Release readiness
Generated by
tools/traceability/trace.py buildfrom the kit matrix,docs/implementation/traceability.yamland the evidence recorded indocs/implementation/evidence/results/. Do not edit by hand.
Latest recorded evidence: 2026-11-01T14:15:21+00:00.
NOT READY: 0 of 269 P0 requirements are PASSED; 57 failing, 45 blocked.
The release is declared ready only once the end to end acceptance is signed by the client with evidence (RELE-016). This document does not replace that signature.
Acceptance scenarios (RELE)
| ID | Requirement (kit wording, French) | Status | What remains or what blocks |
|---|---|---|---|
| RELE-001 | Fresh cluster install automated | BLOCKED | Automated install on a blank acceptance Kubernetes cluster cannot be replayed here [B-CLUSTER]. |
| RELE-002 | BYO Kubernetes Postgres Redis storage | BLOCKED | Real client Kubernetes, PostgreSQL, Redis and storage not available [B-CLUSTER] [B-CLOUD]. |
| RELE-003 | No Internet airgap install | FAILED | airgap / audit: existing / failed evidence E-DO-AIRGAP / Packet egress equivalent: install inside unshare -rn (no network interface), signatures and SBOM verified offline. The run needs unprivileged user namespaces (outside the exec tool sandbox). |
| RELE-004 | Failure of OPA OpenFGA audit gateway | IN_PROGRESS | fail-closed / audit: existing / sources changed since evidence E-DO-FAIL-CLOSED / Scenario 16: real OPA killed, real OpenFGA stopped, audit store unavailable: sensitive operations refused and the refusal audited; Audit Gateway target down: redelivery without loss or duplicate. |
| RELE-005 | Policy revocation while agent running | IN_PROGRESS | revocation / audit: existing / sources changed since evidence E-DO-REVOCATION / Scenario 6: revocation of the delegation, of the user or a policy change during the run: the next sensitive action is refused. |
| RELE-006 | Non-privileged user cannot see another tenant | IN_PROGRESS | tenant-isolation / audit: existing / sources changed since evidence E-DO-ISOLATION / Real security tests: cross-tenant IDOR on every route and real Qdrant with two tenants without leak (scenario 7). |
| RELE-007 | Bank financial operation retry idempotent | IN_PROGRESS | idempotency / audit: existing / sources changed since evidence E-DO-SOC; sources changed since evidence E-DO-MARKETPLACE / Scenario 17: payment retried and killed in flight never executed twice; Finance pack with exactly-once payments. |
| RELE-008 | Secrets encrypted and PII out of logs | IN_PROGRESS | redaction / audit: existing / sources changed since evidence E-DO-REDACTION / Redaction tests: secrets and PII absent from logs and spans, secrets stored encrypted, audit PII in the encrypted payload. |
| RELE-009 | Agent kill restart cannot resume unauthorized | IN_PROGRESS | kill-restart / audit: existing / sources changed since evidence E-DO-SOC / Persistent suspension proven: the Kill Switch survives an application restart, recovery needs four eyes then reauthorization. |
| RELE-010 | Signed plugin unsafe permission denied | IN_PROGRESS | unsafe-plugin / audit: existing / sources changed since evidence E-DO-MARKETPLACE / The Marketplace refuses a correctly signed pack (real cosign) asking for an unsafe permission. |
| RELE-011 | Voice consent and participant identity | BLOCKED | End to end WebRTC audio media (UDP, ICE, codecs) needs a WebRTC client [B-WEBRTC]. |
