{"title":"Our promise to you","description":"Why we are building VirtualOrg: meaningful access control, a choice of operator, a credible exit and the freedom to build independent applications.","llmSummary":"VirtualOrg is an experimental independent execution runtime. This page separates its commitments to access control, managed operations, self-hosting, portability and transparent service expectations from current local evidence and the company pilot.","updated":"2026-10-18T00:00:00.000Z","introduction":["Your org should work for you.","Your business runs on more than records. It runs on who can see them, who can change them, and what happens next.","VirtualOrg is building an independent execution runtime for that work: permissions, metadata, queries and automation, with a practical path to operating it on infrastructure you control.","Our aim is to make managed hosting convenient and self-hosting achievable. You should be able to choose us for the service we provide, and have a clear path forward if your needs change."],"availability":{"notice":"Experimental runtime · Company pilot","items":[{"label":"Try the browser experiments","description":"Anonymous Apex, SOQL and field formulas run on fictional data on your device.","href":"/#playground-title"},{"label":"Read the capability notes","description":"Local test results, reference matches and known limits are separate. Hosted readiness is not established by these results.","href":"/why/evidence"},{"label":"Review setup and deployment status","description":"Local setup and an account-owned deployment recipe exist for source-access participants. Customer cloud deployment remains unverified in this evidence.","href":"/deploy"},{"label":"Apply to the company pilot","description":"The application form is live. Applications are reviewed individually; org access is arranged separately.","href":"/pilot"}]},"body":"## Keep the controls your business depends on.\n\nCustomer control includes deciding who can do what inside an application, as well as choosing who operates it. Preserving the meaning of supported access rules is a core engineering objective.\n\nProfiles establish a baseline of user permissions. Permission sets add particular grants; groups combine sets, with muting scoped to a group. Roles describe a hierarchy used in record access. Record sharing opens particular records to users and groups. Object permissions govern operations such as reading, creating and deleting records; field access governs which fields a person can read or change.\n\nThose distinctions matter when a query, a form or an automation runs. Importing an access definition is only a starting point: it does not prove equivalent enforcement. We assess the rules, users and execution paths a workload actually needs. Our [selected capability notes](/why/evidence#permissions-object-crud-permissions) show the current evidence and limits, including differences between profile, field and sharing coverage.\n\n## Let us handle the operations. Keep a choice about who runs them.\n\nThe managed-service direction is to take care of deployment, upgrades, monitoring and recovery, so a team can focus on its application. That service is being developed. The pilot is an opportunity to evaluate a specific workload with us; it is not an established production hosting offer.\n\nA usable self-hosting path matters just as much. Our commitment is to document deployment in customer-controlled accounts, the required services, expected costs and the responsibilities that stay with the operator.\n\nThe runtime source carries an MIT license, while its dependencies retain their own licenses. Source licensing, access to setup instructions, a tested deployment path and a managed operational service are different things. The source repository is currently private. Local setup documentation and an account-owned deployment recipe exist for participants with source access; a customer cloud deployment has not yet been verified in the published evidence. The [setup and deployment status](/deploy) explains that boundary.\n\nCurrent recipes depend on Cloudflare Workers, Hyperdrive and R2 alongside PostgreSQL. Using accounts you control still involves those providers, their services and their charges. A self-hosting path needs to make those dependencies explicit.