informed-decision/docs/evidence/2026-10-11-purpose-image-release/native-backup-restore-protocol.md

Protected native backup/restore and image-only release protocol

Prepared protocol for INFD-WP-0009-T04/purpose-overlay-v1. No actual native backup, data export, restore, workload change or approval is recorded here. Candidate registry image identity remains a prerequisite; only after actual artifact proof may the founder approve one exact conditional protocol/rollout packet. The config-only7db8485 approval is outside this scope.

Preconditions and protected custody

Freeze exact candidate and prior7f5c6cb image digests, source/installed policy hashes, current manually managed Argo Application/revision, runtime ConfigMap6c221878d051, Deployment UID/template/spec, schema5, policy package pins, database path /data/private/review.sqlite, PVC binding, replicas1/Recreate and stable keys for intended verification. Confirm no concurrent writer or custody change. Use fixed metadata; never fetch Secret objects or token values. A changed image/config/schema/owner invalidates the packet. Fresh resources/headroom and exact source/native server-dry-run/diff remain required.

Backups are private evidence containing real decision records, not logs or packet attachments. Allocate a unique backup directory under existing protected PVC custody, owned10001, mode0700, snapshot file0600, no symlink/hardlink/reused output path. An off-cluster copy belongs only in the already established ignored .private-backups/<unique-trial-directory> custody with0700/0600 permissions; no Git, StateHub, public object store or terminal-content dump. Record only schema, integrity pass/fail, bounded table/state counts and protected receipt identifier; retain byte digests in protected custody if needed for internal copy identity. No credential, record payload or token fingerprint enters public evidence.

Approved online compatibility drill

Within the explicit founder-approved action, run the existing base image's informed-decision-admin backup --db /data/private/review.sqlite --output <new-private-snapshot> in the actual serving workload. This uses SQLite's backup API for a transactionally consistent snapshot; copying a live main database while ignoring WAL is prohibited. Suppress raw failures/output and retain only sanitized status. Observe schema/integrity and count-only metadata from the resulting snapshot, not record content.

Transfer that consistent snapshot only into protected off-cluster custody through the existing authorized operator lane. The copy is real production data even in build mode. Verify private permissions, unique identity and protected internal digest agreement. Do not export mounted workload credentials or directory trees; copy only the exact snapshot.

Create a separate private disposable restore volume/directory; retain the original snapshot unchanged. Run the exact published candidate with network disabled, no production ConfigMap/token mounts, read-only image and only that isolated volume writable. Override the service entrypoint with the owner's count-only administrative inspection/integrity check; do not start HTTP listeners, audit delivery, requester exchanges or approval operations. The current candidate changes policy.py only and retains the schema/store module bytes; still prove schema5, SQLite integrity and exact bounded counts before/after opening the restored copy. Refuse any migration/downgrade, lost/changed counts, unexpected write class or unknown outcome. Keep pending/uncertain submission and outbox states; never replay, discard or mark them delivered to green the drill. Cleanup only the disposable copy/volume after verified receipt; retain the original protected backup for the approved recovery interval.

This step is actual native-data compatibility evidence once performed. Its previous synthetic fixture checks remain mechanism evidence and cannot be renamed native success. A failed drill stops rollout and remains a failed/unverified outcome in the same trial.

Fresh cutover snapshot and single-writer rollout

After successful actual-data compatibility checks, create another unique SQLite-consistent online snapshot immediately before the image cutover, retaining its point-in-time schema/integrity/count receipt. This is an online transactional snapshot, not a claim that dispatchers or human writes were quiesced. Every later committed record remains in the live database; same-schema rollback retains that database and never restores the earlier snapshot over it. The narrow image-only update does not need dispatcher/configuration/PVC/temporary-pod changes or a schema cutover. If fresh verification shows a migration or any data-restoration requirement, stop and refine the proposal rather than applying this protocol.

The existing Recreate rollout drains/stops the single old writer before starting the new image on the same PVC; the inherited single-writer lock independently refuses concurrent serving processes. Do not add an admin pod, scale-to-zero, dispatcher stop, network-policy rewrite or snapshot overwrite as an improvised image-only step. The existing owner admin backup operation runs inside the admitted serving workload, and its separate protected restore drill runs off-cluster with network disabled and no workload credentials. Those exact custody operations must be enumerated in the founder packet alongside the one Deployment image change.

Once backup/compatibility/preflight gates pass, manually pin the existing Argo Application to the exact reviewed source revision and sync only Deployment/informed-decision with prune false, keeping the current immutable runtime ConfigMap and all other resources. The source patch changes only the image in admission/rendered Deployment; no Secret, PVC, policy, database or dispatcher change is included unless separately enumerated in the final proposal. Observe five-minute readiness and exact image/config/schema/pins. Verify native lifecycle binding using stable keys and an isolated installed-client probe based on a real provider response contaminated with advisory purpose; prove refusal before any write. Do not contaminate the live PDP, create human approvals, read credentials through CLI, or replay unknown external outcomes for testing.

