The architecture set.

A homelab follows from three answers. Everything downstream is a consequence of them.

One box, one service, one owner. One backup on another failure domain. One restore that has worked. One alert path that reaches you.

Trust boundaries are physical, not conceptual. A boundary is a wall with named doors. Deny cross-zone by default. Allow only documented flows.

A backup is a claim. A restore is evidence. Each stage crosses a failure boundary, keeps its own credentials, and leaves a dated record.

The agent came last. It uses the same typed operations a person already trusts. Policy decides. Live verification closes the record.