Backup and Disaster Recovery

Encrypted .agwbak archives (AES-256-GCM + PBKDF2). All 44 DB tables + /data/ file tree. gzip/TAR. Max 10 stored. APIs: create, status, list, download, restore. Cross-system portable (shared AGENTWATCH_BACKUP_SECRET).

RPO / RTO: backups can be scheduled (cron) or triggered on-demand; RPO is bounded by the schedule cadence (default hourly snapshot recommended for production). RTO is dominated by archive download + restore time — typically minutes for SQLite, low single-digit hours for PostgreSQL multi-GB datasets. For tighter targets, run an HA PostgreSQL primary/replica behind AgentWatch and rely on the database tier’s replication + PITR (point-in-time-recovery) rather than the .agwbak snapshot.

Multi-region failover: stateless application instances behind HAProxy or a global load balancer (Route 53, Azure Traffic Manager, Cloud DNS); shared PostgreSQL with cross-region read replicas; Redis with multi-AZ replication. The application tier supports active/active across regions; failover is automatic at the LB layer.

Configuration rollback: the encrypted backup is the system-of-record for full state rollback. Gateway routes, schemas, plugins, and guardrails all support import/export of their config JSON for fine-grained rollback without touching unrelated state.

Zero-downtime upgrades: rolling deploys behind HAProxy — drain → upgrade → re-add. Schema migrations are forward-only with self-healing backfills (Section 8).

---