You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Commit e97bf30
Browse filesBrowse the repository at this point in the historyBrowse files
Copy file name to clipboardExpand all lines: README.md
+2Lines changed: 2 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -47,6 +47,8 @@ The server uses ZoneTree.FullTextSearch for bounded derived text candidates whil
47
47
48
48
A bounded lossless time-series chunk codec has [development evidence](docs/implementation/sample-chunk-codec-development-2026-10-03.json) from full Aspire unit/scalar suites and matched native-codec controls. Canonical chunk storage, rewrite/recovery and RF3 qualification remain in progress under KL-078.
49
49
50
+
Canonical key validation and persisted document permissions have [development evidence](docs/implementation/keycodec-crud-development-2026-10-04.json): 2,889 tests pass in each Aspire normal/scalar suite and 228 recovery tests pass, with 1,000 unique atomic process-crash trials. This includes invariant decimal keys, malformed-input bounds, owned storage bytes, CRUD revisions, index rollback and isolated field/row authorization controls. Complete delivered-source Linux and Docker/Aspire RF3 qualification remain pending.
51
+
50
52
## Get started
51
53
52
54
Install the .NET SDK selected in [global.json](global.json) and Docker, then build from the repository root:
| Nonfinite double or invalid UTF-16 string | Validation with a constant safe message |
58
+
| Empty/unknown key version | Existing FormatUnsupported |
59
+
| Invalid/truncated tag, scalar, escape, UTF-8, timestamp or decimal | Corruption with a constant safe message |
60
+
| Decode257+ components | Corruption before decoding component257 |
61
+
| Noncanonical negative-zero double or nonzero-form decimal zero | Corruption; these bytes are never emitted by the valid v1 writer |
62
+
| Noncanonical decimal leading/trailing zero, exponent, precision or scale | Corruption; reject rounding/underflow rather than aliasing another canonical key |
63
+
64
+
Decimal decoding must accept every value emitted by the existing writer,
65
+
including its extrema and all scales0..28. Bound canonical nonzero exponents
66
+
and significant digits before parsing; use the BCL decimal parser with exact
67
+
representability checks. Both parse-text construction and parsing must use
68
+
InvariantCulture: a changed CurrentCulture or custom non-ASCII negative sign
69
+
cannot change a durable key's meaning. Pin literal positive/negative fractional
70
+
decimal v1 vectors and decode them under such a culture, restoring the caller's
71
+
culture in finally. TASK-KEYCODEC-CULTURE assigns only this invariant construction
72
+
and new KeyCodecCultureContractTests to query_wave Luna/high before the final
73
+
normal/scalar/recovery source freeze. Do not add a duplicate decimal serializer or re-encode
74
+
every decoded key. Keep successful hot paths free of new full-envelope copies.
75
+
Invalid UTF text and timestamps use narrow validation; never retain offending
76
+
data in an error or relax existing malformed guards.
77
+
78
+
The immutable payload-envelope requirement means storage captures independently
79
+
owned key/value bytes at staging and preserves their committed content across
80
+
caller/pool reuse and returned-result mutation. Its existing carriers are
81
+
StorageMutation and KeyValueRecord with permanent aliases/Ids. The read result
82
+
is an independently owned copy; this does not promise a deeply immutable CLR
83
+
backing array. Test the actual authoritative storage isolation, native envelope
84
+
roundtrip and reopen, rather than changing those carriers or adding a new API.
85
+
86
+
Ordered implementation: root freezes this contract, feature mapping and task
87
+
graph; query_wave Luna/high owns only KeyCodec.cs, KeyCodecDecimal.cs,
88
+
KeyCodecReadPrimitives.cs and cohesive new Features/StorageRecovery/KeyCodec*
89
+
validation helpers if needed; lifecycle_wave Luna/high owns new KeyCodec*
90
+
UnitTests/Features/StorageRecovery corpus, malformed, golden and real-store
91
+
ownership tests; root reviews every diff and joins full build/formatter,
92
+
Aspire normal/scalar/recovery and exact-source Linux/RF3 originals.
93
+
Existing10,000 decimal cases and all golden vectors remain intact; add an
94
+
independent10,000 generated mixed-type/composite corpus and literal corruption
95
+
vectors. No skips, mock provider, suppressed diagnostic or altered tolerance.