\n\n## Your exit path matters as much as your onboarding.\n\nPortability should cover the parts that make an application useful: records, supported metadata, files, relationships, and a manifest that identifies the format and runtime version.\n\nThe local runtime already has an export and restore format for metadata, live records, deployed source and optional file contents. Local restore keeps record IDs while creating a new org identity and re-keying stored files. Recycle-bin contents are excluded. These are local implementation results, with [specific export and restore limits](/why/evidence#operations-backup-export); they do not establish a complete migration or a tested hosted recovery service.\n\nOur goal is to make exports understandable and documented, including version and dependency information. Some supported definitions and records can move through the existing format. Other systems may need conversion, external integrations need reconnection, and unsupported behavior still needs an implementation or a different approach. A pilot should establish the exit path for the selected workload alongside its onboarding plan.\n\n## Bring the business behavior you need.\n\nBuild independently authored applications and automation on the runtime capabilities that fit your workload. That can mean a focused approval process, a query-backed operational tool, or new business logic built around the metadata and data you choose to provide. A useful pilot can start with one application or workflow; it does not need to move an entire org.\n\nMoving data does not automatically move a managed package's functionality. Third-party code, dependencies and rights need separate consideration, and managed packages are not assumed to run unchanged. We can identify the behavior a company needs and assess an independently built implementation using the supported runtime contracts.\n\n## Understand the service before you depend on it.\n\nWe want users to be able to inspect supported behavior and known differences, understand usage allocations, see background-job status, and know how shared work is scheduled. Performance should be measured for defined workloads. Pricing and material policy changes should be explained clearly before a company relies on the service.\n\nThese are product commitments guiding development. The current evidence describes bounded runtime contracts and local tests. It does not establish managed-service allocations, scheduling fairness, production performance, pricing, service-level terms or a policy-change notice agreement. Those expectations need to be defined and verified with an actual service offering.\n\n## Explore your next org with us.\n\nWe're looking for companies with a specific application or workflow they want more control over. Tell us what it does, how access is managed, and which automation matters most.\n\nTogether, we can identify what is supported, what needs work, and whether a pilot makes sense.","evidence":{"runtimeVersion":"0.7.25","reportGeneratedAt":"2026-10-18T23:25:46.976Z","sourceRevision":"451d23463d9281665d0e752eed47e648a93636a9","sourceDigest":"sha256:1dc0fc3a28554de5a5c1497aa63941d9e95c7652fc2f735c8a9ae7917f1fe554","snapshotDate":"2026-10-18","notice":"Selected dated contracts only. Local passes, profile-bound reference matches and full support are distinct; hosted readiness is unverified by this snapshot.","rows":[{"id":"permissions.object-crud-permissions","anchor":"permissions-object-crud-permissions","title":"Object CRUD permissions","support":"partial","supportLabel":"Partial","localState":"passed","localLabel":"Local tests passed","testedVersion":"0.7.25","firstImplementedVersion":"0.1.0","requirements":["A positive example within the declared scope.","Boundary and invalid-input examples with expected errors.","Authorization and transaction behavior where applicable.","A reproducible reference observation or exact official specification.","A Virtual Org result bound to code revision, runtime configuration, and fixture digest."],"limits":["Profile-owned and assigned permission sets; Modify/View All Data; no permission set groups or muting","Create/edit without delete: DELETE fails INSUFFICIENT_ACCESS_OR_READONLY; updates without edit fail CANNOT_INSERT_UPDATE_ACTIVATE_ENTITY","Differential match is