indexreader

package
v0.5.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Nov 11, 2026 License: Apache-2.0 Imports: 25 Imported by: 0

Documentation

Overview

Package indexreader provides a format-aware local index read seam.

It dispatches on authoritative markers (sqlite-v1 | durable-v2) and exposes a narrow reader used by index query (and, later, stats/doctor/list). Durable reads stream verified segment rows; they do not hydrate into ephemeral SQLite.

This package is Experimental. The durable-v2 path is an internal-render surface, not a publication or de-identification path.

Index

Constants

View Source
const (
	AcquiredBundleType     = "gonimbus.index.acquired_bundle.v1"
	AcquiredBundleSchema   = "gonimbus/v1.0.0/index-acquired-bundle.v1"
	AcquiredBundleTypeV2   = "gonimbus.index.acquired_bundle.v2"
	AcquiredBundleSchemaV2 = "gonimbus/v1.0.0/index-acquired-bundle.v2"
	HubMarkerSchemaV2      = "gonimbus.index.hub_marker.v2"
)
View Source
const (
	HubMarkerSchemaV1 = "gonimbus.index.hub_marker.v1"
	HubMarkerSchemaV3 = "gonimbus.index.hub_marker.v3"

	BridgeDispositionCreated          = "created"
	BridgeDispositionAlreadyIdentical = "already_identical"

	BridgeRunStartLegacyAsserted  = "legacy_asserted"
	BridgeRunStartLocallyObserved = "locally_observed"

	BridgeSnapshotTimeExactCommit       = "exact_commit"
	BridgeSnapshotTimeLegacyUnavailable = "legacy_unavailable"

	BridgeConversionType = "gonimbus.index.custody_bridge_conversion.v1"
)
View Source
const (
	BridgeErrorInvalidRequest    = "bridge_invalid_request"
	BridgeErrorSourceRead        = "bridge_source_read_failed"
	BridgeErrorLegacyMarker      = "bridge_legacy_marker_invalid"
	BridgeErrorIdentityInvalid   = "bridge_identity_invalid"
	BridgeErrorEvidenceInvalid   = "bridge_evidence_invalid"
	BridgeErrorManifestInvalid   = "bridge_manifest_invalid"
	BridgeErrorSegmentInvalid    = "bridge_segment_invalid"
	BridgeErrorResourceLimit     = "bridge_resource_limit"
	BridgeErrorWorkspace         = "bridge_workspace_failed"
	BridgeErrorTargetCreate      = "bridge_target_create_failed"
	BridgeErrorTargetRead        = "bridge_target_read_failed"
	BridgeErrorTargetConflict    = "bridge_target_conflict"
	BridgeErrorInternalInvariant = "bridge_internal_invariant"
)
View Source
const (
	BridgeIdentitySchema  = "gonimbus.index_set_identity.canonical-json-lf.v1"
	BridgeIdentityProfile = "default"
)
View Source
const (
	SnapshotSourceLocalPublished SnapshotSourceKind = "local_published"
	SnapshotSourceAcquiredHub    SnapshotSourceKind = "acquired_hub"

	// SourceIdentitySchemaV1 identifies the existing public schema for the
	// canonical IndexSetIdentityPayload.
	SourceIdentitySchemaV1 = "gonimbus/v1.0.0/index-hub-identity"
	// SourceIdentityProfileV1 freezes the artifact encoding: the exact
	// ComputeIndexSetID canonical JSON payload followed by one LF.
	SourceIdentityProfileV1 = "gonimbus.index_set_identity.canonical-json-lf.v1"
)

Variables

View Source
var (

	// ErrHubExactRead deliberately omits provider error text. A provider may put
	// account coordinates, request IDs, or credential-adjacent details in errors.
	ErrHubExactRead = errors.New("hub exact-object read failed")
	// ErrAcquiredBundleConflict means the final destination already names a
	// different or unverifiable acquisition. It is never overlaid or repaired.
	ErrAcquiredBundleConflict = errors.New("acquired bundle destination conflict")
	// ErrNotAcquiredBundle is the stable refusal for hydrate directories,
	// canonical index directories, and other unmarked paths.
	ErrNotAcquiredBundle = errors.New("not a final acquired bundle")
)
View Source
var ErrCanonicalSQLiteAdoption = errors.New("refusing to adopt untrusted existing canonical SQLite database")

ErrCanonicalSQLiteAdoption reports that a writer found an existing canonical database whose trusted identity marker cannot authorize reuse.

