admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

validation: new-box restore round-trip PASS (9/9 sha-identical) + old-archive retirement decision

Browse Source 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
This commit is contained in:
authentik Default Admin
2026-07-10 09:29:22 +02:00
parent 004dabb7ca
commit c8d36b07e4
2 changed files with 41 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CONTEXT.md
+8
View File
@@ -3,6 +3,14 @@
> Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
> `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.
- **2026-07-10 — new-box restore round-trip VALIDATED + old-box archive RETIRED.** Record:
`documentation/audits/VALIDATION-newbox-restore-2026-07-10.md`. Both toggled apps restored from the
production pool box via the real endpoint — **9/9 sha256-identical** (immich 44MB db-dump exact,
`d78466fcbf…4526b`, agreeing with the campaign's independent round). ~10s/app. **Viktor's decision:
RETIRE the old archive** — he deletes `u629193-sub1` in the old project's console (the PBS-storage-1 box
itself stays for dev). C2 fixed same day as controller v0.110.0 (crash-lock self-heal, live-proven).
Offsite arc: build-complete + restore-proven both directions; remaining = the Peti onboarding runbook.
- **2026-07-10 — offsite arc overnight soak (unattended) — PASS + 1 HIGH finding.** Record:
`documentation/audits/CAMPAIGN-offsite-overnight-2026-07-10.md`. F4 re-issue proved LIVE (reset invalidates
the old password); restore round-trip 9/9 byte-identical new-box↔USB (immich db-dump exact → old-box
documentation/audits/VALIDATION-newbox-restore-2026-07-10.md
+33
View File
@@ -0,0 +1,33 @@
# VALIDATION — new-box restore round-trip + old-box archive retirement — 2026-07-10
**Class:** supervised operational validation (small). **Baseline:** controller v0.110.0 on guest 9201
(healthy), offbox escrowed on the NEW pool box (project 15282031, sub-account 269008 /
`u629488-sub1`), quota 50 GB, 4 snapshots, last run ok — re-confirmed live at start.
## Phase 1 — restore from the NEW box (real endpoint, anti-F9)
Both toggled apps restored via `POST /backup/offbox/restore` (async, non-destructive →
`<DataDir>/offbox-restore/<app>`); the live app tree and USB units untouched.
| App | Endpoint result | Duration (residential, incl. polling) | Integrity |
|---|---|---|---|
| immich | restored | ~10 s | 5/5 files sha256-identical vs USB source |
| audiobookshelf | restored | ~11 s | 4/4 files sha256-identical vs USB source |
**9/9 byte-identical**, including the 44 MB `db-dumps/immich-postgres.sql`:
`d78466fcbf595b488ba8b962fcc521f68fbe6f36b8b8e57815a6124bccf4526b` — identical to the overnight
campaign's Track-E hash (two independent restore rounds agree). Restore scratch removed after hashing.
## Phase 2 — retirement decision (Viktor)
**DECISION: RETIRE.** Viktor deletes the `u629193-sub1` sub-account in the OLD project's Hetzner console
himself (one click — revokes access + frees the space). The old box (`PBS-storage-1`) itself stays for
future dev use. The demo's OLD R-blob at the hub (pre-hash, covering the old history) remains — harmless.
## Arc status
**Offsite tier restore-proven on the production pool box; old-box archive retired (console click:
Viktor).** The offsite arc is build-complete (S1–S4 + hardening + C1/C2 self-heal) and its data path is
now proven both directions (backup → box → restore, byte-exact) on the production project. Remaining
operational: the Peti onboarding runbook (session-gated tracks: auto-confirm happy chain, fresh-enable,
live quota-crossing, hub-orchestrated F4/freeze).