2 Commits

Include renames

Author	SHA1	Message	Date
bvandeusenandClaude Opus 5.5	87e8f8f777	docs(6205): last id-less stories in services — a ported-from project name and two "this milestone" references ... backup_s3 says what its signing is checked against instead of which of the operator's projects it was ported from; rulebooks and shape_check state what the code is for rather than which milestone it belonged to. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-21 20:35:04 -04:00
bvandeusenandClaude Opus 5.5	ff4f2ee5c2	feat(523): backup destinations - a folder or an S3 bucket, with the S3 secret sealed and kept out of backups ... services/backup_s3.py is FabledSteward's SigV4 client ported (put + list, never delete, so an append-only key is enough), with its tests against AWS's published signatures. services/backup_destination.py holds the admin config (backup_config JSON) and delivers a dated tar to a mounted folder or a bucket, and checks either without sending a backup. services/secrets.py seals the S3 secret with Fernet under a key derived from SECRET_KEY; backup._SETTINGS_NOT_EXPORTED keeps it out of every backup. cryptography becomes a direct dependency (already in the image through pyjwt). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-15 17:31:08 -04:00