From 1b9d44cfa7c092e9aa4bec99a0d29f6d025534f6 Mon Sep 17 00:00:00 2001 From: Your Name Date: Thu, 18 Jun 2026 09:11:39 +0800 Subject: [PATCH] =?UTF-8?q?feat(iwooos):=20=E6=96=B0=E5=A2=9E=E5=82=99?= =?UTF-8?q?=E4=BB=BD=E5=BE=A9=E5=8E=9F=E4=BA=8B=E6=95=85=E5=9B=9E=E8=AE=80?= =?UTF-8?q?=20gate?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- apps/web/messages/en.json | 2 +- apps/web/messages/zh-TW.json | 2 +- apps/web/src/app/[locale]/iwooos/page.tsx | 20 +- docs/LOGBOOK.md | 15 + .../iwooos_posture_projection_v1.schema.json | 135 + ...KUP-RESTORE-POST-INCIDENT-READBACK-PLAN.md | 127 + .../HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md | 9 +- .../IWOOOS-CONFIG-CONTROL-INVENTORY.md | 3 + docs/security/IWOOOS-POSTURE-PROJECTION.md | 12 +- .../SECURITY-SUPPLY-CHAIN-PROGRESS.md | 11 +- ...-post-incident-readback-plan.snapshot.json | 10936 ++++++++++++++++ ...alue-config-control-coverage.snapshot.json | 28 +- .../iwooos-posture-projection.snapshot.json | 29 + ...-04-15-MASTER-ai-autonomous-flywheel-v2.md | 2 + ...026-06-04-iwooos-security-governance-p0.md | 9 +- ...kup-restore-post-incident-readback-plan.py | 542 + .../high-value-config-control-coverage.py | 11 +- .../security/iwooos-config-control-guard.py | 47 +- .../security-mirror-progress-guard.py | 292 +- 19 files changed, 12199 insertions(+), 33 deletions(-) create mode 100644 docs/security/BACKUP-RESTORE-POST-INCIDENT-READBACK-PLAN.md create mode 100644 docs/security/backup-restore-post-incident-readback-plan.snapshot.json create mode 100644 scripts/security/backup-restore-post-incident-readback-plan.py diff --git a/apps/web/messages/en.json b/apps/web/messages/en.json index 5f8b0bd47..c8e93000d 100644 --- a/apps/web/messages/en.json +++ b/apps/web/messages/en.json @@ -18045,7 +18045,7 @@ }, "backupRestore": { "title": "備份 / 還原 / 金庫", - "body": "repo-only 清冊已納入 38 個 backup / restore / escrow / retention surface，且 owner response acceptance 已補 restore recovery、freshness SLO、隔離還原目標、遠端刪除保護、retention runway、credential recovery metadata-only 與 no-false-green backup health Gate；下一步仍需 owner 回覆、restore drill approval package、offsite / escrow owner、rollback owner、validation plan 與 no-secret-value evidence。" + "body": "repo-only 清冊、owner response acceptance、restore recovery、freshness SLO、隔離還原目標與事故後回讀計畫已納入 38 個 backup / restore / escrow / retention surface；目前只讀成熟度 66%，34 個必填回讀欄位、32 個 reviewer checks、11 條 outcome lanes、51 類 blocked action。backup status、restore drill、offsite sync、credential escrow non-secret proof、retention runway、backup health no-false-green、readback accepted、runtime gate 與 action button 仍全部為 0。" }, "monitoring": { "title": "監控與告警設定", diff --git a/apps/web/messages/zh-TW.json b/apps/web/messages/zh-TW.json index 5f8b0bd47..c8e93000d 100644 --- a/apps/web/messages/zh-TW.json +++ b/apps/web/messages/zh-TW.json @@ -18045,7 +18045,7 @@ }, "backupRestore": { "title": "備份 / 還原 / 金庫", - "body": "repo-only 清冊已納入 38 個 backup / restore / escrow / retention surface，且 owner response acceptance 已補 restore recovery、freshness SLO、隔離還原目標、遠端刪除保護、retention runway、credential recovery metadata-only 與 no-false-green backup health Gate；下一步仍需 owner 回覆、restore drill approval package、offsite / escrow owner、rollback owner、validation plan 與 no-secret-value evidence。" + "body": "repo-only 清冊、owner response acceptance、restore recovery、freshness SLO、隔離還原目標與事故後回讀計畫已納入 38 個 backup / restore / escrow / retention surface；目前只讀成熟度 66%，34 個必填回讀欄位、32 個 reviewer checks、11 條 outcome lanes、51 類 blocked action。backup status、restore drill、offsite sync、credential escrow non-secret proof、retention runway、backup health no-false-green、readback accepted、runtime gate 與 action button 仍全部為 0。" }, "monitoring": { "title": "監控與告警設定", diff --git a/apps/web/src/app/[locale]/iwooos/page.tsx b/apps/web/src/app/[locale]/iwooos/page.tsx index f06aa4140..8d1268027 100644 --- a/apps/web/src/app/[locale]/iwooos/page.tsx +++ b/apps/web/src/app/[locale]/iwooos/page.tsx @@ -2096,11 +2096,12 @@ const highValueConfigControlCoverageItems: HighValueConfigControlCoverageItem[] { key: 'sshNetwork', rank: 'P1-2', value: '64%', icon: Network, tone: 'warn' }, { key: 'aiProvider', rank: 'P1-3', value: '64%', icon: Cloud, tone: 'warn' }, { key: 'k8sGitops', rank: 'P1-4', value: '66%', icon: Workflow, tone: 'warn' }, + { key: 'backupRestore', rank: 'P1-5', value: '66%', icon: Database, tone: 'warn' }, ] const highValueConfigControlCoverageBoundaries = [ 'high_value_config_control_coverage_frontstage_summary_count=4', - 'high_value_config_control_coverage_frontstage_item_count=4', + 'high_value_config_control_coverage_frontstage_item_count=5', 'high_value_config_control_coverage_category_count=14', 'high_value_config_control_coverage_c0_category_count=8', 'high_value_config_control_coverage_c1_category_count=4', @@ -2362,6 +2363,23 @@ const highValueConfigControlCoverageBoundaries = [ 'backup_restore_owner_response_acceptance_restore_target_isolation_accepted_count=0', 'backup_restore_owner_response_acceptance_remote_delete_guard_accepted_count=0', 'backup_restore_owner_response_acceptance_backup_health_no_false_green_accepted_count=0', + 'backup_restore_post_incident_readback_plan_candidate_count=38', + 'backup_restore_post_incident_readback_plan_write_capable_candidate_count=27', + 'backup_restore_post_incident_readback_plan_live_evidence_required_candidate_count=38', + 'backup_restore_post_incident_readback_plan_required_readback_field_count=34', + 'backup_restore_post_incident_readback_plan_reviewer_check_count=32', + 'backup_restore_post_incident_readback_plan_outcome_lane_count=11', + 'backup_restore_post_incident_readback_plan_blocked_action_count=51', + 'backup_restore_post_incident_readback_plan_post_incident_readback_received_count=0', + 'backup_restore_post_incident_readback_plan_post_incident_readback_accepted_count=0', + 'backup_restore_post_incident_readback_plan_backup_status_readback_accepted_count=0', + 'backup_restore_post_incident_readback_plan_restore_drill_readback_accepted_count=0', + 'backup_restore_post_incident_readback_plan_offsite_sync_readback_accepted_count=0', + 'backup_restore_post_incident_readback_plan_credential_escrow_non_secret_readback_accepted_count=0', + 'backup_restore_post_incident_readback_plan_retention_runway_readback_accepted_count=0', + 'backup_restore_post_incident_readback_plan_backup_health_no_false_green_readback_accepted_count=0', + 'backup_restore_post_incident_readback_plan_runtime_gate_count=0', + 'backup_restore_credential_coverage_percent=66', 'monitoring_alerting_observability_inventory_surface_count=60', 'monitoring_alerting_observability_inventory_alert_rule_surface_count=13', 'monitoring_alerting_observability_inventory_deploy_or_reload_surface_count=6', diff --git a/docs/LOGBOOK.md b/docs/LOGBOOK.md index 72eac18cc..4ff1e503a 100644 --- a/docs/LOGBOOK.md +++ b/docs/LOGBOOK.md @@ -21,6 +21,21 @@ **邊界**：本段不送 Telegram、不寫 Gateway queue、不呼叫 Bot API、不寫讀報回執、不啟動排程、不啟動 AI analysis runtime、不啟動中低風險自動處理、不讀 secret、不新增批准或發送按鈕；不得把 dry-run rehearsal 解讀成 runtime gate 已開啟。 +## 2026-06-18｜Backup / Restore / Escrow 事故後回讀 Gate 本地收斂 + +**背景**：Backup / Restore / Escrow 不能只看「最新備份成功」、route `200`、dashboard up、alert quiet、textfile present 或 UI 可見。前一階段已把 owner response acceptance 補到 restore recovery / freshness / remote delete / retention / credential recovery / no-false-green，但仍缺事故後「誰動、何時動、改前改後 freshness、restore/offsite/escrow/retention 狀態、rollback、post-change monitoring 與防再發」的回讀欄位。 + +**完成項目**： +- 新增 `scripts/security/backup-restore-post-incident-readback-plan.py`、`docs/security/backup-restore-post-incident-readback-plan.snapshot.json` 與 `docs/security/BACKUP-RESTORE-POST-INCIDENT-READBACK-PLAN.md`。 +- Backup / Restore / Escrow post-incident readback plan 固定為 candidate `38`、write-capable `27`、live evidence required `38`、restore drill required `38`、offsite / escrow required `20`、retention / remote delete required `17`。 +- Readback fields `45`、required readback fields `34`、reviewer checks `32`、outcome lanes `11`、blocked actions `51`。 +- `backup_restore_credential` 只讀成熟度從 `64%` 推進到 `66%`；高價值配置平均成熟度維持 `71%`；needs-live-evidence 類別維持 `9`；IwoooS headline 維持 `64%`；active runtime gate 維持 `0`。 +- `/zh-TW/iwooos` repo 內前台 marker 已加入 `backup_restore_post_incident_readback_plan_candidate_count=38`、`blocked_action_count=51`、`backup_restore_credential_coverage_percent=66` 與 `runtime_gate_count=0`。 + +**邊界**： +- post-incident readback received / accepted、backup status readback accepted、restore drill accepted、offsite sync accepted、credential escrow non-secret proof accepted、retention runway accepted、backup health no-false-green accepted、backup run、restore run、offsite sync、remote delete、credential escrow marker write、retention change、secret collection、host write、production write、runtime gate 與 action button 全部仍為 `0 / false`。 +- 本階段未 SSH、未讀 live backup store、未跑 backup / restore / offsite sync、未 remote delete、未 restic prune、未寫 escrow marker、未改 retention、未跑 Velero、未 kubectl、未收 secret 明文、未 force push。 + ## 2026-06-16｜IwoooS CD / Runner / Secret 回讀 Gate 正式部署驗證 **背景**：上一段 CD / Runner / Secret 注入事故後回讀 gate 已完成 repo 內 artifact / guard / 前台 marker，但一度被 CD run `3071` 的 Docker build lock timeout 擋住，不能宣告 production 完成。後續另一個 Session 記錄 empty lock cleanup evidence，並以 `97b66a0e` 前端 locale commit 觸發正式 CD；本視窗只做只讀 Actions / production 回讀與 LOGBOOK 同步，未 SSH、未 Docker / host live write、未 workflow dispatch、未改 runner 或 repository secret。 diff --git a/docs/schemas/iwooos_posture_projection_v1.schema.json b/docs/schemas/iwooos_posture_projection_v1.schema.json index 3981a0af6..5bced5c0c 100644 --- a/docs/schemas/iwooos_posture_projection_v1.schema.json +++ b/docs/schemas/iwooos_posture_projection_v1.schema.json @@ -244,6 +244,33 @@ "backup_restore_escrow_inventory_action_button_count", "backup_restore_escrow_inventory_coverage_percent_before_inventory", "backup_restore_escrow_inventory_coverage_percent_after_inventory", + "backup_restore_post_incident_readback_plan_first_layer", + "backup_restore_post_incident_readback_plan_candidate_count", + "backup_restore_post_incident_readback_plan_write_capable_candidate_count", + "backup_restore_post_incident_readback_plan_live_evidence_required_candidate_count", + "backup_restore_post_incident_readback_plan_restore_drill_required_candidate_count", + "backup_restore_post_incident_readback_plan_offsite_or_escrow_required_candidate_count", + "backup_restore_post_incident_readback_plan_retention_or_remote_delete_required_candidate_count", + "backup_restore_post_incident_readback_plan_required_readback_field_count", + "backup_restore_post_incident_readback_plan_reviewer_check_count", + "backup_restore_post_incident_readback_plan_outcome_lane_count", + "backup_restore_post_incident_readback_plan_blocked_action_count", + "backup_restore_post_incident_readback_plan_post_incident_readback_received_count", + "backup_restore_post_incident_readback_plan_post_incident_readback_accepted_count", + "backup_restore_post_incident_readback_plan_actor_attribution_accepted_count", + "backup_restore_post_incident_readback_plan_before_after_freshness_accepted_count", + "backup_restore_post_incident_readback_plan_backup_status_readback_accepted_count", + "backup_restore_post_incident_readback_plan_restore_drill_readback_accepted_count", + "backup_restore_post_incident_readback_plan_restore_target_isolation_readback_accepted_count", + "backup_restore_post_incident_readback_plan_offsite_sync_readback_accepted_count", + "backup_restore_post_incident_readback_plan_offsite_remote_delete_guard_accepted_count", + "backup_restore_post_incident_readback_plan_credential_escrow_non_secret_readback_accepted_count", + "backup_restore_post_incident_readback_plan_retention_runway_readback_accepted_count", + "backup_restore_post_incident_readback_plan_backup_health_no_false_green_readback_accepted_count", + "backup_restore_post_incident_readback_plan_runtime_gate_count", + "backup_restore_post_incident_readback_plan_action_button_count", + "backup_restore_post_incident_readback_plan_coverage_percent_after_readback_plan", + "backup_restore_credential_coverage_percent", "monitoring_alerting_observability_inventory_coverage_percent_after_inventory", "monitoring_alerting_observability_inventory_coverage_percent_before_inventory", "monitoring_alerting_observability_inventory_action_button_count", @@ -1334,6 +1361,114 @@ "type": "integer", "const": 58 }, + "backup_restore_post_incident_readback_plan_first_layer": { + "type": "boolean", + "const": true + }, + "backup_restore_post_incident_readback_plan_candidate_count": { + "type": "integer", + "const": 38 + }, + "backup_restore_post_incident_readback_plan_write_capable_candidate_count": { + "type": "integer", + "const": 27 + }, + "backup_restore_post_incident_readback_plan_live_evidence_required_candidate_count": { + "type": "integer", + "const": 38 + }, + "backup_restore_post_incident_readback_plan_restore_drill_required_candidate_count": { + "type": "integer", + "const": 38 + }, + "backup_restore_post_incident_readback_plan_offsite_or_escrow_required_candidate_count": { + "type": "integer", + "const": 20 + }, + "backup_restore_post_incident_readback_plan_retention_or_remote_delete_required_candidate_count": { + "type": "integer", + "const": 17 + }, + "backup_restore_post_incident_readback_plan_required_readback_field_count": { + "type": "integer", + "const": 34 + }, + "backup_restore_post_incident_readback_plan_reviewer_check_count": { + "type": "integer", + "const": 32 + }, + "backup_restore_post_incident_readback_plan_outcome_lane_count": { + "type": "integer", + "const": 11 + }, + "backup_restore_post_incident_readback_plan_blocked_action_count": { + "type": "integer", + "const": 51 + }, + "backup_restore_post_incident_readback_plan_post_incident_readback_received_count": { + "type": "integer", + "const": 0 + }, + "backup_restore_post_incident_readback_plan_post_incident_readback_accepted_count": { + "type": "integer", + "const": 0 + }, + "backup_restore_post_incident_readback_plan_actor_attribution_accepted_count": { + "type": "integer", + "const": 0 + }, + "backup_restore_post_incident_readback_plan_before_after_freshness_accepted_count": { + "type": "integer", + "const": 0 + }, + "backup_restore_post_incident_readback_plan_backup_status_readback_accepted_count": { + "type": "integer", + "const": 0 + }, + "backup_restore_post_incident_readback_plan_restore_drill_readback_accepted_count": { + "type": "integer", + "const": 0 + }, + "backup_restore_post_incident_readback_plan_restore_target_isolation_readback_accepted_count": { + "type": "integer", + "const": 0 + }, + "backup_restore_post_incident_readback_plan_offsite_sync_readback_accepted_count": { + "type": "integer", + "const": 0 + }, + "backup_restore_post_incident_readback_plan_offsite_remote_delete_guard_accepted_count": { + "type": "integer", + "const": 0 + }, + "backup_restore_post_incident_readback_plan_credential_escrow_non_secret_readback_accepted_count": { + "type": "integer", + "const": 0 + }, + "backup_restore_post_incident_readback_plan_retention_runway_readback_accepted_count": { + "type": "integer", + "const": 0 + }, + "backup_restore_post_incident_readback_plan_backup_health_no_false_green_readback_accepted_count": { + "type": "integer", + "const": 0 + }, + "backup_restore_post_incident_readback_plan_runtime_gate_count": { + "type": "integer", + "const": 0 + }, + "backup_restore_post_incident_readback_plan_action_button_count": { + "type": "integer", + "const": 0 + }, + "backup_restore_post_incident_readback_plan_coverage_percent_after_readback_plan": { + "type": "integer", + "const": 66 + }, + "backup_restore_credential_coverage_percent": { + "type": "integer", + "const": 66 + }, "monitoring_alerting_observability_inventory_first_layer": { "type": "boolean" }, diff --git a/docs/security/BACKUP-RESTORE-POST-INCIDENT-READBACK-PLAN.md b/docs/security/BACKUP-RESTORE-POST-INCIDENT-READBACK-PLAN.md new file mode 100644 index 000000000..2c702abef --- /dev/null +++ b/docs/security/BACKUP-RESTORE-POST-INCIDENT-READBACK-PLAN.md @@ -0,0 +1,127 @@ +# IwoooS Backup / Restore / Escrow 事故後回讀計畫 + +| 項目 | 內容 | +|------|------| +| 日期 | 2026-06-18 | +| 狀態 | `post_incident_readback_plan_ready_no_runtime_action` | +| 工具 | `scripts/security/backup-restore-post-incident-readback-plan.py` | +| Snapshot | `docs/security/backup-restore-post-incident-readback-plan.snapshot.json` | +| 來源 | `docs/security/backup-restore-owner-response-acceptance.snapshot.json` | +| runtime gate | `0` | + +## 1. 目的 + +此計畫把 Backup / Restore / Escrow 的事故後回讀從「有備份狀態」推進成可重跑、可補件、可隔離、可拒收的只讀帳本。 + +它處理的風險不是替正式備份系統下指令，而是先定義未來 owner 必須提供哪些脫敏 ref，才能說明誰動了 backup / restore / offsite / escrow / retention，何時異常，改前改後 freshness 與 restore / offsite / retention 狀態如何，是否有隔離 restore target、credential escrow non-secret proof、rollback、post-change monitoring、recurrence guard 與 no-false-green 檢查。 + +本 artifact 不執行 backup、不 restore、不跑 offsite sync、不 remote delete、不寫 credential escrow marker、不改 retention、不 restic prune、不讀 rclone config、不跑 Velero、不 kubectl、不 SSH、不讀 secret value、不保存 raw backup listing、不保存 raw restore payload、不寫 production。 + +## 2. 固定數字 + +| 指標 | 數值 | +|------|------| +| readback candidate | `38` | +| write-capable candidate | `27` | +| live evidence required candidate | `38` | +| restore drill readback required candidate | `38` | +| offsite / escrow readback required candidate | `20` | +| retention / remote delete readback required candidate | `17` | +| required readback fields | `34` | +| reviewer checks | `32` | +| outcome lanes | `11` | +| blocked actions | `51` | +| post-incident readback received / accepted | `0 / 0` | +| runtime gate | `0` | + +## 3. 必填回讀欄位 + +每一個候選都必須補齊以下 metadata-only refs，才能進入 reviewer review： + +1. incident / change / outage ref。 +2. actor role / team attribution ref。 +3. change / outage time window ref。 +4. change intent 或 break-glass reason ref。 +5. before / after backup freshness state refs。 +6. backup status readback ref。 +7. restore drill readback ref。 +8. restore target isolation readback ref。 +9. offsite sync readback ref。 +10. offsite remote delete guard readback ref。 +11. credential escrow non-secret readback ref。 +12. credential recovery drill metadata ref。 +13. retention runway readback ref。 +14. retention 或 prune decision ref。 +15. backup dependency map ref。 +16. data classification ref。 +17. restore observer / stop condition ref。 +18. backup health no-false-green readback ref。 +19. alert textfile readback ref。 +20. cold-start / DR scorecard ref。 +21. cross-project sync ref。 +22. rollback validation ref。 +23. post-change monitoring ref。 +24. independent postcheck readback ref。 +25. recurrence guard ref。 +26. maintenance window、rollback owner、followup owner。 +27. redacted evidence refs。 +28. no-secret-value、no-raw-backup-payload、no-production-restore 與 no-false-green attestation。 + +## 4. Reviewer 檢查 + +Reviewer 必須確認來源 snapshot 是目前版本，並逐項檢查 actor、時間窗、變更意圖、before / after freshness、backup status、restore drill、restore target isolation、offsite sync、remote delete guard、credential escrow non-secret proof、credential recovery metadata、retention runway、retention / prune decision、dependency map、data classification、restore observer、backup health no-false-green、alert textfile、cold-start scorecard、cross-project sync、rollback、post-change monitoring、independent postcheck、recurrence guard、maintenance window、脫敏 ref、secret absence、raw payload absence、runtime stays zero 與 count transition safe。 + +不能把 backup success、route `200`、dashboard up、alert quiet、textfile present、UI 可見、CD success 或 latest 字樣視為 DR / backup 驗收。 + +## 5. 分流 + +| lane | 用途 | +|------|------| +| `waiting_post_incident_readback` | 尚未收到回讀包；所有 accepted / runtime count 維持 `0` | +| `request_actor_or_time_supplement` | 缺 actor、時間窗、intent 或 break-glass reason | +| `request_backup_freshness_supplement` | 缺 before / after freshness、backup status、alert textfile 或 scorecard | +| `request_restore_isolation_supplement` | 缺 restore drill、隔離目標、observer、stop condition 或 rollback validation | +| `request_offsite_retention_supplement` | 缺 offsite sync、remote delete guard、retention runway 或 prune decision | +| `request_escrow_non_secret_supplement` | 缺 credential escrow non-secret proof 或 recovery drill metadata | +| `quarantine_raw_payload` | 收到 secret、raw backup listing、raw restore payload、raw DB dump、rclone config 或未脫敏截圖時隔離 | +| `reject_false_green_claim` | 把 backup success、route 200、dashboard up、alert quiet、textfile present 或 UI 可見當驗收時拒收 | +| `ready_for_backup_restore_post_incident_review` | metadata 合格後只能進 reviewer review | +| `recurrence_guard_backfill_required` | 需補防再發 guard、retention freeze、remote-delete block、owner review 或 automation block | +| `waiting_runtime_gate` | 即使 readback accepted，runtime gate 仍需獨立人工批准 | + +## 6. 固定禁止動作 + +本階段明確阻擋 `backup_run`、`restore_run`、`restore_drill`、`production_restore`、`offsite_sync`、`offsite_remote_delete`、`credential_escrow_marker_write`、`credential_recovery_execution`、`retention_change`、`retention_prune`、`restic_prune`、`rclone_config_read`、`rclone_config_change`、`velero_restore`、`velero_backup`、`kubectl_action`、`ssh_read`、`ssh_write`、`secret_value_collection`、`secret_hash_collection`、`partial_token_collection`、`restic_password_collection`、`rclone_token_collection`、`kubeconfig_collection`、`host_write`、`active_scan`、`production_write`、`runtime_gate_open`、raw backup / restore / object listing / DB dump storage、接受 secret 或 credential derivative evidence、無 reviewer record 標記 accepted、接受 false green、跳過 dependency / data classification / observer / cross-project / rollback / post-change monitoring review、偽造 credential escrow evidence 與任何 action button。 + +## 7. 目前邊界 + +此 artifact 只代表事故後回讀計畫已建立。`post_incident_readback_received_count`、`post_incident_readback_accepted_count`、`backup_status_readback_accepted_count`、`restore_drill_readback_accepted_count`、`offsite_sync_readback_accepted_count`、`credential_escrow_non_secret_readback_accepted_count`、`retention_runway_readback_accepted_count`、`backup_health_no_false_green_readback_accepted_count`、`backup_run_authorized_count`、`restore_run_authorized_count`、`offsite_sync_authorized_count`、`credential_escrow_marker_write_authorized_count`、`retention_change_authorized_count`、`runtime_gate_count` 與 `action_button_count` 仍全部維持 `0`。 + +## 8. 指令 + +產生 committed snapshot： + +```bash +python3 scripts/security/backup-restore-post-incident-readback-plan.py \ + --root . \ + --generated-at 2026-06-18T10:30:00+08:00 \ + --output docs/security/backup-restore-post-incident-readback-plan.snapshot.json +``` + +只讀 guard： + +```bash +python3 scripts/security/iwooos-config-control-guard.py --root . +python3 scripts/security/security-mirror-progress-guard.py --root . +``` + +## 9. 