Expose sanitized backup restore evidence

src/govoplan_ops/backend/manifest.py

@@ -1,8 +1,25 @@
 from __future__ import annotations
 
-from govoplan_core.core.access import CAPABILITY_AUTH_PERMISSION_EVALUATOR, CAPABILITY_AUTH_PRINCIPAL_RESOLVER
-from govoplan_core.core.modules import DocumentationCondition, DocumentationTopic, FrontendModule, FrontendRoute, ModuleContext, ModuleManifest, NavItem, PermissionDefinition, RoleTemplate
-from govoplan_core.core.provider_governance import ModuleArchitectureDeclaration, ModuleArchitectureDocumentation, ModuleMaturityEvidence
+from govoplan_core.core.access import (
+    CAPABILITY_AUTH_PERMISSION_EVALUATOR,
+    CAPABILITY_AUTH_PRINCIPAL_RESOLVER,
+)
+from govoplan_core.core.modules import (
+    DocumentationCondition,
+    DocumentationTopic,
+    FrontendModule,
+    FrontendRoute,
+    ModuleContext,
+    ModuleManifest,
+    NavItem,
+    PermissionDefinition,
+    RoleTemplate,
+)
+from govoplan_core.core.provider_governance import (
+    ModuleArchitectureDeclaration,
+    ModuleArchitectureDocumentation,
+    ModuleMaturityEvidence,
+)
 from govoplan_core.core.views import ViewSurface
 
 OPS_READ_SCOPE = "ops:operations:read"
@@ -25,6 +42,11 @@ ARCHITECTURE = ModuleArchitectureDeclaration(
             reference="docs/SCALABILITY_PROFILES.md",
             summary="Documents operational topology and scaling posture.",
         ),
+        ModuleMaturityEvidence(
+            kind="documentation",
+            reference="docs/BACKUP_EVIDENCE_STATUS.md",
+            summary="Documents the sanitized signed backup and restore status projection.",
+        ),
     ),
     known_limits=(
         "Provider health observations depend on module-owned operational probes and may be unavailable until configured.",
@@ -32,8 +54,14 @@ ARCHITECTURE = ModuleArchitectureDeclaration(
     owned_concepts=("operations status projection", "bounded operational probes"),
     non_owned_concepts=("domain repair", "external provider credentials"),
     documentation=ModuleArchitectureDocumentation(
-        recovery=("docs/SCALABILITY_PROFILES.md",),
-        operations=("docs/SCALABILITY_PROFILES.md",),
+        recovery=(
+            "docs/SCALABILITY_PROFILES.md",
+            "docs/BACKUP_EVIDENCE_STATUS.md",
+        ),
+        operations=(
+            "docs/SCALABILITY_PROFILES.md",
+            "docs/BACKUP_EVIDENCE_STATUS.md",
+        ),
     ),
 )
 
@@ -63,7 +91,10 @@ manifest = ModuleManifest(
     id="ops",
     name="Ops",
     version="0.1.8",
-    required_capabilities=(CAPABILITY_AUTH_PRINCIPAL_RESOLVER, CAPABILITY_AUTH_PERMISSION_EVALUATOR),
+    required_capabilities=(
+        CAPABILITY_AUTH_PRINCIPAL_RESOLVER,
+        CAPABILITY_AUTH_PERMISSION_EVALUATOR,
+    ),
     optional_dependencies=("audit", "docs", "notifications"),
     permissions=(
         _permission(
@@ -108,7 +139,7 @@ manifest = ModuleManifest(
             id="ops.runtime-coordination-and-recovery",
             title="Drain runtime nodes and inspect recovery evidence",
             summary="Ops projects shared runtime heartbeats, replica gaps, drain controls, and recovery states that require operator attention.",
-            body="Use the runtime table to identify stale or composition-skewed API and worker replicas. Drain before replacement so API readiness closes and workers stop taking new queue work; cancellation is available while the node is still draining. The recovery table reports durable Core recovery operations, but a recorded forward-recovery or manual-intervention state is not an automatic database restore.",
+            body="Use the runtime table to identify stale or composition-skewed API and worker replicas. Drain before replacement so API readiness closes and workers stop taking new queue work; cancellation is available while the node is still draining. The recovery table reports durable Core recovery operations. Backup status separately projects only the sanitized deployment verification receipt: a verified status identifies a coordinated recovery point and isolated restore drill, while absent, expired, or invalid evidence blocks a release-changing migration.",
             documentation_types=("admin", "user"),
             audience=("operator", "system_admin"),
             conditions=(
@@ -126,24 +157,55 @@ manifest = ModuleManifest(
                     "Compare active non-stale nodes with the configured API and worker replica expectations.",
                     "Request drain and wait for the node to report draining before replacing it.",
                     "Inspect every recovery-required, outcome-unknown, or manual-intervention operation and follow its recorded recovery mode.",
+                    "Confirm that backup evidence is verified and current before authorizing a release-changing migration.",
                     "Verify replacement composition, readiness, queue consumers, and recovery evidence before closing the operation.",
                 ],
                 "limitations": [
                     "Drain is observed on the runtime heartbeat interval and does not forcibly terminate active work.",
-                    "Ops does not create database backups or make an unsafe post-migration rollback reversible.",
+                    "Ops does not create or restore backups and never receives private artifact or key-custody references.",
+                    "A verified receipt proves the recorded drill; it does not make an unsafe post-migration code rollback reversible.",
                 ],
             },
         ),
     ),
     route_factory=_route_factory,
-    nav_items=(NavItem(path="/ops", label="Ops", icon="activity", required_any=OPS_READ_SCOPES, order=890),),
+    nav_items=(
+        NavItem(
+            path="/ops",
+            label="Ops",
+            icon="activity",
+            required_any=OPS_READ_SCOPES,
+            order=890,
+        ),
+    ),
     frontend=FrontendModule(
         module_id="ops",
         package_name="@govoplan/ops-webui",
-        routes=(FrontendRoute(path="/ops", component="OpsPage", required_any=OPS_READ_SCOPES, order=890),),
-        nav_items=(NavItem(path="/ops", label="Ops", icon="activity", required_any=OPS_READ_SCOPES, order=890),),
+        routes=(
+            FrontendRoute(
+                path="/ops",
+                component="OpsPage",
+                required_any=OPS_READ_SCOPES,
+                order=890,
+            ),
+        ),
+        nav_items=(
+            NavItem(
+                path="/ops",
+                label="Ops",
+                icon="activity",
+                required_any=OPS_READ_SCOPES,
+                order=890,
+            ),
+        ),
         view_surfaces=(
-            ViewSurface(id="ops.widget.health", module_id="ops", kind="section", label="Operations health widget", order=100),
+            ViewSurface(
+                id="ops.widget.health",
+                module_id="ops",
+                kind="section",
+                label="Operations health widget",
+                order=100,
+            ),
         ),
     ),
     architecture=ARCHITECTURE,