eric/narratio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 27 Wiki Activity

Cover bounded reads and cancelled replacements

Browse Source
This commit is contained in:
Eric Rakestraw
2026-09-02 01:19:21 +00:00
parent 9f84446509
commit d67a0389e0
4 changed files with 104 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
docs/internal/fileops.md
View File

@@ -9,10 +9,11 @@ and destination-directory policy.
Ordinary workspace replacement uses standard operating-system path semantics.
Callers with a root-scoped safety contract own that validation at their boundary.
Remote object acquisition uses a writer supplied by the storage owner. The
writer receives a `fileops`-owned, already-open sibling temporary file rather
than a mutable destination path. Callers still own remote object selection,
validation, conflict handling, and final mode.
Remote object acquisition is owned by its domain caller. The caller writes a
sibling temporary file, validates the complete result, and passes that file to
`InstallSiblingTempFile` only when it is ready to become canonical. Callers own
remote object selection, validation, conflict handling, and temporary-file
cleanup.
Directory bundles are not promoted by `internal/fileops`; extraction owns its
validated Notarius bundle rename.
@@ -48,6 +49,7 @@ Replacement follows the operating system's same-filesystem rename semantics.
If a platform cannot replace an existing destination, the operation returns an
error and never removes the old file as an emulation step.
`WriteFileAtomic`, copy helpers, and downloaded temporary-file installation
retain their compatibility behavior of creating the destination parent with
the repository's workspace permissions before using this contract.
`WriteFileAtomic` and the copy helpers create the destination parent with the
repository's workspace permissions. `InstallSiblingTempFile` requires the
caller to provide an existing temporary file in the existing destination
directory.