# Legacy reuse protection register

Owner instruction, 2026-09-09: check what the new Sibyla reused from Legacy so it is not lost,
and remember that boundary for subsequent cleanup. This register supersedes any broader removal
wording in `legacy-retirement-260909.md`. Nothing was removed during this audit.

**Execution update, 2026-09-09 12:26 UTC:** following the owner's explicit `execute`, the narrowed
application retirement completed. All 17 protected paths, four protected databases and three enabled
Hermes jobs remain; the jobs' latest recorded statuses were `ok`. Installed certificates and shared
renewal scheduling remain. The old account is disabled with its SID/profile preserved. See the
[completed execution record](legacy-retirement-260909.md). These protections remain in force.

## Confirmed live dependencies to retain

| What is reused | Evidence checked on 2026-09-09 | What must remain |
|---|---|---|
| Legacy email triage implementation | Enabled Hermes cron `apollo-email-gateway` (`c92c908053df`) calls `scripts/sibyla_email_gateway_runner.py`; that wrapper invokes `C:\SibylaApps\Documental-agent\scripts\graph_email_gateway.py` with `Documental-agent` as its working directory. Last observed run 12:11:32 UTC, status `ok`. | The wrapper, `Documental-agent`, Graph script, and **`config/email_gateway.example.yaml`**: despite its name, it is the script's runtime default configuration. |
| Microsoft Graph credential source and Python runtime | Both the retained triage script and the new `apollo_email_intake.py` load the Hermes `.env`; the wrapper runs Hermes's existing Python environment with `msal`, `requests`, and `yaml`. | Administrator's `%LOCALAPPDATA%\hermes\.env`, `hermes-agent\venv`, and Graph credentials/permissions. Do not revoke these merely because Legacy also used them. No secret values are recorded here. |
| New intake's durable state, alongside the reused triage | Enabled `apollo-email-intake` (`25c3ac4615bf`) last ran 12:10:31 UTC, `ok`. Code uses `state/apollo-email-intake.json`, `cache/documents/email-intake`, `plugins/apollo-channel-intake/client.py`, and `safe_document_links.py`; no path overrides were found in the checked `.env`. | Hermes home, intake ledger, attachment cache, plugin, link-policy support, credentials and sender bindings. Deleting the ledger can repeat terminal work; deleting the cache can lose pending attachments. |
| Existing backup machinery | Enabled `backup-diario-hermes-gitlab` (`d3696db1dd50`) last ran 03:01:36 UTC, `ok`. `hermes_backup_runner.py` invokes `C:\SibylaApps\SibylaMem\scripts\hermes_backup.py`. | `SibylaMem`, the wrapper, Hermes runtime and backup credentials/repository. The whole `C:\SibylaApps` parent must never be a cleanup target. |
| Existing agent/tool installations | The deployed Web configuration and its protected configuration file reference Hermes's existing `hermes.exe`; deployed `AiHarness:GitExecutablePath` references `hermes\git\cmd\git.exe`. | The entire active Hermes installation, profiles, plugins, Git, credentials and state; agent directories such as `Apolo-agent` are excluded from Legacy application retirement. |
| Existing identity service | Protected Web configuration identifies `https://login.gottsolutions.net`; live IIS serves it from `C:\SibylaApps\IdentityServer`. Current app clients are distinct from the already-retired intake client. | IdentityServer, `gott_identity`, current clients/scopes/signing keys, certificates and renewal infrastructure. Do not remove the shared `sibyla.channel-intake.write` scope because its name predates the new application. |
| Existing Nextcloud service | Current Main has one enabled `NEXTCLOUD` storage connection with a credential reference and stored status `Ok`. The new WebDAV provider is implemented in current source. | Nextcloud service/data, access credentials and stored objects; current storage metadata and CREDST. This was a configuration read, not a new provider-operation test. |
| Existing Cegid service and integration knowledge | Main has one enabled `CEGID_IZIBIZI` connection with a credential reference and stored status `Ok`. `IzibiziErpProvider.cs` explicitly records the authentication/session contract verified against Legacy's `CegidApiClient`. | ERP connection/account and credential material; the current provider code and its settings. This is a ported contract in the new implementation, not a DLL dependency on the old Web/API binaries. |
| Sender authorization previously adopted from Legacy | Channel-intake specification records the owner-directed transfer of the existing sender list. The new service resolves through its current bindings, not the old channel-intake plugin. | Current sender bindings and their provenance/seed artifacts. Do not re-delete users/bindings by their old names during identity cleanup. |

Job results above are read-only observations of existing cron records. No email job, backup job,
provider push or extraction was triggered as part of this audit.

