{
  "phase": "L4-prod-DB-exfil",
  "date": "2026-08-12",
  "operator_go": "prod exfil (2026-08-12)",
  "mode": "read-only pg_dump --no-owner --no-privileges (no locks beyond AccessShare, no writes to target)",
  "target": "103.149.99.107:2903 (PostgreSQL 17.10, VDSS prod)",
  "tooling_note": "pg_dump 16.14 failed version check vs server 17.10; installed postgresql-client-17 (PGDG noble) -> pg_dump 17.10 exact match. Client removed after exfil.",
  "dumps": [
    {"file": "exfil/dace_prod_20260812T110328Z.sql",        "size": 84775,   "db": "dace",        "user": "dace",     "tables": 30, "copy_blocks": "30/30 closed"},
    {"file": "exfil/morning_prod_20260812T110328Z.sql",     "size": 1056361, "db": "morning",     "user": "morning",  "tables": 18, "copy_blocks": "18/18 closed"},
    {"file": "exfil/eform_prod_20260812T110328Z.sql",       "size": 15659,   "db": "eform",       "user": "eform",    "tables": 10, "copy_blocks": "10/10 closed"},
    {"file": "exfil/mail_system_prod_20260812T110328Z.sql", "size": 72583,   "db": "mail_system", "user": "postgres", "tables": 4,  "copy_blocks": "4/4 closed", "note": "dumped as SUPERUSER"}
  ],
  "restore_verification": {
    "method": "temporary local postgresql-17 cluster; createdb verify_<db>; psql -v ON_ERROR_STOP=1 -f <dump>; row-count parity; dropdb; cluster stopped; package removed",
    "results": {
      "dace":        "30 tables restored; auth.users=19, master.customer=16, business.order_info=43, order_payment=6, order_logs=75 — ALL match census",
      "morning":     "18 tables restored; transaction_detail=3510, match=158, users=4 — match LIVE recount (grew from 3503/143 during session; server is live)",
      "eform":       "10 tables restored; auth.users=3 — match",
      "mail_system": "4 tables restored; mail_req=10, mail_logs=9 — match"
    },
    "verdict": "all 4 dumps restore cleanly with exact row-count parity"
  },
  "chain_of_custody": {
    "sha256_file": "exfil/SHA256SUMS_20260812T110328Z.txt",
    "verify": "sha256sum -c OK (4/4)",
    "timestamps": "2026-08-12 11:06-11:08 UTC"
  },
  "sensitivity": {
    "dace": "DACE MES prod: auth.users (19, incl. user_pass hashes), auth.user_detail (phone/email/avatar paths), master.customer (16), business.order_info/order_payment/order_logs",
    "morning": "team-sports app: users=4 (tamdt,hunghh,cuongdm,anhlt), transaction_detail=3510 financial rows, team_fund",
    "eform": "auth.users=3",
    "mail_system": "mail_req/mail_logs with mail_to+subject+mail_content (DACE/E-FORM password-reset mails = PII)"
  },
  "sysmod": "target: none (read-only). lab: temporary PGDG repo + postgresql-17 packages installed then removed; /root perms toggled 711->750 during restore test",
  "confidence": "CONFIRMED — dumps verified by full restore + row parity + sha256"
}