Skip to main content

Safety model

DonkeyFleet treats safety requirements as executable boundaries, not operator reminders.

Non-negotiable invariants​

  1. Source-role clusters are read-only. All mutating clients are guarded by destination role.
  2. Identity is the volume UUID. A reused name with a new UUID is never treated as the same volume, and is never auto-remediated. (Automatic source_replaced detection is planned, not yet implemented.)
  3. Partial observation stops the run. Failed requests, unfinished pagination, and record-count mismatches produce skipped_observe_incomplete.
  4. Adopted and suspended relationships are structurally excluded from mutating queries.
  5. Intent is persisted before ONTAP work. Long-running ONTAP job UUIDs are persisted and polled; unresolved jobs are never blindly re-issued.
  6. Initializations are serialized. The default concurrent-baseline limit is one, and the bandwidth budget is checked.
  7. Deletion always requires a person. Orphans never auto-delete.
  8. Apply is gated by effective dry-run. The one-way kill switch wins over configuration and the UI override.
  9. Ambiguity is a refusal. Colliding destination names, ambiguous aggregates, and a missing named schedule produce an actionable skip instead of a guess.

Approval is not execution​

Approval records authorization and the expected action payload. The reconcile loop re-checks the current volume UUID, policy, destination, and guardrails before executing.

Read the indicators correctly​

An initializing baseline can remain uninitialized and unhealthy for many hours. This is expected while the ONTAP job is still active; it is not the same state as suspended.