{
  "$schema": "./disaster-recovery-plan-schema.json",
  "schemaVersion": "1.0.0",
  "planId": "DRP-EXAMPLE-001",
  "title": "Juniper Trail Services Disaster Recovery Plan",
  "status": "draft",
  "version": "1.0.0",
  "dates": {
    "createdAt": "2026-07-15",
    "lastReviewedAt": "2026-08-01",
    "nextReviewAt": "2026-10-30"
  },
  "planOwnerId": "ROLE-PLAN-OWNER",
  "decisionAuthorityId": "ROLE-DECISION-AUTHORITY",
  "owners": [
    {
      "id": "ROLE-PLAN-OWNER",
      "role": "Continuity plan owner",
      "responsibility": "Maintains the plan record, review cadence, and cross-plan boundaries",
      "authority": "May propose revisions but cannot activate recovery or approve a traffic switch",
      "alternateOwnerId": "ROLE-RECOVERY-LEAD",
      "contactRef": "directory://role/continuity-plan-owner"
    },
    {
      "id": "ROLE-RECOVERY-LEAD",
      "role": "Recovery lead",
      "responsibility": "Coordinates the authorized recovery sequence and retains evidence",
      "authority": "May execute approved steps and stop on failed verification",
      "alternateOwnerId": "ROLE-SERVICE-OWNER",
      "contactRef": "directory://role/recovery-lead"
    },
    {
      "id": "ROLE-SERVICE-OWNER",
      "role": "Service owner",
      "responsibility": "Defines minimum usable service and verifies critical journeys",
      "authority": "May accept technical verification evidence but cannot authorize activation",
      "alternateOwnerId": "ROLE-PLAN-OWNER",
      "contactRef": "directory://role/service-owner"
    },
    {
      "id": "ROLE-DATA-OWNER",
      "role": "Data owner",
      "responsibility": "Defines data recovery boundary and reviews reconciliation evidence",
      "authority": "May hold restoration when data evidence is incomplete",
      "alternateOwnerId": "ROLE-SERVICE-OWNER",
      "contactRef": "directory://role/data-owner"
    },
    {
      "id": "ROLE-COMMUNICATIONS",
      "role": "Operational communications owner",
      "responsibility": "Coordinates reviewed service-status notices and stakeholder updates",
      "authority": "May publish only pre-approved operational messages",
      "alternateOwnerId": "ROLE-PLAN-OWNER",
      "contactRef": "directory://role/operational-communications"
    },
    {
      "id": "ROLE-DECISION-AUTHORITY",
      "role": "Recovery decision authority",
      "responsibility": "Reviews activation, traffic-switch, fallback, and reconstitution evidence",
      "authority": "Sole fictional authority for disaster-recovery activation and traffic switch",
      "alternateOwnerId": "ROLE-PLAN-OWNER",
      "contactRef": "directory://role/recovery-decision-authority"
    }
  ],
  "scope": {
    "organization": "Juniper Trail Services",
    "scenarioBoundary": "Loss or corruption of the primary runtime serving the customer portal and operations console",
    "includedServiceIds": ["SVC-CUSTOMER-PORTAL", "SVC-OPERATIONS-CONSOLE"],
    "excludedWork": [
      "Enterprise-wide business continuity for people, facilities, suppliers, and non-IT operations",
      "Emergency response and life-safety actions",
      "Cybersecurity incident detection, evidence preservation, containment, eradication, and reporting",
      "Backup-product selection, procurement, and enterprise retention policy",
      "Data-record mapping, transformation, migration cutover, and migration reconciliation",
      "Legal, regulatory, compliance, certification, insurance, and safety decisions"
    ],
    "assumptions": [
      "The alternate runtime has been separately authorized and can reach the required fictional dependencies",
      "Role-directory references are current at activation time",
      "Backup and restore evidence is reviewed in its authorized system before any recovery step",
