The dr.* family (2 verbs). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.
Setdr.policy.set
| Property | Value |
|---|---|
| Capability | tenant.dr |
| Risk class | Sensitive - autonomy L2 |
| Min. permission | Owner |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | Yes |
| Egress | None - in-box (pure Postgres, no outbound call) |
Set the DR RPO/RTO + restore-drill cadence (the policy writer).
{ rpoMinutes?, rtoMinutes?, drillCadenceDays?, cadence?, retentionDays?, destination?, residencyOnBox? }.
Call POST /v/dr.policy.set with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.
Statusdr.status
| Property | Value |
|---|---|
| Capability | tenant.read |
| Risk class | Read - autonomy L0 |
| Min. permission | Owner |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
| Render schema | Yes - drives an inline chat artefact and a GUI panel |
DR readiness (last restore-drill verdict, chain-continuity, RTO). {}.
Reads ops_event (last RESTORE_DRILL) + dr_policy + the audit-chain HEAD (INV-6, zero new store).
Call POST /v/dr.status with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.