# WYG Backup and Recovery Procedure — Pilot

**Status:** Activation and production-account verification required
**Updated:** August 23, 2026

## Backup control

WYG uses Cloudflare D1 Time Travel as the primary automatic database-recovery control. Time Travel is provider-managed and supplies restore points without WYG running a destructive or data-bearing export through a public CI system. Before student launch, the operations owner must confirm that the bound database uses D1's production storage backend, record the plan-specific recovery window, and save evidence that a current bookmark can be retrieved.

The repository includes a daily scheduled recovery-point check. It requires restricted Cloudflare credentials and the production D1 database identifier. The job fails if it cannot retrieve evidence of a current restore point. CI output must never contain database contents or student information.

Private playbook uploads live in R2 and are not contained in a D1 restore point. Before launch, WYG must confirm the provider's object recovery/versioning behavior or establish a separate encrypted object-copy process and record its retention period. Until then, source-file recovery is an open launch gate.

## Recovery objectives

- Proposed pilot RPO: 24 hours maximum, subject to production-account verification.
- Proposed pilot RTO: four hours for a database recovery, subject to a timed drill.
- Restore authority: incident commander plus a second authorized maintainer.
- Production restore is destructive and requires written approval, a preserved pre-restore bookmark, and school communication when availability or records may be affected.

## Non-production recovery drill

Run `pnpm ops:recovery-test` before launch, at least quarterly, and after migration or backup-tool changes. The drill:

1. Creates isolated local D1 environments containing synthetic data only.
2. Applies every checked-in database migration in order.
3. Writes a unique recovery marker.
4. Produces a logical SQL backup.
5. Restores the backup into a clean environment.
6. Verifies the marker and critical tables.
7. Emits a machine-readable pass/fail result with duration and backup size.

Record the date, release, operator, result, elapsed time, exceptions, and corrective actions. A local drill proves the process and schema, not the provider account; the daily Time Travel check closes the provider-control portion.

## Production recovery decision

1. Open an incident record and identify the last known-good time.
2. Stop risky writes if continuing service could worsen data loss.
3. Confirm scope with the school when student records or test history may change.
4. Obtain approval from two authorized WYG maintainers.
5. Record the current bookmark so the restore can be reversed if needed.
6. Restore only to the approved timestamp/bookmark using the provider's protected operations channel.
7. Run health, authentication, roster, playbook, immutable-version, score-history, audit, and private-file checks.
8. Reopen service, monitor closely, notify the school, and preserve all evidence.

## Failure handling

A failed daily check or recovery drill is a high-priority operational event. Student onboarding and schema deployments pause until the cause is understood, a usable restore point is confirmed, and the evidence owner closes the corrective action.