sjat/boma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

docs(backup): gate BACKUP.md in service checklist (ADR-022)

Browse source
This commit is contained in:
sjat 2026-06-10 11:20:55 +02:00
parent f3f80443d0
commit 81dac4f28b
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
docs/security/service-checklist.md
View file

@ -47,7 +47,10 @@ This checklist is the generic **bar**. Each service answers it in its own
## Operability (security-adjacent)
- [ ] Logs go somewhere reviewable (central aggregation when available)
- [ ] Backup/restore is covered if the service holds state
- [ ] Backup/restore recorded and verifiable (ADR-022): a stateful service carries
`backup__*` data, `roles/<service>/BACKUP.md` is rendered, and `/check-backup`
reports the declared paths/dumps captured in the latest snapshot — or the service
sets `backup__state: false` with a reason. Deviations → `docs/security/accepted-risks.md`.
- [ ] Passed Level 4 service-UI verification (`/verify-service`) against staging — the
service has a populated `roles/<service>/VERIFY.md` and its critical journeys
verified (ADR-008 Level 4 / ADR-017)