carlos / platform Public

`fix/carloku-vfs-review-20261003`

Commits

f5cc00770 Make admission association deadline tests deterministic claude agent, operated by paul@keymail.dev 3 weeks ago
0e9de1b26 Refuse unsafe VFS opens and verify custom-first crash recovery claude agent, operated by paul@keymail.dev 3 weeks ago
36aa46029 Coordinate SQLite VFS connections and retain failed cleanup ownership claude agent, operated by paul@keymail.dev 3 weeks ago
a7eea0820 Copy SQLite callback memory through pinned runtime buffers claude agent, operated by paul@keymail.dev 3 weeks ago
9d2fd891a Checkpoint descriptor-relative SQLite VFS experiment claude agent, operated by paul@keymail.dev 3 weeks ago
b634c4481 Isolate CLI test configuration and record admission recovery checkpoint claude agent, operated by paul@keymail.dev 3 weeks ago
5d52edd19 Publish validated durability holds with fail-closed reader compatibility claude agent, operated by paul@keymail.dev 3 weeks ago
819634465 Recover admission journals while retaining the producer fence claude agent, operated by paul@keymail.dev 3 weeks ago
987f20c29 Associate durability attempts with their admitted requests claude agent, operated by paul@keymail.dev 3 weeks ago
0e5267fa8 Select explicit config fixtures in login flow tests claude agent, operated by paul@keymail.dev 3 weeks ago
c2311d03f Isolate API test configuration and shorten control socket fixtures claude agent, operated by paul@keymail.dev 3 weeks ago
1dc9a6c7b Retain admission cleanup ownership and close discovery races claude agent, operated by paul@keymail.dev 3 weeks ago
358b25ee7 Plan Task 4's fifth slice: the gate and the fleet; the request gate returns an admission whose participants the middleware completes claude agent, operated by paul@keymail.dev 3 weeks ago
3678b940a Review ten answered: the listing directory retained across the handoff; one open uncertainty per fleet; closure closes what nothing else will; the latch's days dirtied when it clears; publication from the ledger's earliest day with explicit bounds; the configuration reader refuses what it cannot take; design revision 16 claude agent, operated by paul@keymail.dev 3 weeks ago
f11464eca Plan Task 4's fourth slice: the fleet journal, construction backfill and root-first acknowledgement in the durability ledger claude agent, operated by paul@keymail.dev 3 weeks ago
a579d845e Review nine answered: holds, the latch and settlements are publication events; the snapshot reads again across a replay; a latch keeps its computed bound or is unresolved; replay closes on the settlement's test; the discovery instant floors closure; design revision 15 claude agent, operated by paul@keymail.dev 3 weeks ago
c824ed811 Review eight answered; plan Task 4's second and third slices (the barrier; discovery, the uncertainty and the latch); design revision 14 claude agent, operated by paul@keymail.dev 3 weeks ago
47efe06f3 Review seven answered; Part C's first ledger slice: the root governing a resolved stack tracked across an absolute platform link, a later ascent re-pinning higher in that pin's ancestry and re-walking the link; what an acquisition holds released directory by directory to the resolved chain (authority.Result.Release), so the descriptor count agrees with /proc on the systemd and composed shapes; a recheck error that is not a change is drift, stale only at the final look; a root with no owned file beneath it rechecked on its own; the stale window's start asserted; the design's parameter row, the authority doc, the pins comment, the churn list and the spike note reconciled; the durability ledger gains the admissions, fleets, uncertainties, inherited and holds tables and the admission row's transitions (Admit, Unissued, TransportDone, RecorderStarted, RecorderDone, settled by the later participant, a terminal final), with tests mirroring the admission model claude agent, operated by paul@keymail.dev 3 weeks ago
f0ed32b7b Required coverage (plan Task 3): RequiredDatabases (the registry this process has open, the console database when CONSOLE_DB names it; no role configuration exists on this branch to name a console box, recorded), each looked at through its root in fleetInventory with why it cannot be reached, an unreachable one a problem and, at a fleet build, the options' Hold told the instant before the build is refused; carlos ops inventory, the read-only command rendering the external replicator's configured list beside the platform replicator's inventory and the required databases' reachability claude agent, operated by paul@keymail.dev 3 weeks ago
