Problem
Some state exists only off-chain: dispute evidence, API keys, export artifacts,
idempotency records. Losing it is unrecoverable — unlike the index, which can be
rebuilt from the ledger. There is currently no backup plan and no statement of
what the service guarantees.
What to do
- Classify state explicitly: reconstructible from chain (index, cached
reads) versus irreplaceable (evidence, keys, audit logs). The backup
strategy follows the classification.
- Automated encrypted backups of the irreplaceable set, stored in a separate
failure domain from the primary.
- Restore drills on a schedule. A backup that has never been restored is a
hypothesis, not a backup.
- Document the rebuild-from-chain procedure for the reconstructible set, with a
measured time-to-rebuild.
- Publish RPO and RTO targets and hold the design to them.
Acceptance criteria
Notes
Dispute evidence is the item to worry about most: it is irreplaceable, it is
what a disagreement turns on, and it is exactly what someone would want to
destroy.
Problem
Some state exists only off-chain: dispute evidence, API keys, export artifacts,
idempotency records. Losing it is unrecoverable — unlike the index, which can be
rebuilt from the ledger. There is currently no backup plan and no statement of
what the service guarantees.
What to do
reads) versus irreplaceable (evidence, keys, audit logs). The backup
strategy follows the classification.
failure domain from the primary.
hypothesis, not a backup.
measured time-to-rebuild.
Acceptance criteria
Notes
Dispute evidence is the item to worry about most: it is irreplaceable, it is
what a disagreement turns on, and it is exactly what someone would want to
destroy.