docs(dr): start W3 restore confidence #430

Merged

pdurlej merged 1 commit from codex/w3/dr-restore-confidence into main

2026-05-24 16:25:48 +02:00

codex commented

2026-05-24 16:21:40 +02:00

Collaborator

Canary status: missing - docs/status W3 preflight; rely on required Forgejo checks before merge

Canary Context Pack

Product story

W3 is the restore-confidence wave. Before legacy cleanup or broad upgrades, the operator needs a concrete answer to: do current backups actually restore, and what evidence is still missing?

What changed

Reconciles runbooks/dr-restore-test.md with current RS2000 evidence.
Adds state/reports/w3-dr-restore-preflight-2026-05-24.md with read-only backup/restore status.
Adds state/cycle/W3-dr-restore-confidence-output.md as the W3 operator-visible cycle record.
Updates state/STATUS_NOW.md and roadmap to mark W3 active and restore execution gated.

Why it changed

The old restore-test-stale signal is partly obsolete: hp-restore-smoke.service succeeded on 2026-05-05 and backup timers are green. But that smoke only restores Forgejo SQL into a disposable Postgres container, so W3 remains open until Honcho and broader sandbox restore evidence exist.

Files touched

runbooks/dr-restore-test.md
state/STATUS_NOW.md
state/roadmap/current-platform-roadmap.md
state/cycle/W3-dr-restore-confidence-output.md
state/reports/w3-dr-restore-preflight-2026-05-24.md

Runtime evidence

Read-only RS2000 evidence captured 2026-05-24 16:16 CEST:

/opt/pdurlej-platform/current -> releases/dc7b1454e97d091c5d580e3597dd24e0bee24011
/srv/baseline-mirror/iskra-platform-2026-04-30 exists with baseline metadata and recovery directories.
hp-backup-critical.timer: active; last success 2026-05-24 12:02 CEST.
hp-backup-noncritical.timer: active; last success 2026-05-24 03:42 CEST.
hp-restore-smoke.timer: active; next run 2026-06-02 03:45 CEST.
hp-restore-smoke.service: last success 2026-05-05 03:45 CEST.
Existing restore smoke creates/removes a disposable restore-test-postgres container and restores only db/forgejo.sql.

Known constraints

This PR does not run a restore drill.
This PR does not mutate production runtime.
Actual W3 restore execution is gated because even disposable Docker restore tests create runtime objects.

Explicit out-of-scope

Production restore.
Production restart.
Release-root promotion.
Legacy cleanup or deletion.
Broad module upgrades.
Printing or storing raw private memory/session/message contents.

Requested decision

Merge as W3a preflight/contract. After merge, the next operator phrase is w3-restore-smoke-approved if you want Codex to run W3b.

Merge blockers

Any contradiction between STATUS_NOW.md, roadmap, and W3 cycle output.
Any missing proof that W3 remains gated before restore execution.
Any failed required Forgejo check.

Spec sources read

state/roadmap/current-platform-roadmap.md - W3/Milestone 02 scope and gates.
state/STATUS_NOW.md - canonical operator-facing status.
runbooks/dr-restore-test.md - existing restore-test runbook.
scripts/cutover/README.md - backup class and backup-before context.
scripts/cutover/backup-before-apply.sh - existing backup helper behavior.
Forgejo issues #45 and #238 - acceptance criteria for stale restore-test and DR restore test.

Test plan

python3 "$CODEX_HOME/skills/bmadx/scripts/sync_bmadx.py" check --gear X3 --compact -> allowed.
git diff --cached --check
Read-only RS2000 checks only; no apply/promote/restart/restore execution.

Canary status: missing - docs/status W3 preflight; rely on required Forgejo checks before merge ## Canary Context Pack ### Product story W3 is the restore-confidence wave. Before legacy cleanup or broad upgrades, the operator needs a concrete answer to: do current backups actually restore, and what evidence is still missing? ### What changed - Reconciles `runbooks/dr-restore-test.md` with current RS2000 evidence. - Adds `state/reports/w3-dr-restore-preflight-2026-05-24.md` with read-only backup/restore status. - Adds `state/cycle/W3-dr-restore-confidence-output.md` as the W3 operator-visible cycle record. - Updates `state/STATUS_NOW.md` and roadmap to mark W3 active and restore execution gated. ### Why it changed The old restore-test-stale signal is partly obsolete: `hp-restore-smoke.service` succeeded on 2026-05-05 and backup timers are green. But that smoke only restores Forgejo SQL into a disposable Postgres container, so W3 remains open until Honcho and broader sandbox restore evidence exist. ### Files touched - `runbooks/dr-restore-test.md` - `state/STATUS_NOW.md` - `state/roadmap/current-platform-roadmap.md` - `state/cycle/W3-dr-restore-confidence-output.md` - `state/reports/w3-dr-restore-preflight-2026-05-24.md` ### Runtime evidence Read-only RS2000 evidence captured 2026-05-24 16:16 CEST: - `/opt/pdurlej-platform/current -> releases/dc7b1454e97d091c5d580e3597dd24e0bee24011` - `/srv/baseline-mirror/iskra-platform-2026-04-30` exists with baseline metadata and recovery directories. - `hp-backup-critical.timer`: active; last success 2026-05-24 12:02 CEST. - `hp-backup-noncritical.timer`: active; last success 2026-05-24 03:42 CEST. - `hp-restore-smoke.timer`: active; next run 2026-06-02 03:45 CEST. - `hp-restore-smoke.service`: last success 2026-05-05 03:45 CEST. - Existing restore smoke creates/removes a disposable `restore-test-postgres` container and restores only `db/forgejo.sql`. ### Known constraints - This PR does not run a restore drill. - This PR does not mutate production runtime. - Actual W3 restore execution is gated because even disposable Docker restore tests create runtime objects. ### Explicit out-of-scope - Production restore. - Production restart. - Release-root promotion. - Legacy cleanup or deletion. - Broad module upgrades. - Printing or storing raw private memory/session/message contents. ### Requested decision Merge as W3a preflight/contract. After merge, the next operator phrase is `w3-restore-smoke-approved` if you want Codex to run W3b. ### Merge blockers - Any contradiction between `STATUS_NOW.md`, roadmap, and W3 cycle output. - Any missing proof that W3 remains gated before restore execution. - Any failed required Forgejo check. ## Spec sources read - `state/roadmap/current-platform-roadmap.md` - W3/Milestone 02 scope and gates. - `state/STATUS_NOW.md` - canonical operator-facing status. - `runbooks/dr-restore-test.md` - existing restore-test runbook. - `scripts/cutover/README.md` - backup class and backup-before context. - `scripts/cutover/backup-before-apply.sh` - existing backup helper behavior. - Forgejo issues #45 and #238 - acceptance criteria for stale restore-test and DR restore test. ## Test plan - `python3 "$CODEX_HOME/skills/bmadx/scripts/sync_bmadx.py" check --gear X3 --compact` -> allowed. - `git diff --cached --check` - Read-only RS2000 checks only; no apply/promote/restart/restore execution.

codex added 1 commit

2026-05-24 16:21:40 +02:00

docs(dr): start W3 restore confidence

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / collect-diff (pull_request) Successful in 5s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

canary-required / canary (pull_request) Has been skipped

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 23s