Implement governed S1 backup recovery loop

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018

ansible/roles/s1_backup/tasks/main.yml

@@ -0,0 +1,81 @@
+---
+- name: Install S1 backup runtime packages
+  ansible.builtin.package:
+    name:
+      - age
+      - python3
+      - python3-yaml
+    state: present
+
+- name: Create bounded S1 backup directories
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "{{ item.mode }}"
+  loop:
+    - {path: /usr/local/lib/railiance-infra/s1-backup/scripts, mode: "0755"}
+    - {path: /usr/local/lib/railiance-infra/s1-backup/spec, mode: "0755"}
+    - {path: /opt/backup/railiance/infra, mode: "0700"}
+
+- name: Install S1 backup Python implementation
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../../scripts/{{ item }}"
+    dest: "/usr/local/lib/railiance-infra/s1-backup/scripts/{{ item }}"
+    owner: root
+    group: root
+    mode: "0755"
+  loop:
+    - s1_backup.py
+    - s1_backup_contract.py
+    - s1_restore.py
+
+- name: Install S1 backup declaration
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../../spec/s1-backup.yaml"
+    dest: /usr/local/lib/railiance-infra/s1-backup/spec/s1-backup.yaml
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: Install public recipient policy metadata
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../../.sops.yaml"
+    dest: /usr/local/lib/railiance-infra/s1-backup/.sops.yaml
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: Install S1 backup command wrapper
+  ansible.builtin.template:
+    src: railiance-backup-s1.j2
+    dest: /usr/local/sbin/railiance-backup-s1
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Install S1 backup systemd service
+  ansible.builtin.template:
+    src: railiance-backup-s1.service.j2
+    dest: /etc/systemd/system/railiance-backup-s1.service
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Reload systemd for S1 backup
+
+- name: Install S1 backup systemd timer
+  ansible.builtin.template:
+    src: railiance-backup-s1.timer.j2
+    dest: /etc/systemd/system/railiance-backup-s1.timer
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Reload systemd for S1 backup
+
+- name: Enable daily S1 backup timer
+  ansible.builtin.systemd:
+    name: railiance-backup-s1.timer
+    enabled: true
+    state: started
+    daemon_reload: true