Consistent backups

The administration dashboard creates downloadable archives. SQLite backups contain a consistent native snapshot plus a portable logical archive; PostgreSQL backups are the portable logical archive, a transactionally consistent dump of schema metadata, records, identities, rules, events, audit, jobs, integration targets and the file manifest. Local file objects are included when local storage is active.

Archive contents

• manifest.json records format, schema version, storage provider and secret treatment.
• trestle.db is produced with SQLite VACUUM INTO, rather than copying a live WAL database.
• files/ is included for local storage. S3 objects remain in the configured bucket and require the provider's own backup policy.

Operational boundary

Backup archives contain sensitive account hashes, sessions and encrypted integration secrets. Store them as production credentials, restrict access and test restore procedures regularly.

Administration API

POST /admin/v1/backups
GET  /admin/v1/backups
GET  /admin/v1/backups/{archive}

All endpoints require an authenticated administrator; mutations also require CSRF protection.

Dogfood path

The incident tracker gate creates a database-and-files archive, downloads it, and requires restore preflight to accept the exact artifact. See the recovery proof.

Provider storage

SQLite backups retain the native consistent snapshot. PostgreSQL backups are a portable Trestle logical archive: a transactionally consistent dump of schema metadata, records, identities, rules, events, audit, jobs, integration targets and the file manifest. A Trestle backup never claims to back up an operator's whole PostgreSQL service; use pg_dump or a managed-service backup separately for cluster-level protection.