Appearance
Release Archive — Ops Quick Reference
One-page policy. No code. For the engineering doc with internals see release-archive-and-env-retention.md.
The lifecycle
| When | What happens |
|---|---|
| Release completes (or fails, rolls back, is cancelled) | Full data kept indefinitely. Nothing auto-deletes. |
| 3 years after completion | Release is auto-archived. All data is still intact. Status shows archived. |
| Anytime after archive (manual or auto) | You can unarchive for 30 days. Restores the prior status. Data was never touched. |
| 30 days after archive | Permanent purge: per-service config, env-version pin, and command logs are cleared. The release row stays. Unarchive button disappears. |
You can also manually archive any terminal release (completed / failed / rolled_back / cancelled) at any time — same 30-day clock starts when you click the button.
The sweep runs once every 24 hours.
What's kept vs purged
After the permanent purge runs, here's what's left on an archived release:
| Kept (forever) | Purged (at archive + 30d) |
|---|---|
| Release name, version, type | Per-service container images |
| Release notes / changelog | Env-version pin |
| Stage approvals (who, when) | Per-instance command payloads |
| Activity log / timeline | Per-instance command replies |
| Initiator, created/deployed/completed timestamps | |
| Archive timestamp |
Goal: audit story ("who approved this, when") survives forever. Operational detail ("which exact image went where with what env") goes away after 3y + 30d.
Env-variable history
Every change to an env var (default or instance override) is recorded. Cleanup runs in the same 24h sweep.
A history entry is kept if any of these is true:
- A release points at it.
- An instance is currently running it.
- It was changed less than 30 days ago.
Anything else gets cleaned up.
Practical effect:
- Recent edits — always browsable for at least 30 days, no matter what.
- Edits tied to a release — kept as long as the release is kept (i.e. until 3y + 30d past completion).
- Edits an instance is actively running — kept as long as the instance is on that version.
Common situations
"I archived a release by mistake"
- Within 30 days → open the release, click Unarchive. Status restores. Nothing was lost.
- After 30 days → not recoverable. Per-service config, env pin, and command logs are gone. The release record itself (name, notes, approvals, activity log) is still there. If you genuinely need the purged data, restore from backup.
"I need to see the env-var diff for an old release"
- Release is not archived (or archived <30d ago) → diff is there, view as normal.
- Release was purged (archived >30d ago) → diff is no longer available. The UI shows an "archived (permanent)" banner.
"I need to see what I changed in env vars last week"
- Always works. The 30-day age floor on env-var history guarantees the last 30 days are browsable.
"I need to see env-var changes from 6 months ago"
- Visible if a release or a live instance still points at that version. Otherwise gone.
"Worker isn't archiving anything"
- Check the worker dashboard — look for
release_archive. It runs every 24h on the leader replica. If it shows recent runs witharchived: 0, purged: 0, envVersionsPruned: 0, that's normal — it just means nothing was eligible this tick.
"I want to keep a specific release forever, even past 3y"
- Not currently supported as a per-release flag. Workaround: manually unarchive within the 30-day window each time it auto-archives. Cleaner option (ask engineering): add a "pinned" boolean to skip auto-archive for that row.
What to tell users
Releases stay fully visible for 3 years. After that they're auto-archived — still listed, still searchable, but flagged. You have 30 days from archive to unarchive if you need it back. After that, the deployment details (which image, which env vars) are cleared, but the changelog and approval history are kept forever.
Env-var history works the same way: the last 30 days are always there, and anything tied to a release or a running instance stays as long as that release or instance does.
Knobs (require engineering to change)
| What | Default |
|---|---|
| Time before auto-archive | 3 years |
| Unarchive window | 30 days |
| Sweep frequency | 24 hours |
| Env-var history floor | 30 days |
| Max releases archived/purged per sweep | 100 |
All four time windows are constants in the codebase — straightforward edits, no schema change.