disaster-control/TestEvidence/README.md

Test Evidence

Dated restore-drill reports proving RTO/RPO targets in RTO-RPO-Matrix.md are actually met — not just documented.

Naming convention

TestEvidence/restore-drill-YYYY-MM-DD-<system>.md

Examples: restore-drill-2026-07-04-forgejo.md

Required fields

Every evidence file must include:

Field	Description
Date	Drill execution date (UTC)
System	What was restored (register ID or system name)
Backup artifact	Filename, size, timestamp, source (manual/automated)
Target environment	Isolated namespace, staging host, clean VM, etc.
Operator	Who ran the drill
Result	success / partial / failed
RPO achieved	Actual recovery point (how stale was the backup?)
RTO achieved	Wall-clock time from start to validated service
Checks performed	API calls, smoke tests, representative workflow
Issues found	Anything that blocked or degraded restore
Follow-up actions	Workplan items, pickup queue refs, register updates
Canonical evidence	Link to owner-repo evidence if drill ran elsewhere

Drill cadence

Tier	Minimum cadence	Owner
T1 irreplaceable source of truth	Quarterly	Bernd
T0 identity / trust	Quarterly (cold decrypt included)	Bernd
T2 runtime platforms	Semi-annual	Bernd

Quarterly Forgejo drill gate: re-run forgejo-restore-drill.sh from an automated Nextcloud artifact once daily backups are wired (promotion gate in BackupPolicy.md §7).

Next untested targets

Priority order after Forgejo manual drill (2026-07-04):

1. S2 k8s runtime — decrypt railiance-backup-s2 artifact on clean target; validate Helm values redeploy
2. Dev workstation cold restore — decrypt Nextcloud artifact without using production key on same machine (password-manager key only)
3. Gitea dump — manual gitea dump restore to staging before next migration wave
4. Secret vault cold decrypt — SOPS/age recovery material (R5 mitigation)