#!/usr/bin/env python3 """ IwoooS backup / restore / escrow / retention repo-only 清冊。 本工具只讀取已提交的 repo 檔案，整理 backup orchestration、service backup scripts、restic retention、offsite sync、credential escrow、Velero restore drill、alert rules 與 DR runbook evidence。它不執行 backup、不 restore、不呼叫 rclone、不寫 escrow marker、不跑 restic prune、不連 K8s、不 SSH、不讀 secret value。 """ from __future__ import annotations import argparse import hashlib import json import subprocess import sys from datetime import datetime, timedelta, timezone from pathlib import Path from typing import Any TAIPEI = timezone(timedelta(hours=8)) SURFACES: list[dict[str, Any]] = [ { "surface_id": "backup_all_orchestrator", "label": "全服務備份總控", "source_path": "scripts/backup/backup-all.sh", "expected_scope": "110_backup_host_all_services", "config_kind": "backup_orchestrator", "control_tier": "C0", "current_state": "write_capable_orchestrator_visible_not_executed", "backup_scope": ["gitea", "momo", "harbor", "awoooi", "langfuse", "monitoring", "signoz", "open-webui", "clawbot"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 backup owner、cron owner、失敗通知 owner、restore drill owner、rollback owner 與 post-check 指標。", }, { "surface_id": "backup_common_restic_retention", "label": "Restic 共用設定與 GFS retention", "source_path": "scripts/backup/common.sh", "expected_scope": "restic_password_b2_retention_common", "config_kind": "backup_common_policy", "control_tier": "C0", "current_state": "retention_and_credential_metadata_visible_secret_values_absent", "backup_scope": ["RESTIC_PASSWORD_FILE", "B2 metadata", "KEEP_DAILY=30", "KEEP_WEEKLY=12", "KEEP_MONTHLY=24"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 restic password owner、B2 / rclone owner、retention owner、prune window 與 no-secret-value evidence。", }, { "surface_id": "backup_gitea_service_script", "label": "Gitea 備份腳本", "source_path": "scripts/backup/backup-gitea.sh", "expected_scope": "gitea_database_and_repositories", "config_kind": "service_backup_script", "control_tier": "C0", "current_state": "service_backup_script_visible_gate_closed", "backup_scope": ["Gitea DB", "repositories", "app.ini redaction boundary"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 Gitea backup owner、freshness evidence、restore target isolation 與 secret redaction proof。", }, { "surface_id": "backup_momo_service_script", "label": "MOMO PostgreSQL 備份腳本", "source_path": "scripts/backup/backup-momo.sh", "expected_scope": "momo_postgresql", "config_kind": "service_backup_script", "control_tier": "C0", "current_state": "service_backup_script_visible_gate_closed", "backup_scope": ["MOMO PostgreSQL", "188 database path"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 MOMO backup owner、188 DB access boundary、restore drill target 與 rollback owner。", }, { "surface_id": "backup_harbor_service_script", "label": "Harbor 備份腳本", "source_path": "scripts/backup/backup-harbor.sh", "expected_scope": "harbor_registry_and_database", "config_kind": "service_backup_script", "control_tier": "C0", "current_state": "service_backup_script_visible_gate_closed", "backup_scope": ["Harbor registry", "Harbor DB", "image registry recovery"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 Harbor backup owner、registry restore smoke、robot account secret boundary 與 image rollback owner。", }, { "surface_id": "backup_awoooi_service_script", "label": "AWOOOI PostgreSQL 完整備份腳本", "source_path": "scripts/backup/backup-awoooi.sh", "expected_scope": "awoooi_postgresql_and_k3s_datastore", "config_kind": "service_backup_script", "control_tier": "C0", "current_state": "service_backup_script_visible_gate_closed", "backup_scope": ["awoooi_prod", "awoooi_dev", "k3s datastore"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 AWOOOI DB backup owner、RPO owner、restore drill isolation 與 data masking policy。", }, { "surface_id": "backup_awoooi_frequent_script", "label": "AWOOOI PostgreSQL 高頻備份腳本", "source_path": "scripts/backup/backup-awoooi-frequent.sh", "expected_scope": "awoooi_postgresql_high_frequency", "config_kind": "service_backup_script", "control_tier": "C0", "current_state": "high_frequency_backup_script_visible_gate_closed", "backup_scope": ["awoooi_prod", "6h RPO", "latest-only interaction"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補高頻備份 