profile-bound; broader parity unverified"],"emptyLimitNotice":"Reference scope remains to be established.","target":{"runtime":"virtualorg","release":"0.2.0","revision":"661071d3cde0bb3ec164058c0a349d857f816c49","environment":"local workerd + PostgreSQL 18 + local R2","profile":"standard-org-67.0"},"evidence":[{"id":"EV-permissions.object-crud-permissions-661071d","kind":"differential-test","result":"pass","capabilityId":"permissions.object-crud-permissions","recipe":"pnpm test:integration / pnpm test (VO-DIFF-051, VO-DIFF-052) against tests/compatibility/reference/2026-10-06-perms-api67.0.json","fixtureDigest":"sha256:9c56acb71a34796ac722e0eb434b8e19c70f726621d5a2101e4f64e5924653e2","revision":"661071d3cde0bb3ec164058c0a349d857f816c49","recordedAt":"2026-10-06","environment":"local workerd + PostgreSQL 18 vs Salesforce Developer-edition scratch org API 67.0","sourceIds":["security"]}],"tests":[{"id":"VO-DIFF-007","file":"integration/reference.test.ts","layer":"integration","observations":[{"profile":"verification-default","status":"passed","fullName":"Salesforce API 67.0 differential (RES-REF-001 receipt) [VO-DIFF-007] read-only permission set user behavior matches Salesforce","packetDigest":"sha256:02a75858c6de1cb1053ffb4a2c7cde3ab2d983e2093498ac9afba1e40c655168"}],"line":43},{"id":"VO-E2E-007","file":"integration/org.test.ts","layer":"integration","observations":[{"profile":"verification-default","status":"passed","fullName":"security model [VO-E2E-007] applies profile object/field permissions, permission sets and role-hierarchy sharing","packetDigest":"sha256:02a75858c6de1cb1053ffb4a2c7cde3ab2d983e2093498ac9afba1e40c655168"}],"line":96},{"id":"VO-DIFF-051","file":"integration/reference-perms.test.ts","layer":"integration","observations":[{"profile":"verification-default","status":"passed","fullName":"Salesforce API 67.0 permissions differential [VO-DIFF-051] View All Records grants and revokes read access to unshared records as in Salesforce","packetDigest":"sha256:02a75858c6de1cb1053ffb4a2c7cde3ab2d983e2093498ac9afba1e40c655168"}],"line":25},{"id":"VO-DIFF-052","file":"integration/reference-perms.test.ts","layer":"integration","observations":[{"profile":"verification-default","status":"passed","fullName":"Salesforce API 67.0 permissions differential [VO-DIFF-052] create/edit without delete and read-only field security match Salesforce","packetDigest":"sha256:02a75858c6de1cb1053ffb4a2c7cde3ab2d983e2093498ac9afba1e40c655168"}],"line":26}]},{"id":"profiles.profile-object-permissions","anchor":"profiles-profile-object-permissions","title":"Profile object permissions","support":"partial","supportLabel":"Partial","localState":"passed","localLabel":"Local tests passed","testedVersion":"0.7.25","firstImplementedVersion":"0.2.0","requirements":["A positive example within the declared scope.","Boundary and invalid-input examples with expected errors.","Authorization and transaction behavior where applicable.","A reproducible reference observation or exact official specification.","A Virtual Org result bound to code revision, runtime configuration, and fixture digest."],"limits":["Standard profiles' object permissions and 429 permission flags as recorded for System Administrator, Standard User, Standard Platform User and Minimum Access - Salesforce","Custom profiles are compared only through metadata deployment","Differential match is profile-bound; broader parity unverified"],"emptyLimitNotice":"Reference scope remains to be established.","target":{"runtime":"virtualorg","release":"0.7.25","revision":"31d0f749be7c7a7c57f2a2101b7b6eebd84f9ac0","environment":"local workerd + PostgreSQL 18 + local R2","profile":"standard-org-67.0"},"evidence":[{"id":"EV-profiles.profile-object-permissions-31d0f74","kind":"differential-test","result":"pass","capabilityId":"profiles.profile-object-permissions","recipe":"pnpm test:integration (integration/reference-perms2.test.ts: VO-DIFF-1155) against tests/compatibility/reference/2026-10-15-perms2-api67.0.json","fixtureDigest":"sha256:068e92cf2ea13142215c05515b1422b18a342f0629a4de37e0374349c59be3eb","revision":"31d0f749be7c7a7c57f2a2101b7b6eebd84f9ac0","recordedAt":"2026-10-15","environment":"local workerd + PostgreSQL 18 vs Salesforce Developer-edition scratch org API 67.0","sourceIds":["security"]}],"tests":[{"id":"VO-E2E-007","file":"integration/org.test.ts","layer":"integration","observations":[{"profile":"verification-default","status":"passed","fullName":"security model [VO-E2E-007] applies profile object/field permissions, permission sets and role-hierarchy sharing","packetDigest":"sha256:02a75858c6de1cb1053ffb4a2c7cde3ab2d983e2093498ac9afba1e40c655168"}],"line":96},{"id":"VO-E2E-001","file":"integration/org.test.ts","layer":"integration","observations":[{"profile":"verification-default","status":"passed","fullName":"org provisioning and identity [VO-E2E-001] provisions an org with Salesforce-shaped identity, standard setup records and userinfo","packetDigest":"sha256:02a75858c6de1cb1053ffb4a2c7cde3ab2d983e2093498ac9afba1e40c655168"}],"line":11},{"id":"VO-DIFF-1155","file":"integration/reference-perms2.test.ts","layer":"integration","observations":[{"profile":"verification-default","status":"passed","fullName":"Salesforce API 67.0 permission, profile and license differential [VO-DIFF-1155] standard profile permissions and object permissions match Salesforce","packetDigest":"sha256:02a75858c6de1cb1053ffb4a2c7cde3ab2d983e2093498ac9afba1e40c655168"}],"line":33}]},{"id":"profiles.profile-field-permissions","anchor":"profiles-profile-field-permissions","title":"Profile field permissions","support":"experimental","supportLabel":"Experimental","localState":"passed","localLabel":"Local tests passed","testedVersion":"0.7.25","firstImplementedVersion":"0.2.0","requirements":["A positive example within the declared scope.","Boundary and invalid-input examples with expected errors.","Authorization and transaction behavior where applicable.","A reproducible reference observation or exact official specification.","A Virtual Org result bound to code revision, runtime configuration, and fixture digest."],"limits":["Compound fields govern component field access","Salesforce differential parity not yet verified","Development0.7.25 admits an existing declared FieldPermissions.Field metadata reference beyond its nominal picklist describe length; ordinary strings remain bounded. The selected source capture and native demo are separate from complete field-permission parity."],"emptyLimitNotice":"Reference scope remains to be established.","target":{"runtime":"virtualorg","release":"0.2.0","revision":null,"environment":"local workerd + PostgreSQL 18 + local R2","profile":"standard-org-67.0"},"evidence":[],"tests":[{"id":"VO-E2E-007","file":"integration/org.test.ts","layer":"integration","observations":[{"profile":"verification-default","status":"passed","fullName":"security model [VO-E2E-007] applies profile object/field permissions, permission sets and role-hierarchy sharing","packetDigest":"sha256:02a75858c6de1cb1053ffb4a2c7cde3ab2d983e2093498ac9afba1e40c655168"}],"line":96},{"id":"VO-DEMO-002","file":"tests/demo-field-permissions.test.ts","layer":"unit","line":4}]},{"id":"permissions.field-read-access","anchor":"permissions-field-read-access","title":"Field read access","support":"partial","supportLabel":"Partial","localState":"passed","localLabel":"Local tests passed","testedVersion":"0.7.25","firstImplementedVersion":"0.1.0","requirements":["A positive example within the declared scope.","Boundary and invalid-input examples with expected errors.","Authorization and transaction behavior where applicable.","A reproducible reference observation or exact official specification.","A Virtual Org result bound to code revision, runtime configuration, and fixture digest."],"limits":["Unreadable fields behave as nonexistent (INVALID_FIELD), including for administrators, as observed","Differential match is profile-bound; broader parity unverified"],"emptyLimitNotice":"Reference scope remains to be established.","target":{"runtime":"virtualorg","release":"0.2.0","revision":"deac2b488dd36ffa2715e50b93dfde6488a6aa5c","environment":"local workerd + PostgreSQL 18 + local R2","profile":"standard-org-67.0"},"evidence":[{"id":"EV-permissions.field-read-access-2026-10-06","kind":"differential-test","result":"pass","capabilityId":"permissions.field-read-access","recipe":"pnpm test:integration (integration/reference*.test.ts: VO-DIFF-007) against tests/compatibility/reference/2026-10-06-project-api67.0.json","fixtureDigest":"sha256:c82d5aa1a668256029f23538b07798e82c02614aefb096d686870557ef03be23","revision":"deac2b488dd36ffa2715e50b93dfde6488a6aa5c","recordedAt":"2026-10-06","environment":"local