Complete DISCTL-WP-0002-T06 and finish resilience foundation

Record automated Forgejo backup decrypt drill evidence, update
registers and pickup queue (item 3 in progress). Mark WP-0002
finished — 8/8 tasks done.

TestEvidence/README.md

@@ -44,11 +44,15 @@ in `BackupPolicy.md` §7).
 
 ## Next untested targets
 
-Priority order after Forgejo manual drill (2026-07-04):
+Completed drills:
 
-1. **S2 k8s runtime** — decrypt `railiance-backup-s2` artifact on clean target;
-   validate Helm values redeploy
-2. **Dev workstation cold restore** — decrypt Nextcloud artifact without using
-   production key on same machine (password-manager key only)
-3. **Gitea dump** — manual `gitea dump` restore to staging before next migration wave
-4. **Secret vault cold decrypt** — SOPS/age recovery material (R5 mitigation)
+- 2026-07-04 — Forgejo manual isolated restore
+- 2026-07-07 — Forgejo automated backup decrypt + validate
+
+Next targets:
+
+1. **Forgejo from Nextcloud only** — promotion gate (`BackupPolicy.md` §7)
+2. **S2 k3s runtime** — decrypt `railiance-backup-s2` on railiance01
+3. **Dev workstation cold restore** — password-manager key only
+4. **Gitea dump** — before next migration wave
+5. **Secret vault cold decrypt** — SOPS/age recovery material (R5)

TestEvidence/restore-drill-2026-07-07-forgejo-automated.md

@@ -0,0 +1,87 @@
+# Restore Drill: Forgejo automated backup (decrypt + validate)
+
+**Date:** 2026-07-07  
+**System:** `backup-forgejo-production` — automated Option A artifacts  
+**Operator:** grok (Bernd workstation)  
+**Result:** success (decrypt + validate scope)  
+**Workplan:** DISCTL-WP-0002-T06
+
+`no_secret_material_recorded: true`
+
+## Scope
+
+This drill proves **automated** Forgejo backup artifacts are decryptable and
+contain coherent restore inputs. It does **not** deploy an isolated namespace
+(full restore remains covered by 2026-07-04 manual drill).
+
+Promotion gate still requires restore from a **Nextcloud** artifact — this drill
+used the local cache copy (`~/.cache/railiance/backups/forgejo/`).
+
+## Backup artifacts
+
+| Field | Value |
+| --- | --- |
+| Source | `railiance-platform/tools/cmd/forgejo-backup` (automated run) |
+| Dump artifact | `forgejo-dump-20260707T180844Z.zip.age` |
+| DB artifact | `forgejo-db-20260707T180844Z.sql.age` |
+| Backup timestamp | 2026-07-07T18:08:44Z (`.last-success`) |
+| Dump size (decrypted) | 719,116,262 bytes (~686 MiB) |
+| DB size (decrypted) | 2,141,692 bytes (~2.0 MiB) |
+| Encryption | age (platform backup public key) |
+| Local cache path | `~/.cache/railiance/backups/forgejo/` |
+
+## Target environment
+
+Clean staging directory on workstation (no production services touched):
+
+```text
+/tmp/disaster-control-drill-2026-07-07/
+```
+
+## Procedure
+
+1. Record start time (UTC).
+2. `age -d` decrypt dump and DB artifacts using operational age key.
+3. `unzip -l` validate dump structure.
+4. Verify `pg_dump` header on SQL file.
+5. Record elapsed time.
+
+## Validation checks
+
+| Check | Result |
+| --- | --- |
+| Dump decrypt | success |
+| DB decrypt | success |
+| `pg_dump` header | `PostgreSQL database dump` present |
+| `repos/coulomb/glas-harness.git/` | present |
+| `repos/coulomb/core-hub.git/` | present |
+| Package blobs under `data/packages/` | present (4704 files in archive) |
+| Elapsed (decrypt + list + header) | **7 seconds** |
+
+## RPO / RTO measured
+
+| Metric | Target (adopted) | Achieved |
+| --- | --- | --- |
+| RPO | 24h | ~47 minutes (backup 18:08Z, drill 18:55Z) |
+| RTO (decrypt + validate) | 4h | **7 seconds** |
+| RTO (full isolated restore) | 4h | not measured this drill |
+
+## Issues found
+
+- Drill used **local cache**, not Nextcloud download — promotion gate item 3
+  still needs explicit restore-from-offsite proof.
+- Full isolated namespace restore not re-run (2026-07-04 manual drill still
+  canonical for deploy path).
+
+## Follow-up actions
+
+| Action | Owner | Reference |
+| --- | --- | --- |
+| Re-run drill downloading artifact from Nextcloud only | Bernd | `BackupPolicy.md` §7 promotion gate |
+| Quarterly full isolated restore from automated backup | `railiance-infra` | `forgejo-restore-drill.sh` |
+| Update pickup queue item 3 status if cron confirmed | `disaster-control` | `BackupPickupQueue.md` |
+
+## Related evidence
+
+- Manual isolated restore: `TestEvidence/restore-drill-2026-07-04-forgejo.md`
+- Owner repo: `railiance-infra/docs/forgejo-restore-drill-evidence.md`