96
+
97
+
Rollout is a homogeneous current-format build after qualification. No canonical
98
+
writer output changes, rewrite or dual-version reader is allowed. Rollback
99
+
restores prior validation while preserving valid durable keys; its malformed
Copy file name to clipboardExpand all lines: docs/Features/DocumentStorage.md
+35-4Lines changed: 35 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -34,9 +34,9 @@ The current root-level files are documented migration debt under ADR-032, not th
34
34
35
35
| Requirement | Measurable acceptance | Existing TUnit evidence or planned test |
36
36
|---|---|---|
37
-
| REQ-DSTORE-001: validate scoped CRUD, revisions, and document authority | AC-DSTORE-001 passes when create/read/replace/patch/delete produce monotone revisions, exact-CAS concurrency has one winner, and invalid/stale writes or direct mutation of event-authoritative resources are rejected without partial state. | Existing `ConcurrentCompareAndSwapHasOneWinner`; planned `DocumentCrudRevisionAuthorityAndValidationCases` for create/missing/delete/invalid JSON/authority matrix. CI qualification pending. |
38
-
| REQ-DSTORE-002: maintain declared scalar indexes atomically | AC-DSTORE-002 passes when replacing/deleting a document removes its old keys, writes new keys, and a duplicate partition-unique value rejects the full mutation batch. | Existing `UniqueConflictRollsBackDocumentIndexEventAndEnqueue`, `AcMp003PointAndIndexDereferenceConsumeTheSameRawReadBudget`; planned persisted old/new index transition matrix. CI qualification pending. |
39
-
| REQ-DSTORE-003: enforce row/field policy at every document boundary | AC-DSTORE-003 passes when unauthorized row writes/reads and protected field use fail or project according to policy; tenant or row ownership cannot be supplied to gain access. | Existing `NestedSensitiveFieldsAreOmittedAndAliasedPredicateAndSortAreDenied`, `RowScopeAndTenantCannotBeForged`; planned focused document CRUD authorization matrix if existing cases do not cover every mutation. CI qualification pending. |
37
+
| REQ-DSTORE-001: validate scoped CRUD, revisions, and document authority | AC-DSTORE-001 passes when create/read/replace/patch/delete produce monotone revisions, exact-CAS concurrency has one winner, and invalid/stale writes or direct mutation of event-authoritative resources are rejected without partial state. | Existing `ConcurrentCompareAndSwapHasOneWinner`; actual `DocumentCrudRevisionTests` and `DocumentPutValidationAtomicityTests` cover create/missing/delete/invalid JSON/authority. Local full-suite evidence below; exact-source CI qualification pending. |
38
+
| REQ-DSTORE-002: maintain declared scalar indexes atomically | AC-DSTORE-002 passes when replacing/deleting a document removes its old keys, writes new keys, and a duplicate partition-unique value rejects the full mutation batch. | Existing `UniqueConflictRollsBackDocumentIndexEventAndEnqueue`, `AcMp003PointAndIndexDereferenceConsumeTheSameRawReadBudget`; actual `DocumentScalarIndexMutationTests` covers persisted old/new index transitions and rollback. Local full-suite evidence below; exact-source CI qualification pending. |
39
+
| REQ-DSTORE-003: enforce row/field policy at every document boundary | AC-DSTORE-003 passes when unauthorized row writes/reads and protected field use fail or project according to policy; tenant or row ownership cannot be supplied to gain access. | Existing `NestedSensitiveFieldsAreOmittedAndAliasedPredicateAndSortAreDenied`, `RowScopeAndTenantCannotBeForged`; actual field/row/tenant matrix plus isolated replacement-write and Delete-index-use controls. Local full-suite evidence below; exact-source CI qualification pending. |
40
40
| REQ-DSTORE-004: share an atomic transaction domain with eligible events and queues | AC-DSTORE-004 passes when document + event + local enqueue commit together or all remain absent, same command retry returns the stored outcome, and identical partition-key text in unrelated domains stays isolated. | Existing `DocumentEventAndQueueCommitTogetherAndCommandRetryDoesNotRepeatEffects`, `UniqueConflictRollsBackDocumentIndexEventAndEnqueue`, `SameLiteralPartitionKeyCannotCrossTransactionDomains`. CI qualification pending. |
41
41
| REQ-DSTORE-005: reuse transaction-scoped document images | AC-DSTORE-005 passes when one before-record lookup supplies CRUD and outbox; no final staged lookup/decode is required; exact bytes, revisions, tombstones, indexes, authorization, quotas and sequential same-ID mutations remain intact. | TASK-MP-007I in ADR-035; new real-store paired-size/counter and before/after/failure cases plus existing transaction/change-feed/recovery/RF3 regressions; GitHub evidence pending. |
42
42
@@ -46,6 +46,37 @@ AtomicMutationApplication caller integration to the lead. Internal context/resul
46
46
carriers stay under Features/DocumentStorage and within one atomic transaction.
