pdurlej/platform

Fork 0

fix(backups): codify RS2000 unique-knowledge retention #839

Merged

pdurlej merged 2 commits from codex/795-unique-knowledge-retention into main

2026-06-26 14:53:55 +02:00

codex commented

2026-06-26 13:45:01 +02:00

Collaborator

Canary status: missing — fire canary 3+3 manually before merge

Canary Context Pack

Product story

RS2000 unique-knowledge backups should be visibly healthy and bounded so future agents read green state as green state instead of treating old backup growth or a stale failed unit as active fire.

What changed

Added a metadata-only RS2000 unique-knowledge retention helper.
Documented the keep-newest-8 local retention policy.
Recorded 2026-06-26 runtime evidence for green backup, local restore, offsite restore, and dry-run reclaim.
Added fixture-only tests for dry-run, execute safety, and generated-file deletion boundaries.

Why it changed

Issue #795 required backup health evidence and a documented retention policy before any archive deletion.

Files touched

scripts/backup/unique_knowledge_retention.py
tests/test_unique_knowledge_backup.py
scripts/backup/README.md
runbooks/unique-knowledge-backup.md
state/reports/unique-knowledge-backup-health-2026-06-26.md

Relevant context

runbooks/unique-knowledge-backup.md
scripts/backup/README.md
scripts/backup/rs2000_unique_knowledge_backup.sh
scripts/backup/unique_knowledge_backup.py
state/reports/rs2000-runtime-health-closeout-2026-06-17.md

Runtime evidence

RS2000 backup service is green from a real 2026-06-26 backup path. Latest run 20260625T220004Z has local and offsite restore receipts. Dry-run retention on RS2000 found 22 archive runs, keeps 8, and estimates 31,505,975,426 bytes reclaim with deleted=0.

Known constraints

No archive contents, secret values, token files, rclone config contents, or pCloud credentials were read or printed. Real deletion still requires scoped operator approval and --execute.

Explicit out-of-scope

Executing retention deletion on RS2000.
Credential rotation or broadening.
Changing the backup timer or offsite destination.

Requested decision

Approve the source-controlled retention policy and helper. Runtime deletion can be performed separately after reviewing dry-run output.

Merge blockers

The retention helper must remain metadata-only and generated-file scoped.
Tests must pass.
Any reviewer finding that the helper can delete outside the backup root blocks merge.

Spec sources read

runbooks/unique-knowledge-backup.md
scripts/backup/README.md
scripts/backup/rs2000_unique_knowledge_backup.sh
scripts/backup/unique_knowledge_backup.py
scripts/backup/restore_check.py — needed to verify receipt naming and restore evidence shape
scripts/backup/sync_unique_knowledge_to_old_mac.sh — needed to reuse existing keep-newest retention policy semantics
tests/test_unique_knowledge_backup.py — needed for focused fixture tests
tests/test_host_ops_backup_retention.py — needed for existing retention test style
state/reports/rs2000-runtime-health-closeout-2026-06-17.md

Verification

PYTHONPATH=. python3 -m pytest tests/test_unique_knowledge_backup.py
python3 -m py_compile scripts/backup/unique_knowledge_retention.py
RS2000 dry-run via SSH/stdin, no --execute: matched 28 files, estimated 31,505,975,426 bytes, deleted 0.