workerd + PostgreSQL 18 vs Salesforce Developer-edition scratch org API 67.0","sourceIds":["security"]}],"tests":[{"id":"VO-DIFF-007","file":"integration/reference.test.ts","layer":"integration","observations":[{"profile":"verification-default","status":"passed","fullName":"Salesforce API 67.0 differential (RES-REF-001 receipt) [VO-DIFF-007] read-only permission set user behavior matches Salesforce","packetDigest":"sha256:02a75858c6de1cb1053ffb4a2c7cde3ab2d983e2093498ac9afba1e40c655168"}],"line":43},{"id":"VO-E2E-007","file":"integration/org.test.ts","layer":"integration","observations":[{"profile":"verification-default","status":"passed","fullName":"security model [VO-E2E-007] applies profile object/field permissions, permission sets and role-hierarchy sharing","packetDigest":"sha256:02a75858c6de1cb1053ffb4a2c7cde3ab2d983e2093498ac9afba1e40c655168"}],"line":96},{"id":"VO-DIFF-001","file":"integration/reference.test.ts","layer":"integration","observations":[{"profile":"verification-default","status":"passed","fullName":"Salesforce API 67.0 differential (RES-REF-001 receipt) [VO-DIFF-001] administrator describe of Project__c matches Salesforce","packetDigest":"sha256:02a75858c6de1cb1053ffb4a2c7cde3ab2d983e2093498ac9afba1e40c655168"}],"line":37}]},{"id":"permissions.field-edit-access","anchor":"permissions-field-edit-access","title":"Field edit access","support":"partial","supportLabel":"Partial","localState":"passed","localLabel":"Local tests passed","testedVersion":"0.7.25","firstImplementedVersion":"0.1.0","requirements":["A positive example within the declared scope.","Boundary and invalid-input examples with expected errors.","Authorization and transaction behavior where applicable.","A reproducible reference observation or exact official specification.","A Virtual Org result bound to code revision, runtime configuration, and fixture digest."],"limits":["INVALID_FIELD_FOR_INSERT_UPDATE for read-only fields","Writes to read-only fields fail INVALID_FIELD_FOR_INSERT_UPDATE; describe reports createable/updateable per field security","Administrators can write standard fields whose profile field permission is read-only (Case.AccountId); custom fields follow field security","Differential match is profile-bound; broader parity unverified"],"emptyLimitNotice":"Reference scope remains to be established.","target":{"runtime":"virtualorg","release":"0.2.0","revision":"5dbf838737355b6a7c72b5fa7eb1a55af016e0fc","environment":"local workerd + PostgreSQL 18 + local R2","profile":"standard-org-67.0"},"evidence":[{"id":"EV-permissions.field-edit-access-5dbf838","kind":"differential-test","result":"pass","capabilityId":"permissions.field-edit-access","recipe":"pnpm test:integration / pnpm test (VO-DIFF-052) against tests/compatibility/reference/2026-10-06-perms-api67.0.json","fixtureDigest":"sha256:120d7d4389058b6d041abd24a99ab1dda129ee10f62af551377ff83cac79318b","revision":"5dbf838737355b6a7c72b5fa7eb1a55af016e0fc","recordedAt":"2026-10-06","environment":"local workerd + PostgreSQL 18 vs Salesforce Developer-edition scratch org API 67.0","sourceIds":["security"]}],"tests":[{"id":"VO-DIFF-007","file":"integration/reference.test.ts","layer":"integration","observations":[{"profile":"verification-default","status":"passed","fullName":"Salesforce API 67.0 differential (RES-REF-001 receipt) [VO-DIFF-007] read-only permission set user behavior matches Salesforce","packetDigest":"sha256:02a75858c6de1cb1053ffb4a2c7cde3ab2d983e2093498ac9afba1e40c655168"}],"line":43},{"id":"VO-E2E-007","file":"integration/org.test.ts","layer":"integration","observations":[{"profile":"verification-default","status":"passed","fullName":"security model [VO-E2E-007] applies profile object/field permissions, permission sets and role-hierarchy sharing","packetDigest":"sha256:02a75858c6de1cb1053ffb4a2c7cde3ab2d983e2093498ac9afba1e40c655168"}],"line":96},{"id":"VO-DIFF-052","file":"integration/reference-perms.test.ts","layer":"integration","observations":[{"profile":"verification-default","status":"passed","fullName":"Salesforce API 67.0 permissions differential [VO-DIFF-052] create/edit without delete and read-only field security match