Skip to content

Trial and Production

Going to production with encryption is not a leap of faith. Muppy Vault ships a deployment trial: a mode in which everything runs encrypted for real, while the plaintext stays in place as a safety net — and a four-step exit protocol that tells you, on screen, exactly what remains before the point of no return.

The promise it delivers: you cannot lose a secret by trying the vault. Until you deliberately take the last step, the plaintext never left.

Think of it as the dry-run of a migration: it is not a beta feature to be removed once the vault has proven itself, but a permanent part of how encryption is deployed — because what it certifies is not Muppy's code, it is your database crossing the vault. Every new activation, and every new family of secrets brought in later (including fields declared by partner addons), deserves its own trial, the same way trusted backup tooling never makes you drop the restore test.

The deployment trial

Turn it on in Settings ▸ Muppy Vault ▸ The deployment trial (Deployment mode — keep the plaintext as a safety net). While it is on:

  • Writes go to both places. Every secret written is encrypted into the vault and kept in clear in its original column, identical.
  • Reads are served from the vault, and audited. Every read serves the decrypted value — the production code path, exercised for real — and compares it against the plaintext copy behind the scenes.
  • A divergence is an alarm, not a loss. If the two ever differ, Muppy serves the plaintext (your reference), records the divergence in a journal, and notifies the keyring administrators with a link to the evidence. The user who happened to trigger the read is not bothered — a divergence is the operator's business.
  • The sweep becomes reversible. Running "Encrypt secrets still in clear" under the trial encrypts everything without clearing the columns. You can leave the trial at any moment with nothing lost.

The Encryption screen shows the trial's numbers: days under trial, divergence count, last divergence, and how much of the corpus is audited. Zero divergences is the exit criterion — and its weight grows with time: zero after two days means little; zero after six weeks of real use means what the trial is for.

The Encryption screen under trial: the counters, and a divergence flagged

The export file

The trial's certification rests on a plaintext export of every declared secret — taken through the same fields the application itself reads, which is exactly what makes it meaningful (see Certifying below).

On Vault ▸ Encryption, the Export button opens the ceremony. Three things to know, and the screen says them too, unsoftened:

Read before exporting

  • Without a passphrase, the file is a plaintext super-dump of every credential Muppy holds. It exists solely between your hands.
  • The file is never stored on the server — it is generated in memory at the moment of download and Muppy keeps no copy, only the fact that an export was produced, by whom, and when.
  • If you set a passphrase, the file is GPG-encrypted with it. Keep the passphrase in your password manager beside the master key — it is a different secret. (The passphrase is your own choice; it is never the master key.)

Exporting is gated by an identity check and traced in the chatter. A sealed vault refuses to export — but a database where encryption was never activated exports fine: that is precisely how the "before" reference file is taken.

The export ceremony and its warning

Compare and Import

Two buttons consume an export file. Both work from the same report of four counters:

    X updated       (values that differ file -> vault)
    Y new           (in the file, absent from the vault)
    Z vault only    (in the vault, absent from the file)
    S skipped       (records that no longer exist)

Compare writes nothing. It reads the live vault through the ORM fields and tells you how it differs from the file. 0 updated on a file taken before encryption is the certification: two independent code paths — the plain columns then, the store-and-decrypt path now — agreeing value by value.

Import writes the file's values back through the normal fields (so whatever mode the vault is in applies untouched). It never deletes: a secret present in the vault and absent from the file is reported, not removed — a file is a snapshot, and removal has no undo.

Both refuse a file taken from another database (record identifiers mean something else there), and both refuse to run sealed.

The exit protocol

The Encryption screen carries an Exit protocol tab: four steps, each showing whether it is done and, if not, why it is blocked — in a sentence, not a status code.

The Exit protocol tab: four steps, and what holds each one

Step 1 — Turn the mode on, export, then sweep

In that order. The mode first, or the sweep destroys the plaintext it is meant to keep as your safety net. The export second, because a reference file taken after the sweep proves nothing about what the encryption did. Then click Encrypt secrets still in clear: everything encrypts, columns stay.

The sweep: families still in clear, pre-checked, and the preconditions

Step 2 — Live the trial and monitor divergences

Run Muppy normally, for weeks. The number to watch is the divergence count, and it must stay at zero. The screen suggests 30 days and says openly that this is advice, not a rule — zero divergences over a fortnight is a statement about a fortnight.

If divergences appear: stop and understand them. This is the trial doing exactly what it exists for, and stopping costs nothing.

Step 3 — Certify

Export again, then Compare the before file against the live vault: 0 updated means every secret crossed the vault unchanged. Only Compare stamps the certification — an import that wrote its way to agreement would have certified nothing; it would have modified what was being certified.

Step 4 — Choose: commit or roll back

Commit — turn the mode off, then run Encrypt secrets still in clear once more. The plaintext columns are cleared. This is the point of no return: from here, only the master key opens anything — which is precisely the protection you came for. Guard the key as what it now is: the only way in (Troubleshooting).

Rollback — turn the mode off and remove the vault's copies (the envelopes and the encrypted rows). Your plaintext columns are intact: the trial cost nothing, which is the promise it was built on.

For the operator's eyes: the crypt store

Keyring administrators have a read-only debug window on the underlying ciphertext table (Vault ▸ Muppy Keyring), with search and filters — one row per encrypted value, showing which data key encrypts it. You will normally never need it; it exists so that when you do ask "what exactly is in the vault right now", the answer is a list view, not a support ticket.

The crypt store window: one row per encrypted value