PRINCIPLE

Canonical immutability and operational recovery are distinct. LXKeys does not rewrite finalized Registry history to recover software operation.

SHARED RUNTIME

Production canonical data and evidence are stored in a shared runtime separated from application release directories. An application rollback can therefore restore known-good code without silently rewinding canonical records.

BACKUPS

Full recovery packages contain the database snapshot, evidence/storage material required for recovery, configuration reference, version information, a manifest and SHA-256 checksums. Backup existence is not considered recovery proof until verification and restoration procedures are tested.

RESTORE CONTROL

LXKeys Control may stage a recovery package and display integrity information. Privileged restore is deliberately performed through an audited host CLI so the web application does not receive Docker or root-level host privileges. Restore validates the package, creates a pre-restore backup, applies the recovery and runs post-restore integrity checks.

AUDIT

Application actions are recorded in the LXKeys Audit. Privileged SSH continuity actions are additionally written to a root-controlled, SHA-256 hash-chained external continuity ledger so a database restore cannot erase the fact that a recovery operation occurred and ledger continuity can be verified independently.

PUBLIC SCOPE

This document describes control principles only. Secrets, private host paths, recovery credentials and detailed defensive procedures are not public.