Documentation
¶
Overview ¶
Package indexreader provides a format-aware local index read seam.
It dispatches on authoritative markers (sqlite-v1 | durable-v2) and exposes a narrow reader used by index query (and, later, stats/doctor/list). Durable reads stream verified segment rows; they do not hydrate into ephemeral SQLite.
This package is Experimental. The durable-v2 path is an internal-render surface, not a publication or de-identification path.
Index ¶
- Constants
- Variables
- func IsBridgeError(err error, code string) bool
- func ReadBoundedFile(path string, maxBytes int64) ([]byte, error)
- func ValidateSQLiteWriteTarget(ctx context.Context, opts SQLiteWriteTargetOptions) error
- type AcquireBundleOptions
- type AcquiredArtifact
- type AcquiredBundleLimits
- type AcquiredBundleMarker
- type AcquiredLineageNode
- type AcquiredOpenOptions
- type BridgeError
- type BridgeLimits
- type BridgeOptions
- type BridgeResult
- type BridgeRunStart
- type BridgeSnapshotTime
- type CanonicalIdentityAuthority
- type CanonicalLocalIdentityFile
- type CoverageSummary
- type DeclaredSnapshotCounts
- type Format
- type HubConditionalCreatePublisher
- type HubExactObjectReader
- type IdentityStatus
- type ListedIndex
- type LocalIdentityFile
- type Meta
- type Reader
- type ResolveOptions
- type ResolveTarget
- type SQLiteIdentityPublicationGuard
- func (g *SQLiteIdentityPublicationGuard) Check() error
- func (g *SQLiteIdentityPublicationGuard) Close() error
- func (g *SQLiteIdentityPublicationGuard) PublishIdentity(identity *indexstore.IndexSetIdentityResult) error
- func (g *SQLiteIdentityPublicationGuard) PublishManifest(doc *manifest.IndexManifest) error
- type SQLiteSnapshot
- type SQLiteSnapshotOptions
- type SQLiteVerificationTarget
- func (t *SQLiteVerificationTarget) AttemptName() string
- func (t *SQLiteVerificationTarget) Check() error
- func (t *SQLiteVerificationTarget) Close() error
- func (t *SQLiteVerificationTarget) DB() *sql.DB
- func (t *SQLiteVerificationTarget) Locator() string
- func (t *SQLiteVerificationTarget) Path() string
- type SQLiteVerificationTargetOptions
- type SQLiteWriteTarget
- func (t *SQLiteWriteTarget) Check() error
- func (t *SQLiteWriteTarget) Close() error
- func (t *SQLiteWriteTarget) DB() *sql.DB
- func (t *SQLiteWriteTarget) PublishIdentity(identity *indexstore.IndexSetIdentityResult) error
- func (t *SQLiteWriteTarget) PublishManifest(doc *manifest.IndexManifest) error
- func (t *SQLiteWriteTarget) QuarantineResidue() []string
- type SQLiteWriteTargetOptions
- type SnapshotSourceKind
- type VerifiedAcquiredBundleReport
- type VerifiedAcquiredBundleReporter
- type VerifiedSnapshotMetadata
- type VerifiedSnapshotMetadataReader
- type VisitObject
Constants ¶
const ( AcquiredBundleType = "gonimbus.index.acquired_bundle.v1" AcquiredBundleSchema = "gonimbus/v1.0.0/index-acquired-bundle.v1" AcquiredBundleTypeV2 = "gonimbus.index.acquired_bundle.v2" AcquiredBundleSchemaV2 = "gonimbus/v1.0.0/index-acquired-bundle.v2" HubMarkerSchemaV2 = "gonimbus.index.hub_marker.v2" )
const ( HubMarkerSchemaV1 = "gonimbus.index.hub_marker.v1" HubMarkerSchemaV3 = "gonimbus.index.hub_marker.v3" BridgeDispositionCreated = "created" BridgeDispositionAlreadyIdentical = "already_identical" BridgeRunStartLegacyAsserted = "legacy_asserted" BridgeRunStartLocallyObserved = "locally_observed" BridgeSnapshotTimeExactCommit = "exact_commit" BridgeConversionType = "gonimbus.index.custody_bridge_conversion.v1" )
