projection

type DefinitionResolver ¶ added in v0.0.21

type DefinitionResolver interface {
	EvidencePageReader
	LookupCommitted(provenance.OperationID) (provenance.CommittedResult, error)
}

DefinitionResolver is the owner read capability replay validation needs. Evidence alone cannot authenticate an operation's actual committed result slots, so v2 envelope validation requires the committed-result lookup alongside the evidence query. It is satisfied by the ordinary journal and by provenance.TransactionEvidenceReader on the caller's transaction.

type EvidencePageReader ¶ added in v0.0.21

type EvidencePageReader interface {
	QueryEvidence(query provenance.EvidenceQuery) (provenance.EvidencePage, error)
}

EvidencePageReader is the narrow evidence surface the non-reclaiming replay needs. It is satisfied BOTH by the ordinary pooled journal (provenance.FactQueryAPI) and by provenance.TransactionEvidenceReader, which reads only the caller's active SQL transaction. The migration binds the transaction reader so every converted evidence row, actor join and digest it replays comes from the SAME uncommitted view, never a second connection.

type LinkReader ¶

type LinkReader struct {
	Facts provenance.FactQueryAPI
}

LinkReader reads committed occurrence lineage links from journal truth. Like the occurrence Reader it is a disposable projection over the journal: it holds no state, reads under one pinned snapshot, and validates every row's digest before decoding (the F18 reader discipline). It is strictly read-side and never writes — materialization is the lineage command's gated write.

func (r LinkReader) Links() ([]model.LinkRecord, error)

type Reader ¶

type Reader struct {
	DB    *sql.DB
	Facts provenance.FactQueryAPI
	// Defs is the owner read capability v3 envelope validation needs:
	// evidence queries plus the committed-result lookup on one snapshot. It
	// is wired by tasks.NewLifecycleReader. A v3 record read with nil Defs
	// fails closed rather than returning an unvalidated envelope.
	Defs receipt.DefinitionReader
}

func (r Reader) Occurrences(ctx context.Context, q model.OccurrenceQuery) (model.OccurrencePage, error)

func (r Reader) Payload(ctx context.Context, ref digest.Digest) ([]byte, error)

func (r Reader) Records(ctx context.Context, query model.OccurrenceQuery) (model.LifecyclePage, error)

type RebuildOptions ¶ added in v0.0.9

type RebuildOptions struct {
	Clock   receipt.Clock
	Window  time.Duration
	Reclaim ReclaimPolicy
}

RebuildOptions carries what the rebuild's reclaim needs beyond the store: the clock that supplies the snapshot instant, the longest window any writer may hold between its blob write and its journal append (the WorkflowResult tier of the injected profile), and the retention policy that widens the reclaim for the operator prune verb. All are required and all come from the store that owns the rebuild, never from a caller above it. There is no silent default for a bound: a zero window would reclaim in-flight blobs. The rebuild takes NO output stream; it RETURNS what the reclaim did, and the layer that owns a diagnostic stream prints the one failure line from that outcome.

type ReclaimOutcome ¶ added in v0.0.9

type ReclaimOutcome struct {
	Reclaimed      []digest.Digest
	ReclaimedBytes int64
	Failure        error
}

ReclaimOutcome is what the reclaim inside one rebuild did: the digests it deleted, how many bytes those rows held, and the failure it reported if it could not run. A failure never fails the rebuild; the rebuild returns it here and the caller that owns a diagnostic stream prints ReclaimFailureLine once.

func RebuildOccurrences(ctx context.Context, journal provenance.Journal, db *sql.DB, options RebuildOptions) (ReclaimOutcome, error)

func (o ReclaimOutcome) Count() int

type ReclaimPolicy ¶ added in v0.0.21

type ReclaimPolicy struct {
	MaxAge     time.Duration
	Cap        int
	KeepNewest bool
}

ReclaimPolicy bounds the orphan payload blobs one rebuild may delete. Its zero value is the READ-COMMAND policy: delete up to ReclaimCap orphans older than the writer window, and nothing else. The operator prune verb is the one caller that sets it, and each field is a deliberate widening of the read path's bound:

• MaxAge is the operator's RETENTION age. An orphan is eligible only when it is older than max(Window, MaxAge), so a value below the writer window cannot shorten the in-flight safety floor; zero leaves the floor as the only age bound, which is the read path's behavior.
• Cap bounds the rows this rebuild deletes. Zero uses ReclaimCap.
• KeepNewest refuses to delete the row at the greatest written_at. The read path does not need it: a read command is bounded small, runs unattended, and its reclaim is a safety valve. The operator verb asks for a bulk delete, so it states the one exclusion an operator would assume.