activity-core/declarations/backup-daily/tenancy.yaml

# backup-daily workload identity and security-zone declaration
# Standard: net-kingdom/canon/standards/security-zones_v0.1.md §6
#   (independently governed operational execution unit, declared directly in its
#   responsible repo; not a managed rapp deployable)
# Conformance rule: accuracy, not altitude. Nothing here is aspirational.
#
# Founder confirmed on 2026-10-08 (relayed by ops-warden, hub msg 49292aca) that
# activity-core's daily-cnpg-option-a-backup worker is the unit the ops-warden
# actor atm-backup-daily stands for; classification ordinary, not z2-continuity.
# Consumer: ops-warden WARDEN-WP-0040-T02 (declaration_ref to this file).
# Tenancy axes are graded conservatively for a scheduled batch unit with no
# inbound callers and no datastore of its own.

schema_version: "0.1"
framework: netkingdom-tenancy-posture
service: backup-daily
role: scheduled-backup-execution

workload_identity:
  name: backup-daily
  kind: maintenance-job
  responsible_repo: activity-core
  # The activity-core Temporal worker on railiance01 executing the daily-cnpg-
  # option-a-backup ActivityDefinition: the code-registered bounded operation
  # cnpg_option_a_backup (ACT-ADR-007), which calls railiance-platform's cnpg-
  # option-a-backup tool to age-encrypt logical dumps of r01-forgejo-db,
  # r01-net-kingdom-pg and r01-state-hub-db and upload them to the Nextcloud
  # offsite lane. It never restores.
  identity_bindings:
    - scheme: ssh-certificate
      authority: ops-warden
      subject: atm-backup-daily
      # atm-* is a non-human automation actor; the schema offers service|agent.
      principal_type: service
      environment: prod
    - scheme: kubernetes-service-account
      authority: railiance01
      # The worker Deployment sets no serviceAccountName; it runs as the
      # namespace default SA, which the databases-namespace RoleBinding names.
      subject: system:serviceaccount:activity-core:default
      principal_type: service
      environment: prod

tenancy:
  current:
    I: "n/a"
    A: "n/a"
    E: 0
    P: "n/a"
    R: "n/a"
    V: 0
  target:
    I: "n/a"
    A: "n/a"
    E: 0
    P: "n/a"
    R: "n/a"
    V: 0
  reviewed: "2026-10-09"
  review_due: "2027-04-09"
  service_class: batch
  permanent: [I, A, P, R]

  gap:
    I: >-
      n/a. The unit has no inbound request surface: a Temporal Schedule fires
      it. No caller presents an identity for it to verify.
    A: >-
      n/a, on the same ground as I. There is no request to bind to a tenant.
      Execution authority is the code-registered operation (ACT-ADR-007) and
      the databases-namespace RoleBinding, not a per-request decision.
    E: >-
      E0. One process dumps several owners' databases (Forgejo, net-kingdom,
      State Hub) with no tenant partitioning between them. This is
      accurate. A backup sweep has no tenant-scoped choke point to build.
    P: >-
      n/a. No primary datastore. Dumps are transient in the worker and are
      uploaded encrypted to the railiance-platform-owned offsite lane.
    R: >-
      n/a. Nothing is held at rest here. Retention of the uploaded artifacts
      belongs to the offsite lane's owner (railiance-platform).
    V: >-
      V0. One worker on the single-node railiance01 reef, misfire policy
      skip, and no exercised recovery objective for the job itself.

zones:
  standard: security-zones_v0.1
  membership: z2-protected
  responsible_party: activity-core
  justification: >-
    The unit runs in prod and holds plaintext logical dumps of production
    databases (Forgejo, net-kingdom, State Hub) before encryption, so its
    context is confidential data at high criticality, which floors at M2.
    It is ordinary, not z2-continuity: losing a nightly run delays an RPO
    point but breaks no access or recovery path. Declared M1 is below the M2
    floor, so admission is expected to resolve below-floor and the effective
    zone stays unknown until M2 evidence (SLO history, on-call, incident
    readiness) exists. This is a recorded gap, not a claim of admission.
  context:
    maturity: M1
    criticality: high
    data_classification: confidential
  evidence:
    - ref: activity-definitions/daily-cnpg-option-a-backup.md
      supports: [prod-schedule, targets, non-secret-evidence-sink]
    - ref: k8s/railiance/26-worker-cnpg-backup-rbac.yaml
      supports: [service-account-binding, databases-exec-scope]
    - ref: docs/adr/adr-007-bounded-operations.md
      supports: [bounded-operation, no-general-executor]
    - ref: docs/runbook.md
      supports: [M1, production-runbook]
  reviewed: "2026-10-09"
  review_due: "2027-01-09"

notes:
  - >-
    Data classification is activity-core's conservative reading in the absence
    of an owner-declared class for the source databases. If their owners
    declare a lower class, re-review membership here as a reviewed change.
  - >-
    Maturity M1 rests on production operation, the runbook and the
    deterministic automation-status surface; no formal promotion record exists
    yet.