      "The decision authority can stop or reverse the sequence when evidence is incomplete"
    ]
  },
  "services": [
    {
      "id": "SVC-CUSTOMER-PORTAL",
      "name": "Juniper Trail customer portal",
      "criticality": "critical",
      "businessImpact": "Customers cannot view current service requests or submit a new request",
      "recoveryTimeObjectiveMinutes": 240,
      "recoveryPointObjectiveMinutes": 60,
      "maximumTolerableDowntimeMinutes": 480,
      "minimumServiceLevel": "Authenticated customers can view current requests and submit a new request",
      "serviceOwnerId": "ROLE-SERVICE-OWNER",
      "recoveryOwnerId": "ROLE-RECOVERY-LEAD",
      "strategyId": "STRAT-PORTAL-ALTERNATE",
      "dependencyIds": ["DEP-DNS", "DEP-IDENTITY", "DEP-APP-DATABASE", "DEP-OBJECT-STORAGE"],
      "dataSetIds": ["DATA-APP-DATABASE", "DATA-UPLOADED-DOCUMENTS"],
      "verificationCheckIds": ["CHECK-PORTAL-JOURNEY", "CHECK-DATA-RECONCILIATION"]
    },
    {
      "id": "SVC-OPERATIONS-CONSOLE",
      "name": "Juniper Trail operations console",
      "criticality": "high",
      "businessImpact": "Authorized operators cannot review or update queued customer requests",
      "recoveryTimeObjectiveMinutes": 480,
      "recoveryPointObjectiveMinutes": 120,
      "maximumTolerableDowntimeMinutes": 720,
      "minimumServiceLevel": "Authorized operators can review and update queued requests",
      "serviceOwnerId": "ROLE-SERVICE-OWNER",
      "recoveryOwnerId": "ROLE-RECOVERY-LEAD",
      "strategyId": "STRAT-OPS-ALTERNATE",
      "dependencyIds": ["DEP-DNS", "DEP-IDENTITY", "DEP-APP-DATABASE", "DEP-OBJECT-STORAGE"],
      "dataSetIds": ["DATA-APP-DATABASE", "DATA-UPLOADED-DOCUMENTS"],
      "verificationCheckIds": ["CHECK-OPS-JOURNEY", "CHECK-DATA-RECONCILIATION"]
    }
  ],
  "dependencies": [
    {
      "id": "DEP-DNS",
      "name": "Public name resolution",
      "kind": "external",
      "ownerId": "ROLE-RECOVERY-LEAD",
      "requiredCapability": "Reviewed records can direct the fictional service name to the authorized runtime",
      "fallback": "Use the separately approved alternate hostname while the decision authority holds public traffic",
      "serviceIds": ["SVC-CUSTOMER-PORTAL", "SVC-OPERATIONS-CONSOLE"]
    },
    {
      "id": "DEP-IDENTITY",
      "name": "Identity and session service",
      "kind": "external",
      "ownerId": "ROLE-SERVICE-OWNER",
      "requiredCapability": "Authorized fictional customer and operator test identities can authenticate",
      "fallback": "Keep the affected journey unavailable; do not bypass authentication",
      "serviceIds": ["SVC-CUSTOMER-PORTAL", "SVC-OPERATIONS-CONSOLE"]
    },
    {
      "id": "DEP-APP-DATABASE",
      "name": "Application database capability",
      "kind": "internal",
      "ownerId": "ROLE-DATA-OWNER",
      "requiredCapability": "The reviewed recovery point can serve reconciled request records",
      "fallback": "Hold write traffic and return to the last reviewed recovery point only after decision review",
      "serviceIds": ["SVC-CUSTOMER-PORTAL", "SVC-OPERATIONS-CONSOLE"]
    },
    {
      "id": "DEP-OBJECT-STORAGE",
      "name": "Uploaded-document capability",
      "kind": "internal",
      "ownerId": "ROLE-DATA-OWNER",
      "requiredCapability": "Authorized users can retrieve the fictional documents referenced by request records",
      "fallback": "Restore the minimum reviewed document set or keep document actions unavailable",
      "serviceIds": ["SVC-CUSTOMER-PORTAL", "SVC-OPERATIONS-CONSOLE"]
    }
  ],
  "dataSets": [
    {
      "id": "DATA-APP-DATABASE",
      "name": "Application request records",
      "ownerId": "ROLE-DATA-OWNER",
      "minimumRecoveryBoundary": "Current customer, request, status, and audit-link records required by the minimum service level",
