3 Commits

Include renames

Author	SHA1	Message	Date
bvandeusenandClaude Opus 5.5	8569b3d674	fix(backup): the safety backup's audit row names who restored (#5820) ... On the live restore the "before restore" backup.made row read user "unknown": _safety_backup recorded it with no username. It now carries the person who started the restore. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-15 11:32:08 -04:00
bvandeusenandClaude Opus 5.5	e445c83e67	feat(backup): restore at first-run setup, restore --in-place, docs lead with the UI (#5818, #5819) ... #5818 "First-run setup: Restore from a backup, by upload": beside creating the first admin, setup offers "Or restore from a backup". Only while no user exists; the upload is checked (a newer backup or one whose key can't open its secrets is refused and not kept), then restored with no safety backup (nothing to keep), and Steward restarts into the backup's users. #5819 "Docs and CI": backups.md leads with restoring from Settings → Backups and from setup; `steward restore --in-place` does the same-schema restore from the shell, and CI's image check now uses it with a real pg_restore: a changed setting comes back and the audit log stays. Also exempts errors/restoring.html from the breadcrumb guard, as with the other whole-app error pages: it replaces every page while a restore runs, so there is nowhere to trail back to. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-15 11:05:39 -04:00
bvandeusenandClaude Opus 5.5	fb99f8b551	feat(backup): restore from Settings → Backups, with restoring mode (#5816, #5817) ... #5816 "Restoring mode": while a backup goes back in, the scheduler holds, ingest and HTMX answer 503 with Retry-After (agents keep their samples), and every page says what is happening. A safety backup of Steward as it stands is made first, to /data/backups and the bucket. The backup's key is put in place, the restore audited, and Steward exits with code 3 so Swarm, compose or systemd starts it fresh. A failed in-place restore changes nothing and says why on Backups; a full replace that fails after the wipe restarts into first-run setup. #5817 "Settings → Backups: Restore": a Restore button on each sent backup and on the file card. The chosen backup is checked (the same comparison as Check, now a shared partial) and held server-side for an hour under a token; it starts only once the admin types "restore", and an older backup also needs "Replace everything" ticked. A newer backup, or one whose key can't open its secrets, gets no button. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-15 11:03:01 -04:00