready while allowing failure reporting. An explicit approval takes precedence over an older failed registration. A consumed grant never becomes ordinary retry authority, including after attempt pruning, and an older registration cannot bypass that requirement. A larger abandoned generation without materialization is not itself supersession. Ready/revoke races serialize through the sandbox lock.

Issuance defaults off until all readers and workers enforce the contract. The admin routes do not seal captures, enqueue uploads, clear quarantine, change placement, or wake a VM. Preserve original retained bytes; use independently owned staging copies. Grant-aware readers and retained audit schema are rollback floors after issuance. The administrator attests source validation; worker hashes are not independent attestation against a compromised uploader. See docs/backup-recovery.md for the outcome matrix and rollout contract.

Validation: the full internal API nextest inventory passed all 389 tests with zero skips; real RPC/TokenReview/live-pod/PostgreSQL cases cover expiry, revocation, wrong proofs/objects, changed state, successor materialization, abandoned successors, exact replay, failure/retry, and Ready/revoke concurrency. The compressed-versus-logical byte-count regression failed before correction. All 228 admin tests passed, including authorization and the rollout gate; sealed-manifest validation, SQL audit constraints, and refreshed OpenAPI snapshot pass. Workspace all-target/all-feature Clippy and affected aarch64 Linux musl compilation/lint pass. Public diff review and Gitleaks passed.

Stack (land in order): #318 schema → #319 materialization ownership → #345 backup caller identity → #346 upload evidence → #283 retained-artifact recovery.

Rebuilt against d1abc66fe48bccaaa715e09593f875f7c6c4d11d. The schema is separate because current CI requires migration-only PRs. All existing PRs are reused.

Scope boundary: no file overlap with #828 (2a4988b6), #829 (1b696768), or #837 (58ceff04). Both compositions—#828+#829 and #837+#829—passed aarch64 Linux musl Clippy and all 98 selected snapshot/teardown tests each. These are component tests, not live Firecracker recovery evidence. Capture, encrypted sealing, teardown handoff, and source cleanup remain with those workstreams. Linux/KVM held-volume recovery, manager-restart/handoff failure, and live restore of the same artifact have not been validated here; issuance must remain disabled until that deployment evidence exists.

AI assistance: Codex contributed implementation, tests, and this description.

[zibi-pplx]

Implemented the agreed admission and recovery contract. Strict ordinary retries require prior registration for the exact artifact and verified worker incarnation; first registration after retirement stays refused. Compatibility remains the default and cannot mint trusted historical UIDs. Grant-backed attempts are excluded from ordinary retry authority in every state. Capture freshness and registration liveness are separate.

The explicit managing-admin recovery operation binds a sealed full artifact, generation, uploader incarnation, capture time, stable metadata, and logical file proofs. Grants expire, are revocable, permit one active attempt, and are consumed atomically at Ready. Begin, heartbeat, replay, and finalize revalidate authority; finalize also checks proof drift and successor state. Issuance defaults off. The shadow scanner and registration share decision code; its result remains advisory, with identity coverage, inventory completeness, and writer rollout separate gates.

Prerequisites are separate draft PRs for encrypted file admission (#344), retained/live-verified TokenReview identity (#345), schema (#318), identity writers (#319), and durable logical upload proofs (#346). The recovery lifecycle and all 250 internal API tests passed. Broad checks passed apart from a gateway TLS timeout independently reproduced on the base revision; the four initial lifecycle fixture failures now pass.

Still outside this implementation: repairing incomplete encrypted-device captures, credential-vending policy changes, and live Linux/KVM restore evidence. This remains draft and does not enable enforcement or perform production recovery.