| RELE-012 | License expires without production cut | IN_PROGRESS | licence-expiry / audit: existing / sources changed since evidence E-DO-LICENCE / Behaviour demonstrated: at expiry nothing stops in production, only the two documented actions are refused, warnings at 30, 7 and 1 days then grace. |
| RELE-013 | Backup restore evidence retention tested | IN_PROGRESS | backup-evidence / audit: existing / sources changed since evidence E-DO-BACKUP / Scenario 20: real PostgreSQL backup then restore, the audit chain, seals and legal hold stay verifiable after restore. |
| RELE-014 | Performance HA scale and RTO RPO measured | BLOCKED | High availability, scale and node loss on a real cluster [B-CLUSTER]; RTO and RPO targets to be set by the client [B-CLIENT]. |
| RELE-015 | Developer first agent works day one | IN_PROGRESS | developer-day-one / audit: existing / sources changed since evidence E-DO-DAY-ONE / Template + SDK + docs succeed: login, create agent, validate, test authz (real opa), deploy, run start, events and trace against a real Control Plane, with the quickstart commands of cli.md, all present in the CLI reference. |
| RELE-016 | Docs and support handover complete | BLOCKED | Documentation and handover file delivered in FR and EN; the end to end acceptance signed by the client is still to obtain [B-CLIENT]. |
P0 requirements not PASSED
| ID | Requirement (kit wording, French) | Status |
|---|---|---|
| FOUN-001 | Inventaire repos branches et changements existants | IN_PROGRESS |
| FOUN-002 | Architecture en plans et ADR versionnés | IN_PROGRESS |
| FOUN-003 | Matrice bidirectionnelle exigences code API SQL UI tests docs | IN_PROGRESS |
| FOUN-004 | Plan DAG et lots livrables | IN_PROGRESS |
| FOUN-005 | Monorepo conventions Python TS Go | IN_PROGRESS |
| FOUN-006 | OpenAPI et JSON Schema versionnés | IN_PROGRESS |
| FOUN-007 | PostgreSQL central accepté | IN_PROGRESS |
| FOUN-008 | Redis central accepté | IN_PROGRESS |
| FOUN-009 | CI pipelines lint types unit integration e2e | IN_PROGRESS |
| FOUN-010 | Gestion des secrets par références | IN_PROGRESS |
| FOUN-011 | SBOM et SPDX par artefact | IN_PROGRESS |
| FOUN-012 | Exceptions de licence PostgreSQL Redis client models | BLOCKED |
| FOUN-013 | Matrice versions composants et dependances | IN_PROGRESS |
| FOUN-014 | Build de distribution signé et reproductible | FAILED |
| MANA-001 | Découverte clusters BYO ou managés | IN_PROGRESS |
| MANA-002 | Inventaire nodes CPU RAM stockage GPU | IN_PROGRESS |
| MANA-003 | Preflight DNS TLS ports capacité versions | IN_PROGRESS |
| MANA-004 | Profils development enterprise banking airgapped hybrid | IN_PROGRESS |
| MANA-005 | Catalogue managed components | IN_PROGRESS |
| MANA-006 | Graphe de dépendances et ordre des opérations | IN_PROGRESS |
| MANA-007 | Reconciler desired observed states | IN_PROGRESS |
| MANA-008 | Différencier health operation security states | IN_PROGRESS |
| MANA-009 | Install/config/start/stop/restart | IN_PROGRESS |
| MANA-010 | Rolling restart drain maintenance et PDB | IN_PROGRESS |
| MANA-011 | Scale KEDA HPA quotas ressources | IN_PROGRESS |
| MANA-012 | Upgrade migration compatibilité canary | IN_PROGRESS |
| MANA-013 | Rollback ou restore explicite | IN_PROGRESS |
