test(dogfood): 字段文件回收的真实启动端到端证明 — ADR-0104 PR-5b 全周期 + 两条否决路径 (#3459) - #4285
Merged
Conversation
…3459, #3438) The released-file collection path is the only code on the platform that deletes a user's bytes, and its only proof was unit tests over fakes. Its sibling lineage — attachments — has had an end-to-end proof since #2755; field files, which reach collection by a different route (exclusive ownership, released by the write path, gated per deployment), had none. Five properties, on a real kernel with a real storage adapter, real bytes on disk and a real lifecycle.sweep(): PRECONDITION a store created by this boot has already attested its file migration — so the gate is open and the rest cannot pass vacuously. Doubles as a live check of #3438's creation-time attestation. CYCLE release tombstones; a fresh tombstone survives a sweep; past the declared window the row AND the bytes are reclaimed. REVIVAL re-referencing inside the window brings the file back. VETO (owner) a tombstone that regained an owner behind the hooks' back is un-tombstoned, never reaped — the half of PR-5b that had to ship with the tombstone itself. VETO (gate) a regressed migration flag stops collection immediately, tombstones included, without a restart; re-verifying makes the same row collectable again. This is what the guard's fresh sweep-time flag read buys, and nothing else covered it. The fixture boots PlatformObjectsPlugin explicitly: sys_migration became platform infrastructure rather than a storage concern in #4243, and the gate cannot be read without it. Adds the matching workspace dependency. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KM46HedAWLbkuZyMBXn5wJ
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
github-actions
Bot
added
documentation
Contributor
📓 Docs Drift CheckThis PR changes 1 package(s): 2 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
os-zhuang
marked this pull request as ready for review
July 31, 2026 03:18
os-zhuang
added a commit
that referenced
this pull request
Jul 31, 2026
#4298) `packages/qa/dogfood/test/field-file-collection.dogfood.test.ts` declares `@proof: adr0104-field-file-collection`, but the ADR-0054 registry never learned about it — so the liveness gate has been warning on every run since #4285 landed the test: ⚠ 1 unregistered dogfood proof tag(s) — add to proof-registry.mts That warning is the registry's reverse-integrity leg doing exactly its job: an orphan tag means a proof was written but never wired into the high-risk class list, so nothing connects the test to the surface it guards. Registered as **honestly unbound**, not bound. The collection contract the proof exercises is the `lifecycle` ttl declared on the SYSTEM object `sys_file` (service-storage), not an authorable per-type property — and `object.lifecycle` is already bound to `data-lifecycle`, which carries one `proof` ref. The rest of the route (exclusive ownership, release-on-write, the per-deployment migration gate) is service code with no authorable surface to govern, so there is no other entry to bind instead. Faking a binding would misrepresent both what the proof covers and what that entry is proven by; `blockedReason` records the reason instead, the same shape as `flow-runas-userless` and `scope-depth-cli-fallback`. Enforcement is therefore unchanged: `BOUND_PROOF_PATHS` skips unbound classes, so the bound-class list and the pinned path map are byte-identical. The only behavioural change is that the gate now runs clean. Verification: `check:liveness` green with the warning gone; liveness script suite 98/98; spec suite 277 files / 7128 tests; `tsc --noEmit` clean. Gate-only change under `packages/spec/scripts/`, which is not in the package's published `files` — empty changeset. Co-authored-by: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
59 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GA 前对全平台唯一会删用户字节的代码做的最后一道确认。做成常驻 dogfood 证明而不是一次性手工演练——手工确认的信心会随每次重构衰减。
缺口
附件血统从 #2755 起就有端到端证明（
attachments-permission-matrix.dogfood.test.ts）。字段文件血统一条都没有——而它走的是完全不同的路线：独占所有权、由写路径释放、按部署门禁。此前它的全部保障只有 fake 之上的单元测试。五条断言，全部在真实 kernel 上（真实存储适配器、真实字节落盘、真实
lifecycle.sweep()）--apply）→ 已过期的墓碑仍被保留、字节保留、无需重启；恢复标记后同一行立刻被回收最后一条是 PR-5b 里那个设计决定的实证：guard 每次 sweep 都新读标记，而不是复用 release 路径的 memoized 读取——所以数据漂移的部署能立即自行关门。这条此前完全没有真实环境覆盖。
fixture 显式引入
PlatformObjectsPluginsys_migration在 #4243 从 storage 的关切变成了平台基础设施，不引它就读不到门禁。同时补上 dogfood 缺失的 workspace 依赖声明。过程中的一个诊断修正（值得记）
新测试单跑通过、混在整套里却全挂，我起初判断为"测试隔离问题"——这个判断是错的。真实原因是我的验证被过期的构建产物骗了：单跑那次用的还是我早先构建的 service-storage dist，那个版本仍然自己注册
sys_migration。重装依赖、按当前源码重建后，fixture 缺插件的问题才浮出来。教训是本地 dist 与当前 main 不同步时，绿色可能是假的。验证
pnpm test132/132 · nul-bytes ✅ · lint ✅🤖 Generated with Claude Code
https://claude.ai/code/session_01KM46HedAWLbkuZyMBXn5wJ
Generated by Claude Code