Evidence level: historically reviewed source and owner proposals; not freshly tested or certified for production.
Design and implementation invariants
- Backup/restore readiness requires authenticated, independently trusted readback and restore evidence; ordinary process health does not prove durability.
- Replay-fencing and receipt uniqueness must be durable, scoped to the appropriate authority, and fail closed on forged, stale or conflicting evidence.
- Recovery assessments must not trust caller-supplied public keys or ambient database credentials; the legacy monolithic storage HTTP router is not this service’s responsibility.
Verification still required
- Prove off-host durable recovery with independent trust roots and operator authority before declaring disaster-recovery readiness.
- Validate cryptographic evidence chains and privileged YSQL boundaries against authorized non-production fixtures; historical isolated tests are not live acceptance.
How to update
When the owner changes implementation or contract behavior, update this page and the relevant service interfaces. For cross-service changes, also update the platform interface map or decision register. State the actual verification performed; do not inherit historical pass claims without fresh evidence.