Repository navigation

Views step D: verified bind, view token and steady-state cost token (4v-4, 4v-5) - #1016

Open

aft-alfonso[bot] wants to merge 31 commits into

land/views-e-legacy-importsfrom

land/views-d-verified-bind

Open

Views step D: verified bind, view token and steady-state cost token (4v-4, 4v-5)#1016
aft-alfonso[bot] wants to merge 31 commits into
land/views-e-legacy-importsfrom
land/views-d-verified-bind

aft-alfonso Bot commented Oct 26, 2026

Stacked on #999 (views step E). Views stay default-off and unrouted; nothing changes for users.

v3-only checkout registration and driver: a fresh checkout builds a base through the base builder (admission and disk budget) and publishes a base-referencing view without writing old-format storage; fresh bootstrap is lexical-only, and other planes refuse with a typed reason before claiming (they get bootstrap in steps G and H).
Publication: the driver's PublishFence and transition mutex enclose final validation and the pointer CAS, so a retired driver cannot publish after validating.
Watcher: cookies, overflow recovery that clears only the epoch a strict re-check covered, and typed partial-coverage status on inotify (a root with an unreadable subfolder keeps watching the rest; incomplete coverage never grants verified-bind trust).
View token bound to root and git dir at first consumption; stat evidence files are reclaimed with their generation by the existing pinned sweep.
Verified bind on every base stays strict for now: proving a base's git tree needs a full-index tree builder and per-file proof receipts, sketched for a follow-up step. FSEvents (macOS) verified bind stays off.
Includes the 4v-1 (git index reader) and 4v-2 (watcher cookies) code commits from land: views-4v-1-git-index-reader #995 and land: views-4v-2-watcher-cookies #994 via cherry-pick.

ualtinok and others added 30 commits

October 26, 2026 19:32


          mason: add read-only Git index reader and golden fixtures

9de8875

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
(cherry picked from commit 2f67e55)


          mason: correct check-attr stdin argument syntax

c72523c

The large bidirectional-pump golden test exposed BrokenPipe because check-attr --stdin treats arguments after -- as forbidden pathnames, not attribute names. Keep the fixed conversion attribute names before any pathname separator. The initial module run passed the other 19 tests; the corrected query test passes on Linux. Windows tests compile with warnings denied.

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
(cherry picked from commit 32d1489)


          mason: audit watcher frontier coverage before cookie wiring

4b6ffcd

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
(cherry picked from commit 9f8edb6)


          mason: deliver ordered watcher cookies and views overflow state

468639c

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>
(cherry picked from commit ffd2761)


          mason: expose plane-independent verified bind snapshot hook

044d36a

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>


          mason: reject unstable view reads and validate after publication waits

215e04a

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>


          mason: arm inotify directories before initial enumeration

b1df8f9

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>


          mason: pair v3 stat evidence with generations and mint advisory view …

de24132

…tokens

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>


          mason: bootstrap fresh verified-bind drivers through v3-only registra…

a47b6b1

…tion

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>


          mason: align advisory token wire types and current registry floor

2bbc1b6

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>


          mason: use the public trigram attachment type in v3 materialization

39aff97

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>


          mason: keep stable-read stats distinct from persisted evidence rows

e59e131

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>


          mason: recover overflow only after a strict walk of its exact epoch

15049cf

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>


          mason: close provenance gaps and guard steady refresh by subscription…

8aa9c7c

… continuity

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>


          mason: cover view-token management dispatch without enabling views

314f530

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>


          mason: preserve deterministic registration-walk test interception

b13e579

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>


          mason: return only validated advisory-token fields from bridge minting

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>


          mason: keep legacy and v3 inventory test helpers in their own modules

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>


          mason: reclaim stat evidence through the protected generation sweep

870f8f0

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>


          mason: refuse initial coverage when the root disappears before regist…

bd9e418

…ration

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>


          mason: publish sweep fixtures through the prepared generation CAS

71b1e97

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>


          mason: open writable handles for portable timestamp fixtures

77a9b01

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>


          mason: preserve canonical watcher gaps and require live steady subscr…

61714c0

…iptions

Keep the sparse-v3 fixture's sparse/restart/no-v2 assertions unchanged, but establish a real reconciled and installed driver cut before publication. Merely naming its generation installed-worker no longer satisfies the final CAS identity check.

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>


          mason: skip source admission probes for already reconciled deltas

7fd7fd6

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>


          mason: keep unsupported roots out of watcher-trusted steady refresh

02b6788

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>


          mason: fence v3 final validation and CAS with driver ownership

02781f1

Keep artifact construction and admission outside the ownership fence. Preserve the old publication helper as an unfenced delegate, serialize the driver's installed-bundle transition with validate+CAS, and release a completed lexical-only bootstrap claim even when publication is refused.

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>


          mason: retain partial shared watchers with typed untrusted coverage

796f8b9

Preserve views-off startup when a descendant cannot be listed or watched. Initial coverage now names gaps on the retained native handle; v3 trust refuses incomplete or opaque handles. This intentionally replaces the temporary whole-watcher-refusal test with partial-service and strict-v3 controls, per the compatibility ruling. Configure's generic attachment API is unchanged.

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>


          mason: refuse unowned fresh planes and complete source metadata guards

9d6ee58

Fresh bootstrap is lexical-only until the G/H base completion coordinators exist; typed preflight refuses unsupported planes before reads or claims. Existing bases remain plane-independent. Reuse the source stamp already taken before the read instead of adding a duplicate stat, and preserve resolution-input metadata on cached callgraph attachments.

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>


          mason: keep newer-registry refusal tests above the supported format

bae4932

Registry format 3 is now supported. Probe the compiled maximum plus one so the existing newer-format refusal assertion remains a newer-format test rather than schema drift within a supported version.

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>


          mason: make the source-probe control exercise a nonregular path

b7a7089

Missing paths intentionally cost zero bytes, so the earlier missing-file fixture could not distinguish a skipped probe. Keep the same assertions but use a directory at the live file path: the probe must classify it as large after an intent, and must not run for an already reconciled delta.

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>


          search-quality descriptor for views-d-verified-bind

1b15e30

Co-authored-by: alfonso-aft <289616620+alfonso-aft@users.noreply.github.com>

This was referenced Oct 26, 2026

Views step F: route grep, glob and aft_search's text lane through views (7a-1, 7a-2) #1017

Open

Views cutover steps C to G, landed together #1039

Open

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet