{
  "format": "vercy-model-allocation-candidate/v1",
  "contourId": "EM-RSK-04",
  "proposedName": "Backup / Data Protection Policy",
  "modelId": null,
  "registryId": null,
  "allocationState": "unassigned",
  "decision": "NEW MODEL",
  "canonicalPublishable": false,
  "identityTest": {
    "stableIdentity": "A governed protection policy remains identifiable across continuity plans, protected subjects and backup executions while its approved controls evolve through versions.",
    "versionIdentity": "Changes to scope, schedule, copy placement, retention, isolation, encryption, key custody, verification cadence or exception rules create immutable effective-dated versions.",
    "independentLifecycle": [
      "active",
      "suspended",
      "retired"
    ],
    "versionLifecycle": [
      "draft",
      "approved",
      "effective",
      "superseded",
      "withdrawn"
    ],
    "mastership": "data protection or platform resilience policy authority"
  },
  "boundary": {
    "owns": [
      "persistent protection-policy identity",
      "immutable effective-dated policy versions with addressable identity and content digest",
      "protected scope and classification rules",
      "backup schedule and recovery-point requirements",
      "copy count, placement, isolation and immutability controls",
      "retention and disposal rules",
      "encryption and key-custody requirements",
      "restore-verification cadence and minimum verification requirements",
      "exception, approval, supersession and retirement history"
    ],
    "references": [
      {
        "target": "WM-ACT-043",
        "approvalStatus": "unverified-non-canonical",
        "purpose": "Business continuity capability, BIA and plan releases, Restore Verification specification, exercises and recovery evidence"
      },
      {
        "target": "WM-ACT-008",
        "approvalStatus": "unapproved",
        "purpose": "Plan-release boundary where applicable"
      },
      {
        "target": "WM-ACT-042",
        "approvalStatus": "unapproved",
        "purpose": "Recovery or resilience activity boundary under review"
      },
      {
        "target": "WM-XCT-037",
        "approvalStatus": "unverified",
        "purpose": "Dependency-graph mastership and source-graph version pin only"
      },
      {
        "target": "WM-SFT-016",
        "approvalStatus": "unverified",
        "purpose": "Reliability-objective identity; observed outcomes remain separate"
      }
    ],
    "excludes": [
      "backup job execution or recovery-point observation",
      "restore test or production restoration event",
      "business impact analysis or continuity plan identity",
      "service, dataset, system, key or storage identity",
      "RTO, RPO, tolerance or contractual commitment mastership",
      "incident activation, recovery, reconstitution or closure decision"
    ]
  },
  "objects": {
    "BackupDataProtectionPolicy": {
      "identity": [
        "backupDataProtectionPolicyId"
      ],
      "required": [
        "name",
        "ownerRef",
        "status"
      ],
      "optional": [
        "successorRef",
        "retiredAt"
      ],
      "lifecycle": [
        "active",
        "suspended",
        "retired"
      ],
      "effectiveness": "derived exclusively from non-overlapping effective PolicyVersion records"
    },
    "PolicyVersion": {
      "identity": [
        "backupDataProtectionPolicyId",
        "version"
      ],
      "required": [
        "protectionScope",
        "scheduleRules",
        "retentionRules",
        "verificationCadence",
        "validFrom",
        "contentDigest",
        "status",
        "approvedBy",
        "approvedAt"
      ],
      "optional": [
        "copyPlacementRules",
        "isolationRules",
        "immutabilityRules",
        "encryptionRequirements",
        "keyCustodyRequirements",
        "exceptionRules",
        "validTo",
        "supersedesVersion"
      ],
      "lifecycle": [
        "draft",
        "approved",
        "effective",
        "superseded",
        "withdrawn"
      ],
      "overlapRule": "No two versions may be effective for the same protected scope over an overlapping interval."
    }
  },
  "invariants": [
    "Policy, platform backup observation, WM-ACT-043 Restore Verification specification, RestoreTest occurrence and RecoveryEvidence retain separate identities and owners.",
    "Policy versions expose immutable addressable version identity and content digest; pinning obligations belong to WM-ACT-043 verification and platform observations.",
    "Backup Policy owns cadence and minimum verification requirements only; executable criteria belong to the Restore Verification specification that cites the policy version.",
    "A green backup job proves only its declared write-time checks and never proves restorability, dependency order, RTO, RPO, minimum service or production-scale behavior.",
    "Observation outcome and objective verdict use separate normative vocabularies and neither substitutes for the other.",
    "RTO-to-MTPD and RPO-to-maximum-tolerable-data-loss comparisons require the same subject, scope qualifier, degraded level and pinned BIA release; otherwise the verdict is not-evaluable.",
    "A BIA release binds maximum tolerable disruption and maximum tolerable data loss; absence of the latter makes an RPO comparison not-evaluable.",
    "Recovery order is derived and owned by a ContinuityPlan release; WM-XCT-037 supplies only the dependency graph and source-graph version.",
    "Every exercise and activation pins both recovery-order version and source-graph version.",
    "An isolation boundary enumerates all crossings; declared crossings or pre-provisioned bootstrap dependencies cap the outcome at verified-with-limitations and mark them not-attempted, while an undeclared crossing yields indeterminate-insufficient-observation.",
    "A non-representative fixture caps outcome at verified-with-limitations, cannot assert RTO attainment and records a scale ratio and divergence list.",
    "Restore verification and evidence record disruption reference time, recovery-point time, acceptance time, time source and evidence validity window; missing values make the objective verdict not-evaluable.",
    "A published recovery claim pins BIA release, objective identity and version, plan release, recovery-order version, policy version, event identity, evidence scope and evidence time; any missing pin yields indeterminate-insufficient-observation.",
    "Contradictory availability records for the same dependency and window can never yield verified; required dependencies yield blocked-by-dependency and optional dependencies yield indeterminate-insufficient-observation.",
    "Policy versions are immutable, require approval authority and time, and cannot overlap for the same protected scope; aggregate effectiveness is derived from versions.",
    "Production restoration is an activation and never reclassified as a test."
