# Test Evidence

Dated restore-drill reports proving RTO/RPO targets in `RTO-RPO-Matrix.md` are
actually met — not just documented.

## Naming convention

```text
TestEvidence/restore-drill-YYYY-MM-DD-<system>.md
```

Examples: `restore-drill-2026-07-04-forgejo.md`

## Required fields

Every evidence file must include:

| Field | Description |
| --- | --- |
| Date | Drill execution date (UTC) |
| System | What was restored (register ID or system name) |
| Backup artifact | Filename, size, timestamp, source (manual/automated) |
| Target environment | Isolated namespace, staging host, clean VM, etc. |
| Operator | Who ran the drill |
| Result | `success` / `partial` / `failed` |
| RPO achieved | Actual recovery point (how stale was the backup?) |
| RTO achieved | Wall-clock time from start to validated service |
| Checks performed | API calls, smoke tests, representative workflow |
| Issues found | Anything that blocked or degraded restore |
| Follow-up actions | Workplan items, pickup queue refs, register updates |
| Canonical evidence | Link to owner-repo evidence if drill ran elsewhere |

## Drill cadence

| Tier | Minimum cadence | Owner |
| --- | --- | --- |
| T1 irreplaceable source of truth | Quarterly | Bernd |
| T0 identity / trust | Quarterly (cold decrypt included) | Bernd |
| T2 runtime platforms | Semi-annual | Bernd |

Quarterly Forgejo drill gate: re-run `forgejo-restore-drill.sh` from an
**automated** Nextcloud artifact once daily backups are wired (promotion gate
in `BackupPolicy.md` §7).

## Next untested targets

Completed drills:

- 2026-07-04 — Forgejo manual isolated restore
- 2026-07-07 — Forgejo automated backup decrypt + validate

Next targets:

1. **Forgejo from Nextcloud only** — promotion gate (`BackupPolicy.md` §7)
2. **S2 k3s runtime** — decrypt `railiance-backup-s2` on railiance01
3. **Dev workstation cold restore** — password-manager key only
4. **Gitea dump** — before next migration wave
5. **Secret vault cold decrypt** — SOPS/age recovery material (R5)