what pg_dump records — and what needs separate evidence

`pg_dump` produces a logical database snapshot. The file alone does not record a later restore outcome, establish who operated a restore, or provide a workflow history.

Walwarden's product capability adds several separate records around that dump:

- an Ed25519-signed Manifest over canonical metadata; - a checksum that verification recomputes; - a hash-chained Audit chain, append-only under the reviewed SQL trigger; - an operator-run restore workflow through the CLI; and - an Evidence-bundle export that can be checked with the matching public key and a successful verifier result.

Those mechanisms do not guarantee a particular backup or restore. The named artifact, matching key, checksum, and verifier result determine what was verified. Policy or compliance conclusions remain a team's responsibility with its reviewers.

Walwarden currently supports scheduled logical backups for Supabase and Neon to a configured customer-owned S3 destination. AWS RDS/Aurora remains on the roadmap. /proof is one published static demo artifact, not a statement about a customer Team or production runtime.