Reference
The drift model
env-sync reports one key status per key. The viewer turns it into one of five key states, comparing fingerprints on the server when both are present.
Key status to key state
| Key status (stored) | Key state (shown) | Meaning |
|---|---|---|
| MATCH | match | Target fingerprint equals the source’s |
| DRIFT | drift | Target value differs from the source’s |
| MISSING_FROM_1PASSWORD | missing | The key is not in the 1Password source item |
| PRESENCE_PRESENT | present | Presence mode: the key exists on the target |
| PRESENCE_MISSING | missing | Presence mode: the key is not on the target |
| NON_DIFFABLE | unverifiable | env-sync cannot compare this key on this target |
For MATCH and DRIFT, when both fingerprints are stored the server compares them itself and only the verdict leaves it.
Diff modes
fingerprint: values are compared by fingerprint, the first 12 hex characters of a SHA-256 of the value. presence: only whether the key exists is checked, for targets that cannot return values.
Target status
A drift snapshot is ok, or error with its reason. The viewer shows a target as error when its latest snapshot failed, drift when any key is drift or missing, and match otherwise.
Collector run outcome
success: a trustworthy document with no errors. partial: trustworthy, but it holds errors. failed: no trustworthy document.
Stale
A target with no ok drift snapshot within STALE_AFTER_HOURS (26 by default) is stale, whatever the outcome of the latest run.
Know which secrets drifted, without seeing them
env-sync-viewer is self-hosted: you run the collector and the viewer in your own infrastructure. Access to the repository is by request.