alkblobs/tasks/split-ops.md

id, name, status, depends_on, scope, risk, impact, level, tags

id	name	status	depends_on	scope	risk	impact	level	tags
split-ops	ops.rs → ops/ — tokens, acl, specs, put pipe, fetch fanout, harness, tests; re-exports unchanged	completed	mem-default-on	moderate	medium	component	implementation	wave-8 review-001 split structure

Description

Review-001 D-1's worst composite: src/ops.rs at 6,896 lines behind one #[cfg(feature = "ops")] — the token layer, the ACL mapping, the five op specs + handlers, the JSON Schemas, the put pipe (writer/ reader pump), the fetch fanout (registry + publisher + pumps), the wire-error synthesis, a full in-process alkcall harness, and the e2e test tree, all in one file — every reader or writer of any part opens all of it. Same method as split-store: pure moves, no behavior change, lib.rs re-exports unchanged, the feature gate moves with the module (the whole directory stays #[cfg(feature = "ops")]).

Proposed module shape (the task's to adjust, recording the final shape on the module docs):

• ops/mod.rs — the directory module: the module doc (the ADR-001 posture, the store-consumer rule, what lives where), the intra-ops re-exports, the OpsContext if it reads as the spine (or it lives with the token layer).
• ops/tokens.rs — the pin-token layer: PinToken, the TokenRegistry, the mint verbs, the custody split (ADR-010 §4, ADR-012 §2), the renewal probe composition.
• ops/acl.rs — the namespace→resource mapping and the action tables (OQ-09's closed-by-default enforcement as implemented).
• ops/specs.rs — the five OperationSpecs + their JSON Schemas; ops/wire.rs the wire-error synthesis (store_internal_error, put_refused_error, et al.) if it reads cleaner split — the boundary is the task's.
• ops/handlers.rs — the five handler pairs, or per-op files (stat/have/delete/fetch/put) with put's size justifying its own; the task places it.
• ops/put.rs — the put pipe: the writer/reader pump, put_handle, finish_put, the marked-pub ack machinery.
• ops/fetch.rs — the fetch fanout: ranges establishment, the publisher, the pumps.
• ops/harness.rs — the in-process alkcall test harness (its non-test/test split preserved as it is today).
• the tests ride their subject modules; the e2e tree moves as its own ops/tests.rs (or per-module) — the task places it.

The #![allow(dead_code)] discipline matches split-store's (any remaining allowance scoped, consumer-named). No fixing: review-001's S-findings are wave 10's; if the moves touch a misleading error text anyway, it is a noted exception, not a fix sweep (S-1's error texts are OQ-14's to resolve).

Acceptance Criteria

• src/ops.rs is an ops/ directory module; lib.rs's public re-export set byte-identical (audited)
• every moved region is a move, not a rewrite (move detection on the diff; spot-reads against the old blob)
• the ops feature gate intact: default builds compile the directory out; no leak of ops into the base crate
• the default dependency tree unchanged (cargo tree diff)
• the test sections ride their subject modules; the full suite green (default + --features ops + --all-features)
• gates green: cargo test, cargo test --features ops, cargo test --all-features server-less, clippy across variants, fmt, cargo doc --no-deps (zero warnings on the default and ops builds)

References

• docs/reviews/001-storage-surface-general-review.md (D-1, D-2 — the op handlers' error arms are wave 9/10's tests, not this task's)
• docs/plans/implementation.md (§Wave 8; §Review gates — the split gate)
• src/ops.rs (the file this task splits)
• docs/architecture/decisions/001-substrate-posture-and-ops-placement.md §4 (the module's posture — the module doc it splits into pieces)
• src/lib.rs (the re-export surface)
• tasks/split-store.md (the sibling split; same method and audit)

Notes (the recorded shape, 2026-10-15)

• mod.rs: the old module doc carried over verbatim plus a new layout-section; the five ops' spec/handler code rides its family.
• OpsContext/OpsConfig ride tokens.rs — the proposal's named alternative taken: the custody verbs (the mint pairing, the renewal composition, the confirm conversion) reach the registry's private ticket state, so a mod.rs placement would have forced visibility surgery on moved code.
• No acl.rs — the namespace→resource mapping and the action tables exist in the code only as the specs' AccessControl values and the resource_id_path selections inside the spec constructors (the closed-by-default enforcement is alkcall's, at op entry); a separate module would have been an empty shell.
• The put wire-error trio (put_refused_error, digest_mismatch_error, put_message_details_schema) moved to wire.rs with the rest of the synthesis, per the proposal's boundary note.
• The fanout registry + publisher ride fetch.rs (the task's "fetch fanout: registry + publisher + pumps").
• The harness machinery (harness.rs) and the e2e tree (tests.rs) sit at file top level — the four-space nesting indent dedented where a level was removed (whitespace-only); the machinery's ops items come via explicit imports (the old use super::* glob leaned on the parent file's private use bindings); items shared across the two test files carry pub(crate). The unit tests for tokens/fetch moved into their subject modules as #[cfg(test)] mod tests (indent preserved); the shared helpers (RecordingConverter, key_of, test_store) live at the top of tests.rs.
• Audit exception (move-necessitated, not a fix sweep): the structural no-side-door audit test was adapted to enumerate from the six module files, each cut at its first #[cfg(test)] gate — the old include_str!("ops.rs") single-file read has no target after the split. Its expected method set and forbidden-token list are unchanged.