| MANA-014 | Health liveness readiness functional probes | IN_PROGRESS |
| MANA-015 | Drift detection configuration | IN_PROGRESS |
| MANA-016 | Config versions typed schema et secret refs | IN_PROGRESS |
| MANA-017 | Node agent Go avec allowlist | IN_PROGRESS |
| MANA-018 | Platform Operator Kubernetes | IN_PROGRESS |
| MANA-019 | Backups coordonnés et tests restore | IN_PROGRESS |
| MANA-020 | Diagnostics support bundle expurgé | IN_PROGRESS |
| MANA-021 | Installation offline et images miroir | FAILED |
| MANA-022 | Bascule sur infrastructure client existante | IN_PROGRESS |
| MANA-023 | Rapport recette installation signé | IN_PROGRESS |
| IAM_-001 | Keycloak OIDC SAML SSO MFA | FAILED |
| IAM_-002 | Identités de service SPIFFE SPIRE mTLS | FAILED |
| IAM_-003 | OpenFGA relations ressources | FAILED |
| IAM_-004 | OPA Rego ABAC contextuel | FAILED |
| IAM_-005 | Policy bundles version et publication | FAILED |
| IAM_-006 | Deny by default et fail-closed | FAILED |
| IAM_-007 | Context Authority signe contextes | IN_PROGRESS |
| IAM_-008 | Delegation scopes audience expiry depth | IN_PROGRESS |
| IAM_-009 | Identité on_behalf_of utilisateur de bout en bout | IN_PROGRESS |
| IAM_-010 | Sessions révoquées en cours de run | IN_PROGRESS |
| IAM_-011 | Identités pour agents planifiés | IN_PROGRESS |
| IAM_-012 | Séparation roles admins developers auditors | FAILED |
| IAM_-013 | Break glass exceptionnel | IN_PROGRESS |
| IAM_-014 | Approval four-eyes et séparation tâches | FAILED |
| IAM_-015 | Permissions données RLS et droits sources | IN_PROGRESS |
| IAM_-016 | Policy simulator et audit des changements | FAILED |
| IAM_-017 | Modeles de rôles RBAC ABAC ReBAC | IN_PROGRESS |
| IAM_-018 | KMS HSM integration via client | BLOCKED |
| AGEN-001 | Runtime Navin Loop Runner SubagentManager | IN_PROGRESS |
| AGEN-002 | Planning acting verification recovery | IN_PROGRESS |
| AGEN-003 | Checkpoints et reprise sans re-exécution non sûre | IN_PROGRESS |
| AGEN-004 | Heartbeat deadline cancellation | IN_PROGRESS |
| AGEN-005 | Temporal workflows durables | IN_PROGRESS |
| AGEN-006 | NATS JetStream events durables | IN_PROGRESS |
| AGEN-007 | gVisor sandbox code outil | IN_PROGRESS |
| AGEN-008 | Agent registry versions owners risk states | IN_PROGRESS |
| AGEN-009 | Application registry avec deploy et statuts | IN_PROGRESS |
| AGEN-010 | Agents tiers via SDK et gateways | IN_PROGRESS |
| AGEN-011 | MCP gateway authz par invocation | IN_PROGRESS |
| AGEN-012 | MCP catalogue discovery outils schemas | IN_PROGRESS |
| AGEN-013 | API gateway APISIX auth rate limit | BLOCKED |
| AGEN-014 | Sécurisation sous-agent identités et ressources | IN_PROGRESS |
| AGEN-015 | Validation args outils effets side-effects | IN_PROGRESS |
| AGEN-016 | Webhook events signés et idempotents | IN_PROGRESS |
| AGEN-017 | Protected execution des skills/plugins | IN_PROGRESS |
| DATA-001 | Storage abstraction S3 AWS | IN_PROGRESS |
| DATA-002 | Storage abstraction Azure Blob | IN_PROGRESS |
| DATA-003 | Storage abstraction GCS | IN_PROGRESS |
| DATA-004 | Storage abstraction IBM COS | IN_PROGRESS |
| DATA-005 | Storage abstraction Seaweed S3 | IN_PROGRESS |
| DATA-006 | Capabilities discovery versioning retention WORM | IN_PROGRESS |
| DATA-007 | Presigned URLs et contrôles accès | IN_PROGRESS |
| DATA-008 | Qdrant filtre tenant et ACL | IN_PROGRESS |