## Data and recovery dependencies to retain even without an active reader

- `D:\fileStorage\SibylaDocuments`, Nextcloud archives, original files, and migration evidence.
  An absence of active connections does not establish that old documents have been safely replaced.
- `D:\SibylaData\Keys\Cegid`, `.\GottSibylaDocumental`'s SID/profile and retained-data ACLs.
  These are recovery dependencies; current Web/worker use **different** Data Protection keys at
  `D:\ApolloData\dp-keys`. Keep both key sets, not just the newer one.
- `D:\ApolloData` (current keys, staging and AI work), `C:\ProgramData\Sibyla\secrets`,
  `C:\Apps\Sibyla` (current releases and Claude tool), Main `gott_sibyla`, and Preview
  `gott_sibyla_preview`. Naming changes do not make these legacy assets.
- `gott_sibyla_legacy`: **retain pending an explicit data-disposition reconciliation**.
  Discovery-plan D10 contains an explicit 2026-09-05 re-amendment restoring full corpus/PDF
  handover, whereas later implementation notes repeat the earlier no-document-carryover boundary.
  This audit does not choose a migration policy or import anything. The earlier proposed database
  drop is withdrawn until the current owner decision, preserved records and recovery are reconciled.
- `D:\fileStorage\repos\invoice-skill-build` and its source/archive paths: the accounting source
  and C6 authority transition are a separate workstream, not old Web/API application cleanup.
- `legacy/` in this repository and archived GitLab project `gott-sibyla-legacy`. The archived maintenance branch contains
  deployed hotfixes absent from legacy main; four preserved stashes contain otherwise-local work.
  A supplementary ZIP now preserves all 3,926 checkout files absent by path/content from the
  two source ZIPs, including `.git` and ignored files. The remaining 680 files match those ZIPs.
  See `legacy/README.md` for the restricted archive location, checksum and restoration manifest.
  All archive members verified. The owner subsequently explicitly authorized deletion of the exact
  `D:\fileStorage\repos\GOTT.Sibyla.Legacy` checkout. It was removed at 12:45:30 UTC on 2026-09-09,
  after rechecking the recovery archives and all 4,606 source files. Its source/history protection
  now rests with the retained source ZIPs and restricted supplementary archive/manifest/ACL export.
  The remaining 16 protected paths and live services passed postchecks; no database was modified.
- `D:\Backups\SibylaRetirement\20260909-120359` and other recovery backups. Application retirement
  does not approve purging evidence, dumps, certificates, profiles or source history.

## What this audit found about the proposed application deletions

Current `.csproj` references all point within the new source tree; none references the archived
legacy project. The checked current deployment configuration and operational script/plugin paths
did not reference `gott_sibyla_legacy` or `Sibyla.PdfTextExtractor`; PDF helper references found
in Hermes were historical deployment instructions. Current extraction uses the separately installed
Claude tool at `C:\Apps\Sibyla\tools\claude\claude.exe`.

Main database read-only checks found zero foreign servers and zero public view/function source
references to `gott_sibyla_legacy`. These checks support absence of an identified runtime dependency;
they do **not** prove historical data is disposable or cover every possible external consumer.

The four old application directories, three old IIS site/pool definitions and three legacy-only
renewal IDs were subsequently removed under the owner's narrowed execution authorization.
That authorization does not extend to additional targets. Shared certs, the win-acme task, IdentityServer, dashboard,
agents, Postiz, Buzz and their data are excluded. The source behind legacy Docs remains preserved
in the source/recovery archives following the separately authorized checkout deletion above.

## Durable cleanup rule

`local/legacy-retirement-protection.json` is the machine-readable keep list, and root `AGENTS.md`
requires future work to consult it and this register before any legacy retirement. A name such as
`legacy`, `Sibyla`, `Documental`, or `example` is never sufficient evidence for deletion.

Before removing or disabling anything, trace its caller, credentials, keys, data and recovery
dependencies; check the proposed literal target against the keep list, including ancestor paths;
and stop if it intersects a protected path or unresolved database. Only narrow application targets
with reviewed evidence can return to an execution proposal. Do not run functional email or ERP
operations merely to test whether a retained dependency is live.

Sources: live Hermes cron definitions and named scripts; deployed release `20260908-222415-9cbea5d`;
protected configuration paths (values redacted here); read-only Main metadata; `legacy/README.md`;
`docs/apollo-channel-intake-api-spec.md`; `docs/apollo-discovery-and-plan-260826.md` D10;
`src/Sibyla.Platform.Infrastructure/Erp/IzibiziErpProvider.cs`.