完成度 + +| 工作 | 完成度 | 說明 | +|------|--------|------| +| post-incident readback plan artifact | `100%` | 38 個候選已建立只讀回讀計畫 | +| post-incident readback received / accepted | `0%` | 尚未收到或驗收任何事故後回讀包 | +| live backup / offsite / escrow evidence | `0%` | 未讀 live backup、offsite、credential escrow 或 secret | +| backup / restore / offsite / retention | `0%` | 未授權且未執行 | +| secret / host / production write | `0%` | 未收 secret、未 SSH、未寫 host | +| runtime gate / action button | `0%` | 無 action button，無 production write | diff --git a/docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md b/docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md index d99ecbef2..7bf6da68b 100644 --- a/docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md +++ b/docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md @@ -48,6 +48,12 @@ 2026-06-16 再新增 `docs/security/CD-RUNNER-SECRET-INJECTION-POST-INCIDENT-READBACK-PLAN.md` 與 `docs/security/cd-runner-secret-injection-post-incident-readback-plan.snapshot.json`，將同一批 CD pipeline、Code Review、Deploy alerts、Runner attestation 與 Secret parity / injection owner 轉成事故後回讀計畫。固定 `readback_candidate_count=5`、`c0_readback_candidate_count=4`、`c1_readback_candidate_count=1`、`write_capable_readback_candidate_count=5`、`required_readback_field_count=33`、`reviewer_check_count=30`、`outcome_lane_count=11`、`blocked_action_count=52`，讓 `secret_metadata` 從 `68%` 推進到 `70%`，讓 `gitea_workflow_runner_source_control` 從 `72%` 推進到 `74%`，高價值配置平均維持 `71%`，需 live evidence 類別仍為 `9`。此更新只補上 actor、時間窗、workflow diff state、runner executor / host、workspace cleanup、permission scope、secret name parity、secret injection route、step-env secret guard、log redaction、deploy marker / Gitea run、webhook / notification receipt、before / after deploy state、跨專案同步、rollback、post-check、防再發與 no-false-green 的脫敏回讀欄位；post-incident readback received / accepted、workflow 修改、dispatch、runner 變更、repo secret 變更、secret value collection、secret injection change、webhook / deploy key / branch protection / CODEOWNERS 變更、Gitea action dispatch、K8s secret injection、ArgoCD sync、production deploy、runtime gate 與 action button 仍全部為 `0 / false`。 +## 1.2c 2026-06-18 Backup / Restore / Escrow 事故後回讀計畫 + +已新增 `docs/security/BACKUP-RESTORE-POST-INCIDENT-READBACK-PLAN.md` 與 `docs/security/backup-restore-post-incident-readback-plan.snapshot.json`，將 38 個 backup / restore / escrow / retention surface 轉成事故後回讀計畫。固定 `readback_candidate_count=38`、`write_capable_readback_candidate_count=27`、`live_evidence_required_readback_candidate_count=38`、`restore_drill_readback_required_candidate_count=38`、`offsite_or_escrow_readback_required_candidate_count=20`、`retention_or_remote_delete_readback_required_candidate_count=17`、`required_readback_field_count=34`、`reviewer_check_count=32`、`outcome_lane_count=11`、`blocked_action_count=51`，讓 `backup_restore_credential` 從 `64%` 推進到 `66%`，高價值配置平均維持 `71%`，需 live evidence 類別仍為 `9`。 + +此更新只補上 actor、時間窗、改前改後 freshness、backup status readback、restore drill、隔離 restore target、offsite sync、remote delete guard、credential escrow non-secret proof、credential recovery metadata、retention runway、retention / prune decision、dependency map、data classification、restore observer、alert textfile、cold-start scorecard、cross-project sync、rollback、post-change monitoring、防再發與 no-false-green 的脫敏回讀欄位；post-incident readback received / accepted、backup run、restore run、offsite sync、remote delete、credential escrow marker write、retention change、restic prune、rclone config、Velero、kubectl、SSH、secret value collection、production write、runtime gate 與 action button 仍全部為 `0 / false`。 + ## 1.2b 2026-06-15 Public / Admin / API runtime config 變更證據驗收 已新增 `docs/security/PUBLIC-RUNTIME-CONFIG-CHANGE-EVIDENCE-ACCEPTANCE.md` 與 `docs/security/public-runtime-config-change-evidence-acceptance.snapshot.json`，將公開產品頁、AwoooP 後台、API / CORS、frontend env、Sentry tunnel、webhook / callback 與跨產品 runtime route 轉成 metadata-only 變更證據驗收帳本。 @@ -135,7 +141,7 @@ | P1-2 | SSH / sudoers / known_hosts / firewall / WireGuard / NodePort | `64%` | repo-only 清冊已納入 16 個 SSH / network access surface，owner response acceptance、事故型端口 / 防火牆變更證據驗收與 post-incident readback plan 已完成；仍缺 owner-provided change / incident ref、actor、before / after state、health impact、notification、cross-project sync、maintenance window、rollback owner 與 post-check evidence | | P1-3 | AI provider / model routing / Ollama proxy / cost and privacy | `64%` | 已新增 owner response acceptance 帳本，固定 8 個候選、24 個 owner 必填欄位、24 個 reviewer checks、10 條 outcome lanes、38 類 blocked actions；仍缺 provider owner、fallback order、dry-run、benchmark、cost review、privacy review、data classification、prompt redaction、quality gate、rollback owner 與 post-check evidence，不切 production | | P1-4 | K8s / ArgoCD / production manifests | `64%` | manifest inventory、owner response acceptance 與 GitOps change evidence acceptance 已完成；仍缺 proposed commit ref、rendered manifest diff、ArgoCD app / sync revision、health before / after、rollout、route smoke、metrics / alert、blast radius、rollback revision、maintenance window 與 post-check owner | -| P1-5 | Backup / restore / escrow / retention | `64%` | repo-only 清冊已納入 38 個 surface，owner request draft 與 owner response acceptance ledger 已完成，並補 restore recovery、freshness SLO、隔離還原目標、remote delete guard、retention runway、credential recovery metadata-only 與 no-false-green backup health Gate；仍缺 owner response、restore drill approval package、offsite / escrow owner、rollback owner、validation plan 與 no-secret-value evidence | +| P1-5 | Backup / restore / escrow / retention | `66%` | repo-only 清冊、owner response acceptance 與事故後回讀計畫已納入 38 個 surface；freshness before-after、backup status readback、restore drill、offsite sync、credential escrow non-secret proof、retention runway、cold-start scorecard、防再發與 no-false-green 已納入；仍缺 owner response、事故回讀包、restore drill approval package、offsite / escrow owner、rollback owner、validation plan 與 no-secret-value evidence | | P1-6 | Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse | `70%` | repo-only 清冊、owner response acceptance 與事故後回讀計畫已納入 60 個 monitoring / alerting / observability surface；actor、時間窗、before / after alert state、rule / datasource / scrape、receiver receipt、stale / silence、freshness、alert chain health、cross-project sync、rollback 與 no-false-green 已納入；仍缺 owner response、事故回讀包、live drift evidence、receiver receipt proof、noise budget owner 與 maintenance window | ## 4. 固定 0 / false 邊界 @@ -269,6 +275,7 @@ python3 scripts/security/iwooos-config-control-guard.py --root . | CD / Runner / Secret injection change evidence acceptance | `100%` | 已新增 `cd_runner_secret_injection_change_evidence_acceptance_v1`，5 個 candidate、4 個 C0、19 個 reviewer checks、8 條 outcome lanes、32 類 blocked action；secret metadata 成熟度 `66% -> 68%`，workflow / runner 成熟度 `70% -> 72%` | | Public / Admin / API runtime config 變更證據驗收 | `100%` | 已新增 `public_runtime_config_change_evidence_acceptance_v1` 與前台 source / messages 防洩漏 guard；6 個 candidate、5 個 C0、21 個 reviewer checks、8 條 outcome lanes、32 類 blocked action，另掃 225 個前端檔案、12 類禁字、違規 0；public/admin/API runtime config 成熟度 `62% -> 66%`，raw namespace / repo slug / 內部狀態碼 / 內部協作內容外洩列為拒收或隔離條件 | | Backup / restore / escrow owner response acceptance backfill | `100%` | 已將 `backup_restore_owner_response_acceptance_v1` 補強為 38 個 candidate、27 個 write-capable、23 個 owner 必填欄位、22 個 reviewer checks、9 條 outcome lanes、31 類 blocked action；backup / restore / credential 成熟度 `62% -> 64%` | +| Backup / restore / escrow post-incident readback plan | `100%` | 已新增 `backup_restore_post_incident_readback_plan_v1`，38 個事故回讀 candidate、27 個 write-capable、34 個必填欄位、32 個 reviewer checks、11 條 outcome lanes、51 類 blocked action；成熟度 `64% -> 66%`，readback received / accepted、backup status、restore drill、offsite sync、credential escrow、retention runway、no-false-green 與 runtime gate 仍為 `0` | | Monitoring / alerting / observability owner response acceptance backfill | `100%` | 已將 `monitoring_owner_response_acceptance_v1` 補強為 60 個 candidate、11 個 write-capable、38 個 acceptance fields、23 個 reviewer checks、12 條 outcome lanes、34 類 blocked action；monitoring / alerting / observability 成熟度 `66% -> 68%` | | Monitoring / alerting / observability post-incident readback plan | `100%` | 已新增 `monitoring_post_incident_readback_plan_v1`，60 個事故回讀 candidate、11 個 write-capable、30 個必填欄位、28 個 reviewer checks、11 條 outcome lanes、53 類 blocked action；成熟度 `68% -> 70%`，readback received / accepted、receiver receipt、stale / silence、alert chain health、reload、Telegram send、alert chain smoke 與 runtime gate 仍為 `0` | | AI provider / model routing owner response acceptance | `100%` | 已新增 `ai_provider_owner_response_acceptance_v1`，8 個 candidate、5 個 write-capable、24 個 owner 必填欄位、24 個 reviewer checks、10 條 outcome lanes、38 類 blocked action；AI provider / model routing 成熟度 `60% -> 64%` | diff --git a/docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md b/docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md index d4428dad5..2823c760e 100644 --- a/docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md +++ b/docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md @@ -105,6 +105,8 @@ 同日再補 restore recovery backfill Gate，將 `backup_restore_owner_response_acceptance_v1` 固定為 `acceptance_fields=33`、`owner_fields=23`、`reviewer_checks=22`、`outcome_lanes=9`、`blocked_actions=31`。新增 freshness SLO、隔離 restore target、backup dependency map、data classification、remote delete guard、retention runway、restore observer / stop condition、credential recovery non-secret proof 與 backup health no-false-green review；讓 backup / restore / credential 類別成熟度從 `62%` 推進到 `64%`。這不代表 owner response received / accepted、live backup evidence、freshness SLO accepted、restore target isolation accepted、remote delete guard accepted、retention runway accepted、credential recovery drill accepted、backup run、restore run、offsite sync、remote delete、retention change、secret collection、host write 或 runtime gate 已授權。 +2026-06-18 再新增 `backup_restore_post_incident_readback_plan_v1`，將同一批 38 個 backup / restore / escrow / retention surface 補成事故後回讀計畫。固定 `readback_candidates=38`、`write_capable=27`、`live_evidence_required=38`、`restore_drill_required=38`、`offsite_or_escrow_required=20`、`retention_or_remote_delete_required=17`、`required_readback_fields=34`、`reviewer_checks=32`、`outcome_lanes=11`、`blocked_actions=51`，並要求 actor、時間窗、改前改後 freshness、backup status readback、restore drill、隔離 restore target、offsite sync、remote delete guard、credential escrow non-secret proof、credential recovery metadata、retention runway、retention / prune decision、dependency map、data classification、restore observer、alert textfile、cold-start scorecard、cross-project sync、rollback、post-change monitoring、防再發與 no-false-green attestation，讓 backup / restore / credential 類別成熟度從 `64%` 推進到 `66%`。這不代表 post-incident readback received / accepted、backup run、restore run、offsite sync、remote delete、escrow marker write、retention change、secret collection、host write 或 runtime gate 已授權。 + 此更新仍不是 live backup truth：owner response、live evidence、restore drill acceptance、offsite sync acceptance、credential escrow acceptance、retention change acceptance、maintenance window、rollback owner 與 runtime gate 全部仍為 `0`，也不得執行 backup、restore、offsite sync、remote delete、restic prune、escrow marker write、rclone config、Velero restore、kubectl 或 SSH。 ### 0.5 2026-06-12 Monitoring / alerting / observability repo-only 清冊 @@ -289,6 +291,7 @@ Nginx 是目前必須最先資安控管的配置，原因是它同時控制公 | 高價值配置集中 guard | `100%` | 已新增 `scripts/security/iwooos-config-control-guard.py`，並串接 `security-mirror-progress-guard.py`；14 類配置、主要 owner / change evidence 帳本、supply-chain manifest 與 `0 / false` 邊界可集中驗證 | | Backup / restore / escrow 清冊 | `100%` | 已新增 `backup_restore_escrow_inventory_v1`，納入 38 個 repo-only surface；成熟度 `52% -> 58%` | | Backup / restore / escrow owner response acceptance | `100%` | 已新增並強化 `backup_restore_owner_response_acceptance_v1`，38 個 candidate、27 個 write-capable、22 個 reviewer checks、9 條 outcome lanes、31 類 blocked action；成熟度 `58% -> 64%` | +| Backup / restore / escrow 事故後回讀計畫 | `100%` | 已新增 `backup_restore_post_incident_readback_plan_v1`，38 個事故回讀 candidate、27 個 write-capable、34 個必填欄位、32 個 reviewer checks、11 條 outcome lanes、51 類 blocked action；成熟度 `64% -> 66%`，readback accepted 與 runtime gate 仍為 `0` | | Monitoring / alerting / observability 清冊 | `100%` | 已新增 `monitoring_alerting_observability_inventory_v1`，納入 60 個 repo-only surface；成熟度 `56% -> 62%` | | Monitoring / alerting / observability owner request draft | `100%` | 已將 60 個 monitoring surface 轉成 owner request draft；request sent / received / accepted、reload、receiver route change、Telegram send、alert chain smoke 仍為 0 | | Monitoring / alerting / observability owner response acceptance | `100%` | 已新增並強化 `monitoring_owner_response_acceptance_v1`，60 個 candidate、11 個 write-capable、23 個 reviewer checks、12 條 outcome lanes、34 類 blocked action；成熟度 `62% -> 68%` | diff --git a/docs/security/IWOOOS-POSTURE-PROJECTION.md b/docs/security/IWOOOS-POSTURE-PROJECTION.md index 37f585664..15cab49bc 100644 --- a/docs/security/IWOOOS-POSTURE-PROJECTION.md +++ b/docs/security/IWOOOS-POSTURE-PROJECTION.md @@ -2,8 +2,8 @@ | 項目 | 內容 | |------|------| -| 日期 | 2026-06-15 | -| 狀態 | 草案；P0 governance 總帳已建立；高價值配置 Owner Packet count sync、K8s / ArgoCD、Public Gateway / Nginx、Monitoring 與 CD / Runner / Secret 事故後回讀投影已完成 | +| 日期 | 2026-06-18 | +| 狀態 | 草案；P0 governance 總帳已建立；高價值配置 Owner Packet count sync、K8s / ArgoCD、Public Gateway / Nginx、Monitoring、CD / Runner / Secret 與 Backup / Restore / Escrow 事故後回讀投影已完成 | | Schema | `docs/schemas/iwooos_posture_projection_v1.schema.json` | | Snapshot | `docs/security/iwooos-posture-projection.snapshot.json` | | 模式 | `mirror_only` | @@ -47,6 +47,12 @@ 此同步只代表前端可以顯示 CD / Runner / Secret injection 事故後回讀計畫與邊界；`post_incident_readback_received_count`、`post_incident_readback_accepted_count`、`workflow_diff_state_accepted_count`、`runner_attestation_accepted_count`、`secret_name_parity_accepted_count`、`secret_injection_route_accepted_count`、`deploy_marker_readback_accepted_count`、`gitea_action_run_readback_accepted_count`、`log_redaction_readback_accepted_count`、`runtime_gate_count` 與 `action_button_count` 仍全部維持 `0`。不得把 CD success、deploy marker、workflow success、route `200`、runner online、AwoooP approval 或 UI 可見視為資安驗收。 +## 1.6 2026-06-18 Backup / Restore / Escrow 事故後回讀投影 + +`backup_restore_post_incident_readback_plan_v1` 已投影到 `iwooos-posture-projection.snapshot.json` 與前台 marker。固定 `candidate_count=38`、`write_capable_candidate_count=27`、`live_evidence_required_candidate_count=38`、`restore_drill_required_candidate_count=38`、`offsite_or_escrow_required_candidate_count=20`、`retention_or_remote_delete_required_candidate_count=17`、`required_readback_field_count=34`、`reviewer_check_count=32`、`outcome_lane_count=11`、`blocked_action_count=51`，並讓 `backup_restore_credential_coverage_percent=66`。 + +此同步只代表前端可以顯示 Backup / Restore / Escrow 事故後回讀計畫與邊界；`post_incident_readback_received_count`、`post_incident_readback_accepted_count`、`backup_status_readback_accepted_count`、`restore_drill_readback_accepted_count`、`offsite_sync_readback_accepted_count`、`credential_escrow_non_secret_readback_accepted_count`、`retention_runway_readback_accepted_count`、`backup_health_no_false_green_readback_accepted_count`、`runtime_gate_count` 與 `action_button_count` 仍全部維持 `0`。不得把備份排程存在、route `200`、冷啟動分數、UI 可見或文件齊備視為 backup / restore / DR 資安驗收。 + ## 2. 來源 IwoooS 首版只讀取或對齊以下已提交 evidence： @@ -61,6 +67,7 @@ IwoooS 首版只讀取或對齊以下已提交 evidence： | `k8s_argocd_post_incident_readback_plan_v1` | K8s / ArgoCD 事故後回讀計畫、66% 子項成熟度、31 個必填欄位、41 類 blocked action、runtime gate 0 | | `monitoring_post_incident_readback_plan_v1` | Monitoring / Alerting / Observability 事故後回讀計畫、70% 子項成熟度、30 個必填欄位、53 類 blocked action、runtime gate 0 | | `cd_runner_secret_injection_post_incident_readback_plan_v1` | CD / Runner / Secret injection 事故後回讀計畫、secret metadata 70%、workflow / runner 74%、33 個必填欄位、52 類 blocked action、runtime gate 0 | +| `backup_restore_post_incident_readback_plan_v1` | Backup / Restore / Escrow 事故後回讀計畫、66% 子項成熟度、34 個必填欄位、51 類 blocked action、runtime gate 0 | | `kali_integration_status_v1` | Kali 112 observe-only 整合態勢 | | `vibework_iwooos_onboarding_handoff_v1` | VibeWork repo / product / surface / owner / evidence refs / 獨立產品邊界只讀 handoff | | `docs/LOGBOOK.md` | 部署 marker、Gitea run 與 rollout risk 邊界紀錄 | @@ -136,6 +143,7 @@ IwoooS 首版只讀取或對齊以下已提交 evidence： 56c. 8 個 AI provider / model routing owner response acceptance 候選，顯示 AI router provider policy、Ollama proxy gateway、fallback order / circuit breaker、cost budget / quota、privacy / data egress、benchmark / dry-run、model card / version inventory 與 agent replacement candidate boundary 的 metadata-only 收件規則；write-capable candidate `5`、paid-provider candidate `5`、data-egress candidate `6`、owner field `24`、reviewer check `24`、outcome lane `10`、blocked action `38`，讓 AI provider / model routing 類別成熟度從 `60%` 推進到 `64%`；owner response、fallback order、dry-run、benchmark、cost review、privacy review、prompt redaction、quality gate、provider switch、external provider call、paid provider call、prompt send、live endpoint probe、secret collection、SDK install、shadow / canary、runtime gate 與 action button 仍全部為 `0`。 57. 38 個 Backup / restore / escrow / retention repo-only inventory surfaces，顯示 backup orchestration、service backup scripts、restic retention、offsite sync、credential escrow、Velero restore drill、backup health alert 與 cold-start / DR runbook 的第一層清冊；write-capable surface `27`、restore drill surface `4`、offsite / escrow surface `8`，owner response、live evidence、restore drill、offsite sync、credential escrow、retention change、runtime gate 與 action button 仍全部為 `0`，不代表 backup、restore、offsite sync、remote delete、restic prune、escrow marker write、rclone config 或 Velero restore 已授權。 57a. 38 個 Backup / restore / escrow owner response acceptance backfill，顯示 restore recovery、freshness SLO、隔離 restore target、backup dependency map、data classification、remote delete guard、retention runway、restore observer / stop condition、credential recovery non-secret proof 與 backup health no-false-green review 收件規則；owner field `23`、reviewer check `22`、outcome lane `9`、blocked action `31`，讓 backup / restore / credential 類別成熟度從 `62%` 推進到 `64%`；owner response、freshness SLO accepted、restore target isolation accepted、remote delete guard accepted、retention runway accepted、credential recovery drill accepted、backup run、restore run、offsite sync、remote delete、retention change、secret collection、runtime gate 與 action button 仍全部為 `0`。 +57b. 38 個 Backup / restore / escrow post-incident readback 候選，顯示 actor、時間窗、改前改後 freshness、backup status、restore drill、隔離 restore target、offsite sync、remote delete guard、credential escrow non-secret proof、retention runway、retention / prune decision、dependency map、data classification、restore observer、alert textfile、cold-start scorecard、cross-project sync、rollback、post-change monitoring、防再發與 no-false-green attestation 的事故後回讀規則；write-capable candidate `27`、live evidence required `38`、required readback field `34`、reviewer check `32`、outcome lane `11`、blocked action `51`，讓 backup / restore / credential 類別成熟度從 `64%` 推進到 `66%`；readback received / accepted、backup status accepted、restore drill accepted、offsite sync accepted、credential escrow non-secret proof accepted、retention runway accepted、backup health no-false-green accepted、runtime gate 與 action button 仍全部為 `0`。 58. 60 個 Monitoring / alerting / observability repo-only inventory surfaces，顯示 Prometheus、Alertmanager、Grafana、SigNoz、Sentry、Langfuse、OTEL、Telegram / notification policy、deploy / reload scripts 與 alert chain smoke scripts 的第一層清冊；write-capable surface `11`、alert rule surface `13`、deploy / reload surface `6`，owner response、live evidence、reload owner、receiver owner、route smoke、runtime gate 與 action button 仍全部為 `0`，不代表 Prometheus reload、Alertmanager reload、Grafana import、SigNoz apply、Sentry deploy、Telegram send、live alert fire 或 alert chain smoke 已授權。 58a. 60 個 Monitoring / alerting / observability owner response acceptance 候選已補告警鏈路 no-false-green 回補規則；acceptance field `38`、reviewer check `23`、outcome lane `12`、blocked action `34`，新增 incident context、alert chain health 不能只看 route 200、receiver receipt proof、stale alert review、silence / dedup review、false-green risk review、post-reload readback plan 與 cross-project notification ref，讓 monitoring / alerting / observability 類別成熟度從 `66%` 推進到 `68%`；owner response、receiver receipt、stale alert review、silence / dedup review、false-green risk review、post-reload readback、runtime gate 與 action button 仍全部為 `0`。 58b. 60 個 Monitoring / alerting / observability post-incident readback 候選，顯示 actor、change / outage time window、before / after alert state、rule / datasource / scrape state、receiver route、receiver receipt、stale / silence review、dashboard / trace / log freshness、notification delivery、alert chain health、cross-project sync、rollback、post-change monitoring、postcheck、recurrence guard 與 no-false-green attestation 的事故後回讀規則；write-capable candidate `11`、live evidence required `60`、alert rule candidate `13`、deploy / reload candidate `6`、required readback field `30`、reviewer check `28`、outcome lane `11`、blocked action `53`，讓 monitoring / alerting / observability 類別成熟度從 `68%` 推進到 `70%`；readback received / accepted、receiver receipt、stale / silence、alert chain health、reload、Telegram send、alert chain smoke、runtime gate 與 action button 仍全部為 `0`。 