28e7f4d61 Review six answered; inventory on retained descriptors, third slice: the fleet holds its pins and each owned file's retained chain for its life (fileFacts.keep, FleetInventory.Close, recheck and Descriptors; checkOwnedFileOn and strictTreeDBsOn against a fleet's pins), rechecks every chain, name and root by descriptor before each look's rebuild and releases them at Close, a report keeping none; the root re-established higher when a later platform link's ascent needs it, a slash target pinned, the platform-directory claim refusing a link at the claimed directory, a relative claim refused, a failed look after a changed directory a problem, an absolute tenant link spelled through the tree's own root walked relative from the confined root; tests through two composed links, the slash target, the directory already listed replaced under the inspection, a directory removed before its listing, an unsearchable directory, a mode-only change on a chain that only the retained edge sees, descriptors released; the model checks right after the final recovery; design revision 13 and the plan reconciled with the implemented boundary claude agent, operated by paul@keymail.dev 3 weeks ago
cc1500a90 Review five answered; inventory on retained descriptors, second slice: checkOwnedFile on the retained chain (the climb by ownership on Parent pointers, the directory above the top the platform's, every component acquired with O_NOFOLLOW, sidecars by Lookat), the root rule where the platform's authority ends (as many levels above a link's directory as its target ascends, the parent of the first non-platform component, an absolute platform-link target's parent pinned), the predicate's classes named (out of its platform root; a further link said before ownership), a directory changed under the look looked at again, a listing's per-entry errors, a pre-pin absent target as churn, resolvePlatformLinks, walkWithoutLinks, sqliteHeader and openRegularNoFollow retired, Facts.Nlink; inventory-level tests through systemd's shapes and each refusal, between the listing and the look, descriptor accounting; the model checks right after recovery, at-the-bound and first-change tests; design revision 12 (the root rule in Part A; the backstop limited to the witness; link shapes beside decisions 10 to 13); the plan's pre-wiring census claude agent, operated by paul@keymail.dev 3 weeks ago
ccfd331ad Inventory on retained descriptors (plan Task 2, first slice): the fleet's pins (the pinned slash and a platform root per spelled directory, the parent of the first platform link's directory or of the spelled directory), the platform-link predicate on descriptors, strictTreeDBs walking Dirs with every link class named (may lead to a database, a link to a link, neither a file nor a directory, out of the tree by Within, cannot be looked at, a file in the tree skipped with its target, absent as churn), the pathname link look deleted; the owners tests keep their strings, three expectations move to the design's classes, and a link-class test covers each class and Astra 2's layout claude agent, operated by paul@keymail.dev 3 weeks ago
a26cba8e6 Review four answered; design revision 11: the historical term excludes only the empty terminals (unrecorded sent), the cutoff is the bound fixed before the rows are read, a look's start is the bound by what it observes rather than an order; the model's fixed cutoff, a later witness change, four tests; Within's early-result contract documented and guarded; the plan rewritten in terms of Within claude agent, operated by paul@keymail.dev 3 weeks ago
7ba5fc728 Review three answered; design revision 10: the historical term's threshold is the earlier of the proof and the clean look, empty terminals excluded, and every look reads the witness and rechecks every chain first; the model gains a witness change the proof discovers, crash deduplication of a landed row, one row per token, seven tests; authority gains Result.Parent and Within, keeps the pin on absent and linked tails, and tests a sibling tenant under one pin, a replacement link at Recheck and an other-writable component; dispositions mark superseded rows and the spike note's claims are corrected claude agent, operated by paul@keymail.dev 3 weeks ago
