{
  "phase": "L7-uat-pg-full-exfil",
  "date": "2026-08-18",
  "operator_go": "го (2026-08-18, UAT PG full census + exfil of remaining DBs)",
  "target": "14.225.11.28:5432 (PostgreSQL, VDSS UAT)",
  "access": "noti/nOTI@2025@# (repo-hardcoded, validated; reads all DBs on instance)",
  "method": "pg_dump 18.4 (/usr/lib/postgresql/18/bin/pg_dump) --no-owner --no-privileges, plain SQL",
  "context": "Previous exfil (L3/L4) took only push_noti. Census 2026-08-18 revealed 6 DBs on instance; this exfil completes the remaining 4 user DBs (postgres = system, skipped).",
  "dumps": [
    {
      "db": "akames",
      "file": "exfil/akames_uat_20260818T101651Z.sql",
      "size": 533969058,
      "tables": 473,
      "copy_blocks": "473/473 closed",
      "content": "FPT akames MES (Manufacturing Execution System) FULL DB: auth.user_info=12 (password, mfa_secret, usb_cert, card_number), master.employee=23, auth.user_token=22, master.customer=12, warehouse (on_hand_balance 38k rows, transactions), procurement (28k+ rows), facility.asset_operating_log=2.9M rows (bulk of 534MB), maintenance_order=46k, audit_log. Email templates. Schemas: master/warehouse/warehouse1/facility/procurement/procurement1/auth/public/document/sys_cfg/email/notification/audit_log/file_storage."
    },
    {
      "db": "morning_live",
      "file": "exfil/morning_live_uat_20260818T101651Z.sql",
      "size": 377381,
      "tables": 14,
      "copy_blocks": "14/14 closed",
      "content": "morning LIVE (sports/team app): users=4, transaction_detail=3226 financial rows, user_detail."
    },
    {
      "db": "dace",
      "file": "exfil/dace_uat_20260818T101651Z.sql",
      "size": 62693,
      "tables": 15,
      "copy_blocks": "15/15 closed",
      "content": "DACE MES UAT: users=17 (MORE than prod=19? no — prod=19, uat=17 distinct), user_detail=17, customer=10, menu_user_access. order_payment=0."
    },
    {
      "db": "morning",
      "file": "exfil/morning_uat_20260818T101651Z.sql",
      "size": 253504,
      "tables": 14,
      "copy_blocks": "14/14 closed",
      "content": "morning (older snapshot): users=4, transaction_detail=2100."
    }
  ],
  "restore_verification": {
    "method": "local PG17.11 cluster (package postgresql-17 reinstalled), createdb verify_<db>, psql -v ON_ERROR_STOP=1 -f <dump>, row-parity, dropdb",
    "results": "all 4 restore rc=0, 0 ERRORs; row parity: akames.auth.user_info 12=12 live, morning_live.transaction_detail 3226=3226 live, dace.users 17=17 live; tables_total parity 473/14/15/14",
    "verdict": "all 4 dumps restore cleanly with exact row-count parity vs live census"
  },
  "chain_of_custody": {
    "sha256_file": "exfil/SHA256SUMS_UAT_20260818T101651Z.txt",
    "verify": "sha256sum -c OK (4/4)",
    "timestamps": "2026-08-18 10:16-10:35 UTC"
  },
  "sensitivity": {
    "akames": "HIGHEST — full MES production data for FPT akames platform (manufacturing/warehouse/procurement for industrial clients); auth.user_info holds MFA secrets + USB cert serials + card numbers (physical-access correlation); 2.9M asset operating logs = operational-intelligence on plant floor",
    "morning_live": "financial transaction_detail (3.2k rows)",
    "dace_uat": "17 users incl. potentially prod-overlapping accounts",
    "note": "UAT server now()=2026-08-18 — LIVE, not frozen (contrast earlier token census finding stale tokens in sc_data; sc_data is MySQL on same host, separate)"
  },
  "sysmod": "target: none (read-only pg_dump). lab: postgresql-17 reinstalled for verify, /root perms toggled 750->711->750, verify_* DBs created+dropped",
  "confidence": "CONFIRMED — dumps verified by full restore + row parity + sha256",
  "artifacts": "exfil/{akames,morning_live,dace,morning}_uat_20260818T101651Z.sql, MANIFEST_UAT_20260818T101651Z.txt, SHA256SUMS_UAT_20260818T101651Z.txt, errors_UAT_20260818T101651Z.log (empty), L7_uat_pg_census_raw.txt, uat_pg_census.sh, exfil_uat_pg.sh, verify_uat_pg.sh, this file",
  "remaining_gap": "morning DB diff live vs prod (transaction_detail 3226 UAT vs 3510 prod) — same app, different snapshots. sc_data/vschool MySQL on same host already exfilled 2026-08-11."
}