Close release and quarantine recovery gaps

.github/workflows/ci.yml

@@ -82,6 +82,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - name: Test backup scripts
+        run: bash deploy/tests/backup_scripts_test.sh
       - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
         with:
           toolchain: 1.88.0

crates/frameshift-cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "frameshift-cli"
-version = "0.10.0"
+version = "0.10.1"
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true

crates/frameshift-mcp/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "frameshift-mcp"
-version = "0.10.0"
+version = "0.10.1"
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true

deploy/frameshift-backup-receive.sh

@@ -14,10 +14,10 @@ parse_upload_command() {
 
   read -r action kind timestamp extra <<<"${SSH_ORIGINAL_COMMAND:-}"
   if [[ "$action" != "put" || -n "$extra" ]]; then
-    echo "expected: put <postgres|objects|manifest> <UTC timestamp>" >&2
+    echo "expected: put <postgres|objects|quarantine|manifest> <UTC timestamp>" >&2
     return 64
   fi
-  if [[ ! "$kind" =~ ^(postgres|objects|manifest)$ ]]; then
+  if [[ ! "$kind" =~ ^(postgres|objects|quarantine|manifest)$ ]]; then
     echo "invalid backup kind" >&2
     return 64
   fi
@@ -34,6 +34,7 @@ backup_suffix() {
   case "$1" in
     postgres) printf '%s\n' 'postgres.dump.gz' ;;
     objects) printf '%s\n' 'objects.tar.gz' ;;
+    quarantine) printf '%s\n' 'quarantine.tar.gz' ;;
     manifest) printf '%s\n' 'manifest.txt' ;;
   esac
 }

deploy/frameshift-backup.service

@@ -13,6 +13,7 @@ PrivateTmp=true
 ProtectHome=true
 ProtectSystem=strict
 ReadOnlyPaths=/etc/frameshift /var/lib/frameshift/objects
+ReadOnlyPaths=-/var/lib/frameshift/quarantine
 NoNewPrivileges=true
 LockPersonality=true
 MemoryDenyWriteExecute=true

deploy/frameshift-backup.sh

@@ -49,14 +49,83 @@ backup_manifest() {
   printf 'objects=%s\n' "$objects_receipt"
 }
 
+# Produces a deterministic v2 manifest that includes the quarantine archive.
+backup_manifest_v2() {
+  local timestamp="$1"
+  local postgres_receipt="$2"
+  local objects_receipt="$3"
+  local quarantine_receipt="$4"
+
+  printf 'format=frameshift-backup-v2\n'
+  printf 'created_at=%s\n' "$timestamp"
+  printf 'postgres=%s\n' "$postgres_receipt"
+  printf 'objects=%s\n' "$objects_receipt"
+  printf 'quarantine=%s\n' "$quarantine_receipt"
+}
+
+# Rejects unsupported stores and validates distinct filesystem quarantine roots.
+validate_backup_sources() {
+  local objects_canonical
+  local quarantine_canonical
+
+  case "$OBJECT_STORE_BACKEND" in
+    fs) ;;
+    r2)
+      echo "OBJECT_STORE_BACKEND=r2 is not supported by this backup transport" >&2
+      return 64
+      ;;
+    *)
+      echo "invalid OBJECT_STORE_BACKEND: expected fs" >&2
+      return 64
+      ;;
+  esac
+
+  case "$QUARANTINE_OBJECT_STORE_BACKEND" in
+    disabled) return 0 ;;
+    fs) ;;
+    r2)
+      echo "QUARANTINE_OBJECT_STORE_BACKEND=r2 is not supported by this backup transport" >&2
+      return 64
+      ;;
+    *)
+      echo "invalid QUARANTINE_OBJECT_STORE_BACKEND: expected disabled or fs" >&2
+      return 64
+      ;;
+  esac
+
+  if [[ -z "${OBJECT_STORE_ROOT:-}" \
+    || ! -d "$OBJECT_STORE_ROOT" \
+    || ! -r "$OBJECT_STORE_ROOT" ]]; then
+    echo "OBJECT_STORE_ROOT must name a readable directory for filesystem quarantine backups" >&2
+    return 66
+  fi
+  if [[ -z "${QUARANTINE_OBJECT_STORE_ROOT:-}" \
+    || ! -d "$QUARANTINE_OBJECT_STORE_ROOT" \
+    || ! -r "$QUARANTINE_OBJECT_STORE_ROOT" ]]; then
+    echo "QUARANTINE_OBJECT_STORE_ROOT must name a readable directory" >&2
+    return 66
+  fi
+
+  objects_canonical="$(realpath -- "$OBJECT_STORE_ROOT")"
+  quarantine_canonical="$(realpath -- "$QUARANTINE_OBJECT_STORE_ROOT")"
+  if [[ "$objects_canonical" == "$quarantine_canonical" ]]; then
+    echo "public and quarantine object-store roots must be distinct" >&2
+    return 64
+  fi
+}
+
 # Creates and transmits one complete backup set without retaining archives locally.
 main() {
   local timestamp
   local postgres_receipt
   local objects_receipt
+  local quarantine_receipt
 
   load_environment "$SERVER_ENV_FILE"
   load_environment "$BACKUP_ENV_FILE"
+  : "${OBJECT_STORE_BACKEND=fs}"
+  : "${QUARANTINE_OBJECT_STORE_BACKEND=disabled}"
+  validate_backup_sources
   : "${POSTGRES_URL:?POSTGRES_URL is required}"
   : "${OBJECT_STORE_ROOT:?OBJECT_STORE_ROOT is required}"
   : "${BACKUP_SSH_KEY:?BACKUP_SSH_KEY is required}"
@@ -84,7 +153,24 @@ main() {
     "$(basename "$OBJECT_STORE_ROOT")" \
     | gzip -n \
     | send_backup objects "$timestamp")"
-  backup_manifest "$timestamp" "$postgres_receipt" "$objects_receipt" \
+  if [[ "$QUARANTINE_OBJECT_STORE_BACKEND" == "disabled" ]]; then
+    backup_manifest "$timestamp" "$postgres_receipt" "$objects_receipt" \
+      | send_backup manifest "$timestamp"
+    return
+  fi
+
+  quarantine_receipt="$(tar \
+    --create \
+    --file=- \
+    --directory="$(dirname "$QUARANTINE_OBJECT_STORE_ROOT")" \
+    "$(basename "$QUARANTINE_OBJECT_STORE_ROOT")" \
+    | gzip -n \
+    | send_backup quarantine "$timestamp")"
+  backup_manifest_v2 \
+    "$timestamp" \
+    "$postgres_receipt" \
+    "$objects_receipt" \
+    "$quarantine_receipt" \
     | send_backup manifest "$timestamp"
 }
 

deploy/frameshift-server.service

@@ -30,6 +30,7 @@ ProtectKernelTunables=true
 ProtectProc=invisible
 ProtectSystem=strict
 ReadWritePaths=/var/lib/frameshift/objects
+ReadWritePaths=-/var/lib/frameshift/quarantine
 RemoveIPC=true
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
 RestrictNamespaces=true