fix(rustfs): read the policy in the store's form; release v0.1.5-nddev.116 - #365
Merged
Conversation
…s prefix The first reconcile with an actions cache prefix applied the policy and then refused to converge: RustFS keeps a one-element condition value as the bare string, the reconcile compared the list it had sent, and every identity reported "did not converge" while the store held exactly the intended document. The document now carries the string form and the comparison reads both sides in it, normalising nothing outside a statement's Condition; the fake store keeps policies the way RustFS was observed to. The effective-boundary proof now covers the actions prefix as it covers the trust roots: the writer puts, reads and lists under it, is refused an unscoped listing and a listing of its trust root, cannot write beside the prefix and cannot delete. Measured live on almaty-libraries before this change: every one of those answers was already the intended one. Claude-Session: https://claude.ai/code/session_0128syXKxAGCfJGRDxUUNQXp
rldyourmnd
enabled auto-merge
September 2, 2026 02:24
The manifest validator required the literal go1.26.6 while go.mod has built with go1.26.7 since 2026-08-31, so every release since restated a toolchain it was not built with and the check could not notice. CI rebuilds the release with the go.mod toolchain and validates it with a binary from that toolchain, so the manifest must name runtime.Version(); the .115 line is corrected to the toolchain that reproduces its digest. Claude-Session: https://claude.ai/code/session_0128syXKxAGCfJGRDxUUNQXp
…verges Source c8f5f86, built twice with CGO_ENABLED=0 go build -trimpath -buildvcs=false -ldflags "-buildid= -s -w -X main.version=v0.1.5-nddev.116 -X main.commit=<source>"; both builds agree on c7c34953405f418d81fdec92c0423c6b22aac528795304b44eca69d91478fbdd. The rustfscache and providerrelease packages are compiled into the provider, so the release moves with them; the provider's own behaviour is unchanged from .115. Claude-Session: https://claude.ai/code/session_0128syXKxAGCfJGRDxUUNQXp
rldyourmnd
force-pushed
the
fix/rustfs-policy-in-the-store-form
branch
from
September 2, 2026 02:28
e7ec150 to
9afd7b3
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The first reconcile with an actions cache prefix applied the policy and then refused to converge on all 25 identity files: RustFS keeps a one-element condition value as the bare string, the reconcile compared the list it had sent. The store held exactly the intended document (verified live with the root identity and with a trusted writer: put/get/list inside the prefix allowed, unscoped listing, cross-prefix write and delete refused).
policyEquivalentreads both sides in the store's form, normalising nothing outside a statement's ConditionApplied live with a gha-fleet built from the fix commit: 25/25 identity files converge with
verify_effective_boundaries.https://claude.ai/code/session_0128syXKxAGCfJGRDxUUNQXp