| DATA-009 | Haystack ingest retrieve rerank | IN_PROGRESS |
| DATA-010 | Docling extraction PDF/Word/table | IN_PROGRESS |
| DATA-011 | PaddleOCR scan images | IN_PROGRESS |
| DATA-012 | OpenLineage provenance transformations | IN_PROGRESS |
| DATA-013 | Chunk-level ACL et document-level ACL | IN_PROGRESS |
| DATA-014 | Source permission pre-retrieval | IN_PROGRESS |
| DATA-015 | RAG poisoning detection quarantine | IN_PROGRESS |
| DATA-016 | Retention/erasure data lifecycle | IN_PROGRESS |
| DATA-017 | RAG citations et version source | IN_PROGRESS |
| DATA-018 | PII detection Presidio | IN_PROGRESS |
| DATA-019 | Masking before LLM logs outputs | IN_PROGRESS |
| DATA-020 | Tokenization reversible vault separé | IN_PROGRESS |
| DATA-021 | Tink encryption envelope et rotation clés | IN_PROGRESS |
| DATA-022 | Residency et data egress restrictions | IN_PROGRESS |
| DATA-023 | SQL RLS isolation end-to-end | IN_PROGRESS |
| DATA-024 | Cache sensible encrypted et segregation | IN_PROGRESS |
| OBSE-001 | OpenTelemetry instrumentation W3C trace | IN_PROGRESS |
| OBSE-002 | OTel collector filtering export | IN_PROGRESS |
| OBSE-003 | Opik traces prompt evaluations | IN_PROGRESS |
| OBSE-004 | Jaeger distributed traces | IN_PROGRESS |
| OBSE-005 | Prometheus metrics p50 p95 p99 | IN_PROGRESS |
| OBSE-006 | Perses dashboards unified | FAILED |
| OBSE-007 | Alertmanager routing silences grouping | IN_PROGRESS |
| OBSE-008 | OpenSearch logs indexing search | IN_PROGRESS |
| OBSE-009 | OpenSearch security analytics detections | IN_PROGRESS |
| OBSE-010 | OpenLineage lineage exploration | IN_PROGRESS |
| OBSE-011 | Opik et OTel pas seul audit probant | IN_PROGRESS |
| OBSE-012 | SLO et error budget tracking | IN_PROGRESS |
| OBSE-013 | FinOps metrics tenant model agent | IN_PROGRESS |
| OBSE-014 | Performance CPU GPU RAM concurrency | BLOCKED |
| SECU-001 | Falco runtime detection | BLOCKED |
| SECU-002 | Tetragon runtime enforcement | BLOCKED |
| SECU-003 | Detection ingestor normalize events | IN_PROGRESS |
| SECU-004 | Event correlator user agent tenant | IN_PROGRESS |
| SECU-005 | AI risk engine policy decision | IN_PROGRESS |
| SECU-006 | Detection prompt injection | IN_PROGRESS |
| SECU-007 | Detection data exfiltration | IN_PROGRESS |
| SECU-008 | Detection secrets leak | IN_PROGRESS |
| SECU-009 | Detection runaway agent cost loops | IN_PROGRESS |
| SECU-010 | Detection MCP compromised plugin | IN_PROGRESS |
| SECU-011 | Detection privilege escalation | IN_PROGRESS |
| SECU-012 | Detection RAG poisoning | IN_PROGRESS |
| SECU-013 | Detection no-audit or unauthorized policy change | IN_PROGRESS |
| SECU-014 | SOC incidents assign lifecycle | IN_PROGRESS |
| SECU-015 | SOAR playbooks approved typed actions | IN_PROGRESS |
| SECU-016 | Kill Switch run agent subagents | IN_PROGRESS |
| SECU-017 | Kill Switch application tool MCP provider | IN_PROGRESS |
| SECU-018 | Kill Switch network Cilium | BLOCKED |
| SECU-019 | Kill Switch credentials user and tenant | IN_PROGRESS |
| SECU-020 | Containment desired observed receipts | IN_PROGRESS |
| SECU-021 | Separation alerting vs enforcement vs audit | IN_PROGRESS |
| SECU-022 | Recover workflow four-eyes and reauthorization | IN_PROGRESS |
| SECU-023 | Transaction safety in incident | IN_PROGRESS |
| SECU-024 | False positive proportionality guard | IN_PROGRESS |