47
47
UI/SDK/MCP schema migration is N/A: public contracts and persisted bytes stay exact.
48
48
49
+
The2026-10-04 regression-completion stage maps AC-DSTORE-001 to
50
+
DocumentCrudRevisionTests and DocumentPutValidationAtomicityTests, AC-DSTORE-002
51
+
to DocumentScalarIndexMutationTests, and AC-DSTORE-003 to
52
+
DocumentFieldMutationAuthorizationTests and DocumentRowTenantMutationAuthorizationTests.
53
+
These use actual TestDatabase/ZoneTree and the existing contracts: no new product
54
+
semantics or mutation DTO. Root owns this mapping and join; cluster_wave Luna/high
55
+
owns only these new UnitTests/Features/DocumentStorage files and their cohesive
56
+
fixture. Include duplicate JSON members, document-byte/depth bounds after an
unique-index isolation, persisted field grants and healthy owner follow-up.
59
+
60
+
Field-write grants gate create/replacement/patch of protected fields. Whole-row
61
+
Delete follows the existing DocumentsWrite capability and row-write policy,
62
+
plus any index-field-use grant required for strict maintenance. It does not
63
+
introduce a field-write requirement for whole-row deletion. This distinguishes
64
+
the current lifecycle and field-mutation contracts in REQ-AUTH-006; neither
65
+
client-supplied row ownership nor an administrator label establishes authority.
66
+
67
+
TASK-DSTORE-FIELD-MUTATION-ORACLES closes the remaining AC-DSTORE-003 boundaries
68
+
with separate DocumentReplacementFieldAuthorizationTests and
69
+
DocumentDeleteIndexAuthorizationTests. Replacement denial uses a principal that
70
+
already has DocumentsWrite, field-read and indexed field-use grants, isolating the missing
71
+
field-write grant; exact original revision/JSON/index entries remain unchanged,
72
+
and a principal with both grants replaces successfully. Delete denial isolates
73
+
the missing indexed field-use grant and preserves the live record/index; its
74
+
allowed control has field-use but no field-write grant and produces the exact
75
+
next tombstone revision while removing the index entry. These are existing
76
+
persisted-policy semantics, not a public contract or schema change. cluster_wave
77
+
Luna/high owns only the two new files; root reviews and integrates actual Aspire
78
+
normal/scalar/recovery and exact delivered-source Linux/RF3 qualification.
79
+
49
80
## Flows and failure behavior
50
81
51
82
Positive: authorized valid JSON mutation passes catalog and CAS checks, updates document and affected indexes in one atomic command, and returns its committed revision/receipt. Negative: malformed JSON, stale CAS, denied row/field access, event-authoritative direct write, or unique collision rejects the operation. Edge: replacing indexed values removes old entries; delete creates a tombstone; patch of missing/deleted document fails; duplicate command identity is resolved by persisted outcome. Error responses must not disclose protected payload values. Query pages and index scans remain subject to the shared read budgets.
@@ -63,4 +94,4 @@ flowchart LR
63
94
Commit --> Read[Authorized projected read or bounded query]
64
95
```
65
96
66
-
Named tests are source mappings, not passing results. Product build, TUnit, process-recovery and Aspire RF3 qualification run only in GitHub Actions under the repository policy. Required official MCP parity through Aspire RF3 is pending; no MCP implementation or result is claimed. No document-specific UI, cross-partition unique constraint, or production-readiness claim is introduced by this specification.
97
+
The [2026-10-04 development receipt](../implementation/keycodec-crud-development-2026-10-04.json) records8 new real-ZoneTree CRUD cases in full Aspire normal/scalar suites at2889/2889 each and recovery228/228, with unchanged source/runtime and1000 unique atomic process cuts. Local development verification is authorized through unified Aspire; delivered-source qualification still requires complete Linux GitHub original build/TUnit/recovery/Docker RF3 artifacts. Required official MCP parity through Aspire RF3 remains pending. Document-specific UI is N/A; cross-partition unique constraints and productionreadiness remain unqualified.
0 commit comments