Complete DISCTL-WP-0003-T01: seed asset and data registers

Add AssetRegister.yaml and DataRegister.yaml documenting the
railiance-backup tool family, backup lanes, data classes, gaps,
and RTO/RPO targets. Mark T01 done.

AssetRegister.yaml

@@ -0,0 +1,239 @@
+# Resilience Control Plane — asset register (initial seed)
+# DISCTL-WP-0003-T01 — railiance-backup tool family and backup lanes
+# Broader T0/T4 inventory (domains, Stripe, Bubble, etc.) follows in DISCTL-WP-0002-T02.
+
+schema_version: "0.1"
+updated: "2026-07-07"
+register_scope: backup_lanes
+
+tier_definitions:
+  T0: "Identity / trust / money — recoverable even after breach"
+  T1: "Irreplaceable source of truth — strong backups, tested restore"
+  T2: "Runtime platforms — rebuild from IaC + restore data"
+  T3: "Derived / rebuildable — recompute where possible"
+  T4: "External dependencies — export, monitor, document limits"
+
+backup_streams:
+  - id: backup-dev-workstation
+    name: Dev workstation custodian state
+    tool: railiance-backup
+    tool_path: railiance-cluster/tools/cmd/railiance-backup
+    owner_repo: railiance-cluster
+    operator: Bernd
+    tier: T1
+    host: bnt-lap001
+    backup_mechanism: >-
+      pg_dump from Docker container infra-postgres-1 (custodian DB);
+      tar of ~/.claude, ~/.claude.json, ~/.gitconfig; age encrypt; upload via curl PUT
+    destination:
+      primary: Nextcloud WebDAV file drop (off-node)
+      local_cache: ~/.cache/railiance/backups/
+    backup_schedule: "daily 02:00 UTC (cron)"
+    retention: "7 local copies per artifact type"
+    encryption: age
+    recovery_method: >-
+      Download artifacts from Nextcloud; age -d with ~/.config/age/railiance-backup.key;
+      restore PostgreSQL volume; unpack config tar. See railiance-cluster/docs/backup-restore.md
+    rpo: 24h
+    rto: 4h
+    status: operational
+    gaps: []
+    evidence:
+      restore_tested: false
+      last_drill: null
+    references:
+      - railiance-cluster/docs/backup-restore.md
+      - railiance-cluster/tools/cmd/railiance-backup
+
+  - id: backup-s1-os-config
+    name: S1 OS and provisioning config
+    tool: railiance-backup-s1
+    tool_path: railiance-infra/tools/cmd/railiance-backup-s1
+    owner_repo: railiance-infra
+    operator: Bernd
+    tier: T2
+    host: railiance01
+    backup_mechanism: >-
+      Tar of Ansible-managed OS files (sshd, ufw, fail2ban, hosts, hostname,
+      apt sources) plus dpkg --get-selections; age encrypt
+    destination:
+      primary: /opt/backup/railiance/infra/ (on-node local only)
+      offsite: none
+    backup_schedule: manual (make backup in railiance-infra)
+    retention: "7 local copies per artifact type"
+    encryption: age (SOPS key pair)
+    recovery_method: >-
+      age -d with ~/.config/sops/age/keys.txt; restore files to /etc/ or re-apply
+      via Ansible playbooks
+    rpo: 24h
+    rto: 4-8h
+    status: operational
+    gaps:
+      - "No scheduled automation — manual make backup only"
+      - "No off-cluster upload — lost if host is destroyed"
+    evidence:
+      restore_tested: false
+      last_drill: null
+    references:
+      - railiance-infra/tools/cmd/railiance-backup-s1
+
+  - id: backup-s2-k8s-runtime
+    name: S2 Kubernetes runtime state
+    tool: railiance-backup-s2
+    tool_path: railiance-cluster/tools/cmd/railiance-backup-s2
+    owner_repo: railiance-cluster
+    operator: Bernd
+    tier: T1
+    host: railiance01
+    backup_mechanism: >-
+      sqlite3 hot backup of k3s state.db; tar of Helm release values (all namespaces);
+      kubeconfig copy; age encrypt
+    destination:
+      primary: /opt/backup/railiance/cluster/ (on-node local only)
+      offsite: none
+    backup_schedule: manual (make backup in railiance-cluster)
+    retention: "7 local copies per artifact type"
+    encryption: age (SOPS key pair)
+    recovery_method: >-
+      age -d; restore k3s state.db or redeploy from Helm values + kubeconfig.
+      Prefer rebuild-from-manifests where possible.
+    rpo: 24h
+    rto: 4-8h
+    status: operational
+    gaps:
+      - "No scheduled automation — manual make backup only"
+      - "No off-cluster upload — lost if host is destroyed"
+    evidence:
+      restore_tested: false
+      last_drill: null
+    references:
+      - railiance-cluster/tools/cmd/railiance-backup-s2
+      - history/2026-07-04-forgejo-backup-strategy-assessment.md
+
+  - id: backup-s3-platform
+    name: S3 platform services (PostgreSQL, Valkey)
+    tool: railiance-backup
+    tool_path: railiance-platform/tools/cmd/railiance-backup
+    owner_repo: railiance-platform
+    operator: Bernd
+    tier: T1
+    host: railiance01
+    backup_mechanism: >-
