Almost every storage product makes the same promise, usually as one sentence in an FAQ: your data can always leave. The sentence is sincere when it is written. Then the product keeps moving. A new field lands in the storage format; the export path nobody runs falls a version behind; a dependency of the export tool breaks and nobody notices, because nothing in the release process ever runs it. The promise is still on the page. It just isn't true anymore, and there is no moment at which anyone decided to break it.
That failure mode is structural, not moral. A promise checked by nobody, on no schedule, will drift out of truth — the only question is when. So we tie the check to the moment the drift would start: a change to the format.
The escape hatch is restore.sh: one plain shell script that brings a nest's
files and dependencies back using only curl, jq, sha256sum (or shasum), tar and uv, plus the stock
text tools every base system ships. It does not need Renest installed, and pointed at a
bucket you can already read it needs no account and no server of ours. From format 2.3
on, a copy travels inside every nest Renest packs. The
operational page covers how to run it. This page is
about how it is kept honest.
Two things check it:
restore.sh against it — not a Python stand-in — and checks
every file that comes back against its recorded fingerprint, byte for byte.The script's clean exit is not the whole verdict. It proves the files
came back and matched their fingerprints. The script itself never starts the application —
its last stage is the byte check — so "did the rebuilt environment actually do its job"
is answered by the product path, where the renest tool starts the
application and judges what comes out. See how a rebuild
is judged.
The format cannot quietly grow private state. The script rebuilds only what the manifest records. Anything a format change put somewhere else — a server-side lookup, a field only our own tooling understands — is invisible to the script, and a rebuild that relied on it would come back incomplete. So a capability the format gains has to be expressible in the open manifest to survive the escape hatch.
The dependency list cannot creep. Each new convenience — a fancier
downloader, a verification library, a progress UI — would be one more thing a stranded
user in some future year has to find before their files come back. The format-change
checklist says outright that the escape hatch gains no new dependency, and the script
works around missing conveniences rather than adding them (it builds its own timeout from
a background job and sleep instead of requiring timeout). The
list has moved in only one direction so far: git was on it once, and was removed when it
turned out the script never actually called it.
Old nests stay readable on purpose. The script's header records exactly which format versions this copy reads, and the version check distinguishes two cases: a newer minor version of the same major is warned about and let through, because the specification only ever adds optional fields within a major version — refusing would turn a nest whose bytes restore perfectly into a brick. A different major version is refused outright, and the refusal points out that the manifest still lists every file with its fingerprint, so nobody is left wondering whether their models are gone. The warn-and-continue rule exists because an earlier copy of the script once refused a minor version that had only added optional fields.
Stating the promise narrowly is what makes it keepable, so here is the narrow version. The escape hatch needs: the five tools above, a shell, and network reach to wherever your nest is stored — your own bucket, or ours. It cannot sign links to a private bucket itself (it has no openssl, deliberately), so a private bucket needs links signed where your key lives, passed in as a restore code or presigned URLs.
And it does not promise the rebuilt environment runs on any machine. A GPU the packed build has no compiled code for, a different CUDA major version, a different chip family — the script detects these, says so in plain terms before the download starts, and carries on anyway. Its job is to get your files back and rebuild the environment as recorded; whether this particular machine can run the result is a fact it reports, never a decision it makes for you.
Trust is the exception, because a nest is someone's code arriving on your machine. The script refuses a manifest path that tries to write outside the folder you gave it, or to drop files where they would be executed rather than read — that check runs before any file is fetched. A nest may carry four model caches (Hugging Face, rembg, transparent-background, insightface); they land inside the restore folder. Two riskier cases, a link in a code archive that points outside its folder and a home-folder path beyond those caches, are warned about loudly and go ahead only when you type yes or set the confirming variable. It tells you the risk and leaves the decision to you. And it stops before
installing any dependency when a nest's dependency lock points at servers outside a known
list, unless you name those hosts yourself. Those are not compatibility questions, and a
warning that scrolls past during a long install would be worthless there. Machine
mismatches, by contrast, are told loudly and then attempted anyway.
None of the above needs to be taken on faith. The script is plain shell, readable start to finish, and each shipped version is listed by sha256 — along with which format it was written for and what was later found wrong with it — in a version list kept with the format specification. The script never reads that list itself; it works the same when you cannot reach it. It is there for you.
The licensing matches the role. The format specification and the escape hatch script are
Apache-2.0 — genuinely open, because these are the parts that must outlive us for any of
this to mean anything. The renest command-line tool is source-available, with
its code published in full, and we don't call this source-available tool open-source software.
See licensing for the details.
A promise is a sentence about the future, maintained by memory. A check is something you run. We would rather depend on the second — and so can you.