@rizom/ops 0.2.0-alpha.342 → 0.2.0-alpha.344
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -40,6 +40,22 @@ When a push changes only deploy contract files and no generated `users/<handle>/
|
|
|
40
40
|
|
|
41
41
|
They are scaffolded from `@rizom/ops`, then versioned in this repo like any other deploy contract.
|
|
42
42
|
|
|
43
|
+
## Verified pre-deploy rollback snapshots
|
|
44
|
+
|
|
45
|
+
Deploy creates and verifies one target-scoped rollback snapshot after SSH and image readiness, immediately before optional stale-lock release and `kamal setup`. A snapshot failure stops the workflow before container replacement. A genuinely new server with no runtime or persistent state reports `not applicable`; persistent state without an identifiable runtime fails closed.
|
|
46
|
+
|
|
47
|
+
Each snapshot contains transaction-consistent online captures of the six canonical SQLite databases, database hashes and `quick_check` results, the deployed `brain.yaml`, sanitized container and mount metadata, and the Directory Sync checkout. Git capture includes all refs, an observed remote head, staged and unstaged binary patches, and mode-preserving archives of untracked and ignored files. Capture performs no checkout mutation or remote write.
|
|
48
|
+
|
|
49
|
+
Verified snapshots are finalized atomically under:
|
|
50
|
+
|
|
51
|
+
```text
|
|
52
|
+
/opt/brain-state/backups/predeploy-<handle>-<target>-<UTC timestamp>/
|
|
53
|
+
```
|
|
54
|
+
|
|
55
|
+
Files use mode `0600` and the directory uses `0700`. A `.incomplete` directory is diagnostic evidence, never a rollback point. Checksums and the versioned manifest must verify before finalization. The default retention is five verified snapshots per target; incomplete or unverified directories do not count, and the snapshot created by the current deployment is never pruned.
|
|
56
|
+
|
|
57
|
+
These are same-server rollback snapshots, not off-host disaster recovery. There is no normal skip and no automatic restore. Restoration requires separate approval: stop replacement/application processes, recheck the selected snapshot's checksums, preserve the current state, restore databases and exact Git state, then validate health, queues, Git checkpoints, durable export intents, preview, and production output before reopening the target.
|
|
58
|
+
|
|
43
59
|
## Canonical contract crossover maintenance window
|
|
44
60
|
|
|
45
61
|
Do not run this procedure without explicit operator approval. The canonical desired state, canonical `@rizom/ops`, and unified runtime image form one contract and must move or roll back together. Complete `docs/canonical-crossover-record.md` as the approval evidence without adding secret values.
|