backup-tool/docs/release/m14-evidence.md

M14 operations and packaging evidence

Delivered

• Pinned non-root OCI application and proxy images; isolated web, scheduler, worker, migrate, and admin roles; same-origin Unix-socket proxy; no reload or embedded roles. The proxy port is loopback-bound by default (127.0.0.1), so the localhost public URL cannot permit remote first-admin setup takeover. Operators exposing it through an external reverse proxy must set a non-loopback public URL and bootstrap secret.
• Role-aware readiness, JSON structured logs, safe worker claim shutdown, and dependency-free Prometheus metrics for request volume/duration, active/stale/failed execution state, schedule lag, corrupt/unavailable repositories, and free space.
• SBOM generation at tools/generate_sbom.py, generated CycloneDX artifact m14-sbom.json, and base-image/source provenance in m14-provenance.md.
• Metadata, repository, key, upgrade, disaster-recovery, and observability runbooks.

Green verification

 docker compose config --quiet                         # passed (loopback port binding)
 docker compose build --pull                           # passed
 make test-e2e                                         # 1 passed in 51.69s (loopback regression)
 make check                                            # passed after loopback regression
   91 unit/contract, 61 integration, 15 fault, 33 security
   Ruff/format, mypy (40 files), TypeScript, frontend build all passed
 python tools/generate_sbom.py                         # 256 components

test_compose_v2.py creates its source and host-bind key fixture in pytest temporary directories. The actual service-owned master key is generated only in an ephemeral Compose named volume, then down --volumes --remove-orphans removes it. No fixture secret or source directory is committed. The test runs migration, starts the stack, checks readiness and metrics, stops/restarts the worker cleanly, restarts runtime roles, verifies setup metadata persists, and tears down the project.