const ( BridgeErrorInvalidRequest = "bridge_invalid_request" BridgeErrorSourceRead = "bridge_source_read_failed" BridgeErrorLegacyMarker = "bridge_legacy_marker_invalid" BridgeErrorIdentityInvalid = "bridge_identity_invalid" BridgeErrorEvidenceInvalid = "bridge_evidence_invalid" BridgeErrorManifestInvalid = "bridge_manifest_invalid" BridgeErrorSegmentInvalid = "bridge_segment_invalid" BridgeErrorResourceLimit = "bridge_resource_limit" BridgeErrorWorkspace = "bridge_workspace_failed" BridgeErrorTargetCreate = "bridge_target_create_failed" BridgeErrorTargetRead = "bridge_target_read_failed" BridgeErrorTargetConflict = "bridge_target_conflict" BridgeErrorInternalInvariant = "bridge_internal_invariant" )
const ( BridgeIdentitySchema = "gonimbus.index_set_identity.canonical-json-lf.v1" BridgeIdentityProfile = "default" )
const ( SnapshotSourceLocalPublished SnapshotSourceKind = "local_published" SnapshotSourceAcquiredHub SnapshotSourceKind = "acquired_hub" // SourceIdentitySchemaV1 identifies the existing public schema for the // canonical IndexSetIdentityPayload. SourceIdentitySchemaV1 = "gonimbus/v1.0.0/index-hub-identity" // SourceIdentityProfileV1 freezes the artifact encoding: the exact // ComputeIndexSetID canonical JSON payload followed by one LF. SourceIdentityProfileV1 = "gonimbus.index_set_identity.canonical-json-lf.v1" )
Variables ¶
var ( // ErrHubExactRead deliberately omits provider error text. A provider may put // account coordinates, request IDs, or credential-adjacent details in errors. ErrHubExactRead = errors.New("hub exact-object read failed") // ErrAcquiredBundleConflict means the final destination already names a // different or unverifiable acquisition. It is never overlaid or repaired. ErrAcquiredBundleConflict = errors.New("acquired bundle destination conflict") // ErrNotAcquiredBundle is the stable refusal for hydrate directories, // canonical index directories, and other unmarked paths. ErrNotAcquiredBundle = errors.New("not a final acquired bundle") )
var ErrCanonicalSQLiteAdoption = errors.New("refusing to adopt untrusted existing canonical SQLite database")
ErrCanonicalSQLiteAdoption reports that a writer found an existing canonical database whose trusted identity marker cannot authorize reuse.
var ErrDurableSinceRunUnsupported = fmt.Errorf("--since-run on durable-v2 requires exact pinned current and baseline runs")
ErrDurableSinceRunUnsupported is returned when --since-run is requested against an unpinned durable-v2 reader.
var ErrSQLiteIdentityScope = errors.New("SQLite snapshot identity/scope mismatch")
ErrSQLiteIdentityScope reports that an authority-held database does not contain exactly the single index set authorized by the caller.
var ErrVerificationProjectionTarget = errors.New("refusing unsafe verification projection target")
ErrVerificationProjectionTarget reports that a run-scoped verification projection path could not be created or retained safely under the authority-bound segment-set root.
ErrVerifiedSnapshotMetadataUnavailable is returned when a reader substrate cannot provide the verified durable facts required by receipt-jsonl-v1.
Functions ¶
func IsBridgeError ¶
IsBridgeError reports whether err carries the given closed bridge code.
func ReadBoundedFile ¶
ReadBoundedFile reads a local file with a single open and LimitReader(max+1). Oversized files fail closed. Default max is 1 MiB when maxBytes <= 0.
func ValidateSQLiteWriteTarget ¶
func ValidateSQLiteWriteTarget(ctx context.Context, opts SQLiteWriteTargetOptions) error
ValidateSQLiteWriteTarget is the non-mutating companion used by workflows such as durable-only publication that write canonical identity metadata but do not open or create index.db. An absent database remains absent.
Types ¶
type AcquireBundleOptions ¶
type AcquireBundleOptions struct {
IndexSetID string
RunID string
ProofThroughRunID string
Destination string
Limits AcquiredBundleLimits
// Warning receives post-commit durability/cleanup warnings. A successful
// no-replace rename remains authoritative and is never reported as failure.