owner、cron owner、latest-only retention owner 與 freshness evidence。", }, { "surface_id": "backup_langfuse_service_script", "label": "Langfuse 備份腳本", "source_path": "scripts/backup/backup-langfuse.sh", "expected_scope": "langfuse_ai_trace_database", "config_kind": "service_backup_script", "control_tier": "C0", "current_state": "service_backup_script_visible_gate_closed", "backup_scope": ["Langfuse DB", "AI trace evidence"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 Langfuse backup owner、trace privacy boundary、restore smoke 與 secret redaction proof。", }, { "surface_id": "backup_monitoring_service_script", "label": "Monitoring 備份腳本", "source_path": "scripts/backup/backup-monitoring.sh", "expected_scope": "prometheus_grafana_alertmanager", "config_kind": "service_backup_script", "control_tier": "C0", "current_state": "service_backup_script_visible_gate_closed", "backup_scope": ["Prometheus", "Grafana", "Alertmanager"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 observability backup owner、Grafana secret boundary、alert route restore smoke 與 rollback owner。", }, { "surface_id": "backup_signoz_service_script", "label": "SigNoz 備份腳本", "source_path": "scripts/backup/backup-signoz.sh", "expected_scope": "signoz_clickhouse_and_sqlite", "config_kind": "service_backup_script", "control_tier": "C0", "current_state": "service_backup_script_visible_gate_closed", "backup_scope": ["SigNoz ClickHouse", "SigNoz SQLite"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 SigNoz disruptive guard owner、ClickHouse restore owner、告警靜音邊界與 post-check 指標。", }, { "surface_id": "backup_open_webui_service_script", "label": "Open-WebUI 備份腳本", "source_path": "scripts/backup/backup-open-webui.sh", "expected_scope": "open_webui_volume", "config_kind": "service_backup_script", "control_tier": "C0", "current_state": "service_backup_script_visible_gate_closed", "backup_scope": ["Open-WebUI volume", "LLM conversation data"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 Open-WebUI data privacy owner、188 read boundary、restore target isolation 與 retention owner。", }, { "surface_id": "backup_clawbot_service_script", "label": "ClawBot Redis 備份腳本", "source_path": "scripts/backup/backup-clawbot.sh", "expected_scope": "clawbot_redis_state", "config_kind": "service_backup_script", "control_tier": "C0", "current_state": "service_backup_script_visible_gate_closed", "backup_scope": ["ClawBot Redis", "agent state cache"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 ClawBot state owner、Redis restore owner、agent state masking 與 rollback owner。", }, { "surface_id": "backup_sentry_service_script", "label": "Sentry 備份腳本", "source_path": "scripts/backup/backup-sentry.sh", "expected_scope": "sentry_self_hosted", "config_kind": "service_backup_script", "control_tier": "C0", "current_state": "service_backup_script_visible_gate_closed", "backup_scope": ["Sentry", "ClickHouse / Postgres / Redis dependency boundary"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 Sentry backup owner、multi-store restore owner、admin secret boundary 與 route smoke。", }, { "surface_id": "backup_ai_artifacts_script", "label": "AI artifacts 備份腳本", "source_path": "scripts/backup/backup-ai-artifacts.sh", "expected_scope": "ai_artifacts", "config_kind": "service_backup_script", "control_tier": "C0", "current_state": "artifact_backup_script_visible_gate_closed", "backup_scope": ["AI artifacts", "model / evaluation outputs"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 artifact owner、retention owner、模型資料外送邊界與 restore validation。", }, { "surface_id": "backup_public_routes_script", "label": "Public routes 備份腳本", "source_path": "scripts/backup/backup-public-routes.sh", "expected_scope": "public_route_reconstruction", "config_kind": "service_backup_script", "control_tier": "C0", "current_state": "route_backup_script_visible_gate_closed", "backup_scope": ["public routes", "Nginx route reconstruction", "frontend/API smoke evidence"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 route reconstruction owner、public/admin/API smoke、rollback ref 與 no-internal-transcript proof。", }, { "surface_id": "config_backup_capture", "label": "Host / service / K8s 