| SECU-025 | SOC consoles and access control | IN_PROGRESS |
| AUDI-001 | Immutable audit event schema | IN_PROGRESS |
| AUDI-002 | Audit capture who what when how why result | IN_PROGRESS |
| AUDI-003 | Trace and run ID correlation | IN_PROGRESS |
| AUDI-004 | Audit policy FGA OPA decisions | FAILED |
| AUDI-005 | Audit approvals delegation rights lineage | IN_PROGRESS |
| AUDI-006 | Audit data classification DLP and egress | IN_PROGRESS |
| AUDI-007 | Audit tool model prompt skill plugin versions | IN_PROGRESS |
| AUDI-008 | Audit gateway durable queue no sampling | IN_PROGRESS |
| AUDI-009 | Transactional outbox idempotency dedup | IN_PROGRESS |
| AUDI-010 | Sealing canonicalization hashing signature | IN_PROGRESS |
| AUDI-011 | Client storage WORM Object Lock capability | BLOCKED |
| AUDI-012 | Audit encryption access separation | IN_PROGRESS |
| AUDI-013 | Retention and legal hold workflows | IN_PROGRESS |
| AUDI-014 | Audit read/export accesses themselves audited | IN_PROGRESS |
| AUDI-015 | Evidence verification integrity monitoring | IN_PROGRESS |
| AUDI-016 | Clock sync event_time ingested sealed | IN_PROGRESS |
| AUDI-017 | Incident evidence preservation and chain | IN_PROGRESS |
| LICE-001 | License annual 12 months | IN_PROGRESS |
| LICE-002 | License triennial 36 months | IN_PROGRESS |
| LICE-003 | No limit users agents apps cases plugins | IN_PROGRESS |
| LICE-004 | No prices anywhere | IN_PROGRESS |
| LICE-005 | Offline license issuance verification | IN_PROGRESS |
| LICE-006 | Install-group scope and DR portability | IN_PROGRESS |
| LICE-007 | Expiry grace no safety kill | IN_PROGRESS |
| LICE-008 | Release version pinning components | FAILED |
| LICE-009 | Airgap bundle images packages models SQL | FAILED |
| LICE-010 | Cosign signatures Syft SBOM Trivy | FAILED |
| LICE-011 | Registry Harbor and CI Tekton | BLOCKED |
| LICE-012 | Git Gitea and GitOps ArgoCD | BLOCKED |
| LICE-013 | Kyverno Cilium KEDA HPA Helm | BLOCKED |
| LICE-014 | Backup Velero and restoration | BLOCKED |
| LICE-015 | Client installation handbook and release notes | FAILED |
| LICE-016 | Support bundle safe and diagnostics | IN_PROGRESS |
| RELE-001 | Fresh cluster install automated | BLOCKED |
| RELE-002 | BYO Kubernetes Postgres Redis storage | BLOCKED |
| RELE-003 | No Internet airgap install | FAILED |
| RELE-004 | Failure of OPA OpenFGA audit gateway | IN_PROGRESS |
| RELE-005 | Policy revocation while agent running | IN_PROGRESS |
| RELE-006 | Non-privileged user cannot see another tenant | IN_PROGRESS |
| RELE-007 | Bank financial operation retry idempotent | IN_PROGRESS |
| RELE-008 | Secrets encrypted and PII out of logs | IN_PROGRESS |
| RELE-009 | Agent kill restart cannot resume unauthorized | IN_PROGRESS |
| RELE-010 | Signed plugin unsafe permission denied | IN_PROGRESS |
| RELE-011 | Voice consent and participant identity | BLOCKED |
| RELE-012 | License expires without production cut | IN_PROGRESS |
| RELE-013 | Backup restore evidence retention tested | IN_PROGRESS |
| RELE-014 | Performance HA scale and RTO RPO measured | BLOCKED |
| RELE-015 | Developer first agent works day one | IN_PROGRESS |
| RELE-016 | Docs and support handover complete | BLOCKED |
| HOST-001 | Inventaire hôtes VM bare metal et capacités CPU RAM GPU OS réseau | IN_PROGRESS |