Warning func(message string)
}
AcquireBundleOptions identifies one immutable acquisition. Destination is the final bundle directory. ProofThroughRunID, when set, acquires and verifies the exact continuous ancestry from RunID through that run without ancestor rows.
type AcquiredArtifact ¶
type AcquiredArtifact struct {
Path string `json:"path"`
Role string `json:"role"`
SizeBytes int64 `json:"size_bytes"`
SHA256 string `json:"sha256"`
}
AcquiredArtifact binds one bundle-internal relative path.
type AcquiredBundleLimits ¶
type AcquiredBundleLimits struct {
MaxMarkerBytes int64
MaxManifestBytes int64
MaxIdentityBytes int64
MaxSegmentBytes int64
MaxSegments int
MaxLineageNodes int
MaxAggregateBytes int64
MaxMetadataBytes int64
}
AcquiredBundleLimits bounds every remotely supplied allocation/read.
type AcquiredBundleMarker ¶
type AcquiredBundleMarker struct {
Type string `json:"type"`
Schema string `json:"schema"`
IndexSetID string `json:"index_set_id"`
RunID string `json:"run_id"`
ProofThroughRunID string `json:"proof_through_run_id,omitempty"`
SourceIdentitySHA256 string `json:"source_identity_sha256"`
SourceIdentitySchema string `json:"source_identity_schema"`
SourceIdentityProfile string `json:"source_identity_profile"`
HubMarkerSchemaVersion string `json:"hub_marker_schema_version,omitempty"`
RunStart *BridgeRunStart `json:"run_start,omitempty"`
SnapshotTime *BridgeSnapshotTime `json:"snapshot_time,omitempty"`
ConversionIdentitySHA256 string `json:"conversion_identity_sha256,omitempty"`
SnapshotCompletedAt string `json:"snapshot_completed_at,omitempty"`
SnapshotCompletionSemantics string `json:"snapshot_completion_semantics,omitempty"`
HubCommittedAt string `json:"hub_committed_at"`
HubCompleteSHA256 string `json:"hub_complete_sha256"`
ManifestSHA256 string `json:"manifest_sha256"`
AcquiredAt string `json:"acquired_at"`
Lineage []AcquiredLineageNode `json:"lineage"`
Artifacts []AcquiredArtifact `json:"artifacts"`
}
AcquiredBundleMarker is the final acquisition receipt. It intentionally contains no source coordinates, provider configuration, or credential handle.
func AcquireBundle ¶
func AcquireBundle(ctx context.Context, source HubExactObjectReader, opts AcquireBundleOptions) (AcquiredBundleMarker, error)
AcquireBundle downloads and verifies exactly one durable hub run and optional proof-through ancestry, then publishes acquired.json last via atomic no-replace directory rename.
type AcquiredLineageNode ¶
type AcquiredLineageNode struct {
IndexSetID string `json:"index_set_id"`
RunID string `json:"run_id"`
MarkerSchemaVersion string `json:"marker_schema_version,omitempty"`
HubCompleteSHA256 string `json:"hub_complete_sha256"`
ManifestSHA256 string `json:"manifest_sha256"`
ConversionIdentitySHA256 string `json:"conversion_identity_sha256,omitempty"`
}
AcquiredLineageNode binds the hub and manifest bytes for one verified node.
type AcquiredOpenOptions ¶
type AcquiredOpenOptions struct {
Directory string
Limits AcquiredBundleLimits
}
AcquiredOpenOptions selects a final acquired bundle.
type BridgeError ¶
type BridgeError struct {
Code string
}
BridgeError is a closed, coordinate-free library failure.
func (*BridgeError) Error ¶
func (e *BridgeError) Error() string
type BridgeLimits ¶
type BridgeLimits struct {
MaxMarkerBytes int64
MaxManifestBytes int64
MaxIdentityBytes int64
MaxEvidenceBytes int64
MaxSegmentBytes int64
MaxSegments int
MaxAggregateBytes int64
MaxConversionBytes int64
}
BridgeLimits supplies caller ceilings for untrusted input and aggregate verified content. Positive values can tighten but never loosen the frozen protocol maxima.
type BridgeOptions ¶
type BridgeOptions struct {
IndexSetID string
RunID string
Workspace string
Limits BridgeLimits
ExportedBy string
HubCommitClock func() time.Time
}
BridgeOptions identifies one exact legacy durable run. Workspace is an optional parent for the private verification spool. HubCommitClock is injectable for deterministic commit-boundary tests.
