ENGINEERING INDEX / ENTRY 15
CASE 15 / RECOVERY / PRIVATE STATE
A backup is only useful if it returns.
Learning progress, sessions, journals, and evidence live in separate private stores. A credible backup has to verify and restore them together. James set the recovery design direction and tested the behavior.
Can Academy restore the learning state and evidence without copying access credentials?
Where the handoffs happen.
The recovery test restores four databases and one evidence file, checks a recovered session and journal, and excludes the access-key file. Tampered hashes, unsafe paths, and live overwrite are refused.
- 01Create backup
- 02Verify manifest and hashes
- 03Restore to new location
- 04Inspect recovered state
What the record earns.
Four databases and one evidence file restored in a synthetic drill.
- Observed receipt
- The local recovery suite passed again on September 28, 2026 (4 tests). The synthetic fixture restored four databases and one evidence file to a new directory, left the access-key file out, and refused a tampered backup and live-data overwrite.
- Source and scope
- Twilight Academy recovery implementation and tests/test_recovery.py at clean commit 64556b625271b63af7068eb39726f69e9a7ee8e9. Selected assertions from the synthetic drill appear below.
Selected assertions from a local backup-and-restore fixture. No family data, journal text, or key value is included.
- Verify backup → 4 databases; 1 evidence file; credentials_included == False
- Restore to new directory → verified == True; evidence_paths_relocated == 1
- Recovered fixture session, journal, evidence bytes, and classroom database integrity
- Access-key file absent from backup and restored directory
- Tampered backup → hash mismatch; live-data overwrite → refused
- Source
- Twilight-Academy tests/test_recovery.py: test_verified_backup_restore_recovers_every_private_state_store and test_backup_verification_rejects_tampering_and_restore_refuses_live_overwrite. Clean HEAD 64556b625271b63af7068eb39726f69e9a7ee8e9; all 4 recovery tests passed.
- What it does not show
- The restore ran on synthetic local data. It does not measure offsite recovery, time to restore on a new device, or erasure from historical backups.
What this does not prove.
A local synthetic drill is not a scheduled offsite backup, field recovery, or proof of acceptable recovery time.
Where the work goes next.
Rehearse restore from an independently stored backup on a fresh device with measured time and a privacy-safe checklist.