電子カルテが止まれば地域医療が止まる——保守用VPNの盲点と「診療を止めない二重防御」とは？

#![forbid(unsafe_code)]

#[derive(Debug, Clone, Copy)]
pub struct HealthcareBackupState {
    pub total_copies: u8,           // >= 3
    pub distinct_media_types: u8,   // >= 2 (e.g., NVMe ZFS Pool + Offline LTO/RDX/Air-Gapped ZFS)
    pub offsite_copies: u8,         // >= 1
    pub immutable_airgap_copies: u8,// >= 1 (ZFS hold + Pull-only vLAN 99)
    pub verification_errors: u32,   // == 0 (zfs scrub & test restore checksum errors)
    pub latest_snapshot_age_secs: u64,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum Guideline6Compliance {
    Compliant32110,
    ViolationMissingImmutableCopy,
    ViolationRpoExceeded,
    ViolationUnverifiedIntegrity,
    ViolationInsufficientRedundancy,
}

/// Audits a clinic/hospital backup topology against the 3-2-1-1-0 rule and
/// 3-Ministry 2-Guidelines v6.0 Section 13 (BCP & Ransomware Recovery).
pub fn verify_medical_backup_compliance(
    state: &HealthcareBackupState,
    max_rpo_secs: u64,
) -> Guideline6Compliance {
    if state.verification_errors > 0 {
        return Guideline6Compliance::ViolationUnverifiedIntegrity;
    }
    if state.immutable_airgap_copies < 1 {
        return Guideline6Compliance::ViolationMissingImmutableCopy;
    }
    if state.total_copies < 3 || state.distinct_media_types < 2 || state.offsite_copies < 1 {
        return Guideline6Compliance::ViolationInsufficientRedundancy;
    }
    if state.latest_snapshot_age_secs > max_rpo_secs {
        return Guideline6Compliance::ViolationRpoExceeded;
    }
    Guideline6Compliance::Compliant32110
}