Evidence
The ledger
| Claim | Evidence | Last verified |
|---|---|---|
| Rolling patch upgrades are zero-downtime | 156/156 probes returned HTTP 200 during a live 26.6.0 → 26.6.2 upgrade — the published probe log, plus the UPGRADES.md row | 2026-08-25 |
| Minor upgrades have a ~16 s service window and sessions survive | Measured for 26.6.2 → 26.7.0, stop-start strategy — UPGRADES.md | 2026-08-25 |
| Every upgrade path is drilled nightly on 3 nodes under load-balancer probes, then failover, restore and session drills run | The HA matrix: public GitHub Actions, cron 01:47 UTC, on a 3-node container rig | nightly, in public |
| Every supported upgrade path re-proves itself nightly | The upgrade matrix: public GitHub Actions, cron 03:17 UTC — install the old version, log in, upgrade, and the pre-upgrade session must still refresh | nightly, in public |
| A clean 3-node install takes ~10 minutes | The HA smoke workflow installs 3 nodes from scratch on every change to the roles — run durations are public | every roles change |
| A 3-node cluster installs and upgrades with no internet access on the nodes | The offline workflow builds offline bundles for two releases, removes the nodes' default route, then installs from one, runs every drill, and rolls onto the next release from the other; a bundle missing the target version stops the upgrade before it touches the cluster | every roles change and weekly |
| Sessions survive a full rolling restart | ./verify --drill session — runs in CI on every commit, and on your cluster whenever you like | every commit |
| Backups actually restore | ./verify --drill restore — pgBackRest restores the latest backup to a scratch directory; CI runs it on every commit and nightly on 3 nodes, and you can run it on your own cluster | every commit |
| PostgreSQL fails over automatically | ./verify --drill failover — Patroni switchover with a write test through the load balancer; CI runs it on 3 nodes on every roles change and nightly | nightly, in public |
| Agent8 runs Jenkins builds on Java 8, including CentOS 6.10 and OpenJ9 | Agent8 CI: HotSpot 8 on CentOS 6.10 and OpenJ9 8 against the current Jenkins LTS and weekly — Pipeline, Git checkout, credentials, abort and agent restart; Java 11 and 17 against the LTS | every change and weekly |
| An older Agent8 release keeps working after a controller upgrade, within limits | The version-skew job in Agent8 CI runs the latest release against the newer weekly controller; Jenkins 2.586 refusing the build for 2.462.3 is recorded in the README | every change and weekly |
The last seven nights
Every supported upgrade path, every night, in public. The table is rebuilt from the GitHub Actions API each morning; a red mark stays here for a week.
ha-matrix.yml 3 nodes, load balancer probed every second, then every drill
| Upgrade path | Strategy | 10-10 | 10-11 | 10-12 | 10-13 | 10-14 | 10-15 | 10-16 |
|---|---|---|---|---|---|---|---|---|
| 26.8.0 → 26.8.1 | rolling | – | – | – | – | ✓ | ✓ | ✓ |
| 26.7.5 → 26.8.1 | stop-start | – | – | – | – | ✓ | ✓ | ✓ |
| 26.7.5 → 26.8.0 | stop-start | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| 26.7.3 → 26.8.0 | stop-start | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| 26.7.3 → 26.7.5 | rolling | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| 26.7.0 → 26.7.5 | rolling | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| 26.6.7 → 26.7.5 | stop-start | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| 26.6.6 → 26.7.5 | stop-start | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| 26.6.2 → 26.7.5 | stop-start | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| 26.6.6 → 26.6.7 | rolling | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| 26.6.4 → 26.6.6 | rolling | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| 26.6.0 → 26.6.2 | rolling | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| 26.2.5 → 26.2.16 | rolling | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
upgrade-matrix.yml single node: install, log in, upgrade, the session must refresh
| Upgrade path | Strategy | 10-10 | 10-11 | 10-12 | 10-13 | 10-14 | 10-15 | 10-16 |
|---|---|---|---|---|---|---|---|---|
| 26.8.0 → 26.8.1 | rolling | – | – | – | – | ✓ | ✓ | ✓ |
| 26.7.5 → 26.8.1 | stop-start | – | – | – | – | ✓ | ✓ | ✓ |
| 26.7.5 → 26.8.0 | stop-start | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| 26.7.3 → 26.8.0 | stop-start | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| 26.7.3 → 26.7.5 | rolling | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| 26.7.0 → 26.7.5 | rolling | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| 26.6.7 → 26.7.5 | stop-start | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| 26.6.6 → 26.7.5 | stop-start | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| 26.6.2 → 26.7.5 | stop-start | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| 26.6.6 → 26.6.7 | rolling | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| 26.6.4 → 26.6.6 | rolling | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| 26.6.0 → 26.6.2 | rolling | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| 26.2.5 → 26.2.16 | rolling | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
✓ passed, ✗ failed, – not in the matrix that night. Each mark links to the job's full log. Fetched from the GitHub Actions API on 2026-10-16 18:06 UTC.
Claims we do not make (yet)
- A single-node-to-HA growth path. Growing from one node to three today means a fresh 3-node install plus a realm import. Documented, not hidden.
- An SLA. We publish measurements, not promises. An uptime number without a public probe log is marketing.
- SOC 2 / ISO certification. Certifications attest to how a vendor handles your data. Your data never reaches us — the code is auditable and the drills are runnable instead.
Corrections
Found a claim that's wrong, stale, or missing a receipt? Email hello@keelinfra.io — we correct within one business day.