  ],
  "holds": [
    "Registry namespace and identifier allocation are pending and no identifier may be guessed.",
    "WM-ACT-043 is non-canonical; WM-ACT-008 and WM-ACT-042 are unapproved; WM-XCT-037 and WM-SFT-016 remain explicitly unverified for this candidate.",
    "Cross-domain reuse of Restore Verification remains deferred; within continuity it is a WM-ACT-043-owned specification, never a profile of Backup Policy.",
    "Package conversion and live verification are pending; this allocation dossier is not canonically publishable."
  ],
  "candidateRevision": 3,
  "status": "provider-reconciled-audited-remediated-allocation-held",
  "normativeVocabularies": {
    "observationOutcome": [
      "verified",
      "verified-with-limitations",
      "failed",
      "blocked-by-dependency",
      "indeterminate-insufficient-observation",
      "not-attempted"
    ],
    "ingestMapping": {
      "pass": "verified",
      "partial": "verified-with-limitations",
      "blocked": "blocked-by-dependency"
    },
    "objectiveVerdict": [
      "attained",
      "breached",
      "not-evaluable"
    ]
  },
  "invariantRules": [
    {
      "id": "RSK04-INVARIANT-001",
      "rule": "Policy, platform backup observation, WM-ACT-043 Restore Verification specification, RestoreTest occurrence and RecoveryEvidence retain separate identities and owners."
    },
    {
      "id": "RSK04-INVARIANT-002",
      "rule": "Policy versions expose immutable addressable version identity and content digest; pinning obligations belong to WM-ACT-043 verification and platform observations."
    },
    {
      "id": "RSK04-INVARIANT-003",
      "rule": "Backup Policy owns cadence and minimum verification requirements only; executable criteria belong to the Restore Verification specification that cites the policy version."
    },
    {
      "id": "RSK04-INVARIANT-004",
      "rule": "A green backup job proves only its declared write-time checks and never proves restorability, dependency order, RTO, RPO, minimum service or production-scale behavior."
    },
    {
      "id": "RSK04-INVARIANT-005",
      "rule": "Observation outcome and objective verdict use separate normative vocabularies and neither substitutes for the other."
    },
    {
      "id": "RSK04-INVARIANT-006",
      "rule": "RTO-to-MTPD and RPO-to-maximum-tolerable-data-loss comparisons require the same subject, scope qualifier, degraded level and pinned BIA release; otherwise the verdict is not-evaluable."
    },
    {
      "id": "RSK04-INVARIANT-007",
      "rule": "A BIA release binds maximum tolerable disruption and maximum tolerable data loss; absence of the latter makes an RPO comparison not-evaluable."
    },
    {
      "id": "RSK04-INVARIANT-008",
      "rule": "Recovery order is derived and owned by a ContinuityPlan release; WM-XCT-037 supplies only the dependency graph and source-graph version."
    },
    {
      "id": "RSK04-INVARIANT-009",
      "rule": "Every exercise and activation pins both recovery-order version and source-graph version."
    },
    {
      "id": "RSK04-INVARIANT-010",
      "rule": "An isolation boundary enumerates all crossings; declared crossings or pre-provisioned bootstrap dependencies cap the outcome at verified-with-limitations and mark them not-attempted, while an undeclared crossing yields indeterminate-insufficient-observation."
    },
    {
      "id": "RSK04-INVARIANT-011",
      "rule": "A non-representative fixture caps outcome at verified-with-limitations, cannot assert RTO attainment and records a scale ratio and divergence list."
    },
    {
      "id": "RSK04-INVARIANT-012",
      "rule": "Restore verification and evidence record disruption reference time, recovery-point time, acceptance time, time source and evidence validity window; missing values make the objective verdict not-evaluable."
    },
    {
      "id": "RSK04-INVARIANT-013",
      "rule": "A published recovery claim pins BIA release, objective identity and version, plan release, recovery-order version, policy version, event identity, evidence scope and evidence time; any missing pin yields indeterminate-insufficient-observation."
    },
    {
      "id": "RSK04-INVARIANT-014",
      "rule": "Contradictory availability records for the same dependency and window can never yield verified; required dependencies yield blocked-by-dependency and optional dependencies yield indeterminate-insufficient-observation."
    },
    {
      "id": "RSK04-INVARIANT-015",
      "rule": "Policy versions are immutable, require approval authority and time, and cannot overlap for the same protected scope; aggregate effectiveness is derived from versions."
    },
    {
      "id": "RSK04-INVARIANT-016",
      "rule": "Production restoration is an activation and never reclassified as a test."
    }
  ]
}