-
Notifications
You must be signed in to change notification settings - Fork 1
Backup Workflow
Alex Stoyanov edited this page Apr 17, 2026
·
11 revisions
Use this page to choose a backup strategy that matches your custody policy and the amount of coordination you can realistically maintain.
For your first successful drill:
- use one small test file
- do not shard yet
- recover it immediately
- compare the restored bytes with the original
Complex custody schemes are only useful after the simple path has already worked.
| Mode | Use it when | What it costs |
|---|---|---|
| Non-sharded | one operator can recover alone | lowest coordination, weakest separation of duties |
| Passphrase-sharded | one person must not recover alone | shard custody and quorum planning |
| Dual-sharded | passphrase and signing identity must be split | highest coordination burden |
| Sealed | your policy requires a sealed artifact set | less flexibility later; sealed roots cannot be extended |
Practical defaults:
- start with non-sharded for the first drill
- use 2-of-3 when one person must not recover alone
- use dual sharding only when policy requires it
| File | Purpose |
|---|---|
qr_document.pdf |
primary QR scan source |
recovery_document.pdf |
fallback text recovery path |
shard-*-N-of-K.pdf |
passphrase shard artifacts when sharding is enabled |
signing-key-shard-*-N-of-K.pdf |
signing-key shard artifacts when dual sharding is enabled |
recovery_kit_index.pdf |
optional index page for designs that support it |
These are different artifact classes. Treat them that way in storage and custody.
- Keep main documents, recovery documents, and shards in separate custody paths.
- Keep one independent non-Ethernity backup path.
- Record which artifact set belongs to which source and date.
- Do not store every recovery input in the same folder forever and call that a custody policy.
If the source data changes later:
- use
ethernity extendto append changes to an existing unsealed root - use
ethernity compactwhen you want to flatten a root plus extensions into a new standalone set
Practical rule:
- use
extendfor normal updates - use
compactwhen the chain has done its job and you want a fresh root to carry forward
For the full operator flow, use Extension Workflow.
- 2-of-3 is a practical baseline for small teams.
- 3-of-5 is more resilient, but slower to assemble under pressure.
- Test the minimum quorum, not just the full set.
- Avoid thresholds your team cannot actually meet during an incident.
- Starting with complex sharding before a simple first drill.
- Storing all artifact classes together.
- Never testing minimum-quorum recovery.
- Picking a threshold that sounds good on paper but fails in practice.
- Treating printed artifacts as automatically safe without a custody plan.