Backup and Restore Service · View 10 of 26 · 4 · Data
Decisions
- Artefacts are the source of truth and the catalogue is an index over them. Every artefact carries a signed envelope with engine and tool versions, consistency level, key reference, chain parent and checksum, so the index can be dropped and rebuilt.
- Verification records are kept for 7 years under a compliance-mode lock, longer than any Tier 1 copy. They are the basis of every RTO claim, and an auditor asks about the past, not only the present.
- Keys live outside all four stores, in OpenBao, with a recovery drill of their own. A copy whose key is gone is not a backup, however well locked it is.
Numbers
- Rebuild by scan: envelopes are prefixed by datastore and day, so 32 parallel listers cover 30 million envelopes in about 3 hours. A full rebuild runs every week into a shadow catalogue and is diffed against the live one.
- Policy and coverage store: a few megabytes, rebuilt from Git in minutes.
Risks
- An envelope written without its artefact, or the reverse, is possible if capture dies between the two writes. The scan treats an artefact without an envelope as an orphan finding, never as a recovery point.
