{
  "format": "vercy-enterprise-allocation-fixtures/v1",
  "candidateName": "Backup / Data Protection Policy",
  "cases": [
    {
      "id": "pinned-policy-restore",
      "kind": "positive",
      "input": "A database restore pins policy version 4, recovery point digest, isolated target, tools and fixtures.",
      "expect": "The verification is reproducible and remains distinct from the policy and backup job."
    },
    {
      "id": "blocked-service-chain",
      "kind": "positive",
      "input": "Database and identity restore, but an external signer is unavailable.",
      "expect": "Database D is verified at object scope; the chain is blocked-by-dependency; RTO objective verdict is breached; closure is refused."
    },
    {
      "id": "rpo-breach",
      "kind": "positive",
      "input": "The usable recovery point is 12 hours old against a one-hour RPO.",
      "expect": "The RPO is breached even if object-level restoration succeeds."
    },
    {
      "id": "green-job-proves-recovery",
      "kind": "negative",
      "input": "Thirty green backup jobs are used to assert service recovery and RTO attainment.",
      "expect": "The inference is rejected."
    },
    {
      "id": "file-restore-equals-rto",
      "kind": "negative",
      "input": "RTO stops when files are restored before minimum service is accepted.",
      "expect": "The measurement is rejected."
    },
    {
      "id": "test-equals-production",
      "kind": "negative",
      "input": "A synthetic exercise is treated as proof of real-event capability.",
      "expect": "The claim is rejected without declared representativeness and limits."
    },
    {
      "id": "policy-owns-execution",
      "kind": "negative",
      "input": "The policy record is mutated for every backup job execution.",
      "expect": "The ownership and identity merge is rejected."
    },
    {
      "id": "outcome-vocabulary-mapping",
      "kind": "negative",
      "input": "Recovery evidence records outcome values pass and partial.",
      "expect": "Rejected; only the six normative terms are accepted and pass/partial must be mapped to verified and verified-with-limitations at ingest."
    },
    {
      "id": "chain-recovered-undefined",
      "kind": "negative",
      "input": "A chain claim uses the token chain-recovered.",
      "expect": "Rejected; the token is undefined and must be expressed in the normative outcome enumeration at chain scope."
    },
    {
      "id": "objective-verdict-vs-outcome",
      "kind": "positive",
      "input": "An object restore is verified at object scope while the pinned one-hour RPO is breached.",
      "expect": "Observation outcome verified (object scope) and objective verdict breached are recorded as separate fields; neither overrides the other."
    },
    {
      "id": "incomparable-rto-mtpd",
      "kind": "negative",
      "input": "An RTO at degraded level minimum-service is compared against an MTPD from a different scope qualifier and BIA release.",
      "expect": "Comparison rejected as incomparable; verdict not-evaluable, neither violation nor compliance."
    },
    {
      "id": "missing-tolerable-data-loss",
      "kind": "negative",
      "input": "RPO is checked against a BIA release that declares no maximum tolerable data loss.",
      "expect": "Rejected; verdict not-evaluable until the BIA release carries the value."
    },
    {
      "id": "schedule-interval-as-rpo-evidence",
      "kind": "negative",
      "input": "A fifteen-minute policy schedule interval is asserted as RPO attainment.",
      "expect": "Rejected; the schedule interval is a feasibility input only."
    },
    {
      "id": "undeclared-isolation-crossing",
      "kind": "negative",
      "input": "A restore test uses the production identity provider and production key custody without declaring the crossing.",
      "expect": "Result voided to indeterminate-insufficient-observation."
    },
    {
      "id": "declared-bootstrap-assumption",
      "kind": "positive",
      "input": "Identity, DNS and key material are pre-provisioned in the isolated target and declared as unexercised assumptions.",
      "expect": "Outcome capped at verified-with-limitations, those bootstrap dependencies marked not-attempted, no RTO attainment claim."
    },
    {
      "id": "non-representative-fixture-rto",
      "kind": "negative",
      "input": "RTO attainment is asserted from a one-percent-scale fixture.",
      "expect": "Rejected; capped at verified-with-limitations with declared scale ratio and divergence list."
    },
    {
      "id": "missing-time-base",
      "kind": "negative",
      "input": "A recovery point is described as twelve hours old with no disruption reference time, acceptance time or time source.",
      "expect": "RPO and RTO verdicts are not-evaluable."
    },
    {
      "id": "expired-evidence-window",
      "kind": "negative",
      "input": "A restore verification from fourteen months earlier is cited as current readiness outside its declared validity window.",
      "expect": "Rejected; readiness is indeterminate-insufficient-observation."
    },
    {
      "id": "incomplete-traceability-pins",
      "kind": "negative",
      "input": "A published recovery claim omits the recovery-order version and the policy version pin.",
      "expect": "Rejected; outcome indeterminate-insufficient-observation."
    },
    {
      "id": "stale-recovery-order-pin",
      "kind": "positive",
      "input": "An exercise pins recovery-order version 3 while the current ContinuityPlan release carries version 5.",
      "expect": "The result remains valid only against version 3 and cannot support readiness for the current plan release."
    },
    {
      "id": "conflicting-provider-records",
      "kind": "negative",
      "input": "A provider waiver asserts availability while a timeout record shows unavailability for the same required dependency and window.",
      "expect": "Verified is forbidden; blocked-by-dependency if the dependency is required, otherwise indeterminate-insufficient-observation."
    },
    {
      "id": "policy-owns-verification-criteria",
      "kind": "negative",
      "input": "A policy version redefines executable restore acceptance criteria.",
      "expect": "Rejected; the policy states cadence and minimum requirements only and criteria remain with the Restore Verification specification."
    },
    {
      "id": "restore-verification-profiles-policy",
      "kind": "negative",
      "input": "Restore Verification is declared a profile of Backup / Data Protection Policy.",
      "expect": "Rejected; it is a WM-ACT-043-owned specification that references the policy version."
    },
    {
      "id": "overlapping-effective-policy-versions",
      "kind": "negative",
      "input": "Two policy versions are effective for the same protected scope over the same interval.",
      "expect": "Rejected."
    },
    {
      "id": "policy-effective-without-effective-version",
      "kind": "negative",
      "input": "The policy aggregate is marked effective while no policy version is effective.",
      "expect": "Rejected; aggregate effectiveness is derived from versions."
    },
    {
      "id": "unapproved-reference-pin",
      "kind": "negative",
      "input": "The candidate publishes references to WM-XCT-037 and WM-SFT-016 with no recorded approval state.",
      "expect": "Rejected until every reference carries an explicit approved or unverified status."
    }
  ]
}