Agents operations and recovery

Agents v0.10 · Early access · Updated 23 October 2026

Use one writer per workspace, private backups and an isolated recovery rehearsal before customer access.

Storage and migration

CREEKX_STORE=sqlite enables a versioned snapshot store with WAL, FULL synchronous mode and transactional revision checks. It is not a normalized multi-tenant database. Migration retains a private pre-SQLite JSON copy. Once SQLite exists, JSON fallback is refused to avoid loading stale state. A save failure makes readiness fail and stops data APIs from presenting uncommitted memory as stored data.

Shutdown and leases

Ctrl+C or SIGTERM aborts provider work, drains connections, finishes saves and releases the writer lease. Wait before restarting. If an unclean shutdown leaves a lease, inspect its recorded process and verify it is stopped before moving that exact lock aside. Preserve it for investigation; never remove a lock speculatively while another writer might run.

Health and errors

GET /livez reports liveness. GET /readyz checks storage and draining; strict mode also requires configured authentication and model settings. It does not probe model quality or caller acceptance. GET /api/metrics returns numeric counters behind configured authentication. Errors include a server request ID. Use that identifier for investigation without publishing credentials, transcripts or provider bodies.

Encrypted backup

Provision the separate key with node tools/backup-key.mjs and set CREEKX_BACKUP_KEY_FILE. An administrator can create an AES-256-GCM backup in Operator security. Keep the key separate from backup copies. Review package docs/DEPLOYMENT.md before tools/decrypt-backup.mjs. Decryption creates private plaintext and is not a one-click restore. Stop the app and preserve the current directory before replacing valued data; rehearse with a copy first.

Exports and retained copies

Evidence exports include source content, configuration and suite plus a file digest. Transcript exports contain customer messages. Protect exports like workspace data and review before sharing. Archiving a source does not erase older sessions, publications, exports or backups. Include every copy in your retention process; full cascading source revocation is not implemented.

Upgrade and rollback checklist

1. Record the current version and stop pilot traffic.
2. Create a backup and verify the private key is available.
3. Retain the old package and configuration outside the new source directory.
4. Exercise the new package against an isolated workspace copy.
5. Verify login, sources, publication, supported replies, abstention, local tickets and operator replies.
6. Expand only after intended hardware and recovery checks pass.

Do not assume an older executable can read a newer store. Rollback may require both the matching old package and pre-upgrade data. Media Server installation does not upgrade this separate Agents service.

Acceptance and cost

Measure recognition errors, first audible speech, physical-device behavior, provider failures and operator workload. Production load, customer isolation and long-running recovery remain open. Revenue previews neither charge cards nor establish authoritative voice minutes. Budget inference, storage, hardware and staffing separately from any Media Server plan.