| HOST-002 | Préflight SSH OS DNS NTP disque ports et réseau | IN_PROGRESS |
| HOST-003 | SSH par clé Ed25519 ou certificats approuvés | IN_PROGRESS |
| HOST-005 | Strict SSH host key/certificate verification | IN_PROGRESS |
| HOST-006 | SSH via bastion proxy jump et réseaux segmentés | IN_PROGRESS |
| HOST-007 | Compte bootstrap dédié et sudo allowlist sans root permanent | IN_PROGRESS |
| HOST-008 | Références des clés et secrets uniquement dans PostgreSQL | IN_PROGRESS |
| HOST-009 | Binaire Node Agent signé digest vérifié et service systemd durci | IN_PROGRESS |
| HOST-010 | Bootstrap idempotent, rollback et suppression accès temporaires | IN_PROGRESS |
| HOST-011 | Enrôlement par jeton unique court lié à un hôte | IN_PROGRESS |
| HOST-012 | Identité SPIFFE et canal mTLS pour Node Agent | IN_PROGRESS |
| HOST-013 | Agent Node Go inventaire heartbeat métriques et diagnostics | IN_PROGRESS |
| HOST-014 | Commandes agents signées allowlistées expirantes anti-rejeu | IN_PROGRESS |
| HOST-015 | Commandes agents context identité et audit reçus réels | IN_PROGRESS |
| HOST-016 | Mise en quarantaine désenrôlement et récupération machine | IN_PROGRESS |
| HOST-018 | Break glass SSH approuvé et audité | IN_PROGRESS |
| CLUS-001 | Six modes single host node group K8s existing K8s managed multi cluster external | BLOCKED |
| CLUS-002 | Distinction platform managed et client managed | IN_PROGRESS |
| CLUS-003 | Import Kubernetes via API sans SSH et permissions minimales | FAILED |
| CLUS-004 | Cluster Agent Go répliqué et identité par cluster | FAILED |
| CLUS-005 | Cluster Agent connexion sortante mTLS et autonomie contrôlée offline | FAILED |
| CLUS-006 | Platform Operator CRDs schémas et reconciliation | FAILED |
| CLUS-007 | Node pools CPU GPU labels et placement contraint | BLOCKED |
| CLUS-008 | ManagedComponent manifest des modes opérations dépendances et sécurité | FAILED |
| CLUS-009 | DAG dépendances services ordre et maintenance | IN_PROGRESS |
| CLUS-010 | Séparation service start/stop et security suspension | IN_PROGRESS |
| CLUS-012 | Gestion de plusieurs clusters et perte de connexion WAN | BLOCKED |
| HAVA-001 | Profils standalone ha critical ha et choix de fault domains | FAILED |
| HAVA-002 | Frontend backend Manager gateway répliqués en HA | BLOCKED |
| HAVA-003 | HA Identity Policy Context Authority et Security Controllers | BLOCKED |
| HAVA-004 | HA Audit Evidence SOC Kill Switch et Licensing | BLOCKED |
| HAVA-005 | Topology spread affinity PDB et drains planifiés | BLOCKED |
| HAVA-006 | Leader election et anti-double opération exclusive | FAILED |
| HAVA-007 | HA PostgreSQL sous K8s via CloudNativePG | BLOCKED |
| HAVA-008 | HA PostgreSQL VM via Patroni ou client-managed | FAILED |
| HAVA-009 | HA Redis Sentinel ou Cluster et reconnexion clients | FAILED |
| HAVA-010 | HA NATS JetStream quorum et redelivery idempotent | FAILED |
| HAVA-011 | HA Temporal persistence et jobs durables | BLOCKED |
| HAVA-012 | HA des dépendances Keycloak LiteLLM Opik OpenFGA Qdrant OpenSearch | BLOCKED |
| HAVA-014 | HA LiveKit avec limites de reconnexion rooms | BLOCKED |
| HAVA-016 | Fail closed sécurité en panne control plane | FAILED |
| HAVA-017 | Observabilité HA distinction configured versus validated | FAILED |
| BACK-001 | Backup Manager central plans restauration permissions et historique | FAILED |