      "backupSetId": "BACKUP-APP-DATABASE",
      "verificationCheckId": "CHECK-DATA-RECONCILIATION"
    },
    {
      "id": "DATA-UPLOADED-DOCUMENTS",
      "name": "Uploaded request documents",
      "ownerId": "ROLE-DATA-OWNER",
      "minimumRecoveryBoundary": "Document objects referenced by recovered in-scope request records",
      "backupSetId": "BACKUP-UPLOADED-DOCUMENTS",
      "verificationCheckId": "CHECK-BACKUP-INTEGRITY"
    }
  ],
  "recoveryStrategies": [
    {
      "id": "STRAT-PORTAL-ALTERNATE",
      "name": "Restore customer portal to authorized alternate runtime",
      "type": "alternate-runtime-restore",
      "serviceIds": ["SVC-CUSTOMER-PORTAL"],
      "activationTrigger": "Decision authority activates recovery after primary-runtime loss meets CRITERION-ACTIVATE-PRIMARY-LOSS",
      "prerequisites": [
        "Required role-directory references have been checked",
        "Backup integrity and restore evidence are available in the authorized evidence system",
        "The alternate runtime and dependency access have separate approval"
      ],
      "backupSetIds": ["BACKUP-APP-DATABASE", "BACKUP-UPLOADED-DOCUMENTS"],
      "runbookStepIds": [
        "STEP-01-HANDOFF",
        "STEP-02-ACTIVATE",
        "STEP-03-FREEZE",
        "STEP-04-BACKUP-EVIDENCE",
        "STEP-05-ALTERNATE-RUNTIME",
        "STEP-06-RESTORE-DATABASE",
        "STEP-07-RESTORE-DOCUMENTS",
        "STEP-08-CONFIGURE-DEPENDENCIES",
        "STEP-09-VALIDATE-PORTAL",
        "STEP-10-VALIDATE-DATA",
        "STEP-11-TRAFFIC-DECISION",
        "STEP-12-RECONSTITUTE"
      ],
      "fallback": "Hold or return traffic to the last separately verified service state after decision review",
      "constraints": [
        "No credential, key, or private endpoint is stored in this pack",
        "A failed required verification check stops the sequence",
        "The fictional targets are not promises or observed performance"
      ]
    },
    {
      "id": "STRAT-OPS-ALTERNATE",
      "name": "Restore operations console after shared data and identity checks",
      "type": "alternate-runtime-restore",
      "serviceIds": ["SVC-OPERATIONS-CONSOLE"],
      "activationTrigger": "Decision authority includes the operations console in the activated recovery scope",
      "prerequisites": [
        "Database reconciliation is complete",
        "Identity service behavior is verified without bypass",
        "The customer-portal recovery boundary is stable or explicitly held"
      ],
      "backupSetIds": ["BACKUP-APP-DATABASE", "BACKUP-UPLOADED-DOCUMENTS"],
      "runbookStepIds": [
        "STEP-01-HANDOFF",
        "STEP-02-ACTIVATE",
        "STEP-03-FREEZE",
        "STEP-04-BACKUP-EVIDENCE",
        "STEP-05-ALTERNATE-RUNTIME",
        "STEP-06-RESTORE-DATABASE",
        "STEP-07-RESTORE-DOCUMENTS",
        "STEP-08-CONFIGURE-DEPENDENCIES",
        "STEP-10-VALIDATE-DATA",
        "STEP-12-RECONSTITUTE"
      ],
      "fallback": "Keep operator writes unavailable until the service and data owners approve another reviewed state",
      "constraints": [
        "The operations console cannot bypass the identity dependency",
        "The console remains unavailable when the database check fails",
        "A separate human decision is required before normal operations resume"
      ]
    }
  ],
  "backupSets": [
    {
      "id": "BACKUP-APP-DATABASE",
      "name": "Application database recovery set",
      "dataSetIds": ["DATA-APP-DATABASE"],
      "methodBoundary": "Fictional encrypted database snapshots stored outside the primary runtime boundary",
      "isolationBoundary": "The recovery copy is not writable from the primary application identity",
      "encrypted": true,
      "offlineOrImmutable": true,
      "frequencyHours": 1,
