Recovery DriftSentinel / v0.1

Backup success is not recovery proof

Trust the restore.
Keep the receipt.

Sentinel restores your newest PostgreSQL backup in an isolated target, tests the facts your application depends on, and signs the evidence.

Run your first drill Read the source
Self-hostedNo telemetryPostgreSQL
A risograph-style archive reel feeds backup pages into an isolated database chamber, producing three verified seals and a proof receipt.
Backup → isolated restore → signed evidence

One command. Three pieces of evidence.

A recovery drill your scheduler can understand.

  1. Find & restore

    Selects the newest eligible dump, rejects stale backups and production-looking targets, then invokes PostgreSQL’s own restore tools.

  2. Check the facts

    Runs your SQL invariants and migration checks in read-only transactions. Expected values stay in config; returned values stay out of receipts.

  3. Sign the proof

    Writes JSON for automation and Markdown for humans, both tied to the backup SHA-256 and an HMAC signature you can verify later.

Start locally

From zero to first receipt.

You bring a disposable PostgreSQL target. Sentinel brings the guardrails and proof format.

recovery-drift-sentinel — zsh
$ cargo install --git https://github.com/B-Divyesh/sf-recovery-drift-sentinel
$ recovery-drift-sentinel init
Wrote sentinel.toml
$ recovery-drift-sentinel run --config sentinel.toml
Recovery proof: Passed
Example config Kubernetes CronJob Security model

Compact by design

Evidence without a data leak.

Receipts say what passed, how long it took, and which backup was tested. Query output and credentials never enter the artifact.

  • Backup identity and freshness
  • Restore status and duration
  • Named invariant results
  • Tamper-evident HMAC signature
RECOVERY PROOFPASSED
Backup
weekly-2026-08-24.dump
Freshness
02h 14m
Restore
✓ 48.2 s
  • ✓ orders have owners
  • ✓ ledger balances
  • ✓ migration 2026082201
HMAC-SHA256 · key 8bf0c194ae26VERIFIED

Intentionally narrow

It verifies recovery.
It does not become your backup system.

Sentinel does

Discover, restore, check, sign, and report.

Sentinel does not

Transport backups, host databases, repair production, or collect telemetry.

Free core, useful forever

The verifier is MIT. The rollout pack buys back planning time.

Every restore, check, signed receipt, and export remains free. The optional Team rollout pack adds a browser-local policy generator for multi-database schedules and 90-day drill evidence.

$39 once

  • Multi-database schedule matrix
  • 90-day evidence log template
  • Escalation runbook generator
  • Use across one team, forever
Buy the rollout pack Sociobot/Dodo is the merchant of record. Refunds are handled there and revoke the license.

Already purchased?

Paste your license to unlock this browser. Verification never blocks the free CLI or docs.

By purchasing, you agree to the terms. See how license data is handled in our privacy note.

Your next backup deserves a trial run

Make “we can restore” a fact.

Install Sentinel