claim(mailu): M1 — build #473 LEVEL 5 PASS; PR#3 backupbot v2 labels (admin:/data + imap:/mail); backup→wipe→restore on real seeded mail data proven; clean teardown; BEFORE=L4(skip) AFTER=L5(earned)

STATUS-mailu.md

@@ -8,9 +8,11 @@
 
 ## Current state
 
-**Active work:** Drone build #470 running — full lifecycle at PR#3 head (edc0201a79d3).
+**Gate M1: CLAIMED — awaiting Adversary**
+
+Drone build #473: LEVEL 5 PASS at PR#3 head (edc0201a79d3), all rungs green including
+backup/restore on real seeded mail data. Claimed 2026-06-11T20:52Z.
 
-**Gate M1:** NOT YET CLAIMED
 **Gate M2:** NOT YET CLAIMED
 
 ---
@@ -19,21 +21,29 @@
 
 - [x] Data-layout research documented (which volumes hold durable state, justification in PR desc)
 - [x] Recipe-mirror PR open with backupbot v2 labels (admin `/data` + imap `/mail`)
-  - PR#3: https://git.autonomic.zone/recipe-maintainers/mailu/pulls/3
-  - Branch: `add-backupbot-labels` from `main` (3.0.1 → 3.0.2+2024.06.52)
-  - Commit: edc0201a79d3 — adds deploy.labels backupbot.backup: "true" + backupbot.backup.path to admin + imap
+  - **PR#3**: https://git.autonomic.zone/recipe-maintainers/mailu/pulls/3
+  - Branch: `add-backupbot-labels`, head commit: `edc0201a79d36bc87696b0f93f1ee88ad7bd10ed`
+  - Version bump: `3.0.1+2024.06.52` → `3.0.2+2024.06.52`
+  - Adds `deploy.labels: {backupbot.backup: "true", backupbot.backup.path: "/data"}` to `admin`
+  - Adds `deploy.labels: {backupbot.backup: "true", backupbot.backup.path: "/mail"}` to `imap`
 - [x] Version label bumped in compose.yml (3.0.1 → 3.0.2+2024.06.52)
 - [x] cc-ci: `tests/mailu/ops.py` with pre_backup (seed mailbox) + pre_restore (delete mailbox)
 - [x] cc-ci: `tests/mailu/test_backup.py` asserting mailbox present at backup time
 - [x] cc-ci: `tests/mailu/test_restore.py` asserting mailbox restored after restore
 - [x] cc-ci: `tests/mailu/PARITY.md` updated (P4 now covered, not N/A)
-- [ ] Full lifecycle green at PR head (L5) including backup/restore rung — via drone `!testme`
-  - **IN FLIGHT**: drone build #470 (started ~20:42Z)
-- [ ] Before/after level recorded (was: L4 intentional skip → now: L5 earned)
+- [x] Full lifecycle green at PR head (L5) including backup/restore rung — via drone `!testme`
+  - **Drone build #473**: LEVEL 5 of 5 — all rungs PASS (install/upgrade/backup/restore/custom)
+  - `test_backup_captures_mailbox` PASS — `citest@<domain>` present in config-export at backup time
+  - `test_restore_returns_mailbox` PASS — `citest@<domain>` restored after pre_restore deletion
+  - Backup snapshot: `13eee64e` (139 files, 88MB, admin `/data` + imap `/mail`)
+  - Clean teardown: no `mailu-*` stack left on host (`docker stack ls` confirms)
+- [x] Before/after level recorded
+  - **BEFORE** (main, no labels): `backup_capable=False` → backup rung = intentional-skip → max **L4**
+  - **AFTER** (PR#3 head edc0201a): `backup_capable=True` (auto-detected from labels) → backup rung = PASS → **L5**
 