設定備份", "source_path": "scripts/backup/backup-configs.sh", "expected_scope": "110_188_120_121_cluster_configs", "config_kind": "config_backup_script", "control_tier": "C0", "current_state": "config_capture_visible_blocked_until_owner_evidence", "backup_scope": ["systemd", "docker", "nginx", "cron", "k8s", "host configs"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 config capture owner、secret redaction proof、120 blocked disposition、restore validation 與 retention owner。", }, { "surface_id": "backup_status_reporter", "label": "備份狀態彙整腳本", "source_path": "scripts/backup/backup-status.sh", "expected_scope": "110_188_backup_status_summary", "config_kind": "backup_status_reporter", "control_tier": "C0", "current_state": "status_reporter_visible_not_executed", "backup_scope": ["freshness", "failure", "integrity", "restore drill", "offsite", "escrow"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 backup status owner、read-only execution window、SSH read boundary、notification owner 與 false-green 防線。", }, { "surface_id": "backup_integrity_check", "label": "Restic integrity check", "source_path": "scripts/backup/check-backup-integrity.sh", "expected_scope": "restic_integrity_check", "config_kind": "integrity_check_script", "control_tier": "C0", "current_state": "integrity_check_visible_not_executed", "backup_scope": ["restic check", "read-data subset", "integrity evidence"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 integrity check owner、執行窗口、資源上限、結果證據與 restore drill 前置條件。", }, { "surface_id": "latest_only_retention_enforcer", "label": "Latest-only retention enforcer", "source_path": "scripts/backup/enforce-latest-only-retention.sh", "expected_scope": "latest_only_retention", "config_kind": "retention_enforcer", "control_tier": "C0", "current_state": "delete_capable_retention_script_visible_gate_closed", "backup_scope": ["keep latest", "local delete", "retention marker"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 retention owner、刪除窗口、restore runway、offsite mirror interaction 與 rollback / stop condition。", }, { "surface_id": "offsite_sync_controller", "label": "Offsite rclone sync controller", "source_path": "scripts/backup/sync-offsite-backups.sh", "expected_scope": "google_drive_rclone_offsite_mirror", "config_kind": "offsite_sync_controller", "control_tier": "C0", "current_state": "remote_write_and_delete_capable_sync_visible_gate_closed", "backup_scope": ["13 repos", "rclone sync", "remote delete", "success markers"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 offsite owner、remote delete owner、runway check、full sync window、rclone credential escrow 與 verifier evidence。", }, { "surface_id": "offsite_full_sync_verifier", "label": "Offsite full sync verifier", "source_path": "scripts/backup/verify-offsite-full-sync.sh", "expected_scope": "offsite_full_sync_verification", "config_kind": "offsite_verifier", "control_tier": "C0", "current_state": "remote_read_and_textfile_write_capable_verifier_visible_gate_closed", "backup_scope": ["remote repo count", "latest-only evidence", "textfile metrics"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 verifier owner、remote read window、metric write owner、failure notification owner 與 evidence retention。", }, { "surface_id": "offsite_readiness_gate", "label": "Offsite readiness gate", "source_path": "scripts/backup/backup-offsite-readiness-gate.sh", "expected_scope": "offsite_preflight_and_escrow_gate", "config_kind": "offsite_readiness_gate", "control_tier": "C0", "current_state": "readiness_gate_visible_not_executed", "backup_scope": ["status", "dry-run-small", "pre-full-sync", "escrow markers"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 readiness owner、dry-run scope、escrow owner、load/runway policy 與 accepted evidence refs。", }, { "surface_id": "offsite_escrow_evidence_report", "label": "Offsite / escrow evidence report", "source_path": "scripts/backup/offsite-escrow-evidence-report.sh", "expected_scope": "offsite_escrow_redacted_report", "config_kind": "offsite_escrow_report", "control_tier": "C0", "current_state": "redacted_report_visible_default_no_remote_status", "backup_scope": ["script presence", "offsite marker", "escrow marker", "redacted output"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 evidence report owner、remote status opt-in owner、redaction proof 與 blocked marker