Same-schema rollback and evidence retention

On startup/readiness/binding/refusal failure, retain current database, cutover backup and every post-cutover evidence/uncertain outcome. Restore only the prior7f5c6cb image through the same manual Argo owner path, retaining schema5 and current DB/configuration; never restore an old snapshot over current live evidence just to roll the image back. Verify old image/Ready1, same schema/counts and prior behavior, and reconcile any external effects using existing lifecycle/audit ownership. The narrow overlay's identical store/schema/dependency bytes permit this image-only rollback; it is not permission for a schema downgrade or data loss.

Record original/approved/executed source and image revisions, backup/drill/cutover/rollout timestamps, exact disposition and sanitized outcomes in the existing supervised trial receipt. EUR0 incremental infrastructure estimate uses existing service/storage/operator lane; protected temporary copy/storage consumption and15–30minute recovery time remain operational costs. No EUR incident-loss cap or autonomy grant is inferred. TaskT04 cannot close until actual published image, approved native compatibility and release plus post-release refusal/binding evidence all exist.

Exact release case identifiers

Proposal INFD-WP-0009-T04/purpose-overlay-v1, trial infd-purpose-20261011-r1. Protected native parent /data/private/purpose-overlay-r1 must be unique/non-symlink, owned10001 and0700. The drill snapshot is drill.sqlite, the refreshed pre-cutover snapshot cutover.sqlite, each new0600 file; refuse any existing output. Off-cluster custody is the existing ignored Custodian .private-backups/20261011-infd-purpose-r1 parent0700, files0600; no snapshot is an evidence attachment. Check owner UID, no symlinks, ignored status and free capacity for both native snapshots plus independently protected copies before making any snapshot.

The disposable offline restore volume is infd-purpose-r1-restore-20261011; refuse an existing volume, copy only the selected frozen snapshot, and run exact published candidate763c with networknone/read-only image,128MiB/core1 and no runtime config/token mounts. SQLite PRAGMA integrity_check must return ok, PRAGMA user_version/Store inspection must agree with actual schema5 semantics, and installed admin count-only inspection must match the frozen snapshot. Validate the actual schema representation rather than assume PRAGMA user_version is the schema authority. No synthetic restoration is reported as native restoration. Native original/off-cluster copies remain retained; only the disposable restore copy/volume may be removed under the exact approved cleanup scope.

Mandatory pre-open schema gate and offline command

informed-decision-admin inspect and backup construct Store, which can migrate schemas1–4 to5. Therefore before any Store/admin open, run the exact attached stdlib-only sqlite_readonly.py against the native source database using SQLite URI mode=ro, query_only and one read transaction. Require PRAGMA user_version5, integrity_check=ok and retain count-only baseline. Refuse any other/unknown schema or incomplete integrity/count check before constructing Store; do not infer no migration from a post-open admin report. This native gate has not been executed in this source-preparation stage. Repeat before each native backup/admin operation.

After copying the selected consistent snapshot to the isolated restored private path /restore/review.sqlite, run the same read-only checker before any offline candidate admin/Store opens that copy. Frozen snapshot and restored-copy schema/integrity/count reports must agree exactly; the copied main-file digest must match the selected closed snapshot. Reject oldschema fixtures rather than allow migration. Only after this pre-open gate may the offline candidate admin inspect run.

Offline command vectors use exactimage forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a, --network none --read-only --cpus 1 --memory 128m, private restored volume mounted at /restore, and no runtime config/credential/token mounts. First override entrypoint to python, arguments - --db /restore/review.sqlite, streaming only the verified attached checker on stdin. Then override entrypoint to informed-decision-admin, arguments inspect --db /restore/review.sqlite. This does not start informed-decision-container, the HTTP service, dispatcher or delivery workers. Compare the admin's schema/lifecycle/outbox/submission counters to the frozen pre-open snapshot report; integrity and migration-free pre-open proof come from the stdlib checker, not admin output alone.

Live reads and online snapshots may legitimately differ because reviews, intake and delivery can commit concurrently. Exact counter equality is required between the frozen selected snapshot and its offline restored clone; it is not required between a running post-cutover/rollback database and an earlier snapshot. Live count changes must be accounted for as legitimate committed records/state transitions; preserve all current and uncertain entries. Do not discard new commits or restore the old snapshot to force equality. Same-schema image rollback keeps the current live DB, followed by read-only schema5/integrity and count-only health checks; any unexplained evidence loss or required data recovery stops and requires a separate founder decision.

The fresh preflight also independently reads the actual immutable nonsecret ConfigMap and bound PVC: compares sealed UIDs/fullmetadata/PVCspec+volumeName and canonical runtime data checksum, returning no raw runtime data. Same-name deletion/recreation or content/custody drift stops before admission. Secret values remain excluded. Both local and remote optimized Python interpreters are explicitly refused before assertion-based gates.