dr(w3): prove local sandbox restore #520

Merged

pdurlej merged 1 commit from codex/w3d-local-sandbox-drill into main

2026-05-27 11:20:38 +02:00

codex commented

2026-05-27 10:57:09 +02:00

Collaborator

Canary status: missing - not fired; touched scripts/dr/ and state/ evidence only, not mandatory canary paths.

Canary Context Pack

Product story

W3d should stop being a plan and become concrete restore evidence before destructive cleanup or broader upgrade work. This PR records a local sandbox restore pass that exercises Forgejo, Honcho, Postgres, Redis, and Traefik together from the current RS2000 critical backup.

What changed

Added scripts/dr/w3d-local-sandbox-drill.sh, a repeatable local Docker-host restore harness.
Added state/reports/w3d-local-sandbox-drill-2026-05-27.md with metadata-only PASS evidence.
Updated W3 output and STATUS_NOW to reflect W3d local pass and the remaining optional/deeper disposable VPS pass.

Why it changed

The operator chose W3d option 1 first: local sandbox restore before a disposable VPS pass. This proves multi-service restore choreography without production mutation.

Files touched

scripts/dr/w3d-local-sandbox-drill.sh
state/reports/w3d-local-sandbox-drill-2026-05-27.md
state/cycle/W3-dr-restore-confidence-output.md
state/STATUS_NOW.md

Relevant context

#433 W3d full sandbox DR lane.
state/reports/w3d-full-sandbox-preflight-2026-05-27.md
state/cycle/W3-dr-restore-confidence-output.md

Runtime evidence

Final local run: PASS.

Backup root: /opt/vps-home-platform-infra/backups/20260527-060017-critical
Restored topology: Forgejo SQL/data, Honcho SQL, Postgres, pgvector Postgres, Redis, Honcho Redis, Traefik fake ingress.
Health: Forgejo/Honcho/Postgres/Redis services healthy; Traefik running.
Routed smokes: Traefik ping 200, Forgejo /api/healthz via fake ingress 200, Honcho /openapi.json via fake ingress 200.
RTO from backup-on-disk locally to first routed requests: 101 seconds.
Total elapsed including read-only backup staging from RS2000: 210 seconds.
Final cleanup removed local Compose project, containers, networks, volumes, and temp workspace.

Known constraints

No production restore was executed. RS2000 interaction was read-only backup discovery/copy and image streaming. Bitwarden in the script environment reported locked; the local pass only confirms CLI visibility plus Infisical Token Auth script syntax, not a full fresh-machine secret bootstrap.

Explicit out-of-scope

Disposable VPS pass.
Production restore/restart/apply/promote.
Destructive legacy cleanup.
Semantic OpenClaw/Iskra behavior verification.

Requested decision

Merge as W3d local sandbox restore evidence. Keep #433 open if the operator wants a deeper disposable VPS pass before opening destructive cleanup.

Merge blockers

Evidence contains private raw data or secrets.
The report overclaims production restore acceptance.
The harness is not repeatable or leaves local Docker resources behind on success.

Spec sources read

AGENTS.md - repo operating contract.
docs/forgejo-agent-operations.md - Forgejo write/comment identity contract.
state/cycle/W3-dr-restore-confidence-output.md - W3 acceptance shape and W3d target.
state/reports/w3d-full-sandbox-preflight-2026-05-27.md - current read-only backup preflight evidence.
state/STATUS_NOW.md - canonical operator-facing wave status.

Refs #433

Canary status: missing - not fired; touched `scripts/dr/` and `state/` evidence only, not mandatory canary paths. ## Canary Context Pack ### Product story W3d should stop being a plan and become concrete restore evidence before destructive cleanup or broader upgrade work. This PR records a local sandbox restore pass that exercises Forgejo, Honcho, Postgres, Redis, and Traefik together from the current RS2000 critical backup. ### What changed - Added `scripts/dr/w3d-local-sandbox-drill.sh`, a repeatable local Docker-host restore harness. - Added `state/reports/w3d-local-sandbox-drill-2026-05-27.md` with metadata-only PASS evidence. - Updated W3 output and `STATUS_NOW` to reflect W3d local pass and the remaining optional/deeper disposable VPS pass. ### Why it changed The operator chose W3d option 1 first: local sandbox restore before a disposable VPS pass. This proves multi-service restore choreography without production mutation. ### Files touched - `scripts/dr/w3d-local-sandbox-drill.sh` - `state/reports/w3d-local-sandbox-drill-2026-05-27.md` - `state/cycle/W3-dr-restore-confidence-output.md` - `state/STATUS_NOW.md` ### Relevant context - #433 W3d full sandbox DR lane. - `state/reports/w3d-full-sandbox-preflight-2026-05-27.md` - `state/cycle/W3-dr-restore-confidence-output.md` ### Runtime evidence Final local run: `PASS`. - Backup root: `/opt/vps-home-platform-infra/backups/20260527-060017-critical` - Restored topology: Forgejo SQL/data, Honcho SQL, Postgres, pgvector Postgres, Redis, Honcho Redis, Traefik fake ingress. - Health: Forgejo/Honcho/Postgres/Redis services healthy; Traefik running. - Routed smokes: Traefik ping `200`, Forgejo `/api/healthz` via fake ingress `200`, Honcho `/openapi.json` via fake ingress `200`. - RTO from backup-on-disk locally to first routed requests: `101` seconds. - Total elapsed including read-only backup staging from RS2000: `210` seconds. - Final cleanup removed local Compose project, containers, networks, volumes, and temp workspace. ### Known constraints No production restore was executed. RS2000 interaction was read-only backup discovery/copy and image streaming. Bitwarden in the script environment reported `locked`; the local pass only confirms CLI visibility plus Infisical Token Auth script syntax, not a full fresh-machine secret bootstrap. ### Explicit out-of-scope - Disposable VPS pass. - Production restore/restart/apply/promote. - Destructive legacy cleanup. - Semantic OpenClaw/Iskra behavior verification. ### Requested decision Merge as W3d local sandbox restore evidence. Keep #433 open if the operator wants a deeper disposable VPS pass before opening destructive cleanup. ### Merge blockers - Evidence contains private raw data or secrets. - The report overclaims production restore acceptance. - The harness is not repeatable or leaves local Docker resources behind on success. ## Spec sources read - `AGENTS.md` - repo operating contract. - `docs/forgejo-agent-operations.md` - Forgejo write/comment identity contract. - `state/cycle/W3-dr-restore-confidence-output.md` - W3 acceptance shape and W3d target. - `state/reports/w3d-full-sandbox-preflight-2026-05-27.md` - current read-only backup preflight evidence. - `state/STATUS_NOW.md` - canonical operator-facing wave status. Refs #433

codex added 1 commit

2026-05-27 10:57:09 +02:00

dr(w3): prove local sandbox restore

base-is-main / guard (pull_request) Successful in 2s

Details

canary-required / collect-diff (pull_request) Successful in 5s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

canary-required / canary (pull_request) Has been skipped