View Source
var ErrDurableSinceRunUnsupported = fmt.Errorf("--since-run on durable-v2 requires exact pinned current and baseline runs")

ErrDurableSinceRunUnsupported is returned when --since-run is requested against an unpinned durable-v2 reader.

View Source
var ErrSQLiteIdentityScope = errors.New("SQLite snapshot identity/scope mismatch")

ErrSQLiteIdentityScope reports that an authority-held database does not contain exactly the single index set authorized by the caller.

View Source
var ErrVerificationProjectionTarget = errors.New("refusing unsafe verification projection target")

ErrVerificationProjectionTarget reports that a run-scoped verification projection path could not be created or retained safely under the authority-bound segment-set root.

View Source
var ErrVerifiedSnapshotMetadataUnavailable = errors.New("verified snapshot metadata is unavailable")

ErrVerifiedSnapshotMetadataUnavailable is returned when a reader substrate cannot provide the verified durable facts required by receipt-jsonl-v1.

Functions

func IsBridgeError

func IsBridgeError(err error, code string) bool

IsBridgeError reports whether err carries the given closed bridge code.

func ReadBoundedFile

func ReadBoundedFile(path string, maxBytes int64) ([]byte, error)

ReadBoundedFile reads a local file with a single open and LimitReader(max+1). Oversized files fail closed. Default max is 1 MiB when maxBytes <= 0.

func ValidateSQLiteWriteTarget

func ValidateSQLiteWriteTarget(ctx context.Context, opts SQLiteWriteTargetOptions) error

ValidateSQLiteWriteTarget is the non-mutating companion used by workflows such as durable-only publication that write canonical identity metadata but do not open or create index.db. An absent database remains absent.

Types

type AcquireBundleOptions

type AcquireBundleOptions struct {
	IndexSetID        string
	RunID             string
	ProofThroughRunID string
	Destination       string
	Limits            AcquiredBundleLimits
	// Warning receives post-commit durability/cleanup warnings. A successful
	// no-replace rename remains authoritative and is never reported as failure.
	Warning func(message string)
}

AcquireBundleOptions identifies one immutable acquisition. Destination is the final bundle directory. ProofThroughRunID, when set, acquires and verifies the exact continuous ancestry from RunID through that run without ancestor rows.

type AcquiredArtifact

type AcquiredArtifact struct {
	Path      string `json:"path"`
	Role      string `json:"role"`
	SizeBytes int64  `json:"size_bytes"`
	SHA256    string `json:"sha256"`
}

AcquiredArtifact binds one bundle-internal relative path.

type AcquiredBundleLimits

type AcquiredBundleLimits struct {
	MaxMarkerBytes    int64
	MaxManifestBytes  int64
	MaxIdentityBytes  int64
	MaxSegmentBytes   int64
	MaxSegments       int
	MaxLineageNodes   int
	MaxAggregateBytes int64
	MaxMetadataBytes  int64
}

AcquiredBundleLimits bounds every remotely supplied allocation/read.

type AcquiredBundleMarker

type AcquiredBundleMarker struct {
	Type                        string                `json:"type"`
	Schema                      string                `json:"schema"`
	IndexSetID                  string                `json:"index_set_id"`
	RunID                       string                `json:"run_id"`
	ProofThroughRunID           string                `json:"proof_through_run_id,omitempty"`
	SourceIdentitySHA256        string                `json:"source_identity_sha256"`
	SourceIdentitySchema        string                `json:"source_identity_schema"`
	SourceIdentityProfile       string                `json:"source_identity_profile"`
	HubMarkerSchemaVersion      string                `json:"hub_marker_schema_version,omitempty"`
	RunStart                    *BridgeRunStart       `json:"run_start,omitempty"`
	SnapshotTime                *BridgeSnapshotTime   `json:"snapshot_time,omitempty"`
	ConversionIdentitySHA256    string                `json:"conversion_identity_sha256,omitempty"`
	SnapshotCompletedAt         string                `json:"snapshot_completed_at,omitempty"`
	SnapshotCompletionSemantics string                `json:"snapshot_completion_semantics,omitempty"`
	HubCommittedAt              string                `json:"hub_committed_at"`
	HubCompleteSHA256           string                `json:"hub_complete_sha256"`
	ManifestSHA256              string                `json:"manifest_sha256"`
	AcquiredAt                  string                `json:"acquired_at"`
	Lineage                     []AcquiredLineageNode `json:"lineage"`
	Artifacts                   []AcquiredArtifact    `json:"artifacts"`
}