diff --git a/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md b/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md index 27f7bad92..69e349941 100644 --- a/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md +++ b/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md @@ -2,18 +2,24 @@ | 項目 | 內容 | |------|------| -| 日期 | 2026-06-15 | +| 日期 | 2026-06-18 | | 狀態 | IwoooS 64% 只讀治理推進中；高價值配置集中 guard、Package / Docker 供應鏈 repo-only baseline 與 Package / Docker 供應鏈 owner policy gate 已完成；Frontend public sensitive surface guard、Backup / Restore / Escrow owner response acceptance backfill、Monitoring / Alerting / Observability no-false-green owner response acceptance、Host Service change evidence acceptance、Host Service post-incident readback plan、AI provider / model routing owner response acceptance、CD / Runner / Secret 注入變更證據驗收、CD / Runner / Secret 注入事故後回讀計畫、Public / Admin / API runtime config 變更證據驗收、K8s / ArgoCD post-incident readback plan、Monitoring / Alerting / Observability post-incident readback plan 與 Public Gateway / Nginx post-incident readback plan 已本地完成；端口 / 防火牆變更證據驗收、主機服務事故回補與 K8s / ArgoCD GitOps 變更證據驗收已正式部署驗證；S4.9 owner response gate 仍是第一優先 | | 本階段完成 | 資安供應鏈 contract manifest + Source Control Approval Board + Draft Reconcile Plan + Ref Detail Diff + Ref Truth Classification + Source Control Ref Truth Owner Response 收件包 + GitHub Primary Readiness Gate + GitHub Primary Rollback ADR + GitHub Target Owner Decision Response 收件包 + Gitea 認證清冊匯出請求 + Gitea 認證清冊匯入驗收契約 + Gitea 清冊覆蓋 Owner Attestation + Gitea Owner Attestation Approval Lane 對齊 + Gitea Owner Attestation Response 收件包 + Workflow / Secret Name Inventory + Workflow / Secret Name Local Evidence + Workflow / Secret Name Redacted Export Request + Workflow / Secret Name Owner Response 收件包 + Source Control Owner Response Validation Rollup + Kali 112 live integration status + Security Finding contract + Kali scan scope approval package + Security Approval Queue + S3 人工批准 Gate + S3 人工決策紀錄 + S3 人工審查封包 + S3 人工決策狀態轉移 + S3 後續 runtime gate 準備契約 + 鏡像 readiness index + 鏡像接收計畫 + 鏡像事件信封 + 鏡像路由矩陣 + 鏡像驗收契約 + 鏡像隔離契約 + 鏡像 dry-run 報告契約 + 鏡像狀態彙整契約 + IwoooS 前端態勢入口 + IwoooS posture projection contract + IwoooS 既有前端資安頁面整合 + IwoooS 覆蓋與邊界矩陣 + IwoooS 只讀資安處理旅程 + IwoooS owner evidence readiness board + IwoooS host coverage view + IwoooS host action gate matrix + IwoooS host evidence readiness board + IwoooS host evidence collection order + IwoooS host evidence intake preflight + IwoooS host evidence review outcome lanes + IwoooS host evidence review handoff packets + IwoooS host evidence reviewer checklist + IwoooS host evidence reviewer outcome lanes + IwoooS host owner decision candidate packets + IwoooS host owner decision review checklist + IwoooS host owner decision review outcome lanes + IwoooS host owner decision record draft packets + IwoooS host owner decision record draft review checklist + IwoooS host owner decision record draft review outcome lanes + IwoooS host owner decision record write-up packets + IwoooS host owner decision record write-up review checklist + IwoooS host owner decision record write-up review outcome lanes + IwoooS host owner decision record formal candidate packets + IwoooS host owner decision record formal candidate review checklist + IwoooS host owner decision record formal candidate review outcome lanes + IwoooS host owner decision record formal record queue packets + IwoooS host owner decision record formal record queue review checklist + IwoooS host owner decision record formal record queue review outcome lanes + IwoooS host owner decision record human handoff readiness packets + IwoooS host owner decision record human handoff readiness review checklist + IwoooS host owner decision record human handoff readiness review outcome lanes + IwoooS host owner decision record human record owner review candidate packets + IwoooS host owner decision record human record owner review candidate checklist + IwoooS host owner decision record human record owner review candidate outcome lanes + IwoooS host owner decision record human record owner review preparation packets + IwoooS host owner decision record human record owner review preparation checklist + IwoooS progress acceleration lanes + IwoooS owner response next-action focus + IwoooS S4.9 owner response preflight + IwoooS S4.9 owner response request templates + IwoooS progress hold movement gates + IwoooS AwoooP read-only landing readiness + IwoooS AwoooP cross-session handoff packets + AwoooP 首頁 IwoooS 資安鏡像候選 + AwoooP 工作鏈路 IwoooS 資安鏡像候選 + AwoooP 審批佇列 IwoooS owner response 只讀焦點 | | 本階段追加 | AwoooP 合約儀表板 IwoooS 資安契約只讀候選 + AwoooP 租戶管理 IwoooS 資安租戶範圍只讀候選 + AwoooP 執行監控 IwoooS 執行狀態只讀候選 + 既有安全 / 合規頁面 IwoooS 只讀反向橋接 + 告警 / 錯誤 / 授權 / 治理頁面 IwoooS 只讀反向橋接 + 稽核 / 工程審查頁面 IwoooS 深色只讀反向橋接 + IwoooS 前端資安頁面連接狀態板 + IwoooS GitHub 主要來源就緒度只讀狀態板 + AwoooP 工作鏈路 GitHub 主要來源就緒度只讀工作項 + AwoooP 合約儀表板 GitHub 主要來源就緒度合約只讀候選 + AwoooP 審批佇列 GitHub 主要來源就緒度審批邊界 + AwoooP 首頁 GitHub 主要來源就緒度只讀摘要 + AwoooP 租戶管理 GitHub 主要來源就緒度租戶範圍 + AwoooP 執行監控 GitHub 主要來源就緒度執行邊界 + IwoooS / AwoooP 資安可視區塊繁體中文呈現防護檢查 + AwoooP 執行詳情 / 審批詳情繁體中文呈現防護檢查 + AwoooP 首頁負責人回覆驗收總覽 + AwoooP 工作鏈路負責人回覆驗收只讀工作項 + AwoooP 合約儀表板負責人回覆驗收契約只讀候選 + AwoooP 審批佇列負責人回覆驗收只讀審查邊界 + AwoooP 租戶管理負責人回覆驗收租戶範圍 + AwoooP 執行監控負責人回覆驗收執行邊界 + AwoooP 執行詳情負責人回覆驗收詳情邊界 + AwoooP 審批決策負責人回覆驗收審批邊界 + IwoooS AwoooP 資安入口覆蓋狀態板 + IwoooS 階段式資安收斂節奏圖 + IwoooS 下一步人工收件作戰板 + IwoooS 人工回覆安全驗收閘道 + IwoooS 人工回覆審查結果分流 + IwoooS 人工決策準備佇列 + IwoooS 人工決策紀錄草稿防誤用 + IwoooS 人工決策正式紀錄負責人指派確認準備包 + IwoooS 人工決策正式紀錄負責人指派確認清單 + IwoooS 人工決策正式紀錄負責人指派確認結果分流 + IwoooS 人工決策正式紀錄負責人指派決策準備包 + IwoooS 人工決策正式紀錄負責人指派決策檢查清單 + IwoooS S4.9 負責人回覆封套欄位 + IwoooS S4.9 負責人回覆封套送件前檢查 + IwoooS S4.9 負責人回覆封套送件前結果分流 + IwoooS S4.9 負責人回覆送件請求草稿 + IwoooS S4.9 負責人回覆送件鏈路摘要 + IwoooS 低摩擦分階段收斂主控 + IwoooS 低摩擦下一步行動邊界 + IwoooS 64% 進度移動訊號驗收條 + IwoooS 第一個進度解鎖路徑 + IwoooS 第一解鎖證據包 + IwoooS 第一解鎖證據包預檢分流 + IwoooS 第一解鎖證據包補件路徑 + IwoooS 第一解鎖證據包補件送審前檢查 + IwoooS 第一解鎖證據包補件送審結果分流 + IwoooS 第一解鎖證據包 reviewer 指派準備包 + IwoooS 第一解鎖證據包 reviewer 指派前檢查 + IwoooS 第一解鎖證據包 reviewer 指派前檢查結果分流 + IwoooS 正式只讀 landing 與 Kali 112 只讀證據進度重估 | | 本階段追加補充 | IwoooS 目前具體工作地圖 + IwoooS 目前具體交付清單 + IwoooS 目前阻塞與解除條件 + IwoooS 三軸進度與全產品套用範圍 + IwoooS 全產品分階段套用台帳 + IwoooS 全產品 rollout 波次驗收門檻 + IwoooS 全產品 rollout 驗收結果分流 + IwoooS 全產品證據接線地圖 + IwoooS 全產品證據接線預檢 + IwoooS 全產品證據接線預檢結果分流 + IwoooS 全產品預檢補件回收台帳 + IwoooS 全產品補件重試門檻 + IwoooS 全產品重試結果分流 + IwoooS 全產品人工審查候選準備 + IwoooS 全產品人工審查候選預檢 + IwoooS 全產品人工審查候選預檢結果分流 + IwoooS 全產品人工審查候選預檢補件回收台帳 + IwoooS 全產品人工審查候選預檢補件重試門檻 + IwoooS 全產品只讀套用快照 + P2-145 owner response acceptance gate 正式驗證完成 | | P0 追加 | IwoooS P0 配置控管優先序前台正式驗證完成；Nginx public gateway、DNS / TLS / certbot、K8s / ArgoCD / production manifests、Workflow / runner / secret metadata、Public / admin / API runtime config、agent-bounty runtime / treasury 六類先列為即時風險配置；高價值配置 Gate 已補上 `k8s/nginx/**`、`scripts/ops/**/*cert*`、`scripts/ops/**/*tls*`，sample 從 `matched=0 / C0=0` 收斂到 `matched=3 / C0=2`；Gate 預設工作樹 preflight 已可讀取 staged / unstaged / untracked，本地 smoke 對臨時 `k8s/nginx/*` 檔命中 C0；Owner Packet snapshot 已同步為 `packets=3 / c0=2`，Coverage snapshot 已同步最新 patterns；IwoooS / AwoooP 前台 Owner Packet 摘要已正式驗證 `packet=3 / c0=2`，feature commit `e999c16b`、deploy marker `16c6b983`、Gitea code-review `2973` / CD `2972` success；IwoooS posture projection snapshot / schema / guard 已同步 `packet=3 / c0=2`，不再保留舊 `1 / 0` 口徑；高價值配置 Owner Packet 收件預檢已新增 `checks=9 / lanes=5 / required_fields=27 / blocked_requests=16`；高價值配置 Owner Request 草稿包已新增 `drafts=3 / handoff_fields=11 / forbidden_payloads=12 / sent=0`；Public Gateway live conf 匯出請求包已新增 `requests=3 / c0=2 / redaction_rules=8 / received=0`；Public Gateway redacted export 收件預檢已新增 `candidates=3 / c0=2 / checks=10 / rejection_guards=12 / received=0 / accepted=0`；Public Gateway rendered diff / nginx gate 草稿已新增 `candidates=3 / c0=2 / stages=7 / blocked=14 / rendered_diff=0 / runtime=0`；Public Gateway owner response acceptance 只讀帳本已新增 `candidates=3 / c0=2 / fields=33 / checks=22 / lanes=8 / blocked=28 / accepted=0 / runtime=0`，並補上手動 / 緊急 gateway 變更的 intent、approval / break-glass、route health、rollback validation 與 post-change monitoring 必填 ref；DNS / TLS / certbot Owner Confirmation Request 已新增 `requests=4 / c0=4 / fields=9 / questions=5 / guards=12 / received=0 / accepted=0`；K8s / ArgoCD manifest repo-only 清冊已新增 `files=49 / c0=36 / yaml=45 / kinds=20 / blocked=13 / runtime=0`；K8s / ArgoCD Owner Request Draft 已新增 `drafts=4 / c0=3 / fields=11 / sent=0 / runtime=0`；K8s / ArgoCD owner response acceptance 只讀帳本已新增 `candidates=4 / c0=3 / fields=11 / checks=12 / lanes=7 / blocked=18 / accepted=0 / runtime=0`；K8s / ArgoCD GitOps 變更證據驗收已新增 `candidates=4 / c0=3 / write_capable=4 / evidence_fields=18 / checks=18 / lanes=8 / blocked=28 / accepted=0 / runtime=0`；K8s / ArgoCD Post-incident Readback Plan 已新增 `candidates=4 / c0=3 / c1=1 / write_capable=4 / required_fields=31 / reviewer_checks=28 / lanes=10 / blocked=41 / accepted=0 / runtime=0`；CD / Runner / Secret 注入變更證據驗收已新增 `candidates=5 / c0=4 / write_capable=5 / workflow_files=33 / secret_names=42 / runner_labels=5 / evidence_fields=19 / checks=19 / lanes=8 / blocked=32 / accepted=0 / runtime=0`；Public / Admin / API runtime config 變更證據驗收已新增 `candidates=6 / c0=5 / write_capable=6 / source_refs=20 / evidence_fields=21 / checks=21 / lanes=8 / blocked=32 / accepted=0 / runtime=0`，並把 raw namespace、repo slug、內部狀態碼與內部協作內容外洩列為拒收 / 隔離；Frontend public sensitive surface guard 已新增 `files=225 / patterns=12 / allowlisted=2 / violations=0 / runtime=0`，讓 public runtime config 成熟度 `64% -> 66%`、高價值配置平均 `69% -> 70%`；Backup / Restore / Escrow owner response acceptance 只讀帳本已更新為 `candidates=38 / write_capable=27 / fields=33 / owner_fields=23 / reviewer_checks=22 / lanes=9 / blocked=31 / accepted=0 / runtime=0`；SSH / Firewall / Network Access owner response acceptance 只讀帳本已新增 `candidates=16 / write_capable=6 / fields=13 / checks=15 / lanes=7 / blocked=22 / accepted=0 / runtime=0`；端口 / 防火牆變更證據驗收只讀帳本已新增 `candidates=14 / write_capable=6 / policy_or_exposure=5 / evidence_fields=16 / checks=16 / lanes=8 / blocked=24 / accepted=0 / runtime=0`；owner response / live evidence / runtime gate / action buttons 仍全部為 0 | | P0 agent-bounty 追加 | agent-bounty-protocol Owner Request Draft 已新增 `drafts=11 / control=4 / surface=7 / write_capable=8 / treasury=4 / mcp_a2a=5 / fields=22 / forbidden_inputs=25 / blocked=28 / sent=0 / runtime=0`；這是 repo / refs、deployment、data classification、MCP / A2A、cron / daemon、admin / treasury、webhook / traffic 的人工送件前草稿，不是 owner response、repo push、refs sync、workflow 修改、secret 收集、deploy、compose restart、DB migration、claim / submit、payout / withdrawal、cron / daemon、external send、host write 或 runtime gate | -| P1 追加 | Docker / systemd / Host Service Owner Request Draft 已新增 `drafts=9 / write_capable=3 / fields=12 / blocked=14 / sent=0 / runtime=0`；Docker / systemd / Host Service Owner Response Acceptance 已更新為 `candidates=9 / write_capable=3 / live_evidence_required=8 / fields=34 / owner_fields=18 / reviewer_checks=21 / lanes=8 / blocked=27 / accepted=0 / runtime=0`；Docker / systemd / Host Service Change Evidence Acceptance 已新增 `candidates=9 / write_capable=3 / live_evidence_required=8 / evidence_fields=45 / required_fields=25 / reviewer_checks=26 / lanes=10 / blocked=39 / accepted=0 / runtime=0`；Docker / systemd / Host Service Post-incident Readback Plan 已新增 `candidates=9 / write_capable=3 / live_evidence_required=8 / readback_fields=36 / required_fields=28 / reviewer_checks=28 / lanes=10 / blocked=41 / accepted=0 / runtime=0`；AI provider / Model Routing Owner Response Acceptance 已新增 `candidates=8 / write_capable=5 / paid_provider=5 / data_egress=6 / fields=37 / owner_fields=24 / reviewer_checks=24 / lanes=10 / blocked=38 / accepted=0 / runtime=0`；SSH / Firewall / Network Access Owner Request Draft 已新增 `drafts=16 / write_capable=6 / fields=13 / blocked=16 / sent=0 / runtime=0`；Backup / Restore / Escrow Owner Request Draft 已新增 `drafts=38 / write_capable=27 / fields=14 / blocked=18 / sent=0 / runtime=0`；Backup / Restore / Escrow Owner Response Acceptance 已更新為 `candidates=38 / write_capable=27 / owner_fields=23 / reviewer_checks=22 / lanes=9 / blocked=31 / accepted=0 / runtime=0`；Monitoring / Alerting / Observability Owner Request Draft 已新增 `drafts=60 / write_capable=11 / fields=14 / blocked=24 / sent=0 / runtime=0`；Monitoring / Alerting / Observability Owner Response Acceptance 已更新為 `candidates=60 / write_capable=11 / live_evidence_required=60 / fields=38 / owner_fields=14 / reviewer_checks=23 / lanes=12 / blocked=34 / accepted=0 / runtime=0`，並補 incident context、receiver receipt、stale alert、silence / dedup、post-reload readback 與 false-green risk review；上述全部仍是人工送件前草稿、只讀 acceptance 帳本或事故後回讀計畫，不是 owner response、change evidence accepted、live evidence、provider switch、外部 provider call、付費呼叫、prompt send、reload、restart、backup、restore、Telegram send、alert smoke、host write 或 runtime gate | +| P1 追加 | Docker / systemd / Host Service Owner Request Draft 已新增 `drafts=9 / write_capable=3 / fields=12 / blocked=14 / sent=0 / runtime=0`；Docker / systemd / Host Service Owner Response Acceptance 已更新為 `candidates=9 / write_capable=3 / live_evidence_required=8 / fields=34 / owner_fields=18 / reviewer_checks=21 / lanes=8 / blocked=27 / accepted=0 / runtime=0`；Docker / systemd / Host Service Change Evidence Acceptance 已新增 `candidates=9 / write_capable=3 / live_evidence_required=8 / evidence_fields=45 / required_fields=25 / reviewer_checks=26 / lanes=10 / blocked=39 / accepted=0 / runtime=0`；Docker / systemd / Host Service Post-incident Readback Plan 已新增 `candidates=9 / write_capable=3 / live_evidence_required=8 / readback_fields=36 / required_fields=28 / reviewer_checks=28 / lanes=10 / blocked=41 / accepted=0 / runtime=0`；AI provider / Model Routing Owner Response Acceptance 已新增 `candidates=8 / write_capable=5 / paid_provider=5 / data_egress=6 / fields=37 / owner_fields=24 / reviewer_checks=24 / lanes=10 / blocked=38 / accepted=0 / runtime=0`；SSH / Firewall / Network Access Owner Request Draft 已新增 `drafts=16 / write_capable=6 / fields=13 / blocked=16 / sent=0 / runtime=0`；Backup / Restore / Escrow Owner Request Draft 已新增 `drafts=38 / write_capable=27 / fields=14 / blocked=18 / sent=0 / runtime=0`；Backup / Restore / Escrow Owner Response Acceptance 已更新為 `candidates=38 / write_capable=27 / owner_fields=23 / reviewer_checks=22 / lanes=9 / blocked=31 / accepted=0 / runtime=0`；Backup / Restore / Escrow Post-incident Readback Plan 已新增 `candidates=38 / write_capable=27 / live_evidence_required=38 / restore_drill_required=38 / offsite_or_escrow_required=20 / retention_or_remote_delete_required=17 / required_fields=34 / reviewer_checks=32 / lanes=11 / blocked=51 / accepted=0 / runtime=0`；Monitoring / Alerting / Observability Owner Request Draft 已新增 `drafts=60 / write_capable=11 / fields=14 / blocked=24 / sent=0 / runtime=0`；Monitoring / Alerting / Observability Owner Response Acceptance 已更新為 `candidates=60 / write_capable=11 / live_evidence_required=60 / fields=38 / owner_fields=14 / reviewer_checks=23 / lanes=12 / blocked=34 / accepted=0 / runtime=0`，並補 incident context、receiver receipt、stale alert、silence / dedup、post-reload readback 與 false-green risk review；上述全部仍是人工送件前草稿、只讀 acceptance 帳本或事故後回讀計畫，不是 owner response、change evidence accepted、live evidence、provider switch、外部 provider call、付費呼叫、prompt send、reload、restart、backup、restore、offsite sync、remote delete、Telegram send、alert smoke、host write 或 runtime gate | | P2 供應鏈追加 | Package / Docker 供應鏈 repo-only baseline 已新增 `package_json=6 / pyproject=4 / requirements=2 / dockerfiles=2 / compose=6 / gaps=5 / runtime=0`；Package / Docker 供應鏈 owner policy gate 已新增 `requests=6 / c0=2 / fields=8 / checks=12 / blocked=20 / sent=0 / accepted=0 / runtime=0`；缺口為 Python lockfile 缺席、requirements 未 pin、Docker base image 未全數 digest pinning、Docker `COPY --from` 外部 image 未 digest pinning、compose image 未 digest pinning，以及 CVE / license / SBOM window 未定；目前尚未列入 36 個正式 AwoooP 消費 contract，後續若要前台消費需同步 manifest / readiness / route / rollup / dry-run / posture projection / guard count；本輪不 install、不 upgrade、不跑 CVE、不 pull / build / push image、不改 tag、不登入 registry、不部署 | | 原則 | 低摩擦分階段；文件、schema、read-only evidence 優先；不做 runtime enforcement、不切 primary | | P0 主控板 | `docs/workplans/2026-06-04-iwooos-security-governance-p0.md` | +## 0.0a 2026-06-18 Backup / Restore / Escrow 事故後回讀計畫 + +本輪把 Backup / Restore / Escrow 從 owner response acceptance 再補一層 post-incident readback plan：`backup_restore_post_incident_readback_plan_v1` 固定 `candidates=38`、`write_capable=27`、`live_evidence_required=38`、`restore_drill_required=38`、`offsite_or_escrow_required=20`、`retention_or_remote_delete_required=17`、`required_readback_fields=34`、`reviewer_checks=32`、`outcome_lanes=11`、`blocked_actions=51`，並讓 `backup_restore_credential` 只讀治理成熟度 `64% -> 66%`，高價值配置平均成熟度維持 `71%`。新增要求包含 actor、時間窗、改前改後 freshness、backup status readback、restore drill、隔離 restore target、offsite sync、remote delete guard、credential escrow non-secret proof、retention runway、retention / prune decision、dependency map、data classification、restore observer、alert textfile、cold-start scorecard、cross-project sync、rollback、post-change monitoring、防再發與 no-false-green attestation。 + +同步邊界：IwoooS headline 維持 `64%`，active runtime gate 維持 `0`；post-incident readback received / accepted、backup status accepted、restore drill accepted、offsite sync accepted、credential escrow non-secret proof accepted、retention runway accepted、backup health no-false-green accepted、backup run、restore run、offsite sync、remote delete、credential escrow marker write、retention change、restic prune、rclone config、Velero、kubectl、SSH、secret collection、host write、production write、runtime gate 與 action buttons 全部仍為 `0 / false`。本段只更新文件、snapshot、guard、投影契約與前端 marker，不執行任何 live backup / restore / offsite / host 動作。 + ## 0.1 2026-06-15 Public Gateway / Nginx 事故後回讀計畫 本輪把 Public Gateway / Nginx 從 rendered diff evidence acceptance 再補一層事故後回讀計畫：`public_gateway_post_incident_readback_plan_v1` 固定 `candidates=3`、`c0=2`、`c1=1`、`write_capable=3`、`readback_fields=36`、`required_readback_fields=30`、`reviewer_checks=28`、`outcome_lanes=10`、`blocked_actions=41`，並讓 `nginx_public_gateway` 只讀治理成熟度 `90% -> 92%`，高價值配置平均成熟度維持 `71%`。新增要求包含 actor、變更時間窗、change intent / break-glass、改前改後 route、source-to-live diff、`nginx -t` readback、reload / no-reload、route smoke、TLS / ACME、WebSocket、upstream、AI provider、monitoring、operator notification、cross-project sync、rollback validation、post-change monitoring、postcheck、recurrence guard 與 no-false-green attestation。 @@ -498,6 +504,7 @@ headline 要再往上，需要 S4.9 / S4.10 / S4.11 / S4.12 任一 owner respons | SSH / Firewall / Network Access Owner Request Draft | 本地完成 | `ssh-network-owner-request-draft.snapshot.json` 已固定 `request_draft_count=16`、`write_capable_request_draft_count=6`、`live_evidence_required_request_count=16`、`request_field_count=23`、`required_owner_field_count=13`、`blocked_action_count=16`、`request_sent_count=0`、`owner_response_received_count=0`、`runtime_gate_count=0`，並由 `security-mirror-progress-guard.py` 鎖住 request ids、blocked actions 與 false flags | 這是 SSH target、known_hosts、CI deploy SSH、monitoring SSH、backup SSH、sudoers、NetworkPolicy、NodePort、WireGuard 與 alert SSH action 的人工送件前 request draft，不是 request sent、owner response received / accepted、live host read、host keyscan、known_hosts patch、firewall / port change、NetworkPolicy apply、NodePort change、WireGuard change、secret collection、host write、production write 或 runtime gate；不需要 production browser smoke | | Backup / Restore / Escrow Owner Request Draft | 本地完成 | `backup-restore-owner-request-draft.snapshot.json` 已固定 `request_draft_count=38`、`write_capable_request_draft_count=27`、`live_evidence_required_request_count=38`、`request_field_count=24`、`required_owner_field_count=14`、`blocked_action_count=18`、`request_sent_count=0`、`owner_response_received_count=0`、`runtime_gate_count=0`，並由 `security-mirror-progress-guard.py` 鎖住 request ids、blocked actions 與 false flags | 這是 backup、restore、offsite、credential escrow、retention、Velero、alert / health 與 DR runbook 的人工送件前 request draft，不是 request sent、owner response received / accepted、live backup evidence、backup run、restore run、offsite sync、remote delete、escrow marker write、retention change、restic prune、rclone config、Velero restore / backup、secret collection、host write、production write 或 runtime gate；不需要 production browser smoke | | Backup / Restore / Escrow Owner Response Acceptance | 本地完成 | `backup-restore-owner-response-acceptance.snapshot.json` 已固定 `acceptance_candidate_count=38`、`write_capable_acceptance_candidate_count=27`、`live_evidence_required_candidate_count=38`、`acceptance_field_count=33`、`required_owner_field_count=23`、`reviewer_check_count=22`、`outcome_lane_count=9`、`blocked_action_count=31`、`owner_response_received_count=0`、`owner_response_accepted_count=0`、`runtime_gate_count=0`，並由 `security-mirror-progress-guard.py` 鎖住 candidate ids、reviewer checks、outcome lanes、blocked actions 與 false flags | 這是 backup、restore、offsite、credential escrow、retention、Velero、alert / health、freshness SLO、隔離還原目標、遠端刪除保護、保留期 runway、金庫非明文復原證明與 DR runbook 的 owner response 收件驗收帳本，不是 owner response received / accepted、live backup evidence、backup run、restore run、offsite sync、remote delete、escrow marker write、retention change、restic prune、rclone config、Velero restore / backup、secret collection、host write、production write 或 runtime gate；前端數字會隨本輪 commit / deploy 另行 smoke | +| Backup / Restore / Escrow Post-incident Readback Plan | 本地完成 | `backup-restore-post-incident-readback-plan.snapshot.json` 已固定 `readback_candidate_count=38`、`write_capable_readback_candidate_count=27`、`live_evidence_required_readback_candidate_count=38`、`restore_drill_readback_required_candidate_count=38`、`offsite_or_escrow_readback_required_candidate_count=20`、`retention_or_remote_delete_readback_required_candidate_count=17`、`required_readback_field_count=34`、`reviewer_check_count=32`、`outcome_lane_count=11`、`blocked_action_count=51`、`post_incident_readback_received_count=0`、`post_incident_readback_accepted_count=0`、`runtime_gate_count=0`，並由 `security-mirror-progress-guard.py` 鎖住 readback ids、reviewer checks、outcome lanes、blocked actions 與 false flags | 這是 backup / restore / escrow / retention 事故後回讀計畫，不是 owner response received / accepted、backup status accepted、restore drill accepted、offsite sync accepted、credential escrow proof accepted、backup run、restore run、offsite sync、remote delete、credential escrow marker write、retention change、restic prune、rclone config、Velero restore / backup、kubectl、SSH、secret collection、host write、production write 或 runtime gate；前端數字會隨本輪 commit / deploy 另行 smoke | | Monitoring / Alerting / Observability Owner Request Draft | 本地完成 | `monitoring-owner-request-draft.snapshot.json` 已固定 `request_draft_count=60`、`write_capable_request_draft_count=11`、`live_evidence_required_request_count=60`、`request_field_count=24`、`required_owner_field_count=14`、`blocked_action_count=24`、`request_sent_count=0`、`owner_response_received_count=0`、`runtime_gate_count=0`，並由 `security-mirror-progress-guard.py` 鎖住 request ids、blocked actions 與 false flags | 這是 Prometheus、Alertmanager、Grafana、SigNoz、Sentry、Langfuse、OTEL、Telegram / notification policy、deploy / reload scripts 與 alert chain smoke 的人工送件前 request draft，不是 request sent、owner response received / accepted、live evidence、Prometheus reload、Alertmanager reload、Grafana import、SigNoz apply、Sentry deploy、Langfuse change、OTEL reload、receiver route change、silence change、Telegram send、live alert fire、alert chain smoke、secret collection、host write、production write 或 runtime gate；不需要 production browser smoke | | Monitoring / Alerting / Observability Post-incident Readback Plan | 本地完成 | `monitoring-post-incident-readback-plan.snapshot.json` 已固定 `readback_candidate_count=60`、`write_capable_readback_candidate_count=11`、`live_evidence_required_readback_candidate_count=60`、`alert_rule_readback_candidate_count=13`、`deploy_or_reload_readback_candidate_count=6`、`required_readback_field_count=30`、`reviewer_check_count=28`、`outcome_lane_count=11`、`blocked_action_count=53`、`post_incident_readback_received_count=0`、`post_incident_readback_accepted_count=0`、`runtime_gate_count=0`，並由 `security-mirror-progress-guard.py` 鎖住 readback ids、reviewer checks、outcome lanes、blocked actions 與 false flags | 這是監控 / 告警事故後回讀計畫，不是 owner response received / accepted、live evidence、Prometheus reload、Alertmanager reload、Grafana import、SigNoz apply、Sentry deploy、Langfuse change、OTEL reload、receiver route change、silence change、Telegram send、live alert fire、alert chain smoke、secret collection、host write、production write 或 runtime gate；前端數字會隨本輪 commit / deploy 另行 smoke | | S3 approval gate | 進行中 | `security_approval_gate_v1` 已建立 8 個人工 gate items：7 pending、1 block candidate、0 approved | 不得繞過人工批准；批准後仍需 follow-up runtime gate | diff --git a/docs/security/backup-restore-post-incident-readback-plan.snapshot.json b/docs/security/backup-restore-post-incident-readback-plan.snapshot.json new file mode 100644 index 000000000..7b3f33758 --- /dev/null +++ b/docs/security/backup-restore-post-incident-readback-plan.snapshot.json @@ -0,0 +1,10936 @@ +{ + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "execution_boundaries": { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "backup_run_authorized": false, + "credential_escrow_marker_write_authorized": false, + "credential_recovery_execution_authorized": false, + "host_write_authorized": false, + "kubectl_action_authorized": false, + "not_authorization": true, + "offsite_remote_delete_authorized": false, + "offsite_sync_authorized": false, + "production_write_authorized": false, + "raw_backup_payload_storage_allowed": false, + "rclone_config_authorized": false, + "restic_prune_authorized": false, + "restore_run_authorized": false, + "retention_change_authorized": false, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "velero_backup_authorized": false, + "velero_restore_authorized": false + }, + "generated_at": "2026-06-18T10:30:00+08:00", + "git_commit": "3e30807c", + "mode": "metadata_only_no_backup_no_restore_no_secret_value", + "operator_interpretation": [ + "此計畫只定義 Backup / Restore / Escrow 事故後回讀欄位，不代表 live backup store 已讀取或可讀取。", + "backup success、route 200、dashboard up、alert quiet、textfile present、UI 可見或 CD success 都不能單獨當成 DR / backup 健康。", + "未來若要 backup、restore、offsite sync、remote delete、retention / prune、escrow marker、Velero、kubectl、SSH 或 production write，必須另有維護窗口、rollback owner 與人工批准。" + ], + "outcome_lanes": [ + { + "lane_id": "waiting_post_incident_readback", + "meaning": "尚未收到 Backup / Restore / Escrow 事故回讀包；所有 accepted / runtime count 維持 0。" + }, + { + "lane_id": "request_actor_or_time_supplement", + "meaning": "缺 actor、change / outage time window、intent 或 break-glass reason 時要求補件。" + }, + { + "lane_id": "request_backup_freshness_supplement", + "meaning": "缺 before / after freshness、backup status、alert textfile 或 scorecard 時要求補件。" + }, + { + "lane_id": "request_restore_isolation_supplement", + "meaning": "缺 restore drill、隔離目標、observer、stop condition 或 rollback validation 時要求補件。" + }, + { + "lane_id": "request_offsite_retention_supplement", + "meaning": "缺 offsite sync、remote delete guard、retention runway 或 prune decision 時要求補件。" + }, + { + "lane_id": "request_escrow_non_secret_supplement", + "meaning": "缺 credential escrow non-secret proof 或 recovery drill metadata 時要求補件。" + }, + { + "lane_id": "quarantine_raw_payload", + "meaning": "收到 secret、raw backup listing、raw restore payload、raw DB dump、rclone config 或未脫敏截圖時只能隔離。" + }, + { + "lane_id": "reject_false_green_claim", + "meaning": "把 backup success、route 200、dashboard up、alert quiet、textfile present 或 UI 可見當驗收時拒收。" + }, + { + "lane_id": "ready_for_backup_restore_post_incident_review", + "meaning": "metadata 合格後，只能進 backup / restore reviewer review。" + }, + { + "lane_id": "recurrence_guard_backfill_required", + "meaning": "需補防再發 guard、retention freeze、remote-delete block、owner review 或 automation block。" + }, + { + "lane_id": "waiting_runtime_gate", + "meaning": "即使 readback accepted，runtime gate 仍需獨立人工批准。" + } + ], + "readback_candidates": [ + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "gitea", + "momo", + "harbor", + "awoooi", + "langfuse", + "monitoring", + "signoz", + "open-webui", + "clawbot" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "backup_orchestrator", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:backup_all_orchestrator", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:backup_all_orchestrator", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:backup_all_orchestrator", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "backup_all_orchestrator", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "RESTIC_PASSWORD_FILE", + "B2 metadata", + "KEEP_DAILY=30", + "KEEP_WEEKLY=12", + "KEEP_MONTHLY=24" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "backup_common_policy", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:backup_common_restic_retention", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:backup_common_restic_retention", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:backup_common_restic_retention", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "backup_common_restic_retention", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "Gitea DB", + "repositories", + "app.ini redaction boundary" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "service_backup_script", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:backup_gitea_service_script", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:backup_gitea_service_script", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:backup_gitea_service_script", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "backup_gitea_service_script", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "MOMO PostgreSQL", + "188 database path" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "service_backup_script", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:backup_momo_service_script", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:backup_momo_service_script", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:backup_momo_service_script", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "backup_momo_service_script", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "Harbor registry", + "Harbor DB", + "image registry recovery" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "service_backup_script", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:backup_harbor_service_script", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:backup_harbor_service_script", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:backup_harbor_service_script", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "backup_harbor_service_script", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "awoooi_prod", + "awoooi_dev", + "k3s datastore" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "service_backup_script", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:backup_awoooi_service_script", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:backup_awoooi_service_script", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:backup_awoooi_service_script", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "backup_awoooi_service_script", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "awoooi_prod", + "6h RPO", + "latest-only interaction" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "service_backup_script", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:backup_awoooi_frequent_script", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:backup_awoooi_frequent_script", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:backup_awoooi_frequent_script", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "backup_awoooi_frequent_script", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "Langfuse DB", + "AI trace evidence" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "service_backup_script", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:backup_langfuse_service_script", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:backup_langfuse_service_script", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:backup_langfuse_service_script", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "backup_langfuse_service_script", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "Prometheus", + "Grafana", + "Alertmanager" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "service_backup_script", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:backup_monitoring_service_script", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:backup_monitoring_service_script", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:backup_monitoring_service_script", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "backup_monitoring_service_script", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "SigNoz ClickHouse", + "SigNoz SQLite" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "service_backup_script", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:backup_signoz_service_script", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:backup_signoz_service_script", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:backup_signoz_service_script", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "backup_signoz_service_script", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "Open-WebUI volume", + "LLM conversation data" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "service_backup_script", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:backup_open_webui_service_script", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:backup_open_webui_service_script", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:backup_open_webui_service_script", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "backup_open_webui_service_script", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "ClawBot Redis", + "agent state cache" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "service_backup_script", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:backup_clawbot_service_script", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:backup_clawbot_service_script", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:backup_clawbot_service_script", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "backup_clawbot_service_script", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "Sentry", + "ClickHouse / Postgres / Redis dependency boundary" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "service_backup_script", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:backup_sentry_service_script", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:backup_sentry_service_script", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:backup_sentry_service_script", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "backup_sentry_service_script", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "AI artifacts", + "model / evaluation outputs" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "service_backup_script", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:backup_ai_artifacts_script", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:backup_ai_artifacts_script", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:backup_ai_artifacts_script", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "backup_ai_artifacts_script", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "public routes", + "Nginx route reconstruction", + "frontend/API smoke evidence" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "service_backup_script", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:backup_public_routes_script", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:backup_public_routes_script", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:backup_public_routes_script", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "backup_public_routes_script", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "systemd", + "docker", + "nginx", + "cron", + "k8s", + "host configs" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "config_backup_script", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:config_backup_capture", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:config_backup_capture", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:config_backup_capture", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "config_backup_capture", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "freshness", + "failure", + "integrity", + "restore drill", + "offsite", + "escrow" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "backup_status_reporter", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:backup_status_reporter", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:backup_status_reporter", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:backup_status_reporter", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "backup_status_reporter", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "restic check", + "read-data subset", + "integrity evidence" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "integrity_check_script", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:backup_integrity_check", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:backup_integrity_check", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:backup_integrity_check", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "backup_integrity_check", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "keep latest", + "local delete", + "retention marker" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "retention_enforcer", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:latest_only_retention_enforcer", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:latest_only_retention_enforcer", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:latest_only_retention_enforcer", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "latest_only_retention_enforcer", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "13 repos", + "rclone sync", + "remote delete", + "success markers" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "offsite_sync_controller", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:offsite_sync_controller", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:offsite_sync_controller", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:offsite_sync_controller", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "offsite_sync_controller", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "remote repo count", + "latest-only evidence", + "textfile metrics" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "offsite_verifier", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:offsite_full_sync_verifier", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:offsite_full_sync_verifier", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:offsite_full_sync_verifier", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "offsite_full_sync_verifier", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "status", + "dry-run-small", + "pre-full-sync", + "escrow markers" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "offsite_readiness_gate", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:offsite_readiness_gate", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:offsite_readiness_gate", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:offsite_readiness_gate", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "offsite_readiness_gate", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "script presence", + "offsite marker", + "escrow marker", + "redacted output" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "offsite_escrow_report", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:offsite_escrow_evidence_report", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:offsite_escrow_evidence_report", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:offsite_escrow_evidence_report", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "offsite_escrow_evidence_report", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "restic password", + "offsite provider", + "break-glass admin", + "DNS recovery", + "OAuth / AI provider recovery" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "credential_escrow_marker", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:credential_escrow_marker", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:credential_escrow_marker", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:credential_escrow_marker", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "credential_escrow_marker", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "rclone remote", + "Google Drive", + "offsite.env metadata" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "offsite_rclone_config", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:offsite_rclone_config", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:offsite_rclone_config", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:offsite_rclone_config", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "offsite_rclone_config", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "Backblaze B2 metadata", + "offsite env", + "fallback provider" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "offsite_b2_config", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:offsite_b2_config", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:offsite_b2_config", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:offsite_b2_config", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "offsite_b2_config", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "freshness metrics", + "restore drill metrics", + "offsite metrics", + "escrow metrics" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "backup_health_exporter", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:backup_health_textfile_exporter", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:backup_health_textfile_exporter", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:backup_health_textfile_exporter", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "backup_health_textfile_exporter", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "Velero restore dry-run", + "weekly schedule", + "textfile metrics" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "velero_restore_cronjob", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:velero_restore_test_cronjob", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:velero_restore_test_cronjob", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:velero_restore_test_cronjob", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "velero_restore_test_cronjob", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "restore dry-run script", + "13-digit textfile timestamp risk", + "Prometheus textfile" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "velero_restore_script_configmap", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:velero_restore_test_script_configmap", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:velero_restore_test_script_configmap", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:velero_restore_test_script_configmap", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "velero_restore_test_script_configmap", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "restore dry-run", + "Prometheus textfile seconds timestamp", + "failure metric" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "velero_restore_standalone_script", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:velero_standalone_restore_test_script", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:velero_standalone_restore_test_script", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:velero_standalone_restore_test_script", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "velero_standalone_restore_test_script", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "MinIO credential names", + "placeholder values", + "External Secrets / Sealed Secrets recommendation" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "velero_credentials_manifest", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:velero_credentials_manifest", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:velero_credentials_manifest", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:velero_credentials_manifest", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "velero_credentials_manifest", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "Velero Deployment", + "cluster-admin binding", + "MinIO s3Url", + "backup storage location" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "velero_install_manifest", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:velero_install_manifest", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:velero_install_manifest", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:velero_install_manifest", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "velero_install_manifest", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": true + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "BackupRestoreTestFailed", + "Velero freshness", + "offsite freshness", + "restore stale" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "backup_restore_alert_rules", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:backup_restore_alert_rules", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:backup_restore_alert_rules", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:backup_restore_alert_rules", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "backup_restore_alert_rules", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "readiness matrix", + "blocked targets", + "restore drill status" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "dr_readiness_contract", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:backup_dr_readiness_contract", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:backup_dr_readiness_contract", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:backup_dr_readiness_contract", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "backup_dr_readiness_contract", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "database restore", + "configuration restore", + "credential escrow", + "K8s restore", + "observability restore" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "restore_drill_approval_template", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:backup_restore_drill_approval_template", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:backup_restore_drill_approval_template", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:backup_restore_drill_approval_template", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "backup_restore_drill_approval_template", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "offsite_rclone_full_sync", + "credential_escrow_markers", + "velero_k8s_resources" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "offsite_escrow_readiness_contract", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:offsite_escrow_readiness_contract", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:offsite_escrow_readiness_contract", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:offsite_escrow_readiness_contract", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "offsite_escrow_readiness_contract", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "110 backup center", + "latest-only", + "Google Drive / rclone", + "credential escrow", + "120 blocker" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "backup_status_runbook", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:backup_status_runbook", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:backup_status_runbook", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:backup_status_runbook", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "backup_status_runbook", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": false + }, + { + "action_buttons_allowed": false, + "active_scan_authorized": false, + "actor_attribution_accepted": false, + "actor_attribution_ref": null, + "after_backup_freshness_state_ref": null, + "alert_textfile_readback_accepted": false, + "alert_textfile_readback_ref": null, + "backup_dependency_map_readback_accepted": false, + "backup_dependency_map_readback_ref": null, + "backup_health_no_false_green_readback_accepted": false, + "backup_health_no_false_green_readback_ref": null, + "backup_incident_or_change_ref": null, + "backup_run_authorized": false, + "backup_scope": [ + "cold start", + "backup-all", + "sync-offsite", + "restore guard", + "schedules" + ], + "backup_status_readback_accepted": false, + "backup_status_readback_ref": null, + "before_after_freshness_accepted": false, + "before_backup_freshness_state_ref": null, + "blocked_actions": [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button" + ], + "change_intent_or_break_glass_ref": null, + "change_or_outage_time_window_ref": null, + "cold_start_dr_scorecard_accepted": false, + "cold_start_dr_scorecard_ref": null, + "config_kind": "cold_start_sop", + "control_tier": "C0", + "credential_escrow_marker_write_authorized": false, + "credential_escrow_non_secret_readback_accepted": false, + "credential_escrow_non_secret_readback_ref": null, + "credential_recovery_drill_readback_accepted": false, + "credential_recovery_drill_readback_ref": null, + "credential_recovery_execution_authorized": false, + "cross_project_sync_accepted": false, + "cross_project_sync_ref": null, + "data_classification_readback_accepted": false, + "data_classification_readback_ref": null, + "followup_owner": "pending_post_incident_readback", + "host_write_authorized": false, + "kubectl_action_authorized": false, + "maintenance_window": "pending_post_incident_readback", + "no_false_green_accepted": false, + "not_approval": true, + "offsite_remote_delete_authorized": false, + "offsite_remote_delete_guard_accepted": false, + "offsite_remote_delete_guard_readback_ref": null, + "offsite_sync_authorized": false, + "offsite_sync_readback_accepted": false, + "offsite_sync_readback_ref": null, + "outcome_lanes": [ + "waiting_post_incident_readback", + "request_actor_or_time_supplement", + "request_backup_freshness_supplement", + "request_restore_isolation_supplement", + "request_offsite_retention_supplement", + "request_escrow_non_secret_supplement", + "quarantine_raw_payload", + "reject_false_green_claim", + "ready_for_backup_restore_post_incident_review", + "recurrence_guard_backfill_required", + "waiting_runtime_gate" + ], + "post_change_monitoring_accepted": false, + "post_change_monitoring_ref": null, + "post_incident_readback_accepted": false, + "post_incident_readback_candidate_id": "backup_restore_post_incident_readback:cold_start_sop", + "post_incident_readback_received": false, + "postcheck_readback_accepted": false, + "postcheck_readback_ref": null, + "production_write_authorized": false, + "rclone_config_authorized": false, + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "recurrence_guard_accepted": false, + "recurrence_guard_ref": null, + "redacted_evidence_refs": [], + "request_id": "backup_restore_owner_request:cold_start_sop", + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "requires_live_evidence": true, + "restic_prune_authorized": false, + "restore_drill_readback_accepted": false, + "restore_drill_readback_ref": null, + "restore_observer_stop_condition_accepted": false, + "restore_observer_stop_condition_ref": null, + "restore_run_authorized": false, + "restore_target_isolation_readback_accepted": false, + "restore_target_isolation_readback_ref": null, + "retention_change_authorized": false, + "retention_or_prune_decision_accepted": false, + "retention_or_prune_decision_ref": null, + "retention_runway_readback_accepted": false, + "retention_runway_readback_ref": null, + "reviewer_checks": [ + "source_owner_response_acceptance_current", + "incident_or_change_ref_present", + "actor_attribution_present", + "change_or_outage_time_window_present", + "intent_or_break_glass_present", + "before_after_freshness_present", + "backup_status_readback_present", + "restore_drill_readback_present", + "restore_target_isolation_present", + "offsite_sync_readback_present", + "remote_delete_guard_present", + "credential_escrow_non_secret_present", + "credential_recovery_drill_metadata_only", + "retention_runway_present", + "retention_or_prune_decision_present", + "dependency_map_present", + "data_classification_present", + "restore_observer_stop_condition_present", + "backup_health_no_false_green_present", + "alert_textfile_readback_present", + "cold_start_scorecard_present", + "cross_project_sync_present", + "rollback_validation_present", + "post_change_monitoring_present", + "postcheck_independent", + "recurrence_guard_present", + "maintenance_window_present", + "redacted_refs_only", + "secret_value_absent", + "raw_payload_absent", + "no_false_green", + "runtime_stays_zero" + ], + "reviewer_outcome": "waiting_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "rollback_validation_accepted": false, + "rollback_validation_ref": null, + "runtime_gate": false, + "secret_value_collection_allowed": false, + "source_acceptance_candidate_id": "backup_restore_owner_response_acceptance:cold_start_sop", + "ssh_read_authorized": false, + "ssh_write_authorized": false, + "status": "waiting_post_incident_readback", + "surface_id": "cold_start_sop", + "velero_backup_authorized": false, + "velero_restore_authorized": false, + "write_capable_surface": false + } + ], + "readback_fields": [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval" + ], + "required_readback_fields": [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation" + ], + "reviewer_checks": [ + { + "check_id": "source_owner_response_acceptance_current", + "instruction": "來源 owner response acceptance snapshot 必須是目前版本。" + }, + { + "check_id": "incident_or_change_ref_present", + "instruction": "必須有 incident、change、outage、ticket 或 maintenance ref，不能只寫備份正常。" + }, + { + "check_id": "actor_attribution_present", + "instruction": "必須標示 actor role / team，不接受匿名 backup、restore、sync、prune 或 escrow marker write。" + }, + { + "check_id": "change_or_outage_time_window_present", + "instruction": "必須有變更 / 異常時間窗，供 freshness、offsite、alert 與 cold-start scorecard 對齊。" + }, + { + "check_id": "intent_or_break_glass_present", + "instruction": "正常變更需有 change intent；緊急變更需有 break-glass reason，但 break-glass 不等於事前批准。" + }, + { + "check_id": "before_after_freshness_present", + "instruction": "必須有 before / after backup freshness state ref，不得只看最新一次成功。" + }, + { + "check_id": "backup_status_readback_present", + "instruction": "backup status 只能收 owner-provided redacted ref，不得讀 raw backup store 或未脫敏 listing。" + }, + { + "check_id": "restore_drill_readback_present", + "instruction": "restore drill 必須是 readback / approval metadata，不得是 production restore 執行要求。" + }, + { + "check_id": "restore_target_isolation_present", + "instruction": "必須有隔離 restore target 或明確 no-production-write 邊界。" + }, + { + "check_id": "offsite_sync_readback_present", + "instruction": "offsite sync 必須有 redacted state ref，不得保存 raw remote path、object listing 或 rclone config。" + }, + { + "check_id": "remote_delete_guard_present", + "instruction": "任何 latest-only、remote delete 或 retention policy 必須有 remote delete guard 與 owner ref。" + }, + { + "check_id": "credential_escrow_non_secret_present", + "instruction": "credential escrow 只能是 non-secret proof / marker ref，不得包含 value、hash、seed、recovery code 或 partial token。" + }, + { + "check_id": "credential_recovery_drill_metadata_only", + "instruction": "credential recovery drill 必須以 metadata / evidence id 呈現，不保存 secret derivative。" + }, + { + "check_id": "retention_runway_present", + "instruction": "retention / prune 必須有可恢復窗口、runway、撤回條件與 owner。" + }, + { + "check_id": "retention_or_prune_decision_present", + "instruction": "retention 或 prune decision 必須獨立列出，不得與 offsite sync 成功混在一起。" + }, + { + "check_id": "dependency_map_present", + "instruction": "必須列出 DB、repo、registry、object storage、K8s、monitoring、credential escrow 與 DR runbook 依賴圖 ref。" + }, + { + "check_id": "data_classification_present", + "instruction": "必須標示備份集資料分級；不得要求 raw customer data、payload 或 unredacted archive listing。" + }, + { + "check_id": "restore_observer_stop_condition_present", + "instruction": "restore / drill 必須有 observer、stop condition、rollback owner 與停損條件。" + }, + { + "check_id": "backup_health_no_false_green_present", + "instruction": "backup health / textfile / alert evidence 必須防止 false green，不能只看單一 healthy、route 200 或 dashboard up。" + }, + { + "check_id": "alert_textfile_readback_present", + "instruction": "若涉及告警或 textfile exporter，必須回讀 stale / partial / missing marker，不得只看 alert quiet。" + }, + { + "check_id": "cold_start_scorecard_present", + "instruction": "若影響冷啟動或 DR，必須有 cold-start / scorecard ref，且不能偽造 credential escrow evidence。" + }, + { + "check_id": "cross_project_sync_present", + "instruction": "若影響 AwoooP、IwoooS、momo、Gitea、Harbor、monitoring 或公開站，需有跨專案同步 ref。" + }, + { + "check_id": "rollback_validation_present", + "instruction": "必須提供 rollback validation ref，包含 rollback owner 與回復方式。" + }, + { + "check_id": "post_change_monitoring_present", + "instruction": "必須有 post-change monitoring window，觀察 freshness、offsite、restore target、alerts 與 scorecard。" + }, + { + "check_id": "postcheck_independent", + "instruction": "post-check 必須獨立於原操作人、單一 backup status 與 UI 顯示。" + }, + { + "check_id": "recurrence_guard_present", + "instruction": "必須提出防再發 guard、owner review、retention freeze、remote-delete block 或 automation block。" + }, + { + "check_id": "maintenance_window_present", + "instruction": "後續任何 backup、restore、offsite sync、prune、escrow marker 或 Velero 動作都需維護窗口。" + }, + { + "check_id": "redacted_refs_only", + "instruction": "evidence 只能是脫敏 ref、hash、ticket、commit 或 artifact pointer。" + }, + { + "check_id": "secret_value_absent", + "instruction": "不得出現 token、private key、rclone config、restic password、seed、kubeconfig、recovery code、credential URL 或 partial secret。" + }, + { + "check_id": "raw_payload_absent", + "instruction": "不得保存 raw backup listing、raw restore payload、raw archive content、raw object path、raw DB dump 或未脫敏 screenshot。" + }, + { + "check_id": "no_false_green", + "instruction": "不得只用 backup success、route 200、dashboard up、alert quiet、textfile present、UI 可見或 CD success 當 DR / backup 驗收。" + }, + { + "check_id": "runtime_stays_zero", + "instruction": "readback plan 不得觸發 backup、restore、offsite sync、remote delete、retention change、prune、Velero、kubectl、SSH 或 production write。" + } + ], + "schema_version": "backup_restore_post_incident_readback_plan_v1", + "source_paths": [ + "docs/security/BACKUP-RESTORE-ESCROW-INVENTORY.md", + "docs/security/backup-restore-escrow-inventory.snapshot.json", + "docs/security/BACKUP-RESTORE-OWNER-RESPONSE-ACCEPTANCE.md", + "docs/security/backup-restore-owner-response-acceptance.snapshot.json" + ], + "source_schema_version": "backup_restore_owner_response_acceptance_v1", + "source_status": "owner_response_acceptance_ledger_ready_no_runtime_action", + "status": "post_incident_readback_plan_ready_no_runtime_action", + "summary": { + "action_button_count": 0, + "active_scan_authorized_count": 0, + "actor_attribution_accepted_count": 0, + "alert_textfile_readback_accepted_count": 0, + "backup_dependency_map_readback_accepted_count": 0, + "backup_health_no_false_green_readback_accepted_count": 0, + "backup_run_authorized_count": 0, + "backup_status_readback_accepted_count": 0, + "before_after_freshness_accepted_count": 0, + "blocked_action_count": 51, + "cold_start_dr_scorecard_accepted_count": 0, + "coverage_percent_after_readback_plan": 66, + "credential_escrow_marker_write_authorized_count": 0, + "credential_escrow_non_secret_readback_accepted_count": 0, + "credential_recovery_drill_readback_accepted_count": 0, + "credential_recovery_execution_authorized_count": 0, + "cross_project_sync_accepted_count": 0, + "cross_project_sync_required_candidate_count": 38, + "data_classification_readback_accepted_count": 0, + "host_write_authorized_count": 0, + "kubectl_action_authorized_count": 0, + "live_evidence_required_readback_candidate_count": 38, + "no_false_green_accepted_count": 0, + "no_false_green_required_candidate_count": 38, + "offsite_or_escrow_readback_required_candidate_count": 20, + "offsite_remote_delete_authorized_count": 0, + "offsite_remote_delete_guard_accepted_count": 0, + "offsite_sync_authorized_count": 0, + "offsite_sync_readback_accepted_count": 0, + "outcome_lane_count": 11, + "post_change_monitoring_accepted_count": 0, + "post_incident_readback_accepted_count": 0, + "post_incident_readback_received_count": 0, + "postcheck_readback_accepted_count": 0, + "production_write_authorized_count": 0, + "rclone_config_authorized_count": 0, + "readback_candidate_count": 38, + "readback_field_count": 45, + "recurrence_guard_accepted_count": 0, + "required_readback_field_count": 34, + "restic_prune_authorized_count": 0, + "restore_drill_readback_accepted_count": 0, + "restore_drill_readback_required_candidate_count": 38, + "restore_observer_stop_condition_accepted_count": 0, + "restore_run_authorized_count": 0, + "restore_target_isolation_readback_accepted_count": 0, + "retention_change_authorized_count": 0, + "retention_or_prune_decision_accepted_count": 0, + "retention_or_remote_delete_readback_required_candidate_count": 17, + "retention_runway_readback_accepted_count": 0, + "reviewer_check_count": 32, + "rollback_validation_accepted_count": 0, + "runtime_gate_count": 0, + "secret_value_collection_allowed_count": 0, + "source_acceptance_candidate_count": 38, + "source_blocked_action_count": 31, + "source_live_evidence_required_candidate_count": 38, + "source_owner_response_accepted_count": 0, + "source_required_owner_field_count": 23, + "source_reviewer_check_count": 22, + "source_runtime_gate_count": 0, + "source_write_capable_acceptance_candidate_count": 27, + "ssh_read_authorized_count": 0, + "ssh_write_authorized_count": 0, + "velero_backup_authorized_count": 0, + "velero_restore_authorized_count": 0, + "write_capable_readback_candidate_count": 27 + } +} diff --git a/docs/security/high-value-config-control-coverage.snapshot.json b/docs/security/high-value-config-control-coverage.snapshot.json index b9231a65c..4d2385baa 100644 --- a/docs/security/high-value-config-control-coverage.snapshot.json +++ b/docs/security/high-value-config-control-coverage.snapshot.json @@ -260,19 +260,21 @@ "action_buttons_allowed": false, "category_id": "backup_restore_credential", "control_tier": "C0", - "coverage_percent": 64, - "coverage_status": "restore_recovery_backfill_ready_needs_owner_live_evidence", - "current_gap": "已固定 owner response acceptance、restore recovery backfill、remote delete guard、retention runway、credential recovery metadata-only 與 backup health no-false-green 只讀帳本；restore drill、offsite sync、credential escrow、retention change、live evidence 與 owner response 仍全部為 0。", + "coverage_percent": 66, + "coverage_status": "post_incident_readback_plan_ready_needs_backup_restore_owner_evidence", + "current_gap": "已固定 owner response acceptance、restore recovery backfill 與事故後回讀計畫；freshness before-after、backup status readback、restore drill、隔離 restore target、offsite sync、remote delete guard、credential escrow non-secret proof、retention runway、alert textfile、cold-start scorecard、rollback、post-change monitoring、防再發與 no-false-green 已納入只讀帳本；owner response、事故回讀包、live backup evidence、restore drill accepted、offsite / escrow / retention accepted 與 runtime gate 仍全部為 0。", "evidence_refs": [ "docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md", "docs/security/BACKUP-RESTORE-ESCROW-INVENTORY.md", "docs/security/backup-restore-escrow-inventory.snapshot.json", "docs/security/BACKUP-RESTORE-OWNER-RESPONSE-ACCEPTANCE.md", "docs/security/backup-restore-owner-response-acceptance.snapshot.json", + "docs/security/BACKUP-RESTORE-POST-INCIDENT-READBACK-PLAN.md", + "docs/security/backup-restore-post-incident-readback-plan.snapshot.json", "docs/schemas/backup_restore_escrow_inventory_v1.schema.json" ], "label": "Backup / restore / escrow / retention", - "next_owner_action": "補 restore drill approval package、freshness SLO、隔離 restore target、依賴圖、資料分級、offsite remote delete guard、credential recovery non-secret proof、retention runway、observer / stop condition、rollback owner、validation plan 與 no-secret-value evidence。", + "next_owner_action": "補 Backup / Restore / Escrow 事故回讀包：incident / change ref、actor role / team、時間窗、改前改後 freshness、backup status readback、restore drill、隔離 restore target、offsite sync、remote delete guard、credential escrow non-secret proof、credential recovery metadata、retention runway、retention / prune decision、依賴圖、資料分級、restore observer / stop condition、alert textfile、cold-start / DR scorecard、rollback validation、post-change monitoring、recurrence guard 與 no-secret-value evidence。", "owner_response_accepted": false, "owner_response_received": false, "owner_response_required": true, @@ -653,16 +655,9 @@ "websocket_route_change_authorized": false, "workflow_modification_authorized": false }, - "generated_at": "2026-06-16T00:30:00+08:00", - "git_commit": "7db05e00", + "generated_at": "2026-06-18T10:30:00+08:00", + "git_commit": "3e30807c", "lowest_coverage_categories": [ - { - "category_id": "backup_restore_credential", - "coverage_percent": 64, - "current_gap": "已固定 owner response acceptance、restore recovery backfill、remote delete guard、retention runway、credential recovery metadata-only 與 backup health no-false-green 只讀帳本；restore drill、offsite sync、credential escrow、retention change、live evidence 與 owner response 仍全部為 0。", - "label": "Backup / restore / escrow / retention", - "next_owner_action": "補 restore drill approval package、freshness SLO、隔離 restore target、依賴圖、資料分級、offsite remote delete guard、credential recovery non-secret proof、retention runway、observer / stop condition、rollback owner、validation plan 與 no-secret-value evidence。" - }, { "category_id": "docker_compose_systemd_host_config", "coverage_percent": 64, @@ -683,6 +678,13 @@ "current_gap": "已固定 AI provider / model routing owner response acceptance 帳本；provider owner、fallback order、dry-run、benchmark、成本、privacy、data classification、prompt redaction、rollback 與 post-check evidence 仍全部為 0，目前不切 production。", "label": "AI provider / model routing / Ollama proxy / cost and privacy", "next_owner_action": "補 provider owner、fallback order、dry-run result、benchmark result、cost review、privacy review、data classification、prompt redaction、quota budget、quality gate、rollback owner 與 post-check evidence。" + }, + { + "category_id": "k8s_production_gitops", + "coverage_percent": 66, + "current_gap": "已固定 owner response acceptance、GitOps 變更證據驗收與事故後回讀計畫只讀帳本；ArgoCD sync / health / degraded、Pending workload、image pull / scheduling、rollout before-after、event / metrics / alert、drift scanner、CronJob schedule、NetworkPolicy / RBAC、route / AI provider / monitoring 影響、防再發與 no-false-green 已納入；仍缺 owner response、事故回讀包、rendered manifest diff、ArgoCD revision、maintenance window、rollback revision、post-check owner 與 no-secret-value evidence。", + "label": "K8s / ArgoCD / production manifests", + "next_owner_action": "補 GitOps / K8s 事故回讀包：incident / change ref、actor role / team、ArgoCD sync / health / revision、degraded / Pending / image pull / scheduling 摘要、rollout before-after、event summary、metrics / alert、drift scanner、CronJob schedule、NetworkPolicy / Service / RBAC 影響、public/admin route、AI provider、monitoring、operator notification、cross-project sync、recovery 或 still-degraded ref、recurrence guard、maintenance window、rollback revision、rollback owner、post-check owner 與 no-secret-value evidence。" } ], "next_collection_order": [ diff --git a/docs/security/iwooos-posture-projection.snapshot.json b/docs/security/iwooos-posture-projection.snapshot.json index a3209dbdf..0e6b2f64d 100644 --- a/docs/security/iwooos-posture-projection.snapshot.json +++ b/docs/security/iwooos-posture-projection.snapshot.json @@ -8402,6 +8402,8 @@ "docs/security/BACKUP-RESTORE-ESCROW-INVENTORY.md", "docs/security/backup-restore-owner-response-acceptance.snapshot.json", "docs/security/BACKUP-RESTORE-OWNER-RESPONSE-ACCEPTANCE.md", + "docs/security/BACKUP-RESTORE-POST-INCIDENT-READBACK-PLAN.md", + "docs/security/backup-restore-post-incident-readback-plan.snapshot.json", "docs/schemas/backup_restore_escrow_inventory_v1.schema.json", "docs/security/monitoring-alerting-observability-inventory.snapshot.json", "docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md", @@ -8493,6 +8495,7 @@ "awooop_high_value_config_owner_packet_summary_count": 4, "awooop_read_only_landing_readiness_item_count": 6, "awooop_read_only_production_landing_evidence_count": 1, + "backup_restore_credential_coverage_percent": 66, "backup_restore_escrow_inventory_action_button_count": 0, "backup_restore_escrow_inventory_alert_surface_count": 1, "backup_restore_escrow_inventory_backup_script_surface_count": 15, @@ -8521,6 +8524,32 @@ "backup_restore_escrow_inventory_surface_count": 38, "backup_restore_escrow_inventory_velero_surface_count": 5, "backup_restore_escrow_inventory_write_capable_surface_count": 27, + "backup_restore_post_incident_readback_plan_action_button_count": 0, + "backup_restore_post_incident_readback_plan_actor_attribution_accepted_count": 0, + "backup_restore_post_incident_readback_plan_backup_health_no_false_green_readback_accepted_count": 0, + "backup_restore_post_incident_readback_plan_backup_status_readback_accepted_count": 0, + "backup_restore_post_incident_readback_plan_before_after_freshness_accepted_count": 0, + "backup_restore_post_incident_readback_plan_blocked_action_count": 51, + "backup_restore_post_incident_readback_plan_candidate_count": 38, + "backup_restore_post_incident_readback_plan_coverage_percent_after_readback_plan": 66, + "backup_restore_post_incident_readback_plan_credential_escrow_non_secret_readback_accepted_count": 0, + "backup_restore_post_incident_readback_plan_first_layer": true, + "backup_restore_post_incident_readback_plan_live_evidence_required_candidate_count": 38, + "backup_restore_post_incident_readback_plan_offsite_or_escrow_required_candidate_count": 20, + "backup_restore_post_incident_readback_plan_offsite_remote_delete_guard_accepted_count": 0, + "backup_restore_post_incident_readback_plan_offsite_sync_readback_accepted_count": 0, + "backup_restore_post_incident_readback_plan_outcome_lane_count": 11, + "backup_restore_post_incident_readback_plan_post_incident_readback_accepted_count": 0, + "backup_restore_post_incident_readback_plan_post_incident_readback_received_count": 0, + "backup_restore_post_incident_readback_plan_required_readback_field_count": 34, + "backup_restore_post_incident_readback_plan_restore_drill_readback_accepted_count": 0, + "backup_restore_post_incident_readback_plan_restore_drill_required_candidate_count": 38, + "backup_restore_post_incident_readback_plan_restore_target_isolation_readback_accepted_count": 0, + "backup_restore_post_incident_readback_plan_retention_or_remote_delete_required_candidate_count": 17, + "backup_restore_post_incident_readback_plan_retention_runway_readback_accepted_count": 