feat(backup): add verified SQLite snapshots#105718
Merged
Merged
Conversation
Co-authored-by: Gio Della-Libera <[email protected]>
Co-authored-by: Gio Della-Libera <[email protected]>
Co-authored-by: Gio Della-Libera <[email protected]>
Co-authored-by: Gio Della-Libera <[email protected]>
Co-authored-by: Gio Della-Libera <[email protected]>
openclaw-barnacle
Bot
added
docs
Member
Author
|
Land-ready proof for head
Known follow-up: cross-process destructive stress, crash injection, high-I/O repetition, additional containers/sandboxes/architectures, and the broader gateway/CLI database ownership race remain tracked under #94967 and #101290. They are the next workstream, not hidden proof for this local snapshot primitive. |
vincentkoc
marked this pull request as ready for review
July 12, 2026 22:26
Member
Author
|
Merged via squash.
|
github-actions Bot
pushed a commit
to Desicool/openclaw
that referenced
this pull request
Jul 13, 2026
* feat(backup): expose verified SQLite snapshots Co-authored-by: Gio Della-Libera <[email protected]> * feat(sqlite): add verified snapshot repository (openclaw#105525) Co-authored-by: Gio Della-Libera <[email protected]> * test(sqlite): use canonical snapshot schemas * fix(backup): restrict SQLite snapshot roles * fix(sqlite): harden snapshot staging paths Co-authored-by: Gio Della-Libera <[email protected]> * fix(sqlite): pin snapshot repository paths Co-authored-by: Gio Della-Libera <[email protected]> * fix(sqlite): secure Windows snapshot staging Co-authored-by: Gio Della-Libera <[email protected]> * fix(sqlite): validate macOS ACL captures * test(sqlite): preserve stat uid type * style(sqlite): satisfy snapshot lint --------- Co-authored-by: Gio Della-Libera <[email protected]>
This was referenced Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related: #94805
Related: #94967
Related: #101290
What Problem This Solves
OpenClaw had no supported way to capture one live SQLite database as a compact, portable, independently verifiable artifact. Operators either copied live database files and WAL sidecars, or relied on broad backup archives that do not provide a database-scoped restore primitive. That creates avoidable corruption and partial-copy risk during host moves, container replacement, failover preparation, and incident recovery.
This also supersedes the uneditable contributor prototype in #94805 while preserving Gio Della-Libera's design contribution and keeping the stress work in #94967 as the next validation slice.
Why This Change Was Made
This adds
openclaw backup sqlite create|list|verify|restorebacked by a strict local snapshot repository. Creation validates the source, uses SQLiteVACUUM INTOto capture committed WAL state, verifies the compacted output, hashes and manifests it, and publishes only a fully synced snapshot directory. Verification and restore re-copy content into private pinned staging paths before SQLite opens it, and restore writes only to a fresh destination outside the repository.The repository fails closed on schema, index, ownership, ACL, path-identity, manifest, hash, unexpected-entry, hardlink, symlink, and publication-race violations. Windows uses protected DACL directory creation; macOS validates ACL captures; POSIX paths require private ownership and modes. Scheduling, upload, retention, incremental WAL bundles, and in-place live database replacement remain out of scope.
User Impact
Operators can now create compact snapshots for the shared state database or a per-agent database, sync only completed snapshot directories, verify them independently, and restore into a fresh SQLite file. The command refuses unsafe repositories, tampered artifacts, unsupported database roles, existing restore targets, stale sidecars, and incomplete publications instead of guessing or falling back.
Evidence
tbx_01kxc5txjedwzht2hc1vzw3gyp(tidal-crayfish), Actions run https://github.com/openclaw/openclaw/actions/runs/29210878108.pnpm check:changedagainstorigin/main2c06dfdd2f: passed in 9m57s.pnpm build: passed in 1m29s.git diff --check origin/main...HEAD: passed.