Documentation
¶
Overview ¶
Package upgrade runs the permanent final current-state upgrade: it verifies only the sealed facts of a bridge attestation and applies the cutover output plan through a recoverable journal. It ships no legacy inventory, approval parser, or cross-schema adapter; the sealed attestation is the sole trust anchor for the legacy adjudication the current-state binary can no longer recompute.
Index ¶
- Constants
- func FinalUpgrade(root string, lock *manifest.Lock, log io.Writer) error
- func JournalPath(root string) string
- func JournalPresent(root string) bool
- func LockRel() string
- func Recover(root string, log io.Writer) error
- func Verify(root string, att *manifest.BridgeAttestation) error
- type Image
- type Journal
- type Operation
Constants ¶
const JournalVersion = 1
JournalVersion is the only accepted current-state upgrade journal schema.
Variables ¶
This section is empty.
Functions ¶
func FinalUpgrade ¶
FinalUpgrade consumes a sealed bridge attestation. It verifies only the sealed facts, then journals the cutover output plan: the single deletion of the migration approval file and the lock replacement last, which drops the consumed attestation and promotes the sealed cutoff/gaps into permanent lock fields. The lock replacement is the transaction commit point; a pre-commit failure rolls back, a post-commit failure leaves a recoverable journal.
func JournalPath ¶
JournalPath returns the fixed journal path under root.
func JournalPresent ¶
JournalPresent reports whether a journal file exists under root.
func Recover ¶
Recover applies the journal recovery decision table. It is the only project mode permitted while a journal exists.
func Verify ¶
func Verify(root string, att *manifest.BridgeAttestation) error
Verify checks only the sealed facts of att: its version, that current HEAD equals the sealed PreparedHead, and that the recomputed tree digest equals the sealed TreeDigest. It reads the tree read-only. The sealed legacy adjudication is trusted through this unchanged seal alone, because the current-state binary ships no inventory, approval parser, or cross-schema adapter to recompute it.
Types ¶
type Image ¶
type Image struct {
Present bool `json:"present"`
Mode uint32 `json:"mode"`
Content []byte `json:"content"`
}
Image is one file's exact recorded state: present with an octal permission mode and content, or absent (present:false, mode 0, empty content).
type Journal ¶
type Journal struct {
Version int `json:"version"`
Phase string `json:"phase"`
FinalLockSHA256 string `json:"finalLockSHA256"`
Operations []Operation `json:"operations"`
}
Journal is the durable transaction record. Version is always 1; Operations are unique, sorted, and end with the lock operation; FinalLockSHA256 is the SHA-256 of the sealed lock content the transaction commits.
func LoadJournal ¶
LoadJournal reads and validates the journal under root. A malformed or contract-violating journal is a hard error naming the Git-restoration escape, so no caller mutates the tree on a journal it cannot trust.
func ParseJournal ¶
ParseJournal validates a journal captured from an immutable snapshot. It is the staged-check counterpart of LoadJournal, sharing the exact journal contract without materializing index bytes into the working tree.
Source Files