type BridgeResult ¶
type BridgeResult struct {
IndexSetID string
RunID string
LegacyMarkerSHA256 string
IdentitySHA256 string
IdentitySchema string
IdentityProfile string
ManifestSHA256 string
DeclaredRows int
DeclaredSegments int
SegmentsVerified int
BytesRead int64
BytesConditionallyCreated int64
RunStart BridgeRunStart
SnapshotTime BridgeSnapshotTime
ConversionIdentitySHA256 string
HubCommittedAt string
CompleteSHA256 string
ExportedBy string
Disposition string
}
func BridgeLegacyDurableRun ¶
func BridgeLegacyDurableRun( ctx context.Context, source HubExactObjectReader, target HubConditionalCreatePublisher, identityAuthority CanonicalIdentityAuthority, snapshotCompletionEvidence []byte, opts BridgeOptions, ) (BridgeResult, error)
BridgeLegacyDurableRun verifies and republishes one exact legacy durable run. It cannot list, select latest, overwrite, delete, or construct live-source providers because none of those capabilities are present in its interfaces.
type BridgeRunStart ¶
type BridgeSnapshotTime ¶
type CanonicalIdentityAuthority ¶
CanonicalIdentityAuthority supplies exactly one identity authority. The canonical form is the exact payload JSON plus one LF. A declaration is the closed typed reconstruction input; it is never itself published.
type CanonicalLocalIdentityFile ¶
type CanonicalLocalIdentityFile struct {
Payload indexstore.IndexSetIdentityPayload
IndexSetID string
Raw []byte
SHA256 string
}
CanonicalLocalIdentityFile is an exact, single-open canonical identity artifact. Raw includes the required final LF and SHA256 covers all Raw bytes.
func ReadCanonicalLocalIdentityFile ¶
func ReadCanonicalLocalIdentityFile(path string, maxBytes int64, expectedIndexSetID string) (CanonicalLocalIdentityFile, error)
ReadCanonicalLocalIdentityFile performs the frozen canonical identity check and returns the exact same bytes that were parsed and hashed.
type CoverageSummary ¶
type CoverageSummary struct {
Entries int
CompleteEntries int
ConfirmedEntries int
InferredEntries int
GapCount int
}
CoverageSummary contains non-literal counts derived from a verified manifest. It deliberately omits coverage scopes and gaps, which may contain object-key material that does not belong in a transport-safe query receipt.
type DeclaredSnapshotCounts ¶
type DeclaredSnapshotCounts struct {
Rows int
ActiveRows int
Tombstones int
DistinctETags int
Segments int
}
DeclaredSnapshotCounts are manifest-declared bounds. They are not observed query scan counts.
type HubConditionalCreatePublisher ¶
type HubConditionalCreatePublisher interface {
HubExactObjectReader
CreateExact(
ctx context.Context,
key string,
body io.Reader,
sizeBytes int64,
) (created bool, err error)
}
HubConditionalCreatePublisher exposes only exact reads and indivisible conditional creates. Created=false with a nil error means an existing object won the create; the library then exact-reads and verifies it. Created=true is a definitive durable create even if err also reports a post-commit failure; implementations must not return it before fully storing the supplied body. Implementations must never emulate this operation with check-then-create.
type HubExactObjectReader ¶
type HubExactObjectReader interface {
OpenExact(ctx context.Context, key string) (body io.ReadCloser, sizeBytes int64, err error)
}
HubExactObjectReader is the entire authority surface exposed to acquisition. Implementations open only the exact key supplied by the library. Listing, latest selection, write, and delete are deliberately absent.
type IdentityStatus ¶
type IdentityStatus string
IdentityStatus classifies whether canonical identity is trusted during aggregate discovery. Untrusted entries are report-only and are never opened.
const ( IdentityStatusOK IdentityStatus = "ok" IdentityStatusMissing IdentityStatus = "missing" IdentityStatusInvalid IdentityStatus = "invalid" IdentityStatusMismatch IdentityStatus = "mismatch" )
type ListedIndex ¶
type ListedIndex struct {
Meta Meta
IdentityStatus IdentityStatus
IdentityDiagnostic string
}
ListedIndex is one discovered local index for ListIndexReaders.
func ListIndexReaders ¶
func ListIndexReaders(ctx context.Context, opts ResolveOptions) ([]ListedIndex, error)
ListIndexReaders enumerates local indexes under the configured roots. SQLite entries require index.db; durable entries require a validated latest pointer.
type LocalIdentityFile ¶
type LocalIdentityFile struct {
// Raw is the trimmed file content used for presentation hashing.
Raw []byte
// Payload is the parsed identity document.
Payload indexstore.IndexSetIdentityPayload
// IndexSetID is the recomputed full idx_<64hex> when ComputeIndexSetID succeeds.
