Complete session-only manifest migration

This commit is contained in:
2026-09-03 04:22:19 +00:00
parent c0fbc14f2d
commit 1da34ab5cd
15 changed files with 42 additions and 49 deletions

View File

@@ -7,7 +7,7 @@ Upload run/session outputs to object storage and atomically advance remote curre
## Inputs
- successful preceding stages from the [canonical stage set](overview.md#pipeline-stage-set)
- invocation-scoped run files
- declared run-local diagnostic files
- resolved publish output rules
- effective publish locks (static + remote merged lock set), revalidated at the
remote commit boundary
@@ -15,7 +15,8 @@ Upload run/session outputs to object storage and atomically advance remote curre
## Outputs
- uploaded invocation record and selected publish outputs;
- uploaded session manifest, declared run-local diagnostics, and selected
publish outputs;
- uploaded durable previous-session cache files when present;
- immutable run-scoped commit manifest; and
- current commit pointer, written last.
@@ -27,13 +28,15 @@ Exact remote placement and the operator workflow belong in
- when publishing or run upload is disabled, completes successfully with no
outputs and records explanatory metadata. This is not an explicit self-skip:
both manifests record success. Enablement and upload policy are fingerprinted,
so changing either automatically makes the prior result non-resumable.
the session manifest records success. Enablement and upload policy are
fingerprinted, so changing either automatically makes the prior result
non-resumable.
- validates prerequisite stage success and object-store availability.
- derives a deterministic run-archive allowlist from the session manifest's
declared current-run outputs, logs, and generated configurations. References
outside the current run root, including canonical session files and prior-run
diagnostics, are not archive candidates. No run manifest is read or uploaded.
diagnostics, are not archive candidates. No distinguished diagnostic file is
read or uploaded.
- opens each archive candidate beneath its archive root without following
symlinked ancestors or leaf entries, verifies that it is a regular file and
checks a declared checksum when present, then streams the opened descriptor.