| BACK-002 | Storage adapter S3 Azure GCS IBM Seaweed BYO | BLOCKED |
| BACK-003 | Qualification capabilities versioning ObjectLock legal hold native | FAILED |
| BACK-004 | Velero backup Kubernetes manifests CRDs volumes compatibles | BLOCKED |
| BACK-005 | PostgreSQL backup cohérent CNPG ou pgBackRest selon mode | FAILED |
| BACK-006 | PostgreSQL WAL continu et Point in Time Recovery | FAILED |
| BACK-007 | Snapshots etcd et procédure restore control plane | BLOCKED |
| BACK-008 | Backup OpenSearch via snapshots natifs | FAILED |
| BACK-009 | Backup Qdrant via snapshots natifs | FAILED |
| BACK-010 | Backup Opik et backends MySQL Redis ClickHouse object storage selon distro | FAILED |
| BACK-011 | Backup Temporal NATS JetStream et checkpoints agents | FAILED |
| BACK-012 | Backup OCI Harbor manifests prompts skills plugins policies modèles | BLOCKED |
| BACK-013 | Backup secrets certificats CA et processus key recovery | FAILED |
| BACK-014 | Cohérence transverse DB objets registres versions | FAILED |
| BACK-015 | Chiffrement backup rétention et séparation de privilèges | FAILED |
| BACK-016 | Backup WORM preuves d audit immuables sur backend qualifié | FAILED |
| BACK-017 | Tests réguliers automatiques restore isolé et intégrité | FAILED |
| BACK-018 | Backup policies monitoring retards erreurs et alertes | FAILED |
| BACK-019 | Restore approval dry-run plan et rollback de configuration | FAILED |
| DR-001 | DR sites primary secondary multi cluster et rôles | FAILED |
| DR-002 | Modes active passive warm cold et active active stateless | BLOCKED |
| DR-003 | Fencing ancien primary et prevention split brain | FAILED |
| DR-004 | Plan recovery séquencé données identités gateways modèles | FAILED |
| DR-005 | Reconstruire Manager depuis bundle offline backups et manifests | FAILED |
| DR-006 | DNS load balancer routes reconfiguration failover | BLOCKED |
| DR-007 | RPO RTO objectifs client et valeurs observées | BLOCKED |
| DR-008 | DR tests planifiés avec approbation et preuves | FAILED |
| DR-009 | Licence 12 36 mois reste valide pendant DR et mode offline | FAILED |
| DR-010 | Audit identités suspensions et permissions préservés pendant DR | FAILED |
| DR-011 | Réconciliation post failover empêche doubles paiements | FAILED |
| INFUI-001 | UI hosts preflight SSH bootstrap et enrôlement | IN_PROGRESS |
| INFUI-002 | UI node agents heartbeats certificats et révocation | IN_PROGRESS |
| INFUI-003 | UI clusters pools placement et dépendances | IN_PROGRESS |
| INFUI-004 | UI HA replicas quorum failover et fault domains | IN_PROGRESS |
| INFUI-005 | UI backups policies jobs historiques et tests | IN_PROGRESS |
| INFUI-006 | UI Restore dry run approve execute verify | IN_PROGRESS |
| INFUI-007 | UI PRA sites objectifs exercices et résultats | FAILED |
| INFUI-008 | UI client-managed actions non autorisées cachées et refusées backend | IN_PROGRESS |
| INFSDK-001 | SDK Python TS Go hosts bootstrap enrollment diagnostics | IN_PROGRESS |
| INFSDK-002 | SDK Python TS Go clusters et services operations | IN_PROGRESS |
| INFSDK-003 | SDK Python TS Go HA backups restore DR | IN_PROGRESS |
| INFSDK-004 | Contexte user identity on behalf of service delegation pour operations | IN_PROGRESS |
| INFSDK-005 | CLI host cluster services ha backup restore dr | IN_PROGRESS |