IndexSetID string
}
LocalIdentityFile is identity.json loaded with bounded single-open semantics.
func ReadLocalIdentityFile ¶
func ReadLocalIdentityFile(path string, maxBytes int64) (LocalIdentityFile, error)
ReadLocalIdentityFile reads and parses identity.json with the same bounded single-open posture as durable marker discovery. Prefer this over unbounded os.ReadFile + ad-hoc ComputeIndexSetID assembly at call sites.
type Meta ¶
type Meta struct {
Format Format
IndexSetID string
BaseURI string
Provider string
// IdentityDir is the indexes/idx_* directory when known.
IdentityDir string
// SourcePath is the primary artifact path (index.db or latest.json).
SourcePath string
// RunID is the durable snapshot run id when Format is durable-v2.
RunID string
}
Meta describes the resolved index identity.
type Reader ¶
type Reader interface {
Meta() Meta
// SQLiteDB returns the query-only authority-held connection for sqlite-v1;
// durable-v2 readers return nil. It remains valid until Close.
SQLiteDB() *sql.DB
// WalkObjects streams matching object rows in rel_key order without
// accumulating them. On durable-v2, each segment digest is verified before
// that segment's rows are visited. A later-segment failure aborts with
// error after any already-visited rows (callers may have emitted a prefix).
WalkObjects(ctx context.Context, params indexstore.QueryParams, visit VisitObject) (indexstore.QueryStats, error)
// QueryObjects is a convenience collector over WalkObjects. Prefer WalkObjects
// for large durable snapshots — this materialises the full match set.
QueryObjects(ctx context.Context, params indexstore.QueryParams) ([]indexstore.QueryResult, indexstore.QueryStats, error)
// QueryObjectCount counts matches without requiring full materialisation
// for plain (non-canonical) queries on durable; SQLite uses COUNT when possible.
QueryObjectCount(ctx context.Context, params indexstore.QueryParams) (int64, error)
// QueryCanonicalObjects applies the same filters as WalkObjects, then
// groups by ETag. This path is intentionally non-constant-memory: it
// materialises the filtered row set before grouping. Envelope is
// O(matched rows) with selection/output bounded by O(distinct non-empty
// ETags) plus alternates storage for non-canonical group members.
QueryCanonicalObjects(ctx context.Context, params indexstore.QueryParams) ([]indexstore.CanonicalOutputRecord, indexstore.CanonicalQueryStats, error)
// ResolveSinceRunFilter validates a --since-run boundary for this index.
// Durable-v2 requires an exact pinned current run and digest-verified
// continuous ancestry through the requested baseline.
ResolveSinceRunFilter(ctx context.Context, runID string) (*indexstore.SinceRunFilter, error)
Close() error
}
Reader is the narrow format-aware index read surface used by index query (and later stats/doctor/list consumers of the same seam).
func OpenAcquiredBundle ¶
func OpenAcquiredBundle(opts AcquiredOpenOptions) (Reader, error)
OpenAcquiredBundle validates acquired.json first, revalidates every bound artifact beneath the no-symlink root, and returns the same durable reader used by pinned local queries.
func ResolveIndexReader ¶
func ResolveIndexReader(ctx context.Context, opts ResolveOptions, target ResolveTarget) (Reader, error)
ResolveIndexReader opens a format-aware reader for the target.
Dispatch is marker-authoritative:
- durable latest+complete+manifest trust chain → durable-v2 (preferred when both formats exist for the same set; a set-root index.db beside a verified durable latest may be a stale artifact from an earlier run)
- else index.db present → sqlite-v1
- absent/unknown/malformed markers → reject (no layout guessing)
When target.RunID is set, dispatch is pin-mode: durable-v2 only, via the run complete marker. latest.json is never consulted (receipt-pinned snapshot).
type ResolveOptions ¶
type ResolveOptions struct {
// IndexesRoot is the indexes/ directory (contains idx_* identity dirs).
IndexesRoot string
// SegmentCacheRoot is the cache/segments/ directory (contains full index_set_id dirs).
SegmentCacheRoot string
// Authority optionally supplies caller-held whole-set authority for a
// single-set resolution. It remains caller-owned.
Authority *indexcoord.Lease
// MaxMarkerBytes bounds latest/complete JSON reads (default: 1 MiB).
MaxMarkerBytes int64
// MaxManifestBytes bounds manifest JSON reads (default: 64 MiB).
