coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Bind isolated restore to fetched artifact and document archive integrity gates
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
This commit is contained in:
codex 2026-09-05 22:21:54 +02:00
parent 0cca68da96
commit 480d181549
4 changed files with 41 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

26
docs/backup-credential-recovery.md
View file

@ -98,3 +98,29 @@ a cleanup failure after CAS can occur after credentials have already changed.
Refresh `actcore-backup-offsite`, verify delivery by contained comparison, and
restart its three environment consumers (`actcore-api`, `actcore-event-router`,
`actcore-worker`). Record their readiness and loaded-value comparisons.
## Real archive acceptance
`capture_forgejo_archive.py` requires the exact producer's successful exit marker,
checks every transferred chunk's length and the complete SHA-256 against the
producer, then validates ZIP structure and member CRCs before encryption. The
2026-09-05 recovery attempt exposed a truncated September 4 encrypted archive;
successful age decryption and upload alone cannot certify backup completeness.
`verify_nextcloud_offsite_restore.py` streams a real encrypted archive through
the current upload lane and downloads it separately through owner recovery
custody. It emits a hash-bound transfer receipt. Run this silent helper through
the attended Warden envelope, with fresh private staging and receipt paths.
`restore_forgejo_offsite_locally.py` requires both that receipt and the fetched
archive. Its disposable local Docker network is internal, exposes no host ports,
and uses an independent database password/configuration. Production app.ini is
never activated. It checks database import, application health, repository API
and clone/fsck, and package blob integrity; cleanup removes its named containers,
anonymous volumes, network and extracted staging. Remaining fetched plaintext
must be removed after the acceptance receipt is preserved.
This bounded application-data recovery does not test replacement runners or
prove that every restored package can be installed or every image pulled.
Package-consumer acceptance and broader disaster-recovery guarantees remain
with their owning assurance tasks. Full backups share the account's 10 GiB
quota; a newly measured archive size must inform the separate retention decision.