Closes #795

Canary status: missing — fire canary 3+3 manually before merge ## Canary Context Pack ### Product story RS2000 unique-knowledge backups should be visibly healthy and bounded so future agents read green state as green state instead of treating old backup growth or a stale failed unit as active fire. ### What changed - Added a metadata-only RS2000 unique-knowledge retention helper. - Documented the keep-newest-8 local retention policy. - Recorded 2026-06-26 runtime evidence for green backup, local restore, offsite restore, and dry-run reclaim. - Added fixture-only tests for dry-run, execute safety, and generated-file deletion boundaries. ### Why it changed Issue #795 required backup health evidence and a documented retention policy before any archive deletion. ### Files touched - scripts/backup/unique_knowledge_retention.py - tests/test_unique_knowledge_backup.py - scripts/backup/README.md - runbooks/unique-knowledge-backup.md - state/reports/unique-knowledge-backup-health-2026-06-26.md ### Relevant context - runbooks/unique-knowledge-backup.md - scripts/backup/README.md - scripts/backup/rs2000_unique_knowledge_backup.sh - scripts/backup/unique_knowledge_backup.py - state/reports/rs2000-runtime-health-closeout-2026-06-17.md ### Runtime evidence RS2000 backup service is green from a real 2026-06-26 backup path. Latest run `20260625T220004Z` has local and offsite restore receipts. Dry-run retention on RS2000 found 22 archive runs, keeps 8, and estimates 31,505,975,426 bytes reclaim with `deleted=0`. ### Known constraints No archive contents, secret values, token files, rclone config contents, or pCloud credentials were read or printed. Real deletion still requires scoped operator approval and `--execute`. ### Explicit out-of-scope - Executing retention deletion on RS2000. - Credential rotation or broadening. - Changing the backup timer or offsite destination. ### Requested decision Approve the source-controlled retention policy and helper. Runtime deletion can be performed separately after reviewing dry-run output. ### Merge blockers - The retention helper must remain metadata-only and generated-file scoped. - Tests must pass. - Any reviewer finding that the helper can delete outside the backup root blocks merge. ## Spec sources read - runbooks/unique-knowledge-backup.md - scripts/backup/README.md - scripts/backup/rs2000_unique_knowledge_backup.sh - scripts/backup/unique_knowledge_backup.py - scripts/backup/restore_check.py — needed to verify receipt naming and restore evidence shape - scripts/backup/sync_unique_knowledge_to_old_mac.sh — needed to reuse existing keep-newest retention policy semantics - tests/test_unique_knowledge_backup.py — needed for focused fixture tests - tests/test_host_ops_backup_retention.py — needed for existing retention test style - state/reports/rs2000-runtime-health-closeout-2026-06-17.md ## Verification - `PYTHONPATH=. python3 -m pytest tests/test_unique_knowledge_backup.py` - `python3 -m py_compile scripts/backup/unique_knowledge_retention.py` - RS2000 dry-run via SSH/stdin, no `--execute`: matched 28 files, estimated 31,505,975,426 bytes, deleted 0. Closes #795

codex added 1 commit

2026-06-26 13:45:01 +02:00

fix(backups): codify unique-knowledge retention

python-ci / Python 3.11 (pull_request) Successful in 40s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 17s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 2m18s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 5s

Details

python-ci / Python 3.12 (pull_request) Successful in 43s

Details

python-ci / Python 3.13 (pull_request) Successful in 42s

Details

canary-required / canary (pull_request) Successful in 16s

Details

8828fe58e9

patchwarden commented

2026-06-26 13:50:16 +02:00

First-time contributor

Patchwarden PR sanity

Operator signal: ✅ GO - Patchwarden can hand this exact head to the approval controller.

Automerge signal: 🟡 CONTROLLER ONLY - approval-ready, but outside the narrow safe-docs/status automerge lane.

Verdict: ✅ PASS - deterministic checks and configured reviewers are clean.

Next step: Continue through required Forgejo approval and the automerge controller.

PR: 839
Commit: e460972b7ab8c6f07578d98c6dd05f8e14b398a1
Status: eligible_sanity_clean
Reviewer health: clean
Security-sensitive label: missing
Authority: Patchwarden policy signal; branch protection and automerge controller remain merge authority.
Model mix: glm-5.2:cloud, deepseek-v4-pro:cloud, kimi-k2.7-code:cloud

What I checked

Changed files: 5
Deterministic blocker scan: clean
External Forgejo gates: not_reported
Model reviewer lanes: 3
Comment contract: this comment is updated in place via a hidden Patchwarden marker.

Approval Handoff

State: ready_for_external_controller_review
Action: external controller may publish an APPROVED review for this exact head.
Boundary: branch protection and the automerge controller remain merge authority.

Signal Board

Legend: ✅ evidence is sufficient; 🟡 controller still has work; ⚠️ automation retries first; 🛑/❌ do not approve or merge.

Lane	Signal	Meaning
🧪 Deterministic sanity	✅ `clean`	No deterministic blockers found.
🧩 External Forgejo gates	🟡 `not reported`	No external gate snapshot was included in this report.
🧠 Model reviewers	✅ `clean`	Configured reviewers returned OK.
🛡️ Patchwarden approval	✅ `ready`	Exact-head sanity is clean; approval controller may continue.
🚦 Unattended automerge	❌ `ineligible`	Outside the narrow safe-docs/status unattended lane.
🙋 Owner attention	✅ `not needed`	No operator handoff is needed from this comment.

