# IwoooS Backup / Restore / Escrow 事故後回讀計畫

| 項目 | 內容 |
|------|------|
| 日期 | 2026-06-18 |
| 狀態 | `post_incident_readback_plan_ready_no_runtime_action` |
| 工具 | `scripts/security/backup-restore-post-incident-readback-plan.py` |
| Snapshot | `docs/security/backup-restore-post-incident-readback-plan.snapshot.json` |
| 來源 | `docs/security/backup-restore-owner-response-acceptance.snapshot.json` |
| runtime gate | `0` |

## 1. 目的

此計畫把 Backup / Restore / Escrow 的事故後回讀從「有備份狀態」推進成可重跑、可補件、可隔離、可拒收的只讀帳本。

它處理的風險不是替正式備份系統下指令，而是先定義未來 owner 必須提供哪些脫敏 ref，才能說明誰動了 backup / restore / offsite / escrow / retention，何時異常，改前改後 freshness 與 restore / offsite / retention 狀態如何，是否有隔離 restore target、credential escrow non-secret proof、rollback、post-change monitoring、recurrence guard 與 no-false-green 檢查。

本 artifact 不執行 backup、不 restore、不跑 offsite sync、不 remote delete、不寫 credential escrow marker、不改 retention、不 restic prune、不讀 rclone config、不跑 Velero、不 kubectl、不 SSH、不讀 secret value、不保存 raw backup listing、不保存 raw restore payload、不寫 production。

## 2. 固定數字

| 指標 | 數值 |
|------|------|
| readback candidate | `38` |
| write-capable candidate | `27` |
| live evidence required candidate | `38` |
| restore drill readback required candidate | `38` |
| offsite / escrow readback required candidate | `20` |
| retention / remote delete readback required candidate | `17` |
| required readback fields | `34` |
| reviewer checks | `32` |
| outcome lanes | `11` |
| blocked actions | `51` |
| post-incident readback received / accepted | `0 / 0` |
| runtime gate | `0` |

## 3. 必填回讀欄位

每一個候選都必須補齊以下 metadata-only refs，才能進入 reviewer review：

1. incident / change / outage ref。
2. actor role / team attribution ref。
3. change / outage time window ref。
4. change intent 或 break-glass reason ref。
5. before / after backup freshness state refs。
6. backup status readback ref。
7. restore drill readback ref。
8. restore target isolation readback ref。
9. offsite sync readback ref。
10. offsite remote delete guard readback ref。
11. credential escrow non-secret readback ref。
12. credential recovery drill metadata ref。
13. retention runway readback ref。
14. retention 或 prune decision ref。
15. backup dependency map ref。
16. data classification ref。
17. restore observer / stop condition ref。
18. backup health no-false-green readback ref。
19. alert textfile readback ref。
20. cold-start / DR scorecard ref。
21. cross-project sync ref。
22. rollback validation ref。
23. post-change monitoring ref。
24. independent postcheck readback ref。
25. recurrence guard ref。
26. maintenance window、rollback owner、followup owner。
27. redacted evidence refs。
28. no-secret-value、no-raw-backup-payload、no-production-restore 與 no-false-green attestation。

## 4. Reviewer 檢查

Reviewer 必須確認來源 snapshot 是目前版本，並逐項檢查 actor、時間窗、變更意圖、before / after freshness、backup status、restore drill、restore target isolation、offsite sync、remote delete guard、credential escrow non-secret proof、credential recovery metadata、retention runway、retention / prune decision、dependency map、data classification、restore observer、backup health no-false-green、alert textfile、cold-start scorecard、cross-project sync、rollback、post-change monitoring、independent postcheck、recurrence guard、maintenance window、脫敏 ref、secret absence、raw payload absence、runtime stays zero 與 count transition safe。

不能把 backup success、route `200`、dashboard up、alert quiet、textfile present、UI 可見、CD success 或 latest 字樣視為 DR / backup 驗收。