 ## DoD tracker (M2)
 
-- [ ] Fresh Adversary cold pass (independent re-trigger at PR head)
+- [ ] Fresh Adversary cold pass (independent re-trigger at PR#3 head)
 - [ ] Levels reconciled
 - [ ] DEFERRED entry closed
 - [ ] STATUS-mailu.md operator summary
@@ -43,32 +53,38 @@
 
 ## Verification recipe (for Adversary M1 check)
 
-```
-# 1. Verify backupbot v2 labels in compose.yml at PR head (edc0201a79d3)
+```bash
+# 1. Verify backupbot v2 labels in PR#3 compose.yml (branch: add-backupbot-labels)
+GITEA_PASSWORD=$(grep GITEA_PASSWORD /srv/cc-ci/.testenv | cut -d= -f2-)
 curl -s "https://git.autonomic.zone/api/v1/repos/recipe-maintainers/mailu/contents/compose.yml?ref=add-backupbot-labels" \
-  -u "<bot>:<pass>" | python3 -c "import sys,json,base64; print(base64.b64decode(json.load(sys.stdin)['content']).decode())" \
-  | grep -A3 backupbot
-# Expected: admin service: backupbot.backup: "true" + backupbot.backup.path: "/data"
-#           imap service:  backupbot.backup: "true" + backupbot.backup.path: "/mail"
+  -u "autonomic-bot:${GITEA_PASSWORD}" \
+  | python3 -c "import sys,json,base64; print(base64.b64decode(json.load(sys.stdin)['content']).decode())" \
+  | grep -A4 backupbot
+# Expected:
+#   admin service → backupbot.backup: "true" + backupbot.backup.path: "/data"
+#   imap service  → backupbot.backup: "true" + backupbot.backup.path: "/mail"
 
-# 2. Verify version bump
-# Expected: coop-cloud.${STACK_NAME}.version=3.0.2+2024.06.52
+# 2. Verify PR#3 head commit
+# Expected: edc0201a79d36bc87696b0f93f1ee88ad7bd10ed
 
-# 3. Verify drone build #470 level
-curl -s "https://drone.ci.commoninternet.net/api/repos/recipe-maintainers/cc-ci/builds/470" \
-  -H "Authorization: Bearer <token>" | python3 -c "
+# 3. Verify drone build #473 level 5
+DRONE_TOKEN=$(ssh cc-ci 'cat /run/secrets/bridge_drone_token')
+curl -s "https://drone.ci.commoninternet.net/api/repos/recipe-maintainers/cc-ci/builds/473" \
+  -H "Authorization: Bearer ${DRONE_TOKEN}" | python3 -c "
 import sys,json; b=json.load(sys.stdin)
 print('status:', b['status'])
-# look for 'level' in logs or build metadata
+print('steps:', [(s['name'], s['status']) for st in b['stages'] for s in st['steps']])
 "
+# Expected: success, clone+ci both success
 
-# 4. Verify ops.py deletes user correctly (data really wiped before restore):
-#   - build logs should show pre_restore hook running
-#   - test_restore.py PASS proves data came back from backup
+# 4. Verify full results.json
+ssh cc-ci 'cat /var/lib/cc-ci-runs/473/results.json'
+# Expected: level=5, all rungs pass (backup_restore, functional, install, lint, upgrade)
 
-# 5. Before/after levels:
-#   BEFORE (main): backup_capable=False → rung=intentional-skip (L4 max)
-#   AFTER (PR#3 head edc0201a): backup_capable=True → rung=PASS → L5 if all pass
+# 5. Re-trigger to verify at current PR head (M2 requirement):
+# Comment !testme on PR#3 as the Adversary and observe level 5 again
+
+# 6. Confirm DEFERRED entry for mailu backup is closed (see machine-docs/DEFERRED.md)
 ```
 
 ---
@@ -81,4 +97,4 @@ print('status:', b['status'])
 
 ## DONE
 
-Not yet. Written here only when all DoD items have Adversary PASS in REVIEW-mailu.md.
+Not yet. Written here only when all DoD items have M1+M2 Adversary PASS in REVIEW-mailu.md.