MaxManifestBytes int64
}
ResolveOptions configures local index discovery roots.
type ResolveTarget ¶
type ResolveTarget struct {
// BaseURI selects by identity/base_uri when IndexSetID is empty.
BaseURI string
// IndexSetID is a full idx_<64hex> or a unique hex prefix / dir name.
IndexSetID string
// RunID, when set, pins a durable-v2 snapshot by complete marker and never
// consults latest.json. Requires IndexSetID. SQLite cannot satisfy a pin.
RunID string
}
ResolveTarget selects which index to open.
type SQLiteIdentityPublicationGuard ¶
type SQLiteIdentityPublicationGuard struct {
// contains filtered or unexported fields
}
SQLiteIdentityPublicationGuard retains the proof used to decide whether canonical identity.json may be published without adopting an unvalidated index.db. Existing databases stay bound by a no-follow handle; an absent database must remain absent at the publication boundary.
func OpenSQLiteIdentityPublicationGuard ¶
func OpenSQLiteIdentityPublicationGuard(ctx context.Context, opts SQLiteWriteTargetOptions) (*SQLiteIdentityPublicationGuard, error)
OpenSQLiteIdentityPublicationGuard validates the canonical SQLite sibling and retains that proof until PublishIdentity or Close. It does not create an absent database or publish metadata.
func (*SQLiteIdentityPublicationGuard) Check ¶
func (g *SQLiteIdentityPublicationGuard) Check() error
Check revalidates the retained database/absence proof and caller authority.
func (*SQLiteIdentityPublicationGuard) Close ¶
func (g *SQLiteIdentityPublicationGuard) Close() error
Close releases the retained proof. The caller-owned authority is unchanged.
func (*SQLiteIdentityPublicationGuard) PublishIdentity ¶
func (g *SQLiteIdentityPublicationGuard) PublishIdentity(identity *indexstore.IndexSetIdentityResult) error
PublishIdentity durably replaces canonical identity.json through the bound directory without following an existing marker symlink.
func (*SQLiteIdentityPublicationGuard) PublishManifest ¶
func (g *SQLiteIdentityPublicationGuard) PublishManifest(doc *manifest.IndexManifest) error
PublishManifest durably replaces the informational canonical manifest under the same retained proof and whole-set authority as identity publication.
type SQLiteSnapshot ¶
type SQLiteSnapshot struct {
// contains filtered or unexported fields
}
SQLiteSnapshot holds a sidecar-free immutable database and, for canonical indexes, the same stable whole-set authority used by writers and GC.
func OpenSQLiteSnapshot ¶
func OpenSQLiteSnapshot(ctx context.Context, opts SQLiteSnapshotOptions) (*SQLiteSnapshot, error)
OpenSQLiteSnapshot opens a current-schema, non-mutating SQLite snapshot.
func (*SQLiteSnapshot) Check ¶
func (s *SQLiteSnapshot) Check() error
Check revalidates authority and rejects transaction sidecars.
func (*SQLiteSnapshot) Close ¶
func (s *SQLiteSnapshot) Close() error
Close closes the connection, performs post-read checks, and releases only authority acquired by OpenSQLiteSnapshot itself.
func (*SQLiteSnapshot) DB ¶
func (s *SQLiteSnapshot) DB() *sql.DB
DB returns the query-only connection owned by the snapshot.
type SQLiteSnapshotOptions ¶
type SQLiteSnapshotOptions struct {
Path string
SegmentSetRoot string
IndexSetID string
Authority *indexcoord.Lease
}
SQLiteSnapshotOptions identifies a strict immutable SQLite read. Canonical reads provide SegmentSetRoot and IndexSetID so stable whole-set authority is held for the snapshot lifetime. Omitting both is reserved for caller-owned, externally quiesced databases.
type SQLiteVerificationTarget ¶
type SQLiteVerificationTarget struct {
// contains filtered or unexported fields
}
SQLiteVerificationTarget owns the run-scoped SQLite parity-verification database of a dual-format build. The projection carries no canonical trust and is never a reader-selectable consumer artifact; this type guarantees that the projection is created exclusively on a fresh owner-only path under the bound segment-set root (prefix possession is not authority), that the SQLite connection is bound to the exclusively created file through the attested-VFS open, and that every authority-bearing directory component (segment-set root, verification intermediate, attempt directory) plus the exact database binding is re-attested at every mutation boundary and through close — so a substituted parent namespace refuses instead of blessing a projection through a foreign tree, even when the final pathname still names the originally created inode.
