{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-24T22:44:15.019Z",
  "record_id": "VXI-EXT-PROCUREMENT-RESTIC-APPEND-ONLY-RETENTION-MANIPULATION-01-v1",
  "record_kind": "external_reference",
  "title": "restic append-only retention decisions",
  "system": "restic v0.19.1",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does an append-only restic repository prevent a compromised writer from influencing later retention?",
  "near_questions": [
    "Can a compromised restic writer influence a later forget policy?",
    "Why does append-only restic still need retention review?",
    "What limits keep-within protection for restic snapshots?",
    "Should a restic maintenance account trust every new snapshot timestamp?"
  ],
  "supported_claims": [
    {
      "claim": "The v0.19.1 guide warns that an append-only writer can add misleading snapshots whose timestamps displace legitimate snapshots under some count or calendar retention policies when an administrator later runs forget. It recommends separate secured maintenance access and a keep-within policy, while documenting that protection still depends on the retention window and correct time. Append-only access alone does not validate the snapshots chosen for retention.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "No compromise, attack or buyer repository integrity was independently assessed.",
    "No independently verified physical deletion, complete recovery, legal compliance or security assurance.",
    "Buyer deployment testing, live runtime enforcement, certification or permission to act",
    "Expanded capabilities or licences for existing INDEX executables"
  ],
  "public_summary": "The v0.19.1 guide warns that an append-only writer can add misleading snapshots whose timestamps displace legitimate snapshots under some count or calendar retention policies when an administrator later runs forget. It recommends separate secured maintenance access and a keep-within policy, while documenting that protection still depends on the retention window and correct time. Append-only access alone does not validate the snapshots chosen for retention.",
  "related_record_ids": [],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "restic v0.19.1 — 060_forget",
    "source_url": "https://raw.githubusercontent.com/restic/restic/6aa3a516ce654808a1f28f9fa21e9b7c8e6e90bf/doc/060_forget.rst",
    "checked_on": "2026-10-24",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-RESTIC-APPEND-ONLY-RETENTION-MANIPULATION-01-v1",
    "candidate_record_sha256": "1b3968b97ee2c93c0453f80877481e91c24baa5656e77b88e4be0a322bf199c6",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "The v0.19.1 guide warns that an append-only writer can add misleading snapshots whose timestamps displace legitimate snapshots under some count or calendar retention policies when an administrator later runs forget. It recommends separate secured maintenance access and a keep-within policy, while documenting that protection still depends on the retention window and correct time. Append-only access alone does not validate the snapshots chosen for retention.",
    "required_buyer_context": "Writer and maintenance access separation; Snapshot origins, timestamps and retention selection; Policy window and last known-good recovery evidence. Buyer deployment not inspected.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-24",
    "claim_to_check": "Does an append-only restic repository prevent a compromised writer from influencing later retention?",
    "documented_statement": {
      "status": "documented",
      "statement": "The v0.19.1 guide warns that an append-only writer can add misleading snapshots whose timestamps displace legitimate snapshots under some count or calendar retention policies when an administrator later runs forget. It recommends separate secured maintenance access and a keep-within policy, while documenting that protection still depends on the retention window and correct time. Append-only access alone does not validate the snapshots chosen for retention.",
      "source_ids": [
        "restic-forget"
      ]
    },
    "review_inference": {
      "status": "review_inference",
      "statement": "Review snapshot provenance before privileged maintenance removes recoverable history. The required reconciliation is a review judgment; no buyer deployment was inspected.",
      "source_ids": [
        "restic-forget"
      ]
    },
    "buyer_evidence_required": [
      "Writer and maintenance access separation",
      "Snapshot origins, timestamps and retention selection",
      "Policy window and last known-good recovery evidence"
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Refuse a retention-integrity guarantee from append-only permissions alone."
    },
    "unknowns": "No compromise, attack or buyer repository integrity was independently assessed.",
    "unknown_finding": {
      "status": "unknown",
      "statement": "No compromise, attack or buyer repository integrity was independently assessed."
    },
    "evidence_sources": [
      {
        "source_id": "restic-forget",
        "url": "https://raw.githubusercontent.com/restic/restic/6aa3a516ce654808a1f28f9fa21e9b7c8e6e90bf/doc/060_forget.rst",
        "final_url": "https://raw.githubusercontent.com/restic/restic/6aa3a516ce654808a1f28f9fa21e9b7c8e6e90bf/doc/060_forget.rst",
        "status": 200,
        "captured_at_utc": "2026-10-24T22:28:59.717Z",
        "sha256": "444be0adec93ad92810a4c6b363d8a5a7b77d84c88879e38408b1a7ea2eff614",
        "bytes": 26823,
        "title": "restic v0.19.1 — 060_forget",
        "hash_basis": "Decoded HTTP response body bytes",
        "rights_review": "Original bounded paraphrase; source bodies are captured privately and not redistributed. Repository BSD-2-Clause licence reviewed.",
        "checked_on": "2026-10-24",
        "capture_status": 200,
        "claim_review_completed": true,
        "reviewed_sections": [
          "Removing snapshots and pruning unused data",
          "Retention policy grouping and filters",
          "Time-based retention and future timestamps",
          "Security considerations in append-only mode"
        ],
        "version_context": "Released restic v0.19.1 (2026-07-05); pinned restic/restic revision 6aa3a516ce654808a1f28f9fa21e9b7c8e6e90bf. Source documentation is not independent evidence of buyer deployment behaviour."
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Documentation review only; the buyer must establish applicability and actual outcomes. INDEX does not inspect or control the deployment.",
    "paid_value": {
      "decision_context": "Review snapshot provenance before privileged maintenance removes recoverable history.",
      "free": "Complete review, sources, practical questions and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Recheck the pinned source, deployed version, selection policy and retained operation results before relying on a current outcome."
    },
    "buyer_relevance": "Review snapshot provenance before privileged maintenance removes recoverable history.",
    "refusal_conditions": [
      "Refuse a retention-integrity guarantee from append-only permissions alone."
    ]
  },
  "niche": {
    "niche_id": "enterprise-ai-data-custody-exit-assurance",
    "label": "Enterprise AI Data Custody & Exit Assurance",
    "classification_id": "custody",
    "classification_label": "AI Data Custody, Retention & Exit Assurance",
    "topic_id": "custody",
    "buyer_intent": "Review snapshot provenance before privileged maintenance removes recoverable history.",
    "comparison_role": "supplementary_discovery"
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#restic-append-only-retention-manipulation",
  "machine_readable_record": "/varexis-index/records/restic-append-only-retention-manipulation.json"
}