awoooi/docs/security/BACKUP-RESTORE-POST-INCIDENT-READBACK-PLAN.md

IwoooS Backup / Restore / Escrow 事故後回讀計畫

項目	內容
日期	2026-06-18
狀態	post_incident_readback_plan_ready_no_runtime_action
工具	scripts/security/backup-restore-post-incident-readback-plan.py
Snapshot	docs/security/backup-restore-post-incident-readback-plan.snapshot.json
來源	docs/security/backup-restore-owner-response-acceptance.snapshot.json
runtime gate	0

1. 目的

此計畫把 Backup / Restore / Escrow 的事故後回讀從「有備份狀態」推進成可重跑、可補件、可隔離、可拒收的只讀帳本。

它處理的風險不是替正式備份系統下指令，而是先定義未來 owner 必須提供哪些脫敏 ref，才能說明誰動了 backup / restore / offsite / escrow / retention，何時異常，改前改後 freshness 與 restore / offsite / retention 狀態如何，是否有隔離 restore target、credential escrow non-secret proof、rollback、post-change monitoring、recurrence guard 與 no-false-green 檢查。

本 artifact 不執行 backup、不 restore、不跑 offsite sync、不 remote delete、不寫 credential escrow marker、不改 retention、不 restic prune、不讀 rclone config、不跑 Velero、不 kubectl、不 SSH、不讀 secret value、不保存 raw backup listing、不保存 raw restore payload、不寫 production。

2. 固定數字

指標	數值
readback candidate	38
write-capable candidate	27
live evidence required candidate	38
restore drill readback required candidate	38
offsite / escrow readback required candidate	20
retention / remote delete readback required candidate	17
required readback fields	34
reviewer checks	32
outcome lanes	11
blocked actions	51
post-incident readback received / accepted	0 / 0
runtime gate	0

3. 必填回讀欄位

每一個候選都必須補齊以下 metadata-only refs，才能進入 reviewer review：

1. incident / change / outage ref。
2. actor role / team attribution ref。
3. change / outage time window ref。
4. change intent 或 break-glass reason ref。
5. before / after backup freshness state refs。
6. backup status readback ref。
7. restore drill readback ref。
8. restore target isolation readback ref。
9. offsite sync readback ref。
10. offsite remote delete guard readback ref。
11. credential escrow non-secret readback ref。
12. credential recovery drill metadata ref。
13. retention runway readback ref。
14. retention 或 prune decision ref。
15. backup dependency map ref。
16. data classification ref。
17. restore observer / stop condition ref。
18. backup health no-false-green readback ref。
19. alert textfile readback ref。
20. cold-start / DR scorecard ref。
21. cross-project sync ref。
22. rollback validation ref。
23. post-change monitoring ref。
24. independent postcheck readback ref。
25. recurrence guard ref。
26. maintenance window、rollback owner、followup owner。
27. redacted evidence refs。
28. no-secret-value、no-raw-backup-payload、no-production-restore 與 no-false-green attestation。

4. Reviewer 檢查

Reviewer 必須確認來源 snapshot 是目前版本，並逐項檢查 actor、時間窗、變更意圖、before / after freshness、backup status、restore drill、restore target isolation、offsite sync、remote delete guard、credential escrow non-secret proof、credential recovery metadata、retention runway、retention / prune decision、dependency map、data classification、restore observer、backup health no-false-green、alert textfile、cold-start scorecard、cross-project sync、rollback、post-change monitoring、independent postcheck、recurrence guard、maintenance window、脫敏 ref、secret absence、raw payload absence、runtime stays zero 與 count transition safe。

不能把 backup success、route 200、dashboard up、alert quiet、textfile present、UI 可見、CD success 或 latest 字樣視為 DR / backup 驗收。

5. 分流

lane	用途
waiting_post_incident_readback	尚未收到回讀包；所有 accepted / runtime count 維持 0
request_actor_or_time_supplement	缺 actor、時間窗、intent 或 break-glass reason
request_backup_freshness_supplement	缺 before / after freshness、backup status、alert textfile 或 scorecard
request_restore_isolation_supplement	缺 restore drill、隔離目標、observer、stop condition 或 rollback validation
request_offsite_retention_supplement	缺 offsite sync、remote delete guard、retention runway 或 prune decision
request_escrow_non_secret_supplement	缺 credential escrow non-secret proof 或 recovery drill metadata
quarantine_raw_payload	收到 secret、raw backup listing、raw restore payload、raw DB dump、rclone config 或未脫敏截圖時隔離
reject_false_green_claim	把 backup success、route 200、dashboard up、alert quiet、textfile present 或 UI 可見當驗收時拒收
ready_for_backup_restore_post_incident_review	metadata 合格後只能進 reviewer review
recurrence_guard_backfill_required	需補防再發 guard、retention freeze、remote-delete block、owner review 或 automation block
waiting_runtime_gate	即使 readback accepted，runtime gate 仍需獨立人工批准

6. 固定禁止動作

本階段明確阻擋 backup_run、restore_run、restore_drill、production_restore、offsite_sync、offsite_remote_delete、credential_escrow_marker_write、credential_recovery_execution、retention_change、retention_prune、restic_prune、rclone_config_read、rclone_config_change、velero_restore、velero_backup、kubectl_action、ssh_read、ssh_write、secret_value_collection、secret_hash_collection、partial_token_collection、restic_password_collection、rclone_token_collection、kubeconfig_collection、host_write、active_scan、production_write、runtime_gate_open、raw backup / restore / object listing / DB dump storage、接受 secret 或 credential derivative evidence、無 reviewer record 標記 accepted、接受 false green、跳過 dependency / data classification / observer / cross-project / rollback / post-change monitoring review、偽造 credential escrow evidence 與任何 action button。

7. 目前邊界

此 artifact 只代表事故後回讀計畫已建立。post_incident_readback_received_count、post_incident_readback_accepted_count、backup_status_readback_accepted_count、restore_drill_readback_accepted_count、offsite_sync_readback_accepted_count、credential_escrow_non_secret_readback_accepted_count、retention_runway_readback_accepted_count、backup_health_no_false_green_readback_accepted_count、backup_run_authorized_count、restore_run_authorized_count、offsite_sync_authorized_count、credential_escrow_marker_write_authorized_count、retention_change_authorized_count、runtime_gate_count 與 action_button_count 仍全部維持 0。

8. 指令

產生 committed snapshot：

python3 scripts/security/backup-restore-post-incident-readback-plan.py \
  --root . \
  --generated-at 2026-06-18T10:30:00+08:00 \
  --output docs/security/backup-restore-post-incident-readback-plan.snapshot.json

只讀 guard：

python3 scripts/security/iwooos-config-control-guard.py --root .
python3 scripts/security/security-mirror-progress-guard.py --root .

9. 完成度

工作	完成度	說明
post-incident readback plan artifact	100%	38 個候選已建立只讀回讀計畫
post-incident readback received / accepted	0%	尚未收到或驗收任何事故後回讀包
live backup / offsite / escrow evidence	0%	未讀 live backup、offsite、credential escrow 或 secret
backup / restore / offsite / retention	0%	未授權且未執行
secret / host / production write	0%	未收 secret、未 SSH、未寫 host
runtime gate / action button	0%	無 action button，無 production write