INFINBOT — NATIVE RECOVERY AND REAL EXTERNAL TOKEN CHECK
2026-10-13 | Isolated software evidence; owner Mac execution pending

FILES INSTALLED BY install_infinbot.py USING FILE IO, NOT LONG TERMINAL PASTES
  /Users/bpa/ForesixaQuant/test_backup_recovery.py
  /Users/bpa/ForesixaQuant/verify_keychain_token.py
The package installer preserves originals in private/code-backups and copies only
source files. It does not create/reset a ledger, alter credentials or edit LGC terms.
Its Python 3.10+ requirement is for the full package. The standalone backup script
uses only standard-library modules and requires no venv or provider connection.

RUN ON YOUR MAC AFTER INSTALLATION
python3 /Users/bpa/ForesixaQuant/test_backup_recovery.py
This preserves the existing historical filename qzotic_pure_sandbox.db. No rename
or replacement ledger is performed. If the correct current source has another name,
select it explicitly:
python3 /Users/bpa/ForesixaQuant/test_backup_recovery.py --db-path /absolute/path/current.db

The default schema is exactly the requested enterprise profile:
enterprise_portfolio, ingestion_journal, autonomous_resolution_rules,
remediation_lifecycle, notification_outbox.
If the selected trading ledger has a different schema, it remains blocked; do not
initialize tables or seed mock records to make this test pass. Identify the actual
application and required schema first. Explicit --required-table flags support a
documented alternate profile. No profile is inferred from a filename or symbols.
The consolidated runner uses these same defaults, or an existing explicitly
configured backup_required_tables list; it never rewrites the host config.

WHAT IS ACTUALLY VERIFIED
Source opened with mode=ro and query_only; no source write/checkpoint issued.
One source read transaction pins the schema/count snapshot, including committed
WAL pages visible at its start. Backup writes only into an owned private temporary
directory. Only the temporary destination is converted to a standalone file.
All destination handles close before cold mode=ro reopening. Full integrity_check,
foreign_key_check, declared table presence, schema hash and required row counts are
reconciled against the pinned source. Source readers close and temporary files and
their sidecars are removed. Bounded timeout is configurable up to 60 seconds.
WAL readers can coexist with writers. A pinned reader may briefly hold back WAL
checkpoint progress; rollback-mode writers can wait on the bounded read lock.
Concurrent independent source writes are expected and are not undone by this test.
The test does not claim complete application recovery, retained archive correctness,
offsite durability, scheduler execution, production clearance or 100% reliability.
The separately encrypted archive recovery test remains a distinct acceptance check.

SQLITE CLARIFICATION
An open SQLite connection normally reads committed WAL pages. The concern is a
naive main-file-only copy or a stale/incomplete snapshot, not integrity_check simply
ignoring WAL. SQLite backup creates a coherent snapshot; it need not flush the source
WAL. Integrity checking also does not detect foreign-key errors by itself.
References checked 2026-10-13:
https://sqlite.org/wal.html
https://sqlite.org/backup.html
https://sqlite.org/pragma.html

TOKEN CHECK (NO FAKE PASS FROM A FILE OR DOCUMENT EXISTING)
python3 /Users/bpa/ForesixaQuant/verify_keychain_token.py
This uses an already configured INFINBOT_HMAC_KEYCHAIN_SERVICE or
INFINBOT_HMAC_TOKEN_FILE. Otherwise it reports missing evidence and exits 1.
Select the actual existing service or owner-private token file explicitly:
python3 /Users/bpa/ForesixaQuant/verify_keychain_token.py --keychain-service YOUR_EXISTING_SERVICE_NAME
python3 /Users/bpa/ForesixaQuant/verify_keychain_token.py --token-file /absolute/private/existing-token
Choose one source. No secret is an argument; secret stdout remains internal.
The token checker rejects the disclosed placeholder and unsafe file permissions,
loads the external token and performs a local HMAC roundtrip. It does not prove
system-wide purge, external revocation, entropy or actual production-consumer use.
It never treats DATAMINE_ACCEPTANCE.txt existence as token authentication or infers
Keychain use from a missing vault file. Existing differently named private vaults
can be selected explicitly; no historical vault path is renamed or copied.
Both commands emit scoped JSON results with nonzero exit status for missing evidence.
Share only a redacted status/blocker summary; never upload credentials or the ledger.
