resource-control/docs/evidence/RESOURCE-canon-restatement-2026-08-15.md

# Backup case restated in ITC-CAP terms — 2026-08-15

## Result

info-tech-canon accepted `demand/CapabilityProvisionEconomics.md` in full and
shipped canon 0.3.0 / ITC-CAP 0.2.0. They asked resource-control to restate the
backup case against the new shape, and said they would treat that restatement as
the real-provision proof for their §10 promotion requirement 3 rather than
inventing a worked example.

Delivered:

- `data/capability/platform-audit-storage.json` — the restatement
- `tools/capability.py`, `make capability` — validation against the live catalog
- `tools/basis.py`, `docs/evidence-basis.md` — the evidence-basis vocabulary
- 44 tests across `tests/test_capability.py` and `tests/test_basis.py`

`tools/capability.py` reads
`info-tech-canon/infospace/models/capability/capabilities.yaml` directly rather
than copying it. Every capability id, profile, quality dimension, maturity level,
resource class, native unit, and constraint predicate we use is checked against
what the canon actually declares, so drift in either repository fails here.

## What the restatement says

**The requirement is now expressible.** The constraint that decided the
procurement — the backup must not sit in the failure domain of the host it
protects — was prose in an acceptance-requirements section. It is now:

```yaml
constraints:
  - dimension: geographical_separation
    predicate: not_in
    of: [{kind: host, id: railiance01}, {kind: provider, id: host-europe}]
```

**Two provisions, not one.** `resource:platform:audit-storage` provides
`data.object`; the CNPG/Barman configuration provides `data.backup` and depends
on it. This is the layering our resource records already had and could not name.

**The requirement is not met, and the record says so.** The requirement asks for
`data.backup` at D5. The provision is D4. Thresholds are declared, but the
evidence behind them is one backup, one full restore, one PITR, and about four
hours of operation; `wal_archive_gap_minutes` is declared and not yet emitted.
Reliability is claimed, not substantiated. The review reports
`status: below_requirement` rather than inflating the maturity to match.

**All four `data.backup` evidence hooks are satisfied** —
`successful_backup`, `successful_restore_test`, `measured_rpo`, `measured_rto` —
each `measured`, each pointing at the T05 evidence file. The `data.object`
provision is honestly incomplete: it satisfies neither `object_integrity_tests`
nor `availability_metrics`.

**Consumption is in native units.** Storage in GB, human effort in hours, tokens
for intelligence, and `P` for the purchased service — with unknown recorded as
unknown and never as zero. Two rows the old model could not have carried:

- `H` on the `data.backup` provision is `unknown`, because real operator time
  was spent on procurement, credential custody, and two restore drills and no
  time record was kept. A time record starts in 2026-09.
- `I` is `unknown` on both provisions. We do not meter tokens against a
  provision yet.

## The evidence-basis addition

Beyond what the canon asked for, every value in the restatement declares how it
was obtained, on an ordered scale from `invoiced` through `measured`, `quoted`,
`derived`, `projected`, `estimated`, `assumed`, to `unknown`. A derived value
resolves to the weakest basis among its inputs.

The rule earns its place immediately. The provider comparison that produced the
decision — Scaleway over Hetzner by €29.14/month, stated to the cent — grades:

| | |
|---|---|
| by basis | `quoted` 1, `projected` 1, `assumed` 2 |
| weakest | `assumed` |
| evidenced ratio | 0.25 |
| **grade** | **`indicative`** |

One of four load-bearing values is evidenced. The two labour figures — the ones
that actually inverted the ranking — are `derived` from an `assumed` hour count
and an `assumed` rate, so they resolve to `assumed`.

This does not overturn the decision. The direction is robust under any plausible
rate, and the remaining alternative was five times dearer. It does say that the
*magnitude* is a model output rather than a measurement, and it identifies the
cheapest way to strengthen it: record real operator hours, not better arithmetic.

Note that this is a finding about our own most consequential decision, produced
by a mechanism that did not exist yesterday. It is the intended effect.

## Boundary held

No canon artifact was copied into this repository, and nothing was written into
info-tech-canon for this restatement. The capability catalog stays theirs; the
provisioned facts stay ours; the join is by capability id, which is exactly the
durable interface CAP-R5 describes and the reason the canon was not split.