      "retentionDays": 30,
      "lastSuccessfulBackupAt": "2026-07-31T23:00:00Z",
      "lastIntegrityCheckAt": "2026-07-31T23:15:00Z",
      "lastRestoreExerciseAt": "2026-07-20T14:00:00Z",
      "restoreEvidenceRef": "evidence://example/restore/database-2026-07-20",
      "ownerId": "ROLE-DATA-OWNER"
    },
    {
      "id": "BACKUP-UPLOADED-DOCUMENTS",
      "name": "Uploaded-document recovery set",
      "dataSetIds": ["DATA-UPLOADED-DOCUMENTS"],
      "methodBoundary": "Fictional encrypted object versions stored outside the primary runtime boundary",
      "isolationBoundary": "The recovery copy is retained through a separately controlled fictional identity",
      "encrypted": true,
      "offlineOrImmutable": true,
      "frequencyHours": 6,
      "retentionDays": 30,
      "lastSuccessfulBackupAt": "2026-07-31T18:00:00Z",
      "lastIntegrityCheckAt": "2026-07-31T18:30:00Z",
      "lastRestoreExerciseAt": "2026-07-20T14:30:00Z",
      "restoreEvidenceRef": "evidence://example/restore/documents-2026-07-20",
      "ownerId": "ROLE-DATA-OWNER"
    }
  ],
  "activationCriteria": [
    {
      "id": "CRITERION-ACTIVATE-PRIMARY-LOSS",
      "condition": "Primary runtime has been unavailable for 30 minutes and the reviewed provider estimate exceeds two additional hours",
      "evaluatorId": "ROLE-DECISION-AUTHORITY",
      "requiredEvidence": [
        "Observed service health evidence",
        "Reviewed provider estimate",
        "Current backup and dependency evidence"
      ],
      "outcome": "activate"
    },
    {
      "id": "CRITERION-HOLD-UNKNOWN-CAUSE",
      "condition": "The disruption cause is unknown and the required recovery evidence boundary cannot be established",
      "evaluatorId": "ROLE-RECOVERY-LEAD",
      "requiredEvidence": [
        "Authorized incident handoff",
        "Recovery environment isolation decision"
      ],
      "outcome": "hold"
    },
    {
      "id": "CRITERION-ESCALATE-BACKUP",
      "condition": "Backup integrity or restore evidence is missing, expired, or inconsistent",
      "evaluatorId": "ROLE-DATA-OWNER",
      "requiredEvidence": [
        "Backup job evidence",
        "Integrity evidence",
        "Latest restore-exercise evidence"
      ],
      "outcome": "escalate"
    }
  ],
  "verificationChecks": [
    {
      "id": "CHECK-BACKUP-INTEGRITY",
      "name": "Backup evidence review",
      "ownerId": "ROLE-DATA-OWNER",
      "observableResult": "Both in-scope backup sets have current integrity and restore-exercise references",
      "evidenceRef": "evidence://example/checks/backup-integrity",
      "failureResponse": "Stop restoration and escalate to decision authority"
    },
    {
      "id": "CHECK-DEPENDENCY-CONFIGURATION",
      "name": "Dependency configuration review",
      "ownerId": "ROLE-RECOVERY-LEAD",
      "observableResult": "DNS, identity, database, and object-storage boundaries match the authorized recovery record",
      "evidenceRef": "evidence://example/checks/dependencies",
      "failureResponse": "Keep public traffic held and correct or reject the recovery environment"
    },
    {
      "id": "CHECK-DATA-RECONCILIATION",
      "name": "Recovered data reconciliation",
      "ownerId": "ROLE-DATA-OWNER",
      "observableResult": "Approved counts, reference samples, and audit-link checks match the recorded recovery point",
      "evidenceRef": "evidence://example/checks/data-reconciliation",
      "failureResponse": "Stop service validation and review another recovery point or repair path"
    },
    {
      "id": "CHECK-PORTAL-JOURNEY",
      "name": "Customer portal minimum journey",
      "ownerId": "ROLE-SERVICE-OWNER",
      "observableResult": "A fictional authorized customer can sign in, view a request, and submit a new request",