Salesforce","packetDigest":"sha256:02a75858c6de1cb1053ffb4a2c7cde3ab2d983e2093498ac9afba1e40c655168"}],"line":26},{"id":"VO-DIFF-066","file":"integration/reference-activity.test.ts","layer":"integration","observations":[{"profile":"verification-default","status":"passed","fullName":"Salesforce API 67.0 cases and activities differential [VO-DIFF-066] case defaults, closing, ClosedDate and case comments match Salesforce","packetDigest":"sha256:02a75858c6de1cb1053ffb4a2c7cde3ab2d983e2093498ac9afba1e40c655168"}],"line":23}]},{"id":"sharing.role-hierarchy","anchor":"sharing-role-hierarchy","title":"Role hierarchy","support":"partial","supportLabel":"Partial","localState":"passed","localLabel":"Local tests passed","testedVersion":"0.7.25","firstImplementedVersion":"0.2.0","requirements":["A positive example within the declared scope.","Boundary and invalid-input examples with expected errors.","Authorization and transaction behavior where applicable.","A reproducible reference observation or exact official specification.","A Virtual Org result bound to code revision, runtime configuration, and fixture digest."],"limits":["Grant access using hierarchies always on","Users above a record owner's role read, edit and delete private standard records; access follows role changes; Grant Access Using Hierarchies off for custom objects not tested","Differential match is profile-bound; broader parity unverified"],"emptyLimitNotice":"Reference scope remains to be established.","target":{"runtime":"virtualorg","release":"0.2.0","revision":"029d89173e590e58f139d7364bb3c4319baf8e57","environment":"local workerd + PostgreSQL 18 + local R2","profile":"standard-org-67.0"},"evidence":[{"id":"EV-sharing.role-hierarchy-029d891","kind":"differential-test","result":"pass","capabilityId":"sharing.role-hierarchy","recipe":"pnpm test:integration / pnpm test (VO-DIFF-101) against tests/compatibility/reference/2026-10-06-stdroles-api67.0.json","fixtureDigest":"sha256:38d342cc77f614bc0c97c8cab745be371f29aea380132afbcb7de2540905c76f","revision":"029d89173e590e58f139d7364bb3c4319baf8e57","recordedAt":"2026-10-07","environment":"local workerd + PostgreSQL 18 vs Salesforce Developer-edition scratch org API 67.0","sourceIds":["security"]}],"tests":[{"id":"VO-E2E-007","file":"integration/org.test.ts","layer":"integration","observations":[{"profile":"verification-default","status":"passed","fullName":"security model [VO-E2E-007] applies profile object/field permissions, permission sets and role-hierarchy sharing","packetDigest":"sha256:02a75858c6de1cb1053ffb4a2c7cde3ab2d983e2093498ac9afba1e40c655168"}],"line":96},{"id":"VO-DIFF-101","file":"integration/reference-stdroles.test.ts","layer":"integration","observations":[{"profile":"verification-default","status":"passed","fullName":"Salesforce API 67.0 role-based implicit child sharing differential [VO-DIFF-101] managers read, edit and delete private accounts owned below them in the role hierarchy, as in Salesforce","packetDigest":"sha256:02a75858c6de1cb1053ffb4a2c7cde3ab2d983e2093498ac9afba1e40c655168"}],"line":23}]},{"id":"sharing.owner-based-sharing-rules","anchor":"sharing-owner-based-sharing-rules","title":"Owner-based sharing rules","support":"partial","supportLabel":"Partial","localState":"passed","localLabel":"Local tests passed","testedVersion":"0.7.25","firstImplementedVersion":"0.2.0","requirements":["A positive example within the declared scope.","Boundary and invalid-input examples with expected errors.","Authorization and transaction behavior where applicable.","A reproducible reference observation or exact official specification.","A Virtual Org result bound to code revision, runtime configuration, and fixture digest."],"limits":["Source groups resolve direct, nested, role and role-and-subordinates members","Recalculated synchronously when group membership or user roles change","Differential match is profile-bound; broader parity unverified"],"emptyLimitNotice":"Reference scope remains to be established.","target":{"runtime":"virtualorg","release":"0.2.0","revision":"643e382a043b155b9cff18032edfc5f2d866990c","environment":"local workerd + PostgreSQL 18 + local R2","profile":"standard-org-67.0"},"evidence":[{"id":"EV-sharing.owner-based-sharing-rules-643e382","kind":"differential-test","result":"pass","capabilityId":"sharing.owner-based-sharing-rules","recipe":"pnpm