[Reliability] Reconcile Files database and blob integrity #36

New Issue

2026-07-21T16:40:42+02:00

zemion commented

2026-07-21 16:40:42 +02:00

Outcome

Operators can detect and safely reconcile metadata rows without blobs, blobs without metadata, interrupted imports/uploads, and checksum/size mismatches without silently weakening Campaign evidence.

Context

Files metadata and blob writes are not one atomic storage transaction. A process or storage failure can therefore leave an orphan or an incomplete evidence chain. The Campaign reference composition needs an explicit integrity and recovery path before production claims.

Acceptance

A bounded, resumable integrity scan compares metadata, blob presence, size, and checksum.
Missing or corrupt evidence is quarantined and reported; it is never presented as a valid managed version.
Orphan blobs are reported before any separately authorized cleanup action.
Repair/cleanup actions are idempotent, scoped, dry-run capable, and audited without leaking content or connector secrets.
Campaign attachment resolution fails visibly for quarantined or missing versions.
Backup/restore and injected interruption tests cover both orphan directions.
Operator documentation distinguishes detection, reconciliation, and destructive cleanup.

## Outcome Operators can detect and safely reconcile metadata rows without blobs, blobs without metadata, interrupted imports/uploads, and checksum/size mismatches without silently weakening Campaign evidence. ## Context Files metadata and blob writes are not one atomic storage transaction. A process or storage failure can therefore leave an orphan or an incomplete evidence chain. The Campaign reference composition needs an explicit integrity and recovery path before production claims. ## Acceptance - A bounded, resumable integrity scan compares metadata, blob presence, size, and checksum. - Missing or corrupt evidence is quarantined and reported; it is never presented as a valid managed version. - Orphan blobs are reported before any separately authorized cleanup action. - Repair/cleanup actions are idempotent, scoped, dry-run capable, and audited without leaking content or connector secrets. - Campaign attachment resolution fails visibly for quarantined or missing versions. - Backup/restore and injected interruption tests cover both orphan directions. - Operator documentation distinguishes detection, reconciliation, and destructive cleanup.

zemion referenced this issue

2026-07-21 16:48:03 +02:00

[Feature] Govern file restore, retention, legal hold, purge, and blob garbage collection #38

zemion added the area/db codex/ready module/files

labels 2026-07-29 14:15:02 +02:00

zemion commented

2026-07-30 14:32:54 +02:00

Implemented in 835eacf. Files now has persisted integrity reconciliation, bounded scans, missing/corrupt/orphan detection, fail-closed reads, deduplicated repair behavior, administration APIs/UI, migrations, and handbook coverage. Files suite: 81 tests passed.

Implemented in `835eacf`. Files now has persisted integrity reconciliation, bounded scans, missing/corrupt/orphan detection, fail-closed reads, deduplicated repair behavior, administration APIs/UI, migrations, and handbook coverage. Files suite: 81 tests passed.

zemion closed this issue

2026-07-30 14:32:54 +02:00

zemion referenced this issue

2026-08-02 04:11:04 +02:00

[Feature] Add file-integrity scan and reconciliation UI #40

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-files#36