      "evidenceRef": "evidence://example/checks/customer-portal",
      "failureResponse": "Keep customer traffic held and record the failing step"
    },
    {
      "id": "CHECK-OPS-JOURNEY",
      "name": "Operations console minimum journey",
      "ownerId": "ROLE-SERVICE-OWNER",
      "observableResult": "A fictional authorized operator can sign in, review a queued request, and save an allowed status change",
      "evidenceRef": "evidence://example/checks/operations-console",
      "failureResponse": "Keep operator writes unavailable and record the failing step"
    }
  ],
  "runbookSteps": [
    {
      "id": "STEP-01-HANDOFF",
      "order": 1,
      "phase": "activate",
      "ownerId": "ROLE-RECOVERY-LEAD",
      "serviceIds": ["SVC-CUSTOMER-PORTAL", "SVC-OPERATIONS-CONSOLE"],
      "prerequisiteStepIds": [],
      "action": "Confirm the authorized operational or incident handoff and record the disruption boundary",
      "expectedResult": "Recovery participants share one reviewed scope and evidence location",
      "verificationCheckId": "CHECK-DEPENDENCY-CONFIGURATION",
      "evidenceRef": "evidence://example/runbook/01-handoff",
      "haltOnFailure": true
    },
    {
      "id": "STEP-02-ACTIVATE",
      "order": 2,
      "phase": "activate",
      "ownerId": "ROLE-DECISION-AUTHORITY",
      "serviceIds": ["SVC-CUSTOMER-PORTAL", "SVC-OPERATIONS-CONSOLE"],
      "prerequisiteStepIds": ["STEP-01-HANDOFF"],
      "action": "Review activation criteria and record the authorized recovery scope",
      "expectedResult": "Activation, hold, or escalation has one named human decision",
      "verificationCheckId": "CHECK-DEPENDENCY-CONFIGURATION",
      "evidenceRef": "evidence://example/runbook/02-activation",
      "haltOnFailure": true
    },
    {
      "id": "STEP-03-FREEZE",
      "order": 3,
      "phase": "activate",
      "ownerId": "ROLE-RECOVERY-LEAD",
      "serviceIds": ["SVC-CUSTOMER-PORTAL", "SVC-OPERATIONS-CONSOLE"],
      "prerequisiteStepIds": ["STEP-02-ACTIVATE"],
      "action": "Freeze unreviewed changes and isolate the authorized recovery workspace",
      "expectedResult": "No routine change can alter the recovery inputs during execution",
      "verificationCheckId": "CHECK-DEPENDENCY-CONFIGURATION",
      "evidenceRef": "evidence://example/runbook/03-freeze",
      "haltOnFailure": true
    },
    {
      "id": "STEP-04-BACKUP-EVIDENCE",
      "order": 4,
      "phase": "recover",
      "ownerId": "ROLE-DATA-OWNER",
      "serviceIds": ["SVC-CUSTOMER-PORTAL", "SVC-OPERATIONS-CONSOLE"],
      "prerequisiteStepIds": ["STEP-03-FREEZE"],
      "action": "Review backup, integrity, and restore-exercise evidence for both data sets",
      "expectedResult": "The decision authority can select or reject a recovery point from reviewed evidence",
      "verificationCheckId": "CHECK-BACKUP-INTEGRITY",
      "evidenceRef": "evidence://example/runbook/04-backup-evidence",
      "haltOnFailure": true
    },
    {
      "id": "STEP-05-ALTERNATE-RUNTIME",
      "order": 5,
      "phase": "recover",
      "ownerId": "ROLE-RECOVERY-LEAD",
      "serviceIds": ["SVC-CUSTOMER-PORTAL", "SVC-OPERATIONS-CONSOLE"],
      "prerequisiteStepIds": ["STEP-04-BACKUP-EVIDENCE"],
      "action": "Prepare the separately authorized alternate runtime without public traffic",
      "expectedResult": "The isolated runtime matches the reviewed service and dependency boundary",
      "verificationCheckId": "CHECK-DEPENDENCY-CONFIGURATION",
      "evidenceRef": "evidence://example/runbook/05-alternate-runtime",
      "haltOnFailure": true
    },
    {
      "id": "STEP-06-RESTORE-DATABASE",
      "order": 6,
      "phase": "recover",
      "ownerId": "ROLE-DATA-OWNER",
      "serviceIds": ["SVC-CUSTOMER-PORTAL", "SVC-OPERATIONS-CONSOLE"],
