Migration
Fifteen systems · one bridge

Run both before you trust one.

Moving monitoring is a trust problem, not a data problem. The import is only the first half; the second is a record of both systems watching the same window.

15 systems14 over an API, one from a file
read-onlytokens, sealed and deletable
shadowchecks without consequences
24 hminimum overlap for a SAFE verdict

The sequence

01

Connect

A read-only token, sealed with the same AES-256-GCM secretbox as a notification credential, never returned by any page or API and deleted outright on disconnect.

02

Shadow

Imported monitors check, record observations and open incidents with full timelines. None of it pages a person, fires a runbook or reaches a status page.

03

Compare

Which outages both systems recorded, which only one did, and how far apart detection and recovery were. Anything that fits neither side is unprovable and counts for neither.

04

Decide

A frozen cutover report with a SAFE or NOT SAFE verdict and every reason written out. Source incident copies are never pruned, so a verdict cannot improve by waiting.

The importer

Fifteen systems, and what each one refuses.

Fourteen read their vendor's own API; the fifteenth is an Uptime Kuma database file, because Kuma arrives as a volume rather than as an account. Previewing is a real import that was rolled back, not an estimate, and applying reads the source again and keeps what it creates.

The Vigil importer, with one entry for every monitoring system it reads: Uptime Kuma, Better Stack, Checkly, Cronitor, Datadog Synthetics, Grafana Cloud Synthetic Monitoring, Healthchecks.io, Hyperping, New Relic Synthetics, Oh Dear, Pingdom, StatusCake, updown.io, Uptime.com and UptimeRobot.

settings, importevery source, with the rule that decided each unmapped field

Refused, rather than approximated.

What does not come across gets a line naming the rule that was applied, on the same report as everything that did. The point of a dry run is to be disappointed on a Tuesday afternoon rather than at three in the morning.

The full migration tables

Credentials
Never copied out of your old account. A monitor that authenticated arrives without its secret and says so.
Browser journeys
Refused. A Vigil journey is typed steps with no loops or expressions, and a recorded script that uses them has no honest translation.
k6 and custom scripts
Refused, for the same reason, rather than half-converted.
Four sources
Are not supported at all, and are named on the docs page rather than left for you to discover.

Shadow mode

A stored flag, not an inferred one.

Every incident a bridge import opens carries a shadow flag written once at creation, from the monitor row the opening transaction already holds locked.

A shadow monitor does

  • run its checks on your schedule
  • record observations
  • open and resolve incidents
  • keep a full timeline
  • appear in the cutover comparison

A shadow monitor does not

  • page a person
  • reach a notification channel
  • trigger a recovery action or a runbook
  • enter an escalation ladder
  • appear on a public status page
  • consume an error budget

Every suppression site reads that stored column rather than joining back to bridge membership, so a deleted bridge or a cutover in flight cannot silently change what is allowed to make noise. Groups aggregate only members that share their shadow setting, so an imported fleet cannot turn a live group red. The suppression seams are mutation-tested: the suite was shown to fail with each gate removed.

The cutover report

Conservative by construction.

Each direction of the comparison leans on its own evidence, and anything that fits neither is recorded as unprovable rather than counted for whichever side it flatters.

a miss
needs proof
Vigil was provably observing before the source outage started, and the outage provably outlived the failure window recorded at import time.
an extra
needs coverage
source silence is a claim, so it requires poll coverage; an extra still open at the last successful poll is a live disagreement and blocks on its own.
SAFE
24 h minimum
of overlap between evidence and observation, measured per compared pair rather than across the bridge.
a partial feed
not coverage
a feed whose rows stop parsing is recorded as partial, and a monitor deleted mid-shadow stays in the verdict as a hole in the fleet.
heartbeats
never compared
your cron jobs keep pinging the old system until they are repointed, so each heartbeat is listed as its own cutover step instead of being pretended about.