[Reliability] Reconcile Files database and blob integrity #36

New Issue

zemion · 2026-07-21T16:40:42+02:00

zemion commented

2026-07-21 16:40:42 +02:00

Outcome

Operators can detect and safely reconcile metadata rows without blobs, blobs without metadata, interrupted imports/uploads, and checksum/size mismatches without silently weakening Campaign evidence.

Context

Files metadata and blob writes are not one atomic storage transaction. A process or storage failure can therefore leave an orphan or an incomplete evidence chain. The Campaign reference composition needs an explicit integrity and recovery path before production claims.

Acceptance

A bounded, resumable integrity scan compares metadata, blob presence, size, and checksum.
Missing or corrupt evidence is quarantined and reported; it is never presented as a valid managed version.
Orphan blobs are reported before any separately authorized cleanup action.
Repair/cleanup actions are idempotent, scoped, dry-run capable, and audited without leaking content or connector secrets.
Campaign attachment resolution fails visibly for quarantined or missing versions.
Backup/restore and injected interruption tests cover both orphan directions.
Operator documentation distinguishes detection, reconciliation, and destructive cleanup.

## Outcome Operators can detect and safely reconcile metadata rows without blobs, blobs without metadata, interrupted imports/uploads, and checksum/size mismatches without silently weakening Campaign evidence. ## Context Files metadata and blob writes are not one atomic storage transaction. A process or storage failure can therefore leave an orphan or an incomplete evidence chain. The Campaign reference composition needs an explicit integrity and recovery path before production claims. ## Acceptance - A bounded, resumable integrity scan compares metadata, blob presence, size, and checksum. - Missing or corrupt evidence is quarantined and reported; it is never presented as a valid managed version. - Orphan blobs are reported before any separately authorized cleanup action. - Repair/cleanup actions are idempotent, scoped, dry-run capable, and audited without leaking content or connector secrets. - Campaign attachment resolution fails visibly for quarantined or missing versions. - Backup/restore and injected interruption tests cover both orphan directions. - Operator documentation distinguishes detection, reconciliation, and destructive cleanup.

zemion referenced this issue

2026-07-21 16:48:03 +02:00

[Feature] Govern file restore, retention, legal hold, purge, and blob garbage collection #38

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-files#36