      "prerequisiteStepIds": ["STEP-05-ALTERNATE-RUNTIME"],
      "action": "Restore the selected fictional application-database recovery set",
      "expectedResult": "The isolated database exposes the recorded recovery point for reconciliation",
      "verificationCheckId": "CHECK-DATA-RECONCILIATION",
      "evidenceRef": "evidence://example/runbook/06-database-restore",
      "haltOnFailure": true
    },
    {
      "id": "STEP-07-RESTORE-DOCUMENTS",
      "order": 7,
      "phase": "recover",
      "ownerId": "ROLE-DATA-OWNER",
      "serviceIds": ["SVC-CUSTOMER-PORTAL", "SVC-OPERATIONS-CONSOLE"],
      "prerequisiteStepIds": ["STEP-06-RESTORE-DATABASE"],
      "action": "Restore the minimum fictional document set referenced by recovered records",
      "expectedResult": "Referenced in-scope documents are available for authorized verification",
      "verificationCheckId": "CHECK-BACKUP-INTEGRITY",
      "evidenceRef": "evidence://example/runbook/07-document-restore",
      "haltOnFailure": true
    },
    {
      "id": "STEP-08-CONFIGURE-DEPENDENCIES",
      "order": 8,
      "phase": "recover",
      "ownerId": "ROLE-RECOVERY-LEAD",
      "serviceIds": ["SVC-CUSTOMER-PORTAL", "SVC-OPERATIONS-CONSOLE"],
      "prerequisiteStepIds": ["STEP-07-RESTORE-DOCUMENTS"],
      "action": "Apply reviewed DNS, identity, database, and object-storage configuration references",
      "expectedResult": "Both services use the authorized dependency boundary without bypass",
      "verificationCheckId": "CHECK-DEPENDENCY-CONFIGURATION",
      "evidenceRef": "evidence://example/runbook/08-dependencies",
      "haltOnFailure": true
    },
    {
      "id": "STEP-09-VALIDATE-PORTAL",
      "order": 9,
      "phase": "validate",
      "ownerId": "ROLE-SERVICE-OWNER",
      "serviceIds": ["SVC-CUSTOMER-PORTAL"],
      "prerequisiteStepIds": ["STEP-08-CONFIGURE-DEPENDENCIES"],
      "action": "Run the minimum authenticated customer-portal journey with fictional test identities",
      "expectedResult": "The minimum customer journey passes and stores its evidence reference",
      "verificationCheckId": "CHECK-PORTAL-JOURNEY",
      "evidenceRef": "evidence://example/runbook/09-portal",
      "haltOnFailure": true
    },
    {
      "id": "STEP-10-VALIDATE-DATA",
      "order": 10,
      "phase": "validate",
      "ownerId": "ROLE-DATA-OWNER",
      "serviceIds": ["SVC-CUSTOMER-PORTAL", "SVC-OPERATIONS-CONSOLE"],
      "prerequisiteStepIds": ["STEP-09-VALIDATE-PORTAL"],
      "action": "Reconcile the recovered data boundary and run the operator minimum journey",
      "expectedResult": "Data reconciliation and authorized operator checks are reviewable",
      "verificationCheckId": "CHECK-OPS-JOURNEY",
      "evidenceRef": "evidence://example/runbook/10-data-and-ops",
      "haltOnFailure": true
    },
    {
      "id": "STEP-11-TRAFFIC-DECISION",
      "order": 11,
      "phase": "validate",
      "ownerId": "ROLE-DECISION-AUTHORITY",
      "serviceIds": ["SVC-CUSTOMER-PORTAL", "SVC-OPERATIONS-CONSOLE"],
      "prerequisiteStepIds": ["STEP-10-VALIDATE-DATA"],
      "action": "Review required evidence and authorize traffic switch, hold, or fallback",
      "expectedResult": "Public and operator traffic state follows one named human decision",
      "verificationCheckId": "CHECK-PORTAL-JOURNEY",
      "evidenceRef": "evidence://example/runbook/11-traffic-decision",
      "haltOnFailure": true
    },
    {
      "id": "STEP-12-RECONSTITUTE",
      "order": 12,
      "phase": "reconstitute",
      "ownerId": "ROLE-RECOVERY-LEAD",
      "serviceIds": ["SVC-CUSTOMER-PORTAL", "SVC-OPERATIONS-CONSOLE"],
      "prerequisiteStepIds": ["STEP-11-TRAFFIC-DECISION"],
      "action": "Reconcile changed records, preserve evidence, assign gaps, and document the chosen steady state",