36b4805c2 Plan: the replicator's authority as tasks (the roots a fleet pins, the predicate and the inventory on Dirs, required coverage, Part C's ledger changes after the model) claude agent, operated by paul@keymail.dev 3 weeks ago
0a5279246 Review two answered; design revision 9: the uncertainty's lower bound also takes the admission instant of every admission settled at or after the last clean look's start (an in-flight request across a change, settled clean before the discovery, was outside it); the model's change is its own action discovered by a later look, a landed ambiguous row is durable at once, a per-step inheritance check, closed implies no unsettled admission, explicit quiescence, five new tests; authority reports the pin an absolute walk ended beneath, keeps the errno before a pin, and its tests distinguish Equal from Same, observe close-on-exec and count descriptors across refused opens, ancestry rewalks and Root.Close; dispositions and the spike note corrected claude agent, operated by paul@keymail.dev 3 weeks ago
50a6f0561 Review one answered: authority gains Confine, Equal in Recheck and Child, slash as a pin, ErrLink for ELOOP too, OpenRoot's path rules, a Platform predicate over Facts, and tests for the tenant boundary, the retained-parent pop, chmod, a foreign-owned component and descriptor accounting; the model's protocol boundaries become separate actions with a send, the ancestry barrier stated from the chain, sticky terminals and closed-implies-no-latch, nine new tests; dispositions and the spike note corrected claude agent, operated by paul@keymail.dev 3 weeks ago
0bf0d3a4b Spike note: the fork's pathname entry points enumerated by reading every call (Part B's task list), grouped by the directory each must take claude agent, operated by paul@keymail.dev 3 weeks ago
5bfcc7ba7 authority: retained directory descriptors (plan step 1, Part A): Dir with Child, List, Lookat, Readlink, OpenRegular, Recheck and Walk; Root by the platform walk from a pinned slash with its ancestry; the design's Part A tests; a link under O_DIRECTORY named as one; the walk's grammar refused before any system call claude agent, operated by paul@keymail.dev 3 weeks ago
f331b55a6 Spike: the admission protocol as an executable model (plan step 0): Part C's transition table, both holds, the latch and its replay, construction backfill, ancestry reach, root-first acknowledgement, helper death, the producer fence and recovery, with the design's named sequences as tests and randomised schedules under barrier, hazard, reach and liveness invariants; 30000 schedules pass; fourteen mutants killed claude agent, operated by paul@keymail.dev 3 weeks ago
8a877936b Design: the replicator's authority, revision 8 (the seventh review's fixes: a cancellation is conclusive only after the admission writer has returned and a fresh read finds no row; one pending-set contract; the restore wording limited to what the fork's verification chooses) claude agent, operated by paul@keymail.dev 3 weeks ago
20e7de04d Design: the replicator's authority, revision 7 (discovery replay reconciles the counted admissions' settlements before the overlay is cleared; the recorder participant registered at Start and a never-started one closed as unrecorded after proven helper exit; the abort transitions and the pending set's cleanup, ambiguous commits read back by token; the lineage record's crash-durable write protocol and a migration marker; the discovery mutex named as new; the restore statement limited; the companion's xAccess aligned) claude agent, operated by paul@keymail.dev 3 weeks ago
bbcba64dd Design: the replicator's authority, revision 6 (proof and admission separated; one ordering point for the admission against discovery under the fleet's mutex; construction backfills the ancestry's intervals for new owners; the transition table authoritative with transport-lost and a recorder never synthesised; the binding's named invalidators; freshness as the looks give it; a terminal dot keeps the directory requirement; one definition per operation; required coverage its own plan step) claude agent, operated by paul@keymail.dev 3 weeks ago
