//! Multi-context backup orchestrator: restic-first with kopia opt-in, multi-destination replication, ontoref-driven docs.
//!
//! `backup-manager` runs in four modes that share a single binary, configuration
//! loader, schema set, and event surface:
//!
//! - **one-shot** — invoked by a scheduler (Kubernetes CronJob, system cron,
//!   systemd timer). Loads the policy, executes the requested operation
//!   (`backup`, `restore`, `verify`, `prune`, `list`), reports through metrics
//!   and NATS events, terminates.
//! - **daemon** — long-running orchestrator. Holds a priority queue, enforces
//!   concurrency budgets, reloads policies via [`platform_config`] watcher,
//!   exposes a local HTTP/Unix socket API, and emits Prometheus metrics on a
//!   dedicated endpoint.
//! - **standalone** — workstation mode. Connects to a destination directly with
//!   the operator's age key and runs `mount`, `restore`, or `list` without
//!   needing the cluster, the daemon, or even a Nickel runtime (the binary
//!   embeds the schema subset required to deserialise policies).
//! - **coordinator** — orchestrates `BackupGroup` consistent cuts across
//!   members. Tags every member's snapshot with the same `group_id` and
//!   `group_ts` so a single timestamp recovers the whole group.
//!
//! ## Schema integration
//!
//! Policies are declared in Nickel (`provisioning/schemas/lib/backup_policy.ncl`,
//! `backup_group.ncl`, `system_backup.ncl`, `verify_policy.ncl`, `concerns.ncl`).
//! The Nickel layer enforces three invariants at export time:
//!
//! - `EncryptionRequired` — every [`BackupProvider`](policy::BackupProvider)
//!   must declare `features.encryption = true`.
//! - `MultiDestinationRequired` — every enabled
//!   [`BackupPolicy`](policy::BackupPolicy) must declare ≥2 destinations,
//!   at least one with `role = 'primary`.
//! - `NonEmptyScopes` — every enabled `BackupPolicy` must list at least one
//!   `BackupScope`.
//!
//! ## Custody model (ADR-011)
//!
//! Four custody boxes, never co-dependent: keys live in `secretumvault`,
//! definitions in git, data in ≥2 destinations, production in the cluster.
//! Standalone restore needs only one custody box plus the bootstrap key.
//!
//! ## ontoref integration
//!
//! This crate is registered as the `backup-manager` Practice node in
//! `.ontology/core.ncl`. `ontoref generate-mdbook` extracts this `//!` and
//! produces architecture documentation automatically. The first sentence above
//! is Jaccard-aligned with the node `description` and validated by
//! `ontoref sync diff --docs`.

#![forbid(unsafe_code)]
#![warn(missing_docs)]
#![warn(rust_2018_idioms)]

pub mod config;
pub mod error;
pub mod modes;
pub mod policy;

pub use config::BackupManagerConfig;
pub use error::{BackupError, Result};
