- the harness lands in src/ops.rs's test tree (#\[cfg(test)] under
feature ops): serving assembly (OperationRegistryBuilder + CallAdapter
run loop) and client side (CallClient + spawn_dispatch; ChannelClient)
- the loopback connection source: Connection::from_source with a
pre-wired multi-stream BidiStreamSource — the QUIC-shaped in-memory
stand-in stream-per-request needs (a single from_bidi half cannot
serve spawn_dispatch's call path)
- the channel shape: ChannelsAdapter install hook forks the assembled
registry, registers the stub openable through
register_openable_with_establisher (the awaited Establishment phase),
dispatches via run_loop_single_stream
- the identity/ACL wiring: TestIdentityProvider (token → identity) +
TestOwnership (namespace → identities → granted actions,
closed-by-default per OQ-09); call shape rides auth_token resolution,
channel shape rides the transport-identity seam
- proven with the stub ops: JSON round-trip call → envelope; the ACL
stub denies anonymous/ungranted and admits granted; the channel stub
establishes and bytes flow both directions; the refusal arms prove
ACL-before-establishment and the channel:open_failed/unknown_resource
reply shape
- dev-dep: async-trait 0.1 (the BidiStreamSource impl); lib tree
unchanged
verified: cargo test --features ops (88/19/3 green), cargo test
(default, harness compiled out — 73/19/3 green), cargo clippy
--all-targets -- -D warnings on both shapes, cargo fmt --check,
cargo doc --no-deps clean
The ops module's state substrate under feature `ops`, no op handlers
yet (they land with ops-json-ops/ops-fetch/ops-put):
- `OpsContext` — the context type the handler pairs capture: the
`Arc<Store>`, the module config, the token registry, the per-
namespace converter bindings, the fanout registry (re-exported
from lib.rs)
- The pin-token layer (ADR-010 §4 / ADR-012 §2): CSPRNG `PinToken`
(32 bytes, `getrandom 0.4` — the decided minting form; counter and
derivable forms rejected as guessable capabilities), the
token↔(key, owner) mapping with process lifetime (retirement at
conversion-confirmed or process end; no expiry machinery), the
validity domain = the minting node (peers refuse unknown tokens
with present: false, never an error)
- The guard-custody split: `mint_fleet` (mapping only; the put
handler's guard drops at response completion — its own act; the
fleet-declaration and owner-instance checks ride the mint) vs
`mint_custodial` (the registry holds the guard; nothing expires;
refused under a fleet declaration)
- The namespace→liveness-source binding: per-namespace `PinConverter`
registration; the conversion trigger decided as the embedder-called
confirm verb (probe-triggered conversion rejected: a read-gated op
never mutates protection), riding `RegistryCore::convert`'s
ordered step under the arbitration lock
- The crate-internal store-core renewal access:
`Store::ops_pin_renew`/`Store::ops_pin_check` (pub(crate), cfg all
(ops, postgres)) routed through the fleet host — the W6-3 named
consumer; the probe composition decided as
verify-the-mapping-then-renew; no public-API widening, no backend
side-door
- The fanout registry (POC #3 finding A3): per-digest broadcasts,
bounded subscriber channels, the late-joiner degrade signal
(subscribe → None, channel end → verified get), and the
Stall/Drop slow-subscriber policies
- Dependency posture: serde/serde_json/getrandom enter as ops-gated
optional deps; the default build's dependency tree verified
unchanged; gc.rs's allow-scope notes updated to the landed state
Verification: cargo test (default 73/19/3, module compiled out),
cargo test --features ops (84/19/3, 11 new ops unit tests),
cargo test --all-features (237/125/4); clippy --all-targets
-D warnings across the default/ops/all-features/pg-pure variants;
cargo fmt; cargo doc --no-deps zero warnings on the default and
gated-ops builds (the all-features count at the pre-existing
baseline).
- Under fleet: true, puts route through the joint entry+pin tx
(store-fleet-put): kv tier via begin_joint_tx -> joint_put (CAS; a
dedup re-put commits the pin row alone, upsert-renewing
(key, owner)) -> pin_commit — entry + pin row in one step, verified
against an independent connection; large = pg-lo rides the one-tx
consolidation form (known- and unknown-length; the 512 KiB knee,
the empty-contribution re-put form, read-your-own-writes
derivation); large = local on declared shared media is
pin-first, publish-second (the row-only joint tx, then the staged
commit-rename; the orphan-pin crash window is the expiry
machinery's).
- Amendment A1 landed: catch-propagate-terminate — every error path
between begin_joint_tx and pin_commit terminates the held tx before
propagating (no mid-flight PgJointTx returns dirty to the pool,
PG-2); tested with a forced mid-driver failure (zero residue, the
pool's idle-in-transaction count zero, a follow-up put clean).
- The pin guard's fleet form: the returned guard carries the row's
TTL/3 renewal duty — a per-guard tokio task (spawned at the row's
durability), silent on Err, ended by the never-resurrect
Ok(false), aborted at every guard-life boundary (drop, batch
contribution, conversion); PinRenewal gated feature postgres.
- KvEngine::Postgres holds Arc<PostgresBackend> so detached renewal
tasks share the fleet host's engine; tokio gains the time feature
for the cadence.