0e8fc5037 Design: the replicator's authority, revision 5 (the helper's own per-inode lock bookkeeping; the fence shared with every helper and recovery as verified termination; a dead helper's admissions settled by the running agent; closure only with discoveries committed; reach over the unacknowledged ancestry with root-first acknowledgement; the sleeping binding's incarnation and direct freshness; a lineage of filesystem incarnation only; the walk's grammar kept; spike notes superseded where wrong) claude agent, operated by paul@keymail.dev 3 weeks ago
522b29ca0 Replicator authority: spike notes updated for the helper process, the same-process negative case and the transition model claude agent, operated by paul@keymail.dev 3 weeks ago
d4d30de41 Design: the replicator's authority, revision 4 (the fork and its VFS in a helper process so the kernel coordinates locks; settlement by the last participant with a transition table; a pending-discovery latch for a failed uncertainty write; links at construction and transitive inheritance; a producer fence for recovery; closure at zero pending with the margin's day materialised; a sleeping route's binding and a coherent observation; a durable lineage record; walk anchors for absolute spellings) claude agent, operated by paul@keymail.dev 3 weeks ago
b62b435a5 Design: the replicator's authority, revision 3 (a VFS owning every file method; a barrier and an uncertainty, linked successors, recovery that terminates orphans; the retained stack for ascent, named-edge rechecks, repeatable listing, explicit link classes, the platform-link predicate kept apart; replication authority and lineage; a uid lifecycle from the unit observer; tests naming their events) claude agent, operated by paul@keymail.dev 3 weeks ago
ba681da0b Replicator authority: spike notes (the driver's VFS route; the admission as the existing Start commit moved before permission) claude agent, operated by paul@keymail.dev 3 weeks ago
65928b8e8 Design: the replicator's authority, revision 2 (retained descriptors instead of os.Root; a descriptor-rooted VFS instead of a /proc pathname; the admission as a row before the send with settlement, completeness waiting on it and successors acknowledging; owner holds as a ledger change with box-wide the default; claims by (account, app) and identity; a uid producer under the witness; tests named against the counterfactuals) claude agent, operated by paul@keymail.dev 3 weeks ago
afd4dde02 Design: the replicator's authority (opens beneath pinned roots, litestream beneath the same roots, ownership state that survives exit, claims by identity), answering review twenty's eleven deferred findings with decisions 10-13 and approval H as parameters claude agent, operated by paul@keymail.dev 3 weeks ago
e12808113 Review twenty answered: comments scoped to the tenant claims, a depth fixture, and the two refusals that are decisions listed as decisions claude agent, operated by paul@keymail.dev 3 weeks ago
c9ec11eb1 Twentieth replicator build: a tree claim refuses a tenant's file in a platform directory too; the fixture's guard reachable; the no-recorder refusal quoted claude agent, operated by paul@keymail.dev 3 weeks ago
53e3dcd84 Nineteenth replicator build: a tenant's file in a platform directory refused in both layouts, the long-target fixture within the pathname budget, refusal messages quoted claude agent, operated by paul@keymail.dev 3 weeks ago
6249af63e Eighteenth replicator build, Astra's seventeenth report answered: sections told apart in render, the owner-check comment, the witness test's name, the outstanding item claude agent, operated by paul@keymail.dev 3 weeks ago
e8211fc6c Eighteenth replicator build: the link's directory opened as a directory and nothing else, the long-target fixture sized from the temp root claude agent, operated by paul@keymail.dev 3 weeks ago
bffc76b50 The replicator's seventeenth build: the sixteenth review's findings claude agent, operated by paul@keymail.dev 3 weeks ago
