Migration
Move with evidence.
Switch when you are ready.
Preview an import, inspect what transfers, and compare observations in shadow mode before you enable alerts or automation.
Preview. Compare. Cut over.
Make the change
on your terms.
Commercial imports from supported providers over their APIs. Core includes Uptime Kuma import.
- Preview the import
- A preview executes a real import and rolls it back. Review exactly what would be created before committing.
- Inspect the exceptions
- Unsupported fields are named rather than silently approximated. Credentials are not copied from the old account.
- Observe in shadow
- Imported monitors can collect checks and incidents without paging, running automation or publishing status updates. Compare the record before enabling them.
Technical details and implementation notes
The sequence
Connect
A read-only token, sealed with the same AES-256-GCM secretbox as a notification credential, never returned by any page or API and deleted outright on disconnect.
Shadow
Imported monitors check, record observations and open incidents with full timelines. None of it pages a person, fires a runbook or reaches a status page.
Compare
Which outages both systems recorded, which only one did, and how far apart detection and recovery were. Anything that fits neither side is unprovable and counts for neither.
Decide
A frozen cutover report with a SAFE or NOT SAFE verdict and every reason written out. Source incident copies are never pruned, so a verdict cannot improve by waiting.
The importer
Fifteen systems, and what each one refuses.
Fourteen read their vendor's own API; the fifteenth is an Uptime Kuma database file, because Kuma arrives as a volume rather than as an account. What the Kuma file keeps and refuses. Previewing is a real import that was rolled back, not an estimate, and applying reads the source again and keeps what it creates.
settings, importevery source, with the rule that decided each unmapped field
Refused, rather than approximated.
What does not come across gets a line naming the rule that was applied, on the same report as everything that did. The point of a dry run is to be disappointed on a Tuesday afternoon rather than at three in the morning.
- Credentials
- Never copied out of your old account. A monitor that authenticated arrives without its secret and says so.
- Browser journeys
- Refused. A Vigil journey is typed steps with no loops or expressions, and a recorded script that uses them has no honest translation.
- k6 and custom scripts
- Refused, for the same reason, rather than half-converted.
- Four sources
- Are not supported at all, and are named on the docs page rather than left for you to discover.
Shadow mode
A stored flag, not an inferred one.
Every incident a bridge import opens carries a
shadow flag written once at creation, from the
monitor row the opening transaction already holds locked.
A shadow monitor does
- run its checks on your schedule
- record observations
- open and resolve incidents
- keep a full timeline
- appear in the cutover comparison
A shadow monitor does not
- page a person
- reach a notification channel
- trigger a recovery action or a runbook
- enter an escalation ladder
- appear on a public status page
- consume an error budget
Every suppression site reads that stored column rather than joining back to bridge membership, so a deleted bridge or a cutover in flight cannot silently change what is allowed to make noise. Groups aggregate only members that share their shadow setting, so an imported fleet cannot turn a live group red. The suppression seams are mutation-tested: the suite was shown to fail with each gate removed.
The cutover report
Conservative by construction.
Each direction of the comparison leans on its own evidence, and anything that fits neither is recorded as unprovable rather than counted for whichever side it flatters.
- a miss
- needs proof
- Vigil was provably observing before the source outage started, and the outage provably outlived the failure window recorded at import time.
- an extra
- needs coverage
- source silence is a claim, so it requires poll coverage; an extra still open at the last successful poll is a live disagreement and blocks on its own.
- SAFE
- 24 h minimum
- of overlap between evidence and observation, measured per compared pair rather than across the bridge.
- a partial feed
- not coverage
- a feed whose rows stop parsing is recorded as partial, and a monitor deleted mid-shadow stays in the verdict as a hole in the fleet.
- heartbeats
- never compared
- your cron jobs keep pinging the old system until they are repointed, so each heartbeat is listed as its own cutover step instead of being pretended about.
The report states what it can prove, and what it cannot.
Your infrastructure. Your record.