From 0fb1d5aa9f63d2e256860095e7584494127a8256 Mon Sep 17 00:00:00 2001
From: ogt <ogt@awoooi.local>
Date: Wed, 15 Jul 2026 02:35:45 +0800
Subject: [PATCH] fix(backup): deploy guarded SigNoz backup script

---
 docs/LOGBOOK.md                                       |  1 +
 infra/ansible/playbooks/110-devops.yml                |  1 +
 ops/signoz/p0-obs-002-post-closure-regression.yaml    |  3 +++
 .../tests/test_backup_signoz_collector_restore.py     | 11 +++++++++++
 4 files changed, 16 insertions(+)

diff --git a/docs/LOGBOOK.md b/docs/LOGBOOK.md
index 44dde0a64..2cc48e858 100644
--- a/docs/LOGBOOK.md
+++ b/docs/LOGBOOK.md
@@ -8,6 +8,7 @@
 **source/test evidence**：
 - CD probe 改為先檢查 connection budget、保留 4 條安全餘量、最多 4 workers、單輪、每 request 5 秒；新增 workers/reserve/skip reason machine-readable receipt fields。
 - `backup-signoz.sh` 在 stop 前先 arm restore，加入 `EXIT/HUP/INT/TERM` trap、防重入 cleanup 與首次 restart 失敗後的有界 EXIT retry。
+- `110-devops.yml --tags backup_jobs` 納入 `backup-signoz.sh`，確保 source guard 有可驗證的 `/backup/scripts/backup-signoz.sh` 部署路徑，不再只停留在 repo。
 - 新增 `ops/signoz/p0-obs-002-post-closure-regression.yaml`，分離 API probe starvation、collector backup interruption、controlled recovery、source candidate 與 scope boundary。
 
 **仍維持**：
diff --git a/infra/ansible/playbooks/110-devops.yml b/infra/ansible/playbooks/110-devops.yml
index 34a777810..a0db8eb98 100644
--- a/infra/ansible/playbooks/110-devops.yml
+++ b/infra/ansible/playbooks/110-devops.yml
@@ -241,6 +241,7 @@
         - backup-momo.sh
         - backup-awoooi.sh
         - backup-awoooi-frequent.sh
+        - backup-signoz.sh
         - backup-configs.sh
         - check-backup-integrity.sh
         - verify-gitea-backup.sh
diff --git a/ops/signoz/p0-obs-002-post-closure-regression.yaml b/ops/signoz/p0-obs-002-post-closure-regression.yaml
index 6ff20acab..c550b9774 100644
--- a/ops/signoz/p0-obs-002-post-closure-regression.yaml
+++ b/ops/signoz/p0-obs-002-post-closure-regression.yaml
@@ -66,6 +66,9 @@ source_candidates:
     deployment_status: pending
   backup_restore_guard:
     path: scripts/backup/backup-signoz.sh
+    deployment_playbook: infra/ansible/playbooks/110-devops.yml
+    deployment_tag: backup_jobs
+    deployment_contract_present: true
     trap_exit_hup_int_term: true
     restore_armed_before_stop: true
     bounded_exit_retry: true
diff --git a/scripts/backup/tests/test_backup_signoz_collector_restore.py b/scripts/backup/tests/test_backup_signoz_collector_restore.py
index fcab0e174..e08feb796 100644
--- a/scripts/backup/tests/test_backup_signoz_collector_restore.py
+++ b/scripts/backup/tests/test_backup_signoz_collector_restore.py
@@ -8,6 +8,9 @@ from pathlib import Path
 
 ROOT = Path(__file__).resolve().parents[3]
 SCRIPT = ROOT / "scripts" / "backup" / "backup-signoz.sh"
+DEPLOYMENT_PLAYBOOK = (
+    ROOT / "infra" / "ansible" / "playbooks" / "110-devops.yml"
+)
 
 
 def _write_executable(path: Path, text: str) -> None:
@@ -129,6 +132,14 @@ def _collector_start_count(docker_calls: list[str]) -> int:
     return docker_calls.count("start signoz-otel-collector")
 
 
+def test_backup_jobs_deploys_the_guarded_signoz_script() -> None:
+    playbook = DEPLOYMENT_PLAYBOOK.read_text(encoding="utf-8")
+
+    assert 'dest: "/backup/scripts/{{ item }}"' in playbook
+    assert "- backup-signoz.sh" in playbook
+    assert "tags: backup_jobs" in playbook
+
+
 def test_collector_is_restored_once_when_backup_receives_term(tmp_path: Path) -> None:
     result, docker_calls, dump_dir = _run_backup(
         tmp_path,