feat(restore): Phase-2 full restore capstone (slice 5) #25
+659
−0
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Disjoint-union reassembly of a size-routed target from its _vault manifest (docs/RFC_incremental_v2.md §2.9): - completeness gate BEFORE any transfer: every selected object tar must exist on Fortress (reclaim.hsi_exists) or ABORT — never a partial restore - empty-dest guard: restore only into a new/empty directory - per-object extract by recorded transport: htar -xvf -L memberlist (random-access indexed) / hsi get + tar xf for htar_large (invariant #6) - per-file MD5 verify against each object's own run-log source_files (arcname-keyed, invariant #2) - MANDATORY final reconciliation on a full restore: set(walk(dest)) == U objects' arcnames, else ABORT - --slot solo:<hex> / --slot shard:<k> / --member <relpath> selective restore (reconciliation is full-restore-only) LOCAL only (hsi/htar at /opt/hsi/bin, prepended like ship_object). Driven by either the target's archive config (badge -> manifest) or --manifest directly. Tests: tests/test_restore.py (17) — tape mocked via reclaim.hsi_exists + an injected extract fn (mirrors ship_one). Full suite 238 -> 255 green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
Author
Negishi end-to-end validation — PASSED (2026-07-09, real Fortress, HPSS 10.3.0.p3)Scratch worktree off
Cleanup done: 🤖 Generated with Claude Code |
Sign in
to join this conversation on GitHub.
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Phase-2 slice 5 — full restore (the capstone, RFC §2.9)
New
restore.py: reassembles a size-routed target from its{log_dir}/_vault/{badge}.manifest.jsonas a disjoint union of objects —extract every current object, verify, reconcile. No overlay ordering, no
deletion replay (that superset stays in deferred Phase-3 §3.4).
This is what makes aggregate
reclaim --deletetrustworthy: the object set isprovably round-trippable off tape. Operator-invoked — NOT wired into
reclaim --delete(a full restore pulls every tar, TB-scale).Gates (each aborts the whole restore — never partial)
fortress_tarmust exist (reclaim.hsi_exists) or ABORT"not fully restorable"; never "restored minus one".
live data.
htar -xvf <tar> -L <memberlist>(random-access indexed; reads only therequested members) /
hsi get+tar xfforhtar_large(invariant revert(skip-unchanged): drop in-engine incremental Phase 1a #6: never
htar_large -xvfthrough a pipe).source_files(arcname-keyed — invariant Canonical-root invariant: paths reclaim can never delete #2). Missing run-log or mismatch = ABORT.
set(walk(dest)) == ⋃ objects' arcnames, else ABORT.Selective restore
--slot solo:<hex>/--slot shard:<k>/--member <relpath>filter theobject set (single-file restore falls out as a flag). Gate 1 checks only the
selected tars; reconciliation runs only on a full restore.
CLI
LOCAL only (hsi/htar at
/opt/hsi/bin, prepended likeship_object). New fileoff main — not stacked on #24; no engine files touched.
Tests
tests/test_restore.py(17) — tape mocked (reclaim.hsi_exists+ injectedextract fn, mirroring
ship_one): full round-trip reconstructs the exactaggregate arcname set (names AND bytes); partial-GONE aborts before any
extraction with dest untouched;
--slot/--memberrestore exactly oneobject/file; GONE tar outside the selection doesn't block a selective restore;
MD5 mismatch aborts; missing run-log aborts; non-empty dest / dest-is-a-file
refused; stray file fails reconciliation.
Full suite: 238 → 255 green (
python3 -m unittest discover -s tests).Negishi end-to-end
Validated live against real Fortress (see PR comment below once run).
🤖 Generated with Claude Code