## 5. 分流

| lane | 用途 |
|------|------|
| `waiting_post_incident_readback` | 尚未收到回讀包；所有 accepted / runtime count 維持 `0` |
| `request_actor_or_time_supplement` | 缺 actor、時間窗、intent 或 break-glass reason |
| `request_backup_freshness_supplement` | 缺 before / after freshness、backup status、alert textfile 或 scorecard |
| `request_restore_isolation_supplement` | 缺 restore drill、隔離目標、observer、stop condition 或 rollback validation |
| `request_offsite_retention_supplement` | 缺 offsite sync、remote delete guard、retention runway 或 prune decision |
| `request_escrow_non_secret_supplement` | 缺 credential escrow non-secret proof 或 recovery drill metadata |
| `quarantine_raw_payload` | 收到 secret、raw backup listing、raw restore payload、raw DB dump、rclone config 或未脫敏截圖時隔離 |
| `reject_false_green_claim` | 把 backup success、route 200、dashboard up、alert quiet、textfile present 或 UI 可見當驗收時拒收 |
| `ready_for_backup_restore_post_incident_review` | metadata 合格後只能進 reviewer review |
| `recurrence_guard_backfill_required` | 需補防再發 guard、retention freeze、remote-delete block、owner review 或 automation block |
| `waiting_runtime_gate` | 即使 readback accepted，runtime gate 仍需獨立人工批准 |

## 6. 固定禁止動作

本階段明確阻擋 `backup_run`、`restore_run`、`restore_drill`、`production_restore`、`offsite_sync`、`offsite_remote_delete`、`credential_escrow_marker_write`、`credential_recovery_execution`、`retention_change`、`retention_prune`、`restic_prune`、`rclone_config_read`、`rclone_config_change`、`velero_restore`、`velero_backup`、`kubectl_action`、`ssh_read`、`ssh_write`、`secret_value_collection`、`secret_hash_collection`、`partial_token_collection`、`restic_password_collection`、`rclone_token_collection`、`kubeconfig_collection`、`host_write`、`active_scan`、`production_write`、`runtime_gate_open`、raw backup / restore / object listing / DB dump storage、接受 secret 或 credential derivative evidence、無 reviewer record 標記 accepted、接受 false green、跳過 dependency / data classification / observer / cross-project / rollback / post-change monitoring review、偽造 credential escrow evidence 與任何 action button。

## 7. 目前邊界

此 artifact 只代表事故後回讀計畫已建立。`post_incident_readback_received_count`、`post_incident_readback_accepted_count`、`backup_status_readback_accepted_count`、`restore_drill_readback_accepted_count`、`offsite_sync_readback_accepted_count`、`credential_escrow_non_secret_readback_accepted_count`、`retention_runway_readback_accepted_count`、`backup_health_no_false_green_readback_accepted_count`、`backup_run_authorized_count`、`restore_run_authorized_count`、`offsite_sync_authorized_count`、`credential_escrow_marker_write_authorized_count`、`retention_change_authorized_count`、`runtime_gate_count` 與 `action_button_count` 仍全部維持 `0`。

## 8. 指令

產生 committed snapshot：

```bash
python3 scripts/security/backup-restore-post-incident-readback-plan.py \
  --root . \
  --generated-at 2026-06-18T10:30:00+08:00 \
  --output docs/security/backup-restore-post-incident-readback-plan.snapshot.json
```

只讀 guard：

```bash
python3 scripts/security/iwooos-config-control-guard.py --root .
python3 scripts/security/security-mirror-progress-guard.py --root .
```

## 9. 完成度

| 工作 | 完成度 | 說明 |
|------|--------|------|
| post-incident readback plan artifact | `100%` | 38 個候選已建立只讀回讀計畫 |
| post-incident readback received / accepted | `0%` | 尚未收到或驗收任何事故後回讀包 |
| live backup / offsite / escrow evidence | `0%` | 未讀 live backup、offsite、credential escrow 或 secret |
| backup / restore / offsite / retention | `0%` | 未授權且未執行 |
| secret / host / production write | `0%` | 未收 secret、未 SSH、未寫 host |
| runtime gate / action button | `0%` | 無 action button，無 production write |
