32 lines
1.6 KiB
Markdown
32 lines
1.6 KiB
Markdown
# ADR-0041: Authoritative versus rebuildable recovery state
|
|
|
|
## Status
|
|
|
|
Accepted in M15 on 2026-08-27.
|
|
|
|
## Decision
|
|
|
|
Classify every persisted state source as `AUTHORITATIVE`, `REBUILDABLE`, `EPHEMERAL`, `EXTERNAL` or
|
|
`SECRET` in a versioned `RecoveryPolicyRevision`, and enforce the classification in the contract:
|
|
authoritative state may not declare a manifest-only or absent backup and must state an RPO,
|
|
ephemeral state may not claim a payload backup, external state must be marked as a dependency,
|
|
secret state must name a secret recovery class, and only rebuildable state may be rehydrated.
|
|
|
|
Partition the database itself along the same line. Fingerprinted history is compared across a
|
|
restore; `CURRENT_TRUTH_TABLES` — NVML telemetry, GPU leases, residency, inventory runs, storage
|
|
volume states — is cleared during reconciliation and re-measured by a running control plane. A test
|
|
asserts the two sets together cover the whole schema.
|
|
|
|
## Consequences
|
|
|
|
Recovery cost is proportional to what is genuinely irreplaceable: a 5 MB encrypted control-plane
|
|
dump protects the provenance, lifecycle, migration, approval and audit truth, while 8.1 GB of model
|
|
weights are protected by exact-revision manifests instead of being copied.
|
|
|
|
A restored control plane cannot present a stale GPU lease or a dead NVML reading as present-day
|
|
fact, and the `READY` gate refuses to pass while any current-truth row survives. External projects
|
|
are recorded as dependencies rather than silently claimed as backed up.
|
|
|
|
The cost is that a new milestone must classify every table it adds. The invariant test makes that a
|
|
build failure rather than a silent recovery gap.
|