Accept velero PVC backup for fovea audit data, no native Qdrant snapshot
Date: 2026-06-28 Status: Accepted Decision: hl-buts Deciders: Sean Brandt
Context
Section titled “Context”The fovea-audit-js (raw prompt+diff, JetStream) and qdrant-fovea-data (vectors) PVCs hold sensitive 30d observability/forensics data. Unlike engram’s durable memory store (which uses a native Qdrant S3-snapshot CronJob + velero dual-path), fovea audit is short-lived telemetry. The fovea namespace is stateful and therefore velero-backed by default (exclude-only strategy).
Decision
Section titled “Decision”Rely on the namespace’s default velero PVC backup for the audit PVCs. Do NOT build a native Qdrant snapshot CronJob for fovea-audit. Revisit if the cluster’s backup-target posture changes or audit retention grows beyond 30d.
Rationale
Section titled “Rationale”- Audit data is 30d observability/forensics data, not durable memory — its retention value does not justify a second backup mechanism.
- The engram dual-path pattern was designed for single-tenant durable memory; applying it to short-lived audit data would be cargo-culting.
- The raw-diff-in-velero exposure is documented as a sensitive-data surface and is already namespace-internal (encrypted backups).
Alternatives Considered
Section titled “Alternatives Considered”- Velero PVC backup only (chosen): zero new infrastructure; reuses the stateful-namespace default; sufficient for 30d observability/forensics data.
- Native Qdrant snapshot CronJob like agent-memory (rejected): app-consistent, collection-level, checksum-verified restore, but operational overhead for 30d data that is not durable memory — over-engineering relative to data value.
Consequences
Section titled “Consequences”- Positive: no CronJob/S3-config maintenance burden for short-lived data; clear, intentional divergence from the engram dual-path pattern.
- Negative: restore is block-level only (no app-consistent Qdrant recovery path); rollback (ArgoCD finalizer prune) can destroy audit PVCs depending on
longhorn-encrypted’sreclaimPolicy— operators must drain/extract forensics data first. - Neutral: scoped to fovea-audit; engram’s backup strategy is untouched.