memory: U11b legacy-memory archive done (dedicated restic repo, drill passed); destroy-by 2026-10-30 runbook

2026-09-30 03:01:54 -07:00
parent 37d0b34682
commit 9a6ac59da7
1 changed files with 11 additions and 1 deletions
@@ -127,7 +127,17 @@ _As of 2026-09-30 ~0120 PT._
  - **PERSONAL flipped at 0120 PT** on 64f79b38a7fb, the same way. ⚠ Personal has **no /metrics**, because the #308 metrics block is demo-only, so the proof was the no-metrics one: an in-container `get_default→load_cutover_config→validate_cutover` gave off/writer/reader True, /health was 200, and the boot log matched the pre-flip one. Whether to add metrics to personal is still worldtree-dev's open call. Both instances are in sync with the repo.
  - Watch after each flip: any `legacy executor <kind> invoked with memory.legacy.mode=off; ignored` line goes to worldtree-dev with its stamp. A sweep at 0154 of both logs since their last start found **0 watched lines, but there was ~no traffic** (demo 0 real requests, personal 1), so that proves little. **TODO: re-sweep after the first real traffic** with `docker logs --since <StartedAt>`, grepping `legacy executor|Traceback|ERROR|will not be remembered`. A CI recreate drops the old container's log.
 - **Daily gate batches at off: LIVE, infra-hermes from 2026-10-01** (Prime's 2340 ruling; the plan was revised to `--legacy-mode off --label window-off` by worldtree-dev, thread `01M3RRW7WZ04GNR871HC1VKY4K`). The wrapper is `scripts/wt-memory-gate-batch`. It tests demo's deployed sha, from the detached worktree `~/development/Worldtree-gate` when worldtree-dev's tree has moved. Exit codes: 0 PASS, 1 FAIL, 2 error, 3 refused, 4 busy. **PASS and FAIL both go to worldtree-dev the same day**, because they build the n. **The U11b DATA deletion is gated on 3 consecutive PASS at off, or a Prime waiver**; code retirement is not gated. The controls were 080927Z FAIL and 082829Z FAIL (one flip each; the filing floor held; worldtree-dev calls it undecided). **Mine, 20260930T090608Z, PASSED (user median 0.83)**, so the count is 1 of 3 if the FAILs reset it. ⚠ It started by accident, from a test meant to be `--dry-run`, and matched the plan anyway.
- **U11b prep (worldtree-dev asks, read-only, answered 0215):** /embed usage from the Skuld ledger (`phase_name='embed'`, which carries no caller identity): demo 436 calls, 07-29..08-31, none since; personal 5 calls, 07-30..08-05. ⚠ Demo's whole Skuld ledger has been idle since 09-14. Legacy data: demo 3 chroma ≈2.1M plus context_promotion 224K; personal ≈26M plus 6.5M (1,413 JSONL + ledger.db). Both are in the `*_worldtree-state` volumes. **Archive plan proposed, not run**: tar.zst as root with explicit paths, a sha256 manifest, a copy to nh3-dev `~/archive/worldtree-legacy-memory/`, which reaches rest-server-nh3 (append-only) through restic, and a check that a restic SNAPSHOT holds the files before any deletion. corviduo-dev itself has NO backups. Steps 1-4 wait on worldtree-dev's word; the deletion waits on Prime and the gate.
+- **U11b prep (worldtree-dev asks, read-only, answered 0215):** /embed usage from the Skuld ledger (`phase_name='embed'`, which carries no caller identity): demo 436 calls, 07-29..08-31, none since; personal 5 calls, 07-30..08-05. ⚠ Demo's whole Skuld ledger has been idle since 09-14. Legacy data: demo 3 chroma ≈2.1M plus context_promotion 224K; personal ≈26M plus 6.5M (1,413 JSONL + ledger.db). Both are in the `*_worldtree-state` volumes. **ARCHIVE DONE 2026-09-30 0957 PT (worldtree-dev GO), restore drill passed.** The copies:
  - corviduo-dev `/var/lib/wt-legacy-archive/` (root 0700, UNENCRYPTED): demo 51 files and personal 1,426 files, each as tar.zst plus per-file sha256 plus MANIFEST.txt.
  - A DEDICATED restic repo, rest-server-nh3 `/nh3-dev/wt-legacy-archive/`, snapshot `98dc64e0`, with its password vaulted at `nh3-dev/wt-legacy-archive/restic-password`. Its URL is the vaulted `nh3-dev/etc/restic/repository` plus `wt-legacy-archive/`. It is mirrored to ana-nas at 05:00.
  - It is deliberately NOT in the main nh3-dev /home sweep, whose keep-monthly 12 retention would break the contract's 30-day rule.
  - The drill: 51/51 and 1,426/1,426 per-file sha OK, sqlite integrity ok, and a one-flipped-byte negative control was caught.
  - **Contract rev 1.2: DESTROY WHOLE at retirement-done or 2026-10-30, whichever is first, or on any subject-erasure request.** The runbook (sent to worldtree-dev):
    1. rm `/var/lib/wt-legacy-archive` on corviduo-dev.
    2. rm `/volume1/Backup/restic/nh3-dev/wt-legacy-archive` on nh3-nas.
    3. The ana-nas mirror's `--delete` removes that copy; verify it.
    4. `secret rm` the password AND purge Vaultwarden's trash (crypto-shred), and check for NAS share snapshots.
  - Observation: the context_promotion dir's mtime moves at boot even under mode=off, while its files do not; this was flagged to worldtree-dev for C3.
 ### nh3-pve + nh3-ml1: post-visit, all live (2026-09-25/26)