v0.6 session 3: reserved-prefix guard (#155), instance lock (#156), storage connect + setup mode (#160) #165

Merged

Cordy merged 17 commits from feat-s3-guards into main

2026-08-09 06:55:14 +00:00

Cordy commented

2026-08-09 06:54:56 +00:00

Owner

Session 3 of the v0.6 stateless-instance milestone, built and tested green on the runner (vet + full test suite + build).

#155 — internal/storage/reserved: innermost driver decorator; /.cairn-state and /.cairn invisible and unreachable from every user surface (ErrNotFound, never "forbidden"), .cairn-state blocked as a segment anywhere; statestore keeps the raw driver below the guard. Tests cover hidden root listings, all eight ops on reserved paths, nested .cairn allowance, and raw-driver passthrough.

#156 — statestore.Lock: .cairn-state/.lock, 60s heartbeat, 5min stale threshold, hostname identity (crash-restart takes over its own lock immediately; a second deployment is refused with the holder named), released on graceful shutdown, acquired BEFORE migration. Advisory framing in code comments — no CAS on Garage, and it isn't pretended otherwise.

#160 — three-layer model: config.Bootstrap (machine-written /data/.cairn/bootstrap.json, 0600, env > config > bootstrap), setup mode behind the explicit storage.driver: "setup" sentinel (wizard-only server, one-time log token, everything else 503), storage-setup.html wizard (en/de/fr/it, S3 or already-mounted directory, real write/read/delete probe, restart through the one normal boot path), and the read-only storage card in admin Settings backed by extended /api/v1/admin/info.

Also: CHANGELOG backfill for the whole v0.5.x line (v0.5.0–v0.5.4 were tagged without entries) plus the v0.5.5 entry this merge will be tagged as.

Session 3 of the v0.6 stateless-instance milestone, built and tested green on the runner (vet + full test suite + build). **#155** — `internal/storage/reserved`: innermost driver decorator; `/.cairn-state` and `/.cairn` invisible and unreachable from every user surface (ErrNotFound, never "forbidden"), `.cairn-state` blocked as a segment anywhere; statestore keeps the raw driver below the guard. Tests cover hidden root listings, all eight ops on reserved paths, nested `.cairn` allowance, and raw-driver passthrough. **#156** — `statestore.Lock`: `.cairn-state/.lock`, 60s heartbeat, 5min stale threshold, hostname identity (crash-restart takes over its own lock immediately; a second deployment is refused with the holder named), released on graceful shutdown, acquired BEFORE migration. Advisory framing in code comments — no CAS on Garage, and it isn't pretended otherwise. **#160** — three-layer model: `config.Bootstrap` (machine-written `/data/.cairn/bootstrap.json`, 0600, env > config > bootstrap), setup mode behind the explicit `storage.driver: "setup"` sentinel (wizard-only server, one-time log token, everything else 503), `storage-setup.html` wizard (en/de/fr/it, S3 or already-mounted directory, real write/read/delete probe, restart through the one normal boot path), and the read-only storage card in admin Settings backed by extended `/api/v1/admin/info`. Also: CHANGELOG backfill for the whole v0.5.x line (v0.5.0–v0.5.4 were tagged without entries) plus the v0.5.5 entry this merge will be tagged as.

Cordy added 17 commits

2026-08-09 06:54:57 +00:00