Production Safety
Backup Readiness
WarpIntel keeps recovery planning visible as aggregate counts while database connection values, migration tags, SQL dumps, restore artifacts, provider console details, token ciphertext, and private EVE data stay out of public pages, health snapshots, smoke logs, screenshots, and readiness feeds.
Public backup readiness is count-only and protected setup details remain private.
Migration ledger count is tracked without exposing migration names, SQL, or rollback targets.
Setup packet and dry-run coverage stay behind protected admin routes.
Recovery drill status is honest: ready to review, but no public claim of a verified restore yet.
Required pass/fail evidence is defined before any real restore drill can be marked verified.
Recovery stays gated until all public-safe activation criteria are ready.
Restore-drill owner handoff steps are ready for secret-free review.
Deployment, data, and environment rollback decisions are documented before a drill.
WarpIntel Neon project boundary
Protected recovery guidance requires the dedicated WarpIntel Neon project and excludes separate-project backup paths.
Migration ledger ready
Drizzle migration count is recorded so restore review can compare schema state without exposing migration tags or SQL bodies publicly.
Runtime database gate
The production database connection must be present in protected runtime configuration before a restore drill can be attempted.
Protected heartbeat gate
Protected cron health checks must be able to authenticate before recovery evidence can prove scheduled health after a restore.
Safe recovery exports ready
Protected no-secret exports cover ops snapshot, ops review, queue CSV, route smoke, and account export comparison evidence.
Restore acceptance criteria ready
A real restore drill must prove release fingerprint, route smoke, migration ledger, ops snapshot, and tracker evidence.
Protected dry run without provider mutation
Protected dry runs validate the recovery boundary without restoring Neon, rolling back Vercel, reading env vars, writing database rows, or dumping secrets.
Owner-reviewed restore drill gate
Backup recovery is not launch-ready until a real restore drill is owner-reviewed and recorded with secret-free evidence.
Coverage
Recovery prerequisites are tracked as public-safe counts while restore artifacts stay protected.
Migration Ledger
Migration count is visible without exposing migration tags, SQL bodies, or database connection values.
Protected Review
Setup packet, recovery dry-run, and restore-drill rehearsal coverage stay behind protected admin routes.
Restore Drill
The app is ready for an owner-reviewed drill; the public page does not claim a real restore is verified.
Acceptance Criteria
A real restore drill must prove release fingerprint, route smoke, migration ledger, ops snapshot, and tracker evidence before it is marked verified.
Owner Handoff
The restore drill has a secret-free handoff covering baseline, provider boundary, isolated restore, migration reconcile, proof review, and tracker record.
Rollback Decisions
Deployment, data-restore, and environment-boundary rollback decisions are documented without exposing provider artifacts.
Pre-drill baseline
Record the current commit, deployment host, route-smoke floor, and no-secret health status.
Provider scope check
Confirm the drill uses only WarpIntel provider projects and does not touch separate-project assets.
Isolated restore path
Use an isolated branch/restore target first, then record only provider name and pass/fail status.
Migration reconcile
Confirm migration count alignment without publishing migration tags, SQL, or database URLs.
App proof review
Compare protected route and ops summaries before and after the drill without exporting secrets.
Tracker and release record
Record secret-free commit, deployment, route status, and owner decision notes.
Deployment regression
Rollback evidence is limited to commit, deployment, status code, and route count.
Data restore mismatch
Provider artifacts, SQL dumps, token ciphertext, and row-level private data stay excluded.
Environment boundary mismatch
Decision notes identify the boundary category only, not secret names or values.
migration ledger
Represented in public readiness as aggregate status only; private implementation evidence stays protected.
runtime readiness
Represented in public readiness as aggregate status only; private implementation evidence stays protected.
ops heartbeat
Represented in public readiness as aggregate status only; private implementation evidence stays protected.
safe exports
Represented in public readiness as aggregate status only; private implementation evidence stays protected.
restore drill
Represented in public readiness as aggregate status only; private implementation evidence stays protected.
acceptance criteria
Represented in public readiness as aggregate status only; private implementation evidence stays protected.
owner handoff
Represented in public readiness as aggregate status only; private implementation evidence stays protected.
rollback decision points
Represented in public readiness as aggregate status only; private implementation evidence stays protected.
Database Connection Values
Excluded from public pages, health snapshots, smoke logs, screenshots, and readiness feeds.
Cron Secret Values
Excluded from public pages, health snapshots, smoke logs, screenshots, and readiness feeds.
Migration Tags
Excluded from public pages, health snapshots, smoke logs, screenshots, and readiness feeds.
Neon Passwords
Excluded from public pages, health snapshots, smoke logs, screenshots, and readiness feeds.
Sql Dumps
Excluded from public pages, health snapshots, smoke logs, screenshots, and readiness feeds.
Vercel Rollback Targets
Excluded from public pages, health snapshots, smoke logs, screenshots, and readiness feeds.
Provider Console Artifacts
Excluded from public pages, health snapshots, smoke logs, screenshots, and readiness feeds.
Token Ciphertext
Excluded from public pages, health snapshots, smoke logs, screenshots, and readiness feeds.
Raw Ip Addresses
Excluded from public pages, health snapshots, smoke logs, screenshots, and readiness feeds.
Raw User Agents
Excluded from public pages, health snapshots, smoke logs, screenshots, and readiness feeds.
Private Eve Data
Excluded from public pages, health snapshots, smoke logs, screenshots, and readiness feeds.
Protected Setup Details
Excluded from public pages, health snapshots, smoke logs, screenshots, and readiness feeds.
No-Secret Backup Rule
Public backup readiness exposes aggregate recovery counts, activation criteria, migration count, protected-check booleans, proof-target counts, safe-export counts, restore-drill acceptance-criteria counts, owner-handoff counts, rollback decision counts, restore-drill status, and no-provider-mutation dry-run status only; it does not expose database connection values, cron secret values, migration tags, Neon passwords, SQL dumps, Vercel rollback targets, provider-console backup artifacts, token ciphertext, raw IP addresses, raw user-agent strings, EVE tokens, private account data, or raw pasted analyzer inputs.