fix(release): make deployment backup and rollback immutable

backend/tests/test_rc_backup_restore_scripts.py

@@ -20,12 +20,35 @@ def test_backup_is_atomic_read_only_and_checksum_bound() -> None:
     assert "--no-owner" in script
     assert "CHECKSUMS.sha256" in script
     assert "database-password" not in script.lower()
-    assert 'git -C "$ROOT" rev-parse HEAD' in script
-    assert 'git -C "$ROOT" status --porcelain=v1' in script
+    assert 'for required in docker python3 sha256sum; do' in script
+    assert 'for required in docker python3 sha256sum git; do' not in script
+    assert "GITEA_COMMIT_SHA" in script
+    assert "GITHUB_SHA" in script
+    assert "GEOINTEL_BUILD_SHA" in script
+    assert 'if command -v git >/dev/null 2>&1' in script
     assert "mv \"$PARTIAL\" \"$FINAL\"" in script
     assert "rm -rf -- \"$PARTIAL\"" in script
     assert "DROP DATABASE" not in script
     assert "pg_restore --clean" not in script
+    assert "/mnt/user/appdata/geointel/backups" in script
+    assert "release_backup_snapshot.py" in script
+    assert "storage-snapshot" not in script  # labels are composed without unsafe path interpolation
+    assert "--link-dest-backup" in script
+    assert "--rollback-image-tag" in script
+    assert '"rollback_image_tag": ${ROLLBACK_IMAGE_TAG@Q} or None' in script
+
+
+def test_backup_binds_prepared_source_without_requiring_dot_git() -> None:
+    script = read("backup_release_state.sh")
+
+    controller_resolution = script.index('local gitea_sha="${GITEA_COMMIT_SHA:-}"')
+    optional_git_fallback = script.index('if command -v git >/dev/null 2>&1')
+    docker_access = script.index("docker inspect -f '{{.State.Running}}'")
+    assert controller_resolution < optional_git_fallback < docker_access
+    assert 'SOURCE_REVISION="$explicit_sha"' in script
+    assert '"backup_tool_revision": ${SOURCE_REVISION@Q}' in script
+    assert '"running_image_revision": ${RUNNING_IMAGE_REVISION@Q}' in script
+    assert "Cannot bind backup to a source revision" in script
 
 
 def test_backup_verification_is_read_only() -> None:
@@ -55,9 +78,11 @@ def test_release_safety_scripts_have_valid_bash_syntax() -> None:
         "backup_release_state.sh",
         "verify_release_backup.sh",
         "restore_release_backup_smoke.sh",
+        "../deploy/unraid/restore-predeploy-database.sh",
     ):
+        script_path = f"scripts/{name}" if not name.startswith("../") else name.removeprefix("../")
         result = subprocess.run(
-            ["bash", "-n", f"scripts/{name}"],
+            ["bash", "-n", script_path],
             cwd=ROOT,
             capture_output=True,
             text=True,
@@ -66,6 +91,30 @@ def test_release_safety_scripts_have_valid_bash_syntax() -> None:
         assert result.returncode == 0, f"{name}: {result.stderr}"
 
 
+def test_production_restore_is_explicit_bounded_and_verified() -> None:
+    script = (ROOT / "deploy" / "unraid" / "restore-predeploy-database.sh").read_text(
+        encoding="utf-8"
+    )
+
+    assert "--confirm-production-database-restore" in script
+    assert "/mnt/user/appdata/geointel/backups" in script
+    assert "backup.relative_to(root)" in script
+    assert "sha256sum -c CHECKSUMS.sha256" in script
+    assert '"$RESTORE_PROOF_DB"' in script
+    assert "pg_restore" in script
+    assert "Restored Alembic head" in script
+    assert "Restored count mismatch" in script
+    assert "pg_restore --clean" not in script
+    assert "geointel_restore_proof_" in script
+    assert "Isolated predeploy restore proof passed" in script
+    assert "ALTER DATABASE" in script
+    assert "Pre-restore production database retained" in script
+    drop_start = script.index("dropdb --if-exists --force")
+    drop_command = script[drop_start : script.index("\n  fi", drop_start)]
+    assert '"$RESTORE_PROOF_DB"' in drop_command
+    assert '"$GEOINTEL_POSTGRES_DB"' not in drop_command
+
+
 def test_readiness_gate_checks_release_safety_scripts() -> None:
     readiness = read("run_readiness_check.sh")