Validate archived retrieval before deletion
Compare retained source rows with verified archives and optional gateway ID lookups; persist redacted evidence.
Archive without deleting first
Create a completed archive and keep its eligible source records stable and present. Refresh and map it in the gateway catalog. Shadow validation never deletes or restores source data and rejects jobs with deletion history. It holds job/policy locks and uses the original connector identity.
coldctl archive shadow JOB_ID --confirm-original-source --gateway-url https://archive.example.com --dataset-id DATASET_ID --token-env COLDCTL_GATEWAY_TOKEN
coldctl archive shadow-reports JOB_IDBounded, explicit coverage
Omit all gateway flags for source/archive comparison only. --max-batches and --max-duration-seconds bound a trial; unfinished runs return incomplete and nonzero. The duration is cooperative: blocking archive I/O may finish first. Gateway mode batches typed ID membership searches (64 keys by default; --gateway-batch-size accepts 1-100), matches results by key and checks all supported columns, missing/duplicate/extra records and truncation. Reduce batch size for wide records or small Gateway result limits. Durable reports distinguish keys checked from HTTP requests. It does not mirror live application traffic or validate arbitrary predicates, joins, collation and aggregates. MongoDB uses the raw-BSON envelope. Comparisons retain timestamp/decimal precision; non-finite floats are unsupported.
Evidence and safety
Reports store manifest hash, timestamps, rows/batches, gateway lookups, source-mismatch batches and gateway-mismatch rows without record values, keys, raw errors or credentials. Crashes leave running/unfinalized evidence, never a pass. New runs restart comparison from the beginning. Responses are capped at 1 MiB and gateway calls at 30 seconds. Production protection applies. The latest 100 reports are listed; older reports remain in shadow.sqlite. Real-cloud/100-GB qualification remains pending.