Scope blocker: non-doc/status path(s): scripts/backup/README.md, scripts/backup/unique_knowledge_retention.py, tests/test_unique_knowledge_backup.py
🧭 Merge authority: branch protection and automerge controller remain authoritative.

Required Fixes

No deterministic blockers.

Reviewer Details

Model reviewer lanes

`global-glm` / `glm-5.2:cloud`

Status: ok
Verdict: OK
Findings: none

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
Findings: none

`redteam` / `kimi-k2.7-code:cloud`

Status: ok
Verdict: OK
Findings: none

Policy notes

Patchwarden PR sanity is the first merge-lane signal for this PR.
Models produce findings; Patchwarden/policy produces decisions.
Model findings alone do not fail the status check; they require human or agent disposition.
Formal approval is separate from this comment and requires clean reviewer health.
Automerge remains delegated to branch protection and the automerge pilot.

# Patchwarden PR sanity **Operator signal:** ✅ GO - Patchwarden can hand this exact head to the approval controller. **Automerge signal:** 🟡 CONTROLLER ONLY - approval-ready, but outside the narrow safe-docs/status automerge lane. **Verdict:** ✅ PASS - deterministic checks and configured reviewers are clean. **Next step:** Continue through required Forgejo approval and the automerge controller. - PR: `839` - Commit: `e460972b7ab8c6f07578d98c6dd05f8e14b398a1` - Status: `eligible_sanity_clean` - Reviewer health: `clean` - Security-sensitive label: `missing` - Authority: Patchwarden policy signal; branch protection and automerge controller remain merge authority. - Model mix: `glm-5.2:cloud`, `deepseek-v4-pro:cloud`, `kimi-k2.7-code:cloud` ## What I checked - Changed files: `5` - Deterministic blocker scan: `clean` - External Forgejo gates: `not_reported` - Model reviewer lanes: `3` - Comment contract: this comment is updated in place via a hidden Patchwarden marker. ## Approval Handoff - State: `ready_for_external_controller_review` - Action: external controller may publish an APPROVED review for this exact head. - Boundary: branch protection and the automerge controller remain merge authority. ## Signal Board - Legend: ✅ evidence is sufficient; 🟡 controller still has work; ⚠️ automation retries first; 🛑/❌ do not approve or merge. | Lane | Signal | Meaning | | --- | --- | --- | | 🧪 Deterministic sanity | ✅ `clean` | No deterministic blockers found. | | 🧩 External Forgejo gates | 🟡 `not reported` | No external gate snapshot was included in this report. | | 🧠 Model reviewers | ✅ `clean` | Configured reviewers returned OK. | | 🛡️ Patchwarden approval | ✅ `ready` | Exact-head sanity is clean; approval controller may continue. | | 🚦 Unattended automerge | ❌ `ineligible` | Outside the narrow safe-docs/status unattended lane. | | 🙋 Owner attention | ✅ `not needed` | No operator handoff is needed from this comment. | - Scope blocker: non-doc/status path(s): `scripts/backup/README.md`, `scripts/backup/unique_knowledge_retention.py`, `tests/test_unique_knowledge_backup.py` 🧭 Merge authority: branch protection and automerge controller remain authoritative. ## Required Fixes No deterministic blockers. ## Reviewer Details <details> <summary>Model reviewer lanes</summary> ### `global-glm` / `glm-5.2:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `redteam` / `kimi-k2.7-code:cloud` - Status: `ok` - Verdict: `OK` - Findings: none </details> ## Policy notes - Patchwarden PR sanity is the first merge-lane signal for this PR. - Models produce findings; Patchwarden/policy produces decisions. - Model findings alone do not fail the status check; they require human or agent disposition. - Formal approval is separate from this comment and requires clean reviewer health. - Automerge remains delegated to branch protection and the automerge pilot.

codex added 1 commit

2026-06-26 14:45:40 +02:00

Merge remote-tracking branch 'origin/main' into codex/795-unique-knowledge-retention

python-ci / Python 3.12 (pull_request) Successful in 42s

Details

python-ci / Python 3.13 (pull_request) Successful in 42s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 2m11s

Details

base-is-main / guard (pull_request) Successful in 2s

Details

canary-required / collect-diff (pull_request) Successful in 4s