Create and verify a backup

Back up Oore state before an upgrade or recovery operation. The backup contains a consistent SQLite snapshot, the encryption key needed for encrypted state, and a checksum manifest in an owner-readable .tar.gz archive. For a Complete installation, it also contains managed-runner.json when that config matches the selected database, control-plane URL, and managed runner service.

Backups without a managed runner config use oore-backup-v1. Backups with the config use oore-backup-v2. Use Oore v0.1.42 or newer to verify or restore a v2 backup. Current Oore releases still read older v1 backups.

This task supports only the default managed data layout. Do not use the manual command for a custom database/key layout: the command can select another database, but it cannot select that database’s matching encryption key.

What you need

• Write access to a separate encrypted destination.
• Enough free space for a database snapshot and archive.
• A plan to back up artifact payloads separately. Oore state backups do not contain local artifact files or S3/R2 objects.

1. Create the archive

oore backup create --output /Volumes/oore-backups/oore-state.tar.gz

Creation uses a consistent SQLite snapshot and may run while oored is live.

2. Verify the archive

oore backup verify --input /Volumes/oore-backups/oore-state.tar.gz

Verification checks the expected flat files, SHA-256 digests, key length, and SQLite integrity. If the archive contains managed-runner.json, verification also checks its private file mode, safe URL, and matching database registration.

Before creation, Oore recovers any interrupted restore for the selected state path. Stop oored first when recovery is required.

Verify the result

Confirm the first command prints Created backup and the second prints Backup verified. Copy the archive off the backend Mac, verify the copied archive again, and record the date and installed Oore version with it.

Troubleshooting

If creation cannot find state or the key, stop and confirm you are using the default managed layout. If verification fails, do not retain that archive as a recovery point; create a new one and investigate disk or copy errors.

If creation reports a managed runner mismatch, run oore setup to repair the Complete installation. Then create and verify a new backup.

Oore never captures runner.json or another custom runner config. If the Complete service uses one, repair the service before creating a backup.

Next step

Rehearse a restore on a non-production instance.