from pathlib import Path
import json,html
root=Path('/Users/bpa/Documents/Codex/2026-10-21/f')
p=root/'work/build_audit.py'
s=p.read_text().replace('superiority ambition','superiority target').replace('existing ambition','assigned target').replace('overall ambition','assigned target').replace('Defining “30% above the best” honestly','Measuring the assigned 30% performance target')
p.write_text(s)
p=root/'outputs/recovery/business-recovery-plan.html'
s=p.read_text().replace('from the cloud folder or independent server replica','from the cloud folder; server retrieval requires a separate approved recovery process')
a=s.index('<h2>Additional enterprise-server backup</h2>')
b=s.index('<h2>',a+5)
s=s[:a]+'''<h2>Additional enterprise-server backup: formal approval, storage only</h2>
<p>Follow ETV’s five-stage Blueprint: complete preflight; submit through the approved public intake link; host issues a payload-bound temporary token and isolated destination; enforce the absolute 600-second window; expire the token, link and dedicated connection. Every adjustment requires a new request. No connection, discovery probe or upload precedes formal approval.</p>
<p>This request permits storage of the named encrypted snapshot only. It prohibits server retrieval, downloads, listing, searches, deletion, overwrite, administration, payment activity and access to existing server data. The recovery key is excluded. A host-issued write acknowledgement may confirm the new object’s identifier, received bytes, checksum and durable commit; this is not permission for a separate read or status query.</p>
<p>The recovered ETV candidate provisions product/catalog folders. A general backup upload interface is not established by that evidence. The server owner must approve a storage-specific adapter, isolated destination, designated approver and intake route before activation. No product purchase or fabricated catalog item will be used to obtain storage access.</p>
<p>A separate authorized server custodian must test server recovery under a separately approved retrieval process. The present storage-only assignment does not authorize that test. Until a custodian provides evidence, server recoverability remains unverified.</p>
''' + s[b:]
p.write_text(s)
r={
'request_id':'FORESIXA-RECOVERY-STORAGE-20261021-01','status':'PREPARED — NOT SUBMITTED OR APPROVED',
'requested_by':'Enterprise audit and recovery workstream, on Founder instruction',
'purpose':'Additional enterprise-server copy of an encrypted recovery snapshot; storage only',
'blueprint_source':{'task_id':'6ab524cd-2884-83e9-847f-8b44ab1a1a02','durable_task_id':'01a15bf5-f38e-7657-a2a0-8e5861aa90c5','artifact':'Foresixa Storefront Blueprint v0.2 DRAFT, version 3','library_id':'libfile_89a31a855cd08191905d8b8eb39237bb','basis':'Founder five-stage instructions recovered from task; storage adaptation requires approval'},
'payload':{'name':'enterprise-20261021-01.fernet','bytes':1608332,'sha256':'debd3e629dac5f2c8d089f0045975477465fb598b805f99fd3e3566908191fb1','content':'66 files from partial enterprise chat, Page, Library and audit records','key_included':False},
'allow':['Create exactly one new encrypted backup object in a host-approved isolated destination','Receive the acknowledgement attached to that write'],
'deny':['Read or retrieve server data','List directories or objects','Download or search','Overwrite or delete','Administer server or change access controls','Access payment, trading or customer systems','Upload decryption keys','Probe the server before approval'],
'five_stage_workflow':['Preflight: owner verifies exact payload, hash, destination, approver and storage adapter','Public link drop: submit through approved intake; host issues token privately','Isolated destination: approved host adapter binds one token to this request and payload','Absolute deadline: enforce 600 seconds from complete-payload validation, before public exposure; never extend','Evacuation: revoke token, expire intake link and close dedicated connection; changes require a new request'],
'write_acknowledgement_required':['request_id','new_object_id','received_bytes','server_computed_sha256','durable_commit','acceptance_time_utc'],
'approval_fields':{'designated_approver':None,'approval_reference':None,'approved_intake_link':None,'isolated_destination':None,'storage_adapter_reference':None,'retention_and_capacity':None,'approved_at_utc':None},
'activation_blockers':['Approved intake link and designated approver have not been supplied or verified','Recovered product provisioner does not establish a storage-upload adapter','Approval and host-side controls must be confirmed before connecting'],
'recovery_test':'A different authorized custodian and separately approved retrieval request are required; no server restore is authorized here',
'benchmark_direction':'30% above leading comparable performance is the assigned target; measured attainment requires evidence, not a change in the target.'}
(root/'outputs/recovery/server-storage-access-request.json').write_text(json.dumps(r,indent=2))
body='<h1>Formal enterprise-server storage request</h1><p><strong>Prepared for approval — no server access performed.</strong></p><p>Request FORESIXA-RECOVERY-STORAGE-20261021-01. Purpose: store one additional encrypted enterprise recovery snapshot. No retrieval is requested.</p>'
for k,v in r.items():
 body+='<h2>'+html.escape(k.replace('_',' ').title())+'</h2><pre>'+html.escape(json.dumps(v,indent=2) if isinstance(v,(dict,list)) else str(v))+'</pre>'
(root/'outputs/recovery/server-storage-access-request.html').write_text('<!doctype html><html lang="en"><meta charset="utf-8"><title>Formal storage access request</title><style>body{font:16px/1.6 system-ui;max-width:960px;margin:40px auto;padding:20px;color:#172733}pre{white-space:pre-wrap;overflow-wrap:anywhere;background:#f2f5f5;padding:16px;font:14px/1.6 system-ui}h2{font-size:21px}</style>'+body+'</html>')
print('Updated target language, recovery protocol, and formal approval packet.')
