feat(core): workspace recovery and Sokar artifact manifests (PR 4/9) #655
Loading…
Reference in a new issue
No description provided.
Delete branch "feat/core-workspace-recovery"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Core relocation must reconstruct cognitive state from Postgres, while only explicitly reviewed non-derived, non-secret files may come from Sokar. This PR adds optional artifact recovery and offline legacy staging; it does not enable them, deploy, import production data, extract the wk01 archive, or change volumes/manifests.
require_authoritative = truedeployment, independently of artifact config. The opted-in artifact path rechecks the physical residency session after downloads before admitting the workspace. The opted-in artifact path rechecks the physical residency session after downloads before admitting the workspace.created_atand typedsourcemetadata. Older rows remain explicitly unknown (0/null), requiring ledger reconciliation with retained sources.artifacts/tree. Reject unsafe/DB/archive/credential paths, unknown files, symlinks, divergent trees and hash/length mismatches. Warm validation does not download or rewrite files. Publication reads every object back, then CAS-publishes its digest/manifest through the physical PG residency session and current epoch. Interrupted uploads cannot advance the pointer; exact lost-ack retries reconcile.akh-workspace-recover: an exact-file disposition ledger gates legacy loading into a new, isolated SQLite stage. Verify every typed component by readback, exercise cold wake/full resume, and report post-resume differences. Offline authority comparison is read-only and includes recovery boundaries and ordered WAL tail. It accepts no production URL and never grants production acceptance.Runbook:
scripts/platform-storage/CORE-WORKSPACES.md. No actual archived identity is certified here; all 15 require the operator disposition ledger and later GO. Full resume intentionally refreshes tool-fact timestamps and continuity observations, which remain visible in the staging report. Unknown legacy metadata remains a hold. Older snapshot writers would discard the new symbol fields on delete/reinsert: prefer config-only rollback; otherwise quiesce writers and retain a verified typed export first.Validation (lean local target, only changed crates):
cargo test --locked -p akhomed-store -p sokar-client -- --test-threads=1.cargo test --locked -p akh-medu --features postgres --lib snapshot::tests: 53 passed.scripts/platform-storage/test-postgres.py --workspace-only: real disposable PG fencing/CAS/readback, cold recovery, required-authority refusal, existing provenance/allocator recovery, artifact HTTP fixtures, and offline CLI staging/refusals/read-only comparison.-D warningspassed;cargo fmt --all -- --checkandgit diff --check.postgres:latest= PostgreSQL 18.6 (Debian 18.6-1.pgdg13+2), digestsha256:74935e72241653ca55e0414067e6d8763aceb8a810eb51b452253ec3dcfc4336; uv selected Python 3.12.14 and psycopg 3.3.6. No provider/image build inputs changed or new pins added.Local timing flake:
shared_layout_contends_but_per_akh_snapshots_do_notonce failed athost_storewhile acquiring a connection with its existing 100 ms deadline during concurrent compilation. Its actual contention assertions had not run. Serial retry passed the full changed leaf-crate suites (63 tests passed; environment-gated tests reported separately); no timeout or assertion changes. No sweep-timing or analogy test changes.Review fixes:
ensure_akh; database-read errors explicitly release the held residency session before returning.notes.txt. This complements operator classification; it is not a general secret scanner.migrate_on_start = truefor the older-binary rollback guard, explains the silent metadata-loss risk when that guard is disabled, and carries the fleet gate: never run mixed akhomed versions against one akhomed DB; the first image bump including #655 rolls all houses together.Fix validation (same lean local target; no Docker/image build or full sweep):
cargo test --locked -p akh-medu --features postgres --bin akh-workspace-recover: 2 passed.cargo test --locked -p akh-medu --features postgres --lib workspace_recovery: 3 passed; disposable-Postgres integration test remains environment-gated, not rerun for these fixes.cargo test --locked -p akh-medu --features server --bin akhomed authoritative_house_refuses_local_fallback_and_missing_snapshot: 1 passed, including missing/retired/mismatched join refusal and successful existing-identity join.cargo clippy --locked -p akh-medu --features server --lib --bin akh-workspace-recover -- -D warnings, formatting and diff checks passed.--bin akhomedin strict clippy reports seven pre-existing warnings in unchanged code:unnecessary_map_or(line 1511),too_many_arguments(5172), andcollapsible_if(5315/5316, 6304/6305, 6444). No lint allowances or unrelated cleanup were added; the daemon regression test passes.CI diagnosis (run 4295): the full Forgejo UI log for
test-akh-medushowedrenamed_database_and_pem_content_are_refused_cold_and_warmfailing its warm-path assertion (3947 passed, 1 failed, 22 ignored). This was a real test-fixture regression, not the sweep/analogy flake. The fixture inherited the runner umask and could create a group-writable directory; ownership validation then correctly refused before the magic-header check. The old binary reproduces the exact failure under umask0002. The test-only fix explicitly creates the fixture directory as 0700, matching production restore, and prints the actual refusal on assertion failure. All three local workspace-recovery tests pass under umask0002(PG integration remains environment-gated locally); formatting/diff checks pass. No production code, timeouts, or assertions were weakened.test-session-platformfailed at the same assertion in the disposable PG harness; its rendered Forgejo UI log was interleaved, so the original Solstice step log was checked to confirm this. No separate regression was found there. Both failures are addressed by the same fixture fix.CI: run 4298 is green on
20d233d85d544e727748a023aa8d3c009de51ad6: all 14 jobs succeeded, including both previously failing test jobs and every platform-image job. Operator reviews/merges; no self-merge. No deployment, production import or volume switch.