func OpenSQLiteVerificationTarget ¶
func OpenSQLiteVerificationTarget(ctx context.Context, opts SQLiteVerificationTargetOptions) (*SQLiteVerificationTarget, error)
OpenSQLiteVerificationTarget exclusively creates the attempt directory and database file for one verification projection, then opens the SQLite connection bound to the created file with Check as the before-mutation attestation. Every intermediate is validated no-follow and retained, and every child (verification intermediate, attempt directory, database file) is created relative to its already-bound parent handle — never by rewalking the pathname — with the named namespace re-attested before and after each creation. A symlinked or non-directory segment-set root, `verification` intermediate, or database name refuses before any SQLite mutation, as does a pre-existing attempt directory or database file; a parent substituted mid-creation refuses without touching the substituted tree.
func (*SQLiteVerificationTarget) AttemptName ¶
func (t *SQLiteVerificationTarget) AttemptName() string
AttemptName returns the per-run attempt identifier for this projection.
func (*SQLiteVerificationTarget) Check ¶
func (t *SQLiteVerificationTarget) Check() error
Check revalidates caller authority, every retained authority-bearing directory component, and that the verification pathname still names the exclusively created database file. A rename, symlink/replacement, or hardlink alias through a foreign parent refuses even when the final inode is unchanged.
func (*SQLiteVerificationTarget) Close ¶
func (t *SQLiteVerificationTarget) Close() error
Close closes the verification connection after re-attesting the retained parent namespace and database binding, and verifies live SQLite transaction sidecars are gone on a clean close. A failed Close means the projection is not bindable evidence: callers must not emit a successful dual-format terminal result. Close never deletes projection files.
func (*SQLiteVerificationTarget) DB ¶
func (t *SQLiteVerificationTarget) DB() *sql.DB
DB returns the bound mutable verification connection.
func (*SQLiteVerificationTarget) Locator ¶
func (t *SQLiteVerificationTarget) Locator() string
Locator returns the stable set-relative locator of the projection database (never a host-absolute path).
func (*SQLiteVerificationTarget) Path ¶
func (t *SQLiteVerificationTarget) Path() string
Path returns the created verification database pathname.
type SQLiteVerificationTargetOptions ¶
type SQLiteVerificationTargetOptions struct {
SegmentSetRoot string
IndexSetID string
Authority *indexcoord.Lease
// AttemptName is the per-run attempt directory name (for example
// run_<nano>). Each attempt must be new: a pre-existing attempt directory
// is refused, never adopted.
AttemptName string
}
SQLiteVerificationTargetOptions identifies one run-scoped parity-verification projection attempt under the authority-bound segment-set root.
type SQLiteWriteTarget ¶
type SQLiteWriteTarget struct {
// contains filtered or unexported fields
}
SQLiteWriteTarget owns a mutable connection opened through the canonical index.db pathname while retaining a no-follow handle to the exact file that passed identity validation. Keeping SQLite on the canonical pathname gives every writer one lock/WAL namespace; the retained handle detects pathname substitution before mutation and across the target lifetime. The caller-held authority remains caller-owned.
func OpenSQLiteWriteTarget ¶
func OpenSQLiteWriteTarget(ctx context.Context, opts SQLiteWriteTargetOptions) (*SQLiteWriteTarget, error)
OpenSQLiteWriteTarget validates an existing canonical database or atomically reserves an absent target, binds that exact file, and opens the bound file for mutation. Callers must use DB rather than reopening Options.Path themselves.
func (*SQLiteWriteTarget) Check ¶
func (t *SQLiteWriteTarget) Check() error
Check revalidates the caller's authority and confirms that the retained no-follow binding and canonical pathname still name the selected file.
func (*SQLiteWriteTarget) Close ¶
func (t *SQLiteWriteTarget) Close() error
Close closes the mutable connection and verifies that live SQLite transaction sidecars (WAL/SHM/journal) were checkpointed away. It never deletes transaction or quarantine files. Exact-epoch cleanup may leave discoverable quarantine residue after truncating the reserved inode; when live sidecars are clean that residue is recorded via QuarantineResidue and inventory without failing Close. Unrecovered quarantine residue blocks later canonical readers and mutable writers until a receipt-backed recovery transaction removes exact-bound captures. Whole-set authority alone never authorizes prefix-wide quarantine deletion. Live-sidecar checks run only when db close, authority, and main-file binding all succeed; failures skip those checks and never delete residue.