AcquiredBundleMarker is the final acquisition receipt. It intentionally contains no source coordinates, provider configuration, or credential handle.

func AcquireBundle

AcquireBundle downloads and verifies exactly one durable hub run and optional proof-through ancestry, then publishes acquired.json last via atomic no-replace directory rename.

type AcquiredLineageNode

type AcquiredLineageNode struct {
	IndexSetID               string `json:"index_set_id"`
	RunID                    string `json:"run_id"`
	MarkerSchemaVersion      string `json:"marker_schema_version,omitempty"`
	HubCompleteSHA256        string `json:"hub_complete_sha256"`
	ManifestSHA256           string `json:"manifest_sha256"`
	ConversionIdentitySHA256 string `json:"conversion_identity_sha256,omitempty"`
}

AcquiredLineageNode binds the hub and manifest bytes for one verified node.

type AcquiredOpenOptions

type AcquiredOpenOptions struct {
	Directory string
	Limits    AcquiredBundleLimits
}

AcquiredOpenOptions selects a final acquired bundle.

type BridgeError

type BridgeError struct {
	Code string
}

BridgeError is a closed, coordinate-free library failure.

func (*BridgeError) Error

func (e *BridgeError) Error() string

type BridgeLimits

type BridgeLimits struct {
	MaxMarkerBytes     int64
	MaxManifestBytes   int64
	MaxIdentityBytes   int64
	MaxEvidenceBytes   int64
	MaxSegmentBytes    int64
	MaxSegments        int
	MaxAggregateBytes  int64
	MaxConversionBytes int64
}

BridgeLimits supplies caller ceilings for untrusted input and aggregate verified content. Positive values can tighten but never loosen the frozen protocol maxima.

type BridgeOptions

type BridgeOptions struct {
	IndexSetID     string
	RunID          string
	Workspace      string
	Limits         BridgeLimits
	ExportedBy     string
	HubCommitClock func() time.Time
}

BridgeOptions identifies one exact legacy durable run. Workspace is an optional parent for the private verification spool. HubCommitClock is injectable for deterministic commit-boundary tests.

type BridgeResult

type BridgeResult struct {
	IndexSetID                string
	RunID                     string
	LegacyMarkerSHA256        string
	IdentitySHA256            string
	IdentitySchema            string
	IdentityProfile           string
	ManifestSHA256            string
	DeclaredRows              int
	DeclaredSegments          int
	SegmentsVerified          int
	BytesRead                 int64
	BytesConditionallyCreated int64
	RunStart                  BridgeRunStart
	SnapshotTime              BridgeSnapshotTime
	ConversionIdentitySHA256  string
	HubCommittedAt            string
	CompleteSHA256            string
	ExportedBy                string
	Disposition               string
}

func BridgeLegacyDurableRun

func BridgeLegacyDurableRun(
	ctx context.Context,
	source HubExactObjectReader,
	target HubConditionalCreatePublisher,
	identityAuthority CanonicalIdentityAuthority,
	snapshotCompletionEvidence []byte,
	opts BridgeOptions,
) (BridgeResult, error)

BridgeLegacyDurableRun verifies and republishes one exact legacy durable run. It cannot list, select latest, overwrite, delete, or construct live-source providers because none of those capabilities are present in its interfaces.

type BridgeRunStart

type BridgeRunStart struct {
	Basis     string `json:"basis"`
	StartedAt string `json:"started_at"`
}

type BridgeSnapshotTime

type BridgeSnapshotTime struct {
	Basis          string `json:"basis"`
	CompletedAt    string `json:"completed_at,omitempty"`
	EvidenceType   string `json:"evidence_type,omitempty"`
	EvidenceSHA256 string `json:"evidence_sha256,omitempty"`
}

type CanonicalIdentityAuthority

type CanonicalIdentityAuthority struct {
	CanonicalJSONLF []byte
	DeclarationJSON []byte
}

