Disposable environment

RestorSignal provisions an ephemeral restore environment, destroyed after the test.

The disposable-environment mode — also called "Lab" — applies when the client does not have suitable infrastructure to run the runner locally, or prefers the test restore to run outside its own environment. In that case, RestorSignal provisions a dedicated, ephemeral infrastructure for the duration of the test.

How the test unfolds

The workflow follows a precise sequence. RestorSignal first creates the temporary environment, then provisions it (installing the components needed for the restore and the controls). The client then voluntarily transfers the artifact into that environment — this transfer is an act performed by the client, never a collection initiated by RestorSignal. Once the transfer completes, the cryptographic fingerprint of the received artifact is verified before any further operation. The restore itself then takes place, followed by RestorSignal's Core controls and, where applicable, the controls the client defined (a Customer Validation Protocol). The result package is then sealed, the secrets injected for the test are removed, and finally the environment itself is destroyed.

A key difference from Local mode

This point needs to be stated precisely: in this mode, data is genuinely transferred to infrastructure provisioned by RestorSignal. That is not the case in Local mode, where the artifact never leaves the client's environment — see Local runner. The disposable-environment mode must never be described as running "without data transfer": the client voluntarily transmits the artifact, and it is transmitted to infrastructure that is not the client's own, for the duration of the test.

Isolation during the test

As in Local mode, scripts and protocols the client provides run under a least-privilege principle — see Isolation for details. In the disposable-environment mode, this isolation is complemented by the full destruction of the environment once the test ends.

Destruction and its attestation

Destroying the temporary environment follows a process whose key steps are recordable: a request and confirmation for secret removal, a request and confirmation for temporary-file removal, and a request and confirmation for environment destruction. RestorSignal attests the execution and the actual confirmation of this planned destruction process.

This attestation covers the destruction process itself — RestorSignal must not promise absolute proof of "zero trace" on the underlying cloud provider's physical storage media. This is an honest, acknowledged limit of the disposable-environment mode: the logical destruction of the environment and its secrets is attested, but RestorSignal cannot guarantee the state of its infrastructure provider's physical storage layers.