0, + "backup_restore_post_incident_readback_plan_reviewer_check_count": 32, + "backup_restore_post_incident_readback_plan_runtime_gate_count": 0, + "backup_restore_post_incident_readback_plan_write_capable_candidate_count": 27, "block_candidate_count": 1, "cd_runner_secret_injection_change_evidence_acceptance_accepted_count": 0, "cd_runner_secret_injection_change_evidence_acceptance_action_button_count": 0, diff --git a/docs/superpowers/specs/2026-04-15-MASTER-ai-autonomous-flywheel-v2.md b/docs/superpowers/specs/2026-04-15-MASTER-ai-autonomous-flywheel-v2.md index 8ea6bb0f1..b02353bba 100644 --- a/docs/superpowers/specs/2026-04-15-MASTER-ai-autonomous-flywheel-v2.md +++ b/docs/superpowers/specs/2026-04-15-MASTER-ai-autonomous-flywheel-v2.md @@ -704,6 +704,7 @@ Alert / Sentry / SigNoz / Gitea / Market Watch / Operator | `docs/security/ssh-network-owner-response-acceptance.snapshot.json` + `scripts/security/ssh-network-owner-response-acceptance.py` | SSH / Firewall / Network Access Owner Response Acceptance 已本地完成；承接 SSH / network repo-only 清冊與 owner request draft，固定 16 份 acceptance candidate、6 份 write-capable candidate、16 份需 live evidence candidate、29 欄 acceptance field、13 欄 required owner fields、15 個 reviewer check、7 條 outcome lane 與 22 類 blocked action；SSH / network 類別只讀成熟度 `54% -> 58%`，高價值配置平均只讀成熟度仍為 `67%`；request sent、recipient confirmed、owner response received / accepted、live access state、host key pinning、port policy、firewall owner、NetworkPolicy / NodePort、WireGuard cutover、SSH、keyscan、known_hosts patch、firewall / port change、host write、runtime gate、action buttons 仍全部為 `0` | 這是 owner response acceptance 只讀帳本，不是 owner response received / accepted、live host read、host keyscan、known_hosts patch、firewall / port change、NetworkPolicy apply、NodePort change、WireGuard cutover、secret collection、host write、production write 或 runtime gate | | `docs/security/backup-restore-owner-request-draft.snapshot.json` + `scripts/security/backup-restore-owner-request-draft.py` | Backup / Restore / Escrow Owner Request Draft 已本地完成；承接 backup / restore repo-only 清冊，固定 38 份 request draft、27 份 write-capable request draft、38 份需 live evidence request、24 欄 request fields、14 欄 required owner fields 與 18 類 blocked action；request sent、recipient confirmed、owner response received / accepted、live backup evidence、backup run、restore run、offsite sync、escrow marker write、retention change、runtime gate、action buttons 仍全部為 `0` | 這是人工送件前 request draft，不是 request sent、owner response received / accepted、backup run、restore run、offsite sync、remote delete、credential escrow marker write、retention change、restic prune、rclone config、Velero restore / backup、secret collection、host write、production write 或 runtime gate | | `docs/security/backup-restore-owner-response-acceptance.snapshot.json` + `scripts/security/backup-restore-owner-response-acceptance.py` | Backup / Restore / Escrow Owner Response Acceptance 只讀帳本已本地完成；承接 backup / restore owner request draft，固定 38 份 acceptance candidate、27 份 write-capable acceptance candidate、24 欄 acceptance field、14 欄 required owner field、13 個 reviewer check、7 條 outcome lane 與 22 類 blocked action；owner response received / accepted、live backup evidence、backup run、restore run、offsite sync、credential escrow marker write、retention change、runtime gate、action buttons 仍全部為 `0` | 這是 owner response 收件驗收帳本，不是 owner response received / accepted、backup run、restore run、offsite sync、remote delete、credential escrow marker write、retention change、restic prune、rclone config、Velero restore / backup、secret collection、host write、production write 或 runtime gate | +| `docs/security/backup-restore-post-incident-readback-plan.snapshot.json` + `scripts/security/backup-restore-post-incident-readback-plan.py` | Backup / Restore / Escrow Post-incident Readback Plan 已本地完成；承接 owner response acceptance 與 restore recovery 回補，固定 38 份事故後回讀 candidate、27 份 write-capable、38 份需 live evidence、38 份 restore drill required、20 份 offsite / escrow required、17 份 retention / remote delete required、34 欄 required readback field、32 個 reviewer check、11 條 outcome lane 與 51 類 blocked action；backup / restore / credential 類別只讀成熟度 `64% -> 66%`，高價值配置平均維持 `71%`；post-incident readback received / accepted、backup status accepted、restore drill accepted、offsite sync accepted、credential escrow non-secret proof accepted、retention runway accepted、backup health no-false-green accepted、runtime gate、action buttons 仍全部為 `0` | 這是事故後回讀計畫，不是 owner response received / accepted、backup run、restore run、offsite sync、remote delete、credential escrow marker write、retention change、restic prune、rclone config、Velero restore / backup、kubectl、SSH、secret collection、host write、production write 或 runtime gate | | `docs/security/monitoring-owner-request-draft.snapshot.json` + `scripts/security/monitoring-owner-request-draft.py` | Monitoring / Alerting / Observability Owner Request Draft 已本地完成；承接 monitoring repo-only 清冊，固定 60 份 request draft、11 份 write-capable request draft、60 份需 live evidence request、24 欄 request fields、14 欄 required owner fields 與 24 類 blocked action；request sent、recipient confirmed、owner response received / accepted、live evidence、reload、receiver route change、silence change、Telegram send、alert chain smoke、runtime gate、action buttons 仍全部為 `0` | 這是人工送件前 request draft，不是 request sent、owner response received / accepted、Prometheus reload、Alertmanager reload、Grafana import、SigNoz apply、Sentry deploy、Langfuse change、OTEL reload、receiver route change、silence change、Telegram send、live alert fire、alert chain smoke、secret collection、host write、production write 或 runtime gate | | `docs/security/monitoring-owner-response-acceptance.snapshot.json` + `scripts/security/monitoring-owner-response-acceptance.py` | Monitoring / Alerting / Observability Owner Response Acceptance 只讀帳本已本地完成；承接 monitoring owner request draft，固定 60 份 acceptance candidate、11 份 write-capable acceptance candidate、60 份需 live evidence candidate、30 欄 acceptance field、14 欄 required owner field、15 個 reviewer check、7 條 outcome lane 與 28 類 blocked action；monitoring 類別成熟度 `62% -> 66%`，高價值配置平均成熟度 `68% -> 69%`；owner response received / accepted / rejected、live evidence、reload、receiver route change、silence change、Telegram send、live alert fire、alert chain smoke、runtime gate、action buttons 仍全部為 `0` | 這是 owner response 收件驗收帳本，不是 owner response received / accepted、Prometheus reload、Alertmanager reload、Grafana import、SigNoz apply、Sentry deploy、Langfuse change、OTEL reload、receiver route change、silence change、Telegram send、live alert fire、alert chain smoke、secret collection、host write、production write 或 runtime gate | | `docs/security/agent-bounty-owner-request-draft.snapshot.json` + `scripts/security/agent-bounty-owner-request-draft.py` | agent-bounty-protocol Owner Request Draft 已本地完成；承接 onboarding handoff，固定 11 份 request draft、4 份 control boundary、7 份 product surface、8 份 write-capable request draft、4 份 treasury-related request draft、5 份 MCP / A2A-related request draft、22 欄 required owner fields、25 類 forbidden input 與 28 類 blocked action；request sent、recipient confirmed、owner response received / accepted、repo refs truth、deployment boundary、data classification、external agent boundary、treasury boundary、runtime gate、action buttons 仍全部為 `0` | 這是人工送件前 request draft，不是 request sent、owner response received / accepted、repo push、refs sync、workflow 修改、secret collection、deploy、compose restart、DB migration、claim / submit、payout / withdrawal、cron / daemon、external send、host write、production write 或 runtime gate | @@ -863,6 +864,7 @@ Repo / registry / release notes / K8s / host / observability / backup evidence 85. 建立 K8s / ArgoCD Owner Response Acceptance 只讀帳本。✅ 本地完成；新增 `k8s-argocd-owner-response-acceptance.py`、snapshot 與說明文件，將 manifest inventory 與 owner request draft 串成 `acceptance_candidate_count=4`、`c0_acceptance_candidate_count=3`、`required_owner_field_count=11`、`reviewer_check_count=12`、`outcome_lane_count=7`、`blocked_action_count=18` 的 owner response acceptance ledger；owner response received / accepted、rendered manifest diff、ArgoCD API read、ArgoCD sync、kubectl action、live cluster read、secret collection、runtime gate、action buttons 仍全部為 `0`。這不是 owner response received / accepted、ArgoCD API read、ArgoCD sync、kubectl action、live cluster read、secret collection、production write 或 runtime gate。 85a. 建立 K8s / ArgoCD GitOps 變更證據驗收只讀帳本。✅ 本地完成；新增 `k8s-argocd-change-evidence-acceptance.py`、snapshot 與說明文件，將四個 scan group 串成 `change_evidence_candidate_count=4`、`c0_change_evidence_candidate_count=3`、`write_capable_candidate_count=4`、`required_evidence_field_count=18`、`reviewer_check_count=18`、`outcome_lane_count=8`、`blocked_action_count=28` 的 GitOps change evidence acceptance ledger；change evidence received / accepted、runtime approval package、ArgoCD API read、ArgoCD sync、kubectl action、Helm upgrade、NetworkPolicy / NodePort / RBAC change、live cluster read、secret collection、runtime gate、action buttons 仍全部為 `0`。這不是 change evidence received / accepted、runtime approval、ArgoCD API read、ArgoCD sync、kubectl action、Helm upgrade、production write 或 runtime gate。 86. 建立 Backup / Restore / Escrow Owner Response Acceptance 只讀帳本。✅ 本地完成；新增 `backup-restore-owner-response-acceptance.py`、snapshot 與說明文件，將 38 份 backup / restore / escrow owner request draft 串成 `acceptance_candidate_count=38`、`write_capable_acceptance_candidate_count=27`、`live_evidence_required_candidate_count=38`、`required_owner_field_count=14`、`reviewer_check_count=13`、`outcome_lane_count=7`、`blocked_action_count=22` 的 owner response acceptance ledger；backup / restore 類別只讀成熟度 `58% -> 62%`，高價值配置平均只讀成熟度 `66% -> 67%`；owner response received / accepted、live backup evidence、backup run、restore run、offsite sync、remote delete、credential escrow marker write、retention change、secret collection、host write、runtime gate、action buttons 仍全部為 `0`。這不是 owner response received / accepted、backup run、restore run、offsite sync、remote delete、credential escrow marker write、retention change、restic prune、rclone config、Velero restore / backup、secret collection、host write、production write 或 runtime gate。 +86a. 建立 Backup / Restore / Escrow 事故後回讀計畫。✅ 本地完成；新增 `backup-restore-post-incident-readback-plan.py`、snapshot 與說明文件，將 38 份 backup / restore / escrow / retention surface 串成 `readback_candidate_count=38`、`write_capable_readback_candidate_count=27`、`live_evidence_required_readback_candidate_count=38`、`restore_drill_readback_required_candidate_count=38`、`offsite_or_escrow_readback_required_candidate_count=20`、`retention_or_remote_delete_readback_required_candidate_count=17`、`required_readback_field_count=34`、`reviewer_check_count=32`、`outcome_lane_count=11`、`blocked_action_count=51` 的 post-incident readback plan；backup / restore / credential 類別只讀成熟度 `64% -> 66%`，高價值配置平均維持 `71%`；post-incident readback received / accepted、backup status accepted、restore drill accepted、offsite sync accepted、credential escrow non-secret proof accepted、retention runway accepted、backup health no-false-green accepted、backup run、restore run、offsite sync、remote delete、credential escrow marker write、retention change、secret collection、host write、runtime gate、action buttons 仍全部為 `0`。這不是 owner response received / accepted、backup run、restore run、offsite sync、remote delete、credential escrow marker write、retention change、restic prune、rclone config、Velero restore / backup、kubectl、SSH、secret collection、host write、production write 或 runtime gate。 87. 建立 SSH / Firewall / Network Access Owner Response Acceptance 只讀帳本。✅ 本地完成；新增 `ssh-network-owner-response-acceptance.py`、snapshot 與說明文件，將 16 份 SSH / network owner request draft 串成 `acceptance_candidate_count=16`、`write_capable_acceptance_candidate_count=6`、`live_evidence_required_candidate_count=16`、`required_owner_field_count=13`、`reviewer_check_count=15`、`outcome_lane_count=7`、`blocked_action_count=22` 的 owner response acceptance ledger；SSH / network 類別只讀成熟度 `54% -> 58%`，高價值配置平均只讀成熟度仍為 `67%`；owner response received / accepted、live access state、host key pinning、port policy、firewall owner、NetworkPolicy / NodePort、WireGuard cutover、SSH、keyscan、known_hosts patch、firewall / port change、secret collection、host write、runtime gate、action buttons 仍全部為 `0`。這不是 owner response received / accepted、live host read、host keyscan、known_hosts patch、firewall / port change、NetworkPolicy apply、NodePort change、WireGuard cutover、secret collection、host write、production write 或 runtime gate。 88. 建立 Monitoring / Alerting / Observability Owner Response Acceptance 只讀帳本。✅ 本地完成；新增 `monitoring-owner-response-acceptance.py`、snapshot 與說明文件，將 60 份 monitoring owner request draft 串成 `acceptance_candidate_count=60`、`write_capable_acceptance_candidate_count=11`、`live_evidence_required_candidate_count=60`、`acceptance_field_count=30`、`required_owner_field_count=14`、`reviewer_check_count=15`、`outcome_lane_count=7`、`blocked_action_count=28` 的 owner response acceptance ledger；monitoring / alerting / observability 類別只讀成熟度 `62% -> 66%`，高價值配置平均只讀成熟度 `68% -> 69%`；owner response received / accepted / rejected、live evidence、Prometheus reload、Alertmanager reload、Grafana import、SigNoz apply、Sentry deploy、Langfuse change、OTEL reload、receiver route change、silence change、Telegram send、live alert fire、alert chain smoke、secret collection、host write、runtime gate、action buttons 仍全部為 `0`。這不是 owner response received / accepted、reload、deploy、receiver route change、silence change、Telegram send、alert chain smoke、host write、production write 或 runtime gate。 diff --git a/docs/workplans/2026-06-04-iwooos-security-governance-p0.md b/docs/workplans/2026-06-04-iwooos-security-governance-p0.md index 5a17118f4..580d6c2c1 100644 --- a/docs/workplans/2026-06-04-iwooos-security-governance-p0.md +++ b/docs/workplans/2026-06-04-iwooos-security-governance-p0.md @@ -7,9 +7,9 @@ | 項目 | 目前值 | |------|--------| | 工作視窗 | IwoooS / AWOOOI 資安治理 P0 | -| 本次乾淨 worktree | `/tmp/awoooi-iwooos-p2-138-release-decision-hold-20260614-1038` | -| 本次分支 | `codex/iwooos-p2-145-owner-response-acceptance-20260614` | -| 最新觀察到的 `gitea/main` | `e8de19d7 docs(security): 新增 K8s ArgoCD owner request draft [skip ci]` | +| 本次乾淨 worktree | `/tmp/awoooi-cd-runner-secret-verify-20260618` | +| 本次分支 | detached at `gitea/main`；推送時使用 `HEAD:main`，不 force push | +| 最新觀察到的 `gitea/main` | `3e30807c docs(iwooos): 補記 CD runner secret 正式驗證 [skip ci]` | | 最新 P0 Telegram 告警 / 批准執行真相鏈基準 | code `32e4beca`、deploy marker `717b5870`、code-review `2658`、CD `2657`；no-action approval 不再觸發 executor，可執行修復 approval 會寫入 `auto_repair_executions`、KM 與 verifier | | 最新 P0 Telegram no-action 人工處置包基準 | code `cd928852`、deploy marker `9181cc0e`、code-review `2666`；正式部署 tree 已包含 no-action 人工處置包、`處置包 / 重診 / 歷史 / 靜默 / 真相鏈 / Runs` 鍵盤、production pod render / keyboard smoke | | 最新 P0 MCP evidence / PlayBook 修復候選基準 | code `cc614023`、D1 blocker clarity `47d677ac`、D2 manual draft package `febe9ecf`、D3 draft work item `e8d5eafb`、D4 work item detail panel `e8a5bac5`、D5 coverage gap contract 本地完成；目前 production deploy marker 仍為 `985a2cfe` 的 D4 Work Items detail panel，D5 尚待推送 / 部署驗證。正式部署 tree 經 production pod smoke 與 Work Items browser smoke 確認可由 MCP evidence + approved PlayBook trust 產生 medium approval candidate、綁定預配置 approval id、不外露 preallocated metadata，且通用兜底 / 診斷型 PlayBook 不會被誤當修復命令；若缺安全修復候選，Telegram 人工處置包會顯示阻擋原因、下一步、PlayBook 草案欄位與 AwoooP 修復候選草案工作項，工作項頁會顯示 PlayBook 草案處置板、必填欄位、阻擋原因、下一步與 Runs / 審批連結；D5 讓 blocked result 進一步輸出服務 coverage gap、blocking stage、必收 MCP evidence refs 與 PlayBook template fields | @@ -25,7 +25,7 @@ | 最新 P0 agent-bounty-protocol 配置控管基準 | onboarding handoff 已固定 `product_scope_handoff_only`、owner response / runtime gate 全部 `false`；本輪新增 owner request draft，固定 `drafts=11`、`control=4`、`surface=7`、`write_capable=8`、`treasury=4`、`mcp_a2a=5`、`owner_fields=22`、`forbidden_inputs=25`、`blocked_actions=28`、request sent / received / accepted / repo push / refs sync / deploy / claim / submit / payout / daemon / cron / runtime gate 全部 `0` | | 最新 P1 Docker / systemd / Host Service 配置控管基準 | repo-only inventory 已固定 `surface=9`、`write_capable=3`、`live_evidence_required=8`、成熟度 `42% -> 50%`；owner request draft 固定 `drafts=9`、`owner_fields=12`、`blocked_actions=14`；本輪新增 owner response acceptance 只讀帳本，固定 `candidates=9`、`write_capable=3`、`live_evidence_required=8`、`reviewer_checks=14`、`outcome_lanes=7`、`blocked_actions=20`，成熟度 `50% -> 54%`；request sent / received / accepted / live evidence / host read / restart window / rollback owner / host write / runtime gate 全部 `0` | | 最新 P1 SSH / Firewall / Network Access 配置控管基準 | repo-only inventory 已固定 `surface=16`、`write_capable=6`、`live_evidence_required=16`、成熟度 `48% -> 54%`；本輪新增 owner request draft，固定 `drafts=16`、`owner_fields=13`、`blocked_actions=16`、request sent / received / accepted / live access state / firewall / port change / NetworkPolicy / NodePort / WireGuard / host write / runtime gate 全部 `0` | -| 最新 P1 Backup / Restore / Escrow 配置控管基準 | repo-only inventory 已固定 `surface=38`、`write_capable=27`、`live_evidence_required=38`、成熟度 `52% -> 58%`；本輪新增 owner request draft，固定 `drafts=38`、`owner_fields=14`、`blocked_actions=18`、request sent / received / accepted / backup run / restore run / offsite sync / remote delete / escrow marker / retention change / runtime gate 全部 `0` | +| 最新 P1 Backup / Restore / Escrow 配置控管基準 | repo-only inventory 已固定 `surface=38`、`write_capable=27`、`live_evidence_required=38`，owner request draft、owner response acceptance 與 restore recovery 回補已完成；本輪新增 post-incident readback plan，固定 `candidates=38`、`write_capable=27`、`live_evidence_required=38`、`restore_drill_required=38`、`offsite_or_escrow_required=20`、`retention_or_remote_delete_required=17`、`required_fields=34`、`reviewer_checks=32`、`outcome_lanes=11`、`blocked_actions=51`，成熟度 `52% -> 66%`；request sent / received / accepted / backup run / restore run / offsite sync / remote delete / escrow marker / retention change / runtime gate 全部 `0` | | 最新 P1 Monitoring / Alerting / Observability 配置控管基準 | repo-only inventory 已固定 `surface=60`、`write_capable=11`、`live_evidence_required=60`、成熟度 `56% -> 62%`；owner request draft 固定 `drafts=60`、`owner_fields=14`、`blocked_actions=24`；本輪新增 owner response acceptance 只讀帳本，固定 `candidates=60`、`write_capable=11`、`live_evidence_required=60`、`reviewer_checks=15`、`outcome_lanes=7`、`blocked_actions=28`，成熟度 `62% -> 66%`；request sent / received / accepted / rejected / live evidence / reload / receiver route change / Telegram send / alert chain smoke / runtime gate 全部 `0` | | 最新 P0 CD / Runner / Secret 注入變更證據驗收基準 | 已新增 `CD-RUNNER-SECRET-INJECTION-CHANGE-EVIDENCE-ACCEPTANCE.md`、snapshot 與產生器；固定 `candidates=5`、`c0=4`、`c1=1`、`write_capable=5`、`workflow_files=33`、`referenced_secret_names=42`、`runner_labels=5`、`evidence_fields=19`、`reviewer_checks=19`、`outcome_lanes=8`、`blocked_actions=32`；secret metadata 成熟度 `66% -> 68%`，workflow / runner 成熟度 `70% -> 72%`；workflow diff / runner attestation / secret name parity / secret injection route / deploy marker readback / guard result / postcheck evidence accepted、workflow modification、runner change、repo secret change、secret rotation、Gitea action dispatch、production deploy、runtime gate 全部 `0` | | 最新 P0 Public / Admin / API runtime config 變更證據驗收基準 | 已新增 `PUBLIC-RUNTIME-CONFIG-CHANGE-EVIDENCE-ACCEPTANCE.md`、snapshot 與產生器；固定 `candidates=6`、`c0=5`、`c1=1`、`write_capable=6`、`source_refs=20`、`evidence_fields=21`、`reviewer_checks=21`、`outcome_lanes=8`、`blocked_actions=32`；public/admin/API runtime config 成熟度 `62% -> 64%`；affected route / admin auth / API readback / CORS diff / frontend env diff / i18n redaction / desktop-mobile smoke / sensitive scan / postcheck accepted、route / CORS / env / auth / webhook 變更、production deploy、runtime gate 全部 `0`；raw namespace、repo slug、內部狀態碼、內部協作內容外洩列為拒收或隔離 | @@ -321,6 +321,7 @@ P1 只讀重盤階段整體完成度：`70%`。它代表 freshness / inventory / | P0-26 | Backup / Restore / Escrow owner response acceptance 只讀帳本 | 已新增 `BACKUP-RESTORE-OWNER-RESPONSE-ACCEPTANCE.md`、`backup-restore-owner-response-acceptance.snapshot.json` 與產生器；38 份 acceptance candidate、27 份 write-capable、14 個 owner 必填欄位、13 個 reviewer checks、7 條 outcome lanes、22 類 blocked action | 帳本 artifact `100%`；owner response received / accepted、live backup evidence、backup run、restore run、offsite sync、remote delete、escrow marker write、retention change、secret collection、host write、runtime gate 仍全部 `0 / false`；backup / restore 類別成熟度 `58% -> 62%` | | P0-27 | DNS / TLS / certbot owner response acceptance 只讀帳本 | 已新增 `DOMAIN-TLS-CERTBOT-OWNER-RESPONSE-ACCEPTANCE.md`、`domain-tls-certbot-owner-response-acceptance.snapshot.json` 與產生器；4 份 acceptance candidate、4 份 C0、13 個 owner 必填欄位、13 個 reviewer checks、7 條 outcome lanes、20 類 blocked action | 帳本 artifact `100%`；owner response received / accepted、certificate coverage confirmed、DNS query、live TLS probe、certbot renew、Nginx reload、route smoke、DNS record / certificate path / ACME route 變更、host write、runtime gate 仍全部 `0 / false`；DNS / TLS 類別成熟度 `74% -> 78%` | | P0-29 | Public / Admin / API runtime config 變更證據驗收只讀帳本 | 已新增 `PUBLIC-RUNTIME-CONFIG-CHANGE-EVIDENCE-ACCEPTANCE.md`、`public-runtime-config-change-evidence-acceptance.snapshot.json` 與產生器；6 份 change evidence candidate、5 份 C0、6 份 write-capable、20 個 source refs、21 個 reviewer checks、8 條 outcome lanes、32 類 blocked action | 帳本 artifact `100%`；affected route、admin/auth boundary、API readback、CORS diff、frontend env diff、i18n redaction、webhook owner、desktop / mobile smoke、sensitive scan、postcheck、runtime approval package、route / CORS / env / auth / webhook 變更、frontend / API deploy、runtime gate 仍全部 `0 / false`；raw namespace / repo slug / 內部狀態碼 / 內部協作內容外洩列為拒收或隔離；完成後需 production desktop / mobile smoke | +| P1-15 | Backup / Restore / Escrow 事故後回讀計畫 | 已新增 `BACKUP-RESTORE-POST-INCIDENT-READBACK-PLAN.md`、`backup-restore-post-incident-readback-plan.snapshot.json` 與產生器；38 個 readback candidate、27 個 write-capable、38 個需 live evidence、38 個 restore drill required、20 個 offsite / escrow required、17 個 retention / remote delete required、34 個必填回讀欄位、32 個 reviewer checks、11 條 outcome lanes、51 類 blocked action | 事故後回讀 artifact `100%`；post-incident readback received / accepted、backup status accepted、restore drill accepted、offsite sync accepted、credential escrow non-secret proof accepted、retention runway accepted、backup health no-false-green accepted、backup run、restore run、offsite sync、remote delete、escrow marker write、retention change、secret collection、host write、runtime gate 仍全部 `0 / false`；backup / restore 類別成熟度 `64% -> 66%` | ## 7. 2026-06-04 本輪驗證紀錄 diff --git a/scripts/security/backup-restore-post-incident-readback-plan.py b/scripts/security/backup-restore-post-incident-readback-plan.py new file mode 100644 index 000000000..3fe691b8a --- /dev/null +++ b/scripts/security/backup-restore-post-incident-readback-plan.py @@ -0,0 +1,542 @@ +#!/usr/bin/env python3 +""" +IwoooS Backup / Restore / Escrow post-incident readback 只讀計畫產生器。 + +本工具讀取 Backup / Restore / Escrow owner response acceptance snapshot， +建立事故後回讀計畫：誰觸發或觀察到 backup / restore / offsite / escrow +異常、改前改後 freshness / restore / offsite / retention 狀態、是否有 +no-false-green 與 rollback / stop condition。它不執行 backup、不 restore、 +不 rclone / restic / Velero、不寫 escrow marker、不 SSH、不 kubectl、不讀 +secret value、不保存 raw backup listing、不寫 production。 +""" + +from __future__ import annotations + +import argparse +import json +import subprocess +import sys +from datetime import datetime, timedelta, timezone +from pathlib import Path +from typing import Any + + +TAIPEI = timezone(timedelta(hours=8)) + +READBACK_FIELDS = [ + "post_incident_readback_candidate_id", + "source_acceptance_candidate_id", + "request_id", + "surface_id", + "config_kind", + "backup_scope", + "control_tier", + "write_capable_surface", + "requires_live_evidence", + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "reviewer_outcome", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", + "not_approval", +] + +REQUIRED_READBACK_FIELDS = [ + "backup_incident_or_change_ref", + "actor_attribution_ref", + "change_or_outage_time_window_ref", + "change_intent_or_break_glass_ref", + "before_backup_freshness_state_ref", + "after_backup_freshness_state_ref", + "backup_status_readback_ref", + "restore_drill_readback_ref", + "restore_target_isolation_readback_ref", + "offsite_sync_readback_ref", + "offsite_remote_delete_guard_readback_ref", + "credential_escrow_non_secret_readback_ref", + "credential_recovery_drill_readback_ref", + "retention_runway_readback_ref", + "retention_or_prune_decision_ref", + "backup_dependency_map_readback_ref", + "data_classification_readback_ref", + "restore_observer_stop_condition_ref", + "backup_health_no_false_green_readback_ref", + "alert_textfile_readback_ref", + "cold_start_dr_scorecard_ref", + "cross_project_sync_ref", + "rollback_validation_ref", + "post_change_monitoring_ref", + "postcheck_readback_ref", + "recurrence_guard_ref", + "maintenance_window", + "rollback_owner", + "followup_owner", + "redacted_evidence_refs", + "no_secret_value_attestation", + "no_raw_backup_payload_attestation", + "no_production_restore_attestation", + "no_false_green_attestation", +] + +REVIEWER_CHECKS = [ + {"check_id": "source_owner_response_acceptance_current", "instruction": "來源 owner response acceptance snapshot 必須是目前版本。"}, + {"check_id": "incident_or_change_ref_present", "instruction": "必須有 incident、change、outage、ticket 或 maintenance ref，不能只寫備份正常。"}, + {"check_id": "actor_attribution_present", "instruction": "必須標示 actor role / team，不接受匿名 backup、restore、sync、prune 或 escrow marker write。"}, + {"check_id": "change_or_outage_time_window_present", "instruction": "必須有變更 / 異常時間窗，供 freshness、offsite、alert 與 cold-start scorecard 對齊。"}, + {"check_id": "intent_or_break_glass_present", "instruction": "正常變更需有 change intent；緊急變更需有 break-glass reason，但 break-glass 不等於事前批准。"}, + {"check_id": "before_after_freshness_present", "instruction": "必須有 before / after backup freshness state ref，不得只看最新一次成功。"}, + {"check_id": "backup_status_readback_present", "instruction": "backup status 只能收 owner-provided redacted ref，不得讀 raw backup store 或未脫敏 listing。"}, + {"check_id": "restore_drill_readback_present", "instruction": "restore drill 必須是 readback / approval metadata，不得是 production restore 執行要求。"}, + {"check_id": "restore_target_isolation_present", "instruction": "必須有隔離 restore target 或明確 no-production-write 邊界。"}, + {"check_id": "offsite_sync_readback_present", "instruction": "offsite sync 必須有 redacted state ref，不得保存 raw remote path、object listing 或 rclone config。"}, + {"check_id": "remote_delete_guard_present", "instruction": "任何 latest-only、remote delete 或 retention policy 必須有 remote delete guard 與 owner ref。"}, + {"check_id": "credential_escrow_non_secret_present", "instruction": "credential escrow 只能是 non-secret proof / marker ref，不得包含 value、hash、seed、recovery code 或 partial token。"}, + {"check_id": "credential_recovery_drill_metadata_only", "instruction": "credential recovery drill 必須以 metadata / evidence id 呈現，不保存 secret derivative。"}, + {"check_id": "retention_runway_present", "instruction": "retention / prune 必須有可恢復窗口、runway、撤回條件與 owner。"}, + {"check_id": "retention_or_prune_decision_present", "instruction": "retention 或 prune decision 必須獨立列出，不得與 offsite sync 成功混在一起。"}, + {"check_id": "dependency_map_present", "instruction": "必須列出 DB、repo、registry、object storage、K8s、monitoring、credential escrow 與 DR runbook 依賴圖 ref。"}, + {"check_id": "data_classification_present", "instruction": "必須標示備份集資料分級；不得要求 raw customer data、payload 或 unredacted archive listing。"}, + {"check_id": "restore_observer_stop_condition_present", "instruction": "restore / drill 必須有 observer、stop condition、rollback owner 與停損條件。"}, + {"check_id": "backup_health_no_false_green_present", "instruction": "backup health / textfile / alert evidence 必須防止 false green，不能只看單一 healthy、route 200 或 dashboard up。"}, + {"check_id": "alert_textfile_readback_present", "instruction": "若涉及告警或 textfile exporter，必須回讀 stale / partial / missing marker，不得只看 alert quiet。"}, + {"check_id": "cold_start_scorecard_present", "instruction": "若影響冷啟動或 DR，必須有 cold-start / scorecard ref，且不能偽造 credential escrow evidence。"}, + {"check_id": "cross_project_sync_present", "instruction": "若影響 AwoooP、IwoooS、momo、Gitea、Harbor、monitoring 或公開站，需有跨專案同步 ref。"}, + {"check_id": "rollback_validation_present", "instruction": "必須提供 rollback validation ref，包含 rollback owner 與回復方式。"}, + {"check_id": "post_change_monitoring_present", "instruction": "必須有 post-change monitoring window，觀察 freshness、offsite、restore target、alerts 與 scorecard。"}, + {"check_id": "postcheck_independent", "instruction": "post-check 必須獨立於原操作人、單一 backup status 與 UI 顯示。"}, + {"check_id": "recurrence_guard_present", "instruction": "必須提出防再發 guard、owner review、retention freeze、remote-delete block 或 automation block。"}, + {"check_id": "maintenance_window_present", "instruction": "後續任何 backup、restore、offsite sync、prune、escrow marker 或 Velero 動作都需維護窗口。"}, + {"check_id": "redacted_refs_only", "instruction": "evidence 只能是脫敏 ref、hash、ticket、commit 或 artifact pointer。"}, + {"check_id": "secret_value_absent", "instruction": "不得出現 token、private key、rclone config、restic password、seed、kubeconfig、recovery code、credential URL 或 partial secret。"}, + {"check_id": "raw_payload_absent", "instruction": "不得保存 raw backup listing、raw restore payload、raw archive content、raw object path、raw DB dump 或未脫敏 screenshot。"}, + {"check_id": "no_false_green", "instruction": "不得只用 backup success、route 200、dashboard up、alert quiet、textfile present、UI 可見或 CD success 當 DR / backup 驗收。"}, + {"check_id": "runtime_stays_zero", "instruction": "readback plan 不得觸發 backup、restore、offsite sync、remote delete、retention change、prune、Velero、kubectl、SSH 或 production write。"}, +] + +OUTCOME_LANES = [ + {"lane_id": "waiting_post_incident_readback", "meaning": "尚未收到 Backup / Restore / Escrow 事故回讀包；所有 accepted / runtime count 維持 0。"}, + {"lane_id": "request_actor_or_time_supplement", "meaning": "缺 actor、change / outage time window、intent 或 break-glass reason 時要求補件。"}, + {"lane_id": "request_backup_freshness_supplement", "meaning": "缺 before / after freshness、backup status、alert textfile 或 scorecard 時要求補件。"}, + {"lane_id": "request_restore_isolation_supplement", "meaning": "缺 restore drill、隔離目標、observer、stop condition 或 rollback validation 時要求補件。"}, + {"lane_id": "request_offsite_retention_supplement", "meaning": "缺 offsite sync、remote delete guard、retention runway 或 prune decision 時要求補件。"}, + {"lane_id": "request_escrow_non_secret_supplement", "meaning": "缺 credential escrow non-secret proof 或 recovery drill metadata 時要求補件。"}, + {"lane_id": "quarantine_raw_payload", "meaning": "收到 secret、raw backup listing、raw restore payload、raw DB dump、rclone config 或未脫敏截圖時只能隔離。"}, + {"lane_id": "reject_false_green_claim", "meaning": "把 backup success、route 200、dashboard up、alert quiet、textfile present 或 UI 可見當驗收時拒收。"}, + {"lane_id": "ready_for_backup_restore_post_incident_review", "meaning": "metadata 合格後，只能進 backup / restore reviewer review。"}, + {"lane_id": "recurrence_guard_backfill_required", "meaning": "需補防再發 guard、retention freeze、remote-delete block、owner review 或 automation block。"}, + {"lane_id": "waiting_runtime_gate", "meaning": "即使 readback accepted，runtime gate 仍需獨立人工批准。"}, +] + +BLOCKED_ACTIONS = [ + "backup_run", + "restore_run", + "restore_drill", + "production_restore", + "offsite_sync", + "offsite_remote_delete", + "credential_escrow_marker_write", + "credential_recovery_execution", + "retention_change", + "retention_prune", + "restic_prune", + "rclone_config_read", + "rclone_config_change", + "velero_restore", + "velero_backup", + "kubectl_action", + "ssh_read", + "ssh_write", + "secret_value_collection", + "secret_hash_collection", + "partial_token_collection", + "restic_password_collection", + "rclone_token_collection", + "kubeconfig_collection", + "host_write", + "active_scan", + "production_write", + "runtime_gate_open", + "raw_backup_payload_storage", + "raw_restore_payload_storage", + "raw_object_listing_storage", + "raw_db_dump_storage", + "accept_secret_value_evidence", + "accept_credential_derivative_evidence", + "mark_readback_accepted_without_reviewer_record", + "accept_backup_success_without_freshness_slo", + "accept_restore_without_isolated_target", + "accept_offsite_without_remote_delete_guard", + "accept_retention_without_runway", + "accept_credential_recovery_without_non_secret_proof", + "accept_backup_health_false_green", + "accept_alert_quiet_as_backup_healthy", + "accept_textfile_present_as_dr_complete", + "skip_dependency_map_review", + "skip_data_classification_review", + "skip_restore_observer_stop_condition", + "skip_cross_project_sync", + "skip_rollback_validation", + "skip_post_change_monitoring", + "forge_credential_escrow_evidence", + "add_action_button", +] + + +def git_short_sha(root: Path) -> str: + try: + result = subprocess.run( + ["git", "rev-parse", "--short", "HEAD"], + cwd=root, + check=True, + capture_output=True, + text=True, + ) + return result.stdout.strip() + except Exception: + return "unknown" + + +def load_json(path: Path) -> dict[str, Any]: + return json.loads(path.read_text(encoding="utf-8")) + + +def readback_candidate(item: dict[str, Any]) -> dict[str, Any]: + surface_id = item["surface_id"] + candidate_id = f"backup_restore_post_incident_readback:{surface_id}" + return { + "post_incident_readback_candidate_id": candidate_id, + "status": "waiting_post_incident_readback", + "source_acceptance_candidate_id": item["acceptance_candidate_id"], + "request_id": item["request_id"], + "surface_id": surface_id, + "config_kind": item["config_kind"], + "backup_scope": item["backup_scope"], + "control_tier": item["control_tier"], + "write_capable_surface": item["write_capable_surface"], + "requires_live_evidence": True, + "backup_incident_or_change_ref": None, + "actor_attribution_ref": None, + "change_or_outage_time_window_ref": None, + "change_intent_or_break_glass_ref": None, + "before_backup_freshness_state_ref": None, + "after_backup_freshness_state_ref": None, + "backup_status_readback_ref": None, + "restore_drill_readback_ref": None, + "restore_target_isolation_readback_ref": None, + "offsite_sync_readback_ref": None, + "offsite_remote_delete_guard_readback_ref": None, + "credential_escrow_non_secret_readback_ref": None, + "credential_recovery_drill_readback_ref": None, + "retention_runway_readback_ref": None, + "retention_or_prune_decision_ref": None, + "backup_dependency_map_readback_ref": None, + "data_classification_readback_ref": None, + "restore_observer_stop_condition_ref": None, + "backup_health_no_false_green_readback_ref": None, + "alert_textfile_readback_ref": None, + "cold_start_dr_scorecard_ref": None, + "cross_project_sync_ref": None, + "rollback_validation_ref": None, + "post_change_monitoring_ref": None, + "postcheck_readback_ref": None, + "recurrence_guard_ref": None, + "maintenance_window": "pending_post_incident_readback", + "rollback_owner": "pending_post_incident_readback", + "followup_owner": "pending_post_incident_readback", + "redacted_evidence_refs": [], + "reviewer_outcome": "waiting_post_incident_readback", + "readback_fields": READBACK_FIELDS, + "required_readback_fields": REQUIRED_READBACK_FIELDS, + "reviewer_checks": [entry["check_id"] for entry in REVIEWER_CHECKS], + "outcome_lanes": [entry["lane_id"] for entry in OUTCOME_LANES], + "blocked_actions": BLOCKED_ACTIONS, + "not_approval": True, + "post_incident_readback_received": False, + "post_incident_readback_accepted": False, + "actor_attribution_accepted": False, + "before_after_freshness_accepted": False, + "backup_status_readback_accepted": False, + "restore_drill_readback_accepted": False, + "restore_target_isolation_readback_accepted": False, + "offsite_sync_readback_accepted": False, + "offsite_remote_delete_guard_accepted": False, + "credential_escrow_non_secret_readback_accepted": False, + "credential_recovery_drill_readback_accepted": False, + "retention_runway_readback_accepted": False, + "retention_or_prune_decision_accepted": False, + "backup_dependency_map_readback_accepted": False, + "data_classification_readback_accepted": False, + "restore_observer_stop_condition_accepted": False, + "backup_health_no_false_green_readback_accepted": False, + "alert_textfile_readback_accepted": False, + "cold_start_dr_scorecard_accepted": False, + "cross_project_sync_accepted": False, + "rollback_validation_accepted": False, + "post_change_monitoring_accepted": False, + "postcheck_readback_accepted": False, + "recurrence_guard_accepted": False, + "no_false_green_accepted": False, + "backup_run_authorized": False, + "restore_run_authorized": False, + "offsite_sync_authorized": False, + "offsite_remote_delete_authorized": False, + "credential_escrow_marker_write_authorized": False, + "credential_recovery_execution_authorized": False, + "retention_change_authorized": False, + "restic_prune_authorized": False, + "rclone_config_authorized": False, + "velero_restore_authorized": False, + "velero_backup_authorized": False, + "kubectl_action_authorized": False, + "ssh_read_authorized": False, + "ssh_write_authorized": False, + "secret_value_collection_allowed": False, + "host_write_authorized": False, + "active_scan_authorized": False, + "production_write_authorized": False, + "runtime_gate": False, + "action_buttons_allowed": False, + } + + +def searchable_candidate_text(item: dict[str, Any]) -> str: + scopes = item.get("backup_scope", []) + return " ".join( + [ + str(item.get("surface_id", "")), + str(item.get("config_kind", "")), + " ".join(str(scope) for scope in scopes), + ] + ).lower() + + +def candidate_has_any(item: dict[str, Any], keywords: set[str]) -> bool: + text = searchable_candidate_text(item) + return any(keyword in text for keyword in keywords) + + +def build_report(root: Path, source: dict[str, Any], generated_at: str | None) -> dict[str, Any]: + report_time = generated_at or datetime.now(TAIPEI).isoformat(timespec="seconds") + source_candidates = source.get("acceptance_candidates", []) + candidates = [readback_candidate(item) for item in source_candidates] + + def count_true(key: str) -> int: + return sum(1 for item in candidates if item[key]) + + summary = { + "source_acceptance_candidate_count": source["summary"]["acceptance_candidate_count"], + "source_write_capable_acceptance_candidate_count": source["summary"]["write_capable_acceptance_candidate_count"], + "source_live_evidence_required_candidate_count": source["summary"]["live_evidence_required_candidate_count"], + "source_required_owner_field_count": source["summary"]["required_owner_field_count"], + "source_reviewer_check_count": source["summary"]["reviewer_check_count"], + "source_blocked_action_count": source["summary"]["blocked_action_count"], + "source_owner_response_accepted_count": source["summary"]["owner_response_accepted_count"], + "source_runtime_gate_count": source["summary"]["runtime_gate_count"], + "readback_candidate_count": len(candidates), + "write_capable_readback_candidate_count": count_true("write_capable_surface"), + "live_evidence_required_readback_candidate_count": count_true("requires_live_evidence"), + "restore_drill_readback_required_candidate_count": len(candidates), + "offsite_or_escrow_readback_required_candidate_count": sum( + 1 + for item in candidates + if candidate_has_any( + item, + { + "offsite", + "escrow", + "credential", + "rclone", + "b2", + "velero", + "object storage", + }, + ) + ), + "retention_or_remote_delete_readback_required_candidate_count": sum( + 1 + for item in candidates + if candidate_has_any( + item, + { + "retention", + "prune", + "remote_delete", + "latest-only", + "restic", + "offsite", + }, + ) + ), + "cross_project_sync_required_candidate_count": len(candidates), + "no_false_green_required_candidate_count": len(candidates), + "readback_field_count": len(READBACK_FIELDS), + "required_readback_field_count": len(REQUIRED_READBACK_FIELDS), + "reviewer_check_count": len(REVIEWER_CHECKS), + "outcome_lane_count": len(OUTCOME_LANES), + "blocked_action_count": len(BLOCKED_ACTIONS), + "post_incident_readback_received_count": 0, + "post_incident_readback_accepted_count": 0, + "actor_attribution_accepted_count": 0, + "before_after_freshness_accepted_count": 0, + "backup_status_readback_accepted_count": 0, + "restore_drill_readback_accepted_count": 0, + "restore_target_isolation_readback_accepted_count": 0, + "offsite_sync_readback_accepted_count": 0, + "offsite_remote_delete_guard_accepted_count": 0, + "credential_escrow_non_secret_readback_accepted_count": 0, + "credential_recovery_drill_readback_accepted_count": 0, + "retention_runway_readback_accepted_count": 0, + "retention_or_prune_decision_accepted_count": 0, + "backup_dependency_map_readback_accepted_count": 0, + "data_classification_readback_accepted_count": 0, + "restore_observer_stop_condition_accepted_count": 0, + "backup_health_no_false_green_readback_accepted_count": 0, + "alert_textfile_readback_accepted_count": 0, + "cold_start_dr_scorecard_accepted_count": 0, + "cross_project_sync_accepted_count": 0, + "rollback_validation_accepted_count": 0, + "post_change_monitoring_accepted_count": 0, + "postcheck_readback_accepted_count": 0, + "recurrence_guard_accepted_count": 0, + "no_false_green_accepted_count": 0, + "backup_run_authorized_count": 0, + "restore_run_authorized_count": 0, + "offsite_sync_authorized_count": 0, + "offsite_remote_delete_authorized_count": 0, + "credential_escrow_marker_write_authorized_count": 0, + "credential_recovery_execution_authorized_count": 0, + "retention_change_authorized_count": 0, + "restic_prune_authorized_count": 0, + "rclone_config_authorized_count": 0, + "velero_restore_authorized_count": 0, + "velero_backup_authorized_count": 0, + "kubectl_action_authorized_count": 0, + "ssh_read_authorized_count": 0, + "ssh_write_authorized_count": 0, + "secret_value_collection_allowed_count": 0, + "host_write_authorized_count": 0, + "active_scan_authorized_count": 0, + "production_write_authorized_count": 0, + "runtime_gate_count": 0, + "action_button_count": 0, + "coverage_percent_after_readback_plan": 66, + } + + return { + "schema_version": "backup_restore_post_incident_readback_plan_v1", + "generated_at": report_time, + "git_commit": git_short_sha(root), + "mode": "metadata_only_no_backup_no_restore_no_secret_value", + "source_schema_version": source["schema_version"], + "source_status": source["status"], + "source_paths": [ + "docs/security/BACKUP-RESTORE-ESCROW-INVENTORY.md", + "docs/security/backup-restore-escrow-inventory.snapshot.json", + "docs/security/BACKUP-RESTORE-OWNER-RESPONSE-ACCEPTANCE.md", + "docs/security/backup-restore-owner-response-acceptance.snapshot.json", + ], + "status": "post_incident_readback_plan_ready_no_runtime_action", + "readback_candidates": candidates, + "readback_fields": READBACK_FIELDS, + "required_readback_fields": REQUIRED_READBACK_FIELDS, + "reviewer_checks": REVIEWER_CHECKS, + "outcome_lanes": OUTCOME_LANES, + "blocked_actions": BLOCKED_ACTIONS, + "execution_boundaries": { + "not_authorization": True, + "backup_run_authorized": False, + "restore_run_authorized": False, + "offsite_sync_authorized": False, + "offsite_remote_delete_authorized": False, + "credential_escrow_marker_write_authorized": False, + "credential_recovery_execution_authorized": False, + "retention_change_authorized": False, + "restic_prune_authorized": False, + "rclone_config_authorized": False, + "velero_restore_authorized": False, + "velero_backup_authorized": False, + "kubectl_action_authorized": False, + "ssh_read_authorized": False, + "ssh_write_authorized": False, + "secret_value_collection_allowed": False, + "host_write_authorized": False, + "active_scan_authorized": False, + "production_write_authorized": False, + "runtime_gate": False, + "action_buttons_allowed": False, + "raw_backup_payload_storage_allowed": False, + }, + "operator_interpretation": [ + "此計畫只定義 Backup / Restore / Escrow 事故後回讀欄位，不代表 live backup store 已讀取或可讀取。", + "backup success、route 200、dashboard up、alert quiet、textfile present、UI 可見或 CD success 都不能單獨當成 DR / backup 健康。", + "未來若要 backup、restore、offsite sync、remote delete、retention / prune、escrow marker、Velero、kubectl、SSH 或 production write，必須另有維護窗口、rollback owner 與人工批准。", + ], + "summary": summary, + } + + +def write_report(report: dict[str, Any], output: Path | None) -> None: + text = json.dumps(report, ensure_ascii=False, indent=2, sort_keys=True) + "\n" + if output: + output.write_text(text, encoding="utf-8") + else: + sys.stdout.write(text) + + +def main() -> int: + parser = argparse.ArgumentParser() + parser.add_argument("--root", default=".", help="Repository root") + parser.add_argument("--generated-at", default=None, help="Override generated_at") + parser.add_argument("--output", default=None, help="Output snapshot path") + args = parser.parse_args() + + root = Path(args.root).resolve() + source = load_json(root / "docs/security/backup-restore-owner-response-acceptance.snapshot.json") + report = build_report(root, source, args.generated_at) + output = Path(args.output).resolve() if args.output else None + write_report(report, output) + summary = report["summary"] + print( + "BACKUP_RESTORE_POST_INCIDENT_READBACK_PLAN_OK " + f"candidates={summary['readback_candidate_count']} " + f"write_capable={summary['write_capable_readback_candidate_count']} " + f"checks={summary['reviewer_check_count']} " + f"lanes={summary['outcome_lane_count']} " + f"accepted={summary['post_incident_readback_accepted_count']} " + f"runtime_gate={summary['runtime_gate_count']}" + ) + return 0 + + +if __name__ == "__main__": + raise SystemExit(main()) diff --git a/scripts/security/high-value-config-control-coverage.py b/scripts/security/high-value-config-control-coverage.py index 54d25e908..e54949988 100644 --- a/scripts/security/high-value-config-control-coverage.py +++ b/scripts/security/high-value-config-control-coverage.py @@ -122,18 +122,20 @@ CONTROL_STATUS_BY_CATEGORY = { "next_owner_action": "補 affected route refs、admin/auth boundary、API contract readback、CORS origin diff、frontend env diff、i18n redaction review、webhook/callback owner、desktop/mobile production smoke、bundle sensitive scan、rollback owner 與 post-check