CanonicalIdentityAuthority supplies exactly one identity authority. The canonical form is the exact payload JSON plus one LF. A declaration is the closed typed reconstruction input; it is never itself published.

type CanonicalLocalIdentityFile

type CanonicalLocalIdentityFile struct {
	Payload    indexstore.IndexSetIdentityPayload
	IndexSetID string
	Raw        []byte
	SHA256     string
}

CanonicalLocalIdentityFile is an exact, single-open canonical identity artifact. Raw includes the required final LF and SHA256 covers all Raw bytes.

func ReadCanonicalLocalIdentityFile

func ReadCanonicalLocalIdentityFile(path string, maxBytes int64, expectedIndexSetID string) (CanonicalLocalIdentityFile, error)

ReadCanonicalLocalIdentityFile performs the frozen canonical identity check and returns the exact same bytes that were parsed and hashed.

type CoverageSummary

type CoverageSummary struct {
	Entries          int
	CompleteEntries  int
	ConfirmedEntries int
	InferredEntries  int
	GapCount         int
}

CoverageSummary contains non-literal counts derived from a verified manifest. It deliberately omits coverage scopes and gaps, which may contain object-key material that does not belong in a transport-safe query receipt.

type DeclaredSnapshotCounts

type DeclaredSnapshotCounts struct {
	Rows          int
	ActiveRows    int
	Tombstones    int
	DistinctETags int
	Segments      int
}

DeclaredSnapshotCounts are manifest-declared bounds. They are not observed query scan counts.

type Format

type Format string

Format identifies the on-disk index substrate.

const (
	// FormatSQLiteV1 is the legacy SQLite local index (index.db).
	FormatSQLiteV1 Format = "sqlite-v1"
	// FormatDurableV2 is the segment-backed durable snapshot format.
	FormatDurableV2 Format = "durable-v2"
)

type HubConditionalCreatePublisher

type HubConditionalCreatePublisher interface {
	HubExactObjectReader
	CreateExact(
		ctx context.Context,
		key string,
		body io.Reader,
		sizeBytes int64,
	) (created bool, err error)
}

HubConditionalCreatePublisher exposes only exact reads and indivisible conditional creates. Created=false with a nil error means an existing object won the create; the library then exact-reads and verifies it. Created=true is a definitive durable create even if err also reports a post-commit failure; implementations must not return it before fully storing the supplied body. Implementations must never emulate this operation with check-then-create.

type HubExactObjectReader

type HubExactObjectReader interface {
	OpenExact(ctx context.Context, key string) (body io.ReadCloser, sizeBytes int64, err error)
}

HubExactObjectReader is the entire authority surface exposed to acquisition. Implementations open only the exact key supplied by the library. Listing, latest selection, write, and delete are deliberately absent.

type IdentityStatus

type IdentityStatus string

IdentityStatus classifies whether canonical identity is trusted during aggregate discovery. Untrusted entries are report-only and are never opened.

const (
	IdentityStatusOK       IdentityStatus = "ok"
	IdentityStatusMissing  IdentityStatus = "missing"
	IdentityStatusInvalid  IdentityStatus = "invalid"
	IdentityStatusMismatch IdentityStatus = "mismatch"
)

type ListedIndex

type ListedIndex struct {
	Meta               Meta
	IdentityStatus     IdentityStatus
	IdentityDiagnostic string
}

ListedIndex is one discovered local index for ListIndexReaders.

func ListIndexReaders

func ListIndexReaders(ctx context.Context, opts ResolveOptions) ([]ListedIndex, error)

ListIndexReaders enumerates local indexes under the configured roots. SQLite entries require index.db; durable entries require a validated latest pointer.

type LocalIdentityFile

type LocalIdentityFile struct {
	// Raw is the trimmed file content used for presentation hashing.
	Raw []byte
	// Payload is the parsed identity document.
	Payload indexstore.IndexSetIdentityPayload
	// IndexSetID is the recomputed full idx_<64hex> when ComputeIndexSetID succeeds.
	IndexSetID string
}

