Scheduled identity needs
Write the recovery material.
Upload new object versions and inspect only the intended destination.
Founder operations · Recovery engineering
The backup that failed quietly.
A small launchd job looked complete until macOS refused to execute it. Debugging the permission boundary exposed the more important question: could I prove recovery?
I had a sync script, a scheduled launch agent, and a versioned destination. On paper, the project was protected. In practice, the schedule failed before the first object moved.
This is the story of that failure—and why backup design is really recovery design. Paths, bucket labels, identities, and logs shown here are generalized.
Chapter 01
The design was intentionally small.
Each part had one visible job.
SELECTED FOLDER
→
SYNC SCRIPT
→
LAUNCHD
→
VERSIONED S3
Chapter 02
Separate upload authority from deletion authority.
Scheduled identity does not need
Authority to erase history.
Withhold object deletion, version deletion, and lifecycle-configuration permissions. Versioning helps recovery from some mistakes; it is not complete ransomware protection.
Chapter 03
Same script. Different execution context.
The manual run worked; the background job did not.
exit status: 32256
Operation not permitted
Observed resolution in this build:
move executable script from a privacy-protected project location to
~/Library/Application Support/<illustrative-folder>/
Operation not permitted
Observed resolution in this build:
move executable script from a privacy-protected project location to
~/Library/Application Support/<illustrative-folder>/
This is a build observation, not a guarantee for every macOS version or source folder. Apple privacy controls and the process's granted access determine the result.
Chapter 04
Diagnose the context, not only the command.
Run the script manually and capture its exit code.
Give launchd explicit standard-output and standard-error logs.
Compare paths, environment, permissions, and available
credentials.
Trigger the agent directly instead of waiting for its interval.
Chapter 05
A scheduled job needs a receipt.
| Evidence | What it actually proves |
|---|---|
| Timer configuration | The operating system has a launch instruction |
| Run log and exit state | The process started and reported an outcome |
| S3 object history | Versions reached the destination |
| Denied deletion probe | The scheduled identity cannot erase protected history |
| Restore to a separate folder | Recovery works without overwriting the source |
Field check
Restore is the product.
Primary sources
Watch the entry
The Backup That Failed Quietly
How a macOS launchd permission failure led to a more observable,
least-privilege, restore-tested S3 backup design.