SQLite and durable state

Database foundation

warden.db lives in the private configuration directory with owner-only permissions. Numbered migrations run transactionally at startup; foreign keys, WAL journaling, full synchronous writes and a busy timeout are enabled. Startup runs PRAGMA quick_check after migration and refuses corrupt databases or schemas newer than the binary.

Migration evidence

The hardening suite constructs every historical schema prefix, inserts a durable canary where the first schema exists, upgrades it to the current schema and verifies both the complete migration ledger and preserved canary. Separate cases cover a clean database, four simultaneous startup attempts, corrupt bytes and a synthetic future version.

Durable operational objects

• account-owned agent conversations, transcript events and individual agent runs;
• account-owned terminal tabs and bounded server-side scrollback;
• alert rules, evaluation state, firing/resolved incidents, events and acknowledgements;
• website definitions, domains, immutable revisions and asynchronous operation jobs;
• normalized accounts, identities, roles/capabilities, browser sessions and AI usage totals;
• structured audit events, including an idempotent import of the earlier audit log.

Restore drill

1. Stop Warden so no process owns the database or configuration projections.
2. Copy the entire configuration directory to protected storage, including warden.db, its WAL/SHM files if present, master.key, secrets.json and site data.
3. Restore into an empty mode-0700 directory owned by the Warden OS user.
4. Start the same or a newer Warden release. Never start an older release against a newer schema.
5. Sign in, confirm roles and identities, open one conversation and terminal record, inspect Audit, and decrypt one configured provider credential by making a controlled request.

For cross-instance migration, the password-encrypted portable backup re-encrypts secrets under the destination master key. The test suite verifies correct-password recovery and wrong-password rejection.

Rollback boundary