加固部署隔离与备份来源契约（07-26-internal-ops-recovery-baseline）

scripts/qa/run-backup-restore-drill.sh

@@ -41,6 +41,50 @@ mkdir -p "$SOURCE_STORAGE/nested" "$NONEMPTY_STORAGE" "$BACKUP_ROOT"
 printf 'synthetic attachment for restore drill\n' >"$SOURCE_STORAGE/nested/marker.txt"
 printf 'must not be overwritten\n' >"$NONEMPTY_STORAGE/existing.txt"
 
+if env -u STORAGE_DIR_HOST -u STORAGE_DIR \
+  OUT_FILE="$DRILL_DIR/implicit-storage.tar.gz" \
+  "$ROOT_DIR/scripts/backup-storage.sh" >/dev/null 2>&1; then
+  echo "[ERR] implicit storage backup source was accepted" >&2
+  exit 1
+fi
+
+if env -u DB_CONTAINER DB_TOOL_MODE=docker DATABASE_URL=postgresql://invalid \
+  POSTGRES_DB=invalid POSTGRES_USER=invalid POSTGRES_PASSWORD=invalid \
+  OUT_FILE="$DRILL_DIR/implicit-db.dump" \
+  "$ROOT_DIR/scripts/backup-db.sh" >/dev/null 2>&1; then
+  echo "[ERR] implicit DB container was accepted" >&2
+  exit 1
+fi
+
+if command -v node >/dev/null 2>&1; then
+  MUTATED_PORT_COMPOSE="$DRILL_DIR/docker-compose-db-port.yml"
+  sed '/  db:/a\    ports:\n      - "5432:5432"' \
+    "$ROOT_DIR/deploy/trialrun/docker-compose.yml" >"$MUTATED_PORT_COMPOSE"
+  if ENV_CONTRACT_COMPOSE_PATH="$MUTATED_PORT_COMPOSE" \
+    node "$ROOT_DIR/deploy/trialrun/validate-env-contract.js" >/dev/null 2>&1; then
+    echo "[ERR] unsafe DB port publication passed the contract" >&2
+    exit 1
+  fi
+
+  MUTATED_NAME_COMPOSE="$DRILL_DIR/docker-compose-fixed-name.yml"
+  sed '/  db:/a\    container_name: forbidden-fixed-name' \
+    "$ROOT_DIR/deploy/trialrun/docker-compose.yml" >"$MUTATED_NAME_COMPOSE"
+  if ENV_CONTRACT_COMPOSE_PATH="$MUTATED_NAME_COMPOSE" \
+    node "$ROOT_DIR/deploy/trialrun/validate-env-contract.js" >/dev/null 2>&1; then
+    echo "[ERR] fixed Compose container name passed the contract" >&2
+    exit 1
+  fi
+
+  MUTATED_DEPLOY="$DRILL_DIR/deploy-without-project.sh"
+  sed 's/-p "$COMPOSE_PROJECT_NAME" //g' \
+    "$ROOT_DIR/deploy/trialrun/deploy.sh" >"$MUTATED_DEPLOY"
+  if ENV_CONTRACT_DEPLOY_SCRIPT_PATH="$MUTATED_DEPLOY" \
+    node "$ROOT_DIR/deploy/trialrun/validate-env-contract.js" >/dev/null 2>&1; then
+    echo "[ERR] deployment without an explicit Compose project passed the contract" >&2
+    exit 1
+  fi
+fi
+
 docker run -d --rm --name "$CONTAINER_NAME" \
   -e "POSTGRES_USER=$POSTGRES_USER" \
   -e "POSTGRES_PASSWORD=$POSTGRES_PASSWORD" \