LocalIdentityFile is identity.json loaded with bounded single-open semantics.

func ReadLocalIdentityFile

func ReadLocalIdentityFile(path string, maxBytes int64) (LocalIdentityFile, error)

ReadLocalIdentityFile reads and parses identity.json with the same bounded single-open posture as durable marker discovery. Prefer this over unbounded os.ReadFile + ad-hoc ComputeIndexSetID assembly at call sites.

type Meta

type Meta struct {
	Format     Format
	IndexSetID string
	BaseURI    string
	Provider   string
	// IdentityDir is the indexes/idx_* directory when known.
	IdentityDir string
	// SourcePath is the primary artifact path (index.db or latest.json).
	SourcePath string
	// RunID is the durable snapshot run id when Format is durable-v2.
	RunID string
}

Meta describes the resolved index identity.

type Reader

type Reader interface {
	Meta() Meta
	// SQLiteDB returns the query-only authority-held connection for sqlite-v1;
	// durable-v2 readers return nil. It remains valid until Close.
	SQLiteDB() *sql.DB
	// WalkObjects streams matching object rows in rel_key order without
	// accumulating them. On durable-v2, each segment digest is verified before
	// that segment's rows are visited. A later-segment failure aborts with
	// error after any already-visited rows (callers may have emitted a prefix).
	WalkObjects(ctx context.Context, params indexstore.QueryParams, visit VisitObject) (indexstore.QueryStats, error)
	// QueryObjects is a convenience collector over WalkObjects. Prefer WalkObjects
	// for large durable snapshots — this materialises the full match set.
	QueryObjects(ctx context.Context, params indexstore.QueryParams) ([]indexstore.QueryResult, indexstore.QueryStats, error)
	// QueryObjectCount counts matches without requiring full materialisation
	// for plain (non-canonical) queries on durable; SQLite uses COUNT when possible.
	QueryObjectCount(ctx context.Context, params indexstore.QueryParams) (int64, error)
	// QueryCanonicalObjects applies the same filters as WalkObjects, then
	// groups by ETag. This path is intentionally non-constant-memory: it
	// materialises the filtered row set before grouping. Envelope is
	// O(matched rows) with selection/output bounded by O(distinct non-empty
	// ETags) plus alternates storage for non-canonical group members.
	QueryCanonicalObjects(ctx context.Context, params indexstore.QueryParams) ([]indexstore.CanonicalOutputRecord, indexstore.CanonicalQueryStats, error)
	// ResolveSinceRunFilter validates a --since-run boundary for this index.
	// Durable-v2 requires an exact pinned current run and digest-verified
	// continuous ancestry through the requested baseline.
	ResolveSinceRunFilter(ctx context.Context, runID string) (*indexstore.SinceRunFilter, error)
	Close() error
}

Reader is the narrow format-aware index read surface used by index query (and later stats/doctor/list consumers of the same seam).

func OpenAcquiredBundle

func OpenAcquiredBundle(opts AcquiredOpenOptions) (Reader, error)

OpenAcquiredBundle validates acquired.json first, revalidates every bound artifact beneath the no-symlink root, and returns the same durable reader used by pinned local queries.

func ResolveIndexReader

func ResolveIndexReader(ctx context.Context, opts ResolveOptions, target ResolveTarget) (Reader, error)

ResolveIndexReader opens a format-aware reader for the target.

Dispatch is marker-authoritative:

  • durable latest+complete+manifest trust chain → durable-v2 (preferred when both formats exist for the same set; a set-root index.db beside a verified durable latest may be a stale artifact from an earlier run)
  • else index.db present → sqlite-v1
  • absent/unknown/malformed markers → reject (no layout guessing)

When target.RunID is set, dispatch is pin-mode: durable-v2 only, via the run complete marker. latest.json is never consulted (receipt-pinned snapshot).