      "expectedResult": "The recovery record closes with explicit remaining actions and plan updates",
      "verificationCheckId": "CHECK-DATA-RECONCILIATION",
      "evidenceRef": "evidence://example/runbook/12-reconstitution",
      "haltOnFailure": true
    }
  ],
  "exerciseRecords": [
    {
      "id": "EXERCISE-RESTORE-2026-07-20",
      "type": "restore-test",
      "startedAt": "2026-07-20T13:00:00Z",
      "endedAt": "2026-07-20T16:10:00Z",
      "scenario": "Restore both fictional data sets into an isolated exercise runtime",
      "serviceIds": ["SVC-CUSTOMER-PORTAL", "SVC-OPERATIONS-CONSOLE"],
      "objectiveCheckIds": ["CHECK-BACKUP-INTEGRITY", "CHECK-DATA-RECONCILIATION"],
      "result": "completed-with-gaps",
      "observations": [
        "Database reconciliation completed against the fictional exercise record",
        "Document restore evidence was incomplete for one sampled reference"
      ],
      "gapIds": ["ACTION-DOCUMENT-RESTORE-EVIDENCE"],
      "afterActionRef": "evidence://example/exercises/restore-2026-07-20",
      "reviewerId": "ROLE-DATA-OWNER"
    },
    {
      "id": "EXERCISE-TABLETOP-2026-07-25",
      "type": "tabletop",
      "startedAt": "2026-07-25T09:00:00Z",
      "endedAt": "2026-07-25T10:30:00Z",
      "scenario": "Primary runtime loss with uncertain provider restoration estimate",
      "serviceIds": ["SVC-CUSTOMER-PORTAL", "SVC-OPERATIONS-CONSOLE"],
      "objectiveCheckIds": ["CHECK-DEPENDENCY-CONFIGURATION", "CHECK-PORTAL-JOURNEY"],
      "result": "completed-with-gaps",
      "observations": [
        "Decision authority and service scope were identified",
        "The external provider contact reference needed a scheduled review"
      ],
      "gapIds": ["ACTION-REVIEW-PROVIDER-CONTACT"],
      "afterActionRef": "evidence://example/exercises/tabletop-2026-07-25",
      "reviewerId": "ROLE-PLAN-OWNER"
    }
  ],
  "improvementActions": [
    {
      "id": "ACTION-DOCUMENT-RESTORE-EVIDENCE",
      "title": "Complete document-restore sampling evidence",
      "ownerId": "ROLE-DATA-OWNER",
      "dueAt": "2026-08-20",
      "status": "in-progress",
      "verificationRef": "evidence://example/actions/document-restore-evidence"
    },
    {
      "id": "ACTION-REVIEW-PROVIDER-CONTACT",
      "title": "Review the external provider contact-directory reference",
      "ownerId": "ROLE-PLAN-OWNER",
      "dueAt": "2026-08-15",
      "status": "open",
      "verificationRef": "evidence://example/actions/provider-contact-review"
    }
  ],
  "maintenance": {
    "reviewCadenceDays": 90,
    "reviewTriggers": [
      "Material service architecture change",
      "Owner or decision-authority change",
      "Recovery provider or dependency change",
      "Failed or incomplete restore exercise",
      "Observed recovery target miss",
      "Major incident or continuity-plan change",
      "Material change to the included business service"
    ],
    "versionHistory": [
      {
        "version": "1.0.0",
        "date": "2026-08-01",
        "editorId": "ROLE-PLAN-OWNER",
        "summary": "Created the closed fictional recovery plan, tests, and adjacent-owner boundary",
        "approved": false
      }
    ]
  },
  "boundaries": {
    "ownsBusinessContinuityGovernance": false,
    "ownsIncidentResponse": false,
    "selectsBackupProduct": false,
    "executesDataMigration": false,
    "grantsCompliance": false,
    "certifiesReadiness": false,
    "guaranteesRecovery": false
  },
  "disclaimer": "This fictional record validates structure and references only. It does not observe systems, verify authority, prove backups or restore behavior, certify readiness or compliance, approve activation, establish an SLA, or guarantee RTO, RPO, availability, data integrity, safety, or business outcome."
}