func (*SQLiteWriteTarget) DB ¶
func (t *SQLiteWriteTarget) DB() *sql.DB
DB returns the bound mutable connection owned by the target.
func (*SQLiteWriteTarget) PublishIdentity ¶
func (t *SQLiteWriteTarget) PublishIdentity(identity *indexstore.IndexSetIdentityResult) error
PublishIdentity publishes canonical identity metadata through the same retained database binding and authority that own this mutable connection.
func (*SQLiteWriteTarget) PublishManifest ¶
func (t *SQLiteWriteTarget) PublishManifest(doc *manifest.IndexManifest) error
PublishManifest publishes canonical manifest metadata without following an existing destination symlink.
func (*SQLiteWriteTarget) QuarantineResidue ¶
func (t *SQLiteWriteTarget) QuarantineResidue() []string
QuarantineResidue returns discoverable quarantine-prefix names observed at the last live-clean Close, without implying any entry was deleted.
type SQLiteWriteTargetOptions ¶
type SQLiteWriteTargetOptions struct {
Path string
IdentityPath string
SegmentSetRoot string
IndexSetID string
Authority *indexcoord.Lease
MaxMarkerBytes int64
}
SQLiteWriteTargetOptions identifies a canonical SQLite target before a writer creates a marker, opens the database, or performs migration.
type SnapshotSourceKind ¶
type SnapshotSourceKind string
SnapshotSourceKind identifies the authority shape behind verified snapshot metadata. Acquired hub bundles join this closed set in a later slice.
type VerifiedAcquiredBundleReport ¶
type VerifiedAcquiredBundleReport struct {
MarkerType string
MarkerSchema string
HubMarkerSchemaVersion string
ManifestCreatedAt time.Time
IdentityPayload indexstore.IndexSetIdentityPayload
ManifestRaw []byte
}
VerifiedAcquiredBundleReport carries acquired-marker presentation facts from a verified open. Value-only: diagnostics may project it without re-reading bundle files outside the bound root. Reference fields hold fresh copies per call, so projecting them can never mutate reader state.
type VerifiedAcquiredBundleReporter ¶
type VerifiedAcquiredBundleReporter interface {
VerifiedAcquiredBundleReport() (VerifiedAcquiredBundleReport, error)
}
VerifiedAcquiredBundleReporter is the narrow optional capability implemented by readers opened from a verified acquired bundle.
type VerifiedSnapshotMetadata ¶
type VerifiedSnapshotMetadata struct {
SourceKind SnapshotSourceKind
IndexSetID string
RunID string
RunStart BridgeRunStart
SnapshotTime BridgeSnapshotTime
RunStartedAt time.Time
SnapshotCompletedAt time.Time
SnapshotCompletionSemantics string
HubCommittedAt time.Time
HubCompleteSHA256 string
SourceIdentitySHA256 string
SourceIdentitySchema string
SourceIdentityProfile string
ManifestSHA256 string
CoverageSHA256 string
Coverage CoverageSummary
Declared DeclaredSnapshotCounts
}
VerifiedSnapshotMetadata is immutable, receipt-safe metadata copied from the already-open verified snapshot. No path, base URI, provider coordinate, credential handle, or coverage literal is exposed.
type VerifiedSnapshotMetadataReader ¶
type VerifiedSnapshotMetadataReader interface {
VerifiedSnapshotMetadata() (VerifiedSnapshotMetadata, error)
}
VerifiedSnapshotMetadataReader is the narrow optional capability implemented by readers that can provide receipt-safe facts from their verified open. Keeping it separate avoids widening Reader for substrates and downstream implementations that do not support receipt authority.
type VisitObject ¶
type VisitObject func(result indexstore.QueryResult) error
VisitObject is invoked for each matching row in rel_key order. Returning a non-nil error stops the walk and is returned to the caller.
Source Files
¶
- acquired.go
- acquired_publish_linux.go
- canonical_metadata.go
- canonical_metadata_unix.go
- doc.go
- durable.go
- legacy_bridge.go
- legacy_bridge_identity.go
- legacy_bridge_publish.go
- reader.go
- resolve.go
- sqlite.go
- sqlite_snapshot.go
- sqlite_verification_target.go
- sqlite_write_binding_unix.go
- sqlite_write_target.go
- verification_namespace_unix.go