Backup and Restore Service  ·  View 04 of 26  ·  2 · People and journeys

Journey — Data Owner Takes a New Datastore to PROVEN

How a datastore goes from unknown to proven, and why its first rehearsal is where things usually break.

Editable source SVG draw.io All views
Data owner payments team Goal — A new PostgreSQL cluster proven restorable in its first week Trigger — Coverage report names the cluster as unprotected Done when — Status reads PROVEN with a measured RTO under 60 min 1 · Discovered 2 · Declare tier 3 · First capture 4 · First rehearsal ◆ moment of truth 5 · Fix assertions 6 · PROVEN What they do Reads the incident Adds tier label in Git Waits for base copy Reads the failure Commits invariants Sees the date System behind it Coverage scanner Policy compiler pgBackRest adapter Isolated cluster Assertion runner Catalogue How it feels Confident Neutral Exposed Where it hurts Nobody knew it existed Version not certified Restored, app would not start Invariants hard to write What the platform gives Owner named, age shown No default tier Blocked, not silent Failure before need Invariant templates Measured RTO published Journey — Data Owner Takes a New Datastore to PROVEN v 1.0 · owner Platform Architecture · date 2026-09

The trough, and what answers it

  • The first rehearsal is the worst moment, and that is intended. A restore that opens but whose application will not start is found on day three by a machine, not in an outage by a person.
  • The version gate stops a capture against a PostgreSQL minor version the tool has not been certified for. The owner sees a blocked capture within the hour instead of an unrestorable copy months later (view 20).

Decisions

  • The tier is set by a label in Git, reviewed like code. The policy compiler turns it into schedules, retention and a rehearsal slot. No per-datastore job configuration exists to drift.
  • Invariant templates ship per engine (row counts by partition, foreign-key orphans, balance sums), so a team starts from something that runs rather than a blank file.

Numbers

  • Discovery to incident: 72 hours unprotected.
  • Enrolment to first proof: target 7 days for Tier 1, about 2 of which are the owner writing invariants.
◀  Actors and Their Core Journeys All views Journey — On-call SRE Recovers From a Three-Week-Old Corruption  ▶
Solution Architecture v1.0 · Platform Architecture · 2026-09 · 26 views · open source, fully on-premises04-journey-enrol-to-proven