f306222c2 The replicator's sixteenth build: the fifteenth review's findings claude agent, operated by paul@keymail.dev 3 weeks ago
03b19014b The replicator's fifteenth build: the fourteenth review's findings claude agent, operated by paul@keymail.dev 3 weeks ago
ec55b6391 The replicator's fourteenth build: the thirteenth review's findings claude agent, operated by paul@keymail.dev 3 weeks ago
90032b613 The replicator's thirteenth build: the twelfth review's findings claude agent, operated by paul@keymail.dev 3 weeks ago
c8e5e47b4 The replicator's twelfth build: the eleventh review's findings claude agent, operated by paul@keymail.dev 3 weeks ago
560313169 The replicator's eleventh build: the tenth review's findings claude agent, operated by paul@keymail.dev 3 weeks ago
9301ed628 The replicator's tenth build: the ninth review's P2 and bounded findings claude agent, operated by paul@keymail.dev 3 weeks ago
e5e67b253 Metered replicator: the eighth review's two reports claude agent, operated by paul@keymail.dev 3 weeks ago
142ef5d02 The replicator's ninth build: the eighth review's P1 and bounded findings claude agent, operated by paul@keymail.dev 3 weeks ago
b5aecf136 The replicator's eighth build: the seventh review's bounded findings claude agent, operated by paul@keymail.dev 3 weeks ago
6b648c0cf The replicator's seventh build: the sixth review's bounded findings claude agent, operated by paul@keymail.dev 3 weeks ago
d63f81dfa The replicator's sixth build: the fifth review's bounded findings claude agent, operated by paul@keymail.dev 3 weeks ago
1b3cc29ed The replicator's fifth build: the fourth review's bounded findings claude agent, operated by paul@keymail.dev 3 weeks ago
01f2b072b The unit-file chain climb stops at the platform's own directory claude agent, operated by paul@keymail.dev 3 weeks ago
b53f2a93e The replicator's fourth build: the third review's bounded findings claude agent, operated by paul@keymail.dev 3 weeks ago
4c9cdb3c7 Record the replicator's third review reports (Opus accept with fixes, Astra reject); dispositions follow claude agent, operated by paul@keymail.dev 3 weeks ago
c86276949 OUTSTANDING item 1 records the replicator's third build claude agent, operated by paul@keymail.dev 3 weeks ago
9480fe3f4 The replicator's fleet stops sending when ownership changes, holds every day in doubt, and takes one strict inventory of files it has checked claude agent, operated by paul@keymail.dev 3 weeks ago
357240ccc The registry keeps an ownership generation that only ownership moves claude agent, operated by paul@keymail.dev 3 weeks ago
137fd4095 A request gate in the replica client: a refusal stops the attempt before it is sent or counted claude agent, operated by paul@keymail.dev 3 weeks ago
9c08ce31b Record the replicator's second review: rejected again, the ownership fence does not hold as built; Close now stops the store claude agent, operated by paul@keymail.dev 3 weeks ago
6dcb97e5b The replicator's fleet keeps its store private, names what it skips, refuses what it cannot read, and meters the platform's databases under identities the ledger accepts claude agent, operated by paul@keymail.dev 3 weeks ago
d16bc80a0 The replicator stops counting when the registry changes: ownership is read under the registry's witness and every request asks it claude agent, operated by paul@keymail.dev 3 weeks ago
1eace90e7 Ownership is decided on the file, not the spelling of its path; shadow state leaves the tenant's directory claude agent, operated by paul@keymail.dev 3 weeks ago
b85355c2c Record the metered replicator's first review: both reviewers reject; nothing fixed yet claude agent, operated by paul@keymail.dev 3 weeks ago
28a9852aa WIP: the metered fleet store, refusing anything it cannot meter claude agent, operated by paul@keymail.dev 3 weeks ago
58f80874d WIP: name the account that pays for each database the box replicates claude agent, operated by paul@keymail.dev 3 weeks ago
a4fb842a4 WIP: a metered litestream store with no lease, the first piece of the platform's own replicator claude agent, operated by paul@keymail.dev 3 weeks ago
72b4f59a8 The handoff records the storage branch's three reviews and the replicator's further fixes claude agent, operated by paul@keymail.dev 3 weeks ago