type ResolveOptions

type ResolveOptions struct {
	// IndexesRoot is the indexes/ directory (contains idx_* identity dirs).
	IndexesRoot string
	// SegmentCacheRoot is the cache/segments/ directory (contains full index_set_id dirs).
	SegmentCacheRoot string
	// Authority optionally supplies caller-held whole-set authority for a
	// single-set resolution. It remains caller-owned.
	Authority *indexcoord.Lease
	// MaxMarkerBytes bounds latest/complete JSON reads (default: 1 MiB).
	MaxMarkerBytes int64
	// MaxManifestBytes bounds manifest JSON reads (default: 64 MiB).
	MaxManifestBytes int64
}

ResolveOptions configures local index discovery roots.

type ResolveTarget

type ResolveTarget struct {
	// BaseURI selects by identity/base_uri when IndexSetID is empty.
	BaseURI string
	// IndexSetID is a full idx_<64hex> or a unique hex prefix / dir name.
	IndexSetID string
	// RunID, when set, pins a durable-v2 snapshot by complete marker and never
	// consults latest.json. Requires IndexSetID. SQLite cannot satisfy a pin.
	RunID string
}

ResolveTarget selects which index to open.

type SQLiteIdentityPublicationGuard

type SQLiteIdentityPublicationGuard struct {
	// contains filtered or unexported fields
}

SQLiteIdentityPublicationGuard retains the proof used to decide whether canonical identity.json may be published without adopting an unvalidated index.db. Existing databases stay bound by a no-follow handle; an absent database must remain absent at the publication boundary.

func OpenSQLiteIdentityPublicationGuard

func OpenSQLiteIdentityPublicationGuard(ctx context.Context, opts SQLiteWriteTargetOptions) (*SQLiteIdentityPublicationGuard, error)

OpenSQLiteIdentityPublicationGuard validates the canonical SQLite sibling and retains that proof until PublishIdentity or Close. It does not create an absent database or publish metadata.

func (*SQLiteIdentityPublicationGuard) Check

Check revalidates the retained database/absence proof and caller authority.

func (*SQLiteIdentityPublicationGuard) Close

Close releases the retained proof. The caller-owned authority is unchanged.

func (*SQLiteIdentityPublicationGuard) PublishIdentity

PublishIdentity durably replaces canonical identity.json through the bound directory without following an existing marker symlink.

func (*SQLiteIdentityPublicationGuard) PublishManifest

PublishManifest durably replaces the informational canonical manifest under the same retained proof and whole-set authority as identity publication.

type SQLiteSnapshot

type SQLiteSnapshot struct {
	// contains filtered or unexported fields
}

SQLiteSnapshot holds a sidecar-free immutable database and, for canonical indexes, the same stable whole-set authority used by writers and GC.

func OpenSQLiteSnapshot

func OpenSQLiteSnapshot(ctx context.Context, opts SQLiteSnapshotOptions) (*SQLiteSnapshot, error)

OpenSQLiteSnapshot opens a current-schema, non-mutating SQLite snapshot.

func (*SQLiteSnapshot) Check

func (s *SQLiteSnapshot) Check() error

Check revalidates authority and rejects transaction sidecars.

func (*SQLiteSnapshot) Close

func (s *SQLiteSnapshot) Close() error

Close closes the connection, performs post-read checks, and releases only authority acquired by OpenSQLiteSnapshot itself.

func (*SQLiteSnapshot) DB

func (s *SQLiteSnapshot) DB() *sql.DB

DB returns the query-only connection owned by the snapshot.

type SQLiteSnapshotOptions

type SQLiteSnapshotOptions struct {
	Path           string
	SegmentSetRoot string
	IndexSetID     string
	Authority      *indexcoord.Lease
}

SQLiteSnapshotOptions identifies a strict immutable SQLite read. Canonical reads provide SegmentSetRoot and IndexSetID so stable whole-set authority is held for the snapshot lifetime. Omitting both is reserved for caller-owned, externally quiesced databases.

type SQLiteVerificationTarget

type SQLiteVerificationTarget struct {
	// contains filtered or unexported fields
}

SQLiteVerificationTarget owns the run-scoped SQLite parity-verification database of a dual-format build. The projection carries no canonical trust and is never a reader-selectable consumer artifact; this type guarantees that the projection is created exclusively on a fresh owner-only path under the bound segment-set root (prefix possession is not authority), that the SQLite connection is bound to the exclusively created file through the attested-VFS open, and that every authority-bearing directory component (segment-set root, verification intermediate, attempt directory) plus the exact database binding is re-attested at every mutation boundary and through close — so a substituted parent namespace refuses instead of blessing a projection through a foreign tree, even when the final pathname still names the originally created inode.

