31 lines
1.6 KiB
Markdown
31 lines
1.6 KiB
Markdown
# ADR-0047: terminal audited node decommission
|
|
|
|
## Status
|
|
|
|
Accepted after v1.0 on 2026-08-28.
|
|
|
|
## Decision
|
|
|
|
Represent permanent compute-node removal as an immutable tombstone on `ComputeNode` plus one
|
|
`NodeDecommissionOperation`, never as a hard delete. Require an authenticated preview/execute
|
|
protocol bound to an optimistic node generation and a deterministic dependency digest. Recheck all
|
|
blockers in the execution transaction, lock the dependency graph on PostgreSQL, and provide no
|
|
force override.
|
|
|
|
Revoke credentials and remove only current, rebuildable truth. Preserve every identity and record
|
|
needed to explain acquisition, validation, runtime, deployment, serving, capacity and audit history.
|
|
Block ordinary enrollment and every other known mutation path from resurrecting the tombstone.
|
|
|
|
## Consequences
|
|
|
|
Foreign-key `CASCADE`, `SET NULL` and `RESTRICT` semantics no longer determine whether node history
|
|
survives an operator action: the row is retained deliberately. Operators get an explicit inventory
|
|
of what is blocked, changed and preserved before execution, and retries return the original result.
|
|
|
|
The transition takes broad, short-lived PostgreSQL table locks. Decommission is rare and safety is
|
|
more important than maximizing concurrent scheduling throughput. New node-referencing tables must
|
|
be added to the preview, lock set, cleanup classification and terminal invariant before release.
|
|
|
|
Recovery from an outage and permanent decommission remain distinct. Reusing a decommissioned
|
|
persisted identity is refused until a separately designed explicit recovery lifecycle exists.
|