evidence。", }, "backup_restore_credential": { - "coverage_status": "restore_recovery_backfill_ready_needs_owner_live_evidence", - "coverage_percent": 64, + "coverage_status": "post_incident_readback_plan_ready_needs_backup_restore_owner_evidence", + "coverage_percent": 66, "evidence_refs": [ "docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md", "docs/security/BACKUP-RESTORE-ESCROW-INVENTORY.md", "docs/security/backup-restore-escrow-inventory.snapshot.json", "docs/security/BACKUP-RESTORE-OWNER-RESPONSE-ACCEPTANCE.md", "docs/security/backup-restore-owner-response-acceptance.snapshot.json", + "docs/security/BACKUP-RESTORE-POST-INCIDENT-READBACK-PLAN.md", + "docs/security/backup-restore-post-incident-readback-plan.snapshot.json", "docs/schemas/backup_restore_escrow_inventory_v1.schema.json", ], - "current_gap": "已固定 owner response acceptance、restore recovery backfill、remote delete guard、retention runway、credential recovery metadata-only 與 backup health no-false-green 只讀帳本；restore drill、offsite sync、credential escrow、retention change、live evidence 與 owner response 仍全部為 0。", - "next_owner_action": "補 restore drill approval package、freshness SLO、隔離 restore target、依賴圖、資料分級、offsite remote delete guard、credential recovery non-secret proof、retention runway、observer / stop condition、rollback owner、validation plan 與 no-secret-value evidence。", + "current_gap": "已固定 owner response acceptance、restore recovery backfill 與事故後回讀計畫；freshness before-after、backup status readback、restore drill、隔離 restore target、offsite sync、remote delete guard、credential escrow non-secret proof、retention runway、alert textfile、cold-start scorecard、rollback、post-change monitoring、防再發與 no-false-green 已納入只讀帳本；owner response、事故回讀包、live backup evidence、restore drill accepted、offsite / escrow / retention accepted 與 runtime gate 仍全部為 0。", + "next_owner_action": "補 Backup / Restore / Escrow 事故回讀包：incident / change ref、actor role / team、時間窗、改前改後 freshness、backup status readback、restore drill、隔離 restore target、offsite sync、remote delete guard、credential escrow non-secret proof、credential recovery metadata、retention runway、retention / prune decision、依賴圖、資料分級、restore observer / stop condition、alert textfile、cold-start / DR scorecard、rollback validation、post-change monitoring、recurrence guard 與 no-secret-value evidence。", }, "agent_bounty_protocol_runtime": { "coverage_status": "owner_request_draft_ready_needs_runtime_owner", @@ -402,6 +404,7 @@ def build_report(root: Path, generated_at: str | None) -> dict[str, Any]: "frontend_sensitive_surface_guard_ready_needs_runtime_config_owner_evidence", "owner_response_acceptance_ledger_ready_needs_restore_drill_owner", "restore_recovery_backfill_ready_needs_owner_live_evidence", + "post_incident_readback_plan_ready_needs_backup_restore_owner_evidence", "owner_response_acceptance_ledger_ready_needs_network_owner", "owner_response_acceptance_ledger_ready_needs_live_route_evidence", "alert_chain_no_false_green_backfill_ready_needs_live_evidence_receipt", diff --git a/scripts/security/iwooos-config-control-guard.py b/scripts/security/iwooos-config-control-guard.py index 872801cf2..5c5df4d9e 100644 --- a/scripts/security/iwooos-config-control-guard.py +++ b/scripts/security/iwooos-config-control-guard.py @@ -23,7 +23,7 @@ EXPECTED_CATEGORIES = { "secret_metadata": 70, "gitea_workflow_runner_source_control": 74, "public_admin_api_runtime_config": 66, - "backup_restore_credential": 64, + "backup_restore_credential": 66, "agent_bounty_protocol_runtime": 68, "monitoring_alerting_observability": 70, "docker_compose_systemd_host_config": 64, @@ -59,6 +59,7 @@ REQUIRED_CONTROL_DOCS = [ "docs/security/PORT-FIREWALL-CHANGE-EVIDENCE-ACCEPTANCE.md", "docs/security/SSH-NETWORK-POST-INCIDENT-READBACK-PLAN.md", "docs/security/BACKUP-RESTORE-OWNER-RESPONSE-ACCEPTANCE.md", + "docs/security/BACKUP-RESTORE-POST-INCIDENT-READBACK-PLAN.md", "docs/security/K8S-ARGOCD-OWNER-RESPONSE-ACCEPTANCE.md", "docs/security/K8S-ARGOCD-CHANGE-EVIDENCE-ACCEPTANCE.md", "docs/security/K8S-ARGOCD-POST-INCIDENT-READBACK-PLAN.md", @@ -462,6 +463,50 @@ ARTIFACT_SPECS = [ "runtime_gate_count": 0, }, }, + { + "label": "backup restore post incident readback plan", + "path": "docs/security/backup-restore-post-incident-readback-plan.snapshot.json", + "schema": "backup_restore_post_incident_readback_plan_v1", + "status": "post_incident_readback_plan_ready_no_runtime_action", + "list_counts": { + "readback_candidates": 38, + "blocked_actions": 51, + "reviewer_checks": 32, + "outcome_lanes": 11, + "required_readback_fields": 34, + }, + "summary_counts": { + "source_acceptance_candidate_count": 38, + "readback_candidate_count": 38, + "write_capable_readback_candidate_count": 27, + "live_evidence_required_readback_candidate_count": 38, + "restore_drill_readback_required_candidate_count": 38, + "offsite_or_escrow_readback_required_candidate_count": 20, + "retention_or_remote_delete_readback_required_candidate_count": 17, + "cross_project_sync_required_candidate_count": 38, + "no_false_green_required_candidate_count": 38, + "required_readback_field_count": 34, + "reviewer_check_count": 32, + "outcome_lane_count": 11, + "blocked_action_count": 51, + "post_incident_readback_received_count": 0, + "post_incident_readback_accepted_count": 0, + "backup_status_readback_accepted_count": 0, + "restore_drill_readback_accepted_count": 0, + "offsite_sync_readback_accepted_count": 0, + "credential_escrow_non_secret_readback_accepted_count": 0, + "retention_runway_readback_accepted_count": 0, + "backup_health_no_false_green_readback_accepted_count": 0, + "backup_run_authorized_count": 0, + "restore_run_authorized_count": 0, + "offsite_sync_authorized_count": 0, + "credential_escrow_marker_write_authorized_count": 0, + "retention_change_authorized_count": 0, + "runtime_gate_count": 0, + "action_button_count": 0, + "coverage_percent_after_readback_plan": 66, + }, + }, { "label": "k8s argocd owner response acceptance", "path": "docs/security/k8s-argocd-owner-response-acceptance.snapshot.json", diff --git a/scripts/security/security-mirror-progress-guard.py b/scripts/security/security-mirror-progress-guard.py index 9e1665bdf..c74b40523 100755 --- a/scripts/security/security-mirror-progress-guard.py +++ b/scripts/security/security-mirror-progress-guard.py @@ -176,6 +176,9 @@ def validate(root: Path) -> None: backup_restore_owner_response_acceptance = load_json( security_dir / "backup-restore-owner-response-acceptance.snapshot.json" ) + backup_restore_post_incident_readback_plan = load_json( + security_dir / "backup-restore-post-incident-readback-plan.snapshot.json" + ) monitoring_alerting_observability_inventory = load_json( security_dir / "monitoring-alerting-observability-inventory.snapshot.json" ) @@ -3289,18 +3292,20 @@ def validate(root: Path) -> None: assert_equal( "high_value_config_coverage.coverage_categories.backup_restore.coverage_percent", backup_restore_category["coverage_percent"], - 64, + 66, ) assert_equal( "high_value_config_coverage.coverage_categories.backup_restore.coverage_status", backup_restore_category["coverage_status"], - "restore_recovery_backfill_ready_needs_owner_live_evidence", + "post_incident_readback_plan_ready_needs_backup_restore_owner_evidence", ) for evidence_ref in [ "docs/security/BACKUP-RESTORE-ESCROW-INVENTORY.md", "docs/security/backup-restore-escrow-inventory.snapshot.json", "docs/security/BACKUP-RESTORE-OWNER-RESPONSE-ACCEPTANCE.md", "docs/security/backup-restore-owner-response-acceptance.snapshot.json", + "docs/security/BACKUP-RESTORE-POST-INCIDENT-READBACK-PLAN.md", + "docs/security/backup-restore-post-incident-readback-plan.snapshot.json", "docs/schemas/backup_restore_escrow_inventory_v1.schema.json", ]: assert_contains( @@ -5483,6 +5488,241 @@ def validate(root: Path) -> None: f"backup_restore_owner_response_acceptance.{item['acceptance_candidate_id']}.{false_key}", item[false_key], ) + assert_equal( + "backup_restore_post_incident_readback_plan.schema", + backup_restore_post_incident_readback_plan["schema_version"], + "backup_restore_post_incident_readback_plan_v1", + ) + assert_equal( + "backup_restore_post_incident_readback_plan.status", + backup_restore_post_incident_readback_plan["status"], + "post_incident_readback_plan_ready_no_runtime_action", + ) + assert_equal( + "backup_restore_post_incident_readback_plan.source_schema_version", + backup_restore_post_incident_readback_plan["source_schema_version"], + "backup_restore_owner_response_acceptance_v1", + ) + assert_equal( + "backup_restore_post_incident_readback_plan.source_status", + backup_restore_post_incident_readback_plan["source_status"], + "owner_response_acceptance_ledger_ready_no_runtime_action", + ) + for source_path in [ + "docs/security/BACKUP-RESTORE-ESCROW-INVENTORY.md", + "docs/security/backup-restore-escrow-inventory.snapshot.json", + "docs/security/BACKUP-RESTORE-OWNER-RESPONSE-ACCEPTANCE.md", + "docs/security/backup-restore-owner-response-acceptance.snapshot.json", + ]: + assert_contains( + "backup_restore_post_incident_readback_plan.source_paths", + backup_restore_post_incident_readback_plan["source_paths"], + source_path, + ) + expected_backup_restore_post_incident_readback_summary = { + "source_acceptance_candidate_count": 38, + "source_write_capable_acceptance_candidate_count": 27, + "source_live_evidence_required_candidate_count": 38, + "source_required_owner_field_count": 23, + "source_reviewer_check_count": 22, + "source_blocked_action_count": 31, + "source_owner_response_accepted_count": 0, + "source_runtime_gate_count": 0, + "readback_candidate_count": 38, + "write_capable_readback_candidate_count": 27, + "live_evidence_required_readback_candidate_count": 38, + "restore_drill_readback_required_candidate_count": 38, + "offsite_or_escrow_readback_required_candidate_count": 20, + "retention_or_remote_delete_readback_required_candidate_count": 17, + "cross_project_sync_required_candidate_count": 38, + "no_false_green_required_candidate_count": 38, + "readback_field_count": 45, + "required_readback_field_count": 34, + "reviewer_check_count": 32, + "outcome_lane_count": 11, + "blocked_action_count": 51, + "post_incident_readback_received_count": 0, + "post_incident_readback_accepted_count": 0, + "actor_attribution_accepted_count": 0, + "before_after_freshness_accepted_count": 0, + "backup_status_readback_accepted_count": 0, + "restore_drill_readback_accepted_count": 0, + "restore_target_isolation_readback_accepted_count": 0, + "offsite_sync_readback_accepted_count": 0, + "offsite_remote_delete_guard_accepted_count": 0, + "credential_escrow_non_secret_readback_accepted_count": 0, + "credential_recovery_drill_readback_accepted_count": 0, + "retention_runway_readback_accepted_count": 0, + "retention_or_prune_decision_accepted_count": 0, + "backup_dependency_map_readback_accepted_count": 0, + "data_classification_readback_accepted_count": 0, + "restore_observer_stop_condition_accepted_count": 0, + "backup_health_no_false_green_readback_accepted_count": 0, + "alert_textfile_readback_accepted_count": 0, + "cold_start_dr_scorecard_accepted_count": 0, + "cross_project_sync_accepted_count": 0, + "rollback_validation_accepted_count": 0, + "post_change_monitoring_accepted_count": 0, + "postcheck_readback_accepted_count": 0, + "recurrence_guard_accepted_count": 0, + "no_false_green_accepted_count": 0, + "backup_run_authorized_count": 0, + "restore_run_authorized_count": 0, + "offsite_sync_authorized_count": 0, + "offsite_remote_delete_authorized_count": 0, + "credential_escrow_marker_write_authorized_count": 0, + "credential_recovery_execution_authorized_count": 0, + "retention_change_authorized_count": 0, + "restic_prune_authorized_count": 0, + "rclone_config_authorized_count": 0, + "velero_restore_authorized_count": 0, + "velero_backup_authorized_count": 0, + "kubectl_action_authorized_count": 0, + "ssh_read_authorized_count": 0, + "ssh_write_authorized_count": 0, + "secret_value_collection_allowed_count": 0, + "host_write_authorized_count": 0, + "active_scan_authorized_count": 0, + "production_write_authorized_count": 0, + "runtime_gate_count": 0, + "action_button_count": 0, + "coverage_percent_after_readback_plan": 66, + } + for key, expected in expected_backup_restore_post_incident_readback_summary.items(): + assert_equal( + f"backup_restore_post_incident_readback_plan.summary.{key}", + backup_restore_post_incident_readback_plan["summary"][key], + expected, + ) + for key, value in backup_restore_post_incident_readback_plan["execution_boundaries"].items(): + if key == "not_authorization": + assert_true(f"backup_restore_post_incident_readback_plan.execution_boundaries.{key}", value) + else: + assert_false(f"backup_restore_post_incident_readback_plan.execution_boundaries.{key}", value) + assert_equal( + "backup_restore_post_incident_readback_plan.readback_candidates.count", + len(backup_restore_post_incident_readback_plan["readback_candidates"]), + 38, + ) + for candidate_id in [ + "backup_restore_post_incident_readback:backup_all_orchestrator", + "backup_restore_post_incident_readback:backup_awoooi_service_script", + "backup_restore_post_incident_readback:backup_common_restic_retention", + "backup_restore_post_incident_readback:offsite_sync_controller", + "backup_restore_post_incident_readback:credential_escrow_marker", + "backup_restore_post_incident_readback:velero_restore_test_cronjob", + "backup_restore_post_incident_readback:backup_health_textfile_exporter", + "backup_restore_post_incident_readback:cold_start_sop", + ]: + assert_contains( + "backup_restore_post_incident_readback_plan.readback_candidates", + [ + item["post_incident_readback_candidate_id"] + for item in backup_restore_post_incident_readback_plan["readback_candidates"] + ], + candidate_id, + ) + assert_equal( + "backup_restore_post_incident_readback_plan.required_readback_fields.count", + len(backup_restore_post_incident_readback_plan["required_readback_fields"]), + 34, + ) + assert_equal( + "backup_restore_post_incident_readback_plan.reviewer_checks.count", + len(backup_restore_post_incident_readback_plan["reviewer_checks"]), + 32, + ) + assert_equal( + "backup_restore_post_incident_readback_plan.outcome_lanes.count", + len(backup_restore_post_incident_readback_plan["outcome_lanes"]), + 11, + ) + assert_equal( + "backup_restore_post_incident_readback_plan.blocked_actions.count", + len(backup_restore_post_incident_readback_plan["blocked_actions"]), + 51, + ) + for item in backup_restore_post_incident_readback_plan["readback_candidates"]: + assert_equal( + f"backup_restore_post_incident_readback_plan.{item['post_incident_readback_candidate_id']}.readback_fields", + len(item["readback_fields"]), + 45, + ) + assert_equal( + f"backup_restore_post_incident_readback_plan.{item['post_incident_readback_candidate_id']}.required_readback_fields", + len(item["required_readback_fields"]), + 34, + ) + assert_equal( + f"backup_restore_post_incident_readback_plan.{item['post_incident_readback_candidate_id']}.reviewer_checks", + len(item["reviewer_checks"]), + 32, + ) + assert_equal( + f"backup_restore_post_incident_readback_plan.{item['post_incident_readback_candidate_id']}.outcome_lanes", + len(item["outcome_lanes"]), + 11, + ) + assert_equal( + f"backup_restore_post_incident_readback_plan.{item['post_incident_readback_candidate_id']}.blocked_actions", + len(item["blocked_actions"]), + 51, + ) + assert_true( + f"backup_restore_post_incident_readback_plan.{item['post_incident_readback_candidate_id']}.not_approval", + item["not_approval"], + ) + for false_key in [ + "post_incident_readback_received", + "post_incident_readback_accepted", + "actor_attribution_accepted", + "before_after_freshness_accepted", + "backup_status_readback_accepted", + "restore_drill_readback_accepted", + "restore_target_isolation_readback_accepted", + "offsite_sync_readback_accepted", + "offsite_remote_delete_guard_accepted", + "credential_escrow_non_secret_readback_accepted", + "credential_recovery_drill_readback_accepted", + "retention_runway_readback_accepted", + "retention_or_prune_decision_accepted", + "backup_dependency_map_readback_accepted", + "data_classification_readback_accepted", + "restore_observer_stop_condition_accepted", + "backup_health_no_false_green_readback_accepted", + "alert_textfile_readback_accepted", + "cold_start_dr_scorecard_accepted", + "cross_project_sync_accepted", + "rollback_validation_accepted", + "post_change_monitoring_accepted", + "postcheck_readback_accepted", + "recurrence_guard_accepted", + "no_false_green_accepted", + "backup_run_authorized", + "restore_run_authorized", + "offsite_sync_authorized", + "offsite_remote_delete_authorized", + "credential_escrow_marker_write_authorized", + "credential_recovery_execution_authorized", + "retention_change_authorized", + "restic_prune_authorized", + "rclone_config_authorized", + "velero_restore_authorized", + "velero_backup_authorized", + "kubectl_action_authorized", + "ssh_read_authorized", + "ssh_write_authorized", + "secret_value_collection_allowed", + "host_write_authorized", + "active_scan_authorized", + "production_write_authorized", + "runtime_gate", + "action_buttons_allowed", + ]: + assert_false( + f"backup_restore_post_incident_readback_plan.{item['post_incident_readback_candidate_id']}.{false_key}", + item[false_key], + ) assert_equal( "monitoring_alerting_observability_inventory.schema", monitoring_alerting_observability_inventory["schema_version"], @@ -7686,6 +7926,8 @@ def validate(root: Path) -> None: "docs/security/BACKUP-RESTORE-ESCROW-INVENTORY.md", "docs/security/backup-restore-owner-response-acceptance.snapshot.json", "docs/security/BACKUP-RESTORE-OWNER-RESPONSE-ACCEPTANCE.md", + "docs/security/backup-restore-post-incident-readback-plan.snapshot.json", + "docs/security/BACKUP-RESTORE-POST-INCIDENT-READBACK-PLAN.md", "docs/schemas/backup_restore_escrow_inventory_v1.schema.json", "docs/security/monitoring-alerting-observability-inventory.snapshot.json", "docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md", @@ -8176,6 +8418,33 @@ def validate(root: Path) -> None: "backup_restore_escrow_inventory_action_button_count": 0, "backup_restore_escrow_inventory_coverage_percent_before_inventory": 52, "backup_restore_escrow_inventory_coverage_percent_after_inventory": 58, + "backup_restore_post_incident_readback_plan_first_layer": True, + "backup_restore_post_incident_readback_plan_candidate_count": 38, + "backup_restore_post_incident_readback_plan_write_capable_candidate_count": 27, + "backup_restore_post_incident_readback_plan_live_evidence_required_candidate_count": 38, + "backup_restore_post_incident_readback_plan_restore_drill_required_candidate_count": 38, + "backup_restore_post_incident_readback_plan_offsite_or_escrow_required_candidate_count": 20, + "backup_restore_post_incident_readback_plan_retention_or_remote_delete_required_candidate_count": 17, + "backup_restore_post_incident_readback_plan_required_readback_field_count": 34, + "backup_restore_post_incident_readback_plan_reviewer_check_count": 32, + "backup_restore_post_incident_readback_plan_outcome_lane_count": 11, + "backup_restore_post_incident_readback_plan_blocked_action_count": 51, + "backup_restore_post_incident_readback_plan_post_incident_readback_received_count": 0, + "backup_restore_post_incident_readback_plan_post_incident_readback_accepted_count": 0, + "backup_restore_post_incident_readback_plan_actor_attribution_accepted_count": 0, + "backup_restore_post_incident_readback_plan_before_after_freshness_accepted_count": 0, + "backup_restore_post_incident_readback_plan_backup_status_readback_accepted_count": 0, + "backup_restore_post_incident_readback_plan_restore_drill_readback_accepted_count": 0, + "backup_restore_post_incident_readback_plan_restore_target_isolation_readback_accepted_count": 0, + "backup_restore_post_incident_readback_plan_offsite_sync_readback_accepted_count": 0, + "backup_restore_post_incident_readback_plan_offsite_remote_delete_guard_accepted_count": 0, + "backup_restore_post_incident_readback_plan_credential_escrow_non_secret_readback_accepted_count": 0, + "backup_restore_post_incident_readback_plan_retention_runway_readback_accepted_count": 0, + "backup_restore_post_incident_readback_plan_backup_health_no_false_green_readback_accepted_count": 0, + "backup_restore_post_incident_readback_plan_runtime_gate_count": 0, + "backup_restore_post_incident_readback_plan_action_button_count": 0, + "backup_restore_post_incident_readback_plan_coverage_percent_after_readback_plan": 66, + "backup_restore_credential_coverage_percent": 66, } for key, expected in expected_backup_restore_projection_summary.items(): assert_equal( @@ -17948,7 +18217,7 @@ def validate(root: Path) -> None: ) for text in [ "high_value_config_control_coverage_frontstage_summary_count=4", - "high_value_config_control_coverage_frontstage_item_count=4", + "high_value_config_control_coverage_frontstage_item_count=5", "high_value_config_control_coverage_category_count=14", "high_value_config_control_coverage_c0_category_count=8", "high_value_config_control_coverage_c1_category_count=4", @@ -18208,6 +18477,23 @@ def validate(root: Path) -> None: "backup_restore_owner_response_acceptance_restore_target_isolation_accepted_count=0", "backup_restore_owner_response_acceptance_remote_delete_guard_accepted_count=0", "backup_restore_owner_response_acceptance_backup_health_no_false_green_accepted_count=0", + "backup_restore_post_incident_readback_plan_candidate_count=38", + "backup_restore_post_incident_readback_plan_write_capable_candidate_count=27", + "backup_restore_post_incident_readback_plan_live_evidence_required_candidate_count=38", + "backup_restore_post_incident_readback_plan_required_readback_field_count=34", + "backup_restore_post_incident_readback_plan_reviewer_check_count=32", + "backup_restore_post_incident_readback_plan_outcome_lane_count=11", + "backup_restore_post_incident_readback_plan_blocked_action_count=51", + "backup_restore_post_incident_readback_plan_post_incident_readback_received_count=0", + "backup_restore_post_incident_readback_plan_post_incident_readback_accepted_count=0", + "backup_restore_post_incident_readback_plan_backup_status_readback_accepted_count=0", + "backup_restore_post_incident_readback_plan_restore_drill_readback_accepted_count=0", + "backup_restore_post_incident_readback_plan_offsite_sync_readback_accepted_count=0", + "backup_restore_post_incident_readback_plan_credential_escrow_non_secret_readback_accepted_count=0", + "backup_restore_post_incident_readback_plan_retention_runway_readback_accepted_count=0", + "backup_restore_post_incident_readback_plan_backup_health_no_false_green_readback_accepted_count=0", + "backup_restore_post_incident_readback_plan_runtime_gate_count=0", + "backup_restore_credential_coverage_percent=66", "monitoring_alerting_observability_inventory_surface_count=60", "monitoring_alerting_observability_inventory_alert_rule_surface_count=13", "monitoring_alerting_observability_inventory_deploy_or_reload_surface_count=6",