disposition。", }, { "surface_id": "credential_escrow_marker", "label": "Credential escrow marker writer", "source_path": "scripts/backup/mark-credential-escrow-verified.sh", "expected_scope": "credential_escrow_markers", "config_kind": "credential_escrow_marker", "control_tier": "C0", "current_state": "marker_write_capable_script_visible_gate_closed", "backup_scope": ["restic password", "offsite provider", "break-glass admin", "DNS recovery", "OAuth / AI provider recovery"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 escrow owner、non-secret evidence id、reviewer acceptance、marker write approval 與 retention owner。", }, { "surface_id": "offsite_rclone_config", "label": "rclone offsite config helper", "source_path": "scripts/backup/configure-offsite-rclone.sh", "expected_scope": "rclone_config_metadata", "config_kind": "offsite_rclone_config", "control_tier": "C0", "current_state": "credential_config_helper_visible_secret_values_not_collected", "backup_scope": ["rclone remote", "Google Drive", "offsite.env metadata"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 rclone config owner、secret store owner、file mode evidence、no-value collection proof 與 recovery owner。", }, { "surface_id": "offsite_b2_config", "label": "B2 offsite config helper", "source_path": "scripts/backup/configure-offsite-b2.sh", "expected_scope": "b2_config_metadata", "config_kind": "offsite_b2_config", "control_tier": "C0", "current_state": "credential_config_helper_visible_secret_values_not_collected", "backup_scope": ["Backblaze B2 metadata", "offsite env", "fallback provider"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 B2 provider owner、credential escrow owner、provider cost boundary 與 no-value collection proof。", }, { "surface_id": "backup_health_textfile_exporter", "label": "Backup health textfile exporter", "source_path": "scripts/ops/backup-health-textfile-exporter.py", "expected_scope": "backup_health_prometheus_textfile", "config_kind": "backup_health_exporter", "control_tier": "C0", "current_state": "textfile_write_capable_exporter_visible_gate_closed", "backup_scope": ["freshness metrics", "restore drill metrics", "offsite metrics", "escrow metrics"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 exporter owner、textfile path owner、metric freshness SLO、false-green guard 與 alert owner。", }, { "surface_id": "velero_restore_test_cronjob", "label": "Velero restore dry-run CronJob", "source_path": "k8s/awoooi-prod/16-cronjob-backup-restore-test.yaml", "expected_scope": "velero_weekly_restore_dry_run", "config_kind": "velero_restore_cronjob", "control_tier": "C0", "current_state": "k8s_cronjob_manifest_visible_not_applied_by_this_inventory", "backup_scope": ["Velero restore dry-run", "weekly schedule", "textfile metrics"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 Velero owner、dry-run namespace isolation、CronJob live evidence、restore approval 與 post-check 指標。", }, { "surface_id": "velero_restore_test_script_configmap", "label": "Velero restore script ConfigMap", "source_path": "k8s/awoooi-prod/17-configmap-backup-restore-scripts.yaml", "expected_scope": "velero_restore_script_configmap", "config_kind": "velero_restore_script_configmap", "control_tier": "C0", "current_state": "configmap_script_visible_timestamp_format_needs_owner_disposition", "backup_scope": ["restore dry-run script", "13-digit textfile timestamp risk", "Prometheus textfile"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 ConfigMap owner、timestamp format disposition、CronJob rollout owner、metric scrape proof 與 rollback owner。", }, { "surface_id": "velero_standalone_restore_test_script", "label": "Velero restore dry-run standalone script", "source_path": "scripts/cron_backup_restore_test.sh", "expected_scope": "velero_standalone_restore_script", "config_kind": "velero_restore_standalone_script", "control_tier": "C0", "current_state": "standalone_script_visible_uses_seconds_textfile_timestamp_not_executed", "backup_scope": ["restore dry-run", "Prometheus textfile seconds timestamp", "failure metric"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 standalone / ConfigMap drift disposition、restore drill owner、textfile owner 與 proof of isolation。", }, { "surface_id": "velero_credentials_manifest", "label": "Velero MinIO