35 lines
1.4 KiB
Markdown
35 lines
1.4 KiB
Markdown
# Rollback and Recovery
|
|
|
|
## Basisregels
|
|
Maak per milestone een full zip en update zip. Geen destructieve migrations zonder rollback-notitie.
|
|
|
|
## Database rollback
|
|
Elke migration beschrijft upgrade en downgrade. Als downgrade onveilig is, noteer dit expliciet.
|
|
|
|
## Storage rollback
|
|
Bestanden worden niet stilzwijgend verwijderd. Gebruik soft-delete waar mogelijk.
|
|
|
|
## AI/model rollback
|
|
Elke analysis run bewaart model id, version, parameters, confidence threshold en pipeline version.
|
|
# RC backup and isolated restore gate
|
|
|
|
Before any release migration, credential rotation or image promotion:
|
|
|
|
1. run `scripts/backup_release_state.sh` against the running all-in-one
|
|
container;
|
|
2. run `scripts/verify_release_backup.sh` read-only;
|
|
3. run `scripts/restore_release_backup_smoke.sh` with
|
|
`--confirm-isolated-restore`;
|
|
4. retain the backup directory and the separate restore-smoke JSON with the
|
|
release evidence.
|
|
|
|
The restore smoke may only create databases whose name starts with
|
|
`geointel_restore_verify_`. It refuses the production database name, does not
|
|
use `pg_restore --clean` and drops the temporary database unless an operator
|
|
explicitly asks to retain it.
|
|
|
|
Storage and model files are inventoried rather than copied into the database
|
|
dump. Release backups must therefore be paired with the persistent storage
|
|
volume backup policy. Use `--inventory-mode sha256` for final release
|
|
evidence.
|