test:integration / pnpm test (VO-DIFF-037) against tests/compatibility/reference/2026-10-06-rules-api67.0.json","fixtureDigest":"sha256:92d0bdc170e6883b8ce13b19d145ee6e7beab944766a0c6370c02bf047b1e3e2","revision":"643e382a043b155b9cff18032edfc5f2d866990c","recordedAt":"2026-10-07","environment":"local workerd + PostgreSQL 18 vs Salesforce Developer-edition scratch org API 67.0","sourceIds":["security"]}],"tests":[{"id":"VO-META-005","file":"tests/metadata.test.ts","layer":"unit","line":51},{"id":"VO-DIFF-037","file":"integration/reference-rules.test.ts","layer":"integration","observations":[{"profile":"verification-default","status":"passed","fullName":"Salesforce API 67.0 sharing rules differential [VO-DIFF-037] owner-based sharing rules follow source group membership as in Salesforce","packetDigest":"sha256:02a75858c6de1cb1053ffb4a2c7cde3ab2d983e2093498ac9afba1e40c655168"}],"line":24}]},{"id":"operations.backup-export","anchor":"operations-backup-export","title":"Backup export","support":"experimental","supportLabel":"Experimental","localState":"passed","localLabel":"Local tests passed","testedVersion":"0.7.25","firstImplementedVersion":"0.2.0","requirements":["A positive example within the declared scope.","Boundary and invalid-input examples with expected errors.","Authorization and transaction behavior where applicable.","A reproducible reference observation or exact official specification.","A Virtual Org result bound to code revision, runtime configuration, and fixture digest."],"limits":["virtualorg-export-3: metadata, live records, deployed source, ID sequence and optional R2 file contents; no tokens; recycle bin contents are not exported","Verified locally only; not run against a deployed Worker","Salesforce differential parity not yet verified"],"emptyLimitNotice":"Reference scope remains to be established.","target":{"runtime":"virtualorg","release":"0.2.0","revision":null,"environment":"local workerd + PostgreSQL 18 + local R2","profile":"standard-org-67.0"},"evidence":[],"tests":[{"id":"VO-E2E-010","file":"integration/org.test.ts","layer":"integration","observations":[{"profile":"verification-default","status":"passed","fullName":"operations [VO-E2E-010] exports metadata and records without credentials","packetDigest":"sha256:02a75858c6de1cb1053ffb4a2c7cde3ab2d983e2093498ac9afba1e40c655168"}],"line":152},{"id":"VO-E2E-012","file":"integration/org.test.ts","layer":"integration","observations":[{"profile":"verification-default","status":"passed","fullName":"operations [VO-E2E-012] restores an export with source and files into a new org, then deletes orgs and their files","packetDigest":"sha256:02a75858c6de1cb1053ffb4a2c7cde3ab2d983e2093498ac9afba1e40c655168"}],"line":160}]},{"id":"operations.backup-restore","anchor":"operations-backup-restore","title":"Backup restore","support":"experimental","supportLabel":"Experimental","localState":"passed","localLabel":"Local tests passed","testedVersion":"0.7.25","firstImplementedVersion":"0.2.0","requirements":["A positive example within the declared scope.","Boundary and invalid-input examples with expected errors.","Authorization and transaction behavior where applicable.","A reproducible reference observation or exact official specification.","A Virtual Org result bound to code revision, runtime configuration, and fixture digest."],"limits":["Operator-authorized restore into a new org ID, keeping record IDs and re-keying R2 files; issues a session for the restored administrator","Verified locally only","Salesforce differential parity not yet verified"],"emptyLimitNotice":"Reference scope remains to be established.","target":{"runtime":"virtualorg","release":"0.2.0","revision":null,"environment":"local workerd + PostgreSQL 18 + local R2","profile":"standard-org-67.0"},"evidence":[],"tests":[{"id":"VO-E2E-012","file":"integration/org.test.ts","layer":"integration","observations":[{"profile":"verification-default","status":"passed","fullName":"operations [VO-E2E-012] restores an export with source and files into a new org, then deletes orgs and their files","packetDigest":"sha256:02a75858c6de1cb1053ffb4a2c7cde3ab2d983e2093498ac9afba1e40c655168"}],"line":160}]}]},"actions":[{"label":"Join Pilot Program","href":"/pilot"},{"label":"Explore research progress","href":"/#overview-title"}]}