credential manifest", "source_path": "k8s/velero/01-credentials.yaml", "expected_scope": "velero_minio_credentials_metadata", "config_kind": "velero_credentials_manifest", "control_tier": "C0", "current_state": "placeholder_secret_manifest_visible_values_not_collected", "backup_scope": ["MinIO credential names", "placeholder values", "External Secrets / Sealed Secrets recommendation"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 Velero credential owner、secret manager source、rotation owner、no-value collection proof 與 restore boundary。", }, { "surface_id": "velero_install_manifest", "label": "Velero install manifest", "source_path": "k8s/velero/02-velero-install.yaml", "expected_scope": "velero_install_and_minio_storage", "config_kind": "velero_install_manifest", "control_tier": "C0", "current_state": "cluster_admin_velero_manifest_visible_gate_closed", "backup_scope": ["Velero Deployment", "cluster-admin binding", "MinIO s3Url", "backup storage location"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 Velero RBAC owner、MinIO endpoint owner、least privilege review、install window 與 rollback owner。", }, { "surface_id": "backup_restore_alert_rules", "label": "Backup / restore alert rules", "source_path": "ops/monitoring/alerts.yml", "expected_scope": "backup_restore_prometheus_alerts", "config_kind": "backup_restore_alert_rules", "control_tier": "C0", "current_state": "alert_rule_source_visible_reload_not_authorized", "backup_scope": ["BackupRestoreTestFailed", "Velero freshness", "offsite freshness", "restore stale"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 alert rule owner、receiver owner、reload owner、silence boundary 與 failure-only notification policy。", }, { "surface_id": "backup_dr_readiness_contract", "label": "Backup / DR readiness matrix", "source_path": "docs/evaluations/backup_dr_readiness_matrix_2026-06-04.json", "expected_scope": "backup_dr_readiness_contract", "config_kind": "dr_readiness_contract", "control_tier": "C0", "current_state": "readiness_contract_visible_action_required_items_not_accepted", "backup_scope": ["readiness matrix", "blocked targets", "restore drill status"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 readiness owner、blocked target disposition、freshness evidence、restore drill owner 與 accepted refs。", }, { "surface_id": "backup_restore_drill_approval_template", "label": "Restore drill approval package template", "source_path": "docs/evaluations/backup_restore_drill_approval_package_template_2026-06-05.json", "expected_scope": "restore_drill_approval_template", "config_kind": "restore_drill_approval_template", "control_tier": "C0", "current_state": "approval_template_visible_no_restore_execution", "backup_scope": ["database restore", "configuration restore", "credential escrow", "K8s restore", "observability restore"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 owner response 實際封包、隔離環境、observer、rollback owner 與 restore stop condition。", }, { "surface_id": "offsite_escrow_readiness_contract", "label": "Offsite / escrow readiness status", "source_path": "docs/evaluations/offsite_escrow_readiness_status_2026-06-05.json", "expected_scope": "offsite_escrow_readiness_contract", "config_kind": "offsite_escrow_readiness_contract", "control_tier": "C0", "current_state": "offsite_verified_but_escrow_and_velero_blocked", "backup_scope": ["offsite_rclone_full_sync", "credential_escrow_markers", "velero_k8s_resources"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 escrow marker owner、Velero metric binding、remote evidence expiry owner 與 offsite sync approval boundary。", }, { "surface_id": "backup_status_runbook", "label": "Backup status runbook", "source_path": "docs/runbooks/BACKUP-STATUS.md", "expected_scope": "backup_status_runbook", "config_kind": "backup_status_runbook", "control_tier": "C0", "current_state": "runbook_visible_contains_live_refresh_notes_needs_revalidation", "backup_scope": ["110 backup center", "latest-only", "Google Drive / rclone", "credential escrow", "120 blocker"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補截至本次階段的 owner-provided live refresh、stale evidence disposition、escrow blocker owner 與 validation refs。", }, { "surface_id": "cold_start_sop", "label": "Full-stack cold-start