Publish durable catalog generations - #64
Conversation
|
Important Review skippedToo many files! This PR contains 144 files, which is 44 over the limit of 100. To get a review, narrow the scope: Upgrade to a paid plan to raise the limit. This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry. ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (144)
You can disable this status message by setting the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Self-review activity summary
All findings were resolved with separate RED → GREEN → VERIFY → COMMIT cycles. Final local gates are green: debug/release workspace tests, all/minimal checks and Clippy, doctests, Rust 1.96 compatibility, documentation/source/workflow checks, root/fuzz dependency policy and audits, locked fuzz builds, and a 4,228,409-execution catalog-format smoke campaign with no failures. |
|
@codex review please |
CI repair update
RED: Ubuntu CI failed four catalog publication laws at the exact GREEN: 11/11 focused filesystem publication laws, full locked workspace tests, all-feature Clippy with @codex review please — latest head is |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7e33c16d94
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Review remediation activity summary
All four review threads are resolved. Each finding used its own RED → GREEN → VERIFY → COMMIT cycle. Exact pushed head: Local merge gates are green: debug and release workspace suites, doctests, all/minimal feature checks, all/minimal Clippy with @codex review please — review the current head |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
Closes #16.
Problem
Keep had immutable segments but no durable catalog generation that could atomically publish logical record locations without making physical location stable identity.
Invariant affected
For one logical identity, a reader observes one fully admitted catalog generation whose named immutable bytes verify exactly, or receives a typed refusal.
Approach
Alternatives rejected
Serializer-defined catalogs, location-bearing public handles, lock-file existence as writer authority, and silent stage cleanup or overwrite-on-conflict.
Failure modes
Stale expectations, retained stages, malformed or noncanonical state, dangling references, conflicting pool bytes, lock contention, I/O and sync failures, and resource-bound violations return typed refusals.
Tests
Workspace debug and release tests, doctests, all/minimal-feature Clippy and checks, Rust 1.96 compatibility, source/docs/workflow gates, root/fuzz dependency policy and audits, locked fuzz builds, and a catalog-format fuzz smoke run with 4,228,409 executions and no failures.
Benchmark impact
No performance claim. Admission is bounded and scans each referenced segment once; restart retains only caller-bounded segment bytes.
Format and API compatibility
Adds the v1 catalog and publication-head formats and public APIs. No existing public API is removed. Golden bytes freeze the new protocol.
Recovery implications
Forward publication and crash states are documented. Issue #17 owns initialization and explicit recovery; this slice refuses ambiguous retained stages.
Security implications
No unsafe code. Paths after root admission are capability-relative and no-follow; immutable coordinates are reverified; dependencies are pinned, policy-checked, and audited.