func OpenSQLiteVerificationTarget

func OpenSQLiteVerificationTarget(ctx context.Context, opts SQLiteVerificationTargetOptions) (*SQLiteVerificationTarget, error)

OpenSQLiteVerificationTarget exclusively creates the attempt directory and database file for one verification projection, then opens the SQLite connection bound to the created file with Check as the before-mutation attestation. Every intermediate is validated no-follow and retained, and every child (verification intermediate, attempt directory, database file) is created relative to its already-bound parent handle — never by rewalking the pathname — with the named namespace re-attested before and after each creation. A symlinked or non-directory segment-set root, `verification` intermediate, or database name refuses before any SQLite mutation, as does a pre-existing attempt directory or database file; a parent substituted mid-creation refuses without touching the substituted tree.

func (*SQLiteVerificationTarget) AttemptName

func (t *SQLiteVerificationTarget) AttemptName() string

AttemptName returns the per-run attempt identifier for this projection.

func (*SQLiteVerificationTarget) Check

func (t *SQLiteVerificationTarget) Check() error

Check revalidates caller authority, every retained authority-bearing directory component, and that the verification pathname still names the exclusively created database file. A rename, symlink/replacement, or hardlink alias through a foreign parent refuses even when the final inode is unchanged.

func (*SQLiteVerificationTarget) Close

func (t *SQLiteVerificationTarget) Close() error

Close closes the verification connection after re-attesting the retained parent namespace and database binding, and verifies live SQLite transaction sidecars are gone on a clean close. A failed Close means the projection is not bindable evidence: callers must not emit a successful dual-format terminal result. Close never deletes projection files.

func (*SQLiteVerificationTarget) DB

func (t *SQLiteVerificationTarget) DB() *sql.DB

DB returns the bound mutable verification connection.

func (*SQLiteVerificationTarget) Locator

func (t *SQLiteVerificationTarget) Locator() string

Locator returns the stable set-relative locator of the projection database (never a host-absolute path).

func (*SQLiteVerificationTarget) Path

func (t *SQLiteVerificationTarget) Path() string

Path returns the created verification database pathname.

type SQLiteVerificationTargetOptions

type SQLiteVerificationTargetOptions struct {
	SegmentSetRoot string
	IndexSetID     string
	Authority      *indexcoord.Lease
	// AttemptName is the per-run attempt directory name (for example
	// run_<nano>). Each attempt must be new: a pre-existing attempt directory
	// is refused, never adopted.
	AttemptName string
}

SQLiteVerificationTargetOptions identifies one run-scoped parity-verification projection attempt under the authority-bound segment-set root.

type SQLiteWriteTarget

type SQLiteWriteTarget struct {
	// contains filtered or unexported fields
}

SQLiteWriteTarget owns a mutable connection opened through the canonical index.db pathname while retaining a no-follow handle to the exact file that passed identity validation. Keeping SQLite on the canonical pathname gives every writer one lock/WAL namespace; the retained handle detects pathname substitution before mutation and across the target lifetime. The caller-held authority remains caller-owned.

func OpenSQLiteWriteTarget

func OpenSQLiteWriteTarget(ctx context.Context, opts SQLiteWriteTargetOptions) (*SQLiteWriteTarget, error)

OpenSQLiteWriteTarget validates an existing canonical database or atomically reserves an absent target, binds that exact file, and opens the bound file for mutation. Callers must use DB rather than reopening Options.Path themselves.

func (*SQLiteWriteTarget) Check

func (t *SQLiteWriteTarget) Check() error

Check revalidates the caller's authority and confirms that the retained no-follow binding and canonical pathname still name the selected file.

func (*SQLiteWriteTarget) Close

func (t *SQLiteWriteTarget) Close() error

Close closes the mutable connection and verifies that live SQLite transaction sidecars (WAL/SHM/journal) were checkpointed away. It never deletes transaction or quarantine files. Exact-epoch cleanup may leave discoverable quarantine residue after truncating the reserved inode; when live sidecars are clean that residue is recorded via QuarantineResidue and inventory without failing Close. Unrecovered quarantine residue blocks later canonical readers and mutable writers until a receipt-backed recovery transaction removes exact-bound captures. Whole-set authority alone never authorizes prefix-wide quarantine deletion. Live-sidecar checks run only when db close, authority, and main-file binding all succeed; failures skip those checks and never delete residue.

