`README.md`

33 lines
# backup-freshness-checker

READ-ONLY detector for silent backup gaps. Verifies a recent, **restorable**
backup actually exists for the canonical data + secret stores, and surfaces a
CNCP parking-lot card when anything is stale, zero-byte, or missing.

## What it checks
1. **dw_unified** canonical DB dump on Kamatera (`my-server`) — newest dump in
   `/root/backups/db` + `/root/db-sync`. Flags: newest dump is 0 bytes, no
   non-empty dump exists, or newest restorable dump is older than 48h.
2. **secrets master** `~/Projects/secrets-manager/.env` — mtime + size only
   (NEVER reads contents). Flags missing/empty; notes that no automated backup
   of this file was detected.

## Hard rules (by design)
- Never creates, runs, or modifies any backup. Never `pg_dump`s.
- Never echoes secret contents — mtime/size only.
- Detect-and-surface only. Exit 2 = critical, 1 = warn, 0 = all clear.

## Run
    ./check-backups.sh

## Suggested cadence (NOT installed — Steve-gated)
Mac2 launchd daily, e.g. 09:00 PT. A plist is intentionally NOT shipped here so
nothing schedules itself without Steve's say-so.

## Origin
Born 2026-06-14 (YOLO cycle-3 #5). Found the dw_unified nightly pg_dump silently
producing 0-byte dumps since 2026-06-13 (`password authentication failed for
user "dw_admin"` — stale hardcoded pw in `/root/DW-Agents/scripts/db-backup.sh`,
a recurrence of the same 2026-05-12 silent-failure class). Last GOOD dump was
2026-06-03 (1.28 GB), i.e. 11 days stale.