# BAT-002 Planning

## Included REQ
- REQ-002: 운영 안전 백업·복구·검증 DB 워크플로우

## Delivery Plan
1. Add service helpers for non-sensitive DB status evidence and SQLite online backup creation.
2. Add additive MCP tools for backup creation, backup list, backup status/hash, and DB status.
3. Add a non-MCP restore smoke script requiring explicit approval for overwriting an existing target DB.
4. Add synthetic DB tests for status evidence, backup/list/status/hash, retention, and restore smoke policy.
5. Update runtime/data/interface docs and add a runbook.
6. Run targeted/full verification and request jarcaledgerqc QC gate.

## Dependencies
- Existing SQLite initialization and additive migration behavior in `jarca_ledger_mcp/db.py`.
- Existing service response convention: `{"success": True, ...}` and `fail(...)` error shape.
- Synthetic pytest tmp DBs for safe evidence.

## Design Gate
Design required: yes.

Reason: this batch changes the MCP interface surface and runtime/data safety baseline, and must explicitly preserve restore non-exposure and sensitive evidence restrictions.

## Milestones
- M1: REQ-002 Approved and BAT-002 scaffolded.
- M2: Backup/status/list/hash helpers and MCP tools implemented.
- M3: Restore smoke script and runbook documented without MCP restore surface.
- M4: Synthetic tests and docs evidence complete.
- M5: QC gate PASS/PASS_WITH_NOTES, then REQ-002 Implemented.

## Risks
- Accidentally exposing restore as MCP would violate dcy-002 policy.
- SQLite WAL copy must be consistent; implementation should use SQLite online backup API rather than raw file copy for backup creation.
- Evidence must not serialize sensitive row-level details.