1.6 KiB
ADR-0047: terminal audited node decommission
Status
Accepted after v1.0 on 2026-08-28.
Decision
Represent permanent compute-node removal as an immutable tombstone on ComputeNode plus one
NodeDecommissionOperation, never as a hard delete. Require an authenticated preview/execute
protocol bound to an optimistic node generation and a deterministic dependency digest. Recheck all
blockers in the execution transaction, lock the dependency graph on PostgreSQL, and provide no
force override.
Revoke credentials and remove only current, rebuildable truth. Preserve every identity and record needed to explain acquisition, validation, runtime, deployment, serving, capacity and audit history. Block ordinary enrollment and every other known mutation path from resurrecting the tombstone.
Consequences
Foreign-key CASCADE, SET NULL and RESTRICT semantics no longer determine whether node history
survives an operator action: the row is retained deliberately. Operators get an explicit inventory
of what is blocked, changed and preserved before execution, and retries return the original result.
The transition takes broad, short-lived PostgreSQL table locks. Decommission is rare and safety is more important than maximizing concurrent scheduling throughput. New node-referencing tables must be added to the preview, lock set, cleanup classification and terminal invariant before release.
Recovery from an outage and permanent decommission remain distinct. Reusing a decommissioned persisted identity is refused until a separately designed explicit recovery lifecycle exists.