func (*SQLiteWriteTarget) DB

func (t *SQLiteWriteTarget) DB() *sql.DB

DB returns the bound mutable connection owned by the target.

func (*SQLiteWriteTarget) PublishIdentity

func (t *SQLiteWriteTarget) PublishIdentity(identity *indexstore.IndexSetIdentityResult) error

PublishIdentity publishes canonical identity metadata through the same retained database binding and authority that own this mutable connection.

func (*SQLiteWriteTarget) PublishManifest

func (t *SQLiteWriteTarget) PublishManifest(doc *manifest.IndexManifest) error

PublishManifest publishes canonical manifest metadata without following an existing destination symlink.

func (*SQLiteWriteTarget) QuarantineResidue

func (t *SQLiteWriteTarget) QuarantineResidue() []string

QuarantineResidue returns discoverable quarantine-prefix names observed at the last live-clean Close, without implying any entry was deleted.

type SQLiteWriteTargetOptions

type SQLiteWriteTargetOptions struct {
	Path           string
	IdentityPath   string
	SegmentSetRoot string
	IndexSetID     string
	Authority      *indexcoord.Lease
	MaxMarkerBytes int64
}

SQLiteWriteTargetOptions identifies a canonical SQLite target before a writer creates a marker, opens the database, or performs migration.

type SnapshotSourceKind

type SnapshotSourceKind string

SnapshotSourceKind identifies the authority shape behind verified snapshot metadata. Acquired hub bundles join this closed set in a later slice.

type VerifiedAcquiredBundleReport

type VerifiedAcquiredBundleReport struct {
	MarkerType             string
	MarkerSchema           string
	HubMarkerSchemaVersion string
	ManifestCreatedAt      time.Time
	IdentityPayload        indexstore.IndexSetIdentityPayload
	ManifestRaw            []byte
}

VerifiedAcquiredBundleReport carries acquired-marker presentation facts from a verified open. Value-only: diagnostics may project it without re-reading bundle files outside the bound root. Reference fields hold fresh copies per call, so projecting them can never mutate reader state.

type VerifiedAcquiredBundleReporter

type VerifiedAcquiredBundleReporter interface {
	VerifiedAcquiredBundleReport() (VerifiedAcquiredBundleReport, error)
}

VerifiedAcquiredBundleReporter is the narrow optional capability implemented by readers opened from a verified acquired bundle.

type VerifiedSnapshotMetadata

type VerifiedSnapshotMetadata struct {
	SourceKind                  SnapshotSourceKind
	IndexSetID                  string
	RunID                       string
	RunStart                    BridgeRunStart
	SnapshotTime                BridgeSnapshotTime
	RunStartedAt                time.Time
	SnapshotCompletedAt         time.Time
	SnapshotCompletionSemantics string
	HubCommittedAt              time.Time
	HubCompleteSHA256           string
	SourceIdentitySHA256        string
	SourceIdentitySchema        string
	SourceIdentityProfile       string
	ManifestSHA256              string
	CoverageSHA256              string
	Coverage                    CoverageSummary
	Declared                    DeclaredSnapshotCounts
}

VerifiedSnapshotMetadata is immutable, receipt-safe metadata copied from the already-open verified snapshot. No path, base URI, provider coordinate, credential handle, or coverage literal is exposed.

type VerifiedSnapshotMetadataReader

type VerifiedSnapshotMetadataReader interface {
	VerifiedSnapshotMetadata() (VerifiedSnapshotMetadata, error)
}

VerifiedSnapshotMetadataReader is the narrow optional capability implemented by readers that can provide receipt-safe facts from their verified open. Keeping it separate avoids widening Reader for substrates and downstream implementations that do not support receipt authority.

type VisitObject

type VisitObject func(result indexstore.QueryResult) error

VisitObject is invoked for each matching row in rel_key order. Returning a non-nil error stops the walk and is returned to the caller.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL