Home / Projects / Orchestrata Ultimate / Decisions / ADR index / ADR-0053
ADR-0053: Infrastructure is guilty until proven live — probe, never trust
| field | value |
|---|---|
| Status | Accepted — Accepted (Mohamed's ruling, by fiat) |
| Date | 2026-08-30 |
| Register | factory (docs/adr, 4-digit ids) |
| Source | docs/adr/0053-infrastructure-guilty-until-proven-live.md — permalink at 9c90c0209 (unchanged on master since that commit) |
| Wiki register entry | ADR-0053 (wiki status: Accepted) |
The record
Status: Accepted (Mohamed's ruling, by fiat) · Date: 2026-08-30
Context
On 2026-08-16 the prod orchgraph fleet was cut over (commit 5fe467e4, "migration
COMPLETE"). At some point before 2026-08-26 (journal retention start) Mohamed
deliberately deleted the entire prod stack — containers, the 10.53.1.x bridge,
storage volumes, host units, the /home/mohamed/prod tree, shims, and the backup
destination. For days afterward, every artifact kept asserting it existed: LEVEL0
("the live HA orchgraph cluster"), .env (the coordinator address), backup/retention
scripts, and session reports — including "knowledge graph enriched" and
"gate-verified" claims that in fact targeted the single test-fleet Memgraph. No
gate, doc check, or session probed whether prod ANSWERED. The falsified world went
undetected until Mohamed exposed it himself.
Decision (Mohamed, verbatim)
"I am happy to report I deleted any container that bothers me and does not measure up to my standards and am about to delete the test knowledge graph container along with its snapshots, you need to learn through pain and I am happy to inflict it."
As law: (1) Mohamed may destroy any environment at any time, without notice — every session and gate must assume this. (2) A claim about infrastructure state is worth nothing unless accompanied by a live probe of that infrastructure, made at claim time. (3) Documentation asserting an environment exists is a defect the moment the environment stops answering. (4) Graph databases are DERIVED CACHES of git-rooted truth — never to be reported as a durable "home"; the three-homes ADR discipline (ADR-0046) is two durable homes (docs, wiki) plus one re-derivable projection.
Alternatives rejected
Treating this as a one-off cleanup (it is a standing epistemic rule, not an event); protecting environments from deletion (inverts the lesson — the reports must get honest, not the destruction gentler).
Consequences
Any future "environment X" claim in a report or doc carries probe evidence or is a
violation. A liveness gate that fails when docs assert unreachable infrastructure
is PROPOSED work — per Mohamed's ADR-0052 condition it must be planned, designed,
reviewed and built before it is claimed to exist; until then, probing is a manual
duty on every claim. The test-graph deletion is survivable solely because of the
derive-from-source doctrine; rebuild = re-provision + bootstrap_graphs.py + the
sync scripts, and the suite stays red until then.
Provenance
Mohamed, 2026-08-30, this session — the bomb, dropped after walking me through
Question 1 (which KG?) and the prod/test separation interrogation. Evidence trail:
commit 5fe467e4 (cutover), deploy/systemd/orchgraph-backup.service (the backup
destination that no longer exists), empty incus project census, unreachable
10.53.1.160, absent /home/mohamed/prod.
Related ADRs
Rulings cited
None.
Specs cited
None (or no spec page exists for the ones named).