alkblobs/tasks/pinning-tests-family-wire.md

id, name, status, depends_on, scope, risk, impact, level, tags

id	name	status	depends_on	scope	risk	impact	level	tags
pinning-tests-family-wire	The pinning tests — POC-X's ops_gap substance re-homed: the family entry is wire-addressable end to end	completed	ops-put-handler-key-claims	narrow	low	component	implementation	wave-14 review-003 adr-020 ops tests pinning

Description

ADR-020 §Decision 9's pinning test (the fourth seam): the coherence defect's reproduction — POC-X's tests/ops_gap.rs (/workspace/alkgit-pocx, completed 2026-10-18; one test, git_object_oids_are_unreachable_through_the_ops_ingress) — re-homed into this repo's ops test tree as the positive form. The gap is closed by the preceding tasks; the pinning test proves it closed and stays closed:

• A facade-published family entry is wire-addressable: an entry put through put_as(Algorithm::GitObjectSha1 | GitObjectSha256, len, loose) — the loose-object form, the digest byte-identical to git's oid — is then, over the ops surface: fetchable (the ranged fetch returns the stored bytes, slice digests verifying), stat-able (len = the stored-preimage length, ADR-018 §Decision 3's semantic), and have-servable (present: true for the entry the node holds — the exact miss POC-X measured).
• A wire-offered family put lands under its own oid: the put offer carries the family key hex + len; the response echoes the key; the landed entry's key equals the git oid key; a subsequent fetch/stat over the wire serve it.
• The negative preserved: a bare-hex oid offer (the wave-13 wire form) is rejected — at the schema gate for the put/stat shapes, and the ingress's INVALID_DIGEST for direct calls — the old form is dead, not deprecated.

Shape: extend src/ops/tests.rs (the put/fetch/stat/have test tree already has the harness helpers — put_serving, open_put, the channel client) rather than a new test file; the family legs ride the existing helpers. Both sha-1 and sha-256 family members exercise the path (the cross-family vector's lesson: same digest bytes, different tags — one member's passing says nothing about the other's ingress).

The test names the invariant it pins (ADR-020 §Decision 1): the addressable classes of the facade and of the wire are the same set — a facade-published entry is wire-addressable, a wire-offered put lands under the address its claim named.

Acceptance Criteria

• The pinning test green: facade-published family entries (both sha-1 and sha-256 members) fetchable, stat-able, and have-servable over the ops surface
• The wire-offered family put lands under its own oid; the echoed key equals the git oid key; the landed entry serves over fetch/stat
• The bare-hex negative pinned: the wave-13 wire form rejects at the gate (and INVALID_DIGEST at the ingress)
• The test would have failed on the wave-13 surface (the gap reproduction's substance — record the one-line justification in the task notes: which assertion measured the wall)
• Gates green: cargo test (default), cargo test --all-features server-less (this task adds no pg code; the fleet forms are already covered by the store-core family tests), both clippy variants, cargo fmt --check

References

• docs/architecture/decisions/020-family-explicit-wire-payloads.md (§Decision 9 — the pinning test's definition; §Decision 1 — the invariant pinned)
• docs/reviews/003-family-wire-gap-review.md (F-1 — the measured wall; the recommended-shape section's pinning-test item)
• /workspace/alkgit-pocx/tests/ops_gap.rs (the reproduction — the substance to re-home; measurement material, not design input)
• src/ops/tests.rs (the harness helpers); tasks/ops-put-handler-key-claims.md

Notes

The wall, one line: the have leg — present: [true] for the family entry addressed by its git oid over the wire — is the assertion that measured the wall: on the wave-13 surface it answered present: false (the ingress length-routed the bare oid onto a blob-family key, a different key than the one held — POC-X's exact miss), and the tag-prefixed key hex the test addresses the entry by failed the wave-13 40/64 schema gate before even reaching a decode.

Shape landed: the pinning test (a_facade_published_family_entry_is_wire_readable_end_to_end, already grown during the two preceding tasks' work) is now parameterized over both family members — Algorithm::GitObjectSha1 (tag 0x03, 42-char wire form) and Algorithm::GitObjectSha256 (tag 0x04, 66-char) — each riding: the facade put_as of the loose preimage with the digest byte-identical to git's oid asserted, wire stat (ADR-018 §Decision 3's stored-preimage length), wire have (present: [true]), the ranged fetch with the ack's slice digests verified against the store's own read_range digests plus the served-bytes verification under the family's own derivation, the wire-offered put landing under the claimed git oid key (echoed key == the offered hex, custody refcount, the minted token held), and the landed entry then serving over wire stat and a whole-form fetch — the full invariant's two directions per member.

The bare-hex negative completed across the three arm-shapes the task named: the put offer's bare-hex key (40/64 hex) joined the malformed-wire-sweep battery — the schema gate's INVALID_INPUT, the wave-13 wire form dead at the gate for the put shape (the stat shape was already in the same battery's rows); the put handler's handler-direct bare-hex key claims joined the ingress-guard test — INVALID_DIGEST verbatim from digest_ingress, the rejects-never-guesses decoder, never a length-implied family read (the stat shape's handler-direct and wire arms were already in bare_hex_dies_and_the_gate_and_ingress_agree_on_every_input).

Both members derive from the same loose preimage content in the facade leg (the cross-family vector realized in-crate: identical digest bytes under both sha arms, only the tag splits the addresses — each member exercises its own ingress).

Summary

ADR-020 §Decision 9's pinning test landed: POC-X's ops-gap reproduction re-homed as the in-tree positive form, green. A facade-published family entry — both sha-1 and sha-256 members, tags 0x03/0x04 riding the wire form — is stat-able, have-servable, and ranged-fetchable over the ops surface with slice digests verifying, a wire-offered family put lands under the git oid key its claim named (the echoed key, custody, minted token), and the landed entry then serves over wire stat/fetch. The bare-hex negative is pinned at every arm the task named: put and stat shapes reject at the schema gate, and handler-direct bare-hex claims answer INVALID_DIGEST from the ingress — the wave-13 wire form dead, not deprecated, per ADR-020 §Decision 2. Verification: cargo test (default: 219 passed), cargo test --all-features against the live pglo-poc harness (341 / 125 / 7 / 3 — the pg columns ran for real), both clippy variants with -D warnings, and cargo fmt --check — all green.