# AquaArchive Implementation Plan Document (IPD)
**Version:** 1.0 Draft | **Date:** 2026-10-28 | **Status:** Proposed gated plan

## 1. Current posture
Project context records Phase 3.40 independent review as **HOLD**; Phase 3.41 remediation has been requested but is not independently verified. Historical checksum provenance and backup recoverability are **NOT VERIFIED**. Recheck current files before acting. No remote migration, rollback, reset, or deployment is authorized.

## 2. Workstream A: Requirements and architecture
1. Review PRD, TRD, AFD, DBD, BSD, and IPD.
2. Reconcile roles, sync states, photo taxonomy, report status, and identifiers.
3. Confirm ADR-01: Workers with Static Assets as intended hosting/API model.
4. Confirm ADR-02: Worker as sole API gateway; Supabase as data platform.
5. Confirm ADR-03: `sites` vs `site_coordinates`.
6. Confirm ADR-04: temporary tag, client UUID, permanent code.
7. Confirm ADR-05: independent object backup and recovery.
**Gate:** owner-approved documents and ADRs, conflicts resolved or recorded.

## 3. Workstream B: Phase 3.41 local remediation
1. Inspect current tree and all pending changes before editing.
2. Inventory changed files and preserve unrelated work.
3. Resolve conflicting migration instructions, including any obsolete `supabase db push` route.
4. Replace sequential multi-migration blocks with per-file stop, verification, and owner-approval gates.
5. Correct backup/recovery claims; distinguish database dump from object backups and restore evidence.
6. Extend read-only health checks for relevant `SECURITY DEFINER` `search_path`.
7. Improve checksum preflight without fabricating historical reports or approval records.
8. Inspect package scripts before tests; run only reviewed local, non-destructive checks.
9. Produce file inventory, exact test commands/results, hashes, unresolved findings, and explicit no-remote-operations statement.
**Gate:** no stronger than READY FOR INDEPENDENT RE-AUDIT.

## 4. Workstream C: Independent audit
- Recheck migration routes across README, RUNBOOK, staging plan, owner guide, and scripts.
- Confirm one migration per gate and no hidden remote operations.
- Verify function configuration, grants, RLS, coordinate isolation, and test coverage.
- Review backup inventory, checksums, restore process, and isolated restore evidence.
- Verify checksum provenance is accurately stated.
**Gate:** written independent review; HOLD is not cleared automatically.

## 5. Workstream D: Backup and recovery
1. Validate database dump readability and checksum.
2. Document schema/data and relevant roles/grants coverage.
3. Inventory stored objects with size and checksum.
4. Verify independent copies of original photos and official PDFs.
5. Run isolated restore drill against disposable database and storage targets.
6. Compare counts, checksums, relationships, and restore duration.
**Gate:** owner-approved recovery evidence. Until then, status is NOT VERIFIED.

## 6. Workstream E: Staging migration, blocked pending authorization
Before remote DDL: written owner authorization for exact operation/time window; out-of-band project identity check; verified TLS; read-only baseline; verified backup/recovery plan; approved exact command. Execute one migration only, inspect resulting state read-only, then stop for review before the next. Never use rollback as routine recovery. This document grants no authorization.

## 7. Workstream F: Application deployment
Complete local build, typecheck, tests, security review, and environment/secret review. Prepare a separate deployment plan and obtain explicit owner approval. Database migration approval does not imply application deployment approval.

## 8. Milestones
| Milestone | Deliverable | Gate |
|---|---|---|
| M0 | Current-state inventory | No edits until status understood |
| M1 | Six-document draft set | Owner review |
| M2 | Phase 3.41 remediation | Independent re-audit |
| M3 | Independent audit | Findings and owner decision |
| M4 | Backup/restore evidence | Recovery approved |
| M5 | Migration runbook | Explicit staging authorization |
| M6 | Per-file migration checks | Stop after each migration |
| M7 | Release review | Separate deployment approval |

## 9. Risks
- Conflicting migration paths → one canonical reviewed route.
- Accidental multi-file execution → one file per approval gate.
- Missing checksum history → mark NOT VERIFIED, do not fabricate.
- Database dump mistaken for full backup → verify object inventory and isolated restore.
- GUC mistaken for identity proof → out-of-band provider verification.
- Local test reaches remote target → inspect scripts and environment first.
- Coordinate leak → RLS and cache/log negative tests.
- Original evidence overwrite → immutable permissions and checksum verification.

## 10. Owner decision register
- [ ] Approve these documents as draft baseline.
- [ ] Confirm outstanding ADRs and role matrix.
- [ ] Confirm official PDF renderer.
- [ ] Approve backup RPO/RTO and object replication policy.
- [ ] Approve final migration runbook after independent audit.
- [ ] Separately authorize staging migration, if ready.
- [ ] Separately authorize application deployment, if ready.