{
  "workplan": "RAILIANCE-WP-0015",
  "lane": "option-a",
  "recorded_at": "2026-07-22T16:00:00Z",
  "cluster_api": "CoulombCore databases namespace",
  "rpo_target_hours": 24,
  "rto_target_hours": 4,
  "artifacts": {
    "secret": "databases/cnpg-backup-offsite",
    "secret_keys": ["NC_WEBDAV_TOKEN", "NC_WEBDAV_URL", "AGE_PUBLIC_KEY"],
    "cronjobs": [
      "cnpg-logical-backup-apps-pg",
      "cnpg-logical-backup-gitea-db",
      "cnpg-logical-backup-net-kingdom-pg",
      "cnpg-logical-backup-state-hub-db"
    ],
    "status_configmap": "databases/cnpg-option-a-status",
    "last_success": {
      "apps-pg": "20260722T155755Z",
      "gitea-db": "20260722T155755Z",
      "net-kingdom-pg": "20260722T155755Z",
      "state-hub-db": "20260722T155732Z"
    }
  },
  "uploads": [
    "apps-pg/apps-pg-apps_meta-20260722T155755Z.dump.age",
    "apps-pg/apps-pg-core_hub-20260722T155755Z.dump.age",
    "apps-pg/apps-pg-core_hub_staging-20260722T155755Z.dump.age",
    "apps-pg/apps-pg-vergabe_db-20260722T155755Z.dump.age",
    "gitea-db/gitea-db-gitea-20260722T155755Z.dump.age",
    "net-kingdom-pg/net-kingdom-pg-interhub-20260722T155755Z.dump.age",
    "net-kingdom-pg/net-kingdom-pg-privacyidea_db-20260722T155755Z.dump.age",
    "state-hub-db/state-hub-db-state_hub-20260722T155732Z.dump.age"
  ],
  "status_command": "make cnpg-backup-status",
  "status_result": "ok — all tracked clusters have healthy Option A (or barman) backup coverage",
  "restore_drill": {
    "cluster": "apps-pg",
    "database": "vergabe_db",
    "source_artifact": "apps-pg-vergabe_db-20260722T155755Z.dump.age",
    "evidence": "docs/evidence/apps-pg-restore-drill-20260722T155951Z.json",
    "row_gate": "195/195 pass",
    "rto_note": "decrypt + isolated restore completed under 5 minutes on operator workstation"
  },
  "notes": [
    "First success wave seeded via workstation tools/cnpg-logical-backup.sh.",
    "In-cluster CronJobs are suspended: cluster egress blocks github.com and Alpine CDN age installs.",
    "Unattended path is workstation cron at 02:30 UTC (ConfigMap cnpg-option-a-schedule mode=workstation-cron).",
    "AGE_PRIVATE_KEY remains OpenBao recovery escrow only — not stored in-cluster.",
    "No secret values recorded in this evidence file."
  ]
}