+      Intended pg_dump of platform PostgreSQL HA and Valkey state; age encrypt;
+      upload to Nextcloud WebDAV (same lane as dev workstation pattern)
+    destination:
+      primary: Nextcloud WebDAV file drop (intended, off-node)
+      local_cache: TBD
+    backup_schedule: TBD
+    retention: "14 daily + 4 weekly rotations (adopted 2026-07-09 for Forgejo lane)"
+    encryption: age
+    recovery_method: >-
+      Not operational — tool absent. Makefile target exists but
+      tools/cmd/railiance-backup was never relocated from railiance-cluster
+      (RAIL-PL-WP-0001-T05 cancelled).
+    rpo: 24h
+    rto: 4h
+    status: missing
+    gaps:
+      - "tools/cmd/railiance-backup absent from railiance-platform"
+      - "make backup target references missing implementation"
+      - "Relocation from railiance-cluster planned but never completed"
+    evidence:
+      restore_tested: false
+      last_drill: null
+    references:
+      - railiance-platform/Makefile
+      - railiance-platform/docs/postgresql-ha.md
+      - history/2026-07-04-forgejo-backup-strategy-assessment.md
+
+  - id: backup-forgejo-production
+    name: Forgejo production (git, packages, DB)
+    tool: forgejo dump + CNPG pg_dump
+    tool_path: null
+    owner_repo: railiance-platform
+    operator: Bernd
+    tier: T1
+    host: railiance01
+    backup_mechanism: >-
+      Daily forgejo dump zip (repos, packages OCI/npm/generic, attachments, LFS,
+      avatars) plus daily pg_dump from CNPG forgejo-db; age encrypt; Nextcloud upload
+    destination:
+      primary: Nextcloud WebDAV file drop (decided 2026-07-09, not wired)
+      drill_archive: workstation /tmp only (T09 drill)
+    backup_schedule: daily (intended — not implemented)
+    retention: "14 daily + 4 weekly rotations"
+    encryption: age (platform backup public key)
+    recovery_method: >-
+      forgejo-restore-drill.sh — unzip dump, copy files, psql import, isolated Helm
+      deploy. Proven 2026-07-04 (RAIL-HO-WP-0005-T09); not yet from automated backup.
+    rpo: 24h
+    rto: 4h
+    status: not_wired
+    gaps:
+      - "No scheduled forgejo dump CronJob"
+      - "No CNPG ScheduledBackup CR on forgejo-db"
+      - "No automated upload to Nextcloud — decision #7 adopted but not implemented"
+      - "Promotion gate: 7 consecutive daily successes + restore from Nextcloud artifact"
+    evidence:
+      restore_tested: true
+      last_drill: "2026-07-04"
+      evidence_ref: railiance-infra/docs/forgejo-restore-drill-evidence.md
+    references:
+      - the-custodian/docs/forgejo-production-decisions.md
+      - railiance-infra/tools/forgejo-restore-drill.sh
+      - history/2026-07-04-forgejo-backup-strategy-assessment.md
+
+  - id: backup-gitea-canonical
+    name: Gitea canonical source forge (pre-cutover)
+    tool: gitea dump / git mirror
+    tool_path: null
+    owner_repo: railiance-infra
+    operator: Bernd
+    tier: T1
+    host: coulombcore
+    backup_mechanism: >-
+      Manual gitea dump before migration waves; git mirror to offsite provider (intended).
+      Bundled PostgreSQL + gitea-shared-storage PVC; no automated CronJob evidenced.
+    destination:
+      primary: none automated
+      mirror: TBD (GitHub private mirror or secondary host)
+    backup_schedule: pre-cutover manual only
+    retention: point-in-time of last manual dump
+    encryption: not standardized
+    recovery_method: gitea dump restore per Gitea docs; safety contract requires fresh
+      dump before each Forgejo migration wave
+    rpo: 24h
+    rto: 4-8h
+    status: at_risk
+    gaps:
+      - "No automated Gitea backup CronJob on coulombcore"
+      - "Package blob backup not evidenced"
+      - "disaster-control itself not yet mirrored off primary Gitea (DISCTL-WP-0002-T01)"
+    evidence:
+      restore_tested: false
+      last_drill: null
+    references:
+      - history/2026-07-04-forgejo-backup-strategy-assessment.md
+      - specs/ResilienceControlSetup.md
+
+related_streams:
+  # Operational on cluster but outside T01 minimum table — tracked for completeness.
+  - id: backup-adjacent-sso
+    name: Adjacent SSO/MFA stack
+    tools:
+      - privacyidea-backup
+      - authelia-backup
+      - lldap-backup
+    owner_repo: railiance-platform
+    tier: T2
+    host: railiance01
+    backup_schedule: daily CronJobs on railiance01
+    status: operational
+    note: "Only scheduled backup CronJobs found on cluster as of 2026-07-04 assessment"
+
+  - id: backup-apps-pg
+    name: apps-pg shared CloudNativePG cluster
+    owner_repo: railiance-platform
+    tier: T1
+    status: not_wired
+    note: "Documented follow-up in railiance-platform/docs/apps-pg.md; no ScheduledBackup CR"