diff --git a/dev/ACTIVE_TASK.json b/dev/ACTIVE_TASK.json index 217f80f..3ba719e 100644 --- a/dev/ACTIVE_TASK.json +++ b/dev/ACTIVE_TASK.json @@ -1,5 +1,5 @@ { - "task_file": "dev/tasks/DEV-000156-fleet-execution-status-evidence.json", - "task_id": "DEV-000156", + "task_file": "dev/tasks/DEV-000157-postgres-restore-evidence.json", + "task_id": "DEV-000157", "task_revision": 1 } diff --git a/dev/tasks/DEV-000157-postgres-restore-evidence.json b/dev/tasks/DEV-000157-postgres-restore-evidence.json new file mode 100644 index 0000000..ae6e68a --- /dev/null +++ b/dev/tasks/DEV-000157-postgres-restore-evidence.json @@ -0,0 +1,23 @@ +{ + "task_id": "DEV-000157", + "task_revision": 1, + "architecture_revision": "ADR-0010", + "base_repo_revision": "077f16e50ca22e14dbf00214005f0fe98a1c8308", + "risk_tier": "E", + "intent": "Capture fresh production PostgreSQL backup checksum and isolated restore verification evidence without changing the production database.", + "requirement_ids": ["WP-002", "AUDIT-RECOVERY-TRUTH"], + "allowed_change_scope": {"modules": [], "paths": ["docs/evidence/**", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000157-postgres-restore-evidence.json"]}, + "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "cmd/**", "modules/**", "contracts/**", "adapters/**", "database/**", "deploy/**", ".gitea/**"]}, + "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0}, + "contracts": {"consume": ["backup artifact format", "restore verification output"], "may_change": []}, + "semantic_owner": "none; evidence projection", + "canonical_state": [], + "state_transitions": ["evidence only; no production database mutation"], + "side_effects_and_privileges": ["isolated temporary restore container created and removed by the existing verifier"], + "persistence_and_migrations": ["immutable JSON evidence artifact only"], + "failure_retry_restart": ["checksum or restore failure is recorded as failure; no blind retry claim"], + "assumptions": ["the standard verifier uses tmpfs and cleans up its temporary container", "backup contents and credentials are not copied into repository evidence"], + "acceptance_scenarios": ["latest backup directory is selected", "checksums pass", "isolated restore reports expected schema/table counts", "production database remains untouched"], + "required_tests": ["JSON validation", "go test", "go vet", "preflight", "check-diff", "git diff --check", "independent", "CI"], + "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT"] +} diff --git a/docs/evidence/wp-002-postgres-restore-2026-08-22-v1.json b/docs/evidence/wp-002-postgres-restore-2026-08-22-v1.json new file mode 100644 index 0000000..17303b1 --- /dev/null +++ b/docs/evidence/wp-002-postgres-restore-2026-08-22-v1.json @@ -0,0 +1,16 @@ +{ + "evidence_id": "wp-002-postgres-restore-2026-08-22-v1", + "captured_at": "2026-08-22", + "production_host": "docker.cin.su", + "source": "standard read-only backup verifier", + "selected_backup": "20260822T001501Z", + "checksum": "OK", + "restore": { + "database": "assistant", + "schemas": 11, + "tables": 60, + "result": "verified" + }, + "safety": "restore was performed in an isolated temporary PostgreSQL container and cleaned up by the verifier; production database was not restored over or modified", + "limitations": ["this evidence verifies the latest available backup artifact and isolated restore, not a full disaster-recovery cutover" ] +}