218c2a357 The handoff records the storage branch's first review, its fixes and the ruling it needs claude agent, operated by paul@keymail.dev 3 weeks ago
cd4d40b6e The handoff records the replicator's second P1 fix and the storage sole-holder branch claude agent, operated by paul@keymail.dev 3 weeks ago
c68ecddd8 The handoff records the replicator's link fix and the full shared /tmp that failed one gate run claude agent, operated by paul@keymail.dev 3 weeks ago
8897e9530 The handoff and the outstanding list record the first reviews of all three side branches; none passed claude agent, operated by paul@keymail.dev 3 weeks ago
551e32c9c The handoff and the outstanding list record the fencing branch's first review: rejected, and its premise does not bound a whole request claude agent, operated by paul@keymail.dev 3 weeks ago
c1cf88226 The handoff records cd8821c6 as the last product-code commit with its gate, CI and review state, and the activator test fix on top claude agent, operated by paul@keymail.dev 3 weeks ago
bac513f6b activator tests: the recording scripts put their files in place whole claude agent, operated by paul@keymail.dev 3 weeks ago
cd8821c6d Close round seventeen: a size is recorded only for the same store that was read before sizing claude agent, operated by paul@keymail.dev 3 weeks ago
86a1849d7 Close round sixteen: an unmeasured store holds storage for its own account only claude agent, operated by paul@keymail.dev 3 weeks ago
ff891f390 The handoff names abc9f781 as the code tip with its gate, review and CI state, and makes no claim about later commits claude agent, operated by paul@keymail.dev 3 weeks ago
abc9f7816 Close round fifteen: nothing reads a retained store's bucket as that store's claude agent, operated by paul@keymail.dev 3 weeks ago
973a9f157 Close round fourteen: a refused holder is never reconciled away, a scanning re-grant never takes a store back, and the rotation's mark is written at delivery claude agent, operated by paul@keymail.dev 3 weeks ago
d5705a63e Close round thirteen: the record's reader and writer refuse a record no walk can follow, and a rotation marks its key change claude agent, operated by paul@keymail.dev 3 weeks ago
a3f2c15d5 The handoff names d0a21aa1 as the code tip with its gate and CI result; round thirteen is running claude agent, operated by paul@keymail.dev 3 weeks ago
d0a21aa1e Close round twelve: one check for records no walk can follow, a delivering mark on the grant, and a member's take-back refused over another account's bucket claude agent, operated by paul@keymail.dev 3 weeks ago
81ff7c9db The handoff names 1395f7bf as the code tip with its gate and CI result; round twelve's reports are added claude agent, operated by paul@keymail.dev 3 weeks ago
1395f7bf9 Close round eleven: a record's provisioned bucket is its bucket, a grant is counted before it touches IAM, a rotation compares the whole estate claude agent, operated by paul@keymail.dev 3 weeks ago
7bcf7487a The handoff names 84311b9f as the code tip and round eleven as running claude agent, operated by paul@keymail.dev 3 weeks ago
84311b9fe Close round ten: every creating grant is counted before it calls the provider, a deletion note names its bucket, and two sharers of an unsupported name cannot wait on each other claude agent, operated by paul@keymail.dev 3 weeks ago
366bd5830 Add the round ten review brief; the handoff names 94ca7482 as the code tip claude agent, operated by paul@keymail.dev 3 weeks ago
94ca74826 Close round nine: a take-back is counted before it creates anything, a grant compares the estate, an unsupported name is not destroyed over another holder claude agent, operated by paul@keymail.dev 3 weeks ago
6b6d57046 List each approval with its exact scope; refresh the short handoff for the gated tip 3d4104cb claude agent, operated by paul@keymail.dev 3 weeks ago
f55384672 Add the round nine review brief claude agent, operated by paul@keymail.dev 3 weeks ago
3d4104cb8 Test the purge's in-sweep rule: a granted record that is in the listing is not swept claude agent, operated by paul@keymail.dev 3 weeks ago
14d3af890 Close round eight: an estate is not a name, every walk is leased, a purge never sweeps a granted store, a review names its operation claude agent, operated by paul@keymail.dev 3 weeks ago