backup-tool/docs/release/m11-evidence.md

M11 recovery import evidence

• Recovery bundles use the existing versioned BTREC Argon2id/AES-GCM codec and now carry a version-2 authenticated catalog containing repositories, key epochs, sources, jobs, executions, and backups required for encrypted restore.
• backup-tool admin recovery import requires a migrated empty destination DB, re-inspects every surviving repository through configured allowlists, writes signing/data keys exclusively with mode 0600, and rejects conflicts.
• Imported sources are unavailable; imported jobs are archived and disabled. Imported metadata therefore supports existing restore records without silently restarting backup schedules.
• The focused host-loss drill exports an encrypted backup, imports it into a fresh metadata/key host, and restores the file byte-for-byte. It also proves unsafe repository paths and non-empty destination metadata are rejected.
• Encrypted repository creation is enabled only after that drill passed and now records its active data-key epoch atomically with repository metadata.
• Interrupted imports remove newly installed key files on handled failure; a retry also safely adopts only exact, authenticated key files left by an unclean process loss. Rotation writes an fsynced repository journal before its DB transition; worker startup deterministically completes a committed epoch transition or removes an uncommitted one while retaining old-active. A stale rollback journal is cleared safely even when the unreferenced new key was already deleted before the journal cleanup could run.
• Key-aware GC decrypts encrypted manifests using their declared epoch key and remains fail-closed for absent, wrong, or corrupt keys/manifests. Restore removes setuid, setgid, and sticky bits from captured modes. Migration 0007 refuses downgrade while key metadata is populated.
• Recovery catalog import preserves backup created_at and tombstoned_at.
• Snapshot staging roots, per-execution directories, blob directories, and plaintext temporary blobs are created owner-only (0700/0600) independent of umask and are rejected if their permissions are unsafe.

Verification

pytest tests/integration/test_encrypted_repository.py -q
5 passed

make test-fault
11 passed

make test-security
21 passed

make lint && make typecheck && make frontend-build
passed

make check
86 unit/contract, 53 integration, 12 fault, and 22 security tests passed;
Ruff, mypy, TypeScript, and frontend build passed.

git diff --check && git diff --cached --quiet
passed