version: "11.0"
description: "Router reads and local backup publication."
directives:
  - id: E-1110.13
    dos:
      - Parse the target before an SSH connection.
      - Reject a destination that is a filesystem root.
      - Check the remote script folder for symbolic links.
      - Reject the backup when the remote script folder has a symbolic link.
      - List remote script files with NUL separators.
      - Validate each remote script path and file before download.
      - Require each listed file path to start with /config/scripts/.
      - Read each remote script through a checked file descriptor.
      - Download the active config and scripts to a private temporary folder.
      - Set backed-up files to mode 0600.
      - Write config.boot.manifest.tsv with the backed-up script paths.
      - >-
        Write config.boot.deployment.tsv with current-state records for backed-up directories
        and scripts.
      - Keep config.boot.manifest.tsv separate from config.boot.deployment.tsv.
      - Verify each downloaded script against its remote SHA-256 hash.
      - Replace config.boot, scripts, and both manifests as one local update.
      - Restore prior backup files when publication fails.
      - Close the SSH client after success or failure.
      - Report a remote snapshot cleanup failure.
      - Return success after each backup file exists.
    donts:
      - Do not change router config during backup.
      - Do not publish an incomplete backup.
      - Do not follow a remote script link.
      - Do not replace files at a filesystem root.