Skip to main content
The control plane keeps audit events, deploy attempts and pipeline runs in its database. Archives move the old ones into zstd compressed NDJSON bundles under <data dir>/archives, so the live database stays small and nothing is lost. A bundle can be browsed, verified by restore, downloaded and put back.

​
Retention tiers

The audit log also has its own purge (APP_AUDIT_LOG_RETENTION_DAYS, default 90). Keep the audit hot days below it, or archiving never sees those rows.

​
What is archived

  • Audit events: every row older than the hot days.
  • Deploy attempts: finished attempts older than the hot days. The two newest successful attempts of each service are never archived (they are rollback targets), and neither is an attempt a health probe still points at.
  • Pipeline runs: succeeded, failed and cancelled runs older than the hot days, with their jobs and steps. Run logs, artifacts and approvals of an archived run are deleted with it.
Bundles hold no secret values. Deploy attempts record only the key names of secret environment variables, never their values.

​
Safety

A bundle is written, fsynced, then re-read and compared (checksum and per-table row counts) before any live row is removed. If the re-read fails, the live rows stay. Restore and verify check the recorded checksum first, so a modified bundle is refused. Each run is bounded: at most 50,000 rows (5,000 pipeline runs) per bundle and 20 bundles per kind per run.

​
Verify by restore

Verify checks the checksum and row counts, then restores the bundle into a scratch database built from the current schema and compares the counts. The live database is untouched. The result is stored on the bundle and shown in the list.

​
Restore

Restore inserts the bundle’s rows back into the live tables. Rows already present are left alone, so it is safe to run twice. Pipeline runs whose pipeline no longer exists are skipped. Restored rows age out again on the next archive run.

​
Full control plane dump

The whole database (secrets stay encrypted with the master key, which is never included) is covered by control plane backup: scheduled snapshots, off-box encrypted copies and a restore drill that restores into a scratch database. Archives are for cold history. The dump is for disaster recovery.

​
Use it

Settings, Control plane backup, Archives card: archive now, browse a bundle’s rows, verify, restore, download, delete, and edit the retention tiers.
Scheduled archiving is off until you turn it on. It checks hourly.
Last modified on October 19, 2026