Operations

Run NOXA with repeatable deployment and day-2 procedures.

Operations guidance follows implemented runtime runbooks: deployment, backup, restore, upgrade, rollback, observability, and exploitation controls.

Lifecycle

Operational lifecycle status

Deploy

Implemented

Compose, Kubernetes, and Helm deployment flows with preflight checks are documented and script-backed.

python ./scripts/install.py compose-up --init-env --generate-certs

python ./scripts/install.py k8s-up --init-env --generate-certs

python ./scripts/install.py helm-up --init-env --generate-certs

Backup / Restore

Implemented

Runbooks and helper scripts exist for operational backup and restore validation.

powershell -File ./scripts/backup_db.ps1

powershell -File ./scripts/restore_db.ps1 -BackupFile <dump>

python ./scripts/install.py compose-rollback <dump>

Upgrade / Rollback

Implemented

Upgrade and rollback paths are explicit with pre-checks and post-checks.

python ./scripts/install.py compose-upgrade

python ./scripts/install.py compose-rollback <dump>

cd backend && make db-current

Observability and exploitation

Implemented

Metrics, structured logs, and operational indicators are available for day-2 operations.

GET /metrics

GET /api/v1/admin/license/diagnostics

docker compose logs --tail=200 backend

Boundaries

Runbooks are implemented and versioned, but client-specific SOP customization remains an integrator responsibility.

Supportability depends on trust-chain conformity, not only service uptime.

Operational commitments should be tied to validated deployment profiles and measured telemetry.

Support Continuity

Valid signed license artifacts (license.json + license.sig).

Valid signed product-manifest and bundle-manifest artifacts.

Edition/module/version/artifact coherence between runtime and signed manifests.

No unsupported rebuild or tampering of official runtime artifacts.

Legacy boundary

Canonical production target is signed file artifacts (license + manifests + signatures).

Legacy schema/token paths remain migration-only compatibility paths.

Inline license.signature and runtime_signing.kid fields are transitional interoperability mirrors.

Legacy compatibility is explicitly re-evaluated before 2026-12-31.