1.6 KiB
ADR-0041: Authoritative versus rebuildable recovery state
Status
Accepted in M15 on 2026-08-27.
Decision
Classify every persisted state source as AUTHORITATIVE, REBUILDABLE, EPHEMERAL, EXTERNAL or
SECRET in a versioned RecoveryPolicyRevision, and enforce the classification in the contract:
authoritative state may not declare a manifest-only or absent backup and must state an RPO,
ephemeral state may not claim a payload backup, external state must be marked as a dependency,
secret state must name a secret recovery class, and only rebuildable state may be rehydrated.
Partition the database itself along the same line. Fingerprinted history is compared across a
restore; CURRENT_TRUTH_TABLES — NVML telemetry, GPU leases, residency, inventory runs, storage
volume states — is cleared during reconciliation and re-measured by a running control plane. A test
asserts the two sets together cover the whole schema.
Consequences
Recovery cost is proportional to what is genuinely irreplaceable: a 5 MB encrypted control-plane dump protects the provenance, lifecycle, migration, approval and audit truth, while 8.1 GB of model weights are protected by exact-revision manifests instead of being copied.
A restored control plane cannot present a stale GPU lease or a dead NVML reading as present-day
fact, and the READY gate refuses to pass while any current-truth row survives. External projects
are recorded as dependencies rather than silently claimed as backed up.
The cost is that a new milestone must classify every table it adds. The invariant test makes that a build failure rather than a silent recovery gap.