Verify backup copy and restore

Epic 5329 ask (verbatim): "Analyze current code, processes and documentation and close the gap to being SOC 2 compliant. Humans can participate but only where it cannot be avoided legally. Ask questions, but do not offload any work that you are technically able to do." Sources: PRD (Task 5330) and architecture (Task 5331) of epic 5329 — read them with `task_read` / `task_read_artifact`. Binding decision AS1 (verbatim): "agents may run prod terraform, scripts and tests, but only code that has reached `master` through Roman's promotion, plus read-only and test actions that need no code change (a restore into an isolated target, a page test, an export)." Prod access: `jaah/system/bootstrap-admin` → `OrganizationAccountAccessRole` in 366008913850 (and the backup account), explicit `--region`, env vars per command only; confirm with `task_credential_list` first (missing = BLOCKER ask). Evidence filing: `tools/evidence_store.py` CLI with `EVIDENCE_BUCKET=jaah-main-evidence-366008913850`; Object Lock — permanent; dry-run first. Any new risk: name its row text in your settle summary for the close-out child. ## Requirement (verbatim from PRD) "### R5 — Backup, cross-account copy and restore (A1.2, A1.3, CC9.1, CC7.5; G-23, OA-5, OA-8, OA-12) - **AC5.1** The live backup rule matches code: `DeleteAfterDays` = 36, and the copy goes to the DR region. *Verify:* `aws backup get-backup-plan` on `jaah-main-backup-daily`. - **AC5.2** A backup account exists in the org. `backup_account_id` is wired, and a cross-account copy job has completed. *Verify:* `aws organizations list-accounts` lists it; `aws backup list-copy-jobs` shows a `COMPLETED` job into that account. - **AC5.3** The vault lock is in **governance** mode, until Roman's SOC 2-window call. *Verify:* `describe-backup-vault` shows `Locked` true or a lock configuration present. - **AC5.4** A prod restore has been run with `tools/dr_restore.py --env main` into an isolated target and checked. Its result, with RTO/RPO observed against the BC/DR policy numbers, is filed to `restore-test/`. *Verify:* `aws backup list-restore-jobs` shows at least one `COMPLETED` job, and the `restore-test/` object exists." ## Scope and approach (from the settled architecture) Architecture B3 — master code only. - `aws backup get-backup-plan` on `jaah-main-backup-daily` shows DeleteAfterDays 36 and the DR-region copy. - Start an on-demand backup (or wait for the nightly one) until `list-copy-jobs` shows hop 2 `COMPLETED` into the backup account. - Run `tools/dr_restore.py --env main --expect-account 366008913850`: restore into the isolated scratch network, smoke-check, tear down, file to `restore-test/` with RTO and RPO observed against the BC/DR policy (15 min / 24 h). - If the backup-account child settled without the account (Roman answered it will not come), record AC5.2 and the backup-account vault lock as gaps and name them in the settle summary. Out of scope: Epic-wide fences (PRD §6, verbatim): "No agent merges or pushes to `master`. No agent approves its own promotion. No agent applies to prod any change not yet promoted. Delivery is a PR to `develop` (D1)." "No contact with any outside party: no emails, Slack messages to externals, vendor portals, NDA click-throughs or RFPs sent; no contracts; no new vendor or subprocessor, which also excludes PagerDuty/Opsgenie and Drata (D3, D7, D8)." "Legacy account 210352747749 is untouched." "Out of scope: Security Hub MEDIUM and LOW findings (D10) — registered only; evidence automation: no new crons, workflows or collectors whose purpose is recurring evidence (D7); Type II, the observation window, the audit, auditor engagement; `compliance_locks` and the vault-lock *compliance* mode." "No change to the console Compliance page, `portfolio/registry.toml` or `portfolio/engine/`" (epic 5303 owns them). "No secret value in any doc, register, evidence object or report." "No weakening of an existing control to make a check pass." This child: Restore only into the isolated scratch target — never over the live DB. Tear down restored resources. No retention or lock-mode change. Done means: - AC5.1 — oracle: `get-backup-plan` output cited showing `DeleteAfterDays: 36` and a copy action to `us-west-2` `jaah-main-backup-dr`. - AC5.2 — oracle: `list-copy-jobs` shows a `COMPLETED` job whose destination vault ARN is in the backup account (cited). - AC5.3 — oracle: `describe-backup-vault` on prod primary + DR vaults and the backup-account vault each show a lock configuration (governance) — cited. - AC5.4 — oracle: `list-restore-jobs` shows a `COMPLETED` job; the `restore-test/<date>/…` `s3://` URI printed; the record contains observed RTO and RPO with pass/fail vs 15 min / 24 h; scratch resources deleted afterwards (describe call cited).

AC5.1 and prod vault locks verified. AWS refused master's dr_restore; fixed in #4748 (merged, deploy green) and restore proven by scratch probes. Promotion declined. Risks: "AC5.4 re-run pending promotion"; "AC5.2 and backup vault lock gap: no backup account".