v0.6 docs: backup story, sharp-edge table, ARCHITECTURE section (write last, from fact) #158

Closed
opened 2026-08-09 03:17:46 +00:00 by Cordy · 1 comment
Owner

The #124-pattern tripwire for this milestone: do not action before the acceptance dogfood passes — write once, at the end, from what shipped.

  • docs/handbook/deployment.md: the backup story changes fundamentally — backing up the bucket now backs up the whole instance (state included, ciphertext); the recovery drill becomes "new pod + same config + same bucket". Rewrite the backup/restore section around that, and add the sharp-edge table: what still lives locally (scratch), what refuses boot (backend down, migration conflict, foreign lock), what the .migrated files are.
  • Sovereignty check extended: pull a .cairn-state/ object out of the bucket, age -d with the recovery key, get readable JSON — same drill as file data, documented next to it.
  • README.md: one sentence in the storage/encryption entries — instance state travels with the backend, updates cannot lose it.
  • ARCHITECTURE.md: new shipped § (the §10/§11 pattern from #124); the v0.6 milestone bullet flips from future tense to a pointer.
  • Helm/compose: persistence guidance updated honestly — a PVC remains recommended for scratch and upload spool, but is no longer load-bearing for identity on s3 instances.
The #124-pattern tripwire for this milestone: **do not action before the acceptance dogfood passes** — write once, at the end, from what shipped. - `docs/handbook/deployment.md`: the backup story changes fundamentally — backing up the bucket now backs up the whole instance (state included, ciphertext); the recovery drill becomes "new pod + same config + same bucket". Rewrite the backup/restore section around that, and add the **sharp-edge table**: what still lives locally (scratch), what refuses boot (backend down, migration conflict, foreign lock), what the `.migrated` files are. - Sovereignty check extended: pull a `.cairn-state/` object out of the bucket, `age -d` with the recovery key, get readable JSON — same drill as file data, documented next to it. - `README.md`: one sentence in the storage/encryption entries — instance state travels with the backend, updates cannot lose it. - `ARCHITECTURE.md`: new shipped § (the §10/§11 pattern from #124); the v0.6 milestone bullet flips from future tense to a pointer. - Helm/compose: persistence guidance updated honestly — a PVC remains recommended for scratch and upload spool, but is no longer load-bearing for identity on s3 instances.
Author
Owner

Written and merged (PR #170), after the acceptance dogfood passed — the #124 pattern held: once, at the end, from fact.

Every deliverable landed: deployment.md rewritten around the new reality (three-layer model, browser storage connect, the what-still-lives-locally table with loss consequences, the three deliberate boot refusals as a sharp-edge section, and the backup story inverted — backing up the backend backs up the whole instance, recovery drill = new pod + same config + same bucket, stated as rehearsed, because it was, on #159). Sovereignty check documented for state objects next to the file drill, with the exact commands. README: the source-of-truth bullet now carries the state sentence, the encryption bullet notes the recovery key opens instance identity too, status flipped to v0.6 naming the recovery drill. ARCHITECTURE: §11 describes the shipped system — statestore boundary, envelope, reserved prefix, refuse-first migration, the lock with its honest limits, three layers and setup mode, the storage-first boot order, and the rehearsal as proof; the milestone list gained the v0.6 bullet it was missing entirely and renumbered closed beta → v0.7, public launch → v0.8, matching the Forgejo milestones. Helm values: persistence comment now says precisely what the volume is and isn't for.

One scope note: the ARCHITECTURE milestone list had never been renumbered when this milestone displaced closed beta — fixed here rather than filed separately, since the section was being touched anyway.

Written and merged (PR #170), after the acceptance dogfood passed — the #124 pattern held: once, at the end, from fact. Every deliverable landed: **deployment.md** rewritten around the new reality (three-layer model, browser storage connect, the what-still-lives-locally table with loss consequences, the three deliberate boot refusals as a sharp-edge section, and the backup story inverted — backing up the backend backs up the whole instance, recovery drill = new pod + same config + same bucket, stated as *rehearsed*, because it was, on #159). Sovereignty check documented for state objects next to the file drill, with the exact commands. **README**: the source-of-truth bullet now carries the state sentence, the encryption bullet notes the recovery key opens instance identity too, status flipped to v0.6 naming the recovery drill. **ARCHITECTURE**: §11 describes the shipped system — statestore boundary, envelope, reserved prefix, refuse-first migration, the lock with its honest limits, three layers and setup mode, the storage-first boot order, and the rehearsal as proof; the milestone list gained the v0.6 bullet it was missing entirely and renumbered closed beta → v0.7, public launch → v0.8, matching the Forgejo milestones. **Helm values**: persistence comment now says precisely what the volume is and isn't for. One scope note: the ARCHITECTURE milestone list had never been renumbered when this milestone displaced closed beta — fixed here rather than filed separately, since the section was being touched anyway.
Cordy closed this issue 2026-08-10 00:25:49 +00:00
Sign in to join this conversation.
No labels
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Cordy/Cairn#158
No description provided.