SOP", "source_path": "docs/runbooks/FULL-STACK-COLD-START-SOP.md", "expected_scope": "cold_start_backup_restore_recovery", "config_kind": "cold_start_sop", "control_tier": "C0", "current_state": "sop_visible_contains_backup_commands_not_authorized", "backup_scope": ["cold start", "backup-all", "sync-offsite", "restore guard", "schedules"], "requires_live_evidence": True, "requires_owner_response": True, "next_owner_action": "補 cold-start commander owner、backup command approval boundary、restore stop condition、rollback owner 與 post-start validation。", }, ] FALSE_BOUNDARIES = { "runtime_execution_authorized": False, "host_write_authorized": False, "backup_run_authorized": False, "restore_run_authorized": False, "restore_drill_authorized": False, "offsite_sync_authorized": False, "offsite_remote_delete_authorized": False, "credential_escrow_marker_write_authorized": False, "retention_change_authorized": False, "restic_prune_authorized": False, "rclone_config_authorized": False, "velero_restore_authorized": False, "velero_backup_authorized": False, "kubectl_action_authorized": False, "ssh_read_authorized": False, "ssh_write_authorized": False, "secret_value_collection_allowed": False, "active_scan_authorized": False, "action_buttons_allowed": False, } WRITE_CAPABLE_KINDS = { "backup_orchestrator", "service_backup_script", "config_backup_script", "retention_enforcer", "offsite_sync_controller", "offsite_verifier", "credential_escrow_marker", "offsite_rclone_config", "offsite_b2_config", "backup_health_exporter", "velero_restore_cronjob", "velero_restore_script_configmap", "velero_restore_standalone_script", "velero_credentials_manifest", "velero_install_manifest", } BACKUP_SCRIPT_KINDS = { "backup_orchestrator", "service_backup_script", "config_backup_script", } RESTORE_DRILL_KINDS = { "velero_restore_cronjob", "velero_restore_script_configmap", "velero_restore_standalone_script", "restore_drill_approval_template", } OFFSITE_ESCROW_KINDS = { "offsite_sync_controller", "offsite_verifier", "offsite_readiness_gate", "offsite_escrow_report", "credential_escrow_marker", "offsite_rclone_config", "offsite_b2_config", "offsite_escrow_readiness_contract", } VELERO_KINDS = { "velero_restore_cronjob", "velero_restore_script_configmap", "velero_restore_standalone_script", "velero_credentials_manifest", "velero_install_manifest", } RETENTION_SURFACE_IDS = { "backup_common_restic_retention", "latest_only_retention_enforcer", "offsite_sync_controller", } CREDENTIAL_SURFACE_IDS = { "backup_common_restic_retention", "credential_escrow_marker", "offsite_rclone_config", "offsite_b2_config", "velero_credentials_manifest", } DR_CONTRACT_KINDS = { "dr_readiness_contract", "restore_drill_approval_template", "offsite_escrow_readiness_contract", } def git_short_sha(root: Path) -> str: try: result = subprocess.run( ["git", "rev-parse", "--short", "HEAD"], cwd=root, check=True, capture_output=True, text=True, ) return result.stdout.strip() except Exception: return "unknown" def file_metadata(root: Path, source_path: str) -> dict[str, Any]: path = root / source_path exists = path.exists() if not exists: return {"source_exists": False, "line_count": 0, "sha256": None} content = path.read_bytes() return { "source_exists": True, "line_count": len(content.decode("utf-8", errors="replace").splitlines()), "sha256": hashlib.sha256(content).hexdigest(), } def build_surface(root: Path, surface: dict[str, Any]) -> dict[str, Any]: metadata = file_metadata(root, surface["source_path"]) return { **surface, **metadata, "owner_response_received": False, "owner_response_accepted": False, "live_evidence_received": False, "restore_drill_accepted": False, "offsite_sync_accepted": False, "credential_escrow_accepted": False, "retention_change_accepted": False, "maintenance_window_accepted": False, "rollback_owner_accepted": False, "runtime_gate_open": False, "action_buttons_allowed": False, } def count_kind(surfaces: list[dict[str, Any]], kinds: set[str]) -> int: return sum(1 for surface in surfaces if surface["config_kind"] in kinds) def build_report(root: Path, generated_at: str | None) -> dict[str, Any]: report_time = generated_at or datetime.now(TAIPEI).isoformat(timespec="seconds") surfaces = [build_surface(root, surface) for surface in SURFACES] expected_scopes = sorted({surface["expected_scope"] for surface in surfaces}) write_capable = [surface for surface in surfaces if surface["config_kind"] in WRITE_CAPABLE_KINDS] return { "schema_version": "backup_restore_escrow_inventory_v1", "generated_at": report_time, "git_commit": git_short_sha(root), "status": "repo_only_inventory_ready", "source_scope": "committed_repo_files_only", "summary": { "surface_count": len(surfaces), "source_exists_count": sum(1 for surface in surfaces if surface["source_exists"]), "expected_scope_count": len(expected_scopes), "backup_script_surface_count": count_kind(surfaces, BACKUP_SCRIPT_KINDS), "restore_drill_surface_count": count_kind(surfaces, RESTORE_DRILL_KINDS), "offsite_escrow_surface_count": count_kind(surfaces, OFFSITE_ESCROW_KINDS), "velero_surface_count": count_kind(surfaces, VELERO_KINDS), "retention_surface_count": sum(1 for surface in surfaces if surface["surface_id"] in RETENTION_SURFACE_IDS), "credential_surface_count": sum(1 for surface in surfaces if surface["surface_id"] in CREDENTIAL_SURFACE_IDS), "alert_surface_count": sum(1 for surface in surfaces if surface["config_kind"] == "backup_restore_alert_rules"), "dr_readiness_contract_surface_count": count_kind(surfaces, DR_CONTRACT_KINDS), "write_capable_surface_count": len(write_capable), "surfaces_requiring_owner_response_count": sum(1 for surface in surfaces if surface["requires_owner_response"]), "surfaces_requiring_live_evidence_count": sum(1 for surface in surfaces if surface["requires_live_evidence"]), "owner_response_received_count": 0, "owner_response_accepted_count": 0, "live_evidence_received_count": 0, "restore_drill_accepted_count": 0, "offsite_sync_accepted_count": 0, "credential_escrow_accepted_count": 0, "retention_change_accepted_count": 0, "maintenance_window_accepted_count": 0, "rollback_owner_accepted_count": 0, "runtime_gate_count": 0, "action_button_count": 0, "coverage_percent_before_inventory": 52, "coverage_percent_after_inventory": 58, }, "execution_boundaries": FALSE_BOUNDARIES, "expected_scopes": expected_scopes, "backup_surfaces": surfaces, "write_capable_surfaces": [ { "surface_id": surface["surface_id"], "label": surface["label"], "config_kind": surface["config_kind"], "expected_scope": surface["expected_scope"], "required_gate": "owner_response_plus_maintenance_window_plus_rollback_owner", } for surface in write_capable ], "next_collection_order": [ "backup_common_restic_retention", "offsite_sync_controller", "credential_escrow_marker", "velero_restore_test_script_configmap", "velero_credentials_manifest", "backup_health_textfile_exporter", "backup_restore_alert_rules", "backup_restore_drill_approval_template", "backup_status_runbook", "cold_start_sop", ], "operator_interpretation": [ "這是 repo-only backup / restore / escrow / retention 清冊，不是 live backup、remote provider 或 cluster truth。", "source_exists=true 只代表 repo 檔案存在；不代表備份已成功、restore drill 已執行、offsite sync 已授權或 escrow marker 已可寫入。", "write-capable surface 可見代表需要資安控管，不代表 backup、restore、rclone sync、remote delete、restic prune、Velero restore 或 kubectl 已授權。", "所有 owner response、live evidence、restore drill acceptance、offsite sync acceptance、credential escrow acceptance、retention change acceptance 與 runtime gate 仍為 0。", ], } def parse_args() -> argparse.Namespace: parser = argparse.ArgumentParser(description="產生 IwoooS backup / restore / escrow / retention repo-only 清冊") parser.add_argument("--root", default=".", help="repo root") parser.add_argument("--output", help="輸出 JSON 檔") parser.add_argument("--generated-at", help="固定 generated_at") return parser.parse_args() def main() -> int: args = parse_args() root = Path(args.root).resolve() report = build_report(root, args.generated_at) text = json.dumps(report, ensure_ascii=False, indent=2, sort_keys=True) if args.output: Path(args.output).write_text(text + "\n", encoding="utf-8") else: print(text) print( "BACKUP_RESTORE_ESCROW_INVENTORY_OK " f"surfaces={report['summary']['surface_count']} " f"backup_scripts={report['summary']['backup_script_surface_count']} " f"offsite_escrow={report['summary']['offsite_escrow_surface_count']} " f"runtime_gate={report['summary']['runtime_gate_count']}", file=sys.stderr, ) return 0 if __name__ == "__main__": raise SystemExit(main())