# Test Evidence

Dated restore-drill reports proving RTO/RPO targets in `RTO-RPO-Matrix.md` are
actually met — not just documented.

## Naming convention

```text
TestEvidence/restore-drill-YYYY-MM-DD-<system>.md
```

Examples: `restore-drill-2026-07-04-forgejo.md`

## Required fields

Every evidence file must include:

| Field | Description |
| --- | --- |
| Date | Drill execution date (UTC) |
| System | What was restored (register ID or system name) |
| Backup artifact | Filename, size, timestamp, source (manual/automated) |
| Target environment | Isolated namespace, staging host, clean VM, etc. |
| Operator | Who ran the drill |
| Result | `success` / `partial` / `failed` |
| RPO achieved | Actual recovery point (how stale was the backup?) |
| RTO achieved | Wall-clock time from start to validated service |
| Checks performed | API calls, smoke tests, representative workflow |
| Issues found | Anything that blocked or degraded restore |
| Follow-up actions | Workplan items, pickup queue refs, register updates |
| Canonical evidence | Link to owner-repo evidence if drill ran elsewhere |

## Drill cadence

| Tier | Minimum cadence | Owner |
| --- | --- | --- |
| T1 irreplaceable source of truth | Quarterly | Bernd |
| T0 identity / trust | Quarterly (cold decrypt included) | Bernd |
| T2 runtime platforms | Semi-annual | Bernd |

Quarterly Forgejo drill gate: re-run `forgejo-restore-drill.sh` from an
**automated** Nextcloud artifact once daily backups are wired (promotion gate
in `BackupPolicy.md` §7).

## Next untested targets

Priority order after Forgejo manual drill (2026-07-04):

1. **S2 k8s runtime** — decrypt `railiance-backup-s2` artifact on clean target;
   validate Helm values redeploy
2. **Dev workstation cold restore** — decrypt Nextcloud artifact without using
   production key on same machine (password-manager key only)
3. **Gitea dump** — manual `gitea dump` restore to staging before next migration wave
4. **Secret vault cold decrypt** — SOPS/age recovery material (R5 mitigation)