🔬 Spike: host Cloudflare DOFS directly in Deno with SQLite (#349)

[taras]

Why

#349 asks for the alternative evidence path to #347/PR #348: can Executable.md host a persistent SQLite Workspace directly in Deno by reusing Cloudflare Computer's DOFS filesystem, expose it to native subprocesses without workerd, and how does that compare? #346 needs both evidence sets to decide the local Workspace topology.

What changes

Before: only the bundled-workerd topology had evidence.

After: deno task spike:349 builds and tests a Deno-local DOFS spike — Cloudflare's unmodified Database/initializeSchema/WorkspaceFilesystem over a ~100-line file-backed node:sqlite adapter, a compiled 110 MB proof, a vendored+tested userspace-shim bridge for native subprocesses, and probe-backed verdicts for real FUSE, packaging, durability, and all four reuse boundaries. evidence/COMPARISON.md sets #349 against #347 on the issue's ten axes and recommends limit for #346.

How it works

deno task spike:349
  → vendor: npm install + tsc for vendor/dofs (pinned v0.1.1/63d3636, MIT+provenance)
            and vendor/computerd-shim (byte-identical shim.ts subset)
  → build:  deno compile dist/proof (DOFS CLI) + dist/proof-shim (shim mount + subprocess exec)
  → test:   6 scenarios, each op a separate process against the same db file

Key findings (full detail in evidence/EVIDENCE.md)

• Slice 1 proven: file-backed node:sqlite satisfies DOFS's storage contract with zero schema changes; frontier (incl. create→delete→create, rename, symlinks) survives restarts; newer-schema databases are refused loudly; WAL checkpoints to a single file on close. 110 MB artifact, 0.08 s full op cycle vs Spike: bundle workerd into the compiled XMD host #347's 191 MB / 0.27 s.
• Slice 2 settled: published-package import and tree-shaking are structurally impossible (the DOFS layer is never exported); vendoring works fully and ships here; a 3-line upstream export diff is drafted as the exit path.
• Slice 6 (shim): development-only fallback — runs under Deno byte-identical; ~80-110 ms reconcile medians; VFS-wins conflicts, symlink/chmod losses, and a 250 ms crash-clobber window demonstrated. Committed and tested: a native subprocess reads an API-written file through the mount and its writes land in SQLite.
• Slices 3-5 (real FUSE): the stack mounts and passes every op — under a Node sidecar. Deno loads the N-API addon but fuse.mount() aborts in Deno's uv polyfill (minimal upstream-ready repro committed). Durability boundary pinned by experiment: commit happens at observed RELEASE only; fsync is a no-op and close() races an async release. The cwd-inside-mount spawn deadlock (unrecoverable by SIGKILL) is captured with its recovery runbook. deno compile can carry and load the addon (142 MB). Platform matrix tested, not inferred: linux-x64 via sidecar; darwin-arm64 dead end at this pin; Windows unsupported.
• Comparison/recommendation: limit — Deno-local DOFS for the filesystem-only Workspace; bundled workerd where Computer execution backends are required; subprocess access under Spike: host Cloudflare DOFS directly in Deno with SQLite and FUSE #349 explicitly limited until the Deno uv gap closes. Final selection is Define the local Workspace host topology #346's.

What must stay true

• The four verification gates keep their scope: spikes is root-excluded, the spike owns its deps (nodeModulesDir: "manual", npm file: deps, committed package-lock.json), no root dependency changed. Verified by running all four at root.
• Vendored Cloudflare source is tracked, pinned, MIT-noticed, and unmodified (vendor/*/PROVENANCE.md lists every manifest edit; src/ files are byte-identical, shim sha1-recorded).
• No production XMD contract changes.

How to verify it

• deno task spike:349 from the repo root (needs npm install --install-links in the spike dir once; README documents it).
• The restart-persistence test fails if the adapter, schema init, or WAL handling regresses; the schema-guard test fails if a future-schema db is silently recreated; the shim tests fail if the subprocess bridge or rematerialization breaks.
• FUSE claims are reproducible from evidence/fuse-linux/ (container recipe + minimal repro) — not wired into the test suite because they need Docker + /dev/fuse.

Scope

Included

• spikes/349-dofs/ (self-contained), root task aliases + spikes exclude, .gitignore entry.

Intentionally unchanged

• No <Workspace> API, no provider, no topology selection (Define the local Workspace host topology #346 decides); no upstream filing yet (the Deno uv repro and the dofs export diff are drafted in evidence for follow-up).
• The root deno.json exclude/task edits overlap textually with PR 🔬 Spike: bundle workerd into the compiled XMD host (#347) #348; whichever merges second rebases trivially.

New dependencies

• Spike-local only: vendored @cloudflare/dofs (source, pinned) and @xmd-spike/computerd-shim (shim subset) as file: deps; @platformatic/vfs@0.4.0; the effection stack at root-matching pins. Nothing enters the workspace graph.

Risks and limitations

• The Deno↔.js/.d.ts pairing gap for file: packages is bridged with a typed facade (host/types/) that mirrors the consumed surface; drift is possible and documented in-file.
• Timing-based shim behavior is asserted only through stable outcomes (flush/reconcile round-trips), not latencies.
• Real-FUSE evidence is container-based (linux-x64); darwin-x64 has a prebuild but no hardware test here.

[github-actions]

PR #350: 🔬 Spike: host Cloudflare DOFS directly in Deno with SQLite (#349)

136 files, +18703 / -2

Scope

🔴 PR has 18705 lines changed. Split into focused PRs.

🟡 18705 lines changed. PRs under 400 receive more thorough review.

🟡 136 files changed. Are all changes related?

🟡 PR mixes config and source changes.

🟡 New abstraction files: spikes/349-dofs/vendor/dofs/src/provider.ts. Verify 3+ consumers.

Structural

🟡 12 console statements.

Slop

✅ Slop indicators look low.

Static Analysis

✅ Oxlint found no issues.

Correctness

No extraneous code patterns detected.

[taras]

Correction: this evidence spike was mistakenly merged while collapsing the stack and is reverted from main by #364. Its findings remain valid and reviewable here; production implementation belongs to #218 and #363.