a3ca4b708f
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
46 lines
2.8 KiB
Markdown
46 lines
2.8 KiB
Markdown
# Backup tiers implementation and recovery evidence
|
|
|
|
Implemented and live-verified the two data paths under WP-0038-T04. The full
|
|
5.35 GB encrypted archive now has a separate Scaleway application-archive copy
|
|
and passed actual retrieval, decryption and isolated Forgejo recovery, including
|
|
all 2,040 package blob hashes. Native database backup remains independently active.
|
|
|
|
The explicit essentials profile produced a 286,298,520-byte encrypted archive
|
|
(273 MiB), about 94.7% smaller. It preserves all 142 repository roots, database,
|
|
configuration and unique-data categories. The manifest declares omitted packages,
|
|
generated archives/indexes/logs and the reduced recovery contract. Its real
|
|
Nextcloud round trip and isolated recovery passed with package service disabled,
|
|
142 repository records, six users, and two successful Git clone/fsck checks.
|
|
The newer essentials database has 2,050 blob metadata records; these two captures
|
|
are different recovery points, not a synchronized full/essential pair.
|
|
|
|
Public pinned recovery images were fetched without the production registry or
|
|
Scaleway. Inventory found 21 container, two npm and two Python packages; no blanket
|
|
rebuildability claim is made. Five other database clusters total about 209 MiB
|
|
physical storage, a sizing input rather than compressed backup coverage proof.
|
|
|
|
Implemented tested retention planning and a separate attended owner executor:
|
|
protected recovered anchor, known verified names only, incoming headroom,
|
|
retained-object checks, ciphertext anchor revalidation, conditional ETag deletion
|
|
and a single-writer local lock. Workload delivery remains create-only. No retained
|
|
full archive or provider retention setting was changed.
|
|
|
|
Initial capture/transfer attempts failed before useful diagnostics; safe stage
|
|
and exception-type diagnostics were added. Retried operations passed. Their
|
|
precise initial failure cause was not established. No raw captured credential
|
|
outputs were inspected or recorded.
|
|
|
|
Remaining T04 gate is operational activation: bind durable scheduling/caller and
|
|
its dependencies, canonical generation names and verified inventory, plus the
|
|
separate owner retention/fresh-quota operation. Current local cron still invokes
|
|
the old full-to-Nextcloud helper. This turn's manual tests do not close recurring
|
|
primary coverage or authorize silently dropping a recovery component.
|
|
|
|
Evidence is under `docs/evidence/RPF-WP-0038-*.json`; the complete operational
|
|
contract and limitations are in `docs/backup-storage-tiers.md`.
|
|
|
|
All 221 repository tests passed. Removed the three drill plaintext ZIPs after
|
|
verified recovery; all good encrypted copies and provider backups remain.
|
|
Current create-only workload credentials cannot perform owner quota/expiration.
|
|
The new owner executor remains attended; no owner password or new delete grant
|
|
was delivered to a workload. Operational binding remains explicit in T04.
|