Module restore 

choir backup restore — turn a backup back into a node, and refuse to say it worked until the restored node has accepted a write.

The other half of a backup leg. That one proves a copy arrived; this proves the copy is a node. A backup nobody has restored is a hypothesis, and the only thing that settles it is a running daemon appending to the log it was handed.

Nothing here mints a secret

Backups exclude them by design, so a restore has a hole in it only a person can fill: the daemon’s signing key, the credential, and any TLS material. This stops and names them rather than inventing replacements, because a minted node key is a new node wearing the old node’s log.

The ordering is the safety property

Read, refuse, then write. A restore that fails halfway has already destroyed the thing an operator would fall back to, so everything checkable about the backup is checked before a byte reaches the target — and the policy archive is unpacked into a work directory rather than into the node’s root for the same reason.

Examples

use choir_cli::restore::Refusal;

// Exit 3 is its own code: an operator decision, not a failed check.
let decision = Refusal::decide("the signing key is not here");
assert_eq!(decision.code, 3);

Structs

Backup

What the backup turned out to hold, after every read-side check.

Refusal

Why a restore stopped.

Restored

What a completed restore proved.

Constants

OPTIONAL

Policy whose absence changes what the restored node enforces.

REQUIRED

Policy a node cannot boot or serve restored refs without.

Functions

attested_refs

The refs an attestation says this log ends at, in display form.

bundle_for

The bundle for one repository, under either backup leg’s naming.

place

Places the log, the policy and the git objects.

read

Reads and checks everything about the backup, writing nothing.

ref_mismatches

Every difference between what was attested and what is served.

resuming

Whether this target is a resumed placement rather than a fresh one.

run

The whole restore: read, refuse, place, rehearse, prove.

secrets

The two holes a backup deliberately does not fill.

served_refs

The refs a served view reports, in the same form.

serving_port

The port out of the daemon’s own start line.