D5: an app restore works from the drive alone (v0.188.0)

The recovery unit on the customer's drive now carries the PORTABLE secret
class, so Tier-1/Tier-2 restore no longer depends on the whole-guest tier.
A customer needs the drive and nothing else.

Part 0's rulings overturned the brief's recommendation, on evidence:
- the data_key flag is untrustworthy (4+ encryption keys the catalog itself
  labels as such are unflagged) -> R-127
- a DB password is not resettable in practice: POSTGRES_PASSWORD is ignored
  once PGDATA is non-empty, so a regenerated value leaves the app unable to
  authenticate against its own restored rows while the dump replay still
  reports success (proven on a throwaway postgres:16-alpine)

Ruling (operator): type:secret travels, type:password never does, minus the
nonPortableSecrets code register. Plaintext -- withholding the internet-
reachable class is what licenses that, and the two are coupled.

Precedence: the UNIT WINS over the guest -- the unit's secrets were captured
in the same run as the dumps beside them, so they match the data being
restored. The fail-closed data-key gate is unchanged.

Secret values are never logged; the manifest records NAMES only.

controller/internal/appbackup/appdata.go

@@ -28,10 +28,10 @@ type StackDataProvider interface {
 	StopStack(name string) error
 	StartStack(name string) error
 	RefreshAndIsRunning(name string) bool
-	// GetStackRecoveryInfo returns the data needed to capture a SECRET-FREE recovery unit
-	// (Phase 2): the stack dir, pinned image tags, the non-secret env, and the NAMES of the
-	// secret/data-key env vars (values are NEVER returned — they are recovered at restore time
-	// from the guest's own app.yaml, live or via the PBS whole-guest snapshot). ok=false if the
+	// GetStackRecoveryInfo returns the data needed to capture a recovery unit: the stack dir,
+	// pinned image tags, the non-secret env, the NAMES of the secret/data-key env vars, and (D5)
+	// the decrypted VALUES of the portable class. A WITHHELD secret's value is never returned —
+	// it is recovered at restore time from the guest's app.yaml, or regenerated. ok=false if the
 	// stack is unknown.
 	GetStackRecoveryInfo(name string) (RecoveryInfo, bool)
 
@@ -62,17 +62,27 @@ type StackDataProvider interface {
 	GetStackClassifiedBinds(name string) ([]ClassifiedBind, bool)
 }
 
-// RecoveryInfo carries everything needed to write a secret-free recovery unit for a stack.
-// It deliberately holds NO secret values — only the names of secret/data-key env vars, so the
-// manifest can record what must be recovered from elsewhere (guest app.yaml / PBS) without the
-// unit ever storing a secret or a data-encrypting key.
+// RecoveryInfo carries everything needed to write a recovery unit for a stack.
+//
+// D5: it now carries the VALUES of the PORTABLE secret class (stacks.PortableSecretEnvVars — every
+// `type: secret` field bar the nonPortableSecrets register), because a Tier-1/2 restore that depends
+// on the guest for a data-encrypting key or a DB password is not independent of the guest at all: the
+// data sits safely on the drive and cannot be read back. The EXCLUDED class (`type: password` admin
+// logins) is still name-only and never leaves the guest.
 type RecoveryInfo struct {
 	StackDir       string            // dir holding docker-compose.yml + .felhom.yml + app.yaml
 	DisplayName    string            // app display name
 	ImagePins      []string          // pinned image tags from compose `image:` lines (re-pulled on restore)
-	NonSecretEnv   map[string]string // env with all secret/password/data-key values removed (plaintext only)
-	SecretEnvVars  []string          // NAMES of stripped secret/password fields (recovered from guest/PBS)
+	NonSecretEnv   map[string]string // env with ALL secret/password values removed (plaintext only)
+	SecretEnvVars  []string          // NAMES of every secret/password field
 	DataKeyEnvVars []string          // NAMES of data-encrypting-key fields (fail-closed gate on restore)
+	// PortableSecretEnvVars are the NAMES of the secrets that travel in the unit (D5), and
+	// PortableSecrets their DECRYPTED values. A name present here but absent from PortableSecrets was
+	// unset/empty in the guest's app.yaml — the restore's fail-closed gate decides what that means.
+	// Never logged, never in the manifest's value space: the values reach disk only inside the unit's
+	// 0600 app.yaml.
+	PortableSecretEnvVars []string
+	PortableSecrets       map[string]string
 }
 
 // ParseComposeImages extracts the pinned image references (`image: repo:tag`) from a

controller/internal/appbackup/paths.go

@@ -40,9 +40,10 @@ func PrimaryBackupPath(nsRoot string) string {
 // RecoveryUnitPath returns the per-app self-contained recovery-unit ROOT under a namespace root.
 // It is the existing per-app backup dir (`backups/primary/<stack>/`) — the legacy name is kept so the
 // db-dumps/ and volume-dumps/ already written there need no migration; the unit gains compose/ and
-// manifest.json as siblings, making the whole dir a complete, recreatable unit (Phase 2). The unit is
-// secret-free: secrets/data-keys are recovered from the guest's own app.yaml (live or via PBS), never
-// stored here. See backup.recoveryUnit / restore for the capture + restore flow.
+// manifest.json as siblings, making the whole dir a complete, recreatable unit (Phase 2). Since D5 the
+// unit's compose/app.yaml CARRIES the portable secret class (data keys, DB passwords, internal signing
+// secrets) at mode 0600, so a Tier-1/2 restore needs the drive and nothing else; internet-reachable
+// admin logins are still withheld. See backup.recoveryUnit / restore for the capture + restore flow.
 func RecoveryUnitPath(nsRoot, stackName string) string {
 	return filepath.Join(nsRoot, "backups", "primary", stackName)
 }