feat(assets): cold-device asset metadata reconstruction (Asset-B5)#97
Merged
Conversation
Restore integration: after the 10.14 Y.Doc backfill, reconstruct the local assets + asset_deks + asset_refs rows from each restored entity's synced chunk manifests, so serve-on-miss can lazily materialise bytes on access (the true cold-first-fetch case B4 deferred — no assets row meant the FK forbade the ref and the serve path couldn't find an owner). - manifest carries a validated advisory `kind` (absent/unknown → upload; pre-B5 manifests parse unchanged) - AssetStore.registerSynced: rows from manifest + entity-wrap-recovered DEK (sealed under THIS vault's master key), content_hash sentinel, marked bound - restoreBlob backfills the sentinel hash on first materialise (length- checked; SQL guard makes the backfill write-once) — integrity anchor for a synced asset is the chunk AEAD under the recovered DEK - ydoc worker: listAssetManifests (all pairs on an entity doc) - reconstructAssetMetadata orchestration (per-pair fail-safe tally), wired into runRestore before the search reindex, contained Tests: +25 (parser kind, registerSynced/backfill, reconstruction unit, worker list op, cold-restore end-to-end with real crypto). 993 green across assets/entities/sync/workers/storage; tsc clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
th3-br41n
force-pushed
the
feat/asset-b5-restore
branch
from
64b0704 to
d87ccaf
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Asset-B5 — restore integration. Stacked on #93.
After a cold restore (10.14) the Y.Docs come back but every asset was invisible: no
assetsrow → the FK forbids theasset_refsrow → serve-on-miss can't find an owning entity → permanent 404. This closes that gap per data/70's lazy-fetch design — metadata reconstructs eagerly, bytes stay lazy.How
kind(advisory, validated; absent/unknown →upload; pre-B5 manifests parse unchanged) so the reconstructed row + ref role are faithful.AssetStore.registerSynced— mintsassets+asset_deksrows from the manifest + the B1 entity-wrap-recovered DEK, re-sealed under this vault's master key.content_hashstarts as the empty sentinel: it's a local-only plaintext hash a cold device cannot know; transport integrity is the chunk AEAD under the recovered DEK.restoreBlobbackfill — first materialise length-checks against the row and backfills the hash (write-once via SQL guard); every later restore verifies as before.listAssetManifestsydoc-worker op +reconstructAssetMetadataorchestration (per-pair fail-safe, tallied) wired intorunRestoreafter backfill, before reindex. Contained — can never fail a restore.Security notes
kinddegrades, never rejects; id-mismatched manifests are skipped.Tests
+25: parser kind cases · registerSynced/idempotence · sentinel backfill + write-once + length refusal · reconstruction unit tally paths · worker list op · end-to-end cold restore with real crypto (owner upload → cold reconstruct → lazy materialise → hash backfill → local round-trip). 993 green across the touched suites; tsc clean.
🤖 Generated with Claude Code