Repository navigation
docs: record the backup state and restore rehearsal of the beta database - #1091
kodes-agency wants to merge 1 commit into
Conversation
Section 1 of the backup record and sections 6 and 7 of the beta contract no longer mark the backups unverified. They give the state read in Railway on 2026-11-04: point-in-time recovery and daily and weekly backups are on, and a restore into a separate service reached the chosen moment, accepting connections 36.5 minutes after the request for about 15.5 hours of log. The rehearsal tested the data restore only: the application's own verifier was not used and erasure replay was not tested. ADR 0073 gets a dated note that agency adoption was dropped on 2026-10-30, so the consequence about rewriting the import script no longer applies. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ECC Tools / Security EvidenceCommit: Security evidence gate passed (success) No security-sensitive scanner-evidence gap detected. Mode: enforce Scanned 3 changed file(s). No missing scanner-evidence signal was detected. Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
ECC Tools / PR Risk TaxonomyCommit: PR taxonomy clear (success) Scanned 3 changed file(s). No taxonomy bucket signals were detected. Scanned 3 changed file(s). No PR taxonomy bucket signals were detected. Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
ECC Tools / Reference Set ReadinessCommit: Reference set readiness gaps detected (neutral) Reference evidence present for 0/7 areas (0%) across 3 changed file(s). This check is based on files changed in this PR. Repository-level readiness is still reported by
Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
ECC Tools / Hosted Promotion ReadinessCommit: Hosted promotion readiness passed (success) No hosted promotion evidence gaps detected across 3 changed file(s); 0 corpus scenarios had matching evidence. This check compares PR file changes against the evaluator/RAG promotion corpus in No evaluator corpus scenarios matched this PR. Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
What changed
docs/operations/backup-and-lifecycle.mdsection 1 no longer marks the beta database's backups unverified or quotes the August inspection. It records what was found in Railway on 2026-11-04: point-in-time recovery is on forPostgresinclosed-beta-v2(restore window about four weeks per Railway's documentation, no restore point earlier than 2026-11-04), daily and weekly backups are on, and a restore into a separate service reached the chosen moment, accepting connections 36.5 minutes after the request for about 15.5 hours of log. A restore can lose about one minute of data. It also adds two handling notes for restored copies, and says that the app's ownrestore-verifystill binds tocell-usand was not used.docs/BETA.mdsections 6 and 7 replace their two UNVERIFIED markers with the same finding, and the change log gets a line. A test holds those two passages and the backup record to each other.docs/adr/0073-reply-voice-and-shared-reply-templates.mdgets a dated note that agency adoption was dropped on 2026-10-30, so the consequence about rewriting the import script no longer applies.What the rehearsal did not show: it tested the data restore only. It did not time a full restore to operational state, did not measure a worst case, and did not test erasure replay, which does not run today. The docs say so.
How it was tested
src/shared/db/beta-database-documents.test.tsfails with the backup record updated anddocs/BETA.mdunchanged, and passes with both updated.prettier --checkon the three changed files passes.*.integration.test.tsfiles that match the search only namedocs/BETA.mdin comments, so they were left to CI.🤖 Generated with Claude Code