- Non-fleet put paths byte-unchanged (all existing suites green); a
non-fleet test pins that no pin rows are ever committed.
- Tests: new postgres_fleet_put_tests (fresh schema + SchemaJanitor;
kv joint atomicity both-or-neither, forced pin_commit failure,
renewal cadence/drop/conversion stop, never-resurrect, batch
release ends renewals, dedup upsert-renewal + by-row composition,
local pin-first success + forced-failure forms, non-fleet
non-event) and postgres_pglo_fleet_put_tests (fresh db +
DatabaseJanitor; the A1 pg-lo failure form, the consolidation
round-trip through the public put). Env-driven, skipping cleanly
server-less.
Verified: cargo test (default) green; --features postgres and --features
"postgres,pg-lo" green server-less (skipping) and against the harness
server (pglo-poc, :15432); --all-features green live; pg-pure and
mem,pg-lo pure builds green; clippy -D warnings green (all combos);
cargo fmt --check green; cargo doc --no-deps clean (default; the gated
builds' pre-existing warnings unchanged). Schema/db residue 0.
The gc-protocol task (ADR-005; abort-as-data per ADR-012 §1; non-SQL
inline window staging per ADR-012 §5) wired on the Store facade:
- src/gc.rs — GcHome + RegistryCore: one arbitration lock over per-key
pin refcounts, in-flight delete markers, and the registered source
lists; async pin minting (acquire) that blocks on in-flight deletes
(ADR-005's re-put case (a) delete-then-recover without engine I/O
under the lock); the ordered-step convert primitive (pin release +
registration in one section); batch one-step release; the
single-node sweep lease (the in-process analog of ADR-013 §2).
- src/facade.rs — Pin/Batch carry the registry back-reference and own
their drop release (batch drop decrements every member in one
ordered step); new public vocabulary LivenessSource, ProtectCallback,
Registration, re-exported from lib.rs.
- src/store.rs — sweep() (single-flight → zero-source safe default →
protect consult → mark over both tiers' list() union → arbitrate at
delete time → ~100/batch commit → exact-count report or
abort-as-data), direct delete() (existence probe → full protection
set per ADR-012 §6.4 → GcRefuse/Missing/delete through the
fall-through), and the registration/unregistration verbs.
- 16 new tests + the facade pin/batch shape test reworked on the wired
machinery: exact counts across both tiers, abort shapes, dedup
refcounts, batch drops, live-shared sources, the conversion ordered
step sequentially and raced, sweep-vs-pinned-put (64 rounds, every
schedule, byte-identical delete-then-recover), publish-after-mark,
no-torn reads under a window, single-flight contention, and
malformed-list sweeps as operational errors.
- tasks/gc-protocol.md — status completed; named design points recorded
in Notes.
Verification: cargo test (default) 46 passed; --features mem and
--all-features 89 passed each; cargo clippy --all-targets -- -D
warnings (default and --all-features) clean; cargo fmt --check clean;
cargo doc --no-deps at the pre-existing baseline (no new warnings).
Every gate check read against the cited ADR text: the key encoding
holds byte-exact against ADR-002 (tags, lengths, rejects, sort order,
preamble abstraction, live git-CLI interop, lowercase oid policy
recorded); the trait + I/O seams + engine-state seam match ADR-003/
010 and ADR-012 §5's reduced table; the error model's five variants
and single-enum altitude reading match store-api.md/ADR-012 §6.5; the
feature graph matches ADR-013 §4; all named design points audited
consistent; the suite convention and backlog are traceable; family
conventions clean. One inline fix: publish keyword `bao` -> `git`
(excluded technology named in metadata). Wave 2 decomposition
unblocked, no amendments.
Verified: cargo test (26 lib + 4 conformance + 3 git-interop passed),
cargo clippy --all-targets -- -D warnings, cargo clippy --all-features
--all-targets -- -D warnings, cargo fmt --check, cargo check
--all-features, cargo check --no-default-features --features pg-lo.
Wave 1 task core-hashing-keys: the crate's declared one-way door,
implemented byte-exact to ADR-002.
- src/hashing.rs: Algorithm (exactly GitBlobSha256 canonical /
GitBlobSha1 tolerated; BLAKE3 absent), Digest (known-length
derivation H("blob <len>\0" + content) as primary constructor;
from_git_oid_hex interop constructor, lowercase-only acceptance),
and the hashing::registry constants (0x01/0x02, 0x00 reserved; new
algorithm = new ADR)
- src/keys.rs: typed Key wrapper; as_bytes/from_bytes are the only
backend-boundary conversions; 1 algorithm byte + digest bytes
(33/21 total); rejects-never-guesses validation -> Error::KeyInvalid
- tests/git_interop.rs: the load-bearing test — byte-exact derivation
against the `git hash-object` CLI, both algorithms, small and
75-KiB content; external-oid round-trip into pool keys; both oid
formats coexisting in one flat pool
- named design point (oid hex policy): lowercase-only acceptance,
recorded in the task Notes and on from_git_oid_hex
Verified: cargo test (15 passed), cargo clippy --all-targets